source3/printing/printspoolss.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Printing routines that bridge to spoolss
   4    Copyright (C) Simo Sorce 2010
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/filesys.h"
  22 #include "printing.h"
  23 #include "rpc_client/rpc_client.h"
  24 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  25 #include "rpc_server/rpc_ncacn_np.h"
  26 #include "smbd/globals.h"
  27 #include "../libcli/security/security.h"
  28
  29 struct print_file_data {
  30         char *svcname;
  31         char *docname;
  32         char *filename;
  33         uint64_t offset;
  34         struct rpc_pipe_client *spoolss_pipe;
  35         struct policy_handle handle;
  36         uint32_t jobid;
  37         uint16_t rap_jobid;
  38 };
  39
  40 uint16_t print_spool_rap_jobid(struct print_file_data *print_file)
  41 {
  42         if (print_file == NULL) {
  43                 return 0;
  44         }
  45
  46         return print_file->rap_jobid;
  47 }
  48
  49 void print_spool_terminate(struct connection_struct *conn,
  50                            struct print_file_data *print_file);
  51
  52 /***************************************************************************
  53  * Open a Document over spoolss
  54  ***************************************************************************/
  55
  56 #define DOCNAME_DEFAULT "Remote Downlevel Document"
  57
  58 NTSTATUS print_spool_open(files_struct *fsp,
  59                           const char *fname,
  60                           uint64_t current_vuid)
  61 {
  62         NTSTATUS status;
  63         TALLOC_CTX *tmp_ctx;
  64         struct print_file_data *pf;
  65         struct dcerpc_binding_handle *b = NULL;
  66         struct spoolss_DevmodeContainer devmode_ctr;
  67         struct spoolss_DocumentInfoCtr info_ctr;
  68         struct spoolss_DocumentInfo1 *info1;
  69         int fd = -1;
  70         WERROR werr;
  71         mode_t mask;
  72
  73         tmp_ctx = talloc_new(fsp);
  74         if (!tmp_ctx) {
  75                 return NT_STATUS_NO_MEMORY;
  76         }
  77
  78         pf = talloc_zero(fsp, struct print_file_data);
  79         if (!pf) {
  80                 status = NT_STATUS_NO_MEMORY;
  81                 goto done;
  82         }
  83         pf->svcname = lp_servicename(pf, SNUM(fsp->conn));
  84
  85         /* the document name is derived from the file name.
  86          * "Remote Downlevel Document" is added in front to
  87          * mimic what windows does in this case */
  88         pf->docname = talloc_strdup(pf, DOCNAME_DEFAULT);
  89         if (!pf->docname) {
  90                 status = NT_STATUS_NO_MEMORY;
  91                 goto done;
  92         }
  93         if (fname) {
  94                 const char *p = strrchr(fname, '/');
  95                 if (!p) {
  96                         p = fname;
  97                 }
  98                 pf->docname = talloc_asprintf_append(pf->docname, " %s", p);
  99                 if (!pf->docname) {
 100                         status = NT_STATUS_NO_MEMORY;
 101                         goto done;
 102                 }
 103         }
 104
 105         /*
 106          * Ok, now we have to open an actual file.
 107          * Here is the reason:
 108          * We want to write the spool job to this file in
 109          * smbd for scalability reason (and also because
 110          * apparently window printer drivers can seek when
 111          * spooling to a file).
 112          * So we first create a file, and then we pass it
 113          * to spoolss in output_file so it can monitor and
 114          * take over once we call EndDocPrinter().
 115          * Of course we will not start writing until
 116          * StartDocPrinter() actually gives the ok.
 117          * smbd spooler files do not include a print jobid
 118          * path component, as the jobid is only known after
 119          * calling StartDocPrinter().
 120          */
 121
 122         pf->filename = talloc_asprintf(pf, "%s/%sXXXXXX",
 123                                         lp_path(talloc_tos(),
 124                                                 SNUM(fsp->conn)),
 125                                         PRINT_SPOOL_PREFIX);
 126         pf->filename = talloc_asprintf(pf, "%s.raw", pf->docname);
 127         if (!pf->filename) {
 128                 status = NT_STATUS_NO_MEMORY;
 129                 goto done;
 130         }
 131         errno = 0;
 132         mask = umask(S_IRWXO | S_IRWXG);
 133         fd = -1;// mkstemp(pf->filename);
 134         umask(mask);
 135         //if (fd == -1) {
 136         //      if (errno == EACCES) {
 137         //              /* Common setup error, force a report. */
 138         //              DEBUG(0, ("Insufficient permissions "
 139         //                        "to open spool file %s.\n",
 140         //                        pf->filename));
 141         //      } else {
 142         //              /* Normal case, report at level 3 and above. */
 143         //              DEBUG(3, ("can't open spool file %s,\n",
 144         //                        pf->filename));
 145         //              DEBUGADD(3, ("errno = %d (%s).\n",
 146         //                           errno, strerror(errno)));
 147         //      }
 148         //      status = map_nt_error_from_unix(errno);
 149         //      goto done;
 150         //}
 151
 152         /* now open a document over spoolss so that it does
 153          * all printer verification, and eventually assigns
 154          * a job id */
 155
 156         status = rpc_pipe_open_interface(fsp->conn,
 157                                          &ndr_table_spoolss,
 158                                          fsp->conn->session_info,
 159                                          fsp->conn->sconn->remote_address,
 160                                          fsp->conn->sconn->local_address,
 161                                          fsp->conn->sconn->msg_ctx,
 162                                          &pf->spoolss_pipe);
 163         if (!NT_STATUS_IS_OK(status)) {
 164                 goto done;
 165         }
 166         b = pf->spoolss_pipe->binding_handle;
 167
 168         ZERO_STRUCT(devmode_ctr);
 169
 170         status = dcerpc_spoolss_OpenPrinter(b, pf, pf->svcname,
 171                                             "RAW", devmode_ctr,
 172                                             PRINTER_ACCESS_USE,
 173                                             &pf->handle, &werr);
 174         if (!NT_STATUS_IS_OK(status)) {
 175                 goto done;
 176         }
 177         if (!W_ERROR_IS_OK(werr)) {
 178                 status = werror_to_ntstatus(werr);
 179                 goto done;
 180         }
 181
 182         info1 = talloc(tmp_ctx, struct spoolss_DocumentInfo1);
 183         if (info1 == NULL) {
 184                 status = NT_STATUS_NO_MEMORY;
 185                 goto done;
 186         }
 187         info1->document_name = pf->docname;
 188         info1->output_file = pf->filename;
 189         info1->datatype = "RAW";
 190
 191         info_ctr.level = 1;
 192         info_ctr.info.info1 = info1;
 193
 194         status = dcerpc_spoolss_StartDocPrinter(b, tmp_ctx,
 195                                                 &pf->handle,
 196                                                 &info_ctr,
 197                                                 &pf->jobid,
 198                                                 &werr);
 199         if (!NT_STATUS_IS_OK(status)) {
 200                 goto done;
 201         }
 202         if (!W_ERROR_IS_OK(werr)) {
 203                 status = werror_to_ntstatus(werr);
 204                 goto done;
 205         }
 206
 207         /* Convert to RAP id. */
 208         pf->rap_jobid = pjobid_to_rap(pf->svcname, pf->jobid);
 209         if (pf->rap_jobid == 0) {
 210                 /* No errno around here */
 211                 status = NT_STATUS_ACCESS_DENIED;
 212                 goto done;
 213         }
 214
 215         /* setup a full fsp */
 216         fsp->fsp_name = synthetic_smb_fname(fsp, pf->filename, NULL, NULL, 0);
 217         if (fsp->fsp_name == NULL) {
 218                 status = NT_STATUS_NO_MEMORY;
 219                 goto done;
 220         }
 221
 222         //if (sys_fstat(fd, &fsp->fsp_name->st, false) != 0) {
 223         //      status = map_nt_error_from_unix(errno);
 224         //      goto done;
 225         //}
 226
 227         //fsp->file_id = vfs_file_id_from_sbuf(fsp->conn, &fsp->fsp_name->st);
 228         //fsp->fh->fd = fd;
 229
 230         fsp->vuid = current_vuid;
 231         fsp->can_lock = false;
 232         fsp->can_read = false;
 233         fsp->access_mask = FILE_GENERIC_WRITE;
 234         fsp->can_write = true;
 235         fsp->modified = false;
 236         fsp->oplock_type = NO_OPLOCK;
 237         fsp->sent_oplock_break = NO_BREAK_SENT;
 238         fsp->is_directory = false;
 239
 240         fsp->print_file = pf;
 241
 242         status = NT_STATUS_OK;
 243 done:
 244         if (!NT_STATUS_IS_OK(status)) {
 245                 if (fd != -1) {
 246                         close(fd);
 247                         if (fsp->print_file) {
 248                                 unlink(fsp->print_file->filename);
 249                         }
 250                 }
 251                 /* We need to delete the job from spoolss too */
 252                 if (pf && pf->jobid) {
 253                         print_spool_terminate(fsp->conn, pf);
 254                 }
 255                 TALLOC_FREE(pf);
 256         }
 257         talloc_free(tmp_ctx);
 258         return status;
 259 }
 260
 261 int print_spool_write(files_struct *fsp,
 262                       const char *data, uint32_t size,
 263                       off_t offset, uint32_t *written)
 264 {
 265         struct print_file_data *pf = fsp->print_file;
 266         NTSTATUS status;
 267         TALLOC_CTX *tmp_ctx = talloc_tos();
 268         struct dcerpc_binding_handle *b = NULL;
 269         DATA_BLOB buffer;
 270         //int fd = -1;
 271         WERROR werr;
 272         SMB_STRUCT_STAT st;
 273         ssize_t n;
 274         int ret;
 275         uint64_t remaining;
 276
 277         *written = 0;
 278
 279         if (pf == NULL) {
 280                 return EBADF;
 281         }
 282         if (pf->spoolss_pipe == NULL) {
 283                 return EBADF;
 284         }
 285         b = pf->spoolss_pipe->binding_handle;
 286
 287         /* When print files go beyond 4GB, the 32-bit offset sent in
 288          * old SMBwrite calls is relative to the current 4GB chunk
 289          * we're writing to.
 290          *    Discovered by Sebastian Kloska <oncaphillis@snafu.de>.
 291          */
 292         if (offset < 0xffffffff00000000LL) {
 293                 offset = (pf->offset & 0xffffffff00000000LL) + offset;
 294         }
 295
 296         if ((uint64_t)offset != pf->offset) {
 297                 // TODO: check what windows does, with non sequential
 298                 // writes.
 299                 ret = EINVAL;
 300                 goto error;
 301         }
 302
 303         remaining = UINT64_MAX - pf->offset;
 304         if (size > remaining) {
 305                 ret = EINVAL;
 306                 goto error;
 307         }
 308
 309         buffer = data_blob_const(data, size);
 310
 311         status = dcerpc_spoolss_WritePrinter(b, tmp_ctx,
 312                                              &pf->handle,
 313                                              buffer,
 314                                              buffer.length,
 315                                              written,
 316                                              &werr);
 317         if (!NT_STATUS_IS_OK(status)) {
 318                 ret = EINVAL;
 319                 goto error;
 320         }
 321         if (!W_ERROR_IS_OK(werr)) {
 322                 //status = werror_to_ntstatus(werr);
 323                 ret = EINVAL;
 324                 goto error;
 325         }
 326
 327         if (*written > size) {
 328                 //status = NT_STATUS_INVALID_PARAMETER;
 329                 ret = EINVAL;
 330                 goto error;
 331         }
 332
 333         pf->offset += *written;
 334         return 0;
 335 error:
 336         print_spool_terminate(fsp->conn, fsp->print_file);
 337         return ret;
 338         /* first of all stat file to find out if it is still there.
 339          * spoolss may have deleted it to signal someone has killed
 340          * the job through it's interface */
 341
 342         if (sys_fstat(fsp->fh->fd, &st, false) != 0) {
 343                 ret = errno;
 344                 DEBUG(3, ("printfile_offset: sys_fstat failed on %s (%s)\n",
 345                           fsp_str_dbg(fsp), strerror(ret)));
 346                 return ret;
 347         }
 348
 349         /* check if the file is unlinked, this will signal spoolss has
 350          * killed it, just return an error and close the file */
 351         if (st.st_ex_nlink == 0) {
 352                 close(fsp->fh->fd);
 353                 return EBADF;
 354         }
 355
 356         /* When print files go beyond 4GB, the 32-bit offset sent in
 357          * old SMBwrite calls is relative to the current 4GB chunk
 358          * we're writing to.
 359          *    Discovered by Sebastian Kloska <oncaphillis@snafu.de>.
 360          */
 361         if (offset < 0xffffffff00000000LL) {
 362                 offset = (st.st_ex_size & 0xffffffff00000000LL) + offset;
 363         }
 364
 365         n = write_data_at_offset(fsp->fh->fd, data, size, offset);
 366         if (n == -1) {
 367                 ret = errno;
 368                 print_spool_terminate(fsp->conn, fsp->print_file);
 369         } else {
 370                 *written = n;
 371                 ret = 0;
 372         }
 373
 374         return ret;
 375 }
 376
 377 void print_spool_end(files_struct *fsp, enum file_close_type close_type)
 378 {
 379         struct print_file_data *pf = fsp->print_file;
 380         NTSTATUS status;
 381         WERROR werr;
 382         struct dcerpc_binding_handle *b = NULL;
 383
 384         if (fsp->fh->private_options &
 385             NTCREATEX_OPTIONS_PRIVATE_DELETE_ON_CLOSE) {
 386                 int ret;
 387
 388                 /*
 389                  * Job was requested to be cancelled by setting
 390                  * delete on close so truncate the job file.
 391                  * print_job_end() which is called from
 392                  * _spoolss_EndDocPrinter() will take
 393                  * care of deleting it for us.
 394                  */
 395                 ret = ftruncate(fsp->fh->fd, 0);
 396                 if (ret == -1) {
 397                         DBG_ERR("ftruncate failed: %s\n", strerror(errno));
 398                 }
 399         }
 400
 401         if (pf->spoolss_pipe == NULL) {
 402                 return;
 403         }
 404         b = pf->spoolss_pipe->binding_handle;
 405
 406         switch (close_type) {
 407         case NORMAL_CLOSE:
 408         case SHUTDOWN_CLOSE:
 409                 /* this also automatically calls spoolss_EndDocPrinter */
 410                 status = dcerpc_spoolss_ClosePrinter(b, fsp->print_file,
 411                                                 &fsp->print_file->handle,
 412                                                 &werr);
 413                 if (!NT_STATUS_IS_OK(status) ||
 414                     !NT_STATUS_IS_OK(status = werror_to_ntstatus(werr))) {
 415                         DEBUG(3, ("Failed to close printer %s [%s]\n",
 416                               fsp->print_file->svcname, nt_errstr(status)));
 417                 }
 418                 break;
 419         case ERROR_CLOSE:
 420                 print_spool_terminate(fsp->conn, fsp->print_file);
 421                 break;
 422         }
 423         TALLOC_FREE(fsp->print_file);
 424 }
 425
 426
 427 void print_spool_terminate(struct connection_struct *conn,
 428                            struct print_file_data *print_file)
 429 {
 430         NTSTATUS status;
 431         WERROR werr;
 432         struct dcerpc_binding_handle *b = NULL;
 433
 434         rap_jobid_delete(print_file->svcname, print_file->jobid);
 435
 436         //status = rpc_pipe_open_interface(conn,
 437         //                               &ndr_table_spoolss,
 438         //                               conn->session_info,
 439         //                               conn->sconn->remote_address,
 440         //                               conn->sconn->local_address,
 441         //                               conn->sconn->msg_ctx,
 442         //                               &conn->spoolss_pipe);
 443         //if (!NT_STATUS_IS_OK(status)) {
 444         //      DEBUG(0, ("print_spool_terminate: "
 445         //                "Failed to get spoolss pipe [%s]\n",
 446         //                nt_errstr(status)));
 447         //      return;
 448         //}
 449         if (print_file->spoolss_pipe == NULL) {
 450                 return;
 451         }
 452         b = print_file->spoolss_pipe->binding_handle;
 453
 454         status = dcerpc_spoolss_AbortPrinter(b, print_file,
 455                                              &print_file->handle,
 456                                              &werr);
 457         if (!NT_STATUS_IS_OK(status) ||
 458             !NT_STATUS_IS_OK(status = werror_to_ntstatus(werr))) {
 459                 DEBUG(3, ("Failed to abort printer job %d [%s]\n",
 460                           print_file->jobid, nt_errstr(status)));
 461                 return;
 462         }
 463         status = dcerpc_spoolss_ClosePrinter(b, print_file,
 464                                              &print_file->handle,
 465                                              &werr);
 466         if (!NT_STATUS_IS_OK(status) ||
 467             !NT_STATUS_IS_OK(status = werror_to_ntstatus(werr))) {
 468                 DEBUG(3, ("Failed to close printer %s [%s]\n",
 469                           print_file->svcname, nt_errstr(status)));
 470                 return;
 471         }
 472 }