source3/smbd/lanman.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Inter-process communication and named pipe handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Jeremy Allison 2007.
   6
   7    SMB Version handling
   8    Copyright (C) John H Terpstra 1995-1998
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22    */
  23 /*
  24    This file handles the named pipe and mailslot calls
  25    in the SMBtrans protocol
  26    */
  27
  28 #include "includes.h"
  29
  30 #ifdef CHECK_TYPES
  31 #undef CHECK_TYPES
  32 #endif
  33 #define CHECK_TYPES 0
  34
  35 #define NERR_Success 0
  36 #define NERR_badpass 86
  37 #define NERR_notsupported 50
  38
  39 #define NERR_BASE (2100)
  40 #define NERR_BufTooSmall (NERR_BASE+23)
  41 #define NERR_JobNotFound (NERR_BASE+51)
  42 #define NERR_DestNotFound (NERR_BASE+52)
  43
  44 #define ACCESS_READ 0x01
  45 #define ACCESS_WRITE 0x02
  46 #define ACCESS_CREATE 0x04
  47
  48 #define SHPWLEN 8               /* share password length */
  49
  50 /* Limit size of ipc replies */
  51
  52 static char *smb_realloc_limit(void *ptr, size_t size)
  53 {
  54         char *val;
  55
  56         size = MAX((size),4*1024);
  57         val = (char *)SMB_REALLOC(ptr,size);
  58         if (val) {
  59                 memset(val,'\0',size);
  60         }
  61         return val;
  62 }
  63
  64 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
  65                                 char *param, int tpscnt,
  66                                 char *data, int tdscnt,
  67                                 int mdrcnt, int mprcnt,
  68                                 char **rdata, char **rparam,
  69                                 int *rdata_len, int *rparam_len);
  70
  71 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
  72                          int mdrcnt, int mprcnt,
  73                          char **rdata, char **rparam,
  74                          int *rdata_len, int *rparam_len);
  75
  76
  77 static int CopyExpanded(connection_struct *conn,
  78                         int snum, char **dst, char *src, int *p_space_remaining)
  79 {
  80         TALLOC_CTX *ctx = talloc_tos();
  81         char *buf = NULL;
  82         int l;
  83
  84         if (!src || !dst || !p_space_remaining || !(*dst) ||
  85                         *p_space_remaining <= 0) {
  86                 return 0;
  87         }
  88
  89         buf = talloc_strdup(ctx, src);
  90         if (!buf) {
  91                 *p_space_remaining = 0;
  92                 return 0;
  93         }
  94         buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
  95         if (!buf) {
  96                 *p_space_remaining = 0;
  97                 return 0;
  98         }
  99         buf = talloc_sub_advanced(ctx,
 100                                 lp_servicename(SNUM(conn)),
 101                                 conn->server_info->unix_name,
 102                                 conn->connectpath,
 103                                 conn->server_info->utok.gid,
 104                                 conn->server_info->sanitized_username,
 105                                 pdb_get_domain(conn->server_info->sam_account),
 106                                 buf);
 107         if (!buf) {
 108                 *p_space_remaining = 0;
 109                 return 0;
 110         }
 111         l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
 112         if (l == -1) {
 113                 return 0;
 114         }
 115         (*dst) += l;
 116         (*p_space_remaining) -= l;
 117         return l;
 118 }
 119
 120 static int CopyAndAdvance(char **dst, char *src, int *n)
 121 {
 122         int l;
 123         if (!src || !dst || !n || !(*dst)) {
 124                 return 0;
 125         }
 126         l = push_ascii(*dst,src,*n, STR_TERMINATE);
 127         if (l == -1) {
 128                 return 0;
 129         }
 130         (*dst) += l;
 131         (*n) -= l;
 132         return l;
 133 }
 134
 135 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
 136 {
 137         TALLOC_CTX *ctx = talloc_tos();
 138         char *buf = NULL;
 139         if (!s) {
 140                 return 0;
 141         }
 142         buf = talloc_strdup(ctx,s);
 143         if (!buf) {
 144                 return 0;
 145         }
 146         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 147         if (!buf) {
 148                 return 0;
 149         }
 150         buf = talloc_sub_advanced(ctx,
 151                                 lp_servicename(SNUM(conn)),
 152                                 conn->server_info->unix_name,
 153                                 conn->connectpath,
 154                                 conn->server_info->utok.gid,
 155                                 conn->server_info->sanitized_username,
 156                                 pdb_get_domain(conn->server_info->sam_account),
 157                                 buf);
 158         if (!buf) {
 159                 return 0;
 160         }
 161         return strlen(buf) + 1;
 162 }
 163
 164 static char *Expand(connection_struct *conn, int snum, char *s)
 165 {
 166         TALLOC_CTX *ctx = talloc_tos();
 167         char *buf = NULL;
 168
 169         if (!s) {
 170                 return NULL;
 171         }
 172         buf = talloc_strdup(ctx,s);
 173         if (!buf) {
 174                 return 0;
 175         }
 176         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 177         if (!buf) {
 178                 return 0;
 179         }
 180         return talloc_sub_advanced(ctx,
 181                                 lp_servicename(SNUM(conn)),
 182                                 conn->server_info->unix_name,
 183                                 conn->connectpath,
 184                                 conn->server_info->utok.gid,
 185                                 conn->server_info->sanitized_username,
 186                                 pdb_get_domain(conn->server_info->sam_account),
 187                                 buf);
 188 }
 189
 190 /*******************************************************************
 191  Check a API string for validity when we only need to check the prefix.
 192 ******************************************************************/
 193
 194 static bool prefix_ok(const char *str, const char *prefix)
 195 {
 196         return(strncmp(str,prefix,strlen(prefix)) == 0);
 197 }
 198
 199 struct pack_desc {
 200         const char *format;         /* formatstring for structure */
 201         const char *subformat;  /* subformat for structure */
 202         char *base;         /* baseaddress of buffer */
 203         int buflen;        /* remaining size for fixed part; on init: length of base */
 204         int subcount;       /* count of substructures */
 205         char *structbuf;  /* pointer into buffer for remaining fixed part */
 206         int stringlen;    /* remaining size for variable part */
 207         char *stringbuf;  /* pointer into buffer for remaining variable part */
 208         int neededlen;    /* total needed size */
 209         int usedlen;        /* total used size (usedlen <= neededlen and usedlen <= buflen) */
 210         const char *curpos;         /* current position; pointer into format or subformat */
 211         int errcode;
 212 };
 213
 214 static int get_counter(const char **p)
 215 {
 216         int i, n;
 217         if (!p || !(*p)) {
 218                 return 1;
 219         }
 220         if (!isdigit((int)**p)) {
 221                 return 1;
 222         }
 223         for (n = 0;;) {
 224                 i = **p;
 225                 if (isdigit(i)) {
 226                         n = 10 * n + (i - '0');
 227                 } else {
 228                         return n;
 229                 }
 230                 (*p)++;
 231         }
 232 }
 233
 234 static int getlen(const char *p)
 235 {
 236         int n = 0;
 237         if (!p) {
 238                 return 0;
 239         }
 240
 241         while (*p) {
 242                 switch( *p++ ) {
 243                 case 'W':                       /* word (2 byte) */
 244                         n += 2;
 245                         break;
 246                 case 'K':                       /* status word? (2 byte) */
 247                         n += 2;
 248                         break;
 249                 case 'N':                       /* count of substructures (word) at end */
 250                         n += 2;
 251                         break;
 252                 case 'D':                       /* double word (4 byte) */
 253                 case 'z':                       /* offset to zero terminated string (4 byte) */
 254                 case 'l':                       /* offset to user data (4 byte) */
 255                         n += 4;
 256                         break;
 257                 case 'b':                       /* offset to data (with counter) (4 byte) */
 258                         n += 4;
 259                         get_counter(&p);
 260                         break;
 261                 case 'B':                       /* byte (with optional counter) */
 262                         n += get_counter(&p);
 263                         break;
 264                 }
 265         }
 266         return n;
 267 }
 268
 269 static bool init_package(struct pack_desc *p, int count, int subcount)
 270 {
 271         int n = p->buflen;
 272         int i;
 273
 274         if (!p->format || !p->base) {
 275                 return False;
 276         }
 277
 278         i = count * getlen(p->format);
 279         if (p->subformat) {
 280                 i += subcount * getlen(p->subformat);
 281         }
 282         p->structbuf = p->base;
 283         p->neededlen = 0;
 284         p->usedlen = 0;
 285         p->subcount = 0;
 286         p->curpos = p->format;
 287         if (i > n) {
 288                 p->neededlen = i;
 289                 i = n = 0;
 290 #if 0
 291                 /*
 292                  * This is the old error code we used. Aparently
 293                  * WinNT/2k systems return ERRbuftoosmall (2123) and
 294                  * OS/2 needs this. I'm leaving this here so we can revert
 295                  * if needed. JRA.
 296                  */
 297                 p->errcode = ERRmoredata;
 298 #else
 299                 p->errcode = ERRbuftoosmall;
 300 #endif
 301         } else {
 302                 p->errcode = NERR_Success;
 303         }
 304         p->buflen = i;
 305         n -= i;
 306         p->stringbuf = p->base + i;
 307         p->stringlen = n;
 308         return (p->errcode == NERR_Success);
 309 }
 310
 311 static int package(struct pack_desc *p, ...)
 312 {
 313         va_list args;
 314         int needed=0, stringneeded;
 315         const char *str=NULL;
 316         int is_string=0, stringused;
 317         int32 temp;
 318
 319         va_start(args,p);
 320
 321         if (!*p->curpos) {
 322                 if (!p->subcount) {
 323                         p->curpos = p->format;
 324                 } else {
 325                         p->curpos = p->subformat;
 326                         p->subcount--;
 327                 }
 328         }
 329 #if CHECK_TYPES
 330         str = va_arg(args,char*);
 331         SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
 332 #endif
 333         stringneeded = -1;
 334
 335         if (!p->curpos) {
 336                 va_end(args);
 337                 return 0;
 338         }
 339
 340         switch( *p->curpos++ ) {
 341                 case 'W':                       /* word (2 byte) */
 342                         needed = 2;
 343                         temp = va_arg(args,int);
 344                         if (p->buflen >= needed) {
 345                                 SSVAL(p->structbuf,0,temp);
 346                         }
 347                         break;
 348                 case 'K':                       /* status word? (2 byte) */
 349                         needed = 2;
 350                         temp = va_arg(args,int);
 351                         if (p->buflen >= needed) {
 352                                 SSVAL(p->structbuf,0,temp);
 353                         }
 354                         break;
 355                 case 'N':                       /* count of substructures (word) at end */
 356                         needed = 2;
 357                         p->subcount = va_arg(args,int);
 358                         if (p->buflen >= needed) {
 359                                 SSVAL(p->structbuf,0,p->subcount);
 360                         }
 361                         break;
 362                 case 'D':                       /* double word (4 byte) */
 363                         needed = 4;
 364                         temp = va_arg(args,int);
 365                         if (p->buflen >= needed) {
 366                                 SIVAL(p->structbuf,0,temp);
 367                         }
 368                         break;
 369                 case 'B':                       /* byte (with optional counter) */
 370                         needed = get_counter(&p->curpos);
 371                         {
 372                                 char *s = va_arg(args,char*);
 373                                 if (p->buflen >= needed) {
 374                                         StrnCpy(p->structbuf,s?s:"",needed-1);
 375                                 }
 376                         }
 377                         break;
 378                 case 'z':                       /* offset to zero terminated string (4 byte) */
 379                         str = va_arg(args,char*);
 380                         stringneeded = (str ? strlen(str)+1 : 0);
 381                         is_string = 1;
 382                         break;
 383                 case 'l':                       /* offset to user data (4 byte) */
 384                         str = va_arg(args,char*);
 385                         stringneeded = va_arg(args,int);
 386                         is_string = 0;
 387                         break;
 388                 case 'b':                       /* offset to data (with counter) (4 byte) */
 389                         str = va_arg(args,char*);
 390                         stringneeded = get_counter(&p->curpos);
 391                         is_string = 0;
 392                         break;
 393         }
 394
 395         va_end(args);
 396         if (stringneeded >= 0) {
 397                 needed = 4;
 398                 if (p->buflen >= needed) {
 399                         stringused = stringneeded;
 400                         if (stringused > p->stringlen) {
 401                                 stringused = (is_string ? p->stringlen : 0);
 402                                 if (p->errcode == NERR_Success) {
 403                                         p->errcode = ERRmoredata;
 404                                 }
 405                         }
 406                         if (!stringused) {
 407                                 SIVAL(p->structbuf,0,0);
 408                         } else {
 409                                 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
 410                                 memcpy(p->stringbuf,str?str:"",stringused);
 411                                 if (is_string) {
 412                                         p->stringbuf[stringused-1] = '\0';
 413                                 }
 414                                 p->stringbuf += stringused;
 415                                 p->stringlen -= stringused;
 416                                 p->usedlen += stringused;
 417                         }
 418                 }
 419                 p->neededlen += stringneeded;
 420         }
 421
 422         p->neededlen += needed;
 423         if (p->buflen >= needed) {
 424                 p->structbuf += needed;
 425                 p->buflen -= needed;
 426                 p->usedlen += needed;
 427         } else {
 428                 if (p->errcode == NERR_Success) {
 429                         p->errcode = ERRmoredata;
 430                 }
 431         }
 432         return 1;
 433 }
 434
 435 #if CHECK_TYPES
 436 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
 437 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
 438 #else
 439 #define PACK(desc,t,v) package(desc,v)
 440 #define PACKl(desc,t,v,l) package(desc,v,l)
 441 #endif
 442
 443 static void PACKI(struct pack_desc* desc, const char *t,int v)
 444 {
 445         PACK(desc,t,v);
 446 }
 447
 448 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
 449 {
 450         PACK(desc,t,v);
 451 }
 452
 453 /****************************************************************************
 454  Get a print queue.
 455 ****************************************************************************/
 456
 457 static void PackDriverData(struct pack_desc* desc)
 458 {
 459         char drivdata[4+4+32];
 460         SIVAL(drivdata,0,sizeof drivdata); /* cb */
 461         SIVAL(drivdata,4,1000); /* lVersion */
 462         memset(drivdata+8,0,32);        /* szDeviceName */
 463         push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
 464         PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
 465 }
 466
 467 static int check_printq_info(struct pack_desc* desc,
 468                                 unsigned int uLevel, char *id1, char *id2)
 469 {
 470         desc->subformat = NULL;
 471         switch( uLevel ) {
 472                 case 0:
 473                         desc->format = "B13";
 474                         break;
 475                 case 1:
 476                         desc->format = "B13BWWWzzzzzWW";
 477                         break;
 478                 case 2:
 479                         desc->format = "B13BWWWzzzzzWN";
 480                         desc->subformat = "WB21BB16B10zWWzDDz";
 481                         break;
 482                 case 3:
 483                         desc->format = "zWWWWzzzzWWzzl";
 484                         break;
 485                 case 4:
 486                         desc->format = "zWWWWzzzzWNzzl";
 487                         desc->subformat = "WWzWWDDzz";
 488                         break;
 489                 case 5:
 490                         desc->format = "z";
 491                         break;
 492                 case 51:
 493                         desc->format = "K";
 494                         break;
 495                 case 52:
 496                         desc->format = "WzzzzzzzzN";
 497                         desc->subformat = "z";
 498                         break;
 499                 default:
 500                         DEBUG(0,("check_printq_info: invalid level %d\n",
 501                                 uLevel ));
 502                         return False;
 503         }
 504         if (id1 == NULL || strcmp(desc->format,id1) != 0) {
 505                 DEBUG(0,("check_printq_info: invalid format %s\n",
 506                         id1 ? id1 : "<NULL>" ));
 507                 return False;
 508         }
 509         if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
 510                 DEBUG(0,("check_printq_info: invalid subformat %s\n",
 511                         id2 ? id2 : "<NULL>" ));
 512                 return False;
 513         }
 514         return True;
 515 }
 516
 517
 518 #define RAP_JOB_STATUS_QUEUED 0
 519 #define RAP_JOB_STATUS_PAUSED 1
 520 #define RAP_JOB_STATUS_SPOOLING 2
 521 #define RAP_JOB_STATUS_PRINTING 3
 522 #define RAP_JOB_STATUS_PRINTED 4
 523
 524 #define RAP_QUEUE_STATUS_PAUSED 1
 525 #define RAP_QUEUE_STATUS_ERROR 2
 526
 527 /* turn a print job status into a on the wire status
 528 */
 529 static int printj_status(int v)
 530 {
 531         switch (v) {
 532         case LPQ_QUEUED:
 533                 return RAP_JOB_STATUS_QUEUED;
 534         case LPQ_PAUSED:
 535                 return RAP_JOB_STATUS_PAUSED;
 536         case LPQ_SPOOLING:
 537                 return RAP_JOB_STATUS_SPOOLING;
 538         case LPQ_PRINTING:
 539                 return RAP_JOB_STATUS_PRINTING;
 540         }
 541         return 0;
 542 }
 543
 544 /* turn a print queue status into a on the wire status
 545 */
 546 static int printq_status(int v)
 547 {
 548         switch (v) {
 549         case LPQ_QUEUED:
 550                 return 0;
 551         case LPQ_PAUSED:
 552                 return RAP_QUEUE_STATUS_PAUSED;
 553         }
 554         return RAP_QUEUE_STATUS_ERROR;
 555 }
 556
 557 static void fill_printjob_info(connection_struct *conn, int snum, int uLevel,
 558                                struct pack_desc *desc,
 559                                print_queue_struct *queue, int n)
 560 {
 561         time_t t = queue->time;
 562
 563         /* the client expects localtime */
 564         t -= get_time_zone(t);
 565
 566         PACKI(desc,"W",pjobid_to_rap(lp_const_servicename(snum),queue->job)); /* uJobId */
 567         if (uLevel == 1) {
 568                 PACKS(desc,"B21",queue->fs_user); /* szUserName */
 569                 PACKS(desc,"B","");             /* pad */
 570                 PACKS(desc,"B16","");   /* szNotifyName */
 571                 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
 572                 PACKS(desc,"z","");             /* pszParms */
 573                 PACKI(desc,"W",n+1);            /* uPosition */
 574                 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
 575                 PACKS(desc,"z","");             /* pszStatus */
 576                 PACKI(desc,"D",t); /* ulSubmitted */
 577                 PACKI(desc,"D",queue->size); /* ulSize */
 578                 PACKS(desc,"z",queue->fs_file); /* pszComment */
 579         }
 580         if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
 581                 PACKI(desc,"W",queue->priority);                /* uPriority */
 582                 PACKS(desc,"z",queue->fs_user); /* pszUserName */
 583                 PACKI(desc,"W",n+1);            /* uPosition */
 584                 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
 585                 PACKI(desc,"D",t); /* ulSubmitted */
 586                 PACKI(desc,"D",queue->size); /* ulSize */
 587                 PACKS(desc,"z","Samba");        /* pszComment */
 588                 PACKS(desc,"z",queue->fs_file); /* pszDocument */
 589                 if (uLevel == 3) {
 590                         PACKS(desc,"z","");     /* pszNotifyName */
 591                         PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
 592                         PACKS(desc,"z","");     /* pszParms */
 593                         PACKS(desc,"z","");     /* pszStatus */
 594                         PACKS(desc,"z",SERVICE(snum)); /* pszQueue */
 595                         PACKS(desc,"z","lpd");  /* pszQProcName */
 596                         PACKS(desc,"z","");     /* pszQProcParms */
 597                         PACKS(desc,"z","NULL"); /* pszDriverName */
 598                         PackDriverData(desc);   /* pDriverData */
 599                         PACKS(desc,"z","");     /* pszPrinterName */
 600                 } else if (uLevel == 4) {   /* OS2 */
 601                         PACKS(desc,"z","");       /* pszSpoolFileName  */
 602                         PACKS(desc,"z","");       /* pszPortName       */
 603                         PACKS(desc,"z","");       /* pszStatus         */
 604                         PACKI(desc,"D",0);        /* ulPagesSpooled    */
 605                         PACKI(desc,"D",0);        /* ulPagesSent       */
 606                         PACKI(desc,"D",0);        /* ulPagesPrinted    */
 607                         PACKI(desc,"D",0);        /* ulTimePrinted     */
 608                         PACKI(desc,"D",0);        /* ulExtendJobStatus */
 609                         PACKI(desc,"D",0);        /* ulStartPage       */
 610                         PACKI(desc,"D",0);        /* ulEndPage         */
 611                 }
 612         }
 613 }
 614
 615 /********************************************************************
 616  Return a driver name given an snum.
 617  Returns True if from tdb, False otherwise.
 618  ********************************************************************/
 619
 620 static bool get_driver_name(int snum, char **pp_drivername)
 621 {
 622         NT_PRINTER_INFO_LEVEL *info = NULL;
 623         bool in_tdb = false;
 624
 625         get_a_printer (NULL, &info, 2, lp_servicename(snum));
 626         if (info != NULL) {
 627                 *pp_drivername = talloc_strdup(talloc_tos(),
 628                                         info->info_2->drivername);
 629                 in_tdb = true;
 630                 free_a_printer(&info, 2);
 631                 if (!*pp_drivername) {
 632                         return false;
 633                 }
 634         }
 635
 636         return in_tdb;
 637 }
 638
 639 /********************************************************************
 640  Respond to the DosPrintQInfo command with a level of 52
 641  This is used to get printer driver information for Win9x clients
 642  ********************************************************************/
 643 static void fill_printq_info_52(connection_struct *conn, int snum,
 644                                 struct pack_desc* desc, int count )
 645 {
 646         int                             i;
 647         fstring                         location;
 648         NT_PRINTER_DRIVER_INFO_LEVEL    driver;
 649         NT_PRINTER_INFO_LEVEL           *printer = NULL;
 650
 651         ZERO_STRUCT(driver);
 652
 653         if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
 654                 DEBUG(3,("fill_printq_info_52: Failed to lookup printer [%s]\n",
 655                         lp_servicename(snum)));
 656                 goto err;
 657         }
 658
 659         if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
 660                 "Windows 4.0", 0)) )
 661         {
 662                 DEBUG(3,("fill_printq_info_52: Failed to lookup driver [%s]\n",
 663                         printer->info_2->drivername));
 664                 goto err;
 665         }
 666
 667         trim_string(driver.info_3->driverpath, "\\print$\\WIN40\\0\\", 0);
 668         trim_string(driver.info_3->datafile, "\\print$\\WIN40\\0\\", 0);
 669         trim_string(driver.info_3->helpfile, "\\print$\\WIN40\\0\\", 0);
 670
 671         PACKI(desc, "W", 0x0400);                     /* don't know */
 672         PACKS(desc, "z", driver.info_3->name);        /* long printer name */
 673         PACKS(desc, "z", driver.info_3->driverpath);  /* Driverfile Name */
 674         PACKS(desc, "z", driver.info_3->datafile);    /* Datafile name */
 675         PACKS(desc, "z", driver.info_3->monitorname); /* language monitor */
 676
 677         fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
 678         standard_sub_basic( "", "", location, sizeof(location)-1 );
 679         PACKS(desc,"z", location);                          /* share to retrieve files */
 680
 681         PACKS(desc,"z", driver.info_3->defaultdatatype);    /* default data type */
 682         PACKS(desc,"z", driver.info_3->helpfile);           /* helpfile name */
 683         PACKS(desc,"z", driver.info_3->driverpath);               /* driver name */
 684
 685         DEBUG(3,("Printer Driver Name: %s:\n",driver.info_3->name));
 686         DEBUG(3,("Driver: %s:\n",driver.info_3->driverpath));
 687         DEBUG(3,("Data File: %s:\n",driver.info_3->datafile));
 688         DEBUG(3,("Language Monitor: %s:\n",driver.info_3->monitorname));
 689         DEBUG(3,("Driver Location: %s:\n",location));
 690         DEBUG(3,("Data Type: %s:\n",driver.info_3->defaultdatatype));
 691         DEBUG(3,("Help File: %s:\n",driver.info_3->helpfile));
 692         PACKI(desc,"N",count);                     /* number of files to copy */
 693
 694         for ( i=0; i<count && driver.info_3->dependentfiles && *driver.info_3->dependentfiles[i]; i++)
 695         {
 696                 trim_string(driver.info_3->dependentfiles[i], "\\print$\\WIN40\\0\\", 0);
 697                 PACKS(desc,"z",driver.info_3->dependentfiles[i]);         /* driver files to copy */
 698                 DEBUG(3,("Dependent File: %s:\n",driver.info_3->dependentfiles[i]));
 699         }
 700
 701         /* sanity check */
 702         if ( i != count )
 703                 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
 704                         count, i));
 705
 706         DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", SERVICE(snum),i));
 707
 708         desc->errcode=NERR_Success;
 709         goto done;
 710
 711 err:
 712         DEBUG(3,("fill_printq_info: Can't supply driver files\n"));
 713         desc->errcode=NERR_notsupported;
 714
 715 done:
 716         if ( printer )
 717                 free_a_printer( &printer, 2 );
 718
 719         if ( driver.info_3 )
 720                 free_a_printer_driver( driver, 3 );
 721 }
 722
 723
 724 static void fill_printq_info(connection_struct *conn, int snum, int uLevel,
 725                              struct pack_desc* desc,
 726                              int count, print_queue_struct* queue,
 727                              print_status_struct* status)
 728 {
 729         switch (uLevel) {
 730         case 1:
 731         case 2:
 732                 PACKS(desc,"B13",SERVICE(snum));
 733                 break;
 734         case 3:
 735         case 4:
 736         case 5:
 737                 PACKS(desc,"z",Expand(conn,snum,SERVICE(snum)));
 738                 break;
 739         case 51:
 740                 PACKI(desc,"K",printq_status(status->status));
 741                 break;
 742         }
 743
 744         if (uLevel == 1 || uLevel == 2) {
 745                 PACKS(desc,"B","");             /* alignment */
 746                 PACKI(desc,"W",5);              /* priority */
 747                 PACKI(desc,"W",0);              /* start time */
 748                 PACKI(desc,"W",0);              /* until time */
 749                 PACKS(desc,"z","");             /* pSepFile */
 750                 PACKS(desc,"z","lpd");  /* pPrProc */
 751                 PACKS(desc,"z",SERVICE(snum)); /* pDestinations */
 752                 PACKS(desc,"z","");             /* pParms */
 753                 if (snum < 0) {
 754                         PACKS(desc,"z","UNKNOWN PRINTER");
 755                         PACKI(desc,"W",LPSTAT_ERROR);
 756                 }
 757                 else if (!status || !status->message[0]) {
 758                         PACKS(desc,"z",Expand(conn,snum,lp_comment(snum)));
 759                         PACKI(desc,"W",LPSTAT_OK); /* status */
 760                 } else {
 761                         PACKS(desc,"z",status->message);
 762                         PACKI(desc,"W",printq_status(status->status)); /* status */
 763                 }
 764                 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
 765         }
 766
 767         if (uLevel == 3 || uLevel == 4) {
 768                 char *drivername = NULL;
 769
 770                 PACKI(desc,"W",5);              /* uPriority */
 771                 PACKI(desc,"W",0);              /* uStarttime */
 772                 PACKI(desc,"W",0);              /* uUntiltime */
 773                 PACKI(desc,"W",5);              /* pad1 */
 774                 PACKS(desc,"z","");             /* pszSepFile */
 775                 PACKS(desc,"z","WinPrint");     /* pszPrProc */
 776                 PACKS(desc,"z",NULL);           /* pszParms */
 777                 PACKS(desc,"z",NULL);           /* pszComment - don't ask.... JRA */
 778                 /* "don't ask" that it's done this way to fix corrupted
 779                    Win9X/ME printer comments. */
 780                 if (!status) {
 781                         PACKI(desc,"W",LPSTAT_OK); /* fsStatus */
 782                 } else {
 783                         PACKI(desc,"W",printq_status(status->status)); /* fsStatus */
 784                 }
 785                 PACKI(desc,(uLevel == 3 ? "W" : "N"),count);    /* cJobs */
 786                 PACKS(desc,"z",SERVICE(snum)); /* pszPrinters */
 787                 get_driver_name(snum,&drivername);
 788                 if (!drivername) {
 789                         return;
 790                 }
 791                 PACKS(desc,"z",drivername);             /* pszDriverName */
 792                 PackDriverData(desc);   /* pDriverData */
 793         }
 794
 795         if (uLevel == 2 || uLevel == 4) {
 796                 int i;
 797                 for (i=0;i<count;i++)
 798                         fill_printjob_info(conn,snum,uLevel == 2 ? 1 : 2,desc,&queue[i],i);
 799         }
 800
 801         if (uLevel==52)
 802                 fill_printq_info_52( conn, snum, desc, count );
 803 }
 804
 805 /* This function returns the number of files for a given driver */
 806 static int get_printerdrivernumber(int snum)
 807 {
 808         int                             result = 0;
 809         NT_PRINTER_DRIVER_INFO_LEVEL    driver;
 810         NT_PRINTER_INFO_LEVEL           *printer = NULL;
 811
 812         ZERO_STRUCT(driver);
 813
 814         if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
 815                 DEBUG(3,("get_printerdrivernumber: Failed to lookup printer [%s]\n",
 816                         lp_servicename(snum)));
 817                 goto done;
 818         }
 819
 820         if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
 821                 "Windows 4.0", 0)) )
 822         {
 823                 DEBUG(3,("get_printerdrivernumber: Failed to lookup driver [%s]\n",
 824                         printer->info_2->drivername));
 825                 goto done;
 826         }
 827
 828         /* count the number of files */
 829         while ( driver.info_3->dependentfiles && *driver.info_3->dependentfiles[result] )
 830                         result++;
 831                         \
 832  done:
 833         if ( printer )
 834                 free_a_printer( &printer, 2 );
 835
 836         if ( driver.info_3 )
 837                 free_a_printer_driver( driver, 3 );
 838
 839         return result;
 840 }
 841
 842 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
 843                                 char *param, int tpscnt,
 844                                 char *data, int tdscnt,
 845                                 int mdrcnt,int mprcnt,
 846                                 char **rdata,char **rparam,
 847                                 int *rdata_len,int *rparam_len)
 848 {
 849         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
 850         char *str2 = skip_string(param,tpscnt,str1);
 851         char *p = skip_string(param,tpscnt,str2);
 852         char *QueueName = p;
 853         unsigned int uLevel;
 854         int count=0;
 855         int snum;
 856         char *str3;
 857         struct pack_desc desc;
 858         print_queue_struct *queue=NULL;
 859         print_status_struct status;
 860         char* tmpdata=NULL;
 861
 862         if (!str1 || !str2 || !p) {
 863                 return False;
 864         }
 865         memset((char *)&status,'\0',sizeof(status));
 866         memset((char *)&desc,'\0',sizeof(desc));
 867
 868         p = skip_string(param,tpscnt,p);
 869         if (!p) {
 870                 return False;
 871         }
 872         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 873         str3 = get_safe_str_ptr(param,tpscnt,p,4);
 874         /* str3 may be null here and is checked in check_printq_info(). */
 875
 876         /* remove any trailing username */
 877         if ((p = strchr_m(QueueName,'%')))
 878                 *p = 0;
 879
 880         DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
 881
 882         /* check it's a supported varient */
 883         if (!prefix_ok(str1,"zWrLh"))
 884                 return False;
 885         if (!check_printq_info(&desc,uLevel,str2,str3)) {
 886                 /*
 887                  * Patch from Scott Moomaw <scott@bridgewater.edu>
 888                  * to return the 'invalid info level' error if an
 889                  * unknown level was requested.
 890                  */
 891                 *rdata_len = 0;
 892                 *rparam_len = 6;
 893                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
 894                 if (!*rparam) {
 895                         return False;
 896                 }
 897                 SSVALS(*rparam,0,ERRunknownlevel);
 898                 SSVAL(*rparam,2,0);
 899                 SSVAL(*rparam,4,0);
 900                 return(True);
 901         }
 902
 903         snum = find_service(QueueName);
 904         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) )
 905                 return False;
 906
 907         if (uLevel==52) {
 908                 count = get_printerdrivernumber(snum);
 909                 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
 910         } else {
 911                 count = print_queue_status(snum, &queue,&status);
 912         }
 913
 914         if (mdrcnt > 0) {
 915                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
 916                 if (!*rdata) {
 917                         SAFE_FREE(queue);
 918                         return False;
 919                 }
 920                 desc.base = *rdata;
 921                 desc.buflen = mdrcnt;
 922         } else {
 923                 /*
 924                  * Don't return data but need to get correct length
 925                  * init_package will return wrong size if buflen=0
 926                  */
 927                 desc.buflen = getlen(desc.format);
 928                 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
 929         }
 930
 931         if (init_package(&desc,1,count)) {
 932                 desc.subcount = count;
 933                 fill_printq_info(conn,snum,uLevel,&desc,count,queue,&status);
 934         }
 935
 936         *rdata_len = desc.usedlen;
 937
 938         /*
 939          * We must set the return code to ERRbuftoosmall
 940          * in order to support lanman style printing with Win NT/2k
 941          * clients       --jerry
 942          */
 943         if (!mdrcnt && lp_disable_spoolss())
 944                 desc.errcode = ERRbuftoosmall;
 945
 946         *rdata_len = desc.usedlen;
 947         *rparam_len = 6;
 948         *rparam = smb_realloc_limit(*rparam,*rparam_len);
 949         if (!*rparam) {
 950                 SAFE_FREE(queue);
 951                 SAFE_FREE(tmpdata);
 952                 return False;
 953         }
 954         SSVALS(*rparam,0,desc.errcode);
 955         SSVAL(*rparam,2,0);
 956         SSVAL(*rparam,4,desc.neededlen);
 957
 958         DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
 959
 960         SAFE_FREE(queue);
 961         SAFE_FREE(tmpdata);
 962
 963         return(True);
 964 }
 965
 966 /****************************************************************************
 967  View list of all print jobs on all queues.
 968 ****************************************************************************/
 969
 970 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
 971                                 char *param, int tpscnt,
 972                                 char *data, int tdscnt,
 973                                 int mdrcnt, int mprcnt,
 974                                 char **rdata, char** rparam,
 975                                 int *rdata_len, int *rparam_len)
 976 {
 977         char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
 978         char *output_format1 = skip_string(param,tpscnt,param_format);
 979         char *p = skip_string(param,tpscnt,output_format1);
 980         unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 981         char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
 982         int services = lp_numservices();
 983         int i, n;
 984         struct pack_desc desc;
 985         print_queue_struct **queue = NULL;
 986         print_status_struct *status = NULL;
 987         int *subcntarr = NULL;
 988         int queuecnt = 0, subcnt = 0, succnt = 0;
 989
 990         if (!param_format || !output_format1 || !p) {
 991                 return False;
 992         }
 993
 994         memset((char *)&desc,'\0',sizeof(desc));
 995
 996         DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
 997
 998         if (!prefix_ok(param_format,"WrLeh")) {
 999                 return False;
1000         }
1001         if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1002                 /*
1003                  * Patch from Scott Moomaw <scott@bridgewater.edu>
1004                  * to return the 'invalid info level' error if an
1005                  * unknown level was requested.
1006                  */
1007                 *rdata_len = 0;
1008                 *rparam_len = 6;
1009                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1010                 if (!*rparam) {
1011                         return False;
1012                 }
1013                 SSVALS(*rparam,0,ERRunknownlevel);
1014                 SSVAL(*rparam,2,0);
1015                 SSVAL(*rparam,4,0);
1016                 return(True);
1017         }
1018
1019         for (i = 0; i < services; i++) {
1020                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1021                         queuecnt++;
1022                 }
1023         }
1024
1025         if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
1026                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1027                 goto err;
1028         }
1029         memset(queue,0,queuecnt*sizeof(print_queue_struct*));
1030         if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
1031                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1032                 goto err;
1033         }
1034         memset(status,0,queuecnt*sizeof(print_status_struct));
1035         if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1036                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1037                 goto err;
1038         }
1039
1040         subcnt = 0;
1041         n = 0;
1042         for (i = 0; i < services; i++) {
1043                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1044                         subcntarr[n] = print_queue_status(i, &queue[n],&status[n]);
1045                         subcnt += subcntarr[n];
1046                         n++;
1047                 }
1048         }
1049
1050         if (mdrcnt > 0) {
1051                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1052                 if (!*rdata) {
1053                         goto err;
1054                 }
1055         }
1056         desc.base = *rdata;
1057         desc.buflen = mdrcnt;
1058
1059         if (init_package(&desc,queuecnt,subcnt)) {
1060                 n = 0;
1061                 succnt = 0;
1062                 for (i = 0; i < services; i++) {
1063                         if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1064                                 fill_printq_info(conn,i,uLevel,&desc,subcntarr[n],queue[n],&status[n]);
1065                                 n++;
1066                                 if (desc.errcode == NERR_Success) {
1067                                         succnt = n;
1068                                 }
1069                         }
1070                 }
1071         }
1072
1073         SAFE_FREE(subcntarr);
1074
1075         *rdata_len = desc.usedlen;
1076         *rparam_len = 8;
1077         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1078         if (!*rparam) {
1079                 goto err;
1080         }
1081         SSVALS(*rparam,0,desc.errcode);
1082         SSVAL(*rparam,2,0);
1083         SSVAL(*rparam,4,succnt);
1084         SSVAL(*rparam,6,queuecnt);
1085
1086         for (i = 0; i < queuecnt; i++) {
1087                 if (queue) {
1088                         SAFE_FREE(queue[i]);
1089                 }
1090         }
1091
1092         SAFE_FREE(queue);
1093         SAFE_FREE(status);
1094
1095         return True;
1096
1097   err:
1098
1099         SAFE_FREE(subcntarr);
1100         for (i = 0; i < queuecnt; i++) {
1101                 if (queue) {
1102                         SAFE_FREE(queue[i]);
1103                 }
1104         }
1105         SAFE_FREE(queue);
1106         SAFE_FREE(status);
1107
1108         return False;
1109 }
1110
1111 /****************************************************************************
1112  Get info level for a server list query.
1113 ****************************************************************************/
1114
1115 static bool check_server_info(int uLevel, char* id)
1116 {
1117         switch( uLevel ) {
1118                 case 0:
1119                         if (strcmp(id,"B16") != 0) {
1120                                 return False;
1121                         }
1122                         break;
1123                 case 1:
1124                         if (strcmp(id,"B16BBDz") != 0) {
1125                                 return False;
1126                         }
1127                         break;
1128                 default:
1129                         return False;
1130         }
1131         return True;
1132 }
1133
1134 struct srv_info_struct {
1135         fstring name;
1136         uint32 type;
1137         fstring comment;
1138         fstring domain;
1139         bool server_added;
1140 };
1141
1142 /*******************************************************************
1143  Get server info lists from the files saved by nmbd. Return the
1144  number of entries.
1145 ******************************************************************/
1146
1147 static int get_server_info(uint32 servertype,
1148                            struct srv_info_struct **servers,
1149                            const char *domain)
1150 {
1151         int count=0;
1152         int alloced=0;
1153         char **lines;
1154         bool local_list_only;
1155         int i;
1156
1157         lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1158         if (!lines) {
1159                 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1160                 return 0;
1161         }
1162
1163         /* request for everything is code for request all servers */
1164         if (servertype == SV_TYPE_ALL) {
1165                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1166         }
1167
1168         local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1169
1170         DEBUG(4,("Servertype search: %8x\n",servertype));
1171
1172         for (i=0;lines[i];i++) {
1173                 fstring stype;
1174                 struct srv_info_struct *s;
1175                 const char *ptr = lines[i];
1176                 bool ok = True;
1177                 TALLOC_CTX *frame = NULL;
1178                 char *p;
1179
1180                 if (!*ptr) {
1181                         continue;
1182                 }
1183
1184                 if (count == alloced) {
1185                         alloced += 10;
1186                         *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1187                         if (!*servers) {
1188                                 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1189                                 TALLOC_FREE(lines);
1190                                 return 0;
1191                         }
1192                         memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1193                 }
1194                 s = &(*servers)[count];
1195
1196                 frame = talloc_stackframe();
1197                 s->name[0] = '\0';
1198                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1199                         TALLOC_FREE(frame);
1200                         continue;
1201                 }
1202                 fstrcpy(s->name, p);
1203
1204                 stype[0] = '\0';
1205                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1206                         TALLOC_FREE(frame);
1207                         continue;
1208                 }
1209                 fstrcpy(stype, p);
1210
1211                 s->comment[0] = '\0';
1212                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1213                         TALLOC_FREE(frame);
1214                         continue;
1215                 }
1216                 fstrcpy(s->comment, p);
1217
1218                 s->domain[0] = '\0';
1219                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1220                         /* this allows us to cope with an old nmbd */
1221                         fstrcpy(s->domain,lp_workgroup());
1222                 } else {
1223                         fstrcpy(s->domain, p);
1224                 }
1225                 TALLOC_FREE(frame);
1226
1227                 if (sscanf(stype,"%X",&s->type) != 1) {
1228                         DEBUG(4,("r:host file "));
1229                         ok = False;
1230                 }
1231
1232                 /* Filter the servers/domains we return based on what was asked for. */
1233
1234                 /* Check to see if we are being asked for a local list only. */
1235                 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1236                         DEBUG(4,("r: local list only"));
1237                         ok = False;
1238                 }
1239
1240                 /* doesn't match up: don't want it */
1241                 if (!(servertype & s->type)) {
1242                         DEBUG(4,("r:serv type "));
1243                         ok = False;
1244                 }
1245
1246                 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1247                                 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1248                         DEBUG(4,("s: dom mismatch "));
1249                         ok = False;
1250                 }
1251
1252                 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1253                         ok = False;
1254                 }
1255
1256                 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1257                 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1258
1259                 if (ok) {
1260                         DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1261                                 s->name, s->type, s->comment, s->domain));
1262                         s->server_added = True;
1263                         count++;
1264                 } else {
1265                         DEBUG(4,("%20s %8x %25s %15s\n",
1266                                 s->name, s->type, s->comment, s->domain));
1267                 }
1268         }
1269
1270         TALLOC_FREE(lines);
1271         return count;
1272 }
1273
1274 /*******************************************************************
1275  Fill in a server info structure.
1276 ******************************************************************/
1277
1278 static int fill_srv_info(struct srv_info_struct *service,
1279                          int uLevel, char **buf, int *buflen,
1280                          char **stringbuf, int *stringspace, char *baseaddr)
1281 {
1282         int struct_len;
1283         char* p;
1284         char* p2;
1285         int l2;
1286         int len;
1287
1288         switch (uLevel) {
1289                 case 0:
1290                         struct_len = 16;
1291                         break;
1292                 case 1:
1293                         struct_len = 26;
1294                         break;
1295                 default:
1296                         return -1;
1297         }
1298
1299         if (!buf) {
1300                 len = 0;
1301                 switch (uLevel) {
1302                         case 1:
1303                                 len = strlen(service->comment)+1;
1304                                 break;
1305                 }
1306
1307                 *buflen = struct_len;
1308                 *stringspace = len;
1309                 return struct_len + len;
1310         }
1311
1312         len = struct_len;
1313         p = *buf;
1314         if (*buflen < struct_len) {
1315                 return -1;
1316         }
1317         if (stringbuf) {
1318                 p2 = *stringbuf;
1319                 l2 = *stringspace;
1320         } else {
1321                 p2 = p + struct_len;
1322                 l2 = *buflen - struct_len;
1323         }
1324         if (!baseaddr) {
1325                 baseaddr = p;
1326         }
1327
1328         switch (uLevel) {
1329                 case 0:
1330                         push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1331                         break;
1332
1333                 case 1:
1334                         push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1335                         SIVAL(p,18,service->type);
1336                         SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1337                         len += CopyAndAdvance(&p2,service->comment,&l2);
1338                         break;
1339         }
1340
1341         if (stringbuf) {
1342                 *buf = p + struct_len;
1343                 *buflen -= struct_len;
1344                 *stringbuf = p2;
1345                 *stringspace = l2;
1346         } else {
1347                 *buf = p2;
1348                 *buflen -= len;
1349         }
1350         return len;
1351 }
1352
1353
1354 static bool srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1355 {
1356         return(strcmp(s1->name,s2->name));
1357 }
1358
1359 /****************************************************************************
1360  View list of servers available (or possibly domains). The info is
1361  extracted from lists saved by nmbd on the local host.
1362 ****************************************************************************/
1363
1364 static bool api_RNetServerEnum(connection_struct *conn, uint16 vuid,
1365                                 char *param, int tpscnt,
1366                                 char *data, int tdscnt,
1367                                 int mdrcnt, int mprcnt, char **rdata,
1368                                 char **rparam, int *rdata_len, int *rparam_len)
1369 {
1370         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1371         char *str2 = skip_string(param,tpscnt,str1);
1372         char *p = skip_string(param,tpscnt,str2);
1373         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1374         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1375         uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1376         char *p2;
1377         int data_len, fixed_len, string_len;
1378         int f_len = 0, s_len = 0;
1379         struct srv_info_struct *servers=NULL;
1380         int counted=0,total=0;
1381         int i,missed;
1382         fstring domain;
1383         bool domain_request;
1384         bool local_request;
1385
1386         if (!str1 || !str2 || !p) {
1387                 return False;
1388         }
1389
1390         /* If someone sets all the bits they don't really mean to set
1391            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1392            known servers. */
1393
1394         if (servertype == SV_TYPE_ALL) {
1395                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1396         }
1397
1398         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1399            any other bit (they may just set this bit on its own) they
1400            want all the locally seen servers. However this bit can be
1401            set on its own so set the requested servers to be
1402            ALL - DOMAIN_ENUM. */
1403
1404         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1405                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1406         }
1407
1408         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1409         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1410
1411         p += 8;
1412
1413         if (!prefix_ok(str1,"WrLehD")) {
1414                 return False;
1415         }
1416         if (!check_server_info(uLevel,str2)) {
1417                 return False;
1418         }
1419
1420         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1421         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1422         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1423
1424         if (strcmp(str1, "WrLehDz") == 0) {
1425                 if (skip_string(param,tpscnt,p) == NULL) {
1426                         return False;
1427                 }
1428                 pull_ascii_fstring(domain, p);
1429         } else {
1430                 fstrcpy(domain, lp_workgroup());
1431         }
1432
1433         if (lp_browse_list()) {
1434                 total = get_server_info(servertype,&servers,domain);
1435         }
1436
1437         data_len = fixed_len = string_len = 0;
1438         missed = 0;
1439
1440         if (total > 0) {
1441                 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1442         }
1443
1444         {
1445                 char *lastname=NULL;
1446
1447                 for (i=0;i<total;i++) {
1448                         struct srv_info_struct *s = &servers[i];
1449
1450                         if (lastname && strequal(lastname,s->name)) {
1451                                 continue;
1452                         }
1453                         lastname = s->name;
1454                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1455                         DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1456                                 s->name, s->type, s->comment, s->domain));
1457
1458                         if (data_len <= buf_len) {
1459                                 counted++;
1460                                 fixed_len += f_len;
1461                                 string_len += s_len;
1462                         } else {
1463                                 missed++;
1464                         }
1465                 }
1466         }
1467
1468         *rdata_len = fixed_len + string_len;
1469         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1470         if (!*rdata) {
1471                 return False;
1472         }
1473
1474         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1475         p = *rdata;
1476         f_len = fixed_len;
1477         s_len = string_len;
1478
1479         {
1480                 char *lastname=NULL;
1481                 int count2 = counted;
1482
1483                 for (i = 0; i < total && count2;i++) {
1484                         struct srv_info_struct *s = &servers[i];
1485
1486                         if (lastname && strequal(lastname,s->name)) {
1487                                 continue;
1488                         }
1489                         lastname = s->name;
1490                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1491                         DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1492                                 s->name, s->type, s->comment, s->domain));
1493                         count2--;
1494                 }
1495         }
1496
1497         *rparam_len = 8;
1498         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1499         if (!*rparam) {
1500                 return False;
1501         }
1502         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1503         SSVAL(*rparam,2,0);
1504         SSVAL(*rparam,4,counted);
1505         SSVAL(*rparam,6,counted+missed);
1506
1507         SAFE_FREE(servers);
1508
1509         DEBUG(3,("NetServerEnum domain = %s uLevel=%d counted=%d total=%d\n",
1510                 domain,uLevel,counted,counted+missed));
1511
1512         return True;
1513 }
1514
1515 /****************************************************************************
1516   command 0x34 - suspected of being a "Lookup Names" stub api
1517   ****************************************************************************/
1518
1519 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1520                                 char *param, int tpscnt,
1521                                 char *data, int tdscnt,
1522                                 int mdrcnt, int mprcnt, char **rdata,
1523                                 char **rparam, int *rdata_len, int *rparam_len)
1524 {
1525         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1526         char *str2 = skip_string(param,tpscnt,str1);
1527         char *p = skip_string(param,tpscnt,str2);
1528         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1529         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1530         int counted=0;
1531         int missed=0;
1532
1533         if (!str1 || !str2 || !p) {
1534                 return False;
1535         }
1536
1537         DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1538                 str1, str2, p, uLevel, buf_len));
1539
1540         if (!prefix_ok(str1,"zWrLeh")) {
1541                 return False;
1542         }
1543
1544         *rdata_len = 0;
1545
1546         *rparam_len = 8;
1547         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1548         if (!*rparam) {
1549                 return False;
1550         }
1551
1552         SSVAL(*rparam,0,0x08AC); /* informational warning message */
1553         SSVAL(*rparam,2,0);
1554         SSVAL(*rparam,4,counted);
1555         SSVAL(*rparam,6,counted+missed);
1556
1557         return True;
1558 }
1559
1560 /****************************************************************************
1561   get info about a share
1562   ****************************************************************************/
1563
1564 static bool check_share_info(int uLevel, char* id)
1565 {
1566         switch( uLevel ) {
1567                 case 0:
1568                         if (strcmp(id,"B13") != 0) {
1569                                 return False;
1570                         }
1571                         break;
1572                 case 1:
1573                         if (strcmp(id,"B13BWz") != 0) {
1574                                 return False;
1575                         }
1576                         break;
1577                 case 2:
1578                         if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1579                                 return False;
1580                         }
1581                         break;
1582                 case 91:
1583                         if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1584                                 return False;
1585                         }
1586                         break;
1587                 default:
1588                         return False;
1589         }
1590         return True;
1591 }
1592
1593 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1594                            char** buf, int* buflen,
1595                            char** stringbuf, int* stringspace, char* baseaddr)
1596 {
1597         int struct_len;
1598         char* p;
1599         char* p2;
1600         int l2;
1601         int len;
1602
1603         switch( uLevel ) {
1604                 case 0:
1605                         struct_len = 13;
1606                         break;
1607                 case 1:
1608                         struct_len = 20;
1609                         break;
1610                 case 2:
1611                         struct_len = 40;
1612                         break;
1613                 case 91:
1614                         struct_len = 68;
1615                         break;
1616                 default:
1617                         return -1;
1618         }
1619
1620         if (!buf) {
1621                 len = 0;
1622
1623                 if (uLevel > 0) {
1624                         len += StrlenExpanded(conn,snum,lp_comment(snum));
1625                 }
1626                 if (uLevel > 1) {
1627                         len += strlen(lp_pathname(snum)) + 1;
1628                 }
1629                 if (buflen) {
1630                         *buflen = struct_len;
1631                 }
1632                 if (stringspace) {
1633                         *stringspace = len;
1634                 }
1635                 return struct_len + len;
1636         }
1637
1638         len = struct_len;
1639         p = *buf;
1640         if ((*buflen) < struct_len) {
1641                 return -1;
1642         }
1643
1644         if (stringbuf) {
1645                 p2 = *stringbuf;
1646                 l2 = *stringspace;
1647         } else {
1648                 p2 = p + struct_len;
1649                 l2 = (*buflen) - struct_len;
1650         }
1651
1652         if (!baseaddr) {
1653                 baseaddr = p;
1654         }
1655
1656         push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1657
1658         if (uLevel > 0) {
1659                 int type;
1660
1661                 SCVAL(p,13,0);
1662                 type = STYPE_DISKTREE;
1663                 if (lp_print_ok(snum)) {
1664                         type = STYPE_PRINTQ;
1665                 }
1666                 if (strequal("IPC",lp_fstype(snum))) {
1667                         type = STYPE_IPC;
1668                 }
1669                 SSVAL(p,14,type);               /* device type */
1670                 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1671                 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1672         }
1673
1674         if (uLevel > 1) {
1675                 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1676                 SSVALS(p,22,-1);                /* max uses */
1677                 SSVAL(p,24,1); /* current uses */
1678                 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1679                 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1680                 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1681         }
1682
1683         if (uLevel > 2) {
1684                 memset(p+40,0,SHPWLEN+2);
1685                 SSVAL(p,50,0);
1686                 SIVAL(p,52,0);
1687                 SSVAL(p,56,0);
1688                 SSVAL(p,58,0);
1689                 SIVAL(p,60,0);
1690                 SSVAL(p,64,0);
1691                 SSVAL(p,66,0);
1692         }
1693
1694         if (stringbuf) {
1695                 (*buf) = p + struct_len;
1696                 (*buflen) -= struct_len;
1697                 (*stringbuf) = p2;
1698                 (*stringspace) = l2;
1699         } else {
1700                 (*buf) = p2;
1701                 (*buflen) -= len;
1702         }
1703
1704         return len;
1705 }
1706
1707 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1708                                 char *param, int tpscnt,
1709                                 char *data, int tdscnt,
1710                                 int mdrcnt,int mprcnt,
1711                                 char **rdata,char **rparam,
1712                                 int *rdata_len,int *rparam_len)
1713 {
1714         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1715         char *str2 = skip_string(param,tpscnt,str1);
1716         char *netname = skip_string(param,tpscnt,str2);
1717         char *p = skip_string(param,tpscnt,netname);
1718         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1719         int snum;
1720
1721         if (!str1 || !str2 || !netname || !p) {
1722                 return False;
1723         }
1724
1725         snum = find_service(netname);
1726         if (snum < 0) {
1727                 return False;
1728         }
1729
1730         /* check it's a supported varient */
1731         if (!prefix_ok(str1,"zWrLh")) {
1732                 return False;
1733         }
1734         if (!check_share_info(uLevel,str2)) {
1735                 return False;
1736         }
1737
1738         *rdata = smb_realloc_limit(*rdata,mdrcnt);
1739         if (!*rdata) {
1740                 return False;
1741         }
1742         p = *rdata;
1743         *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
1744         if (*rdata_len < 0) {
1745                 return False;
1746         }
1747
1748         *rparam_len = 6;
1749         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1750         if (!*rparam) {
1751                 return False;
1752         }
1753         SSVAL(*rparam,0,NERR_Success);
1754         SSVAL(*rparam,2,0);             /* converter word */
1755         SSVAL(*rparam,4,*rdata_len);
1756
1757         return True;
1758 }
1759
1760 /****************************************************************************
1761   View the list of available shares.
1762
1763   This function is the server side of the NetShareEnum() RAP call.
1764   It fills the return buffer with share names and share comments.
1765   Note that the return buffer normally (in all known cases) allows only
1766   twelve byte strings for share names (plus one for a nul terminator).
1767   Share names longer than 12 bytes must be skipped.
1768  ****************************************************************************/
1769
1770 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
1771                                 char *param, int tpscnt,
1772                                 char *data, int tdscnt,
1773                                 int                mdrcnt,
1774                                 int                mprcnt,
1775                                 char             **rdata,
1776                                 char             **rparam,
1777                                 int               *rdata_len,
1778                                 int               *rparam_len )
1779 {
1780         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1781         char *str2 = skip_string(param,tpscnt,str1);
1782         char *p = skip_string(param,tpscnt,str2);
1783         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1784         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1785         char *p2;
1786         int count = 0;
1787         int total=0,counted=0;
1788         bool missed = False;
1789         int i;
1790         int data_len, fixed_len, string_len;
1791         int f_len = 0, s_len = 0;
1792
1793         if (!str1 || !str2 || !p) {
1794                 return False;
1795         }
1796
1797         if (!prefix_ok(str1,"WrLeh")) {
1798                 return False;
1799         }
1800         if (!check_share_info(uLevel,str2)) {
1801                 return False;
1802         }
1803
1804         /* Ensure all the usershares are loaded. */
1805         become_root();
1806         load_registry_shares();
1807         count = load_usershare_shares();
1808         unbecome_root();
1809
1810         data_len = fixed_len = string_len = 0;
1811         for (i=0;i<count;i++) {
1812                 fstring servicename_dos;
1813                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1814                         continue;
1815                 }
1816                 push_ascii_fstring(servicename_dos, lp_servicename(i));
1817                 /* Maximum name length = 13. */
1818                 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
1819                         total++;
1820                         data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
1821                         if (data_len <= buf_len) {
1822                                 counted++;
1823                                 fixed_len += f_len;
1824                                 string_len += s_len;
1825                         } else {
1826                                 missed = True;
1827                         }
1828                 }
1829         }
1830
1831         *rdata_len = fixed_len + string_len;
1832         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1833         if (!*rdata) {
1834                 return False;
1835         }
1836
1837         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
1838         p = *rdata;
1839         f_len = fixed_len;
1840         s_len = string_len;
1841
1842         for( i = 0; i < count; i++ ) {
1843                 fstring servicename_dos;
1844                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1845                         continue;
1846                 }
1847
1848                 push_ascii_fstring(servicename_dos, lp_servicename(i));
1849                 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
1850                         if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
1851                                 break;
1852                         }
1853                 }
1854         }
1855
1856         *rparam_len = 8;
1857         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1858         if (!*rparam) {
1859                 return False;
1860         }
1861         SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
1862         SSVAL(*rparam,2,0);
1863         SSVAL(*rparam,4,counted);
1864         SSVAL(*rparam,6,total);
1865
1866         DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
1867                 counted,total,uLevel,
1868                 buf_len,*rdata_len,mdrcnt));
1869
1870         return True;
1871 }
1872
1873 /****************************************************************************
1874   Add a share
1875   ****************************************************************************/
1876
1877 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
1878                                 char *param, int tpscnt,
1879                                 char *data, int tdscnt,
1880                                 int mdrcnt,int mprcnt,
1881                                 char **rdata,char **rparam,
1882                                 int *rdata_len,int *rparam_len)
1883 {
1884         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1885         char *str2 = skip_string(param,tpscnt,str1);
1886         char *p = skip_string(param,tpscnt,str2);
1887         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1888         fstring sharename;
1889         fstring comment;
1890         char *pathname = NULL;
1891         char *command, *cmdname;
1892         unsigned int offset;
1893         int snum;
1894         int res = ERRunsup;
1895         size_t converted_size;
1896
1897         if (!str1 || !str2 || !p) {
1898                 return False;
1899         }
1900
1901         /* check it's a supported varient */
1902         if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
1903                 return False;
1904         }
1905         if (!check_share_info(uLevel,str2)) {
1906                 return False;
1907         }
1908         if (uLevel != 2) {
1909                 return False;
1910         }
1911
1912         /* Do we have a string ? */
1913         if (skip_string(data,mdrcnt,data) == NULL) {
1914                 return False;
1915         }
1916         pull_ascii_fstring(sharename,data);
1917         snum = find_service(sharename);
1918         if (snum >= 0) { /* already exists */
1919                 res = ERRfilexists;
1920                 goto error_exit;
1921         }
1922
1923         if (mdrcnt < 28) {
1924                 return False;
1925         }
1926
1927         /* only support disk share adds */
1928         if (SVAL(data,14)!=STYPE_DISKTREE) {
1929                 return False;
1930         }
1931
1932         offset = IVAL(data, 16);
1933         if (offset >= mdrcnt) {
1934                 res = ERRinvalidparam;
1935                 goto error_exit;
1936         }
1937
1938         /* Do we have a string ? */
1939         if (skip_string(data,mdrcnt,data+offset) == NULL) {
1940                 return False;
1941         }
1942         pull_ascii_fstring(comment, offset? (data+offset) : "");
1943
1944         offset = IVAL(data, 26);
1945
1946         if (offset >= mdrcnt) {
1947                 res = ERRinvalidparam;
1948                 goto error_exit;
1949         }
1950
1951         /* Do we have a string ? */
1952         if (skip_string(data,mdrcnt,data+offset) == NULL) {
1953                 return False;
1954         }
1955
1956         if (!pull_ascii_talloc(talloc_tos(), &pathname,
1957                                offset ? (data+offset) : "", &converted_size))
1958         {
1959                 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
1960                          strerror(errno)));
1961         }
1962
1963         if (!pathname) {
1964                 return false;
1965         }
1966
1967         string_replace(sharename, '"', ' ');
1968         string_replace(pathname, '"', ' ');
1969         string_replace(comment, '"', ' ');
1970
1971         cmdname = lp_add_share_cmd();
1972
1973         if (!cmdname || *cmdname == '\0') {
1974                 return False;
1975         }
1976
1977         if (asprintf(&command, "%s \"%s\" \"%s\" \"%s\" \"%s\"",
1978                      lp_add_share_cmd(), get_dyn_CONFIGFILE(), sharename,
1979                      pathname, comment) == -1) {
1980                 return false;
1981         }
1982
1983         DEBUG(10,("api_RNetShareAdd: Running [%s]\n", command ));
1984
1985         if ((res = smbrun(command, NULL)) != 0) {
1986                 DEBUG(1,("api_RNetShareAdd: Running [%s] returned (%d)\n",
1987                          command, res ));
1988                 SAFE_FREE(command);
1989                 res = ERRnoaccess;
1990                 goto error_exit;
1991         } else {
1992                 SAFE_FREE(command);
1993                 message_send_all(smbd_messaging_context(),
1994                                  MSG_SMB_CONF_UPDATED, NULL, 0, NULL);
1995         }
1996
1997         *rparam_len = 6;
1998         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1999         if (!*rparam) {
2000                 return False;
2001         }
2002         SSVAL(*rparam,0,NERR_Success);
2003         SSVAL(*rparam,2,0);             /* converter word */
2004         SSVAL(*rparam,4,*rdata_len);
2005         *rdata_len = 0;
2006
2007         return True;
2008
2009   error_exit:
2010
2011         *rparam_len = 4;
2012         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2013         if (!*rparam) {
2014                 return False;
2015         }
2016         *rdata_len = 0;
2017         SSVAL(*rparam,0,res);
2018         SSVAL(*rparam,2,0);
2019         return True;
2020 }
2021
2022 /****************************************************************************
2023   view list of groups available
2024   ****************************************************************************/
2025
2026 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2027                                 char *param, int tpscnt,
2028                                 char *data, int tdscnt,
2029                                 int mdrcnt,int mprcnt,
2030                                 char **rdata,char **rparam,
2031                                 int *rdata_len,int *rparam_len)
2032 {
2033         int i;
2034         int errflags=0;
2035         int resume_context, cli_buf_size;
2036         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2037         char *str2 = skip_string(param,tpscnt,str1);
2038         char *p = skip_string(param,tpscnt,str2);
2039
2040         uint32_t num_groups;
2041         uint32_t resume_handle;
2042         struct rpc_pipe_client *samr_pipe;
2043         struct policy_handle samr_handle, domain_handle;
2044         NTSTATUS status;
2045
2046         if (!str1 || !str2 || !p) {
2047                 return False;
2048         }
2049
2050         if (strcmp(str1,"WrLeh") != 0) {
2051                 return False;
2052         }
2053
2054         /* parameters
2055          * W-> resume context (number of users to skip)
2056          * r -> return parameter pointer to receive buffer
2057          * L -> length of receive buffer
2058          * e -> return parameter number of entries
2059          * h -> return parameter total number of users
2060          */
2061
2062         if (strcmp("B21",str2) != 0) {
2063                 return False;
2064         }
2065
2066         status = rpc_pipe_open_internal(
2067                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2068                 conn->server_info, &samr_pipe);
2069         if (!NT_STATUS_IS_OK(status)) {
2070                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2071                           nt_errstr(status)));
2072                 return false;
2073         }
2074
2075         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2076                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2077         if (!NT_STATUS_IS_OK(status)) {
2078                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2079                           nt_errstr(status)));
2080                 return false;
2081         }
2082
2083         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2084                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2085                                         get_global_sam_sid(), &domain_handle);
2086         if (!NT_STATUS_IS_OK(status)) {
2087                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2088                           nt_errstr(status)));
2089                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2090                 return false;
2091         }
2092
2093         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2094         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2095         DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2096                   "%d\n", resume_context, cli_buf_size));
2097
2098         *rdata_len = cli_buf_size;
2099         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2100         if (!*rdata) {
2101                 return False;
2102         }
2103
2104         p = *rdata;
2105
2106         errflags = NERR_Success;
2107         num_groups = 0;
2108         resume_handle = 0;
2109
2110         while (true) {
2111                 struct samr_SamArray *sam_entries;
2112                 uint32_t num_entries;
2113
2114                 status = rpccli_samr_EnumDomainGroups(samr_pipe, talloc_tos(),
2115                                                       &domain_handle,
2116                                                       &resume_handle,
2117                                                       &sam_entries, 1,
2118                                                       &num_entries);
2119                 if (!NT_STATUS_IS_OK(status)) {
2120                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2121                                    "%s\n", nt_errstr(status)));
2122                         break;
2123                 }
2124
2125                 if (num_entries == 0) {
2126                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2127                                    "no entries -- done\n"));
2128                         break;
2129                 }
2130
2131                 for(i=0; i<num_entries; i++) {
2132                         const char *name;
2133
2134                         name = sam_entries->entries[i].name.string;
2135
2136                         if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2137                                 /* set overflow error */
2138                                 DEBUG(3,("overflow on entry %d group %s\n", i,
2139                                          name));
2140                                 errflags=234;
2141                                 break;
2142                         }
2143
2144                         /* truncate the name at 21 chars. */
2145                         memset(p, 0, 21);
2146                         strlcpy(p, name, 21);
2147                         DEBUG(10,("adding entry %d group %s\n", i, p));
2148                         p += 21;
2149                         p += 5; /* Both NT4 and W2k3SP1 do padding here.  No
2150                                  * idea why... */
2151                         num_groups += 1;
2152                 }
2153
2154                 if (errflags != NERR_Success) {
2155                         break;
2156                 }
2157
2158                 TALLOC_FREE(sam_entries);
2159         }
2160
2161         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2162         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2163
2164         *rdata_len = PTR_DIFF(p,*rdata);
2165
2166         *rparam_len = 8;
2167         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2168         if (!*rparam) {
2169                 return False;
2170         }
2171         SSVAL(*rparam, 0, errflags);
2172         SSVAL(*rparam, 2, 0);           /* converter word */
2173         SSVAL(*rparam, 4, num_groups);  /* is this right?? */
2174         SSVAL(*rparam, 6, resume_context+num_groups);   /* is this right?? */
2175
2176         return(True);
2177 }
2178
2179 /*******************************************************************
2180  Get groups that a user is a member of.
2181 ******************************************************************/
2182
2183 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2184                                 char *param, int tpscnt,
2185                                 char *data, int tdscnt,
2186                                 int mdrcnt,int mprcnt,
2187                                 char **rdata,char **rparam,
2188                                 int *rdata_len,int *rparam_len)
2189 {
2190         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2191         char *str2 = skip_string(param,tpscnt,str1);
2192         char *UserName = skip_string(param,tpscnt,str2);
2193         char *p = skip_string(param,tpscnt,UserName);
2194         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2195         const char *level_string;
2196         int count=0;
2197         bool ret = False;
2198         uint32_t i;
2199         char *endp = NULL;
2200
2201         struct rpc_pipe_client *samr_pipe;
2202         struct policy_handle samr_handle, domain_handle, user_handle;
2203         struct lsa_String name;
2204         struct lsa_Strings names;
2205         struct samr_Ids type, rid;
2206         struct samr_RidWithAttributeArray *rids;
2207         NTSTATUS status;
2208
2209         if (!str1 || !str2 || !UserName || !p) {
2210                 return False;
2211         }
2212
2213         *rparam_len = 8;
2214         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2215         if (!*rparam) {
2216                 return False;
2217         }
2218
2219         /* check it's a supported varient */
2220
2221         if ( strcmp(str1,"zWrLeh") != 0 )
2222                 return False;
2223
2224         switch( uLevel ) {
2225                 case 0:
2226                         level_string = "B21";
2227                         break;
2228                 default:
2229                         return False;
2230         }
2231
2232         if (strcmp(level_string,str2) != 0)
2233                 return False;
2234
2235         *rdata_len = mdrcnt + 1024;
2236         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2237         if (!*rdata) {
2238                 return False;
2239         }
2240
2241         SSVAL(*rparam,0,NERR_Success);
2242         SSVAL(*rparam,2,0);             /* converter word */
2243
2244         p = *rdata;
2245         endp = *rdata + *rdata_len;
2246
2247         status = rpc_pipe_open_internal(
2248                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2249                 conn->server_info, &samr_pipe);
2250         if (!NT_STATUS_IS_OK(status)) {
2251                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2252                           nt_errstr(status)));
2253                 return false;
2254         }
2255
2256         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2257                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2258         if (!NT_STATUS_IS_OK(status)) {
2259                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2260                           nt_errstr(status)));
2261                 return false;
2262         }
2263
2264         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2265                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2266                                         get_global_sam_sid(), &domain_handle);
2267         if (!NT_STATUS_IS_OK(status)) {
2268                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2269                           nt_errstr(status)));
2270                 goto close_sam;
2271         }
2272
2273         name.string = UserName;
2274
2275         status = rpccli_samr_LookupNames(samr_pipe, talloc_tos(),
2276                                          &domain_handle, 1, &name,
2277                                          &rid, &type);
2278         if (!NT_STATUS_IS_OK(status)) {
2279                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2280                           nt_errstr(status)));
2281                 goto close_domain;
2282         }
2283
2284         if (type.ids[0] != SID_NAME_USER) {
2285                 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2286                            sid_type_lookup(type.ids[0])));
2287                 goto close_domain;
2288         }
2289
2290         status = rpccli_samr_OpenUser(samr_pipe, talloc_tos(),
2291                                       &domain_handle,
2292                                       SAMR_USER_ACCESS_GET_GROUPS,
2293                                       rid.ids[0], &user_handle);
2294         if (!NT_STATUS_IS_OK(status)) {
2295                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2296                           nt_errstr(status)));
2297                 goto close_domain;
2298         }
2299
2300         status = rpccli_samr_GetGroupsForUser(samr_pipe, talloc_tos(),
2301                                               &user_handle, &rids);
2302         if (!NT_STATUS_IS_OK(status)) {
2303                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2304                           nt_errstr(status)));
2305                 goto close_user;
2306         }
2307
2308         for (i=0; i<rids->count; i++) {
2309
2310                 status = rpccli_samr_LookupRids(samr_pipe, talloc_tos(),
2311                                                 &domain_handle,
2312                                                 1, &rids->rids[i].rid,
2313                                                 &names, &type);
2314                 if (NT_STATUS_IS_OK(status) && (names.count == 1)) {
2315                         strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2316                         p += 21;
2317                         count++;
2318                 }
2319         }
2320
2321         *rdata_len = PTR_DIFF(p,*rdata);
2322
2323         SSVAL(*rparam,4,count); /* is this right?? */
2324         SSVAL(*rparam,6,count); /* is this right?? */
2325
2326         ret = True;
2327
2328  close_user:
2329         rpccli_samr_Close(samr_pipe, talloc_tos(), &user_handle);
2330  close_domain:
2331         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2332  close_sam:
2333         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2334
2335         return ret;
2336 }
2337
2338 /*******************************************************************
2339  Get all users.
2340 ******************************************************************/
2341
2342 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2343                                 char *param, int tpscnt,
2344                                 char *data, int tdscnt,
2345                                 int mdrcnt,int mprcnt,
2346                                 char **rdata,char **rparam,
2347                                 int *rdata_len,int *rparam_len)
2348 {
2349         int count_sent=0;
2350         int num_users=0;
2351         int errflags=0;
2352         int i, resume_context, cli_buf_size;
2353         uint32_t resume_handle;
2354
2355         struct rpc_pipe_client *samr_pipe;
2356         struct policy_handle samr_handle, domain_handle;
2357         NTSTATUS status;
2358
2359         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2360         char *str2 = skip_string(param,tpscnt,str1);
2361         char *p = skip_string(param,tpscnt,str2);
2362         char *endp = NULL;
2363
2364         if (!str1 || !str2 || !p) {
2365                 return False;
2366         }
2367
2368         if (strcmp(str1,"WrLeh") != 0)
2369                 return False;
2370         /* parameters
2371           * W-> resume context (number of users to skip)
2372           * r -> return parameter pointer to receive buffer
2373           * L -> length of receive buffer
2374           * e -> return parameter number of entries
2375           * h -> return parameter total number of users
2376           */
2377
2378         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2379         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2380         DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2381                         resume_context, cli_buf_size));
2382
2383         *rparam_len = 8;
2384         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2385         if (!*rparam) {
2386                 return False;
2387         }
2388
2389         /* check it's a supported varient */
2390         if (strcmp("B21",str2) != 0)
2391                 return False;
2392
2393         *rdata_len = cli_buf_size;
2394         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2395         if (!*rdata) {
2396                 return False;
2397         }
2398
2399         p = *rdata;
2400         endp = *rdata + *rdata_len;
2401
2402         status = rpc_pipe_open_internal(
2403                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2404                 conn->server_info, &samr_pipe);
2405         if (!NT_STATUS_IS_OK(status)) {
2406                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2407                           nt_errstr(status)));
2408                 return false;
2409         }
2410
2411         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2412                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2413         if (!NT_STATUS_IS_OK(status)) {
2414                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2415                           nt_errstr(status)));
2416                 return false;
2417         }
2418
2419         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2420                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2421                                         get_global_sam_sid(), &domain_handle);
2422         if (!NT_STATUS_IS_OK(status)) {
2423                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2424                           nt_errstr(status)));
2425                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2426                 return false;
2427         }
2428
2429         errflags=NERR_Success;
2430
2431         resume_handle = 0;
2432
2433         while (true) {
2434                 struct samr_SamArray *sam_entries;
2435                 uint32_t num_entries;
2436
2437                 status = rpccli_samr_EnumDomainUsers(samr_pipe, talloc_tos(),
2438                                                      &domain_handle,
2439                                                      &resume_handle,
2440                                                      0, &sam_entries, 1,
2441                                                      &num_entries);
2442
2443                 if (!NT_STATUS_IS_OK(status)) {
2444                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2445                                    "%s\n", nt_errstr(status)));
2446                         break;
2447                 }
2448
2449                 if (num_entries == 0) {
2450                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2451                                    "no entries -- done\n"));
2452                         break;
2453                 }
2454
2455                 for (i=0; i<num_entries; i++) {
2456                         const char *name;
2457
2458                         name = sam_entries->entries[i].name.string;
2459
2460                         if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2461                            &&(strlen(name)<=21)) {
2462                                 strlcpy(p,name,PTR_DIFF(endp,p));
2463                                 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2464                                           "username %s\n",count_sent,p));
2465                                 p += 21;
2466                                 count_sent++;
2467                         } else {
2468                                 /* set overflow error */
2469                                 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2470                                           "username %s\n",count_sent,name));
2471                                 errflags=234;
2472                                 break;
2473                         }
2474                 }
2475
2476                 if (errflags != NERR_Success) {
2477                         break;
2478                 }
2479
2480                 TALLOC_FREE(sam_entries);
2481         }
2482
2483         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2484         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2485
2486         *rdata_len = PTR_DIFF(p,*rdata);
2487
2488         SSVAL(*rparam,0,errflags);
2489         SSVAL(*rparam,2,0);           /* converter word */
2490         SSVAL(*rparam,4,count_sent);  /* is this right?? */
2491         SSVAL(*rparam,6,num_users); /* is this right?? */
2492
2493         return True;
2494 }
2495
2496 /****************************************************************************
2497  Get the time of day info.
2498 ****************************************************************************/
2499
2500 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2501                                 char *param, int tpscnt,
2502                                 char *data, int tdscnt,
2503                                 int mdrcnt,int mprcnt,
2504                                 char **rdata,char **rparam,
2505                                 int *rdata_len,int *rparam_len)
2506 {
2507         struct tm *t;
2508         time_t unixdate = time(NULL);
2509         char *p;
2510
2511         *rparam_len = 4;
2512         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2513         if (!*rparam) {
2514                 return False;
2515         }
2516
2517         *rdata_len = 21;
2518         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2519         if (!*rdata) {
2520                 return False;
2521         }
2522
2523         SSVAL(*rparam,0,NERR_Success);
2524         SSVAL(*rparam,2,0);             /* converter word */
2525
2526         p = *rdata;
2527
2528         srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2529                                             by NT in a "net time" operation,
2530                                             it seems to ignore the one below */
2531
2532         /* the client expects to get localtime, not GMT, in this bit
2533                 (I think, this needs testing) */
2534         t = localtime(&unixdate);
2535         if (!t) {
2536                 return False;
2537         }
2538
2539         SIVAL(p,4,0);           /* msecs ? */
2540         SCVAL(p,8,t->tm_hour);
2541         SCVAL(p,9,t->tm_min);
2542         SCVAL(p,10,t->tm_sec);
2543         SCVAL(p,11,0);          /* hundredths of seconds */
2544         SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2545         SSVAL(p,14,10000);              /* timer interval in 0.0001 of sec */
2546         SCVAL(p,16,t->tm_mday);
2547         SCVAL(p,17,t->tm_mon + 1);
2548         SSVAL(p,18,1900+t->tm_year);
2549         SCVAL(p,20,t->tm_wday);
2550
2551         return True;
2552 }
2553
2554 /****************************************************************************
2555  Set the user password.
2556 *****************************************************************************/
2557
2558 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2559                                 char *param, int tpscnt,
2560                                 char *data, int tdscnt,
2561                                 int mdrcnt,int mprcnt,
2562                                 char **rdata,char **rparam,
2563                                 int *rdata_len,int *rparam_len)
2564 {
2565         char *np = get_safe_str_ptr(param,tpscnt,param,2);
2566         char *p = NULL;
2567         fstring user;
2568         fstring pass1,pass2;
2569
2570         /* Skip 2 strings. */
2571         p = skip_string(param,tpscnt,np);
2572         p = skip_string(param,tpscnt,p);
2573
2574         if (!np || !p) {
2575                 return False;
2576         }
2577
2578         /* Do we have a string ? */
2579         if (skip_string(param,tpscnt,p) == NULL) {
2580                 return False;
2581         }
2582         pull_ascii_fstring(user,p);
2583
2584         p = skip_string(param,tpscnt,p);
2585         if (!p) {
2586                 return False;
2587         }
2588
2589         memset(pass1,'\0',sizeof(pass1));
2590         memset(pass2,'\0',sizeof(pass2));
2591         /*
2592          * We use 31 here not 32 as we're checking
2593          * the last byte we want to access is safe.
2594          */
2595         if (!is_offset_safe(param,tpscnt,p,31)) {
2596                 return False;
2597         }
2598         memcpy(pass1,p,16);
2599         memcpy(pass2,p+16,16);
2600
2601         *rparam_len = 4;
2602         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2603         if (!*rparam) {
2604                 return False;
2605         }
2606
2607         *rdata_len = 0;
2608
2609         SSVAL(*rparam,0,NERR_badpass);
2610         SSVAL(*rparam,2,0);             /* converter word */
2611
2612         DEBUG(3,("Set password for <%s>\n",user));
2613
2614         /*
2615          * Attempt to verify the old password against smbpasswd entries
2616          * Win98 clients send old and new password in plaintext for this call.
2617          */
2618
2619         {
2620                 auth_serversupplied_info *server_info = NULL;
2621                 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2622
2623                 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2624
2625                         become_root();
2626                         if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2627                                 SSVAL(*rparam,0,NERR_Success);
2628                         }
2629                         unbecome_root();
2630
2631                         TALLOC_FREE(server_info);
2632                 }
2633                 data_blob_clear_free(&password);
2634         }
2635
2636         /*
2637          * If the plaintext change failed, attempt
2638          * the old encrypted method. NT will generate this
2639          * after trying the samr method. Note that this
2640          * method is done as a last resort as this
2641          * password change method loses the NT password hash
2642          * and cannot change the UNIX password as no plaintext
2643          * is received.
2644          */
2645
2646         if(SVAL(*rparam,0) != NERR_Success) {
2647                 struct samu *hnd = NULL;
2648
2649                 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2650                         become_root();
2651                         if (change_lanman_password(hnd,(uchar *)pass2)) {
2652                                 SSVAL(*rparam,0,NERR_Success);
2653                         }
2654                         unbecome_root();
2655                         TALLOC_FREE(hnd);
2656                 }
2657         }
2658
2659         memset((char *)pass1,'\0',sizeof(fstring));
2660         memset((char *)pass2,'\0',sizeof(fstring));
2661
2662         return(True);
2663 }
2664
2665 /****************************************************************************
2666   Set the user password (SamOEM version - gets plaintext).
2667 ****************************************************************************/
2668
2669 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2670                                 char *param, int tpscnt,
2671                                 char *data, int tdscnt,
2672                                 int mdrcnt,int mprcnt,
2673                                 char **rdata,char **rparam,
2674                                 int *rdata_len,int *rparam_len)
2675 {
2676         fstring user;
2677         char *p = get_safe_str_ptr(param,tpscnt,param,2);
2678         *rparam_len = 2;
2679         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2680         if (!*rparam) {
2681                 return False;
2682         }
2683
2684         if (!p) {
2685                 return False;
2686         }
2687         *rdata_len = 0;
2688
2689         SSVAL(*rparam,0,NERR_badpass);
2690
2691         /*
2692          * Check the parameter definition is correct.
2693          */
2694
2695         /* Do we have a string ? */
2696         if (skip_string(param,tpscnt,p) == 0) {
2697                 return False;
2698         }
2699         if(!strequal(p, "zsT")) {
2700                 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2701                 return False;
2702         }
2703         p = skip_string(param, tpscnt, p);
2704         if (!p) {
2705                 return False;
2706         }
2707
2708         /* Do we have a string ? */
2709         if (skip_string(param,tpscnt,p) == 0) {
2710                 return False;
2711         }
2712         if(!strequal(p, "B516B16")) {
2713                 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2714                 return False;
2715         }
2716         p = skip_string(param,tpscnt,p);
2717         if (!p) {
2718                 return False;
2719         }
2720         /* Do we have a string ? */
2721         if (skip_string(param,tpscnt,p) == 0) {
2722                 return False;
2723         }
2724         p += pull_ascii_fstring(user,p);
2725
2726         DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
2727
2728         /*
2729          * Pass the user through the NT -> unix user mapping
2730          * function.
2731          */
2732
2733         (void)map_username(user);
2734
2735         if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL, NULL))) {
2736                 SSVAL(*rparam,0,NERR_Success);
2737         }
2738
2739         return(True);
2740 }
2741
2742 /****************************************************************************
2743   delete a print job
2744   Form: <W> <>
2745   ****************************************************************************/
2746
2747 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
2748                                 char *param, int tpscnt,
2749                                 char *data, int tdscnt,
2750                                 int mdrcnt,int mprcnt,
2751                                 char **rdata,char **rparam,
2752                                 int *rdata_len,int *rparam_len)
2753 {
2754         int function = get_safe_SVAL(param,tpscnt,param,0,0);
2755         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2756         char *str2 = skip_string(param,tpscnt,str1);
2757         char *p = skip_string(param,tpscnt,str2);
2758         uint32 jobid;
2759         int snum;
2760         fstring sharename;
2761         int errcode;
2762         WERROR werr = WERR_OK;
2763
2764         if (!str1 || !str2 || !p) {
2765                 return False;
2766         }
2767         /*
2768          * We use 1 here not 2 as we're checking
2769          * the last byte we want to access is safe.
2770          */
2771         if (!is_offset_safe(param,tpscnt,p,1)) {
2772                 return False;
2773         }
2774         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2775                 return False;
2776
2777         /* check it's a supported varient */
2778         if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
2779                 return(False);
2780
2781         *rparam_len = 4;
2782         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2783         if (!*rparam) {
2784                 return False;
2785         }
2786         *rdata_len = 0;
2787
2788         if (!print_job_exists(sharename, jobid)) {
2789                 errcode = NERR_JobNotFound;
2790                 goto out;
2791         }
2792
2793         snum = lp_servicenumber( sharename);
2794         if (snum == -1) {
2795                 errcode = NERR_DestNotFound;
2796                 goto out;
2797         }
2798
2799         errcode = NERR_notsupported;
2800
2801         switch (function) {
2802         case 81:                /* delete */
2803                 if (print_job_delete(conn->server_info, snum, jobid, &werr))
2804                         errcode = NERR_Success;
2805                 break;
2806         case 82:                /* pause */
2807                 if (print_job_pause(conn->server_info, snum, jobid, &werr))
2808                         errcode = NERR_Success;
2809                 break;
2810         case 83:                /* resume */
2811                 if (print_job_resume(conn->server_info, snum, jobid, &werr))
2812                         errcode = NERR_Success;
2813                 break;
2814         }
2815
2816         if (!W_ERROR_IS_OK(werr))
2817                 errcode = W_ERROR_V(werr);
2818
2819  out:
2820         SSVAL(*rparam,0,errcode);
2821         SSVAL(*rparam,2,0);             /* converter word */
2822
2823         return(True);
2824 }
2825
2826 /****************************************************************************
2827   Purge a print queue - or pause or resume it.
2828   ****************************************************************************/
2829
2830 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
2831                                 char *param, int tpscnt,
2832                                 char *data, int tdscnt,
2833                                 int mdrcnt,int mprcnt,
2834                                 char **rdata,char **rparam,
2835                                 int *rdata_len,int *rparam_len)
2836 {
2837         int function = get_safe_SVAL(param,tpscnt,param,0,0);
2838         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2839         char *str2 = skip_string(param,tpscnt,str1);
2840         char *QueueName = skip_string(param,tpscnt,str2);
2841         int errcode = NERR_notsupported;
2842         int snum;
2843         WERROR werr = WERR_OK;
2844
2845         if (!str1 || !str2 || !QueueName) {
2846                 return False;
2847         }
2848
2849         /* check it's a supported varient */
2850         if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
2851                 return(False);
2852
2853         *rparam_len = 4;
2854         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2855         if (!*rparam) {
2856                 return False;
2857         }
2858         *rdata_len = 0;
2859
2860         if (skip_string(param,tpscnt,QueueName) == NULL) {
2861                 return False;
2862         }
2863         snum = print_queue_snum(QueueName);
2864
2865         if (snum == -1) {
2866                 errcode = NERR_JobNotFound;
2867                 goto out;
2868         }
2869
2870         switch (function) {
2871         case 74: /* Pause queue */
2872                 werr = print_queue_pause(conn->server_info, snum);
2873                 break;
2874         case 75: /* Resume queue */
2875                 werr = print_queue_resume(conn->server_info, snum);
2876                 break;
2877         case 103: /* Purge */
2878                 werr = print_queue_purge(conn->server_info, snum);
2879                 break;
2880         default:
2881                 werr = WERR_NOT_SUPPORTED;
2882                 break;
2883         }
2884
2885         errcode = W_ERROR_V(werr);
2886
2887  out:
2888         SSVAL(*rparam,0,errcode);
2889         SSVAL(*rparam,2,0);             /* converter word */
2890
2891         return(True);
2892 }
2893
2894 /****************************************************************************
2895   set the property of a print job (undocumented?)
2896   ? function = 0xb -> set name of print job
2897   ? function = 0x6 -> move print job up/down
2898   Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
2899   or   <WWsTP> <WB21BB16B10zWWzDDz>
2900 ****************************************************************************/
2901
2902 static int check_printjob_info(struct pack_desc* desc,
2903                                int uLevel, char* id)
2904 {
2905         desc->subformat = NULL;
2906         switch( uLevel ) {
2907         case 0: desc->format = "W"; break;
2908         case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
2909         case 2: desc->format = "WWzWWDDzz"; break;
2910         case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
2911         case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
2912         default:
2913                 DEBUG(0,("check_printjob_info: invalid level %d\n",
2914                         uLevel ));
2915                 return False;
2916         }
2917         if (id == NULL || strcmp(desc->format,id) != 0) {
2918                 DEBUG(0,("check_printjob_info: invalid format %s\n",
2919                         id ? id : "<NULL>" ));
2920                 return False;
2921         }
2922         return True;
2923 }
2924
2925 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
2926                                 char *param, int tpscnt,
2927                                 char *data, int tdscnt,
2928                                 int mdrcnt,int mprcnt,
2929                                 char **rdata,char **rparam,
2930                                 int *rdata_len,int *rparam_len)
2931 {
2932         struct pack_desc desc;
2933         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2934         char *str2 = skip_string(param,tpscnt,str1);
2935         char *p = skip_string(param,tpscnt,str2);
2936         uint32 jobid;
2937         fstring sharename;
2938         int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
2939         int function = get_safe_SVAL(param,tpscnt,p,4,-1);
2940         int place, errcode;
2941
2942         if (!str1 || !str2 || !p) {
2943                 return False;
2944         }
2945         /*
2946          * We use 1 here not 2 as we're checking
2947          * the last byte we want to access is safe.
2948          */
2949         if (!is_offset_safe(param,tpscnt,p,1)) {
2950                 return False;
2951         }
2952         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2953                 return False;
2954         *rparam_len = 4;
2955         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2956         if (!*rparam) {
2957                 return False;
2958         }
2959
2960         if (!share_defined(sharename)) {
2961                 DEBUG(0,("api_PrintJobInfo: sharen [%s] not defined\n",
2962                          sharename));
2963                 return False;
2964         }
2965
2966         *rdata_len = 0;
2967
2968         /* check it's a supported varient */
2969         if ((strcmp(str1,"WWsTP")) ||
2970             (!check_printjob_info(&desc,uLevel,str2)))
2971                 return(False);
2972
2973         if (!print_job_exists(sharename, jobid)) {
2974                 errcode=NERR_JobNotFound;
2975                 goto out;
2976         }
2977
2978         errcode = NERR_notsupported;
2979
2980         switch (function) {
2981         case 0x6:
2982                 /* change job place in the queue,
2983                    data gives the new place */
2984                 place = SVAL(data,0);
2985                 if (print_job_set_place(sharename, jobid, place)) {
2986                         errcode=NERR_Success;
2987                 }
2988                 break;
2989
2990         case 0xb:
2991                 /* change print job name, data gives the name */
2992                 if (print_job_set_name(sharename, jobid, data)) {
2993                         errcode=NERR_Success;
2994                 }
2995                 break;
2996
2997         default:
2998                 return False;
2999         }
3000
3001  out:
3002         SSVALS(*rparam,0,errcode);
3003         SSVAL(*rparam,2,0);             /* converter word */
3004
3005         return(True);
3006 }
3007
3008
3009 /****************************************************************************
3010  Get info about the server.
3011 ****************************************************************************/
3012
3013 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
3014                                 char *param, int tpscnt,
3015                                 char *data, int tdscnt,
3016                                 int mdrcnt,int mprcnt,
3017                                 char **rdata,char **rparam,
3018                                 int *rdata_len,int *rparam_len)
3019 {
3020         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3021         char *str2 = skip_string(param,tpscnt,str1);
3022         char *p = skip_string(param,tpscnt,str2);
3023         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3024         char *p2;
3025         int struct_len;
3026
3027         if (!str1 || !str2 || !p) {
3028                 return False;
3029         }
3030
3031         DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3032
3033         /* check it's a supported varient */
3034         if (!prefix_ok(str1,"WrLh")) {
3035                 return False;
3036         }
3037
3038         switch( uLevel ) {
3039                 case 0:
3040                         if (strcmp(str2,"B16") != 0) {
3041                                 return False;
3042                         }
3043                         struct_len = 16;
3044                         break;
3045                 case 1:
3046                         if (strcmp(str2,"B16BBDz") != 0) {
3047                                 return False;
3048                         }
3049                         struct_len = 26;
3050                         break;
3051                 case 2:
3052                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3053                                 return False;
3054                         }
3055                         struct_len = 134;
3056                         break;
3057                 case 3:
3058                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3059                                 return False;
3060                         }
3061                         struct_len = 144;
3062                         break;
3063                 case 20:
3064                         if (strcmp(str2,"DN") != 0) {
3065                                 return False;
3066                         }
3067                         struct_len = 6;
3068                         break;
3069                 case 50:
3070                         if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3071                                 return False;
3072                         }
3073                         struct_len = 42;
3074                         break;
3075                 default:
3076                         return False;
3077         }
3078
3079         *rdata_len = mdrcnt;
3080         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3081         if (!*rdata) {
3082                 return False;
3083         }
3084
3085         p = *rdata;
3086         p2 = p + struct_len;
3087         if (uLevel != 20) {
3088                 srvstr_push(NULL, 0, p,global_myname(),16,
3089                         STR_ASCII|STR_UPPER|STR_TERMINATE);
3090         }
3091         p += 16;
3092         if (uLevel > 0) {
3093                 struct srv_info_struct *servers=NULL;
3094                 int i,count;
3095                 char *comment = NULL;
3096                 TALLOC_CTX *ctx = talloc_tos();
3097                 uint32 servertype= lp_default_server_announce();
3098
3099                 comment = talloc_strdup(ctx,lp_serverstring());
3100                 if (!comment) {
3101                         return false;
3102                 }
3103
3104                 if ((count=get_server_info(SV_TYPE_ALL,&servers,lp_workgroup()))>0) {
3105                         for (i=0;i<count;i++) {
3106                                 if (strequal(servers[i].name,global_myname())) {
3107                                         servertype = servers[i].type;
3108                                         TALLOC_FREE(comment);
3109                                         comment = talloc_strdup(ctx,
3110                                                         servers[i].comment);
3111                                         if (comment) {
3112                                                 return false;
3113                                         }
3114                                 }
3115                         }
3116                 }
3117
3118                 SAFE_FREE(servers);
3119
3120                 SCVAL(p,0,lp_major_announce_version());
3121                 SCVAL(p,1,lp_minor_announce_version());
3122                 SIVAL(p,2,servertype);
3123
3124                 if (mdrcnt == struct_len) {
3125                         SIVAL(p,6,0);
3126                 } else {
3127                         SIVAL(p,6,PTR_DIFF(p2,*rdata));
3128                         comment = talloc_sub_advanced(
3129                                 ctx,
3130                                 lp_servicename(SNUM(conn)),
3131                                 conn->server_info->unix_name,
3132                                 conn->connectpath,
3133                                 conn->server_info->utok.gid,
3134                                 conn->server_info->sanitized_username,
3135                                 pdb_get_domain(conn->server_info->sam_account),
3136                                 comment);
3137                         if (comment) {
3138                                 return false;
3139                         }
3140                         if (mdrcnt - struct_len <= 0) {
3141                                 return false;
3142                         }
3143                         push_ascii(p2,
3144                                 comment,
3145                                 MIN(mdrcnt - struct_len,
3146                                         MAX_SERVER_STRING_LENGTH),
3147                                 STR_TERMINATE);
3148                         p2 = skip_string(*rdata,*rdata_len,p2);
3149                         if (!p2) {
3150                                 return False;
3151                         }
3152                 }
3153         }
3154
3155         if (uLevel > 1) {
3156                 return False;           /* not yet implemented */
3157         }
3158
3159         *rdata_len = PTR_DIFF(p2,*rdata);
3160
3161         *rparam_len = 6;
3162         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3163         if (!*rparam) {
3164                 return False;
3165         }
3166         SSVAL(*rparam,0,NERR_Success);
3167         SSVAL(*rparam,2,0);             /* converter word */
3168         SSVAL(*rparam,4,*rdata_len);
3169
3170         return True;
3171 }
3172
3173 /****************************************************************************
3174  Get info about the server.
3175 ****************************************************************************/
3176
3177 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3178                                 char *param, int tpscnt,
3179                                 char *data, int tdscnt,
3180                                 int mdrcnt,int mprcnt,
3181                                 char **rdata,char **rparam,
3182                                 int *rdata_len,int *rparam_len)
3183 {
3184         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3185         char *str2 = skip_string(param,tpscnt,str1);
3186         char *p = skip_string(param,tpscnt,str2);
3187         char *p2;
3188         char *endp;
3189         int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3190
3191         if (!str1 || !str2 || !p) {
3192                 return False;
3193         }
3194
3195         DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3196
3197         *rparam_len = 6;
3198         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3199         if (!*rparam) {
3200                 return False;
3201         }
3202
3203         /* check it's a supported varient */
3204         if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3205                 return False;
3206         }
3207
3208         *rdata_len = mdrcnt + 1024;
3209         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3210         if (!*rdata) {
3211                 return False;
3212         }
3213
3214         SSVAL(*rparam,0,NERR_Success);
3215         SSVAL(*rparam,2,0);             /* converter word */
3216
3217         p = *rdata;
3218         endp = *rdata + *rdata_len;
3219
3220         p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3221         if (!p2) {
3222                 return False;
3223         }
3224
3225         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3226         strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3227         strupper_m(p2);
3228         p2 = skip_string(*rdata,*rdata_len,p2);
3229         if (!p2) {
3230                 return False;
3231         }
3232         p += 4;
3233
3234         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3235         strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3236         p2 = skip_string(*rdata,*rdata_len,p2);
3237         if (!p2) {
3238                 return False;
3239         }
3240         p += 4;
3241
3242         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3243         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3244         strupper_m(p2);
3245         p2 = skip_string(*rdata,*rdata_len,p2);
3246         if (!p2) {
3247                 return False;
3248         }
3249         p += 4;
3250
3251         SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3252         SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3253         p += 2;
3254
3255         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3256         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));   /* don't know.  login domain?? */
3257         p2 = skip_string(*rdata,*rdata_len,p2);
3258         if (!p2) {
3259                 return False;
3260         }
3261         p += 4;
3262
3263         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3264         strlcpy(p2,"",PTR_DIFF(endp,p2));
3265         p2 = skip_string(*rdata,*rdata_len,p2);
3266         if (!p2) {
3267                 return False;
3268         }
3269         p += 4;
3270
3271         *rdata_len = PTR_DIFF(p2,*rdata);
3272
3273         SSVAL(*rparam,4,*rdata_len);
3274
3275         return True;
3276 }
3277
3278 /****************************************************************************
3279   get info about a user
3280
3281     struct user_info_11 {
3282         char                usri11_name[21];  0-20
3283         char                usri11_pad;       21
3284         char                *usri11_comment;  22-25
3285         char            *usri11_usr_comment;  26-29
3286         unsigned short      usri11_priv;      30-31
3287         unsigned long       usri11_auth_flags; 32-35
3288         long                usri11_password_age; 36-39
3289         char                *usri11_homedir; 40-43
3290         char            *usri11_parms; 44-47
3291         long                usri11_last_logon; 48-51
3292         long                usri11_last_logoff; 52-55
3293         unsigned short      usri11_bad_pw_count; 56-57
3294         unsigned short      usri11_num_logons; 58-59
3295         char                *usri11_logon_server; 60-63
3296         unsigned short      usri11_country_code; 64-65
3297         char            *usri11_workstations; 66-69
3298         unsigned long       usri11_max_storage; 70-73
3299         unsigned short      usri11_units_per_week; 74-75
3300         unsigned char       *usri11_logon_hours; 76-79
3301         unsigned short      usri11_code_page; 80-81
3302     };
3303
3304 where:
3305
3306   usri11_name specifies the user name for which information is retrieved
3307
3308   usri11_pad aligns the next data structure element to a word boundary
3309
3310   usri11_comment is a null terminated ASCII comment
3311
3312   usri11_user_comment is a null terminated ASCII comment about the user
3313
3314   usri11_priv specifies the level of the privilege assigned to the user.
3315        The possible values are:
3316
3317 Name             Value  Description
3318 USER_PRIV_GUEST  0      Guest privilege
3319 USER_PRIV_USER   1      User privilege
3320 USER_PRV_ADMIN   2      Administrator privilege
3321
3322   usri11_auth_flags specifies the account operator privileges. The
3323        possible values are:
3324
3325 Name            Value   Description
3326 AF_OP_PRINT     0       Print operator
3327
3328
3329 Leach, Naik                                        [Page 28]
3330 \f
3331
3332
3333 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3334
3335
3336 AF_OP_COMM      1       Communications operator
3337 AF_OP_SERVER    2       Server operator
3338 AF_OP_ACCOUNTS  3       Accounts operator
3339
3340
3341   usri11_password_age specifies how many seconds have elapsed since the
3342        password was last changed.
3343
3344   usri11_home_dir points to a null terminated ASCII string that contains
3345        the path name of the user's home directory.
3346
3347   usri11_parms points to a null terminated ASCII string that is set
3348        aside for use by applications.
3349
3350   usri11_last_logon specifies the time when the user last logged on.
3351        This value is stored as the number of seconds elapsed since
3352        00:00:00, January 1, 1970.
3353
3354   usri11_last_logoff specifies the time when the user last logged off.
3355        This value is stored as the number of seconds elapsed since
3356        00:00:00, January 1, 1970. A value of 0 means the last logoff
3357        time is unknown.
3358
3359   usri11_bad_pw_count specifies the number of incorrect passwords
3360        entered since the last successful logon.
3361
3362   usri11_log1_num_logons specifies the number of times this user has
3363        logged on. A value of -1 means the number of logons is unknown.
3364
3365   usri11_logon_server points to a null terminated ASCII string that
3366        contains the name of the server to which logon requests are sent.
3367        A null string indicates logon requests should be sent to the
3368        domain controller.
3369
3370   usri11_country_code specifies the country code for the user's language
3371        of choice.
3372
3373   usri11_workstations points to a null terminated ASCII string that
3374        contains the names of workstations the user may log on from.
3375        There may be up to 8 workstations, with the names separated by
3376        commas. A null strings indicates there are no restrictions.
3377
3378   usri11_max_storage specifies the maximum amount of disk space the user
3379        can occupy. A value of 0xffffffff indicates there are no
3380        restrictions.
3381
3382   usri11_units_per_week specifies the equal number of time units into
3383        which a week is divided. This value must be equal to 168.
3384
3385   usri11_logon_hours points to a 21 byte (168 bits) string that
3386        specifies the time during which the user can log on. Each bit
3387        represents one unique hour in a week. The first bit (bit 0, word
3388        0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3389
3390
3391
3392 Leach, Naik                                        [Page 29]
3393 \f
3394
3395
3396 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3397
3398
3399        Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3400        are no restrictions.
3401
3402   usri11_code_page specifies the code page for the user's language of
3403        choice
3404
3405 All of the pointers in this data structure need to be treated
3406 specially. The  pointer is a 32 bit pointer. The higher 16 bits need
3407 to be ignored. The converter word returned in the parameters section
3408 needs to be subtracted from the lower 16 bits to calculate an offset
3409 into the return buffer where this ASCII string resides.
3410
3411 There is no auxiliary data in the response.
3412
3413   ****************************************************************************/
3414
3415 #define usri11_name           0
3416 #define usri11_pad            21
3417 #define usri11_comment        22
3418 #define usri11_usr_comment    26
3419 #define usri11_full_name      30
3420 #define usri11_priv           34
3421 #define usri11_auth_flags     36
3422 #define usri11_password_age   40
3423 #define usri11_homedir        44
3424 #define usri11_parms          48
3425 #define usri11_last_logon     52
3426 #define usri11_last_logoff    56
3427 #define usri11_bad_pw_count   60
3428 #define usri11_num_logons     62
3429 #define usri11_logon_server   64
3430 #define usri11_country_code   68
3431 #define usri11_workstations   70
3432 #define usri11_max_storage    74
3433 #define usri11_units_per_week 78
3434 #define usri11_logon_hours    80
3435 #define usri11_code_page      84
3436 #define usri11_end            86
3437
3438 #define USER_PRIV_GUEST 0
3439 #define USER_PRIV_USER 1
3440 #define USER_PRIV_ADMIN 2
3441
3442 #define AF_OP_PRINT     0
3443 #define AF_OP_COMM      1
3444 #define AF_OP_SERVER    2
3445 #define AF_OP_ACCOUNTS  3
3446
3447
3448 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3449                                 char *param, int tpscnt,
3450                                 char *data, int tdscnt,
3451                                 int mdrcnt,int mprcnt,
3452                                 char **rdata,char **rparam,
3453                                 int *rdata_len,int *rparam_len)
3454 {
3455         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3456         char *str2 = skip_string(param,tpscnt,str1);
3457         char *UserName = skip_string(param,tpscnt,str2);
3458         char *p = skip_string(param,tpscnt,UserName);
3459         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3460         char *p2;
3461         char *endp;
3462         const char *level_string;
3463
3464         /* get NIS home of a previously validated user - simeon */
3465         /* With share level security vuid will always be zero.
3466            Don't depend on vuser being non-null !!. JRA */
3467         user_struct *vuser = get_valid_user_struct(vuid);
3468         if(vuser != NULL) {
3469                 DEBUG(3,("  Username of UID %d is %s\n",
3470                          (int)vuser->server_info->utok.uid,
3471                          vuser->server_info->unix_name));
3472         }
3473
3474         if (!str1 || !str2 || !UserName || !p) {
3475                 return False;
3476         }
3477
3478         *rparam_len = 6;
3479         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3480         if (!*rparam) {
3481                 return False;
3482         }
3483
3484         DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3485
3486         /* check it's a supported variant */
3487         if (strcmp(str1,"zWrLh") != 0) {
3488                 return False;
3489         }
3490         switch( uLevel ) {
3491                 case 0: level_string = "B21"; break;
3492                 case 1: level_string = "B21BB16DWzzWz"; break;
3493                 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3494                 case 10: level_string = "B21Bzzz"; break;
3495                 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3496                 default: return False;
3497         }
3498
3499         if (strcmp(level_string,str2) != 0) {
3500                 return False;
3501         }
3502
3503         *rdata_len = mdrcnt + 1024;
3504         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3505         if (!*rdata) {
3506                 return False;
3507         }
3508
3509         SSVAL(*rparam,0,NERR_Success);
3510         SSVAL(*rparam,2,0);             /* converter word */
3511
3512         p = *rdata;
3513         endp = *rdata + *rdata_len;
3514         p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3515         if (!p2) {
3516                 return False;
3517         }
3518
3519         memset(p,0,21);
3520         fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
3521
3522         if (uLevel > 0) {
3523                 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
3524                 *p2 = 0;
3525         }
3526
3527         if (uLevel >= 10) {
3528                 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
3529                 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
3530                 p2 = skip_string(*rdata,*rdata_len,p2);
3531                 if (!p2) {
3532                         return False;
3533                 }
3534
3535                 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
3536                 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
3537                 p2 = skip_string(*rdata,*rdata_len,p2);
3538                 if (!p2) {
3539                         return False;
3540                 }
3541
3542                 /* EEK! the cifsrap.txt doesn't have this in!!!! */
3543                 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
3544                 strlcpy(p2,((vuser != NULL)
3545                             ? pdb_get_fullname(vuser->server_info->sam_account)
3546                             : UserName),PTR_DIFF(endp,p2));
3547                 p2 = skip_string(*rdata,*rdata_len,p2);
3548                 if (!p2) {
3549                         return False;
3550                 }
3551         }
3552
3553         if (uLevel == 11) {
3554                 const char *homedir = "";
3555                 if (vuser != NULL) {
3556                         homedir = pdb_get_homedir(
3557                                 vuser->server_info->sam_account);
3558                 }
3559                 /* modelled after NTAS 3.51 reply */
3560                 SSVAL(p,usri11_priv,conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3561                 SIVAL(p,usri11_auth_flags,AF_OP_PRINT);         /* auth flags */
3562                 SIVALS(p,usri11_password_age,-1);               /* password age */
3563                 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
3564                 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
3565                 p2 = skip_string(*rdata,*rdata_len,p2);
3566                 if (!p2) {
3567                         return False;
3568                 }
3569                 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
3570                 strlcpy(p2,"",PTR_DIFF(endp,p2));
3571                 p2 = skip_string(*rdata,*rdata_len,p2);
3572                 if (!p2) {
3573                         return False;
3574                 }
3575                 SIVAL(p,usri11_last_logon,0);           /* last logon */
3576                 SIVAL(p,usri11_last_logoff,0);          /* last logoff */
3577                 SSVALS(p,usri11_bad_pw_count,-1);       /* bad pw counts */
3578                 SSVALS(p,usri11_num_logons,-1);         /* num logons */
3579                 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
3580                 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
3581                 p2 = skip_string(*rdata,*rdata_len,p2);
3582                 if (!p2) {
3583                         return False;
3584                 }
3585                 SSVAL(p,usri11_country_code,0);         /* country code */
3586
3587                 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
3588                 strlcpy(p2,"",PTR_DIFF(endp,p2));
3589                 p2 = skip_string(*rdata,*rdata_len,p2);
3590                 if (!p2) {
3591                         return False;
3592                 }
3593
3594                 SIVALS(p,usri11_max_storage,-1);                /* max storage */
3595                 SSVAL(p,usri11_units_per_week,168);             /* units per week */
3596                 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
3597
3598                 /* a simple way to get logon hours at all times. */
3599                 memset(p2,0xff,21);
3600                 SCVAL(p2,21,0);           /* fix zero termination */
3601                 p2 = skip_string(*rdata,*rdata_len,p2);
3602                 if (!p2) {
3603                         return False;
3604                 }
3605
3606                 SSVAL(p,usri11_code_page,0);            /* code page */
3607         }
3608
3609         if (uLevel == 1 || uLevel == 2) {
3610                 memset(p+22,' ',16);    /* password */
3611                 SIVALS(p,38,-1);                /* password age */
3612                 SSVAL(p,42,
3613                 conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3614                 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
3615                 strlcpy(p2, vuser ? pdb_get_homedir(
3616                                 vuser->server_info->sam_account) : "",
3617                         PTR_DIFF(endp,p2));
3618                 p2 = skip_string(*rdata,*rdata_len,p2);
3619                 if (!p2) {
3620                         return False;
3621                 }
3622                 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
3623                 *p2++ = 0;
3624                 SSVAL(p,52,0);          /* flags */
3625                 SIVAL(p,54,PTR_DIFF(p2,*rdata));                /* script_path */
3626                 strlcpy(p2, vuser ? pdb_get_logon_script(
3627                                 vuser->server_info->sam_account) : "",
3628                         PTR_DIFF(endp,p2));
3629                 p2 = skip_string(*rdata,*rdata_len,p2);
3630                 if (!p2) {
3631                         return False;
3632                 }
3633                 if (uLevel == 2) {
3634                         SIVAL(p,60,0);          /* auth_flags */
3635                         SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
3636                         strlcpy(p2,((vuser != NULL)
3637                                     ? pdb_get_fullname(vuser->server_info->sam_account)
3638                                     : UserName),PTR_DIFF(endp,p2));
3639                         p2 = skip_string(*rdata,*rdata_len,p2);
3640                         if (!p2) {
3641                                 return False;
3642                         }
3643                         SIVAL(p,68,0);          /* urs_comment */
3644                         SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
3645                         strlcpy(p2,"",PTR_DIFF(endp,p2));
3646                         p2 = skip_string(*rdata,*rdata_len,p2);
3647                         if (!p2) {
3648                                 return False;
3649                         }
3650                         SIVAL(p,76,0);          /* workstations */
3651                         SIVAL(p,80,0);          /* last_logon */
3652                         SIVAL(p,84,0);          /* last_logoff */
3653                         SIVALS(p,88,-1);                /* acct_expires */
3654                         SIVALS(p,92,-1);                /* max_storage */
3655                         SSVAL(p,96,168);        /* units_per_week */
3656                         SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
3657                         memset(p2,-1,21);
3658                         p2 += 21;
3659                         SSVALS(p,102,-1);       /* bad_pw_count */
3660                         SSVALS(p,104,-1);       /* num_logons */
3661                         SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
3662                         {
3663                                 TALLOC_CTX *ctx = talloc_tos();
3664                                 int space_rem = *rdata_len - (p2 - *rdata);
3665                                 char *tmp;
3666
3667                                 if (space_rem <= 0) {
3668                                         return false;
3669                                 }
3670                                 tmp = talloc_strdup(ctx, "\\\\%L");
3671                                 if (!tmp) {
3672                                         return false;
3673                                 }
3674                                 tmp = talloc_sub_basic(ctx,
3675                                                 "",
3676                                                 "",
3677                                                 tmp);
3678                                 if (!tmp) {
3679                                         return false;
3680                                 }
3681
3682                                 push_ascii(p2,
3683                                         tmp,
3684                                         space_rem,
3685                                         STR_TERMINATE);
3686                         }
3687                         p2 = skip_string(*rdata,*rdata_len,p2);
3688                         if (!p2) {
3689                                 return False;
3690                         }
3691                         SSVAL(p,110,49);        /* country_code */
3692                         SSVAL(p,112,860);       /* code page */
3693                 }
3694         }
3695
3696         *rdata_len = PTR_DIFF(p2,*rdata);
3697
3698         SSVAL(*rparam,4,*rdata_len);    /* is this right?? */
3699
3700         return(True);
3701 }
3702
3703 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
3704                                 char *param, int tpscnt,
3705                                 char *data, int tdscnt,
3706                                 int mdrcnt,int mprcnt,
3707                                 char **rdata,char **rparam,
3708                                 int *rdata_len,int *rparam_len)
3709 {
3710         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3711         char *str2 = skip_string(param,tpscnt,str1);
3712         char *p = skip_string(param,tpscnt,str2);
3713         int uLevel;
3714         struct pack_desc desc;
3715         char* name;
3716                 /* With share level security vuid will always be zero.
3717                    Don't depend on vuser being non-null !!. JRA */
3718         user_struct *vuser = get_valid_user_struct(vuid);
3719
3720         if (!str1 || !str2 || !p) {
3721                 return False;
3722         }
3723
3724         if(vuser != NULL) {
3725                 DEBUG(3,("  Username of UID %d is %s\n",
3726                          (int)vuser->server_info->utok.uid,
3727                          vuser->server_info->unix_name));
3728         }
3729
3730         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3731         name = get_safe_str_ptr(param,tpscnt,p,2);
3732         if (!name) {
3733                 return False;
3734         }
3735
3736         memset((char *)&desc,'\0',sizeof(desc));
3737
3738         DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
3739
3740         /* check it's a supported varient */
3741         if (strcmp(str1,"OOWb54WrLh") != 0) {
3742                 return False;
3743         }
3744         if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
3745                 return False;
3746         }
3747         if (mdrcnt > 0) {
3748                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3749                 if (!*rdata) {
3750                         return False;
3751                 }
3752         }
3753
3754         desc.base = *rdata;
3755         desc.buflen = mdrcnt;
3756         desc.subformat = NULL;
3757         desc.format = str2;
3758
3759         if (init_package(&desc,1,0)) {
3760                 PACKI(&desc,"W",0);             /* code */
3761                 PACKS(&desc,"B21",name);        /* eff. name */
3762                 PACKS(&desc,"B","");            /* pad */
3763                 PACKI(&desc,"W", conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3764                 PACKI(&desc,"D",0);             /* auth flags XXX */
3765                 PACKI(&desc,"W",0);             /* num logons */
3766                 PACKI(&desc,"W",0);             /* bad pw count */
3767                 PACKI(&desc,"D",0);             /* last logon */
3768                 PACKI(&desc,"D",-1);            /* last logoff */
3769                 PACKI(&desc,"D",-1);            /* logoff time */
3770                 PACKI(&desc,"D",-1);            /* kickoff time */
3771                 PACKI(&desc,"D",0);             /* password age */
3772                 PACKI(&desc,"D",0);             /* password can change */
3773                 PACKI(&desc,"D",-1);            /* password must change */
3774
3775                 {
3776                         fstring mypath;
3777                         fstrcpy(mypath,"\\\\");
3778                         fstrcat(mypath,get_local_machine_name());
3779                         strupper_m(mypath);
3780                         PACKS(&desc,"z",mypath); /* computer */
3781                 }
3782
3783                 PACKS(&desc,"z",lp_workgroup());/* domain */
3784                 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
3785                               vuser->server_info->sam_account) : ""); /* script path */
3786                 PACKI(&desc,"D",0x00000000);            /* reserved */
3787         }
3788
3789         *rdata_len = desc.usedlen;
3790         *rparam_len = 6;
3791         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3792         if (!*rparam) {
3793                 return False;
3794         }
3795         SSVALS(*rparam,0,desc.errcode);
3796         SSVAL(*rparam,2,0);
3797         SSVAL(*rparam,4,desc.neededlen);
3798
3799         DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
3800
3801         return True;
3802 }
3803
3804 /****************************************************************************
3805  api_WAccessGetUserPerms
3806 ****************************************************************************/
3807
3808 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
3809                                 char *param, int tpscnt,
3810                                 char *data, int tdscnt,
3811                                 int mdrcnt,int mprcnt,
3812                                 char **rdata,char **rparam,
3813                                 int *rdata_len,int *rparam_len)
3814 {
3815         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3816         char *str2 = skip_string(param,tpscnt,str1);
3817         char *user = skip_string(param,tpscnt,str2);
3818         char *resource = skip_string(param,tpscnt,user);
3819
3820         if (!str1 || !str2 || !user || !resource) {
3821                 return False;
3822         }
3823
3824         if (skip_string(param,tpscnt,resource) == NULL) {
3825                 return False;
3826         }
3827         DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
3828
3829         /* check it's a supported varient */
3830         if (strcmp(str1,"zzh") != 0) {
3831                 return False;
3832         }
3833         if (strcmp(str2,"") != 0) {
3834                 return False;
3835         }
3836
3837         *rparam_len = 6;
3838         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3839         if (!*rparam) {
3840                 return False;
3841         }
3842         SSVALS(*rparam,0,0);            /* errorcode */
3843         SSVAL(*rparam,2,0);             /* converter word */
3844         SSVAL(*rparam,4,0x7f);  /* permission flags */
3845
3846         return True;
3847 }
3848
3849 /****************************************************************************
3850   api_WPrintJobEnumerate
3851   ****************************************************************************/
3852
3853 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
3854                                 char *param, int tpscnt,
3855                                 char *data, int tdscnt,
3856                                 int mdrcnt,int mprcnt,
3857                                 char **rdata,char **rparam,
3858                                 int *rdata_len,int *rparam_len)
3859 {
3860         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3861         char *str2 = skip_string(param,tpscnt,str1);
3862         char *p = skip_string(param,tpscnt,str2);
3863         int uLevel;
3864         int count;
3865         int i;
3866         int snum;
3867         fstring sharename;
3868         uint32 jobid;
3869         struct pack_desc desc;
3870         print_queue_struct *queue=NULL;
3871         print_status_struct status;
3872         char *tmpdata=NULL;
3873
3874         if (!str1 || !str2 || !p) {
3875                 return False;
3876         }
3877
3878         uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3879
3880         memset((char *)&desc,'\0',sizeof(desc));
3881         memset((char *)&status,'\0',sizeof(status));
3882
3883         DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
3884
3885         /* check it's a supported varient */
3886         if (strcmp(str1,"WWrLh") != 0) {
3887                 return False;
3888         }
3889         if (!check_printjob_info(&desc,uLevel,str2)) {
3890                 return False;
3891         }
3892
3893         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
3894                 return False;
3895         }
3896
3897         snum = lp_servicenumber( sharename);
3898         if (snum < 0 || !VALID_SNUM(snum)) {
3899                 return(False);
3900         }
3901
3902         count = print_queue_status(snum,&queue,&status);
3903         for (i = 0; i < count; i++) {
3904                 if (queue[i].job == jobid) {
3905                         break;
3906                 }
3907         }
3908
3909         if (mdrcnt > 0) {
3910                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3911                 if (!*rdata) {
3912                         return False;
3913                 }
3914                 desc.base = *rdata;
3915                 desc.buflen = mdrcnt;
3916         } else {
3917                 /*
3918                  * Don't return data but need to get correct length
3919                  *  init_package will return wrong size if buflen=0
3920                  */
3921                 desc.buflen = getlen(desc.format);
3922                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
3923         }
3924
3925         if (init_package(&desc,1,0)) {
3926                 if (i < count) {
3927                         fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
3928                         *rdata_len = desc.usedlen;
3929                 } else {
3930                         desc.errcode = NERR_JobNotFound;
3931                         *rdata_len = 0;
3932                 }
3933         }
3934
3935         *rparam_len = 6;
3936         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3937         if (!*rparam) {
3938                 return False;
3939         }
3940         SSVALS(*rparam,0,desc.errcode);
3941         SSVAL(*rparam,2,0);
3942         SSVAL(*rparam,4,desc.neededlen);
3943
3944         SAFE_FREE(queue);
3945         SAFE_FREE(tmpdata);
3946
3947         DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
3948
3949         return True;
3950 }
3951
3952 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
3953                                 char *param, int tpscnt,
3954                                 char *data, int tdscnt,
3955                                 int mdrcnt,int mprcnt,
3956                                 char **rdata,char **rparam,
3957                                 int *rdata_len,int *rparam_len)
3958 {
3959         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3960         char *str2 = skip_string(param,tpscnt,str1);
3961         char *p = skip_string(param,tpscnt,str2);
3962         char *name = p;
3963         int uLevel;
3964         int count;
3965         int i, succnt=0;
3966         int snum;
3967         struct pack_desc desc;
3968         print_queue_struct *queue=NULL;
3969         print_status_struct status;
3970
3971         if (!str1 || !str2 || !p) {
3972                 return False;
3973         }
3974
3975         memset((char *)&desc,'\0',sizeof(desc));
3976         memset((char *)&status,'\0',sizeof(status));
3977
3978         p = skip_string(param,tpscnt,p);
3979         if (!p) {
3980                 return False;
3981         }
3982         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3983
3984         DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
3985
3986         /* check it's a supported variant */
3987         if (strcmp(str1,"zWrLeh") != 0) {
3988                 return False;
3989         }
3990
3991         if (uLevel > 2) {
3992                 return False;   /* defined only for uLevel 0,1,2 */
3993         }
3994
3995         if (!check_printjob_info(&desc,uLevel,str2)) {
3996                 return False;
3997         }
3998
3999         snum = find_service(name);
4000         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4001                 return False;
4002         }
4003
4004         count = print_queue_status(snum,&queue,&status);
4005         if (mdrcnt > 0) {
4006                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4007                 if (!*rdata) {
4008                         return False;
4009                 }
4010         }
4011         desc.base = *rdata;
4012         desc.buflen = mdrcnt;
4013
4014         if (init_package(&desc,count,0)) {
4015                 succnt = 0;
4016                 for (i = 0; i < count; i++) {
4017                         fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4018                         if (desc.errcode == NERR_Success) {
4019                                 succnt = i+1;
4020                         }
4021                 }
4022         }
4023
4024         *rdata_len = desc.usedlen;
4025
4026         *rparam_len = 8;
4027         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4028         if (!*rparam) {
4029                 return False;
4030         }
4031         SSVALS(*rparam,0,desc.errcode);
4032         SSVAL(*rparam,2,0);
4033         SSVAL(*rparam,4,succnt);
4034         SSVAL(*rparam,6,count);
4035
4036         SAFE_FREE(queue);
4037
4038         DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4039
4040         return True;
4041 }
4042
4043 static int check_printdest_info(struct pack_desc* desc,
4044                                 int uLevel, char* id)
4045 {
4046         desc->subformat = NULL;
4047         switch( uLevel ) {
4048                 case 0:
4049                         desc->format = "B9";
4050                         break;
4051                 case 1:
4052                         desc->format = "B9B21WWzW";
4053                         break;
4054                 case 2:
4055                         desc->format = "z";
4056                         break;
4057                 case 3:
4058                         desc->format = "zzzWWzzzWW";
4059                         break;
4060                 default:
4061                         DEBUG(0,("check_printdest_info: invalid level %d\n",
4062                                 uLevel));
4063                         return False;
4064         }
4065         if (id == NULL || strcmp(desc->format,id) != 0) {
4066                 DEBUG(0,("check_printdest_info: invalid string %s\n",
4067                         id ? id : "<NULL>" ));
4068                 return False;
4069         }
4070         return True;
4071 }
4072
4073 static void fill_printdest_info(connection_struct *conn, int snum, int uLevel,
4074                                 struct pack_desc* desc)
4075 {
4076         char buf[100];
4077
4078         strncpy(buf,SERVICE(snum),sizeof(buf)-1);
4079         buf[sizeof(buf)-1] = 0;
4080         strupper_m(buf);
4081
4082         if (uLevel <= 1) {
4083                 PACKS(desc,"B9",buf);   /* szName */
4084                 if (uLevel == 1) {
4085                         PACKS(desc,"B21","");   /* szUserName */
4086                         PACKI(desc,"W",0);              /* uJobId */
4087                         PACKI(desc,"W",0);              /* fsStatus */
4088                         PACKS(desc,"z","");     /* pszStatus */
4089                         PACKI(desc,"W",0);              /* time */
4090                 }
4091         }
4092
4093         if (uLevel == 2 || uLevel == 3) {
4094                 PACKS(desc,"z",buf);            /* pszPrinterName */
4095                 if (uLevel == 3) {
4096                         PACKS(desc,"z","");     /* pszUserName */
4097                         PACKS(desc,"z","");     /* pszLogAddr */
4098                         PACKI(desc,"W",0);              /* uJobId */
4099                         PACKI(desc,"W",0);              /* fsStatus */
4100                         PACKS(desc,"z","");     /* pszStatus */
4101                         PACKS(desc,"z","");     /* pszComment */
4102                         PACKS(desc,"z","NULL"); /* pszDrivers */
4103                         PACKI(desc,"W",0);              /* time */
4104                         PACKI(desc,"W",0);              /* pad1 */
4105                 }
4106         }
4107 }
4108
4109 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
4110                                 char *param, int tpscnt,
4111                                 char *data, int tdscnt,
4112                                 int mdrcnt,int mprcnt,
4113                                 char **rdata,char **rparam,
4114                                 int *rdata_len,int *rparam_len)
4115 {
4116         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4117         char *str2 = skip_string(param,tpscnt,str1);
4118         char *p = skip_string(param,tpscnt,str2);
4119         char* PrinterName = p;
4120         int uLevel;
4121         struct pack_desc desc;
4122         int snum;
4123         char *tmpdata=NULL;
4124
4125         if (!str1 || !str2 || !p) {
4126                 return False;
4127         }
4128
4129         memset((char *)&desc,'\0',sizeof(desc));
4130
4131         p = skip_string(param,tpscnt,p);
4132         if (!p) {
4133                 return False;
4134         }
4135         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4136
4137         DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4138
4139         /* check it's a supported varient */
4140         if (strcmp(str1,"zWrLh") != 0) {
4141                 return False;
4142         }
4143         if (!check_printdest_info(&desc,uLevel,str2)) {
4144                 return False;
4145         }
4146
4147         snum = find_service(PrinterName);
4148         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4149                 *rdata_len = 0;
4150                 desc.errcode = NERR_DestNotFound;
4151                 desc.neededlen = 0;
4152         } else {
4153                 if (mdrcnt > 0) {
4154                         *rdata = smb_realloc_limit(*rdata,mdrcnt);
4155                         if (!*rdata) {
4156                                 return False;
4157                         }
4158                         desc.base = *rdata;
4159                         desc.buflen = mdrcnt;
4160                 } else {
4161                         /*
4162                          * Don't return data but need to get correct length
4163                          * init_package will return wrong size if buflen=0
4164                          */
4165                         desc.buflen = getlen(desc.format);
4166                         desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4167                 }
4168                 if (init_package(&desc,1,0)) {
4169                         fill_printdest_info(conn,snum,uLevel,&desc);
4170                 }
4171                 *rdata_len = desc.usedlen;
4172         }
4173
4174         *rparam_len = 6;
4175         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4176         if (!*rparam) {
4177                 return False;
4178         }
4179         SSVALS(*rparam,0,desc.errcode);
4180         SSVAL(*rparam,2,0);
4181         SSVAL(*rparam,4,desc.neededlen);
4182
4183         DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4184         SAFE_FREE(tmpdata);
4185
4186         return True;
4187 }
4188
4189 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4190                                 char *param, int tpscnt,
4191                                 char *data, int tdscnt,
4192                                 int mdrcnt,int mprcnt,
4193                                 char **rdata,char **rparam,
4194                                 int *rdata_len,int *rparam_len)
4195 {
4196         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4197         char *str2 = skip_string(param,tpscnt,str1);
4198         char *p = skip_string(param,tpscnt,str2);
4199         int uLevel;
4200         int queuecnt;
4201         int i, n, succnt=0;
4202         struct pack_desc desc;
4203         int services = lp_numservices();
4204
4205         if (!str1 || !str2 || !p) {
4206                 return False;
4207         }
4208
4209         memset((char *)&desc,'\0',sizeof(desc));
4210
4211         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4212
4213         DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4214
4215         /* check it's a supported varient */
4216         if (strcmp(str1,"WrLeh") != 0) {
4217                 return False;
4218         }
4219         if (!check_printdest_info(&desc,uLevel,str2)) {
4220                 return False;
4221         }
4222
4223         queuecnt = 0;
4224         for (i = 0; i < services; i++) {
4225                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4226                         queuecnt++;
4227                 }
4228         }
4229
4230         if (mdrcnt > 0) {
4231                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4232                 if (!*rdata) {
4233                         return False;
4234                 }
4235         }
4236
4237         desc.base = *rdata;
4238         desc.buflen = mdrcnt;
4239         if (init_package(&desc,queuecnt,0)) {
4240                 succnt = 0;
4241                 n = 0;
4242                 for (i = 0; i < services; i++) {
4243                         if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4244                                 fill_printdest_info(conn,i,uLevel,&desc);
4245                                 n++;
4246                                 if (desc.errcode == NERR_Success) {
4247                                         succnt = n;
4248                                 }
4249                         }
4250                 }
4251         }
4252
4253         *rdata_len = desc.usedlen;
4254
4255         *rparam_len = 8;
4256         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4257         if (!*rparam) {
4258                 return False;
4259         }
4260         SSVALS(*rparam,0,desc.errcode);
4261         SSVAL(*rparam,2,0);
4262         SSVAL(*rparam,4,succnt);
4263         SSVAL(*rparam,6,queuecnt);
4264
4265         DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4266
4267         return True;
4268 }
4269
4270 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4271                                 char *param, int tpscnt,
4272                                 char *data, int tdscnt,
4273                                 int mdrcnt,int mprcnt,
4274                                 char **rdata,char **rparam,
4275                                 int *rdata_len,int *rparam_len)
4276 {
4277         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4278         char *str2 = skip_string(param,tpscnt,str1);
4279         char *p = skip_string(param,tpscnt,str2);
4280         int uLevel;
4281         int succnt;
4282         struct pack_desc desc;
4283
4284         if (!str1 || !str2 || !p) {
4285                 return False;
4286         }
4287
4288         memset((char *)&desc,'\0',sizeof(desc));
4289
4290         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4291
4292         DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4293
4294         /* check it's a supported varient */
4295         if (strcmp(str1,"WrLeh") != 0) {
4296                 return False;
4297         }
4298         if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4299                 return False;
4300         }
4301
4302         if (mdrcnt > 0) {
4303                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4304                 if (!*rdata) {
4305                         return False;
4306                 }
4307         }
4308         desc.base = *rdata;
4309         desc.buflen = mdrcnt;
4310         if (init_package(&desc,1,0)) {
4311                 PACKS(&desc,"B41","NULL");
4312         }
4313
4314         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4315
4316         *rdata_len = desc.usedlen;
4317
4318         *rparam_len = 8;
4319         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4320         if (!*rparam) {
4321                 return False;
4322         }
4323         SSVALS(*rparam,0,desc.errcode);
4324         SSVAL(*rparam,2,0);
4325         SSVAL(*rparam,4,succnt);
4326         SSVAL(*rparam,6,1);
4327
4328         DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4329
4330         return True;
4331 }
4332
4333 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4334                                 char *param, int tpscnt,
4335                                 char *data, int tdscnt,
4336                                 int mdrcnt,int mprcnt,
4337                                 char **rdata,char **rparam,
4338                                 int *rdata_len,int *rparam_len)
4339 {
4340         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4341         char *str2 = skip_string(param,tpscnt,str1);
4342         char *p = skip_string(param,tpscnt,str2);
4343         int uLevel;
4344         int succnt;
4345         struct pack_desc desc;
4346
4347         if (!str1 || !str2 || !p) {
4348                 return False;
4349         }
4350         memset((char *)&desc,'\0',sizeof(desc));
4351
4352         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4353
4354         DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4355
4356         /* check it's a supported varient */
4357         if (strcmp(str1,"WrLeh") != 0) {
4358                 return False;
4359         }
4360         if (uLevel != 0 || strcmp(str2,"B13") != 0) {
4361                 return False;
4362         }
4363
4364         if (mdrcnt > 0) {
4365                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4366                 if (!*rdata) {
4367                         return False;
4368                 }
4369         }
4370         desc.base = *rdata;
4371         desc.buflen = mdrcnt;
4372         desc.format = str2;
4373         if (init_package(&desc,1,0)) {
4374                 PACKS(&desc,"B13","lpd");
4375         }
4376
4377         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4378
4379         *rdata_len = desc.usedlen;
4380
4381         *rparam_len = 8;
4382         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4383         if (!*rparam) {
4384                 return False;
4385         }
4386         SSVALS(*rparam,0,desc.errcode);
4387         SSVAL(*rparam,2,0);
4388         SSVAL(*rparam,4,succnt);
4389         SSVAL(*rparam,6,1);
4390
4391         DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
4392
4393         return True;
4394 }
4395
4396 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
4397                                 char *param, int tpscnt,
4398                                 char *data, int tdscnt,
4399                                 int mdrcnt,int mprcnt,
4400                                 char **rdata,char **rparam,
4401                                 int *rdata_len,int *rparam_len)
4402 {
4403         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4404         char *str2 = skip_string(param,tpscnt,str1);
4405         char *p = skip_string(param,tpscnt,str2);
4406         int uLevel;
4407         int succnt;
4408         struct pack_desc desc;
4409
4410         if (!str1 || !str2 || !p) {
4411                 return False;
4412         }
4413
4414         memset((char *)&desc,'\0',sizeof(desc));
4415
4416         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4417
4418         DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
4419
4420         /* check it's a supported varient */
4421         if (strcmp(str1,"WrLeh") != 0) {
4422                 return False;
4423         }
4424         if (uLevel != 0 || strcmp(str2,"B9") != 0) {
4425                 return False;
4426         }
4427
4428         if (mdrcnt > 0) {
4429                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4430                 if (!*rdata) {
4431                         return False;
4432                 }
4433         }
4434         memset((char *)&desc,'\0',sizeof(desc));
4435         desc.base = *rdata;
4436         desc.buflen = mdrcnt;
4437         desc.format = str2;
4438         if (init_package(&desc,1,0)) {
4439                 PACKS(&desc,"B13","lp0");
4440         }
4441
4442         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4443
4444         *rdata_len = desc.usedlen;
4445
4446         *rparam_len = 8;
4447         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4448         if (!*rparam) {
4449                 return False;
4450         }
4451         SSVALS(*rparam,0,desc.errcode);
4452         SSVAL(*rparam,2,0);
4453         SSVAL(*rparam,4,succnt);
4454         SSVAL(*rparam,6,1);
4455
4456         DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
4457
4458         return True;
4459 }
4460
4461 /****************************************************************************
4462  List open sessions
4463  ****************************************************************************/
4464
4465 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
4466                                 char *param, int tpscnt,
4467                                 char *data, int tdscnt,
4468                                 int mdrcnt,int mprcnt,
4469                                 char **rdata,char **rparam,
4470                                 int *rdata_len,int *rparam_len)
4471
4472 {
4473         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4474         char *str2 = skip_string(param,tpscnt,str1);
4475         char *p = skip_string(param,tpscnt,str2);
4476         int uLevel;
4477         struct pack_desc desc;
4478         struct sessionid *session_list;
4479         int i, num_sessions;
4480
4481         if (!str1 || !str2 || !p) {
4482                 return False;
4483         }
4484
4485         memset((char *)&desc,'\0',sizeof(desc));
4486
4487         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4488
4489         DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
4490         DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
4491         DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
4492
4493         /* check it's a supported varient */
4494         if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
4495                 return False;
4496         }
4497         if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
4498                 return False;
4499         }
4500
4501         num_sessions = list_sessions(talloc_tos(), &session_list);
4502
4503         if (mdrcnt > 0) {
4504                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4505                 if (!*rdata) {
4506                         return False;
4507                 }
4508         }
4509         memset((char *)&desc,'\0',sizeof(desc));
4510         desc.base = *rdata;
4511         desc.buflen = mdrcnt;
4512         desc.format = str2;
4513         if (!init_package(&desc,num_sessions,0)) {
4514                 return False;
4515         }
4516
4517         for(i=0; i<num_sessions; i++) {
4518                 PACKS(&desc, "z", session_list[i].remote_machine);
4519                 PACKS(&desc, "z", session_list[i].username);
4520                 PACKI(&desc, "W", 1); /* num conns */
4521                 PACKI(&desc, "W", 0); /* num opens */
4522                 PACKI(&desc, "W", 1); /* num users */
4523                 PACKI(&desc, "D", 0); /* session time */
4524                 PACKI(&desc, "D", 0); /* idle time */
4525                 PACKI(&desc, "D", 0); /* flags */
4526                 PACKS(&desc, "z", "Unknown Client"); /* client type string */
4527         }
4528
4529         *rdata_len = desc.usedlen;
4530
4531         *rparam_len = 8;
4532         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4533         if (!*rparam) {
4534                 return False;
4535         }
4536         SSVALS(*rparam,0,desc.errcode);
4537         SSVAL(*rparam,2,0); /* converter */
4538         SSVAL(*rparam,4,num_sessions); /* count */
4539
4540         DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
4541
4542         return True;
4543 }
4544
4545
4546 /****************************************************************************
4547  The buffer was too small.
4548  ****************************************************************************/
4549
4550 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
4551                          int mdrcnt, int mprcnt,
4552                          char **rdata, char **rparam,
4553                          int *rdata_len, int *rparam_len)
4554 {
4555         *rparam_len = MIN(*rparam_len,mprcnt);
4556         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4557         if (!*rparam) {
4558                 return False;
4559         }
4560
4561         *rdata_len = 0;
4562
4563         SSVAL(*rparam,0,NERR_BufTooSmall);
4564
4565         DEBUG(3,("Supplied buffer too small in API command\n"));
4566
4567         return True;
4568 }
4569
4570 /****************************************************************************
4571  The request is not supported.
4572  ****************************************************************************/
4573
4574 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
4575                                 char *param, int tpscnt,
4576                                 char *data, int tdscnt,
4577                                 int mdrcnt, int mprcnt,
4578                                 char **rdata, char **rparam,
4579                                 int *rdata_len, int *rparam_len)
4580 {
4581         *rparam_len = 4;
4582         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4583         if (!*rparam) {
4584                 return False;
4585         }
4586
4587         *rdata_len = 0;
4588
4589         SSVAL(*rparam,0,NERR_notsupported);
4590         SSVAL(*rparam,2,0);             /* converter word */
4591
4592         DEBUG(3,("Unsupported API command\n"));
4593
4594         return True;
4595 }
4596
4597 static const struct {
4598         const char *name;
4599         int id;
4600         bool (*fn)(connection_struct *, uint16,
4601                         char *, int,
4602                         char *, int,
4603                         int,int,char **,char **,int *,int *);
4604         bool auth_user;         /* Deny anonymous access? */
4605 } api_commands[] = {
4606         {"RNetShareEnum",       RAP_WshareEnum,         api_RNetShareEnum, True},
4607         {"RNetShareGetInfo",    RAP_WshareGetInfo,      api_RNetShareGetInfo},
4608         {"RNetShareAdd",        RAP_WshareAdd,          api_RNetShareAdd},
4609         {"RNetSessionEnum",     RAP_WsessionEnum,       api_RNetSessionEnum, True},
4610         {"RNetServerGetInfo",   RAP_WserverGetInfo,     api_RNetServerGetInfo},
4611         {"RNetGroupEnum",       RAP_WGroupEnum,         api_RNetGroupEnum, True},
4612         {"RNetGroupGetUsers", RAP_WGroupGetUsers,       api_RNetGroupGetUsers, True},
4613         {"RNetUserEnum",        RAP_WUserEnum,          api_RNetUserEnum, True},
4614         {"RNetUserGetInfo",     RAP_WUserGetInfo,       api_RNetUserGetInfo},
4615         {"NetUserGetGroups",    RAP_WUserGetGroups,     api_NetUserGetGroups},
4616         {"NetWkstaGetInfo",     RAP_WWkstaGetInfo,      api_NetWkstaGetInfo},
4617         {"DosPrintQEnum",       RAP_WPrintQEnum,        api_DosPrintQEnum, True},
4618         {"DosPrintQGetInfo",    RAP_WPrintQGetInfo,     api_DosPrintQGetInfo},
4619         {"WPrintQueuePause",  RAP_WPrintQPause, api_WPrintQueueCtrl},
4620         {"WPrintQueueResume", RAP_WPrintQContinue,      api_WPrintQueueCtrl},
4621         {"WPrintJobEnumerate",RAP_WPrintJobEnum,        api_WPrintJobEnumerate},
4622         {"WPrintJobGetInfo",    RAP_WPrintJobGetInfo,   api_WPrintJobGetInfo},
4623         {"RDosPrintJobDel",     RAP_WPrintJobDel,       api_RDosPrintJobDel},
4624         {"RDosPrintJobPause",   RAP_WPrintJobPause,     api_RDosPrintJobDel},
4625         {"RDosPrintJobResume",RAP_WPrintJobContinue,    api_RDosPrintJobDel},
4626         {"WPrintDestEnum",      RAP_WPrintDestEnum,     api_WPrintDestEnum},
4627         {"WPrintDestGetInfo",   RAP_WPrintDestGetInfo,  api_WPrintDestGetInfo},
4628         {"NetRemoteTOD",        RAP_NetRemoteTOD,       api_NetRemoteTOD},
4629         {"WPrintQueuePurge",    RAP_WPrintQPurge,       api_WPrintQueueCtrl},
4630         {"NetServerEnum",       RAP_NetServerEnum2,     api_RNetServerEnum}, /* anon OK */
4631         {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
4632         {"SetUserPassword",     RAP_WUserPasswordSet2,  api_SetUserPassword},
4633         {"WWkstaUserLogon",     RAP_WWkstaUserLogon,    api_WWkstaUserLogon},
4634         {"PrintJobInfo",        RAP_WPrintJobSetInfo,   api_PrintJobInfo},
4635         {"WPrintDriverEnum",    RAP_WPrintDriverEnum,   api_WPrintDriverEnum},
4636         {"WPrintQProcEnum",     RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
4637         {"WPrintPortEnum",      RAP_WPrintPortEnum,     api_WPrintPortEnum},
4638         {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
4639         {NULL,          -1,     api_Unsupported}
4640         /*  The following RAP calls are not implemented by Samba:
4641
4642         RAP_WFileEnum2 - anon not OK
4643         */
4644 };
4645
4646
4647 /****************************************************************************
4648  Handle remote api calls.
4649 ****************************************************************************/
4650
4651 void api_reply(connection_struct *conn, uint16 vuid,
4652                struct smb_request *req,
4653                char *data, char *params,
4654                int tdscnt, int tpscnt,
4655                int mdrcnt, int mprcnt)
4656 {
4657         int api_command;
4658         char *rdata = NULL;
4659         char *rparam = NULL;
4660         const char *name1 = NULL;
4661         const char *name2 = NULL;
4662         int rdata_len = 0;
4663         int rparam_len = 0;
4664         bool reply=False;
4665         int i;
4666
4667         if (!params) {
4668                 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
4669                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4670                 return;
4671         }
4672
4673         if (tpscnt < 2) {
4674                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4675                 return;
4676         }
4677         api_command = SVAL(params,0);
4678         /* Is there a string at position params+2 ? */
4679         if (skip_string(params,tpscnt,params+2)) {
4680                 name1 = params + 2;
4681         } else {
4682                 name1 = "";
4683         }
4684         name2 = skip_string(params,tpscnt,params+2);
4685         if (!name2) {
4686                 name2 = "";
4687         }
4688
4689         DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
4690                 api_command,
4691                 name1,
4692                 name2,
4693                 tdscnt,tpscnt,mdrcnt,mprcnt));
4694
4695         for (i=0;api_commands[i].name;i++) {
4696                 if (api_commands[i].id == api_command && api_commands[i].fn) {
4697                         DEBUG(3,("Doing %s\n",api_commands[i].name));
4698                         break;
4699                 }
4700         }
4701
4702         /* Check whether this api call can be done anonymously */
4703
4704         if (api_commands[i].auth_user && lp_restrict_anonymous()) {
4705                 user_struct *user = get_valid_user_struct(vuid);
4706
4707                 if (!user || user->server_info->guest) {
4708                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4709                         return;
4710                 }
4711         }
4712
4713         rdata = (char *)SMB_MALLOC(1024);
4714         if (rdata) {
4715                 memset(rdata,'\0',1024);
4716         }
4717
4718         rparam = (char *)SMB_MALLOC(1024);
4719         if (rparam) {
4720                 memset(rparam,'\0',1024);
4721         }
4722
4723         if(!rdata || !rparam) {
4724                 DEBUG(0,("api_reply: malloc fail !\n"));
4725                 SAFE_FREE(rdata);
4726                 SAFE_FREE(rparam);
4727                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4728                 return;
4729         }
4730
4731         reply = api_commands[i].fn(conn,
4732                                 vuid,
4733                                 params,tpscnt,  /* params + length */
4734                                 data,tdscnt,    /* data + length */
4735                                 mdrcnt,mprcnt,
4736                                 &rdata,&rparam,&rdata_len,&rparam_len);
4737
4738
4739         if (rdata_len > mdrcnt || rparam_len > mprcnt) {
4740                 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
4741                                         &rdata,&rparam,&rdata_len,&rparam_len);
4742         }
4743
4744         /* if we get False back then it's actually unsupported */
4745         if (!reply) {
4746                 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
4747                         &rdata,&rparam,&rdata_len,&rparam_len);
4748         }
4749
4750         /* If api_Unsupported returns false we can't return anything. */
4751         if (reply) {
4752                 send_trans_reply(conn, req, rparam, rparam_len,
4753                                  rdata, rdata_len, False);
4754         }
4755
4756         SAFE_FREE(rdata);
4757         SAFE_FREE(rparam);
4758         return;
4759 }