source3/smbd/smb1_lanman.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Inter-process communication and named pipe handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Jeremy Allison 2007.
   6
   7    SMB Version handling
   8    Copyright (C) John H Terpstra 1995-1998
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22    */
  23 /*
  24    This file handles the named pipe and mailslot calls
  25    in the SMBtrans protocol
  26    */
  27
  28 #include "includes.h"
  29 #include "lib/util/util_file.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "source3/smbd/smbXsrv_session.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_samr_c.h"
  35 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
  39 #include "../librpc/gen_ndr/rap.h"
  40 #include "../lib/util/binsearch.h"
  41 #include "../libcli/auth/libcli_auth.h"
  42 #include "rpc_client/init_lsa.h"
  43 #include "../libcli/security/security.h"
  44 #include "printing.h"
  45 #include "passdb/machine_sid.h"
  46 #include "auth.h"
  47 #include "rpc_server/rpc_ncacn_np.h"
  48 #include "lib/util/string_wrappers.h"
  49 #include "source3/printing/rap_jobid.h"
  50 #include "source3/lib/substitute.h"
  51
  52 #ifdef CHECK_TYPES
  53 #undef CHECK_TYPES
  54 #endif
  55 #define CHECK_TYPES 0
  56
  57 #define NERR_Success 0
  58 #define NERR_badpass 86
  59 #define NERR_notsupported 50
  60
  61 #define NERR_BASE (2100)
  62 #define NERR_BufTooSmall (NERR_BASE+23)
  63 #define NERR_JobNotFound (NERR_BASE+51)
  64 #define NERR_DestNotFound (NERR_BASE+52)
  65
  66 #define ACCESS_READ 0x01
  67 #define ACCESS_WRITE 0x02
  68 #define ACCESS_CREATE 0x04
  69
  70 #define SHPWLEN 8               /* share password length */
  71
  72 /* Limit size of ipc replies */
  73
  74 static char *smb_realloc_limit(void *ptr, size_t size)
  75 {
  76         char *val;
  77
  78         size = MAX((size),4*1024);
  79         val = (char *)SMB_REALLOC(ptr,size);
  80         if (val) {
  81                 memset(val,'\0',size);
  82         }
  83         return val;
  84 }
  85
  86 static bool api_Unsupported(struct smbd_server_connection *sconn,
  87                             connection_struct *conn, uint64_t vuid,
  88                                 char *param, int tpscnt,
  89                                 char *data, int tdscnt,
  90                                 int mdrcnt, int mprcnt,
  91                                 char **rdata, char **rparam,
  92                                 int *rdata_len, int *rparam_len);
  93
  94 static bool api_TooSmall(struct smbd_server_connection *sconn,
  95                          connection_struct *conn, uint64_t vuid, char *param, char *data,
  96                          int mdrcnt, int mprcnt,
  97                          char **rdata, char **rparam,
  98                          int *rdata_len, int *rparam_len);
  99
 100
 101 static int CopyExpanded(connection_struct *conn,
 102                         int snum, char **dst, char *src, int *p_space_remaining)
 103 {
 104         TALLOC_CTX *ctx = talloc_tos();
 105         const struct loadparm_substitution *lp_sub =
 106                 loadparm_s3_global_substitution();
 107         char *buf = NULL;
 108         int l;
 109
 110         if (!src || !dst || !p_space_remaining || !(*dst) ||
 111                         *p_space_remaining <= 0) {
 112                 return 0;
 113         }
 114
 115         buf = talloc_strdup(ctx, src);
 116         if (!buf) {
 117                 *p_space_remaining = 0;
 118                 return 0;
 119         }
 120         buf = talloc_string_sub(ctx, buf,"%S", lp_servicename(ctx, lp_sub, snum));
 121         if (!buf) {
 122                 *p_space_remaining = 0;
 123                 return 0;
 124         }
 125         buf = talloc_sub_full(ctx,
 126                                   lp_servicename(ctx, lp_sub, SNUM(conn)),
 127                                 conn->session_info->unix_info->unix_name,
 128                                 conn->connectpath,
 129                                 conn->session_info->unix_token->gid,
 130                                 conn->session_info->unix_info->sanitized_username,
 131                                 conn->session_info->info->domain_name,
 132                                 buf);
 133         if (!buf) {
 134                 *p_space_remaining = 0;
 135                 return 0;
 136         }
 137         l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
 138         if (l == 0) {
 139                 return 0;
 140         }
 141         (*dst) += l;
 142         (*p_space_remaining) -= l;
 143         return l;
 144 }
 145
 146 static int CopyAndAdvance(char **dst, char *src, int *n)
 147 {
 148         int l;
 149         if (!src || !dst || !n || !(*dst)) {
 150                 return 0;
 151         }
 152         l = push_ascii(*dst,src,*n, STR_TERMINATE);
 153         if (l == 0) {
 154                 return 0;
 155         }
 156         (*dst) += l;
 157         (*n) -= l;
 158         return l;
 159 }
 160
 161 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
 162 {
 163         TALLOC_CTX *ctx = talloc_tos();
 164         const struct loadparm_substitution *lp_sub =
 165                 loadparm_s3_global_substitution();
 166         char *buf = NULL;
 167         if (!s) {
 168                 return 0;
 169         }
 170         buf = talloc_strdup(ctx,s);
 171         if (!buf) {
 172                 return 0;
 173         }
 174         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(ctx, lp_sub, snum));
 175         if (!buf) {
 176                 return 0;
 177         }
 178         buf = talloc_sub_full(ctx,
 179                                   lp_servicename(ctx, lp_sub, SNUM(conn)),
 180                                 conn->session_info->unix_info->unix_name,
 181                                 conn->connectpath,
 182                                 conn->session_info->unix_token->gid,
 183                                 conn->session_info->unix_info->sanitized_username,
 184                                 conn->session_info->info->domain_name,
 185                                 buf);
 186         if (!buf) {
 187                 return 0;
 188         }
 189         return strlen(buf) + 1;
 190 }
 191
 192 /****************************************************************
 193  Return an SVAL at a pointer, or failval if beyond the end.
 194 ****************************************************************/
 195
 196 static int get_safe_SVAL(
 197         const char *buf_base,
 198         size_t buf_len,
 199         char *ptr,
 200         size_t off,
 201         int failval)
 202 {
 203         /*
 204          * Note we use off+1 here, not off+2 as SVAL accesses ptr[0]
 205          * and ptr[1], NOT ptr[2].
 206          */
 207         if (!is_offset_safe(buf_base, buf_len, ptr, off+1)) {
 208                 return failval;
 209         }
 210         return SVAL(ptr,off);
 211 }
 212
 213 /****************************************************************
 214  Return an IVAL at a pointer, or failval if beyond the end.
 215 ****************************************************************/
 216
 217 static int get_safe_IVAL(
 218         const char *buf_base,
 219         size_t buf_len,
 220         char *ptr,
 221         size_t off,
 222         int failval)
 223 {
 224         /*
 225          * Note we use off+3 here, not off+4 as IVAL accesses
 226          * ptr[0] ptr[1] ptr[2] ptr[3] NOT ptr[4].
 227          */
 228         if (!is_offset_safe(buf_base, buf_len, ptr, off+3)) {
 229                 return failval;
 230         }
 231         return IVAL(ptr,off);
 232 }
 233
 234 /****************************************************************
 235  Return a safe pointer into a buffer, or NULL.
 236 ****************************************************************/
 237
 238 static char *get_safe_ptr(
 239         const char *buf_base,
 240         size_t buf_len,
 241         char *ptr,
 242         size_t off)
 243 {
 244         return is_offset_safe(buf_base, buf_len, ptr, off) ?
 245                         ptr + off : NULL;
 246 }
 247
 248 /*******************************************************************
 249  Check a API string for validity when we only need to check the prefix.
 250 ******************************************************************/
 251
 252 static bool prefix_ok(const char *str, const char *prefix)
 253 {
 254         return(strncmp(str,prefix,strlen(prefix)) == 0);
 255 }
 256
 257 struct pack_desc {
 258         const char *format;         /* formatstring for structure */
 259         const char *subformat;  /* subformat for structure */
 260         char *base;         /* baseaddress of buffer */
 261         int buflen;        /* remaining size for fixed part; on init: length of base */
 262         int subcount;       /* count of substructures */
 263         char *structbuf;  /* pointer into buffer for remaining fixed part */
 264         int stringlen;    /* remaining size for variable part */
 265         char *stringbuf;  /* pointer into buffer for remaining variable part */
 266         int neededlen;    /* total needed size */
 267         int usedlen;        /* total used size (usedlen <= neededlen and usedlen <= buflen) */
 268         const char *curpos;         /* current position; pointer into format or subformat */
 269         int errcode;
 270 };
 271
 272 static int get_counter(const char **p)
 273 {
 274         int i, n;
 275         if (!p || !(*p)) {
 276                 return 1;
 277         }
 278         if (!isdigit((int)**p)) {
 279                 return 1;
 280         }
 281         for (n = 0;;) {
 282                 i = **p;
 283                 if (isdigit(i)) {
 284                         n = 10 * n + (i - '0');
 285                 } else {
 286                         return n;
 287                 }
 288                 (*p)++;
 289         }
 290 }
 291
 292 static int getlen(const char *p)
 293 {
 294         int n = 0;
 295         if (!p) {
 296                 return 0;
 297         }
 298
 299         while (*p) {
 300                 switch( *p++ ) {
 301                 case 'W':                       /* word (2 byte) */
 302                         n += 2;
 303                         break;
 304                 case 'K':                       /* status word? (2 byte) */
 305                         n += 2;
 306                         break;
 307                 case 'N':                       /* count of substructures (word) at end */
 308                         n += 2;
 309                         break;
 310                 case 'D':                       /* double word (4 byte) */
 311                 case 'z':                       /* offset to zero terminated string (4 byte) */
 312                 case 'l':                       /* offset to user data (4 byte) */
 313                         n += 4;
 314                         break;
 315                 case 'b':                       /* offset to data (with counter) (4 byte) */
 316                         n += 4;
 317                         get_counter(&p);
 318                         break;
 319                 case 'B':                       /* byte (with optional counter) */
 320                         n += get_counter(&p);
 321                         break;
 322                 }
 323         }
 324         return n;
 325 }
 326
 327 static bool init_package(struct pack_desc *p, int count, int subcount)
 328 {
 329         int n = p->buflen;
 330         int i;
 331
 332         if (!p->format || !p->base) {
 333                 return False;
 334         }
 335
 336         i = count * getlen(p->format);
 337         if (p->subformat) {
 338                 i += subcount * getlen(p->subformat);
 339         }
 340         p->structbuf = p->base;
 341         p->neededlen = 0;
 342         p->usedlen = 0;
 343         p->subcount = 0;
 344         p->curpos = p->format;
 345         if (i > n) {
 346                 p->neededlen = i;
 347                 i = n = 0;
 348 #if 0
 349                 /*
 350                  * This is the old error code we used. Apparently
 351                  * WinNT/2k systems return ERRbuftoosmall (2123) and
 352                  * OS/2 needs this. I'm leaving this here so we can revert
 353                  * if needed. JRA.
 354                  */
 355                 p->errcode = ERRmoredata;
 356 #else
 357                 p->errcode = ERRbuftoosmall;
 358 #endif
 359         } else {
 360                 p->errcode = NERR_Success;
 361         }
 362         p->buflen = i;
 363         n -= i;
 364         p->stringbuf = p->base + i;
 365         p->stringlen = n;
 366         return (p->errcode == NERR_Success);
 367 }
 368
 369 static int package(struct pack_desc *p, ...)
 370 {
 371         va_list args;
 372         int needed=0, stringneeded;
 373         const char *str=NULL;
 374         int is_string=0, stringused;
 375         int32_t temp;
 376
 377         va_start(args,p);
 378
 379         if (!*p->curpos) {
 380                 if (!p->subcount) {
 381                         p->curpos = p->format;
 382                 } else {
 383                         p->curpos = p->subformat;
 384                         p->subcount--;
 385                 }
 386         }
 387 #if CHECK_TYPES
 388         str = va_arg(args,char*);
 389         SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
 390 #endif
 391         stringneeded = -1;
 392
 393         if (!p->curpos) {
 394                 va_end(args);
 395                 return 0;
 396         }
 397
 398         switch( *p->curpos++ ) {
 399                 case 'W':                       /* word (2 byte) */
 400                         needed = 2;
 401                         temp = va_arg(args,int);
 402                         if (p->buflen >= needed) {
 403                                 SSVAL(p->structbuf,0,temp);
 404                         }
 405                         break;
 406                 case 'K':                       /* status word? (2 byte) */
 407                         needed = 2;
 408                         temp = va_arg(args,int);
 409                         if (p->buflen >= needed) {
 410                                 SSVAL(p->structbuf,0,temp);
 411                         }
 412                         break;
 413                 case 'N':                       /* count of substructures (word) at end */
 414                         needed = 2;
 415                         p->subcount = va_arg(args,int);
 416                         if (p->buflen >= needed) {
 417                                 SSVAL(p->structbuf,0,p->subcount);
 418                         }
 419                         break;
 420                 case 'D':                       /* double word (4 byte) */
 421                         needed = 4;
 422                         temp = va_arg(args,int);
 423                         if (p->buflen >= needed) {
 424                                 SIVAL(p->structbuf,0,temp);
 425                         }
 426                         break;
 427                 case 'B':                       /* byte (with optional counter) */
 428                         needed = get_counter(&p->curpos);
 429                         {
 430                                 char *s = va_arg(args,char*);
 431                                 if (p->buflen >= needed) {
 432                                         strlcpy(p->structbuf,s?s:"",needed);
 433                                 }
 434                         }
 435                         break;
 436                 case 'z':                       /* offset to zero terminated string (4 byte) */
 437                         str = va_arg(args,char*);
 438                         stringneeded = (str ? strlen(str)+1 : 0);
 439                         is_string = 1;
 440                         break;
 441                 case 'l':                       /* offset to user data (4 byte) */
 442                         str = va_arg(args,char*);
 443                         stringneeded = va_arg(args,int);
 444                         is_string = 0;
 445                         break;
 446                 case 'b':                       /* offset to data (with counter) (4 byte) */
 447                         str = va_arg(args,char*);
 448                         stringneeded = get_counter(&p->curpos);
 449                         is_string = 0;
 450                         break;
 451         }
 452
 453         va_end(args);
 454         if (stringneeded >= 0) {
 455                 needed = 4;
 456                 if (p->buflen >= needed) {
 457                         stringused = stringneeded;
 458                         if (stringused > p->stringlen) {
 459                                 stringused = (is_string ? p->stringlen : 0);
 460                                 if (p->errcode == NERR_Success) {
 461                                         p->errcode = ERRmoredata;
 462                                 }
 463                         }
 464                         if (!stringused) {
 465                                 SIVAL(p->structbuf,0,0);
 466                         } else {
 467                                 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
 468                                 memcpy(p->stringbuf,str?str:"",stringused);
 469                                 if (is_string) {
 470                                         p->stringbuf[stringused-1] = '\0';
 471                                 }
 472                                 p->stringbuf += stringused;
 473                                 p->stringlen -= stringused;
 474                                 p->usedlen += stringused;
 475                         }
 476                 }
 477                 p->neededlen += stringneeded;
 478         }
 479
 480         p->neededlen += needed;
 481         if (p->buflen >= needed) {
 482                 p->structbuf += needed;
 483                 p->buflen -= needed;
 484                 p->usedlen += needed;
 485         } else {
 486                 if (p->errcode == NERR_Success) {
 487                         p->errcode = ERRmoredata;
 488                 }
 489         }
 490         return 1;
 491 }
 492
 493 #if CHECK_TYPES
 494 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
 495 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
 496 #else
 497 #define PACK(desc,t,v) package(desc,v)
 498 #define PACKl(desc,t,v,l) package(desc,v,l)
 499 #endif
 500
 501 static void PACKI(struct pack_desc* desc, const char *t,int v)
 502 {
 503         PACK(desc,t,v);
 504 }
 505
 506 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
 507 {
 508         PACK(desc,t,v);
 509 }
 510
 511 /****************************************************************************
 512  Get a print queue.
 513 ****************************************************************************/
 514
 515 static void PackDriverData(struct pack_desc* desc)
 516 {
 517         char drivdata[4+4+32];
 518         SIVAL(drivdata,0,sizeof drivdata); /* cb */
 519         SIVAL(drivdata,4,1000); /* lVersion */
 520         memset(drivdata+8,0,32);        /* szDeviceName */
 521         push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
 522         PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
 523 }
 524
 525 static int check_printq_info(struct pack_desc* desc,
 526                                 unsigned int uLevel, char *id1, char *id2)
 527 {
 528         desc->subformat = NULL;
 529         switch( uLevel ) {
 530                 case 0:
 531                         desc->format = "B13";
 532                         break;
 533                 case 1:
 534                         desc->format = "B13BWWWzzzzzWW";
 535                         break;
 536                 case 2:
 537                         desc->format = "B13BWWWzzzzzWN";
 538                         desc->subformat = "WB21BB16B10zWWzDDz";
 539                         break;
 540                 case 3:
 541                         desc->format = "zWWWWzzzzWWzzl";
 542                         break;
 543                 case 4:
 544                         desc->format = "zWWWWzzzzWNzzl";
 545                         desc->subformat = "WWzWWDDzz";
 546                         break;
 547                 case 5:
 548                         desc->format = "z";
 549                         break;
 550                 case 51:
 551                         desc->format = "K";
 552                         break;
 553                 case 52:
 554                         desc->format = "WzzzzzzzzN";
 555                         desc->subformat = "z";
 556                         break;
 557                 default:
 558                         DEBUG(0,("check_printq_info: invalid level %d\n",
 559                                 uLevel ));
 560                         return False;
 561         }
 562         if (id1 == NULL || strcmp(desc->format,id1) != 0) {
 563                 DEBUG(0,("check_printq_info: invalid format %s\n",
 564                         id1 ? id1 : "<NULL>" ));
 565                 return False;
 566         }
 567         if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
 568                 DEBUG(0,("check_printq_info: invalid subformat %s\n",
 569                         id2 ? id2 : "<NULL>" ));
 570                 return False;
 571         }
 572         return True;
 573 }
 574
 575
 576 #define RAP_JOB_STATUS_QUEUED 0
 577 #define RAP_JOB_STATUS_PAUSED 1
 578 #define RAP_JOB_STATUS_SPOOLING 2
 579 #define RAP_JOB_STATUS_PRINTING 3
 580 #define RAP_JOB_STATUS_PRINTED 4
 581
 582 #define RAP_QUEUE_STATUS_PAUSED 1
 583 #define RAP_QUEUE_STATUS_ERROR 2
 584
 585 /* turn a print job status into a on the wire status
 586 */
 587 static int printj_spoolss_status(int v)
 588 {
 589         if (v == JOB_STATUS_QUEUED)
 590                 return RAP_JOB_STATUS_QUEUED;
 591         if (v & JOB_STATUS_PAUSED)
 592                 return RAP_JOB_STATUS_PAUSED;
 593         if (v & JOB_STATUS_SPOOLING)
 594                 return RAP_JOB_STATUS_SPOOLING;
 595         if (v & JOB_STATUS_PRINTING)
 596                 return RAP_JOB_STATUS_PRINTING;
 597         return 0;
 598 }
 599
 600 /* turn a print queue status into a on the wire status
 601 */
 602 static int printq_spoolss_status(int v)
 603 {
 604         if (v == PRINTER_STATUS_OK)
 605                 return 0;
 606         if (v & PRINTER_STATUS_PAUSED)
 607                 return RAP_QUEUE_STATUS_PAUSED;
 608         return RAP_QUEUE_STATUS_ERROR;
 609 }
 610
 611 static void fill_spoolss_printjob_info(int uLevel,
 612                                        struct pack_desc *desc,
 613                                        struct spoolss_JobInfo2 *info2,
 614                                        int n)
 615 {
 616         time_t t = spoolss_Time_to_time_t(&info2->submitted);
 617
 618         /* the client expects localtime */
 619         t -= get_time_zone(t);
 620
 621         PACKI(desc,"W",pjobid_to_rap(info2->printer_name, info2->job_id)); /* uJobId */
 622         if (uLevel == 1) {
 623                 PACKS(desc,"B21", info2->user_name); /* szUserName */
 624                 PACKS(desc,"B","");             /* pad */
 625                 PACKS(desc,"B16","");   /* szNotifyName */
 626                 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
 627                 PACKS(desc,"z","");             /* pszParms */
 628                 PACKI(desc,"W",n+1);            /* uPosition */
 629                 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
 630                 PACKS(desc,"z","");             /* pszStatus */
 631                 PACKI(desc,"D", t); /* ulSubmitted */
 632                 PACKI(desc,"D", info2->size); /* ulSize */
 633                 PACKS(desc,"z", info2->document_name); /* pszComment */
 634         }
 635         if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
 636                 PACKI(desc,"W", info2->priority);               /* uPriority */
 637                 PACKS(desc,"z", info2->user_name); /* pszUserName */
 638                 PACKI(desc,"W",n+1);            /* uPosition */
 639                 PACKI(desc,"W", printj_spoolss_status(info2->status)); /* fsStatus */
 640                 PACKI(desc,"D",t); /* ulSubmitted */
 641                 PACKI(desc,"D", info2->size); /* ulSize */
 642                 PACKS(desc,"z","Samba");        /* pszComment */
 643                 PACKS(desc,"z", info2->document_name); /* pszDocument */
 644                 if (uLevel == 3) {
 645                         PACKS(desc,"z","");     /* pszNotifyName */
 646                         PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
 647                         PACKS(desc,"z","");     /* pszParms */
 648                         PACKS(desc,"z","");     /* pszStatus */
 649                         PACKS(desc,"z", info2->printer_name); /* pszQueue */
 650                         PACKS(desc,"z","lpd");  /* pszQProcName */
 651                         PACKS(desc,"z","");     /* pszQProcParms */
 652                         PACKS(desc,"z","NULL"); /* pszDriverName */
 653                         PackDriverData(desc);   /* pDriverData */
 654                         PACKS(desc,"z","");     /* pszPrinterName */
 655                 } else if (uLevel == 4) {   /* OS2 */
 656                         PACKS(desc,"z","");       /* pszSpoolFileName  */
 657                         PACKS(desc,"z","");       /* pszPortName       */
 658                         PACKS(desc,"z","");       /* pszStatus         */
 659                         PACKI(desc,"D",0);        /* ulPagesSpooled    */
 660                         PACKI(desc,"D",0);        /* ulPagesSent       */
 661                         PACKI(desc,"D",0);        /* ulPagesPrinted    */
 662                         PACKI(desc,"D",0);        /* ulTimePrinted     */
 663                         PACKI(desc,"D",0);        /* ulExtendJobStatus */
 664                         PACKI(desc,"D",0);        /* ulStartPage       */
 665                         PACKI(desc,"D",0);        /* ulEndPage         */
 666                 }
 667         }
 668 }
 669
 670 /********************************************************************
 671  Respond to the DosPrintQInfo command with a level of 52
 672  This is used to get printer driver information for Win9x clients
 673  ********************************************************************/
 674 static void fill_printq_info_52(struct spoolss_DriverInfo3 *driver,
 675                                 struct pack_desc* desc, int count,
 676                                 const char *printer_name)
 677 {
 678         int                             i;
 679         fstring                         location;
 680         trim_string(discard_const_p(char, driver->driver_path), "\\print$\\WIN40\\0\\", 0);
 681         trim_string(discard_const_p(char, driver->data_file), "\\print$\\WIN40\\0\\", 0);
 682         trim_string(discard_const_p(char, driver->help_file), "\\print$\\WIN40\\0\\", 0);
 683
 684         PACKI(desc, "W", 0x0400);                     /* don't know */
 685         PACKS(desc, "z", driver->driver_name);        /* long printer name */
 686         PACKS(desc, "z", driver->driver_path);  /* Driverfile Name */
 687         PACKS(desc, "z", driver->data_file);    /* Datafile name */
 688         PACKS(desc, "z", driver->monitor_name); /* language monitor */
 689
 690         fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
 691         standard_sub_basic( "", "", location, sizeof(location)-1 );
 692         PACKS(desc,"z", location);                          /* share to retrieve files */
 693
 694         PACKS(desc,"z", driver->default_datatype);    /* default data type */
 695         PACKS(desc,"z", driver->help_file);           /* helpfile name */
 696         PACKS(desc,"z", driver->driver_path);               /* driver name */
 697
 698         DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
 699         DEBUG(3,("Driver: %s:\n",driver->driver_path));
 700         DEBUG(3,("Data File: %s:\n",driver->data_file));
 701         DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
 702         DEBUG(3,("Driver Location: %s:\n",location));
 703         DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
 704         DEBUG(3,("Help File: %s:\n",driver->help_file));
 705         PACKI(desc,"N",count);                     /* number of files to copy */
 706
 707         for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
 708         {
 709                 trim_string(discard_const_p(char, driver->dependent_files[i]), "\\print$\\WIN40\\0\\", 0);
 710                 PACKS(desc,"z",driver->dependent_files[i]);         /* driver files to copy */
 711                 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
 712         }
 713
 714         /* sanity check */
 715         if ( i != count )
 716                 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
 717                         count, i));
 718
 719         DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", printer_name, i));
 720
 721         desc->errcode=NERR_Success;
 722
 723 }
 724
 725 static const char *strip_unc(const char *unc)
 726 {
 727         char *p;
 728
 729         if (unc == NULL) {
 730                 return NULL;
 731         }
 732
 733         if ((p = strrchr(unc, '\\')) != NULL) {
 734                 return p+1;
 735         }
 736
 737         return unc;
 738 }
 739
 740 static void fill_printq_info(int uLevel,
 741                              struct pack_desc* desc,
 742                              int count,
 743                              union spoolss_JobInfo *job_info,
 744                              struct spoolss_DriverInfo3 *driver_info,
 745                              struct spoolss_PrinterInfo2 *printer_info)
 746 {
 747         switch (uLevel) {
 748         case 0:
 749         case 1:
 750         case 2:
 751                 PACKS(desc,"B13", strip_unc(printer_info->printername));
 752                 break;
 753         case 3:
 754         case 4:
 755         case 5:
 756                 PACKS(desc,"z", strip_unc(printer_info->printername));
 757                 break;
 758         case 51:
 759                 PACKI(desc,"K", printq_spoolss_status(printer_info->status));
 760                 break;
 761         }
 762
 763         if (uLevel == 1 || uLevel == 2) {
 764                 PACKS(desc,"B","");             /* alignment */
 765                 PACKI(desc,"W",5);              /* priority */
 766                 PACKI(desc,"W",0);              /* start time */
 767                 PACKI(desc,"W",0);              /* until time */
 768                 PACKS(desc,"z","");             /* pSepFile */
 769                 PACKS(desc,"z","lpd");  /* pPrProc */
 770                 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pDestinations */
 771                 PACKS(desc,"z","");             /* pParms */
 772                 if (printer_info->printername == NULL) {
 773                         PACKS(desc,"z","UNKNOWN PRINTER");
 774                         PACKI(desc,"W",LPSTAT_ERROR);
 775                 } else {
 776                         PACKS(desc,"z", printer_info->comment);
 777                         PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* status */
 778                 }
 779                 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
 780         }
 781
 782         if (uLevel == 3 || uLevel == 4) {
 783                 PACKI(desc,"W",5);              /* uPriority */
 784                 PACKI(desc,"W",0);              /* uStarttime */
 785                 PACKI(desc,"W",0);              /* uUntiltime */
 786                 PACKI(desc,"W",5);              /* pad1 */
 787                 PACKS(desc,"z","");             /* pszSepFile */
 788                 PACKS(desc,"z","WinPrint");     /* pszPrProc */
 789                 PACKS(desc,"z",NULL);           /* pszParms */
 790                 PACKS(desc,"z",NULL);           /* pszComment - don't ask.... JRA */
 791                 /* "don't ask" that it's done this way to fix corrupted
 792                    Win9X/ME printer comments. */
 793                 PACKI(desc,"W", printq_spoolss_status(printer_info->status)); /* fsStatus */
 794                 PACKI(desc,(uLevel == 3 ? "W" : "N"),count);    /* cJobs */
 795                 PACKS(desc,"z", strip_unc(printer_info->printername)); /* pszPrinters */
 796                 PACKS(desc,"z", printer_info->drivername);              /* pszDriverName */
 797                 PackDriverData(desc);   /* pDriverData */
 798         }
 799
 800         if (uLevel == 2 || uLevel == 4) {
 801                 int i;
 802                 for (i = 0; i < count; i++) {
 803                         fill_spoolss_printjob_info(uLevel == 2 ? 1 : 2, desc, &job_info[i].info2, i);
 804                 }
 805         }
 806
 807         if (uLevel==52)
 808                 fill_printq_info_52(driver_info, desc, count, printer_info->printername);
 809 }
 810
 811 /* This function returns the number of files for a given driver */
 812 static int get_printerdrivernumber(const struct spoolss_DriverInfo3 *driver)
 813 {
 814         int                             result = 0;
 815
 816         /* count the number of files */
 817         while (driver->dependent_files && *driver->dependent_files[result])
 818                 result++;
 819
 820         return result;
 821 }
 822
 823 static bool api_DosPrintQGetInfo(struct smbd_server_connection *sconn,
 824                                  connection_struct *conn, uint64_t vuid,
 825                                 char *param, int tpscnt,
 826                                 char *data, int tdscnt,
 827                                 int mdrcnt,int mprcnt,
 828                                 char **rdata,char **rparam,
 829                                 int *rdata_len,int *rparam_len)
 830 {
 831         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
 832         char *str2 = skip_string(param,tpscnt,str1);
 833         char *p = skip_string(param,tpscnt,str2);
 834         char *QueueName = p;
 835         unsigned int uLevel;
 836         uint32_t count = 0;
 837         char *str3;
 838         struct pack_desc desc;
 839         char* tmpdata=NULL;
 840
 841         WERROR werr = WERR_OK;
 842         TALLOC_CTX *mem_ctx = talloc_tos();
 843         NTSTATUS status;
 844         struct rpc_pipe_client *cli = NULL;
 845         struct dcerpc_binding_handle *b = NULL;
 846         struct policy_handle handle;
 847         struct spoolss_DevmodeContainer devmode_ctr;
 848         union spoolss_DriverInfo driver_info;
 849         union spoolss_JobInfo *job_info = NULL;
 850         union spoolss_PrinterInfo printer_info;
 851
 852         if (!str1 || !str2 || !p) {
 853                 return False;
 854         }
 855         memset((char *)&desc,'\0',sizeof(desc));
 856
 857         p = skip_string(param,tpscnt,p);
 858         if (!p) {
 859                 return False;
 860         }
 861         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 862         str3 = get_safe_str_ptr(param,tpscnt,p,4);
 863         /* str3 may be null here and is checked in check_printq_info(). */
 864
 865         /* remove any trailing username */
 866         if ((p = strchr_m(QueueName,'%')))
 867                 *p = 0;
 868
 869         DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
 870
 871         /* check it's a supported variant */
 872         if (!prefix_ok(str1,"zWrLh"))
 873                 return False;
 874         if (!check_printq_info(&desc,uLevel,str2,str3)) {
 875                 /*
 876                  * Patch from Scott Moomaw <scott@bridgewater.edu>
 877                  * to return the 'invalid info level' error if an
 878                  * unknown level was requested.
 879                  */
 880                 *rdata_len = 0;
 881                 *rparam_len = 6;
 882                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
 883                 if (!*rparam) {
 884                         return False;
 885                 }
 886                 SSVALS(*rparam,0,ERRunknownlevel);
 887                 SSVAL(*rparam,2,0);
 888                 SSVAL(*rparam,4,0);
 889                 return(True);
 890         }
 891
 892         ZERO_STRUCT(handle);
 893
 894         if (QueueName == NULL || (strlen(QueueName) < 1)) {
 895                 desc.errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
 896                 goto out;
 897         }
 898
 899         status = rpc_pipe_open_interface(mem_ctx,
 900                                          &ndr_table_spoolss,
 901                                          conn->session_info,
 902                                          conn->sconn->remote_address,
 903                                          conn->sconn->local_address,
 904                                          conn->sconn->msg_ctx,
 905                                          &cli);
 906         if (!NT_STATUS_IS_OK(status)) {
 907                 DEBUG(0,("api_DosPrintQGetInfo: could not connect to spoolss: %s\n",
 908                           nt_errstr(status)));
 909                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
 910                 goto out;
 911         }
 912         b = cli->binding_handle;
 913
 914         ZERO_STRUCT(devmode_ctr);
 915
 916         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
 917                                             QueueName,
 918                                             "RAW",
 919                                             devmode_ctr,
 920                                             PRINTER_ACCESS_USE,
 921                                             &handle,
 922                                             &werr);
 923         if (!NT_STATUS_IS_OK(status)) {
 924                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
 925                 goto out;
 926         }
 927         if (!W_ERROR_IS_OK(werr)) {
 928                 desc.errcode = W_ERROR_V(werr);
 929                 goto out;
 930         }
 931
 932         werr = rpccli_spoolss_getprinter(cli, mem_ctx,
 933                                          &handle,
 934                                          2,
 935                                          0,
 936                                          &printer_info);
 937         if (!W_ERROR_IS_OK(werr)) {
 938                 desc.errcode = W_ERROR_V(werr);
 939                 goto out;
 940         }
 941
 942         if (uLevel==52) {
 943                 uint32_t server_major_version;
 944                 uint32_t server_minor_version;
 945
 946                 werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
 947                                                         &handle,
 948                                                         "Windows 4.0",
 949                                                         3, /* level */
 950                                                         0,
 951                                                         0, /* version */
 952                                                         0,
 953                                                         &driver_info,
 954                                                         &server_major_version,
 955                                                         &server_minor_version);
 956                 if (!W_ERROR_IS_OK(werr)) {
 957                         desc.errcode = W_ERROR_V(werr);
 958                         goto out;
 959                 }
 960
 961                 count = get_printerdrivernumber(&driver_info.info3);
 962                 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
 963         } else {
 964                 uint32_t num_jobs;
 965                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
 966                                                &handle,
 967                                                0, /* firstjob */
 968                                                0xff, /* numjobs */
 969                                                2, /* level */
 970                                                0, /* offered */
 971                                                &num_jobs,
 972                                                &job_info);
 973                 if (!W_ERROR_IS_OK(werr)) {
 974                         desc.errcode = W_ERROR_V(werr);
 975                         goto out;
 976                 }
 977
 978                 count = num_jobs;
 979         }
 980
 981         if (mdrcnt > 0) {
 982                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
 983                 if (!*rdata) {
 984                         return False;
 985                 }
 986                 desc.base = *rdata;
 987                 desc.buflen = mdrcnt;
 988         } else {
 989                 /*
 990                  * Don't return data but need to get correct length
 991                  * init_package will return wrong size if buflen=0
 992                  */
 993                 desc.buflen = getlen(desc.format);
 994                 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
 995         }
 996
 997         if (init_package(&desc,1,count)) {
 998                 desc.subcount = count;
 999                 fill_printq_info(uLevel,&desc,count, job_info, &driver_info.info3, &printer_info.info2);
1000         }
1001
1002         *rdata_len = desc.usedlen;
1003
1004         /*
1005          * We must set the return code to ERRbuftoosmall
1006          * in order to support lanman style printing with Win NT/2k
1007          * clients       --jerry
1008          */
1009         if (!mdrcnt && lp_disable_spoolss())
1010                 desc.errcode = ERRbuftoosmall;
1011
1012  out:
1013         if (b && is_valid_policy_hnd(&handle)) {
1014                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
1015         }
1016
1017         *rdata_len = desc.usedlen;
1018         *rparam_len = 6;
1019         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1020         if (!*rparam) {
1021                 SAFE_FREE(tmpdata);
1022                 return False;
1023         }
1024         SSVALS(*rparam,0,desc.errcode);
1025         SSVAL(*rparam,2,0);
1026         SSVAL(*rparam,4,desc.neededlen);
1027
1028         DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
1029
1030         SAFE_FREE(tmpdata);
1031
1032         return(True);
1033 }
1034
1035 /****************************************************************************
1036  View list of all print jobs on all queues.
1037 ****************************************************************************/
1038
1039 static bool api_DosPrintQEnum(struct smbd_server_connection *sconn,
1040                               connection_struct *conn, uint64_t vuid,
1041                                 char *param, int tpscnt,
1042                                 char *data, int tdscnt,
1043                                 int mdrcnt, int mprcnt,
1044                                 char **rdata, char** rparam,
1045                                 int *rdata_len, int *rparam_len)
1046 {
1047         char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
1048         char *output_format1 = skip_string(param,tpscnt,param_format);
1049         char *p = skip_string(param,tpscnt,output_format1);
1050         unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1051         char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
1052         int i;
1053         struct pack_desc desc;
1054         int *subcntarr = NULL;
1055         int queuecnt = 0, subcnt = 0, succnt = 0;
1056
1057         WERROR werr = WERR_OK;
1058         TALLOC_CTX *mem_ctx = talloc_tos();
1059         NTSTATUS status;
1060         struct rpc_pipe_client *cli = NULL;
1061         struct dcerpc_binding_handle *b = NULL;
1062         struct spoolss_DevmodeContainer devmode_ctr;
1063         uint32_t num_printers;
1064         union spoolss_PrinterInfo *printer_info;
1065         union spoolss_DriverInfo *driver_info;
1066         union spoolss_JobInfo **job_info;
1067
1068         if (!param_format || !output_format1 || !p) {
1069                 return False;
1070         }
1071
1072         memset((char *)&desc,'\0',sizeof(desc));
1073
1074         DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
1075
1076         if (!prefix_ok(param_format,"WrLeh")) {
1077                 return False;
1078         }
1079         if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1080                 /*
1081                  * Patch from Scott Moomaw <scott@bridgewater.edu>
1082                  * to return the 'invalid info level' error if an
1083                  * unknown level was requested.
1084                  */
1085                 *rdata_len = 0;
1086                 *rparam_len = 6;
1087                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1088                 if (!*rparam) {
1089                         return False;
1090                 }
1091                 SSVALS(*rparam,0,ERRunknownlevel);
1092                 SSVAL(*rparam,2,0);
1093                 SSVAL(*rparam,4,0);
1094                 return(True);
1095         }
1096
1097         status = rpc_pipe_open_interface(mem_ctx,
1098                                          &ndr_table_spoolss,
1099                                          conn->session_info,
1100                                          conn->sconn->remote_address,
1101                                          conn->sconn->local_address,
1102                                          conn->sconn->msg_ctx,
1103                                          &cli);
1104         if (!NT_STATUS_IS_OK(status)) {
1105                 DEBUG(0,("api_DosPrintQEnum: could not connect to spoolss: %s\n",
1106                           nt_errstr(status)));
1107                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1108                 goto out;
1109         }
1110         b = cli->binding_handle;
1111
1112         werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
1113                                            PRINTER_ENUM_LOCAL,
1114                                            cli->srv_name_slash,
1115                                            2,
1116                                            0,
1117                                            &num_printers,
1118                                            &printer_info);
1119         if (!W_ERROR_IS_OK(werr)) {
1120                 desc.errcode = W_ERROR_V(werr);
1121                 goto out;
1122         }
1123
1124         queuecnt = num_printers;
1125
1126         job_info = talloc_array(mem_ctx, union spoolss_JobInfo *, num_printers);
1127         if (job_info == NULL) {
1128                 goto err;
1129         }
1130
1131         driver_info = talloc_array(mem_ctx, union spoolss_DriverInfo, num_printers);
1132         if (driver_info == NULL) {
1133                 goto err;
1134         }
1135
1136         if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1137                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1138                 goto err;
1139         }
1140
1141         if (mdrcnt > 0) {
1142                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1143                 if (!*rdata) {
1144                         goto err;
1145                 }
1146         }
1147         desc.base = *rdata;
1148         desc.buflen = mdrcnt;
1149
1150         subcnt = 0;
1151         for (i = 0; i < num_printers; i++) {
1152
1153                 uint32_t num_jobs;
1154                 struct policy_handle handle;
1155                 const char *printername;
1156
1157                 printername = talloc_strdup(mem_ctx, printer_info[i].info2.printername);
1158                 if (printername == NULL) {
1159                         goto err;
1160                 }
1161
1162                 ZERO_STRUCT(handle);
1163                 ZERO_STRUCT(devmode_ctr);
1164
1165                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
1166                                                     printername,
1167                                                     "RAW",
1168                                                     devmode_ctr,
1169                                                     PRINTER_ACCESS_USE,
1170                                                     &handle,
1171                                                     &werr);
1172                 if (!NT_STATUS_IS_OK(status)) {
1173                         desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
1174                         goto out;
1175                 }
1176                 if (!W_ERROR_IS_OK(werr)) {
1177                         desc.errcode = W_ERROR_V(werr);
1178                         goto out;
1179                 }
1180
1181                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
1182                                                &handle,
1183                                                0, /* firstjob */
1184                                                0xff, /* numjobs */
1185                                                2, /* level */
1186                                                0, /* offered */
1187                                                &num_jobs,
1188                                                &job_info[i]);
1189                 if (!W_ERROR_IS_OK(werr)) {
1190                         desc.errcode = W_ERROR_V(werr);
1191                         goto out;
1192                 }
1193
1194                 if (uLevel==52) {
1195                         uint32_t server_major_version;
1196                         uint32_t server_minor_version;
1197
1198                         werr = rpccli_spoolss_getprinterdriver2(cli, mem_ctx,
1199                                                                 &handle,
1200                                                                 "Windows 4.0",
1201                                                                 3, /* level */
1202                                                                 0,
1203                                                                 0, /* version */
1204                                                                 0,
1205                                                                 &driver_info[i],
1206                                                                 &server_major_version,
1207                                                                 &server_minor_version);
1208                         if (!W_ERROR_IS_OK(werr)) {
1209                                 desc.errcode = W_ERROR_V(werr);
1210                                 goto out;
1211                         }
1212                 }
1213
1214                 subcntarr[i] = num_jobs;
1215                 subcnt += subcntarr[i];
1216
1217                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
1218         }
1219
1220         if (init_package(&desc,queuecnt,subcnt)) {
1221                 for (i = 0; i < num_printers; i++) {
1222                         fill_printq_info(uLevel,&desc,subcntarr[i], job_info[i], &driver_info[i].info3, &printer_info[i].info2);
1223                         if (desc.errcode == NERR_Success) {
1224                                 succnt = i;
1225                         }
1226                 }
1227         }
1228
1229  out:
1230         SAFE_FREE(subcntarr);
1231         *rdata_len = desc.usedlen;
1232         *rparam_len = 8;
1233         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1234         if (!*rparam) {
1235                 goto err;
1236         }
1237         SSVALS(*rparam,0,desc.errcode);
1238         SSVAL(*rparam,2,0);
1239         SSVAL(*rparam,4,succnt);
1240         SSVAL(*rparam,6,queuecnt);
1241
1242         return True;
1243
1244   err:
1245
1246         SAFE_FREE(subcntarr);
1247
1248         return False;
1249 }
1250
1251 /****************************************************************************
1252  Get info level for a server list query.
1253 ****************************************************************************/
1254
1255 static bool check_session_info(int uLevel, char* id)
1256 {
1257         switch( uLevel ) {
1258                 case 0:
1259                         if (strcmp(id,"B16") != 0) {
1260                                 return False;
1261                         }
1262                         break;
1263                 case 1:
1264                         if (strcmp(id,"B16BBDz") != 0) {
1265                                 return False;
1266                         }
1267                         break;
1268                 default:
1269                         return False;
1270         }
1271         return True;
1272 }
1273
1274 struct srv_info_struct {
1275         fstring name;
1276         uint32_t type;
1277         fstring comment;
1278         fstring domain;
1279         bool server_added;
1280 };
1281
1282 /*******************************************************************
1283  Get server info lists from the files saved by nmbd. Return the
1284  number of entries.
1285 ******************************************************************/
1286
1287 static int get_session_info(uint32_t servertype,
1288                            struct srv_info_struct **servers,
1289                            const char *domain)
1290 {
1291         int count=0;
1292         int alloced=0;
1293         char **lines;
1294         bool local_list_only;
1295         int i;
1296         char *slist_cache_path = cache_path(talloc_tos(), SERVER_LIST);
1297         if (slist_cache_path == NULL) {
1298                 return 0;
1299         }
1300
1301         lines = file_lines_load(slist_cache_path, NULL, 0, NULL);
1302         if (!lines) {
1303                 DEBUG(4, ("Can't open %s - %s\n",
1304                           slist_cache_path, strerror(errno)));
1305                 TALLOC_FREE(slist_cache_path);
1306                 return 0;
1307         }
1308         TALLOC_FREE(slist_cache_path);
1309
1310         /* request for everything is code for request all servers */
1311         if (servertype == SV_TYPE_ALL) {
1312                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1313         }
1314
1315         local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1316
1317         DEBUG(4,("Servertype search: %8x\n",servertype));
1318
1319         for (i=0;lines[i];i++) {
1320                 fstring stype;
1321                 struct srv_info_struct *s;
1322                 const char *ptr = lines[i];
1323                 bool ok = True;
1324                 TALLOC_CTX *frame = NULL;
1325                 char *p;
1326
1327                 if (!*ptr) {
1328                         continue;
1329                 }
1330
1331                 if (count == alloced) {
1332                         alloced += 10;
1333                         *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1334                         if (!*servers) {
1335                                 DEBUG(0,("get_session_info: failed to enlarge servers info struct!\n"));
1336                                 TALLOC_FREE(lines);
1337                                 return 0;
1338                         }
1339                         memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1340                 }
1341                 s = &(*servers)[count];
1342
1343                 frame = talloc_stackframe();
1344                 s->name[0] = '\0';
1345                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1346                         TALLOC_FREE(frame);
1347                         continue;
1348                 }
1349                 fstrcpy(s->name, p);
1350
1351                 stype[0] = '\0';
1352                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1353                         TALLOC_FREE(frame);
1354                         continue;
1355                 }
1356                 fstrcpy(stype, p);
1357
1358                 s->comment[0] = '\0';
1359                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1360                         TALLOC_FREE(frame);
1361                         continue;
1362                 }
1363                 fstrcpy(s->comment, p);
1364                 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1365
1366                 s->domain[0] = '\0';
1367                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1368                         /* this allows us to cope with an old nmbd */
1369                         fstrcpy(s->domain,lp_workgroup());
1370                 } else {
1371                         fstrcpy(s->domain, p);
1372                 }
1373                 TALLOC_FREE(frame);
1374
1375                 if (sscanf(stype,"%X",&s->type) != 1) {
1376                         DEBUG(4,("r:host file "));
1377                         ok = False;
1378                 }
1379
1380                 /* Filter the servers/domains we return based on what was asked for. */
1381
1382                 /* Check to see if we are being asked for a local list only. */
1383                 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1384                         DEBUG(4,("r: local list only"));
1385                         ok = False;
1386                 }
1387
1388                 /* doesn't match up: don't want it */
1389                 if (!(servertype & s->type)) {
1390                         DEBUG(4,("r:serv type "));
1391                         ok = False;
1392                 }
1393
1394                 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1395                                 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1396                         DEBUG(4,("s: dom mismatch "));
1397                         ok = False;
1398                 }
1399
1400                 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1401                         ok = False;
1402                 }
1403
1404                 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1405                 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1406
1407                 if (ok) {
1408                         DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1409                                 s->name, s->type, s->comment, s->domain));
1410                         s->server_added = True;
1411                         count++;
1412                 } else {
1413                         DEBUG(4,("%20s %8x %25s %15s\n",
1414                                 s->name, s->type, s->comment, s->domain));
1415                 }
1416         }
1417
1418         TALLOC_FREE(lines);
1419         return count;
1420 }
1421
1422 /*******************************************************************
1423  Fill in a server info structure.
1424 ******************************************************************/
1425
1426 static int fill_srv_info(struct srv_info_struct *service,
1427                          int uLevel, char **buf, int *buflen,
1428                          char **stringbuf, int *stringspace, char *baseaddr)
1429 {
1430         int struct_len;
1431         char* p;
1432         char* p2;
1433         int l2;
1434         int len;
1435
1436         switch (uLevel) {
1437                 case 0:
1438                         struct_len = 16;
1439                         break;
1440                 case 1:
1441                         struct_len = 26;
1442                         break;
1443                 default:
1444                         return -1;
1445         }
1446
1447         if (!buf) {
1448                 len = 0;
1449                 switch (uLevel) {
1450                         case 1:
1451                                 len = strlen(service->comment)+1;
1452                                 break;
1453                 }
1454
1455                 *buflen = struct_len;
1456                 *stringspace = len;
1457                 return struct_len + len;
1458         }
1459
1460         len = struct_len;
1461         p = *buf;
1462         if (*buflen < struct_len) {
1463                 return -1;
1464         }
1465         if (stringbuf) {
1466                 p2 = *stringbuf;
1467                 l2 = *stringspace;
1468         } else {
1469                 p2 = p + struct_len;
1470                 l2 = *buflen - struct_len;
1471         }
1472         if (!baseaddr) {
1473                 baseaddr = p;
1474         }
1475
1476         switch (uLevel) {
1477                 case 0:
1478                         push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1479                         break;
1480
1481                 case 1:
1482                         push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1483                         SIVAL(p,18,service->type);
1484                         SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1485                         len += CopyAndAdvance(&p2,service->comment,&l2);
1486                         break;
1487         }
1488
1489         if (stringbuf) {
1490                 *buf = p + struct_len;
1491                 *buflen -= struct_len;
1492                 *stringbuf = p2;
1493                 *stringspace = l2;
1494         } else {
1495                 *buf = p2;
1496                 *buflen -= len;
1497         }
1498         return len;
1499 }
1500
1501
1502 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1503 {
1504         return strcasecmp_m(s1->name,s2->name);
1505 }
1506
1507 /****************************************************************************
1508  View list of servers available (or possibly domains). The info is
1509  extracted from lists saved by nmbd on the local host.
1510 ****************************************************************************/
1511
1512 static bool api_RNetServerEnum2(struct smbd_server_connection *sconn,
1513                                 connection_struct *conn, uint64_t vuid,
1514                                 char *param, int tpscnt,
1515                                 char *data, int tdscnt,
1516                                 int mdrcnt, int mprcnt, char **rdata,
1517                                 char **rparam, int *rdata_len, int *rparam_len)
1518 {
1519         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1520         char *str2 = skip_string(param,tpscnt,str1);
1521         char *p = skip_string(param,tpscnt,str2);
1522         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1523         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1524         uint32_t servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1525         char *p2;
1526         int data_len, fixed_len, string_len;
1527         int f_len = 0, s_len = 0;
1528         struct srv_info_struct *servers=NULL;
1529         int counted=0,total=0;
1530         int i,missed;
1531         fstring domain;
1532         bool domain_request;
1533         bool local_request;
1534
1535         if (!str1 || !str2 || !p) {
1536                 return False;
1537         }
1538
1539         /* If someone sets all the bits they don't really mean to set
1540            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1541            known servers. */
1542
1543         if (servertype == SV_TYPE_ALL) {
1544                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1545         }
1546
1547         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1548            any other bit (they may just set this bit on its own) they
1549            want all the locally seen servers. However this bit can be
1550            set on its own so set the requested servers to be
1551            ALL - DOMAIN_ENUM. */
1552
1553         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1554                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1555         }
1556
1557         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1558         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1559
1560         p += 8;
1561
1562         if (!prefix_ok(str1,"WrLehD")) {
1563                 return False;
1564         }
1565         if (!check_session_info(uLevel,str2)) {
1566                 return False;
1567         }
1568
1569         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1570         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1571         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1572
1573         if (strcmp(str1, "WrLehDz") == 0) {
1574                 if (skip_string(param,tpscnt,p) == NULL) {
1575                         return False;
1576                 }
1577                 pull_ascii_fstring(domain, p);
1578         } else {
1579                 fstrcpy(domain, lp_workgroup());
1580         }
1581
1582         DEBUG(4, ("domain [%s]\n", domain));
1583
1584         if (lp_browse_list()) {
1585                 total = get_session_info(servertype,&servers,domain);
1586         }
1587
1588         data_len = fixed_len = string_len = 0;
1589         missed = 0;
1590
1591         TYPESAFE_QSORT(servers, total, srv_comp);
1592
1593         {
1594                 char *lastname=NULL;
1595
1596                 for (i=0;i<total;i++) {
1597                         struct srv_info_struct *s = &servers[i];
1598
1599                         if (lastname && strequal(lastname,s->name)) {
1600                                 continue;
1601                         }
1602                         lastname = s->name;
1603                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1604                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1605                                 i, s->name, s->type, s->comment, s->domain));
1606
1607                         if (data_len < buf_len) {
1608                                 counted++;
1609                                 fixed_len += f_len;
1610                                 string_len += s_len;
1611                         } else {
1612                                 missed++;
1613                         }
1614                 }
1615         }
1616
1617         *rdata_len = fixed_len + string_len;
1618         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1619         if (!*rdata) {
1620                 return False;
1621         }
1622
1623         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
1624         p = *rdata;
1625         f_len = fixed_len;
1626         s_len = string_len;
1627
1628         {
1629                 char *lastname=NULL;
1630                 int count2 = counted;
1631
1632                 for (i = 0; i < total && count2;i++) {
1633                         struct srv_info_struct *s = &servers[i];
1634
1635                         if (lastname && strequal(lastname,s->name)) {
1636                                 continue;
1637                         }
1638                         lastname = s->name;
1639                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1640                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1641                                 i, s->name, s->type, s->comment, s->domain));
1642                         count2--;
1643                 }
1644         }
1645
1646         *rparam_len = 8;
1647         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1648         if (!*rparam) {
1649                 return False;
1650         }
1651         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1652         SSVAL(*rparam,2,0);
1653         SSVAL(*rparam,4,counted);
1654         SSVAL(*rparam,6,counted+missed);
1655
1656         SAFE_FREE(servers);
1657
1658         DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1659                 domain,uLevel,counted,counted+missed));
1660
1661         return True;
1662 }
1663
1664 static int srv_name_match(const char *n1, const char *n2)
1665 {
1666         /*
1667          * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1668          *
1669          *  In Windows, FirstNameToReturn need not be an exact match:
1670          *  the server will return a list of servers that exist on
1671          *  the network greater than or equal to the FirstNameToReturn.
1672          */
1673         int ret = strcasecmp_m(n1, n2);
1674
1675         if (ret <= 0) {
1676                 return 0;
1677         }
1678
1679         return ret;
1680 }
1681
1682 static bool api_RNetServerEnum3(struct smbd_server_connection *sconn,
1683                                 connection_struct *conn, uint64_t vuid,
1684                                 char *param, int tpscnt,
1685                                 char *data, int tdscnt,
1686                                 int mdrcnt, int mprcnt, char **rdata,
1687                                 char **rparam, int *rdata_len, int *rparam_len)
1688 {
1689         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1690         char *str2 = skip_string(param,tpscnt,str1);
1691         char *p = skip_string(param,tpscnt,str2);
1692         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1693         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1694         uint32_t servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1695         char *p2;
1696         int data_len, fixed_len, string_len;
1697         int f_len = 0, s_len = 0;
1698         struct srv_info_struct *servers=NULL;
1699         int counted=0,first=0,total=0;
1700         int i,missed;
1701         fstring domain;
1702         fstring first_name;
1703         bool domain_request;
1704         bool local_request;
1705
1706         if (!str1 || !str2 || !p) {
1707                 return False;
1708         }
1709
1710         /* If someone sets all the bits they don't really mean to set
1711            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1712            known servers. */
1713
1714         if (servertype == SV_TYPE_ALL) {
1715                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1716         }
1717
1718         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1719            any other bit (they may just set this bit on its own) they
1720            want all the locally seen servers. However this bit can be
1721            set on its own so set the requested servers to be
1722            ALL - DOMAIN_ENUM. */
1723
1724         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1725                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1726         }
1727
1728         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1729         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1730
1731         p += 8;
1732
1733         if (strcmp(str1, "WrLehDzz") != 0) {
1734                 return false;
1735         }
1736         if (!check_session_info(uLevel,str2)) {
1737                 return False;
1738         }
1739
1740         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1741         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1742         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1743
1744         if (skip_string(param,tpscnt,p) == NULL) {
1745                 return False;
1746         }
1747         pull_ascii_fstring(domain, p);
1748         if (domain[0] == '\0') {
1749                 fstrcpy(domain, lp_workgroup());
1750         }
1751         p = skip_string(param,tpscnt,p);
1752         if (skip_string(param,tpscnt,p) == NULL) {
1753                 return False;
1754         }
1755         pull_ascii_fstring(first_name, p);
1756
1757         DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1758                   domain, first_name));
1759
1760         if (lp_browse_list()) {
1761                 total = get_session_info(servertype,&servers,domain);
1762         }
1763
1764         data_len = fixed_len = string_len = 0;
1765         missed = 0;
1766
1767         TYPESAFE_QSORT(servers, total, srv_comp);
1768
1769         if (first_name[0] != '\0') {
1770                 struct srv_info_struct *first_server = NULL;
1771
1772                 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1773                                     srv_name_match, first_server);
1774                 if (first_server) {
1775                         first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1776                         /*
1777                          * The binary search may not find the exact match
1778                          * so we need to search backward to find the first match
1779                          *
1780                          * This implements the strange matching windows
1781                          * implements. (see the comment in srv_name_match().
1782                          */
1783                         for (;first > 0;) {
1784                                 int ret;
1785                                 ret = strcasecmp_m(first_name,
1786                                                  servers[first-1].name);
1787                                 if (ret > 0) {
1788                                         break;
1789                                 }
1790                                 first--;
1791                         }
1792                 } else {
1793                         /* we should return no entries */
1794                         first = total;
1795                 }
1796         }
1797
1798         {
1799                 char *lastname=NULL;
1800
1801                 for (i=first;i<total;i++) {
1802                         struct srv_info_struct *s = &servers[i];
1803
1804                         if (lastname && strequal(lastname,s->name)) {
1805                                 continue;
1806                         }
1807                         lastname = s->name;
1808                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1809                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1810                                 i, s->name, s->type, s->comment, s->domain));
1811
1812                         if (data_len < buf_len) {
1813                                 counted++;
1814                                 fixed_len += f_len;
1815                                 string_len += s_len;
1816                         } else {
1817                                 missed++;
1818                         }
1819                 }
1820         }
1821
1822         *rdata_len = fixed_len + string_len;
1823         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1824         if (!*rdata) {
1825                 return False;
1826         }
1827
1828         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
1829         p = *rdata;
1830         f_len = fixed_len;
1831         s_len = string_len;
1832
1833         {
1834                 char *lastname=NULL;
1835                 int count2 = counted;
1836
1837                 for (i = first; i < total && count2;i++) {
1838                         struct srv_info_struct *s = &servers[i];
1839
1840                         if (lastname && strequal(lastname,s->name)) {
1841                                 continue;
1842                         }
1843                         lastname = s->name;
1844                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1845                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1846                                 i, s->name, s->type, s->comment, s->domain));
1847                         count2--;
1848                 }
1849         }
1850
1851         *rparam_len = 8;
1852         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1853         if (!*rparam) {
1854                 return False;
1855         }
1856         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1857         SSVAL(*rparam,2,0);
1858         SSVAL(*rparam,4,counted);
1859         SSVAL(*rparam,6,counted+missed);
1860
1861         DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1862                 domain,uLevel,first,first_name,
1863                 first < total ? servers[first].name : "",
1864                 counted,counted+missed));
1865
1866         SAFE_FREE(servers);
1867
1868         return True;
1869 }
1870
1871 /****************************************************************************
1872   command 0x34 - suspected of being a "Lookup Names" stub api
1873   ****************************************************************************/
1874
1875 static bool api_RNetGroupGetUsers(struct smbd_server_connection *sconn,
1876                                   connection_struct *conn, uint64_t vuid,
1877                                 char *param, int tpscnt,
1878                                 char *data, int tdscnt,
1879                                 int mdrcnt, int mprcnt, char **rdata,
1880                                 char **rparam, int *rdata_len, int *rparam_len)
1881 {
1882         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1883         char *str2 = skip_string(param,tpscnt,str1);
1884         char *p = skip_string(param,tpscnt,str2);
1885         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1886         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1887         int counted=0;
1888         int missed=0;
1889
1890         if (!str1 || !str2 || !p) {
1891                 return False;
1892         }
1893
1894         DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1895                 str1, str2, p, uLevel, buf_len));
1896
1897         if (!prefix_ok(str1,"zWrLeh")) {
1898                 return False;
1899         }
1900
1901         *rdata_len = 0;
1902
1903         *rparam_len = 8;
1904         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1905         if (!*rparam) {
1906                 return False;
1907         }
1908
1909         SSVAL(*rparam,0,0x08AC); /* informational warning message */
1910         SSVAL(*rparam,2,0);
1911         SSVAL(*rparam,4,counted);
1912         SSVAL(*rparam,6,counted+missed);
1913
1914         return True;
1915 }
1916
1917 /****************************************************************************
1918   get info about a share
1919   ****************************************************************************/
1920
1921 static bool check_share_info(int uLevel, char* id)
1922 {
1923         switch( uLevel ) {
1924                 case 0:
1925                         if (strcmp(id,"B13") != 0) {
1926                                 return False;
1927                         }
1928                         break;
1929                 case 1:
1930                         /* Level-2 descriptor is allowed (and ignored) */
1931                         if (strcmp(id,"B13BWz") != 0 &&
1932                             strcmp(id,"B13BWzWWWzB9B") != 0) {
1933                                 return False;
1934                         }
1935                         break;
1936                 case 2:
1937                         if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1938                                 return False;
1939                         }
1940                         break;
1941                 case 91:
1942                         if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1943                                 return False;
1944                         }
1945                         break;
1946                 default:
1947                         return False;
1948         }
1949         return True;
1950 }
1951
1952 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1953                            char** buf, int* buflen,
1954                            char** stringbuf, int* stringspace, char* baseaddr)
1955 {
1956         const struct loadparm_substitution *lp_sub =
1957                 loadparm_s3_global_substitution();
1958         int struct_len;
1959         char* p;
1960         char* p2;
1961         int l2;
1962         int len;
1963
1964         switch( uLevel ) {
1965                 case 0:
1966                         struct_len = 13;
1967                         break;
1968                 case 1:
1969                         struct_len = 20;
1970                         break;
1971                 case 2:
1972                         struct_len = 40;
1973                         break;
1974                 case 91:
1975                         struct_len = 68;
1976                         break;
1977                 default:
1978                         return -1;
1979         }
1980
1981         if (!buf) {
1982                 len = 0;
1983
1984                 if (uLevel > 0) {
1985                         len += StrlenExpanded(conn,snum,lp_comment(talloc_tos(), lp_sub, snum));
1986                 }
1987                 if (uLevel > 1) {
1988                         len += strlen(lp_path(talloc_tos(), lp_sub, snum)) + 1;
1989                 }
1990                 if (buflen) {
1991                         *buflen = struct_len;
1992                 }
1993                 if (stringspace) {
1994                         *stringspace = len;
1995                 }
1996                 return struct_len + len;
1997         }
1998
1999         len = struct_len;
2000         p = *buf;
2001         if ((*buflen) < struct_len) {
2002                 return -1;
2003         }
2004
2005         if (stringbuf) {
2006                 p2 = *stringbuf;
2007                 l2 = *stringspace;
2008         } else {
2009                 p2 = p + struct_len;
2010                 l2 = (*buflen) - struct_len;
2011         }
2012
2013         if (!baseaddr) {
2014                 baseaddr = p;
2015         }
2016
2017         push_ascii(p,lp_servicename(talloc_tos(), lp_sub, snum),13, STR_TERMINATE);
2018
2019         if (uLevel > 0) {
2020                 int type;
2021
2022                 SCVAL(p,13,0);
2023                 type = STYPE_DISKTREE;
2024                 if (lp_printable(snum)) {
2025                         type = STYPE_PRINTQ;
2026                 }
2027                 if (strequal("IPC",lp_fstype(snum))) {
2028                         type = STYPE_IPC;
2029                 }
2030                 SSVAL(p,14,type);               /* device type */
2031                 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
2032                 len += CopyExpanded(conn,snum,&p2,lp_comment(talloc_tos(), lp_sub, snum),&l2);
2033         }
2034
2035         if (uLevel > 1) {
2036                 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
2037                 SSVALS(p,22,-1);                /* max uses */
2038                 SSVAL(p,24,1); /* current uses */
2039                 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
2040                 len += CopyAndAdvance(&p2,lp_path(talloc_tos(),lp_sub, snum),&l2);
2041                 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
2042         }
2043
2044         if (uLevel > 2) {
2045                 memset(p+40,0,SHPWLEN+2);
2046                 SSVAL(p,50,0);
2047                 SIVAL(p,52,0);
2048                 SSVAL(p,56,0);
2049                 SSVAL(p,58,0);
2050                 SIVAL(p,60,0);
2051                 SSVAL(p,64,0);
2052                 SSVAL(p,66,0);
2053         }
2054
2055         if (stringbuf) {
2056                 (*buf) = p + struct_len;
2057                 (*buflen) -= struct_len;
2058                 (*stringbuf) = p2;
2059                 (*stringspace) = l2;
2060         } else {
2061                 (*buf) = p2;
2062                 (*buflen) -= len;
2063         }
2064
2065         return len;
2066 }
2067
2068 static bool api_RNetShareGetInfo(struct smbd_server_connection *sconn,
2069                                  connection_struct *conn,uint64_t vuid,
2070                                 char *param, int tpscnt,
2071                                 char *data, int tdscnt,
2072                                 int mdrcnt,int mprcnt,
2073                                 char **rdata,char **rparam,
2074                                 int *rdata_len,int *rparam_len)
2075 {
2076         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2077         char *str2 = skip_string(param,tpscnt,str1);
2078         char *netname_in = skip_string(param,tpscnt,str2);
2079         char *netname = NULL;
2080         char *p = skip_string(param,tpscnt,netname);
2081         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2082         int snum;
2083
2084         if (!str1 || !str2 || !netname_in || !p) {
2085                 return False;
2086         }
2087
2088         snum = find_service(talloc_tos(), netname_in, &netname);
2089         if (snum < 0 || !netname) {
2090                 return False;
2091         }
2092
2093         /* check it's a supported variant */
2094         if (!prefix_ok(str1,"zWrLh")) {
2095                 return False;
2096         }
2097         if (!check_share_info(uLevel,str2)) {
2098                 return False;
2099         }
2100
2101         *rdata = smb_realloc_limit(*rdata,mdrcnt);
2102         if (!*rdata) {
2103                 return False;
2104         }
2105         p = *rdata;
2106         *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
2107         if (*rdata_len < 0) {
2108                 return False;
2109         }
2110
2111         *rparam_len = 6;
2112         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2113         if (!*rparam) {
2114                 return False;
2115         }
2116         SSVAL(*rparam,0,NERR_Success);
2117         SSVAL(*rparam,2,0);             /* converter word */
2118         SSVAL(*rparam,4,*rdata_len);
2119
2120         return True;
2121 }
2122
2123 /****************************************************************************
2124   View the list of available shares.
2125
2126   This function is the server side of the NetShareEnum() RAP call.
2127   It fills the return buffer with share names and share comments.
2128   Note that the return buffer normally (in all known cases) allows only
2129   twelve byte strings for share names (plus one for a nul terminator).
2130   Share names longer than 12 bytes must be skipped.
2131  ****************************************************************************/
2132
2133 static bool api_RNetShareEnum(struct smbd_server_connection *sconn,
2134                               connection_struct *conn, uint64_t vuid,
2135                                 char *param, int tpscnt,
2136                                 char *data, int tdscnt,
2137                                 int                mdrcnt,
2138                                 int                mprcnt,
2139                                 char             **rdata,
2140                                 char             **rparam,
2141                                 int               *rdata_len,
2142                                 int               *rparam_len )
2143 {
2144         const struct loadparm_substitution *lp_sub =
2145                 loadparm_s3_global_substitution();
2146         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2147         char *str2 = skip_string(param,tpscnt,str1);
2148         char *p = skip_string(param,tpscnt,str2);
2149         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2150         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
2151         char *p2;
2152         int count = 0;
2153         int total=0,counted=0;
2154         bool missed = False;
2155         int i;
2156         int data_len, fixed_len, string_len;
2157         int f_len = 0, s_len = 0;
2158
2159         if (!str1 || !str2 || !p) {
2160                 return False;
2161         }
2162
2163         if (!prefix_ok(str1,"WrLeh")) {
2164                 return False;
2165         }
2166         if (!check_share_info(uLevel,str2)) {
2167                 return False;
2168         }
2169
2170         /* Ensure all the usershares are loaded. */
2171         become_root();
2172         delete_and_reload_printers();
2173         load_registry_shares();
2174         count = load_usershare_shares(NULL, connections_snum_used);
2175         unbecome_root();
2176
2177         data_len = fixed_len = string_len = 0;
2178         for (i=0;i<count;i++) {
2179                 fstring servicename_dos;
2180                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2181                         continue;
2182                 }
2183                 push_ascii_fstring(servicename_dos, lp_servicename(talloc_tos(), lp_sub, i));
2184                 /* Maximum name length = 13. */
2185                 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2186                         total++;
2187                         data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2188                         if (data_len < buf_len) {
2189                                 counted++;
2190                                 fixed_len += f_len;
2191                                 string_len += s_len;
2192                         } else {
2193                                 missed = True;
2194                         }
2195                 }
2196         }
2197
2198         *rdata_len = fixed_len + string_len;
2199         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2200         if (!*rdata) {
2201                 return False;
2202         }
2203
2204         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
2205         p = *rdata;
2206         f_len = fixed_len;
2207         s_len = string_len;
2208
2209         for( i = 0; i < count; i++ ) {
2210                 fstring servicename_dos;
2211                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2212                         continue;
2213                 }
2214
2215                 push_ascii_fstring(servicename_dos,
2216                                    lp_servicename(talloc_tos(), lp_sub, i));
2217                 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2218                         if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2219                                 break;
2220                         }
2221                 }
2222         }
2223
2224         *rparam_len = 8;
2225         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2226         if (!*rparam) {
2227                 return False;
2228         }
2229         SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2230         SSVAL(*rparam,2,0);
2231         SSVAL(*rparam,4,counted);
2232         SSVAL(*rparam,6,total);
2233
2234         DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2235                 counted,total,uLevel,
2236                 buf_len,*rdata_len,mdrcnt));
2237
2238         return True;
2239 }
2240
2241 /****************************************************************************
2242   Add a share
2243   ****************************************************************************/
2244
2245 static bool api_RNetShareAdd(struct smbd_server_connection *sconn,
2246                              connection_struct *conn,uint64_t vuid,
2247                                 char *param, int tpscnt,
2248                                 char *data, int tdscnt,
2249                                 int mdrcnt,int mprcnt,
2250                                 char **rdata,char **rparam,
2251                                 int *rdata_len,int *rparam_len)
2252 {
2253         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2254         char *str2 = skip_string(param,tpscnt,str1);
2255         char *p = skip_string(param,tpscnt,str2);
2256         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2257         fstring sharename;
2258         fstring comment;
2259         char *pathname = NULL;
2260         unsigned int offset;
2261         int res = ERRunsup;
2262         size_t converted_size;
2263
2264         WERROR werr = WERR_OK;
2265         TALLOC_CTX *mem_ctx = talloc_tos();
2266         NTSTATUS status;
2267         struct rpc_pipe_client *cli = NULL;
2268         union srvsvc_NetShareInfo info;
2269         struct srvsvc_NetShareInfo2 info2;
2270         struct dcerpc_binding_handle *b;
2271
2272         if (!str1 || !str2 || !p) {
2273                 return False;
2274         }
2275
2276         /* check it's a supported variant */
2277         if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2278                 return False;
2279         }
2280         if (!check_share_info(uLevel,str2)) {
2281                 return False;
2282         }
2283         if (uLevel != 2) {
2284                 return False;
2285         }
2286
2287         /* Do we have a string ? */
2288         if (skip_string(data,mdrcnt,data) == NULL) {
2289                 return False;
2290         }
2291         pull_ascii_fstring(sharename,data);
2292
2293         if (mdrcnt < 28) {
2294                 return False;
2295         }
2296
2297         /* only support disk share adds */
2298         if (SVAL(data,14)!=STYPE_DISKTREE) {
2299                 return False;
2300         }
2301
2302         offset = IVAL(data, 16);
2303         if (offset >= mdrcnt) {
2304                 res = ERRinvalidparam;
2305                 goto out;
2306         }
2307
2308         /* Do we have a string ? */
2309         if (skip_string(data,mdrcnt,data+offset) == NULL) {
2310                 return False;
2311         }
2312         pull_ascii_fstring(comment, offset? (data+offset) : "");
2313
2314         offset = IVAL(data, 26);
2315
2316         if (offset >= mdrcnt) {
2317                 res = ERRinvalidparam;
2318                 goto out;
2319         }
2320
2321         /* Do we have a string ? */
2322         if (skip_string(data,mdrcnt,data+offset) == NULL) {
2323                 return False;
2324         }
2325
2326         if (!pull_ascii_talloc(talloc_tos(), &pathname,
2327                                offset ? (data+offset) : "", &converted_size))
2328         {
2329                 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s\n",
2330                          strerror(errno)));
2331         }
2332
2333         if (!pathname) {
2334                 return false;
2335         }
2336
2337         status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc,
2338                                         conn->session_info,
2339                                         conn->sconn->remote_address,
2340                                         conn->sconn->local_address,
2341                                         conn->sconn->msg_ctx,
2342                                         &cli);
2343         if (!NT_STATUS_IS_OK(status)) {
2344                 DEBUG(0,("api_RNetShareAdd: could not connect to srvsvc: %s\n",
2345                           nt_errstr(status)));
2346                 res = W_ERROR_V(ntstatus_to_werror(status));
2347                 goto out;
2348         }
2349
2350         b = cli->binding_handle;
2351
2352         info2.name              = sharename;
2353         info2.type              = STYPE_DISKTREE;
2354         info2.comment           = comment;
2355         info2.permissions       = 0;
2356         info2.max_users         = 0;
2357         info2.current_users     = 0;
2358         info2.path              = pathname;
2359         info2.password          = NULL;
2360
2361         info.info2 = &info2;
2362
2363         status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
2364                                            cli->srv_name_slash,
2365                                            2,
2366                                            &info,
2367                                            NULL,
2368                                            &werr);
2369         if (!NT_STATUS_IS_OK(status)) {
2370                 res = W_ERROR_V(ntstatus_to_werror(status));
2371                 goto out;
2372         }
2373         if (!W_ERROR_IS_OK(werr)) {
2374                 res = W_ERROR_V(werr);
2375                 goto out;
2376         }
2377
2378         *rparam_len = 6;
2379         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2380         if (!*rparam) {
2381                 return False;
2382         }
2383         SSVAL(*rparam,0,NERR_Success);
2384         SSVAL(*rparam,2,0);             /* converter word */
2385         SSVAL(*rparam,4,*rdata_len);
2386         *rdata_len = 0;
2387
2388         return True;
2389
2390   out:
2391
2392         *rparam_len = 4;
2393         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2394         if (!*rparam) {
2395                 return False;
2396         }
2397         *rdata_len = 0;
2398         SSVAL(*rparam,0,res);
2399         SSVAL(*rparam,2,0);
2400         return True;
2401 }
2402
2403 /****************************************************************************
2404   view list of groups available
2405   ****************************************************************************/
2406
2407 static bool api_RNetGroupEnum(struct smbd_server_connection *sconn,
2408                               connection_struct *conn,uint64_t vuid,
2409                                 char *param, int tpscnt,
2410                                 char *data, int tdscnt,
2411                                 int mdrcnt,int mprcnt,
2412                                 char **rdata,char **rparam,
2413                                 int *rdata_len,int *rparam_len)
2414 {
2415         int i;
2416         int errflags=0;
2417         int resume_context, cli_buf_size;
2418         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2419         char *str2 = skip_string(param,tpscnt,str1);
2420         char *p = skip_string(param,tpscnt,str2);
2421
2422         uint32_t num_groups;
2423         uint32_t resume_handle;
2424         struct rpc_pipe_client *samr_pipe = NULL;
2425         struct policy_handle samr_handle, domain_handle;
2426         NTSTATUS status, result;
2427         struct dcerpc_binding_handle *b;
2428
2429         if (!str1 || !str2 || !p) {
2430                 return False;
2431         }
2432
2433         if (strcmp(str1,"WrLeh") != 0) {
2434                 return False;
2435         }
2436
2437         /* parameters
2438          * W-> resume context (number of users to skip)
2439          * r -> return parameter pointer to receive buffer
2440          * L -> length of receive buffer
2441          * e -> return parameter number of entries
2442          * h -> return parameter total number of users
2443          */
2444
2445         if (strcmp("B21",str2) != 0) {
2446                 return False;
2447         }
2448
2449         status = rpc_pipe_open_interface(
2450                 talloc_tos(), &ndr_table_samr,
2451                 conn->session_info, conn->sconn->remote_address,
2452                 conn->sconn->local_address, conn->sconn->msg_ctx, &samr_pipe);
2453         if (!NT_STATUS_IS_OK(status)) {
2454                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2455                           nt_errstr(status)));
2456                 return false;
2457         }
2458
2459         b = samr_pipe->binding_handle;
2460
2461         status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2462                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2463                                       &result);
2464         if (!NT_STATUS_IS_OK(status)) {
2465                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2466                           nt_errstr(status)));
2467                 return false;
2468         }
2469         if (!NT_STATUS_IS_OK(result)) {
2470                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2471                           nt_errstr(result)));
2472                 return false;
2473         }
2474
2475         status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2476                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2477                                         get_global_sam_sid(), &domain_handle,
2478                                         &result);
2479         if (!NT_STATUS_IS_OK(status)) {
2480                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2481                           nt_errstr(status)));
2482                 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2483                 return false;
2484         }
2485         if (!NT_STATUS_IS_OK(result)) {
2486                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2487                           nt_errstr(result)));
2488                 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2489                 return false;
2490         }
2491
2492         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2493         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2494         DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2495                   "%d\n", resume_context, cli_buf_size));
2496
2497         *rdata_len = cli_buf_size;
2498         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2499         if (!*rdata) {
2500                 return False;
2501         }
2502
2503         p = *rdata;
2504
2505         errflags = NERR_Success;
2506         num_groups = 0;
2507         resume_handle = 0;
2508
2509         while (true) {
2510                 struct samr_SamArray *sam_entries;
2511                 uint32_t num_entries;
2512
2513                 status = dcerpc_samr_EnumDomainGroups(b, talloc_tos(),
2514                                                       &domain_handle,
2515                                                       &resume_handle,
2516                                                       &sam_entries, 1,
2517                                                       &num_entries,
2518                                                       &result);
2519                 if (!NT_STATUS_IS_OK(status)) {
2520                         DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2521                                    "%s\n", nt_errstr(status)));
2522                         break;
2523                 }
2524                 if (!NT_STATUS_IS_OK(result)) {
2525                         status = result;
2526                         DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2527                                    "%s\n", nt_errstr(result)));
2528                         break;
2529                 }
2530
2531                 if (num_entries == 0) {
2532                         DEBUG(10, ("dcerpc_samr_EnumDomainGroups returned "
2533                                    "no entries -- done\n"));
2534                         break;
2535                 }
2536
2537                 for(i=0; i<num_entries; i++) {
2538                         const char *name;
2539
2540                         name = sam_entries->entries[i].name.string;
2541
2542                         if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2543                                 /* set overflow error */
2544                                 DEBUG(3,("overflow on entry %d group %s\n", i,
2545                                          name));
2546                                 errflags=234;
2547                                 break;
2548                         }
2549
2550                         /* truncate the name at 21 chars. */
2551                         memset(p, 0, 21);
2552                         strlcpy(p, name, 21);
2553                         DEBUG(10,("adding entry %d group %s\n", i, p));
2554                         p += 21;
2555                         p += 5; /* Both NT4 and W2k3SP1 do padding here.  No
2556                                  * idea why... */
2557                         num_groups += 1;
2558                 }
2559
2560                 if (errflags != NERR_Success) {
2561                         break;
2562                 }
2563
2564                 TALLOC_FREE(sam_entries);
2565         }
2566
2567         dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2568         dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2569
2570         *rdata_len = PTR_DIFF(p,*rdata);
2571
2572         *rparam_len = 8;
2573         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2574         if (!*rparam) {
2575                 return False;
2576         }
2577         SSVAL(*rparam, 0, errflags);
2578         SSVAL(*rparam, 2, 0);           /* converter word */
2579         SSVAL(*rparam, 4, num_groups);  /* is this right?? */
2580         SSVAL(*rparam, 6, resume_context+num_groups);   /* is this right?? */
2581
2582         return(True);
2583 }
2584
2585 /*******************************************************************
2586  Get groups that a user is a member of.
2587 ******************************************************************/
2588
2589 static bool api_NetUserGetGroups(struct smbd_server_connection *sconn,
2590                                  connection_struct *conn,uint64_t vuid,
2591                                 char *param, int tpscnt,
2592                                 char *data, int tdscnt,
2593                                 int mdrcnt,int mprcnt,
2594                                 char **rdata,char **rparam,
2595                                 int *rdata_len,int *rparam_len)
2596 {
2597         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2598         char *str2 = skip_string(param,tpscnt,str1);
2599         char *UserName = skip_string(param,tpscnt,str2);
2600         char *p = skip_string(param,tpscnt,UserName);
2601         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2602         const char *level_string;
2603         int count=0;
2604         bool ret = False;
2605         uint32_t i;
2606         char *endp = NULL;
2607
2608         struct rpc_pipe_client *samr_pipe = NULL;
2609         struct policy_handle samr_handle, domain_handle, user_handle;
2610         struct lsa_String name;
2611         struct lsa_Strings names;
2612         struct samr_Ids type, rid;
2613         struct samr_RidWithAttributeArray *rids;
2614         NTSTATUS status, result;
2615         struct dcerpc_binding_handle *b;
2616
2617         if (!str1 || !str2 || !UserName || !p) {
2618                 return False;
2619         }
2620
2621         *rparam_len = 8;
2622         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2623         if (!*rparam) {
2624                 return False;
2625         }
2626
2627         /* check it's a supported variant */
2628
2629         if ( strcmp(str1,"zWrLeh") != 0 )
2630                 return False;
2631
2632         switch( uLevel ) {
2633                 case 0:
2634                         level_string = "B21";
2635                         break;
2636                 default:
2637                         return False;
2638         }
2639
2640         if (strcmp(level_string,str2) != 0)
2641                 return False;
2642
2643         *rdata_len = mdrcnt + 1024;
2644         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2645         if (!*rdata) {
2646                 return False;
2647         }
2648
2649         SSVAL(*rparam,0,NERR_Success);
2650         SSVAL(*rparam,2,0);             /* converter word */
2651
2652         p = *rdata;
2653         endp = *rdata + *rdata_len;
2654
2655         status = rpc_pipe_open_interface(
2656                 talloc_tos(), &ndr_table_samr,
2657                 conn->session_info, conn->sconn->remote_address,
2658                 conn->sconn->local_address, conn->sconn->msg_ctx, &samr_pipe);
2659         if (!NT_STATUS_IS_OK(status)) {
2660                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2661                           nt_errstr(status)));
2662                 return false;
2663         }
2664
2665         b = samr_pipe->binding_handle;
2666
2667         status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2668                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2669                                       &result);
2670         if (!NT_STATUS_IS_OK(status)) {
2671                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2672                           nt_errstr(status)));
2673                 return false;
2674         }
2675         if (!NT_STATUS_IS_OK(result)) {
2676                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2677                           nt_errstr(result)));
2678                 return false;
2679         }
2680
2681         status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2682                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2683                                         get_global_sam_sid(), &domain_handle,
2684                                         &result);
2685         if (!NT_STATUS_IS_OK(status)) {
2686                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2687                           nt_errstr(status)));
2688                 goto close_sam;
2689         }
2690         if (!NT_STATUS_IS_OK(result)) {
2691                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2692                           nt_errstr(result)));
2693                 goto close_sam;
2694         }
2695
2696         name.string = UserName;
2697
2698         status = dcerpc_samr_LookupNames(b, talloc_tos(),
2699                                          &domain_handle, 1, &name,
2700                                          &rid, &type,
2701                                          &result);
2702         if (!NT_STATUS_IS_OK(status)) {
2703                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2704                           nt_errstr(status)));
2705                 goto close_domain;
2706         }
2707         if (!NT_STATUS_IS_OK(result)) {
2708                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2709                           nt_errstr(result)));
2710                 goto close_domain;
2711         }
2712         if (rid.count != 1) {
2713                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2714                 goto close_domain;
2715         }
2716         if (type.count != 1) {
2717                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2718                 goto close_domain;
2719         }
2720
2721         if (type.ids[0] != SID_NAME_USER) {
2722                 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2723                            sid_type_lookup(type.ids[0])));
2724                 goto close_domain;
2725         }
2726
2727         status = dcerpc_samr_OpenUser(b, talloc_tos(),
2728                                       &domain_handle,
2729                                       SAMR_USER_ACCESS_GET_GROUPS,
2730                                       rid.ids[0], &user_handle,
2731                                       &result);
2732         if (!NT_STATUS_IS_OK(status)) {
2733                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2734                           nt_errstr(status)));
2735                 goto close_domain;
2736         }
2737         if (!NT_STATUS_IS_OK(result)) {
2738                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2739                           nt_errstr(result)));
2740                 goto close_domain;
2741         }
2742
2743         status = dcerpc_samr_GetGroupsForUser(b, talloc_tos(),
2744                                               &user_handle, &rids,
2745                                               &result);
2746         if (!NT_STATUS_IS_OK(status)) {
2747                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2748                           nt_errstr(status)));
2749                 goto close_user;
2750         }
2751         if (!NT_STATUS_IS_OK(result)) {
2752                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2753                           nt_errstr(result)));
2754                 goto close_user;
2755         }
2756
2757         for (i=0; i<rids->count; i++) {
2758
2759                 status = dcerpc_samr_LookupRids(b, talloc_tos(),
2760                                                 &domain_handle,
2761                                                 1, &rids->rids[i].rid,
2762                                                 &names, &type,
2763                                                 &result);
2764                 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result) && (names.count == 1)) {
2765                         strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2766                         p += 21;
2767                         count++;
2768                 }
2769         }
2770
2771         *rdata_len = PTR_DIFF(p,*rdata);
2772
2773         SSVAL(*rparam,4,count); /* is this right?? */
2774         SSVAL(*rparam,6,count); /* is this right?? */
2775
2776         ret = True;
2777
2778  close_user:
2779         dcerpc_samr_Close(b, talloc_tos(), &user_handle, &result);
2780  close_domain:
2781         dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2782  close_sam:
2783         dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2784
2785         return ret;
2786 }
2787
2788 /*******************************************************************
2789  Get all users.
2790 ******************************************************************/
2791
2792 static bool api_RNetUserEnum(struct smbd_server_connection *sconn,
2793                              connection_struct *conn, uint64_t vuid,
2794                                 char *param, int tpscnt,
2795                                 char *data, int tdscnt,
2796                                 int mdrcnt,int mprcnt,
2797                                 char **rdata,char **rparam,
2798                                 int *rdata_len,int *rparam_len)
2799 {
2800         int count_sent=0;
2801         int num_users=0;
2802         int errflags=0;
2803         int i, resume_context, cli_buf_size;
2804         uint32_t resume_handle;
2805
2806         struct rpc_pipe_client *samr_pipe = NULL;
2807         struct policy_handle samr_handle, domain_handle;
2808         NTSTATUS status, result;
2809
2810         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2811         char *str2 = skip_string(param,tpscnt,str1);
2812         char *p = skip_string(param,tpscnt,str2);
2813         char *endp = NULL;
2814
2815         struct dcerpc_binding_handle *b;
2816
2817         if (!str1 || !str2 || !p) {
2818                 return False;
2819         }
2820
2821         if (strcmp(str1,"WrLeh") != 0)
2822                 return False;
2823         /* parameters
2824           * W-> resume context (number of users to skip)
2825           * r -> return parameter pointer to receive buffer
2826           * L -> length of receive buffer
2827           * e -> return parameter number of entries
2828           * h -> return parameter total number of users
2829           */
2830
2831         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2832         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2833         DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2834                         resume_context, cli_buf_size));
2835
2836         *rparam_len = 8;
2837         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2838         if (!*rparam) {
2839                 return False;
2840         }
2841
2842         /* check it's a supported variant */
2843         if (strcmp("B21",str2) != 0)
2844                 return False;
2845
2846         *rdata_len = cli_buf_size;
2847         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2848         if (!*rdata) {
2849                 return False;
2850         }
2851
2852         p = *rdata;
2853         endp = *rdata + *rdata_len;
2854
2855         status = rpc_pipe_open_interface(
2856                 talloc_tos(), &ndr_table_samr,
2857                 conn->session_info, conn->sconn->remote_address,
2858                 conn->sconn->local_address, conn->sconn->msg_ctx, &samr_pipe);
2859         if (!NT_STATUS_IS_OK(status)) {
2860                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2861                           nt_errstr(status)));
2862                 return false;
2863         }
2864
2865         b = samr_pipe->binding_handle;
2866
2867         status = dcerpc_samr_Connect2(b, talloc_tos(), lp_netbios_name(),
2868                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle,
2869                                       &result);
2870         if (!NT_STATUS_IS_OK(status)) {
2871                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2872                           nt_errstr(status)));
2873                 return false;
2874         }
2875         if (!NT_STATUS_IS_OK(result)) {
2876                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2877                           nt_errstr(result)));
2878                 return false;
2879         }
2880
2881         status = dcerpc_samr_OpenDomain(b, talloc_tos(), &samr_handle,
2882                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2883                                         get_global_sam_sid(), &domain_handle,
2884                                         &result);
2885         if (!NT_STATUS_IS_OK(status)) {
2886                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2887                           nt_errstr(status)));
2888                 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2889                 return false;
2890         }
2891         if (!NT_STATUS_IS_OK(result)) {
2892                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2893                           nt_errstr(result)));
2894                 dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2895                 return false;
2896         }
2897
2898         errflags=NERR_Success;
2899
2900         resume_handle = 0;
2901
2902         while (true) {
2903                 struct samr_SamArray *sam_entries;
2904                 uint32_t num_entries;
2905
2906                 status = dcerpc_samr_EnumDomainUsers(b, talloc_tos(),
2907                                                      &domain_handle,
2908                                                      &resume_handle,
2909                                                      0, &sam_entries, 1,
2910                                                      &num_entries,
2911                                                      &result);
2912
2913                 if (!NT_STATUS_IS_OK(status)) {
2914                         DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2915                                    "%s\n", nt_errstr(status)));
2916                         break;
2917                 }
2918                 if (!NT_STATUS_IS_OK(result)) {
2919                         DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2920                                    "%s\n", nt_errstr(result)));
2921                         break;
2922                 }
2923
2924                 if (num_entries == 0) {
2925                         DEBUG(10, ("dcerpc_samr_EnumDomainUsers returned "
2926                                    "no entries -- done\n"));
2927                         break;
2928                 }
2929
2930                 for (i=0; i<num_entries; i++) {
2931                         const char *name;
2932
2933                         name = sam_entries->entries[i].name.string;
2934
2935                         if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2936                            &&(strlen(name)<=21)) {
2937                                 strlcpy(p,name,PTR_DIFF(endp,p));
2938                                 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2939                                           "username %s\n",count_sent,p));
2940                                 p += 21;
2941                                 count_sent++;
2942                         } else {
2943                                 /* set overflow error */
2944                                 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2945                                           "username %s\n",count_sent,name));
2946                                 errflags=234;
2947                                 break;
2948                         }
2949                 }
2950
2951                 if (errflags != NERR_Success) {
2952                         break;
2953                 }
2954
2955                 TALLOC_FREE(sam_entries);
2956         }
2957
2958         dcerpc_samr_Close(b, talloc_tos(), &domain_handle, &result);
2959         dcerpc_samr_Close(b, talloc_tos(), &samr_handle, &result);
2960
2961         *rdata_len = PTR_DIFF(p,*rdata);
2962
2963         SSVAL(*rparam,0,errflags);
2964         SSVAL(*rparam,2,0);           /* converter word */
2965         SSVAL(*rparam,4,count_sent);  /* is this right?? */
2966         SSVAL(*rparam,6,num_users); /* is this right?? */
2967
2968         return True;
2969 }
2970
2971 /****************************************************************************
2972  Get the time of day info.
2973 ****************************************************************************/
2974
2975 static bool api_NetRemoteTOD(struct smbd_server_connection *sconn,
2976                              connection_struct *conn,uint64_t vuid,
2977                                 char *param, int tpscnt,
2978                                 char *data, int tdscnt,
2979                                 int mdrcnt,int mprcnt,
2980                                 char **rdata,char **rparam,
2981                                 int *rdata_len,int *rparam_len)
2982 {
2983         struct tm *t;
2984         time_t unixdate = time(NULL);
2985         char *p;
2986
2987         *rparam_len = 4;
2988         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2989         if (!*rparam) {
2990                 return False;
2991         }
2992
2993         *rdata_len = 21;
2994         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2995         if (!*rdata) {
2996                 return False;
2997         }
2998
2999         SSVAL(*rparam,0,NERR_Success);
3000         SSVAL(*rparam,2,0);             /* converter word */
3001
3002         p = *rdata;
3003
3004         srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
3005                                             by NT in a "net time" operation,
3006                                             it seems to ignore the one below */
3007
3008         /* the client expects to get localtime, not GMT, in this bit
3009                 (I think, this needs testing) */
3010         t = localtime(&unixdate);
3011         if (!t) {
3012                 return False;
3013         }
3014
3015         SIVAL(p,4,0);           /* msecs ? */
3016         SCVAL(p,8,t->tm_hour);
3017         SCVAL(p,9,t->tm_min);
3018         SCVAL(p,10,t->tm_sec);
3019         SCVAL(p,11,0);          /* hundredths of seconds */
3020         SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
3021         SSVAL(p,14,10000);              /* timer interval in 0.0001 of sec */
3022         SCVAL(p,16,t->tm_mday);
3023         SCVAL(p,17,t->tm_mon + 1);
3024         SSVAL(p,18,1900+t->tm_year);
3025         SCVAL(p,20,t->tm_wday);
3026
3027         return True;
3028 }
3029
3030 /****************************************************************************
3031   Set the user password (SamOEM version - gets plaintext).
3032 ****************************************************************************/
3033
3034 static bool api_SamOEMChangePassword(struct smbd_server_connection *sconn,
3035                                      connection_struct *conn,uint64_t vuid,
3036                                 char *param, int tpscnt,
3037                                 char *data, int tdscnt,
3038                                 int mdrcnt,int mprcnt,
3039                                 char **rdata,char **rparam,
3040                                 int *rdata_len,int *rparam_len)
3041 {
3042         fstring user;
3043         char *p = get_safe_str_ptr(param,tpscnt,param,2);
3044
3045         TALLOC_CTX *mem_ctx = talloc_tos();
3046         NTSTATUS status, result;
3047         struct rpc_pipe_client *cli = NULL;
3048         struct lsa_AsciiString server, account;
3049         struct samr_CryptPassword password;
3050         struct samr_Password hash;
3051         int errcode = NERR_badpass;
3052         int bufsize;
3053         struct dcerpc_binding_handle *b;
3054
3055         *rparam_len = 4;
3056         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3057         if (!*rparam) {
3058                 return False;
3059         }
3060
3061         if (!p) {
3062                 return False;
3063         }
3064         *rdata_len = 0;
3065
3066         SSVAL(*rparam,0,NERR_badpass);
3067
3068         /*
3069          * Check the parameter definition is correct.
3070          */
3071
3072         /* Do we have a string ? */
3073         if (skip_string(param,tpscnt,p) == 0) {
3074                 return False;
3075         }
3076         if(!strequal(p, "zsT")) {
3077                 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
3078                 return False;
3079         }
3080         p = skip_string(param, tpscnt, p);
3081         if (!p) {
3082                 return False;
3083         }
3084
3085         /* Do we have a string ? */
3086         if (skip_string(param,tpscnt,p) == 0) {
3087                 return False;
3088         }
3089         if(!strequal(p, "B516B16")) {
3090                 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
3091                 return False;
3092         }
3093         p = skip_string(param,tpscnt,p);
3094         if (!p) {
3095                 return False;
3096         }
3097         /* Do we have a string ? */
3098         if (skip_string(param,tpscnt,p) == 0) {
3099                 return False;
3100         }
3101         p += pull_ascii_fstring(user,p);
3102
3103         DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
3104
3105         if (tdscnt != 532) {
3106                 errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
3107                 goto out;
3108         }
3109
3110         bufsize = get_safe_SVAL(param,tpscnt,p,0,-1);
3111         if (bufsize != 532) {
3112                 errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
3113                 goto out;
3114         }
3115
3116         memcpy(password.data, data, 516);
3117         memcpy(hash.hash, data+516, 16);
3118
3119         status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr,
3120                                         conn->session_info,
3121                                         conn->sconn->remote_address,
3122                                         conn->sconn->local_address,
3123                                         conn->sconn->msg_ctx,
3124                                         &cli);
3125         if (!NT_STATUS_IS_OK(status)) {
3126                 DEBUG(0,("api_SamOEMChangePassword: could not connect to samr: %s\n",
3127                           nt_errstr(status)));
3128                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3129                 goto out;
3130         }
3131
3132         b = cli->binding_handle;
3133
3134         init_lsa_AsciiString(&server, lp_netbios_name());
3135         init_lsa_AsciiString(&account, user);
3136
3137         status = dcerpc_samr_OemChangePasswordUser2(b, mem_ctx,
3138                                                     &server,
3139                                                     &account,
3140                                                     &password,
3141                                                     &hash,
3142                                                     &result);
3143         if (!NT_STATUS_IS_OK(status)) {
3144                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3145                 goto out;
3146         }
3147         if (!NT_STATUS_IS_OK(result)) {
3148                 errcode = W_ERROR_V(ntstatus_to_werror(result));
3149                 goto out;
3150         }
3151
3152         errcode = NERR_Success;
3153  out:
3154         SSVAL(*rparam,0,errcode);
3155         SSVAL(*rparam,2,0);             /* converter word */
3156
3157         return(True);
3158 }
3159
3160 /****************************************************************************
3161   delete a print job
3162   Form: <W> <>
3163   ****************************************************************************/
3164
3165 static bool api_RDosPrintJobDel(struct smbd_server_connection *sconn,
3166                                 connection_struct *conn,uint64_t vuid,
3167                                 char *param, int tpscnt,
3168                                 char *data, int tdscnt,
3169                                 int mdrcnt,int mprcnt,
3170                                 char **rdata,char **rparam,
3171                                 int *rdata_len,int *rparam_len)
3172 {
3173         int function = get_safe_SVAL(param,tpscnt,param,0,0);
3174         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3175         char *str2 = skip_string(param,tpscnt,str1);
3176         char *p = skip_string(param,tpscnt,str2);
3177         uint32_t jobid;
3178         fstring sharename;
3179         int errcode;
3180         WERROR werr = WERR_OK;
3181
3182         TALLOC_CTX *mem_ctx = talloc_tos();
3183         NTSTATUS status;
3184         struct rpc_pipe_client *cli = NULL;
3185         struct dcerpc_binding_handle *b = NULL;
3186         struct policy_handle handle;
3187         struct spoolss_DevmodeContainer devmode_ctr;
3188         enum spoolss_JobControl command;
3189
3190         if (!str1 || !str2 || !p) {
3191                 return False;
3192         }
3193         /*
3194          * We use 1 here not 2 as we're checking
3195          * the last byte we want to access is safe.
3196          */
3197         if (!is_offset_safe(param,tpscnt,p,1)) {
3198                 return False;
3199         }
3200         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3201                 return False;
3202
3203         /* check it's a supported variant */
3204         if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
3205                 return(False);
3206
3207         *rparam_len = 4;
3208         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3209         if (!*rparam) {
3210                 return False;
3211         }
3212         *rdata_len = 0;
3213
3214         ZERO_STRUCT(handle);
3215
3216         status = rpc_pipe_open_interface(mem_ctx,
3217                                          &ndr_table_spoolss,
3218                                          conn->session_info,
3219                                          conn->sconn->remote_address,
3220                                          conn->sconn->local_address,
3221                                          conn->sconn->msg_ctx,
3222                                          &cli);
3223         if (!NT_STATUS_IS_OK(status)) {
3224                 DEBUG(0,("api_RDosPrintJobDel: could not connect to spoolss: %s\n",
3225                           nt_errstr(status)));
3226                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3227                 goto out;
3228         }
3229         b = cli->binding_handle;
3230
3231         ZERO_STRUCT(devmode_ctr);
3232
3233         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3234                                             sharename,
3235                                             "RAW",
3236                                             devmode_ctr,
3237                                             JOB_ACCESS_ADMINISTER,
3238                                             &handle,
3239                                             &werr);
3240         if (!NT_STATUS_IS_OK(status)) {
3241                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3242                 goto out;
3243         }
3244         if (!W_ERROR_IS_OK(werr)) {
3245                 errcode = W_ERROR_V(werr);
3246                 goto out;
3247         }
3248
3249         /* FIXME: formerly NERR_JobNotFound was returned if job did not exist
3250          * and NERR_DestNotFound if share did not exist */
3251
3252         errcode = NERR_Success;
3253
3254         switch (function) {
3255         case 81:                /* delete */
3256                 command = SPOOLSS_JOB_CONTROL_DELETE;
3257                 break;
3258         case 82:                /* pause */
3259                 command = SPOOLSS_JOB_CONTROL_PAUSE;
3260                 break;
3261         case 83:                /* resume */
3262                 command = SPOOLSS_JOB_CONTROL_RESUME;
3263                 break;
3264         default:
3265                 errcode = NERR_notsupported;
3266                 goto out;
3267         }
3268
3269         status = dcerpc_spoolss_SetJob(b, mem_ctx,
3270                                        &handle,
3271                                        jobid,
3272                                        NULL, /* unique ptr ctr */
3273                                        command,
3274                                        &werr);
3275         if (!NT_STATUS_IS_OK(status)) {
3276                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3277                 goto out;
3278         }
3279         if (!W_ERROR_IS_OK(werr)) {
3280                 errcode = W_ERROR_V(werr);
3281                 goto out;
3282         }
3283
3284  out:
3285         if (b && is_valid_policy_hnd(&handle)) {
3286                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3287         }
3288
3289         SSVAL(*rparam,0,errcode);
3290         SSVAL(*rparam,2,0);             /* converter word */
3291
3292         return(True);
3293 }
3294
3295 /****************************************************************************
3296   Purge a print queue - or pause or resume it.
3297   ****************************************************************************/
3298
3299 static bool api_WPrintQueueCtrl(struct smbd_server_connection *sconn,
3300                                 connection_struct *conn,uint64_t vuid,
3301                                 char *param, int tpscnt,
3302                                 char *data, int tdscnt,
3303                                 int mdrcnt,int mprcnt,
3304                                 char **rdata,char **rparam,
3305                                 int *rdata_len,int *rparam_len)
3306 {
3307         int function = get_safe_SVAL(param,tpscnt,param,0,0);
3308         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3309         char *str2 = skip_string(param,tpscnt,str1);
3310         char *QueueName = skip_string(param,tpscnt,str2);
3311         int errcode = NERR_notsupported;
3312         WERROR werr = WERR_OK;
3313         NTSTATUS status;
3314
3315         TALLOC_CTX *mem_ctx = talloc_tos();
3316         struct rpc_pipe_client *cli = NULL;
3317         struct dcerpc_binding_handle *b = NULL;
3318         struct policy_handle handle;
3319         struct spoolss_SetPrinterInfoCtr info_ctr;
3320         struct spoolss_DevmodeContainer devmode_ctr;
3321         struct sec_desc_buf secdesc_ctr;
3322         enum spoolss_PrinterControl command = SPOOLSS_PRINTER_CONTROL_UNPAUSE;
3323
3324         if (!str1 || !str2 || !QueueName) {
3325                 return False;
3326         }
3327
3328         /* check it's a supported variant */
3329         if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3330                 return(False);
3331
3332         *rparam_len = 4;
3333         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3334         if (!*rparam) {
3335                 return False;
3336         }
3337         *rdata_len = 0;
3338
3339         if (skip_string(param,tpscnt,QueueName) == NULL) {
3340                 return False;
3341         }
3342
3343         ZERO_STRUCT(handle);
3344
3345         status = rpc_pipe_open_interface(mem_ctx,
3346                                          &ndr_table_spoolss,
3347                                          conn->session_info,
3348                                          conn->sconn->remote_address,
3349                                          conn->sconn->local_address,
3350                                          conn->sconn->msg_ctx,
3351                                          &cli);
3352         if (!NT_STATUS_IS_OK(status)) {
3353                 DEBUG(0,("api_WPrintQueueCtrl: could not connect to spoolss: %s\n",
3354                           nt_errstr(status)));
3355                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3356                 goto out;
3357         }
3358         b = cli->binding_handle;
3359
3360         ZERO_STRUCT(devmode_ctr);
3361
3362         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3363                                             QueueName,
3364                                             NULL,
3365                                             devmode_ctr,
3366                                             PRINTER_ACCESS_ADMINISTER,
3367                                             &handle,
3368                                             &werr);
3369         if (!NT_STATUS_IS_OK(status)) {
3370                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3371                 goto out;
3372         }
3373         if (!W_ERROR_IS_OK(werr)) {
3374                 errcode = W_ERROR_V(werr);
3375                 goto out;
3376         }
3377
3378         switch (function) {
3379         case 74: /* Pause queue */
3380                 command = SPOOLSS_PRINTER_CONTROL_PAUSE;
3381                 break;
3382         case 75: /* Resume queue */
3383                 command = SPOOLSS_PRINTER_CONTROL_RESUME;
3384                 break;
3385         case 103: /* Purge */
3386                 command = SPOOLSS_PRINTER_CONTROL_PURGE;
3387                 break;
3388         default:
3389                 werr = WERR_NOT_SUPPORTED;
3390                 break;
3391         }
3392
3393         if (!W_ERROR_IS_OK(werr)) {
3394                 errcode = W_ERROR_V(werr);
3395                 goto out;
3396         }
3397
3398         ZERO_STRUCT(info_ctr);
3399         ZERO_STRUCT(secdesc_ctr);
3400
3401         status = dcerpc_spoolss_SetPrinter(b, mem_ctx,
3402                                            &handle,
3403                                            &info_ctr,
3404                                            &devmode_ctr,
3405                                            &secdesc_ctr,
3406                                            command,
3407                                            &werr);
3408         if (!NT_STATUS_IS_OK(status)) {
3409                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3410                 goto out;
3411         }
3412         if (!W_ERROR_IS_OK(werr)) {
3413                 errcode = W_ERROR_V(werr);
3414                 goto out;
3415         }
3416
3417         errcode = W_ERROR_V(werr);
3418
3419  out:
3420
3421         if (b && is_valid_policy_hnd(&handle)) {
3422                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3423         }
3424
3425         SSVAL(*rparam,0,errcode);
3426         SSVAL(*rparam,2,0);             /* converter word */
3427
3428         return(True);
3429 }
3430
3431 /****************************************************************************
3432   set the property of a print job (undocumented?)
3433   ? function = 0xb -> set name of print job
3434   ? function = 0x6 -> move print job up/down
3435   Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3436   or   <WWsTP> <WB21BB16B10zWWzDDz>
3437 ****************************************************************************/
3438
3439 static int check_printjob_info(struct pack_desc* desc,
3440                                int uLevel, char* id)
3441 {
3442         desc->subformat = NULL;
3443         switch( uLevel ) {
3444         case 0: desc->format = "W"; break;
3445         case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3446         case 2: desc->format = "WWzWWDDzz"; break;
3447         case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3448         case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3449         default:
3450                 DEBUG(0,("check_printjob_info: invalid level %d\n",
3451                         uLevel ));
3452                 return False;
3453         }
3454         if (id == NULL || strcmp(desc->format,id) != 0) {
3455                 DEBUG(0,("check_printjob_info: invalid format %s\n",
3456                         id ? id : "<NULL>" ));
3457                 return False;
3458         }
3459         return True;
3460 }
3461
3462 static bool api_PrintJobInfo(struct smbd_server_connection *sconn,
3463                              connection_struct *conn, uint64_t vuid,
3464                                 char *param, int tpscnt,
3465                                 char *data, int tdscnt,
3466                                 int mdrcnt,int mprcnt,
3467                                 char **rdata,char **rparam,
3468                                 int *rdata_len,int *rparam_len)
3469 {
3470         struct pack_desc desc;
3471         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3472         char *str2 = skip_string(param,tpscnt,str1);
3473         char *p = skip_string(param,tpscnt,str2);
3474         uint32_t jobid;
3475         fstring sharename;
3476         int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3477         int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3478         int errcode;
3479
3480         TALLOC_CTX *mem_ctx = talloc_tos();
3481         WERROR werr;
3482         NTSTATUS status;
3483         struct rpc_pipe_client *cli = NULL;
3484         struct dcerpc_binding_handle *b = NULL;
3485         struct policy_handle handle;
3486         struct spoolss_DevmodeContainer devmode_ctr;
3487         struct spoolss_JobInfoContainer ctr;
3488         union spoolss_JobInfo info;
3489         struct spoolss_SetJobInfo1 info1;
3490
3491         if (!str1 || !str2 || !p) {
3492                 return False;
3493         }
3494         /*
3495          * We use 1 here not 2 as we're checking
3496          * the last byte we want to access is safe.
3497          */
3498         if (!is_offset_safe(param,tpscnt,p,1)) {
3499                 return False;
3500         }
3501         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3502                 return False;
3503         *rparam_len = 4;
3504         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3505         if (!*rparam) {
3506                 return False;
3507         }
3508
3509         *rdata_len = 0;
3510
3511         /* check it's a supported variant */
3512         if ((strcmp(str1,"WWsTP")) ||
3513             (!check_printjob_info(&desc,uLevel,str2)))
3514                 return(False);
3515
3516         errcode = NERR_notsupported;
3517
3518         switch (function) {
3519         case 0xb:
3520                 /* change print job name, data gives the name */
3521                 break;
3522         default:
3523                 goto out;
3524         }
3525
3526         ZERO_STRUCT(handle);
3527
3528         status = rpc_pipe_open_interface(mem_ctx,
3529                                          &ndr_table_spoolss,
3530                                          conn->session_info,
3531                                          conn->sconn->remote_address,
3532                                          conn->sconn->local_address,
3533                                          conn->sconn->msg_ctx,
3534                                          &cli);
3535         if (!NT_STATUS_IS_OK(status)) {
3536                 DEBUG(0,("api_PrintJobInfo: could not connect to spoolss: %s\n",
3537                           nt_errstr(status)));
3538                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3539                 goto out;
3540         }
3541         b = cli->binding_handle;
3542
3543         ZERO_STRUCT(devmode_ctr);
3544
3545         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
3546                                             sharename,
3547                                             "RAW",
3548                                             devmode_ctr,
3549                                             PRINTER_ACCESS_USE,
3550                                             &handle,
3551                                             &werr);
3552         if (!NT_STATUS_IS_OK(status)) {
3553                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3554                 goto out;
3555         }
3556         if (!W_ERROR_IS_OK(werr)) {
3557                 errcode = W_ERROR_V(werr);
3558                 goto out;
3559         }
3560
3561         werr = rpccli_spoolss_getjob(cli, mem_ctx,
3562                                      &handle,
3563                                      jobid,
3564                                      1, /* level */
3565                                      0, /* offered */
3566                                      &info);
3567         if (!W_ERROR_IS_OK(werr)) {
3568                 errcode = W_ERROR_V(werr);
3569                 goto out;
3570         }
3571
3572         ZERO_STRUCT(ctr);
3573
3574         info1.job_id            = info.info1.job_id;
3575         info1.printer_name      = info.info1.printer_name;
3576         info1.user_name         = info.info1.user_name;
3577         info1.document_name     = data;
3578         info1.data_type         = info.info1.data_type;
3579         info1.text_status       = info.info1.text_status;
3580         info1.status            = info.info1.status;
3581         info1.priority          = info.info1.priority;
3582         info1.position          = info.info1.position;
3583         info1.total_pages       = info.info1.total_pages;
3584         info1.pages_printed     = info.info1.pages_printed;
3585         info1.submitted         = info.info1.submitted;
3586
3587         ctr.level = 1;
3588         ctr.info.info1 = &info1;
3589
3590         status = dcerpc_spoolss_SetJob(b, mem_ctx,
3591                                        &handle,
3592                                        jobid,
3593                                        &ctr,
3594                                        0,
3595                                        &werr);
3596         if (!NT_STATUS_IS_OK(status)) {
3597                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3598                 goto out;
3599         }
3600         if (!W_ERROR_IS_OK(werr)) {
3601                 errcode = W_ERROR_V(werr);
3602                 goto out;
3603         }
3604
3605         errcode = NERR_Success;
3606  out:
3607
3608         if (b && is_valid_policy_hnd(&handle)) {
3609                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
3610         }
3611
3612         SSVALS(*rparam,0,errcode);
3613         SSVAL(*rparam,2,0);             /* converter word */
3614
3615         return(True);
3616 }
3617
3618
3619 /****************************************************************************
3620  Get info about the server.
3621 ****************************************************************************/
3622
3623 static bool api_RNetServerGetInfo(struct smbd_server_connection *sconn,
3624                                   connection_struct *conn,uint64_t vuid,
3625                                 char *param, int tpscnt,
3626                                 char *data, int tdscnt,
3627                                 int mdrcnt,int mprcnt,
3628                                 char **rdata,char **rparam,
3629                                 int *rdata_len,int *rparam_len)
3630 {
3631         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3632         char *str2 = skip_string(param,tpscnt,str1);
3633         char *p = skip_string(param,tpscnt,str2);
3634         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3635         char *p2;
3636         int struct_len;
3637
3638         NTSTATUS status;
3639         WERROR werr;
3640         TALLOC_CTX *mem_ctx = talloc_tos();
3641         struct rpc_pipe_client *cli = NULL;
3642         union srvsvc_NetSrvInfo info;
3643         int errcode;
3644         struct dcerpc_binding_handle *b;
3645
3646         if (!str1 || !str2 || !p) {
3647                 return False;
3648         }
3649
3650         DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3651
3652         /* check it's a supported variant */
3653         if (!prefix_ok(str1,"WrLh")) {
3654                 return False;
3655         }
3656
3657         switch( uLevel ) {
3658                 case 0:
3659                         if (strcmp(str2,"B16") != 0) {
3660                                 return False;
3661                         }
3662                         struct_len = 16;
3663                         break;
3664                 case 1:
3665                         if (strcmp(str2,"B16BBDz") != 0) {
3666                                 return False;
3667                         }
3668                         struct_len = 26;
3669                         break;
3670                 case 2:
3671                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3672                                 return False;
3673                         }
3674                         struct_len = 134;
3675                         break;
3676                 case 3:
3677                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3678                                 return False;
3679                         }
3680                         struct_len = 144;
3681                         break;
3682                 case 20:
3683                         if (strcmp(str2,"DN") != 0) {
3684                                 return False;
3685                         }
3686                         struct_len = 6;
3687                         break;
3688                 case 50:
3689                         if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3690                                 return False;
3691                         }
3692                         struct_len = 42;
3693                         break;
3694                 default:
3695                         return False;
3696         }
3697
3698         *rdata_len = mdrcnt;
3699         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3700         if (!*rdata) {
3701                 return False;
3702         }
3703
3704         p = *rdata;
3705         p2 = p + struct_len;
3706
3707         status = rpc_pipe_open_interface(mem_ctx, &ndr_table_srvsvc,
3708                                         conn->session_info,
3709                                         conn->sconn->remote_address,
3710                                         conn->sconn->local_address,
3711                                         conn->sconn->msg_ctx,
3712                                         &cli);
3713         if (!NT_STATUS_IS_OK(status)) {
3714                 DEBUG(0,("api_RNetServerGetInfo: could not connect to srvsvc: %s\n",
3715                           nt_errstr(status)));
3716                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3717                 goto out;
3718         }
3719
3720         b = cli->binding_handle;
3721
3722         status = dcerpc_srvsvc_NetSrvGetInfo(b, mem_ctx,
3723                                              NULL,
3724                                              101,
3725                                              &info,
3726                                              &werr);
3727         if (!NT_STATUS_IS_OK(status)) {
3728                 errcode = W_ERROR_V(ntstatus_to_werror(status));
3729                 goto out;
3730         }
3731         if (!W_ERROR_IS_OK(werr)) {
3732                 errcode = W_ERROR_V(werr);
3733                 goto out;
3734         }
3735
3736         if (info.info101 == NULL) {
3737                 errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
3738                 goto out;
3739         }
3740
3741         if (uLevel != 20) {
3742                 size_t len = 0;
3743                 status = srvstr_push(NULL, 0, p, info.info101->server_name, 16,
3744                         STR_ASCII|STR_UPPER|STR_TERMINATE, &len);
3745                 if (!NT_STATUS_IS_OK(status)) {
3746                         errcode = W_ERROR_V(ntstatus_to_werror(status));
3747                         goto out;
3748                 }
3749         }
3750         p += 16;
3751         if (uLevel > 0) {
3752                 SCVAL(p,0,info.info101->version_major);
3753                 SCVAL(p,1,info.info101->version_minor);
3754                 SIVAL(p,2,info.info101->server_type);
3755
3756                 if (mdrcnt == struct_len) {
3757                         SIVAL(p,6,0);
3758                 } else {
3759                         SIVAL(p,6,PTR_DIFF(p2,*rdata));
3760                         if (mdrcnt - struct_len <= 0) {
3761                                 return false;
3762                         }
3763                         push_ascii(p2,
3764                                 info.info101->comment,
3765                                 MIN(mdrcnt - struct_len,
3766                                         MAX_SERVER_STRING_LENGTH),
3767                                 STR_TERMINATE);
3768                         p2 = skip_string(*rdata,*rdata_len,p2);
3769                         if (!p2) {
3770                                 return False;
3771                         }
3772                 }
3773         }
3774
3775         if (uLevel > 1) {
3776                 return False;           /* not yet implemented */
3777         }
3778
3779         errcode = NERR_Success;
3780
3781  out:
3782
3783         *rdata_len = PTR_DIFF(p2,*rdata);
3784
3785         *rparam_len = 6;
3786         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3787         if (!*rparam) {
3788                 return False;
3789         }
3790         SSVAL(*rparam,0,errcode);
3791         SSVAL(*rparam,2,0);             /* converter word */
3792         SSVAL(*rparam,4,*rdata_len);
3793
3794         return True;
3795 }
3796
3797 /****************************************************************************
3798  Get info about the server.
3799 ****************************************************************************/
3800
3801 static bool api_NetWkstaGetInfo(struct smbd_server_connection *sconn,
3802                                 connection_struct *conn,uint64_t vuid,
3803                                 char *param, int tpscnt,
3804                                 char *data, int tdscnt,
3805                                 int mdrcnt,int mprcnt,
3806                                 char **rdata,char **rparam,
3807                                 int *rdata_len,int *rparam_len)
3808 {
3809         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3810         char *str2 = skip_string(param,tpscnt,str1);
3811         char *p = skip_string(param,tpscnt,str2);
3812         char *p2;
3813         char *endp;
3814         int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3815
3816         if (!str1 || !str2 || !p) {
3817                 return False;
3818         }
3819
3820         DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3821
3822         *rparam_len = 6;
3823         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3824         if (!*rparam) {
3825                 return False;
3826         }
3827
3828         /* check it's a supported variant */
3829         if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3830                 return False;
3831         }
3832
3833         *rdata_len = mdrcnt + 1024;
3834         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3835         if (!*rdata) {
3836                 return False;
3837         }
3838
3839         SSVAL(*rparam,0,NERR_Success);
3840         SSVAL(*rparam,2,0);             /* converter word */
3841
3842         p = *rdata;
3843         endp = *rdata + *rdata_len;
3844
3845         p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3846         if (!p2) {
3847                 return False;
3848         }
3849
3850         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3851         strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3852         if (!strupper_m(p2)) {
3853                 return false;
3854         }
3855         p2 = skip_string(*rdata,*rdata_len,p2);
3856         if (!p2) {
3857                 return False;
3858         }
3859         p += 4;
3860
3861         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3862         strlcpy(p2,conn->session_info->unix_info->sanitized_username,PTR_DIFF(endp,p2));
3863         p2 = skip_string(*rdata,*rdata_len,p2);
3864         if (!p2) {
3865                 return False;
3866         }
3867         p += 4;
3868
3869         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3870         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3871         if (!strupper_m(p2)) {
3872                 return false;
3873         }
3874         p2 = skip_string(*rdata,*rdata_len,p2);
3875         if (!p2) {
3876                 return False;
3877         }
3878         p += 4;
3879
3880         SCVAL(p,0,SAMBA_MAJOR_NBT_ANNOUNCE_VERSION); /* system version - e.g 4 in 4.1 */
3881         SCVAL(p,1,SAMBA_MINOR_NBT_ANNOUNCE_VERSION); /* system version - e.g .1 in 4.1 */
3882         p += 2;
3883
3884         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3885         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));   /* don't know.  login domain?? */
3886         p2 = skip_string(*rdata,*rdata_len,p2);
3887         if (!p2) {
3888                 return False;
3889         }
3890         p += 4;
3891
3892         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3893         strlcpy(p2,"",PTR_DIFF(endp,p2));
3894         p2 = skip_string(*rdata,*rdata_len,p2);
3895         if (!p2) {
3896                 return False;
3897         }
3898         p += 4;
3899
3900         *rdata_len = PTR_DIFF(p2,*rdata);
3901
3902         SSVAL(*rparam,4,*rdata_len);
3903
3904         return True;
3905 }
3906
3907 /****************************************************************************
3908   get info about a user
3909
3910     struct user_info_11 {
3911         char                usri11_name[21];  0-20
3912         char                usri11_pad;       21
3913         char                *usri11_comment;  22-25
3914         char            *usri11_usr_comment;  26-29
3915         unsigned short      usri11_priv;      30-31
3916         unsigned long       usri11_auth_flags; 32-35
3917         long                usri11_password_age; 36-39
3918         char                *usri11_homedir; 40-43
3919         char            *usri11_parms; 44-47
3920         long                usri11_last_logon; 48-51
3921         long                usri11_last_logoff; 52-55
3922         unsigned short      usri11_bad_pw_count; 56-57
3923         unsigned short      usri11_num_logons; 58-59
3924         char                *usri11_logon_server; 60-63
3925         unsigned short      usri11_country_code; 64-65
3926         char            *usri11_workstations; 66-69
3927         unsigned long       usri11_max_storage; 70-73
3928         unsigned short      usri11_units_per_week; 74-75
3929         unsigned char       *usri11_logon_hours; 76-79
3930         unsigned short      usri11_code_page; 80-81
3931     };
3932
3933 where:
3934
3935   usri11_name specifies the user name for which information is retrieved
3936
3937   usri11_pad aligns the next data structure element to a word boundary
3938
3939   usri11_comment is a null terminated ASCII comment
3940
3941   usri11_user_comment is a null terminated ASCII comment about the user
3942
3943   usri11_priv specifies the level of the privilege assigned to the user.
3944        The possible values are:
3945
3946 Name             Value  Description
3947 USER_PRIV_GUEST  0      Guest privilege
3948 USER_PRIV_USER   1      User privilege
3949 USER_PRV_ADMIN   2      Administrator privilege
3950
3951   usri11_auth_flags specifies the account operator privileges. The
3952        possible values are:
3953
3954 Name            Value   Description
3955 AF_OP_PRINT     0       Print operator
3956
3957
3958 Leach, Naik                                        [Page 28]
3959 \f
3960
3961
3962 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3963
3964
3965 AF_OP_COMM      1       Communications operator
3966 AF_OP_SERVER    2       Server operator
3967 AF_OP_ACCOUNTS  3       Accounts operator
3968
3969
3970   usri11_password_age specifies how many seconds have elapsed since the
3971        password was last changed.
3972
3973   usri11_home_dir points to a null terminated ASCII string that contains
3974        the path name of the user's home directory.
3975
3976   usri11_parms points to a null terminated ASCII string that is set
3977        aside for use by applications.
3978
3979   usri11_last_logon specifies the time when the user last logged on.
3980        This value is stored as the number of seconds elapsed since
3981        00:00:00, January 1, 1970.
3982
3983   usri11_last_logoff specifies the time when the user last logged off.
3984        This value is stored as the number of seconds elapsed since
3985        00:00:00, January 1, 1970. A value of 0 means the last logoff
3986        time is unknown.
3987
3988   usri11_bad_pw_count specifies the number of incorrect passwords
3989        entered since the last successful logon.
3990
3991   usri11_log1_num_logons specifies the number of times this user has
3992        logged on. A value of -1 means the number of logons is unknown.
3993
3994   usri11_logon_server points to a null terminated ASCII string that
3995        contains the name of the server to which logon requests are sent.
3996        A null string indicates logon requests should be sent to the
3997        domain controller.
3998
3999   usri11_country_code specifies the country code for the user's language
4000        of choice.
4001
4002   usri11_workstations points to a null terminated ASCII string that
4003        contains the names of workstations the user may log on from.
4004        There may be up to 8 workstations, with the names separated by
4005        commas. A null strings indicates there are no restrictions.
4006
4007   usri11_max_storage specifies the maximum amount of disk space the user
4008        can occupy. A value of 0xffffffff indicates there are no
4009        restrictions.
4010
4011   usri11_units_per_week specifies the equal number of time units into
4012        which a week is divided. This value must be equal to 168.
4013
4014   usri11_logon_hours points to a 21 byte (168 bits) string that
4015        specifies the time during which the user can log on. Each bit
4016        represents one unique hour in a week. The first bit (bit 0, word
4017        0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
4018
4019
4020
4021 Leach, Naik                                        [Page 29]
4022 \f
4023
4024
4025 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
4026
4027
4028        Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
4029        are no restrictions.
4030
4031   usri11_code_page specifies the code page for the user's language of
4032        choice
4033
4034 All of the pointers in this data structure need to be treated
4035 specially. The  pointer is a 32 bit pointer. The higher 16 bits need
4036 to be ignored. The converter word returned in the parameters section
4037 needs to be subtracted from the lower 16 bits to calculate an offset
4038 into the return buffer where this ASCII string resides.
4039
4040 There is no auxiliary data in the response.
4041
4042   ****************************************************************************/
4043
4044 #define usri11_name           0
4045 #define usri11_pad            21
4046 #define usri11_comment        22
4047 #define usri11_usr_comment    26
4048 #define usri11_full_name      30
4049 #define usri11_priv           34
4050 #define usri11_auth_flags     36
4051 #define usri11_password_age   40
4052 #define usri11_homedir        44
4053 #define usri11_parms          48
4054 #define usri11_last_logon     52
4055 #define usri11_last_logoff    56
4056 #define usri11_bad_pw_count   60
4057 #define usri11_num_logons     62
4058 #define usri11_logon_server   64
4059 #define usri11_country_code   68
4060 #define usri11_workstations   70
4061 #define usri11_max_storage    74
4062 #define usri11_units_per_week 78
4063 #define usri11_logon_hours    80
4064 #define usri11_code_page      84
4065 #define usri11_end            86
4066
4067 static bool api_RNetUserGetInfo(struct smbd_server_connection *sconn,
4068                                 connection_struct *conn, uint64_t vuid,
4069                                 char *param, int tpscnt,
4070                                 char *data, int tdscnt,
4071                                 int mdrcnt,int mprcnt,
4072                                 char **rdata,char **rparam,
4073                                 int *rdata_len,int *rparam_len)
4074 {
4075         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4076         char *str2 = skip_string(param,tpscnt,str1);
4077         char *UserName = skip_string(param,tpscnt,str2);
4078         char *p = skip_string(param,tpscnt,UserName);
4079         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4080         char *p2;
4081         char *endp;
4082         const char *level_string;
4083
4084         TALLOC_CTX *mem_ctx = talloc_tos();
4085         NTSTATUS status, result;
4086         struct rpc_pipe_client *cli = NULL;
4087         struct policy_handle connect_handle, domain_handle, user_handle;
4088         struct lsa_String domain_name;
4089         struct dom_sid2 *domain_sid;
4090         struct lsa_String names;
4091         struct samr_Ids rids;
4092         struct samr_Ids types;
4093         int errcode = W_ERROR_V(WERR_NERR_USERNOTFOUND);
4094         uint32_t rid;
4095         union samr_UserInfo *info;
4096         struct dcerpc_binding_handle *b = NULL;
4097
4098         if (!str1 || !str2 || !UserName || !p) {
4099                 return False;
4100         }
4101
4102         *rparam_len = 6;
4103         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4104         if (!*rparam) {
4105                 return False;
4106         }
4107
4108         DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
4109
4110         /* check it's a supported variant */
4111         if (strcmp(str1,"zWrLh") != 0) {
4112                 return False;
4113         }
4114         switch( uLevel ) {
4115                 case 0: level_string = "B21"; break;
4116                 case 1: level_string = "B21BB16DWzzWz"; break;
4117                 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
4118                 case 10: level_string = "B21Bzzz"; break;
4119                 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
4120                 default: return False;
4121         }
4122
4123         if (strcmp(level_string,str2) != 0) {
4124                 return False;
4125         }
4126
4127         *rdata_len = mdrcnt + 1024;
4128         *rdata = smb_realloc_limit(*rdata,*rdata_len);
4129         if (!*rdata) {
4130                 return False;
4131         }
4132
4133         p = *rdata;
4134         endp = *rdata + *rdata_len;
4135         p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
4136         if (!p2) {
4137                 return False;
4138         }
4139
4140         ZERO_STRUCT(connect_handle);
4141         ZERO_STRUCT(domain_handle);
4142         ZERO_STRUCT(user_handle);
4143
4144         status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr,
4145                                         conn->session_info,
4146                                         conn->sconn->remote_address,
4147                                         conn->sconn->local_address,
4148                                         conn->sconn->msg_ctx,
4149                                         &cli);
4150         if (!NT_STATUS_IS_OK(status)) {
4151                 DEBUG(0,("api_RNetUserGetInfo: could not connect to samr: %s\n",
4152                           nt_errstr(status)));
4153                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4154                 goto out;
4155         }
4156
4157         b = cli->binding_handle;
4158
4159         status = dcerpc_samr_Connect2(b, mem_ctx,
4160                                       lp_netbios_name(),
4161                                       SAMR_ACCESS_CONNECT_TO_SERVER |
4162                                       SAMR_ACCESS_ENUM_DOMAINS |
4163                                       SAMR_ACCESS_LOOKUP_DOMAIN,
4164                                       &connect_handle,
4165                                       &result);
4166         if (!NT_STATUS_IS_OK(status)) {
4167                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4168                 goto out;
4169         }
4170         if (!NT_STATUS_IS_OK(result)) {
4171                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4172                 goto out;
4173         }
4174
4175         init_lsa_String(&domain_name, get_global_sam_name());
4176
4177         status = dcerpc_samr_LookupDomain(b, mem_ctx,
4178                                           &connect_handle,
4179                                           &domain_name,
4180                                           &domain_sid,
4181                                           &result);
4182         if (!NT_STATUS_IS_OK(status)) {
4183                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4184                 goto out;
4185         }
4186         if (!NT_STATUS_IS_OK(result)) {
4187                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4188                 goto out;
4189         }
4190
4191         status = dcerpc_samr_OpenDomain(b, mem_ctx,
4192                                         &connect_handle,
4193                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4194                                         domain_sid,
4195                                         &domain_handle,
4196                                         &result);
4197         if (!NT_STATUS_IS_OK(status)) {
4198                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4199                 goto out;
4200         }
4201         if (!NT_STATUS_IS_OK(result)) {
4202                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4203                 goto out;
4204         }
4205
4206         init_lsa_String(&names, UserName);
4207
4208         status = dcerpc_samr_LookupNames(b, mem_ctx,
4209                                          &domain_handle,
4210                                          1,
4211                                          &names,
4212                                          &rids,
4213                                          &types,
4214                                          &result);
4215         if (!NT_STATUS_IS_OK(status)) {
4216                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4217                 goto out;
4218         }
4219         if (!NT_STATUS_IS_OK(result)) {
4220                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4221                 goto out;
4222         }
4223
4224         if (rids.count != 1) {
4225                 errcode = W_ERROR_V(WERR_NO_SUCH_USER);
4226                 goto out;
4227         }
4228         if (rids.count != types.count) {
4229                 errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
4230                 goto out;
4231         }
4232         if (types.ids[0] != SID_NAME_USER) {
4233                 errcode = W_ERROR_V(WERR_INVALID_PARAMETER);
4234                 goto out;
4235         }
4236
4237         rid = rids.ids[0];
4238
4239         status = dcerpc_samr_OpenUser(b, mem_ctx,
4240                                       &domain_handle,
4241                                       SAMR_USER_ACCESS_GET_LOCALE |
4242                                       SAMR_USER_ACCESS_GET_LOGONINFO |
4243                                       SAMR_USER_ACCESS_GET_ATTRIBUTES |
4244                                       SAMR_USER_ACCESS_GET_GROUPS |
4245                                       SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP |
4246                                       SEC_STD_READ_CONTROL,
4247                                       rid,
4248                                       &user_handle,
4249                                       &result);
4250         if (!NT_STATUS_IS_OK(status)) {
4251                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4252                 goto out;
4253         }
4254         if (!NT_STATUS_IS_OK(result)) {
4255                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4256                 goto out;
4257         }
4258
4259         status = dcerpc_samr_QueryUserInfo2(b, mem_ctx,
4260                                             &user_handle,
4261                                             UserAllInformation,
4262                                             &info,
4263                                             &result);
4264         if (!NT_STATUS_IS_OK(status)) {
4265                 errcode = W_ERROR_V(ntstatus_to_werror(status));
4266                 goto out;
4267         }
4268         if (!NT_STATUS_IS_OK(result)) {
4269                 errcode = W_ERROR_V(ntstatus_to_werror(result));
4270                 goto out;
4271         }
4272
4273         memset(p,0,21);
4274         fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
4275
4276         if (uLevel > 0) {
4277                 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
4278                 *p2 = 0;
4279         }
4280
4281         if (uLevel >= 10) {
4282                 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
4283                 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
4284                 p2 = skip_string(*rdata,*rdata_len,p2);
4285                 if (!p2) {
4286                         return False;
4287                 }
4288
4289                 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
4290                 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
4291                 p2 = skip_string(*rdata,*rdata_len,p2);
4292                 if (!p2) {
4293                         return False;
4294                 }
4295
4296                 /* EEK! the cifsrap.txt doesn't have this in!!!! */
4297                 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
4298                 strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4299                 p2 = skip_string(*rdata,*rdata_len,p2);
4300                 if (!p2) {
4301                         return False;
4302                 }
4303         }
4304
4305         if (uLevel == 11) {
4306                 const char *homedir = info->info21.home_directory.string;
4307                 /* modelled after NTAS 3.51 reply */
4308                 SSVAL(p,usri11_priv,
4309                         (get_current_uid(conn) == sec_initial_uid())?
4310                         USER_PRIV_ADMIN:USER_PRIV_USER);
4311                 SIVAL(p,usri11_auth_flags,AF_OP_PRINT);         /* auth flags */
4312                 SIVALS(p,usri11_password_age,-1);               /* password age */
4313                 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
4314                 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
4315                 p2 = skip_string(*rdata,*rdata_len,p2);
4316                 if (!p2) {
4317                         return False;
4318                 }
4319                 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
4320                 strlcpy(p2,"",PTR_DIFF(endp,p2));
4321                 p2 = skip_string(*rdata,*rdata_len,p2);
4322                 if (!p2) {
4323                         return False;
4324                 }
4325                 SIVAL(p,usri11_last_logon,0);           /* last logon */
4326                 SIVAL(p,usri11_last_logoff,0);          /* last logoff */
4327                 SSVALS(p,usri11_bad_pw_count,-1);       /* bad pw counts */
4328                 SSVALS(p,usri11_num_logons,-1);         /* num logons */
4329                 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
4330                 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
4331                 p2 = skip_string(*rdata,*rdata_len,p2);
4332                 if (!p2) {
4333                         return False;
4334                 }
4335                 SSVAL(p,usri11_country_code,0);         /* country code */
4336
4337                 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
4338                 strlcpy(p2,"",PTR_DIFF(endp,p2));
4339                 p2 = skip_string(*rdata,*rdata_len,p2);
4340                 if (!p2) {
4341                         return False;
4342                 }
4343
4344                 SIVALS(p,usri11_max_storage,-1);                /* max storage */
4345                 SSVAL(p,usri11_units_per_week,168);             /* units per week */
4346                 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
4347
4348                 /* a simple way to get logon hours at all times. */
4349                 memset(p2,0xff,21);
4350                 SCVAL(p2,21,0);           /* fix zero termination */
4351                 p2 = skip_string(*rdata,*rdata_len,p2);
4352                 if (!p2) {
4353                         return False;
4354                 }
4355
4356                 SSVAL(p,usri11_code_page,0);            /* code page */
4357         }
4358
4359         if (uLevel == 1 || uLevel == 2) {
4360                 memset(p+22,' ',16);    /* password */
4361                 SIVALS(p,38,-1);                /* password age */
4362                 SSVAL(p,42,
4363                         (get_current_uid(conn) == sec_initial_uid())?
4364                         USER_PRIV_ADMIN:USER_PRIV_USER);
4365                 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
4366                 strlcpy(p2, info->info21.home_directory.string,
4367                         PTR_DIFF(endp,p2));
4368                 p2 = skip_string(*rdata,*rdata_len,p2);
4369                 if (!p2) {
4370                         return False;
4371                 }
4372                 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
4373                 *p2++ = 0;
4374                 SSVAL(p,52,0);          /* flags */
4375                 SIVAL(p,54,PTR_DIFF(p2,*rdata));                /* script_path */
4376                 strlcpy(p2, info->info21.logon_script.string,
4377                         PTR_DIFF(endp,p2));
4378                 p2 = skip_string(*rdata,*rdata_len,p2);
4379                 if (!p2) {
4380                         return False;
4381                 }
4382                 if (uLevel == 2) {
4383                         SIVAL(p,58,0);          /* auth_flags */
4384                         SIVAL(p,62,PTR_DIFF(p2,*rdata)); /* full_name */
4385                         strlcpy(p2,info->info21.full_name.string,PTR_DIFF(endp,p2));
4386                         p2 = skip_string(*rdata,*rdata_len,p2);
4387                         if (!p2) {
4388                                 return False;
4389                         }
4390                         SIVAL(p,66,0);          /* urs_comment */
4391                         SIVAL(p,70,PTR_DIFF(p2,*rdata)); /* parms */
4392                         strlcpy(p2,"",PTR_DIFF(endp,p2));
4393                         p2 = skip_string(*rdata,*rdata_len,p2);
4394                         if (!p2) {
4395                                 return False;
4396                         }
4397                         SIVAL(p,74,0);          /* workstations */
4398                         SIVAL(p,78,0);          /* last_logon */
4399                         SIVAL(p,82,0);          /* last_logoff */
4400                         SIVALS(p,86,-1);                /* acct_expires */
4401                         SIVALS(p,90,-1);                /* max_storage */
4402                         SSVAL(p,94,168);        /* units_per_week */
4403                         SIVAL(p,96,PTR_DIFF(p2,*rdata)); /* logon_hours */
4404                         memset(p2,-1,21);
4405                         p2 += 21;
4406                         SSVALS(p,100,-1);       /* bad_pw_count */
4407                         SSVALS(p,102,-1);       /* num_logons */
4408                         SIVAL(p,104,PTR_DIFF(p2,*rdata)); /* logon_server */
4409                         {
4410                                 TALLOC_CTX *ctx = talloc_tos();
4411                                 int space_rem = *rdata_len - (p2 - *rdata);
4412                                 char *tmp;
4413
4414                                 if (space_rem <= 0) {
4415                                         return false;
4416                                 }
4417                                 tmp = talloc_strdup(ctx, "\\\\%L");
4418                                 if (!tmp) {
4419                                         return false;
4420                                 }
4421                                 tmp = talloc_sub_basic(ctx,
4422                                                 "",
4423                                                 "",
4424                                                 tmp);
4425                                 if (!tmp) {
4426                                         return false;
4427                                 }
4428
4429                                 push_ascii(p2,
4430                                         tmp,
4431                                         space_rem,
4432                                         STR_TERMINATE);
4433                         }
4434                         p2 = skip_string(*rdata,*rdata_len,p2);
4435                         if (!p2) {
4436                                 return False;
4437                         }
4438                         SSVAL(p,108,49);        /* country_code */
4439                         SSVAL(p,110,860);       /* code page */
4440                 }
4441         }
4442
4443         errcode = NERR_Success;
4444
4445  out:
4446         *rdata_len = PTR_DIFF(p2,*rdata);
4447
4448         if (b && is_valid_policy_hnd(&user_handle)) {
4449                 dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);
4450         }
4451         if (b && is_valid_policy_hnd(&domain_handle)) {
4452                 dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
4453         }
4454         if (b && is_valid_policy_hnd(&connect_handle)) {
4455                 dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
4456         }
4457
4458         SSVAL(*rparam,0,errcode);
4459         SSVAL(*rparam,2,0);             /* converter word */
4460         SSVAL(*rparam,4,*rdata_len);    /* is this right?? */
4461
4462         return(True);
4463 }
4464
4465 static bool api_WWkstaUserLogon(struct smbd_server_connection *sconn,
4466                                 connection_struct *conn,uint64_t vuid,
4467                                 char *param, int tpscnt,
4468                                 char *data, int tdscnt,
4469                                 int mdrcnt,int mprcnt,
4470                                 char **rdata,char **rparam,
4471                                 int *rdata_len,int *rparam_len)
4472 {
4473         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4474         char *str2 = skip_string(param,tpscnt,str1);
4475         char *p = skip_string(param,tpscnt,str2);
4476         int uLevel;
4477         struct pack_desc desc;
4478         char* name;
4479         struct auth_session_info *si = NULL;
4480         NTSTATUS status;
4481
4482         status = smbXsrv_session_info_lookup(conn->sconn->client,
4483                                              vuid,
4484                                              &si);
4485         if (!NT_STATUS_IS_OK(status)) {
4486                 return false;
4487         }
4488
4489         if (!str1 || !str2 || !p) {
4490                 return False;
4491         }
4492
4493         DBG_INFO("Username of UID %ju is %s\n",
4494                  (uintmax_t)si->unix_token->uid,
4495                  si->unix_info->unix_name);
4496
4497         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4498         name = get_safe_str_ptr(param,tpscnt,p,2);
4499         if (!name) {
4500                 return False;
4501         }
4502
4503         memset((char *)&desc,'\0',sizeof(desc));
4504
4505         DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
4506
4507         /* check it's a supported variant */
4508         if (strcmp(str1,"OOWb54WrLh") != 0) {
4509                 return False;
4510         }
4511         if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
4512                 return False;
4513         }
4514         if (mdrcnt > 0) {
4515                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4516                 if (!*rdata) {
4517                         return False;
4518                 }
4519         }
4520
4521         desc.base = *rdata;
4522         desc.buflen = mdrcnt;
4523         desc.subformat = NULL;
4524         desc.format = str2;
4525
4526         if (init_package(&desc,1,0)) {
4527                 PACKI(&desc,"W",0);             /* code */
4528                 PACKS(&desc,"B21",name);        /* eff. name */
4529                 PACKS(&desc,"B","");            /* pad */
4530                 PACKI(&desc,"W",
4531                         (get_current_uid(conn) == sec_initial_uid())?
4532                         USER_PRIV_ADMIN:USER_PRIV_USER);
4533                 PACKI(&desc,"D",0);             /* auth flags XXX */
4534                 PACKI(&desc,"W",0);             /* num logons */
4535                 PACKI(&desc,"W",0);             /* bad pw count */
4536                 PACKI(&desc,"D",0);             /* last logon */
4537                 PACKI(&desc,"D",-1);            /* last logoff */
4538                 PACKI(&desc,"D",-1);            /* logoff time */
4539                 PACKI(&desc,"D",-1);            /* kickoff time */
4540                 PACKI(&desc,"D",0);             /* password age */
4541                 PACKI(&desc,"D",0);             /* password can change */
4542                 PACKI(&desc,"D",-1);            /* password must change */
4543
4544                 {
4545                         fstring mypath;
4546                         fstrcpy(mypath,"\\\\");
4547                         fstrcat(mypath,get_local_machine_name());
4548                         if (!strupper_m(mypath)) {
4549                                 return false;
4550                         }
4551                         PACKS(&desc,"z",mypath); /* computer */
4552                 }
4553
4554                 PACKS(&desc,"z",lp_workgroup());/* domain */
4555                 PACKS(&desc,"z", si->info->logon_script); /* script path */
4556                 PACKI(&desc,"D",0x00000000);            /* reserved */
4557         }
4558
4559         *rdata_len = desc.usedlen;
4560         *rparam_len = 6;
4561         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4562         if (!*rparam) {
4563                 return False;
4564         }
4565         SSVALS(*rparam,0,desc.errcode);
4566         SSVAL(*rparam,2,0);
4567         SSVAL(*rparam,4,desc.neededlen);
4568
4569         DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4570
4571         return True;
4572 }
4573
4574 /****************************************************************************
4575  api_WAccessGetUserPerms
4576 ****************************************************************************/
4577
4578 static bool api_WAccessGetUserPerms(struct smbd_server_connection *sconn,
4579                                     connection_struct *conn,uint64_t vuid,
4580                                 char *param, int tpscnt,
4581                                 char *data, int tdscnt,
4582                                 int mdrcnt,int mprcnt,
4583                                 char **rdata,char **rparam,
4584                                 int *rdata_len,int *rparam_len)
4585 {
4586         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4587         char *str2 = skip_string(param,tpscnt,str1);
4588         char *user = skip_string(param,tpscnt,str2);
4589         char *resource = skip_string(param,tpscnt,user);
4590
4591         if (!str1 || !str2 || !user || !resource) {
4592                 return False;
4593         }
4594
4595         if (skip_string(param,tpscnt,resource) == NULL) {
4596                 return False;
4597         }
4598         DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4599
4600         /* check it's a supported variant */
4601         if (strcmp(str1,"zzh") != 0) {
4602                 return False;
4603         }
4604         if (strcmp(str2,"") != 0) {
4605                 return False;
4606         }
4607
4608         *rparam_len = 6;
4609         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4610         if (!*rparam) {
4611                 return False;
4612         }
4613         SSVALS(*rparam,0,0);            /* errorcode */
4614         SSVAL(*rparam,2,0);             /* converter word */
4615         SSVAL(*rparam,4,0x7f);  /* permission flags */
4616
4617         return True;
4618 }
4619
4620 /****************************************************************************
4621   api_WPrintJobEnumerate
4622   ****************************************************************************/
4623
4624 static bool api_WPrintJobGetInfo(struct smbd_server_connection *sconn,
4625                                  connection_struct *conn, uint64_t vuid,
4626                                 char *param, int tpscnt,
4627                                 char *data, int tdscnt,
4628                                 int mdrcnt,int mprcnt,
4629                                 char **rdata,char **rparam,
4630                                 int *rdata_len,int *rparam_len)
4631 {
4632         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4633         char *str2 = skip_string(param,tpscnt,str1);
4634         char *p = skip_string(param,tpscnt,str2);
4635         int uLevel;
4636         fstring sharename;
4637         uint32_t jobid;
4638         struct pack_desc desc;
4639         char *tmpdata=NULL;
4640
4641         TALLOC_CTX *mem_ctx = talloc_tos();
4642         WERROR werr;
4643         NTSTATUS status;
4644         struct rpc_pipe_client *cli = NULL;
4645         struct dcerpc_binding_handle *b = NULL;
4646         struct policy_handle handle;
4647         struct spoolss_DevmodeContainer devmode_ctr;
4648         union spoolss_JobInfo info;
4649
4650         if (!str1 || !str2 || !p) {
4651                 return False;
4652         }
4653
4654         uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4655
4656         memset((char *)&desc,'\0',sizeof(desc));
4657         memset((char *)&status,'\0',sizeof(status));
4658
4659         DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4660
4661         /* check it's a supported variant */
4662         if (strcmp(str1,"WWrLh") != 0) {
4663                 return False;
4664         }
4665         if (!check_printjob_info(&desc,uLevel,str2)) {
4666                 return False;
4667         }
4668
4669         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4670                 return False;
4671         }
4672
4673         ZERO_STRUCT(handle);
4674
4675         status = rpc_pipe_open_interface(mem_ctx,
4676                                          &ndr_table_spoolss,
4677                                          conn->session_info,
4678                                          conn->sconn->remote_address,
4679                                          conn->sconn->local_address,
4680                                          conn->sconn->msg_ctx,
4681                                          &cli);
4682         if (!NT_STATUS_IS_OK(status)) {
4683                 DEBUG(0,("api_WPrintJobGetInfo: could not connect to spoolss: %s\n",
4684                           nt_errstr(status)));
4685                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4686                 goto out;
4687         }
4688         b = cli->binding_handle;
4689
4690         ZERO_STRUCT(devmode_ctr);
4691
4692         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4693                                             sharename,
4694                                             "RAW",
4695                                             devmode_ctr,
4696                                             PRINTER_ACCESS_USE,
4697                                             &handle,
4698                                             &werr);
4699         if (!NT_STATUS_IS_OK(status)) {
4700                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4701                 goto out;
4702         }
4703         if (!W_ERROR_IS_OK(werr)) {
4704                 desc.errcode = W_ERROR_V(werr);
4705                 goto out;
4706         }
4707
4708         werr = rpccli_spoolss_getjob(cli, mem_ctx,
4709                                      &handle,
4710                                      jobid,
4711                                      2, /* level */
4712                                      0, /* offered */
4713                                      &info);
4714         if (!W_ERROR_IS_OK(werr)) {
4715                 desc.errcode = W_ERROR_V(werr);
4716                 goto out;
4717         }
4718
4719         if (mdrcnt > 0) {
4720                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4721                 if (!*rdata) {
4722                         return False;
4723                 }
4724                 desc.base = *rdata;
4725                 desc.buflen = mdrcnt;
4726         } else {
4727                 /*
4728                  * Don't return data but need to get correct length
4729                  *  init_package will return wrong size if buflen=0
4730                  */
4731                 desc.buflen = getlen(desc.format);
4732                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4733         }
4734
4735         if (init_package(&desc,1,0)) {
4736                 fill_spoolss_printjob_info(uLevel, &desc, &info.info2, info.info2.position);
4737                 *rdata_len = desc.usedlen;
4738         } else {
4739                 desc.errcode = NERR_JobNotFound;
4740                 *rdata_len = 0;
4741         }
4742  out:
4743         if (b && is_valid_policy_hnd(&handle)) {
4744                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4745         }
4746
4747         *rparam_len = 6;
4748         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4749         if (!*rparam) {
4750                 return False;
4751         }
4752         SSVALS(*rparam,0,desc.errcode);
4753         SSVAL(*rparam,2,0);
4754         SSVAL(*rparam,4,desc.neededlen);
4755
4756         SAFE_FREE(tmpdata);
4757
4758         DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4759
4760         return True;
4761 }
4762
4763 static bool api_WPrintJobEnumerate(struct smbd_server_connection *sconn,
4764                                    connection_struct *conn, uint64_t vuid,
4765                                 char *param, int tpscnt,
4766                                 char *data, int tdscnt,
4767                                 int mdrcnt,int mprcnt,
4768                                 char **rdata,char **rparam,
4769                                 int *rdata_len,int *rparam_len)
4770 {
4771         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4772         char *str2 = skip_string(param,tpscnt,str1);
4773         char *p = skip_string(param,tpscnt,str2);
4774         char *name = p;
4775         int uLevel;
4776         int i, succnt=0;
4777         struct pack_desc desc;
4778
4779         TALLOC_CTX *mem_ctx = talloc_tos();
4780         WERROR werr;
4781         NTSTATUS status;
4782         struct rpc_pipe_client *cli = NULL;
4783         struct dcerpc_binding_handle *b = NULL;
4784         struct policy_handle handle;
4785         struct spoolss_DevmodeContainer devmode_ctr;
4786         uint32_t count = 0;
4787         union spoolss_JobInfo *info;
4788
4789         if (!str1 || !str2 || !p) {
4790                 return False;
4791         }
4792
4793         memset((char *)&desc,'\0',sizeof(desc));
4794
4795         p = skip_string(param,tpscnt,p);
4796         if (!p) {
4797                 return False;
4798         }
4799         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4800
4801         DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4802
4803         /* check it's a supported variant */
4804         if (strcmp(str1,"zWrLeh") != 0) {
4805                 return False;
4806         }
4807
4808         if (uLevel > 2) {
4809                 return False;   /* defined only for uLevel 0,1,2 */
4810         }
4811
4812         if (!check_printjob_info(&desc,uLevel,str2)) {
4813                 return False;
4814         }
4815
4816         ZERO_STRUCT(handle);
4817
4818         status = rpc_pipe_open_interface(mem_ctx,
4819                                          &ndr_table_spoolss,
4820                                          conn->session_info,
4821                                          conn->sconn->remote_address,
4822                                          conn->sconn->local_address,
4823                                          conn->sconn->msg_ctx,
4824                                          &cli);
4825         if (!NT_STATUS_IS_OK(status)) {
4826                 DEBUG(0,("api_WPrintJobEnumerate: could not connect to spoolss: %s\n",
4827                           nt_errstr(status)));
4828                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4829                 goto out;
4830         }
4831         b = cli->binding_handle;
4832
4833         ZERO_STRUCT(devmode_ctr);
4834
4835         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
4836                                             name,
4837                                             NULL,
4838                                             devmode_ctr,
4839                                             PRINTER_ACCESS_USE,
4840                                             &handle,
4841                                             &werr);
4842         if (!NT_STATUS_IS_OK(status)) {
4843                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
4844                 goto out;
4845         }
4846         if (!W_ERROR_IS_OK(werr)) {
4847                 desc.errcode = W_ERROR_V(werr);
4848                 goto out;
4849         }
4850
4851         werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
4852                                        &handle,
4853                                        0, /* firstjob */
4854                                        0xff, /* numjobs */
4855                                        2, /* level */
4856                                        0, /* offered */
4857                                        &count,
4858                                        &info);
4859         if (!W_ERROR_IS_OK(werr)) {
4860                 desc.errcode = W_ERROR_V(werr);
4861                 goto out;
4862         }
4863
4864         if (mdrcnt > 0) {
4865                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4866                 if (!*rdata) {
4867                         return False;
4868                 }
4869         }
4870         desc.base = *rdata;
4871         desc.buflen = mdrcnt;
4872
4873         if (init_package(&desc,count,0)) {
4874                 succnt = 0;
4875                 for (i = 0; i < count; i++) {
4876                         fill_spoolss_printjob_info(uLevel, &desc, &info[i].info2, i);
4877                         if (desc.errcode == NERR_Success) {
4878                                 succnt = i+1;
4879                         }
4880                 }
4881         }
4882  out:
4883         if (b && is_valid_policy_hnd(&handle)) {
4884                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
4885         }
4886
4887         *rdata_len = desc.usedlen;
4888
4889         *rparam_len = 8;
4890         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4891         if (!*rparam) {
4892                 return False;
4893         }
4894         SSVALS(*rparam,0,desc.errcode);
4895         SSVAL(*rparam,2,0);
4896         SSVAL(*rparam,4,succnt);
4897         SSVAL(*rparam,6,count);
4898
4899         DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4900
4901         return True;
4902 }
4903
4904 static int check_printdest_info(struct pack_desc* desc,
4905                                 int uLevel, char* id)
4906 {
4907         desc->subformat = NULL;
4908         switch( uLevel ) {
4909                 case 0:
4910                         desc->format = "B9";
4911                         break;
4912                 case 1:
4913                         desc->format = "B9B21WWzW";
4914                         break;
4915                 case 2:
4916                         desc->format = "z";
4917                         break;
4918                 case 3:
4919                         desc->format = "zzzWWzzzWW";
4920                         break;
4921                 default:
4922                         DEBUG(0,("check_printdest_info: invalid level %d\n",
4923                                 uLevel));
4924                         return False;
4925         }
4926         if (id == NULL || strcmp(desc->format,id) != 0) {
4927                 DEBUG(0,("check_printdest_info: invalid string %s\n",
4928                         id ? id : "<NULL>" ));
4929                 return False;
4930         }
4931         return True;
4932 }
4933
4934 static void fill_printdest_info(struct spoolss_PrinterInfo2 *info2, int uLevel,
4935                                 struct pack_desc* desc)
4936 {
4937         char buf[100];
4938
4939         strncpy(buf, info2->printername, sizeof(buf)-1);
4940         buf[sizeof(buf)-1] = 0;
4941         (void)strupper_m(buf);
4942
4943         if (uLevel <= 1) {
4944                 PACKS(desc,"B9",buf);   /* szName */
4945                 if (uLevel == 1) {
4946                         PACKS(desc,"B21","");   /* szUserName */
4947                         PACKI(desc,"W",0);              /* uJobId */
4948                         PACKI(desc,"W",0);              /* fsStatus */
4949                         PACKS(desc,"z","");     /* pszStatus */
4950                         PACKI(desc,"W",0);              /* time */
4951                 }
4952         }
4953
4954         if (uLevel == 2 || uLevel == 3) {
4955                 PACKS(desc,"z",buf);            /* pszPrinterName */
4956                 if (uLevel == 3) {
4957                         PACKS(desc,"z","");     /* pszUserName */
4958                         PACKS(desc,"z","");     /* pszLogAddr */
4959                         PACKI(desc,"W",0);              /* uJobId */
4960                         PACKI(desc,"W",0);              /* fsStatus */
4961                         PACKS(desc,"z","");     /* pszStatus */
4962                         PACKS(desc,"z","");     /* pszComment */
4963                         PACKS(desc,"z","NULL"); /* pszDrivers */
4964                         PACKI(desc,"W",0);              /* time */
4965                         PACKI(desc,"W",0);              /* pad1 */
4966                 }
4967         }
4968 }
4969
4970 static bool api_WPrintDestGetInfo(struct smbd_server_connection *sconn,
4971                                   connection_struct *conn, uint64_t vuid,
4972                                 char *param, int tpscnt,
4973                                 char *data, int tdscnt,
4974                                 int mdrcnt,int mprcnt,
4975                                 char **rdata,char **rparam,
4976                                 int *rdata_len,int *rparam_len)
4977 {
4978         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4979         char *str2 = skip_string(param,tpscnt,str1);
4980         char *p = skip_string(param,tpscnt,str2);
4981         char* PrinterName = p;
4982         int uLevel;
4983         struct pack_desc desc;
4984         char *tmpdata=NULL;
4985
4986         TALLOC_CTX *mem_ctx = talloc_tos();
4987         WERROR werr;
4988         NTSTATUS status;
4989         struct rpc_pipe_client *cli = NULL;
4990         struct dcerpc_binding_handle *b = NULL;
4991         struct policy_handle handle;
4992         struct spoolss_DevmodeContainer devmode_ctr;
4993         union spoolss_PrinterInfo info;
4994
4995         if (!str1 || !str2 || !p) {
4996                 return False;
4997         }
4998
4999         memset((char *)&desc,'\0',sizeof(desc));
5000
5001         p = skip_string(param,tpscnt,p);
5002         if (!p) {
5003                 return False;
5004         }
5005         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5006
5007         DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
5008
5009         /* check it's a supported variant */
5010         if (strcmp(str1,"zWrLh") != 0) {
5011                 return False;
5012         }
5013         if (!check_printdest_info(&desc,uLevel,str2)) {
5014                 return False;
5015         }
5016
5017         ZERO_STRUCT(handle);
5018
5019         status = rpc_pipe_open_interface(mem_ctx,
5020                                          &ndr_table_spoolss,
5021                                          conn->session_info,
5022                                          conn->sconn->remote_address,
5023                                          conn->sconn->local_address,
5024                                          conn->sconn->msg_ctx,
5025                                          &cli);
5026         if (!NT_STATUS_IS_OK(status)) {
5027                 DEBUG(0,("api_WPrintDestGetInfo: could not connect to spoolss: %s\n",
5028                           nt_errstr(status)));
5029                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5030                 goto out;
5031         }
5032         b = cli->binding_handle;
5033
5034         ZERO_STRUCT(devmode_ctr);
5035
5036         status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5037                                             PrinterName,
5038                                             NULL,
5039                                             devmode_ctr,
5040                                             PRINTER_ACCESS_USE,
5041                                             &handle,
5042                                             &werr);
5043         if (!NT_STATUS_IS_OK(status)) {
5044                 *rdata_len = 0;
5045                 desc.errcode = NERR_DestNotFound;
5046                 desc.neededlen = 0;
5047                 goto out;
5048         }
5049         if (!W_ERROR_IS_OK(werr)) {
5050                 *rdata_len = 0;
5051                 desc.errcode = NERR_DestNotFound;
5052                 desc.neededlen = 0;
5053                 goto out;
5054         }
5055
5056         werr = rpccli_spoolss_getprinter(cli, mem_ctx,
5057                                          &handle,
5058                                          2,
5059                                          0,
5060                                          &info);
5061         if (!W_ERROR_IS_OK(werr)) {
5062                 *rdata_len = 0;
5063                 desc.errcode = NERR_DestNotFound;
5064                 desc.neededlen = 0;
5065                 goto out;
5066         }
5067
5068         if (mdrcnt > 0) {
5069                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5070                 if (!*rdata) {
5071                         return False;
5072                 }
5073                 desc.base = *rdata;
5074                 desc.buflen = mdrcnt;
5075         } else {
5076                 /*
5077                  * Don't return data but need to get correct length
5078                  * init_package will return wrong size if buflen=0
5079                  */
5080                 desc.buflen = getlen(desc.format);
5081                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
5082         }
5083         if (init_package(&desc,1,0)) {
5084                 fill_printdest_info(&info.info2, uLevel,&desc);
5085         }
5086
5087  out:
5088         if (b && is_valid_policy_hnd(&handle)) {
5089                 dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5090         }
5091
5092         *rdata_len = desc.usedlen;
5093
5094         *rparam_len = 6;
5095         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5096         if (!*rparam) {
5097                 return False;
5098         }
5099         SSVALS(*rparam,0,desc.errcode);
5100         SSVAL(*rparam,2,0);
5101         SSVAL(*rparam,4,desc.neededlen);
5102
5103         DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
5104         SAFE_FREE(tmpdata);
5105
5106         return True;
5107 }
5108
5109 static bool api_WPrintDestEnum(struct smbd_server_connection *sconn,
5110                                connection_struct *conn, uint64_t vuid,
5111                                 char *param, int tpscnt,
5112                                 char *data, int tdscnt,
5113                                 int mdrcnt,int mprcnt,
5114                                 char **rdata,char **rparam,
5115                                 int *rdata_len,int *rparam_len)
5116 {
5117         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5118         char *str2 = skip_string(param,tpscnt,str1);
5119         char *p = skip_string(param,tpscnt,str2);
5120         int uLevel;
5121         int queuecnt;
5122         int i, n, succnt=0;
5123         struct pack_desc desc;
5124
5125         TALLOC_CTX *mem_ctx = talloc_tos();
5126         WERROR werr;
5127         NTSTATUS status;
5128         struct rpc_pipe_client *cli = NULL;
5129         union spoolss_PrinterInfo *info;
5130         uint32_t count;
5131
5132         if (!str1 || !str2 || !p) {
5133                 return False;
5134         }
5135
5136         memset((char *)&desc,'\0',sizeof(desc));
5137
5138         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5139
5140         DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
5141
5142         /* check it's a supported variant */
5143         if (strcmp(str1,"WrLeh") != 0) {
5144                 return False;
5145         }
5146         if (!check_printdest_info(&desc,uLevel,str2)) {
5147                 return False;
5148         }
5149
5150         queuecnt = 0;
5151
5152         status = rpc_pipe_open_interface(mem_ctx,
5153                                          &ndr_table_spoolss,
5154                                          conn->session_info,
5155                                          conn->sconn->remote_address,
5156                                          conn->sconn->local_address,
5157                                          conn->sconn->msg_ctx,
5158                                          &cli);
5159         if (!NT_STATUS_IS_OK(status)) {
5160                 DEBUG(0,("api_WPrintDestEnum: could not connect to spoolss: %s\n",
5161                           nt_errstr(status)));
5162                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5163                 goto out;
5164         }
5165
5166         werr = rpccli_spoolss_enumprinters(cli, mem_ctx,
5167                                            PRINTER_ENUM_LOCAL,
5168                                            cli->srv_name_slash,
5169                                            2,
5170                                            0,
5171                                            &count,
5172                                            &info);
5173         if (!W_ERROR_IS_OK(werr)) {
5174                 desc.errcode = W_ERROR_V(werr);
5175                 *rdata_len = 0;
5176                 desc.errcode = NERR_DestNotFound;
5177                 desc.neededlen = 0;
5178                 goto out;
5179         }
5180
5181         queuecnt = count;
5182
5183         if (mdrcnt > 0) {
5184                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5185                 if (!*rdata) {
5186                         return False;
5187                 }
5188         }
5189
5190         desc.base = *rdata;
5191         desc.buflen = mdrcnt;
5192         if (init_package(&desc,queuecnt,0)) {
5193                 succnt = 0;
5194                 n = 0;
5195                 for (i = 0; i < count; i++) {
5196                         fill_printdest_info(&info[i].info2, uLevel,&desc);
5197                         n++;
5198                         if (desc.errcode == NERR_Success) {
5199                                 succnt = n;
5200                         }
5201                 }
5202         }
5203  out:
5204         *rdata_len = desc.usedlen;
5205
5206         *rparam_len = 8;
5207         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5208         if (!*rparam) {
5209                 return False;
5210         }
5211         SSVALS(*rparam,0,desc.errcode);
5212         SSVAL(*rparam,2,0);
5213         SSVAL(*rparam,4,succnt);
5214         SSVAL(*rparam,6,queuecnt);
5215
5216         DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
5217
5218         return True;
5219 }
5220
5221 static bool api_WPrintDriverEnum(struct smbd_server_connection *sconn,
5222                                  connection_struct *conn, uint64_t vuid,
5223                                 char *param, int tpscnt,
5224                                 char *data, int tdscnt,
5225                                 int mdrcnt,int mprcnt,
5226                                 char **rdata,char **rparam,
5227                                 int *rdata_len,int *rparam_len)
5228 {
5229         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5230         char *str2 = skip_string(param,tpscnt,str1);
5231         char *p = skip_string(param,tpscnt,str2);
5232         int uLevel;
5233         int succnt;
5234         struct pack_desc desc;
5235
5236         if (!str1 || !str2 || !p) {
5237                 return False;
5238         }
5239
5240         memset((char *)&desc,'\0',sizeof(desc));
5241
5242         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5243
5244         DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
5245
5246         /* check it's a supported variant */
5247         if (strcmp(str1,"WrLeh") != 0) {
5248                 return False;
5249         }
5250         if (uLevel != 0 || strcmp(str2,"B41") != 0) {
5251                 return False;
5252         }
5253
5254         if (mdrcnt > 0) {
5255                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5256                 if (!*rdata) {
5257                         return False;
5258                 }
5259         }
5260         desc.base = *rdata;
5261         desc.buflen = mdrcnt;
5262         if (init_package(&desc,1,0)) {
5263                 PACKS(&desc,"B41","NULL");
5264         }
5265
5266         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5267
5268         *rdata_len = desc.usedlen;
5269
5270         *rparam_len = 8;
5271         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5272         if (!*rparam) {
5273                 return False;
5274         }
5275         SSVALS(*rparam,0,desc.errcode);
5276         SSVAL(*rparam,2,0);
5277         SSVAL(*rparam,4,succnt);
5278         SSVAL(*rparam,6,1);
5279
5280         DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
5281
5282         return True;
5283 }
5284
5285 static bool api_WPrintQProcEnum(struct smbd_server_connection *sconn,
5286                                 connection_struct *conn, uint64_t vuid,
5287                                 char *param, int tpscnt,
5288                                 char *data, int tdscnt,
5289                                 int mdrcnt,int mprcnt,
5290                                 char **rdata,char **rparam,
5291                                 int *rdata_len,int *rparam_len)
5292 {
5293         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5294         char *str2 = skip_string(param,tpscnt,str1);
5295         char *p = skip_string(param,tpscnt,str2);
5296         int uLevel;
5297         int succnt;
5298         struct pack_desc desc;
5299
5300         if (!str1 || !str2 || !p) {
5301                 return False;
5302         }
5303         memset((char *)&desc,'\0',sizeof(desc));
5304
5305         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5306
5307         DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
5308
5309         /* check it's a supported variant */
5310         if (strcmp(str1,"WrLeh") != 0) {
5311                 return False;
5312         }
5313         if (uLevel != 0 || strcmp(str2,"B13") != 0) {
5314                 return False;
5315         }
5316
5317         if (mdrcnt > 0) {
5318                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5319                 if (!*rdata) {
5320                         return False;
5321                 }
5322         }
5323         desc.base = *rdata;
5324         desc.buflen = mdrcnt;
5325         desc.format = str2;
5326         if (init_package(&desc,1,0)) {
5327                 PACKS(&desc,"B13","lpd");
5328         }
5329
5330         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5331
5332         *rdata_len = desc.usedlen;
5333
5334         *rparam_len = 8;
5335         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5336         if (!*rparam) {
5337                 return False;
5338         }
5339         SSVALS(*rparam,0,desc.errcode);
5340         SSVAL(*rparam,2,0);
5341         SSVAL(*rparam,4,succnt);
5342         SSVAL(*rparam,6,1);
5343
5344         DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
5345
5346         return True;
5347 }
5348
5349 static bool api_WPrintPortEnum(struct smbd_server_connection *sconn,
5350                                connection_struct *conn, uint64_t vuid,
5351                                 char *param, int tpscnt,
5352                                 char *data, int tdscnt,
5353                                 int mdrcnt,int mprcnt,
5354                                 char **rdata,char **rparam,
5355                                 int *rdata_len,int *rparam_len)
5356 {
5357         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5358         char *str2 = skip_string(param,tpscnt,str1);
5359         char *p = skip_string(param,tpscnt,str2);
5360         int uLevel;
5361         int succnt;
5362         struct pack_desc desc;
5363
5364         if (!str1 || !str2 || !p) {
5365                 return False;
5366         }
5367
5368         memset((char *)&desc,'\0',sizeof(desc));
5369
5370         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5371
5372         DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
5373
5374         /* check it's a supported variant */
5375         if (strcmp(str1,"WrLeh") != 0) {
5376                 return False;
5377         }
5378         if (uLevel != 0 || strcmp(str2,"B9") != 0) {
5379                 return False;
5380         }
5381
5382         if (mdrcnt > 0) {
5383                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5384                 if (!*rdata) {
5385                         return False;
5386                 }
5387         }
5388         memset((char *)&desc,'\0',sizeof(desc));
5389         desc.base = *rdata;
5390         desc.buflen = mdrcnt;
5391         desc.format = str2;
5392         if (init_package(&desc,1,0)) {
5393                 PACKS(&desc,"B13","lp0");
5394         }
5395
5396         succnt = (desc.errcode == NERR_Success ? 1 : 0);
5397
5398         *rdata_len = desc.usedlen;
5399
5400         *rparam_len = 8;
5401         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5402         if (!*rparam) {
5403                 return False;
5404         }
5405         SSVALS(*rparam,0,desc.errcode);
5406         SSVAL(*rparam,2,0);
5407         SSVAL(*rparam,4,succnt);
5408         SSVAL(*rparam,6,1);
5409
5410         DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
5411
5412         return True;
5413 }
5414
5415 /****************************************************************************
5416  List open sessions
5417  ****************************************************************************/
5418
5419 static bool api_RNetSessionEnum(struct smbd_server_connection *sconn,
5420                                 connection_struct *conn, uint64_t vuid,
5421                                 char *param, int tpscnt,
5422                                 char *data, int tdscnt,
5423                                 int mdrcnt,int mprcnt,
5424                                 char **rdata,char **rparam,
5425                                 int *rdata_len,int *rparam_len)
5426
5427 {
5428         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
5429         char *str2 = skip_string(param,tpscnt,str1);
5430         char *p = skip_string(param,tpscnt,str2);
5431         int uLevel;
5432         struct pack_desc desc;
5433         int i;
5434
5435         TALLOC_CTX *mem_ctx = talloc_tos();
5436         WERROR werr;
5437         NTSTATUS status;
5438         struct rpc_pipe_client *cli = NULL;
5439         struct dcerpc_binding_handle *b = NULL;
5440         struct srvsvc_NetSessInfoCtr info_ctr;
5441         uint32_t totalentries, resume_handle = 0;
5442         uint32_t count = 0;
5443
5444         if (!str1 || !str2 || !p) {
5445                 return False;
5446         }
5447
5448         ZERO_STRUCT(desc);
5449
5450         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
5451
5452         DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
5453         DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
5454         DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
5455
5456         /* check it's a supported variant */
5457         if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
5458                 return False;
5459         }
5460         if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
5461                 return False;
5462         }
5463
5464         status = rpc_pipe_open_interface(mem_ctx,
5465                                          &ndr_table_srvsvc,
5466                                          conn->session_info,
5467                                          conn->sconn->remote_address,
5468                                          conn->sconn->local_address,
5469                                          conn->sconn->msg_ctx,
5470                                          &cli);
5471         if (!NT_STATUS_IS_OK(status)) {
5472                 DEBUG(0,("RNetSessionEnum: could not connect to srvsvc: %s\n",
5473                           nt_errstr(status)));
5474                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5475                 goto out;
5476         }
5477         b = cli->binding_handle;
5478
5479         info_ctr.level = 1;
5480         info_ctr.ctr.ctr1 = talloc_zero(talloc_tos(), struct srvsvc_NetSessCtr1);
5481         if (info_ctr.ctr.ctr1 == NULL) {
5482                 desc.errcode = W_ERROR_V(WERR_NOT_ENOUGH_MEMORY);
5483                 goto out;
5484         }
5485
5486         status = dcerpc_srvsvc_NetSessEnum(b, mem_ctx,
5487                                            cli->srv_name_slash,
5488                                            NULL, /* client */
5489                                            NULL, /* user */
5490                                            &info_ctr,
5491                                            (uint32_t)-1, /* max_buffer */
5492                                            &totalentries,
5493                                            &resume_handle,
5494                                            &werr);
5495         if (!NT_STATUS_IS_OK(status)) {
5496                 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5497                           nt_errstr(status)));
5498                 desc.errcode = W_ERROR_V(ntstatus_to_werror(status));
5499                 goto out;
5500         }
5501
5502         if (!W_ERROR_IS_OK(werr)) {
5503                 DEBUG(0,("RNetSessionEnum: dcerpc_srvsvc_NetSessEnum failed: %s\n",
5504                           win_errstr(werr)));
5505                 desc.errcode = W_ERROR_V(werr);
5506                 goto out;
5507         }
5508
5509         count = info_ctr.ctr.ctr1->count;
5510
5511  out:
5512         if (mdrcnt > 0) {
5513                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
5514                 if (!*rdata) {
5515                         return False;
5516                 }
5517         }
5518
5519         desc.base = *rdata;
5520         desc.buflen = mdrcnt;
5521         desc.format = str2;
5522         if (!init_package(&desc, count,0)) {
5523                 return False;
5524         }
5525
5526         for(i=0; i < count; i++) {
5527                 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].client);
5528                 PACKS(&desc, "z", info_ctr.ctr.ctr1->array[i].user);
5529                 PACKI(&desc, "W", 1); /* num conns */
5530                 PACKI(&desc, "W", info_ctr.ctr.ctr1->array[i].num_open);
5531                 PACKI(&desc, "W", 1); /* num users */
5532                 PACKI(&desc, "D", 0); /* session time */
5533                 PACKI(&desc, "D", 0); /* idle time */
5534                 PACKI(&desc, "D", 0); /* flags */
5535                 PACKS(&desc, "z", "Unknown Client"); /* client type string */
5536         }
5537
5538         *rdata_len = desc.usedlen;
5539
5540         *rparam_len = 8;
5541         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5542         if (!*rparam) {
5543                 return False;
5544         }
5545         SSVALS(*rparam,0,desc.errcode);
5546         SSVAL(*rparam,2,0); /* converter */
5547         SSVAL(*rparam,4, count); /* count */
5548
5549         DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
5550
5551         return True;
5552 }
5553
5554
5555 /****************************************************************************
5556  The buffer was too small.
5557  ****************************************************************************/
5558
5559 static bool api_TooSmall(struct smbd_server_connection *sconn,
5560                          connection_struct *conn,uint64_t vuid, char *param, char *data,
5561                          int mdrcnt, int mprcnt,
5562                          char **rdata, char **rparam,
5563                          int *rdata_len, int *rparam_len)
5564 {
5565         *rparam_len = MIN(*rparam_len,mprcnt);
5566         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5567         if (!*rparam) {
5568                 return False;
5569         }
5570
5571         *rdata_len = 0;
5572
5573         SSVAL(*rparam,0,NERR_BufTooSmall);
5574
5575         DEBUG(3,("Supplied buffer too small in API command\n"));
5576
5577         return True;
5578 }
5579
5580 /****************************************************************************
5581  The request is not supported.
5582  ****************************************************************************/
5583
5584 static bool api_Unsupported(struct smbd_server_connection *sconn,
5585                             connection_struct *conn, uint64_t vuid,
5586                                 char *param, int tpscnt,
5587                                 char *data, int tdscnt,
5588                                 int mdrcnt, int mprcnt,
5589                                 char **rdata, char **rparam,
5590                                 int *rdata_len, int *rparam_len)
5591 {
5592         *rparam_len = 4;
5593         *rparam = smb_realloc_limit(*rparam,*rparam_len);
5594         if (!*rparam) {
5595                 return False;
5596         }
5597
5598         *rdata_len = 0;
5599
5600         SSVAL(*rparam,0,NERR_notsupported);
5601         SSVAL(*rparam,2,0);             /* converter word */
5602
5603         DEBUG(3,("Unsupported API command\n"));
5604
5605         return True;
5606 }
5607
5608 static const struct {
5609         const char *name;
5610         int id;
5611         bool (*fn)(struct smbd_server_connection *sconn,
5612                    connection_struct *, uint64_t,
5613                         char *, int,
5614                         char *, int,
5615                         int,int,char **,char **,int *,int *);
5616         bool auth_user;         /* Deny anonymous access? */
5617 } api_commands[] = {
5618         {
5619                 .name = "RNetShareEnum",
5620                 .id = RAP_WshareEnum,
5621                 .fn = api_RNetShareEnum,
5622                 .auth_user = true,
5623         },
5624         {
5625                 .name = "RNetShareGetInfo",
5626                 .id = RAP_WshareGetInfo,
5627                 .fn = api_RNetShareGetInfo
5628         },
5629         {
5630                 .name = "RNetShareAdd",
5631                 .id = RAP_WshareAdd,
5632                 .fn = api_RNetShareAdd
5633         },
5634         {
5635                 .name = "RNetSessionEnum",
5636                 .id = RAP_WsessionEnum,
5637                 .fn = api_RNetSessionEnum,
5638                 .auth_user = true,
5639         },
5640         {
5641                 .name = "RNetServerGetInfo",
5642                 .id = RAP_WserverGetInfo,
5643                 .fn = api_RNetServerGetInfo
5644         },
5645         {
5646                 .name = "RNetGroupEnum",
5647                 .id = RAP_WGroupEnum,
5648                 .fn = api_RNetGroupEnum, True
5649         },
5650         {
5651                 .name = "RNetGroupGetUsers",
5652                 .id = RAP_WGroupGetUsers,
5653                 .fn = api_RNetGroupGetUsers,
5654                 .auth_user = true},
5655         {
5656                 .name = "RNetUserEnum",
5657                 .id = RAP_WUserEnum,
5658                 .fn = api_RNetUserEnum,
5659                 .auth_user = true,
5660         },
5661         {
5662                 .name = "RNetUserGetInfo",
5663                 .id = RAP_WUserGetInfo,
5664                 .fn = api_RNetUserGetInfo
5665         },
5666         {
5667                 .name = "NetUserGetGroups",
5668                 .id = RAP_WUserGetGroups,
5669                 .fn = api_NetUserGetGroups
5670         },
5671         {
5672                 .name = "NetWkstaGetInfo",
5673                 .id = RAP_WWkstaGetInfo,
5674                 .fn = api_NetWkstaGetInfo
5675         },
5676         {
5677                 .name = "DosPrintQEnum",
5678                 .id = RAP_WPrintQEnum,
5679                 .fn = api_DosPrintQEnum,
5680                 .auth_user = true,
5681         },
5682         {
5683                 .name = "DosPrintQGetInfo",
5684                 .id = RAP_WPrintQGetInfo,
5685                 .fn = api_DosPrintQGetInfo
5686         },
5687         {
5688                 .name = "WPrintQueuePause",
5689                 .id = RAP_WPrintQPause,
5690                 .fn = api_WPrintQueueCtrl
5691         },
5692         {
5693                 .name = "WPrintQueueResume",
5694                 .id = RAP_WPrintQContinue,
5695                 .fn = api_WPrintQueueCtrl
5696         },
5697         {
5698                 .name = "WPrintJobEnumerate",
5699                 .id = RAP_WPrintJobEnum,
5700                 .fn = api_WPrintJobEnumerate
5701         },
5702         {
5703                 .name = "WPrintJobGetInfo",
5704                 .id = RAP_WPrintJobGetInfo,
5705                 .fn = api_WPrintJobGetInfo
5706         },
5707         {
5708                 .name = "RDosPrintJobDel",
5709                 .id = RAP_WPrintJobDel,
5710                 .fn = api_RDosPrintJobDel
5711         },
5712         {
5713                 .name = "RDosPrintJobPause",
5714                 .id = RAP_WPrintJobPause,
5715                 .fn = api_RDosPrintJobDel
5716         },
5717         {
5718                 .name = "RDosPrintJobResume",
5719                 .id = RAP_WPrintJobContinue,
5720                 .fn = api_RDosPrintJobDel
5721         },
5722         {
5723                 .name = "WPrintDestEnum",
5724                 .id = RAP_WPrintDestEnum,
5725                 .fn = api_WPrintDestEnum
5726         },
5727         {
5728                 .name = "WPrintDestGetInfo",
5729                 .id = RAP_WPrintDestGetInfo,
5730                 .fn = api_WPrintDestGetInfo
5731         },
5732         {
5733                 .name = "NetRemoteTOD",
5734                 .id = RAP_NetRemoteTOD,
5735                 .fn = api_NetRemoteTOD
5736         },
5737         {
5738                 .name = "WPrintQueuePurge",
5739                 .id = RAP_WPrintQPurge,
5740                 .fn = api_WPrintQueueCtrl
5741         },
5742         {
5743                 .name = "NetServerEnum2",
5744                 .id = RAP_NetServerEnum2,
5745                 .fn = api_RNetServerEnum2
5746         }, /* anon OK */
5747         {
5748                 .name = "NetServerEnum3",
5749                 .id = RAP_NetServerEnum3,
5750                 .fn = api_RNetServerEnum3
5751         }, /* anon OK */
5752         {
5753                 .name = "WAccessGetUserPerms",
5754                 .id = RAP_WAccessGetUserPerms,
5755                 .fn = api_WAccessGetUserPerms
5756         },
5757         {
5758                 .name = "WWkstaUserLogon",
5759                 .id = RAP_WWkstaUserLogon,
5760                 .fn = api_WWkstaUserLogon
5761         },
5762         {
5763                 .name = "PrintJobInfo",
5764                 .id = RAP_WPrintJobSetInfo,
5765                 .fn = api_PrintJobInfo
5766         },
5767         {
5768                 .name = "WPrintDriverEnum",
5769                 .id = RAP_WPrintDriverEnum,
5770                 .fn = api_WPrintDriverEnum
5771         },
5772         {
5773                 .name = "WPrintQProcEnum",
5774                 .id = RAP_WPrintQProcessorEnum,
5775                 .fn = api_WPrintQProcEnum
5776         },
5777         {
5778                 .name = "WPrintPortEnum",
5779                 .id = RAP_WPrintPortEnum,
5780                 .fn = api_WPrintPortEnum
5781         },
5782         {
5783                 .name = "SamOEMChangePassword",
5784                 .id = RAP_SamOEMChgPasswordUser2_P,
5785                 .fn = api_SamOEMChangePassword
5786         }, /* anon OK */
5787         {
5788                 .name = NULL,
5789                 .id   = -1,
5790                 .fn   = api_Unsupported}
5791         /*
5792          * The following RAP calls are not implemented by Samba:
5793          *   RAP_WFileEnum2 - anon not OK
5794          */
5795 };
5796
5797
5798 /****************************************************************************
5799  Handle remote api calls.
5800 ****************************************************************************/
5801
5802 void api_reply(connection_struct *conn, uint64_t vuid,
5803                struct smb_request *req,
5804                char *data, char *params,
5805                int tdscnt, int tpscnt,
5806                int mdrcnt, int mprcnt)
5807 {
5808         int api_command;
5809         char *rdata = NULL;
5810         char *rparam = NULL;
5811         const char *name1 = NULL;
5812         const char *name2 = NULL;
5813         int rdata_len = 0;
5814         int rparam_len = 0;
5815         bool reply=False;
5816         int i;
5817
5818         if (!params) {
5819                 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
5820                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5821                 return;
5822         }
5823
5824         if (tpscnt < 2) {
5825                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5826                 return;
5827         }
5828         api_command = SVAL(params,0);
5829         /* Is there a string at position params+2 ? */
5830         if (skip_string(params,tpscnt,params+2)) {
5831                 name1 = params + 2;
5832         } else {
5833                 name1 = "";
5834         }
5835         name2 = skip_string(params,tpscnt,params+2);
5836         if (!name2) {
5837                 name2 = "";
5838         }
5839
5840         DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
5841                 api_command,
5842                 name1,
5843                 name2,
5844                 tdscnt,tpscnt,mdrcnt,mprcnt));
5845
5846         for (i=0;api_commands[i].name;i++) {
5847                 if (api_commands[i].id == api_command && api_commands[i].fn) {
5848                         DEBUG(3,("Doing %s\n",api_commands[i].name));
5849                         break;
5850                 }
5851         }
5852
5853         /* Check whether this api call can be done anonymously */
5854
5855         if (api_commands[i].auth_user && lp_restrict_anonymous()) {
5856                 struct auth_session_info *si = NULL;
5857                 NTSTATUS status;
5858
5859                 status = smbXsrv_session_info_lookup(conn->sconn->client,
5860                                                      vuid,
5861                                                      &si);
5862                 if (!NT_STATUS_IS_OK(status)) {
5863                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5864                         return;
5865                 }
5866
5867                 if (security_session_user_level(si, NULL) < SECURITY_USER) {
5868                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5869                         return;
5870                 }
5871         }
5872
5873         rdata = (char *)SMB_MALLOC(1024);
5874         if (rdata) {
5875                 memset(rdata,'\0',1024);
5876         }
5877
5878         rparam = (char *)SMB_MALLOC(1024);
5879         if (rparam) {
5880                 memset(rparam,'\0',1024);
5881         }
5882
5883         if(!rdata || !rparam) {
5884                 DEBUG(0,("api_reply: malloc fail !\n"));
5885                 SAFE_FREE(rdata);
5886                 SAFE_FREE(rparam);
5887                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5888                 return;
5889         }
5890
5891         reply = api_commands[i].fn(req->sconn, conn,
5892                                 vuid,
5893                                 params,tpscnt,  /* params + length */
5894                                 data,tdscnt,    /* data + length */
5895                                 mdrcnt,mprcnt,
5896                                 &rdata,&rparam,&rdata_len,&rparam_len);
5897
5898
5899         if (rdata_len > mdrcnt || rparam_len > mprcnt) {
5900                 reply = api_TooSmall(req->sconn,conn,vuid,params,data,
5901                                      mdrcnt,mprcnt,
5902                                         &rdata,&rparam,&rdata_len,&rparam_len);
5903         }
5904
5905         /* if we get False back then it's actually unsupported */
5906         if (!reply) {
5907                 reply = api_Unsupported(req->sconn,conn,vuid,params,tpscnt,
5908                                         data,
5909                                         tdscnt,mdrcnt,mprcnt,
5910                         &rdata,&rparam,&rdata_len,&rparam_len);
5911         }
5912
5913         /* If api_Unsupported returns false we can't return anything. */
5914         if (reply) {
5915                 send_trans_reply(conn, req, rparam, rparam_len,
5916                                  rdata, rdata_len, False);
5917         }
5918
5919         SAFE_FREE(rdata);
5920         SAFE_FREE(rparam);
5921         return;
5922 }