source3/smbd/lanman.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Inter-process communication and named pipe handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Jeremy Allison 2007.
   6
   7    SMB Version handling
   8    Copyright (C) John H Terpstra 1995-1998
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22    */
  23 /*
  24    This file handles the named pipe and mailslot calls
  25    in the SMBtrans protocol
  26    */
  27
  28 #include "includes.h"
  29 #include "smbd/globals.h"
  30 #include "../librpc/gen_ndr/cli_samr.h"
  31 #include "../librpc/gen_ndr/cli_spoolss.h"
  32 #include "rpc_client/cli_spoolss.h"
  33 #include "rpc_client/init_spoolss.h"
  34 #include "../librpc/gen_ndr/cli_srvsvc.h"
  35 #include "../librpc/gen_ndr/srv_samr.h"
  36 #include "../librpc/gen_ndr/srv_srvsvc.h"
  37 #include "../librpc/gen_ndr/rap.h"
  38 #include "../lib/util/binsearch.h"
  39 #include "../libcli/auth/libcli_auth.h"
  40
  41 #ifdef CHECK_TYPES
  42 #undef CHECK_TYPES
  43 #endif
  44 #define CHECK_TYPES 0
  45
  46 #define NERR_Success 0
  47 #define NERR_badpass 86
  48 #define NERR_notsupported 50
  49
  50 #define NERR_BASE (2100)
  51 #define NERR_BufTooSmall (NERR_BASE+23)
  52 #define NERR_JobNotFound (NERR_BASE+51)
  53 #define NERR_DestNotFound (NERR_BASE+52)
  54
  55 #define ACCESS_READ 0x01
  56 #define ACCESS_WRITE 0x02
  57 #define ACCESS_CREATE 0x04
  58
  59 #define SHPWLEN 8               /* share password length */
  60
  61 /* Limit size of ipc replies */
  62
  63 static char *smb_realloc_limit(void *ptr, size_t size)
  64 {
  65         char *val;
  66
  67         size = MAX((size),4*1024);
  68         val = (char *)SMB_REALLOC(ptr,size);
  69         if (val) {
  70                 memset(val,'\0',size);
  71         }
  72         return val;
  73 }
  74
  75 static bool api_Unsupported(struct smbd_server_connection *sconn,
  76                             connection_struct *conn, uint16 vuid,
  77                                 char *param, int tpscnt,
  78                                 char *data, int tdscnt,
  79                                 int mdrcnt, int mprcnt,
  80                                 char **rdata, char **rparam,
  81                                 int *rdata_len, int *rparam_len);
  82
  83 static bool api_TooSmall(struct smbd_server_connection *sconn,
  84                          connection_struct *conn, uint16 vuid, char *param, char *data,
  85                          int mdrcnt, int mprcnt,
  86                          char **rdata, char **rparam,
  87                          int *rdata_len, int *rparam_len);
  88
  89
  90 static int CopyExpanded(connection_struct *conn,
  91                         int snum, char **dst, char *src, int *p_space_remaining)
  92 {
  93         TALLOC_CTX *ctx = talloc_tos();
  94         char *buf = NULL;
  95         int l;
  96
  97         if (!src || !dst || !p_space_remaining || !(*dst) ||
  98                         *p_space_remaining <= 0) {
  99                 return 0;
 100         }
 101
 102         buf = talloc_strdup(ctx, src);
 103         if (!buf) {
 104                 *p_space_remaining = 0;
 105                 return 0;
 106         }
 107         buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
 108         if (!buf) {
 109                 *p_space_remaining = 0;
 110                 return 0;
 111         }
 112         buf = talloc_sub_advanced(ctx,
 113                                 lp_servicename(SNUM(conn)),
 114                                 conn->server_info->unix_name,
 115                                 conn->connectpath,
 116                                 conn->server_info->utok.gid,
 117                                 conn->server_info->sanitized_username,
 118                                 conn->server_info->info3->base.domain.string,
 119                                 buf);
 120         if (!buf) {
 121                 *p_space_remaining = 0;
 122                 return 0;
 123         }
 124         l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
 125         if (l == -1) {
 126                 return 0;
 127         }
 128         (*dst) += l;
 129         (*p_space_remaining) -= l;
 130         return l;
 131 }
 132
 133 static int CopyAndAdvance(char **dst, char *src, int *n)
 134 {
 135         int l;
 136         if (!src || !dst || !n || !(*dst)) {
 137                 return 0;
 138         }
 139         l = push_ascii(*dst,src,*n, STR_TERMINATE);
 140         if (l == -1) {
 141                 return 0;
 142         }
 143         (*dst) += l;
 144         (*n) -= l;
 145         return l;
 146 }
 147
 148 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
 149 {
 150         TALLOC_CTX *ctx = talloc_tos();
 151         char *buf = NULL;
 152         if (!s) {
 153                 return 0;
 154         }
 155         buf = talloc_strdup(ctx,s);
 156         if (!buf) {
 157                 return 0;
 158         }
 159         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 160         if (!buf) {
 161                 return 0;
 162         }
 163         buf = talloc_sub_advanced(ctx,
 164                                 lp_servicename(SNUM(conn)),
 165                                 conn->server_info->unix_name,
 166                                 conn->connectpath,
 167                                 conn->server_info->utok.gid,
 168                                 conn->server_info->sanitized_username,
 169                                 conn->server_info->info3->base.domain.string,
 170                                 buf);
 171         if (!buf) {
 172                 return 0;
 173         }
 174         return strlen(buf) + 1;
 175 }
 176
 177 /*******************************************************************
 178  Check a API string for validity when we only need to check the prefix.
 179 ******************************************************************/
 180
 181 static bool prefix_ok(const char *str, const char *prefix)
 182 {
 183         return(strncmp(str,prefix,strlen(prefix)) == 0);
 184 }
 185
 186 struct pack_desc {
 187         const char *format;         /* formatstring for structure */
 188         const char *subformat;  /* subformat for structure */
 189         char *base;         /* baseaddress of buffer */
 190         int buflen;        /* remaining size for fixed part; on init: length of base */
 191         int subcount;       /* count of substructures */
 192         char *structbuf;  /* pointer into buffer for remaining fixed part */
 193         int stringlen;    /* remaining size for variable part */
 194         char *stringbuf;  /* pointer into buffer for remaining variable part */
 195         int neededlen;    /* total needed size */
 196         int usedlen;        /* total used size (usedlen <= neededlen and usedlen <= buflen) */
 197         const char *curpos;         /* current position; pointer into format or subformat */
 198         int errcode;
 199 };
 200
 201 static int get_counter(const char **p)
 202 {
 203         int i, n;
 204         if (!p || !(*p)) {
 205                 return 1;
 206         }
 207         if (!isdigit((int)**p)) {
 208                 return 1;
 209         }
 210         for (n = 0;;) {
 211                 i = **p;
 212                 if (isdigit(i)) {
 213                         n = 10 * n + (i - '0');
 214                 } else {
 215                         return n;
 216                 }
 217                 (*p)++;
 218         }
 219 }
 220
 221 static int getlen(const char *p)
 222 {
 223         int n = 0;
 224         if (!p) {
 225                 return 0;
 226         }
 227
 228         while (*p) {
 229                 switch( *p++ ) {
 230                 case 'W':                       /* word (2 byte) */
 231                         n += 2;
 232                         break;
 233                 case 'K':                       /* status word? (2 byte) */
 234                         n += 2;
 235                         break;
 236                 case 'N':                       /* count of substructures (word) at end */
 237                         n += 2;
 238                         break;
 239                 case 'D':                       /* double word (4 byte) */
 240                 case 'z':                       /* offset to zero terminated string (4 byte) */
 241                 case 'l':                       /* offset to user data (4 byte) */
 242                         n += 4;
 243                         break;
 244                 case 'b':                       /* offset to data (with counter) (4 byte) */
 245                         n += 4;
 246                         get_counter(&p);
 247                         break;
 248                 case 'B':                       /* byte (with optional counter) */
 249                         n += get_counter(&p);
 250                         break;
 251                 }
 252         }
 253         return n;
 254 }
 255
 256 static bool init_package(struct pack_desc *p, int count, int subcount)
 257 {
 258         int n = p->buflen;
 259         int i;
 260
 261         if (!p->format || !p->base) {
 262                 return False;
 263         }
 264
 265         i = count * getlen(p->format);
 266         if (p->subformat) {
 267                 i += subcount * getlen(p->subformat);
 268         }
 269         p->structbuf = p->base;
 270         p->neededlen = 0;
 271         p->usedlen = 0;
 272         p->subcount = 0;
 273         p->curpos = p->format;
 274         if (i > n) {
 275                 p->neededlen = i;
 276                 i = n = 0;
 277 #if 0
 278                 /*
 279                  * This is the old error code we used. Aparently
 280                  * WinNT/2k systems return ERRbuftoosmall (2123) and
 281                  * OS/2 needs this. I'm leaving this here so we can revert
 282                  * if needed. JRA.
 283                  */
 284                 p->errcode = ERRmoredata;
 285 #else
 286                 p->errcode = ERRbuftoosmall;
 287 #endif
 288         } else {
 289                 p->errcode = NERR_Success;
 290         }
 291         p->buflen = i;
 292         n -= i;
 293         p->stringbuf = p->base + i;
 294         p->stringlen = n;
 295         return (p->errcode == NERR_Success);
 296 }
 297
 298 static int package(struct pack_desc *p, ...)
 299 {
 300         va_list args;
 301         int needed=0, stringneeded;
 302         const char *str=NULL;
 303         int is_string=0, stringused;
 304         int32 temp;
 305
 306         va_start(args,p);
 307
 308         if (!*p->curpos) {
 309                 if (!p->subcount) {
 310                         p->curpos = p->format;
 311                 } else {
 312                         p->curpos = p->subformat;
 313                         p->subcount--;
 314                 }
 315         }
 316 #if CHECK_TYPES
 317         str = va_arg(args,char*);
 318         SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
 319 #endif
 320         stringneeded = -1;
 321
 322         if (!p->curpos) {
 323                 va_end(args);
 324                 return 0;
 325         }
 326
 327         switch( *p->curpos++ ) {
 328                 case 'W':                       /* word (2 byte) */
 329                         needed = 2;
 330                         temp = va_arg(args,int);
 331                         if (p->buflen >= needed) {
 332                                 SSVAL(p->structbuf,0,temp);
 333                         }
 334                         break;
 335                 case 'K':                       /* status word? (2 byte) */
 336                         needed = 2;
 337                         temp = va_arg(args,int);
 338                         if (p->buflen >= needed) {
 339                                 SSVAL(p->structbuf,0,temp);
 340                         }
 341                         break;
 342                 case 'N':                       /* count of substructures (word) at end */
 343                         needed = 2;
 344                         p->subcount = va_arg(args,int);
 345                         if (p->buflen >= needed) {
 346                                 SSVAL(p->structbuf,0,p->subcount);
 347                         }
 348                         break;
 349                 case 'D':                       /* double word (4 byte) */
 350                         needed = 4;
 351                         temp = va_arg(args,int);
 352                         if (p->buflen >= needed) {
 353                                 SIVAL(p->structbuf,0,temp);
 354                         }
 355                         break;
 356                 case 'B':                       /* byte (with optional counter) */
 357                         needed = get_counter(&p->curpos);
 358                         {
 359                                 char *s = va_arg(args,char*);
 360                                 if (p->buflen >= needed) {
 361                                         StrnCpy(p->structbuf,s?s:"",needed-1);
 362                                 }
 363                         }
 364                         break;
 365                 case 'z':                       /* offset to zero terminated string (4 byte) */
 366                         str = va_arg(args,char*);
 367                         stringneeded = (str ? strlen(str)+1 : 0);
 368                         is_string = 1;
 369                         break;
 370                 case 'l':                       /* offset to user data (4 byte) */
 371                         str = va_arg(args,char*);
 372                         stringneeded = va_arg(args,int);
 373                         is_string = 0;
 374                         break;
 375                 case 'b':                       /* offset to data (with counter) (4 byte) */
 376                         str = va_arg(args,char*);
 377                         stringneeded = get_counter(&p->curpos);
 378                         is_string = 0;
 379                         break;
 380         }
 381
 382         va_end(args);
 383         if (stringneeded >= 0) {
 384                 needed = 4;
 385                 if (p->buflen >= needed) {
 386                         stringused = stringneeded;
 387                         if (stringused > p->stringlen) {
 388                                 stringused = (is_string ? p->stringlen : 0);
 389                                 if (p->errcode == NERR_Success) {
 390                                         p->errcode = ERRmoredata;
 391                                 }
 392                         }
 393                         if (!stringused) {
 394                                 SIVAL(p->structbuf,0,0);
 395                         } else {
 396                                 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
 397                                 memcpy(p->stringbuf,str?str:"",stringused);
 398                                 if (is_string) {
 399                                         p->stringbuf[stringused-1] = '\0';
 400                                 }
 401                                 p->stringbuf += stringused;
 402                                 p->stringlen -= stringused;
 403                                 p->usedlen += stringused;
 404                         }
 405                 }
 406                 p->neededlen += stringneeded;
 407         }
 408
 409         p->neededlen += needed;
 410         if (p->buflen >= needed) {
 411                 p->structbuf += needed;
 412                 p->buflen -= needed;
 413                 p->usedlen += needed;
 414         } else {
 415                 if (p->errcode == NERR_Success) {
 416                         p->errcode = ERRmoredata;
 417                 }
 418         }
 419         return 1;
 420 }
 421
 422 #if CHECK_TYPES
 423 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
 424 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
 425 #else
 426 #define PACK(desc,t,v) package(desc,v)
 427 #define PACKl(desc,t,v,l) package(desc,v,l)
 428 #endif
 429
 430 static void PACKI(struct pack_desc* desc, const char *t,int v)
 431 {
 432         PACK(desc,t,v);
 433 }
 434
 435 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
 436 {
 437         PACK(desc,t,v);
 438 }
 439
 440 /****************************************************************************
 441  Get a print queue.
 442 ****************************************************************************/
 443
 444 static void PackDriverData(struct pack_desc* desc)
 445 {
 446         char drivdata[4+4+32];
 447         SIVAL(drivdata,0,sizeof drivdata); /* cb */
 448         SIVAL(drivdata,4,1000); /* lVersion */
 449         memset(drivdata+8,0,32);        /* szDeviceName */
 450         push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
 451         PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
 452 }
 453
 454 static int check_printq_info(struct pack_desc* desc,
 455                                 unsigned int uLevel, char *id1, char *id2)
 456 {
 457         desc->subformat = NULL;
 458         switch( uLevel ) {
 459                 case 0:
 460                         desc->format = "B13";
 461                         break;
 462                 case 1:
 463                         desc->format = "B13BWWWzzzzzWW";
 464                         break;
 465                 case 2:
 466                         desc->format = "B13BWWWzzzzzWN";
 467                         desc->subformat = "WB21BB16B10zWWzDDz";
 468                         break;
 469                 case 3:
 470                         desc->format = "zWWWWzzzzWWzzl";
 471                         break;
 472                 case 4:
 473                         desc->format = "zWWWWzzzzWNzzl";
 474                         desc->subformat = "WWzWWDDzz";
 475                         break;
 476                 case 5:
 477                         desc->format = "z";
 478                         break;
 479                 case 51:
 480                         desc->format = "K";
 481                         break;
 482                 case 52:
 483                         desc->format = "WzzzzzzzzN";
 484                         desc->subformat = "z";
 485                         break;
 486                 default:
 487                         DEBUG(0,("check_printq_info: invalid level %d\n",
 488                                 uLevel ));
 489                         return False;
 490         }
 491         if (id1 == NULL || strcmp(desc->format,id1) != 0) {
 492                 DEBUG(0,("check_printq_info: invalid format %s\n",
 493                         id1 ? id1 : "<NULL>" ));
 494                 return False;
 495         }
 496         if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
 497                 DEBUG(0,("check_printq_info: invalid subformat %s\n",
 498                         id2 ? id2 : "<NULL>" ));
 499                 return False;
 500         }
 501         return True;
 502 }
 503
 504
 505 #define RAP_JOB_STATUS_QUEUED 0
 506 #define RAP_JOB_STATUS_PAUSED 1
 507 #define RAP_JOB_STATUS_SPOOLING 2
 508 #define RAP_JOB_STATUS_PRINTING 3
 509 #define RAP_JOB_STATUS_PRINTED 4
 510
 511 #define RAP_QUEUE_STATUS_PAUSED 1
 512 #define RAP_QUEUE_STATUS_ERROR 2
 513
 514 /* turn a print job status into a on the wire status
 515 */
 516 static int printj_spoolss_status(int v)
 517 {
 518         if (v == JOB_STATUS_QUEUED)
 519                 return RAP_JOB_STATUS_QUEUED;
 520         if (v & JOB_STATUS_PAUSED)
 521                 return RAP_JOB_STATUS_PAUSED;
 522         if (v & JOB_STATUS_SPOOLING)
 523                 return RAP_JOB_STATUS_SPOOLING;
 524         if (v & JOB_STATUS_PRINTING)
 525                 return RAP_JOB_STATUS_PRINTING;
 526         return 0;
 527 }
 528
 529 /* turn a print queue status into a on the wire status
 530 */
 531 static int printq_spoolss_status(int v)
 532 {
 533         if (v == PRINTER_STATUS_OK)
 534                 return 0;
 535         if (v & PRINTER_STATUS_PAUSED)
 536                 return RAP_QUEUE_STATUS_PAUSED;
 537         return RAP_QUEUE_STATUS_ERROR;
 538 }
 539
 540 static void fill_spoolss_printjob_info(int uLevel,
 541                                        struct pack_desc *desc,
 542                                        struct spoolss_JobInfo2 *info2,
 543                                        int n)
 544 {
 545         time_t t = spoolss_Time_to_time_t(&info2->submitted);
 546
 547         /* the client expects localtime */
 548         t -= get_time_zone(t);
 549
 550         PACKI(desc,"W",pjobid_to_rap(info2->printer_name, info2->job_id)); /* uJobId */
 551         if (uLevel == 1) {
 552                 PACKS(desc,"B21", info2->user_name); /* szUserName */
 553                 PACKS(desc,"B","");             /* pad */
 554                 PACKS(desc,"B16","");   /* szNotifyName */
 555                 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
 556                 PACKS(desc,"z","");             /* pszParms */
 557                 PACKI(desc,"W",n+1);            /* uPosition */
 558                 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
 559                 PACKS(desc,"z","");             /* pszStatus */
 560                 PACKI(desc,"D", t); /* ulSubmitted */
 561                 PACKI(desc,"D", info2->size); /* ulSize */
 562                 PACKS(desc,"z", info2->document_name); /* pszComment */
 563         }
 564         if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
 565                 PACKI(desc,"W", info2->priority);               /* uPriority */
 566                 PACKS(desc,"z", info2->user_name); /* pszUserName */
 567                 PACKI(desc,"W",n+1);            /* uPosition */
 568                 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
 569                 PACKI(desc,"D",t); /* ulSubmitted */
 570                 PACKI(desc,"D", info2->size); /* ulSize */
 571                 PACKS(desc,"z","Samba");        /* pszComment */
 572                 PACKS(desc,"z", info2->document_name); /* pszDocument */
 573                 if (uLevel == 3) {
 574                         PACKS(desc,"z","");     /* pszNotifyName */
 575                         PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
 576                         PACKS(desc,"z","");     /* pszParms */
 577                         PACKS(desc,"z","");     /* pszStatus */
 578                         PACKS(desc,"z", info2->printer_name); /* pszQueue */
 579                         PACKS(desc,"z","lpd");  /* pszQProcName */
 580                         PACKS(desc,"z","");     /* pszQProcParms */
 581                         PACKS(desc,"z","NULL"); /* pszDriverName */
 582                         PackDriverData(desc);   /* pDriverData */
 583                         PACKS(desc,"z","");     /* pszPrinterName */
 584                 } else if (uLevel == 4) {   /* OS2 */
 585                         PACKS(desc,"z","");       /* pszSpoolFileName  */
 586                         PACKS(desc,"z","");       /* pszPortName       */
 587                         PACKS(desc,"z","");       /* pszStatus         */
 588                         PACKI(desc,"D",0);        /* ulPagesSpooled    */
 589                         PACKI(desc,"D",0);        /* ulPagesSent       */
 590                         PACKI(desc,"D",0);        /* ulPagesPrinted    */
 591                         PACKI(desc,"D",0);        /* ulTimePrinted     */
 592                         PACKI(desc,"D",0);        /* ulExtendJobStatus */
 593                         PACKI(desc,"D",0);        /* ulStartPage       */
 594                         PACKI(desc,"D",0);        /* ulEndPage         */
 595                 }
 596         }
 597 }
 598
 599 /********************************************************************
 600  Respond to the DosPrintQInfo command with a level of 52
 601  This is used to get printer driver information for Win9x clients
 602  ********************************************************************/
 603 static void fill_printq_info_52(struct spoolss_DriverInfo3 *driver,
 604                                 struct pack_desc* desc, int count,
 605                                 const char *printer_name)
 606 {
 607         int                             i;
 608         fstring                         location;
 609         trim_string((char *)driver->driver_path, "\\print$\\WIN40\\0\\", 0);
 610         trim_string((char *)driver->data_file, "\\print$\\WIN40\\0\\", 0);
 611         trim_string((char *)driver->help_file, "\\print$\\WIN40\\0\\", 0);
 612
 613         PACKI(desc, "W", 0x0400);                     /* don't know */
 614         PACKS(desc, "z", driver->driver_name);        /* long printer name */
 615         PACKS(desc, "z", driver->driver_path);  /* Driverfile Name */
 616         PACKS(desc, "z", driver->data_file);    /* Datafile name */
 617         PACKS(desc, "z", driver->monitor_name); /* language monitor */
 618
 619         fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
 620         standard_sub_basic( "", "", location, sizeof(location)-1 );
 621         PACKS(desc,"z", location);                          /* share to retrieve files */
 622
 623         PACKS(desc,"z", driver->default_datatype);    /* default data type */
 624         PACKS(desc,"z", driver->help_file);           /* helpfile name */
 625         PACKS(desc,"z", driver->driver_path);               /* driver name */
 626
 627         DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
 628         DEBUG(3,("Driver: %s:\n",driver->driver_path));
 629         DEBUG(3,("Data File: %s:\n",driver->data_file));
 630         DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
 631         DEBUG(3,("Driver Location: %s:\n",location));
 632         DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
 633         DEBUG(3,("Help File: %s:\n",driver->help_file));
 634         PACKI(desc,"N",count);                     /* number of files to copy */
 635
 636         for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
 637         {
 638                 trim_string((char *)driver->dependent_files[i], "\\print$\\WIN40\\0\\", 0);
 639                 PACKS(desc,"z",driver->dependent_files[i]);         /* driver files to copy */
 640                 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
 641         }
 642
 643         /* sanity check */
 644         if ( i != count )
 645                 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
 646                         count, i));
 647
 648         DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", printer_name, i));
 649
 650         desc->errcode=NERR_Success;
 651
 652 }
 653
 654 static const char *strip_unc(const char *unc)
 655 {
 656         char *p;
 657
 658         if (unc == NULL) {
 659                 return NULL;
 660         }
 661
 662         if ((p = strrchr(unc, '\\')) != NULL) {
 663                 return p+1;
 664         }
 665
 666         return unc;
 667 }
 668
 669 static void fill_printq_info(int uLevel,
 670                              struct pack_desc* desc,
 671                              int count,
 672                              union spoolss_JobInfo *job_info,
 673                              struct spoolss_DriverInfo3 *driver_info,
 674                              struct spoolss_PrinterInfo2 *printer_info)
 675 {
 676         switch (uLevel) {
 677         case 0:
 678         case 1:
 679         case 2:
 680                 PACKS(desc,"B13", strip_unc(printer_info->printername));
 681                 break;
 682         case 3:
 683         case 4:
 684         case 5:
 685                 PACKS(desc,"z", strip_unc(printer_info->printername));
 686                 break;
 687         case 51:
 688                 PACKI(desc,"K", printq_spoolss_status(printer_info->status));
 689                 break;
 690         }
 691
 692         if (uLevel == 1 || uLevel == 2) {
 693                 PACKS(desc,"B","");             /* alignment */
 694                 PACKI(desc,"W",5);              /* priority */
 695                 PACKI(desc,"W",0);              /* start time */
 696                 PACKI(desc,"W",0);              /* until time */
 697                 PACKS(desc,"z","");             /* pSepFile */
 698                 PACKS(desc,"z","lpd");  /* pPrProc */
 699                 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pDestinations */
 700                 PACKS(desc,"z","");             /* pParms */
 701                 if (printer_info->printername == NULL) {
 702                         PACKS(desc,"z","UNKNOWN PRINTER");
 703                         PACKI(desc,"W",LPSTAT_ERROR);
 704                 } else {
 705                         PACKS(desc,"z", printer_info->comment);
 706                         PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* status */
 707                 }
 708                 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
 709         }
 710
 711         if (uLevel == 3 || uLevel == 4) {
 712                 PACKI(desc,"W",5);              /* uPriority */
 713                 PACKI(desc,"W",0);              /* uStarttime */
 714                 PACKI(desc,"W",0);              /* uUntiltime */
 715                 PACKI(desc,"W",5);              /* pad1 */
 716                 PACKS(desc,"z","");             /* pszSepFile */
 717                 PACKS(desc,"z","WinPrint");     /* pszPrProc */
 718                 PACKS(desc,"z",NULL);           /* pszParms */
 719                 PACKS(desc,"z",NULL);           /* pszComment - don't ask.... JRA */
 720                 /* "don't ask" that it's done this way to fix corrupted
 721                    Win9X/ME printer comments. */
 722                 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* fsStatus */
 723                 PACKI(desc,(uLevel == 3 ? "W" : "N"),count);    /* cJobs */
 724                 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pszPrinters */
 725                 PACKS(desc,"z", printer_info->drivername);              /* pszDriverName */
 726                 PackDriverData(desc);   /* pDriverData */
 727         }
 728
 729         if (uLevel == 2 || uLevel == 4) {
 730                 int i;
 731                 for (i = 0; i < count; i++) {
 732                         fill_spoolss_printjob_info(uLevel == 2 ? 1 : 2, desc, &job_info[i].info2, i);
 733                 }
 734         }
 735
 736         if (uLevel==52)
 737                 fill_printq_info_52(driver_info, desc, count, printer_info->printername);
 738 }
 739
 740 /* This function returns the number of files for a given driver */
 741 static int get_printerdrivernumber(const struct spoolss_DriverInfo3 *driver)
 742 {
 743         int                             result = 0;
 744
 745         /* count the number of files */
 746         while (driver->dependent_files && *driver->dependent_files[result])
 747                 result++;
 748
 749         return result;
 750 }
 751
 752 static bool api_DosPrintQGetInfo(struct smbd_server_connection *sconn,
 753                                  connection_struct *conn, uint16 vuid,
 754                                 char *param, int tpscnt,
 755                                 char *data, int tdscnt,
 756                                 int mdrcnt,int mprcnt,
 757                                 char **rdata,char **rparam,
 758                                 int *rdata_len,int *rparam_len)
 759 {
 760         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
 761         char *str2 = skip_string(param,tpscnt,str1);
 762         char *p = skip_string(param,tpscnt,str2);
 763         char *QueueName = p;
 764         unsigned int uLevel;
 765         uint32_t count = 0;
 766         char *str3;
 767         struct pack_desc desc;
 768         char* tmpdata=NULL;
 769
 770         WERROR werr = WERR_OK;
 771         TALLOC_CTX *mem_ctx = talloc_tos();
 772         NTSTATUS status;
 773         struct rpc_pipe_client *cli = NULL;
 774         struct policy_handle handle;
 775         struct spoolss_DevmodeContainer devmode_ctr;
 776         union spoolss_DriverInfo driver_info;
 777         union spoolss_JobInfo *job_info = NULL;
 778         union spoolss_PrinterInfo printer_info;
 779
 780         if (!str1 || !str2 || !p) {
 781                 return False;
 782         }
 783         memset((char *)&desc,'\0',sizeof(desc));
 784
 785         p = skip_string(param,tpscnt,p);
 786         if (!p) {
 787                 return False;
 788         }
 789         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 790         str3 = get_safe_str_ptr(param,tpscnt,p,4);
 791         /* str3 may be null here and is checked in check_printq_info(). */
 792
 793         /* remove any trailing username */
 794         if ((p = strchr_m(QueueName,'%')))
 795                 *p = 0;
 796
 797         DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
 798
 799         /* check it's a supported varient */
 800         if (!prefix_ok(str1,"zWrLh"))
 801                 return False;
 802         if (!check_printq_info(&desc,uLevel,str2,str3)) {
 803                 /*
 804                  * Patch from Scott Moomaw <scott@bridgewater.edu>
 805                  * to return the 'invalid info level' error if an
 806                  * unknown level was requested.
 807                  */
 808                 *rdata_len = 0;
 809                 *rparam_len = 6;
 810                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
 811                 if (!*rparam) {
 812                         return False;
 813                 }
 814                 SSVALS(*rparam,0,ERRunknownlevel);
 815                 SSVAL(*rparam,2,0);
 816                 SSVAL(*rparam,4,0);
 817                 return(True);
 818         }
 819
 820         ZERO_STRUCT(handle);
 821
 822         if (QueueName == NULL || (strlen(QueueName) < 1)) {
 823                 desc.errcode = W_ERROR_V(WERR_INVALID_PARAM);
 824                 goto out;
 825         }
 826
 827         status = rpc_connect_spoolss_pipe(conn, &cli);
 828         if (!NT_STATUS_IS_OK(status)) {
 829                 DEBUG(0,("api_DosPrintQGetInfo: could not connect to spoolss: %s\n",
 830                           nt_errstr(status)));
 831                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
 832                 goto out;
 833         }
 834
 835         ZERO_STRUCT(devmode_ctr);
 836
 837         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
 838                                             QueueName,
 839                                             "RAW",
 840                                             devmode_ctr,
 841                                             PRINTER_ACCESS_USE,
 842                                             &handle,
 843                                             &werr);
 844         if (!NT_STATUS_IS_OK(status)) {
 845                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
 846                 goto out;
 847         }
 848         if (!W_ERROR_IS_OK(werr)) {
 849                 desc.errcode = W_ERROR_V(werr);
 850                 goto out;
 851         }
 852
 853         werr = rpccli_spoolss_getprinter(cli, mem_ctx,
 854                                          &handle,
 855                                          2,
 856                                          0,
 857                                          &printer_info);
 858         if (!W_ERROR_IS_OK(werr)) {
 859                 desc.errcode = W_ERROR_V(werr);
 860                 goto out;
 861         }
 862
 863         if (uLevel==52) {
 864                 uint32_t server_major_version;
 865                 uint32_t server_minor_version;
 866
 867                 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
 868                                                         &handle,
 869                                                         "Windows 4.0",
 870                                                         3, /* level */
 871                                                         0,
 872                                                         0, /* version */
 873                                                         0,
 874                                                         &driver_info,
 875                                                         &server_major_version,
 876                                                         &server_minor_version);
 877                 if (!W_ERROR_IS_OK(werr)) {
 878                         desc.errcode = W_ERROR_V(werr);
 879                         goto out;
 880                 }
 881
 882                 count = get_printerdrivernumber(&driver_info.info3);
 883                 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
 884         } else {
 885                 uint32_t num_jobs;
 886                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
 887                                                &handle,
 888                                                0, /* firstjob */
 889                                                0xff, /* numjobs */
 890                                                2, /* level */
 891                                                0, /* offered */
 892                                                &num_jobs,
 893                                                &job_info);
 894                 if (!W_ERROR_IS_OK(werr)) {
 895                         desc.errcode = W_ERROR_V(werr);
 896                         goto out;
 897                 }
 898
 899                 count = num_jobs;
 900         }
 901
 902         if (mdrcnt > 0) {
 903                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
 904                 if (!*rdata) {
 905                         return False;
 906                 }
 907                 desc.base = *rdata;
 908                 desc.buflen = mdrcnt;
 909         } else {
 910                 /*
 911                  * Don't return data but need to get correct length
 912                  * init_package will return wrong size if buflen=0
 913                  */
 914                 desc.buflen = getlen(desc.format);
 915                 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
 916         }
 917
 918         if (init_package(&desc,1,count)) {
 919                 desc.subcount = count;
 920                 fill_printq_info(uLevel,&desc,count, job_info, &driver_info.info3, &printer_info.info2);
 921         }
 922
 923         *rdata_len = desc.usedlen;
 924
 925         /*
 926          * We must set the return code to ERRbuftoosmall
 927          * in order to support lanman style printing with Win NT/2k
 928          * clients       --jerry
 929          */
 930         if (!mdrcnt && lp_disable_spoolss())
 931                 desc.errcode = ERRbuftoosmall;
 932
 933  out:
 934         if (cli && is_valid_policy_hnd(&handle)) {
 935                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
 936         }
 937
 938         *rdata_len = desc.usedlen;
 939         *rparam_len = 6;
 940         *rparam = smb_realloc_limit(*rparam,*rparam_len);
 941         if (!*rparam) {
 942                 SAFE_FREE(tmpdata);
 943                 return False;
 944         }
 945         SSVALS(*rparam,0,desc.errcode);
 946         SSVAL(*rparam,2,0);
 947         SSVAL(*rparam,4,desc.neededlen);
 948
 949         DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
 950
 951         SAFE_FREE(tmpdata);
 952
 953         return(True);
 954 }
 955
 956 /****************************************************************************
 957  View list of all print jobs on all queues.
 958 ****************************************************************************/
 959
 960 static bool api_DosPrintQEnum(struct smbd_server_connection *sconn,
 961                               connection_struct *conn, uint16 vuid,
 962                                 char *param, int tpscnt,
 963                                 char *data, int tdscnt,
 964                                 int mdrcnt, int mprcnt,
 965                                 char **rdata, char** rparam,
 966                                 int *rdata_len, int *rparam_len)
 967 {
 968         char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
 969         char *output_format1 = skip_string(param,tpscnt,param_format);
 970         char *p = skip_string(param,tpscnt,output_format1);
 971         unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 972         char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
 973         int i;
 974         struct pack_desc desc;
 975         int *subcntarr = NULL;
 976         int queuecnt = 0, subcnt = 0, succnt = 0;
 977
 978         WERROR werr = WERR_OK;
 979         TALLOC_CTX *mem_ctx = talloc_tos();
 980         NTSTATUS status;
 981         struct rpc_pipe_client *cli = NULL;
 982         struct spoolss_DevmodeContainer devmode_ctr;
 983         uint32_t num_printers;
 984         union spoolss_PrinterInfo *printer_info;
 985         union spoolss_DriverInfo *driver_info;
 986         union spoolss_JobInfo **job_info;
 987
 988         if (!param_format || !output_format1 || !p) {
 989                 return False;
 990         }
 991
 992         memset((char *)&desc,'\0',sizeof(desc));
 993
 994         DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
 995
 996         if (!prefix_ok(param_format,"WrLeh")) {
 997                 return False;
 998         }
 999         if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1000                 /*
1001                  * Patch from Scott Moomaw <scott@bridgewater.edu>
1002                  * to return the 'invalid info level' error if an
1003                  * unknown level was requested.
1004                  */
1005                 *rdata_len = 0;
1006                 *rparam_len = 6;
1007                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1008                 if (!*rparam) {
1009                         return False;
1010                 }
1011                 SSVALS(*rparam,0,ERRunknownlevel);
1012                 SSVAL(*rparam,2,0);
1013                 SSVAL(*rparam,4,0);
1014                 return(True);
1015         }
1016
1017         status = rpc_connect_spoolss_pipe(conn, &cli);
1018         if (!NT_STATUS_IS_OK(status)) {
1019                 DEBUG(0,("api_DosPrintQEnum: could not connect to spoolss: %s\n",
1020                           nt_errstr(status)));
1021                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1022                 goto out;
1023         }
1024
1025         werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
1026                                            PRINTER_ENUM_LOCAL,
1027                                            cli->srv_name_slash,
1028                                            2,
1029                                            0,
1030                                            &num_printers,
1031                                            &printer_info);
1032         if (!W_ERROR_IS_OK(werr)) {
1033                 desc.errcode = W_ERROR_V(werr);
1034                 goto out;
1035         }
1036
1037         queuecnt = num_printers;
1038
1039         job_info = talloc_array(mem_ctx, union spoolss_JobInfo *, num_printers);
1040         if (job_info == NULL) {
1041                 goto err;
1042         }
1043
1044         driver_info = talloc_array(mem_ctx, union spoolss_DriverInfo, num_printers);
1045         if (driver_info == NULL) {
1046                 goto err;
1047         }
1048
1049         if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1050                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1051                 goto err;
1052         }
1053
1054         if (mdrcnt > 0) {
1055                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1056                 if (!*rdata) {
1057                         goto err;
1058                 }
1059         }
1060         desc.base = *rdata;
1061         desc.buflen = mdrcnt;
1062
1063         subcnt = 0;
1064         for (i = 0; i < num_printers; i++) {
1065
1066                 uint32_t num_jobs;
1067                 struct policy_handle handle;
1068                 const char *printername;
1069
1070                 printername = talloc_strdup(mem_ctx, printer_info[i].info2.printername);
1071                 if (printername == NULL) {
1072                         goto err;
1073                 }
1074
1075                 ZERO_STRUCT(handle);
1076                 ZERO_STRUCT(devmode_ctr);
1077
1078                 status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
1079                                                     printername,
1080                                                     "RAW",
1081                                                     devmode_ctr,
1082                                                     PRINTER_ACCESS_USE,
1083                                                     &handle,
1084                                                     &werr);
1085                 if (!NT_STATUS_IS_OK(status)) {
1086                         desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1087                         goto out;
1088                 }
1089                 if (!W_ERROR_IS_OK(werr)) {
1090                         desc.errcode = W_ERROR_V(werr);
1091                         goto out;
1092                 }
1093
1094                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
1095                                                &handle,
1096                                                0, /* firstjob */
1097                                                0xff, /* numjobs */
1098                                                2, /* level */
1099                                                0, /* offered */
1100                                                &num_jobs,
1101                                                &job_info[i]);
1102                 if (!W_ERROR_IS_OK(werr)) {
1103                         desc.errcode = W_ERROR_V(werr);
1104                         goto out;
1105                 }
1106
1107                 if (uLevel==52) {
1108                         uint32_t server_major_version;
1109                         uint32_t server_minor_version;
1110
1111                         werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
1112                                                                 &handle,
1113                                                                 "Windows 4.0",
1114                                                                 3, /* level */
1115                                                                 0,
1116                                                                 0, /* version */
1117                                                                 0,
1118                                                                 &driver_info[i],
1119                                                                 &server_major_version,
1120                                                                 &server_minor_version);
1121                         if (!W_ERROR_IS_OK(werr)) {
1122                                 desc.errcode = W_ERROR_V(werr);
1123                                 goto out;
1124                         }
1125                 }
1126
1127                 subcntarr[i] = num_jobs;
1128                 subcnt += subcntarr[i];
1129
1130                 if (cli && is_valid_policy_hnd(&handle)) {
1131                         rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
1132                 }
1133         }
1134
1135         if (init_package(&desc,queuecnt,subcnt)) {
1136                 for (i = 0; i < num_printers; i++) {
1137                         fill_printq_info(uLevel,&desc,subcntarr[i], job_info[i], &driver_info[i].info3, &printer_info[i].info2);
1138                         if (desc.errcode == NERR_Success) {
1139                                 succnt = i;
1140                         }
1141                 }
1142         }
1143
1144         SAFE_FREE(subcntarr);
1145  out:
1146         *rdata_len = desc.usedlen;
1147         *rparam_len = 8;
1148         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1149         if (!*rparam) {
1150                 goto err;
1151         }
1152         SSVALS(*rparam,0,desc.errcode);
1153         SSVAL(*rparam,2,0);
1154         SSVAL(*rparam,4,succnt);
1155         SSVAL(*rparam,6,queuecnt);
1156
1157         return True;
1158
1159   err:
1160
1161         SAFE_FREE(subcntarr);
1162
1163         return False;
1164 }
1165
1166 /****************************************************************************
1167  Get info level for a server list query.
1168 ****************************************************************************/
1169
1170 static bool check_server_info(int uLevel, char* id)
1171 {
1172         switch( uLevel ) {
1173                 case 0:
1174                         if (strcmp(id,"B16") != 0) {
1175                                 return False;
1176                         }
1177                         break;
1178                 case 1:
1179                         if (strcmp(id,"B16BBDz") != 0) {
1180                                 return False;
1181                         }
1182                         break;
1183                 default:
1184                         return False;
1185         }
1186         return True;
1187 }
1188
1189 struct srv_info_struct {
1190         fstring name;
1191         uint32 type;
1192         fstring comment;
1193         fstring domain;
1194         bool server_added;
1195 };
1196
1197 /*******************************************************************
1198  Get server info lists from the files saved by nmbd. Return the
1199  number of entries.
1200 ******************************************************************/
1201
1202 static int get_server_info(uint32 servertype,
1203                            struct srv_info_struct **servers,
1204                            const char *domain)
1205 {
1206         int count=0;
1207         int alloced=0;
1208         char **lines;
1209         bool local_list_only;
1210         int i;
1211
1212         lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1213         if (!lines) {
1214                 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1215                 return 0;
1216         }
1217
1218         /* request for everything is code for request all servers */
1219         if (servertype == SV_TYPE_ALL) {
1220                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1221         }
1222
1223         local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1224
1225         DEBUG(4,("Servertype search: %8x\n",servertype));
1226
1227         for (i=0;lines[i];i++) {
1228                 fstring stype;
1229                 struct srv_info_struct *s;
1230                 const char *ptr = lines[i];
1231                 bool ok = True;
1232                 TALLOC_CTX *frame = NULL;
1233                 char *p;
1234
1235                 if (!*ptr) {
1236                         continue;
1237                 }
1238
1239                 if (count == alloced) {
1240                         alloced += 10;
1241                         *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1242                         if (!*servers) {
1243                                 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1244                                 TALLOC_FREE(lines);
1245                                 return 0;
1246                         }
1247                         memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1248                 }
1249                 s = &(*servers)[count];
1250
1251                 frame = talloc_stackframe();
1252                 s->name[0] = '\0';
1253                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1254                         TALLOC_FREE(frame);
1255                         continue;
1256                 }
1257                 fstrcpy(s->name, p);
1258
1259                 stype[0] = '\0';
1260                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1261                         TALLOC_FREE(frame);
1262                         continue;
1263                 }
1264                 fstrcpy(stype, p);
1265
1266                 s->comment[0] = '\0';
1267                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1268                         TALLOC_FREE(frame);
1269                         continue;
1270                 }
1271                 fstrcpy(s->comment, p);
1272                 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1273
1274                 s->domain[0] = '\0';
1275                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1276                         /* this allows us to cope with an old nmbd */
1277                         fstrcpy(s->domain,lp_workgroup());
1278                 } else {
1279                         fstrcpy(s->domain, p);
1280                 }
1281                 TALLOC_FREE(frame);
1282
1283                 if (sscanf(stype,"%X",&s->type) != 1) {
1284                         DEBUG(4,("r:host file "));
1285                         ok = False;
1286                 }
1287
1288                 /* Filter the servers/domains we return based on what was asked for. */
1289
1290                 /* Check to see if we are being asked for a local list only. */
1291                 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1292                         DEBUG(4,("r: local list only"));
1293                         ok = False;
1294                 }
1295
1296                 /* doesn't match up: don't want it */
1297                 if (!(servertype & s->type)) {
1298                         DEBUG(4,("r:serv type "));
1299                         ok = False;
1300                 }
1301
1302                 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1303                                 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1304                         DEBUG(4,("s: dom mismatch "));
1305                         ok = False;
1306                 }
1307
1308                 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1309                         ok = False;
1310                 }
1311
1312                 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1313                 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1314
1315                 if (ok) {
1316                         DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1317                                 s->name, s->type, s->comment, s->domain));
1318                         s->server_added = True;
1319                         count++;
1320                 } else {
1321                         DEBUG(4,("%20s %8x %25s %15s\n",
1322                                 s->name, s->type, s->comment, s->domain));
1323                 }
1324         }
1325
1326         TALLOC_FREE(lines);
1327         return count;
1328 }
1329
1330 /*******************************************************************
1331  Fill in a server info structure.
1332 ******************************************************************/
1333
1334 static int fill_srv_info(struct srv_info_struct *service,
1335                          int uLevel, char **buf, int *buflen,
1336                          char **stringbuf, int *stringspace, char *baseaddr)
1337 {
1338         int struct_len;
1339         char* p;
1340         char* p2;
1341         int l2;
1342         int len;
1343
1344         switch (uLevel) {
1345                 case 0:
1346                         struct_len = 16;
1347                         break;
1348                 case 1:
1349                         struct_len = 26;
1350                         break;
1351                 default:
1352                         return -1;
1353         }
1354
1355         if (!buf) {
1356                 len = 0;
1357                 switch (uLevel) {
1358                         case 1:
1359                                 len = strlen(service->comment)+1;
1360                                 break;
1361                 }
1362
1363                 *buflen = struct_len;
1364                 *stringspace = len;
1365                 return struct_len + len;
1366         }
1367
1368         len = struct_len;
1369         p = *buf;
1370         if (*buflen < struct_len) {
1371                 return -1;
1372         }
1373         if (stringbuf) {
1374                 p2 = *stringbuf;
1375                 l2 = *stringspace;
1376         } else {
1377                 p2 = p + struct_len;
1378                 l2 = *buflen - struct_len;
1379         }
1380         if (!baseaddr) {
1381                 baseaddr = p;
1382         }
1383
1384         switch (uLevel) {
1385                 case 0:
1386                         push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1387                         break;
1388
1389                 case 1:
1390                         push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1391                         SIVAL(p,18,service->type);
1392                         SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1393                         len += CopyAndAdvance(&p2,service->comment,&l2);
1394                         break;
1395         }
1396
1397         if (stringbuf) {
1398                 *buf = p + struct_len;
1399                 *buflen -= struct_len;
1400                 *stringbuf = p2;
1401                 *stringspace = l2;
1402         } else {
1403                 *buf = p2;
1404                 *buflen -= len;
1405         }
1406         return len;
1407 }
1408
1409
1410 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1411 {
1412         return StrCaseCmp(s1->name,s2->name);
1413 }
1414
1415 /****************************************************************************
1416  View list of servers available (or possibly domains). The info is
1417  extracted from lists saved by nmbd on the local host.
1418 ****************************************************************************/
1419
1420 static bool api_RNetServerEnum2(struct smbd_server_connection *sconn,
1421                                 connection_struct *conn, uint16 vuid,
1422                                 char *param, int tpscnt,
1423                                 char *data, int tdscnt,
1424                                 int mdrcnt, int mprcnt, char **rdata,
1425                                 char **rparam, int *rdata_len, int *rparam_len)
1426 {
1427         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1428         char *str2 = skip_string(param,tpscnt,str1);
1429         char *p = skip_string(param,tpscnt,str2);
1430         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1431         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1432         uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1433         char *p2;
1434         int data_len, fixed_len, string_len;
1435         int f_len = 0, s_len = 0;
1436         struct srv_info_struct *servers=NULL;
1437         int counted=0,total=0;
1438         int i,missed;
1439         fstring domain;
1440         bool domain_request;
1441         bool local_request;
1442
1443         if (!str1 || !str2 || !p) {
1444                 return False;
1445         }
1446
1447         /* If someone sets all the bits they don't really mean to set
1448            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1449            known servers. */
1450
1451         if (servertype == SV_TYPE_ALL) {
1452                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1453         }
1454
1455         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1456            any other bit (they may just set this bit on its own) they
1457            want all the locally seen servers. However this bit can be
1458            set on its own so set the requested servers to be
1459            ALL - DOMAIN_ENUM. */
1460
1461         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1462                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1463         }
1464
1465         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1466         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1467
1468         p += 8;
1469
1470         if (!prefix_ok(str1,"WrLehD")) {
1471                 return False;
1472         }
1473         if (!check_server_info(uLevel,str2)) {
1474                 return False;
1475         }
1476
1477         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1478         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1479         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1480
1481         if (strcmp(str1, "WrLehDz") == 0) {
1482                 if (skip_string(param,tpscnt,p) == NULL) {
1483                         return False;
1484                 }
1485                 pull_ascii_fstring(domain, p);
1486         } else {
1487                 fstrcpy(domain, lp_workgroup());
1488         }
1489
1490         DEBUG(4, ("domain [%s]\n", domain));
1491
1492         if (lp_browse_list()) {
1493                 total = get_server_info(servertype,&servers,domain);
1494         }
1495
1496         data_len = fixed_len = string_len = 0;
1497         missed = 0;
1498
1499         TYPESAFE_QSORT(servers, total, srv_comp);
1500
1501         {
1502                 char *lastname=NULL;
1503
1504                 for (i=0;i<total;i++) {
1505                         struct srv_info_struct *s = &servers[i];
1506
1507                         if (lastname && strequal(lastname,s->name)) {
1508                                 continue;
1509                         }
1510                         lastname = s->name;
1511                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1512                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1513                                 i, s->name, s->type, s->comment, s->domain));
1514
1515                         if (data_len < buf_len) {
1516                                 counted++;
1517                                 fixed_len += f_len;
1518                                 string_len += s_len;
1519                         } else {
1520                                 missed++;
1521                         }
1522                 }
1523         }
1524
1525         *rdata_len = fixed_len + string_len;
1526         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1527         if (!*rdata) {
1528                 return False;
1529         }
1530
1531         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1532         p = *rdata;
1533         f_len = fixed_len;
1534         s_len = string_len;
1535
1536         {
1537                 char *lastname=NULL;
1538                 int count2 = counted;
1539
1540                 for (i = 0; i < total && count2;i++) {
1541                         struct srv_info_struct *s = &servers[i];
1542
1543                         if (lastname && strequal(lastname,s->name)) {
1544                                 continue;
1545                         }
1546                         lastname = s->name;
1547                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1548                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1549                                 i, s->name, s->type, s->comment, s->domain));
1550                         count2--;
1551                 }
1552         }
1553
1554         *rparam_len = 8;
1555         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1556         if (!*rparam) {
1557                 return False;
1558         }
1559         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1560         SSVAL(*rparam,2,0);
1561         SSVAL(*rparam,4,counted);
1562         SSVAL(*rparam,6,counted+missed);
1563
1564         SAFE_FREE(servers);
1565
1566         DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1567                 domain,uLevel,counted,counted+missed));
1568
1569         return True;
1570 }
1571
1572 static int srv_name_match(const char *n1, const char *n2)
1573 {
1574         /*
1575          * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1576          *
1577          *  In Windows, FirstNameToReturn need not be an exact match:
1578          *  the server will return a list of servers that exist on
1579          *  the network greater than or equal to the FirstNameToReturn.
1580          */
1581         int ret = StrCaseCmp(n1, n2);
1582
1583         if (ret <= 0) {
1584                 return 0;
1585         }
1586
1587         return ret;
1588 }
1589
1590 static bool api_RNetServerEnum3(struct smbd_server_connection *sconn,
1591                                 connection_struct *conn, uint16 vuid,
1592                                 char *param, int tpscnt,
1593                                 char *data, int tdscnt,
1594                                 int mdrcnt, int mprcnt, char **rdata,
1595                                 char **rparam, int *rdata_len, int *rparam_len)
1596 {
1597         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1598         char *str2 = skip_string(param,tpscnt,str1);
1599         char *p = skip_string(param,tpscnt,str2);
1600         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1601         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1602         uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1603         char *p2;
1604         int data_len, fixed_len, string_len;
1605         int f_len = 0, s_len = 0;
1606         struct srv_info_struct *servers=NULL;
1607         int counted=0,first=0,total=0;
1608         int i,missed;
1609         fstring domain;
1610         fstring first_name;
1611         bool domain_request;
1612         bool local_request;
1613
1614         if (!str1 || !str2 || !p) {
1615                 return False;
1616         }
1617
1618         /* If someone sets all the bits they don't really mean to set
1619            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1620            known servers. */
1621
1622         if (servertype == SV_TYPE_ALL) {
1623                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1624         }
1625
1626         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1627            any other bit (they may just set this bit on its own) they
1628            want all the locally seen servers. However this bit can be
1629            set on its own so set the requested servers to be
1630            ALL - DOMAIN_ENUM. */
1631
1632         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1633                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1634         }
1635
1636         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1637         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1638
1639         p += 8;
1640
1641         if (strcmp(str1, "WrLehDzz") != 0) {
1642                 return false;
1643         }
1644         if (!check_server_info(uLevel,str2)) {
1645                 return False;
1646         }
1647
1648         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1649         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1650         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1651
1652         if (skip_string(param,tpscnt,p) == NULL) {
1653                 return False;
1654         }
1655         pull_ascii_fstring(domain, p);
1656         if (domain[0] == '\0') {
1657                 fstrcpy(domain, lp_workgroup());
1658         }
1659         p = skip_string(param,tpscnt,p);
1660         if (skip_string(param,tpscnt,p) == NULL) {
1661                 return False;
1662         }
1663         pull_ascii_fstring(first_name, p);
1664
1665         DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1666                   domain, first_name));
1667
1668         if (lp_browse_list()) {
1669                 total = get_server_info(servertype,&servers,domain);
1670         }
1671
1672         data_len = fixed_len = string_len = 0;
1673         missed = 0;
1674
1675         TYPESAFE_QSORT(servers, total, srv_comp);
1676
1677         if (first_name[0] != '\0') {
1678                 struct srv_info_struct *first_server = NULL;
1679
1680                 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1681                                     srv_name_match, first_server);
1682                 if (first_server) {
1683                         first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1684                         /*
1685                          * The binary search may not find the exact match
1686                          * so we need to search backward to find the first match
1687                          *
1688                          * This implements the strange matching windows
1689                          * implements. (see the comment in srv_name_match().
1690                          */
1691                         for (;first > 0;) {
1692                                 int ret;
1693                                 ret = StrCaseCmp(first_name,
1694                                                  servers[first-1].name);
1695                                 if (ret > 0) {
1696                                         break;
1697                                 }
1698                                 first--;
1699                         }
1700                 } else {
1701                         /* we should return no entries */
1702                         first = total;
1703                 }
1704         }
1705
1706         {
1707                 char *lastname=NULL;
1708
1709                 for (i=first;i<total;i++) {
1710                         struct srv_info_struct *s = &servers[i];
1711
1712                         if (lastname && strequal(lastname,s->name)) {
1713                                 continue;
1714                         }
1715                         lastname = s->name;
1716                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1717                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1718                                 i, s->name, s->type, s->comment, s->domain));
1719
1720                         if (data_len < buf_len) {
1721                                 counted++;
1722                                 fixed_len += f_len;
1723                                 string_len += s_len;
1724                         } else {
1725                                 missed++;
1726                         }
1727                 }
1728         }
1729
1730         *rdata_len = fixed_len + string_len;
1731         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1732         if (!*rdata) {
1733                 return False;
1734         }
1735
1736         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1737         p = *rdata;
1738         f_len = fixed_len;
1739         s_len = string_len;
1740
1741         {
1742                 char *lastname=NULL;
1743                 int count2 = counted;
1744
1745                 for (i = first; i < total && count2;i++) {
1746                         struct srv_info_struct *s = &servers[i];
1747
1748                         if (lastname && strequal(lastname,s->name)) {
1749                                 continue;
1750                         }
1751                         lastname = s->name;
1752                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1753                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1754                                 i, s->name, s->type, s->comment, s->domain));
1755                         count2--;
1756                 }
1757         }
1758
1759         *rparam_len = 8;
1760         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1761         if (!*rparam) {
1762                 return False;
1763         }
1764         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1765         SSVAL(*rparam,2,0);
1766         SSVAL(*rparam,4,counted);
1767         SSVAL(*rparam,6,counted+missed);
1768
1769         DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1770                 domain,uLevel,first,first_name,
1771                 first < total ? servers[first].name : "",
1772                 counted,counted+missed));
1773
1774         SAFE_FREE(servers);
1775
1776         return True;
1777 }
1778
1779 /****************************************************************************
1780   command 0x34 - suspected of being a "Lookup Names" stub api
1781   ****************************************************************************/
1782
1783 static bool api_RNetGroupGetUsers(struct smbd_server_connection *sconn,
1784                                   connection_struct *conn, uint16 vuid,
1785                                 char *param, int tpscnt,
1786                                 char *data, int tdscnt,
1787                                 int mdrcnt, int mprcnt, char **rdata,
1788                                 char **rparam, int *rdata_len, int *rparam_len)
1789 {
1790         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1791         char *str2 = skip_string(param,tpscnt,str1);
1792         char *p = skip_string(param,tpscnt,str2);
1793         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1794         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1795         int counted=0;
1796         int missed=0;
1797
1798         if (!str1 || !str2 || !p) {
1799                 return False;
1800         }
1801
1802         DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1803                 str1, str2, p, uLevel, buf_len));
1804
1805         if (!prefix_ok(str1,"zWrLeh")) {
1806                 return False;
1807         }
1808
1809         *rdata_len = 0;
1810
1811         *rparam_len = 8;
1812         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1813         if (!*rparam) {
1814                 return False;
1815         }
1816
1817         SSVAL(*rparam,0,0x08AC); /* informational warning message */
1818         SSVAL(*rparam,2,0);
1819         SSVAL(*rparam,4,counted);
1820         SSVAL(*rparam,6,counted+missed);
1821
1822         return True;
1823 }
1824
1825 /****************************************************************************
1826   get info about a share
1827   ****************************************************************************/
1828
1829 static bool check_share_info(int uLevel, char* id)
1830 {
1831         switch( uLevel ) {
1832                 case 0:
1833                         if (strcmp(id,"B13") != 0) {
1834                                 return False;
1835                         }
1836                         break;
1837                 case 1:
1838                         /* Level-2 descriptor is allowed (and ignored) */
1839                         if (strcmp(id,"B13BWz") != 0 &&
1840                             strcmp(id,"B13BWzWWWzB9B") != 0) {
1841                                 return False;
1842                         }
1843                         break;
1844                 case 2:
1845                         if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1846                                 return False;
1847                         }
1848                         break;
1849                 case 91:
1850                         if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1851                                 return False;
1852                         }
1853                         break;
1854                 default:
1855                         return False;
1856         }
1857         return True;
1858 }
1859
1860 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1861                            char** buf, int* buflen,
1862                            char** stringbuf, int* stringspace, char* baseaddr)
1863 {
1864         int struct_len;
1865         char* p;
1866         char* p2;
1867         int l2;
1868         int len;
1869
1870         switch( uLevel ) {
1871                 case 0:
1872                         struct_len = 13;
1873                         break;
1874                 case 1:
1875                         struct_len = 20;
1876                         break;
1877                 case 2:
1878                         struct_len = 40;
1879                         break;
1880                 case 91:
1881                         struct_len = 68;
1882                         break;
1883                 default:
1884                         return -1;
1885         }
1886
1887         if (!buf) {
1888                 len = 0;
1889
1890                 if (uLevel > 0) {
1891                         len += StrlenExpanded(conn,snum,lp_comment(snum));
1892                 }
1893                 if (uLevel > 1) {
1894                         len += strlen(lp_pathname(snum)) + 1;
1895                 }
1896                 if (buflen) {
1897                         *buflen = struct_len;
1898                 }
1899                 if (stringspace) {
1900                         *stringspace = len;
1901                 }
1902                 return struct_len + len;
1903         }
1904
1905         len = struct_len;
1906         p = *buf;
1907         if ((*buflen) < struct_len) {
1908                 return -1;
1909         }
1910
1911         if (stringbuf) {
1912                 p2 = *stringbuf;
1913                 l2 = *stringspace;
1914         } else {
1915                 p2 = p + struct_len;
1916                 l2 = (*buflen) - struct_len;
1917         }
1918
1919         if (!baseaddr) {
1920                 baseaddr = p;
1921         }
1922
1923         push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1924
1925         if (uLevel > 0) {
1926                 int type;
1927
1928                 SCVAL(p,13,0);
1929                 type = STYPE_DISKTREE;
1930                 if (lp_print_ok(snum)) {
1931                         type = STYPE_PRINTQ;
1932                 }
1933                 if (strequal("IPC",lp_fstype(snum))) {
1934                         type = STYPE_IPC;
1935                 }
1936                 SSVAL(p,14,type);               /* device type */
1937                 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1938                 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1939         }
1940
1941         if (uLevel > 1) {
1942                 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1943                 SSVALS(p,22,-1);                /* max uses */
1944                 SSVAL(p,24,1); /* current uses */
1945                 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1946                 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1947                 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1948         }
1949
1950         if (uLevel > 2) {
1951                 memset(p+40,0,SHPWLEN+2);
1952                 SSVAL(p,50,0);
1953                 SIVAL(p,52,0);
1954                 SSVAL(p,56,0);
1955                 SSVAL(p,58,0);
1956                 SIVAL(p,60,0);
1957                 SSVAL(p,64,0);
1958                 SSVAL(p,66,0);
1959         }
1960
1961         if (stringbuf) {
1962                 (*buf) = p + struct_len;
1963                 (*buflen) -= struct_len;
1964                 (*stringbuf) = p2;
1965                 (*stringspace) = l2;
1966         } else {
1967                 (*buf) = p2;
1968                 (*buflen) -= len;
1969         }
1970
1971         return len;
1972 }
1973
1974 static bool api_RNetShareGetInfo(struct smbd_server_connection *sconn,
1975                                  connection_struct *conn,uint16 vuid,
1976                                 char *param, int tpscnt,
1977                                 char *data, int tdscnt,
1978                                 int mdrcnt,int mprcnt,
1979                                 char **rdata,char **rparam,
1980                                 int *rdata_len,int *rparam_len)
1981 {
1982         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1983         char *str2 = skip_string(param,tpscnt,str1);
1984         char *netname = skip_string(param,tpscnt,str2);
1985         char *p = skip_string(param,tpscnt,netname);
1986         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1987         int snum;
1988
1989         if (!str1 || !str2 || !netname || !p) {
1990                 return False;
1991         }
1992
1993         snum = find_service(netname);
1994         if (snum < 0) {
1995                 return False;
1996         }
1997
1998         /* check it's a supported varient */
1999         if (!prefix_ok(str1,"zWrLh")) {
2000                 return False;
2001         }
2002         if (!check_share_info(uLevel,str2)) {
2003                 return False;
2004         }
2005
2006         *rdata = smb_realloc_limit(*rdata,mdrcnt);
2007         if (!*rdata) {
2008                 return False;
2009         }
2010         p = *rdata;
2011         *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
2012         if (*rdata_len < 0) {
2013                 return False;
2014         }
2015
2016         *rparam_len = 6;
2017         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2018         if (!*rparam) {
2019                 return False;
2020         }
2021         SSVAL(*rparam,0,NERR_Success);
2022         SSVAL(*rparam,2,0);             /* converter word */
2023         SSVAL(*rparam,4,*rdata_len);
2024
2025         return True;
2026 }
2027
2028 /****************************************************************************
2029   View the list of available shares.
2030
2031   This function is the server side of the NetShareEnum() RAP call.
2032   It fills the return buffer with share names and share comments.
2033   Note that the return buffer normally (in all known cases) allows only
2034   twelve byte strings for share names (plus one for a nul terminator).
2035   Share names longer than 12 bytes must be skipped.
2036  ****************************************************************************/
2037
2038 static bool api_RNetShareEnum(struct smbd_server_connection *sconn,
2039                               connection_struct *conn, uint16 vuid,
2040                                 char *param, int tpscnt,
2041                                 char *data, int tdscnt,
2042                                 int                mdrcnt,
2043                                 int                mprcnt,
2044                                 char             **rdata,
2045                                 char             **rparam,
2046                                 int               *rdata_len,
2047                                 int               *rparam_len )
2048 {
2049         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2050         char *str2 = skip_string(param,tpscnt,str1);
2051         char *p = skip_string(param,tpscnt,str2);
2052         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2053         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
2054         char *p2;
2055         int count = 0;
2056         int total=0,counted=0;
2057         bool missed = False;
2058         int i;
2059         int data_len, fixed_len, string_len;
2060         int f_len = 0, s_len = 0;
2061
2062         if (!str1 || !str2 || !p) {
2063                 return False;
2064         }
2065
2066         if (!prefix_ok(str1,"WrLeh")) {
2067                 return False;
2068         }
2069         if (!check_share_info(uLevel,str2)) {
2070                 return False;
2071         }
2072
2073         /* Ensure all the usershares are loaded. */
2074         become_root();
2075         load_registry_shares();
2076         count = load_usershare_shares();
2077         unbecome_root();
2078
2079         data_len = fixed_len = string_len = 0;
2080         for (i=0;i<count;i++) {
2081                 fstring servicename_dos;
2082                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2083                         continue;
2084                 }
2085                 push_ascii_fstring(servicename_dos, lp_servicename(i));
2086                 /* Maximum name length = 13. */
2087                 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2088                         total++;
2089                         data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2090                         if (data_len < buf_len) {
2091                                 counted++;
2092                                 fixed_len += f_len;
2093                                 string_len += s_len;
2094                         } else {
2095                                 missed = True;
2096                         }
2097                 }
2098         }
2099
2100         *rdata_len = fixed_len + string_len;
2101         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2102         if (!*rdata) {
2103                 return False;
2104         }
2105
2106         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
2107         p = *rdata;
2108         f_len = fixed_len;
2109         s_len = string_len;
2110
2111         for( i = 0; i < count; i++ ) {
2112                 fstring servicename_dos;
2113                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2114                         continue;
2115                 }
2116
2117                 push_ascii_fstring(servicename_dos, lp_servicename(i));
2118                 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2119                         if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2120                                 break;
2121                         }
2122                 }
2123         }
2124
2125         *rparam_len = 8;
2126         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2127         if (!*rparam) {
2128                 return False;
2129         }
2130         SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2131         SSVAL(*rparam,2,0);
2132         SSVAL(*rparam,4,counted);
2133         SSVAL(*rparam,6,total);
2134
2135         DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2136                 counted,total,uLevel,
2137                 buf_len,*rdata_len,mdrcnt));
2138
2139         return True;
2140 }
2141
2142 /****************************************************************************
2143   Add a share
2144   ****************************************************************************/
2145
2146 static bool api_RNetShareAdd(struct smbd_server_connection *sconn,
2147                              connection_struct *conn,uint16 vuid,
2148                                 char *param, int tpscnt,
2149                                 char *data, int tdscnt,
2150                                 int mdrcnt,int mprcnt,
2151                                 char **rdata,char **rparam,
2152                                 int *rdata_len,int *rparam_len)
2153 {
2154         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2155         char *str2 = skip_string(param,tpscnt,str1);
2156         char *p = skip_string(param,tpscnt,str2);
2157         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2158         fstring sharename;
2159         fstring comment;
2160         char *pathname = NULL;
2161         unsigned int offset;
2162         int res = ERRunsup;
2163         size_t converted_size;
2164
2165         WERROR werr = WERR_OK;
2166         TALLOC_CTX *mem_ctx = talloc_tos();
2167         NTSTATUS status;
2168         struct rpc_pipe_client *cli = NULL;
2169         union srvsvc_NetShareInfo info;
2170         struct srvsvc_NetShareInfo2 info2;
2171
2172         if (!str1 || !str2 || !p) {
2173                 return False;
2174         }
2175
2176         /* check it's a supported varient */
2177         if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2178                 return False;
2179         }
2180         if (!check_share_info(uLevel,str2)) {
2181                 return False;
2182         }
2183         if (uLevel != 2) {
2184                 return False;
2185         }
2186
2187         /* Do we have a string ? */
2188         if (skip_string(data,mdrcnt,data) == NULL) {
2189                 return False;
2190         }
2191         pull_ascii_fstring(sharename,data);
2192
2193         if (mdrcnt < 28) {
2194                 return False;
2195         }
2196
2197         /* only support disk share adds */
2198         if (SVAL(data,14)!=STYPE_DISKTREE) {
2199                 return False;
2200         }
2201
2202         offset = IVAL(data, 16);
2203         if (offset >= mdrcnt) {
2204                 res = ERRinvalidparam;
2205                 goto out;
2206         }
2207
2208         /* Do we have a string ? */
2209         if (skip_string(data,mdrcnt,data+offset) == NULL) {
2210                 return False;
2211         }
2212         pull_ascii_fstring(comment, offset? (data+offset) : "");
2213
2214         offset = IVAL(data, 26);
2215
2216         if (offset >= mdrcnt) {
2217                 res = ERRinvalidparam;
2218                 goto out;
2219         }
2220
2221         /* Do we have a string ? */
2222         if (skip_string(data,mdrcnt,data+offset) == NULL) {
2223                 return False;
2224         }
2225
2226         if (!pull_ascii_talloc(talloc_tos(), &pathname,
2227                                offset ? (data+offset) : "", &converted_size))
2228         {
2229                 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2230                          strerror(errno)));
2231         }
2232
2233         if (!pathname) {
2234                 return false;
2235         }
2236
2237         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_srvsvc.syntax_id,
2238                                         rpc_srvsvc_dispatch, conn->server_info,
2239                                         &cli);
2240         if (!NT_STATUS_IS_OK(status)) {
2241                 DEBUG(0,("api_RNetShareAdd: could not connect to srvsvc: %s\n",
2242                           nt_errstr(status)));
2243                 res = W_ERROR_V(ntstatus_to_werror(status));
2244                 goto out;
2245         }
2246
2247         info2.name              = sharename;
2248         info2.type              = STYPE_DISKTREE;
2249         info2.comment           = comment;
2250         info2.permissions       = 0;
2251         info2.max_users         = 0;
2252         info2.current_users     = 0;
2253         info2.path              = pathname;
2254         info2.password          = NULL;
2255
2256         info.info2 = &info2;
2257
2258         status = rpccli_srvsvc_NetShareAdd(cli, mem_ctx,
2259                                            cli->srv_name_slash,
2260                                            2,
2261                                            &info,
2262                                            NULL,
2263                                            &werr);
2264         if (!NT_STATUS_IS_OK(status)) {
2265                 res = W_ERROR_V(ntstatus_to_werror(status));
2266                 goto out;
2267         }
2268         if (!W_ERROR_IS_OK(werr)) {
2269                 res = W_ERROR_V(werr);
2270                 goto out;
2271         }
2272
2273         *rparam_len = 6;
2274         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2275         if (!*rparam) {
2276                 return False;
2277         }
2278         SSVAL(*rparam,0,NERR_Success);
2279         SSVAL(*rparam,2,0);             /* converter word */
2280         SSVAL(*rparam,4,*rdata_len);
2281         *rdata_len = 0;
2282
2283         return True;
2284
2285   out:
2286
2287         *rparam_len = 4;
2288         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2289         if (!*rparam) {
2290                 return False;
2291         }
2292         *rdata_len = 0;
2293         SSVAL(*rparam,0,res);
2294         SSVAL(*rparam,2,0);
2295         return True;
2296 }
2297
2298 /****************************************************************************
2299   view list of groups available
2300   ****************************************************************************/
2301
2302 static bool api_RNetGroupEnum(struct smbd_server_connection *sconn,
2303                               connection_struct *conn,uint16 vuid,
2304                                 char *param, int tpscnt,
2305                                 char *data, int tdscnt,
2306                                 int mdrcnt,int mprcnt,
2307                                 char **rdata,char **rparam,
2308                                 int *rdata_len,int *rparam_len)
2309 {
2310         int i;
2311         int errflags=0;
2312         int resume_context, cli_buf_size;
2313         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2314         char *str2 = skip_string(param,tpscnt,str1);
2315         char *p = skip_string(param,tpscnt,str2);
2316
2317         uint32_t num_groups;
2318         uint32_t resume_handle;
2319         struct rpc_pipe_client *samr_pipe;
2320         struct policy_handle samr_handle, domain_handle;
2321         NTSTATUS status;
2322
2323         if (!str1 || !str2 || !p) {
2324                 return False;
2325         }
2326
2327         if (strcmp(str1,"WrLeh") != 0) {
2328                 return False;
2329         }
2330
2331         /* parameters
2332          * W-> resume context (number of users to skip)
2333          * r -> return parameter pointer to receive buffer
2334          * L -> length of receive buffer
2335          * e -> return parameter number of entries
2336          * h -> return parameter total number of users
2337          */
2338
2339         if (strcmp("B21",str2) != 0) {
2340                 return False;
2341         }
2342
2343         status = rpc_pipe_open_internal(
2344                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2345                 conn->server_info, &samr_pipe);
2346         if (!NT_STATUS_IS_OK(status)) {
2347                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2348                           nt_errstr(status)));
2349                 return false;
2350         }
2351
2352         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2353                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2354         if (!NT_STATUS_IS_OK(status)) {
2355                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2356                           nt_errstr(status)));
2357                 return false;
2358         }
2359
2360         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2361                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2362                                         get_global_sam_sid(), &domain_handle);
2363         if (!NT_STATUS_IS_OK(status)) {
2364                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2365                           nt_errstr(status)));
2366                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2367                 return false;
2368         }
2369
2370         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2371         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2372         DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2373                   "%d\n", resume_context, cli_buf_size));
2374
2375         *rdata_len = cli_buf_size;
2376         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2377         if (!*rdata) {
2378                 return False;
2379         }
2380
2381         p = *rdata;
2382
2383         errflags = NERR_Success;
2384         num_groups = 0;
2385         resume_handle = 0;
2386
2387         while (true) {
2388                 struct samr_SamArray *sam_entries;
2389                 uint32_t num_entries;
2390
2391                 status = rpccli_samr_EnumDomainGroups(samr_pipe, talloc_tos(),
2392                                                       &domain_handle,
2393                                                       &resume_handle,
2394                                                       &sam_entries, 1,
2395                                                       &num_entries);
2396                 if (!NT_STATUS_IS_OK(status)) {
2397                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2398                                    "%s\n", nt_errstr(status)));
2399                         break;
2400                 }
2401
2402                 if (num_entries == 0) {
2403                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2404                                    "no entries -- done\n"));
2405                         break;
2406                 }
2407
2408                 for(i=0; i<num_entries; i++) {
2409                         const char *name;
2410
2411                         name = sam_entries->entries[i].name.string;
2412
2413                         if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2414                                 /* set overflow error */
2415                                 DEBUG(3,("overflow on entry %d group %s\n", i,
2416                                          name));
2417                                 errflags=234;
2418                                 break;
2419                         }
2420
2421                         /* truncate the name at 21 chars. */
2422                         memset(p, 0, 21);
2423                         strlcpy(p, name, 21);
2424                         DEBUG(10,("adding entry %d group %s\n", i, p));
2425                         p += 21;
2426                         p += 5; /* Both NT4 and W2k3SP1 do padding here.  No
2427                                  * idea why... */
2428                         num_groups += 1;
2429                 }
2430
2431                 if (errflags != NERR_Success) {
2432                         break;
2433                 }
2434
2435                 TALLOC_FREE(sam_entries);
2436         }
2437
2438         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2439         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2440
2441         *rdata_len = PTR_DIFF(p,*rdata);
2442
2443         *rparam_len = 8;
2444         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2445         if (!*rparam) {
2446                 return False;
2447         }
2448         SSVAL(*rparam, 0, errflags);
2449         SSVAL(*rparam, 2, 0);           /* converter word */
2450         SSVAL(*rparam, 4, num_groups);  /* is this right?? */
2451         SSVAL(*rparam, 6, resume_context+num_groups);   /* is this right?? */
2452
2453         return(True);
2454 }
2455
2456 /*******************************************************************
2457  Get groups that a user is a member of.
2458 ******************************************************************/
2459
2460 static bool api_NetUserGetGroups(struct smbd_server_connection *sconn,
2461                                  connection_struct *conn,uint16 vuid,
2462                                 char *param, int tpscnt,
2463                                 char *data, int tdscnt,
2464                                 int mdrcnt,int mprcnt,
2465                                 char **rdata,char **rparam,
2466                                 int *rdata_len,int *rparam_len)
2467 {
2468         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2469         char *str2 = skip_string(param,tpscnt,str1);
2470         char *UserName = skip_string(param,tpscnt,str2);
2471         char *p = skip_string(param,tpscnt,UserName);
2472         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2473         const char *level_string;
2474         int count=0;
2475         bool ret = False;
2476         uint32_t i;
2477         char *endp = NULL;
2478
2479         struct rpc_pipe_client *samr_pipe;
2480         struct policy_handle samr_handle, domain_handle, user_handle;
2481         struct lsa_String name;
2482         struct lsa_Strings names;
2483         struct samr_Ids type, rid;
2484         struct samr_RidWithAttributeArray *rids;
2485         NTSTATUS status;
2486
2487         if (!str1 || !str2 || !UserName || !p) {
2488                 return False;
2489         }
2490
2491         *rparam_len = 8;
2492         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2493         if (!*rparam) {
2494                 return False;
2495         }
2496
2497         /* check it's a supported varient */
2498
2499         if ( strcmp(str1,"zWrLeh") != 0 )
2500                 return False;
2501
2502         switch( uLevel ) {
2503                 case 0:
2504                         level_string = "B21";
2505                         break;
2506                 default:
2507                         return False;
2508         }
2509
2510         if (strcmp(level_string,str2) != 0)
2511                 return False;
2512
2513         *rdata_len = mdrcnt + 1024;
2514         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2515         if (!*rdata) {
2516                 return False;
2517         }
2518
2519         SSVAL(*rparam,0,NERR_Success);
2520         SSVAL(*rparam,2,0);             /* converter word */
2521
2522         p = *rdata;
2523         endp = *rdata + *rdata_len;
2524
2525         status = rpc_pipe_open_internal(
2526                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2527                 conn->server_info, &samr_pipe);
2528         if (!NT_STATUS_IS_OK(status)) {
2529                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2530                           nt_errstr(status)));
2531                 return false;
2532         }
2533
2534         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2535                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2536         if (!NT_STATUS_IS_OK(status)) {
2537                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2538                           nt_errstr(status)));
2539                 return false;
2540         }
2541
2542         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2543                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2544                                         get_global_sam_sid(), &domain_handle);
2545         if (!NT_STATUS_IS_OK(status)) {
2546                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2547                           nt_errstr(status)));
2548                 goto close_sam;
2549         }
2550
2551         name.string = UserName;
2552
2553         status = rpccli_samr_LookupNames(samr_pipe, talloc_tos(),
2554                                          &domain_handle, 1, &name,
2555                                          &rid, &type);
2556         if (!NT_STATUS_IS_OK(status)) {
2557                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2558                           nt_errstr(status)));
2559                 goto close_domain;
2560         }
2561
2562         if (type.ids[0] != SID_NAME_USER) {
2563                 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2564                            sid_type_lookup(type.ids[0])));
2565                 goto close_domain;
2566         }
2567
2568         status = rpccli_samr_OpenUser(samr_pipe, talloc_tos(),
2569                                       &domain_handle,
2570                                       SAMR_USER_ACCESS_GET_GROUPS,
2571                                       rid.ids[0], &user_handle);
2572         if (!NT_STATUS_IS_OK(status)) {
2573                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2574                           nt_errstr(status)));
2575                 goto close_domain;
2576         }
2577
2578         status = rpccli_samr_GetGroupsForUser(samr_pipe, talloc_tos(),
2579                                               &user_handle, &rids);
2580         if (!NT_STATUS_IS_OK(status)) {
2581                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2582                           nt_errstr(status)));
2583                 goto close_user;
2584         }
2585
2586         for (i=0; i<rids->count; i++) {
2587
2588                 status = rpccli_samr_LookupRids(samr_pipe, talloc_tos(),
2589                                                 &domain_handle,
2590                                                 1, &rids->rids[i].rid,
2591                                                 &names, &type);
2592                 if (NT_STATUS_IS_OK(status) && (names.count == 1)) {
2593                         strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2594                         p += 21;
2595                         count++;
2596                 }
2597         }
2598
2599         *rdata_len = PTR_DIFF(p,*rdata);
2600
2601         SSVAL(*rparam,4,count); /* is this right?? */
2602         SSVAL(*rparam,6,count); /* is this right?? */
2603
2604         ret = True;
2605
2606  close_user:
2607         rpccli_samr_Close(samr_pipe, talloc_tos(), &user_handle);
2608  close_domain:
2609         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2610  close_sam:
2611         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2612
2613         return ret;
2614 }
2615
2616 /*******************************************************************
2617  Get all users.
2618 ******************************************************************/
2619
2620 static bool api_RNetUserEnum(struct smbd_server_connection *sconn,
2621                              connection_struct *conn, uint16 vuid,
2622                                 char *param, int tpscnt,
2623                                 char *data, int tdscnt,
2624                                 int mdrcnt,int mprcnt,
2625                                 char **rdata,char **rparam,
2626                                 int *rdata_len,int *rparam_len)
2627 {
2628         int count_sent=0;
2629         int num_users=0;
2630         int errflags=0;
2631         int i, resume_context, cli_buf_size;
2632         uint32_t resume_handle;
2633
2634         struct rpc_pipe_client *samr_pipe;
2635         struct policy_handle samr_handle, domain_handle;
2636         NTSTATUS status;
2637
2638         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2639         char *str2 = skip_string(param,tpscnt,str1);
2640         char *p = skip_string(param,tpscnt,str2);
2641         char *endp = NULL;
2642
2643         if (!str1 || !str2 || !p) {
2644                 return False;
2645         }
2646
2647         if (strcmp(str1,"WrLeh") != 0)
2648                 return False;
2649         /* parameters
2650           * W-> resume context (number of users to skip)
2651           * r -> return parameter pointer to receive buffer
2652           * L -> length of receive buffer
2653           * e -> return parameter number of entries
2654           * h -> return parameter total number of users
2655           */
2656
2657         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2658         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2659         DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2660                         resume_context, cli_buf_size));
2661
2662         *rparam_len = 8;
2663         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2664         if (!*rparam) {
2665                 return False;
2666         }
2667
2668         /* check it's a supported varient */
2669         if (strcmp("B21",str2) != 0)
2670                 return False;
2671
2672         *rdata_len = cli_buf_size;
2673         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2674         if (!*rdata) {
2675                 return False;
2676         }
2677
2678         p = *rdata;
2679         endp = *rdata + *rdata_len;
2680
2681         status = rpc_pipe_open_internal(
2682                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2683                 conn->server_info, &samr_pipe);
2684         if (!NT_STATUS_IS_OK(status)) {
2685                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2686                           nt_errstr(status)));
2687                 return false;
2688         }
2689
2690         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2691                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2692         if (!NT_STATUS_IS_OK(status)) {
2693                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2694                           nt_errstr(status)));
2695                 return false;
2696         }
2697
2698         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2699                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2700                                         get_global_sam_sid(), &domain_handle);
2701         if (!NT_STATUS_IS_OK(status)) {
2702                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2703                           nt_errstr(status)));
2704                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2705                 return false;
2706         }
2707
2708         errflags=NERR_Success;
2709
2710         resume_handle = 0;
2711
2712         while (true) {
2713                 struct samr_SamArray *sam_entries;
2714                 uint32_t num_entries;
2715
2716                 status = rpccli_samr_EnumDomainUsers(samr_pipe, talloc_tos(),
2717                                                      &domain_handle,
2718                                                      &resume_handle,
2719                                                      0, &sam_entries, 1,
2720                                                      &num_entries);
2721
2722                 if (!NT_STATUS_IS_OK(status)) {
2723                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2724                                    "%s\n", nt_errstr(status)));
2725                         break;
2726                 }
2727
2728                 if (num_entries == 0) {
2729                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2730                                    "no entries -- done\n"));
2731                         break;
2732                 }
2733
2734                 for (i=0; i<num_entries; i++) {
2735                         const char *name;
2736
2737                         name = sam_entries->entries[i].name.string;
2738
2739                         if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2740                            &&(strlen(name)<=21)) {
2741                                 strlcpy(p,name,PTR_DIFF(endp,p));
2742                                 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2743                                           "username %s\n",count_sent,p));
2744                                 p += 21;
2745                                 count_sent++;
2746                         } else {
2747                                 /* set overflow error */
2748                                 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2749                                           "username %s\n",count_sent,name));
2750                                 errflags=234;
2751                                 break;
2752                         }
2753                 }
2754
2755                 if (errflags != NERR_Success) {
2756                         break;
2757                 }
2758
2759                 TALLOC_FREE(sam_entries);
2760         }
2761
2762         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2763         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2764
2765         *rdata_len = PTR_DIFF(p,*rdata);
2766
2767         SSVAL(*rparam,0,errflags);
2768         SSVAL(*rparam,2,0);           /* converter word */
2769         SSVAL(*rparam,4,count_sent);  /* is this right?? */
2770         SSVAL(*rparam,6,num_users); /* is this right?? */
2771
2772         return True;
2773 }
2774
2775 /****************************************************************************
2776  Get the time of day info.
2777 ****************************************************************************/
2778
2779 static bool api_NetRemoteTOD(struct smbd_server_connection *sconn,
2780                              connection_struct *conn,uint16 vuid,
2781                                 char *param, int tpscnt,
2782                                 char *data, int tdscnt,
2783                                 int mdrcnt,int mprcnt,
2784                                 char **rdata,char **rparam,
2785                                 int *rdata_len,int *rparam_len)
2786 {
2787         struct tm *t;
2788         time_t unixdate = time(NULL);
2789         char *p;
2790
2791         *rparam_len = 4;
2792         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2793         if (!*rparam) {
2794                 return False;
2795         }
2796
2797         *rdata_len = 21;
2798         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2799         if (!*rdata) {
2800                 return False;
2801         }
2802
2803         SSVAL(*rparam,0,NERR_Success);
2804         SSVAL(*rparam,2,0);             /* converter word */
2805
2806         p = *rdata;
2807
2808         srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2809                                             by NT in a "net time" operation,
2810                                             it seems to ignore the one below */
2811
2812         /* the client expects to get localtime, not GMT, in this bit
2813                 (I think, this needs testing) */
2814         t = localtime(&unixdate);
2815         if (!t) {
2816                 return False;
2817         }
2818
2819         SIVAL(p,4,0);           /* msecs ? */
2820         SCVAL(p,8,t->tm_hour);
2821         SCVAL(p,9,t->tm_min);
2822         SCVAL(p,10,t->tm_sec);
2823         SCVAL(p,11,0);          /* hundredths of seconds */
2824         SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2825         SSVAL(p,14,10000);              /* timer interval in 0.0001 of sec */
2826         SCVAL(p,16,t->tm_mday);
2827         SCVAL(p,17,t->tm_mon + 1);
2828         SSVAL(p,18,1900+t->tm_year);
2829         SCVAL(p,20,t->tm_wday);
2830
2831         return True;
2832 }
2833
2834 /****************************************************************************
2835  Set the user password.
2836 *****************************************************************************/
2837
2838 static bool api_SetUserPassword(struct smbd_server_connection *sconn,
2839                                 connection_struct *conn,uint16 vuid,
2840                                 char *param, int tpscnt,
2841                                 char *data, int tdscnt,
2842                                 int mdrcnt,int mprcnt,
2843                                 char **rdata,char **rparam,
2844                                 int *rdata_len,int *rparam_len)
2845 {
2846         char *np = get_safe_str_ptr(param,tpscnt,param,2);
2847         char *p = NULL;
2848         fstring user;
2849         fstring pass1,pass2;
2850         TALLOC_CTX *mem_ctx = talloc_tos();
2851         NTSTATUS status;
2852         struct rpc_pipe_client *cli = NULL;
2853         struct policy_handle connect_handle, domain_handle, user_handle;
2854         struct lsa_String domain_name;
2855         struct dom_sid2 *domain_sid;
2856         struct lsa_String names;
2857         struct samr_Ids rids;
2858         struct samr_Ids types;
2859         struct samr_Password old_lm_hash;
2860         struct samr_Password new_lm_hash;
2861         int errcode = NERR_badpass;
2862         uint32_t rid;
2863         int encrypted;
2864         int min_pwd_length;
2865
2866         /* Skip 2 strings. */
2867         p = skip_string(param,tpscnt,np);
2868         p = skip_string(param,tpscnt,p);
2869
2870         if (!np || !p) {
2871                 return False;
2872         }
2873
2874         /* Do we have a string ? */
2875         if (skip_string(param,tpscnt,p) == NULL) {
2876                 return False;
2877         }
2878         pull_ascii_fstring(user,p);
2879
2880         p = skip_string(param,tpscnt,p);
2881         if (!p) {
2882                 return False;
2883         }
2884
2885         memset(pass1,'\0',sizeof(pass1));
2886         memset(pass2,'\0',sizeof(pass2));
2887         /*
2888          * We use 31 here not 32 as we're checking
2889          * the last byte we want to access is safe.
2890          */
2891         if (!is_offset_safe(param,tpscnt,p,31)) {
2892                 return False;
2893         }
2894         memcpy(pass1,p,16);
2895         memcpy(pass2,p+16,16);
2896
2897         encrypted = get_safe_SVAL(param,tpscnt,p+32,0,-1);
2898         if (encrypted == -1) {
2899                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
2900                 goto out;
2901         }
2902
2903         min_pwd_length = get_safe_SVAL(param,tpscnt,p+34,0,-1);
2904         if (min_pwd_length == -1) {
2905                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
2906                 goto out;
2907         }
2908
2909         *rparam_len = 4;
2910         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2911         if (!*rparam) {
2912                 return False;
2913         }
2914
2915         *rdata_len = 0;
2916
2917         DEBUG(3,("Set password for <%s> (encrypted: %d, min_pwd_length: %d)\n",
2918                 user, encrypted, min_pwd_length));
2919
2920         ZERO_STRUCT(connect_handle);
2921         ZERO_STRUCT(domain_handle);
2922         ZERO_STRUCT(user_handle);
2923
2924         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_samr.syntax_id,
2925                                         rpc_samr_dispatch, conn->server_info,
2926                                         &cli);
2927         if (!NT_STATUS_IS_OK(status)) {
2928                 DEBUG(0,("api_SetUserPassword: could not connect to samr: %s\n",
2929                           nt_errstr(status)));
2930                 errcode = W_ERROR_V(ntstatus_to_werror(status));
2931                 goto out;
2932         }
2933
2934         status = rpccli_samr_Connect2(cli, mem_ctx,
2935                                       global_myname(),
2936                                       SAMR_ACCESS_CONNECT_TO_SERVER |
2937                                       SAMR_ACCESS_ENUM_DOMAINS |
2938                                       SAMR_ACCESS_LOOKUP_DOMAIN,
2939                                       &connect_handle);
2940         if (!NT_STATUS_IS_OK(status)) {
2941                 errcode = W_ERROR_V(ntstatus_to_werror(status));
2942                 goto out;
2943         }
2944
2945         init_lsa_String(&domain_name, get_global_sam_name());
2946
2947         status = rpccli_samr_LookupDomain(cli, mem_ctx,
2948                                           &connect_handle,
2949                                           &domain_name,
2950                                           &domain_sid);
2951         if (!NT_STATUS_IS_OK(status)) {
2952                 errcode = W_ERROR_V(ntstatus_to_werror(status));
2953                 goto out;
2954         }
2955
2956         status = rpccli_samr_OpenDomain(cli, mem_ctx,
2957                                         &connect_handle,
2958                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2959                                         domain_sid,
2960                                         &domain_handle);
2961         if (!NT_STATUS_IS_OK(status)) {
2962                 errcode = W_ERROR_V(ntstatus_to_werror(status));
2963                 goto out;
2964         }
2965
2966         init_lsa_String(&names, user);
2967
2968         status = rpccli_samr_LookupNames(cli, mem_ctx,
2969                                          &domain_handle,
2970                                          1,
2971                                          &names,
2972                                          &rids,
2973                                          &types);
2974         if (!NT_STATUS_IS_OK(status)) {
2975                 errcode = W_ERROR_V(ntstatus_to_werror(status));
2976                 goto out;
2977         }
2978
2979         if (rids.count != 1) {
2980                 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
2981                 goto out;
2982         }
2983         if (rids.count != types.count) {
2984                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
2985                 goto out;
2986         }
2987         if (types.ids[0] != SID_NAME_USER) {
2988                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
2989                 goto out;
2990         }
2991
2992         rid = rids.ids[0];
2993
2994         status = rpccli_samr_OpenUser(cli, mem_ctx,
2995                                       &domain_handle,
2996                                       SAMR_USER_ACCESS_CHANGE_PASSWORD,
2997                                       rid,
2998                                       &user_handle);
2999         if (!NT_STATUS_IS_OK(status)) {
3000                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3001                 goto out;
3002         }
3003
3004         if (encrypted == 0) {
3005                 E_deshash(pass1, old_lm_hash.hash);
3006                 E_deshash(pass2, new_lm_hash.hash);
3007         } else {
3008                 ZERO_STRUCT(old_lm_hash);
3009                 ZERO_STRUCT(new_lm_hash);
3010                 memcpy(old_lm_hash.hash, pass1, MIN(strlen(pass1), 16));
3011                 memcpy(new_lm_hash.hash, pass1, MIN(strlen(pass2), 16));
3012         }
3013
3014         status = rpccli_samr_ChangePasswordUser(cli, mem_ctx,
3015                                                 &user_handle,
3016                                                 true, /* lm_present */
3017                                                 &old_lm_hash,
3018                                                 &new_lm_hash,
3019                                                 false, /* nt_present */
3020                                                 NULL, /* old_nt_crypted */
3021                                                 NULL, /* new_nt_crypted */
3022                                                 false, /* cross1_present */
3023                                                 NULL, /* nt_cross */
3024                                                 false, /* cross2_present */
3025                                                 NULL); /* lm_cross */
3026         if (!NT_STATUS_IS_OK(status)) {
3027                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3028                 goto out;
3029         }
3030
3031         errcode = NERR_Success;
3032  out:
3033
3034         if (cli && is_valid_policy_hnd(&user_handle)) {
3035                 rpccli_samr_Close(cli, mem_ctx, &user_handle);
3036         }
3037         if (cli && is_valid_policy_hnd(&domain_handle)) {
3038                 rpccli_samr_Close(cli, mem_ctx, &domain_handle);
3039         }
3040         if (cli && is_valid_policy_hnd(&connect_handle)) {
3041                 rpccli_samr_Close(cli, mem_ctx, &connect_handle);
3042         }
3043
3044         memset((char *)pass1,'\0',sizeof(fstring));
3045         memset((char *)pass2,'\0',sizeof(fstring));
3046
3047         SSVAL(*rparam,0,errcode);
3048         SSVAL(*rparam,2,0);             /* converter word */
3049         return(True);
3050 }
3051
3052 /****************************************************************************
3053   Set the user password (SamOEM version - gets plaintext).
3054 ****************************************************************************/
3055
3056 static bool api_SamOEMChangePassword(struct smbd_server_connection *sconn,
3057                                      connection_struct *conn,uint16 vuid,
3058                                 char *param, int tpscnt,
3059                                 char *data, int tdscnt,
3060                                 int mdrcnt,int mprcnt,
3061                                 char **rdata,char **rparam,
3062                                 int *rdata_len,int *rparam_len)
3063 {
3064         fstring user;
3065         char *p = get_safe_str_ptr(param,tpscnt,param,2);
3066
3067         TALLOC_CTX *mem_ctx = talloc_tos();
3068         NTSTATUS status;
3069         struct rpc_pipe_client *cli = NULL;
3070         struct lsa_AsciiString server, account;
3071         struct samr_CryptPassword password;
3072         struct samr_Password hash;
3073         int errcode = NERR_badpass;
3074         int bufsize;
3075
3076         *rparam_len = 4;
3077         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3078         if (!*rparam) {
3079                 return False;
3080         }
3081
3082         if (!p) {
3083                 return False;
3084         }
3085         *rdata_len = 0;
3086
3087         SSVAL(*rparam,0,NERR_badpass);
3088
3089         /*
3090          * Check the parameter definition is correct.
3091          */
3092
3093         /* Do we have a string ? */
3094         if (skip_string(param,tpscnt,p) == 0) {
3095                 return False;
3096         }
3097         if(!strequal(p, "zsT")) {
3098                 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
3099                 return False;
3100         }
3101         p = skip_string(param, tpscnt, p);
3102         if (!p) {
3103                 return False;
3104         }
3105
3106         /* Do we have a string ? */
3107         if (skip_string(param,tpscnt,p) == 0) {
3108                 return False;
3109         }
3110         if(!strequal(p, "B516B16")) {
3111                 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
3112                 return False;
3113         }
3114         p = skip_string(param,tpscnt,p);
3115         if (!p) {
3116                 return False;
3117         }
3118         /* Do we have a string ? */
3119         if (skip_string(param,tpscnt,p) == 0) {
3120                 return False;
3121         }
3122         p += pull_ascii_fstring(user,p);
3123
3124         DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
3125
3126         if (tdscnt != 532) {
3127                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3128                 goto out;
3129         }
3130
3131         bufsize = get_safe_SVAL(param,tpscnt,p,0,-1);
3132         if (bufsize != 532) {
3133                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3134                 goto out;
3135         }
3136
3137         memcpy(password.data, data, 516);
3138         memcpy(hash.hash, data+516, 16);
3139
3140         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_samr.syntax_id,
3141                                         rpc_samr_dispatch, conn->server_info,
3142                                         &cli);
3143         if (!NT_STATUS_IS_OK(status)) {
3144                 DEBUG(0,("api_SamOEMChangePassword: could not connect to samr: %s\n",
3145                           nt_errstr(status)));
3146                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3147                 goto out;
3148         }
3149
3150         init_lsa_AsciiString(&server, global_myname());
3151         init_lsa_AsciiString(&account, user);
3152
3153         status = rpccli_samr_OemChangePasswordUser2(cli, mem_ctx,
3154                                                     &server,
3155                                                     &account,
3156                                                     &password,
3157                                                     &hash);
3158         if (!NT_STATUS_IS_OK(status)) {
3159                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3160                 goto out;
3161         }
3162
3163         errcode = NERR_Success;
3164  out:
3165         SSVAL(*rparam,0,errcode);
3166         SSVAL(*rparam,2,0);             /* converter word */
3167
3168         return(True);
3169 }
3170
3171 /****************************************************************************
3172   delete a print job
3173   Form: <W> <>
3174   ****************************************************************************/
3175
3176 static bool api_RDosPrintJobDel(struct smbd_server_connection *sconn,
3177                                 connection_struct *conn,uint16 vuid,
3178                                 char *param, int tpscnt,
3179                                 char *data, int tdscnt,
3180                                 int mdrcnt,int mprcnt,
3181                                 char **rdata,char **rparam,
3182                                 int *rdata_len,int *rparam_len)
3183 {
3184         int function = get_safe_SVAL(param,tpscnt,param,0,0);
3185         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3186         char *str2 = skip_string(param,tpscnt,str1);
3187         char *p = skip_string(param,tpscnt,str2);
3188         uint32 jobid;
3189         fstring sharename;
3190         int errcode;
3191         WERROR werr = WERR_OK;
3192
3193         TALLOC_CTX *mem_ctx = talloc_tos();
3194         NTSTATUS status;
3195         struct rpc_pipe_client *cli = NULL;
3196         struct policy_handle handle;
3197         struct spoolss_DevmodeContainer devmode_ctr;
3198         enum spoolss_JobControl command;
3199
3200         if (!str1 || !str2 || !p) {
3201                 return False;
3202         }
3203         /*
3204          * We use 1 here not 2 as we're checking
3205          * the last byte we want to access is safe.
3206          */
3207         if (!is_offset_safe(param,tpscnt,p,1)) {
3208                 return False;
3209         }
3210         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3211                 return False;
3212
3213         /* check it's a supported varient */
3214         if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
3215                 return(False);
3216
3217         *rparam_len = 4;
3218         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3219         if (!*rparam) {
3220                 return False;
3221         }
3222         *rdata_len = 0;
3223
3224         ZERO_STRUCT(handle);
3225
3226         status = rpc_connect_spoolss_pipe(conn, &cli);
3227         if (!NT_STATUS_IS_OK(status)) {
3228                 DEBUG(0,("api_RDosPrintJobDel: could not connect to spoolss: %s\n",
3229                           nt_errstr(status)));
3230                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3231                 goto out;
3232         }
3233
3234         ZERO_STRUCT(devmode_ctr);
3235
3236         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
3237                                             sharename,
3238                                             "RAW",
3239                                             devmode_ctr,
3240                                             JOB_ACCESS_ADMINISTER,
3241                                             &handle,
3242                                             &werr);
3243         if (!NT_STATUS_IS_OK(status)) {
3244                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3245                 goto out;
3246         }
3247         if (!W_ERROR_IS_OK(werr)) {
3248                 errcode = W_ERROR_V(werr);
3249                 goto out;
3250         }
3251
3252         /* FIXME: formerly NERR_JobNotFound was returned if job did not exist
3253          * and NERR_DestNotFound if share did not exist */
3254
3255         errcode = NERR_Success;
3256
3257         switch (function) {
3258         case 81:                /* delete */
3259                 command = SPOOLSS_JOB_CONTROL_DELETE;
3260                 break;
3261         case 82:                /* pause */
3262                 command = SPOOLSS_JOB_CONTROL_PAUSE;
3263                 break;
3264         case 83:                /* resume */
3265                 command = SPOOLSS_JOB_CONTROL_RESUME;
3266                 break;
3267         default:
3268                 errcode = NERR_notsupported;
3269                 goto out;
3270         }
3271
3272         status = rpccli_spoolss_SetJob(cli, mem_ctx,
3273                                        &handle,
3274                                        jobid,
3275                                        NULL, /* unique ptr ctr */
3276                                        command,
3277                                        &werr);
3278         if (!NT_STATUS_IS_OK(status)) {
3279                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3280                 goto out;
3281         }
3282         if (!W_ERROR_IS_OK(werr)) {
3283                 errcode = W_ERROR_V(werr);
3284                 goto out;
3285         }
3286
3287  out:
3288         if (cli && is_valid_policy_hnd(&handle)) {
3289                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
3290         }
3291
3292         SSVAL(*rparam,0,errcode);
3293         SSVAL(*rparam,2,0);             /* converter word */
3294
3295         return(True);
3296 }
3297
3298 /****************************************************************************
3299   Purge a print queue - or pause or resume it.
3300   ****************************************************************************/
3301
3302 static bool api_WPrintQueueCtrl(struct smbd_server_connection *sconn,
3303                                 connection_struct *conn,uint16 vuid,
3304                                 char *param, int tpscnt,
3305                                 char *data, int tdscnt,
3306                                 int mdrcnt,int mprcnt,
3307                                 char **rdata,char **rparam,
3308                                 int *rdata_len,int *rparam_len)
3309 {
3310         int function = get_safe_SVAL(param,tpscnt,param,0,0);
3311         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3312         char *str2 = skip_string(param,tpscnt,str1);
3313         char *QueueName = skip_string(param,tpscnt,str2);
3314         int errcode = NERR_notsupported;
3315         WERROR werr = WERR_OK;
3316         NTSTATUS status;
3317
3318         TALLOC_CTX *mem_ctx = talloc_tos();
3319         struct rpc_pipe_client *cli = NULL;
3320         struct policy_handle handle;
3321         struct spoolss_SetPrinterInfoCtr info_ctr;
3322         struct spoolss_DevmodeContainer devmode_ctr;
3323         struct sec_desc_buf secdesc_ctr;
3324         enum spoolss_PrinterControl command;
3325
3326         if (!str1 || !str2 || !QueueName) {
3327                 return False;
3328         }
3329
3330         /* check it's a supported varient */
3331         if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3332                 return(False);
3333
3334         *rparam_len = 4;
3335         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3336         if (!*rparam) {
3337                 return False;
3338         }
3339         *rdata_len = 0;
3340
3341         if (skip_string(param,tpscnt,QueueName) == NULL) {
3342                 return False;
3343         }
3344
3345         ZERO_STRUCT(handle);
3346
3347         status = rpc_connect_spoolss_pipe(conn, &cli);
3348         if (!NT_STATUS_IS_OK(status)) {
3349                 DEBUG(0,("api_WPrintQueueCtrl: could not connect to spoolss: %s\n",
3350                           nt_errstr(status)));
3351                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3352                 goto out;
3353         }
3354
3355         ZERO_STRUCT(devmode_ctr);
3356
3357         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
3358                                             QueueName,
3359                                             NULL,
3360                                             devmode_ctr,
3361                                             SEC_FLAG_MAXIMUM_ALLOWED,
3362                                             &handle,
3363                                             &werr);
3364         if (!NT_STATUS_IS_OK(status)) {
3365                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3366                 goto out;
3367         }
3368         if (!W_ERROR_IS_OK(werr)) {
3369                 errcode = W_ERROR_V(werr);
3370                 goto out;
3371         }
3372
3373         switch (function) {
3374         case 74: /* Pause queue */
3375                 command = SPOOLSS_PRINTER_CONTROL_PAUSE;
3376                 break;
3377         case 75: /* Resume queue */
3378                 command = SPOOLSS_PRINTER_CONTROL_RESUME;
3379                 break;
3380         case 103: /* Purge */
3381                 command = SPOOLSS_PRINTER_CONTROL_PURGE;
3382                 break;
3383         default:
3384                 werr = WERR_NOT_SUPPORTED;
3385                 break;
3386         }
3387
3388         if (!W_ERROR_IS_OK(werr)) {
3389                 errcode = W_ERROR_V(werr);
3390                 goto out;
3391         }
3392
3393         ZERO_STRUCT(info_ctr);
3394         ZERO_STRUCT(secdesc_ctr);
3395
3396         status = rpccli_spoolss_SetPrinter(cli, mem_ctx,
3397                                            &handle,
3398                                            &info_ctr,
3399                                            &devmode_ctr,
3400                                            &secdesc_ctr,
3401                                            command,
3402                                            &werr);
3403         if (!NT_STATUS_IS_OK(status)) {
3404                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3405                 goto out;
3406         }
3407         if (!W_ERROR_IS_OK(werr)) {
3408                 errcode = W_ERROR_V(werr);
3409                 goto out;
3410         }
3411
3412         errcode = W_ERROR_V(werr);
3413
3414  out:
3415
3416         if (cli && is_valid_policy_hnd(&handle)) {
3417                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
3418         }
3419
3420         SSVAL(*rparam,0,errcode);
3421         SSVAL(*rparam,2,0);             /* converter word */
3422
3423         return(True);
3424 }
3425
3426 /****************************************************************************
3427   set the property of a print job (undocumented?)
3428   ? function = 0xb -> set name of print job
3429   ? function = 0x6 -> move print job up/down
3430   Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3431   or   <WWsTP> <WB21BB16B10zWWzDDz>
3432 ****************************************************************************/
3433
3434 static int check_printjob_info(struct pack_desc* desc,
3435                                int uLevel, char* id)
3436 {
3437         desc->subformat = NULL;
3438         switch( uLevel ) {
3439         case 0: desc->format = "W"; break;
3440         case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3441         case 2: desc->format = "WWzWWDDzz"; break;
3442         case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3443         case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3444         default:
3445                 DEBUG(0,("check_printjob_info: invalid level %d\n",
3446                         uLevel ));
3447                 return False;
3448         }
3449         if (id == NULL || strcmp(desc->format,id) != 0) {
3450                 DEBUG(0,("check_printjob_info: invalid format %s\n",
3451                         id ? id : "<NULL>" ));
3452                 return False;
3453         }
3454         return True;
3455 }
3456
3457 static bool api_PrintJobInfo(struct smbd_server_connection *sconn,
3458                              connection_struct *conn, uint16 vuid,
3459                                 char *param, int tpscnt,
3460                                 char *data, int tdscnt,
3461                                 int mdrcnt,int mprcnt,
3462                                 char **rdata,char **rparam,
3463                                 int *rdata_len,int *rparam_len)
3464 {
3465         struct pack_desc desc;
3466         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3467         char *str2 = skip_string(param,tpscnt,str1);
3468         char *p = skip_string(param,tpscnt,str2);
3469         uint32 jobid;
3470         fstring sharename;
3471         int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3472         int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3473         int errcode;
3474
3475         TALLOC_CTX *mem_ctx = talloc_tos();
3476         WERROR werr;
3477         NTSTATUS status;
3478         struct rpc_pipe_client *cli = NULL;
3479         struct policy_handle handle;
3480         struct spoolss_DevmodeContainer devmode_ctr;
3481         struct spoolss_JobInfoContainer ctr;
3482         union spoolss_JobInfo info;
3483         struct spoolss_SetJobInfo1 info1;
3484
3485         if (!str1 || !str2 || !p) {
3486                 return False;
3487         }
3488         /*
3489          * We use 1 here not 2 as we're checking
3490          * the last byte we want to access is safe.
3491          */
3492         if (!is_offset_safe(param,tpscnt,p,1)) {
3493                 return False;
3494         }
3495         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3496                 return False;
3497         *rparam_len = 4;
3498         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3499         if (!*rparam) {
3500                 return False;
3501         }
3502
3503         *rdata_len = 0;
3504
3505         /* check it's a supported varient */
3506         if ((strcmp(str1,"WWsTP")) ||
3507             (!check_printjob_info(&desc,uLevel,str2)))
3508                 return(False);
3509
3510         errcode = NERR_notsupported;
3511
3512         switch (function) {
3513         case 0xb:
3514                 /* change print job name, data gives the name */
3515                 break;
3516         default:
3517                 goto out;
3518         }
3519
3520         ZERO_STRUCT(handle);
3521
3522         status = rpc_connect_spoolss_pipe(conn, &cli);
3523         if (!NT_STATUS_IS_OK(status)) {
3524                 DEBUG(0,("api_PrintJobInfo: could not connect to spoolss: %s\n",
3525                           nt_errstr(status)));
3526                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3527                 goto out;
3528         }
3529
3530         ZERO_STRUCT(devmode_ctr);
3531
3532         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
3533                                             sharename,
3534                                             "RAW",
3535                                             devmode_ctr,
3536                                             PRINTER_ACCESS_USE,
3537                                             &handle,
3538                                             &werr);
3539         if (!NT_STATUS_IS_OK(status)) {
3540                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3541                 goto out;
3542         }
3543         if (!W_ERROR_IS_OK(werr)) {
3544                 errcode = W_ERROR_V(werr);
3545                 goto out;
3546         }
3547
3548         werr = rpccli_spoolss_getjob(cli, mem_ctx,
3549                                      &handle,
3550                                      jobid,
3551                                      1, /* level */
3552                                      0, /* offered */
3553                                      &info);
3554         if (!W_ERROR_IS_OK(werr)) {
3555                 errcode = W_ERROR_V(werr);
3556                 goto out;
3557         }
3558
3559         ZERO_STRUCT(ctr);
3560
3561         info1.job_id            = info.info1.job_id;
3562         info1.printer_name      = info.info1.printer_name;
3563         info1.user_name         = info.info1.user_name;
3564         info1.document_name     = data;
3565         info1.data_type         = info.info1.data_type;
3566         info1.text_status       = info.info1.text_status;
3567         info1.status            = info.info1.status;
3568         info1.priority          = info.info1.priority;
3569         info1.position          = info.info1.position;
3570         info1.total_pages       = info.info1.total_pages;
3571         info1.pages_printed     = info.info1.pages_printed;
3572         info1.submitted         = info.info1.submitted;
3573
3574         ctr.level = 1;
3575         ctr.info.info1 = &info1;
3576
3577         status = rpccli_spoolss_SetJob(cli, mem_ctx,
3578                                        &handle,
3579                                        jobid,
3580                                        &ctr,
3581                                        0,
3582                                        &werr);
3583         if (!NT_STATUS_IS_OK(status)) {
3584                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3585                 goto out;
3586         }
3587         if (!W_ERROR_IS_OK(werr)) {
3588                 errcode = W_ERROR_V(werr);
3589                 goto out;
3590         }
3591
3592         errcode = NERR_Success;
3593  out:
3594
3595         if (cli && is_valid_policy_hnd(&handle)) {
3596                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
3597         }
3598
3599         SSVALS(*rparam,0,errcode);
3600         SSVAL(*rparam,2,0);             /* converter word */
3601
3602         return(True);
3603 }
3604
3605
3606 /****************************************************************************
3607  Get info about the server.
3608 ****************************************************************************/
3609
3610 static bool api_RNetServerGetInfo(struct smbd_server_connection *sconn,
3611                                   connection_struct *conn,uint16 vuid,
3612                                 char *param, int tpscnt,
3613                                 char *data, int tdscnt,
3614                                 int mdrcnt,int mprcnt,
3615                                 char **rdata,char **rparam,
3616                                 int *rdata_len,int *rparam_len)
3617 {
3618         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3619         char *str2 = skip_string(param,tpscnt,str1);
3620         char *p = skip_string(param,tpscnt,str2);
3621         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3622         char *p2;
3623         int struct_len;
3624
3625         NTSTATUS status;
3626         WERROR werr;
3627         TALLOC_CTX *mem_ctx = talloc_tos();
3628         struct rpc_pipe_client *cli = NULL;
3629         union srvsvc_NetSrvInfo info;
3630         int errcode;
3631
3632         if (!str1 || !str2 || !p) {
3633                 return False;
3634         }
3635
3636         DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3637
3638         /* check it's a supported varient */
3639         if (!prefix_ok(str1,"WrLh")) {
3640                 return False;
3641         }
3642
3643         switch( uLevel ) {
3644                 case 0:
3645                         if (strcmp(str2,"B16") != 0) {
3646                                 return False;
3647                         }
3648                         struct_len = 16;
3649                         break;
3650                 case 1:
3651                         if (strcmp(str2,"B16BBDz") != 0) {
3652                                 return False;
3653                         }
3654                         struct_len = 26;
3655                         break;
3656                 case 2:
3657                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3658                                 return False;
3659                         }
3660                         struct_len = 134;
3661                         break;
3662                 case 3:
3663                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3664                                 return False;
3665                         }
3666                         struct_len = 144;
3667                         break;
3668                 case 20:
3669                         if (strcmp(str2,"DN") != 0) {
3670                                 return False;
3671                         }
3672                         struct_len = 6;
3673                         break;
3674                 case 50:
3675                         if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3676                                 return False;
3677                         }
3678                         struct_len = 42;
3679                         break;
3680                 default:
3681                         return False;
3682         }
3683
3684         *rdata_len = mdrcnt;
3685         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3686         if (!*rdata) {
3687                 return False;
3688         }
3689
3690         p = *rdata;
3691         p2 = p + struct_len;
3692
3693         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_srvsvc.syntax_id,
3694                                         rpc_srvsvc_dispatch, conn->server_info,
3695                                         &cli);
3696         if (!NT_STATUS_IS_OK(status)) {
3697                 DEBUG(0,("api_RNetServerGetInfo: could not connect to srvsvc: %s\n",
3698                           nt_errstr(status)));
3699                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3700                 goto out;
3701         }
3702
3703         status = rpccli_srvsvc_NetSrvGetInfo(cli, mem_ctx,
3704                                              NULL,
3705                                              101,
3706                                              &info,
3707                                              &werr);
3708         if (!NT_STATUS_IS_OK(status)) {
3709                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3710                 goto out;
3711         }
3712         if (!W_ERROR_IS_OK(werr)) {
3713                 errcode = W_ERROR_V(werr);
3714                 goto out;
3715         }
3716
3717         if (info.info101 == NULL) {
3718                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3719                 goto out;
3720         }
3721
3722         if (uLevel != 20) {
3723                 srvstr_push(NULL, 0, p, info.info101->server_name, 16,
3724                         STR_ASCII|STR_UPPER|STR_TERMINATE);
3725         }
3726         p += 16;
3727         if (uLevel > 0) {
3728                 SCVAL(p,0,info.info101->version_major);
3729                 SCVAL(p,1,info.info101->version_minor);
3730                 SIVAL(p,2,info.info101->server_type);
3731
3732                 if (mdrcnt == struct_len) {
3733                         SIVAL(p,6,0);
3734                 } else {
3735                         SIVAL(p,6,PTR_DIFF(p2,*rdata));
3736                         if (mdrcnt - struct_len <= 0) {
3737                                 return false;
3738                         }
3739                         push_ascii(p2,
3740                                 info.info101->comment,
3741                                 MIN(mdrcnt - struct_len,
3742                                         MAX_SERVER_STRING_LENGTH),
3743                                 STR_TERMINATE);
3744                         p2 = skip_string(*rdata,*rdata_len,p2);
3745                         if (!p2) {
3746                                 return False;
3747                         }
3748                 }
3749         }
3750
3751         if (uLevel > 1) {
3752                 return False;           /* not yet implemented */
3753         }
3754
3755         errcode = NERR_Success;
3756
3757  out:
3758
3759         *rdata_len = PTR_DIFF(p2,*rdata);
3760
3761         *rparam_len = 6;
3762         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3763         if (!*rparam) {
3764                 return False;
3765         }
3766         SSVAL(*rparam,0,errcode);
3767         SSVAL(*rparam,2,0);             /* converter word */
3768         SSVAL(*rparam,4,*rdata_len);
3769
3770         return True;
3771 }
3772
3773 /****************************************************************************
3774  Get info about the server.
3775 ****************************************************************************/
3776
3777 static bool api_NetWkstaGetInfo(struct smbd_server_connection *sconn,
3778                                 connection_struct *conn,uint16 vuid,
3779                                 char *param, int tpscnt,
3780                                 char *data, int tdscnt,
3781                                 int mdrcnt,int mprcnt,
3782                                 char **rdata,char **rparam,
3783                                 int *rdata_len,int *rparam_len)
3784 {
3785         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3786         char *str2 = skip_string(param,tpscnt,str1);
3787         char *p = skip_string(param,tpscnt,str2);
3788         char *p2;
3789         char *endp;
3790         int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3791
3792         if (!str1 || !str2 || !p) {
3793                 return False;
3794         }
3795
3796         DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3797
3798         *rparam_len = 6;
3799         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3800         if (!*rparam) {
3801                 return False;
3802         }
3803
3804         /* check it's a supported varient */
3805         if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3806                 return False;
3807         }
3808
3809         *rdata_len = mdrcnt + 1024;
3810         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3811         if (!*rdata) {
3812                 return False;
3813         }
3814
3815         SSVAL(*rparam,0,NERR_Success);
3816         SSVAL(*rparam,2,0);             /* converter word */
3817
3818         p = *rdata;
3819         endp = *rdata + *rdata_len;
3820
3821         p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3822         if (!p2) {
3823                 return False;
3824         }
3825
3826         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3827         strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3828         strupper_m(p2);
3829         p2 = skip_string(*rdata,*rdata_len,p2);
3830         if (!p2) {
3831                 return False;
3832         }
3833         p += 4;
3834
3835         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3836         strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3837         p2 = skip_string(*rdata,*rdata_len,p2);
3838         if (!p2) {
3839                 return False;
3840         }
3841         p += 4;
3842
3843         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3844         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3845         strupper_m(p2);
3846         p2 = skip_string(*rdata,*rdata_len,p2);
3847         if (!p2) {
3848                 return False;
3849         }
3850         p += 4;
3851
3852         SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3853         SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3854         p += 2;
3855
3856         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3857         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));   /* don't know.  login domain?? */
3858         p2 = skip_string(*rdata,*rdata_len,p2);
3859         if (!p2) {
3860                 return False;
3861         }
3862         p += 4;
3863
3864         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3865         strlcpy(p2,"",PTR_DIFF(endp,p2));
3866         p2 = skip_string(*rdata,*rdata_len,p2);
3867         if (!p2) {
3868                 return False;
3869         }
3870         p += 4;
3871
3872         *rdata_len = PTR_DIFF(p2,*rdata);
3873
3874         SSVAL(*rparam,4,*rdata_len);
3875
3876         return True;
3877 }
3878
3879 /****************************************************************************
3880   get info about a user
3881
3882     struct user_info_11 {
3883         char                usri11_name[21];  0-20
3884         char                usri11_pad;       21
3885         char                *usri11_comment;  22-25
3886         char            *usri11_usr_comment;  26-29
3887         unsigned short      usri11_priv;      30-31
3888         unsigned long       usri11_auth_flags; 32-35
3889         long                usri11_password_age; 36-39
3890         char                *usri11_homedir; 40-43
3891         char            *usri11_parms; 44-47
3892         long                usri11_last_logon; 48-51
3893         long                usri11_last_logoff; 52-55
3894         unsigned short      usri11_bad_pw_count; 56-57
3895         unsigned short      usri11_num_logons; 58-59
3896         char                *usri11_logon_server; 60-63
3897         unsigned short      usri11_country_code; 64-65
3898         char            *usri11_workstations; 66-69
3899         unsigned long       usri11_max_storage; 70-73
3900         unsigned short      usri11_units_per_week; 74-75
3901         unsigned char       *usri11_logon_hours; 76-79
3902         unsigned short      usri11_code_page; 80-81
3903     };
3904
3905 where:
3906
3907   usri11_name specifies the user name for which information is retrieved
3908
3909   usri11_pad aligns the next data structure element to a word boundary
3910
3911   usri11_comment is a null terminated ASCII comment
3912
3913   usri11_user_comment is a null terminated ASCII comment about the user
3914
3915   usri11_priv specifies the level of the privilege assigned to the user.
3916        The possible values are:
3917
3918 Name             Value  Description
3919 USER_PRIV_GUEST  0      Guest privilege
3920 USER_PRIV_USER   1      User privilege
3921 USER_PRV_ADMIN   2      Administrator privilege
3922
3923   usri11_auth_flags specifies the account operator privileges. The
3924        possible values are:
3925
3926 Name            Value   Description
3927 AF_OP_PRINT     0       Print operator
3928
3929
3930 Leach, Naik                                        [Page 28]
3931 \f
3932
3933
3934 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3935
3936
3937 AF_OP_COMM      1       Communications operator
3938 AF_OP_SERVER    2       Server operator
3939 AF_OP_ACCOUNTS  3       Accounts operator
3940
3941
3942   usri11_password_age specifies how many seconds have elapsed since the
3943        password was last changed.
3944
3945   usri11_home_dir points to a null terminated ASCII string that contains
3946        the path name of the user's home directory.
3947
3948   usri11_parms points to a null terminated ASCII string that is set
3949        aside for use by applications.
3950
3951   usri11_last_logon specifies the time when the user last logged on.
3952        This value is stored as the number of seconds elapsed since
3953        00:00:00, January 1, 1970.
3954
3955   usri11_last_logoff specifies the time when the user last logged off.
3956        This value is stored as the number of seconds elapsed since
3957        00:00:00, January 1, 1970. A value of 0 means the last logoff
3958        time is unknown.
3959
3960   usri11_bad_pw_count specifies the number of incorrect passwords
3961        entered since the last successful logon.
3962
3963   usri11_log1_num_logons specifies the number of times this user has
3964        logged on. A value of -1 means the number of logons is unknown.
3965
3966   usri11_logon_server points to a null terminated ASCII string that
3967        contains the name of the server to which logon requests are sent.
3968        A null string indicates logon requests should be sent to the
3969        domain controller.
3970
3971   usri11_country_code specifies the country code for the user's language
3972        of choice.
3973
3974   usri11_workstations points to a null terminated ASCII string that
3975        contains the names of workstations the user may log on from.
3976        There may be up to 8 workstations, with the names separated by
3977        commas. A null strings indicates there are no restrictions.
3978
3979   usri11_max_storage specifies the maximum amount of disk space the user
3980        can occupy. A value of 0xffffffff indicates there are no
3981        restrictions.
3982
3983   usri11_units_per_week specifies the equal number of time units into
3984        which a week is divided. This value must be equal to 168.
3985
3986   usri11_logon_hours points to a 21 byte (168 bits) string that
3987        specifies the time during which the user can log on. Each bit
3988        represents one unique hour in a week. The first bit (bit 0, word
3989        0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3990
3991
3992
3993 Leach, Naik                                        [Page 29]
3994 \f
3995
3996
3997 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3998
3999
4000        Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
4001        are no restrictions.
4002
4003   usri11_code_page specifies the code page for the user's language of
4004        choice
4005
4006 All of the pointers in this data structure need to be treated
4007 specially. The  pointer is a 32 bit pointer. The higher 16 bits need
4008 to be ignored. The converter word returned in the parameters section
4009 needs to be subtracted from the lower 16 bits to calculate an offset
4010 into the return buffer where this ASCII string resides.
4011
4012 There is no auxiliary data in the response.
4013
4014   ****************************************************************************/
4015
4016 #define usri11_name           0
4017 #define usri11_pad            21
4018 #define usri11_comment        22
4019 #define usri11_usr_comment    26
4020 #define usri11_full_name      30
4021 #define usri11_priv           34
4022 #define usri11_auth_flags     36
4023 #define usri11_password_age   40
4024 #define usri11_homedir        44
4025 #define usri11_parms          48
4026 #define usri11_last_logon     52
4027 #define usri11_last_logoff    56
4028 #define usri11_bad_pw_count   60
4029 #define usri11_num_logons     62
4030 #define usri11_logon_server   64
4031 #define usri11_country_code   68
4032 #define usri11_workstations   70
4033 #define usri11_max_storage    74
4034 #define usri11_units_per_week 78
4035 #define usri11_logon_hours    80
4036 #define usri11_code_page      84
4037 #define usri11_end            86
4038
4039 static bool api_RNetUserGetInfo(struct smbd_server_connection *sconn,
4040                                 connection_struct *conn, uint16 vuid,
4041                                 char *param, int tpscnt,
4042                                 char *data, int tdscnt,
4043                                 int mdrcnt,int mprcnt,
4044                                 char **rdata,char **rparam,
4045                                 int *rdata_len,int *rparam_len)
4046 {
4047         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4048         char *str2 = skip_string(param,tpscnt,str1);
4049         char *UserName = skip_string(param,tpscnt,str2);
4050         char *p = skip_string(param,tpscnt,UserName);
4051         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4052         char *p2;
4053         char *endp;
4054         const char *level_string;
4055
4056         TALLOC_CTX *mem_ctx = talloc_tos();
4057         NTSTATUS status;
4058         struct rpc_pipe_client *cli = NULL;
4059         struct policy_handle connect_handle, domain_handle, user_handle;
4060         struct lsa_String domain_name;
4061         struct dom_sid2 *domain_sid;
4062         struct lsa_String names;
4063         struct samr_Ids rids;
4064         struct samr_Ids types;
4065         int errcode = W_ERROR_V(WERR_USER_NOT_FOUND);
4066         uint32_t rid;
4067         union samr_UserInfo *info;
4068
4069         if (!str1 || !str2 || !UserName || !p) {
4070                 return False;
4071         }
4072
4073         *rparam_len = 6;
4074         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4075         if (!*rparam) {
4076                 return False;
4077         }
4078
4079         DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
4080
4081         /* check it's a supported variant */
4082         if (strcmp(str1,"zWrLh") != 0) {
4083                 return False;
4084         }
4085         switch( uLevel ) {
4086                 case 0: level_string = "B21"; break;
4087                 case 1: level_string = "B21BB16DWzzWz"; break;
4088                 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
4089                 case 10: level_string = "B21Bzzz"; break;
4090                 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
4091                 default: return False;
4092         }
4093
4094         if (strcmp(level_string,str2) != 0) {
4095                 return False;
4096         }
4097
4098         *rdata_len = mdrcnt + 1024;
4099         *rdata = smb_realloc_limit(*rdata,*rdata_len);
4100         if (!*rdata) {
4101                 return False;
4102         }
4103
4104         p = *rdata;
4105         endp = *rdata + *rdata_len;
4106         p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
4107         if (!p2) {
4108                 return False;
4109         }
4110
4111         ZERO_STRUCT(connect_handle);
4112         ZERO_STRUCT(domain_handle);
4113         ZERO_STRUCT(user_handle);
4114
4115         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_samr.syntax_id,
4116                                         rpc_samr_dispatch, conn->server_info,
4117                                         &cli);
4118         if (!NT_STATUS_IS_OK(status)) {
4119                 DEBUG(0,("api_RNetUserGetInfo: could not connect to samr: %s\n",
4120                           nt_errstr(status)));
4121                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4122                 goto out;
4123         }
4124
4125         status = rpccli_samr_Connect2(cli, mem_ctx,
4126                                       global_myname(),
4127                                       SAMR_ACCESS_CONNECT_TO_SERVER |
4128                                       SAMR_ACCESS_ENUM_DOMAINS |
4129                                       SAMR_ACCESS_LOOKUP_DOMAIN,
4130                                       &connect_handle);
4131         if (!NT_STATUS_IS_OK(status)) {
4132                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4133                 goto out;
4134         }
4135
4136         init_lsa_String(&domain_name, get_global_sam_name());
4137
4138         status = rpccli_samr_LookupDomain(cli, mem_ctx,
4139                                           &connect_handle,
4140                                           &domain_name,
4141                                           &domain_sid);
4142         if (!NT_STATUS_IS_OK(status)) {
4143                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4144                 goto out;
4145         }
4146
4147         status = rpccli_samr_OpenDomain(cli, mem_ctx,
4148                                         &connect_handle,
4149                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4150                                         domain_sid,
4151                                         &domain_handle);
4152         if (!NT_STATUS_IS_OK(status)) {
4153                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4154                 goto out;
4155         }
4156
4157         init_lsa_String(&names, UserName);
4158
4159         status = rpccli_samr_LookupNames(cli, mem_ctx,
4160                                          &domain_handle,
4161                                          1,
4162                                          &names,
4163                                          &rids,
4164                                          &types);
4165         if (!NT_STATUS_IS_OK(status)) {
4166                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4167                 goto out;
4168         }
4169
4170         if (rids.count != 1) {
4171                 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
4172                 goto out;
4173         }
4174         if (rids.count != types.count) {
4175                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4176                 goto out;
4177         }
4178         if (types.ids[0] != SID_NAME_USER) {
4179                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
4180                 goto out;
4181         }
4182
4183         rid = rids.ids[0];
4184
4185         status = rpccli_samr_OpenUser(cli, mem_ctx,
4186                                       &domain_handle,
4187                                       SAMR_USER_ACCESS_GET_LOCALE |
4188                                       SAMR_USER_ACCESS_GET_LOGONINFO |
4189                                       SAMR_USER_ACCESS_GET_ATTRIBUTES |
4190                                       SAMR_USER_ACCESS_GET_GROUPS |
4191                                       SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP |
4192                                       SEC_STD_READ_CONTROL,
4193                                       rid,
4194                                       &user_handle);
4195         if (!NT_STATUS_IS_OK(status)) {
4196                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4197                 goto out;
4198         }
4199
4200         status = rpccli_samr_QueryUserInfo2(cli, mem_ctx,
4201                                             &user_handle,
4202                                             UserAllInformation,
4203                                             &info);
4204         if (!NT_STATUS_IS_OK(status)) {
4205                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4206                 goto out;
4207         }
4208
4209         memset(p,0,21);
4210         fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
4211
4212         if (uLevel > 0) {
4213                 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
4214                 *p2 = 0;
4215         }
4216
4217         if (uLevel >= 10) {
4218                 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
4219                 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
4220                 p2 = skip_string(*rdata,*rdata_len,p2);
4221                 if (!p2) {
4222                         return False;
4223                 }
4224
4225                 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
4226                 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
4227                 p2 = skip_string(*rdata,*rdata_len,p2);
4228                 if (!p2) {
4229                         return False;
4230                 }
4231
4232                 /* EEK! the cifsrap.txt doesn't have this in!!!! */
4233                 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
4234                 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4235                 p2 = skip_string(*rdata,*rdata_len,p2);
4236                 if (!p2) {
4237                         return False;
4238                 }
4239         }
4240
4241         if (uLevel == 11) {
4242                 const char *homedir = info->info21.home_directory.string;
4243                 /* modelled after NTAS 3.51 reply */
4244                 SSVAL(p,usri11_priv,
4245                         (get_current_uid(conn) == sec_initial_uid())?
4246                         USER_PRIV_ADMIN:USER_PRIV_USER);
4247                 SIVAL(p,usri11_auth_flags,AF_OP_PRINT);         /* auth flags */
4248                 SIVALS(p,usri11_password_age,-1);               /* password age */
4249                 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
4250                 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
4251                 p2 = skip_string(*rdata,*rdata_len,p2);
4252                 if (!p2) {
4253                         return False;
4254                 }
4255                 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
4256                 strlcpy(p2,"",PTR_DIFF(endp,p2));
4257                 p2 = skip_string(*rdata,*rdata_len,p2);
4258                 if (!p2) {
4259                         return False;
4260                 }
4261                 SIVAL(p,usri11_last_logon,0);           /* last logon */
4262                 SIVAL(p,usri11_last_logoff,0);          /* last logoff */
4263                 SSVALS(p,usri11_bad_pw_count,-1);       /* bad pw counts */
4264                 SSVALS(p,usri11_num_logons,-1);         /* num logons */
4265                 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
4266                 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
4267                 p2 = skip_string(*rdata,*rdata_len,p2);
4268                 if (!p2) {
4269                         return False;
4270                 }
4271                 SSVAL(p,usri11_country_code,0);         /* country code */
4272
4273                 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
4274                 strlcpy(p2,"",PTR_DIFF(endp,p2));
4275                 p2 = skip_string(*rdata,*rdata_len,p2);
4276                 if (!p2) {
4277                         return False;
4278                 }
4279
4280                 SIVALS(p,usri11_max_storage,-1);                /* max storage */
4281                 SSVAL(p,usri11_units_per_week,168);             /* units per week */
4282                 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
4283
4284                 /* a simple way to get logon hours at all times. */
4285                 memset(p2,0xff,21);
4286                 SCVAL(p2,21,0);           /* fix zero termination */
4287                 p2 = skip_string(*rdata,*rdata_len,p2);
4288                 if (!p2) {
4289                         return False;
4290                 }
4291
4292                 SSVAL(p,usri11_code_page,0);            /* code page */
4293         }
4294
4295         if (uLevel == 1 || uLevel == 2) {
4296                 memset(p+22,' ',16);    /* password */
4297                 SIVALS(p,38,-1);                /* password age */
4298                 SSVAL(p,42,
4299                         (get_current_uid(conn) == sec_initial_uid())?
4300                         USER_PRIV_ADMIN:USER_PRIV_USER);
4301                 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
4302                 strlcpy(p2, info->info21.home_directory.string,
4303                         PTR_DIFF(endp,p2));
4304                 p2 = skip_string(*rdata,*rdata_len,p2);
4305                 if (!p2) {
4306                         return False;
4307                 }
4308                 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
4309                 *p2++ = 0;
4310                 SSVAL(p,52,0);          /* flags */
4311                 SIVAL(p,54,PTR_DIFF(p2,*rdata));                /* script_path */
4312                 strlcpy(p2, info->info21.logon_script.string,
4313                         PTR_DIFF(endp,p2));
4314                 p2 = skip_string(*rdata,*rdata_len,p2);
4315                 if (!p2) {
4316                         return False;
4317                 }
4318                 if (uLevel == 2) {
4319                         SIVAL(p,58,0);          /* auth_flags */
4320                         SIVAL(p,62,PTR_DIFF(p2,*rdata)); /* full_name */
4321                         strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4322                         p2 = skip_string(*rdata,*rdata_len,p2);
4323                         if (!p2) {
4324                                 return False;
4325                         }
4326                         SIVAL(p,66,0);          /* urs_comment */
4327                         SIVAL(p,70,PTR_DIFF(p2,*rdata)); /* parms */
4328                         strlcpy(p2,"",PTR_DIFF(endp,p2));
4329                         p2 = skip_string(*rdata,*rdata_len,p2);
4330                         if (!p2) {
4331                                 return False;
4332                         }
4333                         SIVAL(p,74,0);          /* workstations */
4334                         SIVAL(p,78,0);          /* last_logon */
4335                         SIVAL(p,82,0);          /* last_logoff */
4336                         SIVALS(p,86,-1);                /* acct_expires */
4337                         SIVALS(p,90,-1);                /* max_storage */
4338                         SSVAL(p,94,168);        /* units_per_week */
4339                         SIVAL(p,96,PTR_DIFF(p2,*rdata)); /* logon_hours */
4340                         memset(p2,-1,21);
4341                         p2 += 21;
4342                         SSVALS(p,100,-1);       /* bad_pw_count */
4343                         SSVALS(p,102,-1);       /* num_logons */
4344                         SIVAL(p,104,PTR_DIFF(p2,*rdata)); /* logon_server */
4345                         {
4346                                 TALLOC_CTX *ctx = talloc_tos();
4347                                 int space_rem = *rdata_len - (p2 - *rdata);
4348                                 char *tmp;
4349
4350                                 if (space_rem <= 0) {
4351                                         return false;
4352                                 }
4353                                 tmp = talloc_strdup(ctx, "\\\\%L");
4354                                 if (!tmp) {
4355                                         return false;
4356                                 }
4357                                 tmp = talloc_sub_basic(ctx,
4358                                                 "",
4359                                                 "",
4360                                                 tmp);
4361                                 if (!tmp) {
4362                                         return false;
4363                                 }
4364
4365                                 push_ascii(p2,
4366                                         tmp,
4367                                         space_rem,
4368                                         STR_TERMINATE);
4369                         }
4370                         p2 = skip_string(*rdata,*rdata_len,p2);
4371                         if (!p2) {
4372                                 return False;
4373                         }
4374                         SSVAL(p,108,49);        /* country_code */
4375                         SSVAL(p,110,860);       /* code page */
4376                 }
4377         }
4378
4379         errcode = NERR_Success;
4380
4381  out:
4382         *rdata_len = PTR_DIFF(p2,*rdata);
4383
4384         if (cli && is_valid_policy_hnd(&user_handle)) {
4385                 rpccli_samr_Close(cli, mem_ctx, &user_handle);
4386         }
4387         if (cli && is_valid_policy_hnd(&domain_handle)) {
4388                 rpccli_samr_Close(cli, mem_ctx, &domain_handle);
4389         }
4390         if (cli && is_valid_policy_hnd(&connect_handle)) {
4391                 rpccli_samr_Close(cli, mem_ctx, &connect_handle);
4392         }
4393
4394         SSVAL(*rparam,0,errcode);
4395         SSVAL(*rparam,2,0);             /* converter word */
4396         SSVAL(*rparam,4,*rdata_len);    /* is this right?? */
4397
4398         return(True);
4399 }
4400
4401 static bool api_WWkstaUserLogon(struct smbd_server_connection *sconn,
4402                                 connection_struct *conn,uint16 vuid,
4403                                 char *param, int tpscnt,
4404                                 char *data, int tdscnt,
4405                                 int mdrcnt,int mprcnt,
4406                                 char **rdata,char **rparam,
4407                                 int *rdata_len,int *rparam_len)
4408 {
4409         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4410         char *str2 = skip_string(param,tpscnt,str1);
4411         char *p = skip_string(param,tpscnt,str2);
4412         int uLevel;
4413         struct pack_desc desc;
4414         char* name;
4415                 /* With share level security vuid will always be zero.
4416                    Don't depend on vuser being non-null !!. JRA */
4417         user_struct *vuser = get_valid_user_struct(sconn, vuid);
4418
4419         if (!str1 || !str2 || !p) {
4420                 return False;
4421         }
4422
4423         if(vuser != NULL) {
4424                 DEBUG(3,("  Username of UID %d is %s\n",
4425                          (int)vuser->server_info->utok.uid,
4426                          vuser->server_info->unix_name));
4427         }
4428
4429         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4430         name = get_safe_str_ptr(param,tpscnt,p,2);
4431         if (!name) {
4432                 return False;
4433         }
4434
4435         memset((char *)&desc,'\0',sizeof(desc));
4436
4437         DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
4438
4439         /* check it's a supported varient */
4440         if (strcmp(str1,"OOWb54WrLh") != 0) {
4441                 return False;
4442         }
4443         if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
4444                 return False;
4445         }
4446         if (mdrcnt > 0) {
4447                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4448                 if (!*rdata) {
4449                         return False;
4450                 }
4451         }
4452
4453         desc.base = *rdata;
4454         desc.buflen = mdrcnt;
4455         desc.subformat = NULL;
4456         desc.format = str2;
4457
4458         if (init_package(&desc,1,0)) {
4459                 PACKI(&desc,"W",0);             /* code */
4460                 PACKS(&desc,"B21",name);        /* eff. name */
4461                 PACKS(&desc,"B","");            /* pad */
4462                 PACKI(&desc,"W",
4463                         (get_current_uid(conn) == sec_initial_uid())?
4464                         USER_PRIV_ADMIN:USER_PRIV_USER);
4465                 PACKI(&desc,"D",0);             /* auth flags XXX */
4466                 PACKI(&desc,"W",0);             /* num logons */
4467                 PACKI(&desc,"W",0);             /* bad pw count */
4468                 PACKI(&desc,"D",0);             /* last logon */
4469                 PACKI(&desc,"D",-1);            /* last logoff */
4470                 PACKI(&desc,"D",-1);            /* logoff time */
4471                 PACKI(&desc,"D",-1);            /* kickoff time */
4472                 PACKI(&desc,"D",0);             /* password age */
4473                 PACKI(&desc,"D",0);             /* password can change */
4474                 PACKI(&desc,"D",-1);            /* password must change */
4475
4476                 {
4477                         fstring mypath;
4478                         fstrcpy(mypath,"\\\\");
4479                         fstrcat(mypath,get_local_machine_name());
4480                         strupper_m(mypath);
4481                         PACKS(&desc,"z",mypath); /* computer */
4482                 }
4483
4484                 PACKS(&desc,"z",lp_workgroup());/* domain */
4485                 PACKS(&desc,"z", vuser ?
4486                         vuser->server_info->info3->base.logon_script.string
4487                         : ""); /* script path */
4488                 PACKI(&desc,"D",0x00000000);            /* reserved */
4489         }
4490
4491         *rdata_len = desc.usedlen;
4492         *rparam_len = 6;
4493         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4494         if (!*rparam) {
4495                 return False;
4496         }
4497         SSVALS(*rparam,0,desc.errcode);
4498         SSVAL(*rparam,2,0);
4499         SSVAL(*rparam,4,desc.neededlen);
4500
4501         DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4502
4503         return True;
4504 }
4505
4506 /****************************************************************************
4507  api_WAccessGetUserPerms
4508 ****************************************************************************/
4509
4510 static bool api_WAccessGetUserPerms(struct smbd_server_connection *sconn,
4511                                     connection_struct *conn,uint16 vuid,
4512                                 char *param, int tpscnt,
4513                                 char *data, int tdscnt,
4514                                 int mdrcnt,int mprcnt,
4515                                 char **rdata,char **rparam,
4516                                 int *rdata_len,int *rparam_len)
4517 {
4518         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4519         char *str2 = skip_string(param,tpscnt,str1);
4520         char *user = skip_string(param,tpscnt,str2);
4521         char *resource = skip_string(param,tpscnt,user);
4522
4523         if (!str1 || !str2 || !user || !resource) {
4524                 return False;
4525         }
4526
4527         if (skip_string(param,tpscnt,resource) == NULL) {
4528                 return False;
4529         }
4530         DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4531
4532         /* check it's a supported varient */
4533         if (strcmp(str1,"zzh") != 0) {
4534                 return False;
4535         }
4536         if (strcmp(str2,"") != 0) {
4537                 return False;
4538         }
4539
4540         *rparam_len = 6;
4541         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4542         if (!*rparam) {
4543                 return False;
4544         }
4545         SSVALS(*rparam,0,0);            /* errorcode */
4546         SSVAL(*rparam,2,0);             /* converter word */
4547         SSVAL(*rparam,4,0x7f);  /* permission flags */
4548
4549         return True;
4550 }
4551
4552 /****************************************************************************
4553   api_WPrintJobEnumerate
4554   ****************************************************************************/
4555
4556 static bool api_WPrintJobGetInfo(struct smbd_server_connection *sconn,
4557                                  connection_struct *conn, uint16 vuid,
4558                                 char *param, int tpscnt,
4559                                 char *data, int tdscnt,
4560                                 int mdrcnt,int mprcnt,
4561                                 char **rdata,char **rparam,
4562                                 int *rdata_len,int *rparam_len)
4563 {
4564         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4565         char *str2 = skip_string(param,tpscnt,str1);
4566         char *p = skip_string(param,tpscnt,str2);
4567         int uLevel;
4568         fstring sharename;
4569         uint32 jobid;
4570         struct pack_desc desc;
4571         char *tmpdata=NULL;
4572
4573         TALLOC_CTX *mem_ctx = talloc_tos();
4574         WERROR werr;
4575         NTSTATUS status;
4576         struct rpc_pipe_client *cli = NULL;
4577         struct policy_handle handle;
4578         struct spoolss_DevmodeContainer devmode_ctr;
4579         union spoolss_JobInfo info;
4580
4581         if (!str1 || !str2 || !p) {
4582                 return False;
4583         }
4584
4585         uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4586
4587         memset((char *)&desc,'\0',sizeof(desc));
4588         memset((char *)&status,'\0',sizeof(status));
4589
4590         DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4591
4592         /* check it's a supported varient */
4593         if (strcmp(str1,"WWrLh") != 0) {
4594                 return False;
4595         }
4596         if (!check_printjob_info(&desc,uLevel,str2)) {
4597                 return False;
4598         }
4599
4600         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4601                 return False;
4602         }
4603
4604         ZERO_STRUCT(handle);
4605
4606         status = rpc_connect_spoolss_pipe(conn, &cli);
4607         if (!NT_STATUS_IS_OK(status)) {
4608                 DEBUG(0,("api_WPrintJobGetInfo: could not connect to spoolss: %s\n",
4609                           nt_errstr(status)));
4610                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4611                 goto out;
4612         }
4613
4614         ZERO_STRUCT(devmode_ctr);
4615
4616         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
4617                                             sharename,
4618                                             "RAW",
4619                                             devmode_ctr,
4620                                             PRINTER_ACCESS_USE,
4621                                             &handle,
4622                                             &werr);
4623         if (!NT_STATUS_IS_OK(status)) {
4624                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4625                 goto out;
4626         }
4627         if (!W_ERROR_IS_OK(werr)) {
4628                 desc.errcode = W_ERROR_V(werr);
4629                 goto out;
4630         }
4631
4632         werr = rpccli_spoolss_getjob(cli, mem_ctx,
4633                                      &handle,
4634                                      jobid,
4635                                      2, /* level */
4636                                      0, /* offered */
4637                                      &info);
4638         if (!W_ERROR_IS_OK(werr)) {
4639                 desc.errcode = W_ERROR_V(werr);
4640                 goto out;
4641         }
4642
4643         if (mdrcnt > 0) {
4644                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4645                 if (!*rdata) {
4646                         return False;
4647                 }
4648                 desc.base = *rdata;
4649                 desc.buflen = mdrcnt;
4650         } else {
4651                 /*
4652                  * Don't return data but need to get correct length
4653                  *  init_package will return wrong size if buflen=0
4654                  */
4655                 desc.buflen = getlen(desc.format);
4656                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4657         }
4658
4659         if (init_package(&desc,1,0)) {
4660                 fill_spoolss_printjob_info(uLevel, &desc, &info.info2, info.info2.position);
4661                 *rdata_len = desc.usedlen;
4662         } else {
4663                 desc.errcode = NERR_JobNotFound;
4664                 *rdata_len = 0;
4665         }
4666  out:
4667         if (cli && is_valid_policy_hnd(&handle)) {
4668                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
4669         }
4670
4671         *rparam_len = 6;
4672         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4673         if (!*rparam) {
4674                 return False;
4675         }
4676         SSVALS(*rparam,0,desc.errcode);
4677         SSVAL(*rparam,2,0);
4678         SSVAL(*rparam,4,desc.neededlen);
4679
4680         SAFE_FREE(tmpdata);
4681
4682         DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4683
4684         return True;
4685 }
4686
4687 static bool api_WPrintJobEnumerate(struct smbd_server_connection *sconn,
4688                                    connection_struct *conn, uint16 vuid,
4689                                 char *param, int tpscnt,
4690                                 char *data, int tdscnt,
4691                                 int mdrcnt,int mprcnt,
4692                                 char **rdata,char **rparam,
4693                                 int *rdata_len,int *rparam_len)
4694 {
4695         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4696         char *str2 = skip_string(param,tpscnt,str1);
4697         char *p = skip_string(param,tpscnt,str2);
4698         char *name = p;
4699         int uLevel;
4700         int i, succnt=0;
4701         struct pack_desc desc;
4702
4703         TALLOC_CTX *mem_ctx = talloc_tos();
4704         WERROR werr;
4705         NTSTATUS status;
4706         struct rpc_pipe_client *cli = NULL;
4707         struct policy_handle handle;
4708         struct spoolss_DevmodeContainer devmode_ctr;
4709         uint32_t count = 0;
4710         union spoolss_JobInfo *info;
4711
4712         if (!str1 || !str2 || !p) {
4713                 return False;
4714         }
4715
4716         memset((char *)&desc,'\0',sizeof(desc));
4717
4718         p = skip_string(param,tpscnt,p);
4719         if (!p) {
4720                 return False;
4721         }
4722         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4723
4724         DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4725
4726         /* check it's a supported variant */
4727         if (strcmp(str1,"zWrLeh") != 0) {
4728                 return False;
4729         }
4730
4731         if (uLevel > 2) {
4732                 return False;   /* defined only for uLevel 0,1,2 */
4733         }
4734
4735         if (!check_printjob_info(&desc,uLevel,str2)) {
4736                 return False;
4737         }
4738
4739         ZERO_STRUCT(handle);
4740
4741         status = rpc_connect_spoolss_pipe(conn, &cli);
4742         if (!NT_STATUS_IS_OK(status)) {
4743                 DEBUG(0,("api_WPrintJobEnumerate: could not connect to spoolss: %s\n",
4744                           nt_errstr(status)));
4745                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4746                 goto out;
4747         }
4748
4749         ZERO_STRUCT(devmode_ctr);
4750
4751         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
4752                                             name,
4753                                             NULL,
4754                                             devmode_ctr,
4755                                             SEC_FLAG_MAXIMUM_ALLOWED,
4756                                             &handle,
4757                                             &werr);
4758         if (!NT_STATUS_IS_OK(status)) {
4759                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4760                 goto out;
4761         }
4762         if (!W_ERROR_IS_OK(werr)) {
4763                 desc.errcode = W_ERROR_V(werr);
4764                 goto out;
4765         }
4766
4767         werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
4768                                        &handle,
4769                                        0, /* firstjob */
4770                                        0xff, /* numjobs */
4771                                        2, /* level */
4772                                        0, /* offered */
4773                                        &count,
4774                                        &info);
4775         if (!W_ERROR_IS_OK(werr)) {
4776                 desc.errcode = W_ERROR_V(werr);
4777                 goto out;
4778         }
4779
4780         if (mdrcnt > 0) {
4781                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4782                 if (!*rdata) {
4783                         return False;
4784                 }
4785         }
4786         desc.base = *rdata;
4787         desc.buflen = mdrcnt;
4788
4789         if (init_package(&desc,count,0)) {
4790                 succnt = 0;
4791                 for (i = 0; i < count; i++) {
4792                         fill_spoolss_printjob_info(uLevel, &desc, &info[i].info2, i);
4793                         if (desc.errcode == NERR_Success) {
4794                                 succnt = i+1;
4795                         }
4796                 }
4797         }
4798  out:
4799         if (cli && is_valid_policy_hnd(&handle)) {
4800                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
4801         }
4802
4803         *rdata_len = desc.usedlen;
4804
4805         *rparam_len = 8;
4806         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4807         if (!*rparam) {
4808                 return False;
4809         }
4810         SSVALS(*rparam,0,desc.errcode);
4811         SSVAL(*rparam,2,0);
4812         SSVAL(*rparam,4,succnt);
4813         SSVAL(*rparam,6,count);
4814
4815         DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4816
4817         return True;
4818 }
4819
4820 static int check_printdest_info(struct pack_desc* desc,
4821                                 int uLevel, char* id)
4822 {
4823         desc->subformat = NULL;
4824         switch( uLevel ) {
4825                 case 0:
4826                         desc->format = "B9";
4827                         break;
4828                 case 1:
4829                         desc->format = "B9B21WWzW";
4830                         break;
4831                 case 2:
4832                         desc->format = "z";
4833                         break;
4834                 case 3:
4835                         desc->format = "zzzWWzzzWW";
4836                         break;
4837                 default:
4838                         DEBUG(0,("check_printdest_info: invalid level %d\n",
4839                                 uLevel));
4840                         return False;
4841         }
4842         if (id == NULL || strcmp(desc->format,id) != 0) {
4843                 DEBUG(0,("check_printdest_info: invalid string %s\n",
4844                         id ? id : "<NULL>" ));
4845                 return False;
4846         }
4847         return True;
4848 }
4849
4850 static void fill_printdest_info(struct spoolss_PrinterInfo2 *info2, int uLevel,
4851                                 struct pack_desc* desc)
4852 {
4853         char buf[100];
4854
4855         strncpy(buf, info2->printername, sizeof(buf)-1);
4856         buf[sizeof(buf)-1] = 0;
4857         strupper_m(buf);
4858
4859         if (uLevel <= 1) {
4860                 PACKS(desc,"B9",buf);   /* szName */
4861                 if (uLevel == 1) {
4862                         PACKS(desc,"B21","");   /* szUserName */
4863                         PACKI(desc,"W",0);              /* uJobId */
4864                         PACKI(desc,"W",0);              /* fsStatus */
4865                         PACKS(desc,"z","");     /* pszStatus */
4866                         PACKI(desc,"W",0);              /* time */
4867                 }
4868         }
4869
4870         if (uLevel == 2 || uLevel == 3) {
4871                 PACKS(desc,"z",buf);            /* pszPrinterName */
4872                 if (uLevel == 3) {
4873                         PACKS(desc,"z","");     /* pszUserName */
4874                         PACKS(desc,"z","");     /* pszLogAddr */
4875                         PACKI(desc,"W",0);              /* uJobId */
4876                         PACKI(desc,"W",0);              /* fsStatus */
4877                         PACKS(desc,"z","");     /* pszStatus */
4878                         PACKS(desc,"z","");     /* pszComment */
4879                         PACKS(desc,"z","NULL"); /* pszDrivers */
4880                         PACKI(desc,"W",0);              /* time */
4881                         PACKI(desc,"W",0);              /* pad1 */
4882                 }
4883         }
4884 }
4885
4886 static bool api_WPrintDestGetInfo(struct smbd_server_connection *sconn,
4887                                   connection_struct *conn, uint16 vuid,
4888                                 char *param, int tpscnt,
4889                                 char *data, int tdscnt,
4890                                 int mdrcnt,int mprcnt,
4891                                 char **rdata,char **rparam,
4892                                 int *rdata_len,int *rparam_len)
4893 {
4894         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4895         char *str2 = skip_string(param,tpscnt,str1);
4896         char *p = skip_string(param,tpscnt,str2);
4897         char* PrinterName = p;
4898         int uLevel;
4899         struct pack_desc desc;
4900         char *tmpdata=NULL;
4901
4902         TALLOC_CTX *mem_ctx = talloc_tos();
4903         WERROR werr;
4904         NTSTATUS status;
4905         struct rpc_pipe_client *cli = NULL;
4906         struct policy_handle handle;
4907         struct spoolss_DevmodeContainer devmode_ctr;
4908         union spoolss_PrinterInfo info;
4909
4910         if (!str1 || !str2 || !p) {
4911                 return False;
4912         }
4913
4914         memset((char *)&desc,'\0',sizeof(desc));
4915
4916         p = skip_string(param,tpscnt,p);
4917         if (!p) {
4918                 return False;
4919         }
4920         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4921
4922         DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4923
4924         /* check it's a supported varient */
4925         if (strcmp(str1,"zWrLh") != 0) {
4926                 return False;
4927         }
4928         if (!check_printdest_info(&desc,uLevel,str2)) {
4929                 return False;
4930         }
4931
4932         ZERO_STRUCT(handle);
4933
4934         status = rpc_connect_spoolss_pipe(conn, &cli);
4935         if (!NT_STATUS_IS_OK(status)) {
4936                 DEBUG(0,("api_WPrintDestGetInfo: could not connect to spoolss: %s\n",
4937                           nt_errstr(status)));
4938                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4939                 goto out;
4940         }
4941
4942         ZERO_STRUCT(devmode_ctr);
4943
4944         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
4945                                             PrinterName,
4946                                             NULL,
4947                                             devmode_ctr,
4948                                             SEC_FLAG_MAXIMUM_ALLOWED,
4949                                             &handle,
4950                                             &werr);
4951         if (!NT_STATUS_IS_OK(status)) {
4952                 *rdata_len = 0;
4953                 desc.errcode = NERR_DestNotFound;
4954                 desc.neededlen = 0;
4955                 goto out;
4956         }
4957         if (!W_ERROR_IS_OK(werr)) {
4958                 *rdata_len = 0;
4959                 desc.errcode = NERR_DestNotFound;
4960                 desc.neededlen = 0;
4961                 goto out;
4962         }
4963
4964         werr = rpccli_spoolss_getprinter(cli, mem_ctx,
4965                                          &handle,
4966                                          2,
4967                                          0,
4968                                          &info);
4969         if (!W_ERROR_IS_OK(werr)) {
4970                 *rdata_len = 0;
4971                 desc.errcode = NERR_DestNotFound;
4972                 desc.neededlen = 0;
4973                 goto out;
4974         }
4975
4976         if (mdrcnt > 0) {
4977                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4978                 if (!*rdata) {
4979                         return False;
4980                 }
4981                 desc.base = *rdata;
4982                 desc.buflen = mdrcnt;
4983         } else {
4984                 /*
4985                  * Don't return data but need to get correct length
4986                  * init_package will return wrong size if buflen=0
4987                  */
4988                 desc.buflen = getlen(desc.format);
4989                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4990         }
4991         if (init_package(&desc,1,0)) {
4992                 fill_printdest_info(&info.info2, uLevel,&desc);
4993         }
4994
4995  out:
4996         if (cli && is_valid_policy_hnd(&handle)) {
4997                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
4998         }
4999
5000         *rdata_len = desc.usedlen;
5001
5002         *rparam_len = 6;
5003         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5004         if (!*rparam) {
5005                 return False;
5006         }
5007         SSVALS(*rparam,0,desc.errcode);
5008         SSVAL(*rparam,2,0);
5009         SSVAL(*rparam,4,desc.neededlen);
5010
5011         DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
5012         SAFE_FREE(tmpdata);
5013
5014         return True;
5015 }
5016
5017 static bool api_WPrintDestEnum(struct smbd_server_connection *sconn,
5018                                connection_struct *conn, uint16 vuid,
5019                                 char *param, int tpscnt,
5020                                 char *data, int tdscnt,
5021                                 int mdrcnt,int mprcnt,
5022                                 char **rdata,char **rparam,
5023                                 int *rdata_len,int *rparam_len)
5024 {
5025         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5026         char *str2 = skip_string(param,tpscnt,str1);
5027         char *p = skip_string(param,tpscnt,str2);
5028         int uLevel;
5029         int queuecnt;
5030         int i, n, succnt=0;
5031         struct pack_desc desc;
5032
5033         TALLOC_CTX *mem_ctx = talloc_tos();
5034         WERROR werr;
5035         NTSTATUS status;
5036         struct rpc_pipe_client *cli = NULL;
5037         union spoolss_PrinterInfo *info;
5038         uint32_t count;
5039
5040         if (!str1 || !str2 || !p) {
5041                 return False;
5042         }
5043
5044         memset((char *)&desc,'\0',sizeof(desc));
5045
5046         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5047
5048         DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
5049
5050         /* check it's a supported varient */
5051         if (strcmp(str1,"WrLeh") != 0) {
5052                 return False;
5053         }
5054         if (!check_printdest_info(&desc,uLevel,str2)) {
5055                 return False;
5056         }
5057
5058         queuecnt = 0;
5059
5060         status = rpc_connect_spoolss_pipe(conn, &cli);
5061         if (!NT_STATUS_IS_OK(status)) {
5062                 DEBUG(0,("api_WPrintDestEnum: could not connect to spoolss: %s\n",
5063                           nt_errstr(status)));
5064                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5065                 goto out;
5066         }
5067
5068         werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
5069                                            PRINTER_ENUM_LOCAL,
5070                                            cli->srv_name_slash,
5071                                            2,
5072                                            0,
5073                                            &count,
5074                                            &info);
5075         if (!W_ERROR_IS_OK(werr)) {
5076                 desc.errcode = W_ERROR_V(werr);
5077                 *rdata_len = 0;
5078                 desc.errcode = NERR_DestNotFound;
5079                 desc.neededlen = 0;
5080                 goto out;
5081         }
5082
5083         queuecnt = count;
5084
5085         if (mdrcnt > 0) {
5086                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5087                 if (!*rdata) {
5088                         return False;
5089                 }
5090         }
5091
5092         desc.base = *rdata;
5093         desc.buflen = mdrcnt;
5094         if (init_package(&desc,queuecnt,0)) {
5095                 succnt = 0;
5096                 n = 0;
5097                 for (i = 0; i < count; i++) {
5098                         fill_printdest_info(&info[i].info2, uLevel,&desc);
5099                         n++;
5100                         if (desc.errcode == NERR_Success) {
5101                                 succnt = n;
5102                         }
5103                 }
5104         }
5105  out:
5106         *rdata_len = desc.usedlen;
5107
5108         *rparam_len = 8;
5109         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5110         if (!*rparam) {
5111                 return False;
5112         }
5113         SSVALS(*rparam,0,desc.errcode);
5114         SSVAL(*rparam,2,0);
5115         SSVAL(*rparam,4,succnt);
5116         SSVAL(*rparam,6,queuecnt);
5117
5118         DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
5119
5120         return True;
5121 }
5122
5123 static bool api_WPrintDriverEnum(struct smbd_server_connection *sconn,
5124                                  connection_struct *conn, uint16 vuid,
5125                                 char *param, int tpscnt,
5126                                 char *data, int tdscnt,
5127                                 int mdrcnt,int mprcnt,
5128                                 char **rdata,char **rparam,
5129                                 int *rdata_len,int *rparam_len)
5130 {
5131         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5132         char *str2 = skip_string(param,tpscnt,str1);
5133         char *p = skip_string(param,tpscnt,str2);
5134         int uLevel;
5135         int succnt;
5136         struct pack_desc desc;
5137
5138         if (!str1 || !str2 || !p) {
5139                 return False;
5140         }
5141
5142         memset((char *)&desc,'\0',sizeof(desc));
5143
5144         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5145
5146         DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
5147
5148         /* check it's a supported varient */
5149         if (strcmp(str1,"WrLeh") != 0) {
5150                 return False;
5151         }
5152         if (uLevel != 0 || strcmp(str2,"B41") != 0) {
5153                 return False;
5154         }
5155
5156         if (mdrcnt > 0) {
5157                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5158                 if (!*rdata) {
5159                         return False;
5160                 }
5161         }
5162         desc.base = *rdata;
5163         desc.buflen = mdrcnt;
5164         if (init_package(&desc,1,0)) {
5165                 PACKS(&desc,"B41","NULL");
5166         }
5167
5168         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5169
5170         *rdata_len = desc.usedlen;
5171
5172         *rparam_len = 8;
5173         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5174         if (!*rparam) {
5175                 return False;
5176         }
5177         SSVALS(*rparam,0,desc.errcode);
5178         SSVAL(*rparam,2,0);
5179         SSVAL(*rparam,4,succnt);
5180         SSVAL(*rparam,6,1);
5181
5182         DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
5183
5184         return True;
5185 }
5186
5187 static bool api_WPrintQProcEnum(struct smbd_server_connection *sconn,
5188                                 connection_struct *conn, uint16 vuid,
5189                                 char *param, int tpscnt,
5190                                 char *data, int tdscnt,
5191                                 int mdrcnt,int mprcnt,
5192                                 char **rdata,char **rparam,
5193                                 int *rdata_len,int *rparam_len)
5194 {
5195         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5196         char *str2 = skip_string(param,tpscnt,str1);
5197         char *p = skip_string(param,tpscnt,str2);
5198         int uLevel;
5199         int succnt;
5200         struct pack_desc desc;
5201
5202         if (!str1 || !str2 || !p) {
5203                 return False;
5204         }
5205         memset((char *)&desc,'\0',sizeof(desc));
5206
5207         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5208
5209         DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
5210
5211         /* check it's a supported varient */
5212         if (strcmp(str1,"WrLeh") != 0) {
5213                 return False;
5214         }
5215         if (uLevel != 0 || strcmp(str2,"B13") != 0) {
5216                 return False;
5217         }
5218
5219         if (mdrcnt > 0) {
5220                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5221                 if (!*rdata) {
5222                         return False;
5223                 }
5224         }
5225         desc.base = *rdata;
5226         desc.buflen = mdrcnt;
5227         desc.format = str2;
5228         if (init_package(&desc,1,0)) {
5229                 PACKS(&desc,"B13","lpd");
5230         }
5231
5232         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5233
5234         *rdata_len = desc.usedlen;
5235
5236         *rparam_len = 8;
5237         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5238         if (!*rparam) {
5239                 return False;
5240         }
5241         SSVALS(*rparam,0,desc.errcode);
5242         SSVAL(*rparam,2,0);
5243         SSVAL(*rparam,4,succnt);
5244         SSVAL(*rparam,6,1);
5245
5246         DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
5247
5248         return True;
5249 }
5250
5251 static bool api_WPrintPortEnum(struct smbd_server_connection *sconn,
5252                                connection_struct *conn, uint16 vuid,
5253                                 char *param, int tpscnt,
5254                                 char *data, int tdscnt,
5255                                 int mdrcnt,int mprcnt,
5256                                 char **rdata,char **rparam,
5257                                 int *rdata_len,int *rparam_len)
5258 {
5259         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5260         char *str2 = skip_string(param,tpscnt,str1);
5261         char *p = skip_string(param,tpscnt,str2);
5262         int uLevel;
5263         int succnt;
5264         struct pack_desc desc;
5265
5266         if (!str1 || !str2 || !p) {
5267                 return False;
5268         }
5269
5270         memset((char *)&desc,'\0',sizeof(desc));
5271
5272         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5273
5274         DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
5275
5276         /* check it's a supported varient */
5277         if (strcmp(str1,"WrLeh") != 0) {
5278                 return False;
5279         }
5280         if (uLevel != 0 || strcmp(str2,"B9") != 0) {
5281                 return False;
5282         }
5283
5284         if (mdrcnt > 0) {
5285                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5286                 if (!*rdata) {
5287                         return False;
5288                 }
5289         }
5290         memset((char *)&desc,'\0',sizeof(desc));
5291         desc.base = *rdata;
5292         desc.buflen = mdrcnt;
5293         desc.format = str2;
5294         if (init_package(&desc,1,0)) {
5295                 PACKS(&desc,"B13","lp0");
5296         }
5297
5298         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5299
5300         *rdata_len = desc.usedlen;
5301
5302         *rparam_len = 8;
5303         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5304         if (!*rparam) {
5305                 return False;
5306         }
5307         SSVALS(*rparam,0,desc.errcode);
5308         SSVAL(*rparam,2,0);
5309         SSVAL(*rparam,4,succnt);
5310         SSVAL(*rparam,6,1);
5311
5312         DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
5313
5314         return True;
5315 }
5316
5317 /****************************************************************************
5318  List open sessions
5319  ****************************************************************************/
5320
5321 static bool api_RNetSessionEnum(struct smbd_server_connection *sconn,
5322                                 connection_struct *conn, uint16 vuid,
5323                                 char *param, int tpscnt,
5324                                 char *data, int tdscnt,
5325                                 int mdrcnt,int mprcnt,
5326                                 char **rdata,char **rparam,
5327                                 int *rdata_len,int *rparam_len)
5328
5329 {
5330         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5331         char *str2 = skip_string(param,tpscnt,str1);
5332         char *p = skip_string(param,tpscnt,str2);
5333         int uLevel;
5334         struct pack_desc desc;
5335         struct sessionid *session_list;
5336         int i, num_sessions;
5337
5338         if (!str1 || !str2 || !p) {
5339                 return False;
5340         }
5341
5342         memset((char *)&desc,'\0',sizeof(desc));
5343
5344         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5345
5346         DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
5347         DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
5348         DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
5349
5350         /* check it's a supported varient */
5351         if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
5352                 return False;
5353         }
5354         if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
5355                 return False;
5356         }
5357
5358         num_sessions = list_sessions(talloc_tos(), &session_list);
5359
5360         if (mdrcnt > 0) {
5361                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5362                 if (!*rdata) {
5363                         return False;
5364                 }
5365         }
5366         memset((char *)&desc,'\0',sizeof(desc));
5367         desc.base = *rdata;
5368         desc.buflen = mdrcnt;
5369         desc.format = str2;
5370         if (!init_package(&desc,num_sessions,0)) {
5371                 return False;
5372         }
5373
5374         for(i=0; i<num_sessions; i++) {
5375                 PACKS(&desc, "z", session_list[i].remote_machine);
5376                 PACKS(&desc, "z", session_list[i].username);
5377                 PACKI(&desc, "W", 1); /* num conns */
5378                 PACKI(&desc, "W", 0); /* num opens */
5379                 PACKI(&desc, "W", 1); /* num users */
5380                 PACKI(&desc, "D", 0); /* session time */
5381                 PACKI(&desc, "D", 0); /* idle time */
5382                 PACKI(&desc, "D", 0); /* flags */
5383                 PACKS(&desc, "z", "Unknown Client"); /* client type string */
5384         }
5385
5386         *rdata_len = desc.usedlen;
5387
5388         *rparam_len = 8;
5389         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5390         if (!*rparam) {
5391                 return False;
5392         }
5393         SSVALS(*rparam,0,desc.errcode);
5394         SSVAL(*rparam,2,0); /* converter */
5395         SSVAL(*rparam,4,num_sessions); /* count */
5396
5397         DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
5398
5399         return True;
5400 }
5401
5402
5403 /****************************************************************************
5404  The buffer was too small.
5405  ****************************************************************************/
5406
5407 static bool api_TooSmall(struct smbd_server_connection *sconn,
5408                          connection_struct *conn,uint16 vuid, char *param, char *data,
5409                          int mdrcnt, int mprcnt,
5410                          char **rdata, char **rparam,
5411                          int *rdata_len, int *rparam_len)
5412 {
5413         *rparam_len = MIN(*rparam_len,mprcnt);
5414         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5415         if (!*rparam) {
5416                 return False;
5417         }
5418
5419         *rdata_len = 0;
5420
5421         SSVAL(*rparam,0,NERR_BufTooSmall);
5422
5423         DEBUG(3,("Supplied buffer too small in API command\n"));
5424
5425         return True;
5426 }
5427
5428 /****************************************************************************
5429  The request is not supported.
5430  ****************************************************************************/
5431
5432 static bool api_Unsupported(struct smbd_server_connection *sconn,
5433                             connection_struct *conn, uint16 vuid,
5434                                 char *param, int tpscnt,
5435                                 char *data, int tdscnt,
5436                                 int mdrcnt, int mprcnt,
5437                                 char **rdata, char **rparam,
5438                                 int *rdata_len, int *rparam_len)
5439 {
5440         *rparam_len = 4;
5441         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5442         if (!*rparam) {
5443                 return False;
5444         }
5445
5446         *rdata_len = 0;
5447
5448         SSVAL(*rparam,0,NERR_notsupported);
5449         SSVAL(*rparam,2,0);             /* converter word */
5450
5451         DEBUG(3,("Unsupported API command\n"));
5452
5453         return True;
5454 }
5455
5456 static const struct {
5457         const char *name;
5458         int id;
5459         bool (*fn)(struct smbd_server_connection *sconn,
5460                    connection_struct *, uint16,
5461                         char *, int,
5462                         char *, int,
5463                         int,int,char **,char **,int *,int *);
5464         bool auth_user;         /* Deny anonymous access? */
5465 } api_commands[] = {
5466         {"RNetShareEnum",       RAP_WshareEnum,         api_RNetShareEnum, True},
5467         {"RNetShareGetInfo",    RAP_WshareGetInfo,      api_RNetShareGetInfo},
5468         {"RNetShareAdd",        RAP_WshareAdd,          api_RNetShareAdd},
5469         {"RNetSessionEnum",     RAP_WsessionEnum,       api_RNetSessionEnum, True},
5470         {"RNetServerGetInfo",   RAP_WserverGetInfo,     api_RNetServerGetInfo},
5471         {"RNetGroupEnum",       RAP_WGroupEnum,         api_RNetGroupEnum, True},
5472         {"RNetGroupGetUsers", RAP_WGroupGetUsers,       api_RNetGroupGetUsers, True},
5473         {"RNetUserEnum",        RAP_WUserEnum,          api_RNetUserEnum, True},
5474         {"RNetUserGetInfo",     RAP_WUserGetInfo,       api_RNetUserGetInfo},
5475         {"NetUserGetGroups",    RAP_WUserGetGroups,     api_NetUserGetGroups},
5476         {"NetWkstaGetInfo",     RAP_WWkstaGetInfo,      api_NetWkstaGetInfo},
5477         {"DosPrintQEnum",       RAP_WPrintQEnum,        api_DosPrintQEnum, True},
5478         {"DosPrintQGetInfo",    RAP_WPrintQGetInfo,     api_DosPrintQGetInfo},
5479         {"WPrintQueuePause",  RAP_WPrintQPause, api_WPrintQueueCtrl},
5480         {"WPrintQueueResume", RAP_WPrintQContinue,      api_WPrintQueueCtrl},
5481         {"WPrintJobEnumerate",RAP_WPrintJobEnum,        api_WPrintJobEnumerate},
5482         {"WPrintJobGetInfo",    RAP_WPrintJobGetInfo,   api_WPrintJobGetInfo},
5483         {"RDosPrintJobDel",     RAP_WPrintJobDel,       api_RDosPrintJobDel},
5484         {"RDosPrintJobPause",   RAP_WPrintJobPause,     api_RDosPrintJobDel},
5485         {"RDosPrintJobResume",RAP_WPrintJobContinue,    api_RDosPrintJobDel},
5486         {"WPrintDestEnum",      RAP_WPrintDestEnum,     api_WPrintDestEnum},
5487         {"WPrintDestGetInfo",   RAP_WPrintDestGetInfo,  api_WPrintDestGetInfo},
5488         {"NetRemoteTOD",        RAP_NetRemoteTOD,       api_NetRemoteTOD},
5489         {"WPrintQueuePurge",    RAP_WPrintQPurge,       api_WPrintQueueCtrl},
5490         {"NetServerEnum2",      RAP_NetServerEnum2,     api_RNetServerEnum2}, /* anon OK */
5491         {"NetServerEnum3",      RAP_NetServerEnum3,     api_RNetServerEnum3}, /* anon OK */
5492         {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
5493         {"SetUserPassword",     RAP_WUserPasswordSet2,  api_SetUserPassword},
5494         {"WWkstaUserLogon",     RAP_WWkstaUserLogon,    api_WWkstaUserLogon},
5495         {"PrintJobInfo",        RAP_WPrintJobSetInfo,   api_PrintJobInfo},
5496         {"WPrintDriverEnum",    RAP_WPrintDriverEnum,   api_WPrintDriverEnum},
5497         {"WPrintQProcEnum",     RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
5498         {"WPrintPortEnum",      RAP_WPrintPortEnum,     api_WPrintPortEnum},
5499         {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
5500         {NULL,          -1,     api_Unsupported}
5501         /*  The following RAP calls are not implemented by Samba:
5502
5503         RAP_WFileEnum2 - anon not OK
5504         */
5505 };
5506
5507
5508 /****************************************************************************
5509  Handle remote api calls.
5510 ****************************************************************************/
5511
5512 void api_reply(connection_struct *conn, uint16 vuid,
5513                struct smb_request *req,
5514                char *data, char *params,
5515                int tdscnt, int tpscnt,
5516                int mdrcnt, int mprcnt)
5517 {
5518         int api_command;
5519         char *rdata = NULL;
5520         char *rparam = NULL;
5521         const char *name1 = NULL;
5522         const char *name2 = NULL;
5523         int rdata_len = 0;
5524         int rparam_len = 0;
5525         bool reply=False;
5526         int i;
5527
5528         if (!params) {
5529                 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
5530                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5531                 return;
5532         }
5533
5534         if (tpscnt < 2) {
5535                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5536                 return;
5537         }
5538         api_command = SVAL(params,0);
5539         /* Is there a string at position params+2 ? */
5540         if (skip_string(params,tpscnt,params+2)) {
5541                 name1 = params + 2;
5542         } else {
5543                 name1 = "";
5544         }
5545         name2 = skip_string(params,tpscnt,params+2);
5546         if (!name2) {
5547                 name2 = "";
5548         }
5549
5550         DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
5551                 api_command,
5552                 name1,
5553                 name2,
5554                 tdscnt,tpscnt,mdrcnt,mprcnt));
5555
5556         for (i=0;api_commands[i].name;i++) {
5557                 if (api_commands[i].id == api_command && api_commands[i].fn) {
5558                         DEBUG(3,("Doing %s\n",api_commands[i].name));
5559                         break;
5560                 }
5561         }
5562
5563         /* Check whether this api call can be done anonymously */
5564
5565         if (api_commands[i].auth_user && lp_restrict_anonymous()) {
5566                 user_struct *user = get_valid_user_struct(req->sconn, vuid);
5567
5568                 if (!user || user->server_info->guest) {
5569                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5570                         return;
5571                 }
5572         }
5573
5574         rdata = (char *)SMB_MALLOC(1024);
5575         if (rdata) {
5576                 memset(rdata,'\0',1024);
5577         }
5578
5579         rparam = (char *)SMB_MALLOC(1024);
5580         if (rparam) {
5581                 memset(rparam,'\0',1024);
5582         }
5583
5584         if(!rdata || !rparam) {
5585                 DEBUG(0,("api_reply: malloc fail !\n"));
5586                 SAFE_FREE(rdata);
5587                 SAFE_FREE(rparam);
5588                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5589                 return;
5590         }
5591
5592         reply = api_commands[i].fn(req->sconn, conn,
5593                                 vuid,
5594                                 params,tpscnt,  /* params + length */
5595                                 data,tdscnt,    /* data + length */
5596                                 mdrcnt,mprcnt,
5597                                 &rdata,&rparam,&rdata_len,&rparam_len);
5598
5599
5600         if (rdata_len > mdrcnt || rparam_len > mprcnt) {
5601                 reply = api_TooSmall(req->sconn,conn,vuid,params,data,
5602                                      mdrcnt,mprcnt,
5603                                         &rdata,&rparam,&rdata_len,&rparam_len);
5604         }
5605
5606         /* if we get False back then it's actually unsupported */
5607         if (!reply) {
5608                 reply = api_Unsupported(req->sconn,conn,vuid,params,tpscnt,
5609                                         data,
5610                                         tdscnt,mdrcnt,mprcnt,
5611                         &rdata,&rparam,&rdata_len,&rparam_len);
5612         }
5613
5614         /* If api_Unsupported returns false we can't return anything. */
5615         if (reply) {
5616                 send_trans_reply(conn, req, rparam, rparam_len,
5617                                  rdata, rdata_len, False);
5618         }
5619
5620         SAFE_FREE(rdata);
5621         SAFE_FREE(rparam);
5622         return;
5623 }