source3/smbd/lanman.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Inter-process communication and named pipe handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Jeremy Allison 2007.
   6
   7    SMB Version handling
   8    Copyright (C) John H Terpstra 1995-1998
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22    */
  23 /*
  24    This file handles the named pipe and mailslot calls
  25    in the SMBtrans protocol
  26    */
  27
  28 #include "includes.h"
  29 #include "smbd/globals.h"
  30
  31 #ifdef CHECK_TYPES
  32 #undef CHECK_TYPES
  33 #endif
  34 #define CHECK_TYPES 0
  35
  36 #define NERR_Success 0
  37 #define NERR_badpass 86
  38 #define NERR_notsupported 50
  39
  40 #define NERR_BASE (2100)
  41 #define NERR_BufTooSmall (NERR_BASE+23)
  42 #define NERR_JobNotFound (NERR_BASE+51)
  43 #define NERR_DestNotFound (NERR_BASE+52)
  44
  45 #define ACCESS_READ 0x01
  46 #define ACCESS_WRITE 0x02
  47 #define ACCESS_CREATE 0x04
  48
  49 #define SHPWLEN 8               /* share password length */
  50
  51 /* Limit size of ipc replies */
  52
  53 static char *smb_realloc_limit(void *ptr, size_t size)
  54 {
  55         char *val;
  56
  57         size = MAX((size),4*1024);
  58         val = (char *)SMB_REALLOC(ptr,size);
  59         if (val) {
  60                 memset(val,'\0',size);
  61         }
  62         return val;
  63 }
  64
  65 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
  66                                 char *param, int tpscnt,
  67                                 char *data, int tdscnt,
  68                                 int mdrcnt, int mprcnt,
  69                                 char **rdata, char **rparam,
  70                                 int *rdata_len, int *rparam_len);
  71
  72 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
  73                          int mdrcnt, int mprcnt,
  74                          char **rdata, char **rparam,
  75                          int *rdata_len, int *rparam_len);
  76
  77
  78 static int CopyExpanded(connection_struct *conn,
  79                         int snum, char **dst, char *src, int *p_space_remaining)
  80 {
  81         TALLOC_CTX *ctx = talloc_tos();
  82         char *buf = NULL;
  83         int l;
  84
  85         if (!src || !dst || !p_space_remaining || !(*dst) ||
  86                         *p_space_remaining <= 0) {
  87                 return 0;
  88         }
  89
  90         buf = talloc_strdup(ctx, src);
  91         if (!buf) {
  92                 *p_space_remaining = 0;
  93                 return 0;
  94         }
  95         buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
  96         if (!buf) {
  97                 *p_space_remaining = 0;
  98                 return 0;
  99         }
 100         buf = talloc_sub_advanced(ctx,
 101                                 lp_servicename(SNUM(conn)),
 102                                 conn->server_info->unix_name,
 103                                 conn->connectpath,
 104                                 conn->server_info->utok.gid,
 105                                 conn->server_info->sanitized_username,
 106                                 pdb_get_domain(conn->server_info->sam_account),
 107                                 buf);
 108         if (!buf) {
 109                 *p_space_remaining = 0;
 110                 return 0;
 111         }
 112         l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
 113         if (l == -1) {
 114                 return 0;
 115         }
 116         (*dst) += l;
 117         (*p_space_remaining) -= l;
 118         return l;
 119 }
 120
 121 static int CopyAndAdvance(char **dst, char *src, int *n)
 122 {
 123         int l;
 124         if (!src || !dst || !n || !(*dst)) {
 125                 return 0;
 126         }
 127         l = push_ascii(*dst,src,*n, STR_TERMINATE);
 128         if (l == -1) {
 129                 return 0;
 130         }
 131         (*dst) += l;
 132         (*n) -= l;
 133         return l;
 134 }
 135
 136 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
 137 {
 138         TALLOC_CTX *ctx = talloc_tos();
 139         char *buf = NULL;
 140         if (!s) {
 141                 return 0;
 142         }
 143         buf = talloc_strdup(ctx,s);
 144         if (!buf) {
 145                 return 0;
 146         }
 147         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 148         if (!buf) {
 149                 return 0;
 150         }
 151         buf = talloc_sub_advanced(ctx,
 152                                 lp_servicename(SNUM(conn)),
 153                                 conn->server_info->unix_name,
 154                                 conn->connectpath,
 155                                 conn->server_info->utok.gid,
 156                                 conn->server_info->sanitized_username,
 157                                 pdb_get_domain(conn->server_info->sam_account),
 158                                 buf);
 159         if (!buf) {
 160                 return 0;
 161         }
 162         return strlen(buf) + 1;
 163 }
 164
 165 static char *Expand(connection_struct *conn, int snum, char *s)
 166 {
 167         TALLOC_CTX *ctx = talloc_tos();
 168         char *buf = NULL;
 169
 170         if (!s) {
 171                 return NULL;
 172         }
 173         buf = talloc_strdup(ctx,s);
 174         if (!buf) {
 175                 return 0;
 176         }
 177         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 178         if (!buf) {
 179                 return 0;
 180         }
 181         return talloc_sub_advanced(ctx,
 182                                 lp_servicename(SNUM(conn)),
 183                                 conn->server_info->unix_name,
 184                                 conn->connectpath,
 185                                 conn->server_info->utok.gid,
 186                                 conn->server_info->sanitized_username,
 187                                 pdb_get_domain(conn->server_info->sam_account),
 188                                 buf);
 189 }
 190
 191 /*******************************************************************
 192  Check a API string for validity when we only need to check the prefix.
 193 ******************************************************************/
 194
 195 static bool prefix_ok(const char *str, const char *prefix)
 196 {
 197         return(strncmp(str,prefix,strlen(prefix)) == 0);
 198 }
 199
 200 struct pack_desc {
 201         const char *format;         /* formatstring for structure */
 202         const char *subformat;  /* subformat for structure */
 203         char *base;         /* baseaddress of buffer */
 204         int buflen;        /* remaining size for fixed part; on init: length of base */
 205         int subcount;       /* count of substructures */
 206         char *structbuf;  /* pointer into buffer for remaining fixed part */
 207         int stringlen;    /* remaining size for variable part */
 208         char *stringbuf;  /* pointer into buffer for remaining variable part */
 209         int neededlen;    /* total needed size */
 210         int usedlen;        /* total used size (usedlen <= neededlen and usedlen <= buflen) */
 211         const char *curpos;         /* current position; pointer into format or subformat */
 212         int errcode;
 213 };
 214
 215 static int get_counter(const char **p)
 216 {
 217         int i, n;
 218         if (!p || !(*p)) {
 219                 return 1;
 220         }
 221         if (!isdigit((int)**p)) {
 222                 return 1;
 223         }
 224         for (n = 0;;) {
 225                 i = **p;
 226                 if (isdigit(i)) {
 227                         n = 10 * n + (i - '0');
 228                 } else {
 229                         return n;
 230                 }
 231                 (*p)++;
 232         }
 233 }
 234
 235 static int getlen(const char *p)
 236 {
 237         int n = 0;
 238         if (!p) {
 239                 return 0;
 240         }
 241
 242         while (*p) {
 243                 switch( *p++ ) {
 244                 case 'W':                       /* word (2 byte) */
 245                         n += 2;
 246                         break;
 247                 case 'K':                       /* status word? (2 byte) */
 248                         n += 2;
 249                         break;
 250                 case 'N':                       /* count of substructures (word) at end */
 251                         n += 2;
 252                         break;
 253                 case 'D':                       /* double word (4 byte) */
 254                 case 'z':                       /* offset to zero terminated string (4 byte) */
 255                 case 'l':                       /* offset to user data (4 byte) */
 256                         n += 4;
 257                         break;
 258                 case 'b':                       /* offset to data (with counter) (4 byte) */
 259                         n += 4;
 260                         get_counter(&p);
 261                         break;
 262                 case 'B':                       /* byte (with optional counter) */
 263                         n += get_counter(&p);
 264                         break;
 265                 }
 266         }
 267         return n;
 268 }
 269
 270 static bool init_package(struct pack_desc *p, int count, int subcount)
 271 {
 272         int n = p->buflen;
 273         int i;
 274
 275         if (!p->format || !p->base) {
 276                 return False;
 277         }
 278
 279         i = count * getlen(p->format);
 280         if (p->subformat) {
 281                 i += subcount * getlen(p->subformat);
 282         }
 283         p->structbuf = p->base;
 284         p->neededlen = 0;
 285         p->usedlen = 0;
 286         p->subcount = 0;
 287         p->curpos = p->format;
 288         if (i > n) {
 289                 p->neededlen = i;
 290                 i = n = 0;
 291 #if 0
 292                 /*
 293                  * This is the old error code we used. Aparently
 294                  * WinNT/2k systems return ERRbuftoosmall (2123) and
 295                  * OS/2 needs this. I'm leaving this here so we can revert
 296                  * if needed. JRA.
 297                  */
 298                 p->errcode = ERRmoredata;
 299 #else
 300                 p->errcode = ERRbuftoosmall;
 301 #endif
 302         } else {
 303                 p->errcode = NERR_Success;
 304         }
 305         p->buflen = i;
 306         n -= i;
 307         p->stringbuf = p->base + i;
 308         p->stringlen = n;
 309         return (p->errcode == NERR_Success);
 310 }
 311
 312 static int package(struct pack_desc *p, ...)
 313 {
 314         va_list args;
 315         int needed=0, stringneeded;
 316         const char *str=NULL;
 317         int is_string=0, stringused;
 318         int32 temp;
 319
 320         va_start(args,p);
 321
 322         if (!*p->curpos) {
 323                 if (!p->subcount) {
 324                         p->curpos = p->format;
 325                 } else {
 326                         p->curpos = p->subformat;
 327                         p->subcount--;
 328                 }
 329         }
 330 #if CHECK_TYPES
 331         str = va_arg(args,char*);
 332         SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
 333 #endif
 334         stringneeded = -1;
 335
 336         if (!p->curpos) {
 337                 va_end(args);
 338                 return 0;
 339         }
 340
 341         switch( *p->curpos++ ) {
 342                 case 'W':                       /* word (2 byte) */
 343                         needed = 2;
 344                         temp = va_arg(args,int);
 345                         if (p->buflen >= needed) {
 346                                 SSVAL(p->structbuf,0,temp);
 347                         }
 348                         break;
 349                 case 'K':                       /* status word? (2 byte) */
 350                         needed = 2;
 351                         temp = va_arg(args,int);
 352                         if (p->buflen >= needed) {
 353                                 SSVAL(p->structbuf,0,temp);
 354                         }
 355                         break;
 356                 case 'N':                       /* count of substructures (word) at end */
 357                         needed = 2;
 358                         p->subcount = va_arg(args,int);
 359                         if (p->buflen >= needed) {
 360                                 SSVAL(p->structbuf,0,p->subcount);
 361                         }
 362                         break;
 363                 case 'D':                       /* double word (4 byte) */
 364                         needed = 4;
 365                         temp = va_arg(args,int);
 366                         if (p->buflen >= needed) {
 367                                 SIVAL(p->structbuf,0,temp);
 368                         }
 369                         break;
 370                 case 'B':                       /* byte (with optional counter) */
 371                         needed = get_counter(&p->curpos);
 372                         {
 373                                 char *s = va_arg(args,char*);
 374                                 if (p->buflen >= needed) {
 375                                         StrnCpy(p->structbuf,s?s:"",needed-1);
 376                                 }
 377                         }
 378                         break;
 379                 case 'z':                       /* offset to zero terminated string (4 byte) */
 380                         str = va_arg(args,char*);
 381                         stringneeded = (str ? strlen(str)+1 : 0);
 382                         is_string = 1;
 383                         break;
 384                 case 'l':                       /* offset to user data (4 byte) */
 385                         str = va_arg(args,char*);
 386                         stringneeded = va_arg(args,int);
 387                         is_string = 0;
 388                         break;
 389                 case 'b':                       /* offset to data (with counter) (4 byte) */
 390                         str = va_arg(args,char*);
 391                         stringneeded = get_counter(&p->curpos);
 392                         is_string = 0;
 393                         break;
 394         }
 395
 396         va_end(args);
 397         if (stringneeded >= 0) {
 398                 needed = 4;
 399                 if (p->buflen >= needed) {
 400                         stringused = stringneeded;
 401                         if (stringused > p->stringlen) {
 402                                 stringused = (is_string ? p->stringlen : 0);
 403                                 if (p->errcode == NERR_Success) {
 404                                         p->errcode = ERRmoredata;
 405                                 }
 406                         }
 407                         if (!stringused) {
 408                                 SIVAL(p->structbuf,0,0);
 409                         } else {
 410                                 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
 411                                 memcpy(p->stringbuf,str?str:"",stringused);
 412                                 if (is_string) {
 413                                         p->stringbuf[stringused-1] = '\0';
 414                                 }
 415                                 p->stringbuf += stringused;
 416                                 p->stringlen -= stringused;
 417                                 p->usedlen += stringused;
 418                         }
 419                 }
 420                 p->neededlen += stringneeded;
 421         }
 422
 423         p->neededlen += needed;
 424         if (p->buflen >= needed) {
 425                 p->structbuf += needed;
 426                 p->buflen -= needed;
 427                 p->usedlen += needed;
 428         } else {
 429                 if (p->errcode == NERR_Success) {
 430                         p->errcode = ERRmoredata;
 431                 }
 432         }
 433         return 1;
 434 }
 435
 436 #if CHECK_TYPES
 437 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
 438 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
 439 #else
 440 #define PACK(desc,t,v) package(desc,v)
 441 #define PACKl(desc,t,v,l) package(desc,v,l)
 442 #endif
 443
 444 static void PACKI(struct pack_desc* desc, const char *t,int v)
 445 {
 446         PACK(desc,t,v);
 447 }
 448
 449 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
 450 {
 451         PACK(desc,t,v);
 452 }
 453
 454 /****************************************************************************
 455  Get a print queue.
 456 ****************************************************************************/
 457
 458 static void PackDriverData(struct pack_desc* desc)
 459 {
 460         char drivdata[4+4+32];
 461         SIVAL(drivdata,0,sizeof drivdata); /* cb */
 462         SIVAL(drivdata,4,1000); /* lVersion */
 463         memset(drivdata+8,0,32);        /* szDeviceName */
 464         push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
 465         PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
 466 }
 467
 468 static int check_printq_info(struct pack_desc* desc,
 469                                 unsigned int uLevel, char *id1, char *id2)
 470 {
 471         desc->subformat = NULL;
 472         switch( uLevel ) {
 473                 case 0:
 474                         desc->format = "B13";
 475                         break;
 476                 case 1:
 477                         desc->format = "B13BWWWzzzzzWW";
 478                         break;
 479                 case 2:
 480                         desc->format = "B13BWWWzzzzzWN";
 481                         desc->subformat = "WB21BB16B10zWWzDDz";
 482                         break;
 483                 case 3:
 484                         desc->format = "zWWWWzzzzWWzzl";
 485                         break;
 486                 case 4:
 487                         desc->format = "zWWWWzzzzWNzzl";
 488                         desc->subformat = "WWzWWDDzz";
 489                         break;
 490                 case 5:
 491                         desc->format = "z";
 492                         break;
 493                 case 51:
 494                         desc->format = "K";
 495                         break;
 496                 case 52:
 497                         desc->format = "WzzzzzzzzN";
 498                         desc->subformat = "z";
 499                         break;
 500                 default:
 501                         DEBUG(0,("check_printq_info: invalid level %d\n",
 502                                 uLevel ));
 503                         return False;
 504         }
 505         if (id1 == NULL || strcmp(desc->format,id1) != 0) {
 506                 DEBUG(0,("check_printq_info: invalid format %s\n",
 507                         id1 ? id1 : "<NULL>" ));
 508                 return False;
 509         }
 510         if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
 511                 DEBUG(0,("check_printq_info: invalid subformat %s\n",
 512                         id2 ? id2 : "<NULL>" ));
 513                 return False;
 514         }
 515         return True;
 516 }
 517
 518
 519 #define RAP_JOB_STATUS_QUEUED 0
 520 #define RAP_JOB_STATUS_PAUSED 1
 521 #define RAP_JOB_STATUS_SPOOLING 2
 522 #define RAP_JOB_STATUS_PRINTING 3
 523 #define RAP_JOB_STATUS_PRINTED 4
 524
 525 #define RAP_QUEUE_STATUS_PAUSED 1
 526 #define RAP_QUEUE_STATUS_ERROR 2
 527
 528 /* turn a print job status into a on the wire status
 529 */
 530 static int printj_status(int v)
 531 {
 532         switch (v) {
 533         case LPQ_QUEUED:
 534                 return RAP_JOB_STATUS_QUEUED;
 535         case LPQ_PAUSED:
 536                 return RAP_JOB_STATUS_PAUSED;
 537         case LPQ_SPOOLING:
 538                 return RAP_JOB_STATUS_SPOOLING;
 539         case LPQ_PRINTING:
 540                 return RAP_JOB_STATUS_PRINTING;
 541         }
 542         return 0;
 543 }
 544
 545 /* turn a print queue status into a on the wire status
 546 */
 547 static int printq_status(int v)
 548 {
 549         switch (v) {
 550         case LPQ_QUEUED:
 551                 return 0;
 552         case LPQ_PAUSED:
 553                 return RAP_QUEUE_STATUS_PAUSED;
 554         }
 555         return RAP_QUEUE_STATUS_ERROR;
 556 }
 557
 558 static void fill_printjob_info(connection_struct *conn, int snum, int uLevel,
 559                                struct pack_desc *desc,
 560                                print_queue_struct *queue, int n)
 561 {
 562         time_t t = queue->time;
 563
 564         /* the client expects localtime */
 565         t -= get_time_zone(t);
 566
 567         PACKI(desc,"W",pjobid_to_rap(lp_const_servicename(snum),queue->job)); /* uJobId */
 568         if (uLevel == 1) {
 569                 PACKS(desc,"B21",queue->fs_user); /* szUserName */
 570                 PACKS(desc,"B","");             /* pad */
 571                 PACKS(desc,"B16","");   /* szNotifyName */
 572                 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
 573                 PACKS(desc,"z","");             /* pszParms */
 574                 PACKI(desc,"W",n+1);            /* uPosition */
 575                 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
 576                 PACKS(desc,"z","");             /* pszStatus */
 577                 PACKI(desc,"D",t); /* ulSubmitted */
 578                 PACKI(desc,"D",queue->size); /* ulSize */
 579                 PACKS(desc,"z",queue->fs_file); /* pszComment */
 580         }
 581         if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
 582                 PACKI(desc,"W",queue->priority);                /* uPriority */
 583                 PACKS(desc,"z",queue->fs_user); /* pszUserName */
 584                 PACKI(desc,"W",n+1);            /* uPosition */
 585                 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
 586                 PACKI(desc,"D",t); /* ulSubmitted */
 587                 PACKI(desc,"D",queue->size); /* ulSize */
 588                 PACKS(desc,"z","Samba");        /* pszComment */
 589                 PACKS(desc,"z",queue->fs_file); /* pszDocument */
 590                 if (uLevel == 3) {
 591                         PACKS(desc,"z","");     /* pszNotifyName */
 592                         PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
 593                         PACKS(desc,"z","");     /* pszParms */
 594                         PACKS(desc,"z","");     /* pszStatus */
 595                         PACKS(desc,"z",SERVICE(snum)); /* pszQueue */
 596                         PACKS(desc,"z","lpd");  /* pszQProcName */
 597                         PACKS(desc,"z","");     /* pszQProcParms */
 598                         PACKS(desc,"z","NULL"); /* pszDriverName */
 599                         PackDriverData(desc);   /* pDriverData */
 600                         PACKS(desc,"z","");     /* pszPrinterName */
 601                 } else if (uLevel == 4) {   /* OS2 */
 602                         PACKS(desc,"z","");       /* pszSpoolFileName  */
 603                         PACKS(desc,"z","");       /* pszPortName       */
 604                         PACKS(desc,"z","");       /* pszStatus         */
 605                         PACKI(desc,"D",0);        /* ulPagesSpooled    */
 606                         PACKI(desc,"D",0);        /* ulPagesSent       */
 607                         PACKI(desc,"D",0);        /* ulPagesPrinted    */
 608                         PACKI(desc,"D",0);        /* ulTimePrinted     */
 609                         PACKI(desc,"D",0);        /* ulExtendJobStatus */
 610                         PACKI(desc,"D",0);        /* ulStartPage       */
 611                         PACKI(desc,"D",0);        /* ulEndPage         */
 612                 }
 613         }
 614 }
 615
 616 /********************************************************************
 617  Return a driver name given an snum.
 618  Returns True if from tdb, False otherwise.
 619  ********************************************************************/
 620
 621 static bool get_driver_name(int snum, char **pp_drivername)
 622 {
 623         NT_PRINTER_INFO_LEVEL *info = NULL;
 624         bool in_tdb = false;
 625
 626         get_a_printer (NULL, &info, 2, lp_servicename(snum));
 627         if (info != NULL) {
 628                 *pp_drivername = talloc_strdup(talloc_tos(),
 629                                         info->info_2->drivername);
 630                 in_tdb = true;
 631                 free_a_printer(&info, 2);
 632                 if (!*pp_drivername) {
 633                         return false;
 634                 }
 635         }
 636
 637         return in_tdb;
 638 }
 639
 640 /********************************************************************
 641  Respond to the DosPrintQInfo command with a level of 52
 642  This is used to get printer driver information for Win9x clients
 643  ********************************************************************/
 644 static void fill_printq_info_52(connection_struct *conn, int snum,
 645                                 struct pack_desc* desc, int count )
 646 {
 647         int                             i;
 648         fstring                         location;
 649         NT_PRINTER_DRIVER_INFO_LEVEL    driver;
 650         NT_PRINTER_INFO_LEVEL           *printer = NULL;
 651
 652         ZERO_STRUCT(driver);
 653
 654         if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
 655                 DEBUG(3,("fill_printq_info_52: Failed to lookup printer [%s]\n",
 656                         lp_servicename(snum)));
 657                 goto err;
 658         }
 659
 660         if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
 661                 "Windows 4.0", 0)) )
 662         {
 663                 DEBUG(3,("fill_printq_info_52: Failed to lookup driver [%s]\n",
 664                         printer->info_2->drivername));
 665                 goto err;
 666         }
 667
 668         trim_string(driver.info_3->driverpath, "\\print$\\WIN40\\0\\", 0);
 669         trim_string(driver.info_3->datafile, "\\print$\\WIN40\\0\\", 0);
 670         trim_string(driver.info_3->helpfile, "\\print$\\WIN40\\0\\", 0);
 671
 672         PACKI(desc, "W", 0x0400);                     /* don't know */
 673         PACKS(desc, "z", driver.info_3->name);        /* long printer name */
 674         PACKS(desc, "z", driver.info_3->driverpath);  /* Driverfile Name */
 675         PACKS(desc, "z", driver.info_3->datafile);    /* Datafile name */
 676         PACKS(desc, "z", driver.info_3->monitorname); /* language monitor */
 677
 678         fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
 679         standard_sub_basic( "", "", location, sizeof(location)-1 );
 680         PACKS(desc,"z", location);                          /* share to retrieve files */
 681
 682         PACKS(desc,"z", driver.info_3->defaultdatatype);    /* default data type */
 683         PACKS(desc,"z", driver.info_3->helpfile);           /* helpfile name */
 684         PACKS(desc,"z", driver.info_3->driverpath);               /* driver name */
 685
 686         DEBUG(3,("Printer Driver Name: %s:\n",driver.info_3->name));
 687         DEBUG(3,("Driver: %s:\n",driver.info_3->driverpath));
 688         DEBUG(3,("Data File: %s:\n",driver.info_3->datafile));
 689         DEBUG(3,("Language Monitor: %s:\n",driver.info_3->monitorname));
 690         DEBUG(3,("Driver Location: %s:\n",location));
 691         DEBUG(3,("Data Type: %s:\n",driver.info_3->defaultdatatype));
 692         DEBUG(3,("Help File: %s:\n",driver.info_3->helpfile));
 693         PACKI(desc,"N",count);                     /* number of files to copy */
 694
 695         for ( i=0; i<count && driver.info_3->dependentfiles && *driver.info_3->dependentfiles[i]; i++)
 696         {
 697                 trim_string(driver.info_3->dependentfiles[i], "\\print$\\WIN40\\0\\", 0);
 698                 PACKS(desc,"z",driver.info_3->dependentfiles[i]);         /* driver files to copy */
 699                 DEBUG(3,("Dependent File: %s:\n",driver.info_3->dependentfiles[i]));
 700         }
 701
 702         /* sanity check */
 703         if ( i != count )
 704                 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
 705                         count, i));
 706
 707         DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", SERVICE(snum),i));
 708
 709         desc->errcode=NERR_Success;
 710         goto done;
 711
 712 err:
 713         DEBUG(3,("fill_printq_info: Can't supply driver files\n"));
 714         desc->errcode=NERR_notsupported;
 715
 716 done:
 717         if ( printer )
 718                 free_a_printer( &printer, 2 );
 719
 720         if ( driver.info_3 )
 721                 free_a_printer_driver( driver, 3 );
 722 }
 723
 724
 725 static void fill_printq_info(connection_struct *conn, int snum, int uLevel,
 726                              struct pack_desc* desc,
 727                              int count, print_queue_struct* queue,
 728                              print_status_struct* status)
 729 {
 730         switch (uLevel) {
 731         case 1:
 732         case 2:
 733                 PACKS(desc,"B13",SERVICE(snum));
 734                 break;
 735         case 3:
 736         case 4:
 737         case 5:
 738                 PACKS(desc,"z",Expand(conn,snum,SERVICE(snum)));
 739                 break;
 740         case 51:
 741                 PACKI(desc,"K",printq_status(status->status));
 742                 break;
 743         }
 744
 745         if (uLevel == 1 || uLevel == 2) {
 746                 PACKS(desc,"B","");             /* alignment */
 747                 PACKI(desc,"W",5);              /* priority */
 748                 PACKI(desc,"W",0);              /* start time */
 749                 PACKI(desc,"W",0);              /* until time */
 750                 PACKS(desc,"z","");             /* pSepFile */
 751                 PACKS(desc,"z","lpd");  /* pPrProc */
 752                 PACKS(desc,"z",SERVICE(snum)); /* pDestinations */
 753                 PACKS(desc,"z","");             /* pParms */
 754                 if (snum < 0) {
 755                         PACKS(desc,"z","UNKNOWN PRINTER");
 756                         PACKI(desc,"W",LPSTAT_ERROR);
 757                 }
 758                 else if (!status || !status->message[0]) {
 759                         PACKS(desc,"z",Expand(conn,snum,lp_comment(snum)));
 760                         PACKI(desc,"W",LPSTAT_OK); /* status */
 761                 } else {
 762                         PACKS(desc,"z",status->message);
 763                         PACKI(desc,"W",printq_status(status->status)); /* status */
 764                 }
 765                 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
 766         }
 767
 768         if (uLevel == 3 || uLevel == 4) {
 769                 char *drivername = NULL;
 770
 771                 PACKI(desc,"W",5);              /* uPriority */
 772                 PACKI(desc,"W",0);              /* uStarttime */
 773                 PACKI(desc,"W",0);              /* uUntiltime */
 774                 PACKI(desc,"W",5);              /* pad1 */
 775                 PACKS(desc,"z","");             /* pszSepFile */
 776                 PACKS(desc,"z","WinPrint");     /* pszPrProc */
 777                 PACKS(desc,"z",NULL);           /* pszParms */
 778                 PACKS(desc,"z",NULL);           /* pszComment - don't ask.... JRA */
 779                 /* "don't ask" that it's done this way to fix corrupted
 780                    Win9X/ME printer comments. */
 781                 if (!status) {
 782                         PACKI(desc,"W",LPSTAT_OK); /* fsStatus */
 783                 } else {
 784                         PACKI(desc,"W",printq_status(status->status)); /* fsStatus */
 785                 }
 786                 PACKI(desc,(uLevel == 3 ? "W" : "N"),count);    /* cJobs */
 787                 PACKS(desc,"z",SERVICE(snum)); /* pszPrinters */
 788                 get_driver_name(snum,&drivername);
 789                 if (!drivername) {
 790                         return;
 791                 }
 792                 PACKS(desc,"z",drivername);             /* pszDriverName */
 793                 PackDriverData(desc);   /* pDriverData */
 794         }
 795
 796         if (uLevel == 2 || uLevel == 4) {
 797                 int i;
 798                 for (i=0;i<count;i++)
 799                         fill_printjob_info(conn,snum,uLevel == 2 ? 1 : 2,desc,&queue[i],i);
 800         }
 801
 802         if (uLevel==52)
 803                 fill_printq_info_52( conn, snum, desc, count );
 804 }
 805
 806 /* This function returns the number of files for a given driver */
 807 static int get_printerdrivernumber(int snum)
 808 {
 809         int                             result = 0;
 810         NT_PRINTER_DRIVER_INFO_LEVEL    driver;
 811         NT_PRINTER_INFO_LEVEL           *printer = NULL;
 812
 813         ZERO_STRUCT(driver);
 814
 815         if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
 816                 DEBUG(3,("get_printerdrivernumber: Failed to lookup printer [%s]\n",
 817                         lp_servicename(snum)));
 818                 goto done;
 819         }
 820
 821         if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
 822                 "Windows 4.0", 0)) )
 823         {
 824                 DEBUG(3,("get_printerdrivernumber: Failed to lookup driver [%s]\n",
 825                         printer->info_2->drivername));
 826                 goto done;
 827         }
 828
 829         /* count the number of files */
 830         while ( driver.info_3->dependentfiles && *driver.info_3->dependentfiles[result] )
 831                         result++;
 832                         \
 833  done:
 834         if ( printer )
 835                 free_a_printer( &printer, 2 );
 836
 837         if ( driver.info_3 )
 838                 free_a_printer_driver( driver, 3 );
 839
 840         return result;
 841 }
 842
 843 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
 844                                 char *param, int tpscnt,
 845                                 char *data, int tdscnt,
 846                                 int mdrcnt,int mprcnt,
 847                                 char **rdata,char **rparam,
 848                                 int *rdata_len,int *rparam_len)
 849 {
 850         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
 851         char *str2 = skip_string(param,tpscnt,str1);
 852         char *p = skip_string(param,tpscnt,str2);
 853         char *QueueName = p;
 854         unsigned int uLevel;
 855         int count=0;
 856         int snum;
 857         char *str3;
 858         struct pack_desc desc;
 859         print_queue_struct *queue=NULL;
 860         print_status_struct status;
 861         char* tmpdata=NULL;
 862
 863         if (!str1 || !str2 || !p) {
 864                 return False;
 865         }
 866         memset((char *)&status,'\0',sizeof(status));
 867         memset((char *)&desc,'\0',sizeof(desc));
 868
 869         p = skip_string(param,tpscnt,p);
 870         if (!p) {
 871                 return False;
 872         }
 873         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 874         str3 = get_safe_str_ptr(param,tpscnt,p,4);
 875         /* str3 may be null here and is checked in check_printq_info(). */
 876
 877         /* remove any trailing username */
 878         if ((p = strchr_m(QueueName,'%')))
 879                 *p = 0;
 880
 881         DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
 882
 883         /* check it's a supported varient */
 884         if (!prefix_ok(str1,"zWrLh"))
 885                 return False;
 886         if (!check_printq_info(&desc,uLevel,str2,str3)) {
 887                 /*
 888                  * Patch from Scott Moomaw <scott@bridgewater.edu>
 889                  * to return the 'invalid info level' error if an
 890                  * unknown level was requested.
 891                  */
 892                 *rdata_len = 0;
 893                 *rparam_len = 6;
 894                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
 895                 if (!*rparam) {
 896                         return False;
 897                 }
 898                 SSVALS(*rparam,0,ERRunknownlevel);
 899                 SSVAL(*rparam,2,0);
 900                 SSVAL(*rparam,4,0);
 901                 return(True);
 902         }
 903
 904         snum = find_service(QueueName);
 905         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) )
 906                 return False;
 907
 908         if (uLevel==52) {
 909                 count = get_printerdrivernumber(snum);
 910                 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
 911         } else {
 912                 count = print_queue_status(snum, &queue,&status);
 913         }
 914
 915         if (mdrcnt > 0) {
 916                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
 917                 if (!*rdata) {
 918                         SAFE_FREE(queue);
 919                         return False;
 920                 }
 921                 desc.base = *rdata;
 922                 desc.buflen = mdrcnt;
 923         } else {
 924                 /*
 925                  * Don't return data but need to get correct length
 926                  * init_package will return wrong size if buflen=0
 927                  */
 928                 desc.buflen = getlen(desc.format);
 929                 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
 930         }
 931
 932         if (init_package(&desc,1,count)) {
 933                 desc.subcount = count;
 934                 fill_printq_info(conn,snum,uLevel,&desc,count,queue,&status);
 935         }
 936
 937         *rdata_len = desc.usedlen;
 938
 939         /*
 940          * We must set the return code to ERRbuftoosmall
 941          * in order to support lanman style printing with Win NT/2k
 942          * clients       --jerry
 943          */
 944         if (!mdrcnt && lp_disable_spoolss())
 945                 desc.errcode = ERRbuftoosmall;
 946
 947         *rdata_len = desc.usedlen;
 948         *rparam_len = 6;
 949         *rparam = smb_realloc_limit(*rparam,*rparam_len);
 950         if (!*rparam) {
 951                 SAFE_FREE(queue);
 952                 SAFE_FREE(tmpdata);
 953                 return False;
 954         }
 955         SSVALS(*rparam,0,desc.errcode);
 956         SSVAL(*rparam,2,0);
 957         SSVAL(*rparam,4,desc.neededlen);
 958
 959         DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
 960
 961         SAFE_FREE(queue);
 962         SAFE_FREE(tmpdata);
 963
 964         return(True);
 965 }
 966
 967 /****************************************************************************
 968  View list of all print jobs on all queues.
 969 ****************************************************************************/
 970
 971 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
 972                                 char *param, int tpscnt,
 973                                 char *data, int tdscnt,
 974                                 int mdrcnt, int mprcnt,
 975                                 char **rdata, char** rparam,
 976                                 int *rdata_len, int *rparam_len)
 977 {
 978         char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
 979         char *output_format1 = skip_string(param,tpscnt,param_format);
 980         char *p = skip_string(param,tpscnt,output_format1);
 981         unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 982         char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
 983         int services = lp_numservices();
 984         int i, n;
 985         struct pack_desc desc;
 986         print_queue_struct **queue = NULL;
 987         print_status_struct *status = NULL;
 988         int *subcntarr = NULL;
 989         int queuecnt = 0, subcnt = 0, succnt = 0;
 990
 991         if (!param_format || !output_format1 || !p) {
 992                 return False;
 993         }
 994
 995         memset((char *)&desc,'\0',sizeof(desc));
 996
 997         DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
 998
 999         if (!prefix_ok(param_format,"WrLeh")) {
1000                 return False;
1001         }
1002         if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1003                 /*
1004                  * Patch from Scott Moomaw <scott@bridgewater.edu>
1005                  * to return the 'invalid info level' error if an
1006                  * unknown level was requested.
1007                  */
1008                 *rdata_len = 0;
1009                 *rparam_len = 6;
1010                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1011                 if (!*rparam) {
1012                         return False;
1013                 }
1014                 SSVALS(*rparam,0,ERRunknownlevel);
1015                 SSVAL(*rparam,2,0);
1016                 SSVAL(*rparam,4,0);
1017                 return(True);
1018         }
1019
1020         for (i = 0; i < services; i++) {
1021                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1022                         queuecnt++;
1023                 }
1024         }
1025
1026         if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
1027                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1028                 goto err;
1029         }
1030         memset(queue,0,queuecnt*sizeof(print_queue_struct*));
1031         if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
1032                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1033                 goto err;
1034         }
1035         memset(status,0,queuecnt*sizeof(print_status_struct));
1036         if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1037                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1038                 goto err;
1039         }
1040
1041         subcnt = 0;
1042         n = 0;
1043         for (i = 0; i < services; i++) {
1044                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1045                         subcntarr[n] = print_queue_status(i, &queue[n],&status[n]);
1046                         subcnt += subcntarr[n];
1047                         n++;
1048                 }
1049         }
1050
1051         if (mdrcnt > 0) {
1052                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1053                 if (!*rdata) {
1054                         goto err;
1055                 }
1056         }
1057         desc.base = *rdata;
1058         desc.buflen = mdrcnt;
1059
1060         if (init_package(&desc,queuecnt,subcnt)) {
1061                 n = 0;
1062                 succnt = 0;
1063                 for (i = 0; i < services; i++) {
1064                         if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1065                                 fill_printq_info(conn,i,uLevel,&desc,subcntarr[n],queue[n],&status[n]);
1066                                 n++;
1067                                 if (desc.errcode == NERR_Success) {
1068                                         succnt = n;
1069                                 }
1070                         }
1071                 }
1072         }
1073
1074         SAFE_FREE(subcntarr);
1075
1076         *rdata_len = desc.usedlen;
1077         *rparam_len = 8;
1078         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1079         if (!*rparam) {
1080                 goto err;
1081         }
1082         SSVALS(*rparam,0,desc.errcode);
1083         SSVAL(*rparam,2,0);
1084         SSVAL(*rparam,4,succnt);
1085         SSVAL(*rparam,6,queuecnt);
1086
1087         for (i = 0; i < queuecnt; i++) {
1088                 if (queue) {
1089                         SAFE_FREE(queue[i]);
1090                 }
1091         }
1092
1093         SAFE_FREE(queue);
1094         SAFE_FREE(status);
1095
1096         return True;
1097
1098   err:
1099
1100         SAFE_FREE(subcntarr);
1101         for (i = 0; i < queuecnt; i++) {
1102                 if (queue) {
1103                         SAFE_FREE(queue[i]);
1104                 }
1105         }
1106         SAFE_FREE(queue);
1107         SAFE_FREE(status);
1108
1109         return False;
1110 }
1111
1112 /****************************************************************************
1113  Get info level for a server list query.
1114 ****************************************************************************/
1115
1116 static bool check_server_info(int uLevel, char* id)
1117 {
1118         switch( uLevel ) {
1119                 case 0:
1120                         if (strcmp(id,"B16") != 0) {
1121                                 return False;
1122                         }
1123                         break;
1124                 case 1:
1125                         if (strcmp(id,"B16BBDz") != 0) {
1126                                 return False;
1127                         }
1128                         break;
1129                 default:
1130                         return False;
1131         }
1132         return True;
1133 }
1134
1135 struct srv_info_struct {
1136         fstring name;
1137         uint32 type;
1138         fstring comment;
1139         fstring domain;
1140         bool server_added;
1141 };
1142
1143 /*******************************************************************
1144  Get server info lists from the files saved by nmbd. Return the
1145  number of entries.
1146 ******************************************************************/
1147
1148 static int get_server_info(uint32 servertype,
1149                            struct srv_info_struct **servers,
1150                            const char *domain)
1151 {
1152         int count=0;
1153         int alloced=0;
1154         char **lines;
1155         bool local_list_only;
1156         int i;
1157
1158         lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1159         if (!lines) {
1160                 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1161                 return 0;
1162         }
1163
1164         /* request for everything is code for request all servers */
1165         if (servertype == SV_TYPE_ALL) {
1166                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1167         }
1168
1169         local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1170
1171         DEBUG(4,("Servertype search: %8x\n",servertype));
1172
1173         for (i=0;lines[i];i++) {
1174                 fstring stype;
1175                 struct srv_info_struct *s;
1176                 const char *ptr = lines[i];
1177                 bool ok = True;
1178                 TALLOC_CTX *frame = NULL;
1179                 char *p;
1180
1181                 if (!*ptr) {
1182                         continue;
1183                 }
1184
1185                 if (count == alloced) {
1186                         alloced += 10;
1187                         *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1188                         if (!*servers) {
1189                                 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1190                                 TALLOC_FREE(lines);
1191                                 return 0;
1192                         }
1193                         memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1194                 }
1195                 s = &(*servers)[count];
1196
1197                 frame = talloc_stackframe();
1198                 s->name[0] = '\0';
1199                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1200                         TALLOC_FREE(frame);
1201                         continue;
1202                 }
1203                 fstrcpy(s->name, p);
1204
1205                 stype[0] = '\0';
1206                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1207                         TALLOC_FREE(frame);
1208                         continue;
1209                 }
1210                 fstrcpy(stype, p);
1211
1212                 s->comment[0] = '\0';
1213                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1214                         TALLOC_FREE(frame);
1215                         continue;
1216                 }
1217                 fstrcpy(s->comment, p);
1218                 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1219
1220                 s->domain[0] = '\0';
1221                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1222                         /* this allows us to cope with an old nmbd */
1223                         fstrcpy(s->domain,lp_workgroup());
1224                 } else {
1225                         fstrcpy(s->domain, p);
1226                 }
1227                 TALLOC_FREE(frame);
1228
1229                 if (sscanf(stype,"%X",&s->type) != 1) {
1230                         DEBUG(4,("r:host file "));
1231                         ok = False;
1232                 }
1233
1234                 /* Filter the servers/domains we return based on what was asked for. */
1235
1236                 /* Check to see if we are being asked for a local list only. */
1237                 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1238                         DEBUG(4,("r: local list only"));
1239                         ok = False;
1240                 }
1241
1242                 /* doesn't match up: don't want it */
1243                 if (!(servertype & s->type)) {
1244                         DEBUG(4,("r:serv type "));
1245                         ok = False;
1246                 }
1247
1248                 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1249                                 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1250                         DEBUG(4,("s: dom mismatch "));
1251                         ok = False;
1252                 }
1253
1254                 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1255                         ok = False;
1256                 }
1257
1258                 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1259                 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1260
1261                 if (ok) {
1262                         DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1263                                 s->name, s->type, s->comment, s->domain));
1264                         s->server_added = True;
1265                         count++;
1266                 } else {
1267                         DEBUG(4,("%20s %8x %25s %15s\n",
1268                                 s->name, s->type, s->comment, s->domain));
1269                 }
1270         }
1271
1272         TALLOC_FREE(lines);
1273         return count;
1274 }
1275
1276 /*******************************************************************
1277  Fill in a server info structure.
1278 ******************************************************************/
1279
1280 static int fill_srv_info(struct srv_info_struct *service,
1281                          int uLevel, char **buf, int *buflen,
1282                          char **stringbuf, int *stringspace, char *baseaddr)
1283 {
1284         int struct_len;
1285         char* p;
1286         char* p2;
1287         int l2;
1288         int len;
1289
1290         switch (uLevel) {
1291                 case 0:
1292                         struct_len = 16;
1293                         break;
1294                 case 1:
1295                         struct_len = 26;
1296                         break;
1297                 default:
1298                         return -1;
1299         }
1300
1301         if (!buf) {
1302                 len = 0;
1303                 switch (uLevel) {
1304                         case 1:
1305                                 len = strlen(service->comment)+1;
1306                                 break;
1307                 }
1308
1309                 *buflen = struct_len;
1310                 *stringspace = len;
1311                 return struct_len + len;
1312         }
1313
1314         len = struct_len;
1315         p = *buf;
1316         if (*buflen < struct_len) {
1317                 return -1;
1318         }
1319         if (stringbuf) {
1320                 p2 = *stringbuf;
1321                 l2 = *stringspace;
1322         } else {
1323                 p2 = p + struct_len;
1324                 l2 = *buflen - struct_len;
1325         }
1326         if (!baseaddr) {
1327                 baseaddr = p;
1328         }
1329
1330         switch (uLevel) {
1331                 case 0:
1332                         push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1333                         break;
1334
1335                 case 1:
1336                         push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1337                         SIVAL(p,18,service->type);
1338                         SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1339                         len += CopyAndAdvance(&p2,service->comment,&l2);
1340                         break;
1341         }
1342
1343         if (stringbuf) {
1344                 *buf = p + struct_len;
1345                 *buflen -= struct_len;
1346                 *stringbuf = p2;
1347                 *stringspace = l2;
1348         } else {
1349                 *buf = p2;
1350                 *buflen -= len;
1351         }
1352         return len;
1353 }
1354
1355
1356 static bool srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1357 {
1358         return(strcmp(s1->name,s2->name));
1359 }
1360
1361 /****************************************************************************
1362  View list of servers available (or possibly domains). The info is
1363  extracted from lists saved by nmbd on the local host.
1364 ****************************************************************************/
1365
1366 static bool api_RNetServerEnum(connection_struct *conn, uint16 vuid,
1367                                 char *param, int tpscnt,
1368                                 char *data, int tdscnt,
1369                                 int mdrcnt, int mprcnt, char **rdata,
1370                                 char **rparam, int *rdata_len, int *rparam_len)
1371 {
1372         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1373         char *str2 = skip_string(param,tpscnt,str1);
1374         char *p = skip_string(param,tpscnt,str2);
1375         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1376         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1377         uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1378         char *p2;
1379         int data_len, fixed_len, string_len;
1380         int f_len = 0, s_len = 0;
1381         struct srv_info_struct *servers=NULL;
1382         int counted=0,total=0;
1383         int i,missed;
1384         fstring domain;
1385         bool domain_request;
1386         bool local_request;
1387
1388         if (!str1 || !str2 || !p) {
1389                 return False;
1390         }
1391
1392         /* If someone sets all the bits they don't really mean to set
1393            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1394            known servers. */
1395
1396         if (servertype == SV_TYPE_ALL) {
1397                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1398         }
1399
1400         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1401            any other bit (they may just set this bit on its own) they
1402            want all the locally seen servers. However this bit can be
1403            set on its own so set the requested servers to be
1404            ALL - DOMAIN_ENUM. */
1405
1406         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1407                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1408         }
1409
1410         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1411         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1412
1413         p += 8;
1414
1415         if (!prefix_ok(str1,"WrLehD")) {
1416                 return False;
1417         }
1418         if (!check_server_info(uLevel,str2)) {
1419                 return False;
1420         }
1421
1422         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1423         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1424         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1425
1426         if (strcmp(str1, "WrLehDz") == 0) {
1427                 if (skip_string(param,tpscnt,p) == NULL) {
1428                         return False;
1429                 }
1430                 pull_ascii_fstring(domain, p);
1431         } else {
1432                 fstrcpy(domain, lp_workgroup());
1433         }
1434
1435         if (lp_browse_list()) {
1436                 total = get_server_info(servertype,&servers,domain);
1437         }
1438
1439         data_len = fixed_len = string_len = 0;
1440         missed = 0;
1441
1442         if (total > 0) {
1443                 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1444         }
1445
1446         {
1447                 char *lastname=NULL;
1448
1449                 for (i=0;i<total;i++) {
1450                         struct srv_info_struct *s = &servers[i];
1451
1452                         if (lastname && strequal(lastname,s->name)) {
1453                                 continue;
1454                         }
1455                         lastname = s->name;
1456                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1457                         DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1458                                 s->name, s->type, s->comment, s->domain));
1459
1460                         if (data_len <= buf_len) {
1461                                 counted++;
1462                                 fixed_len += f_len;
1463                                 string_len += s_len;
1464                         } else {
1465                                 missed++;
1466                         }
1467                 }
1468         }
1469
1470         *rdata_len = fixed_len + string_len;
1471         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1472         if (!*rdata) {
1473                 return False;
1474         }
1475
1476         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1477         p = *rdata;
1478         f_len = fixed_len;
1479         s_len = string_len;
1480
1481         {
1482                 char *lastname=NULL;
1483                 int count2 = counted;
1484
1485                 for (i = 0; i < total && count2;i++) {
1486                         struct srv_info_struct *s = &servers[i];
1487
1488                         if (lastname && strequal(lastname,s->name)) {
1489                                 continue;
1490                         }
1491                         lastname = s->name;
1492                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1493                         DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1494                                 s->name, s->type, s->comment, s->domain));
1495                         count2--;
1496                 }
1497         }
1498
1499         *rparam_len = 8;
1500         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1501         if (!*rparam) {
1502                 return False;
1503         }
1504         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1505         SSVAL(*rparam,2,0);
1506         SSVAL(*rparam,4,counted);
1507         SSVAL(*rparam,6,counted+missed);
1508
1509         SAFE_FREE(servers);
1510
1511         DEBUG(3,("NetServerEnum domain = %s uLevel=%d counted=%d total=%d\n",
1512                 domain,uLevel,counted,counted+missed));
1513
1514         return True;
1515 }
1516
1517 /****************************************************************************
1518   command 0x34 - suspected of being a "Lookup Names" stub api
1519   ****************************************************************************/
1520
1521 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1522                                 char *param, int tpscnt,
1523                                 char *data, int tdscnt,
1524                                 int mdrcnt, int mprcnt, char **rdata,
1525                                 char **rparam, int *rdata_len, int *rparam_len)
1526 {
1527         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1528         char *str2 = skip_string(param,tpscnt,str1);
1529         char *p = skip_string(param,tpscnt,str2);
1530         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1531         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1532         int counted=0;
1533         int missed=0;
1534
1535         if (!str1 || !str2 || !p) {
1536                 return False;
1537         }
1538
1539         DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1540                 str1, str2, p, uLevel, buf_len));
1541
1542         if (!prefix_ok(str1,"zWrLeh")) {
1543                 return False;
1544         }
1545
1546         *rdata_len = 0;
1547
1548         *rparam_len = 8;
1549         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1550         if (!*rparam) {
1551                 return False;
1552         }
1553
1554         SSVAL(*rparam,0,0x08AC); /* informational warning message */
1555         SSVAL(*rparam,2,0);
1556         SSVAL(*rparam,4,counted);
1557         SSVAL(*rparam,6,counted+missed);
1558
1559         return True;
1560 }
1561
1562 /****************************************************************************
1563   get info about a share
1564   ****************************************************************************/
1565
1566 static bool check_share_info(int uLevel, char* id)
1567 {
1568         switch( uLevel ) {
1569                 case 0:
1570                         if (strcmp(id,"B13") != 0) {
1571                                 return False;
1572                         }
1573                         break;
1574                 case 1:
1575                         if (strcmp(id,"B13BWz") != 0) {
1576                                 return False;
1577                         }
1578                         break;
1579                 case 2:
1580                         if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1581                                 return False;
1582                         }
1583                         break;
1584                 case 91:
1585                         if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1586                                 return False;
1587                         }
1588                         break;
1589                 default:
1590                         return False;
1591         }
1592         return True;
1593 }
1594
1595 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1596                            char** buf, int* buflen,
1597                            char** stringbuf, int* stringspace, char* baseaddr)
1598 {
1599         int struct_len;
1600         char* p;
1601         char* p2;
1602         int l2;
1603         int len;
1604
1605         switch( uLevel ) {
1606                 case 0:
1607                         struct_len = 13;
1608                         break;
1609                 case 1:
1610                         struct_len = 20;
1611                         break;
1612                 case 2:
1613                         struct_len = 40;
1614                         break;
1615                 case 91:
1616                         struct_len = 68;
1617                         break;
1618                 default:
1619                         return -1;
1620         }
1621
1622         if (!buf) {
1623                 len = 0;
1624
1625                 if (uLevel > 0) {
1626                         len += StrlenExpanded(conn,snum,lp_comment(snum));
1627                 }
1628                 if (uLevel > 1) {
1629                         len += strlen(lp_pathname(snum)) + 1;
1630                 }
1631                 if (buflen) {
1632                         *buflen = struct_len;
1633                 }
1634                 if (stringspace) {
1635                         *stringspace = len;
1636                 }
1637                 return struct_len + len;
1638         }
1639
1640         len = struct_len;
1641         p = *buf;
1642         if ((*buflen) < struct_len) {
1643                 return -1;
1644         }
1645
1646         if (stringbuf) {
1647                 p2 = *stringbuf;
1648                 l2 = *stringspace;
1649         } else {
1650                 p2 = p + struct_len;
1651                 l2 = (*buflen) - struct_len;
1652         }
1653
1654         if (!baseaddr) {
1655                 baseaddr = p;
1656         }
1657
1658         push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1659
1660         if (uLevel > 0) {
1661                 int type;
1662
1663                 SCVAL(p,13,0);
1664                 type = STYPE_DISKTREE;
1665                 if (lp_print_ok(snum)) {
1666                         type = STYPE_PRINTQ;
1667                 }
1668                 if (strequal("IPC",lp_fstype(snum))) {
1669                         type = STYPE_IPC;
1670                 }
1671                 SSVAL(p,14,type);               /* device type */
1672                 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1673                 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1674         }
1675
1676         if (uLevel > 1) {
1677                 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1678                 SSVALS(p,22,-1);                /* max uses */
1679                 SSVAL(p,24,1); /* current uses */
1680                 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1681                 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1682                 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1683         }
1684
1685         if (uLevel > 2) {
1686                 memset(p+40,0,SHPWLEN+2);
1687                 SSVAL(p,50,0);
1688                 SIVAL(p,52,0);
1689                 SSVAL(p,56,0);
1690                 SSVAL(p,58,0);
1691                 SIVAL(p,60,0);
1692                 SSVAL(p,64,0);
1693                 SSVAL(p,66,0);
1694         }
1695
1696         if (stringbuf) {
1697                 (*buf) = p + struct_len;
1698                 (*buflen) -= struct_len;
1699                 (*stringbuf) = p2;
1700                 (*stringspace) = l2;
1701         } else {
1702                 (*buf) = p2;
1703                 (*buflen) -= len;
1704         }
1705
1706         return len;
1707 }
1708
1709 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1710                                 char *param, int tpscnt,
1711                                 char *data, int tdscnt,
1712                                 int mdrcnt,int mprcnt,
1713                                 char **rdata,char **rparam,
1714                                 int *rdata_len,int *rparam_len)
1715 {
1716         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1717         char *str2 = skip_string(param,tpscnt,str1);
1718         char *netname = skip_string(param,tpscnt,str2);
1719         char *p = skip_string(param,tpscnt,netname);
1720         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1721         int snum;
1722
1723         if (!str1 || !str2 || !netname || !p) {
1724                 return False;
1725         }
1726
1727         snum = find_service(netname);
1728         if (snum < 0) {
1729                 return False;
1730         }
1731
1732         /* check it's a supported varient */
1733         if (!prefix_ok(str1,"zWrLh")) {
1734                 return False;
1735         }
1736         if (!check_share_info(uLevel,str2)) {
1737                 return False;
1738         }
1739
1740         *rdata = smb_realloc_limit(*rdata,mdrcnt);
1741         if (!*rdata) {
1742                 return False;
1743         }
1744         p = *rdata;
1745         *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
1746         if (*rdata_len < 0) {
1747                 return False;
1748         }
1749
1750         *rparam_len = 6;
1751         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1752         if (!*rparam) {
1753                 return False;
1754         }
1755         SSVAL(*rparam,0,NERR_Success);
1756         SSVAL(*rparam,2,0);             /* converter word */
1757         SSVAL(*rparam,4,*rdata_len);
1758
1759         return True;
1760 }
1761
1762 /****************************************************************************
1763   View the list of available shares.
1764
1765   This function is the server side of the NetShareEnum() RAP call.
1766   It fills the return buffer with share names and share comments.
1767   Note that the return buffer normally (in all known cases) allows only
1768   twelve byte strings for share names (plus one for a nul terminator).
1769   Share names longer than 12 bytes must be skipped.
1770  ****************************************************************************/
1771
1772 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
1773                                 char *param, int tpscnt,
1774                                 char *data, int tdscnt,
1775                                 int                mdrcnt,
1776                                 int                mprcnt,
1777                                 char             **rdata,
1778                                 char             **rparam,
1779                                 int               *rdata_len,
1780                                 int               *rparam_len )
1781 {
1782         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1783         char *str2 = skip_string(param,tpscnt,str1);
1784         char *p = skip_string(param,tpscnt,str2);
1785         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1786         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1787         char *p2;
1788         int count = 0;
1789         int total=0,counted=0;
1790         bool missed = False;
1791         int i;
1792         int data_len, fixed_len, string_len;
1793         int f_len = 0, s_len = 0;
1794
1795         if (!str1 || !str2 || !p) {
1796                 return False;
1797         }
1798
1799         if (!prefix_ok(str1,"WrLeh")) {
1800                 return False;
1801         }
1802         if (!check_share_info(uLevel,str2)) {
1803                 return False;
1804         }
1805
1806         /* Ensure all the usershares are loaded. */
1807         become_root();
1808         load_registry_shares();
1809         count = load_usershare_shares();
1810         unbecome_root();
1811
1812         data_len = fixed_len = string_len = 0;
1813         for (i=0;i<count;i++) {
1814                 fstring servicename_dos;
1815                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1816                         continue;
1817                 }
1818                 push_ascii_fstring(servicename_dos, lp_servicename(i));
1819                 /* Maximum name length = 13. */
1820                 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
1821                         total++;
1822                         data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
1823                         if (data_len <= buf_len) {
1824                                 counted++;
1825                                 fixed_len += f_len;
1826                                 string_len += s_len;
1827                         } else {
1828                                 missed = True;
1829                         }
1830                 }
1831         }
1832
1833         *rdata_len = fixed_len + string_len;
1834         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1835         if (!*rdata) {
1836                 return False;
1837         }
1838
1839         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
1840         p = *rdata;
1841         f_len = fixed_len;
1842         s_len = string_len;
1843
1844         for( i = 0; i < count; i++ ) {
1845                 fstring servicename_dos;
1846                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1847                         continue;
1848                 }
1849
1850                 push_ascii_fstring(servicename_dos, lp_servicename(i));
1851                 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
1852                         if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
1853                                 break;
1854                         }
1855                 }
1856         }
1857
1858         *rparam_len = 8;
1859         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1860         if (!*rparam) {
1861                 return False;
1862         }
1863         SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
1864         SSVAL(*rparam,2,0);
1865         SSVAL(*rparam,4,counted);
1866         SSVAL(*rparam,6,total);
1867
1868         DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
1869                 counted,total,uLevel,
1870                 buf_len,*rdata_len,mdrcnt));
1871
1872         return True;
1873 }
1874
1875 /****************************************************************************
1876   Add a share
1877   ****************************************************************************/
1878
1879 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
1880                                 char *param, int tpscnt,
1881                                 char *data, int tdscnt,
1882                                 int mdrcnt,int mprcnt,
1883                                 char **rdata,char **rparam,
1884                                 int *rdata_len,int *rparam_len)
1885 {
1886         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1887         char *str2 = skip_string(param,tpscnt,str1);
1888         char *p = skip_string(param,tpscnt,str2);
1889         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1890         fstring sharename;
1891         fstring comment;
1892         char *pathname = NULL;
1893         char *command, *cmdname;
1894         unsigned int offset;
1895         int snum;
1896         int res = ERRunsup;
1897         size_t converted_size;
1898
1899         if (!str1 || !str2 || !p) {
1900                 return False;
1901         }
1902
1903         /* check it's a supported varient */
1904         if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
1905                 return False;
1906         }
1907         if (!check_share_info(uLevel,str2)) {
1908                 return False;
1909         }
1910         if (uLevel != 2) {
1911                 return False;
1912         }
1913
1914         /* Do we have a string ? */
1915         if (skip_string(data,mdrcnt,data) == NULL) {
1916                 return False;
1917         }
1918         pull_ascii_fstring(sharename,data);
1919         snum = find_service(sharename);
1920         if (snum >= 0) { /* already exists */
1921                 res = ERRfilexists;
1922                 goto error_exit;
1923         }
1924
1925         if (mdrcnt < 28) {
1926                 return False;
1927         }
1928
1929         /* only support disk share adds */
1930         if (SVAL(data,14)!=STYPE_DISKTREE) {
1931                 return False;
1932         }
1933
1934         offset = IVAL(data, 16);
1935         if (offset >= mdrcnt) {
1936                 res = ERRinvalidparam;
1937                 goto error_exit;
1938         }
1939
1940         /* Do we have a string ? */
1941         if (skip_string(data,mdrcnt,data+offset) == NULL) {
1942                 return False;
1943         }
1944         pull_ascii_fstring(comment, offset? (data+offset) : "");
1945
1946         offset = IVAL(data, 26);
1947
1948         if (offset >= mdrcnt) {
1949                 res = ERRinvalidparam;
1950                 goto error_exit;
1951         }
1952
1953         /* Do we have a string ? */
1954         if (skip_string(data,mdrcnt,data+offset) == NULL) {
1955                 return False;
1956         }
1957
1958         if (!pull_ascii_talloc(talloc_tos(), &pathname,
1959                                offset ? (data+offset) : "", &converted_size))
1960         {
1961                 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
1962                          strerror(errno)));
1963         }
1964
1965         if (!pathname) {
1966                 return false;
1967         }
1968
1969         string_replace(sharename, '"', ' ');
1970         string_replace(pathname, '"', ' ');
1971         string_replace(comment, '"', ' ');
1972
1973         cmdname = lp_add_share_cmd();
1974
1975         if (!cmdname || *cmdname == '\0') {
1976                 return False;
1977         }
1978
1979         if (asprintf(&command, "%s \"%s\" \"%s\" \"%s\" \"%s\"",
1980                      lp_add_share_cmd(), get_dyn_CONFIGFILE(), sharename,
1981                      pathname, comment) == -1) {
1982                 return false;
1983         }
1984
1985         DEBUG(10,("api_RNetShareAdd: Running [%s]\n", command ));
1986
1987         if ((res = smbrun(command, NULL)) != 0) {
1988                 DEBUG(1,("api_RNetShareAdd: Running [%s] returned (%d)\n",
1989                          command, res ));
1990                 SAFE_FREE(command);
1991                 res = ERRnoaccess;
1992                 goto error_exit;
1993         } else {
1994                 SAFE_FREE(command);
1995                 message_send_all(smbd_messaging_context(),
1996                                  MSG_SMB_CONF_UPDATED, NULL, 0, NULL);
1997         }
1998
1999         *rparam_len = 6;
2000         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2001         if (!*rparam) {
2002                 return False;
2003         }
2004         SSVAL(*rparam,0,NERR_Success);
2005         SSVAL(*rparam,2,0);             /* converter word */
2006         SSVAL(*rparam,4,*rdata_len);
2007         *rdata_len = 0;
2008
2009         return True;
2010
2011   error_exit:
2012
2013         *rparam_len = 4;
2014         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2015         if (!*rparam) {
2016                 return False;
2017         }
2018         *rdata_len = 0;
2019         SSVAL(*rparam,0,res);
2020         SSVAL(*rparam,2,0);
2021         return True;
2022 }
2023
2024 /****************************************************************************
2025   view list of groups available
2026   ****************************************************************************/
2027
2028 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2029                                 char *param, int tpscnt,
2030                                 char *data, int tdscnt,
2031                                 int mdrcnt,int mprcnt,
2032                                 char **rdata,char **rparam,
2033                                 int *rdata_len,int *rparam_len)
2034 {
2035         int i;
2036         int errflags=0;
2037         int resume_context, cli_buf_size;
2038         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2039         char *str2 = skip_string(param,tpscnt,str1);
2040         char *p = skip_string(param,tpscnt,str2);
2041
2042         uint32_t num_groups;
2043         uint32_t resume_handle;
2044         struct rpc_pipe_client *samr_pipe;
2045         struct policy_handle samr_handle, domain_handle;
2046         NTSTATUS status;
2047
2048         if (!str1 || !str2 || !p) {
2049                 return False;
2050         }
2051
2052         if (strcmp(str1,"WrLeh") != 0) {
2053                 return False;
2054         }
2055
2056         /* parameters
2057          * W-> resume context (number of users to skip)
2058          * r -> return parameter pointer to receive buffer
2059          * L -> length of receive buffer
2060          * e -> return parameter number of entries
2061          * h -> return parameter total number of users
2062          */
2063
2064         if (strcmp("B21",str2) != 0) {
2065                 return False;
2066         }
2067
2068         status = rpc_pipe_open_internal(
2069                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2070                 conn->server_info, &samr_pipe);
2071         if (!NT_STATUS_IS_OK(status)) {
2072                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2073                           nt_errstr(status)));
2074                 return false;
2075         }
2076
2077         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2078                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2079         if (!NT_STATUS_IS_OK(status)) {
2080                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2081                           nt_errstr(status)));
2082                 return false;
2083         }
2084
2085         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2086                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2087                                         get_global_sam_sid(), &domain_handle);
2088         if (!NT_STATUS_IS_OK(status)) {
2089                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2090                           nt_errstr(status)));
2091                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2092                 return false;
2093         }
2094
2095         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2096         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2097         DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2098                   "%d\n", resume_context, cli_buf_size));
2099
2100         *rdata_len = cli_buf_size;
2101         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2102         if (!*rdata) {
2103                 return False;
2104         }
2105
2106         p = *rdata;
2107
2108         errflags = NERR_Success;
2109         num_groups = 0;
2110         resume_handle = 0;
2111
2112         while (true) {
2113                 struct samr_SamArray *sam_entries;
2114                 uint32_t num_entries;
2115
2116                 status = rpccli_samr_EnumDomainGroups(samr_pipe, talloc_tos(),
2117                                                       &domain_handle,
2118                                                       &resume_handle,
2119                                                       &sam_entries, 1,
2120                                                       &num_entries);
2121                 if (!NT_STATUS_IS_OK(status)) {
2122                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2123                                    "%s\n", nt_errstr(status)));
2124                         break;
2125                 }
2126
2127                 if (num_entries == 0) {
2128                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2129                                    "no entries -- done\n"));
2130                         break;
2131                 }
2132
2133                 for(i=0; i<num_entries; i++) {
2134                         const char *name;
2135
2136                         name = sam_entries->entries[i].name.string;
2137
2138                         if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2139                                 /* set overflow error */
2140                                 DEBUG(3,("overflow on entry %d group %s\n", i,
2141                                          name));
2142                                 errflags=234;
2143                                 break;
2144                         }
2145
2146                         /* truncate the name at 21 chars. */
2147                         memset(p, 0, 21);
2148                         strlcpy(p, name, 21);
2149                         DEBUG(10,("adding entry %d group %s\n", i, p));
2150                         p += 21;
2151                         p += 5; /* Both NT4 and W2k3SP1 do padding here.  No
2152                                  * idea why... */
2153                         num_groups += 1;
2154                 }
2155
2156                 if (errflags != NERR_Success) {
2157                         break;
2158                 }
2159
2160                 TALLOC_FREE(sam_entries);
2161         }
2162
2163         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2164         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2165
2166         *rdata_len = PTR_DIFF(p,*rdata);
2167
2168         *rparam_len = 8;
2169         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2170         if (!*rparam) {
2171                 return False;
2172         }
2173         SSVAL(*rparam, 0, errflags);
2174         SSVAL(*rparam, 2, 0);           /* converter word */
2175         SSVAL(*rparam, 4, num_groups);  /* is this right?? */
2176         SSVAL(*rparam, 6, resume_context+num_groups);   /* is this right?? */
2177
2178         return(True);
2179 }
2180
2181 /*******************************************************************
2182  Get groups that a user is a member of.
2183 ******************************************************************/
2184
2185 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2186                                 char *param, int tpscnt,
2187                                 char *data, int tdscnt,
2188                                 int mdrcnt,int mprcnt,
2189                                 char **rdata,char **rparam,
2190                                 int *rdata_len,int *rparam_len)
2191 {
2192         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2193         char *str2 = skip_string(param,tpscnt,str1);
2194         char *UserName = skip_string(param,tpscnt,str2);
2195         char *p = skip_string(param,tpscnt,UserName);
2196         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2197         const char *level_string;
2198         int count=0;
2199         bool ret = False;
2200         uint32_t i;
2201         char *endp = NULL;
2202
2203         struct rpc_pipe_client *samr_pipe;
2204         struct policy_handle samr_handle, domain_handle, user_handle;
2205         struct lsa_String name;
2206         struct lsa_Strings names;
2207         struct samr_Ids type, rid;
2208         struct samr_RidWithAttributeArray *rids;
2209         NTSTATUS status;
2210
2211         if (!str1 || !str2 || !UserName || !p) {
2212                 return False;
2213         }
2214
2215         *rparam_len = 8;
2216         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2217         if (!*rparam) {
2218                 return False;
2219         }
2220
2221         /* check it's a supported varient */
2222
2223         if ( strcmp(str1,"zWrLeh") != 0 )
2224                 return False;
2225
2226         switch( uLevel ) {
2227                 case 0:
2228                         level_string = "B21";
2229                         break;
2230                 default:
2231                         return False;
2232         }
2233
2234         if (strcmp(level_string,str2) != 0)
2235                 return False;
2236
2237         *rdata_len = mdrcnt + 1024;
2238         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2239         if (!*rdata) {
2240                 return False;
2241         }
2242
2243         SSVAL(*rparam,0,NERR_Success);
2244         SSVAL(*rparam,2,0);             /* converter word */
2245
2246         p = *rdata;
2247         endp = *rdata + *rdata_len;
2248
2249         status = rpc_pipe_open_internal(
2250                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2251                 conn->server_info, &samr_pipe);
2252         if (!NT_STATUS_IS_OK(status)) {
2253                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2254                           nt_errstr(status)));
2255                 return false;
2256         }
2257
2258         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2259                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2260         if (!NT_STATUS_IS_OK(status)) {
2261                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2262                           nt_errstr(status)));
2263                 return false;
2264         }
2265
2266         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2267                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2268                                         get_global_sam_sid(), &domain_handle);
2269         if (!NT_STATUS_IS_OK(status)) {
2270                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2271                           nt_errstr(status)));
2272                 goto close_sam;
2273         }
2274
2275         name.string = UserName;
2276
2277         status = rpccli_samr_LookupNames(samr_pipe, talloc_tos(),
2278                                          &domain_handle, 1, &name,
2279                                          &rid, &type);
2280         if (!NT_STATUS_IS_OK(status)) {
2281                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2282                           nt_errstr(status)));
2283                 goto close_domain;
2284         }
2285
2286         if (type.ids[0] != SID_NAME_USER) {
2287                 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2288                            sid_type_lookup(type.ids[0])));
2289                 goto close_domain;
2290         }
2291
2292         status = rpccli_samr_OpenUser(samr_pipe, talloc_tos(),
2293                                       &domain_handle,
2294                                       SAMR_USER_ACCESS_GET_GROUPS,
2295                                       rid.ids[0], &user_handle);
2296         if (!NT_STATUS_IS_OK(status)) {
2297                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2298                           nt_errstr(status)));
2299                 goto close_domain;
2300         }
2301
2302         status = rpccli_samr_GetGroupsForUser(samr_pipe, talloc_tos(),
2303                                               &user_handle, &rids);
2304         if (!NT_STATUS_IS_OK(status)) {
2305                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2306                           nt_errstr(status)));
2307                 goto close_user;
2308         }
2309
2310         for (i=0; i<rids->count; i++) {
2311
2312                 status = rpccli_samr_LookupRids(samr_pipe, talloc_tos(),
2313                                                 &domain_handle,
2314                                                 1, &rids->rids[i].rid,
2315                                                 &names, &type);
2316                 if (NT_STATUS_IS_OK(status) && (names.count == 1)) {
2317                         strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2318                         p += 21;
2319                         count++;
2320                 }
2321         }
2322
2323         *rdata_len = PTR_DIFF(p,*rdata);
2324
2325         SSVAL(*rparam,4,count); /* is this right?? */
2326         SSVAL(*rparam,6,count); /* is this right?? */
2327
2328         ret = True;
2329
2330  close_user:
2331         rpccli_samr_Close(samr_pipe, talloc_tos(), &user_handle);
2332  close_domain:
2333         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2334  close_sam:
2335         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2336
2337         return ret;
2338 }
2339
2340 /*******************************************************************
2341  Get all users.
2342 ******************************************************************/
2343
2344 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2345                                 char *param, int tpscnt,
2346                                 char *data, int tdscnt,
2347                                 int mdrcnt,int mprcnt,
2348                                 char **rdata,char **rparam,
2349                                 int *rdata_len,int *rparam_len)
2350 {
2351         int count_sent=0;
2352         int num_users=0;
2353         int errflags=0;
2354         int i, resume_context, cli_buf_size;
2355         uint32_t resume_handle;
2356
2357         struct rpc_pipe_client *samr_pipe;
2358         struct policy_handle samr_handle, domain_handle;
2359         NTSTATUS status;
2360
2361         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2362         char *str2 = skip_string(param,tpscnt,str1);
2363         char *p = skip_string(param,tpscnt,str2);
2364         char *endp = NULL;
2365
2366         if (!str1 || !str2 || !p) {
2367                 return False;
2368         }
2369
2370         if (strcmp(str1,"WrLeh") != 0)
2371                 return False;
2372         /* parameters
2373           * W-> resume context (number of users to skip)
2374           * r -> return parameter pointer to receive buffer
2375           * L -> length of receive buffer
2376           * e -> return parameter number of entries
2377           * h -> return parameter total number of users
2378           */
2379
2380         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2381         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2382         DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2383                         resume_context, cli_buf_size));
2384
2385         *rparam_len = 8;
2386         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2387         if (!*rparam) {
2388                 return False;
2389         }
2390
2391         /* check it's a supported varient */
2392         if (strcmp("B21",str2) != 0)
2393                 return False;
2394
2395         *rdata_len = cli_buf_size;
2396         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2397         if (!*rdata) {
2398                 return False;
2399         }
2400
2401         p = *rdata;
2402         endp = *rdata + *rdata_len;
2403
2404         status = rpc_pipe_open_internal(
2405                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2406                 conn->server_info, &samr_pipe);
2407         if (!NT_STATUS_IS_OK(status)) {
2408                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2409                           nt_errstr(status)));
2410                 return false;
2411         }
2412
2413         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2414                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2415         if (!NT_STATUS_IS_OK(status)) {
2416                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2417                           nt_errstr(status)));
2418                 return false;
2419         }
2420
2421         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2422                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2423                                         get_global_sam_sid(), &domain_handle);
2424         if (!NT_STATUS_IS_OK(status)) {
2425                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2426                           nt_errstr(status)));
2427                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2428                 return false;
2429         }
2430
2431         errflags=NERR_Success;
2432
2433         resume_handle = 0;
2434
2435         while (true) {
2436                 struct samr_SamArray *sam_entries;
2437                 uint32_t num_entries;
2438
2439                 status = rpccli_samr_EnumDomainUsers(samr_pipe, talloc_tos(),
2440                                                      &domain_handle,
2441                                                      &resume_handle,
2442                                                      0, &sam_entries, 1,
2443                                                      &num_entries);
2444
2445                 if (!NT_STATUS_IS_OK(status)) {
2446                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2447                                    "%s\n", nt_errstr(status)));
2448                         break;
2449                 }
2450
2451                 if (num_entries == 0) {
2452                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2453                                    "no entries -- done\n"));
2454                         break;
2455                 }
2456
2457                 for (i=0; i<num_entries; i++) {
2458                         const char *name;
2459
2460                         name = sam_entries->entries[i].name.string;
2461
2462                         if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2463                            &&(strlen(name)<=21)) {
2464                                 strlcpy(p,name,PTR_DIFF(endp,p));
2465                                 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2466                                           "username %s\n",count_sent,p));
2467                                 p += 21;
2468                                 count_sent++;
2469                         } else {
2470                                 /* set overflow error */
2471                                 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2472                                           "username %s\n",count_sent,name));
2473                                 errflags=234;
2474                                 break;
2475                         }
2476                 }
2477
2478                 if (errflags != NERR_Success) {
2479                         break;
2480                 }
2481
2482                 TALLOC_FREE(sam_entries);
2483         }
2484
2485         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2486         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2487
2488         *rdata_len = PTR_DIFF(p,*rdata);
2489
2490         SSVAL(*rparam,0,errflags);
2491         SSVAL(*rparam,2,0);           /* converter word */
2492         SSVAL(*rparam,4,count_sent);  /* is this right?? */
2493         SSVAL(*rparam,6,num_users); /* is this right?? */
2494
2495         return True;
2496 }
2497
2498 /****************************************************************************
2499  Get the time of day info.
2500 ****************************************************************************/
2501
2502 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2503                                 char *param, int tpscnt,
2504                                 char *data, int tdscnt,
2505                                 int mdrcnt,int mprcnt,
2506                                 char **rdata,char **rparam,
2507                                 int *rdata_len,int *rparam_len)
2508 {
2509         struct tm *t;
2510         time_t unixdate = time(NULL);
2511         char *p;
2512
2513         *rparam_len = 4;
2514         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2515         if (!*rparam) {
2516                 return False;
2517         }
2518
2519         *rdata_len = 21;
2520         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2521         if (!*rdata) {
2522                 return False;
2523         }
2524
2525         SSVAL(*rparam,0,NERR_Success);
2526         SSVAL(*rparam,2,0);             /* converter word */
2527
2528         p = *rdata;
2529
2530         srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2531                                             by NT in a "net time" operation,
2532                                             it seems to ignore the one below */
2533
2534         /* the client expects to get localtime, not GMT, in this bit
2535                 (I think, this needs testing) */
2536         t = localtime(&unixdate);
2537         if (!t) {
2538                 return False;
2539         }
2540
2541         SIVAL(p,4,0);           /* msecs ? */
2542         SCVAL(p,8,t->tm_hour);
2543         SCVAL(p,9,t->tm_min);
2544         SCVAL(p,10,t->tm_sec);
2545         SCVAL(p,11,0);          /* hundredths of seconds */
2546         SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2547         SSVAL(p,14,10000);              /* timer interval in 0.0001 of sec */
2548         SCVAL(p,16,t->tm_mday);
2549         SCVAL(p,17,t->tm_mon + 1);
2550         SSVAL(p,18,1900+t->tm_year);
2551         SCVAL(p,20,t->tm_wday);
2552
2553         return True;
2554 }
2555
2556 /****************************************************************************
2557  Set the user password.
2558 *****************************************************************************/
2559
2560 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2561                                 char *param, int tpscnt,
2562                                 char *data, int tdscnt,
2563                                 int mdrcnt,int mprcnt,
2564                                 char **rdata,char **rparam,
2565                                 int *rdata_len,int *rparam_len)
2566 {
2567         char *np = get_safe_str_ptr(param,tpscnt,param,2);
2568         char *p = NULL;
2569         fstring user;
2570         fstring pass1,pass2;
2571
2572         /* Skip 2 strings. */
2573         p = skip_string(param,tpscnt,np);
2574         p = skip_string(param,tpscnt,p);
2575
2576         if (!np || !p) {
2577                 return False;
2578         }
2579
2580         /* Do we have a string ? */
2581         if (skip_string(param,tpscnt,p) == NULL) {
2582                 return False;
2583         }
2584         pull_ascii_fstring(user,p);
2585
2586         p = skip_string(param,tpscnt,p);
2587         if (!p) {
2588                 return False;
2589         }
2590
2591         memset(pass1,'\0',sizeof(pass1));
2592         memset(pass2,'\0',sizeof(pass2));
2593         /*
2594          * We use 31 here not 32 as we're checking
2595          * the last byte we want to access is safe.
2596          */
2597         if (!is_offset_safe(param,tpscnt,p,31)) {
2598                 return False;
2599         }
2600         memcpy(pass1,p,16);
2601         memcpy(pass2,p+16,16);
2602
2603         *rparam_len = 4;
2604         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2605         if (!*rparam) {
2606                 return False;
2607         }
2608
2609         *rdata_len = 0;
2610
2611         SSVAL(*rparam,0,NERR_badpass);
2612         SSVAL(*rparam,2,0);             /* converter word */
2613
2614         DEBUG(3,("Set password for <%s>\n",user));
2615
2616         /*
2617          * Attempt to verify the old password against smbpasswd entries
2618          * Win98 clients send old and new password in plaintext for this call.
2619          */
2620
2621         {
2622                 auth_serversupplied_info *server_info = NULL;
2623                 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2624
2625                 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2626
2627                         become_root();
2628                         if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2629                                 SSVAL(*rparam,0,NERR_Success);
2630                         }
2631                         unbecome_root();
2632
2633                         TALLOC_FREE(server_info);
2634                 }
2635                 data_blob_clear_free(&password);
2636         }
2637
2638         /*
2639          * If the plaintext change failed, attempt
2640          * the old encrypted method. NT will generate this
2641          * after trying the samr method. Note that this
2642          * method is done as a last resort as this
2643          * password change method loses the NT password hash
2644          * and cannot change the UNIX password as no plaintext
2645          * is received.
2646          */
2647
2648         if(SVAL(*rparam,0) != NERR_Success) {
2649                 struct samu *hnd = NULL;
2650
2651                 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2652                         become_root();
2653                         if (change_lanman_password(hnd,(uchar *)pass2)) {
2654                                 SSVAL(*rparam,0,NERR_Success);
2655                         }
2656                         unbecome_root();
2657                         TALLOC_FREE(hnd);
2658                 }
2659         }
2660
2661         memset((char *)pass1,'\0',sizeof(fstring));
2662         memset((char *)pass2,'\0',sizeof(fstring));
2663
2664         return(True);
2665 }
2666
2667 /****************************************************************************
2668   Set the user password (SamOEM version - gets plaintext).
2669 ****************************************************************************/
2670
2671 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2672                                 char *param, int tpscnt,
2673                                 char *data, int tdscnt,
2674                                 int mdrcnt,int mprcnt,
2675                                 char **rdata,char **rparam,
2676                                 int *rdata_len,int *rparam_len)
2677 {
2678         struct smbd_server_connection *sconn = smbd_server_conn;
2679         fstring user;
2680         char *p = get_safe_str_ptr(param,tpscnt,param,2);
2681         *rparam_len = 2;
2682         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2683         if (!*rparam) {
2684                 return False;
2685         }
2686
2687         if (!p) {
2688                 return False;
2689         }
2690         *rdata_len = 0;
2691
2692         SSVAL(*rparam,0,NERR_badpass);
2693
2694         /*
2695          * Check the parameter definition is correct.
2696          */
2697
2698         /* Do we have a string ? */
2699         if (skip_string(param,tpscnt,p) == 0) {
2700                 return False;
2701         }
2702         if(!strequal(p, "zsT")) {
2703                 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2704                 return False;
2705         }
2706         p = skip_string(param, tpscnt, p);
2707         if (!p) {
2708                 return False;
2709         }
2710
2711         /* Do we have a string ? */
2712         if (skip_string(param,tpscnt,p) == 0) {
2713                 return False;
2714         }
2715         if(!strequal(p, "B516B16")) {
2716                 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2717                 return False;
2718         }
2719         p = skip_string(param,tpscnt,p);
2720         if (!p) {
2721                 return False;
2722         }
2723         /* Do we have a string ? */
2724         if (skip_string(param,tpscnt,p) == 0) {
2725                 return False;
2726         }
2727         p += pull_ascii_fstring(user,p);
2728
2729         DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
2730
2731         /*
2732          * Pass the user through the NT -> unix user mapping
2733          * function.
2734          */
2735
2736         (void)map_username(sconn, user);
2737
2738         if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL, NULL))) {
2739                 SSVAL(*rparam,0,NERR_Success);
2740         }
2741
2742         return(True);
2743 }
2744
2745 /****************************************************************************
2746   delete a print job
2747   Form: <W> <>
2748   ****************************************************************************/
2749
2750 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
2751                                 char *param, int tpscnt,
2752                                 char *data, int tdscnt,
2753                                 int mdrcnt,int mprcnt,
2754                                 char **rdata,char **rparam,
2755                                 int *rdata_len,int *rparam_len)
2756 {
2757         int function = get_safe_SVAL(param,tpscnt,param,0,0);
2758         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2759         char *str2 = skip_string(param,tpscnt,str1);
2760         char *p = skip_string(param,tpscnt,str2);
2761         uint32 jobid;
2762         int snum;
2763         fstring sharename;
2764         int errcode;
2765         WERROR werr = WERR_OK;
2766
2767         if (!str1 || !str2 || !p) {
2768                 return False;
2769         }
2770         /*
2771          * We use 1 here not 2 as we're checking
2772          * the last byte we want to access is safe.
2773          */
2774         if (!is_offset_safe(param,tpscnt,p,1)) {
2775                 return False;
2776         }
2777         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2778                 return False;
2779
2780         /* check it's a supported varient */
2781         if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
2782                 return(False);
2783
2784         *rparam_len = 4;
2785         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2786         if (!*rparam) {
2787                 return False;
2788         }
2789         *rdata_len = 0;
2790
2791         if (!print_job_exists(sharename, jobid)) {
2792                 errcode = NERR_JobNotFound;
2793                 goto out;
2794         }
2795
2796         snum = lp_servicenumber( sharename);
2797         if (snum == -1) {
2798                 errcode = NERR_DestNotFound;
2799                 goto out;
2800         }
2801
2802         errcode = NERR_notsupported;
2803
2804         switch (function) {
2805         case 81:                /* delete */
2806                 if (print_job_delete(conn->server_info, snum, jobid, &werr))
2807                         errcode = NERR_Success;
2808                 break;
2809         case 82:                /* pause */
2810                 if (print_job_pause(conn->server_info, snum, jobid, &werr))
2811                         errcode = NERR_Success;
2812                 break;
2813         case 83:                /* resume */
2814                 if (print_job_resume(conn->server_info, snum, jobid, &werr))
2815                         errcode = NERR_Success;
2816                 break;
2817         }
2818
2819         if (!W_ERROR_IS_OK(werr))
2820                 errcode = W_ERROR_V(werr);
2821
2822  out:
2823         SSVAL(*rparam,0,errcode);
2824         SSVAL(*rparam,2,0);             /* converter word */
2825
2826         return(True);
2827 }
2828
2829 /****************************************************************************
2830   Purge a print queue - or pause or resume it.
2831   ****************************************************************************/
2832
2833 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
2834                                 char *param, int tpscnt,
2835                                 char *data, int tdscnt,
2836                                 int mdrcnt,int mprcnt,
2837                                 char **rdata,char **rparam,
2838                                 int *rdata_len,int *rparam_len)
2839 {
2840         int function = get_safe_SVAL(param,tpscnt,param,0,0);
2841         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2842         char *str2 = skip_string(param,tpscnt,str1);
2843         char *QueueName = skip_string(param,tpscnt,str2);
2844         int errcode = NERR_notsupported;
2845         int snum;
2846         WERROR werr = WERR_OK;
2847
2848         if (!str1 || !str2 || !QueueName) {
2849                 return False;
2850         }
2851
2852         /* check it's a supported varient */
2853         if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
2854                 return(False);
2855
2856         *rparam_len = 4;
2857         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2858         if (!*rparam) {
2859                 return False;
2860         }
2861         *rdata_len = 0;
2862
2863         if (skip_string(param,tpscnt,QueueName) == NULL) {
2864                 return False;
2865         }
2866         snum = print_queue_snum(QueueName);
2867
2868         if (snum == -1) {
2869                 errcode = NERR_JobNotFound;
2870                 goto out;
2871         }
2872
2873         switch (function) {
2874         case 74: /* Pause queue */
2875                 werr = print_queue_pause(conn->server_info, snum);
2876                 break;
2877         case 75: /* Resume queue */
2878                 werr = print_queue_resume(conn->server_info, snum);
2879                 break;
2880         case 103: /* Purge */
2881                 werr = print_queue_purge(conn->server_info, snum);
2882                 break;
2883         default:
2884                 werr = WERR_NOT_SUPPORTED;
2885                 break;
2886         }
2887
2888         errcode = W_ERROR_V(werr);
2889
2890  out:
2891         SSVAL(*rparam,0,errcode);
2892         SSVAL(*rparam,2,0);             /* converter word */
2893
2894         return(True);
2895 }
2896
2897 /****************************************************************************
2898   set the property of a print job (undocumented?)
2899   ? function = 0xb -> set name of print job
2900   ? function = 0x6 -> move print job up/down
2901   Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
2902   or   <WWsTP> <WB21BB16B10zWWzDDz>
2903 ****************************************************************************/
2904
2905 static int check_printjob_info(struct pack_desc* desc,
2906                                int uLevel, char* id)
2907 {
2908         desc->subformat = NULL;
2909         switch( uLevel ) {
2910         case 0: desc->format = "W"; break;
2911         case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
2912         case 2: desc->format = "WWzWWDDzz"; break;
2913         case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
2914         case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
2915         default:
2916                 DEBUG(0,("check_printjob_info: invalid level %d\n",
2917                         uLevel ));
2918                 return False;
2919         }
2920         if (id == NULL || strcmp(desc->format,id) != 0) {
2921                 DEBUG(0,("check_printjob_info: invalid format %s\n",
2922                         id ? id : "<NULL>" ));
2923                 return False;
2924         }
2925         return True;
2926 }
2927
2928 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
2929                                 char *param, int tpscnt,
2930                                 char *data, int tdscnt,
2931                                 int mdrcnt,int mprcnt,
2932                                 char **rdata,char **rparam,
2933                                 int *rdata_len,int *rparam_len)
2934 {
2935         struct pack_desc desc;
2936         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2937         char *str2 = skip_string(param,tpscnt,str1);
2938         char *p = skip_string(param,tpscnt,str2);
2939         uint32 jobid;
2940         fstring sharename;
2941         int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
2942         int function = get_safe_SVAL(param,tpscnt,p,4,-1);
2943         int place, errcode;
2944
2945         if (!str1 || !str2 || !p) {
2946                 return False;
2947         }
2948         /*
2949          * We use 1 here not 2 as we're checking
2950          * the last byte we want to access is safe.
2951          */
2952         if (!is_offset_safe(param,tpscnt,p,1)) {
2953                 return False;
2954         }
2955         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2956                 return False;
2957         *rparam_len = 4;
2958         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2959         if (!*rparam) {
2960                 return False;
2961         }
2962
2963         if (!share_defined(sharename)) {
2964                 DEBUG(0,("api_PrintJobInfo: sharen [%s] not defined\n",
2965                          sharename));
2966                 return False;
2967         }
2968
2969         *rdata_len = 0;
2970
2971         /* check it's a supported varient */
2972         if ((strcmp(str1,"WWsTP")) ||
2973             (!check_printjob_info(&desc,uLevel,str2)))
2974                 return(False);
2975
2976         if (!print_job_exists(sharename, jobid)) {
2977                 errcode=NERR_JobNotFound;
2978                 goto out;
2979         }
2980
2981         errcode = NERR_notsupported;
2982
2983         switch (function) {
2984         case 0x6:
2985                 /* change job place in the queue,
2986                    data gives the new place */
2987                 place = SVAL(data,0);
2988                 if (print_job_set_place(sharename, jobid, place)) {
2989                         errcode=NERR_Success;
2990                 }
2991                 break;
2992
2993         case 0xb:
2994                 /* change print job name, data gives the name */
2995                 if (print_job_set_name(sharename, jobid, data)) {
2996                         errcode=NERR_Success;
2997                 }
2998                 break;
2999
3000         default:
3001                 return False;
3002         }
3003
3004  out:
3005         SSVALS(*rparam,0,errcode);
3006         SSVAL(*rparam,2,0);             /* converter word */
3007
3008         return(True);
3009 }
3010
3011
3012 /****************************************************************************
3013  Get info about the server.
3014 ****************************************************************************/
3015
3016 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
3017                                 char *param, int tpscnt,
3018                                 char *data, int tdscnt,
3019                                 int mdrcnt,int mprcnt,
3020                                 char **rdata,char **rparam,
3021                                 int *rdata_len,int *rparam_len)
3022 {
3023         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3024         char *str2 = skip_string(param,tpscnt,str1);
3025         char *p = skip_string(param,tpscnt,str2);
3026         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3027         char *p2;
3028         int struct_len;
3029
3030         if (!str1 || !str2 || !p) {
3031                 return False;
3032         }
3033
3034         DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3035
3036         /* check it's a supported varient */
3037         if (!prefix_ok(str1,"WrLh")) {
3038                 return False;
3039         }
3040
3041         switch( uLevel ) {
3042                 case 0:
3043                         if (strcmp(str2,"B16") != 0) {
3044                                 return False;
3045                         }
3046                         struct_len = 16;
3047                         break;
3048                 case 1:
3049                         if (strcmp(str2,"B16BBDz") != 0) {
3050                                 return False;
3051                         }
3052                         struct_len = 26;
3053                         break;
3054                 case 2:
3055                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3056                                 return False;
3057                         }
3058                         struct_len = 134;
3059                         break;
3060                 case 3:
3061                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3062                                 return False;
3063                         }
3064                         struct_len = 144;
3065                         break;
3066                 case 20:
3067                         if (strcmp(str2,"DN") != 0) {
3068                                 return False;
3069                         }
3070                         struct_len = 6;
3071                         break;
3072                 case 50:
3073                         if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3074                                 return False;
3075                         }
3076                         struct_len = 42;
3077                         break;
3078                 default:
3079                         return False;
3080         }
3081
3082         *rdata_len = mdrcnt;
3083         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3084         if (!*rdata) {
3085                 return False;
3086         }
3087
3088         p = *rdata;
3089         p2 = p + struct_len;
3090         if (uLevel != 20) {
3091                 srvstr_push(NULL, 0, p,global_myname(),16,
3092                         STR_ASCII|STR_UPPER|STR_TERMINATE);
3093         }
3094         p += 16;
3095         if (uLevel > 0) {
3096                 struct srv_info_struct *servers=NULL;
3097                 int i,count;
3098                 char *comment = NULL;
3099                 TALLOC_CTX *ctx = talloc_tos();
3100                 uint32 servertype= lp_default_server_announce();
3101
3102                 comment = talloc_strdup(ctx,lp_serverstring());
3103                 if (!comment) {
3104                         return false;
3105                 }
3106
3107                 if ((count=get_server_info(SV_TYPE_ALL,&servers,lp_workgroup()))>0) {
3108                         for (i=0;i<count;i++) {
3109                                 if (strequal(servers[i].name,global_myname())) {
3110                                         servertype = servers[i].type;
3111                                         TALLOC_FREE(comment);
3112                                         comment = talloc_strdup(ctx,
3113                                                         servers[i].comment);
3114                                         if (comment) {
3115                                                 return false;
3116                                         }
3117                                 }
3118                         }
3119                 }
3120
3121                 SAFE_FREE(servers);
3122
3123                 SCVAL(p,0,lp_major_announce_version());
3124                 SCVAL(p,1,lp_minor_announce_version());
3125                 SIVAL(p,2,servertype);
3126
3127                 if (mdrcnt == struct_len) {
3128                         SIVAL(p,6,0);
3129                 } else {
3130                         SIVAL(p,6,PTR_DIFF(p2,*rdata));
3131                         comment = talloc_sub_advanced(
3132                                 ctx,
3133                                 lp_servicename(SNUM(conn)),
3134                                 conn->server_info->unix_name,
3135                                 conn->connectpath,
3136                                 conn->server_info->utok.gid,
3137                                 conn->server_info->sanitized_username,
3138                                 pdb_get_domain(conn->server_info->sam_account),
3139                                 comment);
3140                         if (comment) {
3141                                 return false;
3142                         }
3143                         if (mdrcnt - struct_len <= 0) {
3144                                 return false;
3145                         }
3146                         push_ascii(p2,
3147                                 comment,
3148                                 MIN(mdrcnt - struct_len,
3149                                         MAX_SERVER_STRING_LENGTH),
3150                                 STR_TERMINATE);
3151                         p2 = skip_string(*rdata,*rdata_len,p2);
3152                         if (!p2) {
3153                                 return False;
3154                         }
3155                 }
3156         }
3157
3158         if (uLevel > 1) {
3159                 return False;           /* not yet implemented */
3160         }
3161
3162         *rdata_len = PTR_DIFF(p2,*rdata);
3163
3164         *rparam_len = 6;
3165         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3166         if (!*rparam) {
3167                 return False;
3168         }
3169         SSVAL(*rparam,0,NERR_Success);
3170         SSVAL(*rparam,2,0);             /* converter word */
3171         SSVAL(*rparam,4,*rdata_len);
3172
3173         return True;
3174 }
3175
3176 /****************************************************************************
3177  Get info about the server.
3178 ****************************************************************************/
3179
3180 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3181                                 char *param, int tpscnt,
3182                                 char *data, int tdscnt,
3183                                 int mdrcnt,int mprcnt,
3184                                 char **rdata,char **rparam,
3185                                 int *rdata_len,int *rparam_len)
3186 {
3187         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3188         char *str2 = skip_string(param,tpscnt,str1);
3189         char *p = skip_string(param,tpscnt,str2);
3190         char *p2;
3191         char *endp;
3192         int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3193
3194         if (!str1 || !str2 || !p) {
3195                 return False;
3196         }
3197
3198         DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3199
3200         *rparam_len = 6;
3201         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3202         if (!*rparam) {
3203                 return False;
3204         }
3205
3206         /* check it's a supported varient */
3207         if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3208                 return False;
3209         }
3210
3211         *rdata_len = mdrcnt + 1024;
3212         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3213         if (!*rdata) {
3214                 return False;
3215         }
3216
3217         SSVAL(*rparam,0,NERR_Success);
3218         SSVAL(*rparam,2,0);             /* converter word */
3219
3220         p = *rdata;
3221         endp = *rdata + *rdata_len;
3222
3223         p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3224         if (!p2) {
3225                 return False;
3226         }
3227
3228         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3229         strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3230         strupper_m(p2);
3231         p2 = skip_string(*rdata,*rdata_len,p2);
3232         if (!p2) {
3233                 return False;
3234         }
3235         p += 4;
3236
3237         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3238         strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3239         p2 = skip_string(*rdata,*rdata_len,p2);
3240         if (!p2) {
3241                 return False;
3242         }
3243         p += 4;
3244
3245         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3246         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3247         strupper_m(p2);
3248         p2 = skip_string(*rdata,*rdata_len,p2);
3249         if (!p2) {
3250                 return False;
3251         }
3252         p += 4;
3253
3254         SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3255         SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3256         p += 2;
3257
3258         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3259         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));   /* don't know.  login domain?? */
3260         p2 = skip_string(*rdata,*rdata_len,p2);
3261         if (!p2) {
3262                 return False;
3263         }
3264         p += 4;
3265
3266         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3267         strlcpy(p2,"",PTR_DIFF(endp,p2));
3268         p2 = skip_string(*rdata,*rdata_len,p2);
3269         if (!p2) {
3270                 return False;
3271         }
3272         p += 4;
3273
3274         *rdata_len = PTR_DIFF(p2,*rdata);
3275
3276         SSVAL(*rparam,4,*rdata_len);
3277
3278         return True;
3279 }
3280
3281 /****************************************************************************
3282   get info about a user
3283
3284     struct user_info_11 {
3285         char                usri11_name[21];  0-20
3286         char                usri11_pad;       21
3287         char                *usri11_comment;  22-25
3288         char            *usri11_usr_comment;  26-29
3289         unsigned short      usri11_priv;      30-31
3290         unsigned long       usri11_auth_flags; 32-35
3291         long                usri11_password_age; 36-39
3292         char                *usri11_homedir; 40-43
3293         char            *usri11_parms; 44-47
3294         long                usri11_last_logon; 48-51
3295         long                usri11_last_logoff; 52-55
3296         unsigned short      usri11_bad_pw_count; 56-57
3297         unsigned short      usri11_num_logons; 58-59
3298         char                *usri11_logon_server; 60-63
3299         unsigned short      usri11_country_code; 64-65
3300         char            *usri11_workstations; 66-69
3301         unsigned long       usri11_max_storage; 70-73
3302         unsigned short      usri11_units_per_week; 74-75
3303         unsigned char       *usri11_logon_hours; 76-79
3304         unsigned short      usri11_code_page; 80-81
3305     };
3306
3307 where:
3308
3309   usri11_name specifies the user name for which information is retrieved
3310
3311   usri11_pad aligns the next data structure element to a word boundary
3312
3313   usri11_comment is a null terminated ASCII comment
3314
3315   usri11_user_comment is a null terminated ASCII comment about the user
3316
3317   usri11_priv specifies the level of the privilege assigned to the user.
3318        The possible values are:
3319
3320 Name             Value  Description
3321 USER_PRIV_GUEST  0      Guest privilege
3322 USER_PRIV_USER   1      User privilege
3323 USER_PRV_ADMIN   2      Administrator privilege
3324
3325   usri11_auth_flags specifies the account operator privileges. The
3326        possible values are:
3327
3328 Name            Value   Description
3329 AF_OP_PRINT     0       Print operator
3330
3331
3332 Leach, Naik                                        [Page 28]
3333 \f
3334
3335
3336 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3337
3338
3339 AF_OP_COMM      1       Communications operator
3340 AF_OP_SERVER    2       Server operator
3341 AF_OP_ACCOUNTS  3       Accounts operator
3342
3343
3344   usri11_password_age specifies how many seconds have elapsed since the
3345        password was last changed.
3346
3347   usri11_home_dir points to a null terminated ASCII string that contains
3348        the path name of the user's home directory.
3349
3350   usri11_parms points to a null terminated ASCII string that is set
3351        aside for use by applications.
3352
3353   usri11_last_logon specifies the time when the user last logged on.
3354        This value is stored as the number of seconds elapsed since
3355        00:00:00, January 1, 1970.
3356
3357   usri11_last_logoff specifies the time when the user last logged off.
3358        This value is stored as the number of seconds elapsed since
3359        00:00:00, January 1, 1970. A value of 0 means the last logoff
3360        time is unknown.
3361
3362   usri11_bad_pw_count specifies the number of incorrect passwords
3363        entered since the last successful logon.
3364
3365   usri11_log1_num_logons specifies the number of times this user has
3366        logged on. A value of -1 means the number of logons is unknown.
3367
3368   usri11_logon_server points to a null terminated ASCII string that
3369        contains the name of the server to which logon requests are sent.
3370        A null string indicates logon requests should be sent to the
3371        domain controller.
3372
3373   usri11_country_code specifies the country code for the user's language
3374        of choice.
3375
3376   usri11_workstations points to a null terminated ASCII string that
3377        contains the names of workstations the user may log on from.
3378        There may be up to 8 workstations, with the names separated by
3379        commas. A null strings indicates there are no restrictions.
3380
3381   usri11_max_storage specifies the maximum amount of disk space the user
3382        can occupy. A value of 0xffffffff indicates there are no
3383        restrictions.
3384
3385   usri11_units_per_week specifies the equal number of time units into
3386        which a week is divided. This value must be equal to 168.
3387
3388   usri11_logon_hours points to a 21 byte (168 bits) string that
3389        specifies the time during which the user can log on. Each bit
3390        represents one unique hour in a week. The first bit (bit 0, word
3391        0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3392
3393
3394
3395 Leach, Naik                                        [Page 29]
3396 \f
3397
3398
3399 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3400
3401
3402        Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3403        are no restrictions.
3404
3405   usri11_code_page specifies the code page for the user's language of
3406        choice
3407
3408 All of the pointers in this data structure need to be treated
3409 specially. The  pointer is a 32 bit pointer. The higher 16 bits need
3410 to be ignored. The converter word returned in the parameters section
3411 needs to be subtracted from the lower 16 bits to calculate an offset
3412 into the return buffer where this ASCII string resides.
3413
3414 There is no auxiliary data in the response.
3415
3416   ****************************************************************************/
3417
3418 #define usri11_name           0
3419 #define usri11_pad            21
3420 #define usri11_comment        22
3421 #define usri11_usr_comment    26
3422 #define usri11_full_name      30
3423 #define usri11_priv           34
3424 #define usri11_auth_flags     36
3425 #define usri11_password_age   40
3426 #define usri11_homedir        44
3427 #define usri11_parms          48
3428 #define usri11_last_logon     52
3429 #define usri11_last_logoff    56
3430 #define usri11_bad_pw_count   60
3431 #define usri11_num_logons     62
3432 #define usri11_logon_server   64
3433 #define usri11_country_code   68
3434 #define usri11_workstations   70
3435 #define usri11_max_storage    74
3436 #define usri11_units_per_week 78
3437 #define usri11_logon_hours    80
3438 #define usri11_code_page      84
3439 #define usri11_end            86
3440
3441 #define USER_PRIV_GUEST 0
3442 #define USER_PRIV_USER 1
3443 #define USER_PRIV_ADMIN 2
3444
3445 #define AF_OP_PRINT     0
3446 #define AF_OP_COMM      1
3447 #define AF_OP_SERVER    2
3448 #define AF_OP_ACCOUNTS  3
3449
3450
3451 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3452                                 char *param, int tpscnt,
3453                                 char *data, int tdscnt,
3454                                 int mdrcnt,int mprcnt,
3455                                 char **rdata,char **rparam,
3456                                 int *rdata_len,int *rparam_len)
3457 {
3458         struct smbd_server_connection *sconn = smbd_server_conn;
3459         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3460         char *str2 = skip_string(param,tpscnt,str1);
3461         char *UserName = skip_string(param,tpscnt,str2);
3462         char *p = skip_string(param,tpscnt,UserName);
3463         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3464         char *p2;
3465         char *endp;
3466         const char *level_string;
3467
3468         /* get NIS home of a previously validated user - simeon */
3469         /* With share level security vuid will always be zero.
3470            Don't depend on vuser being non-null !!. JRA */
3471         user_struct *vuser = get_valid_user_struct(sconn, vuid);
3472         if(vuser != NULL) {
3473                 DEBUG(3,("  Username of UID %d is %s\n",
3474                          (int)vuser->server_info->utok.uid,
3475                          vuser->server_info->unix_name));
3476         }
3477
3478         if (!str1 || !str2 || !UserName || !p) {
3479                 return False;
3480         }
3481
3482         *rparam_len = 6;
3483         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3484         if (!*rparam) {
3485                 return False;
3486         }
3487
3488         DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3489
3490         /* check it's a supported variant */
3491         if (strcmp(str1,"zWrLh") != 0) {
3492                 return False;
3493         }
3494         switch( uLevel ) {
3495                 case 0: level_string = "B21"; break;
3496                 case 1: level_string = "B21BB16DWzzWz"; break;
3497                 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3498                 case 10: level_string = "B21Bzzz"; break;
3499                 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3500                 default: return False;
3501         }
3502
3503         if (strcmp(level_string,str2) != 0) {
3504                 return False;
3505         }
3506
3507         *rdata_len = mdrcnt + 1024;
3508         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3509         if (!*rdata) {
3510                 return False;
3511         }
3512
3513         SSVAL(*rparam,0,NERR_Success);
3514         SSVAL(*rparam,2,0);             /* converter word */
3515
3516         p = *rdata;
3517         endp = *rdata + *rdata_len;
3518         p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3519         if (!p2) {
3520                 return False;
3521         }
3522
3523         memset(p,0,21);
3524         fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
3525
3526         if (uLevel > 0) {
3527                 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
3528                 *p2 = 0;
3529         }
3530
3531         if (uLevel >= 10) {
3532                 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
3533                 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
3534                 p2 = skip_string(*rdata,*rdata_len,p2);
3535                 if (!p2) {
3536                         return False;
3537                 }
3538
3539                 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
3540                 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
3541                 p2 = skip_string(*rdata,*rdata_len,p2);
3542                 if (!p2) {
3543                         return False;
3544                 }
3545
3546                 /* EEK! the cifsrap.txt doesn't have this in!!!! */
3547                 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
3548                 strlcpy(p2,((vuser != NULL)
3549                             ? pdb_get_fullname(vuser->server_info->sam_account)
3550                             : UserName),PTR_DIFF(endp,p2));
3551                 p2 = skip_string(*rdata,*rdata_len,p2);
3552                 if (!p2) {
3553                         return False;
3554                 }
3555         }
3556
3557         if (uLevel == 11) {
3558                 const char *homedir = "";
3559                 if (vuser != NULL) {
3560                         homedir = pdb_get_homedir(
3561                                 vuser->server_info->sam_account);
3562                 }
3563                 /* modelled after NTAS 3.51 reply */
3564                 SSVAL(p,usri11_priv,conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3565                 SIVAL(p,usri11_auth_flags,AF_OP_PRINT);         /* auth flags */
3566                 SIVALS(p,usri11_password_age,-1);               /* password age */
3567                 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
3568                 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
3569                 p2 = skip_string(*rdata,*rdata_len,p2);
3570                 if (!p2) {
3571                         return False;
3572                 }
3573                 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
3574                 strlcpy(p2,"",PTR_DIFF(endp,p2));
3575                 p2 = skip_string(*rdata,*rdata_len,p2);
3576                 if (!p2) {
3577                         return False;
3578                 }
3579                 SIVAL(p,usri11_last_logon,0);           /* last logon */
3580                 SIVAL(p,usri11_last_logoff,0);          /* last logoff */
3581                 SSVALS(p,usri11_bad_pw_count,-1);       /* bad pw counts */
3582                 SSVALS(p,usri11_num_logons,-1);         /* num logons */
3583                 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
3584                 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
3585                 p2 = skip_string(*rdata,*rdata_len,p2);
3586                 if (!p2) {
3587                         return False;
3588                 }
3589                 SSVAL(p,usri11_country_code,0);         /* country code */
3590
3591                 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
3592                 strlcpy(p2,"",PTR_DIFF(endp,p2));
3593                 p2 = skip_string(*rdata,*rdata_len,p2);
3594                 if (!p2) {
3595                         return False;
3596                 }
3597
3598                 SIVALS(p,usri11_max_storage,-1);                /* max storage */
3599                 SSVAL(p,usri11_units_per_week,168);             /* units per week */
3600                 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
3601
3602                 /* a simple way to get logon hours at all times. */
3603                 memset(p2,0xff,21);
3604                 SCVAL(p2,21,0);           /* fix zero termination */
3605                 p2 = skip_string(*rdata,*rdata_len,p2);
3606                 if (!p2) {
3607                         return False;
3608                 }
3609
3610                 SSVAL(p,usri11_code_page,0);            /* code page */
3611         }
3612
3613         if (uLevel == 1 || uLevel == 2) {
3614                 memset(p+22,' ',16);    /* password */
3615                 SIVALS(p,38,-1);                /* password age */
3616                 SSVAL(p,42,
3617                 conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3618                 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
3619                 strlcpy(p2, vuser ? pdb_get_homedir(
3620                                 vuser->server_info->sam_account) : "",
3621                         PTR_DIFF(endp,p2));
3622                 p2 = skip_string(*rdata,*rdata_len,p2);
3623                 if (!p2) {
3624                         return False;
3625                 }
3626                 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
3627                 *p2++ = 0;
3628                 SSVAL(p,52,0);          /* flags */
3629                 SIVAL(p,54,PTR_DIFF(p2,*rdata));                /* script_path */
3630                 strlcpy(p2, vuser ? pdb_get_logon_script(
3631                                 vuser->server_info->sam_account) : "",
3632                         PTR_DIFF(endp,p2));
3633                 p2 = skip_string(*rdata,*rdata_len,p2);
3634                 if (!p2) {
3635                         return False;
3636                 }
3637                 if (uLevel == 2) {
3638                         SIVAL(p,60,0);          /* auth_flags */
3639                         SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
3640                         strlcpy(p2,((vuser != NULL)
3641                                     ? pdb_get_fullname(vuser->server_info->sam_account)
3642                                     : UserName),PTR_DIFF(endp,p2));
3643                         p2 = skip_string(*rdata,*rdata_len,p2);
3644                         if (!p2) {
3645                                 return False;
3646                         }
3647                         SIVAL(p,68,0);          /* urs_comment */
3648                         SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
3649                         strlcpy(p2,"",PTR_DIFF(endp,p2));
3650                         p2 = skip_string(*rdata,*rdata_len,p2);
3651                         if (!p2) {
3652                                 return False;
3653                         }
3654                         SIVAL(p,76,0);          /* workstations */
3655                         SIVAL(p,80,0);          /* last_logon */
3656                         SIVAL(p,84,0);          /* last_logoff */
3657                         SIVALS(p,88,-1);                /* acct_expires */
3658                         SIVALS(p,92,-1);                /* max_storage */
3659                         SSVAL(p,96,168);        /* units_per_week */
3660                         SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
3661                         memset(p2,-1,21);
3662                         p2 += 21;
3663                         SSVALS(p,102,-1);       /* bad_pw_count */
3664                         SSVALS(p,104,-1);       /* num_logons */
3665                         SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
3666                         {
3667                                 TALLOC_CTX *ctx = talloc_tos();
3668                                 int space_rem = *rdata_len - (p2 - *rdata);
3669                                 char *tmp;
3670
3671                                 if (space_rem <= 0) {
3672                                         return false;
3673                                 }
3674                                 tmp = talloc_strdup(ctx, "\\\\%L");
3675                                 if (!tmp) {
3676                                         return false;
3677                                 }
3678                                 tmp = talloc_sub_basic(ctx,
3679                                                 "",
3680                                                 "",
3681                                                 tmp);
3682                                 if (!tmp) {
3683                                         return false;
3684                                 }
3685
3686                                 push_ascii(p2,
3687                                         tmp,
3688                                         space_rem,
3689                                         STR_TERMINATE);
3690                         }
3691                         p2 = skip_string(*rdata,*rdata_len,p2);
3692                         if (!p2) {
3693                                 return False;
3694                         }
3695                         SSVAL(p,110,49);        /* country_code */
3696                         SSVAL(p,112,860);       /* code page */
3697                 }
3698         }
3699
3700         *rdata_len = PTR_DIFF(p2,*rdata);
3701
3702         SSVAL(*rparam,4,*rdata_len);    /* is this right?? */
3703
3704         return(True);
3705 }
3706
3707 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
3708                                 char *param, int tpscnt,
3709                                 char *data, int tdscnt,
3710                                 int mdrcnt,int mprcnt,
3711                                 char **rdata,char **rparam,
3712                                 int *rdata_len,int *rparam_len)
3713 {
3714         struct smbd_server_connection *sconn = smbd_server_conn;
3715         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3716         char *str2 = skip_string(param,tpscnt,str1);
3717         char *p = skip_string(param,tpscnt,str2);
3718         int uLevel;
3719         struct pack_desc desc;
3720         char* name;
3721                 /* With share level security vuid will always be zero.
3722                    Don't depend on vuser being non-null !!. JRA */
3723         user_struct *vuser = get_valid_user_struct(sconn, vuid);
3724
3725         if (!str1 || !str2 || !p) {
3726                 return False;
3727         }
3728
3729         if(vuser != NULL) {
3730                 DEBUG(3,("  Username of UID %d is %s\n",
3731                          (int)vuser->server_info->utok.uid,
3732                          vuser->server_info->unix_name));
3733         }
3734
3735         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3736         name = get_safe_str_ptr(param,tpscnt,p,2);
3737         if (!name) {
3738                 return False;
3739         }
3740
3741         memset((char *)&desc,'\0',sizeof(desc));
3742
3743         DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
3744
3745         /* check it's a supported varient */
3746         if (strcmp(str1,"OOWb54WrLh") != 0) {
3747                 return False;
3748         }
3749         if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
3750                 return False;
3751         }
3752         if (mdrcnt > 0) {
3753                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3754                 if (!*rdata) {
3755                         return False;
3756                 }
3757         }
3758
3759         desc.base = *rdata;
3760         desc.buflen = mdrcnt;
3761         desc.subformat = NULL;
3762         desc.format = str2;
3763
3764         if (init_package(&desc,1,0)) {
3765                 PACKI(&desc,"W",0);             /* code */
3766                 PACKS(&desc,"B21",name);        /* eff. name */
3767                 PACKS(&desc,"B","");            /* pad */
3768                 PACKI(&desc,"W", conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3769                 PACKI(&desc,"D",0);             /* auth flags XXX */
3770                 PACKI(&desc,"W",0);             /* num logons */
3771                 PACKI(&desc,"W",0);             /* bad pw count */
3772                 PACKI(&desc,"D",0);             /* last logon */
3773                 PACKI(&desc,"D",-1);            /* last logoff */
3774                 PACKI(&desc,"D",-1);            /* logoff time */
3775                 PACKI(&desc,"D",-1);            /* kickoff time */
3776                 PACKI(&desc,"D",0);             /* password age */
3777                 PACKI(&desc,"D",0);             /* password can change */
3778                 PACKI(&desc,"D",-1);            /* password must change */
3779
3780                 {
3781                         fstring mypath;
3782                         fstrcpy(mypath,"\\\\");
3783                         fstrcat(mypath,get_local_machine_name());
3784                         strupper_m(mypath);
3785                         PACKS(&desc,"z",mypath); /* computer */
3786                 }
3787
3788                 PACKS(&desc,"z",lp_workgroup());/* domain */
3789                 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
3790                               vuser->server_info->sam_account) : ""); /* script path */
3791                 PACKI(&desc,"D",0x00000000);            /* reserved */
3792         }
3793
3794         *rdata_len = desc.usedlen;
3795         *rparam_len = 6;
3796         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3797         if (!*rparam) {
3798                 return False;
3799         }
3800         SSVALS(*rparam,0,desc.errcode);
3801         SSVAL(*rparam,2,0);
3802         SSVAL(*rparam,4,desc.neededlen);
3803
3804         DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
3805
3806         return True;
3807 }
3808
3809 /****************************************************************************
3810  api_WAccessGetUserPerms
3811 ****************************************************************************/
3812
3813 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
3814                                 char *param, int tpscnt,
3815                                 char *data, int tdscnt,
3816                                 int mdrcnt,int mprcnt,
3817                                 char **rdata,char **rparam,
3818                                 int *rdata_len,int *rparam_len)
3819 {
3820         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3821         char *str2 = skip_string(param,tpscnt,str1);
3822         char *user = skip_string(param,tpscnt,str2);
3823         char *resource = skip_string(param,tpscnt,user);
3824
3825         if (!str1 || !str2 || !user || !resource) {
3826                 return False;
3827         }
3828
3829         if (skip_string(param,tpscnt,resource) == NULL) {
3830                 return False;
3831         }
3832         DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
3833
3834         /* check it's a supported varient */
3835         if (strcmp(str1,"zzh") != 0) {
3836                 return False;
3837         }
3838         if (strcmp(str2,"") != 0) {
3839                 return False;
3840         }
3841
3842         *rparam_len = 6;
3843         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3844         if (!*rparam) {
3845                 return False;
3846         }
3847         SSVALS(*rparam,0,0);            /* errorcode */
3848         SSVAL(*rparam,2,0);             /* converter word */
3849         SSVAL(*rparam,4,0x7f);  /* permission flags */
3850
3851         return True;
3852 }
3853
3854 /****************************************************************************
3855   api_WPrintJobEnumerate
3856   ****************************************************************************/
3857
3858 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
3859                                 char *param, int tpscnt,
3860                                 char *data, int tdscnt,
3861                                 int mdrcnt,int mprcnt,
3862                                 char **rdata,char **rparam,
3863                                 int *rdata_len,int *rparam_len)
3864 {
3865         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3866         char *str2 = skip_string(param,tpscnt,str1);
3867         char *p = skip_string(param,tpscnt,str2);
3868         int uLevel;
3869         int count;
3870         int i;
3871         int snum;
3872         fstring sharename;
3873         uint32 jobid;
3874         struct pack_desc desc;
3875         print_queue_struct *queue=NULL;
3876         print_status_struct status;
3877         char *tmpdata=NULL;
3878
3879         if (!str1 || !str2 || !p) {
3880                 return False;
3881         }
3882
3883         uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3884
3885         memset((char *)&desc,'\0',sizeof(desc));
3886         memset((char *)&status,'\0',sizeof(status));
3887
3888         DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
3889
3890         /* check it's a supported varient */
3891         if (strcmp(str1,"WWrLh") != 0) {
3892                 return False;
3893         }
3894         if (!check_printjob_info(&desc,uLevel,str2)) {
3895                 return False;
3896         }
3897
3898         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
3899                 return False;
3900         }
3901
3902         snum = lp_servicenumber( sharename);
3903         if (snum < 0 || !VALID_SNUM(snum)) {
3904                 return(False);
3905         }
3906
3907         count = print_queue_status(snum,&queue,&status);
3908         for (i = 0; i < count; i++) {
3909                 if (queue[i].job == jobid) {
3910                         break;
3911                 }
3912         }
3913
3914         if (mdrcnt > 0) {
3915                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3916                 if (!*rdata) {
3917                         return False;
3918                 }
3919                 desc.base = *rdata;
3920                 desc.buflen = mdrcnt;
3921         } else {
3922                 /*
3923                  * Don't return data but need to get correct length
3924                  *  init_package will return wrong size if buflen=0
3925                  */
3926                 desc.buflen = getlen(desc.format);
3927                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
3928         }
3929
3930         if (init_package(&desc,1,0)) {
3931                 if (i < count) {
3932                         fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
3933                         *rdata_len = desc.usedlen;
3934                 } else {
3935                         desc.errcode = NERR_JobNotFound;
3936                         *rdata_len = 0;
3937                 }
3938         }
3939
3940         *rparam_len = 6;
3941         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3942         if (!*rparam) {
3943                 return False;
3944         }
3945         SSVALS(*rparam,0,desc.errcode);
3946         SSVAL(*rparam,2,0);
3947         SSVAL(*rparam,4,desc.neededlen);
3948
3949         SAFE_FREE(queue);
3950         SAFE_FREE(tmpdata);
3951
3952         DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
3953
3954         return True;
3955 }
3956
3957 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
3958                                 char *param, int tpscnt,
3959                                 char *data, int tdscnt,
3960                                 int mdrcnt,int mprcnt,
3961                                 char **rdata,char **rparam,
3962                                 int *rdata_len,int *rparam_len)
3963 {
3964         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3965         char *str2 = skip_string(param,tpscnt,str1);
3966         char *p = skip_string(param,tpscnt,str2);
3967         char *name = p;
3968         int uLevel;
3969         int count;
3970         int i, succnt=0;
3971         int snum;
3972         struct pack_desc desc;
3973         print_queue_struct *queue=NULL;
3974         print_status_struct status;
3975
3976         if (!str1 || !str2 || !p) {
3977                 return False;
3978         }
3979
3980         memset((char *)&desc,'\0',sizeof(desc));
3981         memset((char *)&status,'\0',sizeof(status));
3982
3983         p = skip_string(param,tpscnt,p);
3984         if (!p) {
3985                 return False;
3986         }
3987         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3988
3989         DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
3990
3991         /* check it's a supported variant */
3992         if (strcmp(str1,"zWrLeh") != 0) {
3993                 return False;
3994         }
3995
3996         if (uLevel > 2) {
3997                 return False;   /* defined only for uLevel 0,1,2 */
3998         }
3999
4000         if (!check_printjob_info(&desc,uLevel,str2)) {
4001                 return False;
4002         }
4003
4004         snum = find_service(name);
4005         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4006                 return False;
4007         }
4008
4009         count = print_queue_status(snum,&queue,&status);
4010         if (mdrcnt > 0) {
4011                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4012                 if (!*rdata) {
4013                         return False;
4014                 }
4015         }
4016         desc.base = *rdata;
4017         desc.buflen = mdrcnt;
4018
4019         if (init_package(&desc,count,0)) {
4020                 succnt = 0;
4021                 for (i = 0; i < count; i++) {
4022                         fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4023                         if (desc.errcode == NERR_Success) {
4024                                 succnt = i+1;
4025                         }
4026                 }
4027         }
4028
4029         *rdata_len = desc.usedlen;
4030
4031         *rparam_len = 8;
4032         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4033         if (!*rparam) {
4034                 return False;
4035         }
4036         SSVALS(*rparam,0,desc.errcode);
4037         SSVAL(*rparam,2,0);
4038         SSVAL(*rparam,4,succnt);
4039         SSVAL(*rparam,6,count);
4040
4041         SAFE_FREE(queue);
4042
4043         DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4044
4045         return True;
4046 }
4047
4048 static int check_printdest_info(struct pack_desc* desc,
4049                                 int uLevel, char* id)
4050 {
4051         desc->subformat = NULL;
4052         switch( uLevel ) {
4053                 case 0:
4054                         desc->format = "B9";
4055                         break;
4056                 case 1:
4057                         desc->format = "B9B21WWzW";
4058                         break;
4059                 case 2:
4060                         desc->format = "z";
4061                         break;
4062                 case 3:
4063                         desc->format = "zzzWWzzzWW";
4064                         break;
4065                 default:
4066                         DEBUG(0,("check_printdest_info: invalid level %d\n",
4067                                 uLevel));
4068                         return False;
4069         }
4070         if (id == NULL || strcmp(desc->format,id) != 0) {
4071                 DEBUG(0,("check_printdest_info: invalid string %s\n",
4072                         id ? id : "<NULL>" ));
4073                 return False;
4074         }
4075         return True;
4076 }
4077
4078 static void fill_printdest_info(connection_struct *conn, int snum, int uLevel,
4079                                 struct pack_desc* desc)
4080 {
4081         char buf[100];
4082
4083         strncpy(buf,SERVICE(snum),sizeof(buf)-1);
4084         buf[sizeof(buf)-1] = 0;
4085         strupper_m(buf);
4086
4087         if (uLevel <= 1) {
4088                 PACKS(desc,"B9",buf);   /* szName */
4089                 if (uLevel == 1) {
4090                         PACKS(desc,"B21","");   /* szUserName */
4091                         PACKI(desc,"W",0);              /* uJobId */
4092                         PACKI(desc,"W",0);              /* fsStatus */
4093                         PACKS(desc,"z","");     /* pszStatus */
4094                         PACKI(desc,"W",0);              /* time */
4095                 }
4096         }
4097
4098         if (uLevel == 2 || uLevel == 3) {
4099                 PACKS(desc,"z",buf);            /* pszPrinterName */
4100                 if (uLevel == 3) {
4101                         PACKS(desc,"z","");     /* pszUserName */
4102                         PACKS(desc,"z","");     /* pszLogAddr */
4103                         PACKI(desc,"W",0);              /* uJobId */
4104                         PACKI(desc,"W",0);              /* fsStatus */
4105                         PACKS(desc,"z","");     /* pszStatus */
4106                         PACKS(desc,"z","");     /* pszComment */
4107                         PACKS(desc,"z","NULL"); /* pszDrivers */
4108                         PACKI(desc,"W",0);              /* time */
4109                         PACKI(desc,"W",0);              /* pad1 */
4110                 }
4111         }
4112 }
4113
4114 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
4115                                 char *param, int tpscnt,
4116                                 char *data, int tdscnt,
4117                                 int mdrcnt,int mprcnt,
4118                                 char **rdata,char **rparam,
4119                                 int *rdata_len,int *rparam_len)
4120 {
4121         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4122         char *str2 = skip_string(param,tpscnt,str1);
4123         char *p = skip_string(param,tpscnt,str2);
4124         char* PrinterName = p;
4125         int uLevel;
4126         struct pack_desc desc;
4127         int snum;
4128         char *tmpdata=NULL;
4129
4130         if (!str1 || !str2 || !p) {
4131                 return False;
4132         }
4133
4134         memset((char *)&desc,'\0',sizeof(desc));
4135
4136         p = skip_string(param,tpscnt,p);
4137         if (!p) {
4138                 return False;
4139         }
4140         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4141
4142         DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4143
4144         /* check it's a supported varient */
4145         if (strcmp(str1,"zWrLh") != 0) {
4146                 return False;
4147         }
4148         if (!check_printdest_info(&desc,uLevel,str2)) {
4149                 return False;
4150         }
4151
4152         snum = find_service(PrinterName);
4153         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4154                 *rdata_len = 0;
4155                 desc.errcode = NERR_DestNotFound;
4156                 desc.neededlen = 0;
4157         } else {
4158                 if (mdrcnt > 0) {
4159                         *rdata = smb_realloc_limit(*rdata,mdrcnt);
4160                         if (!*rdata) {
4161                                 return False;
4162                         }
4163                         desc.base = *rdata;
4164                         desc.buflen = mdrcnt;
4165                 } else {
4166                         /*
4167                          * Don't return data but need to get correct length
4168                          * init_package will return wrong size if buflen=0
4169                          */
4170                         desc.buflen = getlen(desc.format);
4171                         desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4172                 }
4173                 if (init_package(&desc,1,0)) {
4174                         fill_printdest_info(conn,snum,uLevel,&desc);
4175                 }
4176                 *rdata_len = desc.usedlen;
4177         }
4178
4179         *rparam_len = 6;
4180         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4181         if (!*rparam) {
4182                 return False;
4183         }
4184         SSVALS(*rparam,0,desc.errcode);
4185         SSVAL(*rparam,2,0);
4186         SSVAL(*rparam,4,desc.neededlen);
4187
4188         DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4189         SAFE_FREE(tmpdata);
4190
4191         return True;
4192 }
4193
4194 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4195                                 char *param, int tpscnt,
4196                                 char *data, int tdscnt,
4197                                 int mdrcnt,int mprcnt,
4198                                 char **rdata,char **rparam,
4199                                 int *rdata_len,int *rparam_len)
4200 {
4201         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4202         char *str2 = skip_string(param,tpscnt,str1);
4203         char *p = skip_string(param,tpscnt,str2);
4204         int uLevel;
4205         int queuecnt;
4206         int i, n, succnt=0;
4207         struct pack_desc desc;
4208         int services = lp_numservices();
4209
4210         if (!str1 || !str2 || !p) {
4211                 return False;
4212         }
4213
4214         memset((char *)&desc,'\0',sizeof(desc));
4215
4216         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4217
4218         DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4219
4220         /* check it's a supported varient */
4221         if (strcmp(str1,"WrLeh") != 0) {
4222                 return False;
4223         }
4224         if (!check_printdest_info(&desc,uLevel,str2)) {
4225                 return False;
4226         }
4227
4228         queuecnt = 0;
4229         for (i = 0; i < services; i++) {
4230                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4231                         queuecnt++;
4232                 }
4233         }
4234
4235         if (mdrcnt > 0) {
4236                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4237                 if (!*rdata) {
4238                         return False;
4239                 }
4240         }
4241
4242         desc.base = *rdata;
4243         desc.buflen = mdrcnt;
4244         if (init_package(&desc,queuecnt,0)) {
4245                 succnt = 0;
4246                 n = 0;
4247                 for (i = 0; i < services; i++) {
4248                         if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4249                                 fill_printdest_info(conn,i,uLevel,&desc);
4250                                 n++;
4251                                 if (desc.errcode == NERR_Success) {
4252                                         succnt = n;
4253                                 }
4254                         }
4255                 }
4256         }
4257
4258         *rdata_len = desc.usedlen;
4259
4260         *rparam_len = 8;
4261         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4262         if (!*rparam) {
4263                 return False;
4264         }
4265         SSVALS(*rparam,0,desc.errcode);
4266         SSVAL(*rparam,2,0);
4267         SSVAL(*rparam,4,succnt);
4268         SSVAL(*rparam,6,queuecnt);
4269
4270         DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4271
4272         return True;
4273 }
4274
4275 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4276                                 char *param, int tpscnt,
4277                                 char *data, int tdscnt,
4278                                 int mdrcnt,int mprcnt,
4279                                 char **rdata,char **rparam,
4280                                 int *rdata_len,int *rparam_len)
4281 {
4282         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4283         char *str2 = skip_string(param,tpscnt,str1);
4284         char *p = skip_string(param,tpscnt,str2);
4285         int uLevel;
4286         int succnt;
4287         struct pack_desc desc;
4288
4289         if (!str1 || !str2 || !p) {
4290                 return False;
4291         }
4292
4293         memset((char *)&desc,'\0',sizeof(desc));
4294
4295         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4296
4297         DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4298
4299         /* check it's a supported varient */
4300         if (strcmp(str1,"WrLeh") != 0) {
4301                 return False;
4302         }
4303         if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4304                 return False;
4305         }
4306
4307         if (mdrcnt > 0) {
4308                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4309                 if (!*rdata) {
4310                         return False;
4311                 }
4312         }
4313         desc.base = *rdata;
4314         desc.buflen = mdrcnt;
4315         if (init_package(&desc,1,0)) {
4316                 PACKS(&desc,"B41","NULL");
4317         }
4318
4319         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4320
4321         *rdata_len = desc.usedlen;
4322
4323         *rparam_len = 8;
4324         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4325         if (!*rparam) {
4326                 return False;
4327         }
4328         SSVALS(*rparam,0,desc.errcode);
4329         SSVAL(*rparam,2,0);
4330         SSVAL(*rparam,4,succnt);
4331         SSVAL(*rparam,6,1);
4332
4333         DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4334
4335         return True;
4336 }
4337
4338 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4339                                 char *param, int tpscnt,
4340                                 char *data, int tdscnt,
4341                                 int mdrcnt,int mprcnt,
4342                                 char **rdata,char **rparam,
4343                                 int *rdata_len,int *rparam_len)
4344 {
4345         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4346         char *str2 = skip_string(param,tpscnt,str1);
4347         char *p = skip_string(param,tpscnt,str2);
4348         int uLevel;
4349         int succnt;
4350         struct pack_desc desc;
4351
4352         if (!str1 || !str2 || !p) {
4353                 return False;
4354         }
4355         memset((char *)&desc,'\0',sizeof(desc));
4356
4357         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4358
4359         DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4360
4361         /* check it's a supported varient */
4362         if (strcmp(str1,"WrLeh") != 0) {
4363                 return False;
4364         }
4365         if (uLevel != 0 || strcmp(str2,"B13") != 0) {
4366                 return False;
4367         }
4368
4369         if (mdrcnt > 0) {
4370                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4371                 if (!*rdata) {
4372                         return False;
4373                 }
4374         }
4375         desc.base = *rdata;
4376         desc.buflen = mdrcnt;
4377         desc.format = str2;
4378         if (init_package(&desc,1,0)) {
4379                 PACKS(&desc,"B13","lpd");
4380         }
4381
4382         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4383
4384         *rdata_len = desc.usedlen;
4385
4386         *rparam_len = 8;
4387         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4388         if (!*rparam) {
4389                 return False;
4390         }
4391         SSVALS(*rparam,0,desc.errcode);
4392         SSVAL(*rparam,2,0);
4393         SSVAL(*rparam,4,succnt);
4394         SSVAL(*rparam,6,1);
4395
4396         DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
4397
4398         return True;
4399 }
4400
4401 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
4402                                 char *param, int tpscnt,
4403                                 char *data, int tdscnt,
4404                                 int mdrcnt,int mprcnt,
4405                                 char **rdata,char **rparam,
4406                                 int *rdata_len,int *rparam_len)
4407 {
4408         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4409         char *str2 = skip_string(param,tpscnt,str1);
4410         char *p = skip_string(param,tpscnt,str2);
4411         int uLevel;
4412         int succnt;
4413         struct pack_desc desc;
4414
4415         if (!str1 || !str2 || !p) {
4416                 return False;
4417         }
4418
4419         memset((char *)&desc,'\0',sizeof(desc));
4420
4421         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4422
4423         DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
4424
4425         /* check it's a supported varient */
4426         if (strcmp(str1,"WrLeh") != 0) {
4427                 return False;
4428         }
4429         if (uLevel != 0 || strcmp(str2,"B9") != 0) {
4430                 return False;
4431         }
4432
4433         if (mdrcnt > 0) {
4434                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4435                 if (!*rdata) {
4436                         return False;
4437                 }
4438         }
4439         memset((char *)&desc,'\0',sizeof(desc));
4440         desc.base = *rdata;
4441         desc.buflen = mdrcnt;
4442         desc.format = str2;
4443         if (init_package(&desc,1,0)) {
4444                 PACKS(&desc,"B13","lp0");
4445         }
4446
4447         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4448
4449         *rdata_len = desc.usedlen;
4450
4451         *rparam_len = 8;
4452         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4453         if (!*rparam) {
4454                 return False;
4455         }
4456         SSVALS(*rparam,0,desc.errcode);
4457         SSVAL(*rparam,2,0);
4458         SSVAL(*rparam,4,succnt);
4459         SSVAL(*rparam,6,1);
4460
4461         DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
4462
4463         return True;
4464 }
4465
4466 /****************************************************************************
4467  List open sessions
4468  ****************************************************************************/
4469
4470 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
4471                                 char *param, int tpscnt,
4472                                 char *data, int tdscnt,
4473                                 int mdrcnt,int mprcnt,
4474                                 char **rdata,char **rparam,
4475                                 int *rdata_len,int *rparam_len)
4476
4477 {
4478         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4479         char *str2 = skip_string(param,tpscnt,str1);
4480         char *p = skip_string(param,tpscnt,str2);
4481         int uLevel;
4482         struct pack_desc desc;
4483         struct sessionid *session_list;
4484         int i, num_sessions;
4485
4486         if (!str1 || !str2 || !p) {
4487                 return False;
4488         }
4489
4490         memset((char *)&desc,'\0',sizeof(desc));
4491
4492         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4493
4494         DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
4495         DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
4496         DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
4497
4498         /* check it's a supported varient */
4499         if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
4500                 return False;
4501         }
4502         if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
4503                 return False;
4504         }
4505
4506         num_sessions = list_sessions(talloc_tos(), &session_list);
4507
4508         if (mdrcnt > 0) {
4509                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4510                 if (!*rdata) {
4511                         return False;
4512                 }
4513         }
4514         memset((char *)&desc,'\0',sizeof(desc));
4515         desc.base = *rdata;
4516         desc.buflen = mdrcnt;
4517         desc.format = str2;
4518         if (!init_package(&desc,num_sessions,0)) {
4519                 return False;
4520         }
4521
4522         for(i=0; i<num_sessions; i++) {
4523                 PACKS(&desc, "z", session_list[i].remote_machine);
4524                 PACKS(&desc, "z", session_list[i].username);
4525                 PACKI(&desc, "W", 1); /* num conns */
4526                 PACKI(&desc, "W", 0); /* num opens */
4527                 PACKI(&desc, "W", 1); /* num users */
4528                 PACKI(&desc, "D", 0); /* session time */
4529                 PACKI(&desc, "D", 0); /* idle time */
4530                 PACKI(&desc, "D", 0); /* flags */
4531                 PACKS(&desc, "z", "Unknown Client"); /* client type string */
4532         }
4533
4534         *rdata_len = desc.usedlen;
4535
4536         *rparam_len = 8;
4537         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4538         if (!*rparam) {
4539                 return False;
4540         }
4541         SSVALS(*rparam,0,desc.errcode);
4542         SSVAL(*rparam,2,0); /* converter */
4543         SSVAL(*rparam,4,num_sessions); /* count */
4544
4545         DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
4546
4547         return True;
4548 }
4549
4550
4551 /****************************************************************************
4552  The buffer was too small.
4553  ****************************************************************************/
4554
4555 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
4556                          int mdrcnt, int mprcnt,
4557                          char **rdata, char **rparam,
4558                          int *rdata_len, int *rparam_len)
4559 {
4560         *rparam_len = MIN(*rparam_len,mprcnt);
4561         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4562         if (!*rparam) {
4563                 return False;
4564         }
4565
4566         *rdata_len = 0;
4567
4568         SSVAL(*rparam,0,NERR_BufTooSmall);
4569
4570         DEBUG(3,("Supplied buffer too small in API command\n"));
4571
4572         return True;
4573 }
4574
4575 /****************************************************************************
4576  The request is not supported.
4577  ****************************************************************************/
4578
4579 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
4580                                 char *param, int tpscnt,
4581                                 char *data, int tdscnt,
4582                                 int mdrcnt, int mprcnt,
4583                                 char **rdata, char **rparam,
4584                                 int *rdata_len, int *rparam_len)
4585 {
4586         *rparam_len = 4;
4587         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4588         if (!*rparam) {
4589                 return False;
4590         }
4591
4592         *rdata_len = 0;
4593
4594         SSVAL(*rparam,0,NERR_notsupported);
4595         SSVAL(*rparam,2,0);             /* converter word */
4596
4597         DEBUG(3,("Unsupported API command\n"));
4598
4599         return True;
4600 }
4601
4602 static const struct {
4603         const char *name;
4604         int id;
4605         bool (*fn)(connection_struct *, uint16,
4606                         char *, int,
4607                         char *, int,
4608                         int,int,char **,char **,int *,int *);
4609         bool auth_user;         /* Deny anonymous access? */
4610 } api_commands[] = {
4611         {"RNetShareEnum",       RAP_WshareEnum,         api_RNetShareEnum, True},
4612         {"RNetShareGetInfo",    RAP_WshareGetInfo,      api_RNetShareGetInfo},
4613         {"RNetShareAdd",        RAP_WshareAdd,          api_RNetShareAdd},
4614         {"RNetSessionEnum",     RAP_WsessionEnum,       api_RNetSessionEnum, True},
4615         {"RNetServerGetInfo",   RAP_WserverGetInfo,     api_RNetServerGetInfo},
4616         {"RNetGroupEnum",       RAP_WGroupEnum,         api_RNetGroupEnum, True},
4617         {"RNetGroupGetUsers", RAP_WGroupGetUsers,       api_RNetGroupGetUsers, True},
4618         {"RNetUserEnum",        RAP_WUserEnum,          api_RNetUserEnum, True},
4619         {"RNetUserGetInfo",     RAP_WUserGetInfo,       api_RNetUserGetInfo},
4620         {"NetUserGetGroups",    RAP_WUserGetGroups,     api_NetUserGetGroups},
4621         {"NetWkstaGetInfo",     RAP_WWkstaGetInfo,      api_NetWkstaGetInfo},
4622         {"DosPrintQEnum",       RAP_WPrintQEnum,        api_DosPrintQEnum, True},
4623         {"DosPrintQGetInfo",    RAP_WPrintQGetInfo,     api_DosPrintQGetInfo},
4624         {"WPrintQueuePause",  RAP_WPrintQPause, api_WPrintQueueCtrl},
4625         {"WPrintQueueResume", RAP_WPrintQContinue,      api_WPrintQueueCtrl},
4626         {"WPrintJobEnumerate",RAP_WPrintJobEnum,        api_WPrintJobEnumerate},
4627         {"WPrintJobGetInfo",    RAP_WPrintJobGetInfo,   api_WPrintJobGetInfo},
4628         {"RDosPrintJobDel",     RAP_WPrintJobDel,       api_RDosPrintJobDel},
4629         {"RDosPrintJobPause",   RAP_WPrintJobPause,     api_RDosPrintJobDel},
4630         {"RDosPrintJobResume",RAP_WPrintJobContinue,    api_RDosPrintJobDel},
4631         {"WPrintDestEnum",      RAP_WPrintDestEnum,     api_WPrintDestEnum},
4632         {"WPrintDestGetInfo",   RAP_WPrintDestGetInfo,  api_WPrintDestGetInfo},
4633         {"NetRemoteTOD",        RAP_NetRemoteTOD,       api_NetRemoteTOD},
4634         {"WPrintQueuePurge",    RAP_WPrintQPurge,       api_WPrintQueueCtrl},
4635         {"NetServerEnum",       RAP_NetServerEnum2,     api_RNetServerEnum}, /* anon OK */
4636         {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
4637         {"SetUserPassword",     RAP_WUserPasswordSet2,  api_SetUserPassword},
4638         {"WWkstaUserLogon",     RAP_WWkstaUserLogon,    api_WWkstaUserLogon},
4639         {"PrintJobInfo",        RAP_WPrintJobSetInfo,   api_PrintJobInfo},
4640         {"WPrintDriverEnum",    RAP_WPrintDriverEnum,   api_WPrintDriverEnum},
4641         {"WPrintQProcEnum",     RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
4642         {"WPrintPortEnum",      RAP_WPrintPortEnum,     api_WPrintPortEnum},
4643         {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
4644         {NULL,          -1,     api_Unsupported}
4645         /*  The following RAP calls are not implemented by Samba:
4646
4647         RAP_WFileEnum2 - anon not OK
4648         */
4649 };
4650
4651
4652 /****************************************************************************
4653  Handle remote api calls.
4654 ****************************************************************************/
4655
4656 void api_reply(connection_struct *conn, uint16 vuid,
4657                struct smb_request *req,
4658                char *data, char *params,
4659                int tdscnt, int tpscnt,
4660                int mdrcnt, int mprcnt)
4661 {
4662         struct smbd_server_connection *sconn = smbd_server_conn;
4663         int api_command;
4664         char *rdata = NULL;
4665         char *rparam = NULL;
4666         const char *name1 = NULL;
4667         const char *name2 = NULL;
4668         int rdata_len = 0;
4669         int rparam_len = 0;
4670         bool reply=False;
4671         int i;
4672
4673         if (!params) {
4674                 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
4675                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4676                 return;
4677         }
4678
4679         if (tpscnt < 2) {
4680                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4681                 return;
4682         }
4683         api_command = SVAL(params,0);
4684         /* Is there a string at position params+2 ? */
4685         if (skip_string(params,tpscnt,params+2)) {
4686                 name1 = params + 2;
4687         } else {
4688                 name1 = "";
4689         }
4690         name2 = skip_string(params,tpscnt,params+2);
4691         if (!name2) {
4692                 name2 = "";
4693         }
4694
4695         DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
4696                 api_command,
4697                 name1,
4698                 name2,
4699                 tdscnt,tpscnt,mdrcnt,mprcnt));
4700
4701         for (i=0;api_commands[i].name;i++) {
4702                 if (api_commands[i].id == api_command && api_commands[i].fn) {
4703                         DEBUG(3,("Doing %s\n",api_commands[i].name));
4704                         break;
4705                 }
4706         }
4707
4708         /* Check whether this api call can be done anonymously */
4709
4710         if (api_commands[i].auth_user && lp_restrict_anonymous()) {
4711                 user_struct *user = get_valid_user_struct(sconn, vuid);
4712
4713                 if (!user || user->server_info->guest) {
4714                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4715                         return;
4716                 }
4717         }
4718
4719         rdata = (char *)SMB_MALLOC(1024);
4720         if (rdata) {
4721                 memset(rdata,'\0',1024);
4722         }
4723
4724         rparam = (char *)SMB_MALLOC(1024);
4725         if (rparam) {
4726                 memset(rparam,'\0',1024);
4727         }
4728
4729         if(!rdata || !rparam) {
4730                 DEBUG(0,("api_reply: malloc fail !\n"));
4731                 SAFE_FREE(rdata);
4732                 SAFE_FREE(rparam);
4733                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4734                 return;
4735         }
4736
4737         reply = api_commands[i].fn(conn,
4738                                 vuid,
4739                                 params,tpscnt,  /* params + length */
4740                                 data,tdscnt,    /* data + length */
4741                                 mdrcnt,mprcnt,
4742                                 &rdata,&rparam,&rdata_len,&rparam_len);
4743
4744
4745         if (rdata_len > mdrcnt || rparam_len > mprcnt) {
4746                 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
4747                                         &rdata,&rparam,&rdata_len,&rparam_len);
4748         }
4749
4750         /* if we get False back then it's actually unsupported */
4751         if (!reply) {
4752                 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
4753                         &rdata,&rparam,&rdata_len,&rparam_len);
4754         }
4755
4756         /* If api_Unsupported returns false we can't return anything. */
4757         if (reply) {
4758                 send_trans_reply(conn, req, rparam, rparam_len,
4759                                  rdata, rdata_len, False);
4760         }
4761
4762         SAFE_FREE(rdata);
4763         SAFE_FREE(rparam);
4764         return;
4765 }