source3/smbd/smb1_lanman.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Inter-process communication and named pipe handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Jeremy Allison 2007.
   6
   7    SMB Version handling
   8    Copyright (C) John H Terpstra 1995-1998
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22    */
  23 /*
  24    This file handles the named pipe and mailslot calls
  25    in the SMBtrans protocol
  26    */
  27
  28 #include "includes.h"
  29 #include "smbd/smbd.h"
  30 #include "smbd/globals.h"
  31 #include "rpc_client/rpc_client.h"
  32 #include "../librpc/gen_ndr/ndr_samr_c.h"
  33 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  34 #include "rpc_client/cli_spoolss.h"
  35 #include "rpc_client/init_spoolss.h"
  36 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
  37 #include "../librpc/gen_ndr/rap.h"
  38 #include "../lib/util/binsearch.h"
  39 #include "../libcli/auth/libcli_auth.h"
  40 #include "rpc_client/init_lsa.h"
  41 #include "../libcli/security/security.h"
  42 #include "printing.h"
  43 #include "passdb/machine_sid.h"
  44 #include "auth.h"
  45 #include "rpc_server/rpc_ncacn_np.h"
  46 #include "lib/util/string_wrappers.h"
  47 #include "source3/printing/rap_jobid.h"
  48 #include "source3/lib/substitute.h"
  49
  50 #ifdef CHECK_TYPES
  51 #undef CHECK_TYPES
  52 #endif
  53 #define CHECK_TYPES 0
  54
  55 #define NERR_Success 0
  56 #define NERR_badpass 86
  57 #define NERR_notsupported 50
  58
  59 #define NERR_BASE (2100)
  60 #define NERR_BufTooSmall (NERR_BASE+23)
  61 #define NERR_JobNotFound (NERR_BASE+51)
  62 #define NERR_DestNotFound (NERR_BASE+52)
  63
  64 #define ACCESS_READ 0x01
  65 #define ACCESS_WRITE 0x02
  66 #define ACCESS_CREATE 0x04
  67
  68 #define SHPWLEN 8               /* share password length */
  69
  70 /* Limit size of ipc replies */
  71
  72 static char *smb_realloc_limit(void *ptr, size_t size)
  73 {
  74         char *val;
  75
  76         size = MAX((size),4*1024);
  77         val = (char *)SMB_REALLOC(ptr,size);
  78         if (val) {
  79                 memset(val,'\0',size);
  80         }
  81         return val;
  82 }
  83
  84 static bool api_Unsupported(struct smbd_server_connection *sconn,
  85                             connection_struct *conn, uint64_t vuid,
  86                                 char *param, int tpscnt,
  87                                 char *data, int tdscnt,
  88                                 int mdrcnt, int mprcnt,
  89                                 char **rdata, char **rparam,
  90                                 int *rdata_len, int *rparam_len);
  91
  92 static bool api_TooSmall(struct smbd_server_connection *sconn,
  93                          connection_struct *conn, uint64_t vuid, char *param, char *data,
  94                          int mdrcnt, int mprcnt,
  95                          char **rdata, char **rparam,
  96                          int *rdata_len, int *rparam_len);
  97
  98
  99 static int CopyExpanded(connection_struct *conn,
 100                         int snum, char **dst, char *src, int *p_space_remaining)
 101 {
 102         TALLOC_CTX *ctx = talloc_tos();
 103         const struct loadparm_substitution *lp_sub =
 104                 loadparm_s3_global_substitution();
 105         char *buf = NULL;
 106         int l;
 107
 108         if (!src || !dst || !p_space_remaining || !(*dst) ||
 109                         *p_space_remaining <= 0) {
 110                 return 0;
 111         }
 112
 113         buf = talloc_strdup(ctx, src);
 114         if (!buf) {
 115                 *p_space_remaining = 0;
 116                 return 0;
 117         }
 118         buf = talloc_string_sub(ctx, buf,"%S", lp_servicename(ctx, lp_sub, snum));
 119         if (!buf) {
 120                 *p_space_remaining = 0;
 121                 return 0;
 122         }
 123         buf = talloc_sub_full(ctx,
 124                                   lp_servicename(ctx, lp_sub, SNUM(conn)),
 125                                 conn->session_info->unix_info->unix_name,
 126                                 conn->connectpath,
 127                                 conn->session_info->unix_token->gid,
 128                                 conn->session_info->unix_info->sanitized_username,
 129                                 conn->session_info->info->domain_name,
 130                                 buf);
 131         if (!buf) {
 132                 *p_space_remaining = 0;
 133                 return 0;
 134         }
 135         l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
 136         if (l == 0) {
 137                 return 0;
 138         }
 139         (*dst) += l;
 140         (*p_space_remaining) -= l;
 141         return l;
 142 }
 143
 144 static int CopyAndAdvance(char **dst, char *src, int *n)
 145 {
 146         int l;
 147         if (!src || !dst || !n || !(*dst)) {
 148                 return 0;
 149         }
 150         l = push_ascii(*dst,src,*n, STR_TERMINATE);
 151         if (l == 0) {
 152                 return 0;
 153         }
 154         (*dst) += l;
 155         (*n) -= l;
 156         return l;
 157 }
 158
 159 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
 160 {
 161         TALLOC_CTX *ctx = talloc_tos();
 162         const struct loadparm_substitution *lp_sub =
 163                 loadparm_s3_global_substitution();
 164         char *buf = NULL;
 165         if (!s) {
 166                 return 0;
 167         }
 168         buf = talloc_strdup(ctx,s);
 169         if (!buf) {
 170                 return 0;
 171         }
 172         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(ctx, lp_sub, snum));
 173         if (!buf) {
 174                 return 0;
 175         }
 176         buf = talloc_sub_full(ctx,
 177                                   lp_servicename(ctx, lp_sub, SNUM(conn)),
 178                                 conn->session_info->unix_info->unix_name,
 179                                 conn->connectpath,
 180                                 conn->session_info->unix_token->gid,
 181                                 conn->session_info->unix_info->sanitized_username,
 182                                 conn->session_info->info->domain_name,
 183                                 buf);
 184         if (!buf) {
 185                 return 0;
 186         }
 187         return strlen(buf) + 1;
 188 }
 189
 190 /****************************************************************
 191  Return an SVAL at a pointer, or failval if beyond the end.
 192 ****************************************************************/
 193
 194 static int get_safe_SVAL(
 195         const char *buf_base,
 196         size_t buf_len,
 197         char *ptr,
 198         size_t off,
 199         int failval)
 200 {
 201         /*
 202          * Note we use off+1 here, not off+2 as SVAL accesses ptr[0]
 203          * and ptr[1], NOT ptr[2].
 204          */
 205         if (!is_offset_safe(buf_base, buf_len, ptr, off+1)) {
 206                 return failval;
 207         }
 208         return SVAL(ptr,off);
 209 }
 210
 211 /****************************************************************
 212  Return an IVAL at a pointer, or failval if beyond the end.
 213 ****************************************************************/
 214
 215 static int get_safe_IVAL(
 216         const char *buf_base,
 217         size_t buf_len,
 218         char *ptr,
 219         size_t off,
 220         int failval)
 221 {
 222         /*
 223          * Note we use off+3 here, not off+4 as IVAL accesses
 224          * ptr[0] ptr[1] ptr[2] ptr[3] NOT ptr[4].
 225          */
 226         if (!is_offset_safe(buf_base, buf_len, ptr, off+3)) {
 227                 return failval;
 228         }
 229         return IVAL(ptr,off);
 230 }
 231
 232 /****************************************************************
 233  Return a safe pointer into a buffer, or NULL.
 234 ****************************************************************/
 235
 236 static char *get_safe_ptr(
 237         const char *buf_base,
 238         size_t buf_len,
 239         char *ptr,
 240         size_t off)
 241 {
 242         return is_offset_safe(buf_base, buf_len, ptr, off) ?
 243                         ptr + off : NULL;
 244 }
 245
 246 /*******************************************************************
 247  Check a API string for validity when we only need to check the prefix.
 248 ******************************************************************/
 249
 250 static bool prefix_ok(const char *str, const char *prefix)
 251 {
 252         return(strncmp(str,prefix,strlen(prefix)) == 0);
 253 }
 254
 255 struct pack_desc {
 256         const char *format;         /* formatstring for structure */
 257         const char *subformat;  /* subformat for structure */
 258         char *base;         /* baseaddress of buffer */
 259         int buflen;        /* remaining size for fixed part; on init: length of base */
 260         int subcount;       /* count of substructures */
 261         char *structbuf;  /* pointer into buffer for remaining fixed part */
 262         int stringlen;    /* remaining size for variable part */
 263         char *stringbuf;  /* pointer into buffer for remaining variable part */
 264         int neededlen;    /* total needed size */
 265         int usedlen;        /* total used size (usedlen <= neededlen and usedlen <= buflen) */
 266         const char *curpos;         /* current position; pointer into format or subformat */
 267         int errcode;
 268 };
 269
 270 static int get_counter(const char **p)
 271 {
 272         int i, n;
 273         if (!p || !(*p)) {
 274                 return 1;
 275         }
 276         if (!isdigit((int)**p)) {
 277                 return 1;
 278         }
 279         for (n = 0;;) {
 280                 i = **p;
 281                 if (isdigit(i)) {
 282                         n = 10 * n + (i - '0');
 283                 } else {
 284                         return n;
 285                 }
 286                 (*p)++;
 287         }
 288 }
 289
 290 static int getlen(const char *p)
 291 {
 292         int n = 0;
 293         if (!p) {
 294                 return 0;
 295         }
 296
 297         while (*p) {
 298                 switch( *p++ ) {
 299                 case 'W':                       /* word (2 byte) */
 300                         n += 2;
 301                         break;
 302                 case 'K':                       /* status word? (2 byte) */
 303                         n += 2;
 304                         break;
 305                 case 'N':                       /* count of substructures (word) at end */
 306                         n += 2;
 307                         break;
 308                 case 'D':                       /* double word (4 byte) */
 309                 case 'z':                       /* offset to zero terminated string (4 byte) */
 310                 case 'l':                       /* offset to user data (4 byte) */
 311                         n += 4;
 312                         break;
 313                 case 'b':                       /* offset to data (with counter) (4 byte) */
 314                         n += 4;
 315                         get_counter(&p);
 316                         break;
 317                 case 'B':                       /* byte (with optional counter) */
 318                         n += get_counter(&p);
 319                         break;
 320                 }
 321         }
 322         return n;
 323 }
 324
 325 static bool init_package(struct pack_desc *p, int count, int subcount)
 326 {
 327         int n = p->buflen;
 328         int i;
 329
 330         if (!p->format || !p->base) {
 331                 return False;
 332         }
 333
 334         i = count * getlen(p->format);
 335         if (p->subformat) {
 336                 i += subcount * getlen(p->subformat);
 337         }
 338         p->structbuf = p->base;
 339         p->neededlen = 0;
 340         p->usedlen = 0;
 341         p->subcount = 0;
 342         p->curpos = p->format;
 343         if (i > n) {
 344                 p->neededlen = i;
 345                 i = n = 0;
 346 #if 0
 347                 /*
 348                  * This is the old error code we used. Aparently
 349                  * WinNT/2k systems return ERRbuftoosmall (2123) and
 350                  * OS/2 needs this. I'm leaving this here so we can revert
 351                  * if needed. JRA.
 352                  */
 353                 p->errcode = ERRmoredata;
 354 #else
 355                 p->errcode = ERRbuftoosmall;
 356 #endif
 357         } else {
 358                 p->errcode = NERR_Success;
 359         }
 360         p->buflen = i;
 361         n -= i;
 362         p->stringbuf = p->base + i;
 363         p->stringlen = n;
 364         return (p->errcode == NERR_Success);
 365 }
 366
 367 static int package(struct pack_desc *p, ...)
 368 {
 369         va_list args;
 370         int needed=0, stringneeded;
 371         const char *str=NULL;
 372         int is_string=0, stringused;
 373         int32_t temp;
 374
 375         va_start(args,p);
 376
 377         if (!*p->curpos) {
 378                 if (!p->subcount) {
 379                         p->curpos = p->format;
 380                 } else {
 381                         p->curpos = p->subformat;
 382                         p->subcount--;
 383                 }
 384         }
 385 #if CHECK_TYPES
 386         str = va_arg(args,char*);
 387         SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
 388 #endif
 389         stringneeded = -1;
 390
 391         if (!p->curpos) {
 392                 va_end(args);
 393                 return 0;
 394         }
 395
 396         switch( *p->curpos++ ) {
 397                 case 'W':                       /* word (2 byte) */
 398                         needed = 2;
 399                         temp = va_arg(args,int);
 400                         if (p->buflen >= needed) {
 401                                 SSVAL(p->structbuf,0,temp);
 402                         }
 403                         break;
 404                 case 'K':                       /* status word? (2 byte) */
 405                         needed = 2;
 406                         temp = va_arg(args,int);
 407                         if (p->buflen >= needed) {
 408                                 SSVAL(p->structbuf,0,temp);
 409                         }
 410                         break;
 411                 case 'N':                       /* count of substructures (word) at end */
 412                         needed = 2;
 413                         p->subcount = va_arg(args,int);
 414                         if (p->buflen >= needed) {
 415                                 SSVAL(p->structbuf,0,p->subcount);
 416                         }
 417                         break;
 418                 case 'D':                       /* double word (4 byte) */
 419                         needed = 4;
 420                         temp = va_arg(args,int);
 421                         if (p->buflen >= needed) {
 422                                 SIVAL(p->structbuf,0,temp);
 423                         }
 424                         break;
 425                 case 'B':                       /* byte (with optional counter) */
 426                         needed = get_counter(&p->curpos);
 427                         {
 428                                 char *s = va_arg(args,char*);
 429                                 if (p->buflen >= needed) {
 430                                         strlcpy(p->structbuf,s?s:"",needed);
 431                                 }
 432                         }
 433                         break;
 434                 case 'z':                       /* offset to zero terminated string (4 byte) */
 435                         str = va_arg(args,char*);
 436                         stringneeded = (str ? strlen(str)+1 : 0);
 437                         is_string = 1;
 438                         break;
 439                 case 'l':                       /* offset to user data (4 byte) */
 440                         str = va_arg(args,char*);
 441                         stringneeded = va_arg(args,int);
 442                         is_string = 0;
 443                         break;
 444                 case 'b':                       /* offset to data (with counter) (4 byte) */
 445                         str = va_arg(args,char*);
 446                         stringneeded = get_counter(&p->curpos);
 447                         is_string = 0;
 448                         break;
 449         }
 450
 451         va_end(args);
 452         if (stringneeded >= 0) {
 453                 needed = 4;
 454                 if (p->buflen >= needed) {
 455                         stringused = stringneeded;
 456                         if (stringused > p->stringlen) {
 457                                 stringused = (is_string ? p->stringlen : 0);
 458                                 if (p->errcode == NERR_Success) {
 459                                         p->errcode = ERRmoredata;
 460                                 }
 461                         }
 462                         if (!stringused) {
 463                                 SIVAL(p->structbuf,0,0);
 464                         } else {
 465                                 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
 466                                 memcpy(p->stringbuf,str?str:"",stringused);
 467                                 if (is_string) {
 468                                         p->stringbuf[stringused-1] = '\0';
 469                                 }
 470                                 p->stringbuf += stringused;
 471                                 p->stringlen -= stringused;
 472                                 p->usedlen += stringused;
 473                         }
 474                 }
 475                 p->neededlen += stringneeded;
 476         }
 477
 478         p->neededlen += needed;
 479         if (p->buflen >= needed) {
 480                 p->structbuf += needed;
 481                 p->buflen -= needed;
 482                 p->usedlen += needed;
 483         } else {
 484                 if (p->errcode == NERR_Success) {
 485                         p->errcode = ERRmoredata;
 486                 }
 487         }
 488         return 1;
 489 }
 490
 491 #if CHECK_TYPES
 492 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
 493 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
 494 #else
 495 #define PACK(desc,t,v) package(desc,v)
 496 #define PACKl(desc,t,v,l) package(desc,v,l)
 497 #endif
 498
 499 static void PACKI(struct pack_desc* desc, const char *t,int v)
 500 {
 501         PACK(desc,t,v);
 502 }
 503
 504 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
 505 {
 506         PACK(desc,t,v);
 507 }
 508
 509 /****************************************************************************
 510  Get a print queue.
 511 ****************************************************************************/
 512
 513 static void PackDriverData(struct pack_desc* desc)
 514 {
 515         char drivdata[4+4+32];
 516         SIVAL(drivdata,0,sizeof drivdata); /* cb */
 517         SIVAL(drivdata,4,1000); /* lVersion */
 518         memset(drivdata+8,0,32);        /* szDeviceName */
 519         push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
 520         PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
 521 }
 522
 523 static int check_printq_info(struct pack_desc* desc,
 524                                 unsigned int uLevel, char *id1, char *id2)
 525 {
 526         desc->subformat = NULL;
 527         switch( uLevel ) {
 528                 case 0:
 529                         desc->format = "B13";
 530                         break;
 531                 case 1:
 532                         desc->format = "B13BWWWzzzzzWW";
 533                         break;
 534                 case 2:
 535                         desc->format = "B13BWWWzzzzzWN";
 536                         desc->subformat = "WB21BB16B10zWWzDDz";
 537                         break;
 538                 case 3:
 539                         desc->format = "zWWWWzzzzWWzzl";
 540                         break;
 541                 case 4:
 542                         desc->format = "zWWWWzzzzWNzzl";
 543                         desc->subformat = "WWzWWDDzz";
 544                         break;
 545                 case 5:
 546                         desc->format = "z";
 547                         break;
 548                 case 51:
 549                         desc->format = "K";
 550                         break;
 551                 case 52:
 552                         desc->format = "WzzzzzzzzN";
 553                         desc->subformat = "z";
 554                         break;
 555                 default:
 556                         DEBUG(0,("check_printq_info: invalid level %d\n",
 557                                 uLevel ));
 558                         return False;
 559         }
 560         if (id1 == NULL || strcmp(desc->format,id1) != 0) {
 561                 DEBUG(0,("check_printq_info: invalid format %s\n",
 562                         id1 ? id1 : "<NULL>" ));
 563                 return False;
 564         }
 565         if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
 566                 DEBUG(0,("check_printq_info: invalid subformat %s\n",
 567                         id2 ? id2 : "<NULL>" ));
 568                 return False;
 569         }
 570         return True;
 571 }
 572
 573
 574 #define RAP_JOB_STATUS_QUEUED 0
 575 #define RAP_JOB_STATUS_PAUSED 1
 576 #define RAP_JOB_STATUS_SPOOLING 2
 577 #define RAP_JOB_STATUS_PRINTING 3
 578 #define RAP_JOB_STATUS_PRINTED 4
 579
 580 #define RAP_QUEUE_STATUS_PAUSED 1
 581 #define RAP_QUEUE_STATUS_ERROR 2
 582
 583 /* turn a print job status into a on the wire status
 584 */
 585 static int printj_spoolss_status(int v)
 586 {
 587         if (v == JOB_STATUS_QUEUED)
 588                 return RAP_JOB_STATUS_QUEUED;
 589         if (v & JOB_STATUS_PAUSED)
 590                 return RAP_JOB_STATUS_PAUSED;
 591         if (v & JOB_STATUS_SPOOLING)
 592                 return RAP_JOB_STATUS_SPOOLING;
 593         if (v & JOB_STATUS_PRINTING)
 594                 return RAP_JOB_STATUS_PRINTING;
 595         return 0;
 596 }
 597
 598 /* turn a print queue status into a on the wire status
 599 */
 600 static int printq_spoolss_status(int v)
 601 {
 602         if (v == PRINTER_STATUS_OK)
 603                 return 0;
 604         if (v & PRINTER_STATUS_PAUSED)
 605                 return RAP_QUEUE_STATUS_PAUSED;
 606         return RAP_QUEUE_STATUS_ERROR;
 607 }
 608
 609 static void fill_spoolss_printjob_info(int uLevel,
 610                                        struct pack_desc *desc,
 611                                        struct spoolss_JobInfo2 *info2,
 612                                        int n)
 613 {
 614         time_t t = spoolss_Time_to_time_t(&info2->submitted);
 615
 616         /* the client expects localtime */
 617         t -= get_time_zone(t);
 618
 619         PACKI(desc,"W",pjobid_to_rap(info2->printer_name, info2->job_id)); /* uJobId */
 620         if (uLevel == 1) {
 621                 PACKS(desc,"B21", info2->user_name); /* szUserName */
 622                 PACKS(desc,"B","");             /* pad */
 623                 PACKS(desc,"B16","");   /* szNotifyName */
 624                 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
 625                 PACKS(desc,"z","");             /* pszParms */
 626                 PACKI(desc,"W",n+1);            /* uPosition */
 627                 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
 628                 PACKS(desc,"z","");             /* pszStatus */
 629                 PACKI(desc,"D", t); /* ulSubmitted */
 630                 PACKI(desc,"D", info2->size); /* ulSize */
 631                 PACKS(desc,"z", info2->document_name); /* pszComment */
 632         }
 633         if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
 634                 PACKI(desc,"W", info2->priority);               /* uPriority */
 635                 PACKS(desc,"z", info2->user_name); /* pszUserName */
 636                 PACKI(desc,"W",n+1);            /* uPosition */
 637                 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
 638                 PACKI(desc,"D",t); /* ulSubmitted */
 639                 PACKI(desc,"D", info2->size); /* ulSize */
 640                 PACKS(desc,"z","Samba");        /* pszComment */
 641                 PACKS(desc,"z", info2->document_name); /* pszDocument */
 642                 if (uLevel == 3) {
 643                         PACKS(desc,"z","");     /* pszNotifyName */
 644                         PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
 645                         PACKS(desc,"z","");     /* pszParms */
 646                         PACKS(desc,"z","");     /* pszStatus */
 647                         PACKS(desc,"z", info2->printer_name); /* pszQueue */
 648                         PACKS(desc,"z","lpd");  /* pszQProcName */
 649                         PACKS(desc,"z","");     /* pszQProcParms */
 650                         PACKS(desc,"z","NULL"); /* pszDriverName */
 651                         PackDriverData(desc);   /* pDriverData */
 652                         PACKS(desc,"z","");     /* pszPrinterName */
 653                 } else if (uLevel == 4) {   /* OS2 */
 654                         PACKS(desc,"z","");       /* pszSpoolFileName  */
 655                         PACKS(desc,"z","");       /* pszPortName       */
 656                         PACKS(desc,"z","");       /* pszStatus         */
 657                         PACKI(desc,"D",0);        /* ulPagesSpooled    */
 658                         PACKI(desc,"D",0);        /* ulPagesSent       */
 659                         PACKI(desc,"D",0);        /* ulPagesPrinted    */
 660                         PACKI(desc,"D",0);        /* ulTimePrinted     */
 661                         PACKI(desc,"D",0);        /* ulExtendJobStatus */
 662                         PACKI(desc,"D",0);        /* ulStartPage       */
 663                         PACKI(desc,"D",0);        /* ulEndPage         */
 664                 }
 665         }
 666 }
 667
 668 /********************************************************************
 669  Respond to the DosPrintQInfo command with a level of 52
 670  This is used to get printer driver information for Win9x clients
 671  ********************************************************************/
 672 static void fill_printq_info_52(struct spoolss_DriverInfo3 *driver,
 673                                 struct pack_desc* desc, int count,
 674                                 const char *printer_name)
 675 {
 676         int                             i;
 677         fstring                         location;
 678         trim_string(discard_const_p(char, driver->driver_path), "\\print$\\WIN40\\0\\", 0);
 679         trim_string(discard_const_p(char, driver->data_file), "\\print$\\WIN40\\0\\", 0);
 680         trim_string(discard_const_p(char, driver->help_file), "\\print$\\WIN40\\0\\", 0);
 681
 682         PACKI(desc, "W", 0x0400);                     /* don't know */
 683         PACKS(desc, "z", driver->driver_name);        /* long printer name */
 684         PACKS(desc, "z", driver->driver_path);  /* Driverfile Name */
 685         PACKS(desc, "z", driver->data_file);    /* Datafile name */
 686         PACKS(desc, "z", driver->monitor_name); /* language monitor */
 687
 688         fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
 689         standard_sub_basic( "", "", location, sizeof(location)-1 );
 690         PACKS(desc,"z", location);                          /* share to retrieve files */
 691
 692         PACKS(desc,"z", driver->default_datatype);    /* default data type */
 693         PACKS(desc,"z", driver->help_file);           /* helpfile name */
 694         PACKS(desc,"z", driver->driver_path);               /* driver name */
 695
 696         DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
 697         DEBUG(3,("Driver: %s:\n",driver->driver_path));
 698         DEBUG(3,("Data File: %s:\n",driver->data_file));
 699         DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
 700         DEBUG(3,("Driver Location: %s:\n",location));
 701         DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
 702         DEBUG(3,("Help File: %s:\n",driver->help_file));
 703         PACKI(desc,"N",count);                     /* number of files to copy */
 704
 705         for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
 706         {
 707                 trim_string(discard_const_p(char, driver->dependent_files[i]), "\\print$\\WIN40\\0\\", 0);
 708                 PACKS(desc,"z",driver->dependent_files[i]);         /* driver files to copy */
 709                 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
 710         }
 711
 712         /* sanity check */
 713         if ( i != count )
 714                 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
 715                         count, i));
 716
 717         DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", printer_name, i));
 718
 719         desc->errcode=NERR_Success;
 720
 721 }
 722
 723 static const char *strip_unc(const char *unc)
 724 {
 725         char *p;
 726
 727         if (unc == NULL) {
 728                 return NULL;
 729         }
 730
 731         if ((p = strrchr(unc, '\\')) != NULL) {
 732                 return p+1;
 733         }
 734
 735         return unc;
 736 }
 737
 738 static void fill_printq_info(int uLevel,
 739                              struct pack_desc* desc,
 740                              int count,
 741                              union spoolss_JobInfo *job_info,
 742                              struct spoolss_DriverInfo3 *driver_info,
 743                              struct spoolss_PrinterInfo2 *printer_info)
 744 {
 745         switch (uLevel) {
 746         case 0:
 747         case 1:
 748         case 2:
 749                 PACKS(desc,"B13", strip_unc(printer_info->printername));
 750                 break;
 751         case 3:
 752         case 4:
 753         case 5:
 754                 PACKS(desc,"z", strip_unc(printer_info->printername));
 755                 break;
 756         case 51:
 757                 PACKI(desc,"K", printq_spoolss_status(printer_info->status));
 758                 break;
 759         }
 760
 761         if (uLevel == 1 || uLevel == 2) {
 762                 PACKS(desc,"B","");             /* alignment */
 763                 PACKI(desc,"W",5);              /* priority */
 764                 PACKI(desc,"W",0);              /* start time */
 765                 PACKI(desc,"W",0);              /* until time */
 766                 PACKS(desc,"z","");             /* pSepFile */
 767                 PACKS(desc,"z","lpd");  /* pPrProc */
 768                 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pDestinations */
 769                 PACKS(desc,"z","");             /* pParms */
 770                 if (printer_info->printername == NULL) {
 771                         PACKS(desc,"z","UNKNOWN PRINTER");
 772                         PACKI(desc,"W",LPSTAT_ERROR);
 773                 } else {
 774                         PACKS(desc,"z", printer_info->comment);
 775                         PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* status */
 776                 }
 777                 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
 778         }
 779
 780         if (uLevel == 3 || uLevel == 4) {
 781                 PACKI(desc,"W",5);              /* uPriority */
 782                 PACKI(desc,"W",0);              /* uStarttime */
 783                 PACKI(desc,"W",0);              /* uUntiltime */
 784                 PACKI(desc,"W",5);              /* pad1 */
 785                 PACKS(desc,"z","");             /* pszSepFile */
 786                 PACKS(desc,"z","WinPrint");     /* pszPrProc */
 787                 PACKS(desc,"z",NULL);           /* pszParms */
 788                 PACKS(desc,"z",NULL);           /* pszComment - don't ask.... JRA */
 789                 /* "don't ask" that it's done this way to fix corrupted
 790                    Win9X/ME printer comments. */
 791                 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* fsStatus */
 792                 PACKI(desc,(uLevel == 3 ? "W" : "N"),count);    /* cJobs */
 793                 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pszPrinters */
 794                 PACKS(desc,"z", printer_info->drivername);              /* pszDriverName */
 795                 PackDriverData(desc);   /* pDriverData */
 796         }
 797
 798         if (uLevel == 2 || uLevel == 4) {
 799                 int i;
 800                 for (i = 0; i < count; i++) {
 801                         fill_spoolss_printjob_info(uLevel == 2 ? 1 : 2, desc, &job_info[i].info2, i);
 802                 }
 803         }
 804
 805         if (uLevel==52)
 806                 fill_printq_info_52(driver_info, desc, count, printer_info->printername);
 807 }
 808
 809 /* This function returns the number of files for a given driver */
 810 static int get_printerdrivernumber(const struct spoolss_DriverInfo3 *driver)
 811 {
 812         int                             result = 0;
 813
 814         /* count the number of files */
 815         while (driver->dependent_files && *driver->dependent_files[result])
 816                 result++;
 817
 818         return result;
 819 }
 820
 821 static bool api_DosPrintQGetInfo(struct smbd_server_connection *sconn,
 822                                  connection_struct *conn, uint64_t vuid,
 823                                 char *param, int tpscnt,
 824                                 char *data, int tdscnt,
 825                                 int mdrcnt,int mprcnt,
 826                                 char **rdata,char **rparam,
 827                                 int *rdata_len,int *rparam_len)
 828 {
 829         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
 830         char *str2 = skip_string(param,tpscnt,str1);
 831         char *p = skip_string(param,tpscnt,str2);
 832         char *QueueName = p;
 833         unsigned int uLevel;
 834         uint32_t count = 0;
 835         char *str3;
 836         struct pack_desc desc;
 837         char* tmpdata=NULL;
 838
 839         WERROR werr = WERR_OK;
 840         TALLOC_CTX *mem_ctx = talloc_tos();
 841         NTSTATUS status;
 842         struct rpc_pipe_client *cli = NULL;
 843         struct dcerpc_binding_handle *b = NULL;
 844         struct policy_handle handle;
 845         struct spoolss_DevmodeContainer devmode_ctr;
 846         union spoolss_DriverInfo driver_info;
 847         union spoolss_JobInfo *job_info = NULL;
 848         union spoolss_PrinterInfo printer_info;
 849
 850         if (!str1 || !str2 || !p) {
 851                 return False;
 852         }
 853         memset((char *)&desc,'\0',sizeof(desc));
 854
 855         p = skip_string(param,tpscnt,p);
 856         if (!p) {
 857                 return False;
 858         }
 859         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 860         str3 = get_safe_str_ptr(param,tpscnt,p,4);
 861         /* str3 may be null here and is checked in check_printq_info(). */
 862
 863         /* remove any trailing username */
 864         if ((p = strchr_m(QueueName,'%')))
 865                 *p = 0;
 866
 867         DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
 868
 869         /* check it's a supported varient */
 870         if (!prefix_ok(str1,"zWrLh"))
 871                 return False;
 872         if (!check_printq_info(&desc,uLevel,str2,str3)) {
 873                 /*
 874                  * Patch from Scott Moomaw <scott@bridgewater.edu>
 875                  * to return the 'invalid info level' error if an
 876                  * unknown level was requested.
 877                  */
 878                 *rdata_len = 0;
 879                 *rparam_len = 6;
 880                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
 881                 if (!*rparam) {
 882                         return False;
 883                 }
 884                 SSVALS(*rparam,0,ERRunknownlevel);
 885                 SSVAL(*rparam,2,0);
 886                 SSVAL(*rparam,4,0);
 887                 return(True);
 888         }
 889
 890         ZERO_STRUCT(handle);
 891
 892         if (QueueName == NULL || (strlen(QueueName) < 1)) {
 893                 desc.errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
 894                 goto out;
 895         }
 896
 897         status = rpc_pipe_open_interface(mem_ctx,
 898                                          &ndr_table_spoolss,
 899                                          conn->session_info,
 900                                          conn->sconn->remote_address,
 901                                          conn->sconn->local_address,
 902                                          conn->sconn->msg_ctx,
 903                                          &cli);
 904         if (!NT_STATUS_IS_OK(status)) {
 905                 DEBUG(0,("api_DosPrintQGetInfo: could not connect to spoolss: %s\n",
 906                           nt_errstr(status)));
 907                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
 908                 goto out;
 909         }
 910         b = cli->binding_handle;
 911
 912         ZERO_STRUCT(devmode_ctr);
 913
 914         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
 915                                             QueueName,
 916                                             "RAW",
 917                                             devmode_ctr,
 918                                             PRINTER_ACCESS_USE,
 919                                             &handle,
 920                                             &werr);
 921         if (!NT_STATUS_IS_OK(status)) {
 922                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
 923                 goto out;
 924         }
 925         if (!W_ERROR_IS_OK(werr)) {
 926                 desc.errcode = W_ERROR_V(werr);
 927                 goto out;
 928         }
 929
 930         werr = rpccli_spoolss_getprinter(cli, mem_ctx,
 931                                          &handle,
 932                                          2,
 933                                          0,
 934                                          &printer_info);
 935         if (!W_ERROR_IS_OK(werr)) {
 936                 desc.errcode = W_ERROR_V(werr);
 937                 goto out;
 938         }
 939
 940         if (uLevel==52) {
 941                 uint32_t server_major_version;
 942                 uint32_t server_minor_version;
 943
 944                 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
 945                                                         &handle,
 946                                                         "Windows 4.0",
 947                                                         3, /* level */
 948                                                         0,
 949                                                         0, /* version */
 950                                                         0,
 951                                                         &driver_info,
 952                                                         &server_major_version,
 953                                                         &server_minor_version);
 954                 if (!W_ERROR_IS_OK(werr)) {
 955                         desc.errcode = W_ERROR_V(werr);
 956                         goto out;
 957                 }
 958
 959                 count = get_printerdrivernumber(&driver_info.info3);
 960                 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
 961         } else {
 962                 uint32_t num_jobs;
 963                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
 964                                                &handle,
 965                                                0, /* firstjob */
 966                                                0xff, /* numjobs */
 967                                                2, /* level */
 968                                                0, /* offered */
 969                                                &num_jobs,
 970                                                &job_info);
 971                 if (!W_ERROR_IS_OK(werr)) {
 972                         desc.errcode = W_ERROR_V(werr);
 973                         goto out;
 974                 }
 975
 976                 count = num_jobs;
 977         }
 978
 979         if (mdrcnt > 0) {
 980                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
 981                 if (!*rdata) {
 982                         return False;
 983                 }
 984                 desc.base = *rdata;
 985                 desc.buflen = mdrcnt;
 986         } else {
 987                 /*
 988                  * Don't return data but need to get correct length
 989                  * init_package will return wrong size if buflen=0
 990                  */
 991                 desc.buflen = getlen(desc.format);
 992                 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
 993         }
 994
 995         if (init_package(&desc,1,count)) {
 996                 desc.subcount = count;
 997                 fill_printq_info(uLevel,&desc,count, job_info, &driver_info.info3, &printer_info.info2);
 998         }
 999
1000         *rdata_len = desc.usedlen;
1001
1002         /*
1003          * We must set the return code to ERRbuftoosmall
1004          * in order to support lanman style printing with Win NT/2k
1005          * clients       --jerry
1006          */
1007         if (!mdrcnt && lp_disable_spoolss())
1008                 desc.errcode = ERRbuftoosmall;
1009
1010  out:
1011         if (b && is_valid_policy_hnd(&handle)) {
1012                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
1013         }
1014
1015         *rdata_len = desc.usedlen;
1016         *rparam_len = 6;
1017         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1018         if (!*rparam) {
1019                 SAFE_FREE(tmpdata);
1020                 return False;
1021         }
1022         SSVALS(*rparam,0,desc.errcode);
1023         SSVAL(*rparam,2,0);
1024         SSVAL(*rparam,4,desc.neededlen);
1025
1026         DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
1027
1028         SAFE_FREE(tmpdata);
1029
1030         return(True);
1031 }
1032
1033 /****************************************************************************
1034  View list of all print jobs on all queues.
1035 ****************************************************************************/
1036
1037 static bool api_DosPrintQEnum(struct smbd_server_connection *sconn,
1038                               connection_struct *conn, uint64_t vuid,
1039                                 char *param, int tpscnt,
1040                                 char *data, int tdscnt,
1041                                 int mdrcnt, int mprcnt,
1042                                 char **rdata, char** rparam,
1043                                 int *rdata_len, int *rparam_len)
1044 {
1045         char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
1046         char *output_format1 = skip_string(param,tpscnt,param_format);
1047         char *p = skip_string(param,tpscnt,output_format1);
1048         unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1049         char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
1050         int i;
1051         struct pack_desc desc;
1052         int *subcntarr = NULL;
1053         int queuecnt = 0, subcnt = 0, succnt = 0;
1054
1055         WERROR werr = WERR_OK;
1056         TALLOC_CTX *mem_ctx = talloc_tos();
1057         NTSTATUS status;
1058         struct rpc_pipe_client *cli = NULL;
1059         struct dcerpc_binding_handle *b = NULL;
1060         struct spoolss_DevmodeContainer devmode_ctr;
1061         uint32_t num_printers;
1062         union spoolss_PrinterInfo *printer_info;
1063         union spoolss_DriverInfo *driver_info;
1064         union spoolss_JobInfo **job_info;
1065
1066         if (!param_format || !output_format1 || !p) {
1067                 return False;
1068         }
1069
1070         memset((char *)&desc,'\0',sizeof(desc));
1071
1072         DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
1073
1074         if (!prefix_ok(param_format,"WrLeh")) {
1075                 return False;
1076         }
1077         if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1078                 /*
1079                  * Patch from Scott Moomaw <scott@bridgewater.edu>
1080                  * to return the 'invalid info level' error if an
1081                  * unknown level was requested.
1082                  */
1083                 *rdata_len = 0;
1084                 *rparam_len = 6;
1085                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1086                 if (!*rparam) {
1087                         return False;
1088                 }
1089                 SSVALS(*rparam,0,ERRunknownlevel);
1090                 SSVAL(*rparam,2,0);
1091                 SSVAL(*rparam,4,0);
1092                 return(True);
1093         }
1094
1095         status = rpc_pipe_open_interface(mem_ctx,
1096                                          &ndr_table_spoolss,
1097                                          conn->session_info,
1098                                          conn->sconn->remote_address,
1099                                          conn->sconn->local_address,
1100                                          conn->sconn->msg_ctx,
1101                                          &cli);
1102         if (!NT_STATUS_IS_OK(status)) {
1103                 DEBUG(0,("api_DosPrintQEnum: could not connect to spoolss: %s\n",
1104                           nt_errstr(status)));
1105                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1106                 goto out;
1107         }
1108         b = cli->binding_handle;
1109
1110         werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
1111                                            PRINTER_ENUM_LOCAL,
1112                                            cli->srv_name_slash,
1113                                            2,
1114                                            0,
1115                                            &num_printers,
1116                                            &printer_info);
1117         if (!W_ERROR_IS_OK(werr)) {
1118                 desc.errcode = W_ERROR_V(werr);
1119                 goto out;
1120         }
1121
1122         queuecnt = num_printers;
1123
1124         job_info = talloc_array(mem_ctx, union spoolss_JobInfo *, num_printers);
1125         if (job_info == NULL) {
1126                 goto err;
1127         }
1128
1129         driver_info = talloc_array(mem_ctx, union spoolss_DriverInfo, num_printers);
1130         if (driver_info == NULL) {
1131                 goto err;
1132         }
1133
1134         if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1135                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1136                 goto err;
1137         }
1138
1139         if (mdrcnt > 0) {
1140                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1141                 if (!*rdata) {
1142                         goto err;
1143                 }
1144         }
1145         desc.base = *rdata;
1146         desc.buflen = mdrcnt;
1147
1148         subcnt = 0;
1149         for (i = 0; i < num_printers; i++) {
1150
1151                 uint32_t num_jobs;
1152                 struct policy_handle handle;
1153                 const char *printername;
1154
1155                 printername = talloc_strdup(mem_ctx, printer_info[i].info2.printername);
1156                 if (printername == NULL) {
1157                         goto err;
1158                 }
1159
1160                 ZERO_STRUCT(handle);
1161                 ZERO_STRUCT(devmode_ctr);
1162
1163                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
1164                                                     printername,
1165                                                     "RAW",
1166                                                     devmode_ctr,
1167                                                     PRINTER_ACCESS_USE,
1168                                                     &handle,
1169                                                     &werr);
1170                 if (!NT_STATUS_IS_OK(status)) {
1171                         desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1172                         goto out;
1173                 }
1174                 if (!W_ERROR_IS_OK(werr)) {
1175                         desc.errcode = W_ERROR_V(werr);
1176                         goto out;
1177                 }
1178
1179                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
1180                                                &handle,
1181                                                0, /* firstjob */
1182                                                0xff, /* numjobs */
1183                                                2, /* level */
1184                                                0, /* offered */
1185                                                &num_jobs,
1186                                                &job_info[i]);
1187                 if (!W_ERROR_IS_OK(werr)) {
1188                         desc.errcode = W_ERROR_V(werr);
1189                         goto out;
1190                 }
1191
1192                 if (uLevel==52) {
1193                         uint32_t server_major_version;
1194                         uint32_t server_minor_version;
1195
1196                         werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
1197                                                                 &handle,
1198                                                                 "Windows 4.0",
1199                                                                 3, /* level */
1200                                                                 0,
1201                                                                 0, /* version */
1202                                                                 0,
1203                                                                 &driver_info[i],
1204                                                                 &server_major_version,
1205                                                                 &server_minor_version);
1206                         if (!W_ERROR_IS_OK(werr)) {
1207                                 desc.errcode = W_ERROR_V(werr);
1208                                 goto out;
1209                         }
1210                 }
1211
1212                 subcntarr[i] = num_jobs;
1213                 subcnt += subcntarr[i];
1214
1215                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
1216         }
1217
1218         if (init_package(&desc,queuecnt,subcnt)) {
1219                 for (i = 0; i < num_printers; i++) {
1220                         fill_printq_info(uLevel,&desc,subcntarr[i], job_info[i], &driver_info[i].info3, &printer_info[i].info2);
1221                         if (desc.errcode == NERR_Success) {
1222                                 succnt = i;
1223                         }
1224                 }
1225         }
1226
1227  out:
1228         SAFE_FREE(subcntarr);
1229         *rdata_len = desc.usedlen;
1230         *rparam_len = 8;
1231         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1232         if (!*rparam) {
1233                 goto err;
1234         }
1235         SSVALS(*rparam,0,desc.errcode);
1236         SSVAL(*rparam,2,0);
1237         SSVAL(*rparam,4,succnt);
1238         SSVAL(*rparam,6,queuecnt);
1239
1240         return True;
1241
1242   err:
1243
1244         SAFE_FREE(subcntarr);
1245
1246         return False;
1247 }
1248
1249 /****************************************************************************
1250  Get info level for a server list query.
1251 ****************************************************************************/
1252
1253 static bool check_session_info(int uLevel, char* id)
1254 {
1255         switch( uLevel ) {
1256                 case 0:
1257                         if (strcmp(id,"B16") != 0) {
1258                                 return False;
1259                         }
1260                         break;
1261                 case 1:
1262                         if (strcmp(id,"B16BBDz") != 0) {
1263                                 return False;
1264                         }
1265                         break;
1266                 default:
1267                         return False;
1268         }
1269         return True;
1270 }
1271
1272 struct srv_info_struct {
1273         fstring name;
1274         uint32_t type;
1275         fstring comment;
1276         fstring domain;
1277         bool server_added;
1278 };
1279
1280 /*******************************************************************
1281  Get server info lists from the files saved by nmbd. Return the
1282  number of entries.
1283 ******************************************************************/
1284
1285 static int get_session_info(uint32_t servertype,
1286                            struct srv_info_struct **servers,
1287                            const char *domain)
1288 {
1289         int count=0;
1290         int alloced=0;
1291         char **lines;
1292         bool local_list_only;
1293         int i;
1294         char *slist_cache_path = cache_path(talloc_tos(), SERVER_LIST);
1295         if (slist_cache_path == NULL) {
1296                 return 0;
1297         }
1298
1299         lines = file_lines_load(slist_cache_path, NULL, 0, NULL);
1300         if (!lines) {
1301                 DEBUG(4, ("Can't open %s - %s\n",
1302                           slist_cache_path, strerror(errno)));
1303                 TALLOC_FREE(slist_cache_path);
1304                 return 0;
1305         }
1306         TALLOC_FREE(slist_cache_path);
1307
1308         /* request for everything is code for request all servers */
1309         if (servertype == SV_TYPE_ALL) {
1310                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1311         }
1312
1313         local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1314
1315         DEBUG(4,("Servertype search: %8x\n",servertype));
1316
1317         for (i=0;lines[i];i++) {
1318                 fstring stype;
1319                 struct srv_info_struct *s;
1320                 const char *ptr = lines[i];
1321                 bool ok = True;
1322                 TALLOC_CTX *frame = NULL;
1323                 char *p;
1324
1325                 if (!*ptr) {
1326                         continue;
1327                 }
1328
1329                 if (count == alloced) {
1330                         alloced += 10;
1331                         *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1332                         if (!*servers) {
1333                                 DEBUG(0,("get_session_info: failed to enlarge servers info struct!\n"));
1334                                 TALLOC_FREE(lines);
1335                                 return 0;
1336                         }
1337                         memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1338                 }
1339                 s = &(*servers)[count];
1340
1341                 frame = talloc_stackframe();
1342                 s->name[0] = '\0';
1343                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1344                         TALLOC_FREE(frame);
1345                         continue;
1346                 }
1347                 fstrcpy(s->name, p);
1348
1349                 stype[0] = '\0';
1350                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1351                         TALLOC_FREE(frame);
1352                         continue;
1353                 }
1354                 fstrcpy(stype, p);
1355
1356                 s->comment[0] = '\0';
1357                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1358                         TALLOC_FREE(frame);
1359                         continue;
1360                 }
1361                 fstrcpy(s->comment, p);
1362                 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1363
1364                 s->domain[0] = '\0';
1365                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1366                         /* this allows us to cope with an old nmbd */
1367                         fstrcpy(s->domain,lp_workgroup());
1368                 } else {
1369                         fstrcpy(s->domain, p);
1370                 }
1371                 TALLOC_FREE(frame);
1372
1373                 if (sscanf(stype,"%X",&s->type) != 1) {
1374                         DEBUG(4,("r:host file "));
1375                         ok = False;
1376                 }
1377
1378                 /* Filter the servers/domains we return based on what was asked for. */
1379
1380                 /* Check to see if we are being asked for a local list only. */
1381                 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1382                         DEBUG(4,("r: local list only"));
1383                         ok = False;
1384                 }
1385
1386                 /* doesn't match up: don't want it */
1387                 if (!(servertype & s->type)) {
1388                         DEBUG(4,("r:serv type "));
1389                         ok = False;
1390                 }
1391
1392                 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1393                                 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1394                         DEBUG(4,("s: dom mismatch "));
1395                         ok = False;
1396                 }
1397
1398                 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1399                         ok = False;
1400                 }
1401
1402                 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1403                 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1404
1405                 if (ok) {
1406                         DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1407                                 s->name, s->type, s->comment, s->domain));
1408                         s->server_added = True;
1409                         count++;
1410                 } else {
1411                         DEBUG(4,("%20s %8x %25s %15s\n",
1412                                 s->name, s->type, s->comment, s->domain));
1413                 }
1414         }
1415
1416         TALLOC_FREE(lines);
1417         return count;
1418 }
1419
1420 /*******************************************************************
1421  Fill in a server info structure.
1422 ******************************************************************/
1423
1424 static int fill_srv_info(struct srv_info_struct *service,
1425                          int uLevel, char **buf, int *buflen,
1426                          char **stringbuf, int *stringspace, char *baseaddr)
1427 {
1428         int struct_len;
1429         char* p;
1430         char* p2;
1431         int l2;
1432         int len;
1433
1434         switch (uLevel) {
1435                 case 0:
1436                         struct_len = 16;
1437                         break;
1438                 case 1:
1439                         struct_len = 26;
1440                         break;
1441                 default:
1442                         return -1;
1443         }
1444
1445         if (!buf) {
1446                 len = 0;
1447                 switch (uLevel) {
1448                         case 1:
1449                                 len = strlen(service->comment)+1;
1450                                 break;
1451                 }
1452
1453                 *buflen = struct_len;
1454                 *stringspace = len;
1455                 return struct_len + len;
1456         }
1457
1458         len = struct_len;
1459         p = *buf;
1460         if (*buflen < struct_len) {
1461                 return -1;
1462         }
1463         if (stringbuf) {
1464                 p2 = *stringbuf;
1465                 l2 = *stringspace;
1466         } else {
1467                 p2 = p + struct_len;
1468                 l2 = *buflen - struct_len;
1469         }
1470         if (!baseaddr) {
1471                 baseaddr = p;
1472         }
1473
1474         switch (uLevel) {
1475                 case 0:
1476                         push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1477                         break;
1478
1479                 case 1:
1480                         push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1481                         SIVAL(p,18,service->type);
1482                         SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1483                         len += CopyAndAdvance(&p2,service->comment,&l2);
1484                         break;
1485         }
1486
1487         if (stringbuf) {
1488                 *buf = p + struct_len;
1489                 *buflen -= struct_len;
1490                 *stringbuf = p2;
1491                 *stringspace = l2;
1492         } else {
1493                 *buf = p2;
1494                 *buflen -= len;
1495         }
1496         return len;
1497 }
1498
1499
1500 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1501 {
1502         return strcasecmp_m(s1->name,s2->name);
1503 }
1504
1505 /****************************************************************************
1506  View list of servers available (or possibly domains). The info is
1507  extracted from lists saved by nmbd on the local host.
1508 ****************************************************************************/
1509
1510 static bool api_RNetServerEnum2(struct smbd_server_connection *sconn,
1511                                 connection_struct *conn, uint64_t vuid,
1512                                 char *param, int tpscnt,
1513                                 char *data, int tdscnt,
1514                                 int mdrcnt, int mprcnt, char **rdata,
1515                                 char **rparam, int *rdata_len, int *rparam_len)
1516 {
1517         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1518         char *str2 = skip_string(param,tpscnt,str1);
1519         char *p = skip_string(param,tpscnt,str2);
1520         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1521         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1522         uint32_t servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1523         char *p2;
1524         int data_len, fixed_len, string_len;
1525         int f_len = 0, s_len = 0;
1526         struct srv_info_struct *servers=NULL;
1527         int counted=0,total=0;
1528         int i,missed;
1529         fstring domain;
1530         bool domain_request;
1531         bool local_request;
1532
1533         if (!str1 || !str2 || !p) {
1534                 return False;
1535         }
1536
1537         /* If someone sets all the bits they don't really mean to set
1538            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1539            known servers. */
1540
1541         if (servertype == SV_TYPE_ALL) {
1542                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1543         }
1544
1545         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1546            any other bit (they may just set this bit on its own) they
1547            want all the locally seen servers. However this bit can be
1548            set on its own so set the requested servers to be
1549            ALL - DOMAIN_ENUM. */
1550
1551         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1552                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1553         }
1554
1555         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1556         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1557
1558         p += 8;
1559
1560         if (!prefix_ok(str1,"WrLehD")) {
1561                 return False;
1562         }
1563         if (!check_session_info(uLevel,str2)) {
1564                 return False;
1565         }
1566
1567         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1568         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1569         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1570
1571         if (strcmp(str1, "WrLehDz") == 0) {
1572                 if (skip_string(param,tpscnt,p) == NULL) {
1573                         return False;
1574                 }
1575                 pull_ascii_fstring(domain, p);
1576         } else {
1577                 fstrcpy(domain, lp_workgroup());
1578         }
1579
1580         DEBUG(4, ("domain [%s]\n", domain));
1581
1582         if (lp_browse_list()) {
1583                 total = get_session_info(servertype,&servers,domain);
1584         }
1585
1586         data_len = fixed_len = string_len = 0;
1587         missed = 0;
1588
1589         TYPESAFE_QSORT(servers, total, srv_comp);
1590
1591         {
1592                 char *lastname=NULL;
1593
1594                 for (i=0;i<total;i++) {
1595                         struct srv_info_struct *s = &servers[i];
1596
1597                         if (lastname && strequal(lastname,s->name)) {
1598                                 continue;
1599                         }
1600                         lastname = s->name;
1601                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1602                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1603                                 i, s->name, s->type, s->comment, s->domain));
1604
1605                         if (data_len < buf_len) {
1606                                 counted++;
1607                                 fixed_len += f_len;
1608                                 string_len += s_len;
1609                         } else {
1610                                 missed++;
1611                         }
1612                 }
1613         }
1614
1615         *rdata_len = fixed_len + string_len;
1616         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1617         if (!*rdata) {
1618                 return False;
1619         }
1620
1621         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1622         p = *rdata;
1623         f_len = fixed_len;
1624         s_len = string_len;
1625
1626         {
1627                 char *lastname=NULL;
1628                 int count2 = counted;
1629
1630                 for (i = 0; i < total && count2;i++) {
1631                         struct srv_info_struct *s = &servers[i];
1632
1633                         if (lastname && strequal(lastname,s->name)) {
1634                                 continue;
1635                         }
1636                         lastname = s->name;
1637                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1638                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1639                                 i, s->name, s->type, s->comment, s->domain));
1640                         count2--;
1641                 }
1642         }
1643
1644         *rparam_len = 8;
1645         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1646         if (!*rparam) {
1647                 return False;
1648         }
1649         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1650         SSVAL(*rparam,2,0);
1651         SSVAL(*rparam,4,counted);
1652         SSVAL(*rparam,6,counted+missed);
1653
1654         SAFE_FREE(servers);
1655
1656         DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1657                 domain,uLevel,counted,counted+missed));
1658
1659         return True;
1660 }
1661
1662 static int srv_name_match(const char *n1, const char *n2)
1663 {
1664         /*
1665          * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1666          *
1667          *  In Windows, FirstNameToReturn need not be an exact match:
1668          *  the server will return a list of servers that exist on
1669          *  the network greater than or equal to the FirstNameToReturn.
1670          */
1671         int ret = strcasecmp_m(n1, n2);
1672
1673         if (ret <= 0) {
1674                 return 0;
1675         }
1676
1677         return ret;
1678 }
1679
1680 static bool api_RNetServerEnum3(struct smbd_server_connection *sconn,
1681                                 connection_struct *conn, uint64_t vuid,
1682                                 char *param, int tpscnt,
1683                                 char *data, int tdscnt,
1684                                 int mdrcnt, int mprcnt, char **rdata,
1685                                 char **rparam, int *rdata_len, int *rparam_len)
1686 {
1687         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1688         char *str2 = skip_string(param,tpscnt,str1);
1689         char *p = skip_string(param,tpscnt,str2);
1690         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1691         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1692         uint32_t servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1693         char *p2;
1694         int data_len, fixed_len, string_len;
1695         int f_len = 0, s_len = 0;
1696         struct srv_info_struct *servers=NULL;
1697         int counted=0,first=0,total=0;
1698         int i,missed;
1699         fstring domain;
1700         fstring first_name;
1701         bool domain_request;
1702         bool local_request;
1703
1704         if (!str1 || !str2 || !p) {
1705                 return False;
1706         }
1707
1708         /* If someone sets all the bits they don't really mean to set
1709            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1710            known servers. */
1711
1712         if (servertype == SV_TYPE_ALL) {
1713                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1714         }
1715
1716         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1717            any other bit (they may just set this bit on its own) they
1718            want all the locally seen servers. However this bit can be
1719            set on its own so set the requested servers to be
1720            ALL - DOMAIN_ENUM. */
1721
1722         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1723                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1724         }
1725
1726         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1727         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1728
1729         p += 8;
1730
1731         if (strcmp(str1, "WrLehDzz") != 0) {
1732                 return false;
1733         }
1734         if (!check_session_info(uLevel,str2)) {
1735                 return False;
1736         }
1737
1738         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1739         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1740         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1741
1742         if (skip_string(param,tpscnt,p) == NULL) {
1743                 return False;
1744         }
1745         pull_ascii_fstring(domain, p);
1746         if (domain[0] == '\0') {
1747                 fstrcpy(domain, lp_workgroup());
1748         }
1749         p = skip_string(param,tpscnt,p);
1750         if (skip_string(param,tpscnt,p) == NULL) {
1751                 return False;
1752         }
1753         pull_ascii_fstring(first_name, p);
1754
1755         DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1756                   domain, first_name));
1757
1758         if (lp_browse_list()) {
1759                 total = get_session_info(servertype,&servers,domain);
1760         }
1761
1762         data_len = fixed_len = string_len = 0;
1763         missed = 0;
1764
1765         TYPESAFE_QSORT(servers, total, srv_comp);
1766
1767         if (first_name[0] != '\0') {
1768                 struct srv_info_struct *first_server = NULL;
1769
1770                 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1771                                     srv_name_match, first_server);
1772                 if (first_server) {
1773                         first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1774                         /*
1775                          * The binary search may not find the exact match
1776                          * so we need to search backward to find the first match
1777                          *
1778                          * This implements the strange matching windows
1779                          * implements. (see the comment in srv_name_match().
1780                          */
1781                         for (;first > 0;) {
1782                                 int ret;
1783                                 ret = strcasecmp_m(first_name,
1784                                                  servers[first-1].name);
1785                                 if (ret > 0) {
1786                                         break;
1787                                 }
1788                                 first--;
1789                         }
1790                 } else {
1791                         /* we should return no entries */
1792                         first = total;
1793                 }
1794         }
1795
1796         {
1797                 char *lastname=NULL;
1798
1799                 for (i=first;i<total;i++) {
1800                         struct srv_info_struct *s = &servers[i];
1801
1802                         if (lastname && strequal(lastname,s->name)) {
1803                                 continue;
1804                         }
1805                         lastname = s->name;
1806                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1807                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1808                                 i, s->name, s->type, s->comment, s->domain));
1809
1810                         if (data_len < buf_len) {
1811                                 counted++;
1812                                 fixed_len += f_len;
1813                                 string_len += s_len;
1814                         } else {
1815                                 missed++;
1816                         }
1817                 }
1818         }
1819
1820         *rdata_len = fixed_len + string_len;
1821         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1822         if (!*rdata) {
1823                 return False;
1824         }
1825
1826         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1827         p = *rdata;
1828         f_len = fixed_len;
1829         s_len = string_len;
1830
1831         {
1832                 char *lastname=NULL;
1833                 int count2 = counted;
1834
1835                 for (i = first; i < total && count2;i++) {
1836                         struct srv_info_struct *s = &servers[i];
1837
1838                         if (lastname && strequal(lastname,s->name)) {
1839                                 continue;
1840                         }
1841                         lastname = s->name;
1842                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1843                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1844                                 i, s->name, s->type, s->comment, s->domain));
1845                         count2--;
1846                 }
1847         }
1848
1849         *rparam_len = 8;
1850         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1851         if (!*rparam) {
1852                 return False;
1853         }
1854         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1855         SSVAL(*rparam,2,0);
1856         SSVAL(*rparam,4,counted);
1857         SSVAL(*rparam,6,counted+missed);
1858
1859         DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1860                 domain,uLevel,first,first_name,
1861                 first < total ? servers[first].name : "",
1862                 counted,counted+missed));
1863
1864         SAFE_FREE(servers);
1865
1866         return True;
1867 }
1868
1869 /****************************************************************************
1870   command 0x34 - suspected of being a "Lookup Names" stub api
1871   ****************************************************************************/
1872
1873 static bool api_RNetGroupGetUsers(struct smbd_server_connection *sconn,
1874                                   connection_struct *conn, uint64_t vuid,
1875                                 char *param, int tpscnt,
1876                                 char *data, int tdscnt,
1877                                 int mdrcnt, int mprcnt, char **rdata,
1878                                 char **rparam, int *rdata_len, int *rparam_len)
1879 {
1880         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1881         char *str2 = skip_string(param,tpscnt,str1);
1882         char *p = skip_string(param,tpscnt,str2);
1883         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1884         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1885         int counted=0;
1886         int missed=0;
1887
1888         if (!str1 || !str2 || !p) {
1889                 return False;
1890         }
1891
1892         DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1893                 str1, str2, p, uLevel, buf_len));
1894
1895         if (!prefix_ok(str1,"zWrLeh")) {
1896                 return False;
1897         }
1898
1899         *rdata_len = 0;
1900
1901         *rparam_len = 8;
1902         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1903         if (!*rparam) {
1904                 return False;
1905         }
1906
1907         SSVAL(*rparam,0,0x08AC); /* informational warning message */
1908         SSVAL(*rparam,2,0);
1909         SSVAL(*rparam,4,counted);
1910         SSVAL(*rparam,6,counted+missed);
1911
1912         return True;
1913 }
1914
1915 /****************************************************************************
1916   get info about a share
1917   ****************************************************************************/
1918
1919 static bool check_share_info(int uLevel, char* id)
1920 {
1921         switch( uLevel ) {
1922                 case 0:
1923                         if (strcmp(id,"B13") != 0) {
1924                                 return False;
1925                         }
1926                         break;
1927                 case 1:
1928                         /* Level-2 descriptor is allowed (and ignored) */
1929                         if (strcmp(id,"B13BWz") != 0 &&
1930                             strcmp(id,"B13BWzWWWzB9B") != 0) {
1931                                 return False;
1932                         }
1933                         break;
1934                 case 2:
1935                         if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1936                                 return False;
1937                         }
1938                         break;
1939                 case 91:
1940                         if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1941                                 return False;
1942                         }
1943                         break;
1944                 default:
1945                         return False;
1946         }
1947         return True;
1948 }
1949
1950 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1951                            char** buf, int* buflen,
1952                            char** stringbuf, int* stringspace, char* baseaddr)
1953 {
1954         const struct loadparm_substitution *lp_sub =
1955                 loadparm_s3_global_substitution();
1956         int struct_len;
1957         char* p;
1958         char* p2;
1959         int l2;
1960         int len;
1961
1962         switch( uLevel ) {
1963                 case 0:
1964                         struct_len = 13;
1965                         break;
1966                 case 1:
1967                         struct_len = 20;
1968                         break;
1969                 case 2:
1970                         struct_len = 40;
1971                         break;
1972                 case 91:
1973                         struct_len = 68;
1974                         break;
1975                 default:
1976                         return -1;
1977         }
1978
1979         if (!buf) {
1980                 len = 0;
1981
1982                 if (uLevel > 0) {
1983                         len += StrlenExpanded(conn,snum,lp_comment(talloc_tos(), lp_sub, snum));
1984                 }
1985                 if (uLevel > 1) {
1986                         len += strlen(lp_path(talloc_tos(), lp_sub, snum)) + 1;
1987                 }
1988                 if (buflen) {
1989                         *buflen = struct_len;
1990                 }
1991                 if (stringspace) {
1992                         *stringspace = len;
1993                 }
1994                 return struct_len + len;
1995         }
1996
1997         len = struct_len;
1998         p = *buf;
1999         if ((*buflen) < struct_len) {
2000                 return -1;
2001         }
2002
2003         if (stringbuf) {
2004                 p2 = *stringbuf;
2005                 l2 = *stringspace;
2006         } else {
2007                 p2 = p + struct_len;
2008                 l2 = (*buflen) - struct_len;
2009         }
2010
2011         if (!baseaddr) {
2012                 baseaddr = p;
2013         }
2014
2015         push_ascii(p,lp_servicename(talloc_tos(), lp_sub, snum),13, STR_TERMINATE);
2016
2017         if (uLevel > 0) {
2018                 int type;
2019
2020                 SCVAL(p,13,0);
2021                 type = STYPE_DISKTREE;
2022                 if (lp_printable(snum)) {
2023                         type = STYPE_PRINTQ;
2024                 }
2025                 if (strequal("IPC",lp_fstype(snum))) {
2026                         type = STYPE_IPC;
2027                 }
2028                 SSVAL(p,14,type);               /* device type */
2029                 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
2030                 len += CopyExpanded(conn,snum,&p2,lp_comment(talloc_tos(), lp_sub, snum),&l2);
2031         }
2032
2033         if (uLevel > 1) {
2034                 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
2035                 SSVALS(p,22,-1);                /* max uses */
2036                 SSVAL(p,24,1); /* current uses */
2037                 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
2038                 len += CopyAndAdvance(&p2,lp_path(talloc_tos(),lp_sub, snum),&l2);
2039                 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
2040         }
2041
2042         if (uLevel > 2) {
2043                 memset(p+40,0,SHPWLEN+2);
2044                 SSVAL(p,50,0);
2045                 SIVAL(p,52,0);
2046                 SSVAL(p,56,0);
2047                 SSVAL(p,58,0);
2048                 SIVAL(p,60,0);
2049                 SSVAL(p,64,0);
2050                 SSVAL(p,66,0);
2051         }
2052
2053         if (stringbuf) {
2054                 (*buf) = p + struct_len;
2055                 (*buflen) -= struct_len;
2056                 (*stringbuf) = p2;
2057                 (*stringspace) = l2;
2058         } else {
2059                 (*buf) = p2;
2060                 (*buflen) -= len;
2061         }
2062
2063         return len;
2064 }
2065
2066 static bool api_RNetShareGetInfo(struct smbd_server_connection *sconn,
2067                                  connection_struct *conn,uint64_t vuid,
2068                                 char *param, int tpscnt,
2069                                 char *data, int tdscnt,
2070                                 int mdrcnt,int mprcnt,
2071                                 char **rdata,char **rparam,
2072                                 int *rdata_len,int *rparam_len)
2073 {
2074         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2075         char *str2 = skip_string(param,tpscnt,str1);
2076         char *netname_in = skip_string(param,tpscnt,str2);
2077         char *netname = NULL;
2078         char *p = skip_string(param,tpscnt,netname);
2079         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2080         int snum;
2081
2082         if (!str1 || !str2 || !netname_in || !p) {
2083                 return False;
2084         }
2085
2086         snum = find_service(talloc_tos(), netname_in, &netname);
2087         if (snum < 0 || !netname) {
2088                 return False;
2089         }
2090
2091         /* check it's a supported varient */
2092         if (!prefix_ok(str1,"zWrLh")) {
2093                 return False;
2094         }
2095         if (!check_share_info(uLevel,str2)) {
2096                 return False;
2097         }
2098
2099         *rdata = smb_realloc_limit(*rdata,mdrcnt);
2100         if (!*rdata) {
2101                 return False;
2102         }
2103         p = *rdata;
2104         *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
2105         if (*rdata_len < 0) {
2106                 return False;
2107         }
2108
2109         *rparam_len = 6;
2110         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2111         if (!*rparam) {
2112                 return False;
2113         }
2114         SSVAL(*rparam,0,NERR_Success);
2115         SSVAL(*rparam,2,0);             /* converter word */
2116         SSVAL(*rparam,4,*rdata_len);
2117
2118         return True;
2119 }
2120
2121 /****************************************************************************
2122   View the list of available shares.
2123
2124   This function is the server side of the NetShareEnum() RAP call.
2125   It fills the return buffer with share names and share comments.
2126   Note that the return buffer normally (in all known cases) allows only
2127   twelve byte strings for share names (plus one for a nul terminator).
2128   Share names longer than 12 bytes must be skipped.
2129  ****************************************************************************/
2130
2131 static bool api_RNetShareEnum(struct smbd_server_connection *sconn,
2132                               connection_struct *conn, uint64_t vuid,
2133                                 char *param, int tpscnt,
2134                                 char *data, int tdscnt,
2135                                 int                mdrcnt,
2136                                 int                mprcnt,
2137                                 char             **rdata,
2138                                 char             **rparam,
2139                                 int               *rdata_len,
2140                                 int               *rparam_len )
2141 {
2142         const struct loadparm_substitution *lp_sub =
2143                 loadparm_s3_global_substitution();
2144         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2145         char *str2 = skip_string(param,tpscnt,str1);
2146         char *p = skip_string(param,tpscnt,str2);
2147         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2148         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
2149         char *p2;
2150         int count = 0;
2151         int total=0,counted=0;
2152         bool missed = False;
2153         int i;
2154         int data_len, fixed_len, string_len;
2155         int f_len = 0, s_len = 0;
2156
2157         if (!str1 || !str2 || !p) {
2158                 return False;
2159         }
2160
2161         if (!prefix_ok(str1,"WrLeh")) {
2162                 return False;
2163         }
2164         if (!check_share_info(uLevel,str2)) {
2165                 return False;
2166         }
2167
2168         /* Ensure all the usershares are loaded. */
2169         become_root();
2170         delete_and_reload_printers();
2171         load_registry_shares();
2172         count = load_usershare_shares(NULL, connections_snum_used);
2173         unbecome_root();
2174
2175         data_len = fixed_len = string_len = 0;
2176         for (i=0;i<count;i++) {
2177                 fstring servicename_dos;
2178                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2179                         continue;
2180                 }
2181                 push_ascii_fstring(servicename_dos, lp_servicename(talloc_tos(), lp_sub, i));
2182                 /* Maximum name length = 13. */
2183                 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2184                         total++;
2185                         data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2186                         if (data_len < buf_len) {
2187                                 counted++;
2188                                 fixed_len += f_len;
2189                                 string_len += s_len;
2190                         } else {
2191                                 missed = True;
2192                         }
2193                 }
2194         }
2195
2196         *rdata_len = fixed_len + string_len;
2197         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2198         if (!*rdata) {
2199                 return False;
2200         }
2201
2202         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
2203         p = *rdata;
2204         f_len = fixed_len;
2205         s_len = string_len;
2206
2207         for( i = 0; i < count; i++ ) {
2208                 fstring servicename_dos;
2209                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2210                         continue;
2211                 }
2212
2213                 push_ascii_fstring(servicename_dos,
2214                                    lp_servicename(talloc_tos(), lp_sub, i));
2215                 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2216                         if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2217                                 break;
2218                         }
2219                 }
2220         }
2221
2222         *rparam_len = 8;
2223         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2224         if (!*rparam) {
2225                 return False;
2226         }
2227         SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2228         SSVAL(*rparam,2,0);
2229         SSVAL(*rparam,4,counted);
2230         SSVAL(*rparam,6,total);
2231
2232         DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2233                 counted,total,uLevel,
2234                 buf_len,*rdata_len,mdrcnt));
2235
2236         return True;
2237 }
2238
2239 /****************************************************************************
2240   Add a share
2241   ****************************************************************************/
2242
2243 static bool api_RNetShareAdd(struct smbd_server_connection *sconn,
2244                              connection_struct *conn,uint64_t vuid,
2245                                 char *param, int tpscnt,
2246                                 char *data, int tdscnt,
2247                                 int mdrcnt,int mprcnt,
2248                                 char **rdata,char **rparam,
2249                                 int *rdata_len,int *rparam_len)
2250 {
2251         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2252         char *str2 = skip_string(param,tpscnt,str1);
2253         char *p = skip_string(param,tpscnt,str2);
2254         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2255         fstring sharename;
2256         fstring comment;
2257         char *pathname = NULL;
2258         unsigned int offset;
2259         int res = ERRunsup;
2260         size_t converted_size;
2261
2262         WERROR werr = WERR_OK;
2263         TALLOC_CTX *mem_ctx = talloc_tos();
2264         NTSTATUS status;
2265         struct rpc_pipe_client *cli = NULL;
2266         union srvsvc_NetShareInfo info;
2267         struct srvsvc_NetShareInfo2 info2;
2268         struct dcerpc_binding_handle *b;
2269
2270         if (!str1 || !str2 || !p) {
2271                 return False;
2272         }
2273
2274         /* check it's a supported varient */
2275         if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2276                 return False;
2277         }
2278         if (!check_share_info(uLevel,str2)) {
2279                 return False;
2280         }
2281         if (uLevel != 2) {
2282                 return False;
2283         }
2284
2285         /* Do we have a string ? */
2286         if (skip_string(data,mdrcnt,data) == NULL) {
2287                 return False;
2288         }
2289         pull_ascii_fstring(sharename,data);
2290
2291         if (mdrcnt < 28) {
2292                 return False;
2293         }
2294
2295         /* only support disk share adds */
2296         if (SVAL(data,14)!=STYPE_DISKTREE) {
2297                 return False;
2298         }
2299
2300         offset = IVAL(data, 16);
2301         if (offset >= mdrcnt) {
2302                 res = ERRinvalidparam;
2303                 goto out;
2304         }
2305
2306         /* Do we have a string ? */
2307         if (skip_string(data,mdrcnt,data+offset) == NULL) {
2308                 return False;
2309         }
2310         pull_ascii_fstring(comment, offset? (data+offset) : "");
2311
2312         offset = IVAL(data, 26);
2313
2314         if (offset >= mdrcnt) {
2315                 res = ERRinvalidparam;
2316                 goto out;
2317         }
2318
2319         /* Do we have a string ? */
2320         if (skip_string(data,mdrcnt,data+offset) == NULL) {
2321                 return False;
2322         }
2323
2324         if (!pull_ascii_talloc(talloc_tos(), &pathname,
2325                                offset ? (data+offset) : "", &converted_size))
2326         {
2327                 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2328                          strerror(errno)));
2329         }
2330
2331         if (!pathname) {
2332                 return false;
2333         }
2334
2335         status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc,
2336                                         conn->session_info,
2337                                         conn->sconn->remote_address,
2338                                         conn->sconn->local_address,
2339                                         conn->sconn->msg_ctx,
2340                                         &cli);
2341         if (!NT_STATUS_IS_OK(status)) {
2342                 DEBUG(0,("api_RNetShareAdd: could not connect to srvsvc: %s\n",
2343                           nt_errstr(status)));
2344                 res = W_ERROR_V(ntstatus_to_werror(status));
2345                 goto out;
2346         }
2347
2348         b = cli->binding_handle;
2349
2350         info2.name              = sharename;
2351         info2.type              = STYPE_DISKTREE;
2352         info2.comment           = comment;
2353         info2.permissions       = 0;
2354         info2.max_users         = 0;
2355         info2.current_users     = 0;
2356         info2.path              = pathname;
2357         info2.password          = NULL;
2358
2359         info.info2 = &info2;
2360
2361         status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
2362                                            cli->srv_name_slash,
2363                                            2,
2364                                            &info,
2365                                            NULL,
2366                                            &werr);
2367         if (!NT_STATUS_IS_OK(status)) {
2368                 res = W_ERROR_V(ntstatus_to_werror(status));
2369                 goto out;
2370         }
2371         if (!W_ERROR_IS_OK(werr)) {
2372                 res = W_ERROR_V(werr);
2373                 goto out;
2374         }
2375
2376         *rparam_len = 6;
2377         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2378         if (!*rparam) {
2379                 return False;
2380         }
2381         SSVAL(*rparam,0,NERR_Success);
2382         SSVAL(*rparam,2,0);             /* converter word */
2383         SSVAL(*rparam,4,*rdata_len);
2384         *rdata_len = 0;
2385
2386         return True;
2387
2388   out:
2389
2390         *rparam_len = 4;
2391         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2392         if (!*rparam) {
2393                 return False;
2394         }
2395         *rdata_len = 0;
2396         SSVAL(*rparam,0,res);
2397         SSVAL(*rparam,2,0);
2398         return True;
2399 }
2400
2401 /****************************************************************************
2402   view list of groups available
2403   ****************************************************************************/
2404
2405 static bool api_RNetGroupEnum(struct smbd_server_connection *sconn,
2406                               connection_struct *conn,uint64_t vuid,
2407                                 char *param, int tpscnt,
2408                                 char *data, int tdscnt,
2409                                 int mdrcnt,int mprcnt,
2410                                 char **rdata,char **rparam,
2411                                 int *rdata_len,int *rparam_len)
2412 {
2413         int i;
2414         int errflags=0;
2415         int resume_context, cli_buf_size;
2416         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2417         char *str2 = skip_string(param,tpscnt,str1);
2418         char *p = skip_string(param,tpscnt,str2);
2419
2420         uint32_t num_groups;
2421         uint32_t resume_handle;
2422         struct rpc_pipe_client *samr_pipe = NULL;
2423         struct policy_handle samr_handle, domain_handle;
2424         NTSTATUS status, result;
2425         struct dcerpc_binding_handle *b;
2426
2427         if (!str1 || !str2 || !p) {
2428                 return False;
2429         }
2430
2431         if (strcmp(str1,"WrLeh") != 0) {
2432                 return False;
2433         }
2434
2435         /* parameters
2436          * W-> resume context (number of users to skip)
2437          * r -> return parameter pointer to receive buffer
2438          * L -> length of receive buffer
2439          * e -> return parameter number of entries
2440          * h -> return parameter total number of users
2441          */
2442
2443         if (strcmp("B21",str2) != 0) {
2444                 return False;
2445         }
2446
2447         status = rpc_pipe_open_interface(
2448                 talloc_tos(), &ndr_table_samr,
2449                 conn->session_info, conn->sconn->remote_address,
2450                 conn->sconn->local_address, conn->sconn->msg_ctx, &samr_pipe);
2451         if (!NT_STATUS_IS_OK(status)) {
2452                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2453                           nt_errstr(status)));
2454                 return false;
2455         }
2456
2457         b = samr_pipe->binding_handle;
2458
2459         status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2460                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2461                                       &result);
2462         if (!NT_STATUS_IS_OK(status)) {
2463                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2464                           nt_errstr(status)));
2465                 return false;
2466         }
2467         if (!NT_STATUS_IS_OK(result)) {
2468                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2469                           nt_errstr(result)));
2470                 return false;
2471         }
2472
2473         status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2474                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2475                                         get_global_sam_sid(), &domain_handle,
2476                                         &result);
2477         if (!NT_STATUS_IS_OK(status)) {
2478                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2479                           nt_errstr(status)));
2480                 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2481                 return false;
2482         }
2483         if (!NT_STATUS_IS_OK(result)) {
2484                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2485                           nt_errstr(result)));
2486                 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2487                 return false;
2488         }
2489
2490         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2491         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2492         DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2493                   "%d\n", resume_context, cli_buf_size));
2494
2495         *rdata_len = cli_buf_size;
2496         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2497         if (!*rdata) {
2498                 return False;
2499         }
2500
2501         p = *rdata;
2502
2503         errflags = NERR_Success;
2504         num_groups = 0;
2505         resume_handle = 0;
2506
2507         while (true) {
2508                 struct samr_SamArray *sam_entries;
2509                 uint32_t num_entries;
2510
2511                 status = dcerpc_samr_EnumDomainGroups(b, talloc_tos(),
2512                                                       &domain_handle,
2513                                                       &resume_handle,
2514                                                       &sam_entries, 1,
2515                                                       &num_entries,
2516                                                       &result);
2517                 if (!NT_STATUS_IS_OK(status)) {
2518                         DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2519                                    "%s\n", nt_errstr(status)));
2520                         break;
2521                 }
2522                 if (!NT_STATUS_IS_OK(result)) {
2523                         status = result;
2524                         DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2525                                    "%s\n", nt_errstr(result)));
2526                         break;
2527                 }
2528
2529                 if (num_entries == 0) {
2530                         DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2531                                    "no entries -- done\n"));
2532                         break;
2533                 }
2534
2535                 for(i=0; i<num_entries; i++) {
2536                         const char *name;
2537
2538                         name = sam_entries->entries[i].name.string;
2539
2540                         if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2541                                 /* set overflow error */
2542                                 DEBUG(3,("overflow on entry %d group %s\n", i,
2543                                          name));
2544                                 errflags=234;
2545                                 break;
2546                         }
2547
2548                         /* truncate the name at 21 chars. */
2549                         memset(p, 0, 21);
2550                         strlcpy(p, name, 21);
2551                         DEBUG(10,("adding entry %d group %s\n", i, p));
2552                         p += 21;
2553                         p += 5; /* Both NT4 and W2k3SP1 do padding here.  No
2554                                  * idea why... */
2555                         num_groups += 1;
2556                 }
2557
2558                 if (errflags != NERR_Success) {
2559                         break;
2560                 }
2561
2562                 TALLOC_FREE(sam_entries);
2563         }
2564
2565         dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2566         dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2567
2568         *rdata_len = PTR_DIFF(p,*rdata);
2569
2570         *rparam_len = 8;
2571         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2572         if (!*rparam) {
2573                 return False;
2574         }
2575         SSVAL(*rparam, 0, errflags);
2576         SSVAL(*rparam, 2, 0);           /* converter word */
2577         SSVAL(*rparam, 4, num_groups);  /* is this right?? */
2578         SSVAL(*rparam, 6, resume_context+num_groups);   /* is this right?? */
2579
2580         return(True);
2581 }
2582
2583 /*******************************************************************
2584  Get groups that a user is a member of.
2585 ******************************************************************/
2586
2587 static bool api_NetUserGetGroups(struct smbd_server_connection *sconn,
2588                                  connection_struct *conn,uint64_t vuid,
2589                                 char *param, int tpscnt,
2590                                 char *data, int tdscnt,
2591                                 int mdrcnt,int mprcnt,
2592                                 char **rdata,char **rparam,
2593                                 int *rdata_len,int *rparam_len)
2594 {
2595         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2596         char *str2 = skip_string(param,tpscnt,str1);
2597         char *UserName = skip_string(param,tpscnt,str2);
2598         char *p = skip_string(param,tpscnt,UserName);
2599         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2600         const char *level_string;
2601         int count=0;
2602         bool ret = False;
2603         uint32_t i;
2604         char *endp = NULL;
2605
2606         struct rpc_pipe_client *samr_pipe = NULL;
2607         struct policy_handle samr_handle, domain_handle, user_handle;
2608         struct lsa_String name;
2609         struct lsa_Strings names;
2610         struct samr_Ids type, rid;
2611         struct samr_RidWithAttributeArray *rids;
2612         NTSTATUS status, result;
2613         struct dcerpc_binding_handle *b;
2614
2615         if (!str1 || !str2 || !UserName || !p) {
2616                 return False;
2617         }
2618
2619         *rparam_len = 8;
2620         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2621         if (!*rparam) {
2622                 return False;
2623         }
2624
2625         /* check it's a supported varient */
2626
2627         if ( strcmp(str1,"zWrLeh") != 0 )
2628                 return False;
2629
2630         switch( uLevel ) {
2631                 case 0:
2632                         level_string = "B21";
2633                         break;
2634                 default:
2635                         return False;
2636         }
2637
2638         if (strcmp(level_string,str2) != 0)
2639                 return False;
2640
2641         *rdata_len = mdrcnt + 1024;
2642         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2643         if (!*rdata) {
2644                 return False;
2645         }
2646
2647         SSVAL(*rparam,0,NERR_Success);
2648         SSVAL(*rparam,2,0);             /* converter word */
2649
2650         p = *rdata;
2651         endp = *rdata + *rdata_len;
2652
2653         status = rpc_pipe_open_interface(
2654                 talloc_tos(), &ndr_table_samr,
2655                 conn->session_info, conn->sconn->remote_address,
2656                 conn->sconn->local_address, conn->sconn->msg_ctx, &samr_pipe);
2657         if (!NT_STATUS_IS_OK(status)) {
2658                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2659                           nt_errstr(status)));
2660                 return false;
2661         }
2662
2663         b = samr_pipe->binding_handle;
2664
2665         status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2666                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2667                                       &result);
2668         if (!NT_STATUS_IS_OK(status)) {
2669                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2670                           nt_errstr(status)));
2671                 return false;
2672         }
2673         if (!NT_STATUS_IS_OK(result)) {
2674                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2675                           nt_errstr(result)));
2676                 return false;
2677         }
2678
2679         status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2680                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2681                                         get_global_sam_sid(), &domain_handle,
2682                                         &result);
2683         if (!NT_STATUS_IS_OK(status)) {
2684                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2685                           nt_errstr(status)));
2686                 goto close_sam;
2687         }
2688         if (!NT_STATUS_IS_OK(result)) {
2689                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2690                           nt_errstr(result)));
2691                 goto close_sam;
2692         }
2693
2694         name.string = UserName;
2695
2696         status = dcerpc_samr_LookupNames(b, talloc_tos(),
2697                                          &domain_handle, 1, &name,
2698                                          &rid, &type,
2699                                          &result);
2700         if (!NT_STATUS_IS_OK(status)) {
2701                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2702                           nt_errstr(status)));
2703                 goto close_domain;
2704         }
2705         if (!NT_STATUS_IS_OK(result)) {
2706                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2707                           nt_errstr(result)));
2708                 goto close_domain;
2709         }
2710         if (rid.count != 1) {
2711                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2712                 goto close_domain;
2713         }
2714         if (type.count != 1) {
2715                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2716                 goto close_domain;
2717         }
2718
2719         if (type.ids[0] != SID_NAME_USER) {
2720                 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2721                            sid_type_lookup(type.ids[0])));
2722                 goto close_domain;
2723         }
2724
2725         status = dcerpc_samr_OpenUser(b, talloc_tos(),
2726                                       &domain_handle,
2727                                       SAMR_USER_ACCESS_GET_GROUPS,
2728                                       rid.ids[0], &user_handle,
2729                                       &result);
2730         if (!NT_STATUS_IS_OK(status)) {
2731                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2732                           nt_errstr(status)));
2733                 goto close_domain;
2734         }
2735         if (!NT_STATUS_IS_OK(result)) {
2736                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2737                           nt_errstr(result)));
2738                 goto close_domain;
2739         }
2740
2741         status = dcerpc_samr_GetGroupsForUser(b, talloc_tos(),
2742                                               &user_handle, &rids,
2743                                               &result);
2744         if (!NT_STATUS_IS_OK(status)) {
2745                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2746                           nt_errstr(status)));
2747                 goto close_user;
2748         }
2749         if (!NT_STATUS_IS_OK(result)) {
2750                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2751                           nt_errstr(result)));
2752                 goto close_user;
2753         }
2754
2755         for (i=0; i<rids->count; i++) {
2756
2757                 status = dcerpc_samr_LookupRids(b, talloc_tos(),
2758                                                 &domain_handle,
2759                                                 1, &rids->rids[i].rid,
2760                                                 &names, &type,
2761                                                 &result);
2762                 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result) && (names.count == 1)) {
2763                         strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2764                         p += 21;
2765                         count++;
2766                 }
2767         }
2768
2769         *rdata_len = PTR_DIFF(p,*rdata);
2770
2771         SSVAL(*rparam,4,count); /* is this right?? */
2772         SSVAL(*rparam,6,count); /* is this right?? */
2773
2774         ret = True;
2775
2776  close_user:
2777         dcerpc_samr_Close(b, talloc_tos(), &user_handle, &result);
2778  close_domain:
2779         dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2780  close_sam:
2781         dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2782
2783         return ret;
2784 }
2785
2786 /*******************************************************************
2787  Get all users.
2788 ******************************************************************/
2789
2790 static bool api_RNetUserEnum(struct smbd_server_connection *sconn,
2791                              connection_struct *conn, uint64_t vuid,
2792                                 char *param, int tpscnt,
2793                                 char *data, int tdscnt,
2794                                 int mdrcnt,int mprcnt,
2795                                 char **rdata,char **rparam,
2796                                 int *rdata_len,int *rparam_len)
2797 {
2798         int count_sent=0;
2799         int num_users=0;
2800         int errflags=0;
2801         int i, resume_context, cli_buf_size;
2802         uint32_t resume_handle;
2803
2804         struct rpc_pipe_client *samr_pipe = NULL;
2805         struct policy_handle samr_handle, domain_handle;
2806         NTSTATUS status, result;
2807
2808         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2809         char *str2 = skip_string(param,tpscnt,str1);
2810         char *p = skip_string(param,tpscnt,str2);
2811         char *endp = NULL;
2812
2813         struct dcerpc_binding_handle *b;
2814
2815         if (!str1 || !str2 || !p) {
2816                 return False;
2817         }
2818
2819         if (strcmp(str1,"WrLeh") != 0)
2820                 return False;
2821         /* parameters
2822           * W-> resume context (number of users to skip)
2823           * r -> return parameter pointer to receive buffer
2824           * L -> length of receive buffer
2825           * e -> return parameter number of entries
2826           * h -> return parameter total number of users
2827           */
2828
2829         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2830         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2831         DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2832                         resume_context, cli_buf_size));
2833
2834         *rparam_len = 8;
2835         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2836         if (!*rparam) {
2837                 return False;
2838         }
2839
2840         /* check it's a supported varient */
2841         if (strcmp("B21",str2) != 0)
2842                 return False;
2843
2844         *rdata_len = cli_buf_size;
2845         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2846         if (!*rdata) {
2847                 return False;
2848         }
2849
2850         p = *rdata;
2851         endp = *rdata + *rdata_len;
2852
2853         status = rpc_pipe_open_interface(
2854                 talloc_tos(), &ndr_table_samr,
2855                 conn->session_info, conn->sconn->remote_address,
2856                 conn->sconn->local_address, conn->sconn->msg_ctx, &samr_pipe);
2857         if (!NT_STATUS_IS_OK(status)) {
2858                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2859                           nt_errstr(status)));
2860                 return false;
2861         }
2862
2863         b = samr_pipe->binding_handle;
2864
2865         status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2866                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2867                                       &result);
2868         if (!NT_STATUS_IS_OK(status)) {
2869                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2870                           nt_errstr(status)));
2871                 return false;
2872         }
2873         if (!NT_STATUS_IS_OK(result)) {
2874                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2875                           nt_errstr(result)));
2876                 return false;
2877         }
2878
2879         status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2880                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2881                                         get_global_sam_sid(), &domain_handle,
2882                                         &result);
2883         if (!NT_STATUS_IS_OK(status)) {
2884                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2885                           nt_errstr(status)));
2886                 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2887                 return false;
2888         }
2889         if (!NT_STATUS_IS_OK(result)) {
2890                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2891                           nt_errstr(result)));
2892                 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2893                 return false;
2894         }
2895
2896         errflags=NERR_Success;
2897
2898         resume_handle = 0;
2899
2900         while (true) {
2901                 struct samr_SamArray *sam_entries;
2902                 uint32_t num_entries;
2903
2904                 status = dcerpc_samr_EnumDomainUsers(b, talloc_tos(),
2905                                                      &domain_handle,
2906                                                      &resume_handle,
2907                                                      0, &sam_entries, 1,
2908                                                      &num_entries,
2909                                                      &result);
2910
2911                 if (!NT_STATUS_IS_OK(status)) {
2912                         DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2913                                    "%s\n", nt_errstr(status)));
2914                         break;
2915                 }
2916                 if (!NT_STATUS_IS_OK(result)) {
2917                         DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2918                                    "%s\n", nt_errstr(result)));
2919                         break;
2920                 }
2921
2922                 if (num_entries == 0) {
2923                         DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2924                                    "no entries -- done\n"));
2925                         break;
2926                 }
2927
2928                 for (i=0; i<num_entries; i++) {
2929                         const char *name;
2930
2931                         name = sam_entries->entries[i].name.string;
2932
2933                         if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2934                            &&(strlen(name)<=21)) {
2935                                 strlcpy(p,name,PTR_DIFF(endp,p));
2936                                 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2937                                           "username %s\n",count_sent,p));
2938                                 p += 21;
2939                                 count_sent++;
2940                         } else {
2941                                 /* set overflow error */
2942                                 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2943                                           "username %s\n",count_sent,name));
2944                                 errflags=234;
2945                                 break;
2946                         }
2947                 }
2948
2949                 if (errflags != NERR_Success) {
2950                         break;
2951                 }
2952
2953                 TALLOC_FREE(sam_entries);
2954         }
2955
2956         dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2957         dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2958
2959         *rdata_len = PTR_DIFF(p,*rdata);
2960
2961         SSVAL(*rparam,0,errflags);
2962         SSVAL(*rparam,2,0);           /* converter word */
2963         SSVAL(*rparam,4,count_sent);  /* is this right?? */
2964         SSVAL(*rparam,6,num_users); /* is this right?? */
2965
2966         return True;
2967 }
2968
2969 /****************************************************************************
2970  Get the time of day info.
2971 ****************************************************************************/
2972
2973 static bool api_NetRemoteTOD(struct smbd_server_connection *sconn,
2974                              connection_struct *conn,uint64_t vuid,
2975                                 char *param, int tpscnt,
2976                                 char *data, int tdscnt,
2977                                 int mdrcnt,int mprcnt,
2978                                 char **rdata,char **rparam,
2979                                 int *rdata_len,int *rparam_len)
2980 {
2981         struct tm *t;
2982         time_t unixdate = time(NULL);
2983         char *p;
2984
2985         *rparam_len = 4;
2986         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2987         if (!*rparam) {
2988                 return False;
2989         }
2990
2991         *rdata_len = 21;
2992         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2993         if (!*rdata) {
2994                 return False;
2995         }
2996
2997         SSVAL(*rparam,0,NERR_Success);
2998         SSVAL(*rparam,2,0);             /* converter word */
2999
3000         p = *rdata;
3001
3002         srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
3003                                             by NT in a "net time" operation,
3004                                             it seems to ignore the one below */
3005
3006         /* the client expects to get localtime, not GMT, in this bit
3007                 (I think, this needs testing) */
3008         t = localtime(&unixdate);
3009         if (!t) {
3010                 return False;
3011         }
3012
3013         SIVAL(p,4,0);           /* msecs ? */
3014         SCVAL(p,8,t->tm_hour);
3015         SCVAL(p,9,t->tm_min);
3016         SCVAL(p,10,t->tm_sec);
3017         SCVAL(p,11,0);          /* hundredths of seconds */
3018         SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
3019         SSVAL(p,14,10000);              /* timer interval in 0.0001 of sec */
3020         SCVAL(p,16,t->tm_mday);
3021         SCVAL(p,17,t->tm_mon + 1);
3022         SSVAL(p,18,1900+t->tm_year);
3023         SCVAL(p,20,t->tm_wday);
3024
3025         return True;
3026 }
3027
3028 /****************************************************************************
3029   Set the user password (SamOEM version - gets plaintext).
3030 ****************************************************************************/
3031
3032 static bool api_SamOEMChangePassword(struct smbd_server_connection *sconn,
3033                                      connection_struct *conn,uint64_t vuid,
3034                                 char *param, int tpscnt,
3035                                 char *data, int tdscnt,
3036                                 int mdrcnt,int mprcnt,
3037                                 char **rdata,char **rparam,
3038                                 int *rdata_len,int *rparam_len)
3039 {
3040         fstring user;
3041         char *p = get_safe_str_ptr(param,tpscnt,param,2);
3042
3043         TALLOC_CTX *mem_ctx = talloc_tos();
3044         NTSTATUS status, result;
3045         struct rpc_pipe_client *cli = NULL;
3046         struct lsa_AsciiString server, account;
3047         struct samr_CryptPassword password;
3048         struct samr_Password hash;
3049         int errcode = NERR_badpass;
3050         int bufsize;
3051         struct dcerpc_binding_handle *b;
3052
3053         *rparam_len = 4;
3054         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3055         if (!*rparam) {
3056                 return False;
3057         }
3058
3059         if (!p) {
3060                 return False;
3061         }
3062         *rdata_len = 0;
3063
3064         SSVAL(*rparam,0,NERR_badpass);
3065
3066         /*
3067          * Check the parameter definition is correct.
3068          */
3069
3070         /* Do we have a string ? */
3071         if (skip_string(param,tpscnt,p) == 0) {
3072                 return False;
3073         }
3074         if(!strequal(p, "zsT")) {
3075                 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
3076                 return False;
3077         }
3078         p = skip_string(param, tpscnt, p);
3079         if (!p) {
3080                 return False;
3081         }
3082
3083         /* Do we have a string ? */
3084         if (skip_string(param,tpscnt,p) == 0) {
3085                 return False;
3086         }
3087         if(!strequal(p, "B516B16")) {
3088                 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
3089                 return False;
3090         }
3091         p = skip_string(param,tpscnt,p);
3092         if (!p) {
3093                 return False;
3094         }
3095         /* Do we have a string ? */
3096         if (skip_string(param,tpscnt,p) == 0) {
3097                 return False;
3098         }
3099         p += pull_ascii_fstring(user,p);
3100
3101         DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
3102
3103         if (tdscnt != 532) {
3104                 errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
3105                 goto out;
3106         }
3107
3108         bufsize = get_safe_SVAL(param,tpscnt,p,0,-1);
3109         if (bufsize != 532) {
3110                 errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
3111                 goto out;
3112         }
3113
3114         memcpy(password.data, data, 516);
3115         memcpy(hash.hash, data+516, 16);
3116
3117         status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr,
3118                                         conn->session_info,
3119                                         conn->sconn->remote_address,
3120                                         conn->sconn->local_address,
3121                                         conn->sconn->msg_ctx,
3122                                         &cli);
3123         if (!NT_STATUS_IS_OK(status)) {
3124                 DEBUG(0,("api_SamOEMChangePassword: could not connect to samr: %s\n",
3125                           nt_errstr(status)));
3126                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3127                 goto out;
3128         }
3129
3130         b = cli->binding_handle;
3131
3132         init_lsa_AsciiString(&server, lp_netbios_name());
3133         init_lsa_AsciiString(&account, user);
3134
3135         status = dcerpc_samr_OemChangePasswordUser2(b, mem_ctx,
3136                                                     &server,
3137                                                     &account,
3138                                                     &password,
3139                                                     &hash,
3140                                                     &result);
3141         if (!NT_STATUS_IS_OK(status)) {
3142                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3143                 goto out;
3144         }
3145         if (!NT_STATUS_IS_OK(result)) {
3146                 errcode = W_ERROR_V(ntstatus_to_werror(result));
3147                 goto out;
3148         }
3149
3150         errcode = NERR_Success;
3151  out:
3152         SSVAL(*rparam,0,errcode);
3153         SSVAL(*rparam,2,0);             /* converter word */
3154
3155         return(True);
3156 }
3157
3158 /****************************************************************************
3159   delete a print job
3160   Form: <W> <>
3161   ****************************************************************************/
3162
3163 static bool api_RDosPrintJobDel(struct smbd_server_connection *sconn,
3164                                 connection_struct *conn,uint64_t vuid,
3165                                 char *param, int tpscnt,
3166                                 char *data, int tdscnt,
3167                                 int mdrcnt,int mprcnt,
3168                                 char **rdata,char **rparam,
3169                                 int *rdata_len,int *rparam_len)
3170 {
3171         int function = get_safe_SVAL(param,tpscnt,param,0,0);
3172         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3173         char *str2 = skip_string(param,tpscnt,str1);
3174         char *p = skip_string(param,tpscnt,str2);
3175         uint32_t jobid;
3176         fstring sharename;
3177         int errcode;
3178         WERROR werr = WERR_OK;
3179
3180         TALLOC_CTX *mem_ctx = talloc_tos();
3181         NTSTATUS status;
3182         struct rpc_pipe_client *cli = NULL;
3183         struct dcerpc_binding_handle *b = NULL;
3184         struct policy_handle handle;
3185         struct spoolss_DevmodeContainer devmode_ctr;
3186         enum spoolss_JobControl command;
3187
3188         if (!str1 || !str2 || !p) {
3189                 return False;
3190         }
3191         /*
3192          * We use 1 here not 2 as we're checking
3193          * the last byte we want to access is safe.
3194          */
3195         if (!is_offset_safe(param,tpscnt,p,1)) {
3196                 return False;
3197         }
3198         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3199                 return False;
3200
3201         /* check it's a supported varient */
3202         if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
3203                 return(False);
3204
3205         *rparam_len = 4;
3206         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3207         if (!*rparam) {
3208                 return False;
3209         }
3210         *rdata_len = 0;
3211
3212         ZERO_STRUCT(handle);
3213
3214         status = rpc_pipe_open_interface(mem_ctx,
3215                                          &ndr_table_spoolss,
3216                                          conn->session_info,
3217                                          conn->sconn->remote_address,
3218                                          conn->sconn->local_address,
3219                                          conn->sconn->msg_ctx,
3220                                          &cli);
3221         if (!NT_STATUS_IS_OK(status)) {
3222                 DEBUG(0,("api_RDosPrintJobDel: could not connect to spoolss: %s\n",
3223                           nt_errstr(status)));
3224                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3225                 goto out;
3226         }
3227         b = cli->binding_handle;
3228
3229         ZERO_STRUCT(devmode_ctr);
3230
3231         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3232                                             sharename,
3233                                             "RAW",
3234                                             devmode_ctr,
3235                                             JOB_ACCESS_ADMINISTER,
3236                                             &handle,
3237                                             &werr);
3238         if (!NT_STATUS_IS_OK(status)) {
3239                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3240                 goto out;
3241         }
3242         if (!W_ERROR_IS_OK(werr)) {
3243                 errcode = W_ERROR_V(werr);
3244                 goto out;
3245         }
3246
3247         /* FIXME: formerly NERR_JobNotFound was returned if job did not exist
3248          * and NERR_DestNotFound if share did not exist */
3249
3250         errcode = NERR_Success;
3251
3252         switch (function) {
3253         case 81:                /* delete */
3254                 command = SPOOLSS_JOB_CONTROL_DELETE;
3255                 break;
3256         case 82:                /* pause */
3257                 command = SPOOLSS_JOB_CONTROL_PAUSE;
3258                 break;
3259         case 83:                /* resume */
3260                 command = SPOOLSS_JOB_CONTROL_RESUME;
3261                 break;
3262         default:
3263                 errcode = NERR_notsupported;
3264                 goto out;
3265         }
3266
3267         status = dcerpc_spoolss_SetJob(b, mem_ctx,
3268                                        &handle,
3269                                        jobid,
3270                                        NULL, /* unique ptr ctr */
3271                                        command,
3272                                        &werr);
3273         if (!NT_STATUS_IS_OK(status)) {
3274                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3275                 goto out;
3276         }
3277         if (!W_ERROR_IS_OK(werr)) {
3278                 errcode = W_ERROR_V(werr);
3279                 goto out;
3280         }
3281
3282  out:
3283         if (b && is_valid_policy_hnd(&handle)) {
3284                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3285         }
3286
3287         SSVAL(*rparam,0,errcode);
3288         SSVAL(*rparam,2,0);             /* converter word */
3289
3290         return(True);
3291 }
3292
3293 /****************************************************************************
3294   Purge a print queue - or pause or resume it.
3295   ****************************************************************************/
3296
3297 static bool api_WPrintQueueCtrl(struct smbd_server_connection *sconn,
3298                                 connection_struct *conn,uint64_t vuid,
3299                                 char *param, int tpscnt,
3300                                 char *data, int tdscnt,
3301                                 int mdrcnt,int mprcnt,
3302                                 char **rdata,char **rparam,
3303                                 int *rdata_len,int *rparam_len)
3304 {
3305         int function = get_safe_SVAL(param,tpscnt,param,0,0);
3306         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3307         char *str2 = skip_string(param,tpscnt,str1);
3308         char *QueueName = skip_string(param,tpscnt,str2);
3309         int errcode = NERR_notsupported;
3310         WERROR werr = WERR_OK;
3311         NTSTATUS status;
3312
3313         TALLOC_CTX *mem_ctx = talloc_tos();
3314         struct rpc_pipe_client *cli = NULL;
3315         struct dcerpc_binding_handle *b = NULL;
3316         struct policy_handle handle;
3317         struct spoolss_SetPrinterInfoCtr info_ctr;
3318         struct spoolss_DevmodeContainer devmode_ctr;
3319         struct sec_desc_buf secdesc_ctr;
3320         enum spoolss_PrinterControl command = SPOOLSS_PRINTER_CONTROL_UNPAUSE;
3321
3322         if (!str1 || !str2 || !QueueName) {
3323                 return False;
3324         }
3325
3326         /* check it's a supported varient */
3327         if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3328                 return(False);
3329
3330         *rparam_len = 4;
3331         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3332         if (!*rparam) {
3333                 return False;
3334         }
3335         *rdata_len = 0;
3336
3337         if (skip_string(param,tpscnt,QueueName) == NULL) {
3338                 return False;
3339         }
3340
3341         ZERO_STRUCT(handle);
3342
3343         status = rpc_pipe_open_interface(mem_ctx,
3344                                          &ndr_table_spoolss,
3345                                          conn->session_info,
3346                                          conn->sconn->remote_address,
3347                                          conn->sconn->local_address,
3348                                          conn->sconn->msg_ctx,
3349                                          &cli);
3350         if (!NT_STATUS_IS_OK(status)) {
3351                 DEBUG(0,("api_WPrintQueueCtrl: could not connect to spoolss: %s\n",
3352                           nt_errstr(status)));
3353                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3354                 goto out;
3355         }
3356         b = cli->binding_handle;
3357
3358         ZERO_STRUCT(devmode_ctr);
3359
3360         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3361                                             QueueName,
3362                                             NULL,
3363                                             devmode_ctr,
3364                                             PRINTER_ACCESS_ADMINISTER,
3365                                             &handle,
3366                                             &werr);
3367         if (!NT_STATUS_IS_OK(status)) {
3368                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3369                 goto out;
3370         }
3371         if (!W_ERROR_IS_OK(werr)) {
3372                 errcode = W_ERROR_V(werr);
3373                 goto out;
3374         }
3375
3376         switch (function) {
3377         case 74: /* Pause queue */
3378                 command = SPOOLSS_PRINTER_CONTROL_PAUSE;
3379                 break;
3380         case 75: /* Resume queue */
3381                 command = SPOOLSS_PRINTER_CONTROL_RESUME;
3382                 break;
3383         case 103: /* Purge */
3384                 command = SPOOLSS_PRINTER_CONTROL_PURGE;
3385                 break;
3386         default:
3387                 werr = WERR_NOT_SUPPORTED;
3388                 break;
3389         }
3390
3391         if (!W_ERROR_IS_OK(werr)) {
3392                 errcode = W_ERROR_V(werr);
3393                 goto out;
3394         }
3395
3396         ZERO_STRUCT(info_ctr);
3397         ZERO_STRUCT(secdesc_ctr);
3398
3399         status = dcerpc_spoolss_SetPrinter(b, mem_ctx,
3400                                            &handle,
3401                                            &info_ctr,
3402                                            &devmode_ctr,
3403                                            &secdesc_ctr,
3404                                            command,
3405                                            &werr);
3406         if (!NT_STATUS_IS_OK(status)) {
3407                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3408                 goto out;
3409         }
3410         if (!W_ERROR_IS_OK(werr)) {
3411                 errcode = W_ERROR_V(werr);
3412                 goto out;
3413         }
3414
3415         errcode = W_ERROR_V(werr);
3416
3417  out:
3418
3419         if (b && is_valid_policy_hnd(&handle)) {
3420                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3421         }
3422
3423         SSVAL(*rparam,0,errcode);
3424         SSVAL(*rparam,2,0);             /* converter word */
3425
3426         return(True);
3427 }
3428
3429 /****************************************************************************
3430   set the property of a print job (undocumented?)
3431   ? function = 0xb -> set name of print job
3432   ? function = 0x6 -> move print job up/down
3433   Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3434   or   <WWsTP> <WB21BB16B10zWWzDDz>
3435 ****************************************************************************/
3436
3437 static int check_printjob_info(struct pack_desc* desc,
3438                                int uLevel, char* id)
3439 {
3440         desc->subformat = NULL;
3441         switch( uLevel ) {
3442         case 0: desc->format = "W"; break;
3443         case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3444         case 2: desc->format = "WWzWWDDzz"; break;
3445         case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3446         case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3447         default:
3448                 DEBUG(0,("check_printjob_info: invalid level %d\n",
3449                         uLevel ));
3450                 return False;
3451         }
3452         if (id == NULL || strcmp(desc->format,id) != 0) {
3453                 DEBUG(0,("check_printjob_info: invalid format %s\n",
3454                         id ? id : "<NULL>" ));
3455                 return False;
3456         }
3457         return True;
3458 }
3459
3460 static bool api_PrintJobInfo(struct smbd_server_connection *sconn,
3461                              connection_struct *conn, uint64_t vuid,
3462                                 char *param, int tpscnt,
3463                                 char *data, int tdscnt,
3464                                 int mdrcnt,int mprcnt,
3465                                 char **rdata,char **rparam,
3466                                 int *rdata_len,int *rparam_len)
3467 {
3468         struct pack_desc desc;
3469         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3470         char *str2 = skip_string(param,tpscnt,str1);
3471         char *p = skip_string(param,tpscnt,str2);
3472         uint32_t jobid;
3473         fstring sharename;
3474         int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3475         int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3476         int errcode;
3477
3478         TALLOC_CTX *mem_ctx = talloc_tos();
3479         WERROR werr;
3480         NTSTATUS status;
3481         struct rpc_pipe_client *cli = NULL;
3482         struct dcerpc_binding_handle *b = NULL;
3483         struct policy_handle handle;
3484         struct spoolss_DevmodeContainer devmode_ctr;
3485         struct spoolss_JobInfoContainer ctr;
3486         union spoolss_JobInfo info;
3487         struct spoolss_SetJobInfo1 info1;
3488
3489         if (!str1 || !str2 || !p) {
3490                 return False;
3491         }
3492         /*
3493          * We use 1 here not 2 as we're checking
3494          * the last byte we want to access is safe.
3495          */
3496         if (!is_offset_safe(param,tpscnt,p,1)) {
3497                 return False;
3498         }
3499         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3500                 return False;
3501         *rparam_len = 4;
3502         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3503         if (!*rparam) {
3504                 return False;
3505         }
3506
3507         *rdata_len = 0;
3508
3509         /* check it's a supported varient */
3510         if ((strcmp(str1,"WWsTP")) ||
3511             (!check_printjob_info(&desc,uLevel,str2)))
3512                 return(False);
3513
3514         errcode = NERR_notsupported;
3515
3516         switch (function) {
3517         case 0xb:
3518                 /* change print job name, data gives the name */
3519                 break;
3520         default:
3521                 goto out;
3522         }
3523
3524         ZERO_STRUCT(handle);
3525
3526         status = rpc_pipe_open_interface(mem_ctx,
3527                                          &ndr_table_spoolss,
3528                                          conn->session_info,
3529                                          conn->sconn->remote_address,
3530                                          conn->sconn->local_address,
3531                                          conn->sconn->msg_ctx,
3532                                          &cli);
3533         if (!NT_STATUS_IS_OK(status)) {
3534                 DEBUG(0,("api_PrintJobInfo: could not connect to spoolss: %s\n",
3535                           nt_errstr(status)));
3536                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3537                 goto out;
3538         }
3539         b = cli->binding_handle;
3540
3541         ZERO_STRUCT(devmode_ctr);
3542
3543         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3544                                             sharename,
3545                                             "RAW",
3546                                             devmode_ctr,
3547                                             PRINTER_ACCESS_USE,
3548                                             &handle,
3549                                             &werr);
3550         if (!NT_STATUS_IS_OK(status)) {
3551                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3552                 goto out;
3553         }
3554         if (!W_ERROR_IS_OK(werr)) {
3555                 errcode = W_ERROR_V(werr);
3556                 goto out;
3557         }
3558
3559         werr = rpccli_spoolss_getjob(cli, mem_ctx,
3560                                      &handle,
3561                                      jobid,
3562                                      1, /* level */
3563                                      0, /* offered */
3564                                      &info);
3565         if (!W_ERROR_IS_OK(werr)) {
3566                 errcode = W_ERROR_V(werr);
3567                 goto out;
3568         }
3569
3570         ZERO_STRUCT(ctr);
3571
3572         info1.job_id            = info.info1.job_id;
3573         info1.printer_name      = info.info1.printer_name;
3574         info1.user_name         = info.info1.user_name;
3575         info1.document_name     = data;
3576         info1.data_type         = info.info1.data_type;
3577         info1.text_status       = info.info1.text_status;
3578         info1.status            = info.info1.status;
3579         info1.priority          = info.info1.priority;
3580         info1.position          = info.info1.position;
3581         info1.total_pages       = info.info1.total_pages;
3582         info1.pages_printed     = info.info1.pages_printed;
3583         info1.submitted         = info.info1.submitted;
3584
3585         ctr.level = 1;
3586         ctr.info.info1 = &info1;
3587
3588         status = dcerpc_spoolss_SetJob(b, mem_ctx,
3589                                        &handle,
3590                                        jobid,
3591                                        &ctr,
3592                                        0,
3593                                        &werr);
3594         if (!NT_STATUS_IS_OK(status)) {
3595                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3596                 goto out;
3597         }
3598         if (!W_ERROR_IS_OK(werr)) {
3599                 errcode = W_ERROR_V(werr);
3600                 goto out;
3601         }
3602
3603         errcode = NERR_Success;
3604  out:
3605
3606         if (b && is_valid_policy_hnd(&handle)) {
3607                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3608         }
3609
3610         SSVALS(*rparam,0,errcode);
3611         SSVAL(*rparam,2,0);             /* converter word */
3612
3613         return(True);
3614 }
3615
3616
3617 /****************************************************************************
3618  Get info about the server.
3619 ****************************************************************************/
3620
3621 static bool api_RNetServerGetInfo(struct smbd_server_connection *sconn,
3622                                   connection_struct *conn,uint64_t vuid,
3623                                 char *param, int tpscnt,
3624                                 char *data, int tdscnt,
3625                                 int mdrcnt,int mprcnt,
3626                                 char **rdata,char **rparam,
3627                                 int *rdata_len,int *rparam_len)
3628 {
3629         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3630         char *str2 = skip_string(param,tpscnt,str1);
3631         char *p = skip_string(param,tpscnt,str2);
3632         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3633         char *p2;
3634         int struct_len;
3635
3636         NTSTATUS status;
3637         WERROR werr;
3638         TALLOC_CTX *mem_ctx = talloc_tos();
3639         struct rpc_pipe_client *cli = NULL;
3640         union srvsvc_NetSrvInfo info;
3641         int errcode;
3642         struct dcerpc_binding_handle *b;
3643
3644         if (!str1 || !str2 || !p) {
3645                 return False;
3646         }
3647
3648         DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3649
3650         /* check it's a supported varient */
3651         if (!prefix_ok(str1,"WrLh")) {
3652                 return False;
3653         }
3654
3655         switch( uLevel ) {
3656                 case 0:
3657                         if (strcmp(str2,"B16") != 0) {
3658                                 return False;
3659                         }
3660                         struct_len = 16;
3661                         break;
3662                 case 1:
3663                         if (strcmp(str2,"B16BBDz") != 0) {
3664                                 return False;
3665                         }
3666                         struct_len = 26;
3667                         break;
3668                 case 2:
3669                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3670                                 return False;
3671                         }
3672                         struct_len = 134;
3673                         break;
3674                 case 3:
3675                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3676                                 return False;
3677                         }
3678                         struct_len = 144;
3679                         break;
3680                 case 20:
3681                         if (strcmp(str2,"DN") != 0) {
3682                                 return False;
3683                         }
3684                         struct_len = 6;
3685                         break;
3686                 case 50:
3687                         if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3688                                 return False;
3689                         }
3690                         struct_len = 42;
3691                         break;
3692                 default:
3693                         return False;
3694         }
3695
3696         *rdata_len = mdrcnt;
3697         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3698         if (!*rdata) {
3699                 return False;
3700         }
3701
3702         p = *rdata;
3703         p2 = p + struct_len;
3704
3705         status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc,
3706                                         conn->session_info,
3707                                         conn->sconn->remote_address,
3708                                         conn->sconn->local_address,
3709                                         conn->sconn->msg_ctx,
3710                                         &cli);
3711         if (!NT_STATUS_IS_OK(status)) {
3712                 DEBUG(0,("api_RNetServerGetInfo: could not connect to srvsvc: %s\n",
3713                           nt_errstr(status)));
3714                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3715                 goto out;
3716         }
3717
3718         b = cli->binding_handle;
3719
3720         status = dcerpc_srvsvc_NetSrvGetInfo(b, mem_ctx,
3721                                              NULL,
3722                                              101,
3723                                              &info,
3724                                              &werr);
3725         if (!NT_STATUS_IS_OK(status)) {
3726                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3727                 goto out;
3728         }
3729         if (!W_ERROR_IS_OK(werr)) {
3730                 errcode = W_ERROR_V(werr);
3731                 goto out;
3732         }
3733
3734         if (info.info101 == NULL) {
3735                 errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
3736                 goto out;
3737         }
3738
3739         if (uLevel != 20) {
3740                 size_t len = 0;
3741                 status = srvstr_push(NULL, 0, p, info.info101->server_name, 16,
3742                         STR_ASCII|STR_UPPER|STR_TERMINATE, &len);
3743                 if (!NT_STATUS_IS_OK(status)) {
3744                         errcode = W_ERROR_V(ntstatus_to_werror(status));
3745                         goto out;
3746                 }
3747         }
3748         p += 16;
3749         if (uLevel > 0) {
3750                 SCVAL(p,0,info.info101->version_major);
3751                 SCVAL(p,1,info.info101->version_minor);
3752                 SIVAL(p,2,info.info101->server_type);
3753
3754                 if (mdrcnt == struct_len) {
3755                         SIVAL(p,6,0);
3756                 } else {
3757                         SIVAL(p,6,PTR_DIFF(p2,*rdata));
3758                         if (mdrcnt - struct_len <= 0) {
3759                                 return false;
3760                         }
3761                         push_ascii(p2,
3762                                 info.info101->comment,
3763                                 MIN(mdrcnt - struct_len,
3764                                         MAX_SERVER_STRING_LENGTH),
3765                                 STR_TERMINATE);
3766                         p2 = skip_string(*rdata,*rdata_len,p2);
3767                         if (!p2) {
3768                                 return False;
3769                         }
3770                 }
3771         }
3772
3773         if (uLevel > 1) {
3774                 return False;           /* not yet implemented */
3775         }
3776
3777         errcode = NERR_Success;
3778
3779  out:
3780
3781         *rdata_len = PTR_DIFF(p2,*rdata);
3782
3783         *rparam_len = 6;
3784         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3785         if (!*rparam) {
3786                 return False;
3787         }
3788         SSVAL(*rparam,0,errcode);
3789         SSVAL(*rparam,2,0);             /* converter word */
3790         SSVAL(*rparam,4,*rdata_len);
3791
3792         return True;
3793 }
3794
3795 /****************************************************************************
3796  Get info about the server.
3797 ****************************************************************************/
3798
3799 static bool api_NetWkstaGetInfo(struct smbd_server_connection *sconn,
3800                                 connection_struct *conn,uint64_t vuid,
3801                                 char *param, int tpscnt,
3802                                 char *data, int tdscnt,
3803                                 int mdrcnt,int mprcnt,
3804                                 char **rdata,char **rparam,
3805                                 int *rdata_len,int *rparam_len)
3806 {
3807         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3808         char *str2 = skip_string(param,tpscnt,str1);
3809         char *p = skip_string(param,tpscnt,str2);
3810         char *p2;
3811         char *endp;
3812         int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3813
3814         if (!str1 || !str2 || !p) {
3815                 return False;
3816         }
3817
3818         DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3819
3820         *rparam_len = 6;
3821         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3822         if (!*rparam) {
3823                 return False;
3824         }
3825
3826         /* check it's a supported varient */
3827         if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3828                 return False;
3829         }
3830
3831         *rdata_len = mdrcnt + 1024;
3832         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3833         if (!*rdata) {
3834                 return False;
3835         }
3836
3837         SSVAL(*rparam,0,NERR_Success);
3838         SSVAL(*rparam,2,0);             /* converter word */
3839
3840         p = *rdata;
3841         endp = *rdata + *rdata_len;
3842
3843         p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3844         if (!p2) {
3845                 return False;
3846         }
3847
3848         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3849         strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3850         if (!strupper_m(p2)) {
3851                 return false;
3852         }
3853         p2 = skip_string(*rdata,*rdata_len,p2);
3854         if (!p2) {
3855                 return False;
3856         }
3857         p += 4;
3858
3859         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3860         strlcpy(p2,conn->session_info->unix_info->sanitized_username,PTR_DIFF(endp,p2));
3861         p2 = skip_string(*rdata,*rdata_len,p2);
3862         if (!p2) {
3863                 return False;
3864         }
3865         p += 4;
3866
3867         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3868         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3869         if (!strupper_m(p2)) {
3870                 return false;
3871         }
3872         p2 = skip_string(*rdata,*rdata_len,p2);
3873         if (!p2) {
3874                 return False;
3875         }
3876         p += 4;
3877
3878         SCVAL(p,0,SAMBA_MAJOR_NBT_ANNOUNCE_VERSION); /* system version - e.g 4 in 4.1 */
3879         SCVAL(p,1,SAMBA_MINOR_NBT_ANNOUNCE_VERSION); /* system version - e.g .1 in 4.1 */
3880         p += 2;
3881
3882         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3883         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));   /* don't know.  login domain?? */
3884         p2 = skip_string(*rdata,*rdata_len,p2);
3885         if (!p2) {
3886                 return False;
3887         }
3888         p += 4;
3889
3890         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3891         strlcpy(p2,"",PTR_DIFF(endp,p2));
3892         p2 = skip_string(*rdata,*rdata_len,p2);
3893         if (!p2) {
3894                 return False;
3895         }
3896         p += 4;
3897
3898         *rdata_len = PTR_DIFF(p2,*rdata);
3899
3900         SSVAL(*rparam,4,*rdata_len);
3901
3902         return True;
3903 }
3904
3905 /****************************************************************************
3906   get info about a user
3907
3908     struct user_info_11 {
3909         char                usri11_name[21];  0-20
3910         char                usri11_pad;       21
3911         char                *usri11_comment;  22-25
3912         char            *usri11_usr_comment;  26-29
3913         unsigned short      usri11_priv;      30-31
3914         unsigned long       usri11_auth_flags; 32-35
3915         long                usri11_password_age; 36-39
3916         char                *usri11_homedir; 40-43
3917         char            *usri11_parms; 44-47
3918         long                usri11_last_logon; 48-51
3919         long                usri11_last_logoff; 52-55
3920         unsigned short      usri11_bad_pw_count; 56-57
3921         unsigned short      usri11_num_logons; 58-59
3922         char                *usri11_logon_server; 60-63
3923         unsigned short      usri11_country_code; 64-65
3924         char            *usri11_workstations; 66-69
3925         unsigned long       usri11_max_storage; 70-73
3926         unsigned short      usri11_units_per_week; 74-75
3927         unsigned char       *usri11_logon_hours; 76-79
3928         unsigned short      usri11_code_page; 80-81
3929     };
3930
3931 where:
3932
3933   usri11_name specifies the user name for which information is retrieved
3934
3935   usri11_pad aligns the next data structure element to a word boundary
3936
3937   usri11_comment is a null terminated ASCII comment
3938
3939   usri11_user_comment is a null terminated ASCII comment about the user
3940
3941   usri11_priv specifies the level of the privilege assigned to the user.
3942        The possible values are:
3943
3944 Name             Value  Description
3945 USER_PRIV_GUEST  0      Guest privilege
3946 USER_PRIV_USER   1      User privilege
3947 USER_PRV_ADMIN   2      Administrator privilege
3948
3949   usri11_auth_flags specifies the account operator privileges. The
3950        possible values are:
3951
3952 Name            Value   Description
3953 AF_OP_PRINT     0       Print operator
3954
3955
3956 Leach, Naik                                        [Page 28]
3957 \f
3958
3959
3960 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3961
3962
3963 AF_OP_COMM      1       Communications operator
3964 AF_OP_SERVER    2       Server operator
3965 AF_OP_ACCOUNTS  3       Accounts operator
3966
3967
3968   usri11_password_age specifies how many seconds have elapsed since the
3969        password was last changed.
3970
3971   usri11_home_dir points to a null terminated ASCII string that contains
3972        the path name of the user's home directory.
3973
3974   usri11_parms points to a null terminated ASCII string that is set
3975        aside for use by applications.
3976
3977   usri11_last_logon specifies the time when the user last logged on.
3978        This value is stored as the number of seconds elapsed since
3979        00:00:00, January 1, 1970.
3980
3981   usri11_last_logoff specifies the time when the user last logged off.
3982        This value is stored as the number of seconds elapsed since
3983        00:00:00, January 1, 1970. A value of 0 means the last logoff
3984        time is unknown.
3985
3986   usri11_bad_pw_count specifies the number of incorrect passwords
3987        entered since the last successful logon.
3988
3989   usri11_log1_num_logons specifies the number of times this user has
3990        logged on. A value of -1 means the number of logons is unknown.
3991
3992   usri11_logon_server points to a null terminated ASCII string that
3993        contains the name of the server to which logon requests are sent.
3994        A null string indicates logon requests should be sent to the
3995        domain controller.
3996
3997   usri11_country_code specifies the country code for the user's language
3998        of choice.
3999
4000   usri11_workstations points to a null terminated ASCII string that
4001        contains the names of workstations the user may log on from.
4002        There may be up to 8 workstations, with the names separated by
4003        commas. A null strings indicates there are no restrictions.
4004
4005   usri11_max_storage specifies the maximum amount of disk space the user
4006        can occupy. A value of 0xffffffff indicates there are no
4007        restrictions.
4008
4009   usri11_units_per_week specifies the equal number of time units into
4010        which a week is divided. This value must be equal to 168.
4011
4012   usri11_logon_hours points to a 21 byte (168 bits) string that
4013        specifies the time during which the user can log on. Each bit
4014        represents one unique hour in a week. The first bit (bit 0, word
4015        0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
4016
4017
4018
4019 Leach, Naik                                        [Page 29]
4020 \f
4021
4022
4023 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
4024
4025
4026        Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
4027        are no restrictions.
4028
4029   usri11_code_page specifies the code page for the user's language of
4030        choice
4031
4032 All of the pointers in this data structure need to be treated
4033 specially. The  pointer is a 32 bit pointer. The higher 16 bits need
4034 to be ignored. The converter word returned in the parameters section
4035 needs to be subtracted from the lower 16 bits to calculate an offset
4036 into the return buffer where this ASCII string resides.
4037
4038 There is no auxiliary data in the response.
4039
4040   ****************************************************************************/
4041
4042 #define usri11_name           0
4043 #define usri11_pad            21
4044 #define usri11_comment        22
4045 #define usri11_usr_comment    26
4046 #define usri11_full_name      30
4047 #define usri11_priv           34
4048 #define usri11_auth_flags     36
4049 #define usri11_password_age   40
4050 #define usri11_homedir        44
4051 #define usri11_parms          48
4052 #define usri11_last_logon     52
4053 #define usri11_last_logoff    56
4054 #define usri11_bad_pw_count   60
4055 #define usri11_num_logons     62
4056 #define usri11_logon_server   64
4057 #define usri11_country_code   68
4058 #define usri11_workstations   70
4059 #define usri11_max_storage    74
4060 #define usri11_units_per_week 78
4061 #define usri11_logon_hours    80
4062 #define usri11_code_page      84
4063 #define usri11_end            86
4064
4065 static bool api_RNetUserGetInfo(struct smbd_server_connection *sconn,
4066                                 connection_struct *conn, uint64_t vuid,
4067                                 char *param, int tpscnt,
4068                                 char *data, int tdscnt,
4069                                 int mdrcnt,int mprcnt,
4070                                 char **rdata,char **rparam,
4071                                 int *rdata_len,int *rparam_len)
4072 {
4073         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4074         char *str2 = skip_string(param,tpscnt,str1);
4075         char *UserName = skip_string(param,tpscnt,str2);
4076         char *p = skip_string(param,tpscnt,UserName);
4077         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4078         char *p2;
4079         char *endp;
4080         const char *level_string;
4081
4082         TALLOC_CTX *mem_ctx = talloc_tos();
4083         NTSTATUS status, result;
4084         struct rpc_pipe_client *cli = NULL;
4085         struct policy_handle connect_handle, domain_handle, user_handle;
4086         struct lsa_String domain_name;
4087         struct dom_sid2 *domain_sid;
4088         struct lsa_String names;
4089         struct samr_Ids rids;
4090         struct samr_Ids types;
4091         int errcode = W_ERROR_V(WERR_NERR_USERNOTFOUND);
4092         uint32_t rid;
4093         union samr_UserInfo *info;
4094         struct dcerpc_binding_handle *b = NULL;
4095
4096         if (!str1 || !str2 || !UserName || !p) {
4097                 return False;
4098         }
4099
4100         *rparam_len = 6;
4101         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4102         if (!*rparam) {
4103                 return False;
4104         }
4105
4106         DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
4107
4108         /* check it's a supported variant */
4109         if (strcmp(str1,"zWrLh") != 0) {
4110                 return False;
4111         }
4112         switch( uLevel ) {
4113                 case 0: level_string = "B21"; break;
4114                 case 1: level_string = "B21BB16DWzzWz"; break;
4115                 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
4116                 case 10: level_string = "B21Bzzz"; break;
4117                 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
4118                 default: return False;
4119         }
4120
4121         if (strcmp(level_string,str2) != 0) {
4122                 return False;
4123         }
4124
4125         *rdata_len = mdrcnt + 1024;
4126         *rdata = smb_realloc_limit(*rdata,*rdata_len);
4127         if (!*rdata) {
4128                 return False;
4129         }
4130
4131         p = *rdata;
4132         endp = *rdata + *rdata_len;
4133         p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
4134         if (!p2) {
4135                 return False;
4136         }
4137
4138         ZERO_STRUCT(connect_handle);
4139         ZERO_STRUCT(domain_handle);
4140         ZERO_STRUCT(user_handle);
4141
4142         status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr,
4143                                         conn->session_info,
4144                                         conn->sconn->remote_address,
4145                                         conn->sconn->local_address,
4146                                         conn->sconn->msg_ctx,
4147                                         &cli);
4148         if (!NT_STATUS_IS_OK(status)) {
4149                 DEBUG(0,("api_RNetUserGetInfo: could not connect to samr: %s\n",
4150                           nt_errstr(status)));
4151                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4152                 goto out;
4153         }
4154
4155         b = cli->binding_handle;
4156
4157         status = dcerpc_samr_Connect2(b, mem_ctx,
4158                                       lp_netbios_name(),
4159                                       SAMR_ACCESS_CONNECT_TO_SERVER |
4160                                       SAMR_ACCESS_ENUM_DOMAINS |
4161                                       SAMR_ACCESS_LOOKUP_DOMAIN,
4162                                       &connect_handle,
4163                                       &result);
4164         if (!NT_STATUS_IS_OK(status)) {
4165                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4166                 goto out;
4167         }
4168         if (!NT_STATUS_IS_OK(result)) {
4169                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4170                 goto out;
4171         }
4172
4173         init_lsa_String(&domain_name, get_global_sam_name());
4174
4175         status = dcerpc_samr_LookupDomain(b, mem_ctx,
4176                                           &connect_handle,
4177                                           &domain_name,
4178                                           &domain_sid,
4179                                           &result);
4180         if (!NT_STATUS_IS_OK(status)) {
4181                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4182                 goto out;
4183         }
4184         if (!NT_STATUS_IS_OK(result)) {
4185                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4186                 goto out;
4187         }
4188
4189         status = dcerpc_samr_OpenDomain(b, mem_ctx,
4190                                         &connect_handle,
4191                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4192                                         domain_sid,
4193                                         &domain_handle,
4194                                         &result);
4195         if (!NT_STATUS_IS_OK(status)) {
4196                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4197                 goto out;
4198         }
4199         if (!NT_STATUS_IS_OK(result)) {
4200                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4201                 goto out;
4202         }
4203
4204         init_lsa_String(&names, UserName);
4205
4206         status = dcerpc_samr_LookupNames(b, mem_ctx,
4207                                          &domain_handle,
4208                                          1,
4209                                          &names,
4210                                          &rids,
4211                                          &types,
4212                                          &result);
4213         if (!NT_STATUS_IS_OK(status)) {
4214                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4215                 goto out;
4216         }
4217         if (!NT_STATUS_IS_OK(result)) {
4218                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4219                 goto out;
4220         }
4221
4222         if (rids.count != 1) {
4223                 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
4224                 goto out;
4225         }
4226         if (rids.count != types.count) {
4227                 errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
4228                 goto out;
4229         }
4230         if (types.ids[0] != SID_NAME_USER) {
4231                 errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
4232                 goto out;
4233         }
4234
4235         rid = rids.ids[0];
4236
4237         status = dcerpc_samr_OpenUser(b, mem_ctx,
4238                                       &domain_handle,
4239                                       SAMR_USER_ACCESS_GET_LOCALE |
4240                                       SAMR_USER_ACCESS_GET_LOGONINFO |
4241                                       SAMR_USER_ACCESS_GET_ATTRIBUTES |
4242                                       SAMR_USER_ACCESS_GET_GROUPS |
4243                                       SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP |
4244                                       SEC_STD_READ_CONTROL,
4245                                       rid,
4246                                       &user_handle,
4247                                       &result);
4248         if (!NT_STATUS_IS_OK(status)) {
4249                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4250                 goto out;
4251         }
4252         if (!NT_STATUS_IS_OK(result)) {
4253                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4254                 goto out;
4255         }
4256
4257         status = dcerpc_samr_QueryUserInfo2(b, mem_ctx,
4258                                             &user_handle,
4259                                             UserAllInformation,
4260                                             &info,
4261                                             &result);
4262         if (!NT_STATUS_IS_OK(status)) {
4263                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4264                 goto out;
4265         }
4266         if (!NT_STATUS_IS_OK(result)) {
4267                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4268                 goto out;
4269         }
4270
4271         memset(p,0,21);
4272         fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
4273
4274         if (uLevel > 0) {
4275                 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
4276                 *p2 = 0;
4277         }
4278
4279         if (uLevel >= 10) {
4280                 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
4281                 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
4282                 p2 = skip_string(*rdata,*rdata_len,p2);
4283                 if (!p2) {
4284                         return False;
4285                 }
4286
4287                 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
4288                 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
4289                 p2 = skip_string(*rdata,*rdata_len,p2);
4290                 if (!p2) {
4291                         return False;
4292                 }
4293
4294                 /* EEK! the cifsrap.txt doesn't have this in!!!! */
4295                 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
4296                 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4297                 p2 = skip_string(*rdata,*rdata_len,p2);
4298                 if (!p2) {
4299                         return False;
4300                 }
4301         }
4302
4303         if (uLevel == 11) {
4304                 const char *homedir = info->info21.home_directory.string;
4305                 /* modelled after NTAS 3.51 reply */
4306                 SSVAL(p,usri11_priv,
4307                         (get_current_uid(conn) == sec_initial_uid())?
4308                         USER_PRIV_ADMIN:USER_PRIV_USER);
4309                 SIVAL(p,usri11_auth_flags,AF_OP_PRINT);         /* auth flags */
4310                 SIVALS(p,usri11_password_age,-1);               /* password age */
4311                 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
4312                 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
4313                 p2 = skip_string(*rdata,*rdata_len,p2);
4314                 if (!p2) {
4315                         return False;
4316                 }
4317                 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
4318                 strlcpy(p2,"",PTR_DIFF(endp,p2));
4319                 p2 = skip_string(*rdata,*rdata_len,p2);
4320                 if (!p2) {
4321                         return False;
4322                 }
4323                 SIVAL(p,usri11_last_logon,0);           /* last logon */
4324                 SIVAL(p,usri11_last_logoff,0);          /* last logoff */
4325                 SSVALS(p,usri11_bad_pw_count,-1);       /* bad pw counts */
4326                 SSVALS(p,usri11_num_logons,-1);         /* num logons */
4327                 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
4328                 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
4329                 p2 = skip_string(*rdata,*rdata_len,p2);
4330                 if (!p2) {
4331                         return False;
4332                 }
4333                 SSVAL(p,usri11_country_code,0);         /* country code */
4334
4335                 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
4336                 strlcpy(p2,"",PTR_DIFF(endp,p2));
4337                 p2 = skip_string(*rdata,*rdata_len,p2);
4338                 if (!p2) {
4339                         return False;
4340                 }
4341
4342                 SIVALS(p,usri11_max_storage,-1);                /* max storage */
4343                 SSVAL(p,usri11_units_per_week,168);             /* units per week */
4344                 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
4345
4346                 /* a simple way to get logon hours at all times. */
4347                 memset(p2,0xff,21);
4348                 SCVAL(p2,21,0);           /* fix zero termination */
4349                 p2 = skip_string(*rdata,*rdata_len,p2);
4350                 if (!p2) {
4351                         return False;
4352                 }
4353
4354                 SSVAL(p,usri11_code_page,0);            /* code page */
4355         }
4356
4357         if (uLevel == 1 || uLevel == 2) {
4358                 memset(p+22,' ',16);    /* password */
4359                 SIVALS(p,38,-1);                /* password age */
4360                 SSVAL(p,42,
4361                         (get_current_uid(conn) == sec_initial_uid())?
4362                         USER_PRIV_ADMIN:USER_PRIV_USER);
4363                 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
4364                 strlcpy(p2, info->info21.home_directory.string,
4365                         PTR_DIFF(endp,p2));
4366                 p2 = skip_string(*rdata,*rdata_len,p2);
4367                 if (!p2) {
4368                         return False;
4369                 }
4370                 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
4371                 *p2++ = 0;
4372                 SSVAL(p,52,0);          /* flags */
4373                 SIVAL(p,54,PTR_DIFF(p2,*rdata));                /* script_path */
4374                 strlcpy(p2, info->info21.logon_script.string,
4375                         PTR_DIFF(endp,p2));
4376                 p2 = skip_string(*rdata,*rdata_len,p2);
4377                 if (!p2) {
4378                         return False;
4379                 }
4380                 if (uLevel == 2) {
4381                         SIVAL(p,58,0);          /* auth_flags */
4382                         SIVAL(p,62,PTR_DIFF(p2,*rdata)); /* full_name */
4383                         strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4384                         p2 = skip_string(*rdata,*rdata_len,p2);
4385                         if (!p2) {
4386                                 return False;
4387                         }
4388                         SIVAL(p,66,0);          /* urs_comment */
4389                         SIVAL(p,70,PTR_DIFF(p2,*rdata)); /* parms */
4390                         strlcpy(p2,"",PTR_DIFF(endp,p2));
4391                         p2 = skip_string(*rdata,*rdata_len,p2);
4392                         if (!p2) {
4393                                 return False;
4394                         }
4395                         SIVAL(p,74,0);          /* workstations */
4396                         SIVAL(p,78,0);          /* last_logon */
4397                         SIVAL(p,82,0);          /* last_logoff */
4398                         SIVALS(p,86,-1);                /* acct_expires */
4399                         SIVALS(p,90,-1);                /* max_storage */
4400                         SSVAL(p,94,168);        /* units_per_week */
4401                         SIVAL(p,96,PTR_DIFF(p2,*rdata)); /* logon_hours */
4402                         memset(p2,-1,21);
4403                         p2 += 21;
4404                         SSVALS(p,100,-1);       /* bad_pw_count */
4405                         SSVALS(p,102,-1);       /* num_logons */
4406                         SIVAL(p,104,PTR_DIFF(p2,*rdata)); /* logon_server */
4407                         {
4408                                 TALLOC_CTX *ctx = talloc_tos();
4409                                 int space_rem = *rdata_len - (p2 - *rdata);
4410                                 char *tmp;
4411
4412                                 if (space_rem <= 0) {
4413                                         return false;
4414                                 }
4415                                 tmp = talloc_strdup(ctx, "\\\\%L");
4416                                 if (!tmp) {
4417                                         return false;
4418                                 }
4419                                 tmp = talloc_sub_basic(ctx,
4420                                                 "",
4421                                                 "",
4422                                                 tmp);
4423                                 if (!tmp) {
4424                                         return false;
4425                                 }
4426
4427                                 push_ascii(p2,
4428                                         tmp,
4429                                         space_rem,
4430                                         STR_TERMINATE);
4431                         }
4432                         p2 = skip_string(*rdata,*rdata_len,p2);
4433                         if (!p2) {
4434                                 return False;
4435                         }
4436                         SSVAL(p,108,49);        /* country_code */
4437                         SSVAL(p,110,860);       /* code page */
4438                 }
4439         }
4440
4441         errcode = NERR_Success;
4442
4443  out:
4444         *rdata_len = PTR_DIFF(p2,*rdata);
4445
4446         if (b && is_valid_policy_hnd(&user_handle)) {
4447                 dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);
4448         }
4449         if (b && is_valid_policy_hnd(&domain_handle)) {
4450                 dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
4451         }
4452         if (b && is_valid_policy_hnd(&connect_handle)) {
4453                 dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
4454         }
4455
4456         SSVAL(*rparam,0,errcode);
4457         SSVAL(*rparam,2,0);             /* converter word */
4458         SSVAL(*rparam,4,*rdata_len);    /* is this right?? */
4459
4460         return(True);
4461 }
4462
4463 static bool api_WWkstaUserLogon(struct smbd_server_connection *sconn,
4464                                 connection_struct *conn,uint64_t vuid,
4465                                 char *param, int tpscnt,
4466                                 char *data, int tdscnt,
4467                                 int mdrcnt,int mprcnt,
4468                                 char **rdata,char **rparam,
4469                                 int *rdata_len,int *rparam_len)
4470 {
4471         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4472         char *str2 = skip_string(param,tpscnt,str1);
4473         char *p = skip_string(param,tpscnt,str2);
4474         int uLevel;
4475         struct pack_desc desc;
4476         char* name;
4477         struct auth_session_info *si = NULL;
4478         NTSTATUS status;
4479
4480         status = smbXsrv_session_info_lookup(conn->sconn->client,
4481                                              vuid,
4482                                              &si);
4483         if (!NT_STATUS_IS_OK(status)) {
4484                 return false;
4485         }
4486
4487         if (!str1 || !str2 || !p) {
4488                 return False;
4489         }
4490
4491         DBG_INFO("Username of UID %ju is %s\n",
4492                  (uintmax_t)si->unix_token->uid,
4493                  si->unix_info->unix_name);
4494
4495         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4496         name = get_safe_str_ptr(param,tpscnt,p,2);
4497         if (!name) {
4498                 return False;
4499         }
4500
4501         memset((char *)&desc,'\0',sizeof(desc));
4502
4503         DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
4504
4505         /* check it's a supported varient */
4506         if (strcmp(str1,"OOWb54WrLh") != 0) {
4507                 return False;
4508         }
4509         if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
4510                 return False;
4511         }
4512         if (mdrcnt > 0) {
4513                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4514                 if (!*rdata) {
4515                         return False;
4516                 }
4517         }
4518
4519         desc.base = *rdata;
4520         desc.buflen = mdrcnt;
4521         desc.subformat = NULL;
4522         desc.format = str2;
4523
4524         if (init_package(&desc,1,0)) {
4525                 PACKI(&desc,"W",0);             /* code */
4526                 PACKS(&desc,"B21",name);        /* eff. name */
4527                 PACKS(&desc,"B","");            /* pad */
4528                 PACKI(&desc,"W",
4529                         (get_current_uid(conn) == sec_initial_uid())?
4530                         USER_PRIV_ADMIN:USER_PRIV_USER);
4531                 PACKI(&desc,"D",0);             /* auth flags XXX */
4532                 PACKI(&desc,"W",0);             /* num logons */
4533                 PACKI(&desc,"W",0);             /* bad pw count */
4534                 PACKI(&desc,"D",0);             /* last logon */
4535                 PACKI(&desc,"D",-1);            /* last logoff */
4536                 PACKI(&desc,"D",-1);            /* logoff time */
4537                 PACKI(&desc,"D",-1);            /* kickoff time */
4538                 PACKI(&desc,"D",0);             /* password age */
4539                 PACKI(&desc,"D",0);             /* password can change */
4540                 PACKI(&desc,"D",-1);            /* password must change */
4541
4542                 {
4543                         fstring mypath;
4544                         fstrcpy(mypath,"\\\\");
4545                         fstrcat(mypath,get_local_machine_name());
4546                         if (!strupper_m(mypath)) {
4547                                 return false;
4548                         }
4549                         PACKS(&desc,"z",mypath); /* computer */
4550                 }
4551
4552                 PACKS(&desc,"z",lp_workgroup());/* domain */
4553                 PACKS(&desc,"z", si->info->logon_script); /* script path */
4554                 PACKI(&desc,"D",0x00000000);            /* reserved */
4555         }
4556
4557         *rdata_len = desc.usedlen;
4558         *rparam_len = 6;
4559         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4560         if (!*rparam) {
4561                 return False;
4562         }
4563         SSVALS(*rparam,0,desc.errcode);
4564         SSVAL(*rparam,2,0);
4565         SSVAL(*rparam,4,desc.neededlen);
4566
4567         DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4568
4569         return True;
4570 }
4571
4572 /****************************************************************************
4573  api_WAccessGetUserPerms
4574 ****************************************************************************/
4575
4576 static bool api_WAccessGetUserPerms(struct smbd_server_connection *sconn,
4577                                     connection_struct *conn,uint64_t vuid,
4578                                 char *param, int tpscnt,
4579                                 char *data, int tdscnt,
4580                                 int mdrcnt,int mprcnt,
4581                                 char **rdata,char **rparam,
4582                                 int *rdata_len,int *rparam_len)
4583 {
4584         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4585         char *str2 = skip_string(param,tpscnt,str1);
4586         char *user = skip_string(param,tpscnt,str2);
4587         char *resource = skip_string(param,tpscnt,user);
4588
4589         if (!str1 || !str2 || !user || !resource) {
4590                 return False;
4591         }
4592
4593         if (skip_string(param,tpscnt,resource) == NULL) {
4594                 return False;
4595         }
4596         DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4597
4598         /* check it's a supported varient */
4599         if (strcmp(str1,"zzh") != 0) {
4600                 return False;
4601         }
4602         if (strcmp(str2,"") != 0) {
4603                 return False;
4604         }
4605
4606         *rparam_len = 6;
4607         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4608         if (!*rparam) {
4609                 return False;
4610         }
4611         SSVALS(*rparam,0,0);            /* errorcode */
4612         SSVAL(*rparam,2,0);             /* converter word */
4613         SSVAL(*rparam,4,0x7f);  /* permission flags */
4614
4615         return True;
4616 }
4617
4618 /****************************************************************************
4619   api_WPrintJobEnumerate
4620   ****************************************************************************/
4621
4622 static bool api_WPrintJobGetInfo(struct smbd_server_connection *sconn,
4623                                  connection_struct *conn, uint64_t vuid,
4624                                 char *param, int tpscnt,
4625                                 char *data, int tdscnt,
4626                                 int mdrcnt,int mprcnt,
4627                                 char **rdata,char **rparam,
4628                                 int *rdata_len,int *rparam_len)
4629 {
4630         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4631         char *str2 = skip_string(param,tpscnt,str1);
4632         char *p = skip_string(param,tpscnt,str2);
4633         int uLevel;
4634         fstring sharename;
4635         uint32_t jobid;
4636         struct pack_desc desc;
4637         char *tmpdata=NULL;
4638
4639         TALLOC_CTX *mem_ctx = talloc_tos();
4640         WERROR werr;
4641         NTSTATUS status;
4642         struct rpc_pipe_client *cli = NULL;
4643         struct dcerpc_binding_handle *b = NULL;
4644         struct policy_handle handle;
4645         struct spoolss_DevmodeContainer devmode_ctr;
4646         union spoolss_JobInfo info;
4647
4648         if (!str1 || !str2 || !p) {
4649                 return False;
4650         }
4651
4652         uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4653
4654         memset((char *)&desc,'\0',sizeof(desc));
4655         memset((char *)&status,'\0',sizeof(status));
4656
4657         DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4658
4659         /* check it's a supported varient */
4660         if (strcmp(str1,"WWrLh") != 0) {
4661                 return False;
4662         }
4663         if (!check_printjob_info(&desc,uLevel,str2)) {
4664                 return False;
4665         }
4666
4667         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4668                 return False;
4669         }
4670
4671         ZERO_STRUCT(handle);
4672
4673         status = rpc_pipe_open_interface(mem_ctx,
4674                                          &ndr_table_spoolss,
4675                                          conn->session_info,
4676                                          conn->sconn->remote_address,
4677                                          conn->sconn->local_address,
4678                                          conn->sconn->msg_ctx,
4679                                          &cli);
4680         if (!NT_STATUS_IS_OK(status)) {
4681                 DEBUG(0,("api_WPrintJobGetInfo: could not connect to spoolss: %s\n",
4682                           nt_errstr(status)));
4683                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4684                 goto out;
4685         }
4686         b = cli->binding_handle;
4687
4688         ZERO_STRUCT(devmode_ctr);
4689
4690         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4691                                             sharename,
4692                                             "RAW",
4693                                             devmode_ctr,
4694                                             PRINTER_ACCESS_USE,
4695                                             &handle,
4696                                             &werr);
4697         if (!NT_STATUS_IS_OK(status)) {
4698                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4699                 goto out;
4700         }
4701         if (!W_ERROR_IS_OK(werr)) {
4702                 desc.errcode = W_ERROR_V(werr);
4703                 goto out;
4704         }
4705
4706         werr = rpccli_spoolss_getjob(cli, mem_ctx,
4707                                      &handle,
4708                                      jobid,
4709                                      2, /* level */
4710                                      0, /* offered */
4711                                      &info);
4712         if (!W_ERROR_IS_OK(werr)) {
4713                 desc.errcode = W_ERROR_V(werr);
4714                 goto out;
4715         }
4716
4717         if (mdrcnt > 0) {
4718                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4719                 if (!*rdata) {
4720                         return False;
4721                 }
4722                 desc.base = *rdata;
4723                 desc.buflen = mdrcnt;
4724         } else {
4725                 /*
4726                  * Don't return data but need to get correct length
4727                  *  init_package will return wrong size if buflen=0
4728                  */
4729                 desc.buflen = getlen(desc.format);
4730                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4731         }
4732
4733         if (init_package(&desc,1,0)) {
4734                 fill_spoolss_printjob_info(uLevel, &desc, &info.info2, info.info2.position);
4735                 *rdata_len = desc.usedlen;
4736         } else {
4737                 desc.errcode = NERR_JobNotFound;
4738                 *rdata_len = 0;
4739         }
4740  out:
4741         if (b && is_valid_policy_hnd(&handle)) {
4742                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4743         }
4744
4745         *rparam_len = 6;
4746         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4747         if (!*rparam) {
4748                 return False;
4749         }
4750         SSVALS(*rparam,0,desc.errcode);
4751         SSVAL(*rparam,2,0);
4752         SSVAL(*rparam,4,desc.neededlen);
4753
4754         SAFE_FREE(tmpdata);
4755
4756         DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4757
4758         return True;
4759 }
4760
4761 static bool api_WPrintJobEnumerate(struct smbd_server_connection *sconn,
4762                                    connection_struct *conn, uint64_t vuid,
4763                                 char *param, int tpscnt,
4764                                 char *data, int tdscnt,
4765                                 int mdrcnt,int mprcnt,
4766                                 char **rdata,char **rparam,
4767                                 int *rdata_len,int *rparam_len)
4768 {
4769         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4770         char *str2 = skip_string(param,tpscnt,str1);
4771         char *p = skip_string(param,tpscnt,str2);
4772         char *name = p;
4773         int uLevel;
4774         int i, succnt=0;
4775         struct pack_desc desc;
4776
4777         TALLOC_CTX *mem_ctx = talloc_tos();
4778         WERROR werr;
4779         NTSTATUS status;
4780         struct rpc_pipe_client *cli = NULL;
4781         struct dcerpc_binding_handle *b = NULL;
4782         struct policy_handle handle;
4783         struct spoolss_DevmodeContainer devmode_ctr;
4784         uint32_t count = 0;
4785         union spoolss_JobInfo *info;
4786
4787         if (!str1 || !str2 || !p) {
4788                 return False;
4789         }
4790
4791         memset((char *)&desc,'\0',sizeof(desc));
4792
4793         p = skip_string(param,tpscnt,p);
4794         if (!p) {
4795                 return False;
4796         }
4797         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4798
4799         DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4800
4801         /* check it's a supported variant */
4802         if (strcmp(str1,"zWrLeh") != 0) {
4803                 return False;
4804         }
4805
4806         if (uLevel > 2) {
4807                 return False;   /* defined only for uLevel 0,1,2 */
4808         }
4809
4810         if (!check_printjob_info(&desc,uLevel,str2)) {
4811                 return False;
4812         }
4813
4814         ZERO_STRUCT(handle);
4815
4816         status = rpc_pipe_open_interface(mem_ctx,
4817                                          &ndr_table_spoolss,
4818                                          conn->session_info,
4819                                          conn->sconn->remote_address,
4820                                          conn->sconn->local_address,
4821                                          conn->sconn->msg_ctx,
4822                                          &cli);
4823         if (!NT_STATUS_IS_OK(status)) {
4824                 DEBUG(0,("api_WPrintJobEnumerate: could not connect to spoolss: %s\n",
4825                           nt_errstr(status)));
4826                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4827                 goto out;
4828         }
4829         b = cli->binding_handle;
4830
4831         ZERO_STRUCT(devmode_ctr);
4832
4833         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4834                                             name,
4835                                             NULL,
4836                                             devmode_ctr,
4837                                             PRINTER_ACCESS_USE,
4838                                             &handle,
4839                                             &werr);
4840         if (!NT_STATUS_IS_OK(status)) {
4841                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4842                 goto out;
4843         }
4844         if (!W_ERROR_IS_OK(werr)) {
4845                 desc.errcode = W_ERROR_V(werr);
4846                 goto out;
4847         }
4848
4849         werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
4850                                        &handle,
4851                                        0, /* firstjob */
4852                                        0xff, /* numjobs */
4853                                        2, /* level */
4854                                        0, /* offered */
4855                                        &count,
4856                                        &info);
4857         if (!W_ERROR_IS_OK(werr)) {
4858                 desc.errcode = W_ERROR_V(werr);
4859                 goto out;
4860         }
4861
4862         if (mdrcnt > 0) {
4863                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4864                 if (!*rdata) {
4865                         return False;
4866                 }
4867         }
4868         desc.base = *rdata;
4869         desc.buflen = mdrcnt;
4870
4871         if (init_package(&desc,count,0)) {
4872                 succnt = 0;
4873                 for (i = 0; i < count; i++) {
4874                         fill_spoolss_printjob_info(uLevel, &desc, &info[i].info2, i);
4875                         if (desc.errcode == NERR_Success) {
4876                                 succnt = i+1;
4877                         }
4878                 }
4879         }
4880  out:
4881         if (b && is_valid_policy_hnd(&handle)) {
4882                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4883         }
4884
4885         *rdata_len = desc.usedlen;
4886
4887         *rparam_len = 8;
4888         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4889         if (!*rparam) {
4890                 return False;
4891         }
4892         SSVALS(*rparam,0,desc.errcode);
4893         SSVAL(*rparam,2,0);
4894         SSVAL(*rparam,4,succnt);
4895         SSVAL(*rparam,6,count);
4896
4897         DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4898
4899         return True;
4900 }
4901
4902 static int check_printdest_info(struct pack_desc* desc,
4903                                 int uLevel, char* id)
4904 {
4905         desc->subformat = NULL;
4906         switch( uLevel ) {
4907                 case 0:
4908                         desc->format = "B9";
4909                         break;
4910                 case 1:
4911                         desc->format = "B9B21WWzW";
4912                         break;
4913                 case 2:
4914                         desc->format = "z";
4915                         break;
4916                 case 3:
4917                         desc->format = "zzzWWzzzWW";
4918                         break;
4919                 default:
4920                         DEBUG(0,("check_printdest_info: invalid level %d\n",
4921                                 uLevel));
4922                         return False;
4923         }
4924         if (id == NULL || strcmp(desc->format,id) != 0) {
4925                 DEBUG(0,("check_printdest_info: invalid string %s\n",
4926                         id ? id : "<NULL>" ));
4927                 return False;
4928         }
4929         return True;
4930 }
4931
4932 static void fill_printdest_info(struct spoolss_PrinterInfo2 *info2, int uLevel,
4933                                 struct pack_desc* desc)
4934 {
4935         char buf[100];
4936
4937         strncpy(buf, info2->printername, sizeof(buf)-1);
4938         buf[sizeof(buf)-1] = 0;
4939         (void)strupper_m(buf);
4940
4941         if (uLevel <= 1) {
4942                 PACKS(desc,"B9",buf);   /* szName */
4943                 if (uLevel == 1) {
4944                         PACKS(desc,"B21","");   /* szUserName */
4945                         PACKI(desc,"W",0);              /* uJobId */
4946                         PACKI(desc,"W",0);              /* fsStatus */
4947                         PACKS(desc,"z","");     /* pszStatus */
4948                         PACKI(desc,"W",0);              /* time */
4949                 }
4950         }
4951
4952         if (uLevel == 2 || uLevel == 3) {
4953                 PACKS(desc,"z",buf);            /* pszPrinterName */
4954                 if (uLevel == 3) {
4955                         PACKS(desc,"z","");     /* pszUserName */
4956                         PACKS(desc,"z","");     /* pszLogAddr */
4957                         PACKI(desc,"W",0);              /* uJobId */
4958                         PACKI(desc,"W",0);              /* fsStatus */
4959                         PACKS(desc,"z","");     /* pszStatus */
4960                         PACKS(desc,"z","");     /* pszComment */
4961                         PACKS(desc,"z","NULL"); /* pszDrivers */
4962                         PACKI(desc,"W",0);              /* time */
4963                         PACKI(desc,"W",0);              /* pad1 */
4964                 }
4965         }
4966 }
4967
4968 static bool api_WPrintDestGetInfo(struct smbd_server_connection *sconn,
4969                                   connection_struct *conn, uint64_t vuid,
4970                                 char *param, int tpscnt,
4971                                 char *data, int tdscnt,
4972                                 int mdrcnt,int mprcnt,
4973                                 char **rdata,char **rparam,
4974                                 int *rdata_len,int *rparam_len)
4975 {
4976         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4977         char *str2 = skip_string(param,tpscnt,str1);
4978         char *p = skip_string(param,tpscnt,str2);
4979         char* PrinterName = p;
4980         int uLevel;
4981         struct pack_desc desc;
4982         char *tmpdata=NULL;
4983
4984         TALLOC_CTX *mem_ctx = talloc_tos();
4985         WERROR werr;
4986         NTSTATUS status;
4987         struct rpc_pipe_client *cli = NULL;
4988         struct dcerpc_binding_handle *b = NULL;
4989         struct policy_handle handle;
4990         struct spoolss_DevmodeContainer devmode_ctr;
4991         union spoolss_PrinterInfo info;
4992
4993         if (!str1 || !str2 || !p) {
4994                 return False;
4995         }
4996
4997         memset((char *)&desc,'\0',sizeof(desc));
4998
4999         p = skip_string(param,tpscnt,p);
5000         if (!p) {
5001                 return False;
5002         }
5003         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5004
5005         DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
5006
5007         /* check it's a supported varient */
5008         if (strcmp(str1,"zWrLh") != 0) {
5009                 return False;
5010         }
5011         if (!check_printdest_info(&desc,uLevel,str2)) {
5012                 return False;
5013         }
5014
5015         ZERO_STRUCT(handle);
5016
5017         status = rpc_pipe_open_interface(mem_ctx,
5018                                          &ndr_table_spoolss,
5019                                          conn->session_info,
5020                                          conn->sconn->remote_address,
5021                                          conn->sconn->local_address,
5022                                          conn->sconn->msg_ctx,
5023                                          &cli);
5024         if (!NT_STATUS_IS_OK(status)) {
5025                 DEBUG(0,("api_WPrintDestGetInfo: could not connect to spoolss: %s\n",
5026                           nt_errstr(status)));
5027                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5028                 goto out;
5029         }
5030         b = cli->binding_handle;
5031
5032         ZERO_STRUCT(devmode_ctr);
5033
5034         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5035                                             PrinterName,
5036                                             NULL,
5037                                             devmode_ctr,
5038                                             PRINTER_ACCESS_USE,
5039                                             &handle,
5040                                             &werr);
5041         if (!NT_STATUS_IS_OK(status)) {
5042                 *rdata_len = 0;
5043                 desc.errcode = NERR_DestNotFound;
5044                 desc.neededlen = 0;
5045                 goto out;
5046         }
5047         if (!W_ERROR_IS_OK(werr)) {
5048                 *rdata_len = 0;
5049                 desc.errcode = NERR_DestNotFound;
5050                 desc.neededlen = 0;
5051                 goto out;
5052         }
5053
5054         werr = rpccli_spoolss_getprinter(cli, mem_ctx,
5055                                          &handle,
5056                                          2,
5057                                          0,
5058                                          &info);
5059         if (!W_ERROR_IS_OK(werr)) {
5060                 *rdata_len = 0;
5061                 desc.errcode = NERR_DestNotFound;
5062                 desc.neededlen = 0;
5063                 goto out;
5064         }
5065
5066         if (mdrcnt > 0) {
5067                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5068                 if (!*rdata) {
5069                         return False;
5070                 }
5071                 desc.base = *rdata;
5072                 desc.buflen = mdrcnt;
5073         } else {
5074                 /*
5075                  * Don't return data but need to get correct length
5076                  * init_package will return wrong size if buflen=0
5077                  */
5078                 desc.buflen = getlen(desc.format);
5079                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
5080         }
5081         if (init_package(&desc,1,0)) {
5082                 fill_printdest_info(&info.info2, uLevel,&desc);
5083         }
5084
5085  out:
5086         if (b && is_valid_policy_hnd(&handle)) {
5087                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5088         }
5089
5090         *rdata_len = desc.usedlen;
5091
5092         *rparam_len = 6;
5093         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5094         if (!*rparam) {
5095                 return False;
5096         }
5097         SSVALS(*rparam,0,desc.errcode);
5098         SSVAL(*rparam,2,0);
5099         SSVAL(*rparam,4,desc.neededlen);
5100
5101         DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
5102         SAFE_FREE(tmpdata);
5103
5104         return True;
5105 }
5106
5107 static bool api_WPrintDestEnum(struct smbd_server_connection *sconn,
5108                                connection_struct *conn, uint64_t vuid,
5109                                 char *param, int tpscnt,
5110                                 char *data, int tdscnt,
5111                                 int mdrcnt,int mprcnt,
5112                                 char **rdata,char **rparam,
5113                                 int *rdata_len,int *rparam_len)
5114 {
5115         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5116         char *str2 = skip_string(param,tpscnt,str1);
5117         char *p = skip_string(param,tpscnt,str2);
5118         int uLevel;
5119         int queuecnt;
5120         int i, n, succnt=0;
5121         struct pack_desc desc;
5122
5123         TALLOC_CTX *mem_ctx = talloc_tos();
5124         WERROR werr;
5125         NTSTATUS status;
5126         struct rpc_pipe_client *cli = NULL;
5127         union spoolss_PrinterInfo *info;
5128         uint32_t count;
5129
5130         if (!str1 || !str2 || !p) {
5131                 return False;
5132         }
5133
5134         memset((char *)&desc,'\0',sizeof(desc));
5135
5136         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5137
5138         DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
5139
5140         /* check it's a supported varient */
5141         if (strcmp(str1,"WrLeh") != 0) {
5142                 return False;
5143         }
5144         if (!check_printdest_info(&desc,uLevel,str2)) {
5145                 return False;
5146         }
5147
5148         queuecnt = 0;
5149
5150         status = rpc_pipe_open_interface(mem_ctx,
5151                                          &ndr_table_spoolss,
5152                                          conn->session_info,
5153                                          conn->sconn->remote_address,
5154                                          conn->sconn->local_address,
5155                                          conn->sconn->msg_ctx,
5156                                          &cli);
5157         if (!NT_STATUS_IS_OK(status)) {
5158                 DEBUG(0,("api_WPrintDestEnum: could not connect to spoolss: %s\n",
5159                           nt_errstr(status)));
5160                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5161                 goto out;
5162         }
5163
5164         werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
5165                                            PRINTER_ENUM_LOCAL,
5166                                            cli->srv_name_slash,
5167                                            2,
5168                                            0,
5169                                            &count,
5170                                            &info);
5171         if (!W_ERROR_IS_OK(werr)) {
5172                 desc.errcode = W_ERROR_V(werr);
5173                 *rdata_len = 0;
5174                 desc.errcode = NERR_DestNotFound;
5175                 desc.neededlen = 0;
5176                 goto out;
5177         }
5178
5179         queuecnt = count;
5180
5181         if (mdrcnt > 0) {
5182                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5183                 if (!*rdata) {
5184                         return False;
5185                 }
5186         }
5187
5188         desc.base = *rdata;
5189         desc.buflen = mdrcnt;
5190         if (init_package(&desc,queuecnt,0)) {
5191                 succnt = 0;
5192                 n = 0;
5193                 for (i = 0; i < count; i++) {
5194                         fill_printdest_info(&info[i].info2, uLevel,&desc);
5195                         n++;
5196                         if (desc.errcode == NERR_Success) {
5197                                 succnt = n;
5198                         }
5199                 }
5200         }
5201  out:
5202         *rdata_len = desc.usedlen;
5203
5204         *rparam_len = 8;
5205         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5206         if (!*rparam) {
5207                 return False;
5208         }
5209         SSVALS(*rparam,0,desc.errcode);
5210         SSVAL(*rparam,2,0);
5211         SSVAL(*rparam,4,succnt);
5212         SSVAL(*rparam,6,queuecnt);
5213
5214         DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
5215
5216         return True;
5217 }
5218
5219 static bool api_WPrintDriverEnum(struct smbd_server_connection *sconn,
5220                                  connection_struct *conn, uint64_t vuid,
5221                                 char *param, int tpscnt,
5222                                 char *data, int tdscnt,
5223                                 int mdrcnt,int mprcnt,
5224                                 char **rdata,char **rparam,
5225                                 int *rdata_len,int *rparam_len)
5226 {
5227         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5228         char *str2 = skip_string(param,tpscnt,str1);
5229         char *p = skip_string(param,tpscnt,str2);
5230         int uLevel;
5231         int succnt;
5232         struct pack_desc desc;
5233
5234         if (!str1 || !str2 || !p) {
5235                 return False;
5236         }
5237
5238         memset((char *)&desc,'\0',sizeof(desc));
5239
5240         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5241
5242         DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
5243
5244         /* check it's a supported varient */
5245         if (strcmp(str1,"WrLeh") != 0) {
5246                 return False;
5247         }
5248         if (uLevel != 0 || strcmp(str2,"B41") != 0) {
5249                 return False;
5250         }
5251
5252         if (mdrcnt > 0) {
5253                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5254                 if (!*rdata) {
5255                         return False;
5256                 }
5257         }
5258         desc.base = *rdata;
5259         desc.buflen = mdrcnt;
5260         if (init_package(&desc,1,0)) {
5261                 PACKS(&desc,"B41","NULL");
5262         }
5263
5264         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5265
5266         *rdata_len = desc.usedlen;
5267
5268         *rparam_len = 8;
5269         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5270         if (!*rparam) {
5271                 return False;
5272         }
5273         SSVALS(*rparam,0,desc.errcode);
5274         SSVAL(*rparam,2,0);
5275         SSVAL(*rparam,4,succnt);
5276         SSVAL(*rparam,6,1);
5277
5278         DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
5279
5280         return True;
5281 }
5282
5283 static bool api_WPrintQProcEnum(struct smbd_server_connection *sconn,
5284                                 connection_struct *conn, uint64_t vuid,
5285                                 char *param, int tpscnt,
5286                                 char *data, int tdscnt,
5287                                 int mdrcnt,int mprcnt,
5288                                 char **rdata,char **rparam,
5289                                 int *rdata_len,int *rparam_len)
5290 {
5291         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5292         char *str2 = skip_string(param,tpscnt,str1);
5293         char *p = skip_string(param,tpscnt,str2);
5294         int uLevel;
5295         int succnt;
5296         struct pack_desc desc;
5297
5298         if (!str1 || !str2 || !p) {
5299                 return False;
5300         }
5301         memset((char *)&desc,'\0',sizeof(desc));
5302
5303         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5304
5305         DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
5306
5307         /* check it's a supported varient */
5308         if (strcmp(str1,"WrLeh") != 0) {
5309                 return False;
5310         }
5311         if (uLevel != 0 || strcmp(str2,"B13") != 0) {
5312                 return False;
5313         }
5314
5315         if (mdrcnt > 0) {
5316                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5317                 if (!*rdata) {
5318                         return False;
5319                 }
5320         }
5321         desc.base = *rdata;
5322         desc.buflen = mdrcnt;
5323         desc.format = str2;
5324         if (init_package(&desc,1,0)) {
5325                 PACKS(&desc,"B13","lpd");
5326         }
5327
5328         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5329
5330         *rdata_len = desc.usedlen;
5331
5332         *rparam_len = 8;
5333         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5334         if (!*rparam) {
5335                 return False;
5336         }
5337         SSVALS(*rparam,0,desc.errcode);
5338         SSVAL(*rparam,2,0);
5339         SSVAL(*rparam,4,succnt);
5340         SSVAL(*rparam,6,1);
5341
5342         DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
5343
5344         return True;
5345 }
5346
5347 static bool api_WPrintPortEnum(struct smbd_server_connection *sconn,
5348                                connection_struct *conn, uint64_t vuid,
5349                                 char *param, int tpscnt,
5350                                 char *data, int tdscnt,
5351                                 int mdrcnt,int mprcnt,
5352                                 char **rdata,char **rparam,
5353                                 int *rdata_len,int *rparam_len)
5354 {
5355         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5356         char *str2 = skip_string(param,tpscnt,str1);
5357         char *p = skip_string(param,tpscnt,str2);
5358         int uLevel;
5359         int succnt;
5360         struct pack_desc desc;
5361
5362         if (!str1 || !str2 || !p) {
5363                 return False;
5364         }
5365
5366         memset((char *)&desc,'\0',sizeof(desc));
5367
5368         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5369
5370         DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
5371
5372         /* check it's a supported varient */
5373         if (strcmp(str1,"WrLeh") != 0) {
5374                 return False;
5375         }
5376         if (uLevel != 0 || strcmp(str2,"B9") != 0) {
5377                 return False;
5378         }
5379
5380         if (mdrcnt > 0) {
5381                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5382                 if (!*rdata) {
5383                         return False;
5384                 }
5385         }
5386         memset((char *)&desc,'\0',sizeof(desc));
5387         desc.base = *rdata;
5388         desc.buflen = mdrcnt;
5389         desc.format = str2;
5390         if (init_package(&desc,1,0)) {
5391                 PACKS(&desc,"B13","lp0");
5392         }
5393
5394         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5395
5396         *rdata_len = desc.usedlen;
5397
5398         *rparam_len = 8;
5399         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5400         if (!*rparam) {
5401                 return False;
5402         }
5403         SSVALS(*rparam,0,desc.errcode);
5404         SSVAL(*rparam,2,0);
5405         SSVAL(*rparam,4,succnt);
5406         SSVAL(*rparam,6,1);
5407
5408         DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
5409
5410         return True;
5411 }
5412
5413 /****************************************************************************
5414  List open sessions
5415  ****************************************************************************/
5416
5417 static bool api_RNetSessionEnum(struct smbd_server_connection *sconn,
5418                                 connection_struct *conn, uint64_t vuid,
5419                                 char *param, int tpscnt,
5420                                 char *data, int tdscnt,
5421                                 int mdrcnt,int mprcnt,
5422                                 char **rdata,char **rparam,
5423                                 int *rdata_len,int *rparam_len)
5424
5425 {
5426         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5427         char *str2 = skip_string(param,tpscnt,str1);
5428         char *p = skip_string(param,tpscnt,str2);
5429         int uLevel;
5430         struct pack_desc desc;
5431         int i;
5432
5433         TALLOC_CTX *mem_ctx = talloc_tos();
5434         WERROR werr;
5435         NTSTATUS status;
5436         struct rpc_pipe_client *cli = NULL;
5437         struct dcerpc_binding_handle *b = NULL;
5438         struct srvsvc_NetSessInfoCtr info_ctr;
5439         uint32_t totalentries, resume_handle = 0;
5440         uint32_t count = 0;
5441
5442         if (!str1 || !str2 || !p) {
5443                 return False;
5444         }
5445
5446         ZERO_STRUCT(desc);
5447
5448         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5449
5450         DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
5451         DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
5452         DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
5453
5454         /* check it's a supported varient */
5455         if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
5456                 return False;
5457         }
5458         if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
5459                 return False;
5460         }
5461
5462         status = rpc_pipe_open_interface(mem_ctx,
5463                                          &ndr_table_srvsvc,
5464                                          conn->session_info,
5465                                          conn->sconn->remote_address,
5466                                          conn->sconn->local_address,
5467                                          conn->sconn->msg_ctx,
5468                                          &cli);
5469         if (!NT_STATUS_IS_OK(status)) {
5470                 DEBUG(0,("RNetSessionEnum: could not connect to srvsvc: %s\n",
5471                           nt_errstr(status)));
5472                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5473                 goto out;
5474         }
5475         b = cli->binding_handle;
5476
5477         info_ctr.level = 1;
5478         info_ctr.ctr.ctr1 = talloc_zero(talloc_tos(), struct srvsvc_NetSessCtr1);
5479         if (info_ctr.ctr.ctr1 == NULL) {
5480                 desc.errcode = W_ERROR_V(WERR_NOT_ENOUGH_MEMORY);
5481                 goto out;
5482         }
5483
5484         status = dcerpc_srvsvc_NetSessEnum(b, mem_ctx,
5485                                            cli->srv_name_slash,
5486                                            NULL, /* client */
5487                                            NULL, /* user */
5488                                            &info_ctr,
5489                                            (uint32_t)-1, /* max_buffer */
5490                                            &totalentries,
5491                                            &resume_handle,
5492                                            &werr);
5493         if (!NT_STATUS_IS_OK(status)) {
5494                 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5495                           nt_errstr(status)));
5496                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5497                 goto out;
5498         }
5499
5500         if (!W_ERROR_IS_OK(werr)) {
5501                 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5502                           win_errstr(werr)));
5503                 desc.errcode = W_ERROR_V(werr);
5504                 goto out;
5505         }
5506
5507         count = info_ctr.ctr.ctr1->count;
5508
5509  out:
5510         if (mdrcnt > 0) {
5511                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5512                 if (!*rdata) {
5513                         return False;
5514                 }
5515         }
5516
5517         desc.base = *rdata;
5518         desc.buflen = mdrcnt;
5519         desc.format = str2;
5520         if (!init_package(&desc, count,0)) {
5521                 return False;
5522         }
5523
5524         for(i=0; i < count; i++) {
5525                 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].client);
5526                 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].user);
5527                 PACKI(&desc, "W", 1); /* num conns */
5528                 PACKI(&desc, "W", info_ctr.ctr.ctr1->array[i].num_open);
5529                 PACKI(&desc, "W", 1); /* num users */
5530                 PACKI(&desc, "D", 0); /* session time */
5531                 PACKI(&desc, "D", 0); /* idle time */
5532                 PACKI(&desc, "D", 0); /* flags */
5533                 PACKS(&desc, "z", "Unknown Client"); /* client type string */
5534         }
5535
5536         *rdata_len = desc.usedlen;
5537
5538         *rparam_len = 8;
5539         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5540         if (!*rparam) {
5541                 return False;
5542         }
5543         SSVALS(*rparam,0,desc.errcode);
5544         SSVAL(*rparam,2,0); /* converter */
5545         SSVAL(*rparam,4, count); /* count */
5546
5547         DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
5548
5549         return True;
5550 }
5551
5552
5553 /****************************************************************************
5554  The buffer was too small.
5555  ****************************************************************************/
5556
5557 static bool api_TooSmall(struct smbd_server_connection *sconn,
5558                          connection_struct *conn,uint64_t vuid, char *param, char *data,
5559                          int mdrcnt, int mprcnt,
5560                          char **rdata, char **rparam,
5561                          int *rdata_len, int *rparam_len)
5562 {
5563         *rparam_len = MIN(*rparam_len,mprcnt);
5564         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5565         if (!*rparam) {
5566                 return False;
5567         }
5568
5569         *rdata_len = 0;
5570
5571         SSVAL(*rparam,0,NERR_BufTooSmall);
5572
5573         DEBUG(3,("Supplied buffer too small in API command\n"));
5574
5575         return True;
5576 }
5577
5578 /****************************************************************************
5579  The request is not supported.
5580  ****************************************************************************/
5581
5582 static bool api_Unsupported(struct smbd_server_connection *sconn,
5583                             connection_struct *conn, uint64_t vuid,
5584                                 char *param, int tpscnt,
5585                                 char *data, int tdscnt,
5586                                 int mdrcnt, int mprcnt,
5587                                 char **rdata, char **rparam,
5588                                 int *rdata_len, int *rparam_len)
5589 {
5590         *rparam_len = 4;
5591         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5592         if (!*rparam) {
5593                 return False;
5594         }
5595
5596         *rdata_len = 0;
5597
5598         SSVAL(*rparam,0,NERR_notsupported);
5599         SSVAL(*rparam,2,0);             /* converter word */
5600
5601         DEBUG(3,("Unsupported API command\n"));
5602
5603         return True;
5604 }
5605
5606 static const struct {
5607         const char *name;
5608         int id;
5609         bool (*fn)(struct smbd_server_connection *sconn,
5610                    connection_struct *, uint64_t,
5611                         char *, int,
5612                         char *, int,
5613                         int,int,char **,char **,int *,int *);
5614         bool auth_user;         /* Deny anonymous access? */
5615 } api_commands[] = {
5616         {
5617                 .name = "RNetShareEnum",
5618                 .id = RAP_WshareEnum,
5619                 .fn = api_RNetShareEnum,
5620                 .auth_user = true,
5621         },
5622         {
5623                 .name = "RNetShareGetInfo",
5624                 .id = RAP_WshareGetInfo,
5625                 .fn = api_RNetShareGetInfo
5626         },
5627         {
5628                 .name = "RNetShareAdd",
5629                 .id = RAP_WshareAdd,
5630                 .fn = api_RNetShareAdd
5631         },
5632         {
5633                 .name = "RNetSessionEnum",
5634                 .id = RAP_WsessionEnum,
5635                 .fn = api_RNetSessionEnum,
5636                 .auth_user = true,
5637         },
5638         {
5639                 .name = "RNetServerGetInfo",
5640                 .id = RAP_WserverGetInfo,
5641                 .fn = api_RNetServerGetInfo
5642         },
5643         {
5644                 .name = "RNetGroupEnum",
5645                 .id = RAP_WGroupEnum,
5646                 .fn = api_RNetGroupEnum, True
5647         },
5648         {
5649                 .name = "RNetGroupGetUsers",
5650                 .id = RAP_WGroupGetUsers,
5651                 .fn = api_RNetGroupGetUsers,
5652                 .auth_user = true},
5653         {
5654                 .name = "RNetUserEnum",
5655                 .id = RAP_WUserEnum,
5656                 .fn = api_RNetUserEnum,
5657                 .auth_user = true,
5658         },
5659         {
5660                 .name = "RNetUserGetInfo",
5661                 .id = RAP_WUserGetInfo,
5662                 .fn = api_RNetUserGetInfo
5663         },
5664         {
5665                 .name = "NetUserGetGroups",
5666                 .id = RAP_WUserGetGroups,
5667                 .fn = api_NetUserGetGroups
5668         },
5669         {
5670                 .name = "NetWkstaGetInfo",
5671                 .id = RAP_WWkstaGetInfo,
5672                 .fn = api_NetWkstaGetInfo
5673         },
5674         {
5675                 .name = "DosPrintQEnum",
5676                 .id = RAP_WPrintQEnum,
5677                 .fn = api_DosPrintQEnum,
5678                 .auth_user = true,
5679         },
5680         {
5681                 .name = "DosPrintQGetInfo",
5682                 .id = RAP_WPrintQGetInfo,
5683                 .fn = api_DosPrintQGetInfo
5684         },
5685         {
5686                 .name = "WPrintQueuePause",
5687                 .id = RAP_WPrintQPause,
5688                 .fn = api_WPrintQueueCtrl
5689         },
5690         {
5691                 .name = "WPrintQueueResume",
5692                 .id = RAP_WPrintQContinue,
5693                 .fn = api_WPrintQueueCtrl
5694         },
5695         {
5696                 .name = "WPrintJobEnumerate",
5697                 .id = RAP_WPrintJobEnum,
5698                 .fn = api_WPrintJobEnumerate
5699         },
5700         {
5701                 .name = "WPrintJobGetInfo",
5702                 .id = RAP_WPrintJobGetInfo,
5703                 .fn = api_WPrintJobGetInfo
5704         },
5705         {
5706                 .name = "RDosPrintJobDel",
5707                 .id = RAP_WPrintJobDel,
5708                 .fn = api_RDosPrintJobDel
5709         },
5710         {
5711                 .name = "RDosPrintJobPause",
5712                 .id = RAP_WPrintJobPause,
5713                 .fn = api_RDosPrintJobDel
5714         },
5715         {
5716                 .name = "RDosPrintJobResume",
5717                 .id = RAP_WPrintJobContinue,
5718                 .fn = api_RDosPrintJobDel
5719         },
5720         {
5721                 .name = "WPrintDestEnum",
5722                 .id = RAP_WPrintDestEnum,
5723                 .fn = api_WPrintDestEnum
5724         },
5725         {
5726                 .name = "WPrintDestGetInfo",
5727                 .id = RAP_WPrintDestGetInfo,
5728                 .fn = api_WPrintDestGetInfo
5729         },
5730         {
5731                 .name = "NetRemoteTOD",
5732                 .id = RAP_NetRemoteTOD,
5733                 .fn = api_NetRemoteTOD
5734         },
5735         {
5736                 .name = "WPrintQueuePurge",
5737                 .id = RAP_WPrintQPurge,
5738                 .fn = api_WPrintQueueCtrl
5739         },
5740         {
5741                 .name = "NetServerEnum2",
5742                 .id = RAP_NetServerEnum2,
5743                 .fn = api_RNetServerEnum2
5744         }, /* anon OK */
5745         {
5746                 .name = "NetServerEnum3",
5747                 .id = RAP_NetServerEnum3,
5748                 .fn = api_RNetServerEnum3
5749         }, /* anon OK */
5750         {
5751                 .name = "WAccessGetUserPerms",
5752                 .id = RAP_WAccessGetUserPerms,
5753                 .fn = api_WAccessGetUserPerms
5754         },
5755         {
5756                 .name = "WWkstaUserLogon",
5757                 .id = RAP_WWkstaUserLogon,
5758                 .fn = api_WWkstaUserLogon
5759         },
5760         {
5761                 .name = "PrintJobInfo",
5762                 .id = RAP_WPrintJobSetInfo,
5763                 .fn = api_PrintJobInfo
5764         },
5765         {
5766                 .name = "WPrintDriverEnum",
5767                 .id = RAP_WPrintDriverEnum,
5768                 .fn = api_WPrintDriverEnum
5769         },
5770         {
5771                 .name = "WPrintQProcEnum",
5772                 .id = RAP_WPrintQProcessorEnum,
5773                 .fn = api_WPrintQProcEnum
5774         },
5775         {
5776                 .name = "WPrintPortEnum",
5777                 .id = RAP_WPrintPortEnum,
5778                 .fn = api_WPrintPortEnum
5779         },
5780         {
5781                 .name = "SamOEMChangePassword",
5782                 .id = RAP_SamOEMChgPasswordUser2_P,
5783                 .fn = api_SamOEMChangePassword
5784         }, /* anon OK */
5785         {
5786                 .name = NULL,
5787                 .id   = -1,
5788                 .fn   = api_Unsupported}
5789         /*
5790          * The following RAP calls are not implemented by Samba:
5791          *   RAP_WFileEnum2 - anon not OK
5792          */
5793 };
5794
5795
5796 /****************************************************************************
5797  Handle remote api calls.
5798 ****************************************************************************/
5799
5800 void api_reply(connection_struct *conn, uint64_t vuid,
5801                struct smb_request *req,
5802                char *data, char *params,
5803                int tdscnt, int tpscnt,
5804                int mdrcnt, int mprcnt)
5805 {
5806         int api_command;
5807         char *rdata = NULL;
5808         char *rparam = NULL;
5809         const char *name1 = NULL;
5810         const char *name2 = NULL;
5811         int rdata_len = 0;
5812         int rparam_len = 0;
5813         bool reply=False;
5814         int i;
5815
5816         if (!params) {
5817                 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
5818                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5819                 return;
5820         }
5821
5822         if (tpscnt < 2) {
5823                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5824                 return;
5825         }
5826         api_command = SVAL(params,0);
5827         /* Is there a string at position params+2 ? */
5828         if (skip_string(params,tpscnt,params+2)) {
5829                 name1 = params + 2;
5830         } else {
5831                 name1 = "";
5832         }
5833         name2 = skip_string(params,tpscnt,params+2);
5834         if (!name2) {
5835                 name2 = "";
5836         }
5837
5838         DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
5839                 api_command,
5840                 name1,
5841                 name2,
5842                 tdscnt,tpscnt,mdrcnt,mprcnt));
5843
5844         for (i=0;api_commands[i].name;i++) {
5845                 if (api_commands[i].id == api_command && api_commands[i].fn) {
5846                         DEBUG(3,("Doing %s\n",api_commands[i].name));
5847                         break;
5848                 }
5849         }
5850
5851         /* Check whether this api call can be done anonymously */
5852
5853         if (api_commands[i].auth_user && lp_restrict_anonymous()) {
5854                 struct auth_session_info *si = NULL;
5855                 NTSTATUS status;
5856
5857                 status = smbXsrv_session_info_lookup(conn->sconn->client,
5858                                                      vuid,
5859                                                      &si);
5860                 if (!NT_STATUS_IS_OK(status)) {
5861                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5862                         return;
5863                 }
5864
5865                 if (security_session_user_level(si, NULL) < SECURITY_USER) {
5866                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5867                         return;
5868                 }
5869         }
5870
5871         rdata = (char *)SMB_MALLOC(1024);
5872         if (rdata) {
5873                 memset(rdata,'\0',1024);
5874         }
5875
5876         rparam = (char *)SMB_MALLOC(1024);
5877         if (rparam) {
5878                 memset(rparam,'\0',1024);
5879         }
5880
5881         if(!rdata || !rparam) {
5882                 DEBUG(0,("api_reply: malloc fail !\n"));
5883                 SAFE_FREE(rdata);
5884                 SAFE_FREE(rparam);
5885                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5886                 return;
5887         }
5888
5889         reply = api_commands[i].fn(req->sconn, conn,
5890                                 vuid,
5891                                 params,tpscnt,  /* params + length */
5892                                 data,tdscnt,    /* data + length */
5893                                 mdrcnt,mprcnt,
5894                                 &rdata,&rparam,&rdata_len,&rparam_len);
5895
5896
5897         if (rdata_len > mdrcnt || rparam_len > mprcnt) {
5898                 reply = api_TooSmall(req->sconn,conn,vuid,params,data,
5899                                      mdrcnt,mprcnt,
5900                                         &rdata,&rparam,&rdata_len,&rparam_len);
5901         }
5902
5903         /* if we get False back then it's actually unsupported */
5904         if (!reply) {
5905                 reply = api_Unsupported(req->sconn,conn,vuid,params,tpscnt,
5906                                         data,
5907                                         tdscnt,mdrcnt,mprcnt,
5908                         &rdata,&rparam,&rdata_len,&rparam_len);
5909         }
5910
5911         /* If api_Unsupported returns false we can't return anything. */
5912         if (reply) {
5913                 send_trans_reply(conn, req, rparam, rparam_len,
5914                                  rdata, rdata_len, False);
5915         }
5916
5917         SAFE_FREE(rdata);
5918         SAFE_FREE(rparam);
5919         return;
5920 }