source3/smbd/lanman.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Inter-process communication and named pipe handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Jeremy Allison 2007.
   6
   7    SMB Version handling
   8    Copyright (C) John H Terpstra 1995-1998
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22    */
  23 /*
  24    This file handles the named pipe and mailslot calls
  25    in the SMBtrans protocol
  26    */
  27
  28 #include "includes.h"
  29
  30 #ifdef CHECK_TYPES
  31 #undef CHECK_TYPES
  32 #endif
  33 #define CHECK_TYPES 0
  34
  35 #define NERR_Success 0
  36 #define NERR_badpass 86
  37 #define NERR_notsupported 50
  38
  39 #define NERR_BASE (2100)
  40 #define NERR_BufTooSmall (NERR_BASE+23)
  41 #define NERR_JobNotFound (NERR_BASE+51)
  42 #define NERR_DestNotFound (NERR_BASE+52)
  43
  44 #define ACCESS_READ 0x01
  45 #define ACCESS_WRITE 0x02
  46 #define ACCESS_CREATE 0x04
  47
  48 #define SHPWLEN 8               /* share password length */
  49
  50 /* Limit size of ipc replies */
  51
  52 static char *smb_realloc_limit(void *ptr, size_t size)
  53 {
  54         char *val;
  55
  56         size = MAX((size),4*1024);
  57         val = (char *)SMB_REALLOC(ptr,size);
  58         if (val) {
  59                 memset(val,'\0',size);
  60         }
  61         return val;
  62 }
  63
  64 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
  65                                 char *param, int tpscnt,
  66                                 char *data, int tdscnt,
  67                                 int mdrcnt, int mprcnt,
  68                                 char **rdata, char **rparam,
  69                                 int *rdata_len, int *rparam_len);
  70
  71 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
  72                          int mdrcnt, int mprcnt,
  73                          char **rdata, char **rparam,
  74                          int *rdata_len, int *rparam_len);
  75
  76
  77 static int CopyExpanded(connection_struct *conn,
  78                         int snum, char **dst, char *src, int *p_space_remaining)
  79 {
  80         TALLOC_CTX *ctx = talloc_tos();
  81         char *buf = NULL;
  82         int l;
  83
  84         if (!src || !dst || !p_space_remaining || !(*dst) ||
  85                         *p_space_remaining <= 0) {
  86                 return 0;
  87         }
  88
  89         buf = talloc_strdup(ctx, src);
  90         if (!buf) {
  91                 *p_space_remaining = 0;
  92                 return 0;
  93         }
  94         buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
  95         if (!buf) {
  96                 *p_space_remaining = 0;
  97                 return 0;
  98         }
  99         buf = talloc_sub_advanced(ctx,
 100                                 lp_servicename(SNUM(conn)),
 101                                 conn->server_info->unix_name,
 102                                 conn->connectpath,
 103                                 conn->server_info->utok.gid,
 104                                 conn->server_info->sanitized_username,
 105                                 pdb_get_domain(conn->server_info->sam_account),
 106                                 buf);
 107         if (!buf) {
 108                 *p_space_remaining = 0;
 109                 return 0;
 110         }
 111         l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
 112         if (l == -1) {
 113                 return 0;
 114         }
 115         (*dst) += l;
 116         (*p_space_remaining) -= l;
 117         return l;
 118 }
 119
 120 static int CopyAndAdvance(char **dst, char *src, int *n)
 121 {
 122         int l;
 123         if (!src || !dst || !n || !(*dst)) {
 124                 return 0;
 125         }
 126         l = push_ascii(*dst,src,*n, STR_TERMINATE);
 127         if (l == -1) {
 128                 return 0;
 129         }
 130         (*dst) += l;
 131         (*n) -= l;
 132         return l;
 133 }
 134
 135 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
 136 {
 137         TALLOC_CTX *ctx = talloc_tos();
 138         char *buf = NULL;
 139         if (!s) {
 140                 return 0;
 141         }
 142         buf = talloc_strdup(ctx,s);
 143         if (!buf) {
 144                 return 0;
 145         }
 146         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 147         if (!buf) {
 148                 return 0;
 149         }
 150         buf = talloc_sub_advanced(ctx,
 151                                 lp_servicename(SNUM(conn)),
 152                                 conn->server_info->unix_name,
 153                                 conn->connectpath,
 154                                 conn->server_info->utok.gid,
 155                                 conn->server_info->sanitized_username,
 156                                 pdb_get_domain(conn->server_info->sam_account),
 157                                 buf);
 158         if (!buf) {
 159                 return 0;
 160         }
 161         return strlen(buf) + 1;
 162 }
 163
 164 static char *Expand(connection_struct *conn, int snum, char *s)
 165 {
 166         TALLOC_CTX *ctx = talloc_tos();
 167         char *buf = NULL;
 168
 169         if (!s) {
 170                 return NULL;
 171         }
 172         buf = talloc_strdup(ctx,s);
 173         if (!buf) {
 174                 return 0;
 175         }
 176         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 177         if (!buf) {
 178                 return 0;
 179         }
 180         return talloc_sub_advanced(ctx,
 181                                 lp_servicename(SNUM(conn)),
 182                                 conn->server_info->unix_name,
 183                                 conn->connectpath,
 184                                 conn->server_info->utok.gid,
 185                                 conn->server_info->sanitized_username,
 186                                 pdb_get_domain(conn->server_info->sam_account),
 187                                 buf);
 188 }
 189
 190 /*******************************************************************
 191  Check a API string for validity when we only need to check the prefix.
 192 ******************************************************************/
 193
 194 static bool prefix_ok(const char *str, const char *prefix)
 195 {
 196         return(strncmp(str,prefix,strlen(prefix)) == 0);
 197 }
 198
 199 struct pack_desc {
 200         const char *format;         /* formatstring for structure */
 201         const char *subformat;  /* subformat for structure */
 202         char *base;         /* baseaddress of buffer */
 203         int buflen;        /* remaining size for fixed part; on init: length of base */
 204         int subcount;       /* count of substructures */
 205         char *structbuf;  /* pointer into buffer for remaining fixed part */
 206         int stringlen;    /* remaining size for variable part */
 207         char *stringbuf;  /* pointer into buffer for remaining variable part */
 208         int neededlen;    /* total needed size */
 209         int usedlen;        /* total used size (usedlen <= neededlen and usedlen <= buflen) */
 210         const char *curpos;         /* current position; pointer into format or subformat */
 211         int errcode;
 212 };
 213
 214 static int get_counter(const char **p)
 215 {
 216         int i, n;
 217         if (!p || !(*p)) {
 218                 return 1;
 219         }
 220         if (!isdigit((int)**p)) {
 221                 return 1;
 222         }
 223         for (n = 0;;) {
 224                 i = **p;
 225                 if (isdigit(i)) {
 226                         n = 10 * n + (i - '0');
 227                 } else {
 228                         return n;
 229                 }
 230                 (*p)++;
 231         }
 232 }
 233
 234 static int getlen(const char *p)
 235 {
 236         int n = 0;
 237         if (!p) {
 238                 return 0;
 239         }
 240
 241         while (*p) {
 242                 switch( *p++ ) {
 243                 case 'W':                       /* word (2 byte) */
 244                         n += 2;
 245                         break;
 246                 case 'K':                       /* status word? (2 byte) */
 247                         n += 2;
 248                         break;
 249                 case 'N':                       /* count of substructures (word) at end */
 250                         n += 2;
 251                         break;
 252                 case 'D':                       /* double word (4 byte) */
 253                 case 'z':                       /* offset to zero terminated string (4 byte) */
 254                 case 'l':                       /* offset to user data (4 byte) */
 255                         n += 4;
 256                         break;
 257                 case 'b':                       /* offset to data (with counter) (4 byte) */
 258                         n += 4;
 259                         get_counter(&p);
 260                         break;
 261                 case 'B':                       /* byte (with optional counter) */
 262                         n += get_counter(&p);
 263                         break;
 264                 }
 265         }
 266         return n;
 267 }
 268
 269 static bool init_package(struct pack_desc *p, int count, int subcount)
 270 {
 271         int n = p->buflen;
 272         int i;
 273
 274         if (!p->format || !p->base) {
 275                 return False;
 276         }
 277
 278         i = count * getlen(p->format);
 279         if (p->subformat) {
 280                 i += subcount * getlen(p->subformat);
 281         }
 282         p->structbuf = p->base;
 283         p->neededlen = 0;
 284         p->usedlen = 0;
 285         p->subcount = 0;
 286         p->curpos = p->format;
 287         if (i > n) {
 288                 p->neededlen = i;
 289                 i = n = 0;
 290 #if 0
 291                 /*
 292                  * This is the old error code we used. Aparently
 293                  * WinNT/2k systems return ERRbuftoosmall (2123) and
 294                  * OS/2 needs this. I'm leaving this here so we can revert
 295                  * if needed. JRA.
 296                  */
 297                 p->errcode = ERRmoredata;
 298 #else
 299                 p->errcode = ERRbuftoosmall;
 300 #endif
 301         } else {
 302                 p->errcode = NERR_Success;
 303         }
 304         p->buflen = i;
 305         n -= i;
 306         p->stringbuf = p->base + i;
 307         p->stringlen = n;
 308         return (p->errcode == NERR_Success);
 309 }
 310
 311 static int package(struct pack_desc *p, ...)
 312 {
 313         va_list args;
 314         int needed=0, stringneeded;
 315         const char *str=NULL;
 316         int is_string=0, stringused;
 317         int32 temp;
 318
 319         va_start(args,p);
 320
 321         if (!*p->curpos) {
 322                 if (!p->subcount) {
 323                         p->curpos = p->format;
 324                 } else {
 325                         p->curpos = p->subformat;
 326                         p->subcount--;
 327                 }
 328         }
 329 #if CHECK_TYPES
 330         str = va_arg(args,char*);
 331         SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
 332 #endif
 333         stringneeded = -1;
 334
 335         if (!p->curpos) {
 336                 va_end(args);
 337                 return 0;
 338         }
 339
 340         switch( *p->curpos++ ) {
 341                 case 'W':                       /* word (2 byte) */
 342                         needed = 2;
 343                         temp = va_arg(args,int);
 344                         if (p->buflen >= needed) {
 345                                 SSVAL(p->structbuf,0,temp);
 346                         }
 347                         break;
 348                 case 'K':                       /* status word? (2 byte) */
 349                         needed = 2;
 350                         temp = va_arg(args,int);
 351                         if (p->buflen >= needed) {
 352                                 SSVAL(p->structbuf,0,temp);
 353                         }
 354                         break;
 355                 case 'N':                       /* count of substructures (word) at end */
 356                         needed = 2;
 357                         p->subcount = va_arg(args,int);
 358                         if (p->buflen >= needed) {
 359                                 SSVAL(p->structbuf,0,p->subcount);
 360                         }
 361                         break;
 362                 case 'D':                       /* double word (4 byte) */
 363                         needed = 4;
 364                         temp = va_arg(args,int);
 365                         if (p->buflen >= needed) {
 366                                 SIVAL(p->structbuf,0,temp);
 367                         }
 368                         break;
 369                 case 'B':                       /* byte (with optional counter) */
 370                         needed = get_counter(&p->curpos);
 371                         {
 372                                 char *s = va_arg(args,char*);
 373                                 if (p->buflen >= needed) {
 374                                         StrnCpy(p->structbuf,s?s:"",needed-1);
 375                                 }
 376                         }
 377                         break;
 378                 case 'z':                       /* offset to zero terminated string (4 byte) */
 379                         str = va_arg(args,char*);
 380                         stringneeded = (str ? strlen(str)+1 : 0);
 381                         is_string = 1;
 382                         break;
 383                 case 'l':                       /* offset to user data (4 byte) */
 384                         str = va_arg(args,char*);
 385                         stringneeded = va_arg(args,int);
 386                         is_string = 0;
 387                         break;
 388                 case 'b':                       /* offset to data (with counter) (4 byte) */
 389                         str = va_arg(args,char*);
 390                         stringneeded = get_counter(&p->curpos);
 391                         is_string = 0;
 392                         break;
 393         }
 394
 395         va_end(args);
 396         if (stringneeded >= 0) {
 397                 needed = 4;
 398                 if (p->buflen >= needed) {
 399                         stringused = stringneeded;
 400                         if (stringused > p->stringlen) {
 401                                 stringused = (is_string ? p->stringlen : 0);
 402                                 if (p->errcode == NERR_Success) {
 403                                         p->errcode = ERRmoredata;
 404                                 }
 405                         }
 406                         if (!stringused) {
 407                                 SIVAL(p->structbuf,0,0);
 408                         } else {
 409                                 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
 410                                 memcpy(p->stringbuf,str?str:"",stringused);
 411                                 if (is_string) {
 412                                         p->stringbuf[stringused-1] = '\0';
 413                                 }
 414                                 p->stringbuf += stringused;
 415                                 p->stringlen -= stringused;
 416                                 p->usedlen += stringused;
 417                         }
 418                 }
 419                 p->neededlen += stringneeded;
 420         }
 421
 422         p->neededlen += needed;
 423         if (p->buflen >= needed) {
 424                 p->structbuf += needed;
 425                 p->buflen -= needed;
 426                 p->usedlen += needed;
 427         } else {
 428                 if (p->errcode == NERR_Success) {
 429                         p->errcode = ERRmoredata;
 430                 }
 431         }
 432         return 1;
 433 }
 434
 435 #if CHECK_TYPES
 436 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
 437 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
 438 #else
 439 #define PACK(desc,t,v) package(desc,v)
 440 #define PACKl(desc,t,v,l) package(desc,v,l)
 441 #endif
 442
 443 static void PACKI(struct pack_desc* desc, const char *t,int v)
 444 {
 445         PACK(desc,t,v);
 446 }
 447
 448 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
 449 {
 450         PACK(desc,t,v);
 451 }
 452
 453 /****************************************************************************
 454  Get a print queue.
 455 ****************************************************************************/
 456
 457 static void PackDriverData(struct pack_desc* desc)
 458 {
 459         char drivdata[4+4+32];
 460         SIVAL(drivdata,0,sizeof drivdata); /* cb */
 461         SIVAL(drivdata,4,1000); /* lVersion */
 462         memset(drivdata+8,0,32);        /* szDeviceName */
 463         push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
 464         PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
 465 }
 466
 467 static int check_printq_info(struct pack_desc* desc,
 468                                 unsigned int uLevel, char *id1, char *id2)
 469 {
 470         desc->subformat = NULL;
 471         switch( uLevel ) {
 472                 case 0:
 473                         desc->format = "B13";
 474                         break;
 475                 case 1:
 476                         desc->format = "B13BWWWzzzzzWW";
 477                         break;
 478                 case 2:
 479                         desc->format = "B13BWWWzzzzzWN";
 480                         desc->subformat = "WB21BB16B10zWWzDDz";
 481                         break;
 482                 case 3:
 483                         desc->format = "zWWWWzzzzWWzzl";
 484                         break;
 485                 case 4:
 486                         desc->format = "zWWWWzzzzWNzzl";
 487                         desc->subformat = "WWzWWDDzz";
 488                         break;
 489                 case 5:
 490                         desc->format = "z";
 491                         break;
 492                 case 51:
 493                         desc->format = "K";
 494                         break;
 495                 case 52:
 496                         desc->format = "WzzzzzzzzN";
 497                         desc->subformat = "z";
 498                         break;
 499                 default:
 500                         DEBUG(0,("check_printq_info: invalid level %d\n",
 501                                 uLevel ));
 502                         return False;
 503         }
 504         if (id1 == NULL || strcmp(desc->format,id1) != 0) {
 505                 DEBUG(0,("check_printq_info: invalid format %s\n",
 506                         id1 ? id1 : "<NULL>" ));
 507                 return False;
 508         }
 509         if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
 510                 DEBUG(0,("check_printq_info: invalid subformat %s\n",
 511                         id2 ? id2 : "<NULL>" ));
 512                 return False;
 513         }
 514         return True;
 515 }
 516
 517
 518 #define RAP_JOB_STATUS_QUEUED 0
 519 #define RAP_JOB_STATUS_PAUSED 1
 520 #define RAP_JOB_STATUS_SPOOLING 2
 521 #define RAP_JOB_STATUS_PRINTING 3
 522 #define RAP_JOB_STATUS_PRINTED 4
 523
 524 #define RAP_QUEUE_STATUS_PAUSED 1
 525 #define RAP_QUEUE_STATUS_ERROR 2
 526
 527 /* turn a print job status into a on the wire status
 528 */
 529 static int printj_status(int v)
 530 {
 531         switch (v) {
 532         case LPQ_QUEUED:
 533                 return RAP_JOB_STATUS_QUEUED;
 534         case LPQ_PAUSED:
 535                 return RAP_JOB_STATUS_PAUSED;
 536         case LPQ_SPOOLING:
 537                 return RAP_JOB_STATUS_SPOOLING;
 538         case LPQ_PRINTING:
 539                 return RAP_JOB_STATUS_PRINTING;
 540         }
 541         return 0;
 542 }
 543
 544 /* turn a print queue status into a on the wire status
 545 */
 546 static int printq_status(int v)
 547 {
 548         switch (v) {
 549         case LPQ_QUEUED:
 550                 return 0;
 551         case LPQ_PAUSED:
 552                 return RAP_QUEUE_STATUS_PAUSED;
 553         }
 554         return RAP_QUEUE_STATUS_ERROR;
 555 }
 556
 557 static void fill_printjob_info(connection_struct *conn, int snum, int uLevel,
 558                                struct pack_desc *desc,
 559                                print_queue_struct *queue, int n)
 560 {
 561         time_t t = queue->time;
 562
 563         /* the client expects localtime */
 564         t -= get_time_zone(t);
 565
 566         PACKI(desc,"W",pjobid_to_rap(lp_const_servicename(snum),queue->job)); /* uJobId */
 567         if (uLevel == 1) {
 568                 PACKS(desc,"B21",queue->fs_user); /* szUserName */
 569                 PACKS(desc,"B","");             /* pad */
 570                 PACKS(desc,"B16","");   /* szNotifyName */
 571                 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
 572                 PACKS(desc,"z","");             /* pszParms */
 573                 PACKI(desc,"W",n+1);            /* uPosition */
 574                 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
 575                 PACKS(desc,"z","");             /* pszStatus */
 576                 PACKI(desc,"D",t); /* ulSubmitted */
 577                 PACKI(desc,"D",queue->size); /* ulSize */
 578                 PACKS(desc,"z",queue->fs_file); /* pszComment */
 579         }
 580         if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
 581                 PACKI(desc,"W",queue->priority);                /* uPriority */
 582                 PACKS(desc,"z",queue->fs_user); /* pszUserName */
 583                 PACKI(desc,"W",n+1);            /* uPosition */
 584                 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
 585                 PACKI(desc,"D",t); /* ulSubmitted */
 586                 PACKI(desc,"D",queue->size); /* ulSize */
 587                 PACKS(desc,"z","Samba");        /* pszComment */
 588                 PACKS(desc,"z",queue->fs_file); /* pszDocument */
 589                 if (uLevel == 3) {
 590                         PACKS(desc,"z","");     /* pszNotifyName */
 591                         PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
 592                         PACKS(desc,"z","");     /* pszParms */
 593                         PACKS(desc,"z","");     /* pszStatus */
 594                         PACKS(desc,"z",SERVICE(snum)); /* pszQueue */
 595                         PACKS(desc,"z","lpd");  /* pszQProcName */
 596                         PACKS(desc,"z","");     /* pszQProcParms */
 597                         PACKS(desc,"z","NULL"); /* pszDriverName */
 598                         PackDriverData(desc);   /* pDriverData */
 599                         PACKS(desc,"z","");     /* pszPrinterName */
 600                 } else if (uLevel == 4) {   /* OS2 */
 601                         PACKS(desc,"z","");       /* pszSpoolFileName  */
 602                         PACKS(desc,"z","");       /* pszPortName       */
 603                         PACKS(desc,"z","");       /* pszStatus         */
 604                         PACKI(desc,"D",0);        /* ulPagesSpooled    */
 605                         PACKI(desc,"D",0);        /* ulPagesSent       */
 606                         PACKI(desc,"D",0);        /* ulPagesPrinted    */
 607                         PACKI(desc,"D",0);        /* ulTimePrinted     */
 608                         PACKI(desc,"D",0);        /* ulExtendJobStatus */
 609                         PACKI(desc,"D",0);        /* ulStartPage       */
 610                         PACKI(desc,"D",0);        /* ulEndPage         */
 611                 }
 612         }
 613 }
 614
 615 /********************************************************************
 616  Return a driver name given an snum.
 617  Returns True if from tdb, False otherwise.
 618  ********************************************************************/
 619
 620 static bool get_driver_name(int snum, char **pp_drivername)
 621 {
 622         NT_PRINTER_INFO_LEVEL *info = NULL;
 623         bool in_tdb = false;
 624
 625         get_a_printer (NULL, &info, 2, lp_servicename(snum));
 626         if (info != NULL) {
 627                 *pp_drivername = talloc_strdup(talloc_tos(),
 628                                         info->info_2->drivername);
 629                 in_tdb = true;
 630                 free_a_printer(&info, 2);
 631                 if (!*pp_drivername) {
 632                         return false;
 633                 }
 634         }
 635
 636         return in_tdb;
 637 }
 638
 639 /********************************************************************
 640  Respond to the DosPrintQInfo command with a level of 52
 641  This is used to get printer driver information for Win9x clients
 642  ********************************************************************/
 643 static void fill_printq_info_52(connection_struct *conn, int snum,
 644                                 struct pack_desc* desc, int count )
 645 {
 646         int                             i;
 647         fstring                         location;
 648         NT_PRINTER_DRIVER_INFO_LEVEL    driver;
 649         NT_PRINTER_INFO_LEVEL           *printer = NULL;
 650
 651         ZERO_STRUCT(driver);
 652
 653         if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
 654                 DEBUG(3,("fill_printq_info_52: Failed to lookup printer [%s]\n",
 655                         lp_servicename(snum)));
 656                 goto err;
 657         }
 658
 659         if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
 660                 "Windows 4.0", 0)) )
 661         {
 662                 DEBUG(3,("fill_printq_info_52: Failed to lookup driver [%s]\n",
 663                         printer->info_2->drivername));
 664                 goto err;
 665         }
 666
 667         trim_string(driver.info_3->driverpath, "\\print$\\WIN40\\0\\", 0);
 668         trim_string(driver.info_3->datafile, "\\print$\\WIN40\\0\\", 0);
 669         trim_string(driver.info_3->helpfile, "\\print$\\WIN40\\0\\", 0);
 670
 671         PACKI(desc, "W", 0x0400);                     /* don't know */
 672         PACKS(desc, "z", driver.info_3->name);        /* long printer name */
 673         PACKS(desc, "z", driver.info_3->driverpath);  /* Driverfile Name */
 674         PACKS(desc, "z", driver.info_3->datafile);    /* Datafile name */
 675         PACKS(desc, "z", driver.info_3->monitorname); /* language monitor */
 676
 677         fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
 678         standard_sub_basic( "", "", location, sizeof(location)-1 );
 679         PACKS(desc,"z", location);                          /* share to retrieve files */
 680
 681         PACKS(desc,"z", driver.info_3->defaultdatatype);    /* default data type */
 682         PACKS(desc,"z", driver.info_3->helpfile);           /* helpfile name */
 683         PACKS(desc,"z", driver.info_3->driverpath);               /* driver name */
 684
 685         DEBUG(3,("Printer Driver Name: %s:\n",driver.info_3->name));
 686         DEBUG(3,("Driver: %s:\n",driver.info_3->driverpath));
 687         DEBUG(3,("Data File: %s:\n",driver.info_3->datafile));
 688         DEBUG(3,("Language Monitor: %s:\n",driver.info_3->monitorname));
 689         DEBUG(3,("Driver Location: %s:\n",location));
 690         DEBUG(3,("Data Type: %s:\n",driver.info_3->defaultdatatype));
 691         DEBUG(3,("Help File: %s:\n",driver.info_3->helpfile));
 692         PACKI(desc,"N",count);                     /* number of files to copy */
 693
 694         for ( i=0; i<count && driver.info_3->dependentfiles && *driver.info_3->dependentfiles[i]; i++)
 695         {
 696                 trim_string(driver.info_3->dependentfiles[i], "\\print$\\WIN40\\0\\", 0);
 697                 PACKS(desc,"z",driver.info_3->dependentfiles[i]);         /* driver files to copy */
 698                 DEBUG(3,("Dependent File: %s:\n",driver.info_3->dependentfiles[i]));
 699         }
 700
 701         /* sanity check */
 702         if ( i != count )
 703                 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
 704                         count, i));
 705
 706         DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", SERVICE(snum),i));
 707
 708         desc->errcode=NERR_Success;
 709         goto done;
 710
 711 err:
 712         DEBUG(3,("fill_printq_info: Can't supply driver files\n"));
 713         desc->errcode=NERR_notsupported;
 714
 715 done:
 716         if ( printer )
 717                 free_a_printer( &printer, 2 );
 718
 719         if ( driver.info_3 )
 720                 free_a_printer_driver( driver, 3 );
 721 }
 722
 723
 724 static void fill_printq_info(connection_struct *conn, int snum, int uLevel,
 725                              struct pack_desc* desc,
 726                              int count, print_queue_struct* queue,
 727                              print_status_struct* status)
 728 {
 729         switch (uLevel) {
 730         case 1:
 731         case 2:
 732                 PACKS(desc,"B13",SERVICE(snum));
 733                 break;
 734         case 3:
 735         case 4:
 736         case 5:
 737                 PACKS(desc,"z",Expand(conn,snum,SERVICE(snum)));
 738                 break;
 739         case 51:
 740                 PACKI(desc,"K",printq_status(status->status));
 741                 break;
 742         }
 743
 744         if (uLevel == 1 || uLevel == 2) {
 745                 PACKS(desc,"B","");             /* alignment */
 746                 PACKI(desc,"W",5);              /* priority */
 747                 PACKI(desc,"W",0);              /* start time */
 748                 PACKI(desc,"W",0);              /* until time */
 749                 PACKS(desc,"z","");             /* pSepFile */
 750                 PACKS(desc,"z","lpd");  /* pPrProc */
 751                 PACKS(desc,"z",SERVICE(snum)); /* pDestinations */
 752                 PACKS(desc,"z","");             /* pParms */
 753                 if (snum < 0) {
 754                         PACKS(desc,"z","UNKNOWN PRINTER");
 755                         PACKI(desc,"W",LPSTAT_ERROR);
 756                 }
 757                 else if (!status || !status->message[0]) {
 758                         PACKS(desc,"z",Expand(conn,snum,lp_comment(snum)));
 759                         PACKI(desc,"W",LPSTAT_OK); /* status */
 760                 } else {
 761                         PACKS(desc,"z",status->message);
 762                         PACKI(desc,"W",printq_status(status->status)); /* status */
 763                 }
 764                 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
 765         }
 766
 767         if (uLevel == 3 || uLevel == 4) {
 768                 char *drivername = NULL;
 769
 770                 PACKI(desc,"W",5);              /* uPriority */
 771                 PACKI(desc,"W",0);              /* uStarttime */
 772                 PACKI(desc,"W",0);              /* uUntiltime */
 773                 PACKI(desc,"W",5);              /* pad1 */
 774                 PACKS(desc,"z","");             /* pszSepFile */
 775                 PACKS(desc,"z","WinPrint");     /* pszPrProc */
 776                 PACKS(desc,"z",NULL);           /* pszParms */
 777                 PACKS(desc,"z",NULL);           /* pszComment - don't ask.... JRA */
 778                 /* "don't ask" that it's done this way to fix corrupted
 779                    Win9X/ME printer comments. */
 780                 if (!status) {
 781                         PACKI(desc,"W",LPSTAT_OK); /* fsStatus */
 782                 } else {
 783                         PACKI(desc,"W",printq_status(status->status)); /* fsStatus */
 784                 }
 785                 PACKI(desc,(uLevel == 3 ? "W" : "N"),count);    /* cJobs */
 786                 PACKS(desc,"z",SERVICE(snum)); /* pszPrinters */
 787                 get_driver_name(snum,&drivername);
 788                 if (!drivername) {
 789                         return;
 790                 }
 791                 PACKS(desc,"z",drivername);             /* pszDriverName */
 792                 PackDriverData(desc);   /* pDriverData */
 793         }
 794
 795         if (uLevel == 2 || uLevel == 4) {
 796                 int i;
 797                 for (i=0;i<count;i++)
 798                         fill_printjob_info(conn,snum,uLevel == 2 ? 1 : 2,desc,&queue[i],i);
 799         }
 800
 801         if (uLevel==52)
 802                 fill_printq_info_52( conn, snum, desc, count );
 803 }
 804
 805 /* This function returns the number of files for a given driver */
 806 static int get_printerdrivernumber(int snum)
 807 {
 808         int                             result = 0;
 809         NT_PRINTER_DRIVER_INFO_LEVEL    driver;
 810         NT_PRINTER_INFO_LEVEL           *printer = NULL;
 811
 812         ZERO_STRUCT(driver);
 813
 814         if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
 815                 DEBUG(3,("get_printerdrivernumber: Failed to lookup printer [%s]\n",
 816                         lp_servicename(snum)));
 817                 goto done;
 818         }
 819
 820         if ( !W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername,
 821                 "Windows 4.0", 0)) )
 822         {
 823                 DEBUG(3,("get_printerdrivernumber: Failed to lookup driver [%s]\n",
 824                         printer->info_2->drivername));
 825                 goto done;
 826         }
 827
 828         /* count the number of files */
 829         while ( driver.info_3->dependentfiles && *driver.info_3->dependentfiles[result] )
 830                         result++;
 831                         \
 832  done:
 833         if ( printer )
 834                 free_a_printer( &printer, 2 );
 835
 836         if ( driver.info_3 )
 837                 free_a_printer_driver( driver, 3 );
 838
 839         return result;
 840 }
 841
 842 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
 843                                 char *param, int tpscnt,
 844                                 char *data, int tdscnt,
 845                                 int mdrcnt,int mprcnt,
 846                                 char **rdata,char **rparam,
 847                                 int *rdata_len,int *rparam_len)
 848 {
 849         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
 850         char *str2 = skip_string(param,tpscnt,str1);
 851         char *p = skip_string(param,tpscnt,str2);
 852         char *QueueName = p;
 853         unsigned int uLevel;
 854         int count=0;
 855         int snum;
 856         char *str3;
 857         struct pack_desc desc;
 858         print_queue_struct *queue=NULL;
 859         print_status_struct status;
 860         char* tmpdata=NULL;
 861
 862         if (!str1 || !str2 || !p) {
 863                 return False;
 864         }
 865         memset((char *)&status,'\0',sizeof(status));
 866         memset((char *)&desc,'\0',sizeof(desc));
 867
 868         p = skip_string(param,tpscnt,p);
 869         if (!p) {
 870                 return False;
 871         }
 872         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 873         str3 = get_safe_str_ptr(param,tpscnt,p,4);
 874         /* str3 may be null here and is checked in check_printq_info(). */
 875
 876         /* remove any trailing username */
 877         if ((p = strchr_m(QueueName,'%')))
 878                 *p = 0;
 879
 880         DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
 881
 882         /* check it's a supported varient */
 883         if (!prefix_ok(str1,"zWrLh"))
 884                 return False;
 885         if (!check_printq_info(&desc,uLevel,str2,str3)) {
 886                 /*
 887                  * Patch from Scott Moomaw <scott@bridgewater.edu>
 888                  * to return the 'invalid info level' error if an
 889                  * unknown level was requested.
 890                  */
 891                 *rdata_len = 0;
 892                 *rparam_len = 6;
 893                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
 894                 if (!*rparam) {
 895                         return False;
 896                 }
 897                 SSVALS(*rparam,0,ERRunknownlevel);
 898                 SSVAL(*rparam,2,0);
 899                 SSVAL(*rparam,4,0);
 900                 return(True);
 901         }
 902
 903         snum = find_service(QueueName);
 904         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) )
 905                 return False;
 906
 907         if (uLevel==52) {
 908                 count = get_printerdrivernumber(snum);
 909                 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
 910         } else {
 911                 count = print_queue_status(snum, &queue,&status);
 912         }
 913
 914         if (mdrcnt > 0) {
 915                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
 916                 if (!*rdata) {
 917                         SAFE_FREE(queue);
 918                         return False;
 919                 }
 920                 desc.base = *rdata;
 921                 desc.buflen = mdrcnt;
 922         } else {
 923                 /*
 924                  * Don't return data but need to get correct length
 925                  * init_package will return wrong size if buflen=0
 926                  */
 927                 desc.buflen = getlen(desc.format);
 928                 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
 929         }
 930
 931         if (init_package(&desc,1,count)) {
 932                 desc.subcount = count;
 933                 fill_printq_info(conn,snum,uLevel,&desc,count,queue,&status);
 934         }
 935
 936         *rdata_len = desc.usedlen;
 937
 938         /*
 939          * We must set the return code to ERRbuftoosmall
 940          * in order to support lanman style printing with Win NT/2k
 941          * clients       --jerry
 942          */
 943         if (!mdrcnt && lp_disable_spoolss())
 944                 desc.errcode = ERRbuftoosmall;
 945
 946         *rdata_len = desc.usedlen;
 947         *rparam_len = 6;
 948         *rparam = smb_realloc_limit(*rparam,*rparam_len);
 949         if (!*rparam) {
 950                 SAFE_FREE(queue);
 951                 SAFE_FREE(tmpdata);
 952                 return False;
 953         }
 954         SSVALS(*rparam,0,desc.errcode);
 955         SSVAL(*rparam,2,0);
 956         SSVAL(*rparam,4,desc.neededlen);
 957
 958         DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
 959
 960         SAFE_FREE(queue);
 961         SAFE_FREE(tmpdata);
 962
 963         return(True);
 964 }
 965
 966 /****************************************************************************
 967  View list of all print jobs on all queues.
 968 ****************************************************************************/
 969
 970 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
 971                                 char *param, int tpscnt,
 972                                 char *data, int tdscnt,
 973                                 int mdrcnt, int mprcnt,
 974                                 char **rdata, char** rparam,
 975                                 int *rdata_len, int *rparam_len)
 976 {
 977         char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
 978         char *output_format1 = skip_string(param,tpscnt,param_format);
 979         char *p = skip_string(param,tpscnt,output_format1);
 980         unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 981         char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
 982         int services = lp_numservices();
 983         int i, n;
 984         struct pack_desc desc;
 985         print_queue_struct **queue = NULL;
 986         print_status_struct *status = NULL;
 987         int *subcntarr = NULL;
 988         int queuecnt = 0, subcnt = 0, succnt = 0;
 989
 990         if (!param_format || !output_format1 || !p) {
 991                 return False;
 992         }
 993
 994         memset((char *)&desc,'\0',sizeof(desc));
 995
 996         DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
 997
 998         if (!prefix_ok(param_format,"WrLeh")) {
 999                 return False;
1000         }
1001         if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1002                 /*
1003                  * Patch from Scott Moomaw <scott@bridgewater.edu>
1004                  * to return the 'invalid info level' error if an
1005                  * unknown level was requested.
1006                  */
1007                 *rdata_len = 0;
1008                 *rparam_len = 6;
1009                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1010                 if (!*rparam) {
1011                         return False;
1012                 }
1013                 SSVALS(*rparam,0,ERRunknownlevel);
1014                 SSVAL(*rparam,2,0);
1015                 SSVAL(*rparam,4,0);
1016                 return(True);
1017         }
1018
1019         for (i = 0; i < services; i++) {
1020                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1021                         queuecnt++;
1022                 }
1023         }
1024
1025         if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
1026                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1027                 goto err;
1028         }
1029         memset(queue,0,queuecnt*sizeof(print_queue_struct*));
1030         if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
1031                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1032                 goto err;
1033         }
1034         memset(status,0,queuecnt*sizeof(print_status_struct));
1035         if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1036                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1037                 goto err;
1038         }
1039
1040         subcnt = 0;
1041         n = 0;
1042         for (i = 0; i < services; i++) {
1043                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1044                         subcntarr[n] = print_queue_status(i, &queue[n],&status[n]);
1045                         subcnt += subcntarr[n];
1046                         n++;
1047                 }
1048         }
1049
1050         if (mdrcnt > 0) {
1051                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1052                 if (!*rdata) {
1053                         goto err;
1054                 }
1055         }
1056         desc.base = *rdata;
1057         desc.buflen = mdrcnt;
1058
1059         if (init_package(&desc,queuecnt,subcnt)) {
1060                 n = 0;
1061                 succnt = 0;
1062                 for (i = 0; i < services; i++) {
1063                         if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1064                                 fill_printq_info(conn,i,uLevel,&desc,subcntarr[n],queue[n],&status[n]);
1065                                 n++;
1066                                 if (desc.errcode == NERR_Success) {
1067                                         succnt = n;
1068                                 }
1069                         }
1070                 }
1071         }
1072
1073         SAFE_FREE(subcntarr);
1074
1075         *rdata_len = desc.usedlen;
1076         *rparam_len = 8;
1077         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1078         if (!*rparam) {
1079                 goto err;
1080         }
1081         SSVALS(*rparam,0,desc.errcode);
1082         SSVAL(*rparam,2,0);
1083         SSVAL(*rparam,4,succnt);
1084         SSVAL(*rparam,6,queuecnt);
1085
1086         for (i = 0; i < queuecnt; i++) {
1087                 if (queue) {
1088                         SAFE_FREE(queue[i]);
1089                 }
1090         }
1091
1092         SAFE_FREE(queue);
1093         SAFE_FREE(status);
1094
1095         return True;
1096
1097   err:
1098
1099         SAFE_FREE(subcntarr);
1100         for (i = 0; i < queuecnt; i++) {
1101                 if (queue) {
1102                         SAFE_FREE(queue[i]);
1103                 }
1104         }
1105         SAFE_FREE(queue);
1106         SAFE_FREE(status);
1107
1108         return False;
1109 }
1110
1111 /****************************************************************************
1112  Get info level for a server list query.
1113 ****************************************************************************/
1114
1115 static bool check_server_info(int uLevel, char* id)
1116 {
1117         switch( uLevel ) {
1118                 case 0:
1119                         if (strcmp(id,"B16") != 0) {
1120                                 return False;
1121                         }
1122                         break;
1123                 case 1:
1124                         if (strcmp(id,"B16BBDz") != 0) {
1125                                 return False;
1126                         }
1127                         break;
1128                 default:
1129                         return False;
1130         }
1131         return True;
1132 }
1133
1134 struct srv_info_struct {
1135         fstring name;
1136         uint32 type;
1137         fstring comment;
1138         fstring domain;
1139         bool server_added;
1140 };
1141
1142 /*******************************************************************
1143  Get server info lists from the files saved by nmbd. Return the
1144  number of entries.
1145 ******************************************************************/
1146
1147 static int get_server_info(uint32 servertype,
1148                            struct srv_info_struct **servers,
1149                            const char *domain)
1150 {
1151         int count=0;
1152         int alloced=0;
1153         char **lines;
1154         bool local_list_only;
1155         int i;
1156
1157         lines = file_lines_load(lock_path(SERVER_LIST), NULL, 0, NULL);
1158         if (!lines) {
1159                 DEBUG(4,("Can't open %s - %s\n",lock_path(SERVER_LIST),strerror(errno)));
1160                 return 0;
1161         }
1162
1163         /* request for everything is code for request all servers */
1164         if (servertype == SV_TYPE_ALL) {
1165                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1166         }
1167
1168         local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1169
1170         DEBUG(4,("Servertype search: %8x\n",servertype));
1171
1172         for (i=0;lines[i];i++) {
1173                 fstring stype;
1174                 struct srv_info_struct *s;
1175                 const char *ptr = lines[i];
1176                 bool ok = True;
1177                 TALLOC_CTX *frame = NULL;
1178                 char *p;
1179
1180                 if (!*ptr) {
1181                         continue;
1182                 }
1183
1184                 if (count == alloced) {
1185                         alloced += 10;
1186                         *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1187                         if (!*servers) {
1188                                 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1189                                 TALLOC_FREE(lines);
1190                                 return 0;
1191                         }
1192                         memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1193                 }
1194                 s = &(*servers)[count];
1195
1196                 frame = talloc_stackframe();
1197                 s->name[0] = '\0';
1198                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1199                         TALLOC_FREE(frame);
1200                         continue;
1201                 }
1202                 fstrcpy(s->name, p);
1203
1204                 stype[0] = '\0';
1205                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1206                         TALLOC_FREE(frame);
1207                         continue;
1208                 }
1209                 fstrcpy(stype, p);
1210
1211                 s->comment[0] = '\0';
1212                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1213                         TALLOC_FREE(frame);
1214                         continue;
1215                 }
1216                 fstrcpy(s->comment, p);
1217
1218                 s->domain[0] = '\0';
1219                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1220                         /* this allows us to cope with an old nmbd */
1221                         fstrcpy(s->domain,lp_workgroup());
1222                 } else {
1223                         fstrcpy(s->domain, p);
1224                 }
1225                 TALLOC_FREE(frame);
1226
1227                 if (sscanf(stype,"%X",&s->type) != 1) {
1228                         DEBUG(4,("r:host file "));
1229                         ok = False;
1230                 }
1231
1232                 /* Filter the servers/domains we return based on what was asked for. */
1233
1234                 /* Check to see if we are being asked for a local list only. */
1235                 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1236                         DEBUG(4,("r: local list only"));
1237                         ok = False;
1238                 }
1239
1240                 /* doesn't match up: don't want it */
1241                 if (!(servertype & s->type)) {
1242                         DEBUG(4,("r:serv type "));
1243                         ok = False;
1244                 }
1245
1246                 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1247                                 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1248                         DEBUG(4,("s: dom mismatch "));
1249                         ok = False;
1250                 }
1251
1252                 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1253                         ok = False;
1254                 }
1255
1256                 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1257                 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1258
1259                 if (ok) {
1260                         DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1261                                 s->name, s->type, s->comment, s->domain));
1262                         s->server_added = True;
1263                         count++;
1264                 } else {
1265                         DEBUG(4,("%20s %8x %25s %15s\n",
1266                                 s->name, s->type, s->comment, s->domain));
1267                 }
1268         }
1269
1270         TALLOC_FREE(lines);
1271         return count;
1272 }
1273
1274 /*******************************************************************
1275  Fill in a server info structure.
1276 ******************************************************************/
1277
1278 static int fill_srv_info(struct srv_info_struct *service,
1279                          int uLevel, char **buf, int *buflen,
1280                          char **stringbuf, int *stringspace, char *baseaddr)
1281 {
1282         int struct_len;
1283         char* p;
1284         char* p2;
1285         int l2;
1286         int len;
1287
1288         switch (uLevel) {
1289                 case 0:
1290                         struct_len = 16;
1291                         break;
1292                 case 1:
1293                         struct_len = 26;
1294                         break;
1295                 default:
1296                         return -1;
1297         }
1298
1299         if (!buf) {
1300                 len = 0;
1301                 switch (uLevel) {
1302                         case 1:
1303                                 len = strlen(service->comment)+1;
1304                                 break;
1305                 }
1306
1307                 *buflen = struct_len;
1308                 *stringspace = len;
1309                 return struct_len + len;
1310         }
1311
1312         len = struct_len;
1313         p = *buf;
1314         if (*buflen < struct_len) {
1315                 return -1;
1316         }
1317         if (stringbuf) {
1318                 p2 = *stringbuf;
1319                 l2 = *stringspace;
1320         } else {
1321                 p2 = p + struct_len;
1322                 l2 = *buflen - struct_len;
1323         }
1324         if (!baseaddr) {
1325                 baseaddr = p;
1326         }
1327
1328         switch (uLevel) {
1329                 case 0:
1330                         push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1331                         break;
1332
1333                 case 1:
1334                         push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1335                         SIVAL(p,18,service->type);
1336                         SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1337                         len += CopyAndAdvance(&p2,service->comment,&l2);
1338                         break;
1339         }
1340
1341         if (stringbuf) {
1342                 *buf = p + struct_len;
1343                 *buflen -= struct_len;
1344                 *stringbuf = p2;
1345                 *stringspace = l2;
1346         } else {
1347                 *buf = p2;
1348                 *buflen -= len;
1349         }
1350         return len;
1351 }
1352
1353
1354 static bool srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1355 {
1356         return(strcmp(s1->name,s2->name));
1357 }
1358
1359 /****************************************************************************
1360  View list of servers available (or possibly domains). The info is
1361  extracted from lists saved by nmbd on the local host.
1362 ****************************************************************************/
1363
1364 static bool api_RNetServerEnum(connection_struct *conn, uint16 vuid,
1365                                 char *param, int tpscnt,
1366                                 char *data, int tdscnt,
1367                                 int mdrcnt, int mprcnt, char **rdata,
1368                                 char **rparam, int *rdata_len, int *rparam_len)
1369 {
1370         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1371         char *str2 = skip_string(param,tpscnt,str1);
1372         char *p = skip_string(param,tpscnt,str2);
1373         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1374         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1375         uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1376         char *p2;
1377         int data_len, fixed_len, string_len;
1378         int f_len = 0, s_len = 0;
1379         struct srv_info_struct *servers=NULL;
1380         int counted=0,total=0;
1381         int i,missed;
1382         fstring domain;
1383         bool domain_request;
1384         bool local_request;
1385
1386         if (!str1 || !str2 || !p) {
1387                 return False;
1388         }
1389
1390         /* If someone sets all the bits they don't really mean to set
1391            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1392            known servers. */
1393
1394         if (servertype == SV_TYPE_ALL) {
1395                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1396         }
1397
1398         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1399            any other bit (they may just set this bit on its own) they
1400            want all the locally seen servers. However this bit can be
1401            set on its own so set the requested servers to be
1402            ALL - DOMAIN_ENUM. */
1403
1404         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1405                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1406         }
1407
1408         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1409         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1410
1411         p += 8;
1412
1413         if (!prefix_ok(str1,"WrLehD")) {
1414                 return False;
1415         }
1416         if (!check_server_info(uLevel,str2)) {
1417                 return False;
1418         }
1419
1420         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1421         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1422         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1423
1424         if (strcmp(str1, "WrLehDz") == 0) {
1425                 if (skip_string(param,tpscnt,p) == NULL) {
1426                         return False;
1427                 }
1428                 pull_ascii_fstring(domain, p);
1429         } else {
1430                 fstrcpy(domain, lp_workgroup());
1431         }
1432
1433         if (lp_browse_list()) {
1434                 total = get_server_info(servertype,&servers,domain);
1435         }
1436
1437         data_len = fixed_len = string_len = 0;
1438         missed = 0;
1439
1440         if (total > 0) {
1441                 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1442         }
1443
1444         {
1445                 char *lastname=NULL;
1446
1447                 for (i=0;i<total;i++) {
1448                         struct srv_info_struct *s = &servers[i];
1449
1450                         if (lastname && strequal(lastname,s->name)) {
1451                                 continue;
1452                         }
1453                         lastname = s->name;
1454                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1455                         DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1456                                 s->name, s->type, s->comment, s->domain));
1457
1458                         if (data_len <= buf_len) {
1459                                 counted++;
1460                                 fixed_len += f_len;
1461                                 string_len += s_len;
1462                         } else {
1463                                 missed++;
1464                         }
1465                 }
1466         }
1467
1468         *rdata_len = fixed_len + string_len;
1469         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1470         if (!*rdata) {
1471                 return False;
1472         }
1473
1474         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1475         p = *rdata;
1476         f_len = fixed_len;
1477         s_len = string_len;
1478
1479         {
1480                 char *lastname=NULL;
1481                 int count2 = counted;
1482
1483                 for (i = 0; i < total && count2;i++) {
1484                         struct srv_info_struct *s = &servers[i];
1485
1486                         if (lastname && strequal(lastname,s->name)) {
1487                                 continue;
1488                         }
1489                         lastname = s->name;
1490                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1491                         DEBUG(4,("fill_srv_info %20s %8x %25s %15s\n",
1492                                 s->name, s->type, s->comment, s->domain));
1493                         count2--;
1494                 }
1495         }
1496
1497         *rparam_len = 8;
1498         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1499         if (!*rparam) {
1500                 return False;
1501         }
1502         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1503         SSVAL(*rparam,2,0);
1504         SSVAL(*rparam,4,counted);
1505         SSVAL(*rparam,6,counted+missed);
1506
1507         SAFE_FREE(servers);
1508
1509         DEBUG(3,("NetServerEnum domain = %s uLevel=%d counted=%d total=%d\n",
1510                 domain,uLevel,counted,counted+missed));
1511
1512         return True;
1513 }
1514
1515 /****************************************************************************
1516   command 0x34 - suspected of being a "Lookup Names" stub api
1517   ****************************************************************************/
1518
1519 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1520                                 char *param, int tpscnt,
1521                                 char *data, int tdscnt,
1522                                 int mdrcnt, int mprcnt, char **rdata,
1523                                 char **rparam, int *rdata_len, int *rparam_len)
1524 {
1525         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1526         char *str2 = skip_string(param,tpscnt,str1);
1527         char *p = skip_string(param,tpscnt,str2);
1528         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1529         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1530         int counted=0;
1531         int missed=0;
1532
1533         if (!str1 || !str2 || !p) {
1534                 return False;
1535         }
1536
1537         DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1538                 str1, str2, p, uLevel, buf_len));
1539
1540         if (!prefix_ok(str1,"zWrLeh")) {
1541                 return False;
1542         }
1543
1544         *rdata_len = 0;
1545
1546         *rparam_len = 8;
1547         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1548         if (!*rparam) {
1549                 return False;
1550         }
1551
1552         SSVAL(*rparam,0,0x08AC); /* informational warning message */
1553         SSVAL(*rparam,2,0);
1554         SSVAL(*rparam,4,counted);
1555         SSVAL(*rparam,6,counted+missed);
1556
1557         return True;
1558 }
1559
1560 /****************************************************************************
1561   get info about a share
1562   ****************************************************************************/
1563
1564 static bool check_share_info(int uLevel, char* id)
1565 {
1566         switch( uLevel ) {
1567                 case 0:
1568                         if (strcmp(id,"B13") != 0) {
1569                                 return False;
1570                         }
1571                         break;
1572                 case 1:
1573                         if (strcmp(id,"B13BWz") != 0) {
1574                                 return False;
1575                         }
1576                         break;
1577                 case 2:
1578                         if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1579                                 return False;
1580                         }
1581                         break;
1582                 case 91:
1583                         if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1584                                 return False;
1585                         }
1586                         break;
1587                 default:
1588                         return False;
1589         }
1590         return True;
1591 }
1592
1593 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1594                            char** buf, int* buflen,
1595                            char** stringbuf, int* stringspace, char* baseaddr)
1596 {
1597         int struct_len;
1598         char* p;
1599         char* p2;
1600         int l2;
1601         int len;
1602
1603         switch( uLevel ) {
1604                 case 0:
1605                         struct_len = 13;
1606                         break;
1607                 case 1:
1608                         struct_len = 20;
1609                         break;
1610                 case 2:
1611                         struct_len = 40;
1612                         break;
1613                 case 91:
1614                         struct_len = 68;
1615                         break;
1616                 default:
1617                         return -1;
1618         }
1619
1620
1621         if (!buf) {
1622                 len = 0;
1623
1624                 if (uLevel > 0) {
1625                         len += StrlenExpanded(conn,snum,lp_comment(snum));
1626                 }
1627                 if (uLevel > 1) {
1628                         len += strlen(lp_pathname(snum)) + 1;
1629                 }
1630                 if (buflen) {
1631                         *buflen = struct_len;
1632                 }
1633                 if (stringspace) {
1634                         *stringspace = len;
1635                 }
1636                 return struct_len + len;
1637         }
1638
1639         len = struct_len;
1640         p = *buf;
1641         if ((*buflen) < struct_len) {
1642                 return -1;
1643         }
1644
1645         if (stringbuf) {
1646                 p2 = *stringbuf;
1647                 l2 = *stringspace;
1648         } else {
1649                 p2 = p + struct_len;
1650                 l2 = (*buflen) - struct_len;
1651         }
1652
1653         if (!baseaddr) {
1654                 baseaddr = p;
1655         }
1656
1657         push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1658
1659         if (uLevel > 0) {
1660                 int type;
1661
1662                 SCVAL(p,13,0);
1663                 type = STYPE_DISKTREE;
1664                 if (lp_print_ok(snum)) {
1665                         type = STYPE_PRINTQ;
1666                 }
1667                 if (strequal("IPC",lp_fstype(snum))) {
1668                         type = STYPE_IPC;
1669                 }
1670                 SSVAL(p,14,type);               /* device type */
1671                 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1672                 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1673         }
1674
1675         if (uLevel > 1) {
1676                 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1677                 SSVALS(p,22,-1);                /* max uses */
1678                 SSVAL(p,24,1); /* current uses */
1679                 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1680                 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1681                 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1682         }
1683
1684         if (uLevel > 2) {
1685                 memset(p+40,0,SHPWLEN+2);
1686                 SSVAL(p,50,0);
1687                 SIVAL(p,52,0);
1688                 SSVAL(p,56,0);
1689                 SSVAL(p,58,0);
1690                 SIVAL(p,60,0);
1691                 SSVAL(p,64,0);
1692                 SSVAL(p,66,0);
1693         }
1694
1695         if (stringbuf) {
1696                 (*buf) = p + struct_len;
1697                 (*buflen) -= struct_len;
1698                 (*stringbuf) = p2;
1699                 (*stringspace) = l2;
1700         } else {
1701                 (*buf) = p2;
1702                 (*buflen) -= len;
1703         }
1704
1705         return len;
1706 }
1707
1708 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1709                                 char *param, int tpscnt,
1710                                 char *data, int tdscnt,
1711                                 int mdrcnt,int mprcnt,
1712                                 char **rdata,char **rparam,
1713                                 int *rdata_len,int *rparam_len)
1714 {
1715         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1716         char *str2 = skip_string(param,tpscnt,str1);
1717         char *netname = skip_string(param,tpscnt,str2);
1718         char *p = skip_string(param,tpscnt,netname);
1719         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1720         int snum;
1721
1722         if (!str1 || !str2 || !netname || !p) {
1723                 return False;
1724         }
1725
1726         snum = find_service(netname);
1727         if (snum < 0) {
1728                 return False;
1729         }
1730
1731         /* check it's a supported varient */
1732         if (!prefix_ok(str1,"zWrLh")) {
1733                 return False;
1734         }
1735         if (!check_share_info(uLevel,str2)) {
1736                 return False;
1737         }
1738
1739         *rdata = smb_realloc_limit(*rdata,mdrcnt);
1740         if (!*rdata) {
1741                 return False;
1742         }
1743         p = *rdata;
1744         *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
1745         if (*rdata_len < 0) {
1746                 return False;
1747         }
1748
1749         *rparam_len = 6;
1750         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1751         if (!*rparam) {
1752                 return False;
1753         }
1754         SSVAL(*rparam,0,NERR_Success);
1755         SSVAL(*rparam,2,0);             /* converter word */
1756         SSVAL(*rparam,4,*rdata_len);
1757
1758         return True;
1759 }
1760
1761 /****************************************************************************
1762   View the list of available shares.
1763
1764   This function is the server side of the NetShareEnum() RAP call.
1765   It fills the return buffer with share names and share comments.
1766   Note that the return buffer normally (in all known cases) allows only
1767   twelve byte strings for share names (plus one for a nul terminator).
1768   Share names longer than 12 bytes must be skipped.
1769  ****************************************************************************/
1770
1771 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
1772                                 char *param, int tpscnt,
1773                                 char *data, int tdscnt,
1774                                 int                mdrcnt,
1775                                 int                mprcnt,
1776                                 char             **rdata,
1777                                 char             **rparam,
1778                                 int               *rdata_len,
1779                                 int               *rparam_len )
1780 {
1781         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1782         char *str2 = skip_string(param,tpscnt,str1);
1783         char *p = skip_string(param,tpscnt,str2);
1784         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1785         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1786         char *p2;
1787         int count = 0;
1788         int total=0,counted=0;
1789         bool missed = False;
1790         int i;
1791         int data_len, fixed_len, string_len;
1792         int f_len = 0, s_len = 0;
1793
1794         if (!str1 || !str2 || !p) {
1795                 return False;
1796         }
1797
1798         if (!prefix_ok(str1,"WrLeh")) {
1799                 return False;
1800         }
1801         if (!check_share_info(uLevel,str2)) {
1802                 return False;
1803         }
1804
1805         /* Ensure all the usershares are loaded. */
1806         become_root();
1807         load_registry_shares();
1808         count = load_usershare_shares();
1809         unbecome_root();
1810
1811         data_len = fixed_len = string_len = 0;
1812         for (i=0;i<count;i++) {
1813                 fstring servicename_dos;
1814                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1815                         continue;
1816                 }
1817                 push_ascii_fstring(servicename_dos, lp_servicename(i));
1818                 /* Maximum name length = 13. */
1819                 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
1820                         total++;
1821                         data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
1822                         if (data_len <= buf_len) {
1823                                 counted++;
1824                                 fixed_len += f_len;
1825                                 string_len += s_len;
1826                         } else {
1827                                 missed = True;
1828                         }
1829                 }
1830         }
1831
1832         *rdata_len = fixed_len + string_len;
1833         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1834         if (!*rdata) {
1835                 return False;
1836         }
1837
1838         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
1839         p = *rdata;
1840         f_len = fixed_len;
1841         s_len = string_len;
1842
1843         for( i = 0; i < count; i++ ) {
1844                 fstring servicename_dos;
1845                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
1846                         continue;
1847                 }
1848
1849                 push_ascii_fstring(servicename_dos, lp_servicename(i));
1850                 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
1851                         if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
1852                                 break;
1853                         }
1854                 }
1855         }
1856
1857         *rparam_len = 8;
1858         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1859         if (!*rparam) {
1860                 return False;
1861         }
1862         SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
1863         SSVAL(*rparam,2,0);
1864         SSVAL(*rparam,4,counted);
1865         SSVAL(*rparam,6,total);
1866
1867         DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
1868                 counted,total,uLevel,
1869                 buf_len,*rdata_len,mdrcnt));
1870
1871         return True;
1872 }
1873
1874 /****************************************************************************
1875   Add a share
1876   ****************************************************************************/
1877
1878 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
1879                                 char *param, int tpscnt,
1880                                 char *data, int tdscnt,
1881                                 int mdrcnt,int mprcnt,
1882                                 char **rdata,char **rparam,
1883                                 int *rdata_len,int *rparam_len)
1884 {
1885         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1886         char *str2 = skip_string(param,tpscnt,str1);
1887         char *p = skip_string(param,tpscnt,str2);
1888         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1889         fstring sharename;
1890         fstring comment;
1891         char *pathname = NULL;
1892         char *command, *cmdname;
1893         unsigned int offset;
1894         int snum;
1895         int res = ERRunsup;
1896         size_t converted_size;
1897
1898         if (!str1 || !str2 || !p) {
1899                 return False;
1900         }
1901
1902         /* check it's a supported varient */
1903         if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
1904                 return False;
1905         }
1906         if (!check_share_info(uLevel,str2)) {
1907                 return False;
1908         }
1909         if (uLevel != 2) {
1910                 return False;
1911         }
1912
1913         /* Do we have a string ? */
1914         if (skip_string(data,mdrcnt,data) == NULL) {
1915                 return False;
1916         }
1917         pull_ascii_fstring(sharename,data);
1918         snum = find_service(sharename);
1919         if (snum >= 0) { /* already exists */
1920                 res = ERRfilexists;
1921                 goto error_exit;
1922         }
1923
1924         if (mdrcnt < 28) {
1925                 return False;
1926         }
1927
1928         /* only support disk share adds */
1929         if (SVAL(data,14)!=STYPE_DISKTREE) {
1930                 return False;
1931         }
1932
1933         offset = IVAL(data, 16);
1934         if (offset >= mdrcnt) {
1935                 res = ERRinvalidparam;
1936                 goto error_exit;
1937         }
1938
1939         /* Do we have a string ? */
1940         if (skip_string(data,mdrcnt,data+offset) == NULL) {
1941                 return False;
1942         }
1943         pull_ascii_fstring(comment, offset? (data+offset) : "");
1944
1945         offset = IVAL(data, 26);
1946
1947         if (offset >= mdrcnt) {
1948                 res = ERRinvalidparam;
1949                 goto error_exit;
1950         }
1951
1952         /* Do we have a string ? */
1953         if (skip_string(data,mdrcnt,data+offset) == NULL) {
1954                 return False;
1955         }
1956
1957         if (!pull_ascii_talloc(talloc_tos(), &pathname,
1958                                offset ? (data+offset) : "", &converted_size))
1959         {
1960                 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
1961                          strerror(errno)));
1962         }
1963
1964         if (!pathname) {
1965                 return false;
1966         }
1967
1968         string_replace(sharename, '"', ' ');
1969         string_replace(pathname, '"', ' ');
1970         string_replace(comment, '"', ' ');
1971
1972         cmdname = lp_add_share_cmd();
1973
1974         if (!cmdname || *cmdname == '\0') {
1975                 return False;
1976         }
1977
1978         if (asprintf(&command, "%s \"%s\" \"%s\" \"%s\" \"%s\"",
1979                      lp_add_share_cmd(), get_dyn_CONFIGFILE(), sharename,
1980                      pathname, comment) == -1) {
1981                 return false;
1982         }
1983
1984         DEBUG(10,("api_RNetShareAdd: Running [%s]\n", command ));
1985
1986         if ((res = smbrun(command, NULL)) != 0) {
1987                 DEBUG(1,("api_RNetShareAdd: Running [%s] returned (%d)\n",
1988                          command, res ));
1989                 SAFE_FREE(command);
1990                 res = ERRnoaccess;
1991                 goto error_exit;
1992         } else {
1993                 SAFE_FREE(command);
1994                 message_send_all(smbd_messaging_context(),
1995                                  MSG_SMB_CONF_UPDATED, NULL, 0, NULL);
1996         }
1997
1998         *rparam_len = 6;
1999         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2000         if (!*rparam) {
2001                 return False;
2002         }
2003         SSVAL(*rparam,0,NERR_Success);
2004         SSVAL(*rparam,2,0);             /* converter word */
2005         SSVAL(*rparam,4,*rdata_len);
2006         *rdata_len = 0;
2007
2008         return True;
2009
2010   error_exit:
2011
2012         *rparam_len = 4;
2013         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2014         if (!*rparam) {
2015                 return False;
2016         }
2017         *rdata_len = 0;
2018         SSVAL(*rparam,0,res);
2019         SSVAL(*rparam,2,0);
2020         return True;
2021 }
2022
2023 /****************************************************************************
2024   view list of groups available
2025   ****************************************************************************/
2026
2027 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2028                                 char *param, int tpscnt,
2029                                 char *data, int tdscnt,
2030                                 int mdrcnt,int mprcnt,
2031                                 char **rdata,char **rparam,
2032                                 int *rdata_len,int *rparam_len)
2033 {
2034         int i;
2035         int errflags=0;
2036         int resume_context, cli_buf_size;
2037         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2038         char *str2 = skip_string(param,tpscnt,str1);
2039         char *p = skip_string(param,tpscnt,str2);
2040
2041         struct pdb_search *search;
2042         struct samr_displayentry *entries;
2043
2044         int num_entries;
2045
2046         if (!str1 || !str2 || !p) {
2047                 return False;
2048         }
2049
2050         if (strcmp(str1,"WrLeh") != 0) {
2051                 return False;
2052         }
2053
2054         /* parameters
2055          * W-> resume context (number of users to skip)
2056          * r -> return parameter pointer to receive buffer
2057          * L -> length of receive buffer
2058          * e -> return parameter number of entries
2059          * h -> return parameter total number of users
2060          */
2061
2062         if (strcmp("B21",str2) != 0) {
2063                 return False;
2064         }
2065
2066         /* get list of domain groups SID_DOMAIN_GRP=2 */
2067         become_root();
2068         search = pdb_search_groups();
2069         unbecome_root();
2070
2071         if (search == NULL) {
2072                 DEBUG(3,("api_RNetGroupEnum:failed to get group list"));
2073                 return False;
2074         }
2075
2076         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2077         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2078         DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2079                   "%d\n", resume_context, cli_buf_size));
2080
2081         become_root();
2082         num_entries = pdb_search_entries(search, resume_context, 0xffffffff,
2083                                          &entries);
2084         unbecome_root();
2085
2086         *rdata_len = cli_buf_size;
2087         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2088         if (!*rdata) {
2089                 return False;
2090         }
2091
2092         p = *rdata;
2093
2094         for(i=0; i<num_entries; i++) {
2095                 fstring name;
2096                 fstrcpy(name, entries[i].account_name);
2097                 if( ((PTR_DIFF(p,*rdata)+21) <= *rdata_len) ) {
2098                         /* truncate the name at 21 chars. */
2099                         memcpy(p, name, 21);
2100                         DEBUG(10,("adding entry %d group %s\n", i, p));
2101                         p += 21;
2102                         p += 5; /* Both NT4 and W2k3SP1 do padding here.
2103                                    No idea why... */
2104                 } else {
2105                         /* set overflow error */
2106                         DEBUG(3,("overflow on entry %d group %s\n", i, name));
2107                         errflags=234;
2108                         break;
2109                 }
2110         }
2111
2112         pdb_search_destroy(search);
2113
2114         *rdata_len = PTR_DIFF(p,*rdata);
2115
2116         *rparam_len = 8;
2117         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2118         if (!*rparam) {
2119                 return False;
2120         }
2121         SSVAL(*rparam, 0, errflags);
2122         SSVAL(*rparam, 2, 0);           /* converter word */
2123         SSVAL(*rparam, 4, i);   /* is this right?? */
2124         SSVAL(*rparam, 6, resume_context+num_entries);  /* is this right?? */
2125
2126         return(True);
2127 }
2128
2129 /*******************************************************************
2130  Get groups that a user is a member of.
2131 ******************************************************************/
2132
2133 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2134                                 char *param, int tpscnt,
2135                                 char *data, int tdscnt,
2136                                 int mdrcnt,int mprcnt,
2137                                 char **rdata,char **rparam,
2138                                 int *rdata_len,int *rparam_len)
2139 {
2140         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2141         char *str2 = skip_string(param,tpscnt,str1);
2142         char *UserName = skip_string(param,tpscnt,str2);
2143         char *p = skip_string(param,tpscnt,UserName);
2144         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2145         const char *level_string;
2146         int count=0;
2147         struct samu *sampw = NULL;
2148         bool ret = False;
2149         DOM_SID *sids;
2150         gid_t *gids;
2151         size_t num_groups;
2152         size_t i;
2153         NTSTATUS result;
2154         DOM_SID user_sid;
2155         enum lsa_SidType type;
2156         char *endp = NULL;
2157         TALLOC_CTX *mem_ctx;
2158
2159         if (!str1 || !str2 || !UserName || !p) {
2160                 return False;
2161         }
2162
2163         *rparam_len = 8;
2164         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2165         if (!*rparam) {
2166                 return False;
2167         }
2168
2169         /* check it's a supported varient */
2170
2171         if ( strcmp(str1,"zWrLeh") != 0 )
2172                 return False;
2173
2174         switch( uLevel ) {
2175                 case 0:
2176                         level_string = "B21";
2177                         break;
2178                 default:
2179                         return False;
2180         }
2181
2182         if (strcmp(level_string,str2) != 0)
2183                 return False;
2184
2185         *rdata_len = mdrcnt + 1024;
2186         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2187         if (!*rdata) {
2188                 return False;
2189         }
2190
2191         SSVAL(*rparam,0,NERR_Success);
2192         SSVAL(*rparam,2,0);             /* converter word */
2193
2194         p = *rdata;
2195         endp = *rdata + *rdata_len;
2196
2197         mem_ctx = talloc_new(NULL);
2198         if (mem_ctx == NULL) {
2199                 DEBUG(0, ("talloc_new failed\n"));
2200                 return False;
2201         }
2202
2203         if ( !(sampw = samu_new(mem_ctx)) ) {
2204                 DEBUG(0, ("samu_new() failed!\n"));
2205                 TALLOC_FREE(mem_ctx);
2206                 return False;
2207         }
2208
2209         /* Lookup the user information; This should only be one of
2210            our accounts (not remote domains) */
2211
2212         become_root();                                  /* ROOT BLOCK */
2213
2214         if (!lookup_name(mem_ctx, UserName, LOOKUP_NAME_ALL,
2215                          NULL, NULL, &user_sid, &type)) {
2216                 DEBUG(10, ("lookup_name(%s) failed\n", UserName));
2217                 goto done;
2218         }
2219
2220         if (type != SID_NAME_USER) {
2221                 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2222                            sid_type_lookup(type)));
2223                 goto done;
2224         }
2225
2226         if ( !pdb_getsampwsid(sampw, &user_sid) ) {
2227                 DEBUG(10, ("pdb_getsampwsid(%s) failed for user %s\n",
2228                            sid_string_dbg(&user_sid), UserName));
2229                 goto done;
2230         }
2231
2232         gids = NULL;
2233         sids = NULL;
2234         num_groups = 0;
2235
2236         result = pdb_enum_group_memberships(mem_ctx, sampw,
2237                                             &sids, &gids, &num_groups);
2238
2239         if (!NT_STATUS_IS_OK(result)) {
2240                 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
2241                            UserName));
2242                 goto done;
2243         }
2244
2245         for (i=0; i<num_groups; i++) {
2246                 const char *grp_name;
2247
2248                 if ( lookup_sid(mem_ctx, &sids[i], NULL, &grp_name, NULL) ) {
2249                         strlcpy(p, grp_name, PTR_DIFF(endp,p));
2250                         p += 21;
2251                         count++;
2252                 }
2253         }
2254
2255         *rdata_len = PTR_DIFF(p,*rdata);
2256
2257         SSVAL(*rparam,4,count); /* is this right?? */
2258         SSVAL(*rparam,6,count); /* is this right?? */
2259
2260         ret = True;
2261
2262 done:
2263         unbecome_root();                                /* END ROOT BLOCK */
2264
2265         TALLOC_FREE(mem_ctx);
2266
2267         return ret;
2268 }
2269
2270 /*******************************************************************
2271  Get all users.
2272 ******************************************************************/
2273
2274 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2275                                 char *param, int tpscnt,
2276                                 char *data, int tdscnt,
2277                                 int mdrcnt,int mprcnt,
2278                                 char **rdata,char **rparam,
2279                                 int *rdata_len,int *rparam_len)
2280 {
2281         int count_sent=0;
2282         int num_users=0;
2283         int errflags=0;
2284         int i, resume_context, cli_buf_size;
2285         struct pdb_search *search;
2286         struct samr_displayentry *users;
2287
2288         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2289         char *str2 = skip_string(param,tpscnt,str1);
2290         char *p = skip_string(param,tpscnt,str2);
2291         char *endp = NULL;
2292
2293         if (!str1 || !str2 || !p) {
2294                 return False;
2295         }
2296
2297         if (strcmp(str1,"WrLeh") != 0)
2298                 return False;
2299         /* parameters
2300           * W-> resume context (number of users to skip)
2301           * r -> return parameter pointer to receive buffer
2302           * L -> length of receive buffer
2303           * e -> return parameter number of entries
2304           * h -> return parameter total number of users
2305           */
2306
2307         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2308         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2309         DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2310                         resume_context, cli_buf_size));
2311
2312         *rparam_len = 8;
2313         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2314         if (!*rparam) {
2315                 return False;
2316         }
2317
2318         /* check it's a supported varient */
2319         if (strcmp("B21",str2) != 0)
2320                 return False;
2321
2322         *rdata_len = cli_buf_size;
2323         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2324         if (!*rdata) {
2325                 return False;
2326         }
2327
2328         p = *rdata;
2329         endp = *rdata + *rdata_len;
2330
2331         become_root();
2332         search = pdb_search_users(ACB_NORMAL);
2333         unbecome_root();
2334         if (search == NULL) {
2335                 DEBUG(0, ("api_RNetUserEnum:unable to open sam database.\n"));
2336                 return False;
2337         }
2338
2339         become_root();
2340         num_users = pdb_search_entries(search, resume_context, 0xffffffff,
2341                                        &users);
2342         unbecome_root();
2343
2344         errflags=NERR_Success;
2345
2346         for (i=0; i<num_users; i++) {
2347                 const char *name = users[i].account_name;
2348
2349                 if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)&&(strlen(name)<=21)) {
2350                         strlcpy(p,name,PTR_DIFF(endp,p));
2351                         DEBUG(10,("api_RNetUserEnum:adding entry %d username "
2352                                   "%s\n",count_sent,p));
2353                         p += 21;
2354                         count_sent++;
2355                 } else {
2356                         /* set overflow error */
2357                         DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2358                                   "username %s\n",count_sent,name));
2359                         errflags=234;
2360                         break;
2361                 }
2362         }
2363
2364         pdb_search_destroy(search);
2365
2366         *rdata_len = PTR_DIFF(p,*rdata);
2367
2368         SSVAL(*rparam,0,errflags);
2369         SSVAL(*rparam,2,0);           /* converter word */
2370         SSVAL(*rparam,4,count_sent);  /* is this right?? */
2371         SSVAL(*rparam,6,num_users); /* is this right?? */
2372
2373         return True;
2374 }
2375
2376 /****************************************************************************
2377  Get the time of day info.
2378 ****************************************************************************/
2379
2380 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2381                                 char *param, int tpscnt,
2382                                 char *data, int tdscnt,
2383                                 int mdrcnt,int mprcnt,
2384                                 char **rdata,char **rparam,
2385                                 int *rdata_len,int *rparam_len)
2386 {
2387         struct tm *t;
2388         time_t unixdate = time(NULL);
2389         char *p;
2390
2391         *rparam_len = 4;
2392         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2393         if (!*rparam) {
2394                 return False;
2395         }
2396
2397         *rdata_len = 21;
2398         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2399         if (!*rdata) {
2400                 return False;
2401         }
2402
2403         SSVAL(*rparam,0,NERR_Success);
2404         SSVAL(*rparam,2,0);             /* converter word */
2405
2406         p = *rdata;
2407
2408         srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2409                                             by NT in a "net time" operation,
2410                                             it seems to ignore the one below */
2411
2412         /* the client expects to get localtime, not GMT, in this bit
2413                 (I think, this needs testing) */
2414         t = localtime(&unixdate);
2415         if (!t) {
2416                 return False;
2417         }
2418
2419         SIVAL(p,4,0);           /* msecs ? */
2420         SCVAL(p,8,t->tm_hour);
2421         SCVAL(p,9,t->tm_min);
2422         SCVAL(p,10,t->tm_sec);
2423         SCVAL(p,11,0);          /* hundredths of seconds */
2424         SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2425         SSVAL(p,14,10000);              /* timer interval in 0.0001 of sec */
2426         SCVAL(p,16,t->tm_mday);
2427         SCVAL(p,17,t->tm_mon + 1);
2428         SSVAL(p,18,1900+t->tm_year);
2429         SCVAL(p,20,t->tm_wday);
2430
2431         return True;
2432 }
2433
2434 /****************************************************************************
2435  Set the user password.
2436 *****************************************************************************/
2437
2438 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2439                                 char *param, int tpscnt,
2440                                 char *data, int tdscnt,
2441                                 int mdrcnt,int mprcnt,
2442                                 char **rdata,char **rparam,
2443                                 int *rdata_len,int *rparam_len)
2444 {
2445         char *np = get_safe_str_ptr(param,tpscnt,param,2);
2446         char *p = NULL;
2447         fstring user;
2448         fstring pass1,pass2;
2449
2450         /* Skip 2 strings. */
2451         p = skip_string(param,tpscnt,np);
2452         p = skip_string(param,tpscnt,p);
2453
2454         if (!np || !p) {
2455                 return False;
2456         }
2457
2458         /* Do we have a string ? */
2459         if (skip_string(param,tpscnt,p) == NULL) {
2460                 return False;
2461         }
2462         pull_ascii_fstring(user,p);
2463
2464         p = skip_string(param,tpscnt,p);
2465         if (!p) {
2466                 return False;
2467         }
2468
2469         memset(pass1,'\0',sizeof(pass1));
2470         memset(pass2,'\0',sizeof(pass2));
2471         /*
2472          * We use 31 here not 32 as we're checking
2473          * the last byte we want to access is safe.
2474          */
2475         if (!is_offset_safe(param,tpscnt,p,31)) {
2476                 return False;
2477         }
2478         memcpy(pass1,p,16);
2479         memcpy(pass2,p+16,16);
2480
2481         *rparam_len = 4;
2482         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2483         if (!*rparam) {
2484                 return False;
2485         }
2486
2487         *rdata_len = 0;
2488
2489         SSVAL(*rparam,0,NERR_badpass);
2490         SSVAL(*rparam,2,0);             /* converter word */
2491
2492         DEBUG(3,("Set password for <%s>\n",user));
2493
2494         /*
2495          * Attempt to verify the old password against smbpasswd entries
2496          * Win98 clients send old and new password in plaintext for this call.
2497          */
2498
2499         {
2500                 auth_serversupplied_info *server_info = NULL;
2501                 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2502
2503                 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2504
2505                         become_root();
2506                         if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2507                                 SSVAL(*rparam,0,NERR_Success);
2508                         }
2509                         unbecome_root();
2510
2511                         TALLOC_FREE(server_info);
2512                 }
2513                 data_blob_clear_free(&password);
2514         }
2515
2516         /*
2517          * If the plaintext change failed, attempt
2518          * the old encrypted method. NT will generate this
2519          * after trying the samr method. Note that this
2520          * method is done as a last resort as this
2521          * password change method loses the NT password hash
2522          * and cannot change the UNIX password as no plaintext
2523          * is received.
2524          */
2525
2526         if(SVAL(*rparam,0) != NERR_Success) {
2527                 struct samu *hnd = NULL;
2528
2529                 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2530                         become_root();
2531                         if (change_lanman_password(hnd,(uchar *)pass2)) {
2532                                 SSVAL(*rparam,0,NERR_Success);
2533                         }
2534                         unbecome_root();
2535                         TALLOC_FREE(hnd);
2536                 }
2537         }
2538
2539         memset((char *)pass1,'\0',sizeof(fstring));
2540         memset((char *)pass2,'\0',sizeof(fstring));
2541
2542         return(True);
2543 }
2544
2545 /****************************************************************************
2546   Set the user password (SamOEM version - gets plaintext).
2547 ****************************************************************************/
2548
2549 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2550                                 char *param, int tpscnt,
2551                                 char *data, int tdscnt,
2552                                 int mdrcnt,int mprcnt,
2553                                 char **rdata,char **rparam,
2554                                 int *rdata_len,int *rparam_len)
2555 {
2556         fstring user;
2557         char *p = get_safe_str_ptr(param,tpscnt,param,2);
2558         *rparam_len = 2;
2559         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2560         if (!*rparam) {
2561                 return False;
2562         }
2563
2564         if (!p) {
2565                 return False;
2566         }
2567         *rdata_len = 0;
2568
2569         SSVAL(*rparam,0,NERR_badpass);
2570
2571         /*
2572          * Check the parameter definition is correct.
2573          */
2574
2575         /* Do we have a string ? */
2576         if (skip_string(param,tpscnt,p) == 0) {
2577                 return False;
2578         }
2579         if(!strequal(p, "zsT")) {
2580                 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2581                 return False;
2582         }
2583         p = skip_string(param, tpscnt, p);
2584         if (!p) {
2585                 return False;
2586         }
2587
2588         /* Do we have a string ? */
2589         if (skip_string(param,tpscnt,p) == 0) {
2590                 return False;
2591         }
2592         if(!strequal(p, "B516B16")) {
2593                 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2594                 return False;
2595         }
2596         p = skip_string(param,tpscnt,p);
2597         if (!p) {
2598                 return False;
2599         }
2600         /* Do we have a string ? */
2601         if (skip_string(param,tpscnt,p) == 0) {
2602                 return False;
2603         }
2604         p += pull_ascii_fstring(user,p);
2605
2606         DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
2607
2608         /*
2609          * Pass the user through the NT -> unix user mapping
2610          * function.
2611          */
2612
2613         (void)map_username(user);
2614
2615         if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL, NULL))) {
2616                 SSVAL(*rparam,0,NERR_Success);
2617         }
2618
2619         return(True);
2620 }
2621
2622 /****************************************************************************
2623   delete a print job
2624   Form: <W> <>
2625   ****************************************************************************/
2626
2627 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
2628                                 char *param, int tpscnt,
2629                                 char *data, int tdscnt,
2630                                 int mdrcnt,int mprcnt,
2631                                 char **rdata,char **rparam,
2632                                 int *rdata_len,int *rparam_len)
2633 {
2634         int function = get_safe_SVAL(param,tpscnt,param,0,0);
2635         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2636         char *str2 = skip_string(param,tpscnt,str1);
2637         char *p = skip_string(param,tpscnt,str2);
2638         uint32 jobid;
2639         int snum;
2640         fstring sharename;
2641         int errcode;
2642         WERROR werr = WERR_OK;
2643
2644         if (!str1 || !str2 || !p) {
2645                 return False;
2646         }
2647         /*
2648          * We use 1 here not 2 as we're checking
2649          * the last byte we want to access is safe.
2650          */
2651         if (!is_offset_safe(param,tpscnt,p,1)) {
2652                 return False;
2653         }
2654         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2655                 return False;
2656
2657         /* check it's a supported varient */
2658         if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
2659                 return(False);
2660
2661         *rparam_len = 4;
2662         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2663         if (!*rparam) {
2664                 return False;
2665         }
2666         *rdata_len = 0;
2667
2668         if (!print_job_exists(sharename, jobid)) {
2669                 errcode = NERR_JobNotFound;
2670                 goto out;
2671         }
2672
2673         snum = lp_servicenumber( sharename);
2674         if (snum == -1) {
2675                 errcode = NERR_DestNotFound;
2676                 goto out;
2677         }
2678
2679         errcode = NERR_notsupported;
2680
2681         switch (function) {
2682         case 81:                /* delete */
2683                 if (print_job_delete(conn->server_info, snum, jobid, &werr))
2684                         errcode = NERR_Success;
2685                 break;
2686         case 82:                /* pause */
2687                 if (print_job_pause(conn->server_info, snum, jobid, &werr))
2688                         errcode = NERR_Success;
2689                 break;
2690         case 83:                /* resume */
2691                 if (print_job_resume(conn->server_info, snum, jobid, &werr))
2692                         errcode = NERR_Success;
2693                 break;
2694         }
2695
2696         if (!W_ERROR_IS_OK(werr))
2697                 errcode = W_ERROR_V(werr);
2698
2699  out:
2700         SSVAL(*rparam,0,errcode);
2701         SSVAL(*rparam,2,0);             /* converter word */
2702
2703         return(True);
2704 }
2705
2706 /****************************************************************************
2707   Purge a print queue - or pause or resume it.
2708   ****************************************************************************/
2709
2710 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
2711                                 char *param, int tpscnt,
2712                                 char *data, int tdscnt,
2713                                 int mdrcnt,int mprcnt,
2714                                 char **rdata,char **rparam,
2715                                 int *rdata_len,int *rparam_len)
2716 {
2717         int function = get_safe_SVAL(param,tpscnt,param,0,0);
2718         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2719         char *str2 = skip_string(param,tpscnt,str1);
2720         char *QueueName = skip_string(param,tpscnt,str2);
2721         int errcode = NERR_notsupported;
2722         int snum;
2723         WERROR werr = WERR_OK;
2724
2725         if (!str1 || !str2 || !QueueName) {
2726                 return False;
2727         }
2728
2729         /* check it's a supported varient */
2730         if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
2731                 return(False);
2732
2733         *rparam_len = 4;
2734         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2735         if (!*rparam) {
2736                 return False;
2737         }
2738         *rdata_len = 0;
2739
2740         if (skip_string(param,tpscnt,QueueName) == NULL) {
2741                 return False;
2742         }
2743         snum = print_queue_snum(QueueName);
2744
2745         if (snum == -1) {
2746                 errcode = NERR_JobNotFound;
2747                 goto out;
2748         }
2749
2750         switch (function) {
2751         case 74: /* Pause queue */
2752                 if (print_queue_pause(conn->server_info, snum, &werr)) {
2753                         errcode = NERR_Success;
2754                 }
2755                 break;
2756         case 75: /* Resume queue */
2757                 if (print_queue_resume(conn->server_info, snum, &werr)) {
2758                         errcode = NERR_Success;
2759                 }
2760                 break;
2761         case 103: /* Purge */
2762                 if (print_queue_purge(conn->server_info, snum, &werr)) {
2763                         errcode = NERR_Success;
2764                 }
2765                 break;
2766         }
2767
2768         if (!W_ERROR_IS_OK(werr)) errcode = W_ERROR_V(werr);
2769
2770  out:
2771         SSVAL(*rparam,0,errcode);
2772         SSVAL(*rparam,2,0);             /* converter word */
2773
2774         return(True);
2775 }
2776
2777 /****************************************************************************
2778   set the property of a print job (undocumented?)
2779   ? function = 0xb -> set name of print job
2780   ? function = 0x6 -> move print job up/down
2781   Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
2782   or   <WWsTP> <WB21BB16B10zWWzDDz>
2783 ****************************************************************************/
2784
2785 static int check_printjob_info(struct pack_desc* desc,
2786                                int uLevel, char* id)
2787 {
2788         desc->subformat = NULL;
2789         switch( uLevel ) {
2790         case 0: desc->format = "W"; break;
2791         case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
2792         case 2: desc->format = "WWzWWDDzz"; break;
2793         case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
2794         case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
2795         default:
2796                 DEBUG(0,("check_printjob_info: invalid level %d\n",
2797                         uLevel ));
2798                 return False;
2799         }
2800         if (id == NULL || strcmp(desc->format,id) != 0) {
2801                 DEBUG(0,("check_printjob_info: invalid format %s\n",
2802                         id ? id : "<NULL>" ));
2803                 return False;
2804         }
2805         return True;
2806 }
2807
2808 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
2809                                 char *param, int tpscnt,
2810                                 char *data, int tdscnt,
2811                                 int mdrcnt,int mprcnt,
2812                                 char **rdata,char **rparam,
2813                                 int *rdata_len,int *rparam_len)
2814 {
2815         struct pack_desc desc;
2816         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2817         char *str2 = skip_string(param,tpscnt,str1);
2818         char *p = skip_string(param,tpscnt,str2);
2819         uint32 jobid;
2820         fstring sharename;
2821         int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
2822         int function = get_safe_SVAL(param,tpscnt,p,4,-1);
2823         int place, errcode;
2824
2825         if (!str1 || !str2 || !p) {
2826                 return False;
2827         }
2828         /*
2829          * We use 1 here not 2 as we're checking
2830          * the last byte we want to access is safe.
2831          */
2832         if (!is_offset_safe(param,tpscnt,p,1)) {
2833                 return False;
2834         }
2835         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2836                 return False;
2837         *rparam_len = 4;
2838         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2839         if (!*rparam) {
2840                 return False;
2841         }
2842
2843         if (!share_defined(sharename)) {
2844                 DEBUG(0,("api_PrintJobInfo: sharen [%s] not defined\n",
2845                          sharename));
2846                 return False;
2847         }
2848
2849         *rdata_len = 0;
2850
2851         /* check it's a supported varient */
2852         if ((strcmp(str1,"WWsTP")) ||
2853             (!check_printjob_info(&desc,uLevel,str2)))
2854                 return(False);
2855
2856         if (!print_job_exists(sharename, jobid)) {
2857                 errcode=NERR_JobNotFound;
2858                 goto out;
2859         }
2860
2861         errcode = NERR_notsupported;
2862
2863         switch (function) {
2864         case 0x6:
2865                 /* change job place in the queue,
2866                    data gives the new place */
2867                 place = SVAL(data,0);
2868                 if (print_job_set_place(sharename, jobid, place)) {
2869                         errcode=NERR_Success;
2870                 }
2871                 break;
2872
2873         case 0xb:
2874                 /* change print job name, data gives the name */
2875                 if (print_job_set_name(sharename, jobid, data)) {
2876                         errcode=NERR_Success;
2877                 }
2878                 break;
2879
2880         default:
2881                 return False;
2882         }
2883
2884  out:
2885         SSVALS(*rparam,0,errcode);
2886         SSVAL(*rparam,2,0);             /* converter word */
2887
2888         return(True);
2889 }
2890
2891
2892 /****************************************************************************
2893  Get info about the server.
2894 ****************************************************************************/
2895
2896 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
2897                                 char *param, int tpscnt,
2898                                 char *data, int tdscnt,
2899                                 int mdrcnt,int mprcnt,
2900                                 char **rdata,char **rparam,
2901                                 int *rdata_len,int *rparam_len)
2902 {
2903         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2904         char *str2 = skip_string(param,tpscnt,str1);
2905         char *p = skip_string(param,tpscnt,str2);
2906         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2907         char *p2;
2908         int struct_len;
2909
2910         if (!str1 || !str2 || !p) {
2911                 return False;
2912         }
2913
2914         DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
2915
2916         /* check it's a supported varient */
2917         if (!prefix_ok(str1,"WrLh")) {
2918                 return False;
2919         }
2920
2921         switch( uLevel ) {
2922                 case 0:
2923                         if (strcmp(str2,"B16") != 0) {
2924                                 return False;
2925                         }
2926                         struct_len = 16;
2927                         break;
2928                 case 1:
2929                         if (strcmp(str2,"B16BBDz") != 0) {
2930                                 return False;
2931                         }
2932                         struct_len = 26;
2933                         break;
2934                 case 2:
2935                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
2936                                 return False;
2937                         }
2938                         struct_len = 134;
2939                         break;
2940                 case 3:
2941                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
2942                                 return False;
2943                         }
2944                         struct_len = 144;
2945                         break;
2946                 case 20:
2947                         if (strcmp(str2,"DN") != 0) {
2948                                 return False;
2949                         }
2950                         struct_len = 6;
2951                         break;
2952                 case 50:
2953                         if (strcmp(str2,"B16BBDzWWzzz") != 0) {
2954                                 return False;
2955                         }
2956                         struct_len = 42;
2957                         break;
2958                 default:
2959                         return False;
2960         }
2961
2962         *rdata_len = mdrcnt;
2963         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2964         if (!*rdata) {
2965                 return False;
2966         }
2967
2968         p = *rdata;
2969         p2 = p + struct_len;
2970         if (uLevel != 20) {
2971                 srvstr_push(NULL, 0, p,global_myname(),16,
2972                         STR_ASCII|STR_UPPER|STR_TERMINATE);
2973         }
2974         p += 16;
2975         if (uLevel > 0) {
2976                 struct srv_info_struct *servers=NULL;
2977                 int i,count;
2978                 char *comment = NULL;
2979                 TALLOC_CTX *ctx = talloc_tos();
2980                 uint32 servertype= lp_default_server_announce();
2981
2982                 comment = talloc_strdup(ctx,lp_serverstring());
2983                 if (!comment) {
2984                         return false;
2985                 }
2986
2987                 if ((count=get_server_info(SV_TYPE_ALL,&servers,lp_workgroup()))>0) {
2988                         for (i=0;i<count;i++) {
2989                                 if (strequal(servers[i].name,global_myname())) {
2990                                         servertype = servers[i].type;
2991                                         TALLOC_FREE(comment);
2992                                         comment = talloc_strdup(ctx,
2993                                                         servers[i].comment);
2994                                         if (comment) {
2995                                                 return false;
2996                                         }
2997                                 }
2998                         }
2999                 }
3000
3001                 SAFE_FREE(servers);
3002
3003                 SCVAL(p,0,lp_major_announce_version());
3004                 SCVAL(p,1,lp_minor_announce_version());
3005                 SIVAL(p,2,servertype);
3006
3007                 if (mdrcnt == struct_len) {
3008                         SIVAL(p,6,0);
3009                 } else {
3010                         SIVAL(p,6,PTR_DIFF(p2,*rdata));
3011                         comment = talloc_sub_advanced(
3012                                 ctx,
3013                                 lp_servicename(SNUM(conn)),
3014                                 conn->server_info->unix_name,
3015                                 conn->connectpath,
3016                                 conn->server_info->utok.gid,
3017                                 conn->server_info->sanitized_username,
3018                                 pdb_get_domain(conn->server_info->sam_account),
3019                                 comment);
3020                         if (comment) {
3021                                 return false;
3022                         }
3023                         if (mdrcnt - struct_len <= 0) {
3024                                 return false;
3025                         }
3026                         push_ascii(p2,
3027                                 comment,
3028                                 MIN(mdrcnt - struct_len,
3029                                         MAX_SERVER_STRING_LENGTH),
3030                                 STR_TERMINATE);
3031                         p2 = skip_string(*rdata,*rdata_len,p2);
3032                         if (!p2) {
3033                                 return False;
3034                         }
3035                 }
3036         }
3037
3038         if (uLevel > 1) {
3039                 return False;           /* not yet implemented */
3040         }
3041
3042         *rdata_len = PTR_DIFF(p2,*rdata);
3043
3044         *rparam_len = 6;
3045         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3046         if (!*rparam) {
3047                 return False;
3048         }
3049         SSVAL(*rparam,0,NERR_Success);
3050         SSVAL(*rparam,2,0);             /* converter word */
3051         SSVAL(*rparam,4,*rdata_len);
3052
3053         return True;
3054 }
3055
3056 /****************************************************************************
3057  Get info about the server.
3058 ****************************************************************************/
3059
3060 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3061                                 char *param, int tpscnt,
3062                                 char *data, int tdscnt,
3063                                 int mdrcnt,int mprcnt,
3064                                 char **rdata,char **rparam,
3065                                 int *rdata_len,int *rparam_len)
3066 {
3067         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3068         char *str2 = skip_string(param,tpscnt,str1);
3069         char *p = skip_string(param,tpscnt,str2);
3070         char *p2;
3071         char *endp;
3072         int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3073
3074         if (!str1 || !str2 || !p) {
3075                 return False;
3076         }
3077
3078         DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3079
3080         *rparam_len = 6;
3081         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3082         if (!*rparam) {
3083                 return False;
3084         }
3085
3086         /* check it's a supported varient */
3087         if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3088                 return False;
3089         }
3090
3091         *rdata_len = mdrcnt + 1024;
3092         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3093         if (!*rdata) {
3094                 return False;
3095         }
3096
3097         SSVAL(*rparam,0,NERR_Success);
3098         SSVAL(*rparam,2,0);             /* converter word */
3099
3100         p = *rdata;
3101         endp = *rdata + *rdata_len;
3102
3103         p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3104         if (!p2) {
3105                 return False;
3106         }
3107
3108         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3109         strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3110         strupper_m(p2);
3111         p2 = skip_string(*rdata,*rdata_len,p2);
3112         if (!p2) {
3113                 return False;
3114         }
3115         p += 4;
3116
3117         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3118         strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3119         p2 = skip_string(*rdata,*rdata_len,p2);
3120         if (!p2) {
3121                 return False;
3122         }
3123         p += 4;
3124
3125         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3126         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3127         strupper_m(p2);
3128         p2 = skip_string(*rdata,*rdata_len,p2);
3129         if (!p2) {
3130                 return False;
3131         }
3132         p += 4;
3133
3134         SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3135         SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3136         p += 2;
3137
3138         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3139         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));   /* don't know.  login domain?? */
3140         p2 = skip_string(*rdata,*rdata_len,p2);
3141         if (!p2) {
3142                 return False;
3143         }
3144         p += 4;
3145
3146         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3147         strlcpy(p2,"",PTR_DIFF(endp,p2));
3148         p2 = skip_string(*rdata,*rdata_len,p2);
3149         if (!p2) {
3150                 return False;
3151         }
3152         p += 4;
3153
3154         *rdata_len = PTR_DIFF(p2,*rdata);
3155
3156         SSVAL(*rparam,4,*rdata_len);
3157
3158         return True;
3159 }
3160
3161 /****************************************************************************
3162   get info about a user
3163
3164     struct user_info_11 {
3165         char                usri11_name[21];  0-20
3166         char                usri11_pad;       21
3167         char                *usri11_comment;  22-25
3168         char            *usri11_usr_comment;  26-29
3169         unsigned short      usri11_priv;      30-31
3170         unsigned long       usri11_auth_flags; 32-35
3171         long                usri11_password_age; 36-39
3172         char                *usri11_homedir; 40-43
3173         char            *usri11_parms; 44-47
3174         long                usri11_last_logon; 48-51
3175         long                usri11_last_logoff; 52-55
3176         unsigned short      usri11_bad_pw_count; 56-57
3177         unsigned short      usri11_num_logons; 58-59
3178         char                *usri11_logon_server; 60-63
3179         unsigned short      usri11_country_code; 64-65
3180         char            *usri11_workstations; 66-69
3181         unsigned long       usri11_max_storage; 70-73
3182         unsigned short      usri11_units_per_week; 74-75
3183         unsigned char       *usri11_logon_hours; 76-79
3184         unsigned short      usri11_code_page; 80-81
3185     };
3186
3187 where:
3188
3189   usri11_name specifies the user name for which information is retrieved
3190
3191   usri11_pad aligns the next data structure element to a word boundary
3192
3193   usri11_comment is a null terminated ASCII comment
3194
3195   usri11_user_comment is a null terminated ASCII comment about the user
3196
3197   usri11_priv specifies the level of the privilege assigned to the user.
3198        The possible values are:
3199
3200 Name             Value  Description
3201 USER_PRIV_GUEST  0      Guest privilege
3202 USER_PRIV_USER   1      User privilege
3203 USER_PRV_ADMIN   2      Administrator privilege
3204
3205   usri11_auth_flags specifies the account operator privileges. The
3206        possible values are:
3207
3208 Name            Value   Description
3209 AF_OP_PRINT     0       Print operator
3210
3211
3212 Leach, Naik                                        [Page 28]
3213 \f
3214
3215
3216 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3217
3218
3219 AF_OP_COMM      1       Communications operator
3220 AF_OP_SERVER    2       Server operator
3221 AF_OP_ACCOUNTS  3       Accounts operator
3222
3223
3224   usri11_password_age specifies how many seconds have elapsed since the
3225        password was last changed.
3226
3227   usri11_home_dir points to a null terminated ASCII string that contains
3228        the path name of the user's home directory.
3229
3230   usri11_parms points to a null terminated ASCII string that is set
3231        aside for use by applications.
3232
3233   usri11_last_logon specifies the time when the user last logged on.
3234        This value is stored as the number of seconds elapsed since
3235        00:00:00, January 1, 1970.
3236
3237   usri11_last_logoff specifies the time when the user last logged off.
3238        This value is stored as the number of seconds elapsed since
3239        00:00:00, January 1, 1970. A value of 0 means the last logoff
3240        time is unknown.
3241
3242   usri11_bad_pw_count specifies the number of incorrect passwords
3243        entered since the last successful logon.
3244
3245   usri11_log1_num_logons specifies the number of times this user has
3246        logged on. A value of -1 means the number of logons is unknown.
3247
3248   usri11_logon_server points to a null terminated ASCII string that
3249        contains the name of the server to which logon requests are sent.
3250        A null string indicates logon requests should be sent to the
3251        domain controller.
3252
3253   usri11_country_code specifies the country code for the user's language
3254        of choice.
3255
3256   usri11_workstations points to a null terminated ASCII string that
3257        contains the names of workstations the user may log on from.
3258        There may be up to 8 workstations, with the names separated by
3259        commas. A null strings indicates there are no restrictions.
3260
3261   usri11_max_storage specifies the maximum amount of disk space the user
3262        can occupy. A value of 0xffffffff indicates there are no
3263        restrictions.
3264
3265   usri11_units_per_week specifies the equal number of time units into
3266        which a week is divided. This value must be equal to 168.
3267
3268   usri11_logon_hours points to a 21 byte (168 bits) string that
3269        specifies the time during which the user can log on. Each bit
3270        represents one unique hour in a week. The first bit (bit 0, word
3271        0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3272
3273
3274
3275 Leach, Naik                                        [Page 29]
3276 \f
3277
3278
3279 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3280
3281
3282        Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3283        are no restrictions.
3284
3285   usri11_code_page specifies the code page for the user's language of
3286        choice
3287
3288 All of the pointers in this data structure need to be treated
3289 specially. The  pointer is a 32 bit pointer. The higher 16 bits need
3290 to be ignored. The converter word returned in the parameters section
3291 needs to be subtracted from the lower 16 bits to calculate an offset
3292 into the return buffer where this ASCII string resides.
3293
3294 There is no auxiliary data in the response.
3295
3296   ****************************************************************************/
3297
3298 #define usri11_name           0
3299 #define usri11_pad            21
3300 #define usri11_comment        22
3301 #define usri11_usr_comment    26
3302 #define usri11_full_name      30
3303 #define usri11_priv           34
3304 #define usri11_auth_flags     36
3305 #define usri11_password_age   40
3306 #define usri11_homedir        44
3307 #define usri11_parms          48
3308 #define usri11_last_logon     52
3309 #define usri11_last_logoff    56
3310 #define usri11_bad_pw_count   60
3311 #define usri11_num_logons     62
3312 #define usri11_logon_server   64
3313 #define usri11_country_code   68
3314 #define usri11_workstations   70
3315 #define usri11_max_storage    74
3316 #define usri11_units_per_week 78
3317 #define usri11_logon_hours    80
3318 #define usri11_code_page      84
3319 #define usri11_end            86
3320
3321 #define USER_PRIV_GUEST 0
3322 #define USER_PRIV_USER 1
3323 #define USER_PRIV_ADMIN 2
3324
3325 #define AF_OP_PRINT     0
3326 #define AF_OP_COMM      1
3327 #define AF_OP_SERVER    2
3328 #define AF_OP_ACCOUNTS  3
3329
3330
3331 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3332                                 char *param, int tpscnt,
3333                                 char *data, int tdscnt,
3334                                 int mdrcnt,int mprcnt,
3335                                 char **rdata,char **rparam,
3336                                 int *rdata_len,int *rparam_len)
3337 {
3338         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3339         char *str2 = skip_string(param,tpscnt,str1);
3340         char *UserName = skip_string(param,tpscnt,str2);
3341         char *p = skip_string(param,tpscnt,UserName);
3342         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3343         char *p2;
3344         char *endp;
3345         const char *level_string;
3346
3347         /* get NIS home of a previously validated user - simeon */
3348         /* With share level security vuid will always be zero.
3349            Don't depend on vuser being non-null !!. JRA */
3350         user_struct *vuser = get_valid_user_struct(vuid);
3351         if(vuser != NULL) {
3352                 DEBUG(3,("  Username of UID %d is %s\n",
3353                          (int)vuser->server_info->utok.uid,
3354                          vuser->server_info->unix_name));
3355         }
3356
3357         if (!str1 || !str2 || !UserName || !p) {
3358                 return False;
3359         }
3360
3361         *rparam_len = 6;
3362         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3363         if (!*rparam) {
3364                 return False;
3365         }
3366
3367         DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3368
3369         /* check it's a supported variant */
3370         if (strcmp(str1,"zWrLh") != 0) {
3371                 return False;
3372         }
3373         switch( uLevel ) {
3374                 case 0: level_string = "B21"; break;
3375                 case 1: level_string = "B21BB16DWzzWz"; break;
3376                 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3377                 case 10: level_string = "B21Bzzz"; break;
3378                 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3379                 default: return False;
3380         }
3381
3382         if (strcmp(level_string,str2) != 0) {
3383                 return False;
3384         }
3385
3386         *rdata_len = mdrcnt + 1024;
3387         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3388         if (!*rdata) {
3389                 return False;
3390         }
3391
3392         SSVAL(*rparam,0,NERR_Success);
3393         SSVAL(*rparam,2,0);             /* converter word */
3394
3395         p = *rdata;
3396         endp = *rdata + *rdata_len;
3397         p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3398         if (!p2) {
3399                 return False;
3400         }
3401
3402         memset(p,0,21);
3403         fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
3404
3405         if (uLevel > 0) {
3406                 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
3407                 *p2 = 0;
3408         }
3409
3410         if (uLevel >= 10) {
3411                 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
3412                 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
3413                 p2 = skip_string(*rdata,*rdata_len,p2);
3414                 if (!p2) {
3415                         return False;
3416                 }
3417
3418                 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
3419                 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
3420                 p2 = skip_string(*rdata,*rdata_len,p2);
3421                 if (!p2) {
3422                         return False;
3423                 }
3424
3425                 /* EEK! the cifsrap.txt doesn't have this in!!!! */
3426                 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
3427                 strlcpy(p2,((vuser != NULL)
3428                             ? pdb_get_fullname(vuser->server_info->sam_account)
3429                             : UserName),PTR_DIFF(endp,p2));
3430                 p2 = skip_string(*rdata,*rdata_len,p2);
3431                 if (!p2) {
3432                         return False;
3433                 }
3434         }
3435
3436         if (uLevel == 11) {
3437                 const char *homedir = "";
3438                 if (vuser != NULL) {
3439                         homedir = pdb_get_homedir(
3440                                 vuser->server_info->sam_account);
3441                 }
3442                 /* modelled after NTAS 3.51 reply */
3443                 SSVAL(p,usri11_priv,conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3444                 SIVAL(p,usri11_auth_flags,AF_OP_PRINT);         /* auth flags */
3445                 SIVALS(p,usri11_password_age,-1);               /* password age */
3446                 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
3447                 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
3448                 p2 = skip_string(*rdata,*rdata_len,p2);
3449                 if (!p2) {
3450                         return False;
3451                 }
3452                 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
3453                 strlcpy(p2,"",PTR_DIFF(endp,p2));
3454                 p2 = skip_string(*rdata,*rdata_len,p2);
3455                 if (!p2) {
3456                         return False;
3457                 }
3458                 SIVAL(p,usri11_last_logon,0);           /* last logon */
3459                 SIVAL(p,usri11_last_logoff,0);          /* last logoff */
3460                 SSVALS(p,usri11_bad_pw_count,-1);       /* bad pw counts */
3461                 SSVALS(p,usri11_num_logons,-1);         /* num logons */
3462                 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
3463                 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
3464                 p2 = skip_string(*rdata,*rdata_len,p2);
3465                 if (!p2) {
3466                         return False;
3467                 }
3468                 SSVAL(p,usri11_country_code,0);         /* country code */
3469
3470                 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
3471                 strlcpy(p2,"",PTR_DIFF(endp,p2));
3472                 p2 = skip_string(*rdata,*rdata_len,p2);
3473                 if (!p2) {
3474                         return False;
3475                 }
3476
3477                 SIVALS(p,usri11_max_storage,-1);                /* max storage */
3478                 SSVAL(p,usri11_units_per_week,168);             /* units per week */
3479                 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
3480
3481                 /* a simple way to get logon hours at all times. */
3482                 memset(p2,0xff,21);
3483                 SCVAL(p2,21,0);           /* fix zero termination */
3484                 p2 = skip_string(*rdata,*rdata_len,p2);
3485                 if (!p2) {
3486                         return False;
3487                 }
3488
3489                 SSVAL(p,usri11_code_page,0);            /* code page */
3490         }
3491
3492         if (uLevel == 1 || uLevel == 2) {
3493                 memset(p+22,' ',16);    /* password */
3494                 SIVALS(p,38,-1);                /* password age */
3495                 SSVAL(p,42,
3496                 conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3497                 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
3498                 strlcpy(p2, vuser ? pdb_get_homedir(
3499                                 vuser->server_info->sam_account) : "",
3500                         PTR_DIFF(endp,p2));
3501                 p2 = skip_string(*rdata,*rdata_len,p2);
3502                 if (!p2) {
3503                         return False;
3504                 }
3505                 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
3506                 *p2++ = 0;
3507                 SSVAL(p,52,0);          /* flags */
3508                 SIVAL(p,54,PTR_DIFF(p2,*rdata));                /* script_path */
3509                 strlcpy(p2, vuser ? pdb_get_logon_script(
3510                                 vuser->server_info->sam_account) : "",
3511                         PTR_DIFF(endp,p2));
3512                 p2 = skip_string(*rdata,*rdata_len,p2);
3513                 if (!p2) {
3514                         return False;
3515                 }
3516                 if (uLevel == 2) {
3517                         SIVAL(p,60,0);          /* auth_flags */
3518                         SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
3519                         strlcpy(p2,((vuser != NULL)
3520                                     ? pdb_get_fullname(vuser->server_info->sam_account)
3521                                     : UserName),PTR_DIFF(endp,p2));
3522                         p2 = skip_string(*rdata,*rdata_len,p2);
3523                         if (!p2) {
3524                                 return False;
3525                         }
3526                         SIVAL(p,68,0);          /* urs_comment */
3527                         SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
3528                         strlcpy(p2,"",PTR_DIFF(endp,p2));
3529                         p2 = skip_string(*rdata,*rdata_len,p2);
3530                         if (!p2) {
3531                                 return False;
3532                         }
3533                         SIVAL(p,76,0);          /* workstations */
3534                         SIVAL(p,80,0);          /* last_logon */
3535                         SIVAL(p,84,0);          /* last_logoff */
3536                         SIVALS(p,88,-1);                /* acct_expires */
3537                         SIVALS(p,92,-1);                /* max_storage */
3538                         SSVAL(p,96,168);        /* units_per_week */
3539                         SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
3540                         memset(p2,-1,21);
3541                         p2 += 21;
3542                         SSVALS(p,102,-1);       /* bad_pw_count */
3543                         SSVALS(p,104,-1);       /* num_logons */
3544                         SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
3545                         {
3546                                 TALLOC_CTX *ctx = talloc_tos();
3547                                 int space_rem = *rdata_len - (p2 - *rdata);
3548                                 char *tmp;
3549
3550                                 if (space_rem <= 0) {
3551                                         return false;
3552                                 }
3553                                 tmp = talloc_strdup(ctx, "\\\\%L");
3554                                 if (!tmp) {
3555                                         return false;
3556                                 }
3557                                 tmp = talloc_sub_basic(ctx,
3558                                                 "",
3559                                                 "",
3560                                                 tmp);
3561                                 if (!tmp) {
3562                                         return false;
3563                                 }
3564
3565                                 push_ascii(p2,
3566                                         tmp,
3567                                         space_rem,
3568                                         STR_TERMINATE);
3569                         }
3570                         p2 = skip_string(*rdata,*rdata_len,p2);
3571                         if (!p2) {
3572                                 return False;
3573                         }
3574                         SSVAL(p,110,49);        /* country_code */
3575                         SSVAL(p,112,860);       /* code page */
3576                 }
3577         }
3578
3579         *rdata_len = PTR_DIFF(p2,*rdata);
3580
3581         SSVAL(*rparam,4,*rdata_len);    /* is this right?? */
3582
3583         return(True);
3584 }
3585
3586 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
3587                                 char *param, int tpscnt,
3588                                 char *data, int tdscnt,
3589                                 int mdrcnt,int mprcnt,
3590                                 char **rdata,char **rparam,
3591                                 int *rdata_len,int *rparam_len)
3592 {
3593         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3594         char *str2 = skip_string(param,tpscnt,str1);
3595         char *p = skip_string(param,tpscnt,str2);
3596         int uLevel;
3597         struct pack_desc desc;
3598         char* name;
3599                 /* With share level security vuid will always be zero.
3600                    Don't depend on vuser being non-null !!. JRA */
3601         user_struct *vuser = get_valid_user_struct(vuid);
3602
3603         if (!str1 || !str2 || !p) {
3604                 return False;
3605         }
3606
3607         if(vuser != NULL) {
3608                 DEBUG(3,("  Username of UID %d is %s\n",
3609                          (int)vuser->server_info->utok.uid,
3610                          vuser->server_info->unix_name));
3611         }
3612
3613         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3614         name = get_safe_str_ptr(param,tpscnt,p,2);
3615         if (!name) {
3616                 return False;
3617         }
3618
3619         memset((char *)&desc,'\0',sizeof(desc));
3620
3621         DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
3622
3623         /* check it's a supported varient */
3624         if (strcmp(str1,"OOWb54WrLh") != 0) {
3625                 return False;
3626         }
3627         if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
3628                 return False;
3629         }
3630         if (mdrcnt > 0) {
3631                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3632                 if (!*rdata) {
3633                         return False;
3634                 }
3635         }
3636
3637         desc.base = *rdata;
3638         desc.buflen = mdrcnt;
3639         desc.subformat = NULL;
3640         desc.format = str2;
3641
3642         if (init_package(&desc,1,0)) {
3643                 PACKI(&desc,"W",0);             /* code */
3644                 PACKS(&desc,"B21",name);        /* eff. name */
3645                 PACKS(&desc,"B","");            /* pad */
3646                 PACKI(&desc,"W", conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3647                 PACKI(&desc,"D",0);             /* auth flags XXX */
3648                 PACKI(&desc,"W",0);             /* num logons */
3649                 PACKI(&desc,"W",0);             /* bad pw count */
3650                 PACKI(&desc,"D",0);             /* last logon */
3651                 PACKI(&desc,"D",-1);            /* last logoff */
3652                 PACKI(&desc,"D",-1);            /* logoff time */
3653                 PACKI(&desc,"D",-1);            /* kickoff time */
3654                 PACKI(&desc,"D",0);             /* password age */
3655                 PACKI(&desc,"D",0);             /* password can change */
3656                 PACKI(&desc,"D",-1);            /* password must change */
3657
3658                 {
3659                         fstring mypath;
3660                         fstrcpy(mypath,"\\\\");
3661                         fstrcat(mypath,get_local_machine_name());
3662                         strupper_m(mypath);
3663                         PACKS(&desc,"z",mypath); /* computer */
3664                 }
3665
3666                 PACKS(&desc,"z",lp_workgroup());/* domain */
3667                 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
3668                               vuser->server_info->sam_account) : ""); /* script path */
3669                 PACKI(&desc,"D",0x00000000);            /* reserved */
3670         }
3671
3672         *rdata_len = desc.usedlen;
3673         *rparam_len = 6;
3674         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3675         if (!*rparam) {
3676                 return False;
3677         }
3678         SSVALS(*rparam,0,desc.errcode);
3679         SSVAL(*rparam,2,0);
3680         SSVAL(*rparam,4,desc.neededlen);
3681
3682         DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
3683
3684         return True;
3685 }
3686
3687 /****************************************************************************
3688  api_WAccessGetUserPerms
3689 ****************************************************************************/
3690
3691 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
3692                                 char *param, int tpscnt,
3693                                 char *data, int tdscnt,
3694                                 int mdrcnt,int mprcnt,
3695                                 char **rdata,char **rparam,
3696                                 int *rdata_len,int *rparam_len)
3697 {
3698         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3699         char *str2 = skip_string(param,tpscnt,str1);
3700         char *user = skip_string(param,tpscnt,str2);
3701         char *resource = skip_string(param,tpscnt,user);
3702
3703         if (!str1 || !str2 || !user || !resource) {
3704                 return False;
3705         }
3706
3707         if (skip_string(param,tpscnt,resource) == NULL) {
3708                 return False;
3709         }
3710         DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
3711
3712         /* check it's a supported varient */
3713         if (strcmp(str1,"zzh") != 0) {
3714                 return False;
3715         }
3716         if (strcmp(str2,"") != 0) {
3717                 return False;
3718         }
3719
3720         *rparam_len = 6;
3721         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3722         if (!*rparam) {
3723                 return False;
3724         }
3725         SSVALS(*rparam,0,0);            /* errorcode */
3726         SSVAL(*rparam,2,0);             /* converter word */
3727         SSVAL(*rparam,4,0x7f);  /* permission flags */
3728
3729         return True;
3730 }
3731
3732 /****************************************************************************
3733   api_WPrintJobEnumerate
3734   ****************************************************************************/
3735
3736 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
3737                                 char *param, int tpscnt,
3738                                 char *data, int tdscnt,
3739                                 int mdrcnt,int mprcnt,
3740                                 char **rdata,char **rparam,
3741                                 int *rdata_len,int *rparam_len)
3742 {
3743         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3744         char *str2 = skip_string(param,tpscnt,str1);
3745         char *p = skip_string(param,tpscnt,str2);
3746         int uLevel;
3747         int count;
3748         int i;
3749         int snum;
3750         fstring sharename;
3751         uint32 jobid;
3752         struct pack_desc desc;
3753         print_queue_struct *queue=NULL;
3754         print_status_struct status;
3755         char *tmpdata=NULL;
3756
3757         if (!str1 || !str2 || !p) {
3758                 return False;
3759         }
3760
3761         uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3762
3763         memset((char *)&desc,'\0',sizeof(desc));
3764         memset((char *)&status,'\0',sizeof(status));
3765
3766         DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
3767
3768         /* check it's a supported varient */
3769         if (strcmp(str1,"WWrLh") != 0) {
3770                 return False;
3771         }
3772         if (!check_printjob_info(&desc,uLevel,str2)) {
3773                 return False;
3774         }
3775
3776         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
3777                 return False;
3778         }
3779
3780         snum = lp_servicenumber( sharename);
3781         if (snum < 0 || !VALID_SNUM(snum)) {
3782                 return(False);
3783         }
3784
3785         count = print_queue_status(snum,&queue,&status);
3786         for (i = 0; i < count; i++) {
3787                 if (queue[i].job == jobid) {
3788                         break;
3789                 }
3790         }
3791
3792         if (mdrcnt > 0) {
3793                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3794                 if (!*rdata) {
3795                         return False;
3796                 }
3797                 desc.base = *rdata;
3798                 desc.buflen = mdrcnt;
3799         } else {
3800                 /*
3801                  * Don't return data but need to get correct length
3802                  *  init_package will return wrong size if buflen=0
3803                  */
3804                 desc.buflen = getlen(desc.format);
3805                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
3806         }
3807
3808         if (init_package(&desc,1,0)) {
3809                 if (i < count) {
3810                         fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
3811                         *rdata_len = desc.usedlen;
3812                 } else {
3813                         desc.errcode = NERR_JobNotFound;
3814                         *rdata_len = 0;
3815                 }
3816         }
3817
3818         *rparam_len = 6;
3819         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3820         if (!*rparam) {
3821                 return False;
3822         }
3823         SSVALS(*rparam,0,desc.errcode);
3824         SSVAL(*rparam,2,0);
3825         SSVAL(*rparam,4,desc.neededlen);
3826
3827         SAFE_FREE(queue);
3828         SAFE_FREE(tmpdata);
3829
3830         DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
3831
3832         return True;
3833 }
3834
3835 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
3836                                 char *param, int tpscnt,
3837                                 char *data, int tdscnt,
3838                                 int mdrcnt,int mprcnt,
3839                                 char **rdata,char **rparam,
3840                                 int *rdata_len,int *rparam_len)
3841 {
3842         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3843         char *str2 = skip_string(param,tpscnt,str1);
3844         char *p = skip_string(param,tpscnt,str2);
3845         char *name = p;
3846         int uLevel;
3847         int count;
3848         int i, succnt=0;
3849         int snum;
3850         struct pack_desc desc;
3851         print_queue_struct *queue=NULL;
3852         print_status_struct status;
3853
3854         if (!str1 || !str2 || !p) {
3855                 return False;
3856         }
3857
3858         memset((char *)&desc,'\0',sizeof(desc));
3859         memset((char *)&status,'\0',sizeof(status));
3860
3861         p = skip_string(param,tpscnt,p);
3862         if (!p) {
3863                 return False;
3864         }
3865         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3866
3867         DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
3868
3869         /* check it's a supported variant */
3870         if (strcmp(str1,"zWrLeh") != 0) {
3871                 return False;
3872         }
3873
3874         if (uLevel > 2) {
3875                 return False;   /* defined only for uLevel 0,1,2 */
3876         }
3877
3878         if (!check_printjob_info(&desc,uLevel,str2)) {
3879                 return False;
3880         }
3881
3882         snum = find_service(name);
3883         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
3884                 return False;
3885         }
3886
3887         count = print_queue_status(snum,&queue,&status);
3888         if (mdrcnt > 0) {
3889                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3890                 if (!*rdata) {
3891                         return False;
3892                 }
3893         }
3894         desc.base = *rdata;
3895         desc.buflen = mdrcnt;
3896
3897         if (init_package(&desc,count,0)) {
3898                 succnt = 0;
3899                 for (i = 0; i < count; i++) {
3900                         fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
3901                         if (desc.errcode == NERR_Success) {
3902                                 succnt = i+1;
3903                         }
3904                 }
3905         }
3906
3907         *rdata_len = desc.usedlen;
3908
3909         *rparam_len = 8;
3910         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3911         if (!*rparam) {
3912                 return False;
3913         }
3914         SSVALS(*rparam,0,desc.errcode);
3915         SSVAL(*rparam,2,0);
3916         SSVAL(*rparam,4,succnt);
3917         SSVAL(*rparam,6,count);
3918
3919         SAFE_FREE(queue);
3920
3921         DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
3922
3923         return True;
3924 }
3925
3926 static int check_printdest_info(struct pack_desc* desc,
3927                                 int uLevel, char* id)
3928 {
3929         desc->subformat = NULL;
3930         switch( uLevel ) {
3931                 case 0:
3932                         desc->format = "B9";
3933                         break;
3934                 case 1:
3935                         desc->format = "B9B21WWzW";
3936                         break;
3937                 case 2:
3938                         desc->format = "z";
3939                         break;
3940                 case 3:
3941                         desc->format = "zzzWWzzzWW";
3942                         break;
3943                 default:
3944                         DEBUG(0,("check_printdest_info: invalid level %d\n",
3945                                 uLevel));
3946                         return False;
3947         }
3948         if (id == NULL || strcmp(desc->format,id) != 0) {
3949                 DEBUG(0,("check_printdest_info: invalid string %s\n",
3950                         id ? id : "<NULL>" ));
3951                 return False;
3952         }
3953         return True;
3954 }
3955
3956 static void fill_printdest_info(connection_struct *conn, int snum, int uLevel,
3957                                 struct pack_desc* desc)
3958 {
3959         char buf[100];
3960
3961         strncpy(buf,SERVICE(snum),sizeof(buf)-1);
3962         buf[sizeof(buf)-1] = 0;
3963         strupper_m(buf);
3964
3965         if (uLevel <= 1) {
3966                 PACKS(desc,"B9",buf);   /* szName */
3967                 if (uLevel == 1) {
3968                         PACKS(desc,"B21","");   /* szUserName */
3969                         PACKI(desc,"W",0);              /* uJobId */
3970                         PACKI(desc,"W",0);              /* fsStatus */
3971                         PACKS(desc,"z","");     /* pszStatus */
3972                         PACKI(desc,"W",0);              /* time */
3973                 }
3974         }
3975
3976         if (uLevel == 2 || uLevel == 3) {
3977                 PACKS(desc,"z",buf);            /* pszPrinterName */
3978                 if (uLevel == 3) {
3979                         PACKS(desc,"z","");     /* pszUserName */
3980                         PACKS(desc,"z","");     /* pszLogAddr */
3981                         PACKI(desc,"W",0);              /* uJobId */
3982                         PACKI(desc,"W",0);              /* fsStatus */
3983                         PACKS(desc,"z","");     /* pszStatus */
3984                         PACKS(desc,"z","");     /* pszComment */
3985                         PACKS(desc,"z","NULL"); /* pszDrivers */
3986                         PACKI(desc,"W",0);              /* time */
3987                         PACKI(desc,"W",0);              /* pad1 */
3988                 }
3989         }
3990 }
3991
3992 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
3993                                 char *param, int tpscnt,
3994                                 char *data, int tdscnt,
3995                                 int mdrcnt,int mprcnt,
3996                                 char **rdata,char **rparam,
3997                                 int *rdata_len,int *rparam_len)
3998 {
3999         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4000         char *str2 = skip_string(param,tpscnt,str1);
4001         char *p = skip_string(param,tpscnt,str2);
4002         char* PrinterName = p;
4003         int uLevel;
4004         struct pack_desc desc;
4005         int snum;
4006         char *tmpdata=NULL;
4007
4008         if (!str1 || !str2 || !p) {
4009                 return False;
4010         }
4011
4012         memset((char *)&desc,'\0',sizeof(desc));
4013
4014         p = skip_string(param,tpscnt,p);
4015         if (!p) {
4016                 return False;
4017         }
4018         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4019
4020         DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4021
4022         /* check it's a supported varient */
4023         if (strcmp(str1,"zWrLh") != 0) {
4024                 return False;
4025         }
4026         if (!check_printdest_info(&desc,uLevel,str2)) {
4027                 return False;
4028         }
4029
4030         snum = find_service(PrinterName);
4031         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4032                 *rdata_len = 0;
4033                 desc.errcode = NERR_DestNotFound;
4034                 desc.neededlen = 0;
4035         } else {
4036                 if (mdrcnt > 0) {
4037                         *rdata = smb_realloc_limit(*rdata,mdrcnt);
4038                         if (!*rdata) {
4039                                 return False;
4040                         }
4041                         desc.base = *rdata;
4042                         desc.buflen = mdrcnt;
4043                 } else {
4044                         /*
4045                          * Don't return data but need to get correct length
4046                          * init_package will return wrong size if buflen=0
4047                          */
4048                         desc.buflen = getlen(desc.format);
4049                         desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4050                 }
4051                 if (init_package(&desc,1,0)) {
4052                         fill_printdest_info(conn,snum,uLevel,&desc);
4053                 }
4054                 *rdata_len = desc.usedlen;
4055         }
4056
4057         *rparam_len = 6;
4058         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4059         if (!*rparam) {
4060                 return False;
4061         }
4062         SSVALS(*rparam,0,desc.errcode);
4063         SSVAL(*rparam,2,0);
4064         SSVAL(*rparam,4,desc.neededlen);
4065
4066         DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4067         SAFE_FREE(tmpdata);
4068
4069         return True;
4070 }
4071
4072 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4073                                 char *param, int tpscnt,
4074                                 char *data, int tdscnt,
4075                                 int mdrcnt,int mprcnt,
4076                                 char **rdata,char **rparam,
4077                                 int *rdata_len,int *rparam_len)
4078 {
4079         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4080         char *str2 = skip_string(param,tpscnt,str1);
4081         char *p = skip_string(param,tpscnt,str2);
4082         int uLevel;
4083         int queuecnt;
4084         int i, n, succnt=0;
4085         struct pack_desc desc;
4086         int services = lp_numservices();
4087
4088         if (!str1 || !str2 || !p) {
4089                 return False;
4090         }
4091
4092         memset((char *)&desc,'\0',sizeof(desc));
4093
4094         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4095
4096         DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4097
4098         /* check it's a supported varient */
4099         if (strcmp(str1,"WrLeh") != 0) {
4100                 return False;
4101         }
4102         if (!check_printdest_info(&desc,uLevel,str2)) {
4103                 return False;
4104         }
4105
4106         queuecnt = 0;
4107         for (i = 0; i < services; i++) {
4108                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4109                         queuecnt++;
4110                 }
4111         }
4112
4113         if (mdrcnt > 0) {
4114                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4115                 if (!*rdata) {
4116                         return False;
4117                 }
4118         }
4119
4120         desc.base = *rdata;
4121         desc.buflen = mdrcnt;
4122         if (init_package(&desc,queuecnt,0)) {
4123                 succnt = 0;
4124                 n = 0;
4125                 for (i = 0; i < services; i++) {
4126                         if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4127                                 fill_printdest_info(conn,i,uLevel,&desc);
4128                                 n++;
4129                                 if (desc.errcode == NERR_Success) {
4130                                         succnt = n;
4131                                 }
4132                         }
4133                 }
4134         }
4135
4136         *rdata_len = desc.usedlen;
4137
4138         *rparam_len = 8;
4139         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4140         if (!*rparam) {
4141                 return False;
4142         }
4143         SSVALS(*rparam,0,desc.errcode);
4144         SSVAL(*rparam,2,0);
4145         SSVAL(*rparam,4,succnt);
4146         SSVAL(*rparam,6,queuecnt);
4147
4148         DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4149
4150         return True;
4151 }
4152
4153 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4154                                 char *param, int tpscnt,
4155                                 char *data, int tdscnt,
4156                                 int mdrcnt,int mprcnt,
4157                                 char **rdata,char **rparam,
4158                                 int *rdata_len,int *rparam_len)
4159 {
4160         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4161         char *str2 = skip_string(param,tpscnt,str1);
4162         char *p = skip_string(param,tpscnt,str2);
4163         int uLevel;
4164         int succnt;
4165         struct pack_desc desc;
4166
4167         if (!str1 || !str2 || !p) {
4168                 return False;
4169         }
4170
4171         memset((char *)&desc,'\0',sizeof(desc));
4172
4173         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4174
4175         DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4176
4177         /* check it's a supported varient */
4178         if (strcmp(str1,"WrLeh") != 0) {
4179                 return False;
4180         }
4181         if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4182                 return False;
4183         }
4184
4185         if (mdrcnt > 0) {
4186                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4187                 if (!*rdata) {
4188                         return False;
4189                 }
4190         }
4191         desc.base = *rdata;
4192         desc.buflen = mdrcnt;
4193         if (init_package(&desc,1,0)) {
4194                 PACKS(&desc,"B41","NULL");
4195         }
4196
4197         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4198
4199         *rdata_len = desc.usedlen;
4200
4201         *rparam_len = 8;
4202         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4203         if (!*rparam) {
4204                 return False;
4205         }
4206         SSVALS(*rparam,0,desc.errcode);
4207         SSVAL(*rparam,2,0);
4208         SSVAL(*rparam,4,succnt);
4209         SSVAL(*rparam,6,1);
4210
4211         DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4212
4213         return True;
4214 }
4215
4216 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4217                                 char *param, int tpscnt,
4218                                 char *data, int tdscnt,
4219                                 int mdrcnt,int mprcnt,
4220                                 char **rdata,char **rparam,
4221                                 int *rdata_len,int *rparam_len)
4222 {
4223         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4224         char *str2 = skip_string(param,tpscnt,str1);
4225         char *p = skip_string(param,tpscnt,str2);
4226         int uLevel;
4227         int succnt;
4228         struct pack_desc desc;
4229
4230         if (!str1 || !str2 || !p) {
4231                 return False;
4232         }
4233         memset((char *)&desc,'\0',sizeof(desc));
4234
4235         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4236
4237         DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4238
4239         /* check it's a supported varient */
4240         if (strcmp(str1,"WrLeh") != 0) {
4241                 return False;
4242         }
4243         if (uLevel != 0 || strcmp(str2,"B13") != 0) {
4244                 return False;
4245         }
4246
4247         if (mdrcnt > 0) {
4248                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4249                 if (!*rdata) {
4250                         return False;
4251                 }
4252         }
4253         desc.base = *rdata;
4254         desc.buflen = mdrcnt;
4255         desc.format = str2;
4256         if (init_package(&desc,1,0)) {
4257                 PACKS(&desc,"B13","lpd");
4258         }
4259
4260         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4261
4262         *rdata_len = desc.usedlen;
4263
4264         *rparam_len = 8;
4265         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4266         if (!*rparam) {
4267                 return False;
4268         }
4269         SSVALS(*rparam,0,desc.errcode);
4270         SSVAL(*rparam,2,0);
4271         SSVAL(*rparam,4,succnt);
4272         SSVAL(*rparam,6,1);
4273
4274         DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
4275
4276         return True;
4277 }
4278
4279 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
4280                                 char *param, int tpscnt,
4281                                 char *data, int tdscnt,
4282                                 int mdrcnt,int mprcnt,
4283                                 char **rdata,char **rparam,
4284                                 int *rdata_len,int *rparam_len)
4285 {
4286         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4287         char *str2 = skip_string(param,tpscnt,str1);
4288         char *p = skip_string(param,tpscnt,str2);
4289         int uLevel;
4290         int succnt;
4291         struct pack_desc desc;
4292
4293         if (!str1 || !str2 || !p) {
4294                 return False;
4295         }
4296
4297         memset((char *)&desc,'\0',sizeof(desc));
4298
4299         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4300
4301         DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
4302
4303         /* check it's a supported varient */
4304         if (strcmp(str1,"WrLeh") != 0) {
4305                 return False;
4306         }
4307         if (uLevel != 0 || strcmp(str2,"B9") != 0) {
4308                 return False;
4309         }
4310
4311         if (mdrcnt > 0) {
4312                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4313                 if (!*rdata) {
4314                         return False;
4315                 }
4316         }
4317         memset((char *)&desc,'\0',sizeof(desc));
4318         desc.base = *rdata;
4319         desc.buflen = mdrcnt;
4320         desc.format = str2;
4321         if (init_package(&desc,1,0)) {
4322                 PACKS(&desc,"B13","lp0");
4323         }
4324
4325         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4326
4327         *rdata_len = desc.usedlen;
4328
4329         *rparam_len = 8;
4330         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4331         if (!*rparam) {
4332                 return False;
4333         }
4334         SSVALS(*rparam,0,desc.errcode);
4335         SSVAL(*rparam,2,0);
4336         SSVAL(*rparam,4,succnt);
4337         SSVAL(*rparam,6,1);
4338
4339         DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
4340
4341         return True;
4342 }
4343
4344 /****************************************************************************
4345  List open sessions
4346  ****************************************************************************/
4347
4348 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
4349                                 char *param, int tpscnt,
4350                                 char *data, int tdscnt,
4351                                 int mdrcnt,int mprcnt,
4352                                 char **rdata,char **rparam,
4353                                 int *rdata_len,int *rparam_len)
4354
4355 {
4356         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4357         char *str2 = skip_string(param,tpscnt,str1);
4358         char *p = skip_string(param,tpscnt,str2);
4359         int uLevel;
4360         struct pack_desc desc;
4361         struct sessionid *session_list;
4362         int i, num_sessions;
4363
4364         if (!str1 || !str2 || !p) {
4365                 return False;
4366         }
4367
4368         memset((char *)&desc,'\0',sizeof(desc));
4369
4370         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4371
4372         DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
4373         DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
4374         DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
4375
4376         /* check it's a supported varient */
4377         if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
4378                 return False;
4379         }
4380         if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
4381                 return False;
4382         }
4383
4384         num_sessions = list_sessions(talloc_tos(), &session_list);
4385
4386         if (mdrcnt > 0) {
4387                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4388                 if (!*rdata) {
4389                         return False;
4390                 }
4391         }
4392         memset((char *)&desc,'\0',sizeof(desc));
4393         desc.base = *rdata;
4394         desc.buflen = mdrcnt;
4395         desc.format = str2;
4396         if (!init_package(&desc,num_sessions,0)) {
4397                 return False;
4398         }
4399
4400         for(i=0; i<num_sessions; i++) {
4401                 PACKS(&desc, "z", session_list[i].remote_machine);
4402                 PACKS(&desc, "z", session_list[i].username);
4403                 PACKI(&desc, "W", 1); /* num conns */
4404                 PACKI(&desc, "W", 0); /* num opens */
4405                 PACKI(&desc, "W", 1); /* num users */
4406                 PACKI(&desc, "D", 0); /* session time */
4407                 PACKI(&desc, "D", 0); /* idle time */
4408                 PACKI(&desc, "D", 0); /* flags */
4409                 PACKS(&desc, "z", "Unknown Client"); /* client type string */
4410         }
4411
4412         *rdata_len = desc.usedlen;
4413
4414         *rparam_len = 8;
4415         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4416         if (!*rparam) {
4417                 return False;
4418         }
4419         SSVALS(*rparam,0,desc.errcode);
4420         SSVAL(*rparam,2,0); /* converter */
4421         SSVAL(*rparam,4,num_sessions); /* count */
4422
4423         DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
4424
4425         return True;
4426 }
4427
4428
4429 /****************************************************************************
4430  The buffer was too small.
4431  ****************************************************************************/
4432
4433 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
4434                          int mdrcnt, int mprcnt,
4435                          char **rdata, char **rparam,
4436                          int *rdata_len, int *rparam_len)
4437 {
4438         *rparam_len = MIN(*rparam_len,mprcnt);
4439         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4440         if (!*rparam) {
4441                 return False;
4442         }
4443
4444         *rdata_len = 0;
4445
4446         SSVAL(*rparam,0,NERR_BufTooSmall);
4447
4448         DEBUG(3,("Supplied buffer too small in API command\n"));
4449
4450         return True;
4451 }
4452
4453 /****************************************************************************
4454  The request is not supported.
4455  ****************************************************************************/
4456
4457 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
4458                                 char *param, int tpscnt,
4459                                 char *data, int tdscnt,
4460                                 int mdrcnt, int mprcnt,
4461                                 char **rdata, char **rparam,
4462                                 int *rdata_len, int *rparam_len)
4463 {
4464         *rparam_len = 4;
4465         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4466         if (!*rparam) {
4467                 return False;
4468         }
4469
4470         *rdata_len = 0;
4471
4472         SSVAL(*rparam,0,NERR_notsupported);
4473         SSVAL(*rparam,2,0);             /* converter word */
4474
4475         DEBUG(3,("Unsupported API command\n"));
4476
4477         return True;
4478 }
4479
4480 static const struct {
4481         const char *name;
4482         int id;
4483         bool (*fn)(connection_struct *, uint16,
4484                         char *, int,
4485                         char *, int,
4486                         int,int,char **,char **,int *,int *);
4487         bool auth_user;         /* Deny anonymous access? */
4488 } api_commands[] = {
4489         {"RNetShareEnum",       RAP_WshareEnum,         api_RNetShareEnum, True},
4490         {"RNetShareGetInfo",    RAP_WshareGetInfo,      api_RNetShareGetInfo},
4491         {"RNetShareAdd",        RAP_WshareAdd,          api_RNetShareAdd},
4492         {"RNetSessionEnum",     RAP_WsessionEnum,       api_RNetSessionEnum, True},
4493         {"RNetServerGetInfo",   RAP_WserverGetInfo,     api_RNetServerGetInfo},
4494         {"RNetGroupEnum",       RAP_WGroupEnum,         api_RNetGroupEnum, True},
4495         {"RNetGroupGetUsers", RAP_WGroupGetUsers,       api_RNetGroupGetUsers, True},
4496         {"RNetUserEnum",        RAP_WUserEnum,          api_RNetUserEnum, True},
4497         {"RNetUserGetInfo",     RAP_WUserGetInfo,       api_RNetUserGetInfo},
4498         {"NetUserGetGroups",    RAP_WUserGetGroups,     api_NetUserGetGroups},
4499         {"NetWkstaGetInfo",     RAP_WWkstaGetInfo,      api_NetWkstaGetInfo},
4500         {"DosPrintQEnum",       RAP_WPrintQEnum,        api_DosPrintQEnum, True},
4501         {"DosPrintQGetInfo",    RAP_WPrintQGetInfo,     api_DosPrintQGetInfo},
4502         {"WPrintQueuePause",  RAP_WPrintQPause, api_WPrintQueueCtrl},
4503         {"WPrintQueueResume", RAP_WPrintQContinue,      api_WPrintQueueCtrl},
4504         {"WPrintJobEnumerate",RAP_WPrintJobEnum,        api_WPrintJobEnumerate},
4505         {"WPrintJobGetInfo",    RAP_WPrintJobGetInfo,   api_WPrintJobGetInfo},
4506         {"RDosPrintJobDel",     RAP_WPrintJobDel,       api_RDosPrintJobDel},
4507         {"RDosPrintJobPause",   RAP_WPrintJobPause,     api_RDosPrintJobDel},
4508         {"RDosPrintJobResume",RAP_WPrintJobContinue,    api_RDosPrintJobDel},
4509         {"WPrintDestEnum",      RAP_WPrintDestEnum,     api_WPrintDestEnum},
4510         {"WPrintDestGetInfo",   RAP_WPrintDestGetInfo,  api_WPrintDestGetInfo},
4511         {"NetRemoteTOD",        RAP_NetRemoteTOD,       api_NetRemoteTOD},
4512         {"WPrintQueuePurge",    RAP_WPrintQPurge,       api_WPrintQueueCtrl},
4513         {"NetServerEnum",       RAP_NetServerEnum2,     api_RNetServerEnum}, /* anon OK */
4514         {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
4515         {"SetUserPassword",     RAP_WUserPasswordSet2,  api_SetUserPassword},
4516         {"WWkstaUserLogon",     RAP_WWkstaUserLogon,    api_WWkstaUserLogon},
4517         {"PrintJobInfo",        RAP_WPrintJobSetInfo,   api_PrintJobInfo},
4518         {"WPrintDriverEnum",    RAP_WPrintDriverEnum,   api_WPrintDriverEnum},
4519         {"WPrintQProcEnum",     RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
4520         {"WPrintPortEnum",      RAP_WPrintPortEnum,     api_WPrintPortEnum},
4521         {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
4522         {NULL,          -1,     api_Unsupported}
4523         /*  The following RAP calls are not implemented by Samba:
4524
4525         RAP_WFileEnum2 - anon not OK
4526         */
4527 };
4528
4529
4530 /****************************************************************************
4531  Handle remote api calls.
4532 ****************************************************************************/
4533
4534 void api_reply(connection_struct *conn, uint16 vuid,
4535                struct smb_request *req,
4536                char *data, char *params,
4537                int tdscnt, int tpscnt,
4538                int mdrcnt, int mprcnt)
4539 {
4540         int api_command;
4541         char *rdata = NULL;
4542         char *rparam = NULL;
4543         const char *name1 = NULL;
4544         const char *name2 = NULL;
4545         int rdata_len = 0;
4546         int rparam_len = 0;
4547         bool reply=False;
4548         int i;
4549
4550         if (!params) {
4551                 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
4552                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4553                 return;
4554         }
4555
4556         if (tpscnt < 2) {
4557                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4558                 return;
4559         }
4560         api_command = SVAL(params,0);
4561         /* Is there a string at position params+2 ? */
4562         if (skip_string(params,tpscnt,params+2)) {
4563                 name1 = params + 2;
4564         } else {
4565                 name1 = "";
4566         }
4567         name2 = skip_string(params,tpscnt,params+2);
4568         if (!name2) {
4569                 name2 = "";
4570         }
4571
4572         DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
4573                 api_command,
4574                 name1,
4575                 name2,
4576                 tdscnt,tpscnt,mdrcnt,mprcnt));
4577
4578         for (i=0;api_commands[i].name;i++) {
4579                 if (api_commands[i].id == api_command && api_commands[i].fn) {
4580                         DEBUG(3,("Doing %s\n",api_commands[i].name));
4581                         break;
4582                 }
4583         }
4584
4585         /* Check whether this api call can be done anonymously */
4586
4587         if (api_commands[i].auth_user && lp_restrict_anonymous()) {
4588                 user_struct *user = get_valid_user_struct(vuid);
4589
4590                 if (!user || user->server_info->guest) {
4591                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4592                         return;
4593                 }
4594         }
4595
4596         rdata = (char *)SMB_MALLOC(1024);
4597         if (rdata) {
4598                 memset(rdata,'\0',1024);
4599         }
4600
4601         rparam = (char *)SMB_MALLOC(1024);
4602         if (rparam) {
4603                 memset(rparam,'\0',1024);
4604         }
4605
4606         if(!rdata || !rparam) {
4607                 DEBUG(0,("api_reply: malloc fail !\n"));
4608                 SAFE_FREE(rdata);
4609                 SAFE_FREE(rparam);
4610                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4611                 return;
4612         }
4613
4614         reply = api_commands[i].fn(conn,
4615                                 vuid,
4616                                 params,tpscnt,  /* params + length */
4617                                 data,tdscnt,    /* data + length */
4618                                 mdrcnt,mprcnt,
4619                                 &rdata,&rparam,&rdata_len,&rparam_len);
4620
4621
4622         if (rdata_len > mdrcnt || rparam_len > mprcnt) {
4623                 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
4624                                         &rdata,&rparam,&rdata_len,&rparam_len);
4625         }
4626
4627         /* if we get False back then it's actually unsupported */
4628         if (!reply) {
4629                 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
4630                         &rdata,&rparam,&rdata_len,&rparam_len);
4631         }
4632
4633         /* If api_Unsupported returns false we can't return anything. */
4634         if (reply) {
4635                 send_trans_reply(conn, req->inbuf, rparam, rparam_len,
4636                                  rdata, rdata_len, False);
4637         }
4638
4639         SAFE_FREE(rdata);
4640         SAFE_FREE(rparam);
4641         return;
4642 }