source3/smbd/lanman.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Inter-process communication and named pipe handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Jeremy Allison 2007.
   6
   7    SMB Version handling
   8    Copyright (C) John H Terpstra 1995-1998
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22    */
  23 /*
  24    This file handles the named pipe and mailslot calls
  25    in the SMBtrans protocol
  26    */
  27
  28 #include "includes.h"
  29 #include "smbd/globals.h"
  30 #include "../librpc/gen_ndr/cli_samr.h"
  31 #include "../librpc/gen_ndr/srv_samr.h"
  32 #include "../lib/util/binsearch.h"
  33
  34 #ifdef CHECK_TYPES
  35 #undef CHECK_TYPES
  36 #endif
  37 #define CHECK_TYPES 0
  38
  39 #define NERR_Success 0
  40 #define NERR_badpass 86
  41 #define NERR_notsupported 50
  42
  43 #define NERR_BASE (2100)
  44 #define NERR_BufTooSmall (NERR_BASE+23)
  45 #define NERR_JobNotFound (NERR_BASE+51)
  46 #define NERR_DestNotFound (NERR_BASE+52)
  47
  48 #define ACCESS_READ 0x01
  49 #define ACCESS_WRITE 0x02
  50 #define ACCESS_CREATE 0x04
  51
  52 #define SHPWLEN 8               /* share password length */
  53
  54 /* Limit size of ipc replies */
  55
  56 static char *smb_realloc_limit(void *ptr, size_t size)
  57 {
  58         char *val;
  59
  60         size = MAX((size),4*1024);
  61         val = (char *)SMB_REALLOC(ptr,size);
  62         if (val) {
  63                 memset(val,'\0',size);
  64         }
  65         return val;
  66 }
  67
  68 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
  69                                 char *param, int tpscnt,
  70                                 char *data, int tdscnt,
  71                                 int mdrcnt, int mprcnt,
  72                                 char **rdata, char **rparam,
  73                                 int *rdata_len, int *rparam_len);
  74
  75 static bool api_TooSmall(connection_struct *conn, uint16 vuid, char *param, char *data,
  76                          int mdrcnt, int mprcnt,
  77                          char **rdata, char **rparam,
  78                          int *rdata_len, int *rparam_len);
  79
  80
  81 static int CopyExpanded(connection_struct *conn,
  82                         int snum, char **dst, char *src, int *p_space_remaining)
  83 {
  84         TALLOC_CTX *ctx = talloc_tos();
  85         char *buf = NULL;
  86         int l;
  87
  88         if (!src || !dst || !p_space_remaining || !(*dst) ||
  89                         *p_space_remaining <= 0) {
  90                 return 0;
  91         }
  92
  93         buf = talloc_strdup(ctx, src);
  94         if (!buf) {
  95                 *p_space_remaining = 0;
  96                 return 0;
  97         }
  98         buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
  99         if (!buf) {
 100                 *p_space_remaining = 0;
 101                 return 0;
 102         }
 103         buf = talloc_sub_advanced(ctx,
 104                                 lp_servicename(SNUM(conn)),
 105                                 conn->server_info->unix_name,
 106                                 conn->connectpath,
 107                                 conn->server_info->utok.gid,
 108                                 conn->server_info->sanitized_username,
 109                                 pdb_get_domain(conn->server_info->sam_account),
 110                                 buf);
 111         if (!buf) {
 112                 *p_space_remaining = 0;
 113                 return 0;
 114         }
 115         l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
 116         if (l == -1) {
 117                 return 0;
 118         }
 119         (*dst) += l;
 120         (*p_space_remaining) -= l;
 121         return l;
 122 }
 123
 124 static int CopyAndAdvance(char **dst, char *src, int *n)
 125 {
 126         int l;
 127         if (!src || !dst || !n || !(*dst)) {
 128                 return 0;
 129         }
 130         l = push_ascii(*dst,src,*n, STR_TERMINATE);
 131         if (l == -1) {
 132                 return 0;
 133         }
 134         (*dst) += l;
 135         (*n) -= l;
 136         return l;
 137 }
 138
 139 static int StrlenExpanded(connection_struct *conn, int snum, char *s)
 140 {
 141         TALLOC_CTX *ctx = talloc_tos();
 142         char *buf = NULL;
 143         if (!s) {
 144                 return 0;
 145         }
 146         buf = talloc_strdup(ctx,s);
 147         if (!buf) {
 148                 return 0;
 149         }
 150         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 151         if (!buf) {
 152                 return 0;
 153         }
 154         buf = talloc_sub_advanced(ctx,
 155                                 lp_servicename(SNUM(conn)),
 156                                 conn->server_info->unix_name,
 157                                 conn->connectpath,
 158                                 conn->server_info->utok.gid,
 159                                 conn->server_info->sanitized_username,
 160                                 pdb_get_domain(conn->server_info->sam_account),
 161                                 buf);
 162         if (!buf) {
 163                 return 0;
 164         }
 165         return strlen(buf) + 1;
 166 }
 167
 168 static char *Expand(connection_struct *conn, int snum, char *s)
 169 {
 170         TALLOC_CTX *ctx = talloc_tos();
 171         char *buf = NULL;
 172
 173         if (!s) {
 174                 return NULL;
 175         }
 176         buf = talloc_strdup(ctx,s);
 177         if (!buf) {
 178                 return 0;
 179         }
 180         buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
 181         if (!buf) {
 182                 return 0;
 183         }
 184         return talloc_sub_advanced(ctx,
 185                                 lp_servicename(SNUM(conn)),
 186                                 conn->server_info->unix_name,
 187                                 conn->connectpath,
 188                                 conn->server_info->utok.gid,
 189                                 conn->server_info->sanitized_username,
 190                                 pdb_get_domain(conn->server_info->sam_account),
 191                                 buf);
 192 }
 193
 194 /*******************************************************************
 195  Check a API string for validity when we only need to check the prefix.
 196 ******************************************************************/
 197
 198 static bool prefix_ok(const char *str, const char *prefix)
 199 {
 200         return(strncmp(str,prefix,strlen(prefix)) == 0);
 201 }
 202
 203 struct pack_desc {
 204         const char *format;         /* formatstring for structure */
 205         const char *subformat;  /* subformat for structure */
 206         char *base;         /* baseaddress of buffer */
 207         int buflen;        /* remaining size for fixed part; on init: length of base */
 208         int subcount;       /* count of substructures */
 209         char *structbuf;  /* pointer into buffer for remaining fixed part */
 210         int stringlen;    /* remaining size for variable part */
 211         char *stringbuf;  /* pointer into buffer for remaining variable part */
 212         int neededlen;    /* total needed size */
 213         int usedlen;        /* total used size (usedlen <= neededlen and usedlen <= buflen) */
 214         const char *curpos;         /* current position; pointer into format or subformat */
 215         int errcode;
 216 };
 217
 218 static int get_counter(const char **p)
 219 {
 220         int i, n;
 221         if (!p || !(*p)) {
 222                 return 1;
 223         }
 224         if (!isdigit((int)**p)) {
 225                 return 1;
 226         }
 227         for (n = 0;;) {
 228                 i = **p;
 229                 if (isdigit(i)) {
 230                         n = 10 * n + (i - '0');
 231                 } else {
 232                         return n;
 233                 }
 234                 (*p)++;
 235         }
 236 }
 237
 238 static int getlen(const char *p)
 239 {
 240         int n = 0;
 241         if (!p) {
 242                 return 0;
 243         }
 244
 245         while (*p) {
 246                 switch( *p++ ) {
 247                 case 'W':                       /* word (2 byte) */
 248                         n += 2;
 249                         break;
 250                 case 'K':                       /* status word? (2 byte) */
 251                         n += 2;
 252                         break;
 253                 case 'N':                       /* count of substructures (word) at end */
 254                         n += 2;
 255                         break;
 256                 case 'D':                       /* double word (4 byte) */
 257                 case 'z':                       /* offset to zero terminated string (4 byte) */
 258                 case 'l':                       /* offset to user data (4 byte) */
 259                         n += 4;
 260                         break;
 261                 case 'b':                       /* offset to data (with counter) (4 byte) */
 262                         n += 4;
 263                         get_counter(&p);
 264                         break;
 265                 case 'B':                       /* byte (with optional counter) */
 266                         n += get_counter(&p);
 267                         break;
 268                 }
 269         }
 270         return n;
 271 }
 272
 273 static bool init_package(struct pack_desc *p, int count, int subcount)
 274 {
 275         int n = p->buflen;
 276         int i;
 277
 278         if (!p->format || !p->base) {
 279                 return False;
 280         }
 281
 282         i = count * getlen(p->format);
 283         if (p->subformat) {
 284                 i += subcount * getlen(p->subformat);
 285         }
 286         p->structbuf = p->base;
 287         p->neededlen = 0;
 288         p->usedlen = 0;
 289         p->subcount = 0;
 290         p->curpos = p->format;
 291         if (i > n) {
 292                 p->neededlen = i;
 293                 i = n = 0;
 294 #if 0
 295                 /*
 296                  * This is the old error code we used. Aparently
 297                  * WinNT/2k systems return ERRbuftoosmall (2123) and
 298                  * OS/2 needs this. I'm leaving this here so we can revert
 299                  * if needed. JRA.
 300                  */
 301                 p->errcode = ERRmoredata;
 302 #else
 303                 p->errcode = ERRbuftoosmall;
 304 #endif
 305         } else {
 306                 p->errcode = NERR_Success;
 307         }
 308         p->buflen = i;
 309         n -= i;
 310         p->stringbuf = p->base + i;
 311         p->stringlen = n;
 312         return (p->errcode == NERR_Success);
 313 }
 314
 315 static int package(struct pack_desc *p, ...)
 316 {
 317         va_list args;
 318         int needed=0, stringneeded;
 319         const char *str=NULL;
 320         int is_string=0, stringused;
 321         int32 temp;
 322
 323         va_start(args,p);
 324
 325         if (!*p->curpos) {
 326                 if (!p->subcount) {
 327                         p->curpos = p->format;
 328                 } else {
 329                         p->curpos = p->subformat;
 330                         p->subcount--;
 331                 }
 332         }
 333 #if CHECK_TYPES
 334         str = va_arg(args,char*);
 335         SMB_ASSERT(strncmp(str,p->curpos,strlen(str)) == 0);
 336 #endif
 337         stringneeded = -1;
 338
 339         if (!p->curpos) {
 340                 va_end(args);
 341                 return 0;
 342         }
 343
 344         switch( *p->curpos++ ) {
 345                 case 'W':                       /* word (2 byte) */
 346                         needed = 2;
 347                         temp = va_arg(args,int);
 348                         if (p->buflen >= needed) {
 349                                 SSVAL(p->structbuf,0,temp);
 350                         }
 351                         break;
 352                 case 'K':                       /* status word? (2 byte) */
 353                         needed = 2;
 354                         temp = va_arg(args,int);
 355                         if (p->buflen >= needed) {
 356                                 SSVAL(p->structbuf,0,temp);
 357                         }
 358                         break;
 359                 case 'N':                       /* count of substructures (word) at end */
 360                         needed = 2;
 361                         p->subcount = va_arg(args,int);
 362                         if (p->buflen >= needed) {
 363                                 SSVAL(p->structbuf,0,p->subcount);
 364                         }
 365                         break;
 366                 case 'D':                       /* double word (4 byte) */
 367                         needed = 4;
 368                         temp = va_arg(args,int);
 369                         if (p->buflen >= needed) {
 370                                 SIVAL(p->structbuf,0,temp);
 371                         }
 372                         break;
 373                 case 'B':                       /* byte (with optional counter) */
 374                         needed = get_counter(&p->curpos);
 375                         {
 376                                 char *s = va_arg(args,char*);
 377                                 if (p->buflen >= needed) {
 378                                         StrnCpy(p->structbuf,s?s:"",needed-1);
 379                                 }
 380                         }
 381                         break;
 382                 case 'z':                       /* offset to zero terminated string (4 byte) */
 383                         str = va_arg(args,char*);
 384                         stringneeded = (str ? strlen(str)+1 : 0);
 385                         is_string = 1;
 386                         break;
 387                 case 'l':                       /* offset to user data (4 byte) */
 388                         str = va_arg(args,char*);
 389                         stringneeded = va_arg(args,int);
 390                         is_string = 0;
 391                         break;
 392                 case 'b':                       /* offset to data (with counter) (4 byte) */
 393                         str = va_arg(args,char*);
 394                         stringneeded = get_counter(&p->curpos);
 395                         is_string = 0;
 396                         break;
 397         }
 398
 399         va_end(args);
 400         if (stringneeded >= 0) {
 401                 needed = 4;
 402                 if (p->buflen >= needed) {
 403                         stringused = stringneeded;
 404                         if (stringused > p->stringlen) {
 405                                 stringused = (is_string ? p->stringlen : 0);
 406                                 if (p->errcode == NERR_Success) {
 407                                         p->errcode = ERRmoredata;
 408                                 }
 409                         }
 410                         if (!stringused) {
 411                                 SIVAL(p->structbuf,0,0);
 412                         } else {
 413                                 SIVAL(p->structbuf,0,PTR_DIFF(p->stringbuf,p->base));
 414                                 memcpy(p->stringbuf,str?str:"",stringused);
 415                                 if (is_string) {
 416                                         p->stringbuf[stringused-1] = '\0';
 417                                 }
 418                                 p->stringbuf += stringused;
 419                                 p->stringlen -= stringused;
 420                                 p->usedlen += stringused;
 421                         }
 422                 }
 423                 p->neededlen += stringneeded;
 424         }
 425
 426         p->neededlen += needed;
 427         if (p->buflen >= needed) {
 428                 p->structbuf += needed;
 429                 p->buflen -= needed;
 430                 p->usedlen += needed;
 431         } else {
 432                 if (p->errcode == NERR_Success) {
 433                         p->errcode = ERRmoredata;
 434                 }
 435         }
 436         return 1;
 437 }
 438
 439 #if CHECK_TYPES
 440 #define PACK(desc,t,v) package(desc,t,v,0,0,0,0)
 441 #define PACKl(desc,t,v,l) package(desc,t,v,l,0,0,0,0)
 442 #else
 443 #define PACK(desc,t,v) package(desc,v)
 444 #define PACKl(desc,t,v,l) package(desc,v,l)
 445 #endif
 446
 447 static void PACKI(struct pack_desc* desc, const char *t,int v)
 448 {
 449         PACK(desc,t,v);
 450 }
 451
 452 static void PACKS(struct pack_desc* desc,const char *t,const char *v)
 453 {
 454         PACK(desc,t,v);
 455 }
 456
 457 /****************************************************************************
 458  Get a print queue.
 459 ****************************************************************************/
 460
 461 static void PackDriverData(struct pack_desc* desc)
 462 {
 463         char drivdata[4+4+32];
 464         SIVAL(drivdata,0,sizeof drivdata); /* cb */
 465         SIVAL(drivdata,4,1000); /* lVersion */
 466         memset(drivdata+8,0,32);        /* szDeviceName */
 467         push_ascii(drivdata+8,"NULL",32, STR_TERMINATE);
 468         PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */
 469 }
 470
 471 static int check_printq_info(struct pack_desc* desc,
 472                                 unsigned int uLevel, char *id1, char *id2)
 473 {
 474         desc->subformat = NULL;
 475         switch( uLevel ) {
 476                 case 0:
 477                         desc->format = "B13";
 478                         break;
 479                 case 1:
 480                         desc->format = "B13BWWWzzzzzWW";
 481                         break;
 482                 case 2:
 483                         desc->format = "B13BWWWzzzzzWN";
 484                         desc->subformat = "WB21BB16B10zWWzDDz";
 485                         break;
 486                 case 3:
 487                         desc->format = "zWWWWzzzzWWzzl";
 488                         break;
 489                 case 4:
 490                         desc->format = "zWWWWzzzzWNzzl";
 491                         desc->subformat = "WWzWWDDzz";
 492                         break;
 493                 case 5:
 494                         desc->format = "z";
 495                         break;
 496                 case 51:
 497                         desc->format = "K";
 498                         break;
 499                 case 52:
 500                         desc->format = "WzzzzzzzzN";
 501                         desc->subformat = "z";
 502                         break;
 503                 default:
 504                         DEBUG(0,("check_printq_info: invalid level %d\n",
 505                                 uLevel ));
 506                         return False;
 507         }
 508         if (id1 == NULL || strcmp(desc->format,id1) != 0) {
 509                 DEBUG(0,("check_printq_info: invalid format %s\n",
 510                         id1 ? id1 : "<NULL>" ));
 511                 return False;
 512         }
 513         if (desc->subformat && (id2 == NULL || strcmp(desc->subformat,id2) != 0)) {
 514                 DEBUG(0,("check_printq_info: invalid subformat %s\n",
 515                         id2 ? id2 : "<NULL>" ));
 516                 return False;
 517         }
 518         return True;
 519 }
 520
 521
 522 #define RAP_JOB_STATUS_QUEUED 0
 523 #define RAP_JOB_STATUS_PAUSED 1
 524 #define RAP_JOB_STATUS_SPOOLING 2
 525 #define RAP_JOB_STATUS_PRINTING 3
 526 #define RAP_JOB_STATUS_PRINTED 4
 527
 528 #define RAP_QUEUE_STATUS_PAUSED 1
 529 #define RAP_QUEUE_STATUS_ERROR 2
 530
 531 /* turn a print job status into a on the wire status
 532 */
 533 static int printj_status(int v)
 534 {
 535         switch (v) {
 536         case LPQ_QUEUED:
 537                 return RAP_JOB_STATUS_QUEUED;
 538         case LPQ_PAUSED:
 539                 return RAP_JOB_STATUS_PAUSED;
 540         case LPQ_SPOOLING:
 541                 return RAP_JOB_STATUS_SPOOLING;
 542         case LPQ_PRINTING:
 543                 return RAP_JOB_STATUS_PRINTING;
 544         }
 545         return 0;
 546 }
 547
 548 /* turn a print queue status into a on the wire status
 549 */
 550 static int printq_status(int v)
 551 {
 552         switch (v) {
 553         case LPQ_QUEUED:
 554                 return 0;
 555         case LPQ_PAUSED:
 556                 return RAP_QUEUE_STATUS_PAUSED;
 557         }
 558         return RAP_QUEUE_STATUS_ERROR;
 559 }
 560
 561 static void fill_printjob_info(connection_struct *conn, int snum, int uLevel,
 562                                struct pack_desc *desc,
 563                                print_queue_struct *queue, int n)
 564 {
 565         time_t t = queue->time;
 566
 567         /* the client expects localtime */
 568         t -= get_time_zone(t);
 569
 570         PACKI(desc,"W",pjobid_to_rap(lp_const_servicename(snum),queue->job)); /* uJobId */
 571         if (uLevel == 1) {
 572                 PACKS(desc,"B21",queue->fs_user); /* szUserName */
 573                 PACKS(desc,"B","");             /* pad */
 574                 PACKS(desc,"B16","");   /* szNotifyName */
 575                 PACKS(desc,"B10","PM_Q_RAW"); /* szDataType */
 576                 PACKS(desc,"z","");             /* pszParms */
 577                 PACKI(desc,"W",n+1);            /* uPosition */
 578                 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
 579                 PACKS(desc,"z","");             /* pszStatus */
 580                 PACKI(desc,"D",t); /* ulSubmitted */
 581                 PACKI(desc,"D",queue->size); /* ulSize */
 582                 PACKS(desc,"z",queue->fs_file); /* pszComment */
 583         }
 584         if (uLevel == 2 || uLevel == 3 || uLevel == 4) {
 585                 PACKI(desc,"W",queue->priority);                /* uPriority */
 586                 PACKS(desc,"z",queue->fs_user); /* pszUserName */
 587                 PACKI(desc,"W",n+1);            /* uPosition */
 588                 PACKI(desc,"W",printj_status(queue->status)); /* fsStatus */
 589                 PACKI(desc,"D",t); /* ulSubmitted */
 590                 PACKI(desc,"D",queue->size); /* ulSize */
 591                 PACKS(desc,"z","Samba");        /* pszComment */
 592                 PACKS(desc,"z",queue->fs_file); /* pszDocument */
 593                 if (uLevel == 3) {
 594                         PACKS(desc,"z","");     /* pszNotifyName */
 595                         PACKS(desc,"z","PM_Q_RAW"); /* pszDataType */
 596                         PACKS(desc,"z","");     /* pszParms */
 597                         PACKS(desc,"z","");     /* pszStatus */
 598                         PACKS(desc,"z",SERVICE(snum)); /* pszQueue */
 599                         PACKS(desc,"z","lpd");  /* pszQProcName */
 600                         PACKS(desc,"z","");     /* pszQProcParms */
 601                         PACKS(desc,"z","NULL"); /* pszDriverName */
 602                         PackDriverData(desc);   /* pDriverData */
 603                         PACKS(desc,"z","");     /* pszPrinterName */
 604                 } else if (uLevel == 4) {   /* OS2 */
 605                         PACKS(desc,"z","");       /* pszSpoolFileName  */
 606                         PACKS(desc,"z","");       /* pszPortName       */
 607                         PACKS(desc,"z","");       /* pszStatus         */
 608                         PACKI(desc,"D",0);        /* ulPagesSpooled    */
 609                         PACKI(desc,"D",0);        /* ulPagesSent       */
 610                         PACKI(desc,"D",0);        /* ulPagesPrinted    */
 611                         PACKI(desc,"D",0);        /* ulTimePrinted     */
 612                         PACKI(desc,"D",0);        /* ulExtendJobStatus */
 613                         PACKI(desc,"D",0);        /* ulStartPage       */
 614                         PACKI(desc,"D",0);        /* ulEndPage         */
 615                 }
 616         }
 617 }
 618
 619 /********************************************************************
 620  Return a driver name given an snum.
 621  Returns True if from tdb, False otherwise.
 622  ********************************************************************/
 623
 624 static bool get_driver_name(int snum, char **pp_drivername)
 625 {
 626         NT_PRINTER_INFO_LEVEL *info = NULL;
 627         bool in_tdb = false;
 628
 629         get_a_printer (NULL, &info, 2, lp_servicename(snum));
 630         if (info != NULL) {
 631                 *pp_drivername = talloc_strdup(talloc_tos(),
 632                                         info->info_2->drivername);
 633                 in_tdb = true;
 634                 free_a_printer(&info, 2);
 635                 if (!*pp_drivername) {
 636                         return false;
 637                 }
 638         }
 639
 640         return in_tdb;
 641 }
 642
 643 /********************************************************************
 644  Respond to the DosPrintQInfo command with a level of 52
 645  This is used to get printer driver information for Win9x clients
 646  ********************************************************************/
 647 static void fill_printq_info_52(connection_struct *conn, int snum,
 648                                 struct pack_desc* desc, int count )
 649 {
 650         int                             i;
 651         fstring                         location;
 652         struct spoolss_DriverInfo8 *driver = NULL;
 653         NT_PRINTER_INFO_LEVEL           *printer = NULL;
 654
 655         if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
 656                 DEBUG(3,("fill_printq_info_52: Failed to lookup printer [%s]\n",
 657                         lp_servicename(snum)));
 658                 goto err;
 659         }
 660
 661         if (!W_ERROR_IS_OK(get_a_printer_driver(talloc_tos(), &driver, printer->info_2->drivername,
 662                 "Windows 4.0", 0)) )
 663         {
 664                 DEBUG(3,("fill_printq_info_52: Failed to lookup driver [%s]\n",
 665                         printer->info_2->drivername));
 666                 goto err;
 667         }
 668
 669         trim_string((char *)driver->driver_path, "\\print$\\WIN40\\0\\", 0);
 670         trim_string((char *)driver->data_file, "\\print$\\WIN40\\0\\", 0);
 671         trim_string((char *)driver->help_file, "\\print$\\WIN40\\0\\", 0);
 672
 673         PACKI(desc, "W", 0x0400);                     /* don't know */
 674         PACKS(desc, "z", driver->driver_name);        /* long printer name */
 675         PACKS(desc, "z", driver->driver_path);  /* Driverfile Name */
 676         PACKS(desc, "z", driver->data_file);    /* Datafile name */
 677         PACKS(desc, "z", driver->monitor_name); /* language monitor */
 678
 679         fstrcpy(location, "\\\\%L\\print$\\WIN40\\0");
 680         standard_sub_basic( "", "", location, sizeof(location)-1 );
 681         PACKS(desc,"z", location);                          /* share to retrieve files */
 682
 683         PACKS(desc,"z", driver->default_datatype);    /* default data type */
 684         PACKS(desc,"z", driver->help_file);           /* helpfile name */
 685         PACKS(desc,"z", driver->driver_path);               /* driver name */
 686
 687         DEBUG(3,("Printer Driver Name: %s:\n",driver->driver_name));
 688         DEBUG(3,("Driver: %s:\n",driver->driver_path));
 689         DEBUG(3,("Data File: %s:\n",driver->data_file));
 690         DEBUG(3,("Language Monitor: %s:\n",driver->monitor_name));
 691         DEBUG(3,("Driver Location: %s:\n",location));
 692         DEBUG(3,("Data Type: %s:\n",driver->default_datatype));
 693         DEBUG(3,("Help File: %s:\n",driver->help_file));
 694         PACKI(desc,"N",count);                     /* number of files to copy */
 695
 696         for ( i=0; i<count && driver->dependent_files && *driver->dependent_files[i]; i++)
 697         {
 698                 trim_string((char *)driver->dependent_files[i], "\\print$\\WIN40\\0\\", 0);
 699                 PACKS(desc,"z",driver->dependent_files[i]);         /* driver files to copy */
 700                 DEBUG(3,("Dependent File: %s:\n", driver->dependent_files[i]));
 701         }
 702
 703         /* sanity check */
 704         if ( i != count )
 705                 DEBUG(3,("fill_printq_info_52: file count specified by client [%d] != number of dependent files [%i]\n",
 706                         count, i));
 707
 708         DEBUG(3,("fill_printq_info on <%s> gave %d entries\n", SERVICE(snum),i));
 709
 710         desc->errcode=NERR_Success;
 711         goto done;
 712
 713 err:
 714         DEBUG(3,("fill_printq_info: Can't supply driver files\n"));
 715         desc->errcode=NERR_notsupported;
 716
 717 done:
 718         if ( printer )
 719                 free_a_printer( &printer, 2 );
 720
 721         free_a_printer_driver(driver);
 722 }
 723
 724
 725 static void fill_printq_info(connection_struct *conn, int snum, int uLevel,
 726                              struct pack_desc* desc,
 727                              int count, print_queue_struct* queue,
 728                              print_status_struct* status)
 729 {
 730         switch (uLevel) {
 731         case 1:
 732         case 2:
 733                 PACKS(desc,"B13",SERVICE(snum));
 734                 break;
 735         case 3:
 736         case 4:
 737         case 5:
 738                 PACKS(desc,"z",Expand(conn,snum,SERVICE(snum)));
 739                 break;
 740         case 51:
 741                 PACKI(desc,"K",printq_status(status->status));
 742                 break;
 743         }
 744
 745         if (uLevel == 1 || uLevel == 2) {
 746                 PACKS(desc,"B","");             /* alignment */
 747                 PACKI(desc,"W",5);              /* priority */
 748                 PACKI(desc,"W",0);              /* start time */
 749                 PACKI(desc,"W",0);              /* until time */
 750                 PACKS(desc,"z","");             /* pSepFile */
 751                 PACKS(desc,"z","lpd");  /* pPrProc */
 752                 PACKS(desc,"z",SERVICE(snum)); /* pDestinations */
 753                 PACKS(desc,"z","");             /* pParms */
 754                 if (snum < 0) {
 755                         PACKS(desc,"z","UNKNOWN PRINTER");
 756                         PACKI(desc,"W",LPSTAT_ERROR);
 757                 }
 758                 else if (!status || !status->message[0]) {
 759                         PACKS(desc,"z",Expand(conn,snum,lp_comment(snum)));
 760                         PACKI(desc,"W",LPSTAT_OK); /* status */
 761                 } else {
 762                         PACKS(desc,"z",status->message);
 763                         PACKI(desc,"W",printq_status(status->status)); /* status */
 764                 }
 765                 PACKI(desc,(uLevel == 1 ? "W" : "N"),count);
 766         }
 767
 768         if (uLevel == 3 || uLevel == 4) {
 769                 char *drivername = NULL;
 770
 771                 PACKI(desc,"W",5);              /* uPriority */
 772                 PACKI(desc,"W",0);              /* uStarttime */
 773                 PACKI(desc,"W",0);              /* uUntiltime */
 774                 PACKI(desc,"W",5);              /* pad1 */
 775                 PACKS(desc,"z","");             /* pszSepFile */
 776                 PACKS(desc,"z","WinPrint");     /* pszPrProc */
 777                 PACKS(desc,"z",NULL);           /* pszParms */
 778                 PACKS(desc,"z",NULL);           /* pszComment - don't ask.... JRA */
 779                 /* "don't ask" that it's done this way to fix corrupted
 780                    Win9X/ME printer comments. */
 781                 if (!status) {
 782                         PACKI(desc,"W",LPSTAT_OK); /* fsStatus */
 783                 } else {
 784                         PACKI(desc,"W",printq_status(status->status)); /* fsStatus */
 785                 }
 786                 PACKI(desc,(uLevel == 3 ? "W" : "N"),count);    /* cJobs */
 787                 PACKS(desc,"z",SERVICE(snum)); /* pszPrinters */
 788                 get_driver_name(snum,&drivername);
 789                 if (!drivername) {
 790                         return;
 791                 }
 792                 PACKS(desc,"z",drivername);             /* pszDriverName */
 793                 PackDriverData(desc);   /* pDriverData */
 794         }
 795
 796         if (uLevel == 2 || uLevel == 4) {
 797                 int i;
 798                 for (i=0;i<count;i++)
 799                         fill_printjob_info(conn,snum,uLevel == 2 ? 1 : 2,desc,&queue[i],i);
 800         }
 801
 802         if (uLevel==52)
 803                 fill_printq_info_52( conn, snum, desc, count );
 804 }
 805
 806 /* This function returns the number of files for a given driver */
 807 static int get_printerdrivernumber(int snum)
 808 {
 809         int                             result = 0;
 810         struct spoolss_DriverInfo8 *driver;
 811         NT_PRINTER_INFO_LEVEL           *printer = NULL;
 812
 813         ZERO_STRUCT(driver);
 814
 815         if ( !W_ERROR_IS_OK(get_a_printer( NULL, &printer, 2, lp_servicename(snum))) ) {
 816                 DEBUG(3,("get_printerdrivernumber: Failed to lookup printer [%s]\n",
 817                         lp_servicename(snum)));
 818                 goto done;
 819         }
 820
 821         if (!W_ERROR_IS_OK(get_a_printer_driver(talloc_tos(), &driver, printer->info_2->drivername,
 822                 "Windows 4.0", 0)) )
 823         {
 824                 DEBUG(3,("get_printerdrivernumber: Failed to lookup driver [%s]\n",
 825                         printer->info_2->drivername));
 826                 goto done;
 827         }
 828
 829         /* count the number of files */
 830         while (driver->dependent_files && *driver->dependent_files[result])
 831                 result++;
 832  done:
 833         if ( printer )
 834                 free_a_printer( &printer, 2 );
 835
 836         free_a_printer_driver(driver);
 837
 838         return result;
 839 }
 840
 841 static bool api_DosPrintQGetInfo(connection_struct *conn, uint16 vuid,
 842                                 char *param, int tpscnt,
 843                                 char *data, int tdscnt,
 844                                 int mdrcnt,int mprcnt,
 845                                 char **rdata,char **rparam,
 846                                 int *rdata_len,int *rparam_len)
 847 {
 848         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
 849         char *str2 = skip_string(param,tpscnt,str1);
 850         char *p = skip_string(param,tpscnt,str2);
 851         char *QueueName = p;
 852         fstring share_name;
 853         unsigned int uLevel;
 854         int count=0;
 855         int snum;
 856         char *str3;
 857         struct pack_desc desc;
 858         print_queue_struct *queue=NULL;
 859         print_status_struct status;
 860         char* tmpdata=NULL;
 861
 862         if (!str1 || !str2 || !p) {
 863                 return False;
 864         }
 865         memset((char *)&status,'\0',sizeof(status));
 866         memset((char *)&desc,'\0',sizeof(desc));
 867
 868         p = skip_string(param,tpscnt,p);
 869         if (!p) {
 870                 return False;
 871         }
 872         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 873         str3 = get_safe_str_ptr(param,tpscnt,p,4);
 874         /* str3 may be null here and is checked in check_printq_info(). */
 875
 876         /* remove any trailing username */
 877         if ((p = strchr_m(QueueName,'%')))
 878                 *p = 0;
 879
 880         DEBUG(3,("api_DosPrintQGetInfo uLevel=%d name=%s\n",uLevel,QueueName));
 881
 882         /* check it's a supported varient */
 883         if (!prefix_ok(str1,"zWrLh"))
 884                 return False;
 885         if (!check_printq_info(&desc,uLevel,str2,str3)) {
 886                 /*
 887                  * Patch from Scott Moomaw <scott@bridgewater.edu>
 888                  * to return the 'invalid info level' error if an
 889                  * unknown level was requested.
 890                  */
 891                 *rdata_len = 0;
 892                 *rparam_len = 6;
 893                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
 894                 if (!*rparam) {
 895                         return False;
 896                 }
 897                 SSVALS(*rparam,0,ERRunknownlevel);
 898                 SSVAL(*rparam,2,0);
 899                 SSVAL(*rparam,4,0);
 900                 return(True);
 901         }
 902
 903         snum = find_service(QueueName, share_name);
 904         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) )
 905                 return False;
 906
 907         if (uLevel==52) {
 908                 count = get_printerdrivernumber(snum);
 909                 DEBUG(3,("api_DosPrintQGetInfo: Driver files count: %d\n",count));
 910         } else {
 911                 count = print_queue_status(snum, &queue,&status);
 912         }
 913
 914         if (mdrcnt > 0) {
 915                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
 916                 if (!*rdata) {
 917                         SAFE_FREE(queue);
 918                         return False;
 919                 }
 920                 desc.base = *rdata;
 921                 desc.buflen = mdrcnt;
 922         } else {
 923                 /*
 924                  * Don't return data but need to get correct length
 925                  * init_package will return wrong size if buflen=0
 926                  */
 927                 desc.buflen = getlen(desc.format);
 928                 desc.base = tmpdata = (char *) SMB_MALLOC (desc.buflen);
 929         }
 930
 931         if (init_package(&desc,1,count)) {
 932                 desc.subcount = count;
 933                 fill_printq_info(conn,snum,uLevel,&desc,count,queue,&status);
 934         }
 935
 936         *rdata_len = desc.usedlen;
 937
 938         /*
 939          * We must set the return code to ERRbuftoosmall
 940          * in order to support lanman style printing with Win NT/2k
 941          * clients       --jerry
 942          */
 943         if (!mdrcnt && lp_disable_spoolss())
 944                 desc.errcode = ERRbuftoosmall;
 945
 946         *rdata_len = desc.usedlen;
 947         *rparam_len = 6;
 948         *rparam = smb_realloc_limit(*rparam,*rparam_len);
 949         if (!*rparam) {
 950                 SAFE_FREE(queue);
 951                 SAFE_FREE(tmpdata);
 952                 return False;
 953         }
 954         SSVALS(*rparam,0,desc.errcode);
 955         SSVAL(*rparam,2,0);
 956         SSVAL(*rparam,4,desc.neededlen);
 957
 958         DEBUG(4,("printqgetinfo: errorcode %d\n",desc.errcode));
 959
 960         SAFE_FREE(queue);
 961         SAFE_FREE(tmpdata);
 962
 963         return(True);
 964 }
 965
 966 /****************************************************************************
 967  View list of all print jobs on all queues.
 968 ****************************************************************************/
 969
 970 static bool api_DosPrintQEnum(connection_struct *conn, uint16 vuid,
 971                                 char *param, int tpscnt,
 972                                 char *data, int tdscnt,
 973                                 int mdrcnt, int mprcnt,
 974                                 char **rdata, char** rparam,
 975                                 int *rdata_len, int *rparam_len)
 976 {
 977         char *param_format = get_safe_str_ptr(param,tpscnt,param,2);
 978         char *output_format1 = skip_string(param,tpscnt,param_format);
 979         char *p = skip_string(param,tpscnt,output_format1);
 980         unsigned int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
 981         char *output_format2 = get_safe_str_ptr(param,tpscnt,p,4);
 982         int services = lp_numservices();
 983         int i, n;
 984         struct pack_desc desc;
 985         print_queue_struct **queue = NULL;
 986         print_status_struct *status = NULL;
 987         int *subcntarr = NULL;
 988         int queuecnt = 0, subcnt = 0, succnt = 0;
 989
 990         if (!param_format || !output_format1 || !p) {
 991                 return False;
 992         }
 993
 994         memset((char *)&desc,'\0',sizeof(desc));
 995
 996         DEBUG(3,("DosPrintQEnum uLevel=%d\n",uLevel));
 997
 998         if (!prefix_ok(param_format,"WrLeh")) {
 999                 return False;
1000         }
1001         if (!check_printq_info(&desc,uLevel,output_format1,output_format2)) {
1002                 /*
1003                  * Patch from Scott Moomaw <scott@bridgewater.edu>
1004                  * to return the 'invalid info level' error if an
1005                  * unknown level was requested.
1006                  */
1007                 *rdata_len = 0;
1008                 *rparam_len = 6;
1009                 *rparam = smb_realloc_limit(*rparam,*rparam_len);
1010                 if (!*rparam) {
1011                         return False;
1012                 }
1013                 SSVALS(*rparam,0,ERRunknownlevel);
1014                 SSVAL(*rparam,2,0);
1015                 SSVAL(*rparam,4,0);
1016                 return(True);
1017         }
1018
1019         for (i = 0; i < services; i++) {
1020                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1021                         queuecnt++;
1022                 }
1023         }
1024
1025         if((queue = SMB_MALLOC_ARRAY(print_queue_struct*, queuecnt)) == NULL) {
1026                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1027                 goto err;
1028         }
1029         memset(queue,0,queuecnt*sizeof(print_queue_struct*));
1030         if((status = SMB_MALLOC_ARRAY(print_status_struct,queuecnt)) == NULL) {
1031                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1032                 goto err;
1033         }
1034         memset(status,0,queuecnt*sizeof(print_status_struct));
1035         if((subcntarr = SMB_MALLOC_ARRAY(int,queuecnt)) == NULL) {
1036                 DEBUG(0,("api_DosPrintQEnum: malloc fail !\n"));
1037                 goto err;
1038         }
1039
1040         subcnt = 0;
1041         n = 0;
1042         for (i = 0; i < services; i++) {
1043                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1044                         subcntarr[n] = print_queue_status(i, &queue[n],&status[n]);
1045                         subcnt += subcntarr[n];
1046                         n++;
1047                 }
1048         }
1049
1050         if (mdrcnt > 0) {
1051                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
1052                 if (!*rdata) {
1053                         goto err;
1054                 }
1055         }
1056         desc.base = *rdata;
1057         desc.buflen = mdrcnt;
1058
1059         if (init_package(&desc,queuecnt,subcnt)) {
1060                 n = 0;
1061                 succnt = 0;
1062                 for (i = 0; i < services; i++) {
1063                         if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
1064                                 fill_printq_info(conn,i,uLevel,&desc,subcntarr[n],queue[n],&status[n]);
1065                                 n++;
1066                                 if (desc.errcode == NERR_Success) {
1067                                         succnt = n;
1068                                 }
1069                         }
1070                 }
1071         }
1072
1073         SAFE_FREE(subcntarr);
1074
1075         *rdata_len = desc.usedlen;
1076         *rparam_len = 8;
1077         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1078         if (!*rparam) {
1079                 goto err;
1080         }
1081         SSVALS(*rparam,0,desc.errcode);
1082         SSVAL(*rparam,2,0);
1083         SSVAL(*rparam,4,succnt);
1084         SSVAL(*rparam,6,queuecnt);
1085
1086         for (i = 0; i < queuecnt; i++) {
1087                 if (queue) {
1088                         SAFE_FREE(queue[i]);
1089                 }
1090         }
1091
1092         SAFE_FREE(queue);
1093         SAFE_FREE(status);
1094
1095         return True;
1096
1097   err:
1098
1099         SAFE_FREE(subcntarr);
1100         for (i = 0; i < queuecnt; i++) {
1101                 if (queue) {
1102                         SAFE_FREE(queue[i]);
1103                 }
1104         }
1105         SAFE_FREE(queue);
1106         SAFE_FREE(status);
1107
1108         return False;
1109 }
1110
1111 /****************************************************************************
1112  Get info level for a server list query.
1113 ****************************************************************************/
1114
1115 static bool check_server_info(int uLevel, char* id)
1116 {
1117         switch( uLevel ) {
1118                 case 0:
1119                         if (strcmp(id,"B16") != 0) {
1120                                 return False;
1121                         }
1122                         break;
1123                 case 1:
1124                         if (strcmp(id,"B16BBDz") != 0) {
1125                                 return False;
1126                         }
1127                         break;
1128                 default:
1129                         return False;
1130         }
1131         return True;
1132 }
1133
1134 struct srv_info_struct {
1135         fstring name;
1136         uint32 type;
1137         fstring comment;
1138         fstring domain;
1139         bool server_added;
1140 };
1141
1142 /*******************************************************************
1143  Get server info lists from the files saved by nmbd. Return the
1144  number of entries.
1145 ******************************************************************/
1146
1147 static int get_server_info(uint32 servertype,
1148                            struct srv_info_struct **servers,
1149                            const char *domain)
1150 {
1151         int count=0;
1152         int alloced=0;
1153         char **lines;
1154         bool local_list_only;
1155         int i;
1156
1157         lines = file_lines_load(cache_path(SERVER_LIST), NULL, 0, NULL);
1158         if (!lines) {
1159                 DEBUG(4,("Can't open %s - %s\n",cache_path(SERVER_LIST),strerror(errno)));
1160                 return 0;
1161         }
1162
1163         /* request for everything is code for request all servers */
1164         if (servertype == SV_TYPE_ALL) {
1165                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1166         }
1167
1168         local_list_only = (servertype & SV_TYPE_LOCAL_LIST_ONLY);
1169
1170         DEBUG(4,("Servertype search: %8x\n",servertype));
1171
1172         for (i=0;lines[i];i++) {
1173                 fstring stype;
1174                 struct srv_info_struct *s;
1175                 const char *ptr = lines[i];
1176                 bool ok = True;
1177                 TALLOC_CTX *frame = NULL;
1178                 char *p;
1179
1180                 if (!*ptr) {
1181                         continue;
1182                 }
1183
1184                 if (count == alloced) {
1185                         alloced += 10;
1186                         *servers = SMB_REALLOC_ARRAY(*servers,struct srv_info_struct, alloced);
1187                         if (!*servers) {
1188                                 DEBUG(0,("get_server_info: failed to enlarge servers info struct!\n"));
1189                                 TALLOC_FREE(lines);
1190                                 return 0;
1191                         }
1192                         memset((char *)((*servers)+count),'\0',sizeof(**servers)*(alloced-count));
1193                 }
1194                 s = &(*servers)[count];
1195
1196                 frame = talloc_stackframe();
1197                 s->name[0] = '\0';
1198                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1199                         TALLOC_FREE(frame);
1200                         continue;
1201                 }
1202                 fstrcpy(s->name, p);
1203
1204                 stype[0] = '\0';
1205                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1206                         TALLOC_FREE(frame);
1207                         continue;
1208                 }
1209                 fstrcpy(stype, p);
1210
1211                 s->comment[0] = '\0';
1212                 if (!next_token_talloc(frame,&ptr, &p, NULL)) {
1213                         TALLOC_FREE(frame);
1214                         continue;
1215                 }
1216                 fstrcpy(s->comment, p);
1217                 string_truncate(s->comment, MAX_SERVER_STRING_LENGTH);
1218
1219                 s->domain[0] = '\0';
1220                 if (!next_token_talloc(frame,&ptr,&p, NULL)) {
1221                         /* this allows us to cope with an old nmbd */
1222                         fstrcpy(s->domain,lp_workgroup());
1223                 } else {
1224                         fstrcpy(s->domain, p);
1225                 }
1226                 TALLOC_FREE(frame);
1227
1228                 if (sscanf(stype,"%X",&s->type) != 1) {
1229                         DEBUG(4,("r:host file "));
1230                         ok = False;
1231                 }
1232
1233                 /* Filter the servers/domains we return based on what was asked for. */
1234
1235                 /* Check to see if we are being asked for a local list only. */
1236                 if(local_list_only && ((s->type & SV_TYPE_LOCAL_LIST_ONLY) == 0)) {
1237                         DEBUG(4,("r: local list only"));
1238                         ok = False;
1239                 }
1240
1241                 /* doesn't match up: don't want it */
1242                 if (!(servertype & s->type)) {
1243                         DEBUG(4,("r:serv type "));
1244                         ok = False;
1245                 }
1246
1247                 if ((servertype & SV_TYPE_DOMAIN_ENUM) !=
1248                                 (s->type & SV_TYPE_DOMAIN_ENUM)) {
1249                         DEBUG(4,("s: dom mismatch "));
1250                         ok = False;
1251                 }
1252
1253                 if (!strequal(domain, s->domain) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1254                         ok = False;
1255                 }
1256
1257                 /* We should never return a server type with a SV_TYPE_LOCAL_LIST_ONLY set. */
1258                 s->type &= ~SV_TYPE_LOCAL_LIST_ONLY;
1259
1260                 if (ok) {
1261                         DEBUG(4,("**SV** %20s %8x %25s %15s\n",
1262                                 s->name, s->type, s->comment, s->domain));
1263                         s->server_added = True;
1264                         count++;
1265                 } else {
1266                         DEBUG(4,("%20s %8x %25s %15s\n",
1267                                 s->name, s->type, s->comment, s->domain));
1268                 }
1269         }
1270
1271         TALLOC_FREE(lines);
1272         return count;
1273 }
1274
1275 /*******************************************************************
1276  Fill in a server info structure.
1277 ******************************************************************/
1278
1279 static int fill_srv_info(struct srv_info_struct *service,
1280                          int uLevel, char **buf, int *buflen,
1281                          char **stringbuf, int *stringspace, char *baseaddr)
1282 {
1283         int struct_len;
1284         char* p;
1285         char* p2;
1286         int l2;
1287         int len;
1288
1289         switch (uLevel) {
1290                 case 0:
1291                         struct_len = 16;
1292                         break;
1293                 case 1:
1294                         struct_len = 26;
1295                         break;
1296                 default:
1297                         return -1;
1298         }
1299
1300         if (!buf) {
1301                 len = 0;
1302                 switch (uLevel) {
1303                         case 1:
1304                                 len = strlen(service->comment)+1;
1305                                 break;
1306                 }
1307
1308                 *buflen = struct_len;
1309                 *stringspace = len;
1310                 return struct_len + len;
1311         }
1312
1313         len = struct_len;
1314         p = *buf;
1315         if (*buflen < struct_len) {
1316                 return -1;
1317         }
1318         if (stringbuf) {
1319                 p2 = *stringbuf;
1320                 l2 = *stringspace;
1321         } else {
1322                 p2 = p + struct_len;
1323                 l2 = *buflen - struct_len;
1324         }
1325         if (!baseaddr) {
1326                 baseaddr = p;
1327         }
1328
1329         switch (uLevel) {
1330                 case 0:
1331                         push_ascii(p,service->name, MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1332                         break;
1333
1334                 case 1:
1335                         push_ascii(p,service->name,MAX_NETBIOSNAME_LEN, STR_TERMINATE);
1336                         SIVAL(p,18,service->type);
1337                         SIVAL(p,22,PTR_DIFF(p2,baseaddr));
1338                         len += CopyAndAdvance(&p2,service->comment,&l2);
1339                         break;
1340         }
1341
1342         if (stringbuf) {
1343                 *buf = p + struct_len;
1344                 *buflen -= struct_len;
1345                 *stringbuf = p2;
1346                 *stringspace = l2;
1347         } else {
1348                 *buf = p2;
1349                 *buflen -= len;
1350         }
1351         return len;
1352 }
1353
1354
1355 static int srv_comp(struct srv_info_struct *s1,struct srv_info_struct *s2)
1356 {
1357         return StrCaseCmp(s1->name,s2->name);
1358 }
1359
1360 /****************************************************************************
1361  View list of servers available (or possibly domains). The info is
1362  extracted from lists saved by nmbd on the local host.
1363 ****************************************************************************/
1364
1365 static bool api_RNetServerEnum2(connection_struct *conn, uint16 vuid,
1366                                 char *param, int tpscnt,
1367                                 char *data, int tdscnt,
1368                                 int mdrcnt, int mprcnt, char **rdata,
1369                                 char **rparam, int *rdata_len, int *rparam_len)
1370 {
1371         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1372         char *str2 = skip_string(param,tpscnt,str1);
1373         char *p = skip_string(param,tpscnt,str2);
1374         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1375         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1376         uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1377         char *p2;
1378         int data_len, fixed_len, string_len;
1379         int f_len = 0, s_len = 0;
1380         struct srv_info_struct *servers=NULL;
1381         int counted=0,total=0;
1382         int i,missed;
1383         fstring domain;
1384         bool domain_request;
1385         bool local_request;
1386
1387         if (!str1 || !str2 || !p) {
1388                 return False;
1389         }
1390
1391         /* If someone sets all the bits they don't really mean to set
1392            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1393            known servers. */
1394
1395         if (servertype == SV_TYPE_ALL) {
1396                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1397         }
1398
1399         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1400            any other bit (they may just set this bit on its own) they
1401            want all the locally seen servers. However this bit can be
1402            set on its own so set the requested servers to be
1403            ALL - DOMAIN_ENUM. */
1404
1405         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1406                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1407         }
1408
1409         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1410         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1411
1412         p += 8;
1413
1414         if (!prefix_ok(str1,"WrLehD")) {
1415                 return False;
1416         }
1417         if (!check_server_info(uLevel,str2)) {
1418                 return False;
1419         }
1420
1421         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1422         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1423         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1424
1425         if (strcmp(str1, "WrLehDz") == 0) {
1426                 if (skip_string(param,tpscnt,p) == NULL) {
1427                         return False;
1428                 }
1429                 pull_ascii_fstring(domain, p);
1430         } else {
1431                 fstrcpy(domain, lp_workgroup());
1432         }
1433
1434         DEBUG(4, ("domain [%s]\n", domain));
1435
1436         if (lp_browse_list()) {
1437                 total = get_server_info(servertype,&servers,domain);
1438         }
1439
1440         data_len = fixed_len = string_len = 0;
1441         missed = 0;
1442
1443         if (total > 0) {
1444                 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1445         }
1446
1447         {
1448                 char *lastname=NULL;
1449
1450                 for (i=0;i<total;i++) {
1451                         struct srv_info_struct *s = &servers[i];
1452
1453                         if (lastname && strequal(lastname,s->name)) {
1454                                 continue;
1455                         }
1456                         lastname = s->name;
1457                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1458                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1459                                 i, s->name, s->type, s->comment, s->domain));
1460
1461                         if (data_len < buf_len) {
1462                                 counted++;
1463                                 fixed_len += f_len;
1464                                 string_len += s_len;
1465                         } else {
1466                                 missed++;
1467                         }
1468                 }
1469         }
1470
1471         *rdata_len = fixed_len + string_len;
1472         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1473         if (!*rdata) {
1474                 return False;
1475         }
1476
1477         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1478         p = *rdata;
1479         f_len = fixed_len;
1480         s_len = string_len;
1481
1482         {
1483                 char *lastname=NULL;
1484                 int count2 = counted;
1485
1486                 for (i = 0; i < total && count2;i++) {
1487                         struct srv_info_struct *s = &servers[i];
1488
1489                         if (lastname && strequal(lastname,s->name)) {
1490                                 continue;
1491                         }
1492                         lastname = s->name;
1493                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1494                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1495                                 i, s->name, s->type, s->comment, s->domain));
1496                         count2--;
1497                 }
1498         }
1499
1500         *rparam_len = 8;
1501         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1502         if (!*rparam) {
1503                 return False;
1504         }
1505         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1506         SSVAL(*rparam,2,0);
1507         SSVAL(*rparam,4,counted);
1508         SSVAL(*rparam,6,counted+missed);
1509
1510         SAFE_FREE(servers);
1511
1512         DEBUG(3,("NetServerEnum2 domain = %s uLevel=%d counted=%d total=%d\n",
1513                 domain,uLevel,counted,counted+missed));
1514
1515         return True;
1516 }
1517
1518 static int srv_name_match(const char *n1, const char *n2)
1519 {
1520         /*
1521          * [MS-RAP] footnote <88> for Section 3.2.5.15 says:
1522          *
1523          *  In Windows, FirstNameToReturn need not be an exact match:
1524          *  the server will return a list of servers that exist on
1525          *  the network greater than or equal to the FirstNameToReturn.
1526          */
1527         int ret = StrCaseCmp(n1, n2);
1528
1529         if (ret <= 0) {
1530                 return 0;
1531         }
1532
1533         return ret;
1534 }
1535
1536 static bool api_RNetServerEnum3(connection_struct *conn, uint16 vuid,
1537                                 char *param, int tpscnt,
1538                                 char *data, int tdscnt,
1539                                 int mdrcnt, int mprcnt, char **rdata,
1540                                 char **rparam, int *rdata_len, int *rparam_len)
1541 {
1542         char *str1 = get_safe_str_ptr(param, tpscnt, param, 2);
1543         char *str2 = skip_string(param,tpscnt,str1);
1544         char *p = skip_string(param,tpscnt,str2);
1545         int uLevel = get_safe_SVAL(param, tpscnt, p, 0, -1);
1546         int buf_len = get_safe_SVAL(param,tpscnt, p, 2, 0);
1547         uint32 servertype = get_safe_IVAL(param,tpscnt,p,4, 0);
1548         char *p2;
1549         int data_len, fixed_len, string_len;
1550         int f_len = 0, s_len = 0;
1551         struct srv_info_struct *servers=NULL;
1552         int counted=0,first=0,total=0;
1553         int i,missed;
1554         fstring domain;
1555         fstring first_name;
1556         bool domain_request;
1557         bool local_request;
1558
1559         if (!str1 || !str2 || !p) {
1560                 return False;
1561         }
1562
1563         /* If someone sets all the bits they don't really mean to set
1564            DOMAIN_ENUM and LOCAL_LIST_ONLY, they just want all the
1565            known servers. */
1566
1567         if (servertype == SV_TYPE_ALL) {
1568                 servertype &= ~(SV_TYPE_DOMAIN_ENUM|SV_TYPE_LOCAL_LIST_ONLY);
1569         }
1570
1571         /* If someone sets SV_TYPE_LOCAL_LIST_ONLY but hasn't set
1572            any other bit (they may just set this bit on its own) they
1573            want all the locally seen servers. However this bit can be
1574            set on its own so set the requested servers to be
1575            ALL - DOMAIN_ENUM. */
1576
1577         if ((servertype & SV_TYPE_LOCAL_LIST_ONLY) && !(servertype & SV_TYPE_DOMAIN_ENUM)) {
1578                 servertype = SV_TYPE_ALL & ~(SV_TYPE_DOMAIN_ENUM);
1579         }
1580
1581         domain_request = ((servertype & SV_TYPE_DOMAIN_ENUM) != 0);
1582         local_request = ((servertype & SV_TYPE_LOCAL_LIST_ONLY) != 0);
1583
1584         p += 8;
1585
1586         if (strcmp(str1, "WrLehDzz") != 0) {
1587                 return false;
1588         }
1589         if (!check_server_info(uLevel,str2)) {
1590                 return False;
1591         }
1592
1593         DEBUG(4, ("server request level: %s %8x ", str2, servertype));
1594         DEBUG(4, ("domains_req:%s ", BOOLSTR(domain_request)));
1595         DEBUG(4, ("local_only:%s\n", BOOLSTR(local_request)));
1596
1597         if (skip_string(param,tpscnt,p) == NULL) {
1598                 return False;
1599         }
1600         pull_ascii_fstring(domain, p);
1601         if (domain[0] == '\0') {
1602                 fstrcpy(domain, lp_workgroup());
1603         }
1604         p = skip_string(param,tpscnt,p);
1605         if (skip_string(param,tpscnt,p) == NULL) {
1606                 return False;
1607         }
1608         pull_ascii_fstring(first_name, p);
1609
1610         DEBUG(4, ("domain: '%s' first_name: '%s'\n",
1611                   domain, first_name));
1612
1613         if (lp_browse_list()) {
1614                 total = get_server_info(servertype,&servers,domain);
1615         }
1616
1617         data_len = fixed_len = string_len = 0;
1618         missed = 0;
1619
1620         if (total > 0) {
1621                 qsort(servers,total,sizeof(servers[0]),QSORT_CAST srv_comp);
1622         }
1623
1624         if (first_name[0] != '\0') {
1625                 struct srv_info_struct *first_server = NULL;
1626
1627                 BINARY_ARRAY_SEARCH(servers, total, name, first_name,
1628                                     srv_name_match, first_server);
1629                 if (first_server) {
1630                         first = PTR_DIFF(first_server, servers) / sizeof(*servers);
1631                         /*
1632                          * The binary search may not find the exact match
1633                          * so we need to search backward to find the first match
1634                          *
1635                          * This implements the strange matching windows
1636                          * implements. (see the comment in srv_name_match().
1637                          */
1638                         for (;first > 0;) {
1639                                 int ret;
1640                                 ret = StrCaseCmp(first_name,
1641                                                  servers[first-1].name);
1642                                 if (ret > 0) {
1643                                         break;
1644                                 }
1645                                 first--;
1646                         }
1647                 } else {
1648                         /* we should return no entries */
1649                         first = total;
1650                 }
1651         }
1652
1653         {
1654                 char *lastname=NULL;
1655
1656                 for (i=first;i<total;i++) {
1657                         struct srv_info_struct *s = &servers[i];
1658
1659                         if (lastname && strequal(lastname,s->name)) {
1660                                 continue;
1661                         }
1662                         lastname = s->name;
1663                         data_len += fill_srv_info(s,uLevel,0,&f_len,0,&s_len,0);
1664                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1665                                 i, s->name, s->type, s->comment, s->domain));
1666
1667                         if (data_len < buf_len) {
1668                                 counted++;
1669                                 fixed_len += f_len;
1670                                 string_len += s_len;
1671                         } else {
1672                                 missed++;
1673                         }
1674                 }
1675         }
1676
1677         *rdata_len = fixed_len + string_len;
1678         *rdata = smb_realloc_limit(*rdata,*rdata_len);
1679         if (!*rdata) {
1680                 return False;
1681         }
1682
1683         p2 = (*rdata) + fixed_len;      /* auxilliary data (strings) will go here */
1684         p = *rdata;
1685         f_len = fixed_len;
1686         s_len = string_len;
1687
1688         {
1689                 char *lastname=NULL;
1690                 int count2 = counted;
1691
1692                 for (i = first; i < total && count2;i++) {
1693                         struct srv_info_struct *s = &servers[i];
1694
1695                         if (lastname && strequal(lastname,s->name)) {
1696                                 continue;
1697                         }
1698                         lastname = s->name;
1699                         fill_srv_info(s,uLevel,&p,&f_len,&p2,&s_len,*rdata);
1700                         DEBUG(4,("fill_srv_info[%d] %20s %8x %25s %15s\n",
1701                                 i, s->name, s->type, s->comment, s->domain));
1702                         count2--;
1703                 }
1704         }
1705
1706         *rparam_len = 8;
1707         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1708         if (!*rparam) {
1709                 return False;
1710         }
1711         SSVAL(*rparam,0,(missed == 0 ? NERR_Success : ERRmoredata));
1712         SSVAL(*rparam,2,0);
1713         SSVAL(*rparam,4,counted);
1714         SSVAL(*rparam,6,counted+missed);
1715
1716         DEBUG(3,("NetServerEnum3 domain = %s uLevel=%d first=%d[%s => %s] counted=%d total=%d\n",
1717                 domain,uLevel,first,first_name,
1718                 first < total ? servers[first].name : "",
1719                 counted,counted+missed));
1720
1721         SAFE_FREE(servers);
1722
1723         return True;
1724 }
1725
1726 /****************************************************************************
1727   command 0x34 - suspected of being a "Lookup Names" stub api
1728   ****************************************************************************/
1729
1730 static bool api_RNetGroupGetUsers(connection_struct *conn, uint16 vuid,
1731                                 char *param, int tpscnt,
1732                                 char *data, int tdscnt,
1733                                 int mdrcnt, int mprcnt, char **rdata,
1734                                 char **rparam, int *rdata_len, int *rparam_len)
1735 {
1736         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1737         char *str2 = skip_string(param,tpscnt,str1);
1738         char *p = skip_string(param,tpscnt,str2);
1739         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1740         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1741         int counted=0;
1742         int missed=0;
1743
1744         if (!str1 || !str2 || !p) {
1745                 return False;
1746         }
1747
1748         DEBUG(5,("RNetGroupGetUsers: %s %s %s %d %d\n",
1749                 str1, str2, p, uLevel, buf_len));
1750
1751         if (!prefix_ok(str1,"zWrLeh")) {
1752                 return False;
1753         }
1754
1755         *rdata_len = 0;
1756
1757         *rparam_len = 8;
1758         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1759         if (!*rparam) {
1760                 return False;
1761         }
1762
1763         SSVAL(*rparam,0,0x08AC); /* informational warning message */
1764         SSVAL(*rparam,2,0);
1765         SSVAL(*rparam,4,counted);
1766         SSVAL(*rparam,6,counted+missed);
1767
1768         return True;
1769 }
1770
1771 /****************************************************************************
1772   get info about a share
1773   ****************************************************************************/
1774
1775 static bool check_share_info(int uLevel, char* id)
1776 {
1777         switch( uLevel ) {
1778                 case 0:
1779                         if (strcmp(id,"B13") != 0) {
1780                                 return False;
1781                         }
1782                         break;
1783                 case 1:
1784                         /* Level-2 descriptor is allowed (and ignored) */
1785                         if (strcmp(id,"B13BWz") != 0 &&
1786                             strcmp(id,"B13BWzWWWzB9B") != 0) {
1787                                 return False;
1788                         }
1789                         break;
1790                 case 2:
1791                         if (strcmp(id,"B13BWzWWWzB9B") != 0) {
1792                                 return False;
1793                         }
1794                         break;
1795                 case 91:
1796                         if (strcmp(id,"B13BWzWWWzB9BB9BWzWWzWW") != 0) {
1797                                 return False;
1798                         }
1799                         break;
1800                 default:
1801                         return False;
1802         }
1803         return True;
1804 }
1805
1806 static int fill_share_info(connection_struct *conn, int snum, int uLevel,
1807                            char** buf, int* buflen,
1808                            char** stringbuf, int* stringspace, char* baseaddr)
1809 {
1810         int struct_len;
1811         char* p;
1812         char* p2;
1813         int l2;
1814         int len;
1815
1816         switch( uLevel ) {
1817                 case 0:
1818                         struct_len = 13;
1819                         break;
1820                 case 1:
1821                         struct_len = 20;
1822                         break;
1823                 case 2:
1824                         struct_len = 40;
1825                         break;
1826                 case 91:
1827                         struct_len = 68;
1828                         break;
1829                 default:
1830                         return -1;
1831         }
1832
1833         if (!buf) {
1834                 len = 0;
1835
1836                 if (uLevel > 0) {
1837                         len += StrlenExpanded(conn,snum,lp_comment(snum));
1838                 }
1839                 if (uLevel > 1) {
1840                         len += strlen(lp_pathname(snum)) + 1;
1841                 }
1842                 if (buflen) {
1843                         *buflen = struct_len;
1844                 }
1845                 if (stringspace) {
1846                         *stringspace = len;
1847                 }
1848                 return struct_len + len;
1849         }
1850
1851         len = struct_len;
1852         p = *buf;
1853         if ((*buflen) < struct_len) {
1854                 return -1;
1855         }
1856
1857         if (stringbuf) {
1858                 p2 = *stringbuf;
1859                 l2 = *stringspace;
1860         } else {
1861                 p2 = p + struct_len;
1862                 l2 = (*buflen) - struct_len;
1863         }
1864
1865         if (!baseaddr) {
1866                 baseaddr = p;
1867         }
1868
1869         push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
1870
1871         if (uLevel > 0) {
1872                 int type;
1873
1874                 SCVAL(p,13,0);
1875                 type = STYPE_DISKTREE;
1876                 if (lp_print_ok(snum)) {
1877                         type = STYPE_PRINTQ;
1878                 }
1879                 if (strequal("IPC",lp_fstype(snum))) {
1880                         type = STYPE_IPC;
1881                 }
1882                 SSVAL(p,14,type);               /* device type */
1883                 SIVAL(p,16,PTR_DIFF(p2,baseaddr));
1884                 len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
1885         }
1886
1887         if (uLevel > 1) {
1888                 SSVAL(p,20,ACCESS_READ|ACCESS_WRITE|ACCESS_CREATE); /* permissions */
1889                 SSVALS(p,22,-1);                /* max uses */
1890                 SSVAL(p,24,1); /* current uses */
1891                 SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
1892                 len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
1893                 memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
1894         }
1895
1896         if (uLevel > 2) {
1897                 memset(p+40,0,SHPWLEN+2);
1898                 SSVAL(p,50,0);
1899                 SIVAL(p,52,0);
1900                 SSVAL(p,56,0);
1901                 SSVAL(p,58,0);
1902                 SIVAL(p,60,0);
1903                 SSVAL(p,64,0);
1904                 SSVAL(p,66,0);
1905         }
1906
1907         if (stringbuf) {
1908                 (*buf) = p + struct_len;
1909                 (*buflen) -= struct_len;
1910                 (*stringbuf) = p2;
1911                 (*stringspace) = l2;
1912         } else {
1913                 (*buf) = p2;
1914                 (*buflen) -= len;
1915         }
1916
1917         return len;
1918 }
1919
1920 static bool api_RNetShareGetInfo(connection_struct *conn,uint16 vuid,
1921                                 char *param, int tpscnt,
1922                                 char *data, int tdscnt,
1923                                 int mdrcnt,int mprcnt,
1924                                 char **rdata,char **rparam,
1925                                 int *rdata_len,int *rparam_len)
1926 {
1927         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1928         char *str2 = skip_string(param,tpscnt,str1);
1929         char *netname = skip_string(param,tpscnt,str2);
1930         char *p = skip_string(param,tpscnt,netname);
1931         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1932         int snum;
1933         fstring share_name;
1934
1935         if (!str1 || !str2 || !netname || !p) {
1936                 return False;
1937         }
1938
1939         snum = find_service(netname, share_name);
1940         if (snum < 0) {
1941                 return False;
1942         }
1943
1944         /* check it's a supported varient */
1945         if (!prefix_ok(str1,"zWrLh")) {
1946                 return False;
1947         }
1948         if (!check_share_info(uLevel,str2)) {
1949                 return False;
1950         }
1951
1952         *rdata = smb_realloc_limit(*rdata,mdrcnt);
1953         if (!*rdata) {
1954                 return False;
1955         }
1956         p = *rdata;
1957         *rdata_len = fill_share_info(conn,snum,uLevel,&p,&mdrcnt,0,0,0);
1958         if (*rdata_len < 0) {
1959                 return False;
1960         }
1961
1962         *rparam_len = 6;
1963         *rparam = smb_realloc_limit(*rparam,*rparam_len);
1964         if (!*rparam) {
1965                 return False;
1966         }
1967         SSVAL(*rparam,0,NERR_Success);
1968         SSVAL(*rparam,2,0);             /* converter word */
1969         SSVAL(*rparam,4,*rdata_len);
1970
1971         return True;
1972 }
1973
1974 /****************************************************************************
1975   View the list of available shares.
1976
1977   This function is the server side of the NetShareEnum() RAP call.
1978   It fills the return buffer with share names and share comments.
1979   Note that the return buffer normally (in all known cases) allows only
1980   twelve byte strings for share names (plus one for a nul terminator).
1981   Share names longer than 12 bytes must be skipped.
1982  ****************************************************************************/
1983
1984 static bool api_RNetShareEnum( connection_struct *conn, uint16 vuid,
1985                                 char *param, int tpscnt,
1986                                 char *data, int tdscnt,
1987                                 int                mdrcnt,
1988                                 int                mprcnt,
1989                                 char             **rdata,
1990                                 char             **rparam,
1991                                 int               *rdata_len,
1992                                 int               *rparam_len )
1993 {
1994         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
1995         char *str2 = skip_string(param,tpscnt,str1);
1996         char *p = skip_string(param,tpscnt,str2);
1997         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
1998         int buf_len = get_safe_SVAL(param,tpscnt,p,2,0);
1999         char *p2;
2000         int count = 0;
2001         int total=0,counted=0;
2002         bool missed = False;
2003         int i;
2004         int data_len, fixed_len, string_len;
2005         int f_len = 0, s_len = 0;
2006
2007         if (!str1 || !str2 || !p) {
2008                 return False;
2009         }
2010
2011         if (!prefix_ok(str1,"WrLeh")) {
2012                 return False;
2013         }
2014         if (!check_share_info(uLevel,str2)) {
2015                 return False;
2016         }
2017
2018         /* Ensure all the usershares are loaded. */
2019         become_root();
2020         load_registry_shares();
2021         count = load_usershare_shares();
2022         unbecome_root();
2023
2024         data_len = fixed_len = string_len = 0;
2025         for (i=0;i<count;i++) {
2026                 fstring servicename_dos;
2027                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2028                         continue;
2029                 }
2030                 push_ascii_fstring(servicename_dos, lp_servicename(i));
2031                 /* Maximum name length = 13. */
2032                 if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
2033                         total++;
2034                         data_len += fill_share_info(conn,i,uLevel,0,&f_len,0,&s_len,0);
2035                         if (data_len < buf_len) {
2036                                 counted++;
2037                                 fixed_len += f_len;
2038                                 string_len += s_len;
2039                         } else {
2040                                 missed = True;
2041                         }
2042                 }
2043         }
2044
2045         *rdata_len = fixed_len + string_len;
2046         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2047         if (!*rdata) {
2048                 return False;
2049         }
2050
2051         p2 = (*rdata) + fixed_len;      /* auxiliary data (strings) will go here */
2052         p = *rdata;
2053         f_len = fixed_len;
2054         s_len = string_len;
2055
2056         for( i = 0; i < count; i++ ) {
2057                 fstring servicename_dos;
2058                 if (!(lp_browseable(i) && lp_snum_ok(i))) {
2059                         continue;
2060                 }
2061
2062                 push_ascii_fstring(servicename_dos, lp_servicename(i));
2063                 if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
2064                         if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
2065                                 break;
2066                         }
2067                 }
2068         }
2069
2070         *rparam_len = 8;
2071         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2072         if (!*rparam) {
2073                 return False;
2074         }
2075         SSVAL(*rparam,0,missed ? ERRmoredata : NERR_Success);
2076         SSVAL(*rparam,2,0);
2077         SSVAL(*rparam,4,counted);
2078         SSVAL(*rparam,6,total);
2079
2080         DEBUG(3,("RNetShareEnum gave %d entries of %d (%d %d %d %d)\n",
2081                 counted,total,uLevel,
2082                 buf_len,*rdata_len,mdrcnt));
2083
2084         return True;
2085 }
2086
2087 /****************************************************************************
2088   Add a share
2089   ****************************************************************************/
2090
2091 static bool api_RNetShareAdd(connection_struct *conn,uint16 vuid,
2092                                 char *param, int tpscnt,
2093                                 char *data, int tdscnt,
2094                                 int mdrcnt,int mprcnt,
2095                                 char **rdata,char **rparam,
2096                                 int *rdata_len,int *rparam_len)
2097 {
2098         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2099         char *str2 = skip_string(param,tpscnt,str1);
2100         char *p = skip_string(param,tpscnt,str2);
2101         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2102         fstring sharename;
2103         fstring comment;
2104         char *pathname = NULL;
2105         char *command, *cmdname;
2106         unsigned int offset;
2107         int snum;
2108         int res = ERRunsup;
2109         size_t converted_size;
2110
2111         if (!str1 || !str2 || !p) {
2112                 return False;
2113         }
2114
2115         /* check it's a supported varient */
2116         if (!prefix_ok(str1,RAP_WShareAdd_REQ)) {
2117                 return False;
2118         }
2119         if (!check_share_info(uLevel,str2)) {
2120                 return False;
2121         }
2122         if (uLevel != 2) {
2123                 return False;
2124         }
2125
2126         /* Do we have a string ? */
2127         if (skip_string(data,mdrcnt,data) == NULL) {
2128                 return False;
2129         }
2130         pull_ascii_fstring(sharename,data);
2131         snum = find_service(sharename, sharename);
2132         if (snum >= 0) { /* already exists */
2133                 res = ERRfilexists;
2134                 goto error_exit;
2135         }
2136
2137         if (mdrcnt < 28) {
2138                 return False;
2139         }
2140
2141         /* only support disk share adds */
2142         if (SVAL(data,14)!=STYPE_DISKTREE) {
2143                 return False;
2144         }
2145
2146         offset = IVAL(data, 16);
2147         if (offset >= mdrcnt) {
2148                 res = ERRinvalidparam;
2149                 goto error_exit;
2150         }
2151
2152         /* Do we have a string ? */
2153         if (skip_string(data,mdrcnt,data+offset) == NULL) {
2154                 return False;
2155         }
2156         pull_ascii_fstring(comment, offset? (data+offset) : "");
2157
2158         offset = IVAL(data, 26);
2159
2160         if (offset >= mdrcnt) {
2161                 res = ERRinvalidparam;
2162                 goto error_exit;
2163         }
2164
2165         /* Do we have a string ? */
2166         if (skip_string(data,mdrcnt,data+offset) == NULL) {
2167                 return False;
2168         }
2169
2170         if (!pull_ascii_talloc(talloc_tos(), &pathname,
2171                                offset ? (data+offset) : "", &converted_size))
2172         {
2173                 DEBUG(0,("api_RNetShareAdd: pull_ascii_talloc failed: %s",
2174                          strerror(errno)));
2175         }
2176
2177         if (!pathname) {
2178                 return false;
2179         }
2180
2181         string_replace(sharename, '"', ' ');
2182         string_replace(pathname, '"', ' ');
2183         string_replace(comment, '"', ' ');
2184
2185         cmdname = lp_add_share_cmd();
2186
2187         if (!cmdname || *cmdname == '\0') {
2188                 return False;
2189         }
2190
2191         if (asprintf(&command, "%s \"%s\" \"%s\" \"%s\" \"%s\"",
2192                      lp_add_share_cmd(), get_dyn_CONFIGFILE(), sharename,
2193                      pathname, comment) == -1) {
2194                 return false;
2195         }
2196
2197         DEBUG(10,("api_RNetShareAdd: Running [%s]\n", command ));
2198
2199         if ((res = smbrun(command, NULL)) != 0) {
2200                 DEBUG(1,("api_RNetShareAdd: Running [%s] returned (%d)\n",
2201                          command, res ));
2202                 SAFE_FREE(command);
2203                 res = ERRnoaccess;
2204                 goto error_exit;
2205         } else {
2206                 SAFE_FREE(command);
2207                 message_send_all(smbd_messaging_context(),
2208                                  MSG_SMB_CONF_UPDATED, NULL, 0, NULL);
2209         }
2210
2211         *rparam_len = 6;
2212         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2213         if (!*rparam) {
2214                 return False;
2215         }
2216         SSVAL(*rparam,0,NERR_Success);
2217         SSVAL(*rparam,2,0);             /* converter word */
2218         SSVAL(*rparam,4,*rdata_len);
2219         *rdata_len = 0;
2220
2221         return True;
2222
2223   error_exit:
2224
2225         *rparam_len = 4;
2226         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2227         if (!*rparam) {
2228                 return False;
2229         }
2230         *rdata_len = 0;
2231         SSVAL(*rparam,0,res);
2232         SSVAL(*rparam,2,0);
2233         return True;
2234 }
2235
2236 /****************************************************************************
2237   view list of groups available
2238   ****************************************************************************/
2239
2240 static bool api_RNetGroupEnum(connection_struct *conn,uint16 vuid,
2241                                 char *param, int tpscnt,
2242                                 char *data, int tdscnt,
2243                                 int mdrcnt,int mprcnt,
2244                                 char **rdata,char **rparam,
2245                                 int *rdata_len,int *rparam_len)
2246 {
2247         int i;
2248         int errflags=0;
2249         int resume_context, cli_buf_size;
2250         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2251         char *str2 = skip_string(param,tpscnt,str1);
2252         char *p = skip_string(param,tpscnt,str2);
2253
2254         uint32_t num_groups;
2255         uint32_t resume_handle;
2256         struct rpc_pipe_client *samr_pipe;
2257         struct policy_handle samr_handle, domain_handle;
2258         NTSTATUS status;
2259
2260         if (!str1 || !str2 || !p) {
2261                 return False;
2262         }
2263
2264         if (strcmp(str1,"WrLeh") != 0) {
2265                 return False;
2266         }
2267
2268         /* parameters
2269          * W-> resume context (number of users to skip)
2270          * r -> return parameter pointer to receive buffer
2271          * L -> length of receive buffer
2272          * e -> return parameter number of entries
2273          * h -> return parameter total number of users
2274          */
2275
2276         if (strcmp("B21",str2) != 0) {
2277                 return False;
2278         }
2279
2280         status = rpc_pipe_open_internal(
2281                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2282                 conn->server_info, &samr_pipe);
2283         if (!NT_STATUS_IS_OK(status)) {
2284                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2285                           nt_errstr(status)));
2286                 return false;
2287         }
2288
2289         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2290                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2291         if (!NT_STATUS_IS_OK(status)) {
2292                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2293                           nt_errstr(status)));
2294                 return false;
2295         }
2296
2297         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2298                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2299                                         get_global_sam_sid(), &domain_handle);
2300         if (!NT_STATUS_IS_OK(status)) {
2301                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2302                           nt_errstr(status)));
2303                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2304                 return false;
2305         }
2306
2307         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2308         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2309         DEBUG(10,("api_RNetGroupEnum:resume context: %d, client buffer size: "
2310                   "%d\n", resume_context, cli_buf_size));
2311
2312         *rdata_len = cli_buf_size;
2313         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2314         if (!*rdata) {
2315                 return False;
2316         }
2317
2318         p = *rdata;
2319
2320         errflags = NERR_Success;
2321         num_groups = 0;
2322         resume_handle = 0;
2323
2324         while (true) {
2325                 struct samr_SamArray *sam_entries;
2326                 uint32_t num_entries;
2327
2328                 status = rpccli_samr_EnumDomainGroups(samr_pipe, talloc_tos(),
2329                                                       &domain_handle,
2330                                                       &resume_handle,
2331                                                       &sam_entries, 1,
2332                                                       &num_entries);
2333                 if (!NT_STATUS_IS_OK(status)) {
2334                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2335                                    "%s\n", nt_errstr(status)));
2336                         break;
2337                 }
2338
2339                 if (num_entries == 0) {
2340                         DEBUG(10, ("rpccli_samr_EnumDomainGroups returned "
2341                                    "no entries -- done\n"));
2342                         break;
2343                 }
2344
2345                 for(i=0; i<num_entries; i++) {
2346                         const char *name;
2347
2348                         name = sam_entries->entries[i].name.string;
2349
2350                         if( ((PTR_DIFF(p,*rdata)+21) > *rdata_len) ) {
2351                                 /* set overflow error */
2352                                 DEBUG(3,("overflow on entry %d group %s\n", i,
2353                                          name));
2354                                 errflags=234;
2355                                 break;
2356                         }
2357
2358                         /* truncate the name at 21 chars. */
2359                         memset(p, 0, 21);
2360                         strlcpy(p, name, 21);
2361                         DEBUG(10,("adding entry %d group %s\n", i, p));
2362                         p += 21;
2363                         p += 5; /* Both NT4 and W2k3SP1 do padding here.  No
2364                                  * idea why... */
2365                         num_groups += 1;
2366                 }
2367
2368                 if (errflags != NERR_Success) {
2369                         break;
2370                 }
2371
2372                 TALLOC_FREE(sam_entries);
2373         }
2374
2375         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2376         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2377
2378         *rdata_len = PTR_DIFF(p,*rdata);
2379
2380         *rparam_len = 8;
2381         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2382         if (!*rparam) {
2383                 return False;
2384         }
2385         SSVAL(*rparam, 0, errflags);
2386         SSVAL(*rparam, 2, 0);           /* converter word */
2387         SSVAL(*rparam, 4, num_groups);  /* is this right?? */
2388         SSVAL(*rparam, 6, resume_context+num_groups);   /* is this right?? */
2389
2390         return(True);
2391 }
2392
2393 /*******************************************************************
2394  Get groups that a user is a member of.
2395 ******************************************************************/
2396
2397 static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
2398                                 char *param, int tpscnt,
2399                                 char *data, int tdscnt,
2400                                 int mdrcnt,int mprcnt,
2401                                 char **rdata,char **rparam,
2402                                 int *rdata_len,int *rparam_len)
2403 {
2404         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2405         char *str2 = skip_string(param,tpscnt,str1);
2406         char *UserName = skip_string(param,tpscnt,str2);
2407         char *p = skip_string(param,tpscnt,UserName);
2408         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
2409         const char *level_string;
2410         int count=0;
2411         bool ret = False;
2412         uint32_t i;
2413         char *endp = NULL;
2414
2415         struct rpc_pipe_client *samr_pipe;
2416         struct policy_handle samr_handle, domain_handle, user_handle;
2417         struct lsa_String name;
2418         struct lsa_Strings names;
2419         struct samr_Ids type, rid;
2420         struct samr_RidWithAttributeArray *rids;
2421         NTSTATUS status;
2422
2423         if (!str1 || !str2 || !UserName || !p) {
2424                 return False;
2425         }
2426
2427         *rparam_len = 8;
2428         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2429         if (!*rparam) {
2430                 return False;
2431         }
2432
2433         /* check it's a supported varient */
2434
2435         if ( strcmp(str1,"zWrLeh") != 0 )
2436                 return False;
2437
2438         switch( uLevel ) {
2439                 case 0:
2440                         level_string = "B21";
2441                         break;
2442                 default:
2443                         return False;
2444         }
2445
2446         if (strcmp(level_string,str2) != 0)
2447                 return False;
2448
2449         *rdata_len = mdrcnt + 1024;
2450         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2451         if (!*rdata) {
2452                 return False;
2453         }
2454
2455         SSVAL(*rparam,0,NERR_Success);
2456         SSVAL(*rparam,2,0);             /* converter word */
2457
2458         p = *rdata;
2459         endp = *rdata + *rdata_len;
2460
2461         status = rpc_pipe_open_internal(
2462                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2463                 conn->server_info, &samr_pipe);
2464         if (!NT_STATUS_IS_OK(status)) {
2465                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2466                           nt_errstr(status)));
2467                 return false;
2468         }
2469
2470         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2471                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2472         if (!NT_STATUS_IS_OK(status)) {
2473                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2474                           nt_errstr(status)));
2475                 return false;
2476         }
2477
2478         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2479                                         SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2480                                         get_global_sam_sid(), &domain_handle);
2481         if (!NT_STATUS_IS_OK(status)) {
2482                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2483                           nt_errstr(status)));
2484                 goto close_sam;
2485         }
2486
2487         name.string = UserName;
2488
2489         status = rpccli_samr_LookupNames(samr_pipe, talloc_tos(),
2490                                          &domain_handle, 1, &name,
2491                                          &rid, &type);
2492         if (!NT_STATUS_IS_OK(status)) {
2493                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2494                           nt_errstr(status)));
2495                 goto close_domain;
2496         }
2497
2498         if (type.ids[0] != SID_NAME_USER) {
2499                 DEBUG(10, ("%s is a %s, not a user\n", UserName,
2500                            sid_type_lookup(type.ids[0])));
2501                 goto close_domain;
2502         }
2503
2504         status = rpccli_samr_OpenUser(samr_pipe, talloc_tos(),
2505                                       &domain_handle,
2506                                       SAMR_USER_ACCESS_GET_GROUPS,
2507                                       rid.ids[0], &user_handle);
2508         if (!NT_STATUS_IS_OK(status)) {
2509                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2510                           nt_errstr(status)));
2511                 goto close_domain;
2512         }
2513
2514         status = rpccli_samr_GetGroupsForUser(samr_pipe, talloc_tos(),
2515                                               &user_handle, &rids);
2516         if (!NT_STATUS_IS_OK(status)) {
2517                 DEBUG(0, ("api_RNetUserEnum: samr_LookupNames failed: %s\n",
2518                           nt_errstr(status)));
2519                 goto close_user;
2520         }
2521
2522         for (i=0; i<rids->count; i++) {
2523
2524                 status = rpccli_samr_LookupRids(samr_pipe, talloc_tos(),
2525                                                 &domain_handle,
2526                                                 1, &rids->rids[i].rid,
2527                                                 &names, &type);
2528                 if (NT_STATUS_IS_OK(status) && (names.count == 1)) {
2529                         strlcpy(p, names.names[0].string, PTR_DIFF(endp,p));
2530                         p += 21;
2531                         count++;
2532                 }
2533         }
2534
2535         *rdata_len = PTR_DIFF(p,*rdata);
2536
2537         SSVAL(*rparam,4,count); /* is this right?? */
2538         SSVAL(*rparam,6,count); /* is this right?? */
2539
2540         ret = True;
2541
2542  close_user:
2543         rpccli_samr_Close(samr_pipe, talloc_tos(), &user_handle);
2544  close_domain:
2545         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2546  close_sam:
2547         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2548
2549         return ret;
2550 }
2551
2552 /*******************************************************************
2553  Get all users.
2554 ******************************************************************/
2555
2556 static bool api_RNetUserEnum(connection_struct *conn, uint16 vuid,
2557                                 char *param, int tpscnt,
2558                                 char *data, int tdscnt,
2559                                 int mdrcnt,int mprcnt,
2560                                 char **rdata,char **rparam,
2561                                 int *rdata_len,int *rparam_len)
2562 {
2563         int count_sent=0;
2564         int num_users=0;
2565         int errflags=0;
2566         int i, resume_context, cli_buf_size;
2567         uint32_t resume_handle;
2568
2569         struct rpc_pipe_client *samr_pipe;
2570         struct policy_handle samr_handle, domain_handle;
2571         NTSTATUS status;
2572
2573         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2574         char *str2 = skip_string(param,tpscnt,str1);
2575         char *p = skip_string(param,tpscnt,str2);
2576         char *endp = NULL;
2577
2578         if (!str1 || !str2 || !p) {
2579                 return False;
2580         }
2581
2582         if (strcmp(str1,"WrLeh") != 0)
2583                 return False;
2584         /* parameters
2585           * W-> resume context (number of users to skip)
2586           * r -> return parameter pointer to receive buffer
2587           * L -> length of receive buffer
2588           * e -> return parameter number of entries
2589           * h -> return parameter total number of users
2590           */
2591
2592         resume_context = get_safe_SVAL(param,tpscnt,p,0,-1);
2593         cli_buf_size= get_safe_SVAL(param,tpscnt,p,2,0);
2594         DEBUG(10,("api_RNetUserEnum:resume context: %d, client buffer size: %d\n",
2595                         resume_context, cli_buf_size));
2596
2597         *rparam_len = 8;
2598         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2599         if (!*rparam) {
2600                 return False;
2601         }
2602
2603         /* check it's a supported varient */
2604         if (strcmp("B21",str2) != 0)
2605                 return False;
2606
2607         *rdata_len = cli_buf_size;
2608         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2609         if (!*rdata) {
2610                 return False;
2611         }
2612
2613         p = *rdata;
2614         endp = *rdata + *rdata_len;
2615
2616         status = rpc_pipe_open_internal(
2617                 talloc_tos(), &ndr_table_samr.syntax_id, rpc_samr_dispatch,
2618                 conn->server_info, &samr_pipe);
2619         if (!NT_STATUS_IS_OK(status)) {
2620                 DEBUG(0, ("api_RNetUserEnum: Could not connect to samr: %s\n",
2621                           nt_errstr(status)));
2622                 return false;
2623         }
2624
2625         status = rpccli_samr_Connect2(samr_pipe, talloc_tos(), global_myname(),
2626                                       SAMR_ACCESS_LOOKUP_DOMAIN, &samr_handle);
2627         if (!NT_STATUS_IS_OK(status)) {
2628                 DEBUG(0, ("api_RNetUserEnum: samr_Connect2 failed: %s\n",
2629                           nt_errstr(status)));
2630                 return false;
2631         }
2632
2633         status = rpccli_samr_OpenDomain(samr_pipe, talloc_tos(), &samr_handle,
2634                                         SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2635                                         get_global_sam_sid(), &domain_handle);
2636         if (!NT_STATUS_IS_OK(status)) {
2637                 DEBUG(0, ("api_RNetUserEnum: samr_OpenDomain failed: %s\n",
2638                           nt_errstr(status)));
2639                 rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2640                 return false;
2641         }
2642
2643         errflags=NERR_Success;
2644
2645         resume_handle = 0;
2646
2647         while (true) {
2648                 struct samr_SamArray *sam_entries;
2649                 uint32_t num_entries;
2650
2651                 status = rpccli_samr_EnumDomainUsers(samr_pipe, talloc_tos(),
2652                                                      &domain_handle,
2653                                                      &resume_handle,
2654                                                      0, &sam_entries, 1,
2655                                                      &num_entries);
2656
2657                 if (!NT_STATUS_IS_OK(status)) {
2658                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2659                                    "%s\n", nt_errstr(status)));
2660                         break;
2661                 }
2662
2663                 if (num_entries == 0) {
2664                         DEBUG(10, ("rpccli_samr_EnumDomainUsers returned "
2665                                    "no entries -- done\n"));
2666                         break;
2667                 }
2668
2669                 for (i=0; i<num_entries; i++) {
2670                         const char *name;
2671
2672                         name = sam_entries->entries[i].name.string;
2673
2674                         if(((PTR_DIFF(p,*rdata)+21)<=*rdata_len)
2675                            &&(strlen(name)<=21)) {
2676                                 strlcpy(p,name,PTR_DIFF(endp,p));
2677                                 DEBUG(10,("api_RNetUserEnum:adding entry %d "
2678                                           "username %s\n",count_sent,p));
2679                                 p += 21;
2680                                 count_sent++;
2681                         } else {
2682                                 /* set overflow error */
2683                                 DEBUG(10,("api_RNetUserEnum:overflow on entry %d "
2684                                           "username %s\n",count_sent,name));
2685                                 errflags=234;
2686                                 break;
2687                         }
2688                 }
2689
2690                 if (errflags != NERR_Success) {
2691                         break;
2692                 }
2693
2694                 TALLOC_FREE(sam_entries);
2695         }
2696
2697         rpccli_samr_Close(samr_pipe, talloc_tos(), &domain_handle);
2698         rpccli_samr_Close(samr_pipe, talloc_tos(), &samr_handle);
2699
2700         *rdata_len = PTR_DIFF(p,*rdata);
2701
2702         SSVAL(*rparam,0,errflags);
2703         SSVAL(*rparam,2,0);           /* converter word */
2704         SSVAL(*rparam,4,count_sent);  /* is this right?? */
2705         SSVAL(*rparam,6,num_users); /* is this right?? */
2706
2707         return True;
2708 }
2709
2710 /****************************************************************************
2711  Get the time of day info.
2712 ****************************************************************************/
2713
2714 static bool api_NetRemoteTOD(connection_struct *conn,uint16 vuid,
2715                                 char *param, int tpscnt,
2716                                 char *data, int tdscnt,
2717                                 int mdrcnt,int mprcnt,
2718                                 char **rdata,char **rparam,
2719                                 int *rdata_len,int *rparam_len)
2720 {
2721         struct tm *t;
2722         time_t unixdate = time(NULL);
2723         char *p;
2724
2725         *rparam_len = 4;
2726         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2727         if (!*rparam) {
2728                 return False;
2729         }
2730
2731         *rdata_len = 21;
2732         *rdata = smb_realloc_limit(*rdata,*rdata_len);
2733         if (!*rdata) {
2734                 return False;
2735         }
2736
2737         SSVAL(*rparam,0,NERR_Success);
2738         SSVAL(*rparam,2,0);             /* converter word */
2739
2740         p = *rdata;
2741
2742         srv_put_dos_date3(p,0,unixdate); /* this is the time that is looked at
2743                                             by NT in a "net time" operation,
2744                                             it seems to ignore the one below */
2745
2746         /* the client expects to get localtime, not GMT, in this bit
2747                 (I think, this needs testing) */
2748         t = localtime(&unixdate);
2749         if (!t) {
2750                 return False;
2751         }
2752
2753         SIVAL(p,4,0);           /* msecs ? */
2754         SCVAL(p,8,t->tm_hour);
2755         SCVAL(p,9,t->tm_min);
2756         SCVAL(p,10,t->tm_sec);
2757         SCVAL(p,11,0);          /* hundredths of seconds */
2758         SSVALS(p,12,get_time_zone(unixdate)/60); /* timezone in minutes from GMT */
2759         SSVAL(p,14,10000);              /* timer interval in 0.0001 of sec */
2760         SCVAL(p,16,t->tm_mday);
2761         SCVAL(p,17,t->tm_mon + 1);
2762         SSVAL(p,18,1900+t->tm_year);
2763         SCVAL(p,20,t->tm_wday);
2764
2765         return True;
2766 }
2767
2768 /****************************************************************************
2769  Set the user password.
2770 *****************************************************************************/
2771
2772 static bool api_SetUserPassword(connection_struct *conn,uint16 vuid,
2773                                 char *param, int tpscnt,
2774                                 char *data, int tdscnt,
2775                                 int mdrcnt,int mprcnt,
2776                                 char **rdata,char **rparam,
2777                                 int *rdata_len,int *rparam_len)
2778 {
2779         char *np = get_safe_str_ptr(param,tpscnt,param,2);
2780         char *p = NULL;
2781         fstring user;
2782         fstring pass1,pass2;
2783
2784         /* Skip 2 strings. */
2785         p = skip_string(param,tpscnt,np);
2786         p = skip_string(param,tpscnt,p);
2787
2788         if (!np || !p) {
2789                 return False;
2790         }
2791
2792         /* Do we have a string ? */
2793         if (skip_string(param,tpscnt,p) == NULL) {
2794                 return False;
2795         }
2796         pull_ascii_fstring(user,p);
2797
2798         p = skip_string(param,tpscnt,p);
2799         if (!p) {
2800                 return False;
2801         }
2802
2803         memset(pass1,'\0',sizeof(pass1));
2804         memset(pass2,'\0',sizeof(pass2));
2805         /*
2806          * We use 31 here not 32 as we're checking
2807          * the last byte we want to access is safe.
2808          */
2809         if (!is_offset_safe(param,tpscnt,p,31)) {
2810                 return False;
2811         }
2812         memcpy(pass1,p,16);
2813         memcpy(pass2,p+16,16);
2814
2815         *rparam_len = 4;
2816         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2817         if (!*rparam) {
2818                 return False;
2819         }
2820
2821         *rdata_len = 0;
2822
2823         SSVAL(*rparam,0,NERR_badpass);
2824         SSVAL(*rparam,2,0);             /* converter word */
2825
2826         DEBUG(3,("Set password for <%s>\n",user));
2827
2828         /*
2829          * Attempt to verify the old password against smbpasswd entries
2830          * Win98 clients send old and new password in plaintext for this call.
2831          */
2832
2833         {
2834                 auth_serversupplied_info *server_info = NULL;
2835                 DATA_BLOB password = data_blob(pass1, strlen(pass1)+1);
2836
2837                 if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) {
2838
2839                         become_root();
2840                         if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False, NULL))) {
2841                                 SSVAL(*rparam,0,NERR_Success);
2842                         }
2843                         unbecome_root();
2844
2845                         TALLOC_FREE(server_info);
2846                 }
2847                 data_blob_clear_free(&password);
2848         }
2849
2850         /*
2851          * If the plaintext change failed, attempt
2852          * the old encrypted method. NT will generate this
2853          * after trying the samr method. Note that this
2854          * method is done as a last resort as this
2855          * password change method loses the NT password hash
2856          * and cannot change the UNIX password as no plaintext
2857          * is received.
2858          */
2859
2860         if(SVAL(*rparam,0) != NERR_Success) {
2861                 struct samu *hnd = NULL;
2862
2863                 if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) {
2864                         become_root();
2865                         if (change_lanman_password(hnd,(uchar *)pass2)) {
2866                                 SSVAL(*rparam,0,NERR_Success);
2867                         }
2868                         unbecome_root();
2869                         TALLOC_FREE(hnd);
2870                 }
2871         }
2872
2873         memset((char *)pass1,'\0',sizeof(fstring));
2874         memset((char *)pass2,'\0',sizeof(fstring));
2875
2876         return(True);
2877 }
2878
2879 /****************************************************************************
2880   Set the user password (SamOEM version - gets plaintext).
2881 ****************************************************************************/
2882
2883 static bool api_SamOEMChangePassword(connection_struct *conn,uint16 vuid,
2884                                 char *param, int tpscnt,
2885                                 char *data, int tdscnt,
2886                                 int mdrcnt,int mprcnt,
2887                                 char **rdata,char **rparam,
2888                                 int *rdata_len,int *rparam_len)
2889 {
2890         struct smbd_server_connection *sconn = smbd_server_conn;
2891         fstring user;
2892         char *p = get_safe_str_ptr(param,tpscnt,param,2);
2893         *rparam_len = 2;
2894         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2895         if (!*rparam) {
2896                 return False;
2897         }
2898
2899         if (!p) {
2900                 return False;
2901         }
2902         *rdata_len = 0;
2903
2904         SSVAL(*rparam,0,NERR_badpass);
2905
2906         /*
2907          * Check the parameter definition is correct.
2908          */
2909
2910         /* Do we have a string ? */
2911         if (skip_string(param,tpscnt,p) == 0) {
2912                 return False;
2913         }
2914         if(!strequal(p, "zsT")) {
2915                 DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", p));
2916                 return False;
2917         }
2918         p = skip_string(param, tpscnt, p);
2919         if (!p) {
2920                 return False;
2921         }
2922
2923         /* Do we have a string ? */
2924         if (skip_string(param,tpscnt,p) == 0) {
2925                 return False;
2926         }
2927         if(!strequal(p, "B516B16")) {
2928                 DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p));
2929                 return False;
2930         }
2931         p = skip_string(param,tpscnt,p);
2932         if (!p) {
2933                 return False;
2934         }
2935         /* Do we have a string ? */
2936         if (skip_string(param,tpscnt,p) == 0) {
2937                 return False;
2938         }
2939         p += pull_ascii_fstring(user,p);
2940
2941         DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user));
2942
2943         /*
2944          * Pass the user through the NT -> unix user mapping
2945          * function.
2946          */
2947
2948         (void)map_username(sconn, user);
2949
2950         if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL, NULL))) {
2951                 SSVAL(*rparam,0,NERR_Success);
2952         }
2953
2954         return(True);
2955 }
2956
2957 /****************************************************************************
2958   delete a print job
2959   Form: <W> <>
2960   ****************************************************************************/
2961
2962 static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
2963                                 char *param, int tpscnt,
2964                                 char *data, int tdscnt,
2965                                 int mdrcnt,int mprcnt,
2966                                 char **rdata,char **rparam,
2967                                 int *rdata_len,int *rparam_len)
2968 {
2969         int function = get_safe_SVAL(param,tpscnt,param,0,0);
2970         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
2971         char *str2 = skip_string(param,tpscnt,str1);
2972         char *p = skip_string(param,tpscnt,str2);
2973         uint32 jobid;
2974         int snum;
2975         fstring sharename;
2976         int errcode;
2977         WERROR werr = WERR_OK;
2978
2979         if (!str1 || !str2 || !p) {
2980                 return False;
2981         }
2982         /*
2983          * We use 1 here not 2 as we're checking
2984          * the last byte we want to access is safe.
2985          */
2986         if (!is_offset_safe(param,tpscnt,p,1)) {
2987                 return False;
2988         }
2989         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
2990                 return False;
2991
2992         /* check it's a supported varient */
2993         if (!(strcsequal(str1,"W") && strcsequal(str2,"")))
2994                 return(False);
2995
2996         *rparam_len = 4;
2997         *rparam = smb_realloc_limit(*rparam,*rparam_len);
2998         if (!*rparam) {
2999                 return False;
3000         }
3001         *rdata_len = 0;
3002
3003         if (!print_job_exists(sharename, jobid)) {
3004                 errcode = NERR_JobNotFound;
3005                 goto out;
3006         }
3007
3008         snum = lp_servicenumber( sharename);
3009         if (snum == -1) {
3010                 errcode = NERR_DestNotFound;
3011                 goto out;
3012         }
3013
3014         errcode = NERR_notsupported;
3015
3016         switch (function) {
3017         case 81:                /* delete */
3018                 if (print_job_delete(conn->server_info, snum, jobid, &werr))
3019                         errcode = NERR_Success;
3020                 break;
3021         case 82:                /* pause */
3022                 if (print_job_pause(conn->server_info, snum, jobid, &werr))
3023                         errcode = NERR_Success;
3024                 break;
3025         case 83:                /* resume */
3026                 if (print_job_resume(conn->server_info, snum, jobid, &werr))
3027                         errcode = NERR_Success;
3028                 break;
3029         }
3030
3031         if (!W_ERROR_IS_OK(werr))
3032                 errcode = W_ERROR_V(werr);
3033
3034  out:
3035         SSVAL(*rparam,0,errcode);
3036         SSVAL(*rparam,2,0);             /* converter word */
3037
3038         return(True);
3039 }
3040
3041 /****************************************************************************
3042   Purge a print queue - or pause or resume it.
3043   ****************************************************************************/
3044
3045 static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
3046                                 char *param, int tpscnt,
3047                                 char *data, int tdscnt,
3048                                 int mdrcnt,int mprcnt,
3049                                 char **rdata,char **rparam,
3050                                 int *rdata_len,int *rparam_len)
3051 {
3052         int function = get_safe_SVAL(param,tpscnt,param,0,0);
3053         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3054         char *str2 = skip_string(param,tpscnt,str1);
3055         char *QueueName = skip_string(param,tpscnt,str2);
3056         int errcode = NERR_notsupported;
3057         int snum;
3058         WERROR werr = WERR_OK;
3059
3060         if (!str1 || !str2 || !QueueName) {
3061                 return False;
3062         }
3063
3064         /* check it's a supported varient */
3065         if (!(strcsequal(str1,"z") && strcsequal(str2,"")))
3066                 return(False);
3067
3068         *rparam_len = 4;
3069         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3070         if (!*rparam) {
3071                 return False;
3072         }
3073         *rdata_len = 0;
3074
3075         if (skip_string(param,tpscnt,QueueName) == NULL) {
3076                 return False;
3077         }
3078         snum = print_queue_snum(QueueName);
3079
3080         if (snum == -1) {
3081                 errcode = NERR_JobNotFound;
3082                 goto out;
3083         }
3084
3085         switch (function) {
3086         case 74: /* Pause queue */
3087                 werr = print_queue_pause(conn->server_info, snum);
3088                 break;
3089         case 75: /* Resume queue */
3090                 werr = print_queue_resume(conn->server_info, snum);
3091                 break;
3092         case 103: /* Purge */
3093                 werr = print_queue_purge(conn->server_info, snum);
3094                 break;
3095         default:
3096                 werr = WERR_NOT_SUPPORTED;
3097                 break;
3098         }
3099
3100         errcode = W_ERROR_V(werr);
3101
3102  out:
3103         SSVAL(*rparam,0,errcode);
3104         SSVAL(*rparam,2,0);             /* converter word */
3105
3106         return(True);
3107 }
3108
3109 /****************************************************************************
3110   set the property of a print job (undocumented?)
3111   ? function = 0xb -> set name of print job
3112   ? function = 0x6 -> move print job up/down
3113   Form: <WWsTP> <WWzWWDDzzzzzzzzzzlz>
3114   or   <WWsTP> <WB21BB16B10zWWzDDz>
3115 ****************************************************************************/
3116
3117 static int check_printjob_info(struct pack_desc* desc,
3118                                int uLevel, char* id)
3119 {
3120         desc->subformat = NULL;
3121         switch( uLevel ) {
3122         case 0: desc->format = "W"; break;
3123         case 1: desc->format = "WB21BB16B10zWWzDDz"; break;
3124         case 2: desc->format = "WWzWWDDzz"; break;
3125         case 3: desc->format = "WWzWWDDzzzzzzzzzzlz"; break;
3126         case 4: desc->format = "WWzWWDDzzzzzDDDDDDD"; break;
3127         default:
3128                 DEBUG(0,("check_printjob_info: invalid level %d\n",
3129                         uLevel ));
3130                 return False;
3131         }
3132         if (id == NULL || strcmp(desc->format,id) != 0) {
3133                 DEBUG(0,("check_printjob_info: invalid format %s\n",
3134                         id ? id : "<NULL>" ));
3135                 return False;
3136         }
3137         return True;
3138 }
3139
3140 static bool api_PrintJobInfo(connection_struct *conn, uint16 vuid,
3141                                 char *param, int tpscnt,
3142                                 char *data, int tdscnt,
3143                                 int mdrcnt,int mprcnt,
3144                                 char **rdata,char **rparam,
3145                                 int *rdata_len,int *rparam_len)
3146 {
3147         struct pack_desc desc;
3148         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3149         char *str2 = skip_string(param,tpscnt,str1);
3150         char *p = skip_string(param,tpscnt,str2);
3151         uint32 jobid;
3152         fstring sharename;
3153         int uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
3154         int function = get_safe_SVAL(param,tpscnt,p,4,-1);
3155         int place, errcode;
3156
3157         if (!str1 || !str2 || !p) {
3158                 return False;
3159         }
3160         /*
3161          * We use 1 here not 2 as we're checking
3162          * the last byte we want to access is safe.
3163          */
3164         if (!is_offset_safe(param,tpscnt,p,1)) {
3165                 return False;
3166         }
3167         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid))
3168                 return False;
3169         *rparam_len = 4;
3170         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3171         if (!*rparam) {
3172                 return False;
3173         }
3174
3175         if (!share_defined(sharename)) {
3176                 DEBUG(0,("api_PrintJobInfo: sharen [%s] not defined\n",
3177                          sharename));
3178                 return False;
3179         }
3180
3181         *rdata_len = 0;
3182
3183         /* check it's a supported varient */
3184         if ((strcmp(str1,"WWsTP")) ||
3185             (!check_printjob_info(&desc,uLevel,str2)))
3186                 return(False);
3187
3188         if (!print_job_exists(sharename, jobid)) {
3189                 errcode=NERR_JobNotFound;
3190                 goto out;
3191         }
3192
3193         errcode = NERR_notsupported;
3194
3195         switch (function) {
3196         case 0x6:
3197                 /* change job place in the queue,
3198                    data gives the new place */
3199                 place = SVAL(data,0);
3200                 if (print_job_set_place(sharename, jobid, place)) {
3201                         errcode=NERR_Success;
3202                 }
3203                 break;
3204
3205         case 0xb:
3206                 /* change print job name, data gives the name */
3207                 if (print_job_set_name(sharename, jobid, data)) {
3208                         errcode=NERR_Success;
3209                 }
3210                 break;
3211
3212         default:
3213                 return False;
3214         }
3215
3216  out:
3217         SSVALS(*rparam,0,errcode);
3218         SSVAL(*rparam,2,0);             /* converter word */
3219
3220         return(True);
3221 }
3222
3223
3224 /****************************************************************************
3225  Get info about the server.
3226 ****************************************************************************/
3227
3228 static bool api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
3229                                 char *param, int tpscnt,
3230                                 char *data, int tdscnt,
3231                                 int mdrcnt,int mprcnt,
3232                                 char **rdata,char **rparam,
3233                                 int *rdata_len,int *rparam_len)
3234 {
3235         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3236         char *str2 = skip_string(param,tpscnt,str1);
3237         char *p = skip_string(param,tpscnt,str2);
3238         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3239         char *p2;
3240         int struct_len;
3241
3242         if (!str1 || !str2 || !p) {
3243                 return False;
3244         }
3245
3246         DEBUG(4,("NetServerGetInfo level %d\n",uLevel));
3247
3248         /* check it's a supported varient */
3249         if (!prefix_ok(str1,"WrLh")) {
3250                 return False;
3251         }
3252
3253         switch( uLevel ) {
3254                 case 0:
3255                         if (strcmp(str2,"B16") != 0) {
3256                                 return False;
3257                         }
3258                         struct_len = 16;
3259                         break;
3260                 case 1:
3261                         if (strcmp(str2,"B16BBDz") != 0) {
3262                                 return False;
3263                         }
3264                         struct_len = 26;
3265                         break;
3266                 case 2:
3267                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWz")!= 0) {
3268                                 return False;
3269                         }
3270                         struct_len = 134;
3271                         break;
3272                 case 3:
3273                         if (strcmp(str2,"B16BBDzDDDWWzWWWWWWWBB21zWWWWWWWWWWWWWWWWWWWWWWzDWz") != 0) {
3274                                 return False;
3275                         }
3276                         struct_len = 144;
3277                         break;
3278                 case 20:
3279                         if (strcmp(str2,"DN") != 0) {
3280                                 return False;
3281                         }
3282                         struct_len = 6;
3283                         break;
3284                 case 50:
3285                         if (strcmp(str2,"B16BBDzWWzzz") != 0) {
3286                                 return False;
3287                         }
3288                         struct_len = 42;
3289                         break;
3290                 default:
3291                         return False;
3292         }
3293
3294         *rdata_len = mdrcnt;
3295         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3296         if (!*rdata) {
3297                 return False;
3298         }
3299
3300         p = *rdata;
3301         p2 = p + struct_len;
3302         if (uLevel != 20) {
3303                 srvstr_push(NULL, 0, p,global_myname(),16,
3304                         STR_ASCII|STR_UPPER|STR_TERMINATE);
3305         }
3306         p += 16;
3307         if (uLevel > 0) {
3308                 struct srv_info_struct *servers=NULL;
3309                 int i,count;
3310                 char *comment = NULL;
3311                 TALLOC_CTX *ctx = talloc_tos();
3312                 uint32 servertype= lp_default_server_announce();
3313
3314                 comment = talloc_strdup(ctx,lp_serverstring());
3315                 if (!comment) {
3316                         return false;
3317                 }
3318
3319                 if ((count=get_server_info(SV_TYPE_ALL,&servers,lp_workgroup()))>0) {
3320                         for (i=0;i<count;i++) {
3321                                 if (strequal(servers[i].name,global_myname())) {
3322                                         servertype = servers[i].type;
3323                                         TALLOC_FREE(comment);
3324                                         comment = talloc_strdup(ctx,
3325                                                         servers[i].comment);
3326                                         if (comment) {
3327                                                 return false;
3328                                         }
3329                                 }
3330                         }
3331                 }
3332
3333                 SAFE_FREE(servers);
3334
3335                 SCVAL(p,0,lp_major_announce_version());
3336                 SCVAL(p,1,lp_minor_announce_version());
3337                 SIVAL(p,2,servertype);
3338
3339                 if (mdrcnt == struct_len) {
3340                         SIVAL(p,6,0);
3341                 } else {
3342                         SIVAL(p,6,PTR_DIFF(p2,*rdata));
3343                         comment = talloc_sub_advanced(
3344                                 ctx,
3345                                 lp_servicename(SNUM(conn)),
3346                                 conn->server_info->unix_name,
3347                                 conn->connectpath,
3348                                 conn->server_info->utok.gid,
3349                                 conn->server_info->sanitized_username,
3350                                 pdb_get_domain(conn->server_info->sam_account),
3351                                 comment);
3352                         if (comment) {
3353                                 return false;
3354                         }
3355                         if (mdrcnt - struct_len <= 0) {
3356                                 return false;
3357                         }
3358                         push_ascii(p2,
3359                                 comment,
3360                                 MIN(mdrcnt - struct_len,
3361                                         MAX_SERVER_STRING_LENGTH),
3362                                 STR_TERMINATE);
3363                         p2 = skip_string(*rdata,*rdata_len,p2);
3364                         if (!p2) {
3365                                 return False;
3366                         }
3367                 }
3368         }
3369
3370         if (uLevel > 1) {
3371                 return False;           /* not yet implemented */
3372         }
3373
3374         *rdata_len = PTR_DIFF(p2,*rdata);
3375
3376         *rparam_len = 6;
3377         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3378         if (!*rparam) {
3379                 return False;
3380         }
3381         SSVAL(*rparam,0,NERR_Success);
3382         SSVAL(*rparam,2,0);             /* converter word */
3383         SSVAL(*rparam,4,*rdata_len);
3384
3385         return True;
3386 }
3387
3388 /****************************************************************************
3389  Get info about the server.
3390 ****************************************************************************/
3391
3392 static bool api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid,
3393                                 char *param, int tpscnt,
3394                                 char *data, int tdscnt,
3395                                 int mdrcnt,int mprcnt,
3396                                 char **rdata,char **rparam,
3397                                 int *rdata_len,int *rparam_len)
3398 {
3399         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3400         char *str2 = skip_string(param,tpscnt,str1);
3401         char *p = skip_string(param,tpscnt,str2);
3402         char *p2;
3403         char *endp;
3404         int level = get_safe_SVAL(param,tpscnt,p,0,-1);
3405
3406         if (!str1 || !str2 || !p) {
3407                 return False;
3408         }
3409
3410         DEBUG(4,("NetWkstaGetInfo level %d\n",level));
3411
3412         *rparam_len = 6;
3413         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3414         if (!*rparam) {
3415                 return False;
3416         }
3417
3418         /* check it's a supported varient */
3419         if (!(level==10 && strcsequal(str1,"WrLh") && strcsequal(str2,"zzzBBzz"))) {
3420                 return False;
3421         }
3422
3423         *rdata_len = mdrcnt + 1024;
3424         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3425         if (!*rdata) {
3426                 return False;
3427         }
3428
3429         SSVAL(*rparam,0,NERR_Success);
3430         SSVAL(*rparam,2,0);             /* converter word */
3431
3432         p = *rdata;
3433         endp = *rdata + *rdata_len;
3434
3435         p2 = get_safe_ptr(*rdata,*rdata_len,p,22);
3436         if (!p2) {
3437                 return False;
3438         }
3439
3440         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */
3441         strlcpy(p2,get_local_machine_name(),PTR_DIFF(endp,p2));
3442         strupper_m(p2);
3443         p2 = skip_string(*rdata,*rdata_len,p2);
3444         if (!p2) {
3445                 return False;
3446         }
3447         p += 4;
3448
3449         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3450         strlcpy(p2,conn->server_info->sanitized_username,PTR_DIFF(endp,p2));
3451         p2 = skip_string(*rdata,*rdata_len,p2);
3452         if (!p2) {
3453                 return False;
3454         }
3455         p += 4;
3456
3457         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */
3458         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));
3459         strupper_m(p2);
3460         p2 = skip_string(*rdata,*rdata_len,p2);
3461         if (!p2) {
3462                 return False;
3463         }
3464         p += 4;
3465
3466         SCVAL(p,0,lp_major_announce_version()); /* system version - e.g 4 in 4.1 */
3467         SCVAL(p,1,lp_minor_announce_version()); /* system version - e.g .1 in 4.1 */
3468         p += 2;
3469
3470         SIVAL(p,0,PTR_DIFF(p2,*rdata));
3471         strlcpy(p2,lp_workgroup(),PTR_DIFF(endp,p2));   /* don't know.  login domain?? */
3472         p2 = skip_string(*rdata,*rdata_len,p2);
3473         if (!p2) {
3474                 return False;
3475         }
3476         p += 4;
3477
3478         SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* don't know */
3479         strlcpy(p2,"",PTR_DIFF(endp,p2));
3480         p2 = skip_string(*rdata,*rdata_len,p2);
3481         if (!p2) {
3482                 return False;
3483         }
3484         p += 4;
3485
3486         *rdata_len = PTR_DIFF(p2,*rdata);
3487
3488         SSVAL(*rparam,4,*rdata_len);
3489
3490         return True;
3491 }
3492
3493 /****************************************************************************
3494   get info about a user
3495
3496     struct user_info_11 {
3497         char                usri11_name[21];  0-20
3498         char                usri11_pad;       21
3499         char                *usri11_comment;  22-25
3500         char            *usri11_usr_comment;  26-29
3501         unsigned short      usri11_priv;      30-31
3502         unsigned long       usri11_auth_flags; 32-35
3503         long                usri11_password_age; 36-39
3504         char                *usri11_homedir; 40-43
3505         char            *usri11_parms; 44-47
3506         long                usri11_last_logon; 48-51
3507         long                usri11_last_logoff; 52-55
3508         unsigned short      usri11_bad_pw_count; 56-57
3509         unsigned short      usri11_num_logons; 58-59
3510         char                *usri11_logon_server; 60-63
3511         unsigned short      usri11_country_code; 64-65
3512         char            *usri11_workstations; 66-69
3513         unsigned long       usri11_max_storage; 70-73
3514         unsigned short      usri11_units_per_week; 74-75
3515         unsigned char       *usri11_logon_hours; 76-79
3516         unsigned short      usri11_code_page; 80-81
3517     };
3518
3519 where:
3520
3521   usri11_name specifies the user name for which information is retrieved
3522
3523   usri11_pad aligns the next data structure element to a word boundary
3524
3525   usri11_comment is a null terminated ASCII comment
3526
3527   usri11_user_comment is a null terminated ASCII comment about the user
3528
3529   usri11_priv specifies the level of the privilege assigned to the user.
3530        The possible values are:
3531
3532 Name             Value  Description
3533 USER_PRIV_GUEST  0      Guest privilege
3534 USER_PRIV_USER   1      User privilege
3535 USER_PRV_ADMIN   2      Administrator privilege
3536
3537   usri11_auth_flags specifies the account operator privileges. The
3538        possible values are:
3539
3540 Name            Value   Description
3541 AF_OP_PRINT     0       Print operator
3542
3543
3544 Leach, Naik                                        [Page 28]
3545 \f
3546
3547
3548 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3549
3550
3551 AF_OP_COMM      1       Communications operator
3552 AF_OP_SERVER    2       Server operator
3553 AF_OP_ACCOUNTS  3       Accounts operator
3554
3555
3556   usri11_password_age specifies how many seconds have elapsed since the
3557        password was last changed.
3558
3559   usri11_home_dir points to a null terminated ASCII string that contains
3560        the path name of the user's home directory.
3561
3562   usri11_parms points to a null terminated ASCII string that is set
3563        aside for use by applications.
3564
3565   usri11_last_logon specifies the time when the user last logged on.
3566        This value is stored as the number of seconds elapsed since
3567        00:00:00, January 1, 1970.
3568
3569   usri11_last_logoff specifies the time when the user last logged off.
3570        This value is stored as the number of seconds elapsed since
3571        00:00:00, January 1, 1970. A value of 0 means the last logoff
3572        time is unknown.
3573
3574   usri11_bad_pw_count specifies the number of incorrect passwords
3575        entered since the last successful logon.
3576
3577   usri11_log1_num_logons specifies the number of times this user has
3578        logged on. A value of -1 means the number of logons is unknown.
3579
3580   usri11_logon_server points to a null terminated ASCII string that
3581        contains the name of the server to which logon requests are sent.
3582        A null string indicates logon requests should be sent to the
3583        domain controller.
3584
3585   usri11_country_code specifies the country code for the user's language
3586        of choice.
3587
3588   usri11_workstations points to a null terminated ASCII string that
3589        contains the names of workstations the user may log on from.
3590        There may be up to 8 workstations, with the names separated by
3591        commas. A null strings indicates there are no restrictions.
3592
3593   usri11_max_storage specifies the maximum amount of disk space the user
3594        can occupy. A value of 0xffffffff indicates there are no
3595        restrictions.
3596
3597   usri11_units_per_week specifies the equal number of time units into
3598        which a week is divided. This value must be equal to 168.
3599
3600   usri11_logon_hours points to a 21 byte (168 bits) string that
3601        specifies the time during which the user can log on. Each bit
3602        represents one unique hour in a week. The first bit (bit 0, word
3603        0) is Sunday, 0:00 to 0:59, the second bit (bit 1, word 0) is
3604
3605
3606
3607 Leach, Naik                                        [Page 29]
3608 \f
3609
3610
3611 INTERNET-DRAFT   CIFS Remote Admin Protocol     January 10, 1997
3612
3613
3614        Sunday, 1:00 to 1:59 and so on. A null pointer indicates there
3615        are no restrictions.
3616
3617   usri11_code_page specifies the code page for the user's language of
3618        choice
3619
3620 All of the pointers in this data structure need to be treated
3621 specially. The  pointer is a 32 bit pointer. The higher 16 bits need
3622 to be ignored. The converter word returned in the parameters section
3623 needs to be subtracted from the lower 16 bits to calculate an offset
3624 into the return buffer where this ASCII string resides.
3625
3626 There is no auxiliary data in the response.
3627
3628   ****************************************************************************/
3629
3630 #define usri11_name           0
3631 #define usri11_pad            21
3632 #define usri11_comment        22
3633 #define usri11_usr_comment    26
3634 #define usri11_full_name      30
3635 #define usri11_priv           34
3636 #define usri11_auth_flags     36
3637 #define usri11_password_age   40
3638 #define usri11_homedir        44
3639 #define usri11_parms          48
3640 #define usri11_last_logon     52
3641 #define usri11_last_logoff    56
3642 #define usri11_bad_pw_count   60
3643 #define usri11_num_logons     62
3644 #define usri11_logon_server   64
3645 #define usri11_country_code   68
3646 #define usri11_workstations   70
3647 #define usri11_max_storage    74
3648 #define usri11_units_per_week 78
3649 #define usri11_logon_hours    80
3650 #define usri11_code_page      84
3651 #define usri11_end            86
3652
3653 #define USER_PRIV_GUEST 0
3654 #define USER_PRIV_USER 1
3655 #define USER_PRIV_ADMIN 2
3656
3657 #define AF_OP_PRINT     0
3658 #define AF_OP_COMM      1
3659 #define AF_OP_SERVER    2
3660 #define AF_OP_ACCOUNTS  3
3661
3662
3663 static bool api_RNetUserGetInfo(connection_struct *conn, uint16 vuid,
3664                                 char *param, int tpscnt,
3665                                 char *data, int tdscnt,
3666                                 int mdrcnt,int mprcnt,
3667                                 char **rdata,char **rparam,
3668                                 int *rdata_len,int *rparam_len)
3669 {
3670         struct smbd_server_connection *sconn = smbd_server_conn;
3671         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3672         char *str2 = skip_string(param,tpscnt,str1);
3673         char *UserName = skip_string(param,tpscnt,str2);
3674         char *p = skip_string(param,tpscnt,UserName);
3675         int uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3676         char *p2;
3677         char *endp;
3678         const char *level_string;
3679
3680         /* get NIS home of a previously validated user - simeon */
3681         /* With share level security vuid will always be zero.
3682            Don't depend on vuser being non-null !!. JRA */
3683         user_struct *vuser = get_valid_user_struct(sconn, vuid);
3684         if(vuser != NULL) {
3685                 DEBUG(3,("  Username of UID %d is %s\n",
3686                          (int)vuser->server_info->utok.uid,
3687                          vuser->server_info->unix_name));
3688         }
3689
3690         if (!str1 || !str2 || !UserName || !p) {
3691                 return False;
3692         }
3693
3694         *rparam_len = 6;
3695         *rparam = smb_realloc_limit(*rparam,*rparam_len);
3696         if (!*rparam) {
3697                 return False;
3698         }
3699
3700         DEBUG(4,("RNetUserGetInfo level=%d\n", uLevel));
3701
3702         /* check it's a supported variant */
3703         if (strcmp(str1,"zWrLh") != 0) {
3704                 return False;
3705         }
3706         switch( uLevel ) {
3707                 case 0: level_string = "B21"; break;
3708                 case 1: level_string = "B21BB16DWzzWz"; break;
3709                 case 2: level_string = "B21BB16DWzzWzDzzzzDDDDWb21WWzWW"; break;
3710                 case 10: level_string = "B21Bzzz"; break;
3711                 case 11: level_string = "B21BzzzWDDzzDDWWzWzDWb21W"; break;
3712                 default: return False;
3713         }
3714
3715         if (strcmp(level_string,str2) != 0) {
3716                 return False;
3717         }
3718
3719         *rdata_len = mdrcnt + 1024;
3720         *rdata = smb_realloc_limit(*rdata,*rdata_len);
3721         if (!*rdata) {
3722                 return False;
3723         }
3724
3725         SSVAL(*rparam,0,NERR_Success);
3726         SSVAL(*rparam,2,0);             /* converter word */
3727
3728         p = *rdata;
3729         endp = *rdata + *rdata_len;
3730         p2 = get_safe_ptr(*rdata,*rdata_len,p,usri11_end);
3731         if (!p2) {
3732                 return False;
3733         }
3734
3735         memset(p,0,21);
3736         fstrcpy(p+usri11_name,UserName); /* 21 bytes - user name */
3737
3738         if (uLevel > 0) {
3739                 SCVAL(p,usri11_pad,0); /* padding - 1 byte */
3740                 *p2 = 0;
3741         }
3742
3743         if (uLevel >= 10) {
3744                 SIVAL(p,usri11_comment,PTR_DIFF(p2,p)); /* comment */
3745                 strlcpy(p2,"Comment",PTR_DIFF(endp,p2));
3746                 p2 = skip_string(*rdata,*rdata_len,p2);
3747                 if (!p2) {
3748                         return False;
3749                 }
3750
3751                 SIVAL(p,usri11_usr_comment,PTR_DIFF(p2,p)); /* user_comment */
3752                 strlcpy(p2,"UserComment",PTR_DIFF(endp,p2));
3753                 p2 = skip_string(*rdata,*rdata_len,p2);
3754                 if (!p2) {
3755                         return False;
3756                 }
3757
3758                 /* EEK! the cifsrap.txt doesn't have this in!!!! */
3759                 SIVAL(p,usri11_full_name,PTR_DIFF(p2,p)); /* full name */
3760                 strlcpy(p2,((vuser != NULL)
3761                             ? pdb_get_fullname(vuser->server_info->sam_account)
3762                             : UserName),PTR_DIFF(endp,p2));
3763                 p2 = skip_string(*rdata,*rdata_len,p2);
3764                 if (!p2) {
3765                         return False;
3766                 }
3767         }
3768
3769         if (uLevel == 11) {
3770                 const char *homedir = "";
3771                 if (vuser != NULL) {
3772                         homedir = pdb_get_homedir(
3773                                 vuser->server_info->sam_account);
3774                 }
3775                 /* modelled after NTAS 3.51 reply */
3776                 SSVAL(p,usri11_priv,conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3777                 SIVAL(p,usri11_auth_flags,AF_OP_PRINT);         /* auth flags */
3778                 SIVALS(p,usri11_password_age,-1);               /* password age */
3779                 SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
3780                 strlcpy(p2, homedir, PTR_DIFF(endp,p2));
3781                 p2 = skip_string(*rdata,*rdata_len,p2);
3782                 if (!p2) {
3783                         return False;
3784                 }
3785                 SIVAL(p,usri11_parms,PTR_DIFF(p2,p)); /* parms */
3786                 strlcpy(p2,"",PTR_DIFF(endp,p2));
3787                 p2 = skip_string(*rdata,*rdata_len,p2);
3788                 if (!p2) {
3789                         return False;
3790                 }
3791                 SIVAL(p,usri11_last_logon,0);           /* last logon */
3792                 SIVAL(p,usri11_last_logoff,0);          /* last logoff */
3793                 SSVALS(p,usri11_bad_pw_count,-1);       /* bad pw counts */
3794                 SSVALS(p,usri11_num_logons,-1);         /* num logons */
3795                 SIVAL(p,usri11_logon_server,PTR_DIFF(p2,p)); /* logon server */
3796                 strlcpy(p2,"\\\\*",PTR_DIFF(endp,p2));
3797                 p2 = skip_string(*rdata,*rdata_len,p2);
3798                 if (!p2) {
3799                         return False;
3800                 }
3801                 SSVAL(p,usri11_country_code,0);         /* country code */
3802
3803                 SIVAL(p,usri11_workstations,PTR_DIFF(p2,p)); /* workstations */
3804                 strlcpy(p2,"",PTR_DIFF(endp,p2));
3805                 p2 = skip_string(*rdata,*rdata_len,p2);
3806                 if (!p2) {
3807                         return False;
3808                 }
3809
3810                 SIVALS(p,usri11_max_storage,-1);                /* max storage */
3811                 SSVAL(p,usri11_units_per_week,168);             /* units per week */
3812                 SIVAL(p,usri11_logon_hours,PTR_DIFF(p2,p)); /* logon hours */
3813
3814                 /* a simple way to get logon hours at all times. */
3815                 memset(p2,0xff,21);
3816                 SCVAL(p2,21,0);           /* fix zero termination */
3817                 p2 = skip_string(*rdata,*rdata_len,p2);
3818                 if (!p2) {
3819                         return False;
3820                 }
3821
3822                 SSVAL(p,usri11_code_page,0);            /* code page */
3823         }
3824
3825         if (uLevel == 1 || uLevel == 2) {
3826                 memset(p+22,' ',16);    /* password */
3827                 SIVALS(p,38,-1);                /* password age */
3828                 SSVAL(p,42,
3829                 conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3830                 SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
3831                 strlcpy(p2, vuser ? pdb_get_homedir(
3832                                 vuser->server_info->sam_account) : "",
3833                         PTR_DIFF(endp,p2));
3834                 p2 = skip_string(*rdata,*rdata_len,p2);
3835                 if (!p2) {
3836                         return False;
3837                 }
3838                 SIVAL(p,48,PTR_DIFF(p2,*rdata)); /* comment */
3839                 *p2++ = 0;
3840                 SSVAL(p,52,0);          /* flags */
3841                 SIVAL(p,54,PTR_DIFF(p2,*rdata));                /* script_path */
3842                 strlcpy(p2, vuser ? pdb_get_logon_script(
3843                                 vuser->server_info->sam_account) : "",
3844                         PTR_DIFF(endp,p2));
3845                 p2 = skip_string(*rdata,*rdata_len,p2);
3846                 if (!p2) {
3847                         return False;
3848                 }
3849                 if (uLevel == 2) {
3850                         SIVAL(p,60,0);          /* auth_flags */
3851                         SIVAL(p,64,PTR_DIFF(p2,*rdata)); /* full_name */
3852                         strlcpy(p2,((vuser != NULL)
3853                                     ? pdb_get_fullname(vuser->server_info->sam_account)
3854                                     : UserName),PTR_DIFF(endp,p2));
3855                         p2 = skip_string(*rdata,*rdata_len,p2);
3856                         if (!p2) {
3857                                 return False;
3858                         }
3859                         SIVAL(p,68,0);          /* urs_comment */
3860                         SIVAL(p,72,PTR_DIFF(p2,*rdata)); /* parms */
3861                         strlcpy(p2,"",PTR_DIFF(endp,p2));
3862                         p2 = skip_string(*rdata,*rdata_len,p2);
3863                         if (!p2) {
3864                                 return False;
3865                         }
3866                         SIVAL(p,76,0);          /* workstations */
3867                         SIVAL(p,80,0);          /* last_logon */
3868                         SIVAL(p,84,0);          /* last_logoff */
3869                         SIVALS(p,88,-1);                /* acct_expires */
3870                         SIVALS(p,92,-1);                /* max_storage */
3871                         SSVAL(p,96,168);        /* units_per_week */
3872                         SIVAL(p,98,PTR_DIFF(p2,*rdata)); /* logon_hours */
3873                         memset(p2,-1,21);
3874                         p2 += 21;
3875                         SSVALS(p,102,-1);       /* bad_pw_count */
3876                         SSVALS(p,104,-1);       /* num_logons */
3877                         SIVAL(p,106,PTR_DIFF(p2,*rdata)); /* logon_server */
3878                         {
3879                                 TALLOC_CTX *ctx = talloc_tos();
3880                                 int space_rem = *rdata_len - (p2 - *rdata);
3881                                 char *tmp;
3882
3883                                 if (space_rem <= 0) {
3884                                         return false;
3885                                 }
3886                                 tmp = talloc_strdup(ctx, "\\\\%L");
3887                                 if (!tmp) {
3888                                         return false;
3889                                 }
3890                                 tmp = talloc_sub_basic(ctx,
3891                                                 "",
3892                                                 "",
3893                                                 tmp);
3894                                 if (!tmp) {
3895                                         return false;
3896                                 }
3897
3898                                 push_ascii(p2,
3899                                         tmp,
3900                                         space_rem,
3901                                         STR_TERMINATE);
3902                         }
3903                         p2 = skip_string(*rdata,*rdata_len,p2);
3904                         if (!p2) {
3905                                 return False;
3906                         }
3907                         SSVAL(p,110,49);        /* country_code */
3908                         SSVAL(p,112,860);       /* code page */
3909                 }
3910         }
3911
3912         *rdata_len = PTR_DIFF(p2,*rdata);
3913
3914         SSVAL(*rparam,4,*rdata_len);    /* is this right?? */
3915
3916         return(True);
3917 }
3918
3919 static bool api_WWkstaUserLogon(connection_struct *conn,uint16 vuid,
3920                                 char *param, int tpscnt,
3921                                 char *data, int tdscnt,
3922                                 int mdrcnt,int mprcnt,
3923                                 char **rdata,char **rparam,
3924                                 int *rdata_len,int *rparam_len)
3925 {
3926         struct smbd_server_connection *sconn = smbd_server_conn;
3927         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
3928         char *str2 = skip_string(param,tpscnt,str1);
3929         char *p = skip_string(param,tpscnt,str2);
3930         int uLevel;
3931         struct pack_desc desc;
3932         char* name;
3933                 /* With share level security vuid will always be zero.
3934                    Don't depend on vuser being non-null !!. JRA */
3935         user_struct *vuser = get_valid_user_struct(sconn, vuid);
3936
3937         if (!str1 || !str2 || !p) {
3938                 return False;
3939         }
3940
3941         if(vuser != NULL) {
3942                 DEBUG(3,("  Username of UID %d is %s\n",
3943                          (int)vuser->server_info->utok.uid,
3944                          vuser->server_info->unix_name));
3945         }
3946
3947         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
3948         name = get_safe_str_ptr(param,tpscnt,p,2);
3949         if (!name) {
3950                 return False;
3951         }
3952
3953         memset((char *)&desc,'\0',sizeof(desc));
3954
3955         DEBUG(3,("WWkstaUserLogon uLevel=%d name=%s\n",uLevel,name));
3956
3957         /* check it's a supported varient */
3958         if (strcmp(str1,"OOWb54WrLh") != 0) {
3959                 return False;
3960         }
3961         if (uLevel != 1 || strcmp(str2,"WB21BWDWWDDDDDDDzzzD") != 0) {
3962                 return False;
3963         }
3964         if (mdrcnt > 0) {
3965                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
3966                 if (!*rdata) {
3967                         return False;
3968                 }
3969         }
3970
3971         desc.base = *rdata;
3972         desc.buflen = mdrcnt;
3973         desc.subformat = NULL;
3974         desc.format = str2;
3975
3976         if (init_package(&desc,1,0)) {
3977                 PACKI(&desc,"W",0);             /* code */
3978                 PACKS(&desc,"B21",name);        /* eff. name */
3979                 PACKS(&desc,"B","");            /* pad */
3980                 PACKI(&desc,"W", conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
3981                 PACKI(&desc,"D",0);             /* auth flags XXX */
3982                 PACKI(&desc,"W",0);             /* num logons */
3983                 PACKI(&desc,"W",0);             /* bad pw count */
3984                 PACKI(&desc,"D",0);             /* last logon */
3985                 PACKI(&desc,"D",-1);            /* last logoff */
3986                 PACKI(&desc,"D",-1);            /* logoff time */
3987                 PACKI(&desc,"D",-1);            /* kickoff time */
3988                 PACKI(&desc,"D",0);             /* password age */
3989                 PACKI(&desc,"D",0);             /* password can change */
3990                 PACKI(&desc,"D",-1);            /* password must change */
3991
3992                 {
3993                         fstring mypath;
3994                         fstrcpy(mypath,"\\\\");
3995                         fstrcat(mypath,get_local_machine_name());
3996                         strupper_m(mypath);
3997                         PACKS(&desc,"z",mypath); /* computer */
3998                 }
3999
4000                 PACKS(&desc,"z",lp_workgroup());/* domain */
4001                 PACKS(&desc,"z", vuser ? pdb_get_logon_script(
4002                               vuser->server_info->sam_account) : ""); /* script path */
4003                 PACKI(&desc,"D",0x00000000);            /* reserved */
4004         }
4005
4006         *rdata_len = desc.usedlen;
4007         *rparam_len = 6;
4008         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4009         if (!*rparam) {
4010                 return False;
4011         }
4012         SSVALS(*rparam,0,desc.errcode);
4013         SSVAL(*rparam,2,0);
4014         SSVAL(*rparam,4,desc.neededlen);
4015
4016         DEBUG(4,("WWkstaUserLogon: errorcode %d\n",desc.errcode));
4017
4018         return True;
4019 }
4020
4021 /****************************************************************************
4022  api_WAccessGetUserPerms
4023 ****************************************************************************/
4024
4025 static bool api_WAccessGetUserPerms(connection_struct *conn,uint16 vuid,
4026                                 char *param, int tpscnt,
4027                                 char *data, int tdscnt,
4028                                 int mdrcnt,int mprcnt,
4029                                 char **rdata,char **rparam,
4030                                 int *rdata_len,int *rparam_len)
4031 {
4032         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4033         char *str2 = skip_string(param,tpscnt,str1);
4034         char *user = skip_string(param,tpscnt,str2);
4035         char *resource = skip_string(param,tpscnt,user);
4036
4037         if (!str1 || !str2 || !user || !resource) {
4038                 return False;
4039         }
4040
4041         if (skip_string(param,tpscnt,resource) == NULL) {
4042                 return False;
4043         }
4044         DEBUG(3,("WAccessGetUserPerms user=%s resource=%s\n",user,resource));
4045
4046         /* check it's a supported varient */
4047         if (strcmp(str1,"zzh") != 0) {
4048                 return False;
4049         }
4050         if (strcmp(str2,"") != 0) {
4051                 return False;
4052         }
4053
4054         *rparam_len = 6;
4055         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4056         if (!*rparam) {
4057                 return False;
4058         }
4059         SSVALS(*rparam,0,0);            /* errorcode */
4060         SSVAL(*rparam,2,0);             /* converter word */
4061         SSVAL(*rparam,4,0x7f);  /* permission flags */
4062
4063         return True;
4064 }
4065
4066 /****************************************************************************
4067   api_WPrintJobEnumerate
4068   ****************************************************************************/
4069
4070 static bool api_WPrintJobGetInfo(connection_struct *conn, uint16 vuid,
4071                                 char *param, int tpscnt,
4072                                 char *data, int tdscnt,
4073                                 int mdrcnt,int mprcnt,
4074                                 char **rdata,char **rparam,
4075                                 int *rdata_len,int *rparam_len)
4076 {
4077         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4078         char *str2 = skip_string(param,tpscnt,str1);
4079         char *p = skip_string(param,tpscnt,str2);
4080         int uLevel;
4081         int count;
4082         int i;
4083         int snum;
4084         fstring sharename;
4085         uint32 jobid;
4086         struct pack_desc desc;
4087         print_queue_struct *queue=NULL;
4088         print_status_struct status;
4089         char *tmpdata=NULL;
4090
4091         if (!str1 || !str2 || !p) {
4092                 return False;
4093         }
4094
4095         uLevel = get_safe_SVAL(param,tpscnt,p,2,-1);
4096
4097         memset((char *)&desc,'\0',sizeof(desc));
4098         memset((char *)&status,'\0',sizeof(status));
4099
4100         DEBUG(3,("WPrintJobGetInfo uLevel=%d uJobId=0x%X\n",uLevel,SVAL(p,0)));
4101
4102         /* check it's a supported varient */
4103         if (strcmp(str1,"WWrLh") != 0) {
4104                 return False;
4105         }
4106         if (!check_printjob_info(&desc,uLevel,str2)) {
4107                 return False;
4108         }
4109
4110         if(!rap_to_pjobid(SVAL(p,0), sharename, &jobid)) {
4111                 return False;
4112         }
4113
4114         snum = lp_servicenumber( sharename);
4115         if (snum < 0 || !VALID_SNUM(snum)) {
4116                 return(False);
4117         }
4118
4119         count = print_queue_status(snum,&queue,&status);
4120         for (i = 0; i < count; i++) {
4121                 if (queue[i].job == jobid) {
4122                         break;
4123                 }
4124         }
4125
4126         if (mdrcnt > 0) {
4127                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4128                 if (!*rdata) {
4129                         return False;
4130                 }
4131                 desc.base = *rdata;
4132                 desc.buflen = mdrcnt;
4133         } else {
4134                 /*
4135                  * Don't return data but need to get correct length
4136                  *  init_package will return wrong size if buflen=0
4137                  */
4138                 desc.buflen = getlen(desc.format);
4139                 desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4140         }
4141
4142         if (init_package(&desc,1,0)) {
4143                 if (i < count) {
4144                         fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4145                         *rdata_len = desc.usedlen;
4146                 } else {
4147                         desc.errcode = NERR_JobNotFound;
4148                         *rdata_len = 0;
4149                 }
4150         }
4151
4152         *rparam_len = 6;
4153         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4154         if (!*rparam) {
4155                 return False;
4156         }
4157         SSVALS(*rparam,0,desc.errcode);
4158         SSVAL(*rparam,2,0);
4159         SSVAL(*rparam,4,desc.neededlen);
4160
4161         SAFE_FREE(queue);
4162         SAFE_FREE(tmpdata);
4163
4164         DEBUG(4,("WPrintJobGetInfo: errorcode %d\n",desc.errcode));
4165
4166         return True;
4167 }
4168
4169 static bool api_WPrintJobEnumerate(connection_struct *conn, uint16 vuid,
4170                                 char *param, int tpscnt,
4171                                 char *data, int tdscnt,
4172                                 int mdrcnt,int mprcnt,
4173                                 char **rdata,char **rparam,
4174                                 int *rdata_len,int *rparam_len)
4175 {
4176         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4177         char *str2 = skip_string(param,tpscnt,str1);
4178         char *p = skip_string(param,tpscnt,str2);
4179         char *name = p;
4180         int uLevel;
4181         int count;
4182         int i, succnt=0;
4183         int snum;
4184         struct pack_desc desc;
4185         print_queue_struct *queue=NULL;
4186         print_status_struct status;
4187         fstring share_name;
4188
4189         if (!str1 || !str2 || !p) {
4190                 return False;
4191         }
4192
4193         memset((char *)&desc,'\0',sizeof(desc));
4194         memset((char *)&status,'\0',sizeof(status));
4195
4196         p = skip_string(param,tpscnt,p);
4197         if (!p) {
4198                 return False;
4199         }
4200         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4201
4202         DEBUG(3,("WPrintJobEnumerate uLevel=%d name=%s\n",uLevel,name));
4203
4204         /* check it's a supported variant */
4205         if (strcmp(str1,"zWrLeh") != 0) {
4206                 return False;
4207         }
4208
4209         if (uLevel > 2) {
4210                 return False;   /* defined only for uLevel 0,1,2 */
4211         }
4212
4213         if (!check_printjob_info(&desc,uLevel,str2)) {
4214                 return False;
4215         }
4216
4217         snum = find_service(name, share_name);
4218         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4219                 return False;
4220         }
4221
4222         count = print_queue_status(snum,&queue,&status);
4223         if (mdrcnt > 0) {
4224                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4225                 if (!*rdata) {
4226                         return False;
4227                 }
4228         }
4229         desc.base = *rdata;
4230         desc.buflen = mdrcnt;
4231
4232         if (init_package(&desc,count,0)) {
4233                 succnt = 0;
4234                 for (i = 0; i < count; i++) {
4235                         fill_printjob_info(conn,snum,uLevel,&desc,&queue[i],i);
4236                         if (desc.errcode == NERR_Success) {
4237                                 succnt = i+1;
4238                         }
4239                 }
4240         }
4241
4242         *rdata_len = desc.usedlen;
4243
4244         *rparam_len = 8;
4245         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4246         if (!*rparam) {
4247                 return False;
4248         }
4249         SSVALS(*rparam,0,desc.errcode);
4250         SSVAL(*rparam,2,0);
4251         SSVAL(*rparam,4,succnt);
4252         SSVAL(*rparam,6,count);
4253
4254         SAFE_FREE(queue);
4255
4256         DEBUG(4,("WPrintJobEnumerate: errorcode %d\n",desc.errcode));
4257
4258         return True;
4259 }
4260
4261 static int check_printdest_info(struct pack_desc* desc,
4262                                 int uLevel, char* id)
4263 {
4264         desc->subformat = NULL;
4265         switch( uLevel ) {
4266                 case 0:
4267                         desc->format = "B9";
4268                         break;
4269                 case 1:
4270                         desc->format = "B9B21WWzW";
4271                         break;
4272                 case 2:
4273                         desc->format = "z";
4274                         break;
4275                 case 3:
4276                         desc->format = "zzzWWzzzWW";
4277                         break;
4278                 default:
4279                         DEBUG(0,("check_printdest_info: invalid level %d\n",
4280                                 uLevel));
4281                         return False;
4282         }
4283         if (id == NULL || strcmp(desc->format,id) != 0) {
4284                 DEBUG(0,("check_printdest_info: invalid string %s\n",
4285                         id ? id : "<NULL>" ));
4286                 return False;
4287         }
4288         return True;
4289 }
4290
4291 static void fill_printdest_info(connection_struct *conn, int snum, int uLevel,
4292                                 struct pack_desc* desc)
4293 {
4294         char buf[100];
4295
4296         strncpy(buf,SERVICE(snum),sizeof(buf)-1);
4297         buf[sizeof(buf)-1] = 0;
4298         strupper_m(buf);
4299
4300         if (uLevel <= 1) {
4301                 PACKS(desc,"B9",buf);   /* szName */
4302                 if (uLevel == 1) {
4303                         PACKS(desc,"B21","");   /* szUserName */
4304                         PACKI(desc,"W",0);              /* uJobId */
4305                         PACKI(desc,"W",0);              /* fsStatus */
4306                         PACKS(desc,"z","");     /* pszStatus */
4307                         PACKI(desc,"W",0);              /* time */
4308                 }
4309         }
4310
4311         if (uLevel == 2 || uLevel == 3) {
4312                 PACKS(desc,"z",buf);            /* pszPrinterName */
4313                 if (uLevel == 3) {
4314                         PACKS(desc,"z","");     /* pszUserName */
4315                         PACKS(desc,"z","");     /* pszLogAddr */
4316                         PACKI(desc,"W",0);              /* uJobId */
4317                         PACKI(desc,"W",0);              /* fsStatus */
4318                         PACKS(desc,"z","");     /* pszStatus */
4319                         PACKS(desc,"z","");     /* pszComment */
4320                         PACKS(desc,"z","NULL"); /* pszDrivers */
4321                         PACKI(desc,"W",0);              /* time */
4322                         PACKI(desc,"W",0);              /* pad1 */
4323                 }
4324         }
4325 }
4326
4327 static bool api_WPrintDestGetInfo(connection_struct *conn, uint16 vuid,
4328                                 char *param, int tpscnt,
4329                                 char *data, int tdscnt,
4330                                 int mdrcnt,int mprcnt,
4331                                 char **rdata,char **rparam,
4332                                 int *rdata_len,int *rparam_len)
4333 {
4334         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4335         char *str2 = skip_string(param,tpscnt,str1);
4336         char *p = skip_string(param,tpscnt,str2);
4337         char* PrinterName = p;
4338         fstring share_name;
4339         int uLevel;
4340         struct pack_desc desc;
4341         int snum;
4342         char *tmpdata=NULL;
4343
4344         if (!str1 || !str2 || !p) {
4345                 return False;
4346         }
4347
4348         memset((char *)&desc,'\0',sizeof(desc));
4349
4350         p = skip_string(param,tpscnt,p);
4351         if (!p) {
4352                 return False;
4353         }
4354         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4355
4356         DEBUG(3,("WPrintDestGetInfo uLevel=%d PrinterName=%s\n",uLevel,PrinterName));
4357
4358         /* check it's a supported varient */
4359         if (strcmp(str1,"zWrLh") != 0) {
4360                 return False;
4361         }
4362         if (!check_printdest_info(&desc,uLevel,str2)) {
4363                 return False;
4364         }
4365
4366         snum = find_service(PrinterName, share_name);
4367         if ( !(lp_snum_ok(snum) && lp_print_ok(snum)) ) {
4368                 *rdata_len = 0;
4369                 desc.errcode = NERR_DestNotFound;
4370                 desc.neededlen = 0;
4371         } else {
4372                 if (mdrcnt > 0) {
4373                         *rdata = smb_realloc_limit(*rdata,mdrcnt);
4374                         if (!*rdata) {
4375                                 return False;
4376                         }
4377                         desc.base = *rdata;
4378                         desc.buflen = mdrcnt;
4379                 } else {
4380                         /*
4381                          * Don't return data but need to get correct length
4382                          * init_package will return wrong size if buflen=0
4383                          */
4384                         desc.buflen = getlen(desc.format);
4385                         desc.base = tmpdata = (char *)SMB_MALLOC( desc.buflen );
4386                 }
4387                 if (init_package(&desc,1,0)) {
4388                         fill_printdest_info(conn,snum,uLevel,&desc);
4389                 }
4390                 *rdata_len = desc.usedlen;
4391         }
4392
4393         *rparam_len = 6;
4394         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4395         if (!*rparam) {
4396                 return False;
4397         }
4398         SSVALS(*rparam,0,desc.errcode);
4399         SSVAL(*rparam,2,0);
4400         SSVAL(*rparam,4,desc.neededlen);
4401
4402         DEBUG(4,("WPrintDestGetInfo: errorcode %d\n",desc.errcode));
4403         SAFE_FREE(tmpdata);
4404
4405         return True;
4406 }
4407
4408 static bool api_WPrintDestEnum(connection_struct *conn, uint16 vuid,
4409                                 char *param, int tpscnt,
4410                                 char *data, int tdscnt,
4411                                 int mdrcnt,int mprcnt,
4412                                 char **rdata,char **rparam,
4413                                 int *rdata_len,int *rparam_len)
4414 {
4415         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4416         char *str2 = skip_string(param,tpscnt,str1);
4417         char *p = skip_string(param,tpscnt,str2);
4418         int uLevel;
4419         int queuecnt;
4420         int i, n, succnt=0;
4421         struct pack_desc desc;
4422         int services = lp_numservices();
4423
4424         if (!str1 || !str2 || !p) {
4425                 return False;
4426         }
4427
4428         memset((char *)&desc,'\0',sizeof(desc));
4429
4430         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4431
4432         DEBUG(3,("WPrintDestEnum uLevel=%d\n",uLevel));
4433
4434         /* check it's a supported varient */
4435         if (strcmp(str1,"WrLeh") != 0) {
4436                 return False;
4437         }
4438         if (!check_printdest_info(&desc,uLevel,str2)) {
4439                 return False;
4440         }
4441
4442         queuecnt = 0;
4443         for (i = 0; i < services; i++) {
4444                 if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4445                         queuecnt++;
4446                 }
4447         }
4448
4449         if (mdrcnt > 0) {
4450                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4451                 if (!*rdata) {
4452                         return False;
4453                 }
4454         }
4455
4456         desc.base = *rdata;
4457         desc.buflen = mdrcnt;
4458         if (init_package(&desc,queuecnt,0)) {
4459                 succnt = 0;
4460                 n = 0;
4461                 for (i = 0; i < services; i++) {
4462                         if (lp_snum_ok(i) && lp_print_ok(i) && lp_browseable(i)) {
4463                                 fill_printdest_info(conn,i,uLevel,&desc);
4464                                 n++;
4465                                 if (desc.errcode == NERR_Success) {
4466                                         succnt = n;
4467                                 }
4468                         }
4469                 }
4470         }
4471
4472         *rdata_len = desc.usedlen;
4473
4474         *rparam_len = 8;
4475         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4476         if (!*rparam) {
4477                 return False;
4478         }
4479         SSVALS(*rparam,0,desc.errcode);
4480         SSVAL(*rparam,2,0);
4481         SSVAL(*rparam,4,succnt);
4482         SSVAL(*rparam,6,queuecnt);
4483
4484         DEBUG(4,("WPrintDestEnumerate: errorcode %d\n",desc.errcode));
4485
4486         return True;
4487 }
4488
4489 static bool api_WPrintDriverEnum(connection_struct *conn, uint16 vuid,
4490                                 char *param, int tpscnt,
4491                                 char *data, int tdscnt,
4492                                 int mdrcnt,int mprcnt,
4493                                 char **rdata,char **rparam,
4494                                 int *rdata_len,int *rparam_len)
4495 {
4496         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4497         char *str2 = skip_string(param,tpscnt,str1);
4498         char *p = skip_string(param,tpscnt,str2);
4499         int uLevel;
4500         int succnt;
4501         struct pack_desc desc;
4502
4503         if (!str1 || !str2 || !p) {
4504                 return False;
4505         }
4506
4507         memset((char *)&desc,'\0',sizeof(desc));
4508
4509         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4510
4511         DEBUG(3,("WPrintDriverEnum uLevel=%d\n",uLevel));
4512
4513         /* check it's a supported varient */
4514         if (strcmp(str1,"WrLeh") != 0) {
4515                 return False;
4516         }
4517         if (uLevel != 0 || strcmp(str2,"B41") != 0) {
4518                 return False;
4519         }
4520
4521         if (mdrcnt > 0) {
4522                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4523                 if (!*rdata) {
4524                         return False;
4525                 }
4526         }
4527         desc.base = *rdata;
4528         desc.buflen = mdrcnt;
4529         if (init_package(&desc,1,0)) {
4530                 PACKS(&desc,"B41","NULL");
4531         }
4532
4533         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4534
4535         *rdata_len = desc.usedlen;
4536
4537         *rparam_len = 8;
4538         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4539         if (!*rparam) {
4540                 return False;
4541         }
4542         SSVALS(*rparam,0,desc.errcode);
4543         SSVAL(*rparam,2,0);
4544         SSVAL(*rparam,4,succnt);
4545         SSVAL(*rparam,6,1);
4546
4547         DEBUG(4,("WPrintDriverEnum: errorcode %d\n",desc.errcode));
4548
4549         return True;
4550 }
4551
4552 static bool api_WPrintQProcEnum(connection_struct *conn, uint16 vuid,
4553                                 char *param, int tpscnt,
4554                                 char *data, int tdscnt,
4555                                 int mdrcnt,int mprcnt,
4556                                 char **rdata,char **rparam,
4557                                 int *rdata_len,int *rparam_len)
4558 {
4559         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4560         char *str2 = skip_string(param,tpscnt,str1);
4561         char *p = skip_string(param,tpscnt,str2);
4562         int uLevel;
4563         int succnt;
4564         struct pack_desc desc;
4565
4566         if (!str1 || !str2 || !p) {
4567                 return False;
4568         }
4569         memset((char *)&desc,'\0',sizeof(desc));
4570
4571         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4572
4573         DEBUG(3,("WPrintQProcEnum uLevel=%d\n",uLevel));
4574
4575         /* check it's a supported varient */
4576         if (strcmp(str1,"WrLeh") != 0) {
4577                 return False;
4578         }
4579         if (uLevel != 0 || strcmp(str2,"B13") != 0) {
4580                 return False;
4581         }
4582
4583         if (mdrcnt > 0) {
4584                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4585                 if (!*rdata) {
4586                         return False;
4587                 }
4588         }
4589         desc.base = *rdata;
4590         desc.buflen = mdrcnt;
4591         desc.format = str2;
4592         if (init_package(&desc,1,0)) {
4593                 PACKS(&desc,"B13","lpd");
4594         }
4595
4596         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4597
4598         *rdata_len = desc.usedlen;
4599
4600         *rparam_len = 8;
4601         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4602         if (!*rparam) {
4603                 return False;
4604         }
4605         SSVALS(*rparam,0,desc.errcode);
4606         SSVAL(*rparam,2,0);
4607         SSVAL(*rparam,4,succnt);
4608         SSVAL(*rparam,6,1);
4609
4610         DEBUG(4,("WPrintQProcEnum: errorcode %d\n",desc.errcode));
4611
4612         return True;
4613 }
4614
4615 static bool api_WPrintPortEnum(connection_struct *conn, uint16 vuid,
4616                                 char *param, int tpscnt,
4617                                 char *data, int tdscnt,
4618                                 int mdrcnt,int mprcnt,
4619                                 char **rdata,char **rparam,
4620                                 int *rdata_len,int *rparam_len)
4621 {
4622         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4623         char *str2 = skip_string(param,tpscnt,str1);
4624         char *p = skip_string(param,tpscnt,str2);
4625         int uLevel;
4626         int succnt;
4627         struct pack_desc desc;
4628
4629         if (!str1 || !str2 || !p) {
4630                 return False;
4631         }
4632
4633         memset((char *)&desc,'\0',sizeof(desc));
4634
4635         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4636
4637         DEBUG(3,("WPrintPortEnum uLevel=%d\n",uLevel));
4638
4639         /* check it's a supported varient */
4640         if (strcmp(str1,"WrLeh") != 0) {
4641                 return False;
4642         }
4643         if (uLevel != 0 || strcmp(str2,"B9") != 0) {
4644                 return False;
4645         }
4646
4647         if (mdrcnt > 0) {
4648                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4649                 if (!*rdata) {
4650                         return False;
4651                 }
4652         }
4653         memset((char *)&desc,'\0',sizeof(desc));
4654         desc.base = *rdata;
4655         desc.buflen = mdrcnt;
4656         desc.format = str2;
4657         if (init_package(&desc,1,0)) {
4658                 PACKS(&desc,"B13","lp0");
4659         }
4660
4661         succnt = (desc.errcode == NERR_Success ? 1 : 0);
4662
4663         *rdata_len = desc.usedlen;
4664
4665         *rparam_len = 8;
4666         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4667         if (!*rparam) {
4668                 return False;
4669         }
4670         SSVALS(*rparam,0,desc.errcode);
4671         SSVAL(*rparam,2,0);
4672         SSVAL(*rparam,4,succnt);
4673         SSVAL(*rparam,6,1);
4674
4675         DEBUG(4,("WPrintPortEnum: errorcode %d\n",desc.errcode));
4676
4677         return True;
4678 }
4679
4680 /****************************************************************************
4681  List open sessions
4682  ****************************************************************************/
4683
4684 static bool api_RNetSessionEnum(connection_struct *conn, uint16 vuid,
4685                                 char *param, int tpscnt,
4686                                 char *data, int tdscnt,
4687                                 int mdrcnt,int mprcnt,
4688                                 char **rdata,char **rparam,
4689                                 int *rdata_len,int *rparam_len)
4690
4691 {
4692         char *str1 = get_safe_str_ptr(param,tpscnt,param,2);
4693         char *str2 = skip_string(param,tpscnt,str1);
4694         char *p = skip_string(param,tpscnt,str2);
4695         int uLevel;
4696         struct pack_desc desc;
4697         struct sessionid *session_list;
4698         int i, num_sessions;
4699
4700         if (!str1 || !str2 || !p) {
4701                 return False;
4702         }
4703
4704         memset((char *)&desc,'\0',sizeof(desc));
4705
4706         uLevel = get_safe_SVAL(param,tpscnt,p,0,-1);
4707
4708         DEBUG(3,("RNetSessionEnum uLevel=%d\n",uLevel));
4709         DEBUG(7,("RNetSessionEnum req string=%s\n",str1));
4710         DEBUG(7,("RNetSessionEnum ret string=%s\n",str2));
4711
4712         /* check it's a supported varient */
4713         if (strcmp(str1,RAP_NetSessionEnum_REQ) != 0) {
4714                 return False;
4715         }
4716         if (uLevel != 2 || strcmp(str2,RAP_SESSION_INFO_L2) != 0) {
4717                 return False;
4718         }
4719
4720         num_sessions = list_sessions(talloc_tos(), &session_list);
4721
4722         if (mdrcnt > 0) {
4723                 *rdata = smb_realloc_limit(*rdata,mdrcnt);
4724                 if (!*rdata) {
4725                         return False;
4726                 }
4727         }
4728         memset((char *)&desc,'\0',sizeof(desc));
4729         desc.base = *rdata;
4730         desc.buflen = mdrcnt;
4731         desc.format = str2;
4732         if (!init_package(&desc,num_sessions,0)) {
4733                 return False;
4734         }
4735
4736         for(i=0; i<num_sessions; i++) {
4737                 PACKS(&desc, "z", session_list[i].remote_machine);
4738                 PACKS(&desc, "z", session_list[i].username);
4739                 PACKI(&desc, "W", 1); /* num conns */
4740                 PACKI(&desc, "W", 0); /* num opens */
4741                 PACKI(&desc, "W", 1); /* num users */
4742                 PACKI(&desc, "D", 0); /* session time */
4743                 PACKI(&desc, "D", 0); /* idle time */
4744                 PACKI(&desc, "D", 0); /* flags */
4745                 PACKS(&desc, "z", "Unknown Client"); /* client type string */
4746         }
4747
4748         *rdata_len = desc.usedlen;
4749
4750         *rparam_len = 8;
4751         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4752         if (!*rparam) {
4753                 return False;
4754         }
4755         SSVALS(*rparam,0,desc.errcode);
4756         SSVAL(*rparam,2,0); /* converter */
4757         SSVAL(*rparam,4,num_sessions); /* count */
4758
4759         DEBUG(4,("RNetSessionEnum: errorcode %d\n",desc.errcode));
4760
4761         return True;
4762 }
4763
4764
4765 /****************************************************************************
4766  The buffer was too small.
4767  ****************************************************************************/
4768
4769 static bool api_TooSmall(connection_struct *conn,uint16 vuid, char *param, char *data,
4770                          int mdrcnt, int mprcnt,
4771                          char **rdata, char **rparam,
4772                          int *rdata_len, int *rparam_len)
4773 {
4774         *rparam_len = MIN(*rparam_len,mprcnt);
4775         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4776         if (!*rparam) {
4777                 return False;
4778         }
4779
4780         *rdata_len = 0;
4781
4782         SSVAL(*rparam,0,NERR_BufTooSmall);
4783
4784         DEBUG(3,("Supplied buffer too small in API command\n"));
4785
4786         return True;
4787 }
4788
4789 /****************************************************************************
4790  The request is not supported.
4791  ****************************************************************************/
4792
4793 static bool api_Unsupported(connection_struct *conn, uint16 vuid,
4794                                 char *param, int tpscnt,
4795                                 char *data, int tdscnt,
4796                                 int mdrcnt, int mprcnt,
4797                                 char **rdata, char **rparam,
4798                                 int *rdata_len, int *rparam_len)
4799 {
4800         *rparam_len = 4;
4801         *rparam = smb_realloc_limit(*rparam,*rparam_len);
4802         if (!*rparam) {
4803                 return False;
4804         }
4805
4806         *rdata_len = 0;
4807
4808         SSVAL(*rparam,0,NERR_notsupported);
4809         SSVAL(*rparam,2,0);             /* converter word */
4810
4811         DEBUG(3,("Unsupported API command\n"));
4812
4813         return True;
4814 }
4815
4816 static const struct {
4817         const char *name;
4818         int id;
4819         bool (*fn)(connection_struct *, uint16,
4820                         char *, int,
4821                         char *, int,
4822                         int,int,char **,char **,int *,int *);
4823         bool auth_user;         /* Deny anonymous access? */
4824 } api_commands[] = {
4825         {"RNetShareEnum",       RAP_WshareEnum,         api_RNetShareEnum, True},
4826         {"RNetShareGetInfo",    RAP_WshareGetInfo,      api_RNetShareGetInfo},
4827         {"RNetShareAdd",        RAP_WshareAdd,          api_RNetShareAdd},
4828         {"RNetSessionEnum",     RAP_WsessionEnum,       api_RNetSessionEnum, True},
4829         {"RNetServerGetInfo",   RAP_WserverGetInfo,     api_RNetServerGetInfo},
4830         {"RNetGroupEnum",       RAP_WGroupEnum,         api_RNetGroupEnum, True},
4831         {"RNetGroupGetUsers", RAP_WGroupGetUsers,       api_RNetGroupGetUsers, True},
4832         {"RNetUserEnum",        RAP_WUserEnum,          api_RNetUserEnum, True},
4833         {"RNetUserGetInfo",     RAP_WUserGetInfo,       api_RNetUserGetInfo},
4834         {"NetUserGetGroups",    RAP_WUserGetGroups,     api_NetUserGetGroups},
4835         {"NetWkstaGetInfo",     RAP_WWkstaGetInfo,      api_NetWkstaGetInfo},
4836         {"DosPrintQEnum",       RAP_WPrintQEnum,        api_DosPrintQEnum, True},
4837         {"DosPrintQGetInfo",    RAP_WPrintQGetInfo,     api_DosPrintQGetInfo},
4838         {"WPrintQueuePause",  RAP_WPrintQPause, api_WPrintQueueCtrl},
4839         {"WPrintQueueResume", RAP_WPrintQContinue,      api_WPrintQueueCtrl},
4840         {"WPrintJobEnumerate",RAP_WPrintJobEnum,        api_WPrintJobEnumerate},
4841         {"WPrintJobGetInfo",    RAP_WPrintJobGetInfo,   api_WPrintJobGetInfo},
4842         {"RDosPrintJobDel",     RAP_WPrintJobDel,       api_RDosPrintJobDel},
4843         {"RDosPrintJobPause",   RAP_WPrintJobPause,     api_RDosPrintJobDel},
4844         {"RDosPrintJobResume",RAP_WPrintJobContinue,    api_RDosPrintJobDel},
4845         {"WPrintDestEnum",      RAP_WPrintDestEnum,     api_WPrintDestEnum},
4846         {"WPrintDestGetInfo",   RAP_WPrintDestGetInfo,  api_WPrintDestGetInfo},
4847         {"NetRemoteTOD",        RAP_NetRemoteTOD,       api_NetRemoteTOD},
4848         {"WPrintQueuePurge",    RAP_WPrintQPurge,       api_WPrintQueueCtrl},
4849         {"NetServerEnum2",      RAP_NetServerEnum2,     api_RNetServerEnum2}, /* anon OK */
4850         {"NetServerEnum3",      RAP_NetServerEnum3,     api_RNetServerEnum3}, /* anon OK */
4851         {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
4852         {"SetUserPassword",     RAP_WUserPasswordSet2,  api_SetUserPassword},
4853         {"WWkstaUserLogon",     RAP_WWkstaUserLogon,    api_WWkstaUserLogon},
4854         {"PrintJobInfo",        RAP_WPrintJobSetInfo,   api_PrintJobInfo},
4855         {"WPrintDriverEnum",    RAP_WPrintDriverEnum,   api_WPrintDriverEnum},
4856         {"WPrintQProcEnum",     RAP_WPrintQProcessorEnum,api_WPrintQProcEnum},
4857         {"WPrintPortEnum",      RAP_WPrintPortEnum,     api_WPrintPortEnum},
4858         {"SamOEMChangePassword",RAP_SamOEMChgPasswordUser2_P,api_SamOEMChangePassword}, /* anon OK */
4859         {NULL,          -1,     api_Unsupported}
4860         /*  The following RAP calls are not implemented by Samba:
4861
4862         RAP_WFileEnum2 - anon not OK
4863         */
4864 };
4865
4866
4867 /****************************************************************************
4868  Handle remote api calls.
4869 ****************************************************************************/
4870
4871 void api_reply(connection_struct *conn, uint16 vuid,
4872                struct smb_request *req,
4873                char *data, char *params,
4874                int tdscnt, int tpscnt,
4875                int mdrcnt, int mprcnt)
4876 {
4877         struct smbd_server_connection *sconn = smbd_server_conn;
4878         int api_command;
4879         char *rdata = NULL;
4880         char *rparam = NULL;
4881         const char *name1 = NULL;
4882         const char *name2 = NULL;
4883         int rdata_len = 0;
4884         int rparam_len = 0;
4885         bool reply=False;
4886         int i;
4887
4888         if (!params) {
4889                 DEBUG(0,("ERROR: NULL params in api_reply()\n"));
4890                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4891                 return;
4892         }
4893
4894         if (tpscnt < 2) {
4895                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4896                 return;
4897         }
4898         api_command = SVAL(params,0);
4899         /* Is there a string at position params+2 ? */
4900         if (skip_string(params,tpscnt,params+2)) {
4901                 name1 = params + 2;
4902         } else {
4903                 name1 = "";
4904         }
4905         name2 = skip_string(params,tpscnt,params+2);
4906         if (!name2) {
4907                 name2 = "";
4908         }
4909
4910         DEBUG(3,("Got API command %d of form <%s> <%s> (tdscnt=%d,tpscnt=%d,mdrcnt=%d,mprcnt=%d)\n",
4911                 api_command,
4912                 name1,
4913                 name2,
4914                 tdscnt,tpscnt,mdrcnt,mprcnt));
4915
4916         for (i=0;api_commands[i].name;i++) {
4917                 if (api_commands[i].id == api_command && api_commands[i].fn) {
4918                         DEBUG(3,("Doing %s\n",api_commands[i].name));
4919                         break;
4920                 }
4921         }
4922
4923         /* Check whether this api call can be done anonymously */
4924
4925         if (api_commands[i].auth_user && lp_restrict_anonymous()) {
4926                 user_struct *user = get_valid_user_struct(sconn, vuid);
4927
4928                 if (!user || user->server_info->guest) {
4929                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4930                         return;
4931                 }
4932         }
4933
4934         rdata = (char *)SMB_MALLOC(1024);
4935         if (rdata) {
4936                 memset(rdata,'\0',1024);
4937         }
4938
4939         rparam = (char *)SMB_MALLOC(1024);
4940         if (rparam) {
4941                 memset(rparam,'\0',1024);
4942         }
4943
4944         if(!rdata || !rparam) {
4945                 DEBUG(0,("api_reply: malloc fail !\n"));
4946                 SAFE_FREE(rdata);
4947                 SAFE_FREE(rparam);
4948                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4949                 return;
4950         }
4951
4952         reply = api_commands[i].fn(conn,
4953                                 vuid,
4954                                 params,tpscnt,  /* params + length */
4955                                 data,tdscnt,    /* data + length */
4956                                 mdrcnt,mprcnt,
4957                                 &rdata,&rparam,&rdata_len,&rparam_len);
4958
4959
4960         if (rdata_len > mdrcnt || rparam_len > mprcnt) {
4961                 reply = api_TooSmall(conn,vuid,params,data,mdrcnt,mprcnt,
4962                                         &rdata,&rparam,&rdata_len,&rparam_len);
4963         }
4964
4965         /* if we get False back then it's actually unsupported */
4966         if (!reply) {
4967                 reply = api_Unsupported(conn,vuid,params,tpscnt,data,tdscnt,mdrcnt,mprcnt,
4968                         &rdata,&rparam,&rdata_len,&rparam_len);
4969         }
4970
4971         /* If api_Unsupported returns false we can't return anything. */
4972         if (reply) {
4973                 send_trans_reply(conn, req, rparam, rparam_len,
4974                                  rdata, rdata_len, False);
4975         }
4976
4977         SAFE_FREE(rdata);
4978         SAFE_FREE(rparam);
4979         return;
4980 }