source3/smbd/lanman.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Inter-process communication and named pipe handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Jeremy Allison 2007.
   6
   7    SMB Version handling
   8    Copyright (C) John H Terpstra 1995-1998
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22    */
  23 /*
  24    This file handles the named pipe and mailslot calls
  25    in the SMBtrans protocol
  26    */
  27
  28 #include "includes.h"
  29 #include "smbd/globals.h"
  30 #include "../librpc/gen_ndr/cli_samr.h"
  31 #include "../librpc/gen_ndr/srv_samr.h"
  32
  33 #ifdef CHECK_TYPES
  34 #undef CHECK_TYPES
  35 #endif
  36 #define CHECK_TYPES 0
  37
  38 #define NERR_Success 0
  39 #define NERR_badpass 86
  40 #define NERR_notsupported 50
  41
  42 #define NERR_BASE (2100)
  43 #define NERR_BufTooSmall (NERR_BASE+23)
  44 #define NERR_JobNotFound (NERR_BASE+51)
  45 #define NERR_DestNotFound (NERR_BASE+52)
  46
  47 #define ACCESS_READ 0x01
  48 #define ACCESS_WRITE 0x02
  49 #define ACCESS_CREATE 0x04
  50
  51 #define SHPWLEN 8               /* share password length */
  52
  53 /* Limit size of ipc replies */
  54
  55 static char *smb_realloc_limit(void *ptr, size_t size)
  56 {
  57         char *val;
  58
  59         size = MAX((size),4*1024);
  60         val = (char *)SMB_REALLOC(ptr,size);
  61         if (val) {
  62                 memset(val,'\0',size);
  63         }
  64         return val;
  65 }
  66
  67 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
  68                                 char *param, int tpscnt,
  69                                 char *data, int tdscnt,
  70                                 int mdrcnt, int mprcnt,
  71                                 char **rdata, char **rparam,
  72                                 int *rdata_len, int *rparam_len);
  73
  74 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
  75                          int mdrcnt, int mprcnt,
  76                          char **rdata, char **rparam,
  77                          int *rdata_len, int *rparam_len);
  78
  79
  80 static int CopyExpanded(connection_struct *conn,
  81                         int snum, char **dst, char *src, int *p_space_remaining)
  82 {
  83         TALLOC_CTX *ctx = talloc_tos();
  84         char *buf = NULL;
  85         int l;
  86
  87         if (!src || !dst || !p_space_remaining || !(*dst) ||
  88                         *p_space_remaining <= 0) {
  89                 return 0;
  90         }
  91
  92         buf = talloc_strdup(ctx, src);
  93         if (!buf) {
  94                 *p_space_remaining = 0;
  95                 return 0;
  96         }
  97         buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
  98         if (!buf) {
  99                 *p_space_remaining = 0;
 100                 return 0;
 101         }
 102         buf = talloc_sub_advanced(ctx,
 103                                 lp_servicename(SNUM(conn)),
 104                                 conn->server_info->unix_name,
 105                                 conn->connectpath,
 106                                 conn->server_info->utok.gid,
 107                                 conn->server_info->sanitized_username,
 108                                 pdb_get_domain(conn->server_info->sam_account),
 109                                 buf);
 110         if (!buf) {
 111                 *p_space_remaining = 0;
 112                 return 0;
 113         }
 114         l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
 115         if (l == -1) {
 116                 return 0;
 117         }
 118         (*dst) += l;
 119         (*p_space_remaining) -= l;
 120         return l;
 121 }
 122
 123 static int CopyAndAdvance(char **dst, char *src, int *n)
 124 {
 125         int l;
 126         if (!src || !dst || !n || !(*dst)) {
 127                 return 0;
 128         }
 129         l = push_ascii(*dst,src,*n, STR_TERMINATE);
 130         if (l == -1) {
 131                 return 0;
 132         }
 133         (*dst) += l;
 134         (*n) -= l;
 135         return l;
 136 }
 137
 138 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
 139 {
 140         TALLOC_CTX *ctx = talloc_tos();
 141         char *buf = NULL;
 142         if (!s) {
 143                 return 0;
 144         }
 145         buf = talloc_strdup(ctx,s);
 146         if (!buf) {
 147                 return 0;
 148         }
 149         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 150         if (!buf) {
 151                 return 0;
 152         }
 153         buf = talloc_sub_advanced(ctx,
 154                                 lp_servicename(SNUM(conn)),
 155                                 conn->server_info->unix_name,
 156                                 conn->connectpath,
 157                                 conn->server_info->utok.gid,
 158                                 conn->server_info->sanitized_username,
 159                                 pdb_get_domain(conn->server_info->sam_account),
 160                                 buf);
 161         if (!buf) {
 162                 return 0;
 163         }
 164         return strlen(buf) + 1;
 165 }
 166
 167 static char *Expand(connection_struct *conn, int snum, char *s)
 168 {
 169         TALLOC_CTX *ctx = talloc_tos();
 170         char *buf = NULL;
 171
 172         if (!s) {
 173                 return NULL;
 174         }
 175         buf = talloc_strdup(ctx,s);
 176         if (!buf) {
 177                 return 0;
 178         }
 179         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 180         if (!buf) {
 181                 return 0;
 182         }
 183         return talloc_sub_advanced(ctx,
 184                                 lp_servicename(SNUM(conn)),
 185                                 conn->server_info->unix_name,
 186                                 conn->connectpath,
 187                                 conn->server_info->utok.gid,
 188                                 conn->server_info->sanitized_username,
 189                                 pdb_get_domain(conn->server_info->sam_account),
 190                                 buf);
 191 }
 192
 193 /*******************************************************************
 194  Check a API string for validity when we only need to check the prefix.
 195 ******************************************************************/
 196
 197 static bool prefix_ok(const char *str, const char *prefix)
 198 {
 199         return(strncmp(str,prefix,strlen(prefix)) == 0);
 200 }
 201
 202 struct pack_desc {
 203         const char *format;         /* formatstring for structure */
 204         const char *subformat;  /* subformat for structure */
 205         char *base;         /* baseaddress of buffer */
 206         int buflen;        /* remaining size for fixed part; on init: length of base */
 207         int subcount;       /* count of substructures */
 208         char *structbuf;  /* pointer into buffer for remaining fixed part */
 209         int stringlen;    /* remaining size for variable part */
 210         char *stringbuf;  /* pointer into buffer for remaining variable part */
 211         int neededlen;    /* total needed size */
 212         int usedlen;        /* total used size (usedlen <= neededlen and usedlen <= buflen) */
 213         const char *curpos;         /* current position; pointer into format or subformat */
 214         int errcode;
 215 };
 216
 217 static int get_counter(const char **p)
 218 {
 219         int i, n;
 220         if (!p || !(*p)) {
 221                 return 1;
 222         }
 223         if (!isdigit((int)**p)) {
 224                 return 1;
 225         }
 226         for (n = 0;;) {
 227                 i = **p;
 228                 if (isdigit(i)) {
 229                         n = 10 * n + (i - '0');
 230                 } else {
 231                         return n;
 232                 }
 233                 (*p)++;
 234         }
 235 }
 236
 237 static int getlen(const char *p)
 238 {
 239         int n = 0;
 240         if (!p) {
 241                 return 0;
 242         }
 243
 244         while (*p) {
 245                 switch( *p++ ) {
 246                 case 'W':                       /* word (2 byte) */
 247                         n += 2;
 248                         break;
 249                 case 'K':                       /* status word? (2 byte) */
 250                         n += 2;
 251                         break;
 252                 case 'N':                       /* count of substructures (word) at end */
 253                         n += 2;
 254                         break;
 255                 case 'D':                       /* double word (4 byte) */
 256                 case 'z':                       /* offset to zero terminated string (4 byte) */
 257                 case 'l':                       /* offset to user data (4 byte) */
 258                         n += 4;
 259                         break;
 260                 case 'b':                       /* offset to data (with counter) (4 byte) */
 261                         n += 4;
 262                         get_counter(&p);
 263                         break;
 264                 case 'B':                       /* byte (with optional counter) */
 265                         n += get_counter(&p);
 266                         break;
 267                 }
 268         }
 269         return n;
 270 }
 271
 272 static bool init_package(struct pack_desc *p, int count, int subcount)
 273 {
 274         int n = p->buflen;
 275         int i;
 276
 277         if (!p->format || !p->base) {
 278                 return False;
 279         }
 280
 281         i = count * getlen(p->format);
 282         if (p->subformat) {
 283                 i += subcount * getlen(p->subformat);
 284         }
 285         p->structbuf = p->base;
 286         p->neededlen = 0;
 287         p->usedlen = 0;
 288         p->subcount = 0;
 289         p->curpos = p->format;
 290         if (i > n) {
 291                 p->neededlen = i;
 292                 i = n = 0;
 293 #if 0
 294                 /*
 295                  * This is the old error code we used. Aparently
 296                  * WinNT/2k systems return ERRbuftoosmall (2123) and
 297                  * OS/2 needs this. I'm leaving this here so we can revert
 298                  * if needed. JRA.
 299                  */
 300                 p->errcode = ERRmoredata;
 301 #else
 302                 p->errcode = ERRbuftoosmall;
 303 #endif
 304         } else {
 305                 p->errcode = NERR_Success;
 306         }
 307         p->buflen = i;
 308         n -= i;
 309         p->stringbuf = p->base + i;
 310         p->stringlen = n;
 311         return (p->errcode == NERR_Success);
 312 }
 313
 314 static int package(struct pack_desc *p, ...)
 315 {
 316         va_list args;
 317         int needed=0, stringneeded;
 318         const char *str=NULL;
 319         int is_string=0, stringused;
 320         int32 temp;
 321
 322         va_start(args,p);
 323
 324         if (!*p->curpos) {
 325                 if (!p->subcount) {
 326                         p->curpos = p->format;
 327                 } else {
 328                         p->curpos = p->subformat;
 329                         p->subcount--;
 330                 }
 331         }
 332 #if CHECK_TYPES
 333         str = va_arg(args,char*);
 334         SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
 335 #endif
 336         stringneeded = -1;
 337
 338         if (!p->curpos) {
 339                 va_end(args);
 340                 return 0;
 341         }
 342
 343         switch( *p->curpos++ ) {
 344                 case 'W':                       /* word (2 byte) */
 345                         needed = 2;
 346                         temp = va_arg(args,int);
 347                         if (p->buflen >= needed) {
 348                                 SSVAL(p->structbuf,0,temp);
 349                         }
 350                         break;
 351                 case 'K':                       /* status word? (2 byte) */
 352                         needed = 2;
 353                         temp = va_arg(args,int);
 354                         if (p->buflen >= needed) {
 355                                 SSVAL(p->structbuf,0,temp);
 356                         }
 357                         break;
 358                 case 'N':                       /* count of substructures (word) at end */
 359                         needed = 2;
 360                         p->subcount = va_arg(args,int);
 361                         if (p->buflen >= needed) {
 362                                 SSVAL(p->structbuf,0,p->subcount);
 363                         }
 364                         break;
 365                 case 'D':                       /* double word (4 byte) */
 366                         needed = 4;
 367                         temp = va_arg(args,int);
 368                         if (p->buflen >= needed) {
 369                                 SIVAL(p->structbuf,0,temp);
 370                         }
 371                         break;
 372                 case 'B':                       /* byte (with optional counter) */
 373                         needed = get_counter(&p->curpos);
 374                         {
 375                                 char *s = va_arg(args,char*);
 376                                 if (p->buflen >= needed) {
 377                                         StrnCpy(p->structbuf,s?s:"",needed-1);
 378                                 }
 379                         }
 380                         break;
 381                 case 'z':                       /* offset to zero terminated string (4 byte) */
 382                         str = va_arg(args,char*);
 383                         stringneeded = (str ? strlen(str)+1 : 0);
 384                         is_string = 1;
 385                         break;
 386                 case 'l':                       /* offset to user data (4 byte) */
 387                         str = va_arg(args,char*);
 388                         stringneeded = va_arg(args,int);
 389                         is_string = 0;
 390                         break;
 391                 case 'b':                       /* offset to data (with counter) (4 byte) */
 392                         str = va_arg(args,char*);
 393                         stringneeded = get_counter(&p->curpos);
 394                         is_string = 0;
 395                         break;
 396         }
 397
 398         va_end(args);
 399         if (stringneeded >= 0) {
 400                 needed = 4;
 401                 if (p->buflen >= needed) {
 402                         stringused = stringneeded;
 403                         if (stringused > p->stringlen) {
 404                                 stringused = (is_string ? p->stringlen : 0);
 405                                 if (p->errcode == NERR_Success) {
 406                                         p->errcode = ERRmoredata;
 407                                 }
 408                         }
 409                         if (!stringused) {
 410                                 SIVAL(p->structbuf,0,0);
 411                         } else {
 412                                 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
 413                                 memcpy(p->stringbuf,str?str:"",stringused);
 414                                 if (is_string) {
 415                                         p->stringbuf[stringused-1] = '\0';
 416                                 }
 417                                 p->stringbuf += stringused;
 418                                 p->stringlen -= stringused;
 419                                 p->usedlen += stringused;
 420                         }
 421                 }
 422                 p->neededlen += stringneeded;
 423         }
 424
 425         p->neededlen += needed;
 426         if (p->buflen >= needed) {
 427                 p->structbuf += needed;
 428                 p->buflen -= needed;
 429                 p->usedlen += needed;
 430         } else {
 431                 if (p->errcode == NERR_Success) {
 432                         p->errcode = ERRmoredata;
 433                 }
 434         }
 435         return 1;
 436 }
 437
 438 #if CHECK_TYPES
 439 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
 440 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
 441 #else
 442 #define PACK(desc,t,v) package(desc,v)
 443 #define PACKl(desc,t,v,l) package(desc,v,l)
 444 #endif
 445
 446 static void PACKI(struct pack_desc* desc, const char *t,int v)
 447 {
 448         PACK(desc,t,v);
 449 }
 450
 451 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
 452 {
 453         PACK(desc,t,v);
 454 }
 455
 456 /****************************************************************************
 457  Get a print queue.
 458 ****************************************************************************/
 459
 460 static void PackDriverData(struct pack_desc* desc)
 461 {
 462         char drivdata[4+4+32];
 463         SIVAL(drivdata,0,sizeof drivdata); /* cb */
 464         SIVAL(drivdata,4,1000); /* lVersion */
 465         memset(drivdata+8,0,32);        /* szDeviceName */
 466         push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
 467         PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
 468 }
 469
 470 static int check_printq_info(struct pack_desc* desc,
 471                                 unsigned int uLevel, char *id1, char *id2)
 472 {
 473         desc->subformat = NULL;
 474         switch( uLevel ) {
 475                 case 0:
 476                         desc->format = "B13";
 477                         break;
 478                 case 1:
 479                         desc->format = "B13BWWWzzzzzWW";
 480                         break;
 481                 case 2:
 482                         desc->format = "B13BWWWzzzzzWN";
 483                         desc->subformat = "WB21BB16B10zWWzDDz";
 484                         break;
 485                 case 3:
 486                         desc->format = "zWWWWzzzzWWzzl";
 487                         break;
 488                 case 4:
 489                         desc->format = "zWWWWzzzzWNzzl";
 490                         desc->subformat = "WWzWWDDzz";
 491                         break;
 492                 case 5:
 493                         desc->format = "z";
 494                         break;
 495                 case 51:
 496                         desc->format = "K";
 497                         break;
 498                 case 52:
 499                         desc->format = "WzzzzzzzzN";
 500                         desc->subformat = "z";
 501                         break;
 502                 default:
 503                         DEBUG(0,("check_printq_info: invalid level %d\n",
 504                                 uLevel ));
 505                         return False;
 506         }
 507         if (id1 == NULL || strcmp(desc->format,id1) != 0) {
 508                 DEBUG(0,("check_printq_info: invalid format %s\n",
 509                         id1 ? id1 : "<NULL>" ));
 510                 return False;
 511         }
 512         if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
 513                 DEBUG(0,("check_printq_info: invalid subformat %s\n",
 514                         id2 ? id2 : "<NULL>" ));
 515                 return False;
 516         }
 517         return True;
 518 }
 519
 520
 521 #define RAP_JOB_STATUS_QUEUED 0
 522 #define RAP_JOB_STATUS_PAUSED 1
 523 #define RAP_JOB_STATUS_SPOOLING 2
 524 #define RAP_JOB_STATUS_PRINTING 3
 525 #define RAP_JOB_STATUS_PRINTED 4
 526
 527 #define RAP_QUEUE_STATUS_PAUSED 1
 528 #define RAP_QUEUE_STATUS_ERROR 2
 529
 530 /* turn a print job status into a on the wire status
 531 */
 532 static int printj_status(int v)
 533 {
 534         switch (v) {
 535         case LPQ_QUEUED:
 536                 return RAP_JOB_STATUS_QUEUED;
 537         case LPQ_PAUSED:
 538                 return RAP_JOB_STATUS_PAUSED;
 539         case LPQ_SPOOLING:
 540                 return RAP_JOB_STATUS_SPOOLING;
 541         case LPQ_PRINTING:
 542                 return RAP_JOB_STATUS_PRINTING;
 543         }
 544         return 0;
 545 }
 546
 547 /* turn a print queue status into a on the wire status
 548 */
 549 static int printq_status(int v)
 550 {
 551         switch (v) {
 552         case LPQ_QUEUED:
 553                 return 0;
 554         case LPQ_PAUSED:
 555                 return RAP_QUEUE_STATUS_PAUSED;
 556         }
 557         return RAP_QUEUE_STATUS_ERROR;
 558 }
 559
 560 static void fill_printjob_info(connection_struct *conn, int snum, int uLevel,
 561                                struct pack_desc *desc,
 562                                print_queue_struct *queue, int n)
 563 {
 564         time_t t = queue->time;
 565
 566         /* the client expects localtime */
 567         t -= get_time_zone(t);
 568
 569         PACKI(desc,"W",pjobid_to_rap(lp_const_servicename(snum),queue->job)); /* uJobId */
 570         if (uLevel == 1) {
 571                 PACKS(desc,"B21",queue->fs_user); /* szUserName */
 572                 PACKS(desc,"B","");             /* pad */
 573                 PACKS(desc,"B16","");   /* szNotifyName */
 574                 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
 575                 PACKS(desc,"z","");             /* pszParms */
 576                 PACKI(desc,"W",n+1);            /* uPosition */
 577                 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
 578                 PACKS(desc,"z","");             /* pszStatus */
 579                 PACKI(desc,"D",t); /* ulSubmitted */
 580                 PACKI(desc,"D",queue->size); /* ulSize */
 581                 PACKS(desc,"z",queue->fs_file); /* pszComment */
 582         }
 583         if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
 584                 PACKI(desc,"W",queue->priority);                /* uPriority */
 585                 PACKS(desc,"z",queue->fs_user); /* pszUserName */
 586                 PACKI(desc,"W",n+1);            /* uPosition */
 587                 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
 588                 PACKI(desc,"D",t); /* ulSubmitted */
 589                 PACKI(desc,"D",queue->size); /* ulSize */
 590                 PACKS(desc,"z","Samba");        /* pszComment */
 591                 PACKS(desc,"z",queue->fs_file); /* pszDocument */
 592                 if (uLevel == 3) {
 593                         PACKS(desc,"z","");     /* pszNotifyName */
 594                         PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
 595                         PACKS(desc,"z","");     /* pszParms */
 596                         PACKS(desc,"z","");     /* pszStatus */
 597                         PACKS(desc,"z",SERVICE(snum)); /* pszQueue */
 598                         PACKS(desc,"z","lpd");  /* pszQProcName */
 599                         PACKS(desc,"z","");     /* pszQProcParms */
 600                         PACKS(desc,"z","NULL"); /* pszDriverName */
 601                         PackDriverData(desc);   /* pDriverData */
 602                         PACKS(desc,"z","");     /* pszPrinterName */
 603                 } else if (uLevel == 4) {   /* OS2 */
 604                         PACKS(desc,"z","");       /* pszSpoolFileName  */
 605                         PACKS(desc,"z","");       /* pszPortName       */
 606                         PACKS(desc,"z","");       /* pszStatus         */
 607                         PACKI(desc,"D",0);        /* ulPagesSpooled    */
 608                         PACKI(desc,"D",0);        /* ulPagesSent       */
 609                         PACKI(desc,"D",0);        /* ulPagesPrinted    */
 610                         PACKI(desc,"D",0);        /* ulTimePrinted     */
 611                         PACKI(desc,"D",0);        /* ulExtendJobStatus */
 612                         PACKI(desc,"D",0);        /* ulStartPage       */
 613                         PACKI(desc,"D",0);        /* ulEndPage         */
 614                 }
 615         }
 616 }
 617
 618 /********************************************************************
 619  Return a driver name given an snum.
 620  Returns True if from tdb, False otherwise.
 621  ********************************************************************/
 622
 623 static bool get_driver_name(int snum, char **pp_drivername)
 624 {
 625         NT_PRINTER_INFO_LEVEL *info = NULL;
 626         bool in_tdb = false;
 627
 628         get_a_printer (NULL, &info, 2, lp_servicename(snum));
 629         if (info != NULL) {
 630                 *pp_drivername = talloc_strdup(talloc_tos(),
 631                                         info->info_2->drivername);
 632                 in_tdb = true;
 633                 free_a_printer(&info, 2);
 634                 if (!*pp_drivername) {
 635                         return false;
 636                 }
 637         }
 638
 639         return in_tdb;
 640 }
 641
 642 /********************************************************************
 643  Respond to the DosPrintQInfo command with a level of 52
 644  This is used to get printer driver information for Win9x clients
 645  ********************************************************************/
 646 static void fill_printq_info_52(connection_struct *conn, int snum,
 647                                 struct pack_desc* desc, int count )
 648 {
 649         int                             i;
 650         fstring                         location;
 651         struct spoolss_DriverInfo8 *driver = NULL;
 652         NT_PRINTER_INFO_LEVEL           *printer = NULL;
 653
 654         if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
 655                 DEBUG(3,("fill_printq_info_52: Failed to lookup printer [%s]\n",
 656                         lp_servicename(snum)));
 657                 goto err;
 658         }
 659
 660         if (!W_ERROR_IS_OK(get_a_printer_driver(talloc_tos(), &driver, printer->info_2->drivername,
 661                 "Windows 4.0", 0)) )
 662         {
 663                 DEBUG(3,("fill_printq_info_52: Failed to lookup driver [%s]\n",
 664                         printer->info_2->drivername));
 665                 goto err;
 666         }
 667
 668         trim_string((char *)driver->driver_path, "\\print$\\WIN40\\0\\", 0);
 669         trim_string((char *)driver->data_file, "\\print$\\WIN40\\0\\", 0);
 670         trim_string((char *)driver->help_file, "\\print$\\WIN40\\0\\", 0);
 671
 672         PACKI(desc, "W", 0x0400);                     /* don't know */
 673         PACKS(desc, "z", driver->driver_name);        /* long printer name */
 674         PACKS(desc, "z", driver->driver_path);  /* Driverfile Name */
 675         PACKS(desc, "z", driver->data_file);    /* Datafile name */
 676         PACKS(desc, "z", driver->monitor_name); /* language monitor */
 677
 678         fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
 679         standard_sub_basic( "", "", location, sizeof(location)-1 );
 680         PACKS(desc,"z", location);                          /* share to retrieve files */
 681
 682         PACKS(desc,"z", driver->default_datatype);    /* default data type */
 683         PACKS(desc,"z", driver->help_file);           /* helpfile name */
 684         PACKS(desc,"z", driver->driver_path);               /* driver name */
 685
 686         DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
 687         DEBUG(3,("Driver: %s:\n",driver->driver_path));
 688         DEBUG(3,("Data File: %s:\n",driver->data_file));
 689         DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
 690         DEBUG(3,("Driver Location: %s:\n",location));
 691         DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
 692         DEBUG(3,("Help File: %s:\n",driver->help_file));
 693         PACKI(desc,"N",count);                     /* number of files to copy */
 694
 695         for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
 696         {
 697                 trim_string((char *)driver->dependent_files[i], "\\print$\\WIN40\\0\\", 0);
 698                 PACKS(desc,"z",driver->dependent_files[i]);         /* driver files to copy */
 699                 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
 700         }
 701
 702         /* sanity check */
 703         if ( i != count )
 704                 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
 705                         count, i));
 706
 707         DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", SERVICE(snum),i));
 708
 709         desc->errcode=NERR_Success;
 710         goto done;
 711
 712 err:
 713         DEBUG(3,("fill_printq_info: Can't supply driver files\n"));
 714         desc->errcode=NERR_notsupported;
 715
 716 done:
 717         if ( printer )
 718                 free_a_printer( &printer, 2 );
 719
 720         free_a_printer_driver(driver);
 721 }
 722
 723
 724 static void fill_printq_info(connection_struct *conn, int snum, int uLevel,
 725                              struct pack_desc* desc,
 726                              int count, print_queue_struct* queue,
 727                              print_status_struct* status)
 728 {
 729         switch (uLevel) {
 730         case 1:
 731         case 2:
 732                 PACKS(desc,"B13",SERVICE(snum));
 733                 break;
 734         case 3:
 735         case 4:
 736         case 5:
 737                 PACKS(desc,"z",Expand(conn,snum,SERVICE(snum)));
 738                 break;
 739         case 51:
 740                 PACKI(desc,"K",printq_status(status->status));
 741                 break;
 742         }
 743
 744         if (uLevel == 1 || uLevel == 2) {
 745                 PACKS(desc,"B","");             /* alignment */
 746                 PACKI(desc,"W",5);              /* priority */
 747                 PACKI(desc,"W",0);              /* start time */
 748                 PACKI(desc,"W",0);              /* until time */
 749                 PACKS(desc,"z","");             /* pSepFile */
 750                 PACKS(desc,"z","lpd");  /* pPrProc */
 751                 PACKS(desc,"z",SERVICE(snum)); /* pDestinations */
 752                 PACKS(desc,"z","");             /* pParms */
 753                 if (snum < 0) {
 754                         PACKS(desc,"z","UNKNOWN PRINTER");
 755                         PACKI(desc,"W",LPSTAT_ERROR);
 756                 }
 757                 else if (!status || !status->message[0]) {
 758                         PACKS(desc,"z",Expand(conn,snum,lp_comment(snum)));
 759                         PACKI(desc,"W",LPSTAT_OK); /* status */
 760                 } else {
 761                         PACKS(desc,"z",status->message);
 762                         PACKI(desc,"W",printq_status(status->status)); /* status */
 763                 }
 764                 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
 765         }
 766
 767         if (uLevel == 3 || uLevel == 4) {
 768                 char *drivername = NULL;
 769
 770                 PACKI(desc,"W",5);              /* uPriority */
 771                 PACKI(desc,"W",0);              /* uStarttime */
 772                 PACKI(desc,"W",0);              /* uUntiltime */
 773                 PACKI(desc,"W",5);              /* pad1 */
 774                 PACKS(desc,"z","");             /* pszSepFile */
 775                 PACKS(desc,"z","WinPrint");     /* pszPrProc */
 776                 PACKS(desc,"z",NULL);           /* pszParms */
 777                 PACKS(desc,"z",NULL);           /* pszComment - don't ask.... JRA */
 778                 /* "don't ask" that it's done this way to fix corrupted
 779                    Win9X/ME printer comments. */
 780                 if (!status) {
 781                         PACKI(desc,"W",LPSTAT_OK); /* fsStatus */
 782                 } else {
 783                         PACKI(desc,"W",printq_status(status->status)); /* fsStatus */
 784                 }
 785                 PACKI(desc,(uLevel == 3 ? "W" : "N"),count);    /* cJobs */
 786                 PACKS(desc,"z",SERVICE(snum)); /* pszPrinters */
 787                 get_driver_name(snum,&drivername);
 788                 if (!drivername) {
 789                         return;
 790                 }
 791                 PACKS(desc,"z",drivername);             /* pszDriverName */
 792                 PackDriverData(desc);   /* pDriverData */
 793         }
 794
 795         if (uLevel == 2 || uLevel == 4) {
 796                 int i;
 797                 for (i=0;i<count;i++)
 798                         fill_printjob_info(conn,snum,uLevel == 2 ? 1 : 2,desc,&queue[i],i);
 799         }
 800
 801         if (uLevel==52)
 802                 fill_printq_info_52( conn, snum, desc, count );
 803 }
 804
 805 /* This function returns the number of files for a given driver */
 806 static int get_printerdrivernumber(int snum)
 807 {
 808         int                             result = 0;
 809         struct spoolss_DriverInfo8 *driver;
 810         NT_PRINTER_INFO_LEVEL           *printer = NULL;
 811
 812         ZERO_STRUCT(driver);
 813
 814         if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
 815                 DEBUG(3,("get_printerdrivernumber: Failed to lookup printer [%s]\n",
 816                         lp_servicename(snum)));
 817                 goto done;
 818         }
 819
 820         if (!W_ERROR_IS_OK(get_a_printer_driver(talloc_tos(), &driver, printer->info_2->drivername,
 821                 "Windows 4.0", 0)) )
 822         {
 823                 DEBUG(3,("get_printerdrivernumber: Failed to lookup driver [%s]\n",
 824                         printer->info_2->drivername));
 825                 goto done;
 826         }
 827
 828         /* count the number of files */
 829         while (driver->dependent_files && *driver->dependent_files[result])
 830                 result++;
 831  done:
 832         if ( printer )
 833                 free_a_printer( &printer, 2 );
 834
 835         free_a_printer_driver(driver);
 836
 837         return result;
 838 }
 839
 840 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
 841                                 char *param, int tpscnt,
 842                                 char *data, int tdscnt,
 843                                 int mdrcnt,int mprcnt,
 844                                 char **rdata,char **rparam,
 845                                 int *rdata_len,int *rparam_len)
 846 {
 847         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
 848         char *str2 = skip_string(param,tpscnt,str1);
 849         char *p = skip_string(param,tpscnt,str2);
 850         char *QueueName = p;
 851         unsigned int uLevel;
 852         int count=0;
 853         int snum;
 854         char *str3;
 855         struct pack_desc desc;
 856         print_queue_struct *queue=NULL;
 857         print_status_struct status;
 858         char* tmpdata=NULL;
 859
 860         if (!str1 || !str2 || !p) {
 861                 return False;
 862         }
 863         memset((char *)&status,'\0',sizeof(status));
 864         memset((char *)&desc,'\0',sizeof(desc));
 865
 866         p = skip_string(param,tpscnt,p);
 867         if (!p) {
 868                 return False;
 869         }
 870         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 871         str3 = get_safe_str_ptr(param,tpscnt,p,4);
 872         /* str3 may be null here and is checked in check_printq_info(). */
 873
 874         /* remove any trailing username */
 875         if ((p = strchr_m(QueueName,'%')))
 876                 *p = 0;
 877
 878         DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
 879
 880         /* check it's a supported varient */
 881         if (!prefix_ok(str1,"zWrLh"))
 882                 return False;
 883         if (!check_printq_info(&desc,uLevel,str2,str3)) {
 884                 /*
 885                  * Patch from Scott Moomaw <scott@bridgewater.edu>
 886                  * to return the 'invalid info level' error if an
 887                  * unknown level was requested.
 888                  */
 889                 *rdata_len = 0;
 890                 *rparam_len = 6;
 891                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
 892                 if (!*rparam) {
 893                         return False;
 894                 }
 895                 SSVALS(*rparam,0,ERRunknownlevel);
 896                 SSVAL(*rparam,2,0);
 897                 SSVAL(*rparam,4,0);
 898                 return(True);
 899         }
 900
 901         snum = find_service(QueueName);
 902         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) )
 903                 return False;
 904
 905         if (uLevel==52) {
 906                 count = get_printerdrivernumber(snum);
 907                 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
 908         } else {
 909                 count = print_queue_status(snum, &queue,&status);
 910         }
 911
 912         if (mdrcnt > 0) {
 913                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
 914                 if (!*rdata) {
 915                         SAFE_FREE(queue);
 916                         return False;
 917                 }
 918                 desc.base = *rdata;
 919                 desc.buflen = mdrcnt;
 920         } else {
 921                 /*
 922                  * Don't return data but need to get correct length
 923                  * init_package will return wrong size if buflen=0
 924                  */
 925                 desc.buflen = getlen(desc.format);
 926                 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
 927         }
 928
 929         if (init_package(&desc,1,count)) {
 930                 desc.subcount = count;
 931                 fill_printq_info(conn,snum,uLevel,&desc,count,queue,&status);
 932         }
 933
 934         *rdata_len = desc.usedlen;
 935
 936         /*
 937          * We must set the return code to ERRbuftoosmall
 938          * in order to support lanman style printing with Win NT/2k
 939          * clients       --jerry
 940          */
 941         if (!mdrcnt && lp_disable_spoolss())
 942                 desc.errcode = ERRbuftoosmall;
 943
 944         *rdata_len = desc.usedlen;
 945         *rparam_len = 6;
 946         *rparam = smb_realloc_limit(*rparam,*rparam_len);
 947         if (!*rparam) {
 948                 SAFE_FREE(queue);
 949                 SAFE_FREE(tmpdata);
 950                 return False;
 951         }
 952         SSVALS(*rparam,0,desc.errcode);
 953         SSVAL(*rparam,2,0);
 954         SSVAL(*rparam,4,desc.neededlen);
 955
 956         DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
 957
 958         SAFE_FREE(queue);
 959         SAFE_FREE(tmpdata);
 960
 961         return(True);
 962 }
 963
 964 /****************************************************************************
 965  View list of all print jobs on all queues.
 966 ****************************************************************************/
 967
 968 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
 969                                 char *param, int tpscnt,
 970                                 char *data, int tdscnt,
 971                                 int mdrcnt, int mprcnt,
 972                                 char **rdata, char** rparam,
 973                                 int *rdata_len, int *rparam_len)
 974 {
 975         char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
 976         char *output_format1 = skip_string(param,tpscnt,param_format);
 977         char *p = skip_string(param,tpscnt,output_format1);
 978         unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 979         char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
 980         int services = lp_numservices();
 981         int i, n;
 982         struct pack_desc desc;
 983         print_queue_struct **queue = NULL;
 984         print_status_struct *status = NULL;
 985         int *subcntarr = NULL;
 986         int queuecnt = 0, subcnt = 0, succnt = 0;
 987
 988         if (!param_format || !output_format1 || !p) {
 989                 return False;
 990         }
 991
 992         memset((char *)&desc,'\0',sizeof(desc));
 993
 994         DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
 995
 996         if (!prefix_ok(param_format,"WrLeh")) {
 997                 return False;
 998         }
 999         if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1000                 /*
1001                  * Patch from Scott Moomaw <scott@bridgewater.edu>
1002                  * to return the 'invalid info level' error if an
1003                  * unknown level was requested.
1004                  */
1005                 *rdata_len = 0;
1006                 *rparam_len = 6;
1007                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1008                 if (!*rparam) {
1009                         return False;
1010                 }
1011                 SSVALS(*rparam,0,ERRunknownlevel);
1012                 SSVAL(*rparam,2,0);
1013                 SSVAL(*rparam,4,0);
1014                 return(True);
1015         }
1016
1017         for (i = 0; i < services; i++) {
1018                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1019                         queuecnt++;
1020                 }
1021         }
1022
1023         if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
1024                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1025                 goto err;
1026         }
1027         memset(queue,0,queuecnt*sizeof(print_queue_struct*));
1028         if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
1029                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1030                 goto err;
1031         }
1032         memset(status,0,queuecnt*sizeof(print_status_struct));
1033         if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1034                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1035                 goto err;
1036         }
1037
1038         subcnt = 0;
1039         n = 0;
1040         for (i = 0; i < services; i++) {
1041                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1042                         subcntarr[n] = print_queue_status(i, &queue[n],&status[n]);
1043                         subcnt += subcntarr[n];
1044                         n++;
1045                 }
1046         }
1047
1048         if (mdrcnt > 0) {
1049                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1050                 if (!*rdata) {
1051                         goto err;
1052                 }
1053         }
1054         desc.base = *rdata;
1055         desc.buflen = mdrcnt;
1056
1057         if (init_package(&desc,queuecnt,subcnt)) {
1058                 n = 0;
1059                 succnt = 0;
1060                 for (i = 0; i < services; i++) {
1061                         if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1062                                 fill_printq_info(conn,i,uLevel,&desc,subcntarr[n],queue[n],&status[n]);
1063                                 n++;
1064                                 if (desc.errcode == NERR_Success) {
1065                                         succnt = n;
1066                                 }
1067                         }
1068                 }
1069         }
1070
1071         SAFE_FREE(subcntarr);
1072
1073         *rdata_len = desc.usedlen;
1074         *rparam_len = 8;
1075         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1076         if (!*rparam) {
1077                 goto err;
1078         }
1079         SSVALS(*rparam,0,desc.errcode);
1080         SSVAL(*rparam,2,0);
1081         SSVAL(*rparam,4,succnt);
1082         SSVAL(*rparam,6,queuecnt);
1083
1084         for (i = 0; i < queuecnt; i++) {
1085                 if (queue) {
1086                         SAFE_FREE(queue[i]);
1087                 }
1088         }
1089
1090         SAFE_FREE(queue);
1091         SAFE_FREE(status);
1092
1093         return True;
1094
1095   err:
1096
1097         SAFE_FREE(subcntarr);
1098         for (i = 0; i < queuecnt; i++) {
1099                 if (queue) {
1100                         SAFE_FREE(queue[i]);
1101                 }
1102         }
1103         SAFE_FREE(queue);
1104         SAFE_FREE(status);
1105
1106         return False;
1107 }
1108
1109 /****************************************************************************
1110  Get info level for a server list query.
1111 ****************************************************************************/
1112
1113 static bool check_server_info(int uLevel, char* id)
1114 {
1115         switch( uLevel ) {
1116                 case 0:
1117                         if (strcmp(id,"B16") != 0) {
1118                                 return False;
1119                         }
1120                         break;
1121                 case 1:
1122                         if (strcmp(id,"B16BBDz") != 0) {
1123                                 return False;
1124                         }
1125                         break;
1126                 default:
1127                         return False;
1128         }
1129         return True;
1130 }
1131
1132 struct srv_info_struct {
1133         fstring name;
1134         uint32 type;
1135         fstring comment;
1136         fstring domain;
1137         bool server_added;
1138 };
1139
1140 /*******************************************************************
1141  Get server info lists from the files saved by nmbd. Return the
1142  number of entries.
1143 ******************************************************************/
1144
1145 static int get_server_info(uint32 servertype,
1146                            struct srv_info_struct **servers,
1147                            const char *domain)
1148 {
1149         int count=0;
1150         int alloced=0;
1151         char **lines;
1152         bool local_list_only;
1153         int i;
1154
1155         lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1156         if (!lines) {
1157                 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1158                 return 0;
1159         }
1160
1161         /* request for everything is code for request all servers */
1162         if (servertype == SV_TYPE_ALL) {
1163                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1164         }
1165
1166         local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1167
1168         DEBUG(4,("Servertype search: %8x\n",servertype));
1169
1170         for (i=0;lines[i];i++) {
1171                 fstring stype;
1172                 struct srv_info_struct *s;
1173                 const char *ptr = lines[i];
1174                 bool ok = True;
1175                 TALLOC_CTX *frame = NULL;
1176                 char *p;
1177
1178                 if (!*ptr) {
1179                         continue;
1180                 }
1181
1182                 if (count == alloced) {
1183                         alloced += 10;
1184                         *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1185                         if (!*servers) {
1186                                 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1187                                 TALLOC_FREE(lines);
1188                                 return 0;
1189                         }
1190                         memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1191                 }
1192                 s = &(*servers)[count];
1193
1194                 frame = talloc_stackframe();
1195                 s->name[0] = '\0';
1196                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1197                         TALLOC_FREE(frame);
1198                         continue;
1199                 }
1200                 fstrcpy(s->name, p);
1201
1202                 stype[0] = '\0';
1203                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1204                         TALLOC_FREE(frame);
1205                         continue;
1206                 }
1207                 fstrcpy(stype, p);
1208
1209                 s->comment[0] = '\0';
1210                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1211                         TALLOC_FREE(frame);
1212                         continue;
1213                 }
1214                 fstrcpy(s->comment, p);
1215                 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1216
1217                 s->domain[0] = '\0';
1218                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1219                         /* this allows us to cope with an old nmbd */
1220                         fstrcpy(s->domain,lp_workgroup());
1221                 } else {
1222                         fstrcpy(s->domain, p);
1223                 }
1224                 TALLOC_FREE(frame);
1225
1226                 if (sscanf(stype,"%X",&s->type) != 1) {
1227                         DEBUG(4,("r:host file "));
1228                         ok = False;
1229                 }
1230
1231                 /* Filter the servers/domains we return based on what was asked for. */
1232
1233                 /* Check to see if we are being asked for a local list only. */
1234                 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1235                         DEBUG(4,("r: local list only"));
1236                         ok = False;
1237                 }
1238
1239                 /* doesn't match up: don't want it */
1240                 if (!(servertype & s->type)) {
1241                         DEBUG(4,("r:serv type "));
1242                         ok = False;
1243                 }
1244
1245                 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1246                                 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1247                         DEBUG(4,("s: dom mismatch "));
1248                         ok = False;
1249                 }
1250
1251                 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1252                         ok = False;
1253                 }
1254
1255                 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1256                 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1257
1258                 if (ok) {
1259                         DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1260                                 s->name, s->type, s->comment, s->domain));
1261                         s->server_added = True;
1262                         count++;
1263                 } else {
1264                         DEBUG(4,("%20s %8x %25s %15s\n",
1265                                 s->name, s->type, s->comment, s->domain));
1266                 }
1267         }
1268
1269         TALLOC_FREE(lines);
1270         return count;
1271 }
1272
1273 /*******************************************************************
1274  Fill in a server info structure.
1275 ******************************************************************/
1276
1277 static int fill_srv_info(struct srv_info_struct *service,
1278                          int uLevel, char **buf, int *buflen,
1279                          char **stringbuf, int *stringspace, char *baseaddr)
1280 {
1281         int struct_len;
1282         char* p;
1283         char* p2;
1284         int l2;
1285         int len;
1286
1287         switch (uLevel) {
1288                 case 0:
1289                         struct_len = 16;
1290                         break;
1291                 case 1:
1292                         struct_len = 26;
1293                         break;
1294                 default:
1295                         return -1;
1296         }
1297
1298         if (!buf) {
1299                 len = 0;
1300                 switch (uLevel) {
1301                         case 1:
1302                                 len = strlen(service->comment)+1;
1303                                 break;
1304                 }
1305
1306                 *buflen = struct_len;
1307                 *stringspace = len;
1308                 return struct_len + len;
1309         }
1310
1311         len = struct_len;
1312         p = *buf;
1313         if (*buflen < struct_len) {
1314                 return -1;
1315         }
1316         if (stringbuf) {
1317                 p2 = *stringbuf;
1318                 l2 = *stringspace;
1319         } else {
1320                 p2 = p + struct_len;
1321                 l2 = *buflen - struct_len;
1322         }
1323         if (!baseaddr) {
1324                 baseaddr = p;
1325         }
1326
1327         switch (uLevel) {
1328                 case 0:
1329                         push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1330                         break;
1331
1332                 case 1:
1333                         push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1334                         SIVAL(p,18,service->type);
1335                         SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1336                         len += CopyAndAdvance(&p2,service->comment,&l2);
1337                         break;
1338         }
1339
1340         if (stringbuf) {
1341                 *buf = p + struct_len;
1342                 *buflen -= struct_len;
1343                 *stringbuf = p2;
1344                 *stringspace = l2;
1345         } else {
1346                 *buf = p2;
1347                 *buflen -= len;
1348         }
1349         return len;
1350 }
1351
1352
1353 static bool srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1354 {
1355         return(strcmp(s1->name,s2->name));
1356 }
1357
1358 /****************************************************************************
1359  View list of servers available (or possibly domains). The info is
1360  extracted from lists saved by nmbd on the local host.
1361 ****************************************************************************/
1362
1363 static bool api_RNetServerEnum2(connection_struct *conn, uint16 vuid,
1364                                 char *param, int tpscnt,
1365                                 char *data, int tdscnt,
1366                                 int mdrcnt, int mprcnt, char **rdata,
1367                                 char **rparam, int *rdata_len, int *rparam_len)
1368 {
1369         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1370         char *str2 = skip_string(param,tpscnt,str1);
1371         char *p = skip_string(param,tpscnt,str2);
1372         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1373         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1374         uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1375         char *p2;
1376         int data_len, fixed_len, string_len;
1377         int f_len = 0, s_len = 0;
1378         struct srv_info_struct *servers=NULL;
1379         int counted=0,total=0;
1380         int i,missed;
1381         fstring domain;
1382         bool domain_request;
1383         bool local_request;
1384
1385         if (!str1 || !str2 || !p) {
1386                 return False;
1387         }
1388
1389         /* If someone sets all the bits they don't really mean to set
1390            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1391            known servers. */
1392
1393         if (servertype == SV_TYPE_ALL) {
1394                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1395         }
1396
1397         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1398            any other bit (they may just set this bit on its own) they
1399            want all the locally seen servers. However this bit can be
1400            set on its own so set the requested servers to be
1401            ALL - DOMAIN_ENUM. */
1402
1403         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1404                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1405         }
1406
1407         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1408         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1409
1410         p += 8;
1411
1412         if (!prefix_ok(str1,"WrLehD")) {
1413                 return False;
1414         }
1415         if (!check_server_info(uLevel,str2)) {
1416                 return False;
1417         }
1418
1419         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1420         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1421         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1422
1423         if (strcmp(str1, "WrLehDz") == 0) {
1424                 if (skip_string(param,tpscnt,p) == NULL) {
1425                         return False;
1426                 }
1427                 pull_ascii_fstring(domain, p);
1428         } else {
1429                 fstrcpy(domain, lp_workgroup());
1430         }
1431
1432         DEBUG(4, ("domain [%s]\n", domain));
1433
1434         if (lp_browse_list()) {
1435                 total = get_server_info(servertype,&servers,domain);
1436         }
1437
1438         data_len = fixed_len = string_len = 0;
1439         missed = 0;
1440
1441         if (total > 0) {
1442                 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1443         }
1444
1445         {
1446                 char *lastname=NULL;
1447
1448                 for (i=0;i<total;i++) {
1449                         struct srv_info_struct *s = &servers[i];
1450
1451                         if (lastname && strequal(lastname,s->name)) {
1452                                 continue;
1453                         }
1454                         lastname = s->name;
1455                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1456                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1457                                 i, s->name, s->type, s->comment, s->domain));
1458
1459                         if (data_len <= buf_len) {
1460                                 counted++;
1461                                 fixed_len += f_len;
1462                                 string_len += s_len;
1463                         } else {
1464                                 missed++;
1465                         }
1466                 }
1467         }
1468
1469         *rdata_len = fixed_len + string_len;
1470         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1471         if (!*rdata) {
1472                 return False;
1473         }
1474
1475         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1476         p = *rdata;
1477         f_len = fixed_len;
1478         s_len = string_len;
1479
1480         {
1481                 char *lastname=NULL;
1482                 int count2 = counted;
1483
1484                 for (i = 0; i < total && count2;i++) {
1485                         struct srv_info_struct *s = &servers[i];
1486
1487                         if (lastname && strequal(lastname,s->name)) {
1488                                 continue;
1489                         }
1490                         lastname = s->name;
1491                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1492                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1493                                 i, s->name, s->type, s->comment, s->domain));
1494                         count2--;
1495                 }
1496         }
1497
1498         *rparam_len = 8;
1499         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1500         if (!*rparam) {
1501                 return False;
1502         }
1503         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1504         SSVAL(*rparam,2,0);
1505         SSVAL(*rparam,4,counted);
1506         SSVAL(*rparam,6,counted+missed);
1507
1508         SAFE_FREE(servers);
1509
1510         DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1511                 domain,uLevel,counted,counted+missed));
1512
1513         return True;
1514 }
1515
1516 /****************************************************************************
1517   command 0x34 - suspected of being a "Lookup Names" stub api
1518   ****************************************************************************/
1519
1520 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1521                                 char *param, int tpscnt,
1522                                 char *data, int tdscnt,
1523                                 int mdrcnt, int mprcnt, char **rdata,
1524                                 char **rparam, int *rdata_len, int *rparam_len)
1525 {
1526         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1527         char *str2 = skip_string(param,tpscnt,str1);
1528         char *p = skip_string(param,tpscnt,str2);
1529         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1530         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1531         int counted=0;
1532         int missed=0;
1533
1534         if (!str1 || !str2 || !p) {
1535                 return False;
1536         }
1537
1538         DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1539                 str1, str2, p, uLevel, buf_len));
1540
1541         if (!prefix_ok(str1,"zWrLeh")) {
1542                 return False;
1543         }
1544
1545         *rdata_len = 0;
1546
1547         *rparam_len = 8;
1548         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1549         if (!*rparam) {
1550                 return False;
1551         }
1552
1553         SSVAL(*rparam,0,0x08AC); /* informational warning message */
1554         SSVAL(*rparam,2,0);
1555         SSVAL(*rparam,4,counted);
1556         SSVAL(*rparam,6,counted+missed);
1557
1558         return True;
1559 }
1560
1561 /****************************************************************************
1562   get info about a share
1563   ****************************************************************************/
1564
1565 static bool check_share_info(int uLevel, char* id)
1566 {
1567         switch( uLevel ) {
1568                 case 0:
1569                         if (strcmp(id,"B13") != 0) {
1570                                 return False;
1571                         }
1572                         break;
1573                 case 1:
1574                         /* Level-2 descriptor is allowed (and ignored) */
1575                         if (strcmp(id,"B13BWz") != 0 &&
1576                             strcmp(id,"B13BWzWWWzB9B") != 0) {
1577                                 return False;
1578                         }
1579                         break;
1580                 case 2:
1581                         if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1582                                 return False;
1583                         }
1584                         break;
1585                 case 91:
1586                         if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1587                                 return False;
1588                         }
1589                         break;
1590                 default:
1591                         return False;
1592         }
1593         return True;
1594 }
1595
1596 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1597                            char** buf, int* buflen,
1598                            char** stringbuf, int* stringspace, char* baseaddr)
1599 {
1600         int struct_len;
1601         char* p;
1602         char* p2;
1603         int l2;
1604         int len;
1605
1606         switch( uLevel ) {
1607                 case 0:
1608                         struct_len = 13;
1609                         break;
1610                 case 1:
1611                         struct_len = 20;
1612                         break;
1613                 case 2:
1614                         struct_len = 40;
1615                         break;
1616                 case 91:
1617                         struct_len = 68;
1618                         break;
1619                 default:
1620                         return -1;
1621         }
1622
1623         if (!buf) {
1624                 len = 0;
1625
1626                 if (uLevel > 0) {
1627                         len += StrlenExpanded(conn,snum,lp_comment(snum));
1628                 }
1629                 if (uLevel > 1) {
1630                         len += strlen(lp_pathname(snum)) + 1;
1631                 }
1632                 if (buflen) {
1633                         *buflen = struct_len;
1634                 }
1635                 if (stringspace) {
1636                         *stringspace = len;
1637                 }
1638                 return struct_len + len;
1639         }
1640
1641         len = struct_len;
1642         p = *buf;
1643         if ((*buflen) < struct_len) {
1644                 return -1;
1645         }
1646
1647         if (stringbuf) {
1648                 p2 = *stringbuf;
1649                 l2 = *stringspace;
1650         } else {
1651                 p2 = p + struct_len;
1652                 l2 = (*buflen) - struct_len;
1653         }
1654
1655         if (!baseaddr) {
1656                 baseaddr = p;
1657         }
1658
1659         push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1660
1661         if (uLevel > 0) {
1662                 int type;
1663
1664                 SCVAL(p,13,0);
1665                 type = STYPE_DISKTREE;
1666                 if (lp_print_ok(snum)) {
1667                         type = STYPE_PRINTQ;
1668                 }
1669                 if (strequal("IPC",lp_fstype(snum))) {
1670                         type = STYPE_IPC;
1671                 }
1672                 SSVAL(p,14,type);               /* device type */
1673                 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1674                 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1675         }
1676
1677         if (uLevel > 1) {
1678                 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1679                 SSVALS(p,22,-1);                /* max uses */
1680                 SSVAL(p,24,1); /* current uses */
1681                 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1682                 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1683                 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1684         }
1685
1686         if (uLevel > 2) {
1687                 memset(p+40,0,SHPWLEN+2);
1688                 SSVAL(p,50,0);
1689                 SIVAL(p,52,0);
1690                 SSVAL(p,56,0);
1691                 SSVAL(p,58,0);
1692                 SIVAL(p,60,0);
1693                 SSVAL(p,64,0);
1694                 SSVAL(p,66,0);
1695         }
1696
1697         if (stringbuf) {
1698                 (*buf) = p + struct_len;
1699                 (*buflen) -= struct_len;
1700                 (*stringbuf) = p2;
1701                 (*stringspace) = l2;
1702         } else {
1703                 (*buf) = p2;
1704                 (*buflen) -= len;
1705         }
1706
1707         return len;
1708 }
1709
1710 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1711                                 char *param, int tpscnt,
1712                                 char *data, int tdscnt,
1713                                 int mdrcnt,int mprcnt,
1714                                 char **rdata,char **rparam,
1715                                 int *rdata_len,int *rparam_len)
1716 {
1717         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1718         char *str2 = skip_string(param,tpscnt,str1);
1719         char *netname = skip_string(param,tpscnt,str2);
1720         char *p = skip_string(param,tpscnt,netname);
1721         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1722         int snum;
1723
1724         if (!str1 || !str2 || !netname || !p) {
1725                 return False;
1726         }
1727
1728         snum = find_service(netname);
1729         if (snum < 0) {
1730                 return False;
1731         }
1732
1733         /* check it's a supported varient */
1734         if (!prefix_ok(str1,"zWrLh")) {
1735                 return False;
1736         }
1737         if (!check_share_info(uLevel,str2)) {
1738                 return False;
1739         }
1740
1741         *rdata = smb_realloc_limit(*rdata,mdrcnt);
1742         if (!*rdata) {
1743                 return False;
1744         }
1745         p = *rdata;
1746         *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
1747         if (*rdata_len < 0) {
1748                 return False;
1749         }
1750
1751         *rparam_len = 6;
1752         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1753         if (!*rparam) {
1754                 return False;
1755         }
1756         SSVAL(*rparam,0,NERR_Success);
1757         SSVAL(*rparam,2,0);             /* converter word */
1758         SSVAL(*rparam,4,*rdata_len);
1759
1760         return True;
1761 }
1762
1763 /****************************************************************************
1764   View the list of available shares.
1765
1766   This function is the server side of the NetShareEnum() RAP call.
1767   It fills the return buffer with share names and share comments.
1768   Note that the return buffer normally (in all known cases) allows only
1769   twelve byte strings for share names (plus one for a nul terminator).
1770   Share names longer than 12 bytes must be skipped.
1771  ****************************************************************************/
1772
1773 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
1774                                 char *param, int tpscnt,
1775                                 char *data, int tdscnt,
1776                                 int                mdrcnt,
1777                                 int                mprcnt,
1778                                 char             **rdata,
1779                                 char             **rparam,
1780                                 int               *rdata_len,
1781                                 int               *rparam_len )
1782 {
1783         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1784         char *str2 = skip_string(param,tpscnt,str1);
1785         char *p = skip_string(param,tpscnt,str2);
1786         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1787         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1788         char *p2;
1789         int count = 0;
1790         int total=0,counted=0;
1791         bool missed = False;
1792         int i;
1793         int data_len, fixed_len, string_len;
1794         int f_len = 0, s_len = 0;
1795
1796         if (!str1 || !str2 || !p) {
1797                 return False;
1798         }
1799
1800         if (!prefix_ok(str1,"WrLeh")) {
1801                 return False;
1802         }
1803         if (!check_share_info(uLevel,str2)) {
1804                 return False;
1805         }
1806
1807         /* Ensure all the usershares are loaded. */
1808         become_root();
1809         load_registry_shares();
1810         count = load_usershare_shares();
1811         unbecome_root();
1812
1813         data_len = fixed_len = string_len = 0;
1814         for (i=0;i<count;i++) {
1815                 fstring servicename_dos;
1816                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1817                         continue;
1818                 }
1819                 push_ascii_fstring(servicename_dos, lp_servicename(i));
1820                 /* Maximum name length = 13. */
1821                 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
1822                         total++;
1823                         data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
1824                         if (data_len <= buf_len) {
1825                                 counted++;
1826                                 fixed_len += f_len;
1827                                 string_len += s_len;
1828                         } else {
1829                                 missed = True;
1830                         }
1831                 }
1832         }
1833
1834         *rdata_len = fixed_len + string_len;
1835         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1836         if (!*rdata) {
1837                 return False;
1838         }
1839
1840         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
1841         p = *rdata;
1842         f_len = fixed_len;
1843         s_len = string_len;
1844
1845         for( i = 0; i < count; i++ ) {
1846                 fstring servicename_dos;
1847                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1848                         continue;
1849                 }
1850
1851                 push_ascii_fstring(servicename_dos, lp_servicename(i));
1852                 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
1853                         if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
1854                                 break;
1855                         }
1856                 }
1857         }
1858
1859         *rparam_len = 8;
1860         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1861         if (!*rparam) {
1862                 return False;
1863         }
1864         SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
1865         SSVAL(*rparam,2,0);
1866         SSVAL(*rparam,4,counted);
1867         SSVAL(*rparam,6,total);
1868
1869         DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
1870                 counted,total,uLevel,
1871                 buf_len,*rdata_len,mdrcnt));
1872
1873         return True;
1874 }
1875
1876 /****************************************************************************
1877   Add a share
1878   ****************************************************************************/
1879
1880 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
1881                                 char *param, int tpscnt,
1882                                 char *data, int tdscnt,
1883                                 int mdrcnt,int mprcnt,
1884                                 char **rdata,char **rparam,
1885                                 int *rdata_len,int *rparam_len)
1886 {
1887         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1888         char *str2 = skip_string(param,tpscnt,str1);
1889         char *p = skip_string(param,tpscnt,str2);
1890         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1891         fstring sharename;
1892         fstring comment;
1893         char *pathname = NULL;
1894         char *command, *cmdname;
1895         unsigned int offset;
1896         int snum;
1897         int res = ERRunsup;
1898         size_t converted_size;
1899
1900         if (!str1 || !str2 || !p) {
1901                 return False;
1902         }
1903
1904         /* check it's a supported varient */
1905         if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
1906                 return False;
1907         }
1908         if (!check_share_info(uLevel,str2)) {
1909                 return False;
1910         }
1911         if (uLevel != 2) {
1912                 return False;
1913         }
1914
1915         /* Do we have a string ? */
1916         if (skip_string(data,mdrcnt,data) == NULL) {
1917                 return False;
1918         }
1919         pull_ascii_fstring(sharename,data);
1920         snum = find_service(sharename);
1921         if (snum >= 0) { /* already exists */
1922                 res = ERRfilexists;
1923                 goto error_exit;
1924         }
1925
1926         if (mdrcnt < 28) {
1927                 return False;
1928         }
1929
1930         /* only support disk share adds */
1931         if (SVAL(data,14)!=STYPE_DISKTREE) {
1932                 return False;
1933         }
1934
1935         offset = IVAL(data, 16);
1936         if (offset >= mdrcnt) {
1937                 res = ERRinvalidparam;
1938                 goto error_exit;
1939         }
1940
1941         /* Do we have a string ? */
1942         if (skip_string(data,mdrcnt,data+offset) == NULL) {
1943                 return False;
1944         }
1945         pull_ascii_fstring(comment, offset? (data+offset) : "");
1946
1947         offset = IVAL(data, 26);
1948
1949         if (offset >= mdrcnt) {
1950                 res = ERRinvalidparam;
1951                 goto error_exit;
1952         }
1953
1954         /* Do we have a string ? */
1955         if (skip_string(data,mdrcnt,data+offset) == NULL) {
1956                 return False;
1957         }
1958
1959         if (!pull_ascii_talloc(talloc_tos(), &pathname,
1960                                offset ? (data+offset) : "", &converted_size))
1961         {
1962                 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
1963                          strerror(errno)));
1964         }
1965
1966         if (!pathname) {
1967                 return false;
1968         }
1969
1970         string_replace(sharename, '"', ' ');
1971         string_replace(pathname, '"', ' ');
1972         string_replace(comment, '"', ' ');
1973
1974         cmdname = lp_add_share_cmd();
1975
1976         if (!cmdname || *cmdname == '\0') {
1977                 return False;
1978         }
1979
1980         if (asprintf(&command, "%s \"%s\" \"%s\" \"%s\" \"%s\"",
1981                      lp_add_share_cmd(), get_dyn_CONFIGFILE(), sharename,
1982                      pathname, comment) == -1) {
1983                 return false;
1984         }
1985
1986         DEBUG(10,("api_RNetShareAdd: Running [%s]\n", command ));
1987
1988         if ((res = smbrun(command, NULL)) != 0) {
1989                 DEBUG(1,("api_RNetShareAdd: Running [%s] returned (%d)\n",
1990                          command, res ));
1991                 SAFE_FREE(command);
1992                 res = ERRnoaccess;
1993                 goto error_exit;
1994         } else {
1995                 SAFE_FREE(command);
1996                 message_send_all(smbd_messaging_context(),
1997                                  MSG_SMB_CONF_UPDATED, NULL, 0, NULL);
1998         }
1999
2000         *rparam_len = 6;
2001         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2002         if (!*rparam) {
2003                 return False;
2004         }
2005         SSVAL(*rparam,0,NERR_Success);
2006         SSVAL(*rparam,2,0);             /* converter word */
2007         SSVAL(*rparam,4,*rdata_len);
2008         *rdata_len = 0;
2009
2010         return True;
2011
2012   error_exit:
2013
2014         *rparam_len = 4;
2015         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2016         if (!*rparam) {
2017                 return False;
2018         }
2019         *rdata_len = 0;
2020         SSVAL(*rparam,0,res);
2021         SSVAL(*rparam,2,0);
2022         return True;
2023 }
2024
2025 /****************************************************************************
2026   view list of groups available
2027   ****************************************************************************/
2028
2029 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2030                                 char *param, int tpscnt,
2031                                 char *data, int tdscnt,
2032                                 int mdrcnt,int mprcnt,
2033                                 char **rdata,char **rparam,
2034                                 int *rdata_len,int *rparam_len)
2035 {
2036         int i;
2037         int errflags=0;
2038         int resume_context, cli_buf_size;
2039         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2040         char *str2 = skip_string(param,tpscnt,str1);
2041         char *p = skip_string(param,tpscnt,str2);
2042
2043         uint32_t num_groups;
2044         uint32_t resume_handle;
2045         struct rpc_pipe_client *samr_pipe;
2046         struct policy_handle samr_handle, domain_handle;
2047         NTSTATUS status;
2048
2049         if (!str1 || !str2 || !p) {
2050                 return False;
2051         }
2052
2053         if (strcmp(str1,"WrLeh") != 0) {
2054                 return False;
2055         }
2056
2057         /* parameters
2058          * W-> resume context (number of users to skip)
2059          * r -> return parameter pointer to receive buffer
2060          * L -> length of receive buffer
2061          * e -> return parameter number of entries
2062          * h -> return parameter total number of users
2063          */
2064
2065         if (strcmp("B21",str2) != 0) {
2066                 return False;
2067         }
2068
2069         status = rpc_pipe_open_internal(
2070                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2071                 conn->server_info, &samr_pipe);
2072         if (!NT_STATUS_IS_OK(status)) {
2073                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2074                           nt_errstr(status)));
2075                 return false;
2076         }
2077
2078         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2079                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2080         if (!NT_STATUS_IS_OK(status)) {
2081                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2082                           nt_errstr(status)));
2083                 return false;
2084         }
2085
2086         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2087                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2088                                         get_global_sam_sid(), &domain_handle);
2089         if (!NT_STATUS_IS_OK(status)) {
2090                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2091                           nt_errstr(status)));
2092                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2093                 return false;
2094         }
2095
2096         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2097         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2098         DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2099                   "%d\n", resume_context, cli_buf_size));
2100
2101         *rdata_len = cli_buf_size;
2102         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2103         if (!*rdata) {
2104                 return False;
2105         }
2106
2107         p = *rdata;
2108
2109         errflags = NERR_Success;
2110         num_groups = 0;
2111         resume_handle = 0;
2112
2113         while (true) {
2114                 struct samr_SamArray *sam_entries;
2115                 uint32_t num_entries;
2116
2117                 status = rpccli_samr_EnumDomainGroups(samr_pipe, talloc_tos(),
2118                                                       &domain_handle,
2119                                                       &resume_handle,
2120                                                       &sam_entries, 1,
2121                                                       &num_entries);
2122                 if (!NT_STATUS_IS_OK(status)) {
2123                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2124                                    "%s\n", nt_errstr(status)));
2125                         break;
2126                 }
2127
2128                 if (num_entries == 0) {
2129                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2130                                    "no entries -- done\n"));
2131                         break;
2132                 }
2133
2134                 for(i=0; i<num_entries; i++) {
2135                         const char *name;
2136
2137                         name = sam_entries->entries[i].name.string;
2138
2139                         if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2140                                 /* set overflow error */
2141                                 DEBUG(3,("overflow on entry %d group %s\n", i,
2142                                          name));
2143                                 errflags=234;
2144                                 break;
2145                         }
2146
2147                         /* truncate the name at 21 chars. */
2148                         memset(p, 0, 21);
2149                         strlcpy(p, name, 21);
2150                         DEBUG(10,("adding entry %d group %s\n", i, p));
2151                         p += 21;
2152                         p += 5; /* Both NT4 and W2k3SP1 do padding here.  No
2153                                  * idea why... */
2154                         num_groups += 1;
2155                 }
2156
2157                 if (errflags != NERR_Success) {
2158                         break;
2159                 }
2160
2161                 TALLOC_FREE(sam_entries);
2162         }
2163
2164         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2165         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2166
2167         *rdata_len = PTR_DIFF(p,*rdata);
2168
2169         *rparam_len = 8;
2170         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2171         if (!*rparam) {
2172                 return False;
2173         }
2174         SSVAL(*rparam, 0, errflags);
2175         SSVAL(*rparam, 2, 0);           /* converter word */
2176         SSVAL(*rparam, 4, num_groups);  /* is this right?? */
2177         SSVAL(*rparam, 6, resume_context+num_groups);   /* is this right?? */
2178
2179         return(True);
2180 }
2181
2182 /*******************************************************************
2183  Get groups that a user is a member of.
2184 ******************************************************************/
2185
2186 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2187                                 char *param, int tpscnt,
2188                                 char *data, int tdscnt,
2189                                 int mdrcnt,int mprcnt,
2190                                 char **rdata,char **rparam,
2191                                 int *rdata_len,int *rparam_len)
2192 {
2193         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2194         char *str2 = skip_string(param,tpscnt,str1);
2195         char *UserName = skip_string(param,tpscnt,str2);
2196         char *p = skip_string(param,tpscnt,UserName);
2197         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2198         const char *level_string;
2199         int count=0;
2200         bool ret = False;
2201         uint32_t i;
2202         char *endp = NULL;
2203
2204         struct rpc_pipe_client *samr_pipe;
2205         struct policy_handle samr_handle, domain_handle, user_handle;
2206         struct lsa_String name;
2207         struct lsa_Strings names;
2208         struct samr_Ids type, rid;
2209         struct samr_RidWithAttributeArray *rids;
2210         NTSTATUS status;
2211
2212         if (!str1 || !str2 || !UserName || !p) {
2213                 return False;
2214         }
2215
2216         *rparam_len = 8;
2217         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2218         if (!*rparam) {
2219                 return False;
2220         }
2221
2222         /* check it's a supported varient */
2223
2224         if ( strcmp(str1,"zWrLeh") != 0 )
2225                 return False;
2226
2227         switch( uLevel ) {
2228                 case 0:
2229                         level_string = "B21";
2230                         break;
2231                 default:
2232                         return False;
2233         }
2234
2235         if (strcmp(level_string,str2) != 0)
2236                 return False;
2237
2238         *rdata_len = mdrcnt + 1024;
2239         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2240         if (!*rdata) {
2241                 return False;
2242         }
2243
2244         SSVAL(*rparam,0,NERR_Success);
2245         SSVAL(*rparam,2,0);             /* converter word */
2246
2247         p = *rdata;
2248         endp = *rdata + *rdata_len;
2249
2250         status = rpc_pipe_open_internal(
2251                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2252                 conn->server_info, &samr_pipe);
2253         if (!NT_STATUS_IS_OK(status)) {
2254                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2255                           nt_errstr(status)));
2256                 return false;
2257         }
2258
2259         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2260                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2261         if (!NT_STATUS_IS_OK(status)) {
2262                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2263                           nt_errstr(status)));
2264                 return false;
2265         }
2266
2267         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2268                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2269                                         get_global_sam_sid(), &domain_handle);
2270         if (!NT_STATUS_IS_OK(status)) {
2271                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2272                           nt_errstr(status)));
2273                 goto close_sam;
2274         }
2275
2276         name.string = UserName;
2277
2278         status = rpccli_samr_LookupNames(samr_pipe, talloc_tos(),
2279                                          &domain_handle, 1, &name,
2280                                          &rid, &type);
2281         if (!NT_STATUS_IS_OK(status)) {
2282                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2283                           nt_errstr(status)));
2284                 goto close_domain;
2285         }
2286
2287         if (type.ids[0] != SID_NAME_USER) {
2288                 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2289                            sid_type_lookup(type.ids[0])));
2290                 goto close_domain;
2291         }
2292
2293         status = rpccli_samr_OpenUser(samr_pipe, talloc_tos(),
2294                                       &domain_handle,
2295                                       SAMR_USER_ACCESS_GET_GROUPS,
2296                                       rid.ids[0], &user_handle);
2297         if (!NT_STATUS_IS_OK(status)) {
2298                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2299                           nt_errstr(status)));
2300                 goto close_domain;
2301         }
2302
2303         status = rpccli_samr_GetGroupsForUser(samr_pipe, talloc_tos(),
2304                                               &user_handle, &rids);
2305         if (!NT_STATUS_IS_OK(status)) {
2306                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2307                           nt_errstr(status)));
2308                 goto close_user;
2309         }
2310
2311         for (i=0; i<rids->count; i++) {
2312
2313                 status = rpccli_samr_LookupRids(samr_pipe, talloc_tos(),
2314                                                 &domain_handle,
2315                                                 1, &rids->rids[i].rid,
2316                                                 &names, &type);
2317                 if (NT_STATUS_IS_OK(status) && (names.count == 1)) {
2318                         strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2319                         p += 21;
2320                         count++;
2321                 }
2322         }
2323
2324         *rdata_len = PTR_DIFF(p,*rdata);
2325
2326         SSVAL(*rparam,4,count); /* is this right?? */
2327         SSVAL(*rparam,6,count); /* is this right?? */
2328
2329         ret = True;
2330
2331  close_user:
2332         rpccli_samr_Close(samr_pipe, talloc_tos(), &user_handle);
2333  close_domain:
2334         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2335  close_sam:
2336         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2337
2338         return ret;
2339 }
2340
2341 /*******************************************************************
2342  Get all users.
2343 ******************************************************************/
2344
2345 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2346                                 char *param, int tpscnt,
2347                                 char *data, int tdscnt,
2348                                 int mdrcnt,int mprcnt,
2349                                 char **rdata,char **rparam,
2350                                 int *rdata_len,int *rparam_len)
2351 {
2352         int count_sent=0;
2353         int num_users=0;
2354         int errflags=0;
2355         int i, resume_context, cli_buf_size;
2356         uint32_t resume_handle;
2357
2358         struct rpc_pipe_client *samr_pipe;
2359         struct policy_handle samr_handle, domain_handle;
2360         NTSTATUS status;
2361
2362         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2363         char *str2 = skip_string(param,tpscnt,str1);
2364         char *p = skip_string(param,tpscnt,str2);
2365         char *endp = NULL;
2366
2367         if (!str1 || !str2 || !p) {
2368                 return False;
2369         }
2370
2371         if (strcmp(str1,"WrLeh") != 0)
2372                 return False;
2373         /* parameters
2374           * W-> resume context (number of users to skip)
2375           * r -> return parameter pointer to receive buffer
2376           * L -> length of receive buffer
2377           * e -> return parameter number of entries
2378           * h -> return parameter total number of users
2379           */
2380
2381         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2382         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2383         DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2384                         resume_context, cli_buf_size));
2385
2386         *rparam_len = 8;
2387         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2388         if (!*rparam) {
2389                 return False;
2390         }
2391
2392         /* check it's a supported varient */
2393         if (strcmp("B21",str2) != 0)
2394                 return False;
2395
2396         *rdata_len = cli_buf_size;
2397         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2398         if (!*rdata) {
2399                 return False;
2400         }
2401
2402         p = *rdata;
2403         endp = *rdata + *rdata_len;
2404
2405         status = rpc_pipe_open_internal(
2406                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2407                 conn->server_info, &samr_pipe);
2408         if (!NT_STATUS_IS_OK(status)) {
2409                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2410                           nt_errstr(status)));
2411                 return false;
2412         }
2413
2414         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2415                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2416         if (!NT_STATUS_IS_OK(status)) {
2417                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2418                           nt_errstr(status)));
2419                 return false;
2420         }
2421
2422         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2423                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2424                                         get_global_sam_sid(), &domain_handle);
2425         if (!NT_STATUS_IS_OK(status)) {
2426                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2427                           nt_errstr(status)));
2428                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2429                 return false;
2430         }
2431
2432         errflags=NERR_Success;
2433
2434         resume_handle = 0;
2435
2436         while (true) {
2437                 struct samr_SamArray *sam_entries;
2438                 uint32_t num_entries;
2439
2440                 status = rpccli_samr_EnumDomainUsers(samr_pipe, talloc_tos(),
2441                                                      &domain_handle,
2442                                                      &resume_handle,
2443                                                      0, &sam_entries, 1,
2444                                                      &num_entries);
2445
2446                 if (!NT_STATUS_IS_OK(status)) {
2447                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2448                                    "%s\n", nt_errstr(status)));
2449                         break;
2450                 }
2451
2452                 if (num_entries == 0) {
2453                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2454                                    "no entries -- done\n"));
2455                         break;
2456                 }
2457
2458                 for (i=0; i<num_entries; i++) {
2459                         const char *name;
2460
2461                         name = sam_entries->entries[i].name.string;
2462
2463                         if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2464                            &&(strlen(name)<=21)) {
2465                                 strlcpy(p,name,PTR_DIFF(endp,p));
2466                                 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2467                                           "username %s\n",count_sent,p));
2468                                 p += 21;
2469                                 count_sent++;
2470                         } else {
2471                                 /* set overflow error */
2472                                 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2473                                           "username %s\n",count_sent,name));
2474                                 errflags=234;
2475                                 break;
2476                         }
2477                 }
2478
2479                 if (errflags != NERR_Success) {
2480                         break;
2481                 }
2482
2483                 TALLOC_FREE(sam_entries);
2484         }
2485
2486         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2487         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2488
2489         *rdata_len = PTR_DIFF(p,*rdata);
2490
2491         SSVAL(*rparam,0,errflags);
2492         SSVAL(*rparam,2,0);           /* converter word */
2493         SSVAL(*rparam,4,count_sent);  /* is this right?? */
2494         SSVAL(*rparam,6,num_users); /* is this right?? */
2495
2496         return True;
2497 }
2498
2499 /****************************************************************************
2500  Get the time of day info.
2501 ****************************************************************************/
2502
2503 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2504                                 char *param, int tpscnt,
2505                                 char *data, int tdscnt,
2506                                 int mdrcnt,int mprcnt,
2507                                 char **rdata,char **rparam,
2508                                 int *rdata_len,int *rparam_len)
2509 {
2510         struct tm *t;
2511         time_t unixdate = time(NULL);
2512         char *p;
2513
2514         *rparam_len = 4;
2515         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2516         if (!*rparam) {
2517                 return False;
2518         }
2519
2520         *rdata_len = 21;
2521         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2522         if (!*rdata) {
2523                 return False;
2524         }
2525
2526         SSVAL(*rparam,0,NERR_Success);
2527         SSVAL(*rparam,2,0);             /* converter word */
2528
2529         p = *rdata;
2530
2531         srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2532                                             by NT in a "net time" operation,
2533                                             it seems to ignore the one below */
2534
2535         /* the client expects to get localtime, not GMT, in this bit
2536                 (I think, this needs testing) */
2537         t = localtime(&unixdate);
2538         if (!t) {
2539                 return False;
2540         }
2541
2542         SIVAL(p,4,0);           /* msecs ? */
2543         SCVAL(p,8,t->tm_hour);
2544         SCVAL(p,9,t->tm_min);
2545         SCVAL(p,10,t->tm_sec);
2546         SCVAL(p,11,0);          /* hundredths of seconds */
2547         SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2548         SSVAL(p,14,10000);              /* timer interval in 0.0001 of sec */
2549         SCVAL(p,16,t->tm_mday);
2550         SCVAL(p,17,t->tm_mon + 1);
2551         SSVAL(p,18,1900+t->tm_year);
2552         SCVAL(p,20,t->tm_wday);
2553
2554         return True;
2555 }
2556
2557 /****************************************************************************
2558  Set the user password.
2559 *****************************************************************************/
2560
2561 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2562                                 char *param, int tpscnt,
2563                                 char *data, int tdscnt,
2564                                 int mdrcnt,int mprcnt,
2565                                 char **rdata,char **rparam,
2566                                 int *rdata_len,int *rparam_len)
2567 {
2568         char *np = get_safe_str_ptr(param,tpscnt,param,2);
2569         char *p = NULL;
2570         fstring user;
2571         fstring pass1,pass2;
2572
2573         /* Skip 2 strings. */
2574         p = skip_string(param,tpscnt,np);
2575         p = skip_string(param,tpscnt,p);
2576
2577         if (!np || !p) {
2578                 return False;
2579         }
2580
2581         /* Do we have a string ? */
2582         if (skip_string(param,tpscnt,p) == NULL) {
2583                 return False;
2584         }
2585         pull_ascii_fstring(user,p);
2586
2587         p = skip_string(param,tpscnt,p);
2588         if (!p) {
2589                 return False;
2590         }
2591
2592         memset(pass1,'\0',sizeof(pass1));
2593         memset(pass2,'\0',sizeof(pass2));
2594         /*
2595          * We use 31 here not 32 as we're checking
2596          * the last byte we want to access is safe.
2597          */
2598         if (!is_offset_safe(param,tpscnt,p,31)) {
2599                 return False;
2600         }
2601         memcpy(pass1,p,16);
2602         memcpy(pass2,p+16,16);
2603
2604         *rparam_len = 4;
2605         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2606         if (!*rparam) {
2607                 return False;
2608         }
2609
2610         *rdata_len = 0;
2611
2612         SSVAL(*rparam,0,NERR_badpass);
2613         SSVAL(*rparam,2,0);             /* converter word */
2614
2615         DEBUG(3,("Set password for <%s>\n",user));
2616
2617         /*
2618          * Attempt to verify the old password against smbpasswd entries
2619          * Win98 clients send old and new password in plaintext for this call.
2620          */
2621
2622         {
2623                 struct auth_serversupplied_info *server_info = NULL;
2624                 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2625
2626                 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2627
2628                         become_root();
2629                         if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2630                                 SSVAL(*rparam,0,NERR_Success);
2631                         }
2632                         unbecome_root();
2633
2634                         TALLOC_FREE(server_info);
2635                 }
2636                 data_blob_clear_free(&password);
2637         }
2638
2639         /*
2640          * If the plaintext change failed, attempt
2641          * the old encrypted method. NT will generate this
2642          * after trying the samr method. Note that this
2643          * method is done as a last resort as this
2644          * password change method loses the NT password hash
2645          * and cannot change the UNIX password as no plaintext
2646          * is received.
2647          */
2648
2649         if(SVAL(*rparam,0) != NERR_Success) {
2650                 struct samu *hnd = NULL;
2651
2652                 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2653                         become_root();
2654                         if (change_lanman_password(hnd,(uchar *)pass2)) {
2655                                 SSVAL(*rparam,0,NERR_Success);
2656                         }
2657                         unbecome_root();
2658                         TALLOC_FREE(hnd);
2659                 }
2660         }
2661
2662         memset((char *)pass1,'\0',sizeof(fstring));
2663         memset((char *)pass2,'\0',sizeof(fstring));
2664
2665         return(True);
2666 }
2667
2668 /****************************************************************************
2669   Set the user password (SamOEM version - gets plaintext).
2670 ****************************************************************************/
2671
2672 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2673                                 char *param, int tpscnt,
2674                                 char *data, int tdscnt,
2675                                 int mdrcnt,int mprcnt,
2676                                 char **rdata,char **rparam,
2677                                 int *rdata_len,int *rparam_len)
2678 {
2679         struct smbd_server_connection *sconn = smbd_server_conn;
2680         fstring user;
2681         char *p = get_safe_str_ptr(param,tpscnt,param,2);
2682         *rparam_len = 2;
2683         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2684         if (!*rparam) {
2685                 return False;
2686         }
2687
2688         if (!p) {
2689                 return False;
2690         }
2691         *rdata_len = 0;
2692
2693         SSVAL(*rparam,0,NERR_badpass);
2694
2695         /*
2696          * Check the parameter definition is correct.
2697          */
2698
2699         /* Do we have a string ? */
2700         if (skip_string(param,tpscnt,p) == 0) {
2701                 return False;
2702         }
2703         if(!strequal(p, "zsT")) {
2704                 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2705                 return False;
2706         }
2707         p = skip_string(param, tpscnt, p);
2708         if (!p) {
2709                 return False;
2710         }
2711
2712         /* Do we have a string ? */
2713         if (skip_string(param,tpscnt,p) == 0) {
2714                 return False;
2715         }
2716         if(!strequal(p, "B516B16")) {
2717                 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2718                 return False;
2719         }
2720         p = skip_string(param,tpscnt,p);
2721         if (!p) {
2722                 return False;
2723         }
2724         /* Do we have a string ? */
2725         if (skip_string(param,tpscnt,p) == 0) {
2726                 return False;
2727         }
2728         p += pull_ascii_fstring(user,p);
2729
2730         DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
2731
2732         /*
2733          * Pass the user through the NT -> unix user mapping
2734          * function.
2735          */
2736
2737         (void)map_username(sconn, user);
2738
2739         if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL, NULL))) {
2740                 SSVAL(*rparam,0,NERR_Success);
2741         }
2742
2743         return(True);
2744 }
2745
2746 /****************************************************************************
2747   delete a print job
2748   Form: <W> <>
2749   ****************************************************************************/
2750
2751 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
2752                                 char *param, int tpscnt,
2753                                 char *data, int tdscnt,
2754                                 int mdrcnt,int mprcnt,
2755                                 char **rdata,char **rparam,
2756                                 int *rdata_len,int *rparam_len)
2757 {
2758         int function = get_safe_SVAL(param,tpscnt,param,0,0);
2759         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2760         char *str2 = skip_string(param,tpscnt,str1);
2761         char *p = skip_string(param,tpscnt,str2);
2762         uint32 jobid;
2763         int snum;
2764         fstring sharename;
2765         int errcode;
2766         WERROR werr = WERR_OK;
2767
2768         if (!str1 || !str2 || !p) {
2769                 return False;
2770         }
2771         /*
2772          * We use 1 here not 2 as we're checking
2773          * the last byte we want to access is safe.
2774          */
2775         if (!is_offset_safe(param,tpscnt,p,1)) {
2776                 return False;
2777         }
2778         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2779                 return False;
2780
2781         /* check it's a supported varient */
2782         if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
2783                 return(False);
2784
2785         *rparam_len = 4;
2786         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2787         if (!*rparam) {
2788                 return False;
2789         }
2790         *rdata_len = 0;
2791
2792         if (!print_job_exists(sharename, jobid)) {
2793                 errcode = NERR_JobNotFound;
2794                 goto out;
2795         }
2796
2797         snum = lp_servicenumber( sharename);
2798         if (snum == -1) {
2799                 errcode = NERR_DestNotFound;
2800                 goto out;
2801         }
2802
2803         errcode = NERR_notsupported;
2804
2805         switch (function) {
2806         case 81:                /* delete */
2807                 if (print_job_delete(conn->server_info, snum, jobid, &werr))
2808                         errcode = NERR_Success;
2809                 break;
2810         case 82:                /* pause */
2811                 if (print_job_pause(conn->server_info, snum, jobid, &werr))
2812                         errcode = NERR_Success;
2813                 break;
2814         case 83:                /* resume */
2815                 if (print_job_resume(conn->server_info, snum, jobid, &werr))
2816                         errcode = NERR_Success;
2817                 break;
2818         }
2819
2820         if (!W_ERROR_IS_OK(werr))
2821                 errcode = W_ERROR_V(werr);
2822
2823  out:
2824         SSVAL(*rparam,0,errcode);
2825         SSVAL(*rparam,2,0);             /* converter word */
2826
2827         return(True);
2828 }
2829
2830 /****************************************************************************
2831   Purge a print queue - or pause or resume it.
2832   ****************************************************************************/
2833
2834 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
2835                                 char *param, int tpscnt,
2836                                 char *data, int tdscnt,
2837                                 int mdrcnt,int mprcnt,
2838                                 char **rdata,char **rparam,
2839                                 int *rdata_len,int *rparam_len)
2840 {
2841         int function = get_safe_SVAL(param,tpscnt,param,0,0);
2842         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2843         char *str2 = skip_string(param,tpscnt,str1);
2844         char *QueueName = skip_string(param,tpscnt,str2);
2845         int errcode = NERR_notsupported;
2846         int snum;
2847         WERROR werr = WERR_OK;
2848
2849         if (!str1 || !str2 || !QueueName) {
2850                 return False;
2851         }
2852
2853         /* check it's a supported varient */
2854         if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
2855                 return(False);
2856
2857         *rparam_len = 4;
2858         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2859         if (!*rparam) {
2860                 return False;
2861         }
2862         *rdata_len = 0;
2863
2864         if (skip_string(param,tpscnt,QueueName) == NULL) {
2865                 return False;
2866         }
2867         snum = print_queue_snum(QueueName);
2868
2869         if (snum == -1) {
2870                 errcode = NERR_JobNotFound;
2871                 goto out;
2872         }
2873
2874         switch (function) {
2875         case 74: /* Pause queue */
2876                 werr = print_queue_pause(conn->server_info, snum);
2877                 break;
2878         case 75: /* Resume queue */
2879                 werr = print_queue_resume(conn->server_info, snum);
2880                 break;
2881         case 103: /* Purge */
2882                 werr = print_queue_purge(conn->server_info, snum);
2883                 break;
2884         default:
2885                 werr = WERR_NOT_SUPPORTED;
2886                 break;
2887         }
2888
2889         errcode = W_ERROR_V(werr);
2890
2891  out:
2892         SSVAL(*rparam,0,errcode);
2893         SSVAL(*rparam,2,0);             /* converter word */
2894
2895         return(True);
2896 }
2897
2898 /****************************************************************************
2899   set the property of a print job (undocumented?)
2900   ? function = 0xb -> set name of print job
2901   ? function = 0x6 -> move print job up/down
2902   Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
2903   or   <WWsTP> <WB21BB16B10zWWzDDz>
2904 ****************************************************************************/
2905
2906 static int check_printjob_info(struct pack_desc* desc,
2907                                int uLevel, char* id)
2908 {
2909         desc->subformat = NULL;
2910         switch( uLevel ) {
2911         case 0: desc->format = "W"; break;
2912         case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
2913         case 2: desc->format = "WWzWWDDzz"; break;
2914         case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
2915         case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
2916         default:
2917                 DEBUG(0,("check_printjob_info: invalid level %d\n",
2918                         uLevel ));
2919                 return False;
2920         }
2921         if (id == NULL || strcmp(desc->format,id) != 0) {
2922                 DEBUG(0,("check_printjob_info: invalid format %s\n",
2923                         id ? id : "<NULL>" ));
2924                 return False;
2925         }
2926         return True;
2927 }
2928
2929 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
2930                                 char *param, int tpscnt,
2931                                 char *data, int tdscnt,
2932                                 int mdrcnt,int mprcnt,
2933                                 char **rdata,char **rparam,
2934                                 int *rdata_len,int *rparam_len)
2935 {
2936         struct pack_desc desc;
2937         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2938         char *str2 = skip_string(param,tpscnt,str1);
2939         char *p = skip_string(param,tpscnt,str2);
2940         uint32 jobid;
2941         fstring sharename;
2942         int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
2943         int function = get_safe_SVAL(param,tpscnt,p,4,-1);
2944         int place, errcode;
2945
2946         if (!str1 || !str2 || !p) {
2947                 return False;
2948         }
2949         /*
2950          * We use 1 here not 2 as we're checking
2951          * the last byte we want to access is safe.
2952          */
2953         if (!is_offset_safe(param,tpscnt,p,1)) {
2954                 return False;
2955         }
2956         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2957                 return False;
2958         *rparam_len = 4;
2959         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2960         if (!*rparam) {
2961                 return False;
2962         }
2963
2964         if (!share_defined(sharename)) {
2965                 DEBUG(0,("api_PrintJobInfo: sharen [%s] not defined\n",
2966                          sharename));
2967                 return False;
2968         }
2969
2970         *rdata_len = 0;
2971
2972         /* check it's a supported varient */
2973         if ((strcmp(str1,"WWsTP")) ||
2974             (!check_printjob_info(&desc,uLevel,str2)))
2975                 return(False);
2976
2977         if (!print_job_exists(sharename, jobid)) {
2978                 errcode=NERR_JobNotFound;
2979                 goto out;
2980         }
2981
2982         errcode = NERR_notsupported;
2983
2984         switch (function) {
2985         case 0x6:
2986                 /* change job place in the queue,
2987                    data gives the new place */
2988                 place = SVAL(data,0);
2989                 if (print_job_set_place(sharename, jobid, place)) {
2990                         errcode=NERR_Success;
2991                 }
2992                 break;
2993
2994         case 0xb:
2995                 /* change print job name, data gives the name */
2996                 if (print_job_set_name(sharename, jobid, data)) {
2997                         errcode=NERR_Success;
2998                 }
2999                 break;
3000
3001         default:
3002                 return False;
3003         }
3004
3005  out:
3006         SSVALS(*rparam,0,errcode);
3007         SSVAL(*rparam,2,0);             /* converter word */
3008
3009         return(True);
3010 }
3011
3012
3013 /****************************************************************************
3014  Get info about the server.
3015 ****************************************************************************/
3016
3017 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
3018                                 char *param, int tpscnt,
3019                                 char *data, int tdscnt,
3020                                 int mdrcnt,int mprcnt,
3021                                 char **rdata,char **rparam,
3022                                 int *rdata_len,int *rparam_len)
3023 {
3024         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3025         char *str2 = skip_string(param,tpscnt,str1);
3026         char *p = skip_string(param,tpscnt,str2);
3027         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3028         char *p2;
3029         int struct_len;
3030
3031         if (!str1 || !str2 || !p) {
3032                 return False;
3033         }
3034
3035         DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3036
3037         /* check it's a supported varient */
3038         if (!prefix_ok(str1,"WrLh")) {
3039                 return False;
3040         }
3041
3042         switch( uLevel ) {
3043                 case 0:
3044                         if (strcmp(str2,"B16") != 0) {
3045                                 return False;
3046                         }
3047                         struct_len = 16;
3048                         break;
3049                 case 1:
3050                         if (strcmp(str2,"B16BBDz") != 0) {
3051                                 return False;
3052                         }
3053                         struct_len = 26;
3054                         break;
3055                 case 2:
3056                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3057                                 return False;
3058                         }
3059                         struct_len = 134;
3060                         break;
3061                 case 3:
3062                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3063                                 return False;
3064                         }
3065                         struct_len = 144;
3066                         break;
3067                 case 20:
3068                         if (strcmp(str2,"DN") != 0) {
3069                                 return False;
3070                         }
3071                         struct_len = 6;
3072                         break;
3073                 case 50:
3074                         if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3075                                 return False;
3076                         }
3077                         struct_len = 42;
3078                         break;
3079                 default:
3080                         return False;
3081         }
3082
3083         *rdata_len = mdrcnt;
3084         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3085         if (!*rdata) {
3086                 return False;
3087         }
3088
3089         p = *rdata;
3090         p2 = p + struct_len;
3091         if (uLevel != 20) {
3092                 srvstr_push(NULL, 0, p,global_myname(),16,
3093                         STR_ASCII|STR_UPPER|STR_TERMINATE);
3094         }
3095         p += 16;
3096         if (uLevel > 0) {
3097                 struct srv_info_struct *servers=NULL;
3098                 int i,count;
3099                 char *comment = NULL;
3100                 TALLOC_CTX *ctx = talloc_tos();
3101                 uint32 servertype= lp_default_server_announce();
3102
3103                 comment = talloc_strdup(ctx,lp_serverstring());
3104                 if (!comment) {
3105                         return false;
3106                 }
3107
3108                 if ((count=get_server_info(SV_TYPE_ALL,&servers,lp_workgroup()))>0) {
3109                         for (i=0;i<count;i++) {
3110                                 if (strequal(servers[i].name,global_myname())) {
3111                                         servertype = servers[i].type;
3112                                         TALLOC_FREE(comment);
3113                                         comment = talloc_strdup(ctx,
3114                                                         servers[i].comment);
3115                                         if (comment) {
3116                                                 return false;
3117                                         }
3118                                 }
3119                         }
3120                 }
3121
3122                 SAFE_FREE(servers);
3123
3124                 SCVAL(p,0,lp_major_announce_version());
3125                 SCVAL(p,1,lp_minor_announce_version());
3126                 SIVAL(p,2,servertype);
3127
3128                 if (mdrcnt == struct_len) {
3129                         SIVAL(p,6,0);
3130                 } else {
3131                         SIVAL(p,6,PTR_DIFF(p2,*rdata));
3132                         comment = talloc_sub_advanced(
3133                                 ctx,
3134                                 lp_servicename(SNUM(conn)),
3135                                 conn->server_info->unix_name,
3136                                 conn->connectpath,
3137                                 conn->server_info->utok.gid,
3138                                 conn->server_info->sanitized_username,
3139                                 pdb_get_domain(conn->server_info->sam_account),
3140                                 comment);
3141                         if (comment) {
3142                                 return false;
3143                         }
3144                         if (mdrcnt - struct_len <= 0) {
3145                                 return false;
3146                         }
3147                         push_ascii(p2,
3148                                 comment,
3149                                 MIN(mdrcnt - struct_len,
3150                                         MAX_SERVER_STRING_LENGTH),
3151                                 STR_TERMINATE);
3152                         p2 = skip_string(*rdata,*rdata_len,p2);
3153                         if (!p2) {
3154                                 return False;
3155                         }
3156                 }
3157         }
3158
3159         if (uLevel > 1) {
3160                 return False;           /* not yet implemented */
3161         }
3162
3163         *rdata_len = PTR_DIFF(p2,*rdata);
3164
3165         *rparam_len = 6;
3166         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3167         if (!*rparam) {
3168                 return False;
3169         }
3170         SSVAL(*rparam,0,NERR_Success);
3171         SSVAL(*rparam,2,0);             /* converter word */
3172         SSVAL(*rparam,4,*rdata_len);
3173
3174         return True;
3175 }
3176
3177 /****************************************************************************
3178  Get info about the server.
3179 ****************************************************************************/
3180
3181 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3182                                 char *param, int tpscnt,
3183                                 char *data, int tdscnt,
3184                                 int mdrcnt,int mprcnt,
3185                                 char **rdata,char **rparam,
3186                                 int *rdata_len,int *rparam_len)
3187 {
3188         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3189         char *str2 = skip_string(param,tpscnt,str1);
3190         char *p = skip_string(param,tpscnt,str2);
3191         char *p2;
3192         char *endp;
3193         int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3194
3195         if (!str1 || !str2 || !p) {
3196                 return False;
3197         }
3198
3199         DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3200
3201         *rparam_len = 6;
3202         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3203         if (!*rparam) {
3204                 return False;
3205         }
3206
3207         /* check it's a supported varient */
3208         if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3209                 return False;
3210         }
3211
3212         *rdata_len = mdrcnt + 1024;
3213         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3214         if (!*rdata) {
3215                 return False;
3216         }
3217
3218         SSVAL(*rparam,0,NERR_Success);
3219         SSVAL(*rparam,2,0);             /* converter word */
3220
3221         p = *rdata;
3222         endp = *rdata + *rdata_len;
3223
3224         p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3225         if (!p2) {
3226                 return False;
3227         }
3228
3229         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3230         strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3231         strupper_m(p2);
3232         p2 = skip_string(*rdata,*rdata_len,p2);
3233         if (!p2) {
3234                 return False;
3235         }
3236         p += 4;
3237
3238         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3239         strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3240         p2 = skip_string(*rdata,*rdata_len,p2);
3241         if (!p2) {
3242                 return False;
3243         }
3244         p += 4;
3245
3246         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3247         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3248         strupper_m(p2);
3249         p2 = skip_string(*rdata,*rdata_len,p2);
3250         if (!p2) {
3251                 return False;
3252         }
3253         p += 4;
3254
3255         SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3256         SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3257         p += 2;
3258
3259         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3260         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));   /* don't know.  login domain?? */
3261         p2 = skip_string(*rdata,*rdata_len,p2);
3262         if (!p2) {
3263                 return False;
3264         }
3265         p += 4;
3266
3267         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3268         strlcpy(p2,"",PTR_DIFF(endp,p2));
3269         p2 = skip_string(*rdata,*rdata_len,p2);
3270         if (!p2) {
3271                 return False;
3272         }
3273         p += 4;
3274
3275         *rdata_len = PTR_DIFF(p2,*rdata);
3276
3277         SSVAL(*rparam,4,*rdata_len);
3278
3279         return True;
3280 }
3281
3282 /****************************************************************************
3283   get info about a user
3284
3285     struct user_info_11 {
3286         char                usri11_name[21];  0-20
3287         char                usri11_pad;       21
3288         char                *usri11_comment;  22-25
3289         char            *usri11_usr_comment;  26-29
3290         unsigned short      usri11_priv;      30-31
3291         unsigned long       usri11_auth_flags; 32-35
3292         long                usri11_password_age; 36-39
3293         char                *usri11_homedir; 40-43
3294         char            *usri11_parms; 44-47
3295         long                usri11_last_logon; 48-51
3296         long                usri11_last_logoff; 52-55
3297         unsigned short      usri11_bad_pw_count; 56-57
3298         unsigned short      usri11_num_logons; 58-59
3299         char                *usri11_logon_server; 60-63
3300         unsigned short      usri11_country_code; 64-65
3301         char            *usri11_workstations; 66-69
3302         unsigned long       usri11_max_storage; 70-73
3303         unsigned short      usri11_units_per_week; 74-75
3304         unsigned char       *usri11_logon_hours; 76-79
3305         unsigned short      usri11_code_page; 80-81
3306     };
3307
3308 where:
3309
3310   usri11_name specifies the user name for which information is retrieved
3311
3312   usri11_pad aligns the next data structure element to a word boundary
3313
3314   usri11_comment is a null terminated ASCII comment
3315
3316   usri11_user_comment is a null terminated ASCII comment about the user
3317
3318   usri11_priv specifies the level of the privilege assigned to the user.
3319        The possible values are:
3320
3321 Name             Value  Description
3322 USER_PRIV_GUEST  0      Guest privilege
3323 USER_PRIV_USER   1      User privilege
3324 USER_PRV_ADMIN   2      Administrator privilege
3325
3326   usri11_auth_flags specifies the account operator privileges. The
3327        possible values are:
3328
3329 Name            Value   Description
3330 AF_OP_PRINT     0       Print operator
3331
3332
3333 Leach, Naik                                        [Page 28]
3334 \f
3335
3336
3337 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3338
3339
3340 AF_OP_COMM      1       Communications operator
3341 AF_OP_SERVER    2       Server operator
3342 AF_OP_ACCOUNTS  3       Accounts operator
3343
3344
3345   usri11_password_age specifies how many seconds have elapsed since the
3346        password was last changed.
3347
3348   usri11_home_dir points to a null terminated ASCII string that contains
3349        the path name of the user's home directory.
3350
3351   usri11_parms points to a null terminated ASCII string that is set
3352        aside for use by applications.
3353
3354   usri11_last_logon specifies the time when the user last logged on.
3355        This value is stored as the number of seconds elapsed since
3356        00:00:00, January 1, 1970.
3357
3358   usri11_last_logoff specifies the time when the user last logged off.
3359        This value is stored as the number of seconds elapsed since
3360        00:00:00, January 1, 1970. A value of 0 means the last logoff
3361        time is unknown.
3362
3363   usri11_bad_pw_count specifies the number of incorrect passwords
3364        entered since the last successful logon.
3365
3366   usri11_log1_num_logons specifies the number of times this user has
3367        logged on. A value of -1 means the number of logons is unknown.
3368
3369   usri11_logon_server points to a null terminated ASCII string that
3370        contains the name of the server to which logon requests are sent.
3371        A null string indicates logon requests should be sent to the
3372        domain controller.
3373
3374   usri11_country_code specifies the country code for the user's language
3375        of choice.
3376
3377   usri11_workstations points to a null terminated ASCII string that
3378        contains the names of workstations the user may log on from.
3379        There may be up to 8 workstations, with the names separated by
3380        commas. A null strings indicates there are no restrictions.
3381
3382   usri11_max_storage specifies the maximum amount of disk space the user
3383        can occupy. A value of 0xffffffff indicates there are no
3384        restrictions.
3385
3386   usri11_units_per_week specifies the equal number of time units into
3387        which a week is divided. This value must be equal to 168.
3388
3389   usri11_logon_hours points to a 21 byte (168 bits) string that
3390        specifies the time during which the user can log on. Each bit
3391        represents one unique hour in a week. The first bit (bit 0, word
3392        0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3393
3394
3395
3396 Leach, Naik                                        [Page 29]
3397 \f
3398
3399
3400 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3401
3402
3403        Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3404        are no restrictions.
3405
3406   usri11_code_page specifies the code page for the user's language of
3407        choice
3408
3409 All of the pointers in this data structure need to be treated
3410 specially. The  pointer is a 32 bit pointer. The higher 16 bits need
3411 to be ignored. The converter word returned in the parameters section
3412 needs to be subtracted from the lower 16 bits to calculate an offset
3413 into the return buffer where this ASCII string resides.
3414
3415 There is no auxiliary data in the response.
3416
3417   ****************************************************************************/
3418
3419 #define usri11_name           0
3420 #define usri11_pad            21
3421 #define usri11_comment        22
3422 #define usri11_usr_comment    26
3423 #define usri11_full_name      30
3424 #define usri11_priv           34
3425 #define usri11_auth_flags     36
3426 #define usri11_password_age   40
3427 #define usri11_homedir        44
3428 #define usri11_parms          48
3429 #define usri11_last_logon     52
3430 #define usri11_last_logoff    56
3431 #define usri11_bad_pw_count   60
3432 #define usri11_num_logons     62
3433 #define usri11_logon_server   64
3434 #define usri11_country_code   68
3435 #define usri11_workstations   70
3436 #define usri11_max_storage    74
3437 #define usri11_units_per_week 78
3438 #define usri11_logon_hours    80
3439 #define usri11_code_page      84
3440 #define usri11_end            86
3441
3442 #define USER_PRIV_GUEST 0
3443 #define USER_PRIV_USER 1
3444 #define USER_PRIV_ADMIN 2
3445
3446 #define AF_OP_PRINT     0
3447 #define AF_OP_COMM      1
3448 #define AF_OP_SERVER    2
3449 #define AF_OP_ACCOUNTS  3
3450
3451
3452 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3453                                 char *param, int tpscnt,
3454                                 char *data, int tdscnt,
3455                                 int mdrcnt,int mprcnt,
3456                                 char **rdata,char **rparam,
3457                                 int *rdata_len,int *rparam_len)
3458 {
3459         struct smbd_server_connection *sconn = smbd_server_conn;
3460         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3461         char *str2 = skip_string(param,tpscnt,str1);
3462         char *UserName = skip_string(param,tpscnt,str2);
3463         char *p = skip_string(param,tpscnt,UserName);
3464         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3465         char *p2;
3466         char *endp;
3467         const char *level_string;
3468
3469         /* get NIS home of a previously validated user - simeon */
3470         /* With share level security vuid will always be zero.
3471            Don't depend on vuser being non-null !!. JRA */
3472         user_struct *vuser = get_valid_user_struct(sconn, vuid);
3473         if(vuser != NULL) {
3474                 DEBUG(3,("  Username of UID %d is %s\n",
3475                          (int)vuser->server_info->utok.uid,
3476                          vuser->server_info->unix_name));
3477         }
3478
3479         if (!str1 || !str2 || !UserName || !p) {
3480                 return False;
3481         }
3482
3483         *rparam_len = 6;
3484         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3485         if (!*rparam) {
3486                 return False;
3487         }
3488
3489         DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3490
3491         /* check it's a supported variant */
3492         if (strcmp(str1,"zWrLh") != 0) {
3493                 return False;
3494         }
3495         switch( uLevel ) {
3496                 case 0: level_string = "B21"; break;
3497                 case 1: level_string = "B21BB16DWzzWz"; break;
3498                 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3499                 case 10: level_string = "B21Bzzz"; break;
3500                 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3501                 default: return False;
3502         }
3503
3504         if (strcmp(level_string,str2) != 0) {
3505                 return False;
3506         }
3507
3508         *rdata_len = mdrcnt + 1024;
3509         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3510         if (!*rdata) {
3511                 return False;
3512         }
3513
3514         SSVAL(*rparam,0,NERR_Success);
3515         SSVAL(*rparam,2,0);             /* converter word */
3516
3517         p = *rdata;
3518         endp = *rdata + *rdata_len;
3519         p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3520         if (!p2) {
3521                 return False;
3522         }
3523
3524         memset(p,0,21);
3525         fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
3526
3527         if (uLevel > 0) {
3528                 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
3529                 *p2 = 0;
3530         }
3531
3532         if (uLevel >= 10) {
3533                 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
3534                 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
3535                 p2 = skip_string(*rdata,*rdata_len,p2);
3536                 if (!p2) {
3537                         return False;
3538                 }
3539
3540                 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
3541                 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
3542                 p2 = skip_string(*rdata,*rdata_len,p2);
3543                 if (!p2) {
3544                         return False;
3545                 }
3546
3547                 /* EEK! the cifsrap.txt doesn't have this in!!!! */
3548                 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
3549                 strlcpy(p2,((vuser != NULL)
3550                             ? pdb_get_fullname(vuser->server_info->sam_account)
3551                             : UserName),PTR_DIFF(endp,p2));
3552                 p2 = skip_string(*rdata,*rdata_len,p2);
3553                 if (!p2) {
3554                         return False;
3555                 }
3556         }
3557
3558         if (uLevel == 11) {
3559                 const char *homedir = "";
3560                 if (vuser != NULL) {
3561                         homedir = pdb_get_homedir(
3562                                 vuser->server_info->sam_account);
3563                 }
3564                 /* modelled after NTAS 3.51 reply */
3565                 SSVAL(p,usri11_priv,conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3566                 SIVAL(p,usri11_auth_flags,AF_OP_PRINT);         /* auth flags */
3567                 SIVALS(p,usri11_password_age,-1);               /* password age */
3568                 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
3569                 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
3570                 p2 = skip_string(*rdata,*rdata_len,p2);
3571                 if (!p2) {
3572                         return False;
3573                 }
3574                 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
3575                 strlcpy(p2,"",PTR_DIFF(endp,p2));
3576                 p2 = skip_string(*rdata,*rdata_len,p2);
3577                 if (!p2) {
3578                         return False;
3579                 }
3580                 SIVAL(p,usri11_last_logon,0);           /* last logon */
3581                 SIVAL(p,usri11_last_logoff,0);          /* last logoff */
3582                 SSVALS(p,usri11_bad_pw_count,-1);       /* bad pw counts */
3583                 SSVALS(p,usri11_num_logons,-1);         /* num logons */
3584                 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
3585                 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
3586                 p2 = skip_string(*rdata,*rdata_len,p2);
3587                 if (!p2) {
3588                         return False;
3589                 }
3590                 SSVAL(p,usri11_country_code,0);         /* country code */
3591
3592                 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
3593                 strlcpy(p2,"",PTR_DIFF(endp,p2));
3594                 p2 = skip_string(*rdata,*rdata_len,p2);
3595                 if (!p2) {
3596                         return False;
3597                 }
3598
3599                 SIVALS(p,usri11_max_storage,-1);                /* max storage */
3600                 SSVAL(p,usri11_units_per_week,168);             /* units per week */
3601                 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
3602
3603                 /* a simple way to get logon hours at all times. */
3604                 memset(p2,0xff,21);
3605                 SCVAL(p2,21,0);           /* fix zero termination */
3606                 p2 = skip_string(*rdata,*rdata_len,p2);
3607                 if (!p2) {
3608                         return False;
3609                 }
3610
3611                 SSVAL(p,usri11_code_page,0);            /* code page */
3612         }
3613
3614         if (uLevel == 1 || uLevel == 2) {
3615                 memset(p+22,' ',16);    /* password */
3616                 SIVALS(p,38,-1);                /* password age */
3617                 SSVAL(p,42,
3618                 conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3619                 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
3620                 strlcpy(p2, vuser ? pdb_get_homedir(
3621                                 vuser->server_info->sam_account) : "",
3622                         PTR_DIFF(endp,p2));
3623                 p2 = skip_string(*rdata,*rdata_len,p2);
3624                 if (!p2) {
3625                         return False;
3626                 }
3627                 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
3628                 *p2++ = 0;
3629                 SSVAL(p,52,0);          /* flags */
3630                 SIVAL(p,54,PTR_DIFF(p2,*rdata));                /* script_path */
3631                 strlcpy(p2, vuser ? pdb_get_logon_script(
3632                                 vuser->server_info->sam_account) : "",
3633                         PTR_DIFF(endp,p2));
3634                 p2 = skip_string(*rdata,*rdata_len,p2);
3635                 if (!p2) {
3636                         return False;
3637                 }
3638                 if (uLevel == 2) {
3639                         SIVAL(p,60,0);          /* auth_flags */
3640                         SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
3641                         strlcpy(p2,((vuser != NULL)
3642                                     ? pdb_get_fullname(vuser->server_info->sam_account)
3643                                     : UserName),PTR_DIFF(endp,p2));
3644                         p2 = skip_string(*rdata,*rdata_len,p2);
3645                         if (!p2) {
3646                                 return False;
3647                         }
3648                         SIVAL(p,68,0);          /* urs_comment */
3649                         SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
3650                         strlcpy(p2,"",PTR_DIFF(endp,p2));
3651                         p2 = skip_string(*rdata,*rdata_len,p2);
3652                         if (!p2) {
3653                                 return False;
3654                         }
3655                         SIVAL(p,76,0);          /* workstations */
3656                         SIVAL(p,80,0);          /* last_logon */
3657                         SIVAL(p,84,0);          /* last_logoff */
3658                         SIVALS(p,88,-1);                /* acct_expires */
3659                         SIVALS(p,92,-1);                /* max_storage */
3660                         SSVAL(p,96,168);        /* units_per_week */
3661                         SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
3662                         memset(p2,-1,21);
3663                         p2 += 21;
3664                         SSVALS(p,102,-1);       /* bad_pw_count */
3665                         SSVALS(p,104,-1);       /* num_logons */
3666                         SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
3667                         {
3668                                 TALLOC_CTX *ctx = talloc_tos();
3669                                 int space_rem = *rdata_len - (p2 - *rdata);
3670                                 char *tmp;
3671
3672                                 if (space_rem <= 0) {
3673                                         return false;
3674                                 }
3675                                 tmp = talloc_strdup(ctx, "\\\\%L");
3676                                 if (!tmp) {
3677                                         return false;
3678                                 }
3679                                 tmp = talloc_sub_basic(ctx,
3680                                                 "",
3681                                                 "",
3682                                                 tmp);
3683                                 if (!tmp) {
3684                                         return false;
3685                                 }
3686
3687                                 push_ascii(p2,
3688                                         tmp,
3689                                         space_rem,
3690                                         STR_TERMINATE);
3691                         }
3692                         p2 = skip_string(*rdata,*rdata_len,p2);
3693                         if (!p2) {
3694                                 return False;
3695                         }
3696                         SSVAL(p,110,49);        /* country_code */
3697                         SSVAL(p,112,860);       /* code page */
3698                 }
3699         }
3700
3701         *rdata_len = PTR_DIFF(p2,*rdata);
3702
3703         SSVAL(*rparam,4,*rdata_len);    /* is this right?? */
3704
3705         return(True);
3706 }
3707
3708 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
3709                                 char *param, int tpscnt,
3710                                 char *data, int tdscnt,
3711                                 int mdrcnt,int mprcnt,
3712                                 char **rdata,char **rparam,
3713                                 int *rdata_len,int *rparam_len)
3714 {
3715         struct smbd_server_connection *sconn = smbd_server_conn;
3716         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3717         char *str2 = skip_string(param,tpscnt,str1);
3718         char *p = skip_string(param,tpscnt,str2);
3719         int uLevel;
3720         struct pack_desc desc;
3721         char* name;
3722                 /* With share level security vuid will always be zero.
3723                    Don't depend on vuser being non-null !!. JRA */
3724         user_struct *vuser = get_valid_user_struct(sconn, vuid);
3725
3726         if (!str1 || !str2 || !p) {
3727                 return False;
3728         }
3729
3730         if(vuser != NULL) {
3731                 DEBUG(3,("  Username of UID %d is %s\n",
3732                          (int)vuser->server_info->utok.uid,
3733                          vuser->server_info->unix_name));
3734         }
3735
3736         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3737         name = get_safe_str_ptr(param,tpscnt,p,2);
3738         if (!name) {
3739                 return False;
3740         }
3741
3742         memset((char *)&desc,'\0',sizeof(desc));
3743
3744         DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
3745
3746         /* check it's a supported varient */
3747         if (strcmp(str1,"OOWb54WrLh") != 0) {
3748                 return False;
3749         }
3750         if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
3751                 return False;
3752         }
3753         if (mdrcnt > 0) {
3754                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3755                 if (!*rdata) {
3756                         return False;
3757                 }
3758         }
3759
3760         desc.base = *rdata;
3761         desc.buflen = mdrcnt;
3762         desc.subformat = NULL;
3763         desc.format = str2;
3764
3765         if (init_package(&desc,1,0)) {
3766                 PACKI(&desc,"W",0);             /* code */
3767                 PACKS(&desc,"B21",name);        /* eff. name */
3768                 PACKS(&desc,"B","");            /* pad */
3769                 PACKI(&desc,"W", conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3770                 PACKI(&desc,"D",0);             /* auth flags XXX */
3771                 PACKI(&desc,"W",0);             /* num logons */
3772                 PACKI(&desc,"W",0);             /* bad pw count */
3773                 PACKI(&desc,"D",0);             /* last logon */
3774                 PACKI(&desc,"D",-1);            /* last logoff */
3775                 PACKI(&desc,"D",-1);            /* logoff time */
3776                 PACKI(&desc,"D",-1);            /* kickoff time */
3777                 PACKI(&desc,"D",0);             /* password age */
3778                 PACKI(&desc,"D",0);             /* password can change */
3779                 PACKI(&desc,"D",-1);            /* password must change */
3780
3781                 {
3782                         fstring mypath;
3783                         fstrcpy(mypath,"\\\\");
3784                         fstrcat(mypath,get_local_machine_name());
3785                         strupper_m(mypath);
3786                         PACKS(&desc,"z",mypath); /* computer */
3787                 }
3788
3789                 PACKS(&desc,"z",lp_workgroup());/* domain */
3790                 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
3791                               vuser->server_info->sam_account) : ""); /* script path */
3792                 PACKI(&desc,"D",0x00000000);            /* reserved */
3793         }
3794
3795         *rdata_len = desc.usedlen;
3796         *rparam_len = 6;
3797         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3798         if (!*rparam) {
3799                 return False;
3800         }
3801         SSVALS(*rparam,0,desc.errcode);
3802         SSVAL(*rparam,2,0);
3803         SSVAL(*rparam,4,desc.neededlen);
3804
3805         DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
3806
3807         return True;
3808 }
3809
3810 /****************************************************************************
3811  api_WAccessGetUserPerms
3812 ****************************************************************************/
3813
3814 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
3815                                 char *param, int tpscnt,
3816                                 char *data, int tdscnt,
3817                                 int mdrcnt,int mprcnt,
3818                                 char **rdata,char **rparam,
3819                                 int *rdata_len,int *rparam_len)
3820 {
3821         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3822         char *str2 = skip_string(param,tpscnt,str1);
3823         char *user = skip_string(param,tpscnt,str2);
3824         char *resource = skip_string(param,tpscnt,user);
3825
3826         if (!str1 || !str2 || !user || !resource) {
3827                 return False;
3828         }
3829
3830         if (skip_string(param,tpscnt,resource) == NULL) {
3831                 return False;
3832         }
3833         DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
3834
3835         /* check it's a supported varient */
3836         if (strcmp(str1,"zzh") != 0) {
3837                 return False;
3838         }
3839         if (strcmp(str2,"") != 0) {
3840                 return False;
3841         }
3842
3843         *rparam_len = 6;
3844         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3845         if (!*rparam) {
3846                 return False;
3847         }
3848         SSVALS(*rparam,0,0);            /* errorcode */
3849         SSVAL(*rparam,2,0);             /* converter word */
3850         SSVAL(*rparam,4,0x7f);  /* permission flags */
3851
3852         return True;
3853 }
3854
3855 /****************************************************************************
3856   api_WPrintJobEnumerate
3857   ****************************************************************************/
3858
3859 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
3860                                 char *param, int tpscnt,
3861                                 char *data, int tdscnt,
3862                                 int mdrcnt,int mprcnt,
3863                                 char **rdata,char **rparam,
3864                                 int *rdata_len,int *rparam_len)
3865 {
3866         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3867         char *str2 = skip_string(param,tpscnt,str1);
3868         char *p = skip_string(param,tpscnt,str2);
3869         int uLevel;
3870         int count;
3871         int i;
3872         int snum;
3873         fstring sharename;
3874         uint32 jobid;
3875         struct pack_desc desc;
3876         print_queue_struct *queue=NULL;
3877         print_status_struct status;
3878         char *tmpdata=NULL;
3879
3880         if (!str1 || !str2 || !p) {
3881                 return False;
3882         }
3883
3884         uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3885
3886         memset((char *)&desc,'\0',sizeof(desc));
3887         memset((char *)&status,'\0',sizeof(status));
3888
3889         DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
3890
3891         /* check it's a supported varient */
3892         if (strcmp(str1,"WWrLh") != 0) {
3893                 return False;
3894         }
3895         if (!check_printjob_info(&desc,uLevel,str2)) {
3896                 return False;
3897         }
3898
3899         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
3900                 return False;
3901         }
3902
3903         snum = lp_servicenumber( sharename);
3904         if (snum < 0 || !VALID_SNUM(snum)) {
3905                 return(False);
3906         }
3907
3908         count = print_queue_status(snum,&queue,&status);
3909         for (i = 0; i < count; i++) {
3910                 if (queue[i].job == jobid) {
3911                         break;
3912                 }
3913         }
3914
3915         if (mdrcnt > 0) {
3916                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3917                 if (!*rdata) {
3918                         return False;
3919                 }
3920                 desc.base = *rdata;
3921                 desc.buflen = mdrcnt;
3922         } else {
3923                 /*
3924                  * Don't return data but need to get correct length
3925                  *  init_package will return wrong size if buflen=0
3926                  */
3927                 desc.buflen = getlen(desc.format);
3928                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
3929         }
3930
3931         if (init_package(&desc,1,0)) {
3932                 if (i < count) {
3933                         fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
3934                         *rdata_len = desc.usedlen;
3935                 } else {
3936                         desc.errcode = NERR_JobNotFound;
3937                         *rdata_len = 0;
3938                 }
3939         }
3940
3941         *rparam_len = 6;
3942         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3943         if (!*rparam) {
3944                 return False;
3945         }
3946         SSVALS(*rparam,0,desc.errcode);
3947         SSVAL(*rparam,2,0);
3948         SSVAL(*rparam,4,desc.neededlen);
3949
3950         SAFE_FREE(queue);
3951         SAFE_FREE(tmpdata);
3952
3953         DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
3954
3955         return True;
3956 }
3957
3958 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
3959                                 char *param, int tpscnt,
3960                                 char *data, int tdscnt,
3961                                 int mdrcnt,int mprcnt,
3962                                 char **rdata,char **rparam,
3963                                 int *rdata_len,int *rparam_len)
3964 {
3965         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3966         char *str2 = skip_string(param,tpscnt,str1);
3967         char *p = skip_string(param,tpscnt,str2);
3968         char *name = p;
3969         int uLevel;
3970         int count;
3971         int i, succnt=0;
3972         int snum;
3973         struct pack_desc desc;
3974         print_queue_struct *queue=NULL;
3975         print_status_struct status;
3976
3977         if (!str1 || !str2 || !p) {
3978                 return False;
3979         }
3980
3981         memset((char *)&desc,'\0',sizeof(desc));
3982         memset((char *)&status,'\0',sizeof(status));
3983
3984         p = skip_string(param,tpscnt,p);
3985         if (!p) {
3986                 return False;
3987         }
3988         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3989
3990         DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
3991
3992         /* check it's a supported variant */
3993         if (strcmp(str1,"zWrLeh") != 0) {
3994                 return False;
3995         }
3996
3997         if (uLevel > 2) {
3998                 return False;   /* defined only for uLevel 0,1,2 */
3999         }
4000
4001         if (!check_printjob_info(&desc,uLevel,str2)) {
4002                 return False;
4003         }
4004
4005         snum = find_service(name);
4006         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4007                 return False;
4008         }
4009
4010         count = print_queue_status(snum,&queue,&status);
4011         if (mdrcnt > 0) {
4012                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4013                 if (!*rdata) {
4014                         return False;
4015                 }
4016         }
4017         desc.base = *rdata;
4018         desc.buflen = mdrcnt;
4019
4020         if (init_package(&desc,count,0)) {
4021                 succnt = 0;
4022                 for (i = 0; i < count; i++) {
4023                         fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4024                         if (desc.errcode == NERR_Success) {
4025                                 succnt = i+1;
4026                         }
4027                 }
4028         }
4029
4030         *rdata_len = desc.usedlen;
4031
4032         *rparam_len = 8;
4033         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4034         if (!*rparam) {
4035                 return False;
4036         }
4037         SSVALS(*rparam,0,desc.errcode);
4038         SSVAL(*rparam,2,0);
4039         SSVAL(*rparam,4,succnt);
4040         SSVAL(*rparam,6,count);
4041
4042         SAFE_FREE(queue);
4043
4044         DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4045
4046         return True;
4047 }
4048
4049 static int check_printdest_info(struct pack_desc* desc,
4050                                 int uLevel, char* id)
4051 {
4052         desc->subformat = NULL;
4053         switch( uLevel ) {
4054                 case 0:
4055                         desc->format = "B9";
4056                         break;
4057                 case 1:
4058                         desc->format = "B9B21WWzW";
4059                         break;
4060                 case 2:
4061                         desc->format = "z";
4062                         break;
4063                 case 3:
4064                         desc->format = "zzzWWzzzWW";
4065                         break;
4066                 default:
4067                         DEBUG(0,("check_printdest_info: invalid level %d\n",
4068                                 uLevel));
4069                         return False;
4070         }
4071         if (id == NULL || strcmp(desc->format,id) != 0) {
4072                 DEBUG(0,("check_printdest_info: invalid string %s\n",
4073                         id ? id : "<NULL>" ));
4074                 return False;
4075         }
4076         return True;
4077 }
4078
4079 static void fill_printdest_info(connection_struct *conn, int snum, int uLevel,
4080                                 struct pack_desc* desc)
4081 {
4082         char buf[100];
4083
4084         strncpy(buf,SERVICE(snum),sizeof(buf)-1);
4085         buf[sizeof(buf)-1] = 0;
4086         strupper_m(buf);
4087
4088         if (uLevel <= 1) {
4089                 PACKS(desc,"B9",buf);   /* szName */
4090                 if (uLevel == 1) {
4091                         PACKS(desc,"B21","");   /* szUserName */
4092                         PACKI(desc,"W",0);              /* uJobId */
4093                         PACKI(desc,"W",0);              /* fsStatus */
4094                         PACKS(desc,"z","");     /* pszStatus */
4095                         PACKI(desc,"W",0);              /* time */
4096                 }
4097         }
4098
4099         if (uLevel == 2 || uLevel == 3) {
4100                 PACKS(desc,"z",buf);            /* pszPrinterName */
4101                 if (uLevel == 3) {
4102                         PACKS(desc,"z","");     /* pszUserName */
4103                         PACKS(desc,"z","");     /* pszLogAddr */
4104                         PACKI(desc,"W",0);              /* uJobId */
4105                         PACKI(desc,"W",0);              /* fsStatus */
4106                         PACKS(desc,"z","");     /* pszStatus */
4107                         PACKS(desc,"z","");     /* pszComment */
4108                         PACKS(desc,"z","NULL"); /* pszDrivers */
4109                         PACKI(desc,"W",0);              /* time */
4110                         PACKI(desc,"W",0);              /* pad1 */
4111                 }
4112         }
4113 }
4114
4115 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
4116                                 char *param, int tpscnt,
4117                                 char *data, int tdscnt,
4118                                 int mdrcnt,int mprcnt,
4119                                 char **rdata,char **rparam,
4120                                 int *rdata_len,int *rparam_len)
4121 {
4122         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4123         char *str2 = skip_string(param,tpscnt,str1);
4124         char *p = skip_string(param,tpscnt,str2);
4125         char* PrinterName = p;
4126         int uLevel;
4127         struct pack_desc desc;
4128         int snum;
4129         char *tmpdata=NULL;
4130
4131         if (!str1 || !str2 || !p) {
4132                 return False;
4133         }
4134
4135         memset((char *)&desc,'\0',sizeof(desc));
4136
4137         p = skip_string(param,tpscnt,p);
4138         if (!p) {
4139                 return False;
4140         }
4141         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4142
4143         DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4144
4145         /* check it's a supported varient */
4146         if (strcmp(str1,"zWrLh") != 0) {
4147                 return False;
4148         }
4149         if (!check_printdest_info(&desc,uLevel,str2)) {
4150                 return False;
4151         }
4152
4153         snum = find_service(PrinterName);
4154         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4155                 *rdata_len = 0;
4156                 desc.errcode = NERR_DestNotFound;
4157                 desc.neededlen = 0;
4158         } else {
4159                 if (mdrcnt > 0) {
4160                         *rdata = smb_realloc_limit(*rdata,mdrcnt);
4161                         if (!*rdata) {
4162                                 return False;
4163                         }
4164                         desc.base = *rdata;
4165                         desc.buflen = mdrcnt;
4166                 } else {
4167                         /*
4168                          * Don't return data but need to get correct length
4169                          * init_package will return wrong size if buflen=0
4170                          */
4171                         desc.buflen = getlen(desc.format);
4172                         desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4173                 }
4174                 if (init_package(&desc,1,0)) {
4175                         fill_printdest_info(conn,snum,uLevel,&desc);
4176                 }
4177                 *rdata_len = desc.usedlen;
4178         }
4179
4180         *rparam_len = 6;
4181         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4182         if (!*rparam) {
4183                 return False;
4184         }
4185         SSVALS(*rparam,0,desc.errcode);
4186         SSVAL(*rparam,2,0);
4187         SSVAL(*rparam,4,desc.neededlen);
4188
4189         DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4190         SAFE_FREE(tmpdata);
4191
4192         return True;
4193 }
4194
4195 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4196                                 char *param, int tpscnt,
4197                                 char *data, int tdscnt,
4198                                 int mdrcnt,int mprcnt,
4199                                 char **rdata,char **rparam,
4200                                 int *rdata_len,int *rparam_len)
4201 {
4202         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4203         char *str2 = skip_string(param,tpscnt,str1);
4204         char *p = skip_string(param,tpscnt,str2);
4205         int uLevel;
4206         int queuecnt;
4207         int i, n, succnt=0;
4208         struct pack_desc desc;
4209         int services = lp_numservices();
4210
4211         if (!str1 || !str2 || !p) {
4212                 return False;
4213         }
4214
4215         memset((char *)&desc,'\0',sizeof(desc));
4216
4217         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4218
4219         DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4220
4221         /* check it's a supported varient */
4222         if (strcmp(str1,"WrLeh") != 0) {
4223                 return False;
4224         }
4225         if (!check_printdest_info(&desc,uLevel,str2)) {
4226                 return False;
4227         }
4228
4229         queuecnt = 0;
4230         for (i = 0; i < services; i++) {
4231                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4232                         queuecnt++;
4233                 }
4234         }
4235
4236         if (mdrcnt > 0) {
4237                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4238                 if (!*rdata) {
4239                         return False;
4240                 }
4241         }
4242
4243         desc.base = *rdata;
4244         desc.buflen = mdrcnt;
4245         if (init_package(&desc,queuecnt,0)) {
4246                 succnt = 0;
4247                 n = 0;
4248                 for (i = 0; i < services; i++) {
4249                         if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4250                                 fill_printdest_info(conn,i,uLevel,&desc);
4251                                 n++;
4252                                 if (desc.errcode == NERR_Success) {
4253                                         succnt = n;
4254                                 }
4255                         }
4256                 }
4257         }
4258
4259         *rdata_len = desc.usedlen;
4260
4261         *rparam_len = 8;
4262         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4263         if (!*rparam) {
4264                 return False;
4265         }
4266         SSVALS(*rparam,0,desc.errcode);
4267         SSVAL(*rparam,2,0);
4268         SSVAL(*rparam,4,succnt);
4269         SSVAL(*rparam,6,queuecnt);
4270
4271         DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4272
4273         return True;
4274 }
4275
4276 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4277                                 char *param, int tpscnt,
4278                                 char *data, int tdscnt,
4279                                 int mdrcnt,int mprcnt,
4280                                 char **rdata,char **rparam,
4281                                 int *rdata_len,int *rparam_len)
4282 {
4283         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4284         char *str2 = skip_string(param,tpscnt,str1);
4285         char *p = skip_string(param,tpscnt,str2);
4286         int uLevel;
4287         int succnt;
4288         struct pack_desc desc;
4289
4290         if (!str1 || !str2 || !p) {
4291                 return False;
4292         }
4293
4294         memset((char *)&desc,'\0',sizeof(desc));
4295
4296         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4297
4298         DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4299
4300         /* check it's a supported varient */
4301         if (strcmp(str1,"WrLeh") != 0) {
4302                 return False;
4303         }
4304         if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4305                 return False;
4306         }
4307
4308         if (mdrcnt > 0) {
4309                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4310                 if (!*rdata) {
4311                         return False;
4312                 }
4313         }
4314         desc.base = *rdata;
4315         desc.buflen = mdrcnt;
4316         if (init_package(&desc,1,0)) {
4317                 PACKS(&desc,"B41","NULL");
4318         }
4319
4320         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4321
4322         *rdata_len = desc.usedlen;
4323
4324         *rparam_len = 8;
4325         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4326         if (!*rparam) {
4327                 return False;
4328         }
4329         SSVALS(*rparam,0,desc.errcode);
4330         SSVAL(*rparam,2,0);
4331         SSVAL(*rparam,4,succnt);
4332         SSVAL(*rparam,6,1);
4333
4334         DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4335
4336         return True;
4337 }
4338
4339 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4340                                 char *param, int tpscnt,
4341                                 char *data, int tdscnt,
4342                                 int mdrcnt,int mprcnt,
4343                                 char **rdata,char **rparam,
4344                                 int *rdata_len,int *rparam_len)
4345 {
4346         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4347         char *str2 = skip_string(param,tpscnt,str1);
4348         char *p = skip_string(param,tpscnt,str2);
4349         int uLevel;
4350         int succnt;
4351         struct pack_desc desc;
4352
4353         if (!str1 || !str2 || !p) {
4354                 return False;
4355         }
4356         memset((char *)&desc,'\0',sizeof(desc));
4357
4358         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4359
4360         DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4361
4362         /* check it's a supported varient */
4363         if (strcmp(str1,"WrLeh") != 0) {
4364                 return False;
4365         }
4366         if (uLevel != 0 || strcmp(str2,"B13") != 0) {
4367                 return False;
4368         }
4369
4370         if (mdrcnt > 0) {
4371                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4372                 if (!*rdata) {
4373                         return False;
4374                 }
4375         }
4376         desc.base = *rdata;
4377         desc.buflen = mdrcnt;
4378         desc.format = str2;
4379         if (init_package(&desc,1,0)) {
4380                 PACKS(&desc,"B13","lpd");
4381         }
4382
4383         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4384
4385         *rdata_len = desc.usedlen;
4386
4387         *rparam_len = 8;
4388         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4389         if (!*rparam) {
4390                 return False;
4391         }
4392         SSVALS(*rparam,0,desc.errcode);
4393         SSVAL(*rparam,2,0);
4394         SSVAL(*rparam,4,succnt);
4395         SSVAL(*rparam,6,1);
4396
4397         DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
4398
4399         return True;
4400 }
4401
4402 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
4403                                 char *param, int tpscnt,
4404                                 char *data, int tdscnt,
4405                                 int mdrcnt,int mprcnt,
4406                                 char **rdata,char **rparam,
4407                                 int *rdata_len,int *rparam_len)
4408 {
4409         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4410         char *str2 = skip_string(param,tpscnt,str1);
4411         char *p = skip_string(param,tpscnt,str2);
4412         int uLevel;
4413         int succnt;
4414         struct pack_desc desc;
4415
4416         if (!str1 || !str2 || !p) {
4417                 return False;
4418         }
4419
4420         memset((char *)&desc,'\0',sizeof(desc));
4421
4422         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4423
4424         DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
4425
4426         /* check it's a supported varient */
4427         if (strcmp(str1,"WrLeh") != 0) {
4428                 return False;
4429         }
4430         if (uLevel != 0 || strcmp(str2,"B9") != 0) {
4431                 return False;
4432         }
4433
4434         if (mdrcnt > 0) {
4435                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4436                 if (!*rdata) {
4437                         return False;
4438                 }
4439         }
4440         memset((char *)&desc,'\0',sizeof(desc));
4441         desc.base = *rdata;
4442         desc.buflen = mdrcnt;
4443         desc.format = str2;
4444         if (init_package(&desc,1,0)) {
4445                 PACKS(&desc,"B13","lp0");
4446         }
4447
4448         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4449
4450         *rdata_len = desc.usedlen;
4451
4452         *rparam_len = 8;
4453         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4454         if (!*rparam) {
4455                 return False;
4456         }
4457         SSVALS(*rparam,0,desc.errcode);
4458         SSVAL(*rparam,2,0);
4459         SSVAL(*rparam,4,succnt);
4460         SSVAL(*rparam,6,1);
4461
4462         DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
4463
4464         return True;
4465 }
4466
4467 /****************************************************************************
4468  List open sessions
4469  ****************************************************************************/
4470
4471 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
4472                                 char *param, int tpscnt,
4473                                 char *data, int tdscnt,
4474                                 int mdrcnt,int mprcnt,
4475                                 char **rdata,char **rparam,
4476                                 int *rdata_len,int *rparam_len)
4477
4478 {
4479         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4480         char *str2 = skip_string(param,tpscnt,str1);
4481         char *p = skip_string(param,tpscnt,str2);
4482         int uLevel;
4483         struct pack_desc desc;
4484         struct sessionid *session_list;
4485         int i, num_sessions;
4486
4487         if (!str1 || !str2 || !p) {
4488                 return False;
4489         }
4490
4491         memset((char *)&desc,'\0',sizeof(desc));
4492
4493         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4494
4495         DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
4496         DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
4497         DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
4498
4499         /* check it's a supported varient */
4500         if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
4501                 return False;
4502         }
4503         if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
4504                 return False;
4505         }
4506
4507         num_sessions = list_sessions(talloc_tos(), &session_list);
4508
4509         if (mdrcnt > 0) {
4510                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4511                 if (!*rdata) {
4512                         return False;
4513                 }
4514         }
4515         memset((char *)&desc,'\0',sizeof(desc));
4516         desc.base = *rdata;
4517         desc.buflen = mdrcnt;
4518         desc.format = str2;
4519         if (!init_package(&desc,num_sessions,0)) {
4520                 return False;
4521         }
4522
4523         for(i=0; i<num_sessions; i++) {
4524                 PACKS(&desc, "z", session_list[i].remote_machine);
4525                 PACKS(&desc, "z", session_list[i].username);
4526                 PACKI(&desc, "W", 1); /* num conns */
4527                 PACKI(&desc, "W", 0); /* num opens */
4528                 PACKI(&desc, "W", 1); /* num users */
4529                 PACKI(&desc, "D", 0); /* session time */
4530                 PACKI(&desc, "D", 0); /* idle time */
4531                 PACKI(&desc, "D", 0); /* flags */
4532                 PACKS(&desc, "z", "Unknown Client"); /* client type string */
4533         }
4534
4535         *rdata_len = desc.usedlen;
4536
4537         *rparam_len = 8;
4538         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4539         if (!*rparam) {
4540                 return False;
4541         }
4542         SSVALS(*rparam,0,desc.errcode);
4543         SSVAL(*rparam,2,0); /* converter */
4544         SSVAL(*rparam,4,num_sessions); /* count */
4545
4546         DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
4547
4548         return True;
4549 }
4550
4551
4552 /****************************************************************************
4553  The buffer was too small.
4554  ****************************************************************************/
4555
4556 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
4557                          int mdrcnt, int mprcnt,
4558                          char **rdata, char **rparam,
4559                          int *rdata_len, int *rparam_len)
4560 {
4561         *rparam_len = MIN(*rparam_len,mprcnt);
4562         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4563         if (!*rparam) {
4564                 return False;
4565         }
4566
4567         *rdata_len = 0;
4568
4569         SSVAL(*rparam,0,NERR_BufTooSmall);
4570
4571         DEBUG(3,("Supplied buffer too small in API command\n"));
4572
4573         return True;
4574 }
4575
4576 /****************************************************************************
4577  The request is not supported.
4578  ****************************************************************************/
4579
4580 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
4581                                 char *param, int tpscnt,
4582                                 char *data, int tdscnt,
4583                                 int mdrcnt, int mprcnt,
4584                                 char **rdata, char **rparam,
4585                                 int *rdata_len, int *rparam_len)
4586 {
4587         *rparam_len = 4;
4588         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4589         if (!*rparam) {
4590                 return False;
4591         }
4592
4593         *rdata_len = 0;
4594
4595         SSVAL(*rparam,0,NERR_notsupported);
4596         SSVAL(*rparam,2,0);             /* converter word */
4597
4598         DEBUG(3,("Unsupported API command\n"));
4599
4600         return True;
4601 }
4602
4603 static const struct {
4604         const char *name;
4605         int id;
4606         bool (*fn)(connection_struct *, uint16,
4607                         char *, int,
4608                         char *, int,
4609                         int,int,char **,char **,int *,int *);
4610         bool auth_user;         /* Deny anonymous access? */
4611 } api_commands[] = {
4612         {"RNetShareEnum",       RAP_WshareEnum,         api_RNetShareEnum, True},
4613         {"RNetShareGetInfo",    RAP_WshareGetInfo,      api_RNetShareGetInfo},
4614         {"RNetShareAdd",        RAP_WshareAdd,          api_RNetShareAdd},
4615         {"RNetSessionEnum",     RAP_WsessionEnum,       api_RNetSessionEnum, True},
4616         {"RNetServerGetInfo",   RAP_WserverGetInfo,     api_RNetServerGetInfo},
4617         {"RNetGroupEnum",       RAP_WGroupEnum,         api_RNetGroupEnum, True},
4618         {"RNetGroupGetUsers", RAP_WGroupGetUsers,       api_RNetGroupGetUsers, True},
4619         {"RNetUserEnum",        RAP_WUserEnum,          api_RNetUserEnum, True},
4620         {"RNetUserGetInfo",     RAP_WUserGetInfo,       api_RNetUserGetInfo},
4621         {"NetUserGetGroups",    RAP_WUserGetGroups,     api_NetUserGetGroups},
4622         {"NetWkstaGetInfo",     RAP_WWkstaGetInfo,      api_NetWkstaGetInfo},
4623         {"DosPrintQEnum",       RAP_WPrintQEnum,        api_DosPrintQEnum, True},
4624         {"DosPrintQGetInfo",    RAP_WPrintQGetInfo,     api_DosPrintQGetInfo},
4625         {"WPrintQueuePause",  RAP_WPrintQPause, api_WPrintQueueCtrl},
4626         {"WPrintQueueResume", RAP_WPrintQContinue,      api_WPrintQueueCtrl},
4627         {"WPrintJobEnumerate",RAP_WPrintJobEnum,        api_WPrintJobEnumerate},
4628         {"WPrintJobGetInfo",    RAP_WPrintJobGetInfo,   api_WPrintJobGetInfo},
4629         {"RDosPrintJobDel",     RAP_WPrintJobDel,       api_RDosPrintJobDel},
4630         {"RDosPrintJobPause",   RAP_WPrintJobPause,     api_RDosPrintJobDel},
4631         {"RDosPrintJobResume",RAP_WPrintJobContinue,    api_RDosPrintJobDel},
4632         {"WPrintDestEnum",      RAP_WPrintDestEnum,     api_WPrintDestEnum},
4633         {"WPrintDestGetInfo",   RAP_WPrintDestGetInfo,  api_WPrintDestGetInfo},
4634         {"NetRemoteTOD",        RAP_NetRemoteTOD,       api_NetRemoteTOD},
4635         {"WPrintQueuePurge",    RAP_WPrintQPurge,       api_WPrintQueueCtrl},
4636         {"NetServerEnum2",      RAP_NetServerEnum2,     api_RNetServerEnum2}, /* anon OK */
4637         {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
4638         {"SetUserPassword",     RAP_WUserPasswordSet2,  api_SetUserPassword},
4639         {"WWkstaUserLogon",     RAP_WWkstaUserLogon,    api_WWkstaUserLogon},
4640         {"PrintJobInfo",        RAP_WPrintJobSetInfo,   api_PrintJobInfo},
4641         {"WPrintDriverEnum",    RAP_WPrintDriverEnum,   api_WPrintDriverEnum},
4642         {"WPrintQProcEnum",     RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
4643         {"WPrintPortEnum",      RAP_WPrintPortEnum,     api_WPrintPortEnum},
4644         {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
4645         {NULL,          -1,     api_Unsupported}
4646         /*  The following RAP calls are not implemented by Samba:
4647
4648         RAP_WFileEnum2 - anon not OK
4649         */
4650 };
4651
4652
4653 /****************************************************************************
4654  Handle remote api calls.
4655 ****************************************************************************/
4656
4657 void api_reply(connection_struct *conn, uint16 vuid,
4658                struct smb_request *req,
4659                char *data, char *params,
4660                int tdscnt, int tpscnt,
4661                int mdrcnt, int mprcnt)
4662 {
4663         struct smbd_server_connection *sconn = smbd_server_conn;
4664         int api_command;
4665         char *rdata = NULL;
4666         char *rparam = NULL;
4667         const char *name1 = NULL;
4668         const char *name2 = NULL;
4669         int rdata_len = 0;
4670         int rparam_len = 0;
4671         bool reply=False;
4672         int i;
4673
4674         if (!params) {
4675                 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
4676                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4677                 return;
4678         }
4679
4680         if (tpscnt < 2) {
4681                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4682                 return;
4683         }
4684         api_command = SVAL(params,0);
4685         /* Is there a string at position params+2 ? */
4686         if (skip_string(params,tpscnt,params+2)) {
4687                 name1 = params + 2;
4688         } else {
4689                 name1 = "";
4690         }
4691         name2 = skip_string(params,tpscnt,params+2);
4692         if (!name2) {
4693                 name2 = "";
4694         }
4695
4696         DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
4697                 api_command,
4698                 name1,
4699                 name2,
4700                 tdscnt,tpscnt,mdrcnt,mprcnt));
4701
4702         for (i=0;api_commands[i].name;i++) {
4703                 if (api_commands[i].id == api_command && api_commands[i].fn) {
4704                         DEBUG(3,("Doing %s\n",api_commands[i].name));
4705                         break;
4706                 }
4707         }
4708
4709         /* Check whether this api call can be done anonymously */
4710
4711         if (api_commands[i].auth_user && lp_restrict_anonymous()) {
4712                 user_struct *user = get_valid_user_struct(sconn, vuid);
4713
4714                 if (!user || user->server_info->guest) {
4715                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4716                         return;
4717                 }
4718         }
4719
4720         rdata = (char *)SMB_MALLOC(1024);
4721         if (rdata) {
4722                 memset(rdata,'\0',1024);
4723         }
4724
4725         rparam = (char *)SMB_MALLOC(1024);
4726         if (rparam) {
4727                 memset(rparam,'\0',1024);
4728         }
4729
4730         if(!rdata || !rparam) {
4731                 DEBUG(0,("api_reply: malloc fail !\n"));
4732                 SAFE_FREE(rdata);
4733                 SAFE_FREE(rparam);
4734                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4735                 return;
4736         }
4737
4738         reply = api_commands[i].fn(conn,
4739                                 vuid,
4740                                 params,tpscnt,  /* params + length */
4741                                 data,tdscnt,    /* data + length */
4742                                 mdrcnt,mprcnt,
4743                                 &rdata,&rparam,&rdata_len,&rparam_len);
4744
4745
4746         if (rdata_len > mdrcnt || rparam_len > mprcnt) {
4747                 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
4748                                         &rdata,&rparam,&rdata_len,&rparam_len);
4749         }
4750
4751         /* if we get False back then it's actually unsupported */
4752         if (!reply) {
4753                 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
4754                         &rdata,&rparam,&rdata_len,&rparam_len);
4755         }
4756
4757         /* If api_Unsupported returns false we can't return anything. */
4758         if (reply) {
4759                 send_trans_reply(conn, req, rparam, rparam_len,
4760                                  rdata, rdata_len, False);
4761         }
4762
4763         SAFE_FREE(rdata);
4764         SAFE_FREE(rparam);
4765         return;
4766 }