source3/printing/nt_printing.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-2000,
   5  *  Copyright (C) Jean François Micouleau      1998-2000.
   6  *  Copyright (C) Gerald Carter                2002-2005.
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23 #include "printing/nt_printing_tdb.h"
  24 #include "../librpc/gen_ndr/ndr_spoolss.h"
  25 #include "rpc_server/spoolss/srv_spoolss_util.h"
  26 #include "nt_printing.h"
  27 #include "secrets.h"
  28 #include "../librpc/gen_ndr/netlogon.h"
  29 #include "../libcli/security/security.h"
  30 #include "passdb/machine_sid.h"
  31 #include "smbd/smbd.h"
  32 #include "smbd/globals.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  36 #include "rpc_client/cli_winreg_spoolss.h"
  37
  38 /* Map generic permissions to printer object specific permissions */
  39
  40 const struct generic_mapping printer_generic_mapping = {
  41         PRINTER_READ,
  42         PRINTER_WRITE,
  43         PRINTER_EXECUTE,
  44         PRINTER_ALL_ACCESS
  45 };
  46
  47 /* Map generic permissions to print server object specific permissions */
  48
  49 const struct generic_mapping printserver_generic_mapping = {
  50         SERVER_READ,
  51         SERVER_WRITE,
  52         SERVER_EXECUTE,
  53         SERVER_ALL_ACCESS
  54 };
  55
  56 /* Map generic permissions to job object specific permissions */
  57
  58 const struct generic_mapping job_generic_mapping = {
  59         JOB_READ,
  60         JOB_WRITE,
  61         JOB_EXECUTE,
  62         JOB_ALL_ACCESS
  63 };
  64
  65 static const struct print_architecture_table_node archi_table[]= {
  66
  67         {"Windows 4.0",          SPL_ARCH_WIN40,        0 },
  68         {"Windows NT x86",       SPL_ARCH_W32X86,       2 },
  69         {"Windows NT R4000",     SPL_ARCH_W32MIPS,      2 },
  70         {"Windows NT Alpha_AXP", SPL_ARCH_W32ALPHA,     2 },
  71         {"Windows NT PowerPC",   SPL_ARCH_W32PPC,       2 },
  72         {"Windows IA64",         SPL_ARCH_IA64,         3 },
  73         {"Windows x64",          SPL_ARCH_X64,          3 },
  74         {NULL,                   "",            -1 }
  75 };
  76
  77 /****************************************************************************
  78  Open the NT printing tdbs. Done once before fork().
  79 ****************************************************************************/
  80
  81 bool nt_printing_init(struct messaging_context *msg_ctx)
  82 {
  83         WERROR win_rc;
  84
  85         if (!nt_printing_tdb_upgrade()) {
  86                 return false;
  87         }
  88
  89         /*
  90          * register callback to handle updating printers as new
  91          * drivers are installed
  92          */
  93         messaging_register(msg_ctx, NULL, MSG_PRINTER_DRVUPGRADE,
  94                            do_drv_upgrade_printer);
  95
  96         /* of course, none of the message callbacks matter if you don't
  97            tell messages.c that you interested in receiving PRINT_GENERAL
  98            msgs.  This is done in serverid_register() */
  99
 100         if ( lp_security() == SEC_ADS ) {
 101                 win_rc = check_published_printers(msg_ctx);
 102                 if (!W_ERROR_IS_OK(win_rc))
 103                         DEBUG(0, ("nt_printing_init: error checking published printers: %s\n", win_errstr(win_rc)));
 104         }
 105
 106         return true;
 107 }
 108
 109 /*******************************************************************
 110  Function to allow filename parsing "the old way".
 111 ********************************************************************/
 112
 113 static NTSTATUS driver_unix_convert(connection_struct *conn,
 114                                     const char *old_name,
 115                                     struct smb_filename **smb_fname)
 116 {
 117         NTSTATUS status;
 118         TALLOC_CTX *ctx = talloc_tos();
 119         char *name = talloc_strdup(ctx, old_name);
 120
 121         if (!name) {
 122                 return NT_STATUS_NO_MEMORY;
 123         }
 124         unix_format(name);
 125         name = unix_clean_name(ctx, name);
 126         if (!name) {
 127                 return NT_STATUS_NO_MEMORY;
 128         }
 129         trim_string(name,"/","/");
 130
 131         status = unix_convert(ctx, conn, name, smb_fname, 0);
 132         if (!NT_STATUS_IS_OK(status)) {
 133                 return NT_STATUS_NO_MEMORY;
 134         }
 135
 136         return NT_STATUS_OK;
 137 }
 138
 139 /****************************************************************************
 140  Function to do the mapping between the long architecture name and
 141  the short one.
 142 ****************************************************************************/
 143
 144 const char *get_short_archi(const char *long_archi)
 145 {
 146         int i=-1;
 147
 148         DEBUG(107,("Getting architecture dependent directory\n"));
 149         do {
 150                 i++;
 151         } while ( (archi_table[i].long_archi!=NULL ) &&
 152                   strcasecmp_m(long_archi, archi_table[i].long_archi) );
 153
 154         if (archi_table[i].long_archi==NULL) {
 155                 DEBUGADD(10,("Unknown architecture [%s] !\n", long_archi));
 156                 return NULL;
 157         }
 158
 159         /* this might be client code - but shouldn't this be an fstrcpy etc? */
 160
 161         DEBUGADD(108,("index: [%d]\n", i));
 162         DEBUGADD(108,("long architecture: [%s]\n", archi_table[i].long_archi));
 163         DEBUGADD(108,("short architecture: [%s]\n", archi_table[i].short_archi));
 164
 165         return archi_table[i].short_archi;
 166 }
 167
 168 /****************************************************************************
 169  Version information in Microsoft files is held in a VS_VERSION_INFO structure.
 170  There are two case to be covered here: PE (Portable Executable) and NE (New
 171  Executable) files. Both files support the same INFO structure, but PE files
 172  store the signature in unicode, and NE files store it as !unicode.
 173  returns -1 on error, 1 on version info found, and 0 on no version info found.
 174 ****************************************************************************/
 175
 176 static int get_file_version(files_struct *fsp, char *fname,uint32 *major, uint32 *minor)
 177 {
 178         int     i;
 179         char    *buf = NULL;
 180         ssize_t byte_count;
 181
 182         if ((buf=(char *)SMB_MALLOC(DOS_HEADER_SIZE)) == NULL) {
 183                 DEBUG(0,("get_file_version: PE file [%s] DOS Header malloc failed bytes = %d\n",
 184                                 fname, DOS_HEADER_SIZE));
 185                 goto error_exit;
 186         }
 187
 188         if ((byte_count = vfs_read_data(fsp, buf, DOS_HEADER_SIZE)) < DOS_HEADER_SIZE) {
 189                 DEBUG(3,("get_file_version: File [%s] DOS header too short, bytes read = %lu\n",
 190                          fname, (unsigned long)byte_count));
 191                 goto no_version_info;
 192         }
 193
 194         /* Is this really a DOS header? */
 195         if (SVAL(buf,DOS_HEADER_MAGIC_OFFSET) != DOS_HEADER_MAGIC) {
 196                 DEBUG(6,("get_file_version: File [%s] bad DOS magic = 0x%x\n",
 197                                 fname, SVAL(buf,DOS_HEADER_MAGIC_OFFSET)));
 198                 goto no_version_info;
 199         }
 200
 201         /* Skip OEM header (if any) and the DOS stub to start of Windows header */
 202         if (SMB_VFS_LSEEK(fsp, SVAL(buf,DOS_HEADER_LFANEW_OFFSET), SEEK_SET) == (off_t)-1) {
 203                 DEBUG(3,("get_file_version: File [%s] too short, errno = %d\n",
 204                                 fname, errno));
 205                 /* Assume this isn't an error... the file just looks sort of like a PE/NE file */
 206                 goto no_version_info;
 207         }
 208
 209         /* Note: DOS_HEADER_SIZE and NE_HEADER_SIZE are incidentally same */
 210         if ((byte_count = vfs_read_data(fsp, buf, NE_HEADER_SIZE)) < NE_HEADER_SIZE) {
 211                 DEBUG(3,("get_file_version: File [%s] Windows header too short, bytes read = %lu\n",
 212                          fname, (unsigned long)byte_count));
 213                 /* Assume this isn't an error... the file just looks sort of like a PE/NE file */
 214                 goto no_version_info;
 215         }
 216
 217         /* The header may be a PE (Portable Executable) or an NE (New Executable) */
 218         if (IVAL(buf,PE_HEADER_SIGNATURE_OFFSET) == PE_HEADER_SIGNATURE) {
 219                 unsigned int num_sections;
 220                 unsigned int section_table_bytes;
 221
 222                 /* Just skip over optional header to get to section table */
 223                 if (SMB_VFS_LSEEK(fsp,
 224                                 SVAL(buf,PE_HEADER_OPTIONAL_HEADER_SIZE)-(NE_HEADER_SIZE-PE_HEADER_SIZE),
 225                                 SEEK_CUR) == (off_t)-1) {
 226                         DEBUG(3,("get_file_version: File [%s] Windows optional header too short, errno = %d\n",
 227                                 fname, errno));
 228                         goto error_exit;
 229                 }
 230
 231                 /* get the section table */
 232                 num_sections        = SVAL(buf,PE_HEADER_NUMBER_OF_SECTIONS);
 233                 section_table_bytes = num_sections * PE_HEADER_SECT_HEADER_SIZE;
 234                 if (section_table_bytes == 0)
 235                         goto error_exit;
 236
 237                 SAFE_FREE(buf);
 238                 if ((buf=(char *)SMB_MALLOC(section_table_bytes)) == NULL) {
 239                         DEBUG(0,("get_file_version: PE file [%s] section table malloc failed bytes = %d\n",
 240                                         fname, section_table_bytes));
 241                         goto error_exit;
 242                 }
 243
 244                 if ((byte_count = vfs_read_data(fsp, buf, section_table_bytes)) < section_table_bytes) {
 245                         DEBUG(3,("get_file_version: PE file [%s] Section header too short, bytes read = %lu\n",
 246                                  fname, (unsigned long)byte_count));
 247                         goto error_exit;
 248                 }
 249
 250                 /* Iterate the section table looking for the resource section ".rsrc" */
 251                 for (i = 0; i < num_sections; i++) {
 252                         int sec_offset = i * PE_HEADER_SECT_HEADER_SIZE;
 253
 254                         if (strcmp(".rsrc", &buf[sec_offset+PE_HEADER_SECT_NAME_OFFSET]) == 0) {
 255                                 unsigned int section_pos   = IVAL(buf,sec_offset+PE_HEADER_SECT_PTR_DATA_OFFSET);
 256                                 unsigned int section_bytes = IVAL(buf,sec_offset+PE_HEADER_SECT_SIZE_DATA_OFFSET);
 257
 258                                 if (section_bytes == 0)
 259                                         goto error_exit;
 260
 261                                 SAFE_FREE(buf);
 262                                 if ((buf=(char *)SMB_MALLOC(section_bytes)) == NULL) {
 263                                         DEBUG(0,("get_file_version: PE file [%s] version malloc failed bytes = %d\n",
 264                                                         fname, section_bytes));
 265                                         goto error_exit;
 266                                 }
 267
 268                                 /* Seek to the start of the .rsrc section info */
 269                                 if (SMB_VFS_LSEEK(fsp, section_pos, SEEK_SET) == (off_t)-1) {
 270                                         DEBUG(3,("get_file_version: PE file [%s] too short for section info, errno = %d\n",
 271                                                         fname, errno));
 272                                         goto error_exit;
 273                                 }
 274
 275                                 if ((byte_count = vfs_read_data(fsp, buf, section_bytes)) < section_bytes) {
 276                                         DEBUG(3,("get_file_version: PE file [%s] .rsrc section too short, bytes read = %lu\n",
 277                                                  fname, (unsigned long)byte_count));
 278                                         goto error_exit;
 279                                 }
 280
 281                                 if (section_bytes < VS_VERSION_INFO_UNICODE_SIZE)
 282                                         goto error_exit;
 283
 284                                 for (i=0; i<section_bytes-VS_VERSION_INFO_UNICODE_SIZE; i++) {
 285                                         /* Scan for 1st 3 unicoded bytes followed by word aligned magic value */
 286                                         if (buf[i] == 'V' && buf[i+1] == '\0' && buf[i+2] == 'S') {
 287                                                 /* Align to next long address */
 288                                                 int pos = (i + sizeof(VS_SIGNATURE)*2 + 3) & 0xfffffffc;
 289
 290                                                 if (IVAL(buf,pos) == VS_MAGIC_VALUE) {
 291                                                         *major = IVAL(buf,pos+VS_MAJOR_OFFSET);
 292                                                         *minor = IVAL(buf,pos+VS_MINOR_OFFSET);
 293
 294                                                         DEBUG(6,("get_file_version: PE file [%s] Version = %08x:%08x (%d.%d.%d.%d)\n",
 295                                                                           fname, *major, *minor,
 296                                                                           (*major>>16)&0xffff, *major&0xffff,
 297                                                                           (*minor>>16)&0xffff, *minor&0xffff));
 298                                                         SAFE_FREE(buf);
 299                                                         return 1;
 300                                                 }
 301                                         }
 302                                 }
 303                         }
 304                 }
 305
 306                 /* Version info not found, fall back to origin date/time */
 307                 DEBUG(10,("get_file_version: PE file [%s] has no version info\n", fname));
 308                 SAFE_FREE(buf);
 309                 return 0;
 310
 311         } else if (SVAL(buf,NE_HEADER_SIGNATURE_OFFSET) == NE_HEADER_SIGNATURE) {
 312                 if (CVAL(buf,NE_HEADER_TARGET_OS_OFFSET) != NE_HEADER_TARGOS_WIN ) {
 313                         DEBUG(3,("get_file_version: NE file [%s] wrong target OS = 0x%x\n",
 314                                         fname, CVAL(buf,NE_HEADER_TARGET_OS_OFFSET)));
 315                         /* At this point, we assume the file is in error. It still could be somthing
 316                          * else besides a NE file, but it unlikely at this point. */
 317                         goto error_exit;
 318                 }
 319
 320                 /* Allocate a bit more space to speed up things */
 321                 SAFE_FREE(buf);
 322                 if ((buf=(char *)SMB_MALLOC(VS_NE_BUF_SIZE)) == NULL) {
 323                         DEBUG(0,("get_file_version: NE file [%s] malloc failed bytes  = %d\n",
 324                                         fname, PE_HEADER_SIZE));
 325                         goto error_exit;
 326                 }
 327
 328                 /* This is a HACK! I got tired of trying to sort through the messy
 329                  * 'NE' file format. If anyone wants to clean this up please have at
 330                  * it, but this works. 'NE' files will eventually fade away. JRR */
 331                 while((byte_count = vfs_read_data(fsp, buf, VS_NE_BUF_SIZE)) > 0) {
 332                         /* Cover case that should not occur in a well formed 'NE' .dll file */
 333                         if (byte_count-VS_VERSION_INFO_SIZE <= 0) break;
 334
 335                         for(i=0; i<byte_count; i++) {
 336                                 /* Fast skip past data that can't possibly match */
 337                                 if (buf[i] != 'V') continue;
 338
 339                                 /* Potential match data crosses buf boundry, move it to beginning
 340                                  * of buf, and fill the buf with as much as it will hold. */
 341                                 if (i>byte_count-VS_VERSION_INFO_SIZE) {
 342                                         int bc;
 343
 344                                         memcpy(buf, &buf[i], byte_count-i);
 345                                         if ((bc = vfs_read_data(fsp, &buf[byte_count-i], VS_NE_BUF_SIZE-
 346                                                                    (byte_count-i))) < 0) {
 347
 348                                                 DEBUG(0,("get_file_version: NE file [%s] Read error, errno=%d\n",
 349                                                                  fname, errno));
 350                                                 goto error_exit;
 351                                         }
 352
 353                                         byte_count = bc + (byte_count - i);
 354                                         if (byte_count<VS_VERSION_INFO_SIZE) break;
 355
 356                                         i = 0;
 357                                 }
 358
 359                                 /* Check that the full signature string and the magic number that
 360                                  * follows exist (not a perfect solution, but the chances that this
 361                                  * occurs in code is, well, remote. Yes I know I'm comparing the 'V'
 362                                  * twice, as it is simpler to read the code. */
 363                                 if (strcmp(&buf[i], VS_SIGNATURE) == 0) {
 364                                         /* Compute skip alignment to next long address */
 365                                         int skip = -(SMB_VFS_LSEEK(fsp, 0, SEEK_CUR) - (byte_count - i) +
 366                                                                  sizeof(VS_SIGNATURE)) & 3;
 367                                         if (IVAL(buf,i+sizeof(VS_SIGNATURE)+skip) != 0xfeef04bd) continue;
 368
 369                                         *major = IVAL(buf,i+sizeof(VS_SIGNATURE)+skip+VS_MAJOR_OFFSET);
 370                                         *minor = IVAL(buf,i+sizeof(VS_SIGNATURE)+skip+VS_MINOR_OFFSET);
 371                                         DEBUG(6,("get_file_version: NE file [%s] Version = %08x:%08x (%d.%d.%d.%d)\n",
 372                                                           fname, *major, *minor,
 373                                                           (*major>>16)&0xffff, *major&0xffff,
 374                                                           (*minor>>16)&0xffff, *minor&0xffff));
 375                                         SAFE_FREE(buf);
 376                                         return 1;
 377                                 }
 378                         }
 379                 }
 380
 381                 /* Version info not found, fall back to origin date/time */
 382                 DEBUG(0,("get_file_version: NE file [%s] Version info not found\n", fname));
 383                 SAFE_FREE(buf);
 384                 return 0;
 385
 386         } else
 387                 /* Assume this isn't an error... the file just looks sort of like a PE/NE file */
 388                 DEBUG(3,("get_file_version: File [%s] unknown file format, signature = 0x%x\n",
 389                                 fname, IVAL(buf,PE_HEADER_SIGNATURE_OFFSET)));
 390
 391         no_version_info:
 392                 SAFE_FREE(buf);
 393                 return 0;
 394
 395         error_exit:
 396                 SAFE_FREE(buf);
 397                 return -1;
 398 }
 399
 400 /****************************************************************************
 401 Drivers for Microsoft systems contain multiple files. Often, multiple drivers
 402 share one or more files. During the MS installation process files are checked
 403 to insure that only a newer version of a shared file is installed over an
 404 older version. There are several possibilities for this comparison. If there
 405 is no previous version, the new one is newer (obviously). If either file is
 406 missing the version info structure, compare the creation date (on Unix use
 407 the modification date). Otherwise chose the numerically larger version number.
 408 ****************************************************************************/
 409
 410 static int file_version_is_newer(connection_struct *conn, fstring new_file, fstring old_file)
 411 {
 412         bool use_version = true;
 413
 414         uint32 new_major;
 415         uint32 new_minor;
 416         time_t new_create_time;
 417
 418         uint32 old_major;
 419         uint32 old_minor;
 420         time_t old_create_time;
 421
 422         struct smb_filename *smb_fname = NULL;
 423         files_struct    *fsp = NULL;
 424         SMB_STRUCT_STAT st;
 425
 426         NTSTATUS status;
 427         int ret;
 428
 429         SET_STAT_INVALID(st);
 430         new_create_time = (time_t)0;
 431         old_create_time = (time_t)0;
 432
 433         /* Get file version info (if available) for previous file (if it exists) */
 434         status = driver_unix_convert(conn, old_file, &smb_fname);
 435         if (!NT_STATUS_IS_OK(status)) {
 436                 goto error_exit;
 437         }
 438
 439         status = SMB_VFS_CREATE_FILE(
 440                 conn,                                   /* conn */
 441                 NULL,                                   /* req */
 442                 0,                                      /* root_dir_fid */
 443                 smb_fname,                              /* fname */
 444                 FILE_GENERIC_READ,                      /* access_mask */
 445                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
 446                 FILE_OPEN,                              /* create_disposition*/
 447                 0,                                      /* create_options */
 448                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
 449                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
 450                 0,                                      /* allocation_size */
 451                 0,                                      /* private_flags */
 452                 NULL,                                   /* sd */
 453                 NULL,                                   /* ea_list */
 454                 &fsp,                                   /* result */
 455                 NULL);                                  /* pinfo */
 456
 457         if (!NT_STATUS_IS_OK(status)) {
 458                 /* Old file not found, so by definition new file is in fact newer */
 459                 DEBUG(10,("file_version_is_newer: Can't open old file [%s], "
 460                           "errno = %d\n", smb_fname_str_dbg(smb_fname),
 461                           errno));
 462                 ret = 1;
 463                 goto done;
 464
 465         } else {
 466                 ret = get_file_version(fsp, old_file, &old_major, &old_minor);
 467                 if (ret == -1) {
 468                         goto error_exit;
 469                 }
 470
 471                 if (!ret) {
 472                         DEBUG(6,("file_version_is_newer: Version info not found [%s], use mod time\n",
 473                                          old_file));
 474                         use_version = false;
 475                         if (SMB_VFS_FSTAT(fsp, &st) == -1) {
 476                                  goto error_exit;
 477                         }
 478                         old_create_time = convert_timespec_to_time_t(st.st_ex_mtime);
 479                         DEBUGADD(6,("file_version_is_newer: mod time = %ld sec\n",
 480                                 (long)old_create_time));
 481                 }
 482         }
 483         close_file(NULL, fsp, NORMAL_CLOSE);
 484         fsp = NULL;
 485
 486         /* Get file version info (if available) for new file */
 487         status = driver_unix_convert(conn, new_file, &smb_fname);
 488         if (!NT_STATUS_IS_OK(status)) {
 489                 goto error_exit;
 490         }
 491
 492         status = SMB_VFS_CREATE_FILE(
 493                 conn,                                   /* conn */
 494                 NULL,                                   /* req */
 495                 0,                                      /* root_dir_fid */
 496                 smb_fname,                              /* fname */
 497                 FILE_GENERIC_READ,                      /* access_mask */
 498                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
 499                 FILE_OPEN,                              /* create_disposition*/
 500                 0,                                      /* create_options */
 501                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
 502                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
 503                 0,                                      /* allocation_size */
 504                 0,                                      /* private_flags */
 505                 NULL,                                   /* sd */
 506                 NULL,                                   /* ea_list */
 507                 &fsp,                                   /* result */
 508                 NULL);                                  /* pinfo */
 509
 510         if (!NT_STATUS_IS_OK(status)) {
 511                 /* New file not found, this shouldn't occur if the caller did its job */
 512                 DEBUG(3,("file_version_is_newer: Can't open new file [%s], "
 513                          "errno = %d\n", smb_fname_str_dbg(smb_fname), errno));
 514                 goto error_exit;
 515
 516         } else {
 517                 ret = get_file_version(fsp, new_file, &new_major, &new_minor);
 518                 if (ret == -1) {
 519                         goto error_exit;
 520                 }
 521
 522                 if (!ret) {
 523                         DEBUG(6,("file_version_is_newer: Version info not found [%s], use mod time\n",
 524                                          new_file));
 525                         use_version = false;
 526                         if (SMB_VFS_FSTAT(fsp, &st) == -1) {
 527                                 goto error_exit;
 528                         }
 529                         new_create_time = convert_timespec_to_time_t(st.st_ex_mtime);
 530                         DEBUGADD(6,("file_version_is_newer: mod time = %ld sec\n",
 531                                 (long)new_create_time));
 532                 }
 533         }
 534         close_file(NULL, fsp, NORMAL_CLOSE);
 535         fsp = NULL;
 536
 537         if (use_version && (new_major != old_major || new_minor != old_minor)) {
 538                 /* Compare versions and choose the larger version number */
 539                 if (new_major > old_major ||
 540                         (new_major == old_major && new_minor > old_minor)) {
 541
 542                         DEBUG(6,("file_version_is_newer: Replacing [%s] with [%s]\n", old_file, new_file));
 543                         ret = 1;
 544                         goto done;
 545                 }
 546                 else {
 547                         DEBUG(6,("file_version_is_newer: Leaving [%s] unchanged\n", old_file));
 548                         ret = 0;
 549                         goto done;
 550                 }
 551
 552         } else {
 553                 /* Compare modification time/dates and choose the newest time/date */
 554                 if (new_create_time > old_create_time) {
 555                         DEBUG(6,("file_version_is_newer: Replacing [%s] with [%s]\n", old_file, new_file));
 556                         ret = 1;
 557                         goto done;
 558                 }
 559                 else {
 560                         DEBUG(6,("file_version_is_newer: Leaving [%s] unchanged\n", old_file));
 561                         ret = 0;
 562                         goto done;
 563                 }
 564         }
 565
 566  error_exit:
 567         if(fsp)
 568                 close_file(NULL, fsp, NORMAL_CLOSE);
 569         ret = -1;
 570  done:
 571         TALLOC_FREE(smb_fname);
 572         return ret;
 573 }
 574
 575 /****************************************************************************
 576 Determine the correct cVersion associated with an architecture and driver
 577 ****************************************************************************/
 578 static uint32 get_correct_cversion(struct auth_session_info *session_info,
 579                                    const char *architecture,
 580                                    const char *driverpath_in,
 581                                    WERROR *perr)
 582 {
 583         int cversion = -1;
 584         NTSTATUS          nt_status;
 585         struct smb_filename *smb_fname = NULL;
 586         char *driverpath = NULL;
 587         files_struct      *fsp = NULL;
 588         connection_struct *conn = NULL;
 589         char *oldcwd;
 590         char *printdollar = NULL;
 591         int printdollar_snum;
 592
 593         *perr = WERR_INVALID_PARAM;
 594
 595         /* If architecture is Windows 95/98/ME, the version is always 0. */
 596         if (strcmp(architecture, SPL_ARCH_WIN40) == 0) {
 597                 DEBUG(10,("get_correct_cversion: Driver is Win9x, cversion = 0\n"));
 598                 *perr = WERR_OK;
 599                 return 0;
 600         }
 601
 602         /* If architecture is Windows x64, the version is always 3. */
 603         if (strcmp(architecture, SPL_ARCH_X64) == 0) {
 604                 DEBUG(10,("get_correct_cversion: Driver is x64, cversion = 3\n"));
 605                 *perr = WERR_OK;
 606                 return 3;
 607         }
 608
 609         printdollar_snum = find_service(talloc_tos(), "print$", &printdollar);
 610         if (!printdollar) {
 611                 *perr = WERR_NOMEM;
 612                 return -1;
 613         }
 614         if (printdollar_snum == -1) {
 615                 *perr = WERR_NO_SUCH_SHARE;
 616                 return -1;
 617         }
 618
 619         nt_status = create_conn_struct_cwd(talloc_tos(),
 620                                        server_event_context(),
 621                                        server_messaging_context(),
 622                                        &conn,
 623                                        printdollar_snum,
 624                                        lp_pathname(talloc_tos(), printdollar_snum),
 625                                        session_info, &oldcwd);
 626         if (!NT_STATUS_IS_OK(nt_status)) {
 627                 DEBUG(0,("get_correct_cversion: create_conn_struct "
 628                          "returned %s\n", nt_errstr(nt_status)));
 629                 *perr = ntstatus_to_werror(nt_status);
 630                 return -1;
 631         }
 632
 633         nt_status = set_conn_force_user_group(conn, printdollar_snum);
 634         if (!NT_STATUS_IS_OK(nt_status)) {
 635                 DEBUG(0, ("failed set force user / group\n"));
 636                 *perr = ntstatus_to_werror(nt_status);
 637                 goto error_free_conn;
 638         }
 639
 640         if (!become_user_by_session(conn, session_info)) {
 641                 DEBUG(0, ("failed to become user\n"));
 642                 *perr = WERR_ACCESS_DENIED;
 643                 goto error_free_conn;
 644         }
 645
 646         /* Open the driver file (Portable Executable format) and determine the
 647          * deriver the cversion. */
 648         driverpath = talloc_asprintf(talloc_tos(),
 649                                         "%s/%s",
 650                                         architecture,
 651                                         driverpath_in);
 652         if (!driverpath) {
 653                 *perr = WERR_NOMEM;
 654                 goto error_exit;
 655         }
 656
 657         nt_status = driver_unix_convert(conn, driverpath, &smb_fname);
 658         if (!NT_STATUS_IS_OK(nt_status)) {
 659                 *perr = ntstatus_to_werror(nt_status);
 660                 goto error_exit;
 661         }
 662
 663         nt_status = vfs_file_exist(conn, smb_fname);
 664         if (!NT_STATUS_IS_OK(nt_status)) {
 665                 DEBUG(3,("get_correct_cversion: vfs_file_exist failed\n"));
 666                 *perr = WERR_BADFILE;
 667                 goto error_exit;
 668         }
 669
 670         nt_status = SMB_VFS_CREATE_FILE(
 671                 conn,                                   /* conn */
 672                 NULL,                                   /* req */
 673                 0,                                      /* root_dir_fid */
 674                 smb_fname,                              /* fname */
 675                 FILE_GENERIC_READ,                      /* access_mask */
 676                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
 677                 FILE_OPEN,                              /* create_disposition*/
 678                 0,                                      /* create_options */
 679                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
 680                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
 681                 0,                                      /* private_flags */
 682                 0,                                      /* allocation_size */
 683                 NULL,                                   /* sd */
 684                 NULL,                                   /* ea_list */
 685                 &fsp,                                   /* result */
 686                 NULL);                                  /* pinfo */
 687
 688         if (!NT_STATUS_IS_OK(nt_status)) {
 689                 DEBUG(3,("get_correct_cversion: Can't open file [%s], errno = "
 690                          "%d\n", smb_fname_str_dbg(smb_fname), errno));
 691                 *perr = WERR_ACCESS_DENIED;
 692                 goto error_exit;
 693         } else {
 694                 uint32 major;
 695                 uint32 minor;
 696                 int    ret;
 697
 698                 ret = get_file_version(fsp, smb_fname->base_name, &major, &minor);
 699                 if (ret == -1) {
 700                         *perr = WERR_INVALID_PARAM;
 701                         goto error_exit;
 702                 } else if (!ret) {
 703                         DEBUG(6,("get_correct_cversion: Version info not "
 704                                  "found [%s]\n",
 705                                  smb_fname_str_dbg(smb_fname)));
 706                         *perr = WERR_INVALID_PARAM;
 707                         goto error_exit;
 708                 }
 709
 710                 /*
 711                  * This is a Microsoft'ism. See references in MSDN to VER_FILEVERSION
 712                  * for more details. Version in this case is not just the version of the
 713                  * file, but the version in the sense of kernal mode (2) vs. user mode
 714                  * (3) drivers. Other bits of the version fields are the version info.
 715                  * JRR 010716
 716                 */
 717                 cversion = major & 0x0000ffff;
 718                 switch (cversion) {
 719                         case 2: /* WinNT drivers */
 720                         case 3: /* Win2K drivers */
 721                                 break;
 722
 723                         default:
 724                                 DEBUG(6,("get_correct_cversion: cversion "
 725                                          "invalid [%s]  cversion = %d\n",
 726                                          smb_fname_str_dbg(smb_fname),
 727                                          cversion));
 728                                 goto error_exit;
 729                 }
 730
 731                 DEBUG(10,("get_correct_cversion: Version info found [%s] major"
 732                           " = 0x%x  minor = 0x%x\n",
 733                           smb_fname_str_dbg(smb_fname), major, minor));
 734         }
 735
 736         DEBUG(10,("get_correct_cversion: Driver file [%s] cversion = %d\n",
 737                   smb_fname_str_dbg(smb_fname), cversion));
 738         *perr = WERR_OK;
 739
 740  error_exit:
 741         unbecome_user();
 742  error_free_conn:
 743         TALLOC_FREE(smb_fname);
 744         if (fsp != NULL) {
 745                 close_file(NULL, fsp, NORMAL_CLOSE);
 746         }
 747         if (conn != NULL) {
 748                 vfs_ChDir(conn, oldcwd);
 749                 SMB_VFS_DISCONNECT(conn);
 750                 conn_free(conn);
 751         }
 752         if (!W_ERROR_IS_OK(*perr)) {
 753                 cversion = -1;
 754         }
 755
 756         return cversion;
 757 }
 758
 759 /****************************************************************************
 760 ****************************************************************************/
 761
 762 #define strip_driver_path(_mem_ctx, _element) do { \
 763         if (_element && ((_p = strrchr((_element), '\\')) != NULL)) { \
 764                 (_element) = talloc_asprintf((_mem_ctx), "%s", _p+1); \
 765                 W_ERROR_HAVE_NO_MEMORY((_element)); \
 766         } \
 767 } while (0);
 768
 769 static WERROR clean_up_driver_struct_level(TALLOC_CTX *mem_ctx,
 770                                            struct auth_session_info *session_info,
 771                                            const char *architecture,
 772                                            const char **driver_path,
 773                                            const char **data_file,
 774                                            const char **config_file,
 775                                            const char **help_file,
 776                                            struct spoolss_StringArray *dependent_files,
 777                                            enum spoolss_DriverOSVersion *version)
 778 {
 779         const char *short_architecture;
 780         int i;
 781         WERROR err;
 782         char *_p;
 783
 784         if (!*driver_path || !*data_file) {
 785                 return WERR_INVALID_PARAM;
 786         }
 787
 788         if (!strequal(architecture, SPOOLSS_ARCHITECTURE_4_0) && !*config_file) {
 789                 return WERR_INVALID_PARAM;
 790         }
 791
 792         /* clean up the driver name.
 793          * we can get .\driver.dll
 794          * or worse c:\windows\system\driver.dll !
 795          */
 796         /* using an intermediate string to not have overlaping memcpy()'s */
 797
 798         strip_driver_path(mem_ctx, *driver_path);
 799         strip_driver_path(mem_ctx, *data_file);
 800         if (*config_file) {
 801                 strip_driver_path(mem_ctx, *config_file);
 802         }
 803         if (help_file) {
 804                 strip_driver_path(mem_ctx, *help_file);
 805         }
 806
 807         if (dependent_files && dependent_files->string) {
 808                 for (i=0; dependent_files->string[i]; i++) {
 809                         strip_driver_path(mem_ctx, dependent_files->string[i]);
 810                 }
 811         }
 812
 813         short_architecture = get_short_archi(architecture);
 814         if (!short_architecture) {
 815                 return WERR_UNKNOWN_PRINTER_DRIVER;
 816         }
 817
 818         /* jfm:7/16/2000 the client always sends the cversion=0.
 819          * The server should check which version the driver is by reading
 820          * the PE header of driver->driverpath.
 821          *
 822          * For Windows 95/98 the version is 0 (so the value sent is correct)
 823          * For Windows NT (the architecture doesn't matter)
 824          *      NT 3.1: cversion=0
 825          *      NT 3.5/3.51: cversion=1
 826          *      NT 4: cversion=2
 827          *      NT2K: cversion=3
 828          */
 829
 830         *version = get_correct_cversion(session_info, short_architecture,
 831                                         *driver_path, &err);
 832         if (*version == -1) {
 833                 return err;
 834         }
 835
 836         return WERR_OK;
 837 }
 838
 839 /****************************************************************************
 840 ****************************************************************************/
 841
 842 WERROR clean_up_driver_struct(TALLOC_CTX *mem_ctx,
 843                               struct auth_session_info *session_info,
 844                               struct spoolss_AddDriverInfoCtr *r)
 845 {
 846         switch (r->level) {
 847         case 3:
 848                 return clean_up_driver_struct_level(mem_ctx, session_info,
 849                                                     r->info.info3->architecture,
 850                                                     &r->info.info3->driver_path,
 851                                                     &r->info.info3->data_file,
 852                                                     &r->info.info3->config_file,
 853                                                     &r->info.info3->help_file,
 854                                                     r->info.info3->dependent_files,
 855                                                     &r->info.info3->version);
 856         case 6:
 857                 return clean_up_driver_struct_level(mem_ctx, session_info,
 858                                                     r->info.info6->architecture,
 859                                                     &r->info.info6->driver_path,
 860                                                     &r->info.info6->data_file,
 861                                                     &r->info.info6->config_file,
 862                                                     &r->info.info6->help_file,
 863                                                     r->info.info6->dependent_files,
 864                                                     &r->info.info6->version);
 865         default:
 866                 return WERR_NOT_SUPPORTED;
 867         }
 868 }
 869
 870 /****************************************************************************
 871  This function sucks and should be replaced. JRA.
 872 ****************************************************************************/
 873
 874 static void convert_level_6_to_level3(struct spoolss_AddDriverInfo3 *dst,
 875                                       const struct spoolss_AddDriverInfo6 *src)
 876 {
 877         dst->version            = src->version;
 878
 879         dst->driver_name        = src->driver_name;
 880         dst->architecture       = src->architecture;
 881         dst->driver_path        = src->driver_path;
 882         dst->data_file          = src->data_file;
 883         dst->config_file        = src->config_file;
 884         dst->help_file          = src->help_file;
 885         dst->monitor_name       = src->monitor_name;
 886         dst->default_datatype   = src->default_datatype;
 887         dst->_ndr_size_dependent_files = src->_ndr_size_dependent_files;
 888         dst->dependent_files    = src->dependent_files;
 889 }
 890
 891 /****************************************************************************
 892 ****************************************************************************/
 893
 894 static WERROR move_driver_file_to_download_area(TALLOC_CTX *mem_ctx,
 895                                                 connection_struct *conn,
 896                                                 const char *driver_file,
 897                                                 const char *short_architecture,
 898                                                 uint32_t driver_version,
 899                                                 uint32_t version)
 900 {
 901         struct smb_filename *smb_fname_old = NULL;
 902         struct smb_filename *smb_fname_new = NULL;
 903         char *old_name = NULL;
 904         char *new_name = NULL;
 905         NTSTATUS status;
 906         WERROR ret;
 907
 908         old_name = talloc_asprintf(mem_ctx, "%s/%s",
 909                                    short_architecture, driver_file);
 910         W_ERROR_HAVE_NO_MEMORY(old_name);
 911
 912         new_name = talloc_asprintf(mem_ctx, "%s/%d/%s",
 913                                    short_architecture, driver_version, driver_file);
 914         if (new_name == NULL) {
 915                 TALLOC_FREE(old_name);
 916                 return WERR_NOMEM;
 917         }
 918
 919         if (version != -1 && (version = file_version_is_newer(conn, old_name, new_name)) > 0) {
 920
 921                 status = driver_unix_convert(conn, old_name, &smb_fname_old);
 922                 if (!NT_STATUS_IS_OK(status)) {
 923                         ret = WERR_NOMEM;
 924                         goto out;
 925                 }
 926
 927                 /* Setup a synthetic smb_filename struct */
 928                 smb_fname_new = talloc_zero(mem_ctx, struct smb_filename);
 929                 if (!smb_fname_new) {
 930                         ret = WERR_NOMEM;
 931                         goto out;
 932                 }
 933
 934                 smb_fname_new->base_name = new_name;
 935
 936                 DEBUG(10,("move_driver_file_to_download_area: copying '%s' to "
 937                           "'%s'\n", smb_fname_old->base_name,
 938                           smb_fname_new->base_name));
 939
 940                 status = copy_file(mem_ctx, conn, smb_fname_old, smb_fname_new,
 941                                    OPENX_FILE_EXISTS_TRUNCATE |
 942                                    OPENX_FILE_CREATE_IF_NOT_EXIST,
 943                                    0, false);
 944
 945                 if (!NT_STATUS_IS_OK(status)) {
 946                         DEBUG(0,("move_driver_file_to_download_area: Unable "
 947                                  "to rename [%s] to [%s]: %s\n",
 948                                  smb_fname_old->base_name, new_name,
 949                                  nt_errstr(status)));
 950                         ret = WERR_ACCESS_DENIED;
 951                         goto out;
 952                 }
 953         }
 954
 955         ret = WERR_OK;
 956  out:
 957         TALLOC_FREE(smb_fname_old);
 958         TALLOC_FREE(smb_fname_new);
 959         return ret;
 960 }
 961
 962 WERROR move_driver_to_download_area(struct auth_session_info *session_info,
 963                                     struct spoolss_AddDriverInfoCtr *r)
 964 {
 965         struct spoolss_AddDriverInfo3 *driver;
 966         struct spoolss_AddDriverInfo3 converted_driver;
 967         const char *short_architecture;
 968         struct smb_filename *smb_dname = NULL;
 969         char *new_dir = NULL;
 970         connection_struct *conn = NULL;
 971         NTSTATUS nt_status;
 972         int i;
 973         TALLOC_CTX *ctx = talloc_tos();
 974         int ver = 0;
 975         char *oldcwd;
 976         char *printdollar = NULL;
 977         int printdollar_snum;
 978         WERROR err = WERR_OK;
 979
 980         switch (r->level) {
 981         case 3:
 982                 driver = r->info.info3;
 983                 break;
 984         case 6:
 985                 convert_level_6_to_level3(&converted_driver, r->info.info6);
 986                 driver = &converted_driver;
 987                 break;
 988         default:
 989                 DEBUG(0,("move_driver_to_download_area: Unknown info level (%u)\n", (unsigned int)r->level));
 990                 return WERR_UNKNOWN_LEVEL;
 991         }
 992
 993         short_architecture = get_short_archi(driver->architecture);
 994         if (!short_architecture) {
 995                 return WERR_UNKNOWN_PRINTER_DRIVER;
 996         }
 997
 998         printdollar_snum = find_service(ctx, "print$", &printdollar);
 999         if (!printdollar) {
1000                 return WERR_NOMEM;
1001         }
1002         if (printdollar_snum == -1) {
1003                 return WERR_NO_SUCH_SHARE;
1004         }
1005
1006         nt_status = create_conn_struct_cwd(talloc_tos(),
1007                                        server_event_context(),
1008                                        server_messaging_context(),
1009                                        &conn,
1010                                        printdollar_snum,
1011                                        lp_pathname(talloc_tos(), printdollar_snum),
1012                                        session_info, &oldcwd);
1013         if (!NT_STATUS_IS_OK(nt_status)) {
1014                 DEBUG(0,("move_driver_to_download_area: create_conn_struct "
1015                          "returned %s\n", nt_errstr(nt_status)));
1016                 err = ntstatus_to_werror(nt_status);
1017                 return err;
1018         }
1019
1020         nt_status = set_conn_force_user_group(conn, printdollar_snum);
1021         if (!NT_STATUS_IS_OK(nt_status)) {
1022                 DEBUG(0, ("failed set force user / group\n"));
1023                 err = ntstatus_to_werror(nt_status);
1024                 goto err_free_conn;
1025         }
1026
1027         if (!become_user_by_session(conn, session_info)) {
1028                 DEBUG(0, ("failed to become user\n"));
1029                 err = WERR_ACCESS_DENIED;
1030                 goto err_free_conn;
1031         }
1032
1033         new_dir = talloc_asprintf(ctx,
1034                                 "%s/%d",
1035                                 short_architecture,
1036                                 driver->version);
1037         if (!new_dir) {
1038                 err = WERR_NOMEM;
1039                 goto err_exit;
1040         }
1041         nt_status = driver_unix_convert(conn, new_dir, &smb_dname);
1042         if (!NT_STATUS_IS_OK(nt_status)) {
1043                 err = WERR_NOMEM;
1044                 goto err_exit;
1045         }
1046
1047         DEBUG(5,("Creating first directory: %s\n", smb_dname->base_name));
1048
1049         nt_status = create_directory(conn, NULL, smb_dname);
1050         if (!NT_STATUS_IS_OK(nt_status)
1051          && !NT_STATUS_EQUAL(nt_status, NT_STATUS_OBJECT_NAME_COLLISION)) {
1052                 DEBUG(0, ("failed to create driver destination directory: %s\n",
1053                           nt_errstr(nt_status)));
1054                 err = ntstatus_to_werror(nt_status);
1055                 goto err_exit;
1056         }
1057
1058         /* For each driver file, archi\filexxx.yyy, if there is a duplicate file
1059          * listed for this driver which has already been moved, skip it (note:
1060          * drivers may list the same file name several times. Then check if the
1061          * file already exists in archi\version\, if so, check that the version
1062          * info (or time stamps if version info is unavailable) is newer (or the
1063          * date is later). If it is, move it to archi\version\filexxx.yyy.
1064          * Otherwise, delete the file.
1065          *
1066          * If a file is not moved to archi\version\ because of an error, all the
1067          * rest of the 'unmoved' driver files are removed from archi\. If one or
1068          * more of the driver's files was already moved to archi\version\, it
1069          * potentially leaves the driver in a partially updated state. Version
1070          * trauma will most likely occur if an client attempts to use any printer
1071          * bound to the driver. Perhaps a rewrite to make sure the moves can be
1072          * done is appropriate... later JRR
1073          */
1074
1075         DEBUG(5,("Moving files now !\n"));
1076
1077         if (driver->driver_path && strlen(driver->driver_path)) {
1078
1079                 err = move_driver_file_to_download_area(ctx,
1080                                                         conn,
1081                                                         driver->driver_path,
1082                                                         short_architecture,
1083                                                         driver->version,
1084                                                         ver);
1085                 if (!W_ERROR_IS_OK(err)) {
1086                         goto err_exit;
1087                 }
1088         }
1089
1090         if (driver->data_file && strlen(driver->data_file)) {
1091                 if (!strequal(driver->data_file, driver->driver_path)) {
1092
1093                         err = move_driver_file_to_download_area(ctx,
1094                                                                 conn,
1095                                                                 driver->data_file,
1096                                                                 short_architecture,
1097                                                                 driver->version,
1098                                                                 ver);
1099                         if (!W_ERROR_IS_OK(err)) {
1100                                 goto err_exit;
1101                         }
1102                 }
1103         }
1104
1105         if (driver->config_file && strlen(driver->config_file)) {
1106                 if (!strequal(driver->config_file, driver->driver_path) &&
1107                     !strequal(driver->config_file, driver->data_file)) {
1108
1109                         err = move_driver_file_to_download_area(ctx,
1110                                                                 conn,
1111                                                                 driver->config_file,
1112                                                                 short_architecture,
1113                                                                 driver->version,
1114                                                                 ver);
1115                         if (!W_ERROR_IS_OK(err)) {
1116                                 goto err_exit;
1117                         }
1118                 }
1119         }
1120
1121         if (driver->help_file && strlen(driver->help_file)) {
1122                 if (!strequal(driver->help_file, driver->driver_path) &&
1123                     !strequal(driver->help_file, driver->data_file) &&
1124                     !strequal(driver->help_file, driver->config_file)) {
1125
1126                         err = move_driver_file_to_download_area(ctx,
1127                                                                 conn,
1128                                                                 driver->help_file,
1129                                                                 short_architecture,
1130                                                                 driver->version,
1131                                                                 ver);
1132                         if (!W_ERROR_IS_OK(err)) {
1133                                 goto err_exit;
1134                         }
1135                 }
1136         }
1137
1138         if (driver->dependent_files && driver->dependent_files->string) {
1139                 for (i=0; driver->dependent_files->string[i]; i++) {
1140                         if (!strequal(driver->dependent_files->string[i], driver->driver_path) &&
1141                             !strequal(driver->dependent_files->string[i], driver->data_file) &&
1142                             !strequal(driver->dependent_files->string[i], driver->config_file) &&
1143                             !strequal(driver->dependent_files->string[i], driver->help_file)) {
1144                                 int j;
1145                                 for (j=0; j < i; j++) {
1146                                         if (strequal(driver->dependent_files->string[i], driver->dependent_files->string[j])) {
1147                                                 goto NextDriver;
1148                                         }
1149                                 }
1150
1151                                 err = move_driver_file_to_download_area(ctx,
1152                                                                         conn,
1153                                                                         driver->dependent_files->string[i],
1154                                                                         short_architecture,
1155                                                                         driver->version,
1156                                                                         ver);
1157                                 if (!W_ERROR_IS_OK(err)) {
1158                                         goto err_exit;
1159                                 }
1160                         }
1161                 NextDriver: ;
1162                 }
1163         }
1164
1165         err = WERR_OK;
1166  err_exit:
1167         unbecome_user();
1168  err_free_conn:
1169         TALLOC_FREE(smb_dname);
1170
1171         if (conn != NULL) {
1172                 vfs_ChDir(conn, oldcwd);
1173                 SMB_VFS_DISCONNECT(conn);
1174                 conn_free(conn);
1175         }
1176
1177         return err;
1178 }
1179
1180 /****************************************************************************
1181   Determine whether or not a particular driver is currently assigned
1182   to a printer
1183 ****************************************************************************/
1184
1185 bool printer_driver_in_use(TALLOC_CTX *mem_ctx,
1186                            struct dcerpc_binding_handle *b,
1187                            const struct spoolss_DriverInfo8 *r)
1188 {
1189         int snum;
1190         int n_services = lp_numservices();
1191         bool in_use = False;
1192         struct spoolss_PrinterInfo2 *pinfo2 = NULL;
1193         WERROR result;
1194
1195         if (!r) {
1196                 return false;
1197         }
1198
1199         DEBUG(10,("printer_driver_in_use: Beginning search through ntprinters.tdb...\n"));
1200
1201         /* loop through the printers.tdb and check for the drivername */
1202
1203         for (snum=0; snum<n_services && !in_use; snum++) {
1204                 if (!lp_snum_ok(snum) || !lp_print_ok(snum)) {
1205                         continue;
1206                 }
1207
1208                 result = winreg_get_printer(mem_ctx, b,
1209                                             lp_servicename(talloc_tos(), snum),
1210                                             &pinfo2);
1211                 if (!W_ERROR_IS_OK(result)) {
1212                         continue; /* skip */
1213                 }
1214
1215                 if (strequal(r->driver_name, pinfo2->drivername)) {
1216                         in_use = True;
1217                 }
1218
1219                 TALLOC_FREE(pinfo2);
1220         }
1221
1222         DEBUG(10,("printer_driver_in_use: Completed search through ntprinters.tdb...\n"));
1223
1224         if ( in_use ) {
1225                 struct spoolss_DriverInfo8 *driver = NULL;
1226                 WERROR werr;
1227
1228                 DEBUG(5,("printer_driver_in_use: driver \"%s\" is currently in use\n", r->driver_name));
1229
1230                 /* we can still remove the driver if there is one of
1231                    "Windows NT x86" version 2 or 3 left */
1232
1233                 if (!strequal("Windows NT x86", r->architecture)) {
1234                         werr = winreg_get_driver(mem_ctx, b,
1235                                                  "Windows NT x86",
1236                                                  r->driver_name,
1237                                                  DRIVER_ANY_VERSION,
1238                                                  &driver);
1239                 } else if (r->version == 2) {
1240                         werr = winreg_get_driver(mem_ctx, b,
1241                                                  "Windows NT x86",
1242                                                  r->driver_name,
1243                                                  3, &driver);
1244                 } else if (r->version == 3) {
1245                         werr = winreg_get_driver(mem_ctx, b,
1246                                                  "Windows NT x86",
1247                                                  r->driver_name,
1248                                                  2, &driver);
1249                 } else {
1250                         DEBUG(0, ("printer_driver_in_use: ERROR!"
1251                                   " unknown driver version (%d)\n",
1252                                   r->version));
1253                         werr = WERR_UNKNOWN_PRINTER_DRIVER;
1254                 }
1255
1256                 /* now check the error code */
1257
1258                 if ( W_ERROR_IS_OK(werr) ) {
1259                         /* it's ok to remove the driver, we have other architctures left */
1260                         in_use = False;
1261                         talloc_free(driver);
1262                 }
1263         }
1264
1265         /* report that the driver is not in use by default */
1266
1267         return in_use;
1268 }
1269
1270
1271 /**********************************************************************
1272  Check to see if a ogiven file is in use by *info
1273  *********************************************************************/
1274
1275 static bool drv_file_in_use(const char *file, const struct spoolss_DriverInfo8 *info)
1276 {
1277         int i = 0;
1278
1279         if ( !info )
1280                 return False;
1281
1282         /* mz: skip files that are in the list but already deleted */
1283         if (!file || !file[0]) {
1284                 return false;
1285         }
1286
1287         if (strequal(file, info->driver_path))
1288                 return True;
1289
1290         if (strequal(file, info->data_file))
1291                 return True;
1292
1293         if (strequal(file, info->config_file))
1294                 return True;
1295
1296         if (strequal(file, info->help_file))
1297                 return True;
1298
1299         /* see of there are any dependent files to examine */
1300
1301         if (!info->dependent_files)
1302                 return False;
1303
1304         while (info->dependent_files[i] && *info->dependent_files[i]) {
1305                 if (strequal(file, info->dependent_files[i]))
1306                         return True;
1307                 i++;
1308         }
1309
1310         return False;
1311
1312 }
1313
1314 /**********************************************************************
1315  Utility function to remove the dependent file pointed to by the
1316  input parameter from the list
1317  *********************************************************************/
1318
1319 static void trim_dependent_file(TALLOC_CTX *mem_ctx, const char **files, int idx)
1320 {
1321
1322         /* bump everything down a slot */
1323
1324         while (files && files[idx+1]) {
1325                 files[idx] = talloc_strdup(mem_ctx, files[idx+1]);
1326                 idx++;
1327         }
1328
1329         files[idx] = NULL;
1330
1331         return;
1332 }
1333
1334 /**********************************************************************
1335  Check if any of the files used by src are also used by drv
1336  *********************************************************************/
1337
1338 static bool trim_overlap_drv_files(TALLOC_CTX *mem_ctx,
1339                                    struct spoolss_DriverInfo8 *src,
1340                                    const struct spoolss_DriverInfo8 *drv)
1341 {
1342         bool    in_use = False;
1343         int     i = 0;
1344
1345         if ( !src || !drv )
1346                 return False;
1347
1348         /* check each file.  Remove it from the src structure if it overlaps */
1349
1350         if (drv_file_in_use(src->driver_path, drv)) {
1351                 in_use = True;
1352                 DEBUG(10,("Removing driverfile [%s] from list\n", src->driver_path));
1353                 src->driver_path = talloc_strdup(mem_ctx, "");
1354                 if (!src->driver_path) { return false; }
1355         }
1356
1357         if (drv_file_in_use(src->data_file, drv)) {
1358                 in_use = True;
1359                 DEBUG(10,("Removing datafile [%s] from list\n", src->data_file));
1360                 src->data_file = talloc_strdup(mem_ctx, "");
1361                 if (!src->data_file) { return false; }
1362         }
1363
1364         if (drv_file_in_use(src->config_file, drv)) {
1365                 in_use = True;
1366                 DEBUG(10,("Removing configfile [%s] from list\n", src->config_file));
1367                 src->config_file = talloc_strdup(mem_ctx, "");
1368                 if (!src->config_file) { return false; }
1369         }
1370
1371         if (drv_file_in_use(src->help_file, drv)) {
1372                 in_use = True;
1373                 DEBUG(10,("Removing helpfile [%s] from list\n", src->help_file));
1374                 src->help_file = talloc_strdup(mem_ctx, "");
1375                 if (!src->help_file) { return false; }
1376         }
1377
1378         /* are there any dependentfiles to examine? */
1379
1380         if (!src->dependent_files)
1381                 return in_use;
1382
1383         while (src->dependent_files[i] && *src->dependent_files[i]) {
1384                 if (drv_file_in_use(src->dependent_files[i], drv)) {
1385                         in_use = True;
1386                         DEBUG(10,("Removing [%s] from dependent file list\n", src->dependent_files[i]));
1387                         trim_dependent_file(mem_ctx, src->dependent_files, i);
1388                 } else
1389                         i++;
1390         }
1391
1392         return in_use;
1393 }
1394
1395 /****************************************************************************
1396   Determine whether or not a particular driver files are currently being
1397   used by any other driver.
1398
1399   Return value is True if any files were in use by other drivers
1400   and False otherwise.
1401
1402   Upon return, *info has been modified to only contain the driver files
1403   which are not in use
1404
1405   Fix from mz:
1406
1407   This needs to check all drivers to ensure that all files in use
1408   have been removed from *info, not just the ones in the first
1409   match.
1410 ****************************************************************************/
1411
1412 bool printer_driver_files_in_use(TALLOC_CTX *mem_ctx,
1413                                  struct dcerpc_binding_handle *b,
1414                                  struct spoolss_DriverInfo8 *info)
1415 {
1416         int                             i;
1417         uint32                          version;
1418         struct spoolss_DriverInfo8      *driver;
1419         bool in_use = false;
1420         uint32_t num_drivers;
1421         const char **drivers;
1422         WERROR result;
1423
1424         if ( !info )
1425                 return False;
1426
1427         version = info->version;
1428
1429         /* loop over all driver versions */
1430
1431         DEBUG(5,("printer_driver_files_in_use: Beginning search of drivers...\n"));
1432
1433         /* get the list of drivers */
1434
1435         result = winreg_get_driver_list(mem_ctx, b,
1436                                         info->architecture, version,
1437                                         &num_drivers, &drivers);
1438         if (!W_ERROR_IS_OK(result)) {
1439                 return true;
1440         }
1441
1442         DEBUGADD(4, ("we have:[%d] drivers in environment [%s] and version [%d]\n",
1443                      num_drivers, info->architecture, version));
1444
1445         /* check each driver for overlap in files */
1446
1447         for (i = 0; i < num_drivers; i++) {
1448                 DEBUGADD(5,("\tdriver: [%s]\n", drivers[i]));
1449
1450                 driver = NULL;
1451
1452                 result = winreg_get_driver(mem_ctx, b,
1453                                            info->architecture, drivers[i],
1454                                            version, &driver);
1455                 if (!W_ERROR_IS_OK(result)) {
1456                         talloc_free(drivers);
1457                         return True;
1458                 }
1459
1460                 /* check if d2 uses any files from d1 */
1461                 /* only if this is a different driver than the one being deleted */
1462
1463                 if (!strequal(info->driver_name, driver->driver_name)) {
1464                         if (trim_overlap_drv_files(mem_ctx, info, driver)) {
1465                                 /* mz: Do not instantly return -
1466                                  * we need to ensure this file isn't
1467                                  * also in use by other drivers. */
1468                                 in_use = true;
1469                         }
1470                 }
1471
1472                 talloc_free(driver);
1473         }
1474
1475         talloc_free(drivers);
1476
1477         DEBUG(5,("printer_driver_files_in_use: Completed search of drivers...\n"));
1478
1479         return in_use;
1480 }
1481
1482 static NTSTATUS driver_unlink_internals(connection_struct *conn,
1483                                         const char *short_arch,
1484                                         int vers,
1485                                         const char *fname)
1486 {
1487         TALLOC_CTX *tmp_ctx = talloc_new(conn);
1488         struct smb_filename *smb_fname = NULL;
1489         char *print_dlr_path;
1490         NTSTATUS status = NT_STATUS_NO_MEMORY;
1491
1492         print_dlr_path = talloc_asprintf(tmp_ctx, "%s/%d/%s",
1493                                          short_arch, vers, fname);
1494         if (print_dlr_path == NULL) {
1495                 goto err_out;
1496         }
1497
1498         status = create_synthetic_smb_fname(tmp_ctx, print_dlr_path,
1499                                             NULL, NULL, &smb_fname);
1500         if (!NT_STATUS_IS_OK(status)) {
1501                 goto err_out;
1502         }
1503
1504         status = unlink_internals(conn, NULL, 0, smb_fname, false);
1505 err_out:
1506         talloc_free(tmp_ctx);
1507         return status;
1508 }
1509
1510 /****************************************************************************
1511   Actually delete the driver files.  Make sure that
1512   printer_driver_files_in_use() return False before calling
1513   this.
1514 ****************************************************************************/
1515
1516 bool delete_driver_files(const struct auth_session_info *session_info,
1517                          const struct spoolss_DriverInfo8 *r)
1518 {
1519         const char *short_arch;
1520         connection_struct *conn;
1521         NTSTATUS nt_status;
1522         char *oldcwd;
1523         char *printdollar = NULL;
1524         int printdollar_snum;
1525         bool ret = false;
1526
1527         if (!r) {
1528                 return false;
1529         }
1530
1531         DEBUG(6,("delete_driver_files: deleting driver [%s] - version [%d]\n",
1532                 r->driver_name, r->version));
1533
1534         printdollar_snum = find_service(talloc_tos(), "print$", &printdollar);
1535         if (!printdollar) {
1536                 return false;
1537         }
1538         if (printdollar_snum == -1) {
1539                 return false;
1540         }
1541
1542         nt_status = create_conn_struct_cwd(talloc_tos(),
1543                                        server_event_context(),
1544                                        server_messaging_context(),
1545                                        &conn,
1546                                        printdollar_snum,
1547                                        lp_pathname(talloc_tos(), printdollar_snum),
1548                                        session_info, &oldcwd);
1549         if (!NT_STATUS_IS_OK(nt_status)) {
1550                 DEBUG(0,("delete_driver_files: create_conn_struct "
1551                          "returned %s\n", nt_errstr(nt_status)));
1552                 return false;
1553         }
1554
1555         nt_status = set_conn_force_user_group(conn, printdollar_snum);
1556         if (!NT_STATUS_IS_OK(nt_status)) {
1557                 DEBUG(0, ("failed set force user / group\n"));
1558                 ret = false;
1559                 goto err_free_conn;
1560         }
1561
1562         if (!become_user_by_session(conn, session_info)) {
1563                 DEBUG(0, ("failed to become user\n"));
1564                 ret = false;
1565                 goto err_free_conn;
1566         }
1567
1568         if ( !CAN_WRITE(conn) ) {
1569                 DEBUG(3,("delete_driver_files: Cannot delete print driver when [print$] is read-only\n"));
1570                 ret = false;
1571                 goto err_out;
1572         }
1573
1574         short_arch = get_short_archi(r->architecture);
1575         if (short_arch == NULL) {
1576                 DEBUG(0, ("bad architecture %s\n", r->architecture));
1577                 ret = false;
1578                 goto err_out;
1579         }
1580
1581         /* now delete the files */
1582
1583         if (r->driver_path && r->driver_path[0]) {
1584                 DEBUG(10,("deleting driverfile [%s]\n", r->driver_path));
1585                 driver_unlink_internals(conn, short_arch, r->version, r->driver_path);
1586         }
1587
1588         if (r->config_file && r->config_file[0]) {
1589                 DEBUG(10,("deleting configfile [%s]\n", r->config_file));
1590                 driver_unlink_internals(conn, short_arch, r->version, r->config_file);
1591         }
1592
1593         if (r->data_file && r->data_file[0]) {
1594                 DEBUG(10,("deleting datafile [%s]\n", r->data_file));
1595                 driver_unlink_internals(conn, short_arch, r->version, r->data_file);
1596         }
1597
1598         if (r->help_file && r->help_file[0]) {
1599                 DEBUG(10,("deleting helpfile [%s]\n", r->help_file));
1600                 driver_unlink_internals(conn, short_arch, r->version, r->help_file);
1601         }
1602
1603         if (r->dependent_files) {
1604                 int i = 0;
1605                 while (r->dependent_files[i] && r->dependent_files[i][0]) {
1606                         DEBUG(10,("deleting dependent file [%s]\n", r->dependent_files[i]));
1607                         driver_unlink_internals(conn, short_arch, r->version, r->dependent_files[i]);
1608                         i++;
1609                 }
1610         }
1611
1612         ret = true;
1613  err_out:
1614         unbecome_user();
1615  err_free_conn:
1616         if (conn != NULL) {
1617                 vfs_ChDir(conn, oldcwd);
1618                 SMB_VFS_DISCONNECT(conn);
1619                 conn_free(conn);
1620         }
1621         return ret;
1622 }
1623
1624 /* error code:
1625         0: everything OK
1626         1: level not implemented
1627         2: file doesn't exist
1628         3: can't allocate memory
1629         4: can't free memory
1630         5: non existent struct
1631 */
1632
1633 /*
1634         A printer and a printer driver are 2 different things.
1635         NT manages them separatelly, Samba does the same.
1636         Why ? Simply because it's easier and it makes sense !
1637
1638         Now explanation: You have 3 printers behind your samba server,
1639         2 of them are the same make and model (laser A and B). But laser B
1640         has an 3000 sheet feeder and laser A doesn't such an option.
1641         Your third printer is an old dot-matrix model for the accounting :-).
1642
1643         If the /usr/local/samba/lib directory (default dir), you will have
1644         5 files to describe all of this.
1645
1646         3 files for the printers (1 by printer):
1647                 NTprinter_laser A
1648                 NTprinter_laser B
1649                 NTprinter_accounting
1650         2 files for the drivers (1 for the laser and 1 for the dot matrix)
1651                 NTdriver_printer model X
1652                 NTdriver_printer model Y
1653
1654 jfm: I should use this comment for the text file to explain
1655         same thing for the forms BTW.
1656         Je devrais mettre mes commentaires en francais, ca serait mieux :-)
1657
1658 */
1659
1660 /* Convert generic access rights to printer object specific access rights.
1661    It turns out that NT4 security descriptors use generic access rights and
1662    NT5 the object specific ones. */
1663
1664 void map_printer_permissions(struct security_descriptor *sd)
1665 {
1666         int i;
1667
1668         for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
1669                 se_map_generic(&sd->dacl->aces[i].access_mask,
1670                                &printer_generic_mapping);
1671         }
1672 }
1673
1674 void map_job_permissions(struct security_descriptor *sd)
1675 {
1676         int i;
1677
1678         for (i = 0; sd->dacl && i < sd->dacl->num_aces; i++) {
1679                 se_map_generic(&sd->dacl->aces[i].access_mask,
1680                                &job_generic_mapping);
1681         }
1682 }
1683
1684
1685 /****************************************************************************
1686  Check a user has permissions to perform the given operation.  We use the
1687  permission constants defined in include/rpc_spoolss.h to check the various
1688  actions we perform when checking printer access.
1689
1690    PRINTER_ACCESS_ADMINISTER:
1691        print_queue_pause, print_queue_resume, update_printer_sec,
1692        update_printer, spoolss_addprinterex_level_2,
1693        _spoolss_setprinterdata
1694
1695    PRINTER_ACCESS_USE:
1696        print_job_start
1697
1698    JOB_ACCESS_ADMINISTER:
1699        print_job_delete, print_job_pause, print_job_resume,
1700        print_queue_purge
1701
1702   Try access control in the following order (for performance reasons):
1703     1)  root and SE_PRINT_OPERATOR can do anything (easy check)
1704     2)  check security descriptor (bit comparisons in memory)
1705     3)  "printer admins" (may result in numerous calls to winbind)
1706
1707  ****************************************************************************/
1708 bool print_access_check(const struct auth_session_info *session_info,
1709                         struct messaging_context *msg_ctx, int snum,
1710                         int access_type)
1711 {
1712         struct spoolss_security_descriptor *secdesc = NULL;
1713         uint32 access_granted;
1714         size_t sd_size;
1715         NTSTATUS status;
1716         WERROR result;
1717         const char *pname;
1718         TALLOC_CTX *mem_ctx = NULL;
1719
1720         /* If user is NULL then use the current_user structure */
1721
1722         /* Always allow root or SE_PRINT_OPERATROR to do anything */
1723
1724         if (session_info->unix_token->uid == sec_initial_uid()
1725             || security_token_has_privilege(session_info->security_token, SEC_PRIV_PRINT_OPERATOR)) {
1726                 return True;
1727         }
1728
1729         /* Get printer name */
1730
1731         pname = lp_printername(talloc_tos(), snum);
1732
1733         if (!pname || !*pname) {
1734                 errno = EACCES;
1735                 return False;
1736         }
1737
1738         /* Get printer security descriptor */
1739
1740         if(!(mem_ctx = talloc_init("print_access_check"))) {
1741                 errno = ENOMEM;
1742                 return False;
1743         }
1744
1745         result = winreg_get_printer_secdesc_internal(mem_ctx,
1746                                             get_session_info_system(),
1747                                             msg_ctx,
1748                                             pname,
1749                                             &secdesc);
1750         if (!W_ERROR_IS_OK(result)) {
1751                 talloc_destroy(mem_ctx);
1752                 errno = ENOMEM;
1753                 return False;
1754         }
1755
1756         if (access_type == JOB_ACCESS_ADMINISTER) {
1757                 struct spoolss_security_descriptor *parent_secdesc = secdesc;
1758
1759                 /* Create a child security descriptor to check permissions
1760                    against.  This is because print jobs are child objects
1761                    objects of a printer. */
1762                 status = se_create_child_secdesc(mem_ctx,
1763                                                  &secdesc,
1764                                                  &sd_size,
1765                                                  parent_secdesc,
1766                                                  parent_secdesc->owner_sid,
1767                                                  parent_secdesc->group_sid,
1768                                                  false);
1769                 if (!NT_STATUS_IS_OK(status)) {
1770                         talloc_destroy(mem_ctx);
1771                         errno = map_errno_from_nt_status(status);
1772                         return False;
1773                 }
1774
1775                 map_job_permissions(secdesc);
1776         } else {
1777                 map_printer_permissions(secdesc);
1778         }
1779
1780         /* Check access */
1781         status = se_access_check(secdesc, session_info->security_token, access_type,
1782                                  &access_granted);
1783
1784         DEBUG(4, ("access check was %s\n", NT_STATUS_IS_OK(status) ? "SUCCESS" : "FAILURE"));
1785
1786         talloc_destroy(mem_ctx);
1787
1788         if (!NT_STATUS_IS_OK(status)) {
1789                 errno = EACCES;
1790         }
1791
1792         return NT_STATUS_IS_OK(status);
1793 }
1794
1795 /****************************************************************************
1796  Check the time parameters allow a print operation.
1797 *****************************************************************************/
1798
1799 bool print_time_access_check(const struct auth_session_info *session_info,
1800                              struct messaging_context *msg_ctx,
1801                              const char *servicename)
1802 {
1803         struct spoolss_PrinterInfo2 *pinfo2 = NULL;
1804         WERROR result;
1805         bool ok = False;
1806         time_t now = time(NULL);
1807         struct tm *t;
1808         uint32 mins;
1809
1810         result = winreg_get_printer_internal(NULL, session_info, msg_ctx,
1811                                     servicename, &pinfo2);
1812         if (!W_ERROR_IS_OK(result)) {
1813                 return False;
1814         }
1815
1816         if (pinfo2->starttime == 0 && pinfo2->untiltime == 0) {
1817                 ok = True;
1818         }
1819
1820         t = gmtime(&now);
1821         mins = (uint32)t->tm_hour*60 + (uint32)t->tm_min;
1822
1823         if (mins >= pinfo2->starttime && mins <= pinfo2->untiltime) {
1824                 ok = True;
1825         }
1826
1827         TALLOC_FREE(pinfo2);
1828
1829         if (!ok) {
1830                 errno = EACCES;
1831         }
1832
1833         return ok;
1834 }
1835
1836 void nt_printer_remove(TALLOC_CTX *mem_ctx,
1837                         const struct auth_session_info *session_info,
1838                         struct messaging_context *msg_ctx,
1839                         const char *printer)
1840 {
1841         WERROR result;
1842
1843         result = winreg_delete_printer_key_internal(mem_ctx, session_info, msg_ctx,
1844                                            printer, "");
1845         if (!W_ERROR_IS_OK(result)) {
1846                 DEBUG(0, ("nt_printer_remove: failed to remove printer %s: "
1847                 "%s\n", printer, win_errstr(result)));
1848         }
1849 }
1850
1851 void nt_printer_add(TALLOC_CTX *mem_ctx,
1852                     const struct auth_session_info *session_info,
1853                     struct messaging_context *msg_ctx,
1854                     const char *printer)
1855 {
1856         WERROR result;
1857
1858         result = winreg_create_printer_internal(mem_ctx, session_info, msg_ctx,
1859                                                 printer);
1860         if (!W_ERROR_IS_OK(result)) {
1861                 DEBUG(0, ("nt_printer_add: failed to add printer %s: %s\n",
1862                           printer, win_errstr(result)));
1863         }
1864 }