s3-printing: fix crash bug in print_spool_open().
[kai/samba.git] / source3 / printing / printspoolss.c
1 /*
2    Unix SMB/CIFS implementation.
3    Printing routines that bridge to spoolss
4    Copyright (C) Simo Sorce 2010
5
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License as published by
8    the Free Software Foundation; either version 3 of the License, or
9    (at your option) any later version.
10
11    This program is distributed in the hope that it will be useful,
12    but WITHOUT ANY WARRANTY; without even the implied warranty of
13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14    GNU General Public License for more details.
15
16    You should have received a copy of the GNU General Public License
17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "printing.h"
22 #include "../librpc/gen_ndr/cli_spoolss.h"
23 #include "rpc_server/rpc_ncacn_np.h"
24 #include "smbd/globals.h"
25 #include "../libcli/security/security.h"
26
27 void print_spool_terminate(struct connection_struct *conn,
28                            struct print_file_data *print_file);
29
30 /***************************************************************************
31  * Open a Document over spoolss
32  ***************************************************************************/
33
34 #define DOCNAME_DEFAULT "Remote Downlevel Document"
35 #ifndef PRINT_SPOOL_PREFIX
36 #define PRINT_SPOOL_PREFIX "smbprn."
37 #endif
38
39 NTSTATUS print_spool_open(files_struct *fsp,
40                           const char *fname,
41                           uint16_t current_vuid)
42 {
43         NTSTATUS status;
44         TALLOC_CTX *tmp_ctx;
45         struct print_file_data *pf;
46         struct rpc_pipe_client *cli;
47         struct spoolss_DevmodeContainer devmode_ctr;
48         union spoolss_DocumentInfo info;
49         int fd = -1;
50         WERROR werr;
51
52         tmp_ctx = talloc_new(fsp);
53         if (!tmp_ctx) {
54                 return NT_STATUS_NO_MEMORY;
55         }
56
57         pf = talloc_zero(fsp, struct print_file_data);
58         if (!pf) {
59                 status = NT_STATUS_NO_MEMORY;
60                 goto done;
61         }
62         pf->svcname = talloc_strdup(pf, lp_servicename(SNUM(fsp->conn)));
63
64         /* the document name is derived from the file name.
65          * "Remote Downlevel Document" is added in front to
66          * mimic what windows does in this case */
67         pf->docname = talloc_strdup(pf, DOCNAME_DEFAULT);
68         if (!pf->docname) {
69                 status = NT_STATUS_NO_MEMORY;
70                 goto done;
71         }
72         if (fname) {
73                 const char *p = strrchr(fname, '/');
74                 if (!p) {
75                         p = fname;
76                 }
77                 pf->docname = talloc_asprintf_append(pf->docname, " %s", p);
78                 if (!pf->docname) {
79                         status = NT_STATUS_NO_MEMORY;
80                         goto done;
81                 }
82         }
83
84         /* Ok, now we have to open an actual file.
85          * Here is the reason:
86          * We want to write the spool job to this file in
87          * smbd for scalability reason (and also because
88          * apparently window printer drivers can seek when
89          * spooling to a file).
90          * So we first create a file, and then we pass it
91          * to spoolss in output_file so it can monitor and
92          * take over once we call EndDocPrinter().
93          * Of course we will not start writing until
94          * StartDocPrinter() actually gives the ok. */
95
96         pf->filename = talloc_asprintf(pf, "%s/%s.XXXXXX",
97                                         lp_pathname(SNUM(fsp->conn)),
98                                         PRINT_SPOOL_PREFIX);
99         if (!pf->filename) {
100                 status = NT_STATUS_NO_MEMORY;
101                 goto done;
102         }
103         errno = 0;
104         fd = mkstemp(pf->filename);
105         if (fd == -1) {
106                 if (errno == EACCES) {
107                         /* Common setup error, force a report. */
108                         DEBUG(0, ("Insufficient permissions "
109                                   "to open spool file %s.\n",
110                                   pf->filename));
111                 } else {
112                         /* Normal case, report at level 3 and above. */
113                         DEBUG(3, ("can't open spool file %s,\n",
114                                   pf->filename));
115                         DEBUGADD(3, ("errno = %d (%s).\n",
116                                      errno, strerror(errno)));
117                 }
118                 status = map_nt_error_from_unix(errno);
119                 goto done;
120         }
121
122         /* now open a document over spoolss so that it does
123          * all printer verification, and eventually assigns
124          * a job id */
125
126         status = rpc_pipe_open_interface(fsp->conn,
127                                          &ndr_table_spoolss.syntax_id,
128                                          fsp->conn->server_info,
129                                          &fsp->conn->sconn->client_id,
130                                          fsp->conn->sconn->msg_ctx,
131                                          &fsp->conn->spoolss_pipe);
132         if (!NT_STATUS_IS_OK(status)) {
133                 goto done;
134         }
135         cli = fsp->conn->spoolss_pipe;
136
137         ZERO_STRUCT(devmode_ctr);
138
139         status = rpccli_spoolss_OpenPrinter(cli, pf, pf->svcname,
140                                             "RAW", devmode_ctr,
141                                             SEC_FLAG_MAXIMUM_ALLOWED,
142                                             &pf->handle, &werr);
143         if (!NT_STATUS_IS_OK(status)) {
144                 goto done;
145         }
146         if (!W_ERROR_IS_OK(werr)) {
147                 status = werror_to_ntstatus(werr);
148                 goto done;
149         }
150
151         info.info1 = talloc(tmp_ctx, struct spoolss_DocumentInfo1);
152         if (!info.info1) {
153                 status = NT_STATUS_NO_MEMORY;
154                 goto done;
155         }
156         info.info1->document_name = pf->docname;
157         info.info1->output_file = pf->filename;
158         info.info1->datatype = "RAW";
159
160         status = rpccli_spoolss_StartDocPrinter(cli, tmp_ctx, &pf->handle,
161                                                 1, info, &pf->jobid, &werr);
162         if (!NT_STATUS_IS_OK(status)) {
163                 goto done;
164         }
165         if (!W_ERROR_IS_OK(werr)) {
166                 status = werror_to_ntstatus(werr);
167                 goto done;
168         }
169
170         /* Convert to RAP id. */
171         pf->rap_jobid = pjobid_to_rap(pf->svcname, pf->jobid);
172         if (pf->rap_jobid == 0) {
173                 /* No errno around here */
174                 status = NT_STATUS_ACCESS_DENIED;
175                 goto done;
176         }
177
178         /* setup a full fsp */
179         status = create_synthetic_smb_fname(fsp, pf->filename, NULL,
180                                             NULL, &fsp->fsp_name);
181         if (!NT_STATUS_IS_OK(status)) {
182                 goto done;
183         }
184
185         if (sys_fstat(fd, &fsp->fsp_name->st, false) != 0) {
186                 status = map_nt_error_from_unix(errno);
187                 goto done;
188         }
189
190         fsp->file_id = vfs_file_id_from_sbuf(fsp->conn, &fsp->fsp_name->st);
191         fsp->mode = fsp->fsp_name->st.st_ex_mode;
192         fsp->fh->fd = fd;
193
194         fsp->vuid = current_vuid;
195         fsp->can_lock = false;
196         fsp->can_read = false;
197         fsp->access_mask = FILE_GENERIC_WRITE;
198         fsp->can_write = true;
199         fsp->modified = false;
200         fsp->oplock_type = NO_OPLOCK;
201         fsp->sent_oplock_break = NO_BREAK_SENT;
202         fsp->is_directory = false;
203
204         fsp->print_file = pf;
205
206         status = NT_STATUS_OK;
207 done:
208         if (!NT_STATUS_IS_OK(status)) {
209                 if (fd != -1) {
210                         close(fd);
211                         if (fsp->print_file) {
212                                 unlink(fsp->print_file->filename);
213                         }
214                 }
215                 /* We need to delete the job from spoolss too */
216                 if (pf->jobid) {
217                         print_spool_terminate(fsp->conn, pf);
218                 }
219         }
220         talloc_free(tmp_ctx);
221         return status;
222 }
223
224 int print_spool_write(files_struct *fsp,
225                       const char *data, uint32_t size,
226                       SMB_OFF_T offset, uint32_t *written)
227 {
228         SMB_STRUCT_STAT st;
229         ssize_t n;
230         int ret;
231
232         *written = 0;
233
234         /* first of all stat file to find out if it is still there.
235          * spoolss may have deleted it to signal someone has killed
236          * the job through it's interface */
237
238         if (sys_fstat(fsp->fh->fd, &st, false) != 0) {
239                 ret = errno;
240                 DEBUG(3, ("printfile_offset: sys_fstat failed on %s (%s)\n",
241                           fsp_str_dbg(fsp), strerror(ret)));
242                 return ret;
243         }
244
245         /* check if the file is unlinked, this will signal spoolss has
246          * killed it, just return an error and close the file */
247         if (st.st_ex_nlink == 0) {
248                 close(fsp->fh->fd);
249                 return EBADF;
250         }
251
252         /* When print files go beyond 4GB, the 32-bit offset sent in
253          * old SMBwrite calls is relative to the current 4GB chunk
254          * we're writing to.
255          *    Discovered by Sebastian Kloska <oncaphillis@snafu.de>.
256          */
257         if (offset < 0xffffffff00000000LL) {
258                 offset = (st.st_ex_size & 0xffffffff00000000LL) + offset;
259         }
260
261         n = write_data_at_offset(fsp->fh->fd, data, size, offset);
262         if (n == -1) {
263                 ret = errno;
264                 print_spool_terminate(fsp->conn, fsp->print_file);
265         } else {
266                 *written = n;
267                 ret = 0;
268         }
269
270         return ret;
271 }
272
273 void print_spool_end(files_struct *fsp, enum file_close_type close_type)
274 {
275         struct rpc_pipe_client *cli;
276         NTSTATUS status;
277         WERROR werr;
278
279         status = rpc_pipe_open_interface(fsp->conn,
280                                          &ndr_table_spoolss.syntax_id,
281                                          fsp->conn->server_info,
282                                          &fsp->conn->sconn->client_id,
283                                          fsp->conn->sconn->msg_ctx,
284                                          &fsp->conn->spoolss_pipe);
285         if (!NT_STATUS_IS_OK(status)) {
286                 DEBUG(0, ("print_spool_end: "
287                           "Failed to get spoolss pipe [%s]\n",
288                           nt_errstr(status)));
289                 return;
290         }
291         cli = fsp->conn->spoolss_pipe;
292
293         switch (close_type) {
294         case NORMAL_CLOSE:
295         case SHUTDOWN_CLOSE:
296                 /* this also automatically calls spoolss_EndDocPrinter */
297                 status = rpccli_spoolss_ClosePrinter(cli, fsp->print_file,
298                                                 &fsp->print_file->handle,
299                                                 &werr);
300                 if (!NT_STATUS_IS_OK(status) ||
301                     !NT_STATUS_IS_OK(status = werror_to_ntstatus(werr))) {
302                         DEBUG(3, ("Failed to close printer %s [%s]\n",
303                               fsp->print_file->svcname, nt_errstr(status)));
304                 }
305                 break;
306         case ERROR_CLOSE:
307                 print_spool_terminate(fsp->conn, fsp->print_file);
308                 break;
309         }
310 }
311
312
313 void print_spool_terminate(struct connection_struct *conn,
314                            struct print_file_data *print_file)
315 {
316         struct rpc_pipe_client *cli;
317         NTSTATUS status;
318         WERROR werr;
319
320         rap_jobid_delete(print_file->svcname, print_file->jobid);
321
322         status = rpc_pipe_open_interface(conn,
323                                          &ndr_table_spoolss.syntax_id,
324                                          conn->server_info,
325                                          &conn->sconn->client_id,
326                                          conn->sconn->msg_ctx,
327                                          &conn->spoolss_pipe);
328         if (!NT_STATUS_IS_OK(status)) {
329                 DEBUG(0, ("print_spool_terminate: "
330                           "Failed to get spoolss pipe [%s]\n",
331                           nt_errstr(status)));
332                 return;
333         }
334         cli = conn->spoolss_pipe;
335
336         status = rpccli_spoolss_SetJob(cli, print_file,
337                                         &print_file->handle,
338                                         print_file->jobid,
339                                         NULL, SPOOLSS_JOB_CONTROL_DELETE,
340                                         &werr);
341         if (!NT_STATUS_IS_OK(status) ||
342             !NT_STATUS_IS_OK(status = werror_to_ntstatus(werr))) {
343                 DEBUG(3, ("Failed to delete job %d [%s]\n",
344                           print_file->jobid, nt_errstr(status)));
345                 return;
346         }
347         status = rpccli_spoolss_ClosePrinter(cli, print_file,
348                                              &print_file->handle,
349                                              &werr);
350         if (!NT_STATUS_IS_OK(status) ||
351             !NT_STATUS_IS_OK(status = werror_to_ntstatus(werr))) {
352                 DEBUG(3, ("Failed to close printer %s [%s]\n",
353                           print_file->svcname, nt_errstr(status)));
354                 return;
355         }
356 }