source3/printing/nt_printing.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-2000,
   5  *  Copyright (C) Jean François Micouleau      1998-2000.
   6  *  Copyright (C) Gerald Carter                2002-2005.
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23 #include "printing/nt_printing_tdb.h"
  24 #include "../librpc/gen_ndr/ndr_spoolss.h"
  25 #include "rpc_server/spoolss/srv_spoolss_util.h"
  26 #include "nt_printing.h"
  27 #include "secrets.h"
  28 #include "../librpc/gen_ndr/netlogon.h"
  29 #include "../libcli/security/security.h"
  30 #include "passdb/machine_sid.h"
  31 #include "smbd/smbd.h"
  32 #include "smbd/globals.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  36 #include "rpc_client/cli_winreg_spoolss.h"
  37
  38 /* Map generic permissions to printer object specific permissions */
  39
  40 const struct generic_mapping printer_generic_mapping = {
  41         PRINTER_READ,
  42         PRINTER_WRITE,
  43         PRINTER_EXECUTE,
  44         PRINTER_ALL_ACCESS
  45 };
  46
  47 /* Map generic permissions to print server object specific permissions */
  48
  49 const struct generic_mapping printserver_generic_mapping = {
  50         SERVER_READ,
  51         SERVER_WRITE,
  52         SERVER_EXECUTE,
  53         SERVER_ALL_ACCESS
  54 };
  55
  56 /* Map generic permissions to job object specific permissions */
  57
  58 const struct generic_mapping job_generic_mapping = {
  59         JOB_READ,
  60         JOB_WRITE,
  61         JOB_EXECUTE,
  62         JOB_ALL_ACCESS
  63 };
  64
  65 static const struct print_architecture_table_node archi_table[]= {
  66
  67         {"Windows 4.0",          SPL_ARCH_WIN40,        0 },
  68         {"Windows NT x86",       SPL_ARCH_W32X86,       2 },
  69         {"Windows NT R4000",     SPL_ARCH_W32MIPS,      2 },
  70         {"Windows NT Alpha_AXP", SPL_ARCH_W32ALPHA,     2 },
  71         {"Windows NT PowerPC",   SPL_ARCH_W32PPC,       2 },
  72         {"Windows IA64",         SPL_ARCH_IA64,         3 },
  73         {"Windows x64",          SPL_ARCH_X64,          3 },
  74         {NULL,                   "",            -1 }
  75 };
  76
  77 /****************************************************************************
  78  Open the NT printing tdbs. Done once before fork().
  79 ****************************************************************************/
  80
  81 bool nt_printing_init(struct messaging_context *msg_ctx)
  82 {
  83         WERROR win_rc;
  84
  85         if (!nt_printing_tdb_upgrade()) {
  86                 return false;
  87         }
  88
  89         /*
  90          * register callback to handle updating printers as new
  91          * drivers are installed
  92          */
  93         messaging_register(msg_ctx, NULL, MSG_PRINTER_DRVUPGRADE,
  94                            do_drv_upgrade_printer);
  95
  96         /* of course, none of the message callbacks matter if you don't
  97            tell messages.c that you interested in receiving PRINT_GENERAL
  98            msgs.  This is done in serverid_register() */
  99
 100         if ( lp_security() == SEC_ADS ) {
 101                 win_rc = check_published_printers(msg_ctx);
 102                 if (!W_ERROR_IS_OK(win_rc))
 103                         DEBUG(0, ("nt_printing_init: error checking published printers: %s\n", win_errstr(win_rc)));
 104         }
 105
 106         return true;
 107 }
 108
 109 /*******************************************************************
 110  Function to allow filename parsing "the old way".
 111 ********************************************************************/
 112
 113 static NTSTATUS driver_unix_convert(connection_struct *conn,
 114                                     const char *old_name,
 115                                     struct smb_filename **smb_fname)
 116 {
 117         NTSTATUS status;
 118         TALLOC_CTX *ctx = talloc_tos();
 119         char *name = talloc_strdup(ctx, old_name);
 120
 121         if (!name) {
 122                 return NT_STATUS_NO_MEMORY;
 123         }
 124         unix_format(name);
 125         name = unix_clean_name(ctx, name);
 126         if (!name) {
 127                 return NT_STATUS_NO_MEMORY;
 128         }
 129         trim_string(name,"/","/");
 130
 131         status = unix_convert(ctx, conn, name, smb_fname, 0);
 132         if (!NT_STATUS_IS_OK(status)) {
 133                 return NT_STATUS_NO_MEMORY;
 134         }
 135
 136         return NT_STATUS_OK;
 137 }
 138
 139 /****************************************************************************
 140  Function to do the mapping between the long architecture name and
 141  the short one.
 142 ****************************************************************************/
 143
 144 const char *get_short_archi(const char *long_archi)
 145 {
 146         int i=-1;
 147
 148         DEBUG(107,("Getting architecture dependent directory\n"));
 149         do {
 150                 i++;
 151         } while ( (archi_table[i].long_archi!=NULL ) &&
 152                   strcasecmp_m(long_archi, archi_table[i].long_archi) );
 153
 154         if (archi_table[i].long_archi==NULL) {
 155                 DEBUGADD(10,("Unknown architecture [%s] !\n", long_archi));
 156                 return NULL;
 157         }
 158
 159         /* this might be client code - but shouldn't this be an fstrcpy etc? */
 160
 161         DEBUGADD(108,("index: [%d]\n", i));
 162         DEBUGADD(108,("long architecture: [%s]\n", archi_table[i].long_archi));
 163         DEBUGADD(108,("short architecture: [%s]\n", archi_table[i].short_archi));
 164
 165         return archi_table[i].short_archi;
 166 }
 167
 168 /****************************************************************************
 169  Version information in Microsoft files is held in a VS_VERSION_INFO structure.
 170  There are two case to be covered here: PE (Portable Executable) and NE (New
 171  Executable) files. Both files support the same INFO structure, but PE files
 172  store the signature in unicode, and NE files store it as !unicode.
 173  returns -1 on error, 1 on version info found, and 0 on no version info found.
 174 ****************************************************************************/
 175
 176 static int get_file_version(files_struct *fsp, char *fname,uint32 *major, uint32 *minor)
 177 {
 178         int     i;
 179         char    *buf = NULL;
 180         ssize_t byte_count;
 181
 182         if ((buf=(char *)SMB_MALLOC(DOS_HEADER_SIZE)) == NULL) {
 183                 DEBUG(0,("get_file_version: PE file [%s] DOS Header malloc failed bytes = %d\n",
 184                                 fname, DOS_HEADER_SIZE));
 185                 goto error_exit;
 186         }
 187
 188         if ((byte_count = vfs_read_data(fsp, buf, DOS_HEADER_SIZE)) < DOS_HEADER_SIZE) {
 189                 DEBUG(3,("get_file_version: File [%s] DOS header too short, bytes read = %lu\n",
 190                          fname, (unsigned long)byte_count));
 191                 goto no_version_info;
 192         }
 193
 194         /* Is this really a DOS header? */
 195         if (SVAL(buf,DOS_HEADER_MAGIC_OFFSET) != DOS_HEADER_MAGIC) {
 196                 DEBUG(6,("get_file_version: File [%s] bad DOS magic = 0x%x\n",
 197                                 fname, SVAL(buf,DOS_HEADER_MAGIC_OFFSET)));
 198                 goto no_version_info;
 199         }
 200
 201         /* Skip OEM header (if any) and the DOS stub to start of Windows header */
 202         if (SMB_VFS_LSEEK(fsp, SVAL(buf,DOS_HEADER_LFANEW_OFFSET), SEEK_SET) == (SMB_OFF_T)-1) {
 203                 DEBUG(3,("get_file_version: File [%s] too short, errno = %d\n",
 204                                 fname, errno));
 205                 /* Assume this isn't an error... the file just looks sort of like a PE/NE file */
 206                 goto no_version_info;
 207         }
 208
 209         /* Note: DOS_HEADER_SIZE and NE_HEADER_SIZE are incidentally same */
 210         if ((byte_count = vfs_read_data(fsp, buf, NE_HEADER_SIZE)) < NE_HEADER_SIZE) {
 211                 DEBUG(3,("get_file_version: File [%s] Windows header too short, bytes read = %lu\n",
 212                          fname, (unsigned long)byte_count));
 213                 /* Assume this isn't an error... the file just looks sort of like a PE/NE file */
 214                 goto no_version_info;
 215         }
 216
 217         /* The header may be a PE (Portable Executable) or an NE (New Executable) */
 218         if (IVAL(buf,PE_HEADER_SIGNATURE_OFFSET) == PE_HEADER_SIGNATURE) {
 219                 unsigned int num_sections;
 220                 unsigned int section_table_bytes;
 221
 222                 /* Just skip over optional header to get to section table */
 223                 if (SMB_VFS_LSEEK(fsp,
 224                                 SVAL(buf,PE_HEADER_OPTIONAL_HEADER_SIZE)-(NE_HEADER_SIZE-PE_HEADER_SIZE),
 225                                 SEEK_CUR) == (SMB_OFF_T)-1) {
 226                         DEBUG(3,("get_file_version: File [%s] Windows optional header too short, errno = %d\n",
 227                                 fname, errno));
 228                         goto error_exit;
 229                 }
 230
 231                 /* get the section table */
 232                 num_sections        = SVAL(buf,PE_HEADER_NUMBER_OF_SECTIONS);
 233                 section_table_bytes = num_sections * PE_HEADER_SECT_HEADER_SIZE;
 234                 if (section_table_bytes == 0)
 235                         goto error_exit;
 236
 237                 SAFE_FREE(buf);
 238                 if ((buf=(char *)SMB_MALLOC(section_table_bytes)) == NULL) {
 239                         DEBUG(0,("get_file_version: PE file [%s] section table malloc failed bytes = %d\n",
 240                                         fname, section_table_bytes));
 241                         goto error_exit;
 242                 }
 243
 244                 if ((byte_count = vfs_read_data(fsp, buf, section_table_bytes)) < section_table_bytes) {
 245                         DEBUG(3,("get_file_version: PE file [%s] Section header too short, bytes read = %lu\n",
 246                                  fname, (unsigned long)byte_count));
 247                         goto error_exit;
 248                 }
 249
 250                 /* Iterate the section table looking for the resource section ".rsrc" */
 251                 for (i = 0; i < num_sections; i++) {
 252                         int sec_offset = i * PE_HEADER_SECT_HEADER_SIZE;
 253
 254                         if (strcmp(".rsrc", &buf[sec_offset+PE_HEADER_SECT_NAME_OFFSET]) == 0) {
 255                                 unsigned int section_pos   = IVAL(buf,sec_offset+PE_HEADER_SECT_PTR_DATA_OFFSET);
 256                                 unsigned int section_bytes = IVAL(buf,sec_offset+PE_HEADER_SECT_SIZE_DATA_OFFSET);
 257
 258                                 if (section_bytes == 0)
 259                                         goto error_exit;
 260
 261                                 SAFE_FREE(buf);
 262                                 if ((buf=(char *)SMB_MALLOC(section_bytes)) == NULL) {
 263                                         DEBUG(0,("get_file_version: PE file [%s] version malloc failed bytes = %d\n",
 264                                                         fname, section_bytes));
 265                                         goto error_exit;
 266                                 }
 267
 268                                 /* Seek to the start of the .rsrc section info */
 269                                 if (SMB_VFS_LSEEK(fsp, section_pos, SEEK_SET) == (SMB_OFF_T)-1) {
 270                                         DEBUG(3,("get_file_version: PE file [%s] too short for section info, errno = %d\n",
 271                                                         fname, errno));
 272                                         goto error_exit;
 273                                 }
 274
 275                                 if ((byte_count = vfs_read_data(fsp, buf, section_bytes)) < section_bytes) {
 276                                         DEBUG(3,("get_file_version: PE file [%s] .rsrc section too short, bytes read = %lu\n",
 277                                                  fname, (unsigned long)byte_count));
 278                                         goto error_exit;
 279                                 }
 280
 281                                 if (section_bytes < VS_VERSION_INFO_UNICODE_SIZE)
 282                                         goto error_exit;
 283
 284                                 for (i=0; i<section_bytes-VS_VERSION_INFO_UNICODE_SIZE; i++) {
 285                                         /* Scan for 1st 3 unicoded bytes followed by word aligned magic value */
 286                                         if (buf[i] == 'V' && buf[i+1] == '\0' && buf[i+2] == 'S') {
 287                                                 /* Align to next long address */
 288                                                 int pos = (i + sizeof(VS_SIGNATURE)*2 + 3) & 0xfffffffc;
 289
 290                                                 if (IVAL(buf,pos) == VS_MAGIC_VALUE) {
 291                                                         *major = IVAL(buf,pos+VS_MAJOR_OFFSET);
 292                                                         *minor = IVAL(buf,pos+VS_MINOR_OFFSET);
 293
 294                                                         DEBUG(6,("get_file_version: PE file [%s] Version = %08x:%08x (%d.%d.%d.%d)\n",
 295                                                                           fname, *major, *minor,
 296                                                                           (*major>>16)&0xffff, *major&0xffff,
 297                                                                           (*minor>>16)&0xffff, *minor&0xffff));
 298                                                         SAFE_FREE(buf);
 299                                                         return 1;
 300                                                 }
 301                                         }
 302                                 }
 303                         }
 304                 }
 305
 306                 /* Version info not found, fall back to origin date/time */
 307                 DEBUG(10,("get_file_version: PE file [%s] has no version info\n", fname));
 308                 SAFE_FREE(buf);
 309                 return 0;
 310
 311         } else if (SVAL(buf,NE_HEADER_SIGNATURE_OFFSET) == NE_HEADER_SIGNATURE) {
 312                 if (CVAL(buf,NE_HEADER_TARGET_OS_OFFSET) != NE_HEADER_TARGOS_WIN ) {
 313                         DEBUG(3,("get_file_version: NE file [%s] wrong target OS = 0x%x\n",
 314                                         fname, CVAL(buf,NE_HEADER_TARGET_OS_OFFSET)));
 315                         /* At this point, we assume the file is in error. It still could be somthing
 316                          * else besides a NE file, but it unlikely at this point. */
 317                         goto error_exit;
 318                 }
 319
 320                 /* Allocate a bit more space to speed up things */
 321                 SAFE_FREE(buf);
 322                 if ((buf=(char *)SMB_MALLOC(VS_NE_BUF_SIZE)) == NULL) {
 323                         DEBUG(0,("get_file_version: NE file [%s] malloc failed bytes  = %d\n",
 324                                         fname, PE_HEADER_SIZE));
 325                         goto error_exit;
 326                 }
 327
 328                 /* This is a HACK! I got tired of trying to sort through the messy
 329                  * 'NE' file format. If anyone wants to clean this up please have at
 330                  * it, but this works. 'NE' files will eventually fade away. JRR */
 331                 while((byte_count = vfs_read_data(fsp, buf, VS_NE_BUF_SIZE)) > 0) {
 332                         /* Cover case that should not occur in a well formed 'NE' .dll file */
 333                         if (byte_count-VS_VERSION_INFO_SIZE <= 0) break;
 334
 335                         for(i=0; i<byte_count; i++) {
 336                                 /* Fast skip past data that can't possibly match */
 337                                 if (buf[i] != 'V') continue;
 338
 339                                 /* Potential match data crosses buf boundry, move it to beginning
 340                                  * of buf, and fill the buf with as much as it will hold. */
 341                                 if (i>byte_count-VS_VERSION_INFO_SIZE) {
 342                                         int bc;
 343
 344                                         memcpy(buf, &buf[i], byte_count-i);
 345                                         if ((bc = vfs_read_data(fsp, &buf[byte_count-i], VS_NE_BUF_SIZE-
 346                                                                    (byte_count-i))) < 0) {
 347
 348                                                 DEBUG(0,("get_file_version: NE file [%s] Read error, errno=%d\n",
 349                                                                  fname, errno));
 350                                                 goto error_exit;
 351                                         }
 352
 353                                         byte_count = bc + (byte_count - i);
 354                                         if (byte_count<VS_VERSION_INFO_SIZE) break;
 355
 356                                         i = 0;
 357                                 }
 358
 359                                 /* Check that the full signature string and the magic number that
 360                                  * follows exist (not a perfect solution, but the chances that this
 361                                  * occurs in code is, well, remote. Yes I know I'm comparing the 'V'
 362                                  * twice, as it is simpler to read the code. */
 363                                 if (strcmp(&buf[i], VS_SIGNATURE) == 0) {
 364                                         /* Compute skip alignment to next long address */
 365                                         int skip = -(SMB_VFS_LSEEK(fsp, 0, SEEK_CUR) - (byte_count - i) +
 366                                                                  sizeof(VS_SIGNATURE)) & 3;
 367                                         if (IVAL(buf,i+sizeof(VS_SIGNATURE)+skip) != 0xfeef04bd) continue;
 368
 369                                         *major = IVAL(buf,i+sizeof(VS_SIGNATURE)+skip+VS_MAJOR_OFFSET);
 370                                         *minor = IVAL(buf,i+sizeof(VS_SIGNATURE)+skip+VS_MINOR_OFFSET);
 371                                         DEBUG(6,("get_file_version: NE file [%s] Version = %08x:%08x (%d.%d.%d.%d)\n",
 372                                                           fname, *major, *minor,
 373                                                           (*major>>16)&0xffff, *major&0xffff,
 374                                                           (*minor>>16)&0xffff, *minor&0xffff));
 375                                         SAFE_FREE(buf);
 376                                         return 1;
 377                                 }
 378                         }
 379                 }
 380
 381                 /* Version info not found, fall back to origin date/time */
 382                 DEBUG(0,("get_file_version: NE file [%s] Version info not found\n", fname));
 383                 SAFE_FREE(buf);
 384                 return 0;
 385
 386         } else
 387                 /* Assume this isn't an error... the file just looks sort of like a PE/NE file */
 388                 DEBUG(3,("get_file_version: File [%s] unknown file format, signature = 0x%x\n",
 389                                 fname, IVAL(buf,PE_HEADER_SIGNATURE_OFFSET)));
 390
 391         no_version_info:
 392                 SAFE_FREE(buf);
 393                 return 0;
 394
 395         error_exit:
 396                 SAFE_FREE(buf);
 397                 return -1;
 398 }
 399
 400 /****************************************************************************
 401 Drivers for Microsoft systems contain multiple files. Often, multiple drivers
 402 share one or more files. During the MS installation process files are checked
 403 to insure that only a newer version of a shared file is installed over an
 404 older version. There are several possibilities for this comparison. If there
 405 is no previous version, the new one is newer (obviously). If either file is
 406 missing the version info structure, compare the creation date (on Unix use
 407 the modification date). Otherwise chose the numerically larger version number.
 408 ****************************************************************************/
 409
 410 static int file_version_is_newer(connection_struct *conn, fstring new_file, fstring old_file)
 411 {
 412         bool use_version = true;
 413
 414         uint32 new_major;
 415         uint32 new_minor;
 416         time_t new_create_time;
 417
 418         uint32 old_major;
 419         uint32 old_minor;
 420         time_t old_create_time;
 421
 422         struct smb_filename *smb_fname = NULL;
 423         files_struct    *fsp = NULL;
 424         SMB_STRUCT_STAT st;
 425
 426         NTSTATUS status;
 427         int ret;
 428
 429         SET_STAT_INVALID(st);
 430         new_create_time = (time_t)0;
 431         old_create_time = (time_t)0;
 432
 433         /* Get file version info (if available) for previous file (if it exists) */
 434         status = driver_unix_convert(conn, old_file, &smb_fname);
 435         if (!NT_STATUS_IS_OK(status)) {
 436                 goto error_exit;
 437         }
 438
 439         status = SMB_VFS_CREATE_FILE(
 440                 conn,                                   /* conn */
 441                 NULL,                                   /* req */
 442                 0,                                      /* root_dir_fid */
 443                 smb_fname,                              /* fname */
 444                 FILE_GENERIC_READ,                      /* access_mask */
 445                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
 446                 FILE_OPEN,                              /* create_disposition*/
 447                 0,                                      /* create_options */
 448                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
 449                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
 450                 0,                                      /* allocation_size */
 451                 0,                                      /* private_flags */
 452                 NULL,                                   /* sd */
 453                 NULL,                                   /* ea_list */
 454                 &fsp,                                   /* result */
 455                 NULL);                                  /* pinfo */
 456
 457         if (!NT_STATUS_IS_OK(status)) {
 458                 /* Old file not found, so by definition new file is in fact newer */
 459                 DEBUG(10,("file_version_is_newer: Can't open old file [%s], "
 460                           "errno = %d\n", smb_fname_str_dbg(smb_fname),
 461                           errno));
 462                 ret = 1;
 463                 goto done;
 464
 465         } else {
 466                 ret = get_file_version(fsp, old_file, &old_major, &old_minor);
 467                 if (ret == -1) {
 468                         goto error_exit;
 469                 }
 470
 471                 if (!ret) {
 472                         DEBUG(6,("file_version_is_newer: Version info not found [%s], use mod time\n",
 473                                          old_file));
 474                         use_version = false;
 475                         if (SMB_VFS_FSTAT(fsp, &st) == -1) {
 476                                  goto error_exit;
 477                         }
 478                         old_create_time = convert_timespec_to_time_t(st.st_ex_mtime);
 479                         DEBUGADD(6,("file_version_is_newer: mod time = %ld sec\n",
 480                                 (long)old_create_time));
 481                 }
 482         }
 483         close_file(NULL, fsp, NORMAL_CLOSE);
 484         fsp = NULL;
 485
 486         /* Get file version info (if available) for new file */
 487         status = driver_unix_convert(conn, new_file, &smb_fname);
 488         if (!NT_STATUS_IS_OK(status)) {
 489                 goto error_exit;
 490         }
 491
 492         status = SMB_VFS_CREATE_FILE(
 493                 conn,                                   /* conn */
 494                 NULL,                                   /* req */
 495                 0,                                      /* root_dir_fid */
 496                 smb_fname,                              /* fname */
 497                 FILE_GENERIC_READ,                      /* access_mask */
 498                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
 499                 FILE_OPEN,                              /* create_disposition*/
 500                 0,                                      /* create_options */
 501                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
 502                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
 503                 0,                                      /* allocation_size */
 504                 0,                                      /* private_flags */
 505                 NULL,                                   /* sd */
 506                 NULL,                                   /* ea_list */
 507                 &fsp,                                   /* result */
 508                 NULL);                                  /* pinfo */
 509
 510         if (!NT_STATUS_IS_OK(status)) {
 511                 /* New file not found, this shouldn't occur if the caller did its job */
 512                 DEBUG(3,("file_version_is_newer: Can't open new file [%s], "
 513                          "errno = %d\n", smb_fname_str_dbg(smb_fname), errno));
 514                 goto error_exit;
 515
 516         } else {
 517                 ret = get_file_version(fsp, new_file, &new_major, &new_minor);
 518                 if (ret == -1) {
 519                         goto error_exit;
 520                 }
 521
 522                 if (!ret) {
 523                         DEBUG(6,("file_version_is_newer: Version info not found [%s], use mod time\n",
 524                                          new_file));
 525                         use_version = false;
 526                         if (SMB_VFS_FSTAT(fsp, &st) == -1) {
 527                                 goto error_exit;
 528                         }
 529                         new_create_time = convert_timespec_to_time_t(st.st_ex_mtime);
 530                         DEBUGADD(6,("file_version_is_newer: mod time = %ld sec\n",
 531                                 (long)new_create_time));
 532                 }
 533         }
 534         close_file(NULL, fsp, NORMAL_CLOSE);
 535         fsp = NULL;
 536
 537         if (use_version && (new_major != old_major || new_minor != old_minor)) {
 538                 /* Compare versions and choose the larger version number */
 539                 if (new_major > old_major ||
 540                         (new_major == old_major && new_minor > old_minor)) {
 541
 542                         DEBUG(6,("file_version_is_newer: Replacing [%s] with [%s]\n", old_file, new_file));
 543                         ret = 1;
 544                         goto done;
 545                 }
 546                 else {
 547                         DEBUG(6,("file_version_is_newer: Leaving [%s] unchanged\n", old_file));
 548                         ret = 0;
 549                         goto done;
 550                 }
 551
 552         } else {
 553                 /* Compare modification time/dates and choose the newest time/date */
 554                 if (new_create_time > old_create_time) {
 555                         DEBUG(6,("file_version_is_newer: Replacing [%s] with [%s]\n", old_file, new_file));
 556                         ret = 1;
 557                         goto done;
 558                 }
 559                 else {
 560                         DEBUG(6,("file_version_is_newer: Leaving [%s] unchanged\n", old_file));
 561                         ret = 0;
 562                         goto done;
 563                 }
 564         }
 565
 566  error_exit:
 567         if(fsp)
 568                 close_file(NULL, fsp, NORMAL_CLOSE);
 569         ret = -1;
 570  done:
 571         TALLOC_FREE(smb_fname);
 572         return ret;
 573 }
 574
 575 /****************************************************************************
 576 Determine the correct cVersion associated with an architecture and driver
 577 ****************************************************************************/
 578 static uint32 get_correct_cversion(struct auth_session_info *session_info,
 579                                    const char *architecture,
 580                                    const char *driverpath_in,
 581                                    WERROR *perr)
 582 {
 583         int cversion = -1;
 584         NTSTATUS          nt_status;
 585         struct smb_filename *smb_fname = NULL;
 586         char *driverpath = NULL;
 587         files_struct      *fsp = NULL;
 588         connection_struct *conn = NULL;
 589         char *oldcwd;
 590         char *printdollar = NULL;
 591         int printdollar_snum;
 592
 593         *perr = WERR_INVALID_PARAM;
 594
 595         /* If architecture is Windows 95/98/ME, the version is always 0. */
 596         if (strcmp(architecture, SPL_ARCH_WIN40) == 0) {
 597                 DEBUG(10,("get_correct_cversion: Driver is Win9x, cversion = 0\n"));
 598                 *perr = WERR_OK;
 599                 return 0;
 600         }
 601
 602         /* If architecture is Windows x64, the version is always 3. */
 603         if (strcmp(architecture, SPL_ARCH_X64) == 0) {
 604                 DEBUG(10,("get_correct_cversion: Driver is x64, cversion = 3\n"));
 605                 *perr = WERR_OK;
 606                 return 3;
 607         }
 608
 609         printdollar_snum = find_service(talloc_tos(), "print$", &printdollar);
 610         if (!printdollar) {
 611                 *perr = WERR_NOMEM;
 612                 return -1;
 613         }
 614         if (printdollar_snum == -1) {
 615                 *perr = WERR_NO_SUCH_SHARE;
 616                 return -1;
 617         }
 618
 619         nt_status = create_conn_struct(talloc_tos(), smbd_server_conn, &conn,
 620                                        printdollar_snum,
 621                                        lp_pathname(printdollar_snum),
 622                                        session_info, &oldcwd);
 623         if (!NT_STATUS_IS_OK(nt_status)) {
 624                 DEBUG(0,("get_correct_cversion: create_conn_struct "
 625                          "returned %s\n", nt_errstr(nt_status)));
 626                 *perr = ntstatus_to_werror(nt_status);
 627                 return -1;
 628         }
 629
 630         nt_status = set_conn_force_user_group(conn, printdollar_snum);
 631         if (!NT_STATUS_IS_OK(nt_status)) {
 632                 DEBUG(0, ("failed set force user / group\n"));
 633                 *perr = ntstatus_to_werror(nt_status);
 634                 goto error_free_conn;
 635         }
 636
 637         if (!become_user_by_session(conn, session_info)) {
 638                 DEBUG(0, ("failed to become user\n"));
 639                 *perr = WERR_ACCESS_DENIED;
 640                 goto error_free_conn;
 641         }
 642
 643         /* Open the driver file (Portable Executable format) and determine the
 644          * deriver the cversion. */
 645         driverpath = talloc_asprintf(talloc_tos(),
 646                                         "%s/%s",
 647                                         architecture,
 648                                         driverpath_in);
 649         if (!driverpath) {
 650                 *perr = WERR_NOMEM;
 651                 goto error_exit;
 652         }
 653
 654         nt_status = driver_unix_convert(conn, driverpath, &smb_fname);
 655         if (!NT_STATUS_IS_OK(nt_status)) {
 656                 *perr = ntstatus_to_werror(nt_status);
 657                 goto error_exit;
 658         }
 659
 660         nt_status = vfs_file_exist(conn, smb_fname);
 661         if (!NT_STATUS_IS_OK(nt_status)) {
 662                 DEBUG(3,("get_correct_cversion: vfs_file_exist failed\n"));
 663                 *perr = WERR_BADFILE;
 664                 goto error_exit;
 665         }
 666
 667         nt_status = SMB_VFS_CREATE_FILE(
 668                 conn,                                   /* conn */
 669                 NULL,                                   /* req */
 670                 0,                                      /* root_dir_fid */
 671                 smb_fname,                              /* fname */
 672                 FILE_GENERIC_READ,                      /* access_mask */
 673                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
 674                 FILE_OPEN,                              /* create_disposition*/
 675                 0,                                      /* create_options */
 676                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
 677                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
 678                 0,                                      /* private_flags */
 679                 0,                                      /* allocation_size */
 680                 NULL,                                   /* sd */
 681                 NULL,                                   /* ea_list */
 682                 &fsp,                                   /* result */
 683                 NULL);                                  /* pinfo */
 684
 685         if (!NT_STATUS_IS_OK(nt_status)) {
 686                 DEBUG(3,("get_correct_cversion: Can't open file [%s], errno = "
 687                          "%d\n", smb_fname_str_dbg(smb_fname), errno));
 688                 *perr = WERR_ACCESS_DENIED;
 689                 goto error_exit;
 690         } else {
 691                 uint32 major;
 692                 uint32 minor;
 693                 int    ret;
 694
 695                 ret = get_file_version(fsp, smb_fname->base_name, &major, &minor);
 696                 if (ret == -1) {
 697                         *perr = WERR_INVALID_PARAM;
 698                         goto error_exit;
 699                 } else if (!ret) {
 700                         DEBUG(6,("get_correct_cversion: Version info not "
 701                                  "found [%s]\n",
 702                                  smb_fname_str_dbg(smb_fname)));
 703                         *perr = WERR_INVALID_PARAM;
 704                         goto error_exit;
 705                 }
 706
 707                 /*
 708                  * This is a Microsoft'ism. See references in MSDN to VER_FILEVERSION
 709                  * for more details. Version in this case is not just the version of the
 710                  * file, but the version in the sense of kernal mode (2) vs. user mode
 711                  * (3) drivers. Other bits of the version fields are the version info.
 712                  * JRR 010716
 713                 */
 714                 cversion = major & 0x0000ffff;
 715                 switch (cversion) {
 716                         case 2: /* WinNT drivers */
 717                         case 3: /* Win2K drivers */
 718                                 break;
 719
 720                         default:
 721                                 DEBUG(6,("get_correct_cversion: cversion "
 722                                          "invalid [%s]  cversion = %d\n",
 723                                          smb_fname_str_dbg(smb_fname),
 724                                          cversion));
 725                                 goto error_exit;
 726                 }
 727
 728                 DEBUG(10,("get_correct_cversion: Version info found [%s] major"
 729                           " = 0x%x  minor = 0x%x\n",
 730                           smb_fname_str_dbg(smb_fname), major, minor));
 731         }
 732
 733         DEBUG(10,("get_correct_cversion: Driver file [%s] cversion = %d\n",
 734                   smb_fname_str_dbg(smb_fname), cversion));
 735         *perr = WERR_OK;
 736
 737  error_exit:
 738         unbecome_user();
 739  error_free_conn:
 740         TALLOC_FREE(smb_fname);
 741         if (fsp != NULL) {
 742                 close_file(NULL, fsp, NORMAL_CLOSE);
 743         }
 744         if (conn != NULL) {
 745                 vfs_ChDir(conn, oldcwd);
 746                 SMB_VFS_DISCONNECT(conn);
 747                 conn_free(conn);
 748         }
 749         if (!NT_STATUS_IS_OK(*perr)) {
 750                 cversion = -1;
 751         }
 752
 753         return cversion;
 754 }
 755
 756 /****************************************************************************
 757 ****************************************************************************/
 758
 759 #define strip_driver_path(_mem_ctx, _element) do { \
 760         if (_element && ((_p = strrchr((_element), '\\')) != NULL)) { \
 761                 (_element) = talloc_asprintf((_mem_ctx), "%s", _p+1); \
 762                 W_ERROR_HAVE_NO_MEMORY((_element)); \
 763         } \
 764 } while (0);
 765
 766 static WERROR clean_up_driver_struct_level(TALLOC_CTX *mem_ctx,
 767                                            struct auth_session_info *session_info,
 768                                            const char *architecture,
 769                                            const char **driver_path,
 770                                            const char **data_file,
 771                                            const char **config_file,
 772                                            const char **help_file,
 773                                            struct spoolss_StringArray *dependent_files,
 774                                            enum spoolss_DriverOSVersion *version)
 775 {
 776         const char *short_architecture;
 777         int i;
 778         WERROR err;
 779         char *_p;
 780
 781         if (!*driver_path || !*data_file) {
 782                 return WERR_INVALID_PARAM;
 783         }
 784
 785         if (!strequal(architecture, SPOOLSS_ARCHITECTURE_4_0) && !*config_file) {
 786                 return WERR_INVALID_PARAM;
 787         }
 788
 789         /* clean up the driver name.
 790          * we can get .\driver.dll
 791          * or worse c:\windows\system\driver.dll !
 792          */
 793         /* using an intermediate string to not have overlaping memcpy()'s */
 794
 795         strip_driver_path(mem_ctx, *driver_path);
 796         strip_driver_path(mem_ctx, *data_file);
 797         if (*config_file) {
 798                 strip_driver_path(mem_ctx, *config_file);
 799         }
 800         if (help_file) {
 801                 strip_driver_path(mem_ctx, *help_file);
 802         }
 803
 804         if (dependent_files && dependent_files->string) {
 805                 for (i=0; dependent_files->string[i]; i++) {
 806                         strip_driver_path(mem_ctx, dependent_files->string[i]);
 807                 }
 808         }
 809
 810         short_architecture = get_short_archi(architecture);
 811         if (!short_architecture) {
 812                 return WERR_UNKNOWN_PRINTER_DRIVER;
 813         }
 814
 815         /* jfm:7/16/2000 the client always sends the cversion=0.
 816          * The server should check which version the driver is by reading
 817          * the PE header of driver->driverpath.
 818          *
 819          * For Windows 95/98 the version is 0 (so the value sent is correct)
 820          * For Windows NT (the architecture doesn't matter)
 821          *      NT 3.1: cversion=0
 822          *      NT 3.5/3.51: cversion=1
 823          *      NT 4: cversion=2
 824          *      NT2K: cversion=3
 825          */
 826
 827         *version = get_correct_cversion(session_info, short_architecture,
 828                                         *driver_path, &err);
 829         if (*version == -1) {
 830                 return err;
 831         }
 832
 833         return WERR_OK;
 834 }
 835
 836 /****************************************************************************
 837 ****************************************************************************/
 838
 839 WERROR clean_up_driver_struct(TALLOC_CTX *mem_ctx,
 840                               struct auth_session_info *session_info,
 841                               struct spoolss_AddDriverInfoCtr *r)
 842 {
 843         switch (r->level) {
 844         case 3:
 845                 return clean_up_driver_struct_level(mem_ctx, session_info,
 846                                                     r->info.info3->architecture,
 847                                                     &r->info.info3->driver_path,
 848                                                     &r->info.info3->data_file,
 849                                                     &r->info.info3->config_file,
 850                                                     &r->info.info3->help_file,
 851                                                     r->info.info3->dependent_files,
 852                                                     &r->info.info3->version);
 853         case 6:
 854                 return clean_up_driver_struct_level(mem_ctx, session_info,
 855                                                     r->info.info6->architecture,
 856                                                     &r->info.info6->driver_path,
 857                                                     &r->info.info6->data_file,
 858                                                     &r->info.info6->config_file,
 859                                                     &r->info.info6->help_file,
 860                                                     r->info.info6->dependent_files,
 861                                                     &r->info.info6->version);
 862         default:
 863                 return WERR_NOT_SUPPORTED;
 864         }
 865 }
 866
 867 /****************************************************************************
 868  This function sucks and should be replaced. JRA.
 869 ****************************************************************************/
 870
 871 static void convert_level_6_to_level3(struct spoolss_AddDriverInfo3 *dst,
 872                                       const struct spoolss_AddDriverInfo6 *src)
 873 {
 874         dst->version            = src->version;
 875
 876         dst->driver_name        = src->driver_name;
 877         dst->architecture       = src->architecture;
 878         dst->driver_path        = src->driver_path;
 879         dst->data_file          = src->data_file;
 880         dst->config_file        = src->config_file;
 881         dst->help_file          = src->help_file;
 882         dst->monitor_name       = src->monitor_name;
 883         dst->default_datatype   = src->default_datatype;
 884         dst->_ndr_size_dependent_files = src->_ndr_size_dependent_files;
 885         dst->dependent_files    = src->dependent_files;
 886 }
 887
 888 /****************************************************************************
 889 ****************************************************************************/
 890
 891 static WERROR move_driver_file_to_download_area(TALLOC_CTX *mem_ctx,
 892                                                 connection_struct *conn,
 893                                                 const char *driver_file,
 894                                                 const char *short_architecture,
 895                                                 uint32_t driver_version,
 896                                                 uint32_t version)
 897 {
 898         struct smb_filename *smb_fname_old = NULL;
 899         struct smb_filename *smb_fname_new = NULL;
 900         char *old_name = NULL;
 901         char *new_name = NULL;
 902         NTSTATUS status;
 903         WERROR ret;
 904
 905         old_name = talloc_asprintf(mem_ctx, "%s/%s",
 906                                    short_architecture, driver_file);
 907         W_ERROR_HAVE_NO_MEMORY(old_name);
 908
 909         new_name = talloc_asprintf(mem_ctx, "%s/%d/%s",
 910                                    short_architecture, driver_version, driver_file);
 911         if (new_name == NULL) {
 912                 TALLOC_FREE(old_name);
 913                 return WERR_NOMEM;
 914         }
 915
 916         if (version != -1 && (version = file_version_is_newer(conn, old_name, new_name)) > 0) {
 917
 918                 status = driver_unix_convert(conn, old_name, &smb_fname_old);
 919                 if (!NT_STATUS_IS_OK(status)) {
 920                         ret = WERR_NOMEM;
 921                         goto out;
 922                 }
 923
 924                 /* Setup a synthetic smb_filename struct */
 925                 smb_fname_new = talloc_zero(mem_ctx, struct smb_filename);
 926                 if (!smb_fname_new) {
 927                         ret = WERR_NOMEM;
 928                         goto out;
 929                 }
 930
 931                 smb_fname_new->base_name = new_name;
 932
 933                 DEBUG(10,("move_driver_file_to_download_area: copying '%s' to "
 934                           "'%s'\n", smb_fname_old->base_name,
 935                           smb_fname_new->base_name));
 936
 937                 status = copy_file(mem_ctx, conn, smb_fname_old, smb_fname_new,
 938                                    OPENX_FILE_EXISTS_TRUNCATE |
 939                                    OPENX_FILE_CREATE_IF_NOT_EXIST,
 940                                    0, false);
 941
 942                 if (!NT_STATUS_IS_OK(status)) {
 943                         DEBUG(0,("move_driver_file_to_download_area: Unable "
 944                                  "to rename [%s] to [%s]: %s\n",
 945                                  smb_fname_old->base_name, new_name,
 946                                  nt_errstr(status)));
 947                         ret = WERR_ACCESS_DENIED;
 948                         goto out;
 949                 }
 950         }
 951
 952         ret = WERR_OK;
 953  out:
 954         TALLOC_FREE(smb_fname_old);
 955         TALLOC_FREE(smb_fname_new);
 956         return ret;
 957 }
 958
 959 WERROR move_driver_to_download_area(struct auth_session_info *session_info,
 960                                     struct spoolss_AddDriverInfoCtr *r)
 961 {
 962         struct spoolss_AddDriverInfo3 *driver;
 963         struct spoolss_AddDriverInfo3 converted_driver;
 964         const char *short_architecture;
 965         struct smb_filename *smb_dname = NULL;
 966         char *new_dir = NULL;
 967         connection_struct *conn = NULL;
 968         NTSTATUS nt_status;
 969         int i;
 970         TALLOC_CTX *ctx = talloc_tos();
 971         int ver = 0;
 972         char *oldcwd;
 973         char *printdollar = NULL;
 974         int printdollar_snum;
 975         WERROR err = WERR_OK;
 976
 977         switch (r->level) {
 978         case 3:
 979                 driver = r->info.info3;
 980                 break;
 981         case 6:
 982                 convert_level_6_to_level3(&converted_driver, r->info.info6);
 983                 driver = &converted_driver;
 984                 break;
 985         default:
 986                 DEBUG(0,("move_driver_to_download_area: Unknown info level (%u)\n", (unsigned int)r->level));
 987                 return WERR_UNKNOWN_LEVEL;
 988         }
 989
 990         short_architecture = get_short_archi(driver->architecture);
 991         if (!short_architecture) {
 992                 return WERR_UNKNOWN_PRINTER_DRIVER;
 993         }
 994
 995         printdollar_snum = find_service(ctx, "print$", &printdollar);
 996         if (!printdollar) {
 997                 return WERR_NOMEM;
 998         }
 999         if (printdollar_snum == -1) {
1000                 return WERR_NO_SUCH_SHARE;
1001         }
1002
1003         nt_status = create_conn_struct(talloc_tos(), smbd_server_conn, &conn,
1004                                        printdollar_snum,
1005                                        lp_pathname(printdollar_snum),
1006                                        session_info, &oldcwd);
1007         if (!NT_STATUS_IS_OK(nt_status)) {
1008                 DEBUG(0,("move_driver_to_download_area: create_conn_struct "
1009                          "returned %s\n", nt_errstr(nt_status)));
1010                 err = ntstatus_to_werror(nt_status);
1011                 return err;
1012         }
1013
1014         nt_status = set_conn_force_user_group(conn, printdollar_snum);
1015         if (!NT_STATUS_IS_OK(nt_status)) {
1016                 DEBUG(0, ("failed set force user / group\n"));
1017                 err = ntstatus_to_werror(nt_status);
1018                 goto err_free_conn;
1019         }
1020
1021         if (!become_user_by_session(conn, session_info)) {
1022                 DEBUG(0, ("failed to become user\n"));
1023                 err = WERR_ACCESS_DENIED;
1024                 goto err_free_conn;
1025         }
1026
1027         new_dir = talloc_asprintf(ctx,
1028                                 "%s/%d",
1029                                 short_architecture,
1030                                 driver->version);
1031         if (!new_dir) {
1032                 err = WERR_NOMEM;
1033                 goto err_exit;
1034         }
1035         nt_status = driver_unix_convert(conn, new_dir, &smb_dname);
1036         if (!NT_STATUS_IS_OK(nt_status)) {
1037                 err = WERR_NOMEM;
1038                 goto err_exit;
1039         }
1040
1041         DEBUG(5,("Creating first directory: %s\n", smb_dname->base_name));
1042
1043         nt_status = create_directory(conn, NULL, smb_dname);
1044         if (!NT_STATUS_IS_OK(nt_status)
1045          && !NT_STATUS_EQUAL(nt_status, NT_STATUS_OBJECT_NAME_COLLISION)) {
1046                 DEBUG(0, ("failed to create driver destination directory: %s\n",
1047                           nt_errstr(nt_status)));
1048                 err = ntstatus_to_werror(nt_status);
1049                 goto err_exit;
1050         }
1051
1052         /* For each driver file, archi\filexxx.yyy, if there is a duplicate file
1053          * listed for this driver which has already been moved, skip it (note:
1054          * drivers may list the same file name several times. Then check if the
1055          * file already exists in archi\version\, if so, check that the version
1056          * info (or time stamps if version info is unavailable) is newer (or the
1057          * date is later). If it is, move it to archi\version\filexxx.yyy.
1058          * Otherwise, delete the file.
1059          *
1060          * If a file is not moved to archi\version\ because of an error, all the
1061          * rest of the 'unmoved' driver files are removed from archi\. If one or
1062          * more of the driver's files was already moved to archi\version\, it
1063          * potentially leaves the driver in a partially updated state. Version
1064          * trauma will most likely occur if an client attempts to use any printer
1065          * bound to the driver. Perhaps a rewrite to make sure the moves can be
1066          * done is appropriate... later JRR
1067          */
1068
1069         DEBUG(5,("Moving files now !\n"));
1070
1071         if (driver->driver_path && strlen(driver->driver_path)) {
1072
1073                 err = move_driver_file_to_download_area(ctx,
1074                                                         conn,
1075                                                         driver->driver_path,
1076                                                         short_architecture,
1077                                                         driver->version,
1078                                                         ver);
1079                 if (!W_ERROR_IS_OK(err)) {
1080                         goto err_exit;
1081                 }
1082         }
1083
1084         if (driver->data_file && strlen(driver->data_file)) {
1085                 if (!strequal(driver->data_file, driver->driver_path)) {
1086
1087                         err = move_driver_file_to_download_area(ctx,
1088                                                                 conn,
1089                                                                 driver->data_file,
1090                                                                 short_architecture,
1091                                                                 driver->version,
1092                                                                 ver);
1093                         if (!W_ERROR_IS_OK(err)) {
1094                                 goto err_exit;
1095                         }
1096                 }
1097         }
1098
1099         if (driver->config_file && strlen(driver->config_file)) {
1100                 if (!strequal(driver->config_file, driver->driver_path) &&
1101                     !strequal(driver->config_file, driver->data_file)) {
1102
1103                         err = move_driver_file_to_download_area(ctx,
1104                                                                 conn,
1105                                                                 driver->config_file,
1106                                                                 short_architecture,
1107                                                                 driver->version,
1108                                                                 ver);
1109                         if (!W_ERROR_IS_OK(err)) {
1110                                 goto err_exit;
1111                         }
1112                 }
1113         }
1114
1115         if (driver->help_file && strlen(driver->help_file)) {
1116                 if (!strequal(driver->help_file, driver->driver_path) &&
1117                     !strequal(driver->help_file, driver->data_file) &&
1118                     !strequal(driver->help_file, driver->config_file)) {
1119
1120                         err = move_driver_file_to_download_area(ctx,
1121                                                                 conn,
1122                                                                 driver->help_file,
1123                                                                 short_architecture,
1124                                                                 driver->version,
1125                                                                 ver);
1126                         if (!W_ERROR_IS_OK(err)) {
1127                                 goto err_exit;
1128                         }
1129                 }
1130         }
1131
1132         if (driver->dependent_files && driver->dependent_files->string) {
1133                 for (i=0; driver->dependent_files->string[i]; i++) {
1134                         if (!strequal(driver->dependent_files->string[i], driver->driver_path) &&
1135                             !strequal(driver->dependent_files->string[i], driver->data_file) &&
1136                             !strequal(driver->dependent_files->string[i], driver->config_file) &&
1137                             !strequal(driver->dependent_files->string[i], driver->help_file)) {
1138                                 int j;
1139                                 for (j=0; j < i; j++) {
1140                                         if (strequal(driver->dependent_files->string[i], driver->dependent_files->string[j])) {
1141                                                 goto NextDriver;
1142                                         }
1143                                 }
1144
1145                                 err = move_driver_file_to_download_area(ctx,
1146                                                                         conn,
1147                                                                         driver->dependent_files->string[i],
1148                                                                         short_architecture,
1149                                                                         driver->version,
1150                                                                         ver);
1151                                 if (!W_ERROR_IS_OK(err)) {
1152                                         goto err_exit;
1153                                 }
1154                         }
1155                 NextDriver: ;
1156                 }
1157         }
1158
1159         err = WERR_OK;
1160  err_exit:
1161         unbecome_user();
1162  err_free_conn:
1163         TALLOC_FREE(smb_dname);
1164
1165         if (conn != NULL) {
1166                 vfs_ChDir(conn, oldcwd);
1167                 SMB_VFS_DISCONNECT(conn);
1168                 conn_free(conn);
1169         }
1170
1171         return err;
1172 }
1173
1174 /****************************************************************************
1175   Determine whether or not a particular driver is currently assigned
1176   to a printer
1177 ****************************************************************************/
1178
1179 bool printer_driver_in_use(TALLOC_CTX *mem_ctx,
1180                            struct dcerpc_binding_handle *b,
1181                            const struct spoolss_DriverInfo8 *r)
1182 {
1183         int snum;
1184         int n_services = lp_numservices();
1185         bool in_use = False;
1186         struct spoolss_PrinterInfo2 *pinfo2 = NULL;
1187         WERROR result;
1188
1189         if (!r) {
1190                 return false;
1191         }
1192
1193         DEBUG(10,("printer_driver_in_use: Beginning search through ntprinters.tdb...\n"));
1194
1195         /* loop through the printers.tdb and check for the drivername */
1196
1197         for (snum=0; snum<n_services && !in_use; snum++) {
1198                 if (!lp_snum_ok(snum) || !lp_print_ok(snum)) {
1199                         continue;
1200                 }
1201
1202                 result = winreg_get_printer(mem_ctx, b,
1203                                             lp_servicename(snum),
1204                                             &pinfo2);
1205                 if (!W_ERROR_IS_OK(result)) {
1206                         continue; /* skip */
1207                 }
1208
1209                 if (strequal(r->driver_name, pinfo2->drivername)) {
1210                         in_use = True;
1211                 }
1212
1213                 TALLOC_FREE(pinfo2);
1214         }
1215
1216         DEBUG(10,("printer_driver_in_use: Completed search through ntprinters.tdb...\n"));
1217
1218         if ( in_use ) {
1219                 struct spoolss_DriverInfo8 *driver;
1220                 WERROR werr;
1221
1222                 DEBUG(5,("printer_driver_in_use: driver \"%s\" is currently in use\n", r->driver_name));
1223
1224                 /* we can still remove the driver if there is one of
1225                    "Windows NT x86" version 2 or 3 left */
1226
1227                 if (!strequal("Windows NT x86", r->architecture)) {
1228                         werr = winreg_get_driver(mem_ctx, b,
1229                                                  "Windows NT x86",
1230                                                  r->driver_name,
1231                                                  DRIVER_ANY_VERSION,
1232                                                  &driver);
1233                 } else if (r->version == 2) {
1234                         werr = winreg_get_driver(mem_ctx, b,
1235                                                  "Windows NT x86",
1236                                                  r->driver_name,
1237                                                  3, &driver);
1238                 } else if (r->version == 3) {
1239                         werr = winreg_get_driver(mem_ctx, b,
1240                                                  "Windows NT x86",
1241                                                  r->driver_name,
1242                                                  2, &driver);
1243                 } else {
1244                         DEBUG(0, ("printer_driver_in_use: ERROR!"
1245                                   " unknown driver version (%d)\n",
1246                                   r->version));
1247                         werr = WERR_UNKNOWN_PRINTER_DRIVER;
1248                 }
1249
1250                 /* now check the error code */
1251
1252                 if ( W_ERROR_IS_OK(werr) ) {
1253                         /* it's ok to remove the driver, we have other architctures left */
1254                         in_use = False;
1255                         talloc_free(driver);
1256                 }
1257         }
1258
1259         /* report that the driver is not in use by default */
1260
1261         return in_use;
1262 }
1263
1264
1265 /**********************************************************************
1266  Check to see if a ogiven file is in use by *info
1267  *********************************************************************/
1268
1269 static bool drv_file_in_use(const char *file, const struct spoolss_DriverInfo8 *info)
1270 {
1271         int i = 0;
1272
1273         if ( !info )
1274                 return False;
1275
1276         /* mz: skip files that are in the list but already deleted */
1277         if (!file || !file[0]) {
1278                 return false;
1279         }
1280
1281         if (strequal(file, info->driver_path))
1282                 return True;
1283
1284         if (strequal(file, info->data_file))
1285                 return True;
1286
1287         if (strequal(file, info->config_file))
1288                 return True;
1289
1290         if (strequal(file, info->help_file))
1291                 return True;
1292
1293         /* see of there are any dependent files to examine */
1294
1295         if (!info->dependent_files)
1296                 return False;
1297
1298         while (info->dependent_files[i] && *info->dependent_files[i]) {
1299                 if (strequal(file, info->dependent_files[i]))
1300                         return True;
1301                 i++;
1302         }
1303
1304         return False;
1305
1306 }
1307
1308 /**********************************************************************
1309  Utility function to remove the dependent file pointed to by the
1310  input parameter from the list
1311  *********************************************************************/
1312
1313 static void trim_dependent_file(TALLOC_CTX *mem_ctx, const char **files, int idx)
1314 {
1315
1316         /* bump everything down a slot */
1317
1318         while (files && files[idx+1]) {
1319                 files[idx] = talloc_strdup(mem_ctx, files[idx+1]);
1320                 idx++;
1321         }
1322
1323         files[idx] = NULL;
1324
1325         return;
1326 }
1327
1328 /**********************************************************************
1329  Check if any of the files used by src are also used by drv
1330  *********************************************************************/
1331
1332 static bool trim_overlap_drv_files(TALLOC_CTX *mem_ctx,
1333                                    struct spoolss_DriverInfo8 *src,
1334                                    const struct spoolss_DriverInfo8 *drv)
1335 {
1336         bool    in_use = False;
1337         int     i = 0;
1338
1339         if ( !src || !drv )
1340                 return False;
1341
1342         /* check each file.  Remove it from the src structure if it overlaps */
1343
1344         if (drv_file_in_use(src->driver_path, drv)) {
1345                 in_use = True;
1346                 DEBUG(10,("Removing driverfile [%s] from list\n", src->driver_path));
1347                 src->driver_path = talloc_strdup(mem_ctx, "");
1348                 if (!src->driver_path) { return false; }
1349         }
1350
1351         if (drv_file_in_use(src->data_file, drv)) {
1352                 in_use = True;
1353                 DEBUG(10,("Removing datafile [%s] from list\n", src->data_file));
1354                 src->data_file = talloc_strdup(mem_ctx, "");
1355                 if (!src->data_file) { return false; }
1356         }
1357
1358         if (drv_file_in_use(src->config_file, drv)) {
1359                 in_use = True;
1360                 DEBUG(10,("Removing configfile [%s] from list\n", src->config_file));
1361                 src->config_file = talloc_strdup(mem_ctx, "");
1362                 if (!src->config_file) { return false; }
1363         }
1364
1365         if (drv_file_in_use(src->help_file, drv)) {
1366                 in_use = True;
1367                 DEBUG(10,("Removing helpfile [%s] from list\n", src->help_file));
1368                 src->help_file = talloc_strdup(mem_ctx, "");
1369                 if (!src->help_file) { return false; }
1370         }
1371
1372         /* are there any dependentfiles to examine? */
1373
1374         if (!src->dependent_files)
1375                 return in_use;
1376
1377         while (src->dependent_files[i] && *src->dependent_files[i]) {
1378                 if (drv_file_in_use(src->dependent_files[i], drv)) {
1379                         in_use = True;
1380                         DEBUG(10,("Removing [%s] from dependent file list\n", src->dependent_files[i]));
1381                         trim_dependent_file(mem_ctx, src->dependent_files, i);
1382                 } else
1383                         i++;
1384         }
1385
1386         return in_use;
1387 }
1388
1389 /****************************************************************************
1390   Determine whether or not a particular driver files are currently being
1391   used by any other driver.
1392
1393   Return value is True if any files were in use by other drivers
1394   and False otherwise.
1395
1396   Upon return, *info has been modified to only contain the driver files
1397   which are not in use
1398
1399   Fix from mz:
1400
1401   This needs to check all drivers to ensure that all files in use
1402   have been removed from *info, not just the ones in the first
1403   match.
1404 ****************************************************************************/
1405
1406 bool printer_driver_files_in_use(TALLOC_CTX *mem_ctx,
1407                                  struct dcerpc_binding_handle *b,
1408                                  struct spoolss_DriverInfo8 *info)
1409 {
1410         int                             i;
1411         uint32                          version;
1412         struct spoolss_DriverInfo8      *driver;
1413         bool in_use = false;
1414         uint32_t num_drivers;
1415         const char **drivers;
1416         WERROR result;
1417
1418         if ( !info )
1419                 return False;
1420
1421         version = info->version;
1422
1423         /* loop over all driver versions */
1424
1425         DEBUG(5,("printer_driver_files_in_use: Beginning search of drivers...\n"));
1426
1427         /* get the list of drivers */
1428
1429         result = winreg_get_driver_list(mem_ctx, b,
1430                                         info->architecture, version,
1431                                         &num_drivers, &drivers);
1432         if (!W_ERROR_IS_OK(result)) {
1433                 return true;
1434         }
1435
1436         DEBUGADD(4, ("we have:[%d] drivers in environment [%s] and version [%d]\n",
1437                      num_drivers, info->architecture, version));
1438
1439         /* check each driver for overlap in files */
1440
1441         for (i = 0; i < num_drivers; i++) {
1442                 DEBUGADD(5,("\tdriver: [%s]\n", drivers[i]));
1443
1444                 driver = NULL;
1445
1446                 result = winreg_get_driver(mem_ctx, b,
1447                                            info->architecture, drivers[i],
1448                                            version, &driver);
1449                 if (!W_ERROR_IS_OK(result)) {
1450                         talloc_free(drivers);
1451                         return True;
1452                 }
1453
1454                 /* check if d2 uses any files from d1 */
1455                 /* only if this is a different driver than the one being deleted */
1456
1457                 if (!strequal(info->driver_name, driver->driver_name)) {
1458                         if (trim_overlap_drv_files(mem_ctx, info, driver)) {
1459                                 /* mz: Do not instantly return -
1460                                  * we need to ensure this file isn't
1461                                  * also in use by other drivers. */
1462                                 in_use = true;
1463                         }
1464                 }
1465
1466                 talloc_free(driver);
1467         }
1468
1469         talloc_free(drivers);
1470
1471         DEBUG(5,("printer_driver_files_in_use: Completed search of drivers...\n"));
1472
1473         return in_use;
1474 }
1475
1476 static NTSTATUS driver_unlink_internals(connection_struct *conn,
1477                                         const char *name)
1478 {
1479         struct smb_filename *smb_fname = NULL;
1480         NTSTATUS status;
1481
1482         status = create_synthetic_smb_fname(talloc_tos(), name, NULL, NULL,
1483             &smb_fname);
1484         if (!NT_STATUS_IS_OK(status)) {
1485                 return status;
1486         }
1487
1488         status = unlink_internals(conn, NULL, 0, smb_fname, false);
1489
1490         TALLOC_FREE(smb_fname);
1491         return status;
1492 }
1493
1494 /****************************************************************************
1495   Actually delete the driver files.  Make sure that
1496   printer_driver_files_in_use() return False before calling
1497   this.
1498 ****************************************************************************/
1499
1500 bool delete_driver_files(const struct auth_session_info *session_info,
1501                          const struct spoolss_DriverInfo8 *r)
1502 {
1503         int i = 0;
1504         char *s;
1505         const char *file;
1506         connection_struct *conn;
1507         NTSTATUS nt_status;
1508         char *oldcwd;
1509         char *printdollar = NULL;
1510         int printdollar_snum;
1511         bool ret = false;
1512
1513         if (!r) {
1514                 return false;
1515         }
1516
1517         DEBUG(6,("delete_driver_files: deleting driver [%s] - version [%d]\n",
1518                 r->driver_name, r->version));
1519
1520         printdollar_snum = find_service(talloc_tos(), "print$", &printdollar);
1521         if (!printdollar) {
1522                 return false;
1523         }
1524         if (printdollar_snum == -1) {
1525                 return false;
1526         }
1527
1528         nt_status = create_conn_struct(talloc_tos(), smbd_server_conn, &conn,
1529                                        printdollar_snum,
1530                                        lp_pathname(printdollar_snum),
1531                                        session_info, &oldcwd);
1532         if (!NT_STATUS_IS_OK(nt_status)) {
1533                 DEBUG(0,("delete_driver_files: create_conn_struct "
1534                          "returned %s\n", nt_errstr(nt_status)));
1535                 return false;
1536         }
1537
1538         nt_status = set_conn_force_user_group(conn, printdollar_snum);
1539         if (!NT_STATUS_IS_OK(nt_status)) {
1540                 DEBUG(0, ("failed set force user / group\n"));
1541                 ret = false;
1542                 goto err_free_conn;
1543         }
1544
1545         if (!become_user_by_session(conn, session_info)) {
1546                 DEBUG(0, ("failed to become user\n"));
1547                 ret = false;
1548                 goto err_free_conn;
1549         }
1550
1551         if ( !CAN_WRITE(conn) ) {
1552                 DEBUG(3,("delete_driver_files: Cannot delete print driver when [print$] is read-only\n"));
1553                 ret = false;
1554                 goto err_out;
1555         }
1556
1557         /* now delete the files; must strip the '\print$' string from
1558            fron of path                                                */
1559
1560         if (r->driver_path && r->driver_path[0]) {
1561                 if ((s = strchr(&r->driver_path[1], '\\')) != NULL) {
1562                         file = s;
1563                         DEBUG(10,("deleting driverfile [%s]\n", s));
1564                         driver_unlink_internals(conn, file);
1565                 }
1566         }
1567
1568         if (r->config_file && r->config_file[0]) {
1569                 if ((s = strchr(&r->config_file[1], '\\')) != NULL) {
1570                         file = s;
1571                         DEBUG(10,("deleting configfile [%s]\n", s));
1572                         driver_unlink_internals(conn, file);
1573                 }
1574         }
1575
1576         if (r->data_file && r->data_file[0]) {
1577                 if ((s = strchr(&r->data_file[1], '\\')) != NULL) {
1578                         file = s;
1579                         DEBUG(10,("deleting datafile [%s]\n", s));
1580                         driver_unlink_internals(conn, file);
1581                 }
1582         }
1583
1584         if (r->help_file && r->help_file[0]) {
1585                 if ((s = strchr(&r->help_file[1], '\\')) != NULL) {
1586                         file = s;
1587                         DEBUG(10,("deleting helpfile [%s]\n", s));
1588                         driver_unlink_internals(conn, file);
1589                 }
1590         }
1591
1592         /* check if we are done removing files */
1593
1594         if (r->dependent_files) {
1595                 while (r->dependent_files[i] && r->dependent_files[i][0]) {
1596                         char *p;
1597
1598                         /* bypass the "\print$" portion of the path */
1599
1600                         if ((p = strchr(r->dependent_files[i]+1, '\\')) != NULL) {
1601                                 file = p;
1602                                 DEBUG(10,("deleting dependent file [%s]\n", file));
1603                                 driver_unlink_internals(conn, file);
1604                         }
1605
1606                         i++;
1607                 }
1608         }
1609
1610         ret = true;
1611  err_out:
1612         unbecome_user();
1613  err_free_conn:
1614         if (conn != NULL) {
1615                 vfs_ChDir(conn, oldcwd);
1616                 SMB_VFS_DISCONNECT(conn);
1617                 conn_free(conn);
1618         }
1619         return ret;
1620 }
1621
1622 /* error code:
1623         0: everything OK
1624         1: level not implemented
1625         2: file doesn't exist
1626         3: can't allocate memory
1627         4: can't free memory
1628         5: non existant struct
1629 */
1630
1631 /*
1632         A printer and a printer driver are 2 different things.
1633         NT manages them separatelly, Samba does the same.
1634         Why ? Simply because it's easier and it makes sense !
1635
1636         Now explanation: You have 3 printers behind your samba server,
1637         2 of them are the same make and model (laser A and B). But laser B
1638         has an 3000 sheet feeder and laser A doesn't such an option.
1639         Your third printer is an old dot-matrix model for the accounting :-).
1640
1641         If the /usr/local/samba/lib directory (default dir), you will have
1642         5 files to describe all of this.
1643
1644         3 files for the printers (1 by printer):
1645                 NTprinter_laser A
1646                 NTprinter_laser B
1647                 NTprinter_accounting
1648         2 files for the drivers (1 for the laser and 1 for the dot matrix)
1649                 NTdriver_printer model X
1650                 NTdriver_printer model Y
1651
1652 jfm: I should use this comment for the text file to explain
1653         same thing for the forms BTW.
1654         Je devrais mettre mes commentaires en francais, ca serait mieux :-)
1655
1656 */
1657
1658 /* Convert generic access rights to printer object specific access rights.
1659    It turns out that NT4 security descriptors use generic access rights and
1660    NT5 the object specific ones. */
1661
1662 void map_printer_permissions(struct security_descriptor *sd)
1663 {
1664         int i;
1665
1666         for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
1667                 se_map_generic(&sd->dacl->aces[i].access_mask,
1668                                &printer_generic_mapping);
1669         }
1670 }
1671
1672 void map_job_permissions(struct security_descriptor *sd)
1673 {
1674         int i;
1675
1676         for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
1677                 se_map_generic(&sd->dacl->aces[i].access_mask,
1678                                &job_generic_mapping);
1679         }
1680 }
1681
1682
1683 /****************************************************************************
1684  Check a user has permissions to perform the given operation.  We use the
1685  permission constants defined in include/rpc_spoolss.h to check the various
1686  actions we perform when checking printer access.
1687
1688    PRINTER_ACCESS_ADMINISTER:
1689        print_queue_pause, print_queue_resume, update_printer_sec,
1690        update_printer, spoolss_addprinterex_level_2,
1691        _spoolss_setprinterdata
1692
1693    PRINTER_ACCESS_USE:
1694        print_job_start
1695
1696    JOB_ACCESS_ADMINISTER:
1697        print_job_delete, print_job_pause, print_job_resume,
1698        print_queue_purge
1699
1700   Try access control in the following order (for performance reasons):
1701     1)  root and SE_PRINT_OPERATOR can do anything (easy check)
1702     2)  check security descriptor (bit comparisons in memory)
1703     3)  "printer admins" (may result in numerous calls to winbind)
1704
1705  ****************************************************************************/
1706 bool print_access_check(const struct auth_session_info *session_info,
1707                         struct messaging_context *msg_ctx, int snum,
1708                         int access_type)
1709 {
1710         struct spoolss_security_descriptor *secdesc = NULL;
1711         uint32 access_granted;
1712         size_t sd_size;
1713         NTSTATUS status;
1714         WERROR result;
1715         const char *pname;
1716         TALLOC_CTX *mem_ctx = NULL;
1717
1718         /* If user is NULL then use the current_user structure */
1719
1720         /* Always allow root or SE_PRINT_OPERATROR to do anything */
1721
1722         if (session_info->unix_token->uid == sec_initial_uid()
1723             || security_token_has_privilege(session_info->security_token, SEC_PRIV_PRINT_OPERATOR)) {
1724                 return True;
1725         }
1726
1727         /* Get printer name */
1728
1729         pname = lp_printername(snum);
1730
1731         if (!pname || !*pname) {
1732                 errno = EACCES;
1733                 return False;
1734         }
1735
1736         /* Get printer security descriptor */
1737
1738         if(!(mem_ctx = talloc_init("print_access_check"))) {
1739                 errno = ENOMEM;
1740                 return False;
1741         }
1742
1743         result = winreg_get_printer_secdesc_internal(mem_ctx,
1744                                             get_session_info_system(),
1745                                             msg_ctx,
1746                                             pname,
1747                                             &secdesc);
1748         if (!W_ERROR_IS_OK(result)) {
1749                 talloc_destroy(mem_ctx);
1750                 errno = ENOMEM;
1751                 return False;
1752         }
1753
1754         if (access_type == JOB_ACCESS_ADMINISTER) {
1755                 struct spoolss_security_descriptor *parent_secdesc = secdesc;
1756
1757                 /* Create a child security descriptor to check permissions
1758                    against.  This is because print jobs are child objects
1759                    objects of a printer. */
1760                 status = se_create_child_secdesc(mem_ctx,
1761                                                  &secdesc,
1762                                                  &sd_size,
1763                                                  parent_secdesc,
1764                                                  parent_secdesc->owner_sid,
1765                                                  parent_secdesc->group_sid,
1766                                                  false);
1767                 if (!NT_STATUS_IS_OK(status)) {
1768                         talloc_destroy(mem_ctx);
1769                         errno = map_errno_from_nt_status(status);
1770                         return False;
1771                 }
1772
1773                 map_job_permissions(secdesc);
1774         } else {
1775                 map_printer_permissions(secdesc);
1776         }
1777
1778         /* Check access */
1779         status = se_access_check(secdesc, session_info->security_token, access_type,
1780                                  &access_granted);
1781
1782         DEBUG(4, ("access check was %s\n", NT_STATUS_IS_OK(status) ? "SUCCESS" : "FAILURE"));
1783
1784         /* see if we need to try the printer admin list */
1785
1786         if (!NT_STATUS_IS_OK(status) &&
1787             (token_contains_name_in_list(uidtoname(session_info->unix_token->uid),
1788                                          session_info->info->domain_name,
1789                                          NULL, session_info->security_token,
1790                                          lp_printer_admin(snum)))) {
1791                 talloc_destroy(mem_ctx);
1792                 return True;
1793         }
1794
1795         talloc_destroy(mem_ctx);
1796
1797         if (!NT_STATUS_IS_OK(status)) {
1798                 errno = EACCES;
1799         }
1800
1801         return NT_STATUS_IS_OK(status);
1802 }
1803
1804 /****************************************************************************
1805  Check the time parameters allow a print operation.
1806 *****************************************************************************/
1807
1808 bool print_time_access_check(const struct auth_session_info *session_info,
1809                              struct messaging_context *msg_ctx,
1810                              const char *servicename)
1811 {
1812         struct spoolss_PrinterInfo2 *pinfo2 = NULL;
1813         WERROR result;
1814         bool ok = False;
1815         time_t now = time(NULL);
1816         struct tm *t;
1817         uint32 mins;
1818
1819         result = winreg_get_printer_internal(NULL, session_info, msg_ctx,
1820                                     servicename, &pinfo2);
1821         if (!W_ERROR_IS_OK(result)) {
1822                 return False;
1823         }
1824
1825         if (pinfo2->starttime == 0 && pinfo2->untiltime == 0) {
1826                 ok = True;
1827         }
1828
1829         t = gmtime(&now);
1830         mins = (uint32)t->tm_hour*60 + (uint32)t->tm_min;
1831
1832         if (mins >= pinfo2->starttime && mins <= pinfo2->untiltime) {
1833                 ok = True;
1834         }
1835
1836         TALLOC_FREE(pinfo2);
1837
1838         if (!ok) {
1839                 errno = EACCES;
1840         }
1841
1842         return ok;
1843 }
1844
1845 void nt_printer_remove(TALLOC_CTX *mem_ctx,
1846                         const struct auth_session_info *session_info,
1847                         struct messaging_context *msg_ctx,
1848                         const char *printer)
1849 {
1850         WERROR result;
1851
1852         result = winreg_delete_printer_key_internal(mem_ctx, session_info, msg_ctx,
1853                                            printer, "");
1854         if (!W_ERROR_IS_OK(result)) {
1855                 DEBUG(0, ("nt_printer_remove: failed to remove rpinter %s",
1856                           printer));
1857         }
1858 }