converted a couple of bzero() to memset()

rewrote the printer notify code, so now it's compatible with SP5 and fully
dynamic. No more limits on printers and job lists.

removed the make_xxx() functions as they are not used and broken

fixed a bug in the open handle function.

	J.F.
(This used to be commit aa9054d14bc940f251639ab897d9f356814f5fc0)

5 files changed, 504 insertions, 462 deletions

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 837eb27eda..934ec5a4c8 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -2301,11 +2301,6 @@ BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth
 BOOL make_systemtime(SYSTEMTIME *systime, struct tm *unixtime);
 BOOL smb_io_notify_info_data_strings(char *desc,SPOOL_NOTIFY_INFO_DATA *data,
                                      prs_struct *ps, int depth);
-BOOL make_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u, 
-		const char *printername,
-		uint32 cbbuf, uint32 devmod, uint32 des_access,
-		const char *station,
-		const char *username);
 BOOL spoolss_io_q_open_printer_ex(char *desc, SPOOL_Q_OPEN_PRINTER_EX *q_u, prs_struct *ps, int depth);
 BOOL spoolss_io_r_open_printer_ex(char *desc, SPOOL_R_OPEN_PRINTER_EX *r_u, prs_struct *ps, int depth);
 BOOL make_spoolss_q_getprinterdata(SPOOL_Q_GETPRINTERDATA *q_u,
@@ -2327,15 +2322,10 @@ BOOL spoolss_io_q_endpageprinter(char *desc, SPOOL_Q_ENDPAGEPRINTER *q_u, prs_st
 BOOL spoolss_io_r_endpageprinter(char *desc, SPOOL_R_ENDPAGEPRINTER *r_u, prs_struct *ps, int depth);
 BOOL spoolss_io_q_writeprinter(char *desc, SPOOL_Q_WRITEPRINTER *q_u, prs_struct *ps, int depth);
 BOOL spoolss_io_r_writeprinter(char *desc, SPOOL_R_WRITEPRINTER *r_u, prs_struct *ps, int depth);
-BOOL spoolss_io_q_rffpcnex(char *desc, SPOOL_Q_RFFPCNEX *q_u,
-                           prs_struct *ps, int depth);
-BOOL spoolss_io_r_rffpcnex(char *desc, SPOOL_R_RFFPCNEX *r_u, 
-                           prs_struct *ps, int depth);
-BOOL spoolss_io_q_rfnpcnex(char *desc, SPOOL_Q_RFNPCNEX *q_u,
-                           prs_struct *ps, int depth);
-BOOL spoolss_io_r_rfnpcnex(char *desc, 
-                           SPOOL_R_RFNPCNEX *r_u, 
-                           prs_struct *ps, int depth);
+BOOL spoolss_io_q_rffpcnex(char *desc, SPOOL_Q_RFFPCNEX *q_u, prs_struct *ps, int depth);
+BOOL spoolss_io_r_rffpcnex(char *desc, SPOOL_R_RFFPCNEX *r_u, prs_struct *ps, int depth);
+BOOL spoolss_io_q_rfnpcnex(char *desc, SPOOL_Q_RFNPCNEX *q_u, prs_struct *ps, int depth);
+BOOL spoolss_io_r_rfnpcnex(char *desc, SPOOL_R_RFNPCNEX *r_u, prs_struct *ps, int depth);
 BOOL new_smb_io_printer_info_0(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_0 *info, int depth);
 BOOL new_smb_io_printer_info_1(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_1 *info, int depth);
 BOOL new_smb_io_printer_info_2(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_2 *info, int depth);
@@ -2372,18 +2362,9 @@ uint32 spoolss_size_printmonitor_info_1(PRINTMONITOR_1 *info);
 uint32 spoolss_size_printmonitor_info_2(PRINTMONITOR_2 *info);
 BOOL spoolss_io_q_getprinterdriver2(char *desc, SPOOL_Q_GETPRINTERDRIVER2 *q_u, prs_struct *ps, int depth);
 BOOL spoolss_io_r_getprinterdriver2(char *desc, SPOOL_R_GETPRINTERDRIVER2 *r_u, prs_struct *ps, int depth);
-BOOL make_spoolss_q_enumprinters(SPOOL_Q_ENUMPRINTERS *q_u,
-				uint32 flags,
-				const char* servername,
-				uint32 level,
-				uint32 size);
 BOOL spoolss_io_q_enumprinters(char *desc, SPOOL_Q_ENUMPRINTERS *q_u, prs_struct *ps, int depth);
 BOOL new_spoolss_io_r_enumprinters(char *desc, SPOOL_R_ENUMPRINTERS *r_u, prs_struct *ps, int depth);
 BOOL spoolss_io_r_getprinter(char *desc, SPOOL_R_GETPRINTER *r_u, prs_struct *ps, int depth);
-BOOL make_spoolss_q_getprinter(SPOOL_Q_GETPRINTER *q_u,
-				POLICY_HND *hnd,
-				uint32 level,
-				uint32 buf_size);
 BOOL spoolss_io_q_getprinter(char *desc, SPOOL_Q_GETPRINTER *q_u, prs_struct *ps, int depth);
 BOOL spoolss_io_r_setprinter(char *desc, SPOOL_R_SETPRINTER *r_u, prs_struct *ps, int depth);
 BOOL spoolss_io_q_setprinter(char *desc, SPOOL_Q_SETPRINTER *q_u, prs_struct *ps, int depth);
@@ -2621,16 +2602,11 @@ uint32 _spoolss_getprinterdata(const POLICY_HND *handle, UNISTR2 *valuename,
 				uint32 *out_size,
 				uint8 **data,
 				uint32 *needed);
-uint32 _spoolss_rffpcnex(const POLICY_HND *handle,
-				uint32 flags, uint32 options,
-				const UNISTR2 *localmachine,
-				uint32	printerlocal,
-				SPOOL_NOTIFY_OPTION *option);
-uint32 _spoolss_rfnpcnex( const POLICY_HND *handle,
-				uint32 change,
-				const SPOOL_NOTIFY_OPTION *option,
-				uint32 *count,
-				SPOOL_NOTIFY_INFO *info);
+uint32 _spoolss_rffpcnex(const POLICY_HND *handle, uint32 flags, uint32 options,
+			 const UNISTR2 *localmachine, uint32 printerlocal,
+			 SPOOL_NOTIFY_OPTION *option);
+uint32 _spoolss_rfnpcnex( const POLICY_HND *handle, uint32 change,
+			  SPOOL_NOTIFY_OPTION *option, SPOOL_NOTIFY_INFO *info);
 uint32 _spoolss_enumprinters( uint32 flags, const UNISTR2 *servername, uint32 level,
 			      NEW_BUFFER *buffer, uint32 offered,
 			      uint32 *needed, uint32 *returned);
@@ -2655,8 +2631,8 @@ uint32 _spoolss_setprinter( const POLICY_HND *handle,
 				uint32 sec_buf_size,
 				const char *sec_buf,
 				uint32 command);
-uint32 _spoolss_fcpn( const POLICY_HND *handle);
-uint32 _spoolss_addjob( const POLICY_HND *handle, uint32 level,
+uint32 _spoolss_fcpn(const POLICY_HND *handle);
+uint32 _spoolss_addjob(const POLICY_HND *handle, uint32 level,
 			NEW_BUFFER *buffer, uint32 offered);
 uint32 _spoolss_enumjobs( POLICY_HND *handle, uint32 firstjob, uint32 numofjobs, uint32 level,			  
 			  NEW_BUFFER *buffer, uint32 offered,
diff --git a/source3/include/rpc_spoolss.h b/source3/include/rpc_spoolss.h
index 1556c56686..19b6c2845c 100755
--- a/source3/include/rpc_spoolss.h
+++ b/source3/include/rpc_spoolss.h
@@ -185,6 +185,9 @@
 #define JOB_NOTIFY_TYPE     0x01
 
 #define MAX_PRINTER_NOTIFY 26
+#define MAX_JOB_NOTIFY 24
+
+#define MAX_NOTIFY_TYPE_FOR_NOW 26
 
 #define PRINTER_NOTIFY_SERVER_NAME		0x00
 #define PRINTER_NOTIFY_PRINTER_NAME		0x01
@@ -213,8 +216,6 @@
 #define PRINTER_NOTIFY_TOTAL_BYTES		0x18
 #define PRINTER_NOTIFY_BYTES_PRINTED		0x19
 
-#define MAX_JOB_NOTIFY 24
-
 #define JOB_NOTIFY_PRINTER_NAME			0x00
 #define JOB_NOTIFY_MACHINE_NAME			0x01
 #define JOB_NOTIFY_PORT_NAME			0x02
@@ -240,6 +241,57 @@
 #define JOB_NOTIFY_TOTAL_BYTES			0x16
 #define JOB_NOTIFY_BYTES_PRINTED		0x17
 
+#define PRINTER_CHANGE_ADD_PRINTER			0x00000001
+#define PRINTER_CHANGE_SET_PRINTER			0x00000002
+#define PRINTER_CHANGE_DELETE_PRINTER			0x00000004
+#define PRINTER_CHANGE_FAILED_CONNECTION_PRINTER	0x00000008
+#define PRINTER_CHANGE_PRINTER	(PRINTER_CHANGE_ADD_PRINTER | \
+				 PRINTER_CHANGE_SET_PRINTER | \
+				 PRINTER_CHANGE_DELETE_PRINTER | \
+				 PRINTER_CHANGE_FAILED_CONNECTION_PRINTER )
+
+#define PRINTER_CHANGE_ADD_JOB				0x00000100
+#define PRINTER_CHANGE_SET_JOB				0x00000200
+#define PRINTER_CHANGE_DELETE_JOB			0x00000400
+#define PRINTER_CHANGE_WRITE_JOB			0x00000800
+#define PRINTER_CHANGE_JOB	(PRINTER_CHANGE_ADD_JOB | \
+				 PRINTER_CHANGE_SET_JOB | \
+				 PRINTER_CHANGE_DELETE_JOB | \
+				 PRINTER_CHANGE_WRITE_JOB )
+
+#define PRINTER_CHANGE_ADD_FORM				0x00010000
+#define PRINTER_CHANGE_SET_FORM				0x00020000
+#define PRINTER_CHANGE_DELETE_FORM			0x00040000
+#define PRINTER_CHANGE_FORM	(PRINTER_CHANGE_ADD_FORM | \
+				 PRINTER_CHANGE_SET_FORM | \
+				 PRINTER_CHANGE_DELETE_FORM )
+
+#define PRINTER_CHANGE_ADD_PORT				0x00100000
+#define PRINTER_CHANGE_CONFIGURE_PORT			0x00200000
+#define PRINTER_CHANGE_DELETE_PORT			0x00400000
+#define PRINTER_CHANGE_PORT	(PRINTER_CHANGE_ADD_PORT | \
+				 PRINTER_CHANGE_CONFIGURE_PORT | \
+				 PRINTER_CHANGE_DELETE_PORT )
+
+#define PRINTER_CHANGE_ADD_PRINT_PROCESSOR		0x01000000
+#define PRINTER_CHANGE_DELETE_PRINT_PROCESSOR		0x04000000
+#define PRINTER_CHANGE_PRINT_PROCESSOR	(PRINTER_CHANGE_ADD_PRINT_PROCESSOR | \
+					 PRINTER_CHANGE_DELETE_PRINT_PROCESSOR )
+
+#define PRINTER_CHANGE_ADD_PRINTER_DRIVER		0x10000000
+#define PRINTER_CHANGE_SET_PRINTER_DRIVER		0x20000000
+#define PRINTER_CHANGE_DELETE_PRINTER_DRIVER		0x40000000
+#define PRINTER_CHANGE_PRINTER_DRIVER	(PRINTER_CHANGE_ADD_PRINTER_DRIVER | \
+					 PRINTER_CHANGE_SET_PRINTER_DRIVER | \
+					 PRINTER_CHANGE_DELETE_PRINTER_DRIVER )
+
+#define PRINTER_CHANGE_TIMEOUT				0x80000000
+#define PRINTER_CHANGE_ALL	(PRINTER_CHANGE_JOB | \
+				 PRINTER_CHANGE_FORM | \
+				 PRINTER_CHANGE_PORT | \
+				 PRINTER_CHANGE_PRINT_PROCESSOR | \
+				 PRINTER_CHANGE_PRINTER_DRIVER )
+
 /*
  * The printer attributes.
  * I #defined all of them (grabbed form MSDN)
@@ -396,9 +448,18 @@ typedef struct spool_notify_option_type
 	uint32 reserved1;
 	uint32 reserved2;
 	uint32 count;
-	uint16 fields[16];
+	uint32 fields_ptr;
+	uint32 count2;
+	uint16 fields[MAX_NOTIFY_TYPE_FOR_NOW];
 } SPOOL_NOTIFY_OPTION_TYPE;
 
+typedef struct spool_notify_option_type_ctr
+{
+	uint32 count;
+	SPOOL_NOTIFY_OPTION_TYPE *type;
+} SPOOL_NOTIFY_OPTION_TYPE_CTR;
+
+
 
 typedef struct s_header_type
 {
@@ -410,15 +471,6 @@ typedef struct s_header_type
 	} data;
 } HEADER_TYPE;
 
-/*typedef struct s_buffer
-{
-	uint32 ptr;
-	uint32 size;
-	uint32 count;
-	uint8 *data;
-	HEADER_TYPE *header;
-} BUFFER;
-*/
 typedef struct new_buffer
 {
 	uint32 ptr;
@@ -536,9 +588,10 @@ typedef struct spool_r_writeprinter
 typedef struct spool_notify_option
 {
 	uint32 version;
-	uint32 reserved;
+	uint32 flags;
 	uint32 count;
-	SPOOL_NOTIFY_OPTION_TYPE type[16]; /* totally arbitrary !!! */
+	uint32 option_type_ptr;
+	SPOOL_NOTIFY_OPTION_TYPE_CTR ctr;
 } SPOOL_NOTIFY_OPTION;
 
 typedef struct spool_notify_info_data
@@ -565,10 +618,7 @@ typedef struct spool_notify_info
 	uint32 version;
 	uint32 flags;
 	uint32 count;
-	SPOOL_NOTIFY_INFO_DATA data[26*16];
-	/* 26 differents data types */
-	/* so size it for 16 printers at max */
-	/* jfmxxxx: Have to make it dynamic !!!*/
+	SPOOL_NOTIFY_INFO_DATA *data;
 } SPOOL_NOTIFY_INFO;
 
 /* If the struct name looks obscure, yes it is ! */
@@ -578,9 +628,11 @@ typedef struct spoolss_q_rffpcnex
 	POLICY_HND handle;
 	uint32 flags;
 	uint32 options;
+	uint32 localmachine_ptr;
 	UNISTR2 localmachine;
 	uint32	printerlocal;
-        SPOOL_NOTIFY_OPTION option;
+	uint32 option_ptr;
+        SPOOL_NOTIFY_OPTION *option;
 } SPOOL_Q_RFFPCNEX;
 
 typedef struct spool_r_rffpcnex
@@ -593,15 +645,15 @@ typedef struct spool_q_rfnpcnex
 {
 	POLICY_HND handle;
 	uint32 change;
-	SPOOL_NOTIFY_OPTION option;
+	uint32 option_ptr;
+	SPOOL_NOTIFY_OPTION *option;
 } SPOOL_Q_RFNPCNEX;
 
 typedef struct spool_r_rfnpcnex
 {
-	uint32 count;
+	uint32 info_ptr;
 	SPOOL_NOTIFY_INFO info;
 	uint32 status;
-
 } SPOOL_R_RFNPCNEX;
 
 /* Find Close Printer Notify */
diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c
index 796466337f..0979799a98 100644
--- a/source3/rpc_parse/parse_spoolss.c
+++ b/source3/rpc_parse/parse_spoolss.c
@@ -179,24 +179,26 @@ static BOOL smb_io_doc_info_container(char *desc, DOC_INFO_CONTAINER *cont, prs_
 /*******************************************************************
 reads or writes an NOTIFY OPTION TYPE structure.
 ********************************************************************/  
-static BOOL smb_io_notify_option_type(char *desc,
-                               SPOOL_NOTIFY_OPTION_TYPE *type,
-                               prs_struct *ps, int depth)
+static BOOL smb_io_notify_option_type(char *desc, SPOOL_NOTIFY_OPTION_TYPE *type, prs_struct *ps, int depth)
 {
-	uint32 useless_ptr;
-
 	prs_debug(ps, depth, desc, "smb_io_notify_option_type");
 	depth++;
  
-	prs_align(ps);
-
-	prs_uint16("type", ps, depth, &(type->type));
-	prs_uint16("reserved0", ps, depth, &(type->reserved0));
-	prs_uint32("reserved1", ps, depth, &(type->reserved1));
-	prs_uint32("reserved2", ps, depth, &(type->reserved2));
-	prs_uint32("count", ps, depth, &(type->count));
-	prs_uint32("useless ptr", ps, depth, &useless_ptr);
+	if (!prs_align(ps))
+		return False;
 
+	if(!prs_uint16("type", ps, depth, &type->type))
+		return False;
+	if(!prs_uint16("reserved0", ps, depth, &type->reserved0))
+		return False;
+	if(!prs_uint32("reserved1", ps, depth, &type->reserved1))
+		return False;
+	if(!prs_uint32("reserved2", ps, depth, &type->reserved2))
+		return False;
+	if(!prs_uint32("count", ps, depth, &type->count))
+		return False;
+	if(!prs_uint32("fields_ptr", ps, depth, &type->fields_ptr))
+		return False;
 
 	return True;
 }
@@ -204,79 +206,97 @@ static BOOL smb_io_notify_option_type(char *desc,
 /*******************************************************************
 reads or writes an NOTIFY OPTION TYPE DATA.
 ********************************************************************/  
-static BOOL smb_io_notify_option_type_data(char *desc,
-                                    SPOOL_NOTIFY_OPTION_TYPE *type,
-                                    prs_struct *ps, int depth)
+static BOOL smb_io_notify_option_type_data(char *desc, SPOOL_NOTIFY_OPTION_TYPE *type, prs_struct *ps, int depth)
 {
-	uint32 count;
 	int i;
 
 	prs_debug(ps, depth, desc, "smb_io_notify_option_type_data");
 	depth++;
  
-	prs_align(ps);
+ 	/* if there are no fields just return */
+	if (type->fields_ptr==0)
+		return True;
+
+	if(!prs_align(ps))
+		return False;
 
-	prs_uint32("count", ps, depth, &count);
+	if(!prs_uint32("count2", ps, depth, &type->count2))
+		return False;
 	
-	if (count != type->count)
-	{
-		DEBUG(4,("What a mess, count was %x now is %x !\n",type->count,count));
-		type->count=count;
-	}
-	for(i=0;i<count;i++)
-	{
-		/* read the option type struct */
-		prs_uint16("fields",ps,depth,&(type->fields[i]));
-	}
+	if (type->count2 != type->count)
+		DEBUG(4,("What a mess, count was %x now is %x !\n", type->count, type->count2));
 
+	/* parse the option type data */
+	for(i=0;i<type->count2;i++)
+		if(!prs_uint16("fields",ps,depth,&(type->fields[i])))
+			return False;
 	return True;
 }
 
 /*******************************************************************
 reads or writes an NOTIFY OPTION structure.
 ********************************************************************/  
-static BOOL smb_io_notify_option(char *desc, SPOOL_NOTIFY_OPTION *option,
-                          prs_struct *ps, int depth)
-{
-	uint32 useless_ptr;
+static BOOL smb_io_notify_option_type_ctr(char *desc, SPOOL_NOTIFY_OPTION_TYPE_CTR *ctr , prs_struct *ps, int depth)
+{		
 	int i;
-
-	prs_debug(ps, depth, desc, "smb_io_notify_option");
+	
+	prs_debug(ps, depth, desc, "smb_io_notify_option_type_ctr");
 	depth++;
  
-	prs_align(ps);
+	if(!prs_uint32("count", ps, depth, &ctr->count))
+		return False;
 
-	/* memory pointer to the struct */
-	prs_uint32("useless ptr", ps, depth, &useless_ptr);
+	/* reading */
+	if (UNMARSHALLING(ps))
+		ctr->type=(SPOOL_NOTIFY_OPTION_TYPE *)malloc(ctr->count*sizeof(SPOOL_NOTIFY_OPTION_TYPE));
+		
+	/* the option type struct */
+	for(i=0;i<ctr->count;i++)
+		if(!smb_io_notify_option_type("", &(ctr->type[i]) , ps, depth))
+			return False;
+
+	/* the type associated with the option type struct */
+	for(i=0;i<ctr->count;i++)
+		if(!smb_io_notify_option_type_data("", &(ctr->type[i]) , ps, depth))
+			return False;
 	
-	prs_uint32("version",     ps, depth, &(option->version));
-	prs_uint32("reserved",    ps, depth, &(option->reserved));
-	prs_uint32("count",       ps, depth, &(option->count));
-	prs_uint32("useless ptr", ps, depth, &useless_ptr);
-	prs_uint32("count",       ps, depth, &(option->count));
-
-	/* read the option type struct */
-	for(i=0;i<option->count;i++)
-	{
-		smb_io_notify_option_type("",&(option->type[i]) ,ps, depth);
-	}
+	return True;
+}
 
-	/* now read the type associated with the option type struct */
-	for(i=0;i<option->count;i++)
-	{
-		smb_io_notify_option_type_data("",&(option->type[i]) ,ps, depth);
+/*******************************************************************
+reads or writes an NOTIFY OPTION structure.
+********************************************************************/  
+static BOOL smb_io_notify_option(char *desc, SPOOL_NOTIFY_OPTION *option, prs_struct *ps, int depth)
+{
+	prs_debug(ps, depth, desc, "smb_io_notify_option");
+	depth++;
+ 	
+	if(!prs_uint32("version", ps, depth, &option->version))
+		return False;
+	if(!prs_uint32("flags", ps, depth, &option->flags))
+		return False;
+	if(!prs_uint32("count", ps, depth, &option->count))
+		return False;
+	if(!prs_uint32("option_type_ptr", ps, depth, &option->option_type_ptr))
+		return False;
+	
+	/* marshalling or unmarshalling, that would work */	
+	if (option->option_type_ptr!=0) {
+		if(!smb_io_notify_option_type_ctr("", &option->ctr ,ps, depth))
+			return False;
+	}
+	else {
+		option->ctr.type=NULL;
+		option->ctr.count=0;
 	}
 	
-
 	return True;
 }
 
-
 /*******************************************************************
 reads or writes an NOTIFY INFO DATA structure.
 ********************************************************************/  
-static BOOL smb_io_notify_info_data(char *desc,SPOOL_NOTIFY_INFO_DATA *data,
-                             prs_struct *ps, int depth)
+static BOOL smb_io_notify_info_data(char *desc,SPOOL_NOTIFY_INFO_DATA *data, prs_struct *ps, int depth)
 {
 	uint32 useless_ptr=0xADDE0FF0;
 
@@ -354,19 +374,16 @@ BOOL smb_io_notify_info_data_strings(char *desc,SPOOL_NOTIFY_INFO_DATA *data,
 /*******************************************************************
 reads or writes an NOTIFY INFO structure.
 ********************************************************************/  
-static BOOL smb_io_notify_info(char *desc, SPOOL_NOTIFY_INFO *info,
-                        prs_struct *ps, int depth)
+static BOOL smb_io_notify_info(char *desc, SPOOL_NOTIFY_INFO *info, prs_struct *ps, int depth)
 {
-	uint32 useless_ptr=0x0001;
 	int i;
 
-	info->version=0x02;
 	prs_debug(ps, depth, desc, "smb_io_notify_info");
 	depth++;
  
-	prs_align(ps);
+	if(!prs_align(ps))
+		return False;
 
-	prs_uint32("pointer", ps, depth, &useless_ptr);
 	prs_uint32("count", ps, depth, &(info->count));
 	prs_uint32("version", ps, depth, &(info->version));
 	prs_uint32("flags", ps, depth, &(info->flags));
@@ -380,8 +397,7 @@ static BOOL smb_io_notify_info(char *desc, SPOOL_NOTIFY_INFO *info,
 	/* now do the strings at the end of the stream */	
 	for (i=0;i<info->count;i++)
 	{
-		smb_io_notify_info_data_strings(desc, &(info->data[i]),
-		                                ps, depth);
+		smb_io_notify_info_data_strings(desc, &(info->data[i]), ps, depth);
 	}
 
 	return True;
@@ -618,49 +634,6 @@ static BOOL spoolss_io_printer_default(char *desc, PRINTER_DEFAULT *pd, prs_stru
 }
 
 /*******************************************************************
- * make a structure.
- ********************************************************************/
-BOOL make_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u, 
-		const char *printername,
-		uint32 cbbuf, uint32 devmod, uint32 des_access,
-		const char *station,
-		const char *username)
-{
-	int len_name = printername != NULL ? strlen(printername) : 0;
-	int len_sta  = station     != NULL ? strlen(station    ) : 0;
-	int len_user = username    != NULL ? strlen(username   ) : 0;
-
-	if (q_u == NULL) return False;
-
-	DEBUG(5,("make_spoolss_io_q_open_printer_ex\n"));
-
-	q_u->printername_ptr = 1;
-	init_unistr2(&(q_u->printername), printername, len_name);
-
-/*
-	q_u->unknown0 = 0x0;
-	q_u->cbbuf = cbbuf;
-	q_u->devmod = devmod;
-	q_u->access_required = des_access;
-*/
-/*	q_u->unknown1 = 0x1;
-	q_u->unknown2 = 0x1;
-	q_u->unknown3 = 0x149f7d8;
-	q_u->unknown4 = 0x1c;
-	q_u->unknown5 = 0x00b94dd0;
-	q_u->unknown6 = 0x0149f5cc;
-	q_u->unknown7 = 0x00000565;
-	q_u->unknown8  = 0x2;
-	q_u->unknown9 = 0x0;
-	q_u->unknown10 = 0x0;
-
-	init_unistr2(&(q_u->station), station, len_sta);
-	init_unistr2(&(q_u->username), username, len_user);
-*/
-	return True;
-}
-
-/*******************************************************************
  * read a structure.
  * called from spoolss_q_open_printer_ex (srv_spoolss.c)
  ********************************************************************/
@@ -1026,29 +999,43 @@ BOOL spoolss_io_r_writeprinter(char *desc, SPOOL_R_WRITEPRINTER *r_u, prs_struct
  * read a structure.
  * called from spoolss_q_rffpcnex (srv_spoolss.c)
  ********************************************************************/
-BOOL spoolss_io_q_rffpcnex(char *desc, SPOOL_Q_RFFPCNEX *q_u,
-                           prs_struct *ps, int depth)
+BOOL spoolss_io_q_rffpcnex(char *desc, SPOOL_Q_RFFPCNEX *q_u, prs_struct *ps, int depth)
 {
-	uint32 useless_ptr;
-
 	prs_debug(ps, depth, desc, "spoolss_io_q_rffpcnex");
 	depth++;
-	prs_align(ps);
-
-	smb_io_prt_hnd("printer handle",&(q_u->handle),ps,depth);
-	prs_uint32("flags",       ps, depth, &(q_u->flags));
-	prs_uint32("options",     ps, depth, &(q_u->options));
-	prs_uint32("useless ptr", ps, depth, &useless_ptr);
-	/*prs_align(ps);*/
 
-	smb_io_unistr2("", &(q_u->localmachine), True, ps, depth);	
-
-	prs_align(ps);
-	prs_uint32("printerlocal", ps, depth, &(q_u->printerlocal));
+	if(!prs_align(ps))
+		return False;
 
-	smb_io_notify_option("notify option", &(q_u->option), ps, depth);
+	if(!smb_io_prt_hnd("printer handle", &q_u->handle, ps, depth))
+		return False;
+	if(!prs_uint32("flags", ps, depth, &q_u->flags))
+		return False;
+	if(!prs_uint32("options", ps, depth, &q_u->options))
+		return False;
+	if(!prs_uint32("localmachine_ptr", ps, depth, &q_u->localmachine_ptr))
+		return False;
+	if(!smb_io_unistr2("localmachine", &q_u->localmachine, q_u->localmachine_ptr, ps, depth))
+		return False;
 
+	if(!prs_align(ps))
+		return False;
+		
+	if(!prs_uint32("printerlocal", ps, depth, &q_u->printerlocal))
+		return False;
 
+	if(!prs_uint32("option_ptr", ps, depth, &q_u->option_ptr))
+		return False;
+	
+	if (q_u->option_ptr!=0) {
+	
+		if (UNMARSHALLING(ps))
+			q_u->option=(SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION));
+	
+		if(!smb_io_notify_option("notify option", q_u->option, ps, depth))
+			return False;
+	}
+	
 	return True;
 }
 
@@ -1056,13 +1043,13 @@ BOOL spoolss_io_q_rffpcnex(char *desc, SPOOL_Q_RFFPCNEX *q_u,
  * write a structure.
  * called from spoolss_r_rffpcnex (srv_spoolss.c)
  ********************************************************************/
-BOOL spoolss_io_r_rffpcnex(char *desc, SPOOL_R_RFFPCNEX *r_u, 
-                           prs_struct *ps, int depth)
+BOOL spoolss_io_r_rffpcnex(char *desc, SPOOL_R_RFFPCNEX *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_rffpcnex");
 	depth++;
 
-	prs_uint32("status", ps, depth, &(r_u->status));
+	if(!prs_uint32("status", ps, depth, &r_u->status))
+		return False;
 
 	return True;
 }
@@ -1071,20 +1058,31 @@ BOOL spoolss_io_r_rffpcnex(char *desc, SPOOL_R_RFFPCNEX *r_u,
  * read a structure.
  * called from spoolss_q_rfnpcnex (srv_spoolss.c)
  ********************************************************************/
-BOOL spoolss_io_q_rfnpcnex(char *desc, SPOOL_Q_RFNPCNEX *q_u,
-                           prs_struct *ps, int depth)
+BOOL spoolss_io_q_rfnpcnex(char *desc, SPOOL_Q_RFNPCNEX *q_u, prs_struct *ps, int depth)
 {
-
 	prs_debug(ps, depth, desc, "spoolss_io_q_rfnpcnex");
 	depth++;
 
-	prs_align(ps);
+	if(!prs_align(ps))
+		return False;
 
-	smb_io_prt_hnd("printer handle",&(q_u->handle),ps,depth);
+	if(!smb_io_prt_hnd("printer handle",&q_u->handle,ps,depth))
+		return False;
 
-	prs_uint32("change", ps, depth, &(q_u->change));
+	if(!prs_uint32("change", ps, depth, &q_u->change))
+		return False;
+	
+	if(!prs_uint32("option_ptr", ps, depth, &q_u->option_ptr))
+		return False;
+	
+	if (q_u->option_ptr!=0) {
+	
+		if (UNMARSHALLING(ps))
+			q_u->option=(SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION));
 	
-	smb_io_notify_option("notify option",&(q_u->option),ps,depth);
+		if(!smb_io_notify_option("notify option", q_u->option, ps, depth))
+			return False;
+	}
 
 	return True;
 }
@@ -1093,18 +1091,24 @@ BOOL spoolss_io_q_rfnpcnex(char *desc, SPOOL_Q_RFNPCNEX *q_u,
  * write a structure.
  * called from spoolss_r_rfnpcnex (srv_spoolss.c)
  ********************************************************************/
-BOOL spoolss_io_r_rfnpcnex(char *desc, 
-                           SPOOL_R_RFNPCNEX *r_u, 
-                           prs_struct *ps, int depth)
+BOOL spoolss_io_r_rfnpcnex(char *desc, SPOOL_R_RFNPCNEX *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_rfnpcnex");
 	depth++;
 
-	prs_align(ps);
+	if(!prs_align(ps))
+		return False;
+		
+	if (!prs_uint32("info_ptr", ps, depth, &r_u->info_ptr))
+		return False;
 
-	smb_io_notify_info("notify info",&(r_u->info),ps,depth);		
-	prs_align(ps);
-	prs_uint32("status", ps, depth, &r_u->status);
+	if(!smb_io_notify_info("notify info", &r_u->info ,ps,depth))
+		return False;
+	
+	if(!prs_align(ps))
+		return False;
+	if(!prs_uint32("status", ps, depth, &r_u->status))
+		return False;
 
 	return True;
 }
@@ -2499,44 +2503,6 @@ BOOL spoolss_io_r_getprinterdriver2(char *desc, SPOOL_R_GETPRINTERDRIVER2 *r_u,
 	return True;		
 }
 
-/*
-	UNISTR **dependentfiles;
-	int j=0;
-	dependentfiles=info3->dependentfiles;
-	while ( dependentfiles[j] != NULL )
-	{
-		free(dependentfiles[j]);
-		j++;
-	}
-	free(dependentfiles);
-
-	free(info3);
-*/
-
-/*******************************************************************
- * make a structure.
- ********************************************************************/
-BOOL make_spoolss_q_enumprinters(SPOOL_Q_ENUMPRINTERS *q_u,
-				uint32 flags,
-				const char* servername,
-				uint32 level,
-				uint32 size)
-{
-	size_t len_name = servername != NULL ? strlen(servername) : 0;
-
-	DEBUG(5,("make_spoolss_q_enumprinters.  size: %d\n", size));
-
-	q_u->flags = flags;
-
-	init_unistr2(&q_u->servername, servername, len_name);
-
-	q_u->level = level;
-	/*make_spoolss_buffer(&q_u->buffer, size);*/
-/*	q_u->buf_size = size;*/
-
-	return True;
-}
-
 /*******************************************************************
  * read a structure.
  * called from spoolss_enumprinters (srv_spoolss.c)
@@ -2631,26 +2597,6 @@ BOOL spoolss_io_r_getprinter(char *desc, SPOOL_R_GETPRINTER *r_u, prs_struct *ps
 }
 
 /*******************************************************************
- * make a structure.
- * called from spoolss_getprinter (srv_spoolss.c)
- ********************************************************************/
-BOOL make_spoolss_q_getprinter(SPOOL_Q_GETPRINTER *q_u,
-				POLICY_HND *hnd,
-				uint32 level,
-				uint32 buf_size)
-{
-	if (q_u == NULL) return False;
-
-	memcpy(&q_u->handle, hnd, sizeof(q_u->handle));
-	
-	q_u->level = level;
-	q_u->buffer = (uint8 *)Realloc(NULL, (buf_size) * sizeof(uint8) );
-	q_u->offered = buf_size;
-
-	return True;
-}
-
-/*******************************************************************
  * read a structure.
  * called from spoolss_getprinter (srv_spoolss.c)
  ********************************************************************/
diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c
index 4965542d73..be6775f35d 100755
--- a/source3/rpc_server/srv_spoolss.c
+++ b/source3/rpc_server/srv_spoolss.c
@@ -140,9 +140,9 @@ static BOOL api_spoolss_rffpcnex(uint16 vuid, prs_struct *data, prs_struct *rdat
 
 	r_u.status = _spoolss_rffpcnex(&q_u.handle, q_u.flags,
 	                               q_u.options, &q_u.localmachine,
-	                               q_u.printerlocal, &q_u.option);
+	                               q_u.printerlocal, q_u.option);
 
-	if (!spoolss_io_r_rffpcnex("",&r_u,rdata,0)) {
+	if (!spoolss_io_r_rffpcnex("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_rffpcnex: unable to marshall SPOOL_R_RFFPCNEX.\n"));
 		return False;
 	}
@@ -171,13 +171,18 @@ static BOOL api_spoolss_rfnpcnex(uint16 vuid, prs_struct *data, prs_struct *rdat
 	}
 
 	r_u.status = _spoolss_rfnpcnex(&q_u.handle, q_u.change,
-	                               &q_u.option, &r_u.count, &r_u.info);
+	                               q_u.option, &r_u.info);
+
+	/* we always have a NOTIFY_INFO struct */
+	r_u.info_ptr=0x1;
 
 	if (!spoolss_io_r_rfnpcnex("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_rfnpcnex: unable to marshall SPOOL_R_RFNPCNEX.\n"));
 		return False;
 	}
 
+	safe_free(r_u.info.data);
+
 	return True;
 }
 
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 90a7b44aef..cd0d0a8ab1 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -39,28 +39,31 @@ extern pstring global_myname;
 /* and a reference to what it's pointing to */
 /* and the notify info asked about */
 /* that's the central struct */
-static struct
-{
-  BOOL        open;
-  BOOL        ok;
-  BOOL        document_started;
-  BOOL        page_started;
-  uint32      current_jobid;
-  uint32      document_fd;
-  uint32      document_lastwritten;
-  pstring     document_name;
-  pstring     job_name;
-  POLICY_HND printer_hnd;
-  BOOL        printer_type;
-  union
-  {
-  	fstring printername;
-	fstring printerservername;
-  } dev;
-  uint32 type;
-  uint32 access;
-  uint32 number_of_notify;
-  SPOOL_NOTIFY_OPTION_TYPE notify_info[MAX_PRINTER_NOTIFY+MAX_JOB_NOTIFY];
+static struct {
+	BOOL open;
+	BOOL ok;
+	BOOL document_started;
+	BOOL page_started;
+	uint32 current_jobid;
+	uint32 document_fd;
+	uint32 document_lastwritten;
+	pstring document_name;
+	pstring job_name;
+	POLICY_HND printer_hnd;
+	BOOL printer_type;
+	union {
+	  	fstring printername;
+		fstring printerservername;
+	} dev;
+	uint32 type;
+	uint32 access;
+	struct {
+		uint32 flags;
+		uint32 options;
+		fstring localmachine; 
+		uint32 printerlocal;
+		SPOOL_NOTIFY_OPTION *option;
+	} notify;
 } Printer[MAX_OPEN_PRINTER_EXS];
 
 #define VALID_HANDLE(pnum)   (((pnum) >= 0) && ((pnum) < MAX_OPEN_PRINTER_EXS))
@@ -110,13 +113,13 @@ static int find_printer_index_by_hnd(const POLICY_HND *hnd)
 	{
 		if (memcmp(&(Printer[i].printer_hnd), hnd, sizeof(*hnd)) == 0)
 		{
-			DEBUG(4,("Found printer handle[%x] ", i));
-			dump_data(4, hnd->data, sizeof(hnd->data));
+			DEBUG(4,("Found printer handle[%x] \n", i));
+			/*dump_data(4, hnd->data, sizeof(hnd->data));*/
 			return i;
 		}
 	}
 	DEBUG(3,("Whoops, Printer handle not found: "));
-	dump_data(4, hnd->data, sizeof(hnd->data));
+	/*dump_data(4, hnd->data, sizeof(hnd->data));*/
 	return -1;
 }
 
@@ -125,7 +128,7 @@ static int find_printer_index_by_hnd(const POLICY_HND *hnd)
 ****************************************************************************/
 static void clear_handle(POLICY_HND *hnd)
 {
-	bzero(hnd->data, POLICY_HND_SIZE);
+	memset(hnd->data, 0, POLICY_HND_SIZE);
 }
 
 /****************************************************************************
@@ -142,6 +145,13 @@ static BOOL close_printer_handle(POLICY_HND *hnd)
 	}
 
 	Printer[pnum].open=False;
+	Printer[pnum].notify.flags=0;
+	Printer[pnum].notify.options=0;
+	Printer[pnum].notify.localmachine[0]='\0';
+	Printer[pnum].notify.printerlocal=0;
+	safe_free(Printer[pnum].notify.option);
+	Printer[pnum].notify.option=NULL;
+	
 	clear_handle(hnd);
 
 	return True;
@@ -204,6 +214,7 @@ static BOOL open_printer_hnd(POLICY_HND *hnd)
 			memcpy(&(Printer[i].printer_hnd), hnd, sizeof(*hnd));
 			DEBUG(4,("Opened printer handle[%x] ", i));
 			dump_data(4, hnd->data, sizeof(hnd->data));
+			Printer[i].notify.option=NULL;
 			return True;
 		}
 	}
@@ -334,6 +345,7 @@ static BOOL set_printer_hnd_printername(POLICY_HND *hnd, char *printername)
 		return False;
 	}
 	
+	snum--;
 	DEBUGADD(4,("Printer found: %s[%x]\n",lp_servicename(snum),snum));
 	ZERO_STRUCT(Printer[pnum].dev.printername);
 	strncpy(Printer[pnum].dev.printername, lp_servicename(snum), strlen(lp_servicename(snum)));
@@ -635,7 +647,7 @@ static BOOL getprinterdata_printer(const POLICY_HND *handle,
 		if (get_specific_param(printer, 2, value, &idata, type, &len)) 
 		{
 			*data  = (uint8 *)malloc( (len>in_size)?len:in_size *sizeof(uint8) );
-			bzero(*data, sizeof(uint8)*len);
+			memset(*data, 0, sizeof(uint8)*len);
 			memcpy(*data, idata, (len>in_size)?len:in_size);
 			*needed = len;
 			
@@ -713,42 +725,26 @@ uint32 _spoolss_getprinterdata(const POLICY_HND *handle, UNISTR2 *valuename,
  * in fact ReplyOpenPrinter is the changenotify equivalent on the spoolss pipe
  * called from api_spoolss_rffpcnex 
  ********************************************************************/
-uint32 _spoolss_rffpcnex(const POLICY_HND *handle,
-				uint32 flags, uint32 options,
-				const UNISTR2 *localmachine,
-				uint32	printerlocal,
-				SPOOL_NOTIFY_OPTION *option)
+uint32 _spoolss_rffpcnex(const POLICY_HND *handle, uint32 flags, uint32 options,
+			 const UNISTR2 *localmachine, uint32 printerlocal,
+			 SPOOL_NOTIFY_OPTION *option)
 {
-	int i,j,k;
+	int i;
 
 	/* store the notify value in the printer struct */
 
 	i=find_printer_index_by_hnd(handle);
 
 	if (i == -1)
-	{
 		return NT_STATUS_INVALID_HANDLE;
-	}
-
-	Printer[i].number_of_notify=option->count;
 
-	DEBUG(3,("Copying %x notify option info\n",Printer[i].number_of_notify));
+	Printer[i].notify.flags=flags;
+	Printer[i].notify.options=options;
+	Printer[i].notify.printerlocal=printerlocal;
+	Printer[i].notify.option=option;
+	unistr2_to_ascii(Printer[i].notify.localmachine, localmachine, sizeof(Printer[i].notify.localmachine)-1);
 
-	for (j=0;j<Printer[i].number_of_notify;j++)
-	{
-		Printer[i].notify_info[j].count=option->type[j].count;
-		Printer[i].notify_info[j].type=option->type[j].type	;
-		
-		DEBUG(4,("Copying %x info fields of type %x\n",
-		         Printer[i].notify_info[j].count,
-			 Printer[i].notify_info[j].type));
-		for(k=0;k<Printer[i].notify_info[j].count;k++)
-		{
-			Printer[i].notify_info[j].fields[k]=option->type[j].fields[k];
-		}
-	}
-
-	return 0x0;
+	return NT_STATUS_NO_PROBLEMO;
 }
 
 /*******************************************************************
@@ -961,7 +957,7 @@ static void spoolss_notify_status(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_
 	print_queue_struct *q=NULL;
 	print_status_struct status;
 
-	bzero(&status,sizeof(status));
+	memset(&status, 0, sizeof(status));
 
 	count=get_printqueue(snum, NULL, &q, &status);
 
@@ -977,7 +973,7 @@ static void spoolss_notify_cjobs(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_q
 	print_queue_struct *q=NULL;
 	print_status_struct status;
 
-	bzero(&status,sizeof(status));
+	memset(&status, 0, sizeof(status));
 
 	data->notify_data.value[0]=get_printqueue(snum, NULL, &q, &status);
 	if (q) free(q);
@@ -1163,40 +1159,30 @@ static int search_notify(uint16 type, uint16 field, int *value)
 	int j;
 	BOOL found;
 
-	DEBUG(4,("\tsearch_notify: in\n"));	
 	for (j=0, found=False; found==False && notify_info_data_table[j].type != END ; j++)
 	{
 		if ( (notify_info_data_table[j].type  == type  ) &&
 		     (notify_info_data_table[j].field == field ) )
-		{
 			found=True;
-		}
 	}
 	*value=--j;
 
 	if ( found && (notify_info_data_table[j].fn != NULL) )
-	{
-		DEBUG(4,("\tsearch_notify: out TRUE\n"));
-		return (True);
-	}
+		return True;
 	else
-	{
-		DEBUG(4,("\tsearch_notify: out FALSE\n"));
-		return (False);	
-	}
+		return False;	
 }
 
 /****************************************************************************
 ****************************************************************************/
 static void construct_info_data(SPOOL_NOTIFY_INFO_DATA *info_data, uint16 type, uint16 field, int id)
 {
-	DEBUG(4,("\tconstruct_info_data: in\n"));
 	info_data->type     = type;
 	info_data->field    = field;
+	info_data->reserved = 0;
 	info_data->id       = id;
 	info_data->size     = size_of_notify_info_data(type, field);
 	info_data->enc_type = type_of_notify_info_data(type, field);
-	DEBUG(4,("\tconstruct_info_data: out\n"));
 }
 
 
@@ -1205,49 +1191,48 @@ static void construct_info_data(SPOOL_NOTIFY_INFO_DATA *info_data, uint16 type,
  * fill a notify_info struct with info asked
  * 
  ********************************************************************/
-static void construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int pnum, 
-					  int snum, int i, uint32 id)
+static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int snum, SPOOL_NOTIFY_OPTION_TYPE *option_type, uint32 id)
 {
-
-	int k,j;
+	int field_num,j;
 	uint16 type;
 	uint16 field;
 
-	SPOOL_NOTIFY_INFO_DATA *info_data;
-	print_queue_struct *queue=NULL;
+	SPOOL_NOTIFY_INFO_DATA *current_data;
 	NT_PRINTER_INFO_LEVEL printer;
+	print_queue_struct *queue=NULL;
 	
 	DEBUG(4,("construct_notify_printer_info\n"));
 	
-	info_data=&(info->data[info->count]);
-	
-	type = Printer[pnum].notify_info[i].type;
+	type=option_type->type;
 
-	DEBUGADD(4,("Notify number %d -> number of notify info: %d\n",i,Printer[pnum].notify_info[i].count));
+	DEBUGADD(4,("Notify type: [%s], number of notify info: [%d] on printer: [%s]\n",
+		(option_type->type==PRINTER_NOTIFY_TYPE?"PRINTER_NOTIFY_TYPE":"JOB_NOTIFY_TYPE"), 
+		option_type->count, lp_servicename(snum)));
 	
-	if (!get_a_printer(&printer, 2, lp_servicename(snum)))
+	if (get_a_printer(&printer, 2, lp_servicename(snum))!=0)
+	{
+		return False;
+	}
+
+	for(field_num=0; field_num<option_type->count; field_num++)
 	{
+		field = option_type->fields[field_num];
+		DEBUGADD(4,("notify [%d]: type [%x], field [%x]\n", field_num, type, field));
+
+		if (!search_notify(type, field, &j) )
+			continue;
 		
-		for(k=0; k<Printer[pnum].notify_info[i].count; k++)
-		{
-			field = Printer[pnum].notify_info[i].fields[k];
-			DEBUGADD(4,("notify [%d]: type [%x], field [%x]\n", k, type, field));
+		info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA));
+		current_data=&(info->data[info->count]);
 
-			if (search_notify(type, field, &j) )
-			{
-				DEBUGADD(4,("j=[%d]:%s\n", j, notify_info_data_table[j].name));
-				construct_info_data(info_data, type, field, id);
-			
-				DEBUGADD(4,("notify_info_data_table: in\n"));
-				notify_info_data_table[j].fn(snum, info_data, queue, &printer);
-				DEBUGADD(4,("notify_info_data_table: out\n"));
-				info->count++;
-				info_data=&(info->data[info->count]);
-			}
-		}
-	
-		free_a_printer(printer, 2);
+		construct_info_data(current_data, type, field, id);		
+		notify_info_data_table[j].fn(snum, current_data, queue, &printer);
+
+		info->count++;
 	}
+
+	free_a_printer(printer, 2);
+	return True;
 }
 
 /*******************************************************************
@@ -1255,46 +1240,72 @@ static void construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int pnum,
  * fill a notify_info struct with info asked
  * 
  ********************************************************************/
-static void construct_notify_jobs_info(print_queue_struct *queue, SPOOL_NOTIFY_INFO *info,
-                                       int pnum, int snum, int i, uint32 id)
+static BOOL construct_notify_jobs_info(print_queue_struct *queue, SPOOL_NOTIFY_INFO *info, int snum, SPOOL_NOTIFY_OPTION_TYPE *option_type, uint32 id)
 {
-
-	int k,j;
+	int field_num,j;
 	uint16 type;
 	uint16 field;
 
-	SPOOL_NOTIFY_INFO_DATA *info_data;
+	SPOOL_NOTIFY_INFO_DATA *current_data;
 	NT_PRINTER_INFO_LEVEL printer;
 	
 	DEBUG(4,("construct_notify_jobs_info\n"));
-	info_data=&(info->data[info->count]);
 	
-	type = Printer[pnum].notify_info[i].type;
+	type = option_type->type;
 
-	DEBUGADD(4,("Notify number %d -> number of notify info: %d\n",i,Printer[pnum].notify_info[i].count));
+	DEBUGADD(4,("Notify type: [%s], number of notify info: [%d]\n",
+		(option_type->type==PRINTER_NOTIFY_TYPE?"PRINTER_NOTIFY_TYPE":"JOB_NOTIFY_TYPE"), 
+		option_type->count));
 
-	if (!get_a_printer(&printer, 2, lp_servicename(snum)))
+	if (get_a_printer(&printer, 2, lp_servicename(snum))!=0)
 	{	
-		for(k=0; k<Printer[pnum].notify_info[i].count; k++)
-		{
-			field = Printer[pnum].notify_info[i].fields[k];
-			DEBUGADD(4,("notify [%d]: type [%x], field [%x]\n",k, type, field));
+		return False;
+	}
+	
+	for(field_num=0; field_num<option_type->count; field_num++)
+	{
+		field = option_type->fields[field_num];
 
-			if (search_notify(type, field, &j) )
-			{
-				DEBUGADD(4,("j=[%d]:%s\n", j, notify_info_data_table[j].name));
-				construct_info_data(info_data, type, field, id);
-				DEBUGADD(4,("notify_info_data_table: in\n"));
-				notify_info_data_table[j].fn(snum, info_data, queue, &printer);
-				DEBUGADD(4,("notify_info_data_table: out\n"));
-				info->count++;
-				info_data=&(info->data[info->count]);
-			}
-		}
-		free_a_printer(printer, 2);
+		if (!search_notify(type, field, &j) )
+			continue;
+
+		info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA));
+		current_data=&(info->data[info->count]);
+
+		construct_info_data(current_data, type, field, id);
+		notify_info_data_table[j].fn(snum, current_data, queue, &printer);
+		info->count++;
 	}
+	
+	free_a_printer(printer, 2);
+	
+	return True;
 }
 
+/*
+ * JFM: The enumeration is not that simple, it's even non obvious.
+ *
+ * let's take an example: I want to monitor the PRINTER SERVER for
+ * the printer's name and the number of jobs currently queued.
+ * So in the NOTIFY_OPTION, I have one NOTIFY_OPTION_TYPE structure.
+ * Its type is PRINTER_NOTIFY_TYPE and it has 2 fields NAME and CJOBS.
+ * 
+ * I have 3 printers on the back of my server.
+ *
+ * Now the response is a NOTIFY_INFO structure, with 6 NOTIFY_INFO_DATA
+ * structures.
+ *   Number	Data			Id
+ *	1	printer 1 name		1
+ *	2	printer 1 cjob		1
+ *	3	printer 2 name		2
+ *	4	printer 2 cjob		2
+ *	5	printer 3 name		3
+ *	6	printer 3 name		3
+ *
+ * that's the print server case, the printer case is even worse.
+ */
+
+
 
 /*******************************************************************
  *
@@ -1302,40 +1313,54 @@ static void construct_notify_jobs_info(print_queue_struct *queue, SPOOL_NOTIFY_I
  * fill a notify_info struct with info asked
  * 
  ********************************************************************/
-static uint32 printserver_notify_info(const POLICY_HND *hnd,
-				SPOOL_NOTIFY_INFO *info)
+static uint32 printserver_notify_info(const POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info)
 {
 	int snum;
 	int pnum=find_printer_index_by_hnd(hnd);
 	int n_services=lp_numservices();
-	int i=0;
-	uint32 id=1;
+	int i;
+	uint32 id;
+	SPOOL_NOTIFY_OPTION *option;
+	SPOOL_NOTIFY_OPTION_TYPE *option_type;
+
+	DEBUG(4,("printserver_notify_info\n"));
+	
+	option=Printer[pnum].notify.option;
+	id=1;
+	info->version=2;
+	info->data=NULL;
 	info->count=0;
 
-	if (pnum == -1)
+	for (i=0; i<option->count; i++)
 	{
-		return NT_STATUS_INVALID_HANDLE;
+		option_type=&(option->ctr.type[i]);
+		
+		if (option_type->type!=PRINTER_NOTIFY_TYPE)
+			continue;
+		
+		for (snum=0; snum<n_services; snum++)
+			if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) )
+				if (construct_notify_printer_info(info, snum, option_type, id))
+					id++;
 	}
-
-	DEBUG(4,("Enumerating printers\n"));
-
-	for (i=0; i<Printer[pnum].number_of_notify; i++)
+			
+	/*
+	 * Debugging information, don't delete.
+	 */
+	/* 
+	DEBUG(1,("dumping the NOTIFY_INFO\n"));
+	DEBUGADD(1,("info->version:[%d], info->flags:[%d], info->count:[%d]\n", info->version, info->flags, info->count));
+	DEBUGADD(1,("num\ttype\tfield\tres\tid\tsize\tenc_type\n"));
+	
+	for (i=0; i<info->count; i++)
 	{
-	 if ( Printer[pnum].notify_info[i].type == PRINTER_NOTIFY_TYPE )
-	 {
-	  for (snum=0; snum<n_services; snum++)
-	  {
-	   if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) )
-	   {
-		construct_notify_printer_info(info, pnum, snum, i, id);
-		id++;
-	   }
-	  }
-	 }
+		DEBUGADD(1,("[%d]\t[%d]\t[%d]\t[%d]\t[%d]\t[%d]\t[%d]\n",
+		i, info->data[i].type, info->data[i].field, info->data[i].reserved,
+		info->data[i].id, info->data[i].size, info->data[i].enc_type));
 	}
-	DEBUG(4,("All printers enumerated\n"));
-
-	return 0x0;
+	*/
+	
+	return NT_STATUS_NO_PROBLEMO;
 }
 
 /*******************************************************************
@@ -1343,59 +1368,72 @@ static uint32 printserver_notify_info(const POLICY_HND *hnd,
  * fill a notify_info struct with info asked
  * 
  ********************************************************************/
-static uint32 printer_notify_info(const POLICY_HND *hnd,
-				SPOOL_NOTIFY_INFO *info)
+static uint32 printer_notify_info(const POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info)
 {
 	int snum;
 	int pnum=find_printer_index_by_hnd(hnd);
-	int i=0, j;
-	uint32 id=0xFFFF;
+	int i;
+	uint32 id;
+	SPOOL_NOTIFY_OPTION *option;
+	SPOOL_NOTIFY_OPTION_TYPE *option_type;
+	int count,j;
+	print_queue_struct *queue=NULL;
+	print_status_struct status;
 	
+	DEBUG(4,("printer_notify_info\n"));
+
+	option=Printer[pnum].notify.option;
+	id=1;
+	info->version=2;
+	info->data=NULL;
 	info->count=0;
 
-	if (pnum == -1 || !get_printer_snum(hnd, &snum) )
-	{
-		return NT_STATUS_INVALID_HANDLE;
-	}
+	get_printer_snum(hnd, &snum);
 
-	for (i=0; i<Printer[pnum].number_of_notify; i++)
+	for (i=0; i<option->count; i++)
 	{
-	 switch ( Printer[pnum].notify_info[i].type )
-	 {
-	  case PRINTER_NOTIFY_TYPE:
-	   {
-		construct_notify_printer_info(info, pnum, snum, i, id);
-		id--;
-		break;
-	   }
-	  case JOB_NOTIFY_TYPE:
-	   {
-		int count;
-		print_queue_struct *queue=NULL;
-		print_status_struct status;
-		bzero(&status, sizeof(status));	
-		count=get_printqueue(snum, NULL, &queue, &status);
-		for (j=0; j<count; j++)
-		{
-			construct_notify_jobs_info(&(queue[j]), info, pnum, snum, i, queue[j].job);
+		option_type=&(option->ctr.type[i]);
+		
+		switch ( option_type->type ) {
+		case PRINTER_NOTIFY_TYPE:
+			if(construct_notify_printer_info(info, snum, option_type, id))
+				id++;
+			break;
+			
+		case JOB_NOTIFY_TYPE:
+			memset(&status, 0, sizeof(status));	
+			count=get_printqueue(snum, NULL, &queue, &status);
+			for (j=0; j<count; j++)
+				if (construct_notify_jobs_info(&(queue[j]), info, snum, option_type, id))
+					id++;
+			safe_free(queue);
+			break;
 		}
-		safe_free(queue);
-		break;
-	   }
-	 }
 	}
-
-	return 0x0;
+	
+	/*
+	 * Debugging information, don't delete.
+	 */
+	/* 
+	DEBUG(1,("dumping the NOTIFY_INFO\n"));
+	DEBUGADD(1,("info->version:[%d], info->flags:[%d], info->count:[%d]\n", info->version, info->flags, info->count));
+	DEBUGADD(1,("num\ttype\tfield\tres\tid\tsize\tenc_type\n"));
+	
+	for (i=0; i<info->count; i++)
+	{
+		DEBUGADD(1,("[%d]\t[%d]\t[%d]\t[%d]\t[%d]\t[%d]\t[%d]\n",
+		i, info->data[i].type, info->data[i].field, info->data[i].reserved,
+		info->data[i].id, info->data[i].size, info->data[i].enc_type));
+	}
+	*/
+	return NT_STATUS_NO_PROBLEMO;
 }
 
 /********************************************************************
  * spoolss_rfnpcnex
  ********************************************************************/
-uint32 _spoolss_rfnpcnex( const POLICY_HND *handle,
-				uint32 change,
-				const SPOOL_NOTIFY_OPTION *option,
-				uint32 *count,
-				SPOOL_NOTIFY_INFO *info)
+uint32 _spoolss_rfnpcnex( const POLICY_HND *handle, uint32 change,
+			  SPOOL_NOTIFY_OPTION *option, SPOOL_NOTIFY_INFO *info)
 {
 	int pnum=find_printer_index_by_hnd(handle);
 
@@ -1404,21 +1442,32 @@ uint32 _spoolss_rfnpcnex( const POLICY_HND *handle,
 		return NT_STATUS_INVALID_HANDLE;
 	}
 
-	DEBUG(4,("Printer %x of type %x\n",pnum,Printer[pnum].printer_type));
+	DEBUG(4,("Printer %x of type %x\n",pnum, Printer[pnum].printer_type));
+
+	/* jfm: the change value isn't used right now.
+	 * 	we will honour it when
+	 *	a) we'll be able to send notification to the client
+	 *	b) we'll have a way to communicate between the spoolss process.
+	 *
+	 *	same thing for option->flags
+	 *	I should check for PRINTER_NOTIFY_OPTIONS_REFRESH but as 
+	 *	I don't have a global notification system, I'm sending back all the
+	 *	informations even when _NOTHING_ has changed.
+	 */
 
-	/* lkxlXXXX - jfm, is this right? put a warning in for you to review! */
-	DEBUG(0,("_spoolss_rfnpcnex: change, option and count ignored\n"));
+	/* just discard the SPOOL_NOTIFY_OPTION */
+	if (option!=NULL)
+		safe_free(option->ctr.type);
+	
+	safe_free(option);
 
-	switch (Printer[pnum].printer_type)
-	{
+	switch (Printer[pnum].printer_type) {
 		case PRINTER_HANDLE_IS_PRINTSERVER:
-		{
 			return printserver_notify_info(handle, info);
-		}
+			break;
 		case PRINTER_HANDLE_IS_PRINTER:
-		{
 			return printer_notify_info(handle, info);
-		}
+			break;
 	}
 
 	return NT_STATUS_INVALID_INFO_CLASS;
@@ -1436,7 +1485,7 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer,int snum, pstring s
 	
 	print_queue_struct *queue=NULL;
 	print_status_struct status;
-	bzero(&status,sizeof(status));	
+	memset(&status, 0, sizeof(status));	
 
 	if (get_a_printer(&ntprinter, 2, lp_servicename(snum)) != 0)
 	{
@@ -1476,7 +1525,7 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer,int snum, pstring s
 	printer->unknown14    = 0x1;
 	printer->unknown15    = 0x024a; /*586 Pentium ? */
 	printer->unknown16    = 0x0;
-	printer->unknown17    = 0x423ed444;
+	printer->unknown17    = 0x423ed444; /* CacheChangeID */
 	printer->unknown18    = 0x0;
 	printer->status       = status.status;
 	printer->unknown20    = 0x0;
@@ -1536,8 +1585,8 @@ static void construct_dev_mode(DEVICEMODE *devmode, int snum, char *servername)
 
 	DEBUG(7,("construct_dev_mode\n"));
 	
-	bzero(&(devmode->devicename), 2*sizeof(adevice));
-	bzero(&(devmode->formname), 2*sizeof(aform));
+	memset(&(devmode->devicename), 0, 2*sizeof(adevice));
+	memset(&(devmode->formname), 0, 2*sizeof(aform));
 
 	DEBUGADD(8,("getting printer characteristics\n"));
 
@@ -1598,7 +1647,7 @@ static BOOL construct_printer_info_2(PRINTER_INFO_2 *printer, int snum, pstring
 	
 	print_queue_struct *queue=NULL;
 	print_status_struct status;
-	bzero(&status, sizeof(status));	
+	memset(&status, 0, sizeof(status));	
 	count=get_printqueue(snum, NULL, &queue, &status);
 
 	if (get_a_printer(&ntprinter, 2, lp_servicename(snum)) !=0 )
@@ -2713,14 +2762,28 @@ uint32 _spoolss_setprinter( const POLICY_HND *handle,
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_fcpn( const POLICY_HND *handle)
+uint32 _spoolss_fcpn(const POLICY_HND *handle)
 {
-	return 0x0;
+	int pnum = find_printer_index_by_hnd(handle);
+	
+	if (!OPEN_HANDLE(pnum))
+	{
+		return NT_STATUS_INVALID_HANDLE;
+	}
+	
+	Printer[pnum].notify.flags=0;
+	Printer[pnum].notify.options=0;
+	Printer[pnum].notify.localmachine[0]='\0';
+	Printer[pnum].notify.printerlocal=0;
+	safe_free(Printer[pnum].notify.option);
+	Printer[pnum].notify.option=NULL;
+	
+	return NT_STATUS_NO_PROBLEMO;
 }
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_addjob( const POLICY_HND *handle, uint32 level,
+uint32 _spoolss_addjob(const POLICY_HND *handle, uint32 level,
 			NEW_BUFFER *buffer, uint32 offered)
 {
 	return NT_STATUS_NO_PROBLEMO;
@@ -2956,7 +3019,7 @@ uint32 _spoolss_setjob( const POLICY_HND *handle,
 	BOOL found=False;
 	int count;
 		
-	bzero(&prt_status,sizeof(prt_status));
+	memset(&prt_status, 0, sizeof(prt_status));
 
 	if (!get_printer_snum(handle, &snum))
 	{
@@ -3989,7 +4052,7 @@ uint32 _spoolss_getjob( POLICY_HND *handle, uint32 jobid, uint32 level,
 
 	DEBUG(5,("spoolss_getjob\n"));
 	
-	bzero(&prt_status, sizeof(prt_status));
+	memset(&prt_status, 0, sizeof(prt_status));
 
 	*needed=0;