source3/smbd/lanman.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Inter-process communication and named pipe handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Jeremy Allison 2007.
   6
   7    SMB Version handling
   8    Copyright (C) John H Terpstra 1995-1998
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22    */
  23 /*
  24    This file handles the named pipe and mailslot calls
  25    in the SMBtrans protocol
  26    */
  27
  28 #include "includes.h"
  29 #include "smbd/globals.h"
  30 #include "../librpc/gen_ndr/cli_samr.h"
  31 #include "../librpc/gen_ndr/cli_spoolss.h"
  32 #include "rpc_client/cli_spoolss.h"
  33 #include "rpc_client/init_spoolss.h"
  34 #include "../librpc/gen_ndr/cli_srvsvc.h"
  35 #include "../librpc/gen_ndr/srv_samr.h"
  36 #include "../librpc/gen_ndr/srv_spoolss.h"
  37 #include "../librpc/gen_ndr/srv_srvsvc.h"
  38 #include "../librpc/gen_ndr/rap.h"
  39 #include "../lib/util/binsearch.h"
  40
  41 #ifdef CHECK_TYPES
  42 #undef CHECK_TYPES
  43 #endif
  44 #define CHECK_TYPES 0
  45
  46 #define NERR_Success 0
  47 #define NERR_badpass 86
  48 #define NERR_notsupported 50
  49
  50 #define NERR_BASE (2100)
  51 #define NERR_BufTooSmall (NERR_BASE+23)
  52 #define NERR_JobNotFound (NERR_BASE+51)
  53 #define NERR_DestNotFound (NERR_BASE+52)
  54
  55 #define ACCESS_READ 0x01
  56 #define ACCESS_WRITE 0x02
  57 #define ACCESS_CREATE 0x04
  58
  59 #define SHPWLEN 8               /* share password length */
  60
  61 /* Limit size of ipc replies */
  62
  63 static char *smb_realloc_limit(void *ptr, size_t size)
  64 {
  65         char *val;
  66
  67         size = MAX((size),4*1024);
  68         val = (char *)SMB_REALLOC(ptr,size);
  69         if (val) {
  70                 memset(val,'\0',size);
  71         }
  72         return val;
  73 }
  74
  75 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
  76                                 char *param, int tpscnt,
  77                                 char *data, int tdscnt,
  78                                 int mdrcnt, int mprcnt,
  79                                 char **rdata, char **rparam,
  80                                 int *rdata_len, int *rparam_len);
  81
  82 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
  83                          int mdrcnt, int mprcnt,
  84                          char **rdata, char **rparam,
  85                          int *rdata_len, int *rparam_len);
  86
  87
  88 static int CopyExpanded(connection_struct *conn,
  89                         int snum, char **dst, char *src, int *p_space_remaining)
  90 {
  91         TALLOC_CTX *ctx = talloc_tos();
  92         char *buf = NULL;
  93         int l;
  94
  95         if (!src || !dst || !p_space_remaining || !(*dst) ||
  96                         *p_space_remaining <= 0) {
  97                 return 0;
  98         }
  99
 100         buf = talloc_strdup(ctx, src);
 101         if (!buf) {
 102                 *p_space_remaining = 0;
 103                 return 0;
 104         }
 105         buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
 106         if (!buf) {
 107                 *p_space_remaining = 0;
 108                 return 0;
 109         }
 110         buf = talloc_sub_advanced(ctx,
 111                                 lp_servicename(SNUM(conn)),
 112                                 conn->server_info->unix_name,
 113                                 conn->connectpath,
 114                                 conn->server_info->utok.gid,
 115                                 conn->server_info->sanitized_username,
 116                                 pdb_get_domain(conn->server_info->sam_account),
 117                                 buf);
 118         if (!buf) {
 119                 *p_space_remaining = 0;
 120                 return 0;
 121         }
 122         l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
 123         if (l == -1) {
 124                 return 0;
 125         }
 126         (*dst) += l;
 127         (*p_space_remaining) -= l;
 128         return l;
 129 }
 130
 131 static int CopyAndAdvance(char **dst, char *src, int *n)
 132 {
 133         int l;
 134         if (!src || !dst || !n || !(*dst)) {
 135                 return 0;
 136         }
 137         l = push_ascii(*dst,src,*n, STR_TERMINATE);
 138         if (l == -1) {
 139                 return 0;
 140         }
 141         (*dst) += l;
 142         (*n) -= l;
 143         return l;
 144 }
 145
 146 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
 147 {
 148         TALLOC_CTX *ctx = talloc_tos();
 149         char *buf = NULL;
 150         if (!s) {
 151                 return 0;
 152         }
 153         buf = talloc_strdup(ctx,s);
 154         if (!buf) {
 155                 return 0;
 156         }
 157         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 158         if (!buf) {
 159                 return 0;
 160         }
 161         buf = talloc_sub_advanced(ctx,
 162                                 lp_servicename(SNUM(conn)),
 163                                 conn->server_info->unix_name,
 164                                 conn->connectpath,
 165                                 conn->server_info->utok.gid,
 166                                 conn->server_info->sanitized_username,
 167                                 pdb_get_domain(conn->server_info->sam_account),
 168                                 buf);
 169         if (!buf) {
 170                 return 0;
 171         }
 172         return strlen(buf) + 1;
 173 }
 174
 175 /*******************************************************************
 176  Check a API string for validity when we only need to check the prefix.
 177 ******************************************************************/
 178
 179 static bool prefix_ok(const char *str, const char *prefix)
 180 {
 181         return(strncmp(str,prefix,strlen(prefix)) == 0);
 182 }
 183
 184 struct pack_desc {
 185         const char *format;         /* formatstring for structure */
 186         const char *subformat;  /* subformat for structure */
 187         char *base;         /* baseaddress of buffer */
 188         int buflen;        /* remaining size for fixed part; on init: length of base */
 189         int subcount;       /* count of substructures */
 190         char *structbuf;  /* pointer into buffer for remaining fixed part */
 191         int stringlen;    /* remaining size for variable part */
 192         char *stringbuf;  /* pointer into buffer for remaining variable part */
 193         int neededlen;    /* total needed size */
 194         int usedlen;        /* total used size (usedlen <= neededlen and usedlen <= buflen) */
 195         const char *curpos;         /* current position; pointer into format or subformat */
 196         int errcode;
 197 };
 198
 199 static int get_counter(const char **p)
 200 {
 201         int i, n;
 202         if (!p || !(*p)) {
 203                 return 1;
 204         }
 205         if (!isdigit((int)**p)) {
 206                 return 1;
 207         }
 208         for (n = 0;;) {
 209                 i = **p;
 210                 if (isdigit(i)) {
 211                         n = 10 * n + (i - '0');
 212                 } else {
 213                         return n;
 214                 }
 215                 (*p)++;
 216         }
 217 }
 218
 219 static int getlen(const char *p)
 220 {
 221         int n = 0;
 222         if (!p) {
 223                 return 0;
 224         }
 225
 226         while (*p) {
 227                 switch( *p++ ) {
 228                 case 'W':                       /* word (2 byte) */
 229                         n += 2;
 230                         break;
 231                 case 'K':                       /* status word? (2 byte) */
 232                         n += 2;
 233                         break;
 234                 case 'N':                       /* count of substructures (word) at end */
 235                         n += 2;
 236                         break;
 237                 case 'D':                       /* double word (4 byte) */
 238                 case 'z':                       /* offset to zero terminated string (4 byte) */
 239                 case 'l':                       /* offset to user data (4 byte) */
 240                         n += 4;
 241                         break;
 242                 case 'b':                       /* offset to data (with counter) (4 byte) */
 243                         n += 4;
 244                         get_counter(&p);
 245                         break;
 246                 case 'B':                       /* byte (with optional counter) */
 247                         n += get_counter(&p);
 248                         break;
 249                 }
 250         }
 251         return n;
 252 }
 253
 254 static bool init_package(struct pack_desc *p, int count, int subcount)
 255 {
 256         int n = p->buflen;
 257         int i;
 258
 259         if (!p->format || !p->base) {
 260                 return False;
 261         }
 262
 263         i = count * getlen(p->format);
 264         if (p->subformat) {
 265                 i += subcount * getlen(p->subformat);
 266         }
 267         p->structbuf = p->base;
 268         p->neededlen = 0;
 269         p->usedlen = 0;
 270         p->subcount = 0;
 271         p->curpos = p->format;
 272         if (i > n) {
 273                 p->neededlen = i;
 274                 i = n = 0;
 275 #if 0
 276                 /*
 277                  * This is the old error code we used. Aparently
 278                  * WinNT/2k systems return ERRbuftoosmall (2123) and
 279                  * OS/2 needs this. I'm leaving this here so we can revert
 280                  * if needed. JRA.
 281                  */
 282                 p->errcode = ERRmoredata;
 283 #else
 284                 p->errcode = ERRbuftoosmall;
 285 #endif
 286         } else {
 287                 p->errcode = NERR_Success;
 288         }
 289         p->buflen = i;
 290         n -= i;
 291         p->stringbuf = p->base + i;
 292         p->stringlen = n;
 293         return (p->errcode == NERR_Success);
 294 }
 295
 296 static int package(struct pack_desc *p, ...)
 297 {
 298         va_list args;
 299         int needed=0, stringneeded;
 300         const char *str=NULL;
 301         int is_string=0, stringused;
 302         int32 temp;
 303
 304         va_start(args,p);
 305
 306         if (!*p->curpos) {
 307                 if (!p->subcount) {
 308                         p->curpos = p->format;
 309                 } else {
 310                         p->curpos = p->subformat;
 311                         p->subcount--;
 312                 }
 313         }
 314 #if CHECK_TYPES
 315         str = va_arg(args,char*);
 316         SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
 317 #endif
 318         stringneeded = -1;
 319
 320         if (!p->curpos) {
 321                 va_end(args);
 322                 return 0;
 323         }
 324
 325         switch( *p->curpos++ ) {
 326                 case 'W':                       /* word (2 byte) */
 327                         needed = 2;
 328                         temp = va_arg(args,int);
 329                         if (p->buflen >= needed) {
 330                                 SSVAL(p->structbuf,0,temp);
 331                         }
 332                         break;
 333                 case 'K':                       /* status word? (2 byte) */
 334                         needed = 2;
 335                         temp = va_arg(args,int);
 336                         if (p->buflen >= needed) {
 337                                 SSVAL(p->structbuf,0,temp);
 338                         }
 339                         break;
 340                 case 'N':                       /* count of substructures (word) at end */
 341                         needed = 2;
 342                         p->subcount = va_arg(args,int);
 343                         if (p->buflen >= needed) {
 344                                 SSVAL(p->structbuf,0,p->subcount);
 345                         }
 346                         break;
 347                 case 'D':                       /* double word (4 byte) */
 348                         needed = 4;
 349                         temp = va_arg(args,int);
 350                         if (p->buflen >= needed) {
 351                                 SIVAL(p->structbuf,0,temp);
 352                         }
 353                         break;
 354                 case 'B':                       /* byte (with optional counter) */
 355                         needed = get_counter(&p->curpos);
 356                         {
 357                                 char *s = va_arg(args,char*);
 358                                 if (p->buflen >= needed) {
 359                                         StrnCpy(p->structbuf,s?s:"",needed-1);
 360                                 }
 361                         }
 362                         break;
 363                 case 'z':                       /* offset to zero terminated string (4 byte) */
 364                         str = va_arg(args,char*);
 365                         stringneeded = (str ? strlen(str)+1 : 0);
 366                         is_string = 1;
 367                         break;
 368                 case 'l':                       /* offset to user data (4 byte) */
 369                         str = va_arg(args,char*);
 370                         stringneeded = va_arg(args,int);
 371                         is_string = 0;
 372                         break;
 373                 case 'b':                       /* offset to data (with counter) (4 byte) */
 374                         str = va_arg(args,char*);
 375                         stringneeded = get_counter(&p->curpos);
 376                         is_string = 0;
 377                         break;
 378         }
 379
 380         va_end(args);
 381         if (stringneeded >= 0) {
 382                 needed = 4;
 383                 if (p->buflen >= needed) {
 384                         stringused = stringneeded;
 385                         if (stringused > p->stringlen) {
 386                                 stringused = (is_string ? p->stringlen : 0);
 387                                 if (p->errcode == NERR_Success) {
 388                                         p->errcode = ERRmoredata;
 389                                 }
 390                         }
 391                         if (!stringused) {
 392                                 SIVAL(p->structbuf,0,0);
 393                         } else {
 394                                 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
 395                                 memcpy(p->stringbuf,str?str:"",stringused);
 396                                 if (is_string) {
 397                                         p->stringbuf[stringused-1] = '\0';
 398                                 }
 399                                 p->stringbuf += stringused;
 400                                 p->stringlen -= stringused;
 401                                 p->usedlen += stringused;
 402                         }
 403                 }
 404                 p->neededlen += stringneeded;
 405         }
 406
 407         p->neededlen += needed;
 408         if (p->buflen >= needed) {
 409                 p->structbuf += needed;
 410                 p->buflen -= needed;
 411                 p->usedlen += needed;
 412         } else {
 413                 if (p->errcode == NERR_Success) {
 414                         p->errcode = ERRmoredata;
 415                 }
 416         }
 417         return 1;
 418 }
 419
 420 #if CHECK_TYPES
 421 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
 422 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
 423 #else
 424 #define PACK(desc,t,v) package(desc,v)
 425 #define PACKl(desc,t,v,l) package(desc,v,l)
 426 #endif
 427
 428 static void PACKI(struct pack_desc* desc, const char *t,int v)
 429 {
 430         PACK(desc,t,v);
 431 }
 432
 433 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
 434 {
 435         PACK(desc,t,v);
 436 }
 437
 438 /****************************************************************************
 439  Get a print queue.
 440 ****************************************************************************/
 441
 442 static void PackDriverData(struct pack_desc* desc)
 443 {
 444         char drivdata[4+4+32];
 445         SIVAL(drivdata,0,sizeof drivdata); /* cb */
 446         SIVAL(drivdata,4,1000); /* lVersion */
 447         memset(drivdata+8,0,32);        /* szDeviceName */
 448         push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
 449         PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
 450 }
 451
 452 static int check_printq_info(struct pack_desc* desc,
 453                                 unsigned int uLevel, char *id1, char *id2)
 454 {
 455         desc->subformat = NULL;
 456         switch( uLevel ) {
 457                 case 0:
 458                         desc->format = "B13";
 459                         break;
 460                 case 1:
 461                         desc->format = "B13BWWWzzzzzWW";
 462                         break;
 463                 case 2:
 464                         desc->format = "B13BWWWzzzzzWN";
 465                         desc->subformat = "WB21BB16B10zWWzDDz";
 466                         break;
 467                 case 3:
 468                         desc->format = "zWWWWzzzzWWzzl";
 469                         break;
 470                 case 4:
 471                         desc->format = "zWWWWzzzzWNzzl";
 472                         desc->subformat = "WWzWWDDzz";
 473                         break;
 474                 case 5:
 475                         desc->format = "z";
 476                         break;
 477                 case 51:
 478                         desc->format = "K";
 479                         break;
 480                 case 52:
 481                         desc->format = "WzzzzzzzzN";
 482                         desc->subformat = "z";
 483                         break;
 484                 default:
 485                         DEBUG(0,("check_printq_info: invalid level %d\n",
 486                                 uLevel ));
 487                         return False;
 488         }
 489         if (id1 == NULL || strcmp(desc->format,id1) != 0) {
 490                 DEBUG(0,("check_printq_info: invalid format %s\n",
 491                         id1 ? id1 : "<NULL>" ));
 492                 return False;
 493         }
 494         if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
 495                 DEBUG(0,("check_printq_info: invalid subformat %s\n",
 496                         id2 ? id2 : "<NULL>" ));
 497                 return False;
 498         }
 499         return True;
 500 }
 501
 502
 503 #define RAP_JOB_STATUS_QUEUED 0
 504 #define RAP_JOB_STATUS_PAUSED 1
 505 #define RAP_JOB_STATUS_SPOOLING 2
 506 #define RAP_JOB_STATUS_PRINTING 3
 507 #define RAP_JOB_STATUS_PRINTED 4
 508
 509 #define RAP_QUEUE_STATUS_PAUSED 1
 510 #define RAP_QUEUE_STATUS_ERROR 2
 511
 512 /* turn a print job status into a on the wire status
 513 */
 514 static int printj_spoolss_status(int v)
 515 {
 516         if (v == JOB_STATUS_QUEUED)
 517                 return RAP_JOB_STATUS_QUEUED;
 518         if (v & JOB_STATUS_PAUSED)
 519                 return RAP_JOB_STATUS_PAUSED;
 520         if (v & JOB_STATUS_SPOOLING)
 521                 return RAP_JOB_STATUS_SPOOLING;
 522         if (v & JOB_STATUS_PRINTING)
 523                 return RAP_JOB_STATUS_PRINTING;
 524         return 0;
 525 }
 526
 527 /* turn a print queue status into a on the wire status
 528 */
 529 static int printq_spoolss_status(int v)
 530 {
 531         if (v == PRINTER_STATUS_OK)
 532                 return 0;
 533         if (v & PRINTER_STATUS_PAUSED)
 534                 return RAP_QUEUE_STATUS_PAUSED;
 535         return RAP_QUEUE_STATUS_ERROR;
 536 }
 537
 538 static void fill_spoolss_printjob_info(int uLevel,
 539                                        struct pack_desc *desc,
 540                                        struct spoolss_JobInfo2 *info2,
 541                                        int n)
 542 {
 543         time_t t = spoolss_Time_to_time_t(&info2->submitted);
 544
 545         /* the client expects localtime */
 546         t -= get_time_zone(t);
 547
 548         PACKI(desc,"W",pjobid_to_rap(info2->printer_name, info2->job_id)); /* uJobId */
 549         if (uLevel == 1) {
 550                 PACKS(desc,"B21", info2->user_name); /* szUserName */
 551                 PACKS(desc,"B","");             /* pad */
 552                 PACKS(desc,"B16","");   /* szNotifyName */
 553                 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
 554                 PACKS(desc,"z","");             /* pszParms */
 555                 PACKI(desc,"W",n+1);            /* uPosition */
 556                 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
 557                 PACKS(desc,"z","");             /* pszStatus */
 558                 PACKI(desc,"D", t); /* ulSubmitted */
 559                 PACKI(desc,"D", info2->size); /* ulSize */
 560                 PACKS(desc,"z", info2->document_name); /* pszComment */
 561         }
 562         if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
 563                 PACKI(desc,"W", info2->priority);               /* uPriority */
 564                 PACKS(desc,"z", info2->user_name); /* pszUserName */
 565                 PACKI(desc,"W",n+1);            /* uPosition */
 566                 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
 567                 PACKI(desc,"D",t); /* ulSubmitted */
 568                 PACKI(desc,"D", info2->size); /* ulSize */
 569                 PACKS(desc,"z","Samba");        /* pszComment */
 570                 PACKS(desc,"z", info2->document_name); /* pszDocument */
 571                 if (uLevel == 3) {
 572                         PACKS(desc,"z","");     /* pszNotifyName */
 573                         PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
 574                         PACKS(desc,"z","");     /* pszParms */
 575                         PACKS(desc,"z","");     /* pszStatus */
 576                         PACKS(desc,"z", info2->printer_name); /* pszQueue */
 577                         PACKS(desc,"z","lpd");  /* pszQProcName */
 578                         PACKS(desc,"z","");     /* pszQProcParms */
 579                         PACKS(desc,"z","NULL"); /* pszDriverName */
 580                         PackDriverData(desc);   /* pDriverData */
 581                         PACKS(desc,"z","");     /* pszPrinterName */
 582                 } else if (uLevel == 4) {   /* OS2 */
 583                         PACKS(desc,"z","");       /* pszSpoolFileName  */
 584                         PACKS(desc,"z","");       /* pszPortName       */
 585                         PACKS(desc,"z","");       /* pszStatus         */
 586                         PACKI(desc,"D",0);        /* ulPagesSpooled    */
 587                         PACKI(desc,"D",0);        /* ulPagesSent       */
 588                         PACKI(desc,"D",0);        /* ulPagesPrinted    */
 589                         PACKI(desc,"D",0);        /* ulTimePrinted     */
 590                         PACKI(desc,"D",0);        /* ulExtendJobStatus */
 591                         PACKI(desc,"D",0);        /* ulStartPage       */
 592                         PACKI(desc,"D",0);        /* ulEndPage         */
 593                 }
 594         }
 595 }
 596
 597 /********************************************************************
 598  Respond to the DosPrintQInfo command with a level of 52
 599  This is used to get printer driver information for Win9x clients
 600  ********************************************************************/
 601 static void fill_printq_info_52(struct spoolss_DriverInfo3 *driver,
 602                                 struct pack_desc* desc, int count,
 603                                 const char *printer_name)
 604 {
 605         int                             i;
 606         fstring                         location;
 607         trim_string((char *)driver->driver_path, "\\print$\\WIN40\\0\\", 0);
 608         trim_string((char *)driver->data_file, "\\print$\\WIN40\\0\\", 0);
 609         trim_string((char *)driver->help_file, "\\print$\\WIN40\\0\\", 0);
 610
 611         PACKI(desc, "W", 0x0400);                     /* don't know */
 612         PACKS(desc, "z", driver->driver_name);        /* long printer name */
 613         PACKS(desc, "z", driver->driver_path);  /* Driverfile Name */
 614         PACKS(desc, "z", driver->data_file);    /* Datafile name */
 615         PACKS(desc, "z", driver->monitor_name); /* language monitor */
 616
 617         fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
 618         standard_sub_basic( "", "", location, sizeof(location)-1 );
 619         PACKS(desc,"z", location);                          /* share to retrieve files */
 620
 621         PACKS(desc,"z", driver->default_datatype);    /* default data type */
 622         PACKS(desc,"z", driver->help_file);           /* helpfile name */
 623         PACKS(desc,"z", driver->driver_path);               /* driver name */
 624
 625         DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
 626         DEBUG(3,("Driver: %s:\n",driver->driver_path));
 627         DEBUG(3,("Data File: %s:\n",driver->data_file));
 628         DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
 629         DEBUG(3,("Driver Location: %s:\n",location));
 630         DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
 631         DEBUG(3,("Help File: %s:\n",driver->help_file));
 632         PACKI(desc,"N",count);                     /* number of files to copy */
 633
 634         for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
 635         {
 636                 trim_string((char *)driver->dependent_files[i], "\\print$\\WIN40\\0\\", 0);
 637                 PACKS(desc,"z",driver->dependent_files[i]);         /* driver files to copy */
 638                 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
 639         }
 640
 641         /* sanity check */
 642         if ( i != count )
 643                 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
 644                         count, i));
 645
 646         DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", printer_name, i));
 647
 648         desc->errcode=NERR_Success;
 649
 650 }
 651
 652 static const char *strip_unc(const char *unc)
 653 {
 654         char *p;
 655
 656         if (unc == NULL) {
 657                 return NULL;
 658         }
 659
 660         if ((p = strrchr(unc, '\\')) != NULL) {
 661                 return p+1;
 662         }
 663
 664         return unc;
 665 }
 666
 667 static void fill_printq_info(int uLevel,
 668                              struct pack_desc* desc,
 669                              int count,
 670                              union spoolss_JobInfo *job_info,
 671                              struct spoolss_DriverInfo3 *driver_info,
 672                              struct spoolss_PrinterInfo2 *printer_info)
 673 {
 674         switch (uLevel) {
 675         case 0:
 676         case 1:
 677         case 2:
 678                 PACKS(desc,"B13", strip_unc(printer_info->printername));
 679                 break;
 680         case 3:
 681         case 4:
 682         case 5:
 683                 PACKS(desc,"z", strip_unc(printer_info->printername));
 684                 break;
 685         case 51:
 686                 PACKI(desc,"K", printq_spoolss_status(printer_info->status));
 687                 break;
 688         }
 689
 690         if (uLevel == 1 || uLevel == 2) {
 691                 PACKS(desc,"B","");             /* alignment */
 692                 PACKI(desc,"W",5);              /* priority */
 693                 PACKI(desc,"W",0);              /* start time */
 694                 PACKI(desc,"W",0);              /* until time */
 695                 PACKS(desc,"z","");             /* pSepFile */
 696                 PACKS(desc,"z","lpd");  /* pPrProc */
 697                 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pDestinations */
 698                 PACKS(desc,"z","");             /* pParms */
 699                 if (printer_info->printername == NULL) {
 700                         PACKS(desc,"z","UNKNOWN PRINTER");
 701                         PACKI(desc,"W",LPSTAT_ERROR);
 702                 } else {
 703                         PACKS(desc,"z", printer_info->comment);
 704                         PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* status */
 705                 }
 706                 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
 707         }
 708
 709         if (uLevel == 3 || uLevel == 4) {
 710                 PACKI(desc,"W",5);              /* uPriority */
 711                 PACKI(desc,"W",0);              /* uStarttime */
 712                 PACKI(desc,"W",0);              /* uUntiltime */
 713                 PACKI(desc,"W",5);              /* pad1 */
 714                 PACKS(desc,"z","");             /* pszSepFile */
 715                 PACKS(desc,"z","WinPrint");     /* pszPrProc */
 716                 PACKS(desc,"z",NULL);           /* pszParms */
 717                 PACKS(desc,"z",NULL);           /* pszComment - don't ask.... JRA */
 718                 /* "don't ask" that it's done this way to fix corrupted
 719                    Win9X/ME printer comments. */
 720                 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* fsStatus */
 721                 PACKI(desc,(uLevel == 3 ? "W" : "N"),count);    /* cJobs */
 722                 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pszPrinters */
 723                 PACKS(desc,"z", printer_info->drivername);              /* pszDriverName */
 724                 PackDriverData(desc);   /* pDriverData */
 725         }
 726
 727         if (uLevel == 2 || uLevel == 4) {
 728                 int i;
 729                 for (i = 0; i < count; i++) {
 730                         fill_spoolss_printjob_info(uLevel == 2 ? 1 : 2, desc, &job_info[i].info2, i);
 731                 }
 732         }
 733
 734         if (uLevel==52)
 735                 fill_printq_info_52(driver_info, desc, count, printer_info->printername);
 736 }
 737
 738 /* This function returns the number of files for a given driver */
 739 static int get_printerdrivernumber(const struct spoolss_DriverInfo3 *driver)
 740 {
 741         int                             result = 0;
 742
 743         /* count the number of files */
 744         while (driver->dependent_files && *driver->dependent_files[result])
 745                 result++;
 746
 747         return result;
 748 }
 749
 750 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
 751                                 char *param, int tpscnt,
 752                                 char *data, int tdscnt,
 753                                 int mdrcnt,int mprcnt,
 754                                 char **rdata,char **rparam,
 755                                 int *rdata_len,int *rparam_len)
 756 {
 757         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
 758         char *str2 = skip_string(param,tpscnt,str1);
 759         char *p = skip_string(param,tpscnt,str2);
 760         char *QueueName = p;
 761         unsigned int uLevel;
 762         uint32_t count = 0;
 763         char *str3;
 764         struct pack_desc desc;
 765         char* tmpdata=NULL;
 766
 767         WERROR werr = WERR_OK;
 768         TALLOC_CTX *mem_ctx = talloc_tos();
 769         NTSTATUS status;
 770         struct rpc_pipe_client *cli = NULL;
 771         struct policy_handle handle;
 772         struct spoolss_DevmodeContainer devmode_ctr;
 773         union spoolss_DriverInfo driver_info;
 774         union spoolss_JobInfo *job_info;
 775         union spoolss_PrinterInfo printer_info;
 776
 777         if (!str1 || !str2 || !p) {
 778                 return False;
 779         }
 780         memset((char *)&desc,'\0',sizeof(desc));
 781
 782         p = skip_string(param,tpscnt,p);
 783         if (!p) {
 784                 return False;
 785         }
 786         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 787         str3 = get_safe_str_ptr(param,tpscnt,p,4);
 788         /* str3 may be null here and is checked in check_printq_info(). */
 789
 790         /* remove any trailing username */
 791         if ((p = strchr_m(QueueName,'%')))
 792                 *p = 0;
 793
 794         DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
 795
 796         /* check it's a supported varient */
 797         if (!prefix_ok(str1,"zWrLh"))
 798                 return False;
 799         if (!check_printq_info(&desc,uLevel,str2,str3)) {
 800                 /*
 801                  * Patch from Scott Moomaw <scott@bridgewater.edu>
 802                  * to return the 'invalid info level' error if an
 803                  * unknown level was requested.
 804                  */
 805                 *rdata_len = 0;
 806                 *rparam_len = 6;
 807                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
 808                 if (!*rparam) {
 809                         return False;
 810                 }
 811                 SSVALS(*rparam,0,ERRunknownlevel);
 812                 SSVAL(*rparam,2,0);
 813                 SSVAL(*rparam,4,0);
 814                 return(True);
 815         }
 816
 817         ZERO_STRUCT(handle);
 818
 819         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_spoolss.syntax_id,
 820                                         rpc_spoolss_dispatch, conn->server_info,
 821                                         &cli);
 822         if (!NT_STATUS_IS_OK(status)) {
 823                 DEBUG(0,("api_DosPrintQGetInfo: could not connect to spoolss: %s\n",
 824                           nt_errstr(status)));
 825                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
 826                 goto out;
 827         }
 828
 829         ZERO_STRUCT(devmode_ctr);
 830
 831         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
 832                                             QueueName,
 833                                             "RAW",
 834                                             devmode_ctr,
 835                                             PRINTER_ACCESS_USE,
 836                                             &handle,
 837                                             &werr);
 838         if (!NT_STATUS_IS_OK(status)) {
 839                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
 840                 goto out;
 841         }
 842         if (!W_ERROR_IS_OK(werr)) {
 843                 desc.errcode = W_ERROR_V(werr);
 844                 goto out;
 845         }
 846
 847         werr = rpccli_spoolss_getprinter(cli, mem_ctx,
 848                                          &handle,
 849                                          2,
 850                                          0,
 851                                          &printer_info);
 852         if (!W_ERROR_IS_OK(werr)) {
 853                 desc.errcode = W_ERROR_V(werr);
 854                 goto out;
 855         }
 856
 857         if (uLevel==52) {
 858                 uint32_t server_major_version;
 859                 uint32_t server_minor_version;
 860
 861                 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
 862                                                         &handle,
 863                                                         "Windows 4.0",
 864                                                         3, /* level */
 865                                                         0,
 866                                                         0, /* version */
 867                                                         0,
 868                                                         &driver_info,
 869                                                         &server_major_version,
 870                                                         &server_minor_version);
 871                 if (!W_ERROR_IS_OK(werr)) {
 872                         desc.errcode = W_ERROR_V(werr);
 873                         goto out;
 874                 }
 875
 876                 count = get_printerdrivernumber(&driver_info.info3);
 877                 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
 878         } else {
 879                 uint32_t num_jobs;
 880                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
 881                                                &handle,
 882                                                0, /* firstjob */
 883                                                0xff, /* numjobs */
 884                                                2, /* level */
 885                                                0, /* offered */
 886                                                &num_jobs,
 887                                                &job_info);
 888                 if (!W_ERROR_IS_OK(werr)) {
 889                         desc.errcode = W_ERROR_V(werr);
 890                         goto out;
 891                 }
 892
 893                 count = num_jobs;
 894         }
 895
 896         if (mdrcnt > 0) {
 897                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
 898                 if (!*rdata) {
 899                         return False;
 900                 }
 901                 desc.base = *rdata;
 902                 desc.buflen = mdrcnt;
 903         } else {
 904                 /*
 905                  * Don't return data but need to get correct length
 906                  * init_package will return wrong size if buflen=0
 907                  */
 908                 desc.buflen = getlen(desc.format);
 909                 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
 910         }
 911
 912         if (init_package(&desc,1,count)) {
 913                 desc.subcount = count;
 914                 fill_printq_info(uLevel,&desc,count, job_info, &driver_info.info3, &printer_info.info2);
 915         }
 916
 917         *rdata_len = desc.usedlen;
 918
 919         /*
 920          * We must set the return code to ERRbuftoosmall
 921          * in order to support lanman style printing with Win NT/2k
 922          * clients       --jerry
 923          */
 924         if (!mdrcnt && lp_disable_spoolss())
 925                 desc.errcode = ERRbuftoosmall;
 926
 927  out:
 928         if (cli && is_valid_policy_hnd(&handle)) {
 929                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
 930         }
 931
 932         *rdata_len = desc.usedlen;
 933         *rparam_len = 6;
 934         *rparam = smb_realloc_limit(*rparam,*rparam_len);
 935         if (!*rparam) {
 936                 SAFE_FREE(tmpdata);
 937                 return False;
 938         }
 939         SSVALS(*rparam,0,desc.errcode);
 940         SSVAL(*rparam,2,0);
 941         SSVAL(*rparam,4,desc.neededlen);
 942
 943         DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
 944
 945         SAFE_FREE(tmpdata);
 946
 947         return(True);
 948 }
 949
 950 /****************************************************************************
 951  View list of all print jobs on all queues.
 952 ****************************************************************************/
 953
 954 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
 955                                 char *param, int tpscnt,
 956                                 char *data, int tdscnt,
 957                                 int mdrcnt, int mprcnt,
 958                                 char **rdata, char** rparam,
 959                                 int *rdata_len, int *rparam_len)
 960 {
 961         char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
 962         char *output_format1 = skip_string(param,tpscnt,param_format);
 963         char *p = skip_string(param,tpscnt,output_format1);
 964         unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 965         char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
 966         int i;
 967         struct pack_desc desc;
 968         int *subcntarr = NULL;
 969         int queuecnt = 0, subcnt = 0, succnt = 0;
 970
 971         WERROR werr = WERR_OK;
 972         TALLOC_CTX *mem_ctx = talloc_tos();
 973         NTSTATUS status;
 974         struct rpc_pipe_client *cli = NULL;
 975         struct spoolss_DevmodeContainer devmode_ctr;
 976         uint32_t num_printers;
 977         union spoolss_PrinterInfo *printer_info;
 978         union spoolss_DriverInfo *driver_info;
 979         union spoolss_JobInfo **job_info;
 980
 981         if (!param_format || !output_format1 || !p) {
 982                 return False;
 983         }
 984
 985         memset((char *)&desc,'\0',sizeof(desc));
 986
 987         DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
 988
 989         if (!prefix_ok(param_format,"WrLeh")) {
 990                 return False;
 991         }
 992         if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
 993                 /*
 994                  * Patch from Scott Moomaw <scott@bridgewater.edu>
 995                  * to return the 'invalid info level' error if an
 996                  * unknown level was requested.
 997                  */
 998                 *rdata_len = 0;
 999                 *rparam_len = 6;
1000                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1001                 if (!*rparam) {
1002                         return False;
1003                 }
1004                 SSVALS(*rparam,0,ERRunknownlevel);
1005                 SSVAL(*rparam,2,0);
1006                 SSVAL(*rparam,4,0);
1007                 return(True);
1008         }
1009
1010         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_spoolss.syntax_id,
1011                                         rpc_spoolss_dispatch, conn->server_info,
1012                                         &cli);
1013         if (!NT_STATUS_IS_OK(status)) {
1014                 DEBUG(0,("api_DosPrintQEnum: could not connect to spoolss: %s\n",
1015                           nt_errstr(status)));
1016                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1017                 goto out;
1018         }
1019
1020         werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
1021                                            PRINTER_ENUM_LOCAL,
1022                                            cli->srv_name_slash,
1023                                            2,
1024                                            0,
1025                                            &num_printers,
1026                                            &printer_info);
1027         if (!W_ERROR_IS_OK(werr)) {
1028                 desc.errcode = W_ERROR_V(werr);
1029                 goto out;
1030         }
1031
1032         queuecnt = num_printers;
1033
1034         job_info = talloc_array(mem_ctx, union spoolss_JobInfo *, num_printers);
1035         if (job_info == NULL) {
1036                 goto err;
1037         }
1038
1039         driver_info = talloc_array(mem_ctx, union spoolss_DriverInfo, num_printers);
1040         if (driver_info == NULL) {
1041                 goto err;
1042         }
1043
1044         if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1045                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1046                 goto err;
1047         }
1048
1049         if (mdrcnt > 0) {
1050                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1051                 if (!*rdata) {
1052                         goto err;
1053                 }
1054         }
1055         desc.base = *rdata;
1056         desc.buflen = mdrcnt;
1057
1058         subcnt = 0;
1059         for (i = 0; i < num_printers; i++) {
1060
1061                 uint32_t num_jobs;
1062                 struct policy_handle handle;
1063                 const char *printername;
1064
1065                 printername = talloc_strdup(mem_ctx, printer_info[i].info2.printername);
1066                 if (printername == NULL) {
1067                         goto err;
1068                 }
1069
1070                 ZERO_STRUCT(handle);
1071                 ZERO_STRUCT(devmode_ctr);
1072
1073                 status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
1074                                                     printername,
1075                                                     "RAW",
1076                                                     devmode_ctr,
1077                                                     PRINTER_ACCESS_USE,
1078                                                     &handle,
1079                                                     &werr);
1080                 if (!NT_STATUS_IS_OK(status)) {
1081                         desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1082                         goto out;
1083                 }
1084                 if (!W_ERROR_IS_OK(werr)) {
1085                         desc.errcode = W_ERROR_V(werr);
1086                         goto out;
1087                 }
1088
1089                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
1090                                                &handle,
1091                                                0, /* firstjob */
1092                                                0xff, /* numjobs */
1093                                                2, /* level */
1094                                                0, /* offered */
1095                                                &num_jobs,
1096                                                &job_info[i]);
1097                 if (!W_ERROR_IS_OK(werr)) {
1098                         desc.errcode = W_ERROR_V(werr);
1099                         goto out;
1100                 }
1101
1102                 if (uLevel==52) {
1103                         uint32_t server_major_version;
1104                         uint32_t server_minor_version;
1105
1106                         werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
1107                                                                 &handle,
1108                                                                 "Windows 4.0",
1109                                                                 3, /* level */
1110                                                                 0,
1111                                                                 0, /* version */
1112                                                                 0,
1113                                                                 &driver_info[i],
1114                                                                 &server_major_version,
1115                                                                 &server_minor_version);
1116                         if (!W_ERROR_IS_OK(werr)) {
1117                                 desc.errcode = W_ERROR_V(werr);
1118                                 goto out;
1119                         }
1120                 }
1121
1122                 subcntarr[i] = num_jobs;
1123                 subcnt += subcntarr[i];
1124
1125                 if (cli && is_valid_policy_hnd(&handle)) {
1126                         rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
1127                 }
1128         }
1129
1130         if (init_package(&desc,queuecnt,subcnt)) {
1131                 for (i = 0; i < num_printers; i++) {
1132                         fill_printq_info(uLevel,&desc,subcntarr[i], job_info[i], &driver_info[i].info3, &printer_info[i].info2);
1133                         if (desc.errcode == NERR_Success) {
1134                                 succnt = i;
1135                         }
1136                 }
1137         }
1138
1139         SAFE_FREE(subcntarr);
1140  out:
1141         *rdata_len = desc.usedlen;
1142         *rparam_len = 8;
1143         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1144         if (!*rparam) {
1145                 goto err;
1146         }
1147         SSVALS(*rparam,0,desc.errcode);
1148         SSVAL(*rparam,2,0);
1149         SSVAL(*rparam,4,succnt);
1150         SSVAL(*rparam,6,queuecnt);
1151
1152         return True;
1153
1154   err:
1155
1156         SAFE_FREE(subcntarr);
1157
1158         return False;
1159 }
1160
1161 /****************************************************************************
1162  Get info level for a server list query.
1163 ****************************************************************************/
1164
1165 static bool check_server_info(int uLevel, char* id)
1166 {
1167         switch( uLevel ) {
1168                 case 0:
1169                         if (strcmp(id,"B16") != 0) {
1170                                 return False;
1171                         }
1172                         break;
1173                 case 1:
1174                         if (strcmp(id,"B16BBDz") != 0) {
1175                                 return False;
1176                         }
1177                         break;
1178                 default:
1179                         return False;
1180         }
1181         return True;
1182 }
1183
1184 struct srv_info_struct {
1185         fstring name;
1186         uint32 type;
1187         fstring comment;
1188         fstring domain;
1189         bool server_added;
1190 };
1191
1192 /*******************************************************************
1193  Get server info lists from the files saved by nmbd. Return the
1194  number of entries.
1195 ******************************************************************/
1196
1197 static int get_server_info(uint32 servertype,
1198                            struct srv_info_struct **servers,
1199                            const char *domain)
1200 {
1201         int count=0;
1202         int alloced=0;
1203         char **lines;
1204         bool local_list_only;
1205         int i;
1206
1207         lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1208         if (!lines) {
1209                 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1210                 return 0;
1211         }
1212
1213         /* request for everything is code for request all servers */
1214         if (servertype == SV_TYPE_ALL) {
1215                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1216         }
1217
1218         local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1219
1220         DEBUG(4,("Servertype search: %8x\n",servertype));
1221
1222         for (i=0;lines[i];i++) {
1223                 fstring stype;
1224                 struct srv_info_struct *s;
1225                 const char *ptr = lines[i];
1226                 bool ok = True;
1227                 TALLOC_CTX *frame = NULL;
1228                 char *p;
1229
1230                 if (!*ptr) {
1231                         continue;
1232                 }
1233
1234                 if (count == alloced) {
1235                         alloced += 10;
1236                         *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1237                         if (!*servers) {
1238                                 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1239                                 TALLOC_FREE(lines);
1240                                 return 0;
1241                         }
1242                         memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1243                 }
1244                 s = &(*servers)[count];
1245
1246                 frame = talloc_stackframe();
1247                 s->name[0] = '\0';
1248                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1249                         TALLOC_FREE(frame);
1250                         continue;
1251                 }
1252                 fstrcpy(s->name, p);
1253
1254                 stype[0] = '\0';
1255                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1256                         TALLOC_FREE(frame);
1257                         continue;
1258                 }
1259                 fstrcpy(stype, p);
1260
1261                 s->comment[0] = '\0';
1262                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1263                         TALLOC_FREE(frame);
1264                         continue;
1265                 }
1266                 fstrcpy(s->comment, p);
1267                 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1268
1269                 s->domain[0] = '\0';
1270                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1271                         /* this allows us to cope with an old nmbd */
1272                         fstrcpy(s->domain,lp_workgroup());
1273                 } else {
1274                         fstrcpy(s->domain, p);
1275                 }
1276                 TALLOC_FREE(frame);
1277
1278                 if (sscanf(stype,"%X",&s->type) != 1) {
1279                         DEBUG(4,("r:host file "));
1280                         ok = False;
1281                 }
1282
1283                 /* Filter the servers/domains we return based on what was asked for. */
1284
1285                 /* Check to see if we are being asked for a local list only. */
1286                 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1287                         DEBUG(4,("r: local list only"));
1288                         ok = False;
1289                 }
1290
1291                 /* doesn't match up: don't want it */
1292                 if (!(servertype & s->type)) {
1293                         DEBUG(4,("r:serv type "));
1294                         ok = False;
1295                 }
1296
1297                 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1298                                 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1299                         DEBUG(4,("s: dom mismatch "));
1300                         ok = False;
1301                 }
1302
1303                 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1304                         ok = False;
1305                 }
1306
1307                 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1308                 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1309
1310                 if (ok) {
1311                         DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1312                                 s->name, s->type, s->comment, s->domain));
1313                         s->server_added = True;
1314                         count++;
1315                 } else {
1316                         DEBUG(4,("%20s %8x %25s %15s\n",
1317                                 s->name, s->type, s->comment, s->domain));
1318                 }
1319         }
1320
1321         TALLOC_FREE(lines);
1322         return count;
1323 }
1324
1325 /*******************************************************************
1326  Fill in a server info structure.
1327 ******************************************************************/
1328
1329 static int fill_srv_info(struct srv_info_struct *service,
1330                          int uLevel, char **buf, int *buflen,
1331                          char **stringbuf, int *stringspace, char *baseaddr)
1332 {
1333         int struct_len;
1334         char* p;
1335         char* p2;
1336         int l2;
1337         int len;
1338
1339         switch (uLevel) {
1340                 case 0:
1341                         struct_len = 16;
1342                         break;
1343                 case 1:
1344                         struct_len = 26;
1345                         break;
1346                 default:
1347                         return -1;
1348         }
1349
1350         if (!buf) {
1351                 len = 0;
1352                 switch (uLevel) {
1353                         case 1:
1354                                 len = strlen(service->comment)+1;
1355                                 break;
1356                 }
1357
1358                 *buflen = struct_len;
1359                 *stringspace = len;
1360                 return struct_len + len;
1361         }
1362
1363         len = struct_len;
1364         p = *buf;
1365         if (*buflen < struct_len) {
1366                 return -1;
1367         }
1368         if (stringbuf) {
1369                 p2 = *stringbuf;
1370                 l2 = *stringspace;
1371         } else {
1372                 p2 = p + struct_len;
1373                 l2 = *buflen - struct_len;
1374         }
1375         if (!baseaddr) {
1376                 baseaddr = p;
1377         }
1378
1379         switch (uLevel) {
1380                 case 0:
1381                         push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1382                         break;
1383
1384                 case 1:
1385                         push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1386                         SIVAL(p,18,service->type);
1387                         SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1388                         len += CopyAndAdvance(&p2,service->comment,&l2);
1389                         break;
1390         }
1391
1392         if (stringbuf) {
1393                 *buf = p + struct_len;
1394                 *buflen -= struct_len;
1395                 *stringbuf = p2;
1396                 *stringspace = l2;
1397         } else {
1398                 *buf = p2;
1399                 *buflen -= len;
1400         }
1401         return len;
1402 }
1403
1404
1405 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1406 {
1407         return StrCaseCmp(s1->name,s2->name);
1408 }
1409
1410 /****************************************************************************
1411  View list of servers available (or possibly domains). The info is
1412  extracted from lists saved by nmbd on the local host.
1413 ****************************************************************************/
1414
1415 static bool api_RNetServerEnum2(connection_struct *conn, uint16 vuid,
1416                                 char *param, int tpscnt,
1417                                 char *data, int tdscnt,
1418                                 int mdrcnt, int mprcnt, char **rdata,
1419                                 char **rparam, int *rdata_len, int *rparam_len)
1420 {
1421         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1422         char *str2 = skip_string(param,tpscnt,str1);
1423         char *p = skip_string(param,tpscnt,str2);
1424         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1425         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1426         uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1427         char *p2;
1428         int data_len, fixed_len, string_len;
1429         int f_len = 0, s_len = 0;
1430         struct srv_info_struct *servers=NULL;
1431         int counted=0,total=0;
1432         int i,missed;
1433         fstring domain;
1434         bool domain_request;
1435         bool local_request;
1436
1437         if (!str1 || !str2 || !p) {
1438                 return False;
1439         }
1440
1441         /* If someone sets all the bits they don't really mean to set
1442            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1443            known servers. */
1444
1445         if (servertype == SV_TYPE_ALL) {
1446                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1447         }
1448
1449         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1450            any other bit (they may just set this bit on its own) they
1451            want all the locally seen servers. However this bit can be
1452            set on its own so set the requested servers to be
1453            ALL - DOMAIN_ENUM. */
1454
1455         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1456                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1457         }
1458
1459         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1460         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1461
1462         p += 8;
1463
1464         if (!prefix_ok(str1,"WrLehD")) {
1465                 return False;
1466         }
1467         if (!check_server_info(uLevel,str2)) {
1468                 return False;
1469         }
1470
1471         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1472         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1473         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1474
1475         if (strcmp(str1, "WrLehDz") == 0) {
1476                 if (skip_string(param,tpscnt,p) == NULL) {
1477                         return False;
1478                 }
1479                 pull_ascii_fstring(domain, p);
1480         } else {
1481                 fstrcpy(domain, lp_workgroup());
1482         }
1483
1484         DEBUG(4, ("domain [%s]\n", domain));
1485
1486         if (lp_browse_list()) {
1487                 total = get_server_info(servertype,&servers,domain);
1488         }
1489
1490         data_len = fixed_len = string_len = 0;
1491         missed = 0;
1492
1493         TYPESAFE_QSORT(servers, total, srv_comp);
1494
1495         {
1496                 char *lastname=NULL;
1497
1498                 for (i=0;i<total;i++) {
1499                         struct srv_info_struct *s = &servers[i];
1500
1501                         if (lastname && strequal(lastname,s->name)) {
1502                                 continue;
1503                         }
1504                         lastname = s->name;
1505                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1506                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1507                                 i, s->name, s->type, s->comment, s->domain));
1508
1509                         if (data_len < buf_len) {
1510                                 counted++;
1511                                 fixed_len += f_len;
1512                                 string_len += s_len;
1513                         } else {
1514                                 missed++;
1515                         }
1516                 }
1517         }
1518
1519         *rdata_len = fixed_len + string_len;
1520         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1521         if (!*rdata) {
1522                 return False;
1523         }
1524
1525         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1526         p = *rdata;
1527         f_len = fixed_len;
1528         s_len = string_len;
1529
1530         {
1531                 char *lastname=NULL;
1532                 int count2 = counted;
1533
1534                 for (i = 0; i < total && count2;i++) {
1535                         struct srv_info_struct *s = &servers[i];
1536
1537                         if (lastname && strequal(lastname,s->name)) {
1538                                 continue;
1539                         }
1540                         lastname = s->name;
1541                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1542                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1543                                 i, s->name, s->type, s->comment, s->domain));
1544                         count2--;
1545                 }
1546         }
1547
1548         *rparam_len = 8;
1549         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1550         if (!*rparam) {
1551                 return False;
1552         }
1553         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1554         SSVAL(*rparam,2,0);
1555         SSVAL(*rparam,4,counted);
1556         SSVAL(*rparam,6,counted+missed);
1557
1558         SAFE_FREE(servers);
1559
1560         DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1561                 domain,uLevel,counted,counted+missed));
1562
1563         return True;
1564 }
1565
1566 static int srv_name_match(const char *n1, const char *n2)
1567 {
1568         /*
1569          * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1570          *
1571          *  In Windows, FirstNameToReturn need not be an exact match:
1572          *  the server will return a list of servers that exist on
1573          *  the network greater than or equal to the FirstNameToReturn.
1574          */
1575         int ret = StrCaseCmp(n1, n2);
1576
1577         if (ret <= 0) {
1578                 return 0;
1579         }
1580
1581         return ret;
1582 }
1583
1584 static bool api_RNetServerEnum3(connection_struct *conn, uint16 vuid,
1585                                 char *param, int tpscnt,
1586                                 char *data, int tdscnt,
1587                                 int mdrcnt, int mprcnt, char **rdata,
1588                                 char **rparam, int *rdata_len, int *rparam_len)
1589 {
1590         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1591         char *str2 = skip_string(param,tpscnt,str1);
1592         char *p = skip_string(param,tpscnt,str2);
1593         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1594         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1595         uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1596         char *p2;
1597         int data_len, fixed_len, string_len;
1598         int f_len = 0, s_len = 0;
1599         struct srv_info_struct *servers=NULL;
1600         int counted=0,first=0,total=0;
1601         int i,missed;
1602         fstring domain;
1603         fstring first_name;
1604         bool domain_request;
1605         bool local_request;
1606
1607         if (!str1 || !str2 || !p) {
1608                 return False;
1609         }
1610
1611         /* If someone sets all the bits they don't really mean to set
1612            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1613            known servers. */
1614
1615         if (servertype == SV_TYPE_ALL) {
1616                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1617         }
1618
1619         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1620            any other bit (they may just set this bit on its own) they
1621            want all the locally seen servers. However this bit can be
1622            set on its own so set the requested servers to be
1623            ALL - DOMAIN_ENUM. */
1624
1625         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1626                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1627         }
1628
1629         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1630         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1631
1632         p += 8;
1633
1634         if (strcmp(str1, "WrLehDzz") != 0) {
1635                 return false;
1636         }
1637         if (!check_server_info(uLevel,str2)) {
1638                 return False;
1639         }
1640
1641         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1642         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1643         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1644
1645         if (skip_string(param,tpscnt,p) == NULL) {
1646                 return False;
1647         }
1648         pull_ascii_fstring(domain, p);
1649         if (domain[0] == '\0') {
1650                 fstrcpy(domain, lp_workgroup());
1651         }
1652         p = skip_string(param,tpscnt,p);
1653         if (skip_string(param,tpscnt,p) == NULL) {
1654                 return False;
1655         }
1656         pull_ascii_fstring(first_name, p);
1657
1658         DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1659                   domain, first_name));
1660
1661         if (lp_browse_list()) {
1662                 total = get_server_info(servertype,&servers,domain);
1663         }
1664
1665         data_len = fixed_len = string_len = 0;
1666         missed = 0;
1667
1668         TYPESAFE_QSORT(servers, total, srv_comp);
1669
1670         if (first_name[0] != '\0') {
1671                 struct srv_info_struct *first_server = NULL;
1672
1673                 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1674                                     srv_name_match, first_server);
1675                 if (first_server) {
1676                         first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1677                         /*
1678                          * The binary search may not find the exact match
1679                          * so we need to search backward to find the first match
1680                          *
1681                          * This implements the strange matching windows
1682                          * implements. (see the comment in srv_name_match().
1683                          */
1684                         for (;first > 0;) {
1685                                 int ret;
1686                                 ret = StrCaseCmp(first_name,
1687                                                  servers[first-1].name);
1688                                 if (ret > 0) {
1689                                         break;
1690                                 }
1691                                 first--;
1692                         }
1693                 } else {
1694                         /* we should return no entries */
1695                         first = total;
1696                 }
1697         }
1698
1699         {
1700                 char *lastname=NULL;
1701
1702                 for (i=first;i<total;i++) {
1703                         struct srv_info_struct *s = &servers[i];
1704
1705                         if (lastname && strequal(lastname,s->name)) {
1706                                 continue;
1707                         }
1708                         lastname = s->name;
1709                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1710                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1711                                 i, s->name, s->type, s->comment, s->domain));
1712
1713                         if (data_len < buf_len) {
1714                                 counted++;
1715                                 fixed_len += f_len;
1716                                 string_len += s_len;
1717                         } else {
1718                                 missed++;
1719                         }
1720                 }
1721         }
1722
1723         *rdata_len = fixed_len + string_len;
1724         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1725         if (!*rdata) {
1726                 return False;
1727         }
1728
1729         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1730         p = *rdata;
1731         f_len = fixed_len;
1732         s_len = string_len;
1733
1734         {
1735                 char *lastname=NULL;
1736                 int count2 = counted;
1737
1738                 for (i = first; i < total && count2;i++) {
1739                         struct srv_info_struct *s = &servers[i];
1740
1741                         if (lastname && strequal(lastname,s->name)) {
1742                                 continue;
1743                         }
1744                         lastname = s->name;
1745                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1746                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1747                                 i, s->name, s->type, s->comment, s->domain));
1748                         count2--;
1749                 }
1750         }
1751
1752         *rparam_len = 8;
1753         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1754         if (!*rparam) {
1755                 return False;
1756         }
1757         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1758         SSVAL(*rparam,2,0);
1759         SSVAL(*rparam,4,counted);
1760         SSVAL(*rparam,6,counted+missed);
1761
1762         DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1763                 domain,uLevel,first,first_name,
1764                 first < total ? servers[first].name : "",
1765                 counted,counted+missed));
1766
1767         SAFE_FREE(servers);
1768
1769         return True;
1770 }
1771
1772 /****************************************************************************
1773   command 0x34 - suspected of being a "Lookup Names" stub api
1774   ****************************************************************************/
1775
1776 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1777                                 char *param, int tpscnt,
1778                                 char *data, int tdscnt,
1779                                 int mdrcnt, int mprcnt, char **rdata,
1780                                 char **rparam, int *rdata_len, int *rparam_len)
1781 {
1782         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1783         char *str2 = skip_string(param,tpscnt,str1);
1784         char *p = skip_string(param,tpscnt,str2);
1785         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1786         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1787         int counted=0;
1788         int missed=0;
1789
1790         if (!str1 || !str2 || !p) {
1791                 return False;
1792         }
1793
1794         DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1795                 str1, str2, p, uLevel, buf_len));
1796
1797         if (!prefix_ok(str1,"zWrLeh")) {
1798                 return False;
1799         }
1800
1801         *rdata_len = 0;
1802
1803         *rparam_len = 8;
1804         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1805         if (!*rparam) {
1806                 return False;
1807         }
1808
1809         SSVAL(*rparam,0,0x08AC); /* informational warning message */
1810         SSVAL(*rparam,2,0);
1811         SSVAL(*rparam,4,counted);
1812         SSVAL(*rparam,6,counted+missed);
1813
1814         return True;
1815 }
1816
1817 /****************************************************************************
1818   get info about a share
1819   ****************************************************************************/
1820
1821 static bool check_share_info(int uLevel, char* id)
1822 {
1823         switch( uLevel ) {
1824                 case 0:
1825                         if (strcmp(id,"B13") != 0) {
1826                                 return False;
1827                         }
1828                         break;
1829                 case 1:
1830                         /* Level-2 descriptor is allowed (and ignored) */
1831                         if (strcmp(id,"B13BWz") != 0 &&
1832                             strcmp(id,"B13BWzWWWzB9B") != 0) {
1833                                 return False;
1834                         }
1835                         break;
1836                 case 2:
1837                         if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1838                                 return False;
1839                         }
1840                         break;
1841                 case 91:
1842                         if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1843                                 return False;
1844                         }
1845                         break;
1846                 default:
1847                         return False;
1848         }
1849         return True;
1850 }
1851
1852 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1853                            char** buf, int* buflen,
1854                            char** stringbuf, int* stringspace, char* baseaddr)
1855 {
1856         int struct_len;
1857         char* p;
1858         char* p2;
1859         int l2;
1860         int len;
1861
1862         switch( uLevel ) {
1863                 case 0:
1864                         struct_len = 13;
1865                         break;
1866                 case 1:
1867                         struct_len = 20;
1868                         break;
1869                 case 2:
1870                         struct_len = 40;
1871                         break;
1872                 case 91:
1873                         struct_len = 68;
1874                         break;
1875                 default:
1876                         return -1;
1877         }
1878
1879         if (!buf) {
1880                 len = 0;
1881
1882                 if (uLevel > 0) {
1883                         len += StrlenExpanded(conn,snum,lp_comment(snum));
1884                 }
1885                 if (uLevel > 1) {
1886                         len += strlen(lp_pathname(snum)) + 1;
1887                 }
1888                 if (buflen) {
1889                         *buflen = struct_len;
1890                 }
1891                 if (stringspace) {
1892                         *stringspace = len;
1893                 }
1894                 return struct_len + len;
1895         }
1896
1897         len = struct_len;
1898         p = *buf;
1899         if ((*buflen) < struct_len) {
1900                 return -1;
1901         }
1902
1903         if (stringbuf) {
1904                 p2 = *stringbuf;
1905                 l2 = *stringspace;
1906         } else {
1907                 p2 = p + struct_len;
1908                 l2 = (*buflen) - struct_len;
1909         }
1910
1911         if (!baseaddr) {
1912                 baseaddr = p;
1913         }
1914
1915         push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1916
1917         if (uLevel > 0) {
1918                 int type;
1919
1920                 SCVAL(p,13,0);
1921                 type = STYPE_DISKTREE;
1922                 if (lp_print_ok(snum)) {
1923                         type = STYPE_PRINTQ;
1924                 }
1925                 if (strequal("IPC",lp_fstype(snum))) {
1926                         type = STYPE_IPC;
1927                 }
1928                 SSVAL(p,14,type);               /* device type */
1929                 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1930                 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1931         }
1932
1933         if (uLevel > 1) {
1934                 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1935                 SSVALS(p,22,-1);                /* max uses */
1936                 SSVAL(p,24,1); /* current uses */
1937                 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1938                 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1939                 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1940         }
1941
1942         if (uLevel > 2) {
1943                 memset(p+40,0,SHPWLEN+2);
1944                 SSVAL(p,50,0);
1945                 SIVAL(p,52,0);
1946                 SSVAL(p,56,0);
1947                 SSVAL(p,58,0);
1948                 SIVAL(p,60,0);
1949                 SSVAL(p,64,0);
1950                 SSVAL(p,66,0);
1951         }
1952
1953         if (stringbuf) {
1954                 (*buf) = p + struct_len;
1955                 (*buflen) -= struct_len;
1956                 (*stringbuf) = p2;
1957                 (*stringspace) = l2;
1958         } else {
1959                 (*buf) = p2;
1960                 (*buflen) -= len;
1961         }
1962
1963         return len;
1964 }
1965
1966 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1967                                 char *param, int tpscnt,
1968                                 char *data, int tdscnt,
1969                                 int mdrcnt,int mprcnt,
1970                                 char **rdata,char **rparam,
1971                                 int *rdata_len,int *rparam_len)
1972 {
1973         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1974         char *str2 = skip_string(param,tpscnt,str1);
1975         char *netname = skip_string(param,tpscnt,str2);
1976         char *p = skip_string(param,tpscnt,netname);
1977         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1978         int snum;
1979
1980         if (!str1 || !str2 || !netname || !p) {
1981                 return False;
1982         }
1983
1984         snum = find_service(netname);
1985         if (snum < 0) {
1986                 return False;
1987         }
1988
1989         /* check it's a supported varient */
1990         if (!prefix_ok(str1,"zWrLh")) {
1991                 return False;
1992         }
1993         if (!check_share_info(uLevel,str2)) {
1994                 return False;
1995         }
1996
1997         *rdata = smb_realloc_limit(*rdata,mdrcnt);
1998         if (!*rdata) {
1999                 return False;
2000         }
2001         p = *rdata;
2002         *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
2003         if (*rdata_len < 0) {
2004                 return False;
2005         }
2006
2007         *rparam_len = 6;
2008         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2009         if (!*rparam) {
2010                 return False;
2011         }
2012         SSVAL(*rparam,0,NERR_Success);
2013         SSVAL(*rparam,2,0);             /* converter word */
2014         SSVAL(*rparam,4,*rdata_len);
2015
2016         return True;
2017 }
2018
2019 /****************************************************************************
2020   View the list of available shares.
2021
2022   This function is the server side of the NetShareEnum() RAP call.
2023   It fills the return buffer with share names and share comments.
2024   Note that the return buffer normally (in all known cases) allows only
2025   twelve byte strings for share names (plus one for a nul terminator).
2026   Share names longer than 12 bytes must be skipped.
2027  ****************************************************************************/
2028
2029 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
2030                                 char *param, int tpscnt,
2031                                 char *data, int tdscnt,
2032                                 int                mdrcnt,
2033                                 int                mprcnt,
2034                                 char             **rdata,
2035                                 char             **rparam,
2036                                 int               *rdata_len,
2037                                 int               *rparam_len )
2038 {
2039         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2040         char *str2 = skip_string(param,tpscnt,str1);
2041         char *p = skip_string(param,tpscnt,str2);
2042         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2043         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
2044         char *p2;
2045         int count = 0;
2046         int total=0,counted=0;
2047         bool missed = False;
2048         int i;
2049         int data_len, fixed_len, string_len;
2050         int f_len = 0, s_len = 0;
2051
2052         if (!str1 || !str2 || !p) {
2053                 return False;
2054         }
2055
2056         if (!prefix_ok(str1,"WrLeh")) {
2057                 return False;
2058         }
2059         if (!check_share_info(uLevel,str2)) {
2060                 return False;
2061         }
2062
2063         /* Ensure all the usershares are loaded. */
2064         become_root();
2065         load_registry_shares();
2066         count = load_usershare_shares();
2067         unbecome_root();
2068
2069         data_len = fixed_len = string_len = 0;
2070         for (i=0;i<count;i++) {
2071                 fstring servicename_dos;
2072                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2073                         continue;
2074                 }
2075                 push_ascii_fstring(servicename_dos, lp_servicename(i));
2076                 /* Maximum name length = 13. */
2077                 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2078                         total++;
2079                         data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2080                         if (data_len < buf_len) {
2081                                 counted++;
2082                                 fixed_len += f_len;
2083                                 string_len += s_len;
2084                         } else {
2085                                 missed = True;
2086                         }
2087                 }
2088         }
2089
2090         *rdata_len = fixed_len + string_len;
2091         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2092         if (!*rdata) {
2093                 return False;
2094         }
2095
2096         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
2097         p = *rdata;
2098         f_len = fixed_len;
2099         s_len = string_len;
2100
2101         for( i = 0; i < count; i++ ) {
2102                 fstring servicename_dos;
2103                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2104                         continue;
2105                 }
2106
2107                 push_ascii_fstring(servicename_dos, lp_servicename(i));
2108                 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2109                         if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2110                                 break;
2111                         }
2112                 }
2113         }
2114
2115         *rparam_len = 8;
2116         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2117         if (!*rparam) {
2118                 return False;
2119         }
2120         SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2121         SSVAL(*rparam,2,0);
2122         SSVAL(*rparam,4,counted);
2123         SSVAL(*rparam,6,total);
2124
2125         DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2126                 counted,total,uLevel,
2127                 buf_len,*rdata_len,mdrcnt));
2128
2129         return True;
2130 }
2131
2132 /****************************************************************************
2133   Add a share
2134   ****************************************************************************/
2135
2136 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
2137                                 char *param, int tpscnt,
2138                                 char *data, int tdscnt,
2139                                 int mdrcnt,int mprcnt,
2140                                 char **rdata,char **rparam,
2141                                 int *rdata_len,int *rparam_len)
2142 {
2143         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2144         char *str2 = skip_string(param,tpscnt,str1);
2145         char *p = skip_string(param,tpscnt,str2);
2146         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2147         fstring sharename;
2148         fstring comment;
2149         char *pathname = NULL;
2150         unsigned int offset;
2151         int res = ERRunsup;
2152         size_t converted_size;
2153
2154         WERROR werr = WERR_OK;
2155         TALLOC_CTX *mem_ctx = talloc_tos();
2156         NTSTATUS status;
2157         struct rpc_pipe_client *cli = NULL;
2158         union srvsvc_NetShareInfo info;
2159         struct srvsvc_NetShareInfo2 info2;
2160
2161         if (!str1 || !str2 || !p) {
2162                 return False;
2163         }
2164
2165         /* check it's a supported varient */
2166         if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2167                 return False;
2168         }
2169         if (!check_share_info(uLevel,str2)) {
2170                 return False;
2171         }
2172         if (uLevel != 2) {
2173                 return False;
2174         }
2175
2176         /* Do we have a string ? */
2177         if (skip_string(data,mdrcnt,data) == NULL) {
2178                 return False;
2179         }
2180         pull_ascii_fstring(sharename,data);
2181
2182         if (mdrcnt < 28) {
2183                 return False;
2184         }
2185
2186         /* only support disk share adds */
2187         if (SVAL(data,14)!=STYPE_DISKTREE) {
2188                 return False;
2189         }
2190
2191         offset = IVAL(data, 16);
2192         if (offset >= mdrcnt) {
2193                 res = ERRinvalidparam;
2194                 goto out;
2195         }
2196
2197         /* Do we have a string ? */
2198         if (skip_string(data,mdrcnt,data+offset) == NULL) {
2199                 return False;
2200         }
2201         pull_ascii_fstring(comment, offset? (data+offset) : "");
2202
2203         offset = IVAL(data, 26);
2204
2205         if (offset >= mdrcnt) {
2206                 res = ERRinvalidparam;
2207                 goto out;
2208         }
2209
2210         /* Do we have a string ? */
2211         if (skip_string(data,mdrcnt,data+offset) == NULL) {
2212                 return False;
2213         }
2214
2215         if (!pull_ascii_talloc(talloc_tos(), &pathname,
2216                                offset ? (data+offset) : "", &converted_size))
2217         {
2218                 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2219                          strerror(errno)));
2220         }
2221
2222         if (!pathname) {
2223                 return false;
2224         }
2225
2226         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_srvsvc.syntax_id,
2227                                         rpc_srvsvc_dispatch, conn->server_info,
2228                                         &cli);
2229         if (!NT_STATUS_IS_OK(status)) {
2230                 DEBUG(0,("api_RNetShareAdd: could not connect to srvsvc: %s\n",
2231                           nt_errstr(status)));
2232                 res = W_ERROR_V(ntstatus_to_werror(status));
2233                 goto out;
2234         }
2235
2236         info2.name              = sharename;
2237         info2.type              = STYPE_DISKTREE;
2238         info2.comment           = comment;
2239         info2.permissions       = 0;
2240         info2.max_users         = 0;
2241         info2.current_users     = 0;
2242         info2.path              = pathname;
2243         info2.password          = NULL;
2244
2245         info.info2 = &info2;
2246
2247         status = rpccli_srvsvc_NetShareAdd(cli, mem_ctx,
2248                                            cli->srv_name_slash,
2249                                            2,
2250                                            &info,
2251                                            NULL,
2252                                            &werr);
2253         if (!NT_STATUS_IS_OK(status)) {
2254                 res = W_ERROR_V(ntstatus_to_werror(status));
2255                 goto out;
2256         }
2257         if (!W_ERROR_IS_OK(werr)) {
2258                 res = W_ERROR_V(werr);
2259                 goto out;
2260         }
2261
2262         *rparam_len = 6;
2263         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2264         if (!*rparam) {
2265                 return False;
2266         }
2267         SSVAL(*rparam,0,NERR_Success);
2268         SSVAL(*rparam,2,0);             /* converter word */
2269         SSVAL(*rparam,4,*rdata_len);
2270         *rdata_len = 0;
2271
2272         return True;
2273
2274   out:
2275
2276         *rparam_len = 4;
2277         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2278         if (!*rparam) {
2279                 return False;
2280         }
2281         *rdata_len = 0;
2282         SSVAL(*rparam,0,res);
2283         SSVAL(*rparam,2,0);
2284         return True;
2285 }
2286
2287 /****************************************************************************
2288   view list of groups available
2289   ****************************************************************************/
2290
2291 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2292                                 char *param, int tpscnt,
2293                                 char *data, int tdscnt,
2294                                 int mdrcnt,int mprcnt,
2295                                 char **rdata,char **rparam,
2296                                 int *rdata_len,int *rparam_len)
2297 {
2298         int i;
2299         int errflags=0;
2300         int resume_context, cli_buf_size;
2301         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2302         char *str2 = skip_string(param,tpscnt,str1);
2303         char *p = skip_string(param,tpscnt,str2);
2304
2305         uint32_t num_groups;
2306         uint32_t resume_handle;
2307         struct rpc_pipe_client *samr_pipe;
2308         struct policy_handle samr_handle, domain_handle;
2309         NTSTATUS status;
2310
2311         if (!str1 || !str2 || !p) {
2312                 return False;
2313         }
2314
2315         if (strcmp(str1,"WrLeh") != 0) {
2316                 return False;
2317         }
2318
2319         /* parameters
2320          * W-> resume context (number of users to skip)
2321          * r -> return parameter pointer to receive buffer
2322          * L -> length of receive buffer
2323          * e -> return parameter number of entries
2324          * h -> return parameter total number of users
2325          */
2326
2327         if (strcmp("B21",str2) != 0) {
2328                 return False;
2329         }
2330
2331         status = rpc_pipe_open_internal(
2332                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2333                 conn->server_info, &samr_pipe);
2334         if (!NT_STATUS_IS_OK(status)) {
2335                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2336                           nt_errstr(status)));
2337                 return false;
2338         }
2339
2340         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2341                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2342         if (!NT_STATUS_IS_OK(status)) {
2343                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2344                           nt_errstr(status)));
2345                 return false;
2346         }
2347
2348         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2349                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2350                                         get_global_sam_sid(), &domain_handle);
2351         if (!NT_STATUS_IS_OK(status)) {
2352                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2353                           nt_errstr(status)));
2354                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2355                 return false;
2356         }
2357
2358         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2359         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2360         DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2361                   "%d\n", resume_context, cli_buf_size));
2362
2363         *rdata_len = cli_buf_size;
2364         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2365         if (!*rdata) {
2366                 return False;
2367         }
2368
2369         p = *rdata;
2370
2371         errflags = NERR_Success;
2372         num_groups = 0;
2373         resume_handle = 0;
2374
2375         while (true) {
2376                 struct samr_SamArray *sam_entries;
2377                 uint32_t num_entries;
2378
2379                 status = rpccli_samr_EnumDomainGroups(samr_pipe, talloc_tos(),
2380                                                       &domain_handle,
2381                                                       &resume_handle,
2382                                                       &sam_entries, 1,
2383                                                       &num_entries);
2384                 if (!NT_STATUS_IS_OK(status)) {
2385                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2386                                    "%s\n", nt_errstr(status)));
2387                         break;
2388                 }
2389
2390                 if (num_entries == 0) {
2391                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2392                                    "no entries -- done\n"));
2393                         break;
2394                 }
2395
2396                 for(i=0; i<num_entries; i++) {
2397                         const char *name;
2398
2399                         name = sam_entries->entries[i].name.string;
2400
2401                         if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2402                                 /* set overflow error */
2403                                 DEBUG(3,("overflow on entry %d group %s\n", i,
2404                                          name));
2405                                 errflags=234;
2406                                 break;
2407                         }
2408
2409                         /* truncate the name at 21 chars. */
2410                         memset(p, 0, 21);
2411                         strlcpy(p, name, 21);
2412                         DEBUG(10,("adding entry %d group %s\n", i, p));
2413                         p += 21;
2414                         p += 5; /* Both NT4 and W2k3SP1 do padding here.  No
2415                                  * idea why... */
2416                         num_groups += 1;
2417                 }
2418
2419                 if (errflags != NERR_Success) {
2420                         break;
2421                 }
2422
2423                 TALLOC_FREE(sam_entries);
2424         }
2425
2426         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2427         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2428
2429         *rdata_len = PTR_DIFF(p,*rdata);
2430
2431         *rparam_len = 8;
2432         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2433         if (!*rparam) {
2434                 return False;
2435         }
2436         SSVAL(*rparam, 0, errflags);
2437         SSVAL(*rparam, 2, 0);           /* converter word */
2438         SSVAL(*rparam, 4, num_groups);  /* is this right?? */
2439         SSVAL(*rparam, 6, resume_context+num_groups);   /* is this right?? */
2440
2441         return(True);
2442 }
2443
2444 /*******************************************************************
2445  Get groups that a user is a member of.
2446 ******************************************************************/
2447
2448 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2449                                 char *param, int tpscnt,
2450                                 char *data, int tdscnt,
2451                                 int mdrcnt,int mprcnt,
2452                                 char **rdata,char **rparam,
2453                                 int *rdata_len,int *rparam_len)
2454 {
2455         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2456         char *str2 = skip_string(param,tpscnt,str1);
2457         char *UserName = skip_string(param,tpscnt,str2);
2458         char *p = skip_string(param,tpscnt,UserName);
2459         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2460         const char *level_string;
2461         int count=0;
2462         bool ret = False;
2463         uint32_t i;
2464         char *endp = NULL;
2465
2466         struct rpc_pipe_client *samr_pipe;
2467         struct policy_handle samr_handle, domain_handle, user_handle;
2468         struct lsa_String name;
2469         struct lsa_Strings names;
2470         struct samr_Ids type, rid;
2471         struct samr_RidWithAttributeArray *rids;
2472         NTSTATUS status;
2473
2474         if (!str1 || !str2 || !UserName || !p) {
2475                 return False;
2476         }
2477
2478         *rparam_len = 8;
2479         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2480         if (!*rparam) {
2481                 return False;
2482         }
2483
2484         /* check it's a supported varient */
2485
2486         if ( strcmp(str1,"zWrLeh") != 0 )
2487                 return False;
2488
2489         switch( uLevel ) {
2490                 case 0:
2491                         level_string = "B21";
2492                         break;
2493                 default:
2494                         return False;
2495         }
2496
2497         if (strcmp(level_string,str2) != 0)
2498                 return False;
2499
2500         *rdata_len = mdrcnt + 1024;
2501         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2502         if (!*rdata) {
2503                 return False;
2504         }
2505
2506         SSVAL(*rparam,0,NERR_Success);
2507         SSVAL(*rparam,2,0);             /* converter word */
2508
2509         p = *rdata;
2510         endp = *rdata + *rdata_len;
2511
2512         status = rpc_pipe_open_internal(
2513                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2514                 conn->server_info, &samr_pipe);
2515         if (!NT_STATUS_IS_OK(status)) {
2516                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2517                           nt_errstr(status)));
2518                 return false;
2519         }
2520
2521         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2522                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2523         if (!NT_STATUS_IS_OK(status)) {
2524                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2525                           nt_errstr(status)));
2526                 return false;
2527         }
2528
2529         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2530                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2531                                         get_global_sam_sid(), &domain_handle);
2532         if (!NT_STATUS_IS_OK(status)) {
2533                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2534                           nt_errstr(status)));
2535                 goto close_sam;
2536         }
2537
2538         name.string = UserName;
2539
2540         status = rpccli_samr_LookupNames(samr_pipe, talloc_tos(),
2541                                          &domain_handle, 1, &name,
2542                                          &rid, &type);
2543         if (!NT_STATUS_IS_OK(status)) {
2544                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2545                           nt_errstr(status)));
2546                 goto close_domain;
2547         }
2548
2549         if (type.ids[0] != SID_NAME_USER) {
2550                 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2551                            sid_type_lookup(type.ids[0])));
2552                 goto close_domain;
2553         }
2554
2555         status = rpccli_samr_OpenUser(samr_pipe, talloc_tos(),
2556                                       &domain_handle,
2557                                       SAMR_USER_ACCESS_GET_GROUPS,
2558                                       rid.ids[0], &user_handle);
2559         if (!NT_STATUS_IS_OK(status)) {
2560                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2561                           nt_errstr(status)));
2562                 goto close_domain;
2563         }
2564
2565         status = rpccli_samr_GetGroupsForUser(samr_pipe, talloc_tos(),
2566                                               &user_handle, &rids);
2567         if (!NT_STATUS_IS_OK(status)) {
2568                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2569                           nt_errstr(status)));
2570                 goto close_user;
2571         }
2572
2573         for (i=0; i<rids->count; i++) {
2574
2575                 status = rpccli_samr_LookupRids(samr_pipe, talloc_tos(),
2576                                                 &domain_handle,
2577                                                 1, &rids->rids[i].rid,
2578                                                 &names, &type);
2579                 if (NT_STATUS_IS_OK(status) && (names.count == 1)) {
2580                         strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2581                         p += 21;
2582                         count++;
2583                 }
2584         }
2585
2586         *rdata_len = PTR_DIFF(p,*rdata);
2587
2588         SSVAL(*rparam,4,count); /* is this right?? */
2589         SSVAL(*rparam,6,count); /* is this right?? */
2590
2591         ret = True;
2592
2593  close_user:
2594         rpccli_samr_Close(samr_pipe, talloc_tos(), &user_handle);
2595  close_domain:
2596         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2597  close_sam:
2598         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2599
2600         return ret;
2601 }
2602
2603 /*******************************************************************
2604  Get all users.
2605 ******************************************************************/
2606
2607 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2608                                 char *param, int tpscnt,
2609                                 char *data, int tdscnt,
2610                                 int mdrcnt,int mprcnt,
2611                                 char **rdata,char **rparam,
2612                                 int *rdata_len,int *rparam_len)
2613 {
2614         int count_sent=0;
2615         int num_users=0;
2616         int errflags=0;
2617         int i, resume_context, cli_buf_size;
2618         uint32_t resume_handle;
2619
2620         struct rpc_pipe_client *samr_pipe;
2621         struct policy_handle samr_handle, domain_handle;
2622         NTSTATUS status;
2623
2624         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2625         char *str2 = skip_string(param,tpscnt,str1);
2626         char *p = skip_string(param,tpscnt,str2);
2627         char *endp = NULL;
2628
2629         if (!str1 || !str2 || !p) {
2630                 return False;
2631         }
2632
2633         if (strcmp(str1,"WrLeh") != 0)
2634                 return False;
2635         /* parameters
2636           * W-> resume context (number of users to skip)
2637           * r -> return parameter pointer to receive buffer
2638           * L -> length of receive buffer
2639           * e -> return parameter number of entries
2640           * h -> return parameter total number of users
2641           */
2642
2643         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2644         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2645         DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2646                         resume_context, cli_buf_size));
2647
2648         *rparam_len = 8;
2649         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2650         if (!*rparam) {
2651                 return False;
2652         }
2653
2654         /* check it's a supported varient */
2655         if (strcmp("B21",str2) != 0)
2656                 return False;
2657
2658         *rdata_len = cli_buf_size;
2659         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2660         if (!*rdata) {
2661                 return False;
2662         }
2663
2664         p = *rdata;
2665         endp = *rdata + *rdata_len;
2666
2667         status = rpc_pipe_open_internal(
2668                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2669                 conn->server_info, &samr_pipe);
2670         if (!NT_STATUS_IS_OK(status)) {
2671                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2672                           nt_errstr(status)));
2673                 return false;
2674         }
2675
2676         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2677                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2678         if (!NT_STATUS_IS_OK(status)) {
2679                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2680                           nt_errstr(status)));
2681                 return false;
2682         }
2683
2684         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2685                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2686                                         get_global_sam_sid(), &domain_handle);
2687         if (!NT_STATUS_IS_OK(status)) {
2688                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2689                           nt_errstr(status)));
2690                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2691                 return false;
2692         }
2693
2694         errflags=NERR_Success;
2695
2696         resume_handle = 0;
2697
2698         while (true) {
2699                 struct samr_SamArray *sam_entries;
2700                 uint32_t num_entries;
2701
2702                 status = rpccli_samr_EnumDomainUsers(samr_pipe, talloc_tos(),
2703                                                      &domain_handle,
2704                                                      &resume_handle,
2705                                                      0, &sam_entries, 1,
2706                                                      &num_entries);
2707
2708                 if (!NT_STATUS_IS_OK(status)) {
2709                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2710                                    "%s\n", nt_errstr(status)));
2711                         break;
2712                 }
2713
2714                 if (num_entries == 0) {
2715                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2716                                    "no entries -- done\n"));
2717                         break;
2718                 }
2719
2720                 for (i=0; i<num_entries; i++) {
2721                         const char *name;
2722
2723                         name = sam_entries->entries[i].name.string;
2724
2725                         if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2726                            &&(strlen(name)<=21)) {
2727                                 strlcpy(p,name,PTR_DIFF(endp,p));
2728                                 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2729                                           "username %s\n",count_sent,p));
2730                                 p += 21;
2731                                 count_sent++;
2732                         } else {
2733                                 /* set overflow error */
2734                                 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2735                                           "username %s\n",count_sent,name));
2736                                 errflags=234;
2737                                 break;
2738                         }
2739                 }
2740
2741                 if (errflags != NERR_Success) {
2742                         break;
2743                 }
2744
2745                 TALLOC_FREE(sam_entries);
2746         }
2747
2748         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2749         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2750
2751         *rdata_len = PTR_DIFF(p,*rdata);
2752
2753         SSVAL(*rparam,0,errflags);
2754         SSVAL(*rparam,2,0);           /* converter word */
2755         SSVAL(*rparam,4,count_sent);  /* is this right?? */
2756         SSVAL(*rparam,6,num_users); /* is this right?? */
2757
2758         return True;
2759 }
2760
2761 /****************************************************************************
2762  Get the time of day info.
2763 ****************************************************************************/
2764
2765 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2766                                 char *param, int tpscnt,
2767                                 char *data, int tdscnt,
2768                                 int mdrcnt,int mprcnt,
2769                                 char **rdata,char **rparam,
2770                                 int *rdata_len,int *rparam_len)
2771 {
2772         struct tm *t;
2773         time_t unixdate = time(NULL);
2774         char *p;
2775
2776         *rparam_len = 4;
2777         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2778         if (!*rparam) {
2779                 return False;
2780         }
2781
2782         *rdata_len = 21;
2783         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2784         if (!*rdata) {
2785                 return False;
2786         }
2787
2788         SSVAL(*rparam,0,NERR_Success);
2789         SSVAL(*rparam,2,0);             /* converter word */
2790
2791         p = *rdata;
2792
2793         srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2794                                             by NT in a "net time" operation,
2795                                             it seems to ignore the one below */
2796
2797         /* the client expects to get localtime, not GMT, in this bit
2798                 (I think, this needs testing) */
2799         t = localtime(&unixdate);
2800         if (!t) {
2801                 return False;
2802         }
2803
2804         SIVAL(p,4,0);           /* msecs ? */
2805         SCVAL(p,8,t->tm_hour);
2806         SCVAL(p,9,t->tm_min);
2807         SCVAL(p,10,t->tm_sec);
2808         SCVAL(p,11,0);          /* hundredths of seconds */
2809         SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2810         SSVAL(p,14,10000);              /* timer interval in 0.0001 of sec */
2811         SCVAL(p,16,t->tm_mday);
2812         SCVAL(p,17,t->tm_mon + 1);
2813         SSVAL(p,18,1900+t->tm_year);
2814         SCVAL(p,20,t->tm_wday);
2815
2816         return True;
2817 }
2818
2819 /****************************************************************************
2820  Set the user password.
2821 *****************************************************************************/
2822
2823 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2824                                 char *param, int tpscnt,
2825                                 char *data, int tdscnt,
2826                                 int mdrcnt,int mprcnt,
2827                                 char **rdata,char **rparam,
2828                                 int *rdata_len,int *rparam_len)
2829 {
2830         char *np = get_safe_str_ptr(param,tpscnt,param,2);
2831         char *p = NULL;
2832         fstring user;
2833         fstring pass1,pass2;
2834
2835         /* Skip 2 strings. */
2836         p = skip_string(param,tpscnt,np);
2837         p = skip_string(param,tpscnt,p);
2838
2839         if (!np || !p) {
2840                 return False;
2841         }
2842
2843         /* Do we have a string ? */
2844         if (skip_string(param,tpscnt,p) == NULL) {
2845                 return False;
2846         }
2847         pull_ascii_fstring(user,p);
2848
2849         p = skip_string(param,tpscnt,p);
2850         if (!p) {
2851                 return False;
2852         }
2853
2854         memset(pass1,'\0',sizeof(pass1));
2855         memset(pass2,'\0',sizeof(pass2));
2856         /*
2857          * We use 31 here not 32 as we're checking
2858          * the last byte we want to access is safe.
2859          */
2860         if (!is_offset_safe(param,tpscnt,p,31)) {
2861                 return False;
2862         }
2863         memcpy(pass1,p,16);
2864         memcpy(pass2,p+16,16);
2865
2866         *rparam_len = 4;
2867         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2868         if (!*rparam) {
2869                 return False;
2870         }
2871
2872         *rdata_len = 0;
2873
2874         SSVAL(*rparam,0,NERR_badpass);
2875         SSVAL(*rparam,2,0);             /* converter word */
2876
2877         DEBUG(3,("Set password for <%s>\n",user));
2878
2879         /*
2880          * Attempt to verify the old password against smbpasswd entries
2881          * Win98 clients send old and new password in plaintext for this call.
2882          */
2883
2884         {
2885                 struct auth_serversupplied_info *server_info = NULL;
2886                 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2887
2888                 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2889
2890                         become_root();
2891                         if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2892                                 SSVAL(*rparam,0,NERR_Success);
2893                         }
2894                         unbecome_root();
2895
2896                         TALLOC_FREE(server_info);
2897                 }
2898                 data_blob_clear_free(&password);
2899         }
2900
2901         /*
2902          * If the plaintext change failed, attempt
2903          * the old encrypted method. NT will generate this
2904          * after trying the samr method. Note that this
2905          * method is done as a last resort as this
2906          * password change method loses the NT password hash
2907          * and cannot change the UNIX password as no plaintext
2908          * is received.
2909          */
2910
2911         if(SVAL(*rparam,0) != NERR_Success) {
2912                 struct samu *hnd = NULL;
2913
2914                 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2915                         become_root();
2916                         if (change_lanman_password(hnd,(uchar *)pass2)) {
2917                                 SSVAL(*rparam,0,NERR_Success);
2918                         }
2919                         unbecome_root();
2920                         TALLOC_FREE(hnd);
2921                 }
2922         }
2923
2924         memset((char *)pass1,'\0',sizeof(fstring));
2925         memset((char *)pass2,'\0',sizeof(fstring));
2926
2927         return(True);
2928 }
2929
2930 /****************************************************************************
2931   Set the user password (SamOEM version - gets plaintext).
2932 ****************************************************************************/
2933
2934 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2935                                 char *param, int tpscnt,
2936                                 char *data, int tdscnt,
2937                                 int mdrcnt,int mprcnt,
2938                                 char **rdata,char **rparam,
2939                                 int *rdata_len,int *rparam_len)
2940 {
2941         fstring user;
2942         char *p = get_safe_str_ptr(param,tpscnt,param,2);
2943
2944         TALLOC_CTX *mem_ctx = talloc_tos();
2945         NTSTATUS status;
2946         struct rpc_pipe_client *cli = NULL;
2947         struct lsa_AsciiString server, account;
2948         struct samr_CryptPassword password;
2949         struct samr_Password hash;
2950         int errcode = NERR_badpass;
2951         int bufsize;
2952
2953         *rparam_len = 4;
2954         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2955         if (!*rparam) {
2956                 return False;
2957         }
2958
2959         if (!p) {
2960                 return False;
2961         }
2962         *rdata_len = 0;
2963
2964         SSVAL(*rparam,0,NERR_badpass);
2965
2966         /*
2967          * Check the parameter definition is correct.
2968          */
2969
2970         /* Do we have a string ? */
2971         if (skip_string(param,tpscnt,p) == 0) {
2972                 return False;
2973         }
2974         if(!strequal(p, "zsT")) {
2975                 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2976                 return False;
2977         }
2978         p = skip_string(param, tpscnt, p);
2979         if (!p) {
2980                 return False;
2981         }
2982
2983         /* Do we have a string ? */
2984         if (skip_string(param,tpscnt,p) == 0) {
2985                 return False;
2986         }
2987         if(!strequal(p, "B516B16")) {
2988                 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2989                 return False;
2990         }
2991         p = skip_string(param,tpscnt,p);
2992         if (!p) {
2993                 return False;
2994         }
2995         /* Do we have a string ? */
2996         if (skip_string(param,tpscnt,p) == 0) {
2997                 return False;
2998         }
2999         p += pull_ascii_fstring(user,p);
3000
3001         DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
3002
3003         if (tdscnt != 532) {
3004                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3005                 goto out;
3006         }
3007
3008         bufsize = get_safe_SVAL(param,tpscnt,p,0,-1);
3009         if (bufsize != 532) {
3010                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3011                 goto out;
3012         }
3013
3014         memcpy(password.data, data, 516);
3015         memcpy(hash.hash, data+516, 16);
3016
3017         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_samr.syntax_id,
3018                                         rpc_samr_dispatch, conn->server_info,
3019                                         &cli);
3020         if (!NT_STATUS_IS_OK(status)) {
3021                 DEBUG(0,("api_SamOEMChangePassword: could not connect to samr: %s\n",
3022                           nt_errstr(status)));
3023                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3024                 goto out;
3025         }
3026
3027         init_lsa_AsciiString(&server, global_myname());
3028         init_lsa_AsciiString(&account, user);
3029
3030         status = rpccli_samr_OemChangePasswordUser2(cli, mem_ctx,
3031                                                     &server,
3032                                                     &account,
3033                                                     &password,
3034                                                     &hash);
3035         if (!NT_STATUS_IS_OK(status)) {
3036                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3037                 goto out;
3038         }
3039
3040         errcode = NERR_Success;
3041  out:
3042         SSVAL(*rparam,0,errcode);
3043         SSVAL(*rparam,2,0);             /* converter word */
3044
3045         return(True);
3046 }
3047
3048 /****************************************************************************
3049   delete a print job
3050   Form: <W> <>
3051   ****************************************************************************/
3052
3053 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
3054                                 char *param, int tpscnt,
3055                                 char *data, int tdscnt,
3056                                 int mdrcnt,int mprcnt,
3057                                 char **rdata,char **rparam,
3058                                 int *rdata_len,int *rparam_len)
3059 {
3060         int function = get_safe_SVAL(param,tpscnt,param,0,0);
3061         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3062         char *str2 = skip_string(param,tpscnt,str1);
3063         char *p = skip_string(param,tpscnt,str2);
3064         uint32 jobid;
3065         fstring sharename;
3066         int errcode;
3067         WERROR werr = WERR_OK;
3068
3069         TALLOC_CTX *mem_ctx = talloc_tos();
3070         NTSTATUS status;
3071         struct rpc_pipe_client *cli = NULL;
3072         struct policy_handle handle;
3073         struct spoolss_DevmodeContainer devmode_ctr;
3074         enum spoolss_JobControl command;
3075
3076         if (!str1 || !str2 || !p) {
3077                 return False;
3078         }
3079         /*
3080          * We use 1 here not 2 as we're checking
3081          * the last byte we want to access is safe.
3082          */
3083         if (!is_offset_safe(param,tpscnt,p,1)) {
3084                 return False;
3085         }
3086         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3087                 return False;
3088
3089         /* check it's a supported varient */
3090         if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
3091                 return(False);
3092
3093         *rparam_len = 4;
3094         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3095         if (!*rparam) {
3096                 return False;
3097         }
3098         *rdata_len = 0;
3099
3100         ZERO_STRUCT(handle);
3101
3102         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_spoolss.syntax_id,
3103                                         rpc_spoolss_dispatch, conn->server_info,
3104                                         &cli);
3105         if (!NT_STATUS_IS_OK(status)) {
3106                 DEBUG(0,("api_RDosPrintJobDel: could not connect to spoolss: %s\n",
3107                           nt_errstr(status)));
3108                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3109                 goto out;
3110         }
3111
3112         ZERO_STRUCT(devmode_ctr);
3113
3114         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
3115                                             sharename,
3116                                             "RAW",
3117                                             devmode_ctr,
3118                                             JOB_ACCESS_ADMINISTER,
3119                                             &handle,
3120                                             &werr);
3121         if (!NT_STATUS_IS_OK(status)) {
3122                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3123                 goto out;
3124         }
3125         if (!W_ERROR_IS_OK(werr)) {
3126                 errcode = W_ERROR_V(werr);
3127                 goto out;
3128         }
3129
3130         /* FIXME: formerly NERR_JobNotFound was returned if job did not exist
3131          * and NERR_DestNotFound if share did not exist */
3132
3133         errcode = NERR_Success;
3134
3135         switch (function) {
3136         case 81:                /* delete */
3137                 command = SPOOLSS_JOB_CONTROL_DELETE;
3138                 break;
3139         case 82:                /* pause */
3140                 command = SPOOLSS_JOB_CONTROL_PAUSE;
3141                 break;
3142         case 83:                /* resume */
3143                 command = SPOOLSS_JOB_CONTROL_RESUME;
3144                 break;
3145         default:
3146                 errcode = NERR_notsupported;
3147                 goto out;
3148         }
3149
3150         status = rpccli_spoolss_SetJob(cli, mem_ctx,
3151                                        &handle,
3152                                        jobid,
3153                                        NULL, /* unique ptr ctr */
3154                                        command,
3155                                        &werr);
3156         if (!NT_STATUS_IS_OK(status)) {
3157                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3158                 goto out;
3159         }
3160         if (!W_ERROR_IS_OK(werr)) {
3161                 errcode = W_ERROR_V(werr);
3162                 goto out;
3163         }
3164
3165  out:
3166         if (cli && is_valid_policy_hnd(&handle)) {
3167                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
3168         }
3169
3170         SSVAL(*rparam,0,errcode);
3171         SSVAL(*rparam,2,0);             /* converter word */
3172
3173         return(True);
3174 }
3175
3176 /****************************************************************************
3177   Purge a print queue - or pause or resume it.
3178   ****************************************************************************/
3179
3180 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
3181                                 char *param, int tpscnt,
3182                                 char *data, int tdscnt,
3183                                 int mdrcnt,int mprcnt,
3184                                 char **rdata,char **rparam,
3185                                 int *rdata_len,int *rparam_len)
3186 {
3187         int function = get_safe_SVAL(param,tpscnt,param,0,0);
3188         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3189         char *str2 = skip_string(param,tpscnt,str1);
3190         char *QueueName = skip_string(param,tpscnt,str2);
3191         int errcode = NERR_notsupported;
3192         WERROR werr = WERR_OK;
3193         NTSTATUS status;
3194
3195         TALLOC_CTX *mem_ctx = talloc_tos();
3196         struct rpc_pipe_client *cli = NULL;
3197         struct policy_handle handle;
3198         struct spoolss_SetPrinterInfoCtr info_ctr;
3199         struct spoolss_DevmodeContainer devmode_ctr;
3200         struct sec_desc_buf secdesc_ctr;
3201         enum spoolss_PrinterControl command;
3202
3203         if (!str1 || !str2 || !QueueName) {
3204                 return False;
3205         }
3206
3207         /* check it's a supported varient */
3208         if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3209                 return(False);
3210
3211         *rparam_len = 4;
3212         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3213         if (!*rparam) {
3214                 return False;
3215         }
3216         *rdata_len = 0;
3217
3218         if (skip_string(param,tpscnt,QueueName) == NULL) {
3219                 return False;
3220         }
3221
3222         ZERO_STRUCT(handle);
3223
3224         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_spoolss.syntax_id,
3225                                         rpc_spoolss_dispatch, conn->server_info,
3226                                         &cli);
3227         if (!NT_STATUS_IS_OK(status)) {
3228                 DEBUG(0,("api_WPrintQueueCtrl: could not connect to spoolss: %s\n",
3229                           nt_errstr(status)));
3230                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3231                 goto out;
3232         }
3233
3234         ZERO_STRUCT(devmode_ctr);
3235
3236         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
3237                                             QueueName,
3238                                             NULL,
3239                                             devmode_ctr,
3240                                             SEC_FLAG_MAXIMUM_ALLOWED,
3241                                             &handle,
3242                                             &werr);
3243         if (!NT_STATUS_IS_OK(status)) {
3244                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3245                 goto out;
3246         }
3247         if (!W_ERROR_IS_OK(werr)) {
3248                 errcode = W_ERROR_V(werr);
3249                 goto out;
3250         }
3251
3252         switch (function) {
3253         case 74: /* Pause queue */
3254                 command = SPOOLSS_PRINTER_CONTROL_PAUSE;
3255                 break;
3256         case 75: /* Resume queue */
3257                 command = SPOOLSS_PRINTER_CONTROL_RESUME;
3258                 break;
3259         case 103: /* Purge */
3260                 command = SPOOLSS_PRINTER_CONTROL_PURGE;
3261                 break;
3262         default:
3263                 werr = WERR_NOT_SUPPORTED;
3264                 break;
3265         }
3266
3267         if (!W_ERROR_IS_OK(werr)) {
3268                 errcode = W_ERROR_V(werr);
3269                 goto out;
3270         }
3271
3272         ZERO_STRUCT(info_ctr);
3273         ZERO_STRUCT(secdesc_ctr);
3274
3275         status = rpccli_spoolss_SetPrinter(cli, mem_ctx,
3276                                            &handle,
3277                                            &info_ctr,
3278                                            &devmode_ctr,
3279                                            &secdesc_ctr,
3280                                            command,
3281                                            &werr);
3282         if (!NT_STATUS_IS_OK(status)) {
3283                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3284                 goto out;
3285         }
3286         if (!W_ERROR_IS_OK(werr)) {
3287                 errcode = W_ERROR_V(werr);
3288                 goto out;
3289         }
3290
3291         errcode = W_ERROR_V(werr);
3292
3293  out:
3294
3295         if (cli && is_valid_policy_hnd(&handle)) {
3296                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
3297         }
3298
3299         SSVAL(*rparam,0,errcode);
3300         SSVAL(*rparam,2,0);             /* converter word */
3301
3302         return(True);
3303 }
3304
3305 /****************************************************************************
3306   set the property of a print job (undocumented?)
3307   ? function = 0xb -> set name of print job
3308   ? function = 0x6 -> move print job up/down
3309   Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3310   or   <WWsTP> <WB21BB16B10zWWzDDz>
3311 ****************************************************************************/
3312
3313 static int check_printjob_info(struct pack_desc* desc,
3314                                int uLevel, char* id)
3315 {
3316         desc->subformat = NULL;
3317         switch( uLevel ) {
3318         case 0: desc->format = "W"; break;
3319         case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3320         case 2: desc->format = "WWzWWDDzz"; break;
3321         case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3322         case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3323         default:
3324                 DEBUG(0,("check_printjob_info: invalid level %d\n",
3325                         uLevel ));
3326                 return False;
3327         }
3328         if (id == NULL || strcmp(desc->format,id) != 0) {
3329                 DEBUG(0,("check_printjob_info: invalid format %s\n",
3330                         id ? id : "<NULL>" ));
3331                 return False;
3332         }
3333         return True;
3334 }
3335
3336 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
3337                                 char *param, int tpscnt,
3338                                 char *data, int tdscnt,
3339                                 int mdrcnt,int mprcnt,
3340                                 char **rdata,char **rparam,
3341                                 int *rdata_len,int *rparam_len)
3342 {
3343         struct pack_desc desc;
3344         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3345         char *str2 = skip_string(param,tpscnt,str1);
3346         char *p = skip_string(param,tpscnt,str2);
3347         uint32 jobid;
3348         fstring sharename;
3349         int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3350         int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3351         int errcode;
3352
3353         TALLOC_CTX *mem_ctx = talloc_tos();
3354         WERROR werr;
3355         NTSTATUS status;
3356         struct rpc_pipe_client *cli = NULL;
3357         struct policy_handle handle;
3358         struct spoolss_DevmodeContainer devmode_ctr;
3359         struct spoolss_JobInfoContainer ctr;
3360         union spoolss_JobInfo info;
3361         struct spoolss_SetJobInfo1 info1;
3362
3363         if (!str1 || !str2 || !p) {
3364                 return False;
3365         }
3366         /*
3367          * We use 1 here not 2 as we're checking
3368          * the last byte we want to access is safe.
3369          */
3370         if (!is_offset_safe(param,tpscnt,p,1)) {
3371                 return False;
3372         }
3373         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3374                 return False;
3375         *rparam_len = 4;
3376         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3377         if (!*rparam) {
3378                 return False;
3379         }
3380
3381         *rdata_len = 0;
3382
3383         /* check it's a supported varient */
3384         if ((strcmp(str1,"WWsTP")) ||
3385             (!check_printjob_info(&desc,uLevel,str2)))
3386                 return(False);
3387
3388         errcode = NERR_notsupported;
3389
3390         switch (function) {
3391         case 0xb:
3392                 /* change print job name, data gives the name */
3393                 break;
3394         default:
3395                 goto out;
3396         }
3397
3398         ZERO_STRUCT(handle);
3399
3400         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_spoolss.syntax_id,
3401                                         rpc_spoolss_dispatch, conn->server_info,
3402                                         &cli);
3403         if (!NT_STATUS_IS_OK(status)) {
3404                 DEBUG(0,("api_PrintJobInfo: could not connect to spoolss: %s\n",
3405                           nt_errstr(status)));
3406                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3407                 goto out;
3408         }
3409
3410         ZERO_STRUCT(devmode_ctr);
3411
3412         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
3413                                             sharename,
3414                                             "RAW",
3415                                             devmode_ctr,
3416                                             PRINTER_ACCESS_USE,
3417                                             &handle,
3418                                             &werr);
3419         if (!NT_STATUS_IS_OK(status)) {
3420                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3421                 goto out;
3422         }
3423         if (!W_ERROR_IS_OK(werr)) {
3424                 errcode = W_ERROR_V(werr);
3425                 goto out;
3426         }
3427
3428         werr = rpccli_spoolss_getjob(cli, mem_ctx,
3429                                      &handle,
3430                                      jobid,
3431                                      1, /* level */
3432                                      0, /* offered */
3433                                      &info);
3434         if (!W_ERROR_IS_OK(werr)) {
3435                 errcode = W_ERROR_V(werr);
3436                 goto out;
3437         }
3438
3439         ZERO_STRUCT(ctr);
3440
3441         info1.job_id            = info.info1.job_id;
3442         info1.printer_name      = info.info1.printer_name;
3443         info1.user_name         = info.info1.user_name;
3444         info1.document_name     = data;
3445         info1.data_type         = info.info1.data_type;
3446         info1.text_status       = info.info1.text_status;
3447         info1.status            = info.info1.status;
3448         info1.priority          = info.info1.priority;
3449         info1.position          = info.info1.position;
3450         info1.total_pages       = info.info1.total_pages;
3451         info1.pages_printed     = info.info1.pages_printed;
3452         info1.submitted         = info.info1.submitted;
3453
3454         ctr.level = 1;
3455         ctr.info.info1 = &info1;
3456
3457         status = rpccli_spoolss_SetJob(cli, mem_ctx,
3458                                        &handle,
3459                                        jobid,
3460                                        &ctr,
3461                                        0,
3462                                        &werr);
3463         if (!NT_STATUS_IS_OK(status)) {
3464                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3465                 goto out;
3466         }
3467         if (!W_ERROR_IS_OK(werr)) {
3468                 errcode = W_ERROR_V(werr);
3469                 goto out;
3470         }
3471
3472         errcode = NERR_Success;
3473  out:
3474
3475         if (cli && is_valid_policy_hnd(&handle)) {
3476                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
3477         }
3478
3479         SSVALS(*rparam,0,errcode);
3480         SSVAL(*rparam,2,0);             /* converter word */
3481
3482         return(True);
3483 }
3484
3485
3486 /****************************************************************************
3487  Get info about the server.
3488 ****************************************************************************/
3489
3490 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
3491                                 char *param, int tpscnt,
3492                                 char *data, int tdscnt,
3493                                 int mdrcnt,int mprcnt,
3494                                 char **rdata,char **rparam,
3495                                 int *rdata_len,int *rparam_len)
3496 {
3497         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3498         char *str2 = skip_string(param,tpscnt,str1);
3499         char *p = skip_string(param,tpscnt,str2);
3500         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3501         char *p2;
3502         int struct_len;
3503
3504         NTSTATUS status;
3505         WERROR werr;
3506         TALLOC_CTX *mem_ctx = talloc_tos();
3507         struct rpc_pipe_client *cli = NULL;
3508         union srvsvc_NetSrvInfo info;
3509         int errcode;
3510
3511         if (!str1 || !str2 || !p) {
3512                 return False;
3513         }
3514
3515         DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3516
3517         /* check it's a supported varient */
3518         if (!prefix_ok(str1,"WrLh")) {
3519                 return False;
3520         }
3521
3522         switch( uLevel ) {
3523                 case 0:
3524                         if (strcmp(str2,"B16") != 0) {
3525                                 return False;
3526                         }
3527                         struct_len = 16;
3528                         break;
3529                 case 1:
3530                         if (strcmp(str2,"B16BBDz") != 0) {
3531                                 return False;
3532                         }
3533                         struct_len = 26;
3534                         break;
3535                 case 2:
3536                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3537                                 return False;
3538                         }
3539                         struct_len = 134;
3540                         break;
3541                 case 3:
3542                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3543                                 return False;
3544                         }
3545                         struct_len = 144;
3546                         break;
3547                 case 20:
3548                         if (strcmp(str2,"DN") != 0) {
3549                                 return False;
3550                         }
3551                         struct_len = 6;
3552                         break;
3553                 case 50:
3554                         if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3555                                 return False;
3556                         }
3557                         struct_len = 42;
3558                         break;
3559                 default:
3560                         return False;
3561         }
3562
3563         *rdata_len = mdrcnt;
3564         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3565         if (!*rdata) {
3566                 return False;
3567         }
3568
3569         p = *rdata;
3570         p2 = p + struct_len;
3571
3572         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_srvsvc.syntax_id,
3573                                         rpc_srvsvc_dispatch, conn->server_info,
3574                                         &cli);
3575         if (!NT_STATUS_IS_OK(status)) {
3576                 DEBUG(0,("api_RNetServerGetInfo: could not connect to srvsvc: %s\n",
3577                           nt_errstr(status)));
3578                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3579                 goto out;
3580         }
3581
3582         status = rpccli_srvsvc_NetSrvGetInfo(cli, mem_ctx,
3583                                              NULL,
3584                                              101,
3585                                              &info,
3586                                              &werr);
3587         if (!NT_STATUS_IS_OK(status)) {
3588                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3589                 goto out;
3590         }
3591         if (!W_ERROR_IS_OK(werr)) {
3592                 errcode = W_ERROR_V(werr);
3593                 goto out;
3594         }
3595
3596         if (info.info101 == NULL) {
3597                 errcode = W_ERROR_V(WERR_INVALID_PARAM);
3598                 goto out;
3599         }
3600
3601         if (uLevel != 20) {
3602                 srvstr_push(NULL, 0, p, info.info101->server_name, 16,
3603                         STR_ASCII|STR_UPPER|STR_TERMINATE);
3604         }
3605         p += 16;
3606         if (uLevel > 0) {
3607                 SCVAL(p,0,info.info101->version_major);
3608                 SCVAL(p,1,info.info101->version_minor);
3609                 SIVAL(p,2,info.info101->server_type);
3610
3611                 if (mdrcnt == struct_len) {
3612                         SIVAL(p,6,0);
3613                 } else {
3614                         SIVAL(p,6,PTR_DIFF(p2,*rdata));
3615                         if (mdrcnt - struct_len <= 0) {
3616                                 return false;
3617                         }
3618                         push_ascii(p2,
3619                                 info.info101->comment,
3620                                 MIN(mdrcnt - struct_len,
3621                                         MAX_SERVER_STRING_LENGTH),
3622                                 STR_TERMINATE);
3623                         p2 = skip_string(*rdata,*rdata_len,p2);
3624                         if (!p2) {
3625                                 return False;
3626                         }
3627                 }
3628         }
3629
3630         if (uLevel > 1) {
3631                 return False;           /* not yet implemented */
3632         }
3633
3634         errcode = NERR_Success;
3635
3636  out:
3637
3638         *rdata_len = PTR_DIFF(p2,*rdata);
3639
3640         *rparam_len = 6;
3641         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3642         if (!*rparam) {
3643                 return False;
3644         }
3645         SSVAL(*rparam,0,errcode);
3646         SSVAL(*rparam,2,0);             /* converter word */
3647         SSVAL(*rparam,4,*rdata_len);
3648
3649         return True;
3650 }
3651
3652 /****************************************************************************
3653  Get info about the server.
3654 ****************************************************************************/
3655
3656 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3657                                 char *param, int tpscnt,
3658                                 char *data, int tdscnt,
3659                                 int mdrcnt,int mprcnt,
3660                                 char **rdata,char **rparam,
3661                                 int *rdata_len,int *rparam_len)
3662 {
3663         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3664         char *str2 = skip_string(param,tpscnt,str1);
3665         char *p = skip_string(param,tpscnt,str2);
3666         char *p2;
3667         char *endp;
3668         int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3669
3670         if (!str1 || !str2 || !p) {
3671                 return False;
3672         }
3673
3674         DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3675
3676         *rparam_len = 6;
3677         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3678         if (!*rparam) {
3679                 return False;
3680         }
3681
3682         /* check it's a supported varient */
3683         if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3684                 return False;
3685         }
3686
3687         *rdata_len = mdrcnt + 1024;
3688         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3689         if (!*rdata) {
3690                 return False;
3691         }
3692
3693         SSVAL(*rparam,0,NERR_Success);
3694         SSVAL(*rparam,2,0);             /* converter word */
3695
3696         p = *rdata;
3697         endp = *rdata + *rdata_len;
3698
3699         p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3700         if (!p2) {
3701                 return False;
3702         }
3703
3704         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3705         strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3706         strupper_m(p2);
3707         p2 = skip_string(*rdata,*rdata_len,p2);
3708         if (!p2) {
3709                 return False;
3710         }
3711         p += 4;
3712
3713         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3714         strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3715         p2 = skip_string(*rdata,*rdata_len,p2);
3716         if (!p2) {
3717                 return False;
3718         }
3719         p += 4;
3720
3721         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3722         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3723         strupper_m(p2);
3724         p2 = skip_string(*rdata,*rdata_len,p2);
3725         if (!p2) {
3726                 return False;
3727         }
3728         p += 4;
3729
3730         SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3731         SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3732         p += 2;
3733
3734         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3735         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));   /* don't know.  login domain?? */
3736         p2 = skip_string(*rdata,*rdata_len,p2);
3737         if (!p2) {
3738                 return False;
3739         }
3740         p += 4;
3741
3742         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3743         strlcpy(p2,"",PTR_DIFF(endp,p2));
3744         p2 = skip_string(*rdata,*rdata_len,p2);
3745         if (!p2) {
3746                 return False;
3747         }
3748         p += 4;
3749
3750         *rdata_len = PTR_DIFF(p2,*rdata);
3751
3752         SSVAL(*rparam,4,*rdata_len);
3753
3754         return True;
3755 }
3756
3757 /****************************************************************************
3758   get info about a user
3759
3760     struct user_info_11 {
3761         char                usri11_name[21];  0-20
3762         char                usri11_pad;       21
3763         char                *usri11_comment;  22-25
3764         char            *usri11_usr_comment;  26-29
3765         unsigned short      usri11_priv;      30-31
3766         unsigned long       usri11_auth_flags; 32-35
3767         long                usri11_password_age; 36-39
3768         char                *usri11_homedir; 40-43
3769         char            *usri11_parms; 44-47
3770         long                usri11_last_logon; 48-51
3771         long                usri11_last_logoff; 52-55
3772         unsigned short      usri11_bad_pw_count; 56-57
3773         unsigned short      usri11_num_logons; 58-59
3774         char                *usri11_logon_server; 60-63
3775         unsigned short      usri11_country_code; 64-65
3776         char            *usri11_workstations; 66-69
3777         unsigned long       usri11_max_storage; 70-73
3778         unsigned short      usri11_units_per_week; 74-75
3779         unsigned char       *usri11_logon_hours; 76-79
3780         unsigned short      usri11_code_page; 80-81
3781     };
3782
3783 where:
3784
3785   usri11_name specifies the user name for which information is retrieved
3786
3787   usri11_pad aligns the next data structure element to a word boundary
3788
3789   usri11_comment is a null terminated ASCII comment
3790
3791   usri11_user_comment is a null terminated ASCII comment about the user
3792
3793   usri11_priv specifies the level of the privilege assigned to the user.
3794        The possible values are:
3795
3796 Name             Value  Description
3797 USER_PRIV_GUEST  0      Guest privilege
3798 USER_PRIV_USER   1      User privilege
3799 USER_PRV_ADMIN   2      Administrator privilege
3800
3801   usri11_auth_flags specifies the account operator privileges. The
3802        possible values are:
3803
3804 Name            Value   Description
3805 AF_OP_PRINT     0       Print operator
3806
3807
3808 Leach, Naik                                        [Page 28]
3809 \f
3810
3811
3812 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3813
3814
3815 AF_OP_COMM      1       Communications operator
3816 AF_OP_SERVER    2       Server operator
3817 AF_OP_ACCOUNTS  3       Accounts operator
3818
3819
3820   usri11_password_age specifies how many seconds have elapsed since the
3821        password was last changed.
3822
3823   usri11_home_dir points to a null terminated ASCII string that contains
3824        the path name of the user's home directory.
3825
3826   usri11_parms points to a null terminated ASCII string that is set
3827        aside for use by applications.
3828
3829   usri11_last_logon specifies the time when the user last logged on.
3830        This value is stored as the number of seconds elapsed since
3831        00:00:00, January 1, 1970.
3832
3833   usri11_last_logoff specifies the time when the user last logged off.
3834        This value is stored as the number of seconds elapsed since
3835        00:00:00, January 1, 1970. A value of 0 means the last logoff
3836        time is unknown.
3837
3838   usri11_bad_pw_count specifies the number of incorrect passwords
3839        entered since the last successful logon.
3840
3841   usri11_log1_num_logons specifies the number of times this user has
3842        logged on. A value of -1 means the number of logons is unknown.
3843
3844   usri11_logon_server points to a null terminated ASCII string that
3845        contains the name of the server to which logon requests are sent.
3846        A null string indicates logon requests should be sent to the
3847        domain controller.
3848
3849   usri11_country_code specifies the country code for the user's language
3850        of choice.
3851
3852   usri11_workstations points to a null terminated ASCII string that
3853        contains the names of workstations the user may log on from.
3854        There may be up to 8 workstations, with the names separated by
3855        commas. A null strings indicates there are no restrictions.
3856
3857   usri11_max_storage specifies the maximum amount of disk space the user
3858        can occupy. A value of 0xffffffff indicates there are no
3859        restrictions.
3860
3861   usri11_units_per_week specifies the equal number of time units into
3862        which a week is divided. This value must be equal to 168.
3863
3864   usri11_logon_hours points to a 21 byte (168 bits) string that
3865        specifies the time during which the user can log on. Each bit
3866        represents one unique hour in a week. The first bit (bit 0, word
3867        0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3868
3869
3870
3871 Leach, Naik                                        [Page 29]
3872 \f
3873
3874
3875 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3876
3877
3878        Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3879        are no restrictions.
3880
3881   usri11_code_page specifies the code page for the user's language of
3882        choice
3883
3884 All of the pointers in this data structure need to be treated
3885 specially. The  pointer is a 32 bit pointer. The higher 16 bits need
3886 to be ignored. The converter word returned in the parameters section
3887 needs to be subtracted from the lower 16 bits to calculate an offset
3888 into the return buffer where this ASCII string resides.
3889
3890 There is no auxiliary data in the response.
3891
3892   ****************************************************************************/
3893
3894 #define usri11_name           0
3895 #define usri11_pad            21
3896 #define usri11_comment        22
3897 #define usri11_usr_comment    26
3898 #define usri11_full_name      30
3899 #define usri11_priv           34
3900 #define usri11_auth_flags     36
3901 #define usri11_password_age   40
3902 #define usri11_homedir        44
3903 #define usri11_parms          48
3904 #define usri11_last_logon     52
3905 #define usri11_last_logoff    56
3906 #define usri11_bad_pw_count   60
3907 #define usri11_num_logons     62
3908 #define usri11_logon_server   64
3909 #define usri11_country_code   68
3910 #define usri11_workstations   70
3911 #define usri11_max_storage    74
3912 #define usri11_units_per_week 78
3913 #define usri11_logon_hours    80
3914 #define usri11_code_page      84
3915 #define usri11_end            86
3916
3917 #define USER_PRIV_GUEST 0
3918 #define USER_PRIV_USER 1
3919 #define USER_PRIV_ADMIN 2
3920
3921 #define AF_OP_PRINT     0
3922 #define AF_OP_COMM      1
3923 #define AF_OP_SERVER    2
3924 #define AF_OP_ACCOUNTS  3
3925
3926
3927 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3928                                 char *param, int tpscnt,
3929                                 char *data, int tdscnt,
3930                                 int mdrcnt,int mprcnt,
3931                                 char **rdata,char **rparam,
3932                                 int *rdata_len,int *rparam_len)
3933 {
3934         struct smbd_server_connection *sconn = smbd_server_conn;
3935         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3936         char *str2 = skip_string(param,tpscnt,str1);
3937         char *UserName = skip_string(param,tpscnt,str2);
3938         char *p = skip_string(param,tpscnt,UserName);
3939         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3940         char *p2;
3941         char *endp;
3942         const char *level_string;
3943
3944         /* get NIS home of a previously validated user - simeon */
3945         /* With share level security vuid will always be zero.
3946            Don't depend on vuser being non-null !!. JRA */
3947         user_struct *vuser = get_valid_user_struct(sconn, vuid);
3948         if(vuser != NULL) {
3949                 DEBUG(3,("  Username of UID %d is %s\n",
3950                          (int)vuser->server_info->utok.uid,
3951                          vuser->server_info->unix_name));
3952         }
3953
3954         if (!str1 || !str2 || !UserName || !p) {
3955                 return False;
3956         }
3957
3958         *rparam_len = 6;
3959         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3960         if (!*rparam) {
3961                 return False;
3962         }
3963
3964         DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3965
3966         /* check it's a supported variant */
3967         if (strcmp(str1,"zWrLh") != 0) {
3968                 return False;
3969         }
3970         switch( uLevel ) {
3971                 case 0: level_string = "B21"; break;
3972                 case 1: level_string = "B21BB16DWzzWz"; break;
3973                 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3974                 case 10: level_string = "B21Bzzz"; break;
3975                 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3976                 default: return False;
3977         }
3978
3979         if (strcmp(level_string,str2) != 0) {
3980                 return False;
3981         }
3982
3983         *rdata_len = mdrcnt + 1024;
3984         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3985         if (!*rdata) {
3986                 return False;
3987         }
3988
3989         SSVAL(*rparam,0,NERR_Success);
3990         SSVAL(*rparam,2,0);             /* converter word */
3991
3992         p = *rdata;
3993         endp = *rdata + *rdata_len;
3994         p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3995         if (!p2) {
3996                 return False;
3997         }
3998
3999         memset(p,0,21);
4000         fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
4001
4002         if (uLevel > 0) {
4003                 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
4004                 *p2 = 0;
4005         }
4006
4007         if (uLevel >= 10) {
4008                 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
4009                 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
4010                 p2 = skip_string(*rdata,*rdata_len,p2);
4011                 if (!p2) {
4012                         return False;
4013                 }
4014
4015                 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
4016                 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
4017                 p2 = skip_string(*rdata,*rdata_len,p2);
4018                 if (!p2) {
4019                         return False;
4020                 }
4021
4022                 /* EEK! the cifsrap.txt doesn't have this in!!!! */
4023                 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
4024                 strlcpy(p2,((vuser != NULL)
4025                             ? pdb_get_fullname(vuser->server_info->sam_account)
4026                             : UserName),PTR_DIFF(endp,p2));
4027                 p2 = skip_string(*rdata,*rdata_len,p2);
4028                 if (!p2) {
4029                         return False;
4030                 }
4031         }
4032
4033         if (uLevel == 11) {
4034                 const char *homedir = "";
4035                 if (vuser != NULL) {
4036                         homedir = pdb_get_homedir(
4037                                 vuser->server_info->sam_account);
4038                 }
4039                 /* modelled after NTAS 3.51 reply */
4040                 SSVAL(p,usri11_priv,
4041                         (get_current_uid(conn) == sec_initial_uid())?
4042                         USER_PRIV_ADMIN:USER_PRIV_USER);
4043                 SIVAL(p,usri11_auth_flags,AF_OP_PRINT);         /* auth flags */
4044                 SIVALS(p,usri11_password_age,-1);               /* password age */
4045                 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
4046                 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
4047                 p2 = skip_string(*rdata,*rdata_len,p2);
4048                 if (!p2) {
4049                         return False;
4050                 }
4051                 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
4052                 strlcpy(p2,"",PTR_DIFF(endp,p2));
4053                 p2 = skip_string(*rdata,*rdata_len,p2);
4054                 if (!p2) {
4055                         return False;
4056                 }
4057                 SIVAL(p,usri11_last_logon,0);           /* last logon */
4058                 SIVAL(p,usri11_last_logoff,0);          /* last logoff */
4059                 SSVALS(p,usri11_bad_pw_count,-1);       /* bad pw counts */
4060                 SSVALS(p,usri11_num_logons,-1);         /* num logons */
4061                 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
4062                 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
4063                 p2 = skip_string(*rdata,*rdata_len,p2);
4064                 if (!p2) {
4065                         return False;
4066                 }
4067                 SSVAL(p,usri11_country_code,0);         /* country code */
4068
4069                 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
4070                 strlcpy(p2,"",PTR_DIFF(endp,p2));
4071                 p2 = skip_string(*rdata,*rdata_len,p2);
4072                 if (!p2) {
4073                         return False;
4074                 }
4075
4076                 SIVALS(p,usri11_max_storage,-1);                /* max storage */
4077                 SSVAL(p,usri11_units_per_week,168);             /* units per week */
4078                 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
4079
4080                 /* a simple way to get logon hours at all times. */
4081                 memset(p2,0xff,21);
4082                 SCVAL(p2,21,0);           /* fix zero termination */
4083                 p2 = skip_string(*rdata,*rdata_len,p2);
4084                 if (!p2) {
4085                         return False;
4086                 }
4087
4088                 SSVAL(p,usri11_code_page,0);            /* code page */
4089         }
4090
4091         if (uLevel == 1 || uLevel == 2) {
4092                 memset(p+22,' ',16);    /* password */
4093                 SIVALS(p,38,-1);                /* password age */
4094                 SSVAL(p,42,
4095                         (get_current_uid(conn) == sec_initial_uid())?
4096                         USER_PRIV_ADMIN:USER_PRIV_USER);
4097                 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
4098                 strlcpy(p2, vuser ? pdb_get_homedir(
4099                                 vuser->server_info->sam_account) : "",
4100                         PTR_DIFF(endp,p2));
4101                 p2 = skip_string(*rdata,*rdata_len,p2);
4102                 if (!p2) {
4103                         return False;
4104                 }
4105                 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
4106                 *p2++ = 0;
4107                 SSVAL(p,52,0);          /* flags */
4108                 SIVAL(p,54,PTR_DIFF(p2,*rdata));                /* script_path */
4109                 strlcpy(p2, vuser ? pdb_get_logon_script(
4110                                 vuser->server_info->sam_account) : "",
4111                         PTR_DIFF(endp,p2));
4112                 p2 = skip_string(*rdata,*rdata_len,p2);
4113                 if (!p2) {
4114                         return False;
4115                 }
4116                 if (uLevel == 2) {
4117                         SIVAL(p,60,0);          /* auth_flags */
4118                         SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
4119                         strlcpy(p2,((vuser != NULL)
4120                                     ? pdb_get_fullname(vuser->server_info->sam_account)
4121                                     : UserName),PTR_DIFF(endp,p2));
4122                         p2 = skip_string(*rdata,*rdata_len,p2);
4123                         if (!p2) {
4124                                 return False;
4125                         }
4126                         SIVAL(p,68,0);          /* urs_comment */
4127                         SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
4128                         strlcpy(p2,"",PTR_DIFF(endp,p2));
4129                         p2 = skip_string(*rdata,*rdata_len,p2);
4130                         if (!p2) {
4131                                 return False;
4132                         }
4133                         SIVAL(p,76,0);          /* workstations */
4134                         SIVAL(p,80,0);          /* last_logon */
4135                         SIVAL(p,84,0);          /* last_logoff */
4136                         SIVALS(p,88,-1);                /* acct_expires */
4137                         SIVALS(p,92,-1);                /* max_storage */
4138                         SSVAL(p,96,168);        /* units_per_week */
4139                         SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
4140                         memset(p2,-1,21);
4141                         p2 += 21;
4142                         SSVALS(p,102,-1);       /* bad_pw_count */
4143                         SSVALS(p,104,-1);       /* num_logons */
4144                         SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
4145                         {
4146                                 TALLOC_CTX *ctx = talloc_tos();
4147                                 int space_rem = *rdata_len - (p2 - *rdata);
4148                                 char *tmp;
4149
4150                                 if (space_rem <= 0) {
4151                                         return false;
4152                                 }
4153                                 tmp = talloc_strdup(ctx, "\\\\%L");
4154                                 if (!tmp) {
4155                                         return false;
4156                                 }
4157                                 tmp = talloc_sub_basic(ctx,
4158                                                 "",
4159                                                 "",
4160                                                 tmp);
4161                                 if (!tmp) {
4162                                         return false;
4163                                 }
4164
4165                                 push_ascii(p2,
4166                                         tmp,
4167                                         space_rem,
4168                                         STR_TERMINATE);
4169                         }
4170                         p2 = skip_string(*rdata,*rdata_len,p2);
4171                         if (!p2) {
4172                                 return False;
4173                         }
4174                         SSVAL(p,110,49);        /* country_code */
4175                         SSVAL(p,112,860);       /* code page */
4176                 }
4177         }
4178
4179         *rdata_len = PTR_DIFF(p2,*rdata);
4180
4181         SSVAL(*rparam,4,*rdata_len);    /* is this right?? */
4182
4183         return(True);
4184 }
4185
4186 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
4187                                 char *param, int tpscnt,
4188                                 char *data, int tdscnt,
4189                                 int mdrcnt,int mprcnt,
4190                                 char **rdata,char **rparam,
4191                                 int *rdata_len,int *rparam_len)
4192 {
4193         struct smbd_server_connection *sconn = smbd_server_conn;
4194         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4195         char *str2 = skip_string(param,tpscnt,str1);
4196         char *p = skip_string(param,tpscnt,str2);
4197         int uLevel;
4198         struct pack_desc desc;
4199         char* name;
4200                 /* With share level security vuid will always be zero.
4201                    Don't depend on vuser being non-null !!. JRA */
4202         user_struct *vuser = get_valid_user_struct(sconn, vuid);
4203
4204         if (!str1 || !str2 || !p) {
4205                 return False;
4206         }
4207
4208         if(vuser != NULL) {
4209                 DEBUG(3,("  Username of UID %d is %s\n",
4210                          (int)vuser->server_info->utok.uid,
4211                          vuser->server_info->unix_name));
4212         }
4213
4214         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4215         name = get_safe_str_ptr(param,tpscnt,p,2);
4216         if (!name) {
4217                 return False;
4218         }
4219
4220         memset((char *)&desc,'\0',sizeof(desc));
4221
4222         DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
4223
4224         /* check it's a supported varient */
4225         if (strcmp(str1,"OOWb54WrLh") != 0) {
4226                 return False;
4227         }
4228         if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
4229                 return False;
4230         }
4231         if (mdrcnt > 0) {
4232                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4233                 if (!*rdata) {
4234                         return False;
4235                 }
4236         }
4237
4238         desc.base = *rdata;
4239         desc.buflen = mdrcnt;
4240         desc.subformat = NULL;
4241         desc.format = str2;
4242
4243         if (init_package(&desc,1,0)) {
4244                 PACKI(&desc,"W",0);             /* code */
4245                 PACKS(&desc,"B21",name);        /* eff. name */
4246                 PACKS(&desc,"B","");            /* pad */
4247                 PACKI(&desc,"W",
4248                         (get_current_uid(conn) == sec_initial_uid())?
4249                         USER_PRIV_ADMIN:USER_PRIV_USER);
4250                 PACKI(&desc,"D",0);             /* auth flags XXX */
4251                 PACKI(&desc,"W",0);             /* num logons */
4252                 PACKI(&desc,"W",0);             /* bad pw count */
4253                 PACKI(&desc,"D",0);             /* last logon */
4254                 PACKI(&desc,"D",-1);            /* last logoff */
4255                 PACKI(&desc,"D",-1);            /* logoff time */
4256                 PACKI(&desc,"D",-1);            /* kickoff time */
4257                 PACKI(&desc,"D",0);             /* password age */
4258                 PACKI(&desc,"D",0);             /* password can change */
4259                 PACKI(&desc,"D",-1);            /* password must change */
4260
4261                 {
4262                         fstring mypath;
4263                         fstrcpy(mypath,"\\\\");
4264                         fstrcat(mypath,get_local_machine_name());
4265                         strupper_m(mypath);
4266                         PACKS(&desc,"z",mypath); /* computer */
4267                 }
4268
4269                 PACKS(&desc,"z",lp_workgroup());/* domain */
4270                 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
4271                               vuser->server_info->sam_account) : ""); /* script path */
4272                 PACKI(&desc,"D",0x00000000);            /* reserved */
4273         }
4274
4275         *rdata_len = desc.usedlen;
4276         *rparam_len = 6;
4277         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4278         if (!*rparam) {
4279                 return False;
4280         }
4281         SSVALS(*rparam,0,desc.errcode);
4282         SSVAL(*rparam,2,0);
4283         SSVAL(*rparam,4,desc.neededlen);
4284
4285         DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4286
4287         return True;
4288 }
4289
4290 /****************************************************************************
4291  api_WAccessGetUserPerms
4292 ****************************************************************************/
4293
4294 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
4295                                 char *param, int tpscnt,
4296                                 char *data, int tdscnt,
4297                                 int mdrcnt,int mprcnt,
4298                                 char **rdata,char **rparam,
4299                                 int *rdata_len,int *rparam_len)
4300 {
4301         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4302         char *str2 = skip_string(param,tpscnt,str1);
4303         char *user = skip_string(param,tpscnt,str2);
4304         char *resource = skip_string(param,tpscnt,user);
4305
4306         if (!str1 || !str2 || !user || !resource) {
4307                 return False;
4308         }
4309
4310         if (skip_string(param,tpscnt,resource) == NULL) {
4311                 return False;
4312         }
4313         DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4314
4315         /* check it's a supported varient */
4316         if (strcmp(str1,"zzh") != 0) {
4317                 return False;
4318         }
4319         if (strcmp(str2,"") != 0) {
4320                 return False;
4321         }
4322
4323         *rparam_len = 6;
4324         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4325         if (!*rparam) {
4326                 return False;
4327         }
4328         SSVALS(*rparam,0,0);            /* errorcode */
4329         SSVAL(*rparam,2,0);             /* converter word */
4330         SSVAL(*rparam,4,0x7f);  /* permission flags */
4331
4332         return True;
4333 }
4334
4335 /****************************************************************************
4336   api_WPrintJobEnumerate
4337   ****************************************************************************/
4338
4339 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
4340                                 char *param, int tpscnt,
4341                                 char *data, int tdscnt,
4342                                 int mdrcnt,int mprcnt,
4343                                 char **rdata,char **rparam,
4344                                 int *rdata_len,int *rparam_len)
4345 {
4346         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4347         char *str2 = skip_string(param,tpscnt,str1);
4348         char *p = skip_string(param,tpscnt,str2);
4349         int uLevel;
4350         fstring sharename;
4351         uint32 jobid;
4352         struct pack_desc desc;
4353         char *tmpdata=NULL;
4354
4355         TALLOC_CTX *mem_ctx = talloc_tos();
4356         WERROR werr;
4357         NTSTATUS status;
4358         struct rpc_pipe_client *cli = NULL;
4359         struct policy_handle handle;
4360         struct spoolss_DevmodeContainer devmode_ctr;
4361         union spoolss_JobInfo info;
4362
4363         if (!str1 || !str2 || !p) {
4364                 return False;
4365         }
4366
4367         uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4368
4369         memset((char *)&desc,'\0',sizeof(desc));
4370         memset((char *)&status,'\0',sizeof(status));
4371
4372         DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4373
4374         /* check it's a supported varient */
4375         if (strcmp(str1,"WWrLh") != 0) {
4376                 return False;
4377         }
4378         if (!check_printjob_info(&desc,uLevel,str2)) {
4379                 return False;
4380         }
4381
4382         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4383                 return False;
4384         }
4385
4386         ZERO_STRUCT(handle);
4387
4388         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_spoolss.syntax_id,
4389                                         rpc_spoolss_dispatch, conn->server_info,
4390                                         &cli);
4391         if (!NT_STATUS_IS_OK(status)) {
4392                 DEBUG(0,("api_WPrintJobGetInfo: could not connect to spoolss: %s\n",
4393                           nt_errstr(status)));
4394                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4395                 goto out;
4396         }
4397
4398         ZERO_STRUCT(devmode_ctr);
4399
4400         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
4401                                             sharename,
4402                                             "RAW",
4403                                             devmode_ctr,
4404                                             PRINTER_ACCESS_USE,
4405                                             &handle,
4406                                             &werr);
4407         if (!NT_STATUS_IS_OK(status)) {
4408                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4409                 goto out;
4410         }
4411         if (!W_ERROR_IS_OK(werr)) {
4412                 desc.errcode = W_ERROR_V(werr);
4413                 goto out;
4414         }
4415
4416         werr = rpccli_spoolss_getjob(cli, mem_ctx,
4417                                      &handle,
4418                                      jobid,
4419                                      2, /* level */
4420                                      0, /* offered */
4421                                      &info);
4422         if (!W_ERROR_IS_OK(werr)) {
4423                 desc.errcode = W_ERROR_V(werr);
4424                 goto out;
4425         }
4426
4427         if (mdrcnt > 0) {
4428                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4429                 if (!*rdata) {
4430                         return False;
4431                 }
4432                 desc.base = *rdata;
4433                 desc.buflen = mdrcnt;
4434         } else {
4435                 /*
4436                  * Don't return data but need to get correct length
4437                  *  init_package will return wrong size if buflen=0
4438                  */
4439                 desc.buflen = getlen(desc.format);
4440                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4441         }
4442
4443         if (init_package(&desc,1,0)) {
4444                 fill_spoolss_printjob_info(uLevel, &desc, &info.info2, info.info2.position);
4445                 *rdata_len = desc.usedlen;
4446         } else {
4447                 desc.errcode = NERR_JobNotFound;
4448                 *rdata_len = 0;
4449         }
4450  out:
4451         if (cli && is_valid_policy_hnd(&handle)) {
4452                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
4453         }
4454
4455         *rparam_len = 6;
4456         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4457         if (!*rparam) {
4458                 return False;
4459         }
4460         SSVALS(*rparam,0,desc.errcode);
4461         SSVAL(*rparam,2,0);
4462         SSVAL(*rparam,4,desc.neededlen);
4463
4464         SAFE_FREE(tmpdata);
4465
4466         DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4467
4468         return True;
4469 }
4470
4471 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
4472                                 char *param, int tpscnt,
4473                                 char *data, int tdscnt,
4474                                 int mdrcnt,int mprcnt,
4475                                 char **rdata,char **rparam,
4476                                 int *rdata_len,int *rparam_len)
4477 {
4478         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4479         char *str2 = skip_string(param,tpscnt,str1);
4480         char *p = skip_string(param,tpscnt,str2);
4481         char *name = p;
4482         int uLevel;
4483         int i, succnt=0;
4484         struct pack_desc desc;
4485
4486         TALLOC_CTX *mem_ctx = talloc_tos();
4487         WERROR werr;
4488         NTSTATUS status;
4489         struct rpc_pipe_client *cli = NULL;
4490         struct policy_handle handle;
4491         struct spoolss_DevmodeContainer devmode_ctr;
4492         uint32_t count;
4493         union spoolss_JobInfo *info;
4494
4495         if (!str1 || !str2 || !p) {
4496                 return False;
4497         }
4498
4499         memset((char *)&desc,'\0',sizeof(desc));
4500
4501         p = skip_string(param,tpscnt,p);
4502         if (!p) {
4503                 return False;
4504         }
4505         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4506
4507         DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4508
4509         /* check it's a supported variant */
4510         if (strcmp(str1,"zWrLeh") != 0) {
4511                 return False;
4512         }
4513
4514         if (uLevel > 2) {
4515                 return False;   /* defined only for uLevel 0,1,2 */
4516         }
4517
4518         if (!check_printjob_info(&desc,uLevel,str2)) {
4519                 return False;
4520         }
4521
4522         ZERO_STRUCT(handle);
4523
4524         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_spoolss.syntax_id,
4525                                         rpc_spoolss_dispatch, conn->server_info,
4526                                         &cli);
4527         if (!NT_STATUS_IS_OK(status)) {
4528                 DEBUG(0,("api_WPrintJobEnumerate: could not connect to spoolss: %s\n",
4529                           nt_errstr(status)));
4530                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4531                 goto out;
4532         }
4533
4534         ZERO_STRUCT(devmode_ctr);
4535
4536         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
4537                                             name,
4538                                             NULL,
4539                                             devmode_ctr,
4540                                             SEC_FLAG_MAXIMUM_ALLOWED,
4541                                             &handle,
4542                                             &werr);
4543         if (!NT_STATUS_IS_OK(status)) {
4544                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4545                 goto out;
4546         }
4547         if (!W_ERROR_IS_OK(werr)) {
4548                 desc.errcode = W_ERROR_V(werr);
4549                 goto out;
4550         }
4551
4552         werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
4553                                        &handle,
4554                                        0, /* firstjob */
4555                                        0xff, /* numjobs */
4556                                        2, /* level */
4557                                        0, /* offered */
4558                                        &count,
4559                                        &info);
4560         if (!W_ERROR_IS_OK(werr)) {
4561                 desc.errcode = W_ERROR_V(werr);
4562                 goto out;
4563         }
4564
4565         if (mdrcnt > 0) {
4566                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4567                 if (!*rdata) {
4568                         return False;
4569                 }
4570         }
4571         desc.base = *rdata;
4572         desc.buflen = mdrcnt;
4573
4574         if (init_package(&desc,count,0)) {
4575                 succnt = 0;
4576                 for (i = 0; i < count; i++) {
4577                         fill_spoolss_printjob_info(uLevel, &desc, &info[i].info2, i);
4578                         if (desc.errcode == NERR_Success) {
4579                                 succnt = i+1;
4580                         }
4581                 }
4582         }
4583  out:
4584         if (cli && is_valid_policy_hnd(&handle)) {
4585                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
4586         }
4587
4588         *rdata_len = desc.usedlen;
4589
4590         *rparam_len = 8;
4591         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4592         if (!*rparam) {
4593                 return False;
4594         }
4595         SSVALS(*rparam,0,desc.errcode);
4596         SSVAL(*rparam,2,0);
4597         SSVAL(*rparam,4,succnt);
4598         SSVAL(*rparam,6,count);
4599
4600         DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4601
4602         return True;
4603 }
4604
4605 static int check_printdest_info(struct pack_desc* desc,
4606                                 int uLevel, char* id)
4607 {
4608         desc->subformat = NULL;
4609         switch( uLevel ) {
4610                 case 0:
4611                         desc->format = "B9";
4612                         break;
4613                 case 1:
4614                         desc->format = "B9B21WWzW";
4615                         break;
4616                 case 2:
4617                         desc->format = "z";
4618                         break;
4619                 case 3:
4620                         desc->format = "zzzWWzzzWW";
4621                         break;
4622                 default:
4623                         DEBUG(0,("check_printdest_info: invalid level %d\n",
4624                                 uLevel));
4625                         return False;
4626         }
4627         if (id == NULL || strcmp(desc->format,id) != 0) {
4628                 DEBUG(0,("check_printdest_info: invalid string %s\n",
4629                         id ? id : "<NULL>" ));
4630                 return False;
4631         }
4632         return True;
4633 }
4634
4635 static void fill_printdest_info(struct spoolss_PrinterInfo2 *info2, int uLevel,
4636                                 struct pack_desc* desc)
4637 {
4638         char buf[100];
4639
4640         strncpy(buf, info2->printername, sizeof(buf)-1);
4641         buf[sizeof(buf)-1] = 0;
4642         strupper_m(buf);
4643
4644         if (uLevel <= 1) {
4645                 PACKS(desc,"B9",buf);   /* szName */
4646                 if (uLevel == 1) {
4647                         PACKS(desc,"B21","");   /* szUserName */
4648                         PACKI(desc,"W",0);              /* uJobId */
4649                         PACKI(desc,"W",0);              /* fsStatus */
4650                         PACKS(desc,"z","");     /* pszStatus */
4651                         PACKI(desc,"W",0);              /* time */
4652                 }
4653         }
4654
4655         if (uLevel == 2 || uLevel == 3) {
4656                 PACKS(desc,"z",buf);            /* pszPrinterName */
4657                 if (uLevel == 3) {
4658                         PACKS(desc,"z","");     /* pszUserName */
4659                         PACKS(desc,"z","");     /* pszLogAddr */
4660                         PACKI(desc,"W",0);              /* uJobId */
4661                         PACKI(desc,"W",0);              /* fsStatus */
4662                         PACKS(desc,"z","");     /* pszStatus */
4663                         PACKS(desc,"z","");     /* pszComment */
4664                         PACKS(desc,"z","NULL"); /* pszDrivers */
4665                         PACKI(desc,"W",0);              /* time */
4666                         PACKI(desc,"W",0);              /* pad1 */
4667                 }
4668         }
4669 }
4670
4671 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
4672                                 char *param, int tpscnt,
4673                                 char *data, int tdscnt,
4674                                 int mdrcnt,int mprcnt,
4675                                 char **rdata,char **rparam,
4676                                 int *rdata_len,int *rparam_len)
4677 {
4678         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4679         char *str2 = skip_string(param,tpscnt,str1);
4680         char *p = skip_string(param,tpscnt,str2);
4681         char* PrinterName = p;
4682         int uLevel;
4683         struct pack_desc desc;
4684         char *tmpdata=NULL;
4685
4686         TALLOC_CTX *mem_ctx = talloc_tos();
4687         WERROR werr;
4688         NTSTATUS status;
4689         struct rpc_pipe_client *cli = NULL;
4690         struct policy_handle handle;
4691         struct spoolss_DevmodeContainer devmode_ctr;
4692         union spoolss_PrinterInfo info;
4693
4694         if (!str1 || !str2 || !p) {
4695                 return False;
4696         }
4697
4698         memset((char *)&desc,'\0',sizeof(desc));
4699
4700         p = skip_string(param,tpscnt,p);
4701         if (!p) {
4702                 return False;
4703         }
4704         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4705
4706         DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4707
4708         /* check it's a supported varient */
4709         if (strcmp(str1,"zWrLh") != 0) {
4710                 return False;
4711         }
4712         if (!check_printdest_info(&desc,uLevel,str2)) {
4713                 return False;
4714         }
4715
4716         ZERO_STRUCT(handle);
4717
4718         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_spoolss.syntax_id,
4719                                         rpc_spoolss_dispatch, conn->server_info,
4720                                         &cli);
4721         if (!NT_STATUS_IS_OK(status)) {
4722                 DEBUG(0,("api_WPrintDestGetInfo: could not connect to spoolss: %s\n",
4723                           nt_errstr(status)));
4724                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4725                 goto out;
4726         }
4727
4728         ZERO_STRUCT(devmode_ctr);
4729
4730         status = rpccli_spoolss_OpenPrinter(cli, mem_ctx,
4731                                             PrinterName,
4732                                             NULL,
4733                                             devmode_ctr,
4734                                             SEC_FLAG_MAXIMUM_ALLOWED,
4735                                             &handle,
4736                                             &werr);
4737         if (!NT_STATUS_IS_OK(status)) {
4738                 *rdata_len = 0;
4739                 desc.errcode = NERR_DestNotFound;
4740                 desc.neededlen = 0;
4741                 goto out;
4742         }
4743         if (!W_ERROR_IS_OK(werr)) {
4744                 *rdata_len = 0;
4745                 desc.errcode = NERR_DestNotFound;
4746                 desc.neededlen = 0;
4747                 goto out;
4748         }
4749
4750         werr = rpccli_spoolss_getprinter(cli, mem_ctx,
4751                                          &handle,
4752                                          2,
4753                                          0,
4754                                          &info);
4755         if (!W_ERROR_IS_OK(werr)) {
4756                 *rdata_len = 0;
4757                 desc.errcode = NERR_DestNotFound;
4758                 desc.neededlen = 0;
4759                 goto out;
4760         }
4761
4762         if (mdrcnt > 0) {
4763                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4764                 if (!*rdata) {
4765                         return False;
4766                 }
4767                 desc.base = *rdata;
4768                 desc.buflen = mdrcnt;
4769         } else {
4770                 /*
4771                  * Don't return data but need to get correct length
4772                  * init_package will return wrong size if buflen=0
4773                  */
4774                 desc.buflen = getlen(desc.format);
4775                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4776         }
4777         if (init_package(&desc,1,0)) {
4778                 fill_printdest_info(&info.info2, uLevel,&desc);
4779         }
4780
4781  out:
4782         if (cli && is_valid_policy_hnd(&handle)) {
4783                 rpccli_spoolss_ClosePrinter(cli, mem_ctx, &handle, NULL);
4784         }
4785
4786         *rdata_len = desc.usedlen;
4787
4788         *rparam_len = 6;
4789         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4790         if (!*rparam) {
4791                 return False;
4792         }
4793         SSVALS(*rparam,0,desc.errcode);
4794         SSVAL(*rparam,2,0);
4795         SSVAL(*rparam,4,desc.neededlen);
4796
4797         DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4798         SAFE_FREE(tmpdata);
4799
4800         return True;
4801 }
4802
4803 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4804                                 char *param, int tpscnt,
4805                                 char *data, int tdscnt,
4806                                 int mdrcnt,int mprcnt,
4807                                 char **rdata,char **rparam,
4808                                 int *rdata_len,int *rparam_len)
4809 {
4810         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4811         char *str2 = skip_string(param,tpscnt,str1);
4812         char *p = skip_string(param,tpscnt,str2);
4813         int uLevel;
4814         int queuecnt;
4815         int i, n, succnt=0;
4816         struct pack_desc desc;
4817
4818         TALLOC_CTX *mem_ctx = talloc_tos();
4819         WERROR werr;
4820         NTSTATUS status;
4821         struct rpc_pipe_client *cli = NULL;
4822         union spoolss_PrinterInfo *info;
4823         uint32_t count;
4824
4825         if (!str1 || !str2 || !p) {
4826                 return False;
4827         }
4828
4829         memset((char *)&desc,'\0',sizeof(desc));
4830
4831         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4832
4833         DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4834
4835         /* check it's a supported varient */
4836         if (strcmp(str1,"WrLeh") != 0) {
4837                 return False;
4838         }
4839         if (!check_printdest_info(&desc,uLevel,str2)) {
4840                 return False;
4841         }
4842
4843         queuecnt = 0;
4844
4845         status = rpc_pipe_open_internal(mem_ctx, &ndr_table_spoolss.syntax_id,
4846                                         rpc_spoolss_dispatch, conn->server_info,
4847                                         &cli);
4848         if (!NT_STATUS_IS_OK(status)) {
4849                 DEBUG(0,("api_WPrintDestEnum: could not connect to spoolss: %s\n",
4850                           nt_errstr(status)));
4851                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4852                 goto out;
4853         }
4854
4855         werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
4856                                            PRINTER_ENUM_LOCAL,
4857                                            cli->srv_name_slash,
4858                                            2,
4859                                            0,
4860                                            &count,
4861                                            &info);
4862         if (!W_ERROR_IS_OK(werr)) {
4863                 desc.errcode = W_ERROR_V(werr);
4864                 *rdata_len = 0;
4865                 desc.errcode = NERR_DestNotFound;
4866                 desc.neededlen = 0;
4867                 goto out;
4868         }
4869
4870         queuecnt = count;
4871
4872         if (mdrcnt > 0) {
4873                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4874                 if (!*rdata) {
4875                         return False;
4876                 }
4877         }
4878
4879         desc.base = *rdata;
4880         desc.buflen = mdrcnt;
4881         if (init_package(&desc,queuecnt,0)) {
4882                 succnt = 0;
4883                 n = 0;
4884                 for (i = 0; i < count; i++) {
4885                         fill_printdest_info(&info[i].info2, uLevel,&desc);
4886                         n++;
4887                         if (desc.errcode == NERR_Success) {
4888                                 succnt = n;
4889                         }
4890                 }
4891         }
4892  out:
4893         *rdata_len = desc.usedlen;
4894
4895         *rparam_len = 8;
4896         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4897         if (!*rparam) {
4898                 return False;
4899         }
4900         SSVALS(*rparam,0,desc.errcode);
4901         SSVAL(*rparam,2,0);
4902         SSVAL(*rparam,4,succnt);
4903         SSVAL(*rparam,6,queuecnt);
4904
4905         DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4906
4907         return True;
4908 }
4909
4910 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4911                                 char *param, int tpscnt,
4912                                 char *data, int tdscnt,
4913                                 int mdrcnt,int mprcnt,
4914                                 char **rdata,char **rparam,
4915                                 int *rdata_len,int *rparam_len)
4916 {
4917         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4918         char *str2 = skip_string(param,tpscnt,str1);
4919         char *p = skip_string(param,tpscnt,str2);
4920         int uLevel;
4921         int succnt;
4922         struct pack_desc desc;
4923
4924         if (!str1 || !str2 || !p) {
4925                 return False;
4926         }
4927
4928         memset((char *)&desc,'\0',sizeof(desc));
4929
4930         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4931
4932         DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4933
4934         /* check it's a supported varient */
4935         if (strcmp(str1,"WrLeh") != 0) {
4936                 return False;
4937         }
4938         if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4939                 return False;
4940         }
4941
4942         if (mdrcnt > 0) {
4943                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4944                 if (!*rdata) {
4945                         return False;
4946                 }
4947         }
4948         desc.base = *rdata;
4949         desc.buflen = mdrcnt;
4950         if (init_package(&desc,1,0)) {
4951                 PACKS(&desc,"B41","NULL");
4952         }
4953
4954         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4955
4956         *rdata_len = desc.usedlen;
4957
4958         *rparam_len = 8;
4959         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4960         if (!*rparam) {
4961                 return False;
4962         }
4963         SSVALS(*rparam,0,desc.errcode);
4964         SSVAL(*rparam,2,0);
4965         SSVAL(*rparam,4,succnt);
4966         SSVAL(*rparam,6,1);
4967
4968         DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4969
4970         return True;
4971 }
4972
4973 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4974                                 char *param, int tpscnt,
4975                                 char *data, int tdscnt,
4976                                 int mdrcnt,int mprcnt,
4977                                 char **rdata,char **rparam,
4978                                 int *rdata_len,int *rparam_len)
4979 {
4980         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4981         char *str2 = skip_string(param,tpscnt,str1);
4982         char *p = skip_string(param,tpscnt,str2);
4983         int uLevel;
4984         int succnt;
4985         struct pack_desc desc;
4986
4987         if (!str1 || !str2 || !p) {
4988                 return False;
4989         }
4990         memset((char *)&desc,'\0',sizeof(desc));
4991
4992         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4993
4994         DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4995
4996         /* check it's a supported varient */
4997         if (strcmp(str1,"WrLeh") != 0) {
4998                 return False;
4999         }
5000         if (uLevel != 0 || strcmp(str2,"B13") != 0) {
5001                 return False;
5002         }
5003
5004         if (mdrcnt > 0) {
5005                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5006                 if (!*rdata) {
5007                         return False;
5008                 }
5009         }
5010         desc.base = *rdata;
5011         desc.buflen = mdrcnt;
5012         desc.format = str2;
5013         if (init_package(&desc,1,0)) {
5014                 PACKS(&desc,"B13","lpd");
5015         }
5016
5017         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5018
5019         *rdata_len = desc.usedlen;
5020
5021         *rparam_len = 8;
5022         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5023         if (!*rparam) {
5024                 return False;
5025         }
5026         SSVALS(*rparam,0,desc.errcode);
5027         SSVAL(*rparam,2,0);
5028         SSVAL(*rparam,4,succnt);
5029         SSVAL(*rparam,6,1);
5030
5031         DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
5032
5033         return True;
5034 }
5035
5036 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
5037                                 char *param, int tpscnt,
5038                                 char *data, int tdscnt,
5039                                 int mdrcnt,int mprcnt,
5040                                 char **rdata,char **rparam,
5041                                 int *rdata_len,int *rparam_len)
5042 {
5043         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5044         char *str2 = skip_string(param,tpscnt,str1);
5045         char *p = skip_string(param,tpscnt,str2);
5046         int uLevel;
5047         int succnt;
5048         struct pack_desc desc;
5049
5050         if (!str1 || !str2 || !p) {
5051                 return False;
5052         }
5053
5054         memset((char *)&desc,'\0',sizeof(desc));
5055
5056         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5057
5058         DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
5059
5060         /* check it's a supported varient */
5061         if (strcmp(str1,"WrLeh") != 0) {
5062                 return False;
5063         }
5064         if (uLevel != 0 || strcmp(str2,"B9") != 0) {
5065                 return False;
5066         }
5067
5068         if (mdrcnt > 0) {
5069                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5070                 if (!*rdata) {
5071                         return False;
5072                 }
5073         }
5074         memset((char *)&desc,'\0',sizeof(desc));
5075         desc.base = *rdata;
5076         desc.buflen = mdrcnt;
5077         desc.format = str2;
5078         if (init_package(&desc,1,0)) {
5079                 PACKS(&desc,"B13","lp0");
5080         }
5081
5082         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5083
5084         *rdata_len = desc.usedlen;
5085
5086         *rparam_len = 8;
5087         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5088         if (!*rparam) {
5089                 return False;
5090         }
5091         SSVALS(*rparam,0,desc.errcode);
5092         SSVAL(*rparam,2,0);
5093         SSVAL(*rparam,4,succnt);
5094         SSVAL(*rparam,6,1);
5095
5096         DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
5097
5098         return True;
5099 }
5100
5101 /****************************************************************************
5102  List open sessions
5103  ****************************************************************************/
5104
5105 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
5106                                 char *param, int tpscnt,
5107                                 char *data, int tdscnt,
5108                                 int mdrcnt,int mprcnt,
5109                                 char **rdata,char **rparam,
5110                                 int *rdata_len,int *rparam_len)
5111
5112 {
5113         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5114         char *str2 = skip_string(param,tpscnt,str1);
5115         char *p = skip_string(param,tpscnt,str2);
5116         int uLevel;
5117         struct pack_desc desc;
5118         struct sessionid *session_list;
5119         int i, num_sessions;
5120
5121         if (!str1 || !str2 || !p) {
5122                 return False;
5123         }
5124
5125         memset((char *)&desc,'\0',sizeof(desc));
5126
5127         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5128
5129         DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
5130         DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
5131         DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
5132
5133         /* check it's a supported varient */
5134         if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
5135                 return False;
5136         }
5137         if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
5138                 return False;
5139         }
5140
5141         num_sessions = list_sessions(talloc_tos(), &session_list);
5142
5143         if (mdrcnt > 0) {
5144                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5145                 if (!*rdata) {
5146                         return False;
5147                 }
5148         }
5149         memset((char *)&desc,'\0',sizeof(desc));
5150         desc.base = *rdata;
5151         desc.buflen = mdrcnt;
5152         desc.format = str2;
5153         if (!init_package(&desc,num_sessions,0)) {
5154                 return False;
5155         }
5156
5157         for(i=0; i<num_sessions; i++) {
5158                 PACKS(&desc, "z", session_list[i].remote_machine);
5159                 PACKS(&desc, "z", session_list[i].username);
5160                 PACKI(&desc, "W", 1); /* num conns */
5161                 PACKI(&desc, "W", 0); /* num opens */
5162                 PACKI(&desc, "W", 1); /* num users */
5163                 PACKI(&desc, "D", 0); /* session time */
5164                 PACKI(&desc, "D", 0); /* idle time */
5165                 PACKI(&desc, "D", 0); /* flags */
5166                 PACKS(&desc, "z", "Unknown Client"); /* client type string */
5167         }
5168
5169         *rdata_len = desc.usedlen;
5170
5171         *rparam_len = 8;
5172         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5173         if (!*rparam) {
5174                 return False;
5175         }
5176         SSVALS(*rparam,0,desc.errcode);
5177         SSVAL(*rparam,2,0); /* converter */
5178         SSVAL(*rparam,4,num_sessions); /* count */
5179
5180         DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
5181
5182         return True;
5183 }
5184
5185
5186 /****************************************************************************
5187  The buffer was too small.
5188  ****************************************************************************/
5189
5190 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
5191                          int mdrcnt, int mprcnt,
5192                          char **rdata, char **rparam,
5193                          int *rdata_len, int *rparam_len)
5194 {
5195         *rparam_len = MIN(*rparam_len,mprcnt);
5196         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5197         if (!*rparam) {
5198                 return False;
5199         }
5200
5201         *rdata_len = 0;
5202
5203         SSVAL(*rparam,0,NERR_BufTooSmall);
5204
5205         DEBUG(3,("Supplied buffer too small in API command\n"));
5206
5207         return True;
5208 }
5209
5210 /****************************************************************************
5211  The request is not supported.
5212  ****************************************************************************/
5213
5214 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
5215                                 char *param, int tpscnt,
5216                                 char *data, int tdscnt,
5217                                 int mdrcnt, int mprcnt,
5218                                 char **rdata, char **rparam,
5219                                 int *rdata_len, int *rparam_len)
5220 {
5221         *rparam_len = 4;
5222         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5223         if (!*rparam) {
5224                 return False;
5225         }
5226
5227         *rdata_len = 0;
5228
5229         SSVAL(*rparam,0,NERR_notsupported);
5230         SSVAL(*rparam,2,0);             /* converter word */
5231
5232         DEBUG(3,("Unsupported API command\n"));
5233
5234         return True;
5235 }
5236
5237 static const struct {
5238         const char *name;
5239         int id;
5240         bool (*fn)(connection_struct *, uint16,
5241                         char *, int,
5242                         char *, int,
5243                         int,int,char **,char **,int *,int *);
5244         bool auth_user;         /* Deny anonymous access? */
5245 } api_commands[] = {
5246         {"RNetShareEnum",       RAP_WshareEnum,         api_RNetShareEnum, True},
5247         {"RNetShareGetInfo",    RAP_WshareGetInfo,      api_RNetShareGetInfo},
5248         {"RNetShareAdd",        RAP_WshareAdd,          api_RNetShareAdd},
5249         {"RNetSessionEnum",     RAP_WsessionEnum,       api_RNetSessionEnum, True},
5250         {"RNetServerGetInfo",   RAP_WserverGetInfo,     api_RNetServerGetInfo},
5251         {"RNetGroupEnum",       RAP_WGroupEnum,         api_RNetGroupEnum, True},
5252         {"RNetGroupGetUsers", RAP_WGroupGetUsers,       api_RNetGroupGetUsers, True},
5253         {"RNetUserEnum",        RAP_WUserEnum,          api_RNetUserEnum, True},
5254         {"RNetUserGetInfo",     RAP_WUserGetInfo,       api_RNetUserGetInfo},
5255         {"NetUserGetGroups",    RAP_WUserGetGroups,     api_NetUserGetGroups},
5256         {"NetWkstaGetInfo",     RAP_WWkstaGetInfo,      api_NetWkstaGetInfo},
5257         {"DosPrintQEnum",       RAP_WPrintQEnum,        api_DosPrintQEnum, True},
5258         {"DosPrintQGetInfo",    RAP_WPrintQGetInfo,     api_DosPrintQGetInfo},
5259         {"WPrintQueuePause",  RAP_WPrintQPause, api_WPrintQueueCtrl},
5260         {"WPrintQueueResume", RAP_WPrintQContinue,      api_WPrintQueueCtrl},
5261         {"WPrintJobEnumerate",RAP_WPrintJobEnum,        api_WPrintJobEnumerate},
5262         {"WPrintJobGetInfo",    RAP_WPrintJobGetInfo,   api_WPrintJobGetInfo},
5263         {"RDosPrintJobDel",     RAP_WPrintJobDel,       api_RDosPrintJobDel},
5264         {"RDosPrintJobPause",   RAP_WPrintJobPause,     api_RDosPrintJobDel},
5265         {"RDosPrintJobResume",RAP_WPrintJobContinue,    api_RDosPrintJobDel},
5266         {"WPrintDestEnum",      RAP_WPrintDestEnum,     api_WPrintDestEnum},
5267         {"WPrintDestGetInfo",   RAP_WPrintDestGetInfo,  api_WPrintDestGetInfo},
5268         {"NetRemoteTOD",        RAP_NetRemoteTOD,       api_NetRemoteTOD},
5269         {"WPrintQueuePurge",    RAP_WPrintQPurge,       api_WPrintQueueCtrl},
5270         {"NetServerEnum2",      RAP_NetServerEnum2,     api_RNetServerEnum2}, /* anon OK */
5271         {"NetServerEnum3",      RAP_NetServerEnum3,     api_RNetServerEnum3}, /* anon OK */
5272         {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
5273         {"SetUserPassword",     RAP_WUserPasswordSet2,  api_SetUserPassword},
5274         {"WWkstaUserLogon",     RAP_WWkstaUserLogon,    api_WWkstaUserLogon},
5275         {"PrintJobInfo",        RAP_WPrintJobSetInfo,   api_PrintJobInfo},
5276         {"WPrintDriverEnum",    RAP_WPrintDriverEnum,   api_WPrintDriverEnum},
5277         {"WPrintQProcEnum",     RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
5278         {"WPrintPortEnum",      RAP_WPrintPortEnum,     api_WPrintPortEnum},
5279         {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
5280         {NULL,          -1,     api_Unsupported}
5281         /*  The following RAP calls are not implemented by Samba:
5282
5283         RAP_WFileEnum2 - anon not OK
5284         */
5285 };
5286
5287
5288 /****************************************************************************
5289  Handle remote api calls.
5290 ****************************************************************************/
5291
5292 void api_reply(connection_struct *conn, uint16 vuid,
5293                struct smb_request *req,
5294                char *data, char *params,
5295                int tdscnt, int tpscnt,
5296                int mdrcnt, int mprcnt)
5297 {
5298         struct smbd_server_connection *sconn = smbd_server_conn;
5299         int api_command;
5300         char *rdata = NULL;
5301         char *rparam = NULL;
5302         const char *name1 = NULL;
5303         const char *name2 = NULL;
5304         int rdata_len = 0;
5305         int rparam_len = 0;
5306         bool reply=False;
5307         int i;
5308
5309         if (!params) {
5310                 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
5311                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5312                 return;
5313         }
5314
5315         if (tpscnt < 2) {
5316                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5317                 return;
5318         }
5319         api_command = SVAL(params,0);
5320         /* Is there a string at position params+2 ? */
5321         if (skip_string(params,tpscnt,params+2)) {
5322                 name1 = params + 2;
5323         } else {
5324                 name1 = "";
5325         }
5326         name2 = skip_string(params,tpscnt,params+2);
5327         if (!name2) {
5328                 name2 = "";
5329         }
5330
5331         DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
5332                 api_command,
5333                 name1,
5334                 name2,
5335                 tdscnt,tpscnt,mdrcnt,mprcnt));
5336
5337         for (i=0;api_commands[i].name;i++) {
5338                 if (api_commands[i].id == api_command && api_commands[i].fn) {
5339                         DEBUG(3,("Doing %s\n",api_commands[i].name));
5340                         break;
5341                 }
5342         }
5343
5344         /* Check whether this api call can be done anonymously */
5345
5346         if (api_commands[i].auth_user && lp_restrict_anonymous()) {
5347                 user_struct *user = get_valid_user_struct(sconn, vuid);
5348
5349                 if (!user || user->server_info->guest) {
5350                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5351                         return;
5352                 }
5353         }
5354
5355         rdata = (char *)SMB_MALLOC(1024);
5356         if (rdata) {
5357                 memset(rdata,'\0',1024);
5358         }
5359
5360         rparam = (char *)SMB_MALLOC(1024);
5361         if (rparam) {
5362                 memset(rparam,'\0',1024);
5363         }
5364
5365         if(!rdata || !rparam) {
5366                 DEBUG(0,("api_reply: malloc fail !\n"));
5367                 SAFE_FREE(rdata);
5368                 SAFE_FREE(rparam);
5369                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5370                 return;
5371         }
5372
5373         reply = api_commands[i].fn(conn,
5374                                 vuid,
5375                                 params,tpscnt,  /* params + length */
5376                                 data,tdscnt,    /* data + length */
5377                                 mdrcnt,mprcnt,
5378                                 &rdata,&rparam,&rdata_len,&rparam_len);
5379
5380
5381         if (rdata_len > mdrcnt || rparam_len > mprcnt) {
5382                 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
5383                                         &rdata,&rparam,&rdata_len,&rparam_len);
5384         }
5385
5386         /* if we get False back then it's actually unsupported */
5387         if (!reply) {
5388                 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
5389                         &rdata,&rparam,&rdata_len,&rparam_len);
5390         }
5391
5392         /* If api_Unsupported returns false we can't return anything. */
5393         if (reply) {
5394                 send_trans_reply(conn, req, rparam, rparam_len,
5395                                  rdata, rdata_len, False);
5396         }
5397
5398         SAFE_FREE(rdata);
5399         SAFE_FREE(rparam);
5400         return;
5401 }