+ /* access check */
+ if (get_current_uid(conn) != sec_initial_uid()) {
+ DEBUG(1,("get_user_quota: access_denied service [%s] user "
+ "[%s]\n", lp_servicename(talloc_tos(), lp_sub, SNUM(conn)),
+ conn->session_info->unix_info->unix_name));
+ nt_status = NT_STATUS_ACCESS_DENIED;
+ goto error;
+ }
+
+ blob.data = (uint8_t*)params;
+ blob.length = parameter_count;
+
+ err = ndr_pull_struct_blob(&blob, tmp_ctx, &info,
+ (ndr_pull_flags_fn_t)ndr_pull_nttrans_query_quota_params);
+
+ if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
+ DEBUG(0,("TRANSACT_GET_USER_QUOTA: failed to pull "
+ "query_quota_params."));
+ nt_status = NT_STATUS_INVALID_PARAMETER;
+ goto error;
+ }
+ DBG_DEBUG("info.return_single_entry = %u, info.restart_scan = %u, "
+ "info.sid_list_length = %u, info.start_sid_length = %u, "
+ "info.start_sid_offset = %u\n",
+ (unsigned int)info.return_single_entry,
+ (unsigned int)info.restart_scan,
+ (unsigned int)info.sid_list_length,
+ (unsigned int)info.start_sid_length,
+ (unsigned int)info.start_sid_offset);
+
+ /* set blob to point at data for further parsing */
+ blob.data = (uint8_t*)pdata;
+ blob.length = data_count;
+ /*
+ * Although MS-SMB ref is ambiguous here, a microsoft client will
+ * only ever send a start sid (as part of a list) with
+ * sid_list_length & start_sid_offset both set to the actual list
+ * length. Note: Only a single result is returned in this case
+ * In the case where either start_sid_offset or start_sid_length
+ * are set alone or if both set (but have different values) then
+ * it seems windows will return a number of entries from the start
+ * of the list of users with quotas set. This behaviour is undocumented
+ * and windows clients do not send messages of that type. As such we
+ * currently will reject these requests.
+ */
+ if (info.start_sid_length
+ || (info.sid_list_length != info.start_sid_offset)) {
+ DBG_ERR("TRANSACT_GET_USER_QUOTA: unsupported single or "
+ "compound sid format\n");
+ nt_status = NT_STATUS_INVALID_PARAMETER;
+ goto error;
+ }