summaryrefslogtreecommitdiff
path: root/source3/rpc_server
diff options
context:
space:
mode:
Diffstat (limited to 'source3/rpc_server')
-rw-r--r--source3/rpc_server/srv_dfs.c3
-rw-r--r--source3/rpc_server/srv_dfs_nt.c33
-rw-r--r--source3/rpc_server/srv_lsa.c5
-rw-r--r--source3/rpc_server/srv_lsa_hnd.c48
-rw-r--r--source3/rpc_server/srv_lsa_nt.c58
-rw-r--r--source3/rpc_server/srv_netlog.c3
-rw-r--r--source3/rpc_server/srv_netlog_nt.c53
-rw-r--r--source3/rpc_server/srv_pipe.c7
-rw-r--r--source3/rpc_server/srv_pipe_hnd.c50
-rw-r--r--source3/rpc_server/srv_reg.c138
-rw-r--r--source3/rpc_server/srv_reg_nt.c661
-rw-r--r--source3/rpc_server/srv_samr.c35
-rw-r--r--source3/rpc_server/srv_samr_nt.c1339
-rwxr-xr-xsource3/rpc_server/srv_spoolss.c125
-rw-r--r--source3/rpc_server/srv_spoolss_nt.c1330
-rw-r--r--source3/rpc_server/srv_srvsvc.c39
-rw-r--r--source3/rpc_server/srv_srvsvc_nt.c143
-rw-r--r--source3/rpc_server/srv_util.c18
-rw-r--r--source3/rpc_server/srv_wkssvc.c5
-rw-r--r--source3/rpc_server/srv_wkssvc_nt.c3
20 files changed, 3058 insertions, 1038 deletions
diff --git a/source3/rpc_server/srv_dfs.c b/source3/rpc_server/srv_dfs.c
index 4351fd088e..5edc1222a8 100644
--- a/source3/rpc_server/srv_dfs.c
+++ b/source3/rpc_server/srv_dfs.c
@@ -28,6 +28,9 @@
#define MAX_MSDFS_JUNCTIONS 256
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
extern pstring global_myname;
/**********************************************************************
diff --git a/source3/rpc_server/srv_dfs_nt.c b/source3/rpc_server/srv_dfs_nt.c
index 4db6c61a3c..65e387176d 100644
--- a/source3/rpc_server/srv_dfs_nt.c
+++ b/source3/rpc_server/srv_dfs_nt.c
@@ -26,6 +26,9 @@
#include "includes.h"
#include "nterr.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
extern pstring global_myname;
#define MAX_MSDFS_JUNCTIONS 256
@@ -69,10 +72,7 @@ WERROR _dfs_add(pipes_struct *p, DFS_Q_DFS_ADD* q_u, DFS_R_DFS_ADD *r_u)
pstrcat(altpath, "\\");
pstrcat(altpath, sharename);
- if(!create_junction(dfspath, &jn))
- return WERR_DFS_NO_SUCH_SERVER;
-
- if(get_referred_path(&jn))
+ if(get_referred_path(dfspath, &jn, NULL, NULL))
{
exists = True;
jn.referral_count += 1;
@@ -137,16 +137,14 @@ WERROR _dfs_remove(pipes_struct *p, DFS_Q_DFS_REMOVE *q_u,
pstrcpy(altpath, servername);
pstrcat(altpath, "\\");
pstrcat(altpath, sharename);
+ strlower(altpath);
}
DEBUG(5,("init_reply_dfs_remove: Request to remove %s -> %s\\%s.\n",
dfspath, servername, sharename));
- if(!create_junction(dfspath, &jn))
- return WERR_DFS_NO_SUCH_SERVER;
-
- if(!get_referred_path(&jn))
- return WERR_DFS_NO_SUCH_VOL;
+ if(!get_referred_path(dfspath, &jn, NULL, NULL))
+ return WERR_DFS_NO_SUCH_VOL;
/* if no server-share pair given, remove the msdfs link completely */
if(!q_u->ptr_ServerName && !q_u->ptr_ShareName)
@@ -158,14 +156,18 @@ WERROR _dfs_remove(pipes_struct *p, DFS_Q_DFS_REMOVE *q_u,
{
int i=0;
/* compare each referral in the list with the one to remove */
+ DEBUG(10,("altpath: .%s. refcnt: %d\n", altpath, jn.referral_count));
for(i=0;i<jn.referral_count;i++)
{
pstring refpath;
pstrcpy(refpath,jn.referral_list[i].alternate_path);
trim_string(refpath, "\\", "\\");
+ DEBUG(10,("_dfs_remove: refpath: .%s.\n", refpath));
if(strequal(refpath, altpath))
{
*(jn.referral_list[i].alternate_path)='\0';
+ DEBUG(10,("_dfs_remove: Removal request matches referral %s\n",
+ refpath));
found = True;
}
}
@@ -227,8 +229,13 @@ static BOOL init_reply_dfs_info_3(TALLOC_CTX *ctx, struct junction_map* j, DFS_I
{
pstring str;
dfs3[i].ptr_entrypath = 1;
- slprintf(str, sizeof(pstring)-1, "\\\\%s\\%s\\%s", global_myname,
- j[i].service_name, j[i].volume_name);
+ if (j[i].volume_name[0] == '\0')
+ slprintf(str, sizeof(pstring)-1, "\\\\%s\\%s",
+ global_myname, j[i].service_name);
+ else
+ slprintf(str, sizeof(pstring)-1, "\\\\%s\\%s\\%s", global_myname,
+ j[i].service_name, j[i].volume_name);
+
init_unistr2(&dfs3[i].entrypath, str, strlen(str)+1);
dfs3[i].ptr_comment = 1;
init_unistr2(&dfs3[i].comment, "", 1);
@@ -355,8 +362,8 @@ WERROR _dfs_get_info(pipes_struct *p, DFS_Q_DFS_GET_INFO *q_u,
if(!create_junction(path, &jn))
return WERR_DFS_NO_SUCH_SERVER;
- if(!get_referred_path(&jn))
- return WERR_DFS_NO_SUCH_VOL;
+ if(!get_referred_path(path, &jn, NULL, NULL))
+ return WERR_DFS_NO_SUCH_VOL;
r_u->level = level;
r_u->ptr_ctr = 1;
diff --git a/source3/rpc_server/srv_lsa.c b/source3/rpc_server/srv_lsa.c
index fcd4be0212..e5a4d3b46d 100644
--- a/source3/rpc_server/srv_lsa.c
+++ b/source3/rpc_server/srv_lsa.c
@@ -25,6 +25,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
/***************************************************************************
api_lsa_open_policy2
***************************************************************************/
@@ -105,8 +108,10 @@ static BOOL api_lsa_enum_trust_dom(pipes_struct *p)
if(!lsa_io_q_enum_trust_dom("", &q_u, data, 0))
return False;
+ /* get required trusted domains information */
r_u.status = _lsa_enum_trust_dom(p, &q_u, &r_u);
+ /* prepare the response */
if(!lsa_io_r_enum_trust_dom("", &r_u, rdata, 0))
return False;
diff --git a/source3/rpc_server/srv_lsa_hnd.c b/source3/rpc_server/srv_lsa_hnd.c
index 84c3c5a959..2d04d72323 100644
--- a/source3/rpc_server/srv_lsa_hnd.c
+++ b/source3/rpc_server/srv_lsa_hnd.c
@@ -22,6 +22,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
/* This is the max handles across all instances of a pipe name. */
#ifndef MAX_OPEN_POLS
#define MAX_OPEN_POLS 1024
@@ -134,6 +137,14 @@ BOOL create_policy_hnd(pipes_struct *p, POLICY_HND *hnd, void (*free_fn)(void *)
DLIST_ADD(p->pipe_handles->Policy, pol);
p->pipe_handles->count++;
+ /*
+ * Ensure we don't idle this connection if a handle is open.
+ * Increment the number of files open on the first handle create.
+ */
+
+ if (p->pipe_handles->count == 1)
+ p->conn->num_files_open++;
+
*hnd = pol->pol_hnd;
DEBUG(4,("Opened policy hnd[%d] ", (int)p->pipe_handles->count));
@@ -201,6 +212,15 @@ BOOL close_policy_hnd(pipes_struct *p, POLICY_HND *hnd)
p->pipe_handles->count--;
+ /*
+ * Ensure we can idle this connection if this is the last handle.
+ * Decrement the number of files open on the last handle delete.
+ */
+
+ if (p->pipe_handles->count == 0)
+ p->conn->num_files_open--;
+
+
DLIST_REMOVE(p->pipe_handles->Policy, pol);
ZERO_STRUCTP(pol);
@@ -232,3 +252,31 @@ void close_policy_by_pipe(pipes_struct *p)
DEBUG(10,("close_policy_by_pipe: deleted handle list for pipe %s\n", p->name ));
}
}
+
+/*******************************************************************
+Shall we allow access to this rpc? Currently this function
+implements the 'restrict anonymous' setting by denying access to
+anonymous users if the restrict anonymous level is > 0. Further work
+will be checking a security descriptor to determine whether a user
+token has enough access to access the pipe.
+********************************************************************/
+
+BOOL pipe_access_check(pipes_struct *p)
+{
+ /* Don't let anonymous users access this RPC if restrict
+ anonymous > 0 */
+
+ if (lp_restrict_anonymous() > 0) {
+ user_struct *user = get_valid_user_struct(p->vuid);
+
+ if (!user) {
+ DEBUG(3, ("invalid vuid %d\n", p->vuid));
+ return False;
+ }
+
+ if (user->guest)
+ return False;
+ }
+
+ return True;
+}
diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index 84ab44bc30..d072061a5f 100644
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -3,8 +3,9 @@
* RPC Pipe client / server routines
* Copyright (C) Andrew Tridgell 1992-1997,
* Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
- * Copyright (C) Paul Ashton 1997.
- * Copyright (C) Jeremy Allison 2001.
+ * Copyright (C) Paul Ashton 1997,
+ * Copyright (C) Jeremy Allison 2001,
+ * Copyright (C) Rafal Szczesniak 2002.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -25,7 +26,9 @@
#include "includes.h"
-extern DOM_SID global_sam_sid;
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
extern fstring global_myworkgroup;
extern pstring global_myname;
extern PRIVS privs[];
@@ -164,7 +167,7 @@ static void init_lsa_rid2s(DOM_R_REF *ref, DOM_RID2 *rid2,
DEBUG(5, ("init_lsa_rid2s: %s\n", status ? "found" :
"not found"));
- if (status) {
+ if (status && name_type != SID_NAME_UNKNOWN) {
sid_split_rid(&sid, &rid);
dom_idx = init_dom_ref(ref, dom_name, &sid);
(*mapped_count)++;
@@ -258,6 +261,8 @@ static void init_lsa_trans_names(TALLOC_CTX *ctx, DOM_R_REF *ref, LSA_TRANS_NAME
if (!status) {
sid_name_use = SID_NAME_UNKNOWN;
+ } else {
+ (*mapped_count)++;
}
/* Store domain sid in ref array */
@@ -271,8 +276,6 @@ static void init_lsa_trans_names(TALLOC_CTX *ctx, DOM_R_REF *ref, LSA_TRANS_NAME
DEBUG(10,("init_lsa_trans_names: added user '%s\\%s' to "
"referenced list.\n", dom_name, name ));
- (*mapped_count)++;
-
init_lsa_trans_name(&trn->name[total], &trn->uni_name[total],
sid_name_use, name, dom_idx);
total++;
@@ -319,7 +322,7 @@ static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *s
init_sec_access(&mask, POLICY_EXECUTE);
init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
- sid_copy(&adm_sid, &global_sam_sid);
+ sid_copy(&adm_sid, get_global_sam_sid());
sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
init_sec_access(&mask, POLICY_ALL_ACCESS);
init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
@@ -366,7 +369,7 @@ NTSTATUS _lsa_open_policy2(pipes_struct *p, LSA_Q_OPEN_POL2 *q_u, LSA_R_OPEN_POL
return NT_STATUS_NO_MEMORY;
ZERO_STRUCTP(info);
- info->sid = global_sam_sid;
+ sid_copy(&info->sid,get_global_sam_sid());
info->access = acc_granted;
/* set up the LSA QUERY INFO response */
@@ -404,7 +407,7 @@ NTSTATUS _lsa_open_policy(pipes_struct *p, LSA_Q_OPEN_POL *q_u, LSA_R_OPEN_POL *
return NT_STATUS_NO_MEMORY;
ZERO_STRUCTP(info);
- info->sid = global_sam_sid;
+ sid_copy(&info->sid,get_global_sam_sid());
info->access = acc_granted;
/* set up the LSA QUERY INFO response */
@@ -416,14 +419,22 @@ NTSTATUS _lsa_open_policy(pipes_struct *p, LSA_Q_OPEN_POL *q_u, LSA_R_OPEN_POL *
/***************************************************************************
_lsa_enum_trust_dom - this needs fixing to do more than return NULL ! JRA.
+ ufff, done :) mimir
***************************************************************************/
NTSTATUS _lsa_enum_trust_dom(pipes_struct *p, LSA_Q_ENUM_TRUST_DOM *q_u, LSA_R_ENUM_TRUST_DOM *r_u)
{
struct lsa_info *info;
- uint32 enum_context = 0;
- char *dom_name = NULL;
- DOM_SID *dom_sid = NULL;
+ uint32 enum_context = q_u->enum_context;
+
+ /*
+ * preferred length is set to 5 as a "our" preferred length
+ * nt sets this parameter to 2
+ */
+ uint32 max_num_domains = q_u->preferred_len < 5 ? q_u->preferred_len : 10;
+ TRUSTDOM **trust_doms;
+ uint32 num_domains;
+ NTSTATUS nt_status;
if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
return NT_STATUS_INVALID_HANDLE;
@@ -432,9 +443,18 @@ NTSTATUS _lsa_enum_trust_dom(pipes_struct *p, LSA_Q_ENUM_TRUST_DOM *q_u, LSA_R_E
if (!(info->access & POLICY_VIEW_LOCAL_INFORMATION))
return NT_STATUS_ACCESS_DENIED;
- /* set up the LSA QUERY INFO response */
- init_r_enum_trust_dom(p->mem_ctx, r_u, enum_context, dom_name, dom_sid,
- dom_name != NULL ? NT_STATUS_OK : NT_STATUS_NO_MORE_ENTRIES);
+ nt_status = secrets_get_trusted_domains(p->mem_ctx, &enum_context, max_num_domains, &num_domains, &trust_doms);
+
+ if (!NT_STATUS_IS_OK(nt_status) &&
+ !NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES) &&
+ !NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MORE_ENTRIES)) {
+ return nt_status;
+ } else {
+ r_u->status = nt_status;
+ }
+
+ /* set up the lsa_enum_trust_dom response */
+ init_r_enum_trust_dom(p->mem_ctx, r_u, enum_context, max_num_domains, num_domains, trust_doms);
return r_u->status;
}
@@ -484,7 +504,7 @@ NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INF
case ROLE_DOMAIN_PDC:
case ROLE_DOMAIN_BDC:
name = global_myworkgroup;
- sid = &global_sam_sid;
+ sid = get_global_sam_sid();
break;
case ROLE_DOMAIN_MEMBER:
name = global_myworkgroup;
@@ -514,15 +534,15 @@ NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INF
case ROLE_DOMAIN_PDC:
case ROLE_DOMAIN_BDC:
name = global_myworkgroup;
- sid = &global_sam_sid;
+ sid = get_global_sam_sid();
break;
case ROLE_DOMAIN_MEMBER:
name = global_myname;
- sid = &global_sam_sid;
+ sid = get_global_sam_sid();
break;
case ROLE_STANDALONE:
name = global_myname;
- sid = &global_sam_sid;
+ sid = get_global_sam_sid();
break;
default:
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
diff --git a/source3/rpc_server/srv_netlog.c b/source3/rpc_server/srv_netlog.c
index dfd270ff7d..f96a0e2f2d 100644
--- a/source3/rpc_server/srv_netlog.c
+++ b/source3/rpc_server/srv_netlog.c
@@ -25,6 +25,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
/*************************************************************************
api_net_req_chal:
*************************************************************************/
diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c
index bdb064c81d..4ab9c470d0 100644
--- a/source3/rpc_server/srv_netlog_nt.c
+++ b/source3/rpc_server/srv_netlog_nt.c
@@ -26,8 +26,10 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
extern pstring global_myname;
-extern DOM_SID global_sam_sid;
/*************************************************************************
init_net_r_req_chal:
@@ -150,7 +152,7 @@ NTSTATUS _net_trust_dom_list(pipes_struct *p, NET_Q_TRUST_DOM_LIST *q_u, NET_R_T
***********************************************************************************/
static void init_net_r_srv_pwset(NET_R_SRV_PWSET *r_s,
- DOM_CRED *srv_cred, NTSTATUS status)
+ DOM_CRED *srv_cred, NTSTATUS status)
{
DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
@@ -378,7 +380,7 @@ NTSTATUS _net_auth_2(pipes_struct *p, NET_Q_AUTH_2 *q_u, NET_R_AUTH_2 *r_u)
NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *r_u)
{
- NTSTATUS status = NT_STATUS_WRONG_PASSWORD;
+ NTSTATUS status = NT_STATUS_ACCESS_DENIED;
DOM_CRED srv_cred;
pstring workstation;
SAM_ACCOUNT *sampass=NULL;
@@ -395,8 +397,8 @@ NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *
DEBUG(5,("_net_srv_pwset: %d\n", __LINE__));
- rpcstr_pull(workstation,q_u->clnt_id.login.uni_acct_name.buffer,
- sizeof(workstation),q_u->clnt_id.login.uni_acct_name.uni_str_len*2,0);
+ rpcstr_pull(workstation,q_u->clnt_id.login.uni_comp_name.buffer,
+ sizeof(workstation),q_u->clnt_id.login.uni_comp_name.uni_str_len*2,0);
DEBUG(3,("Server Password Set by Wksta:[%s] on account [%s]\n", workstation, p->dc.mach_acct));
@@ -656,14 +658,35 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *
{
DOM_GID *gids = NULL;
+ const DOM_SID *user_sid = NULL;
+ const DOM_SID *group_sid = NULL;
+ DOM_SID domain_sid;
+ uint32 user_rid, group_rid;
+
int num_gids = 0;
pstring my_name;
- pstring my_workgroup;
-
+ fstring user_sid_string;
+ fstring group_sid_string;
+
+ sampw = server_info->sam_account;
+
/* set up pointer indicating user/password failed to be found */
usr_info->ptr_user_info = 0;
-
- pstrcpy(my_workgroup, lp_workgroup());
+
+ user_sid = pdb_get_user_sid(sampw);
+ group_sid = pdb_get_group_sid(sampw);
+
+ sid_copy(&domain_sid, user_sid);
+ sid_split_rid(&domain_sid, &user_rid);
+
+ if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) {
+ DEBUG(1, ("_net_sam_logon: user %s\\%s has user sid %s\n but group sid %s.\nThe conflicting domain portions are not supported for NETLOGON calls\n",
+ pdb_get_domain(sampw), pdb_get_username(sampw),
+ sid_to_string(user_sid_string, user_sid),
+ sid_to_string(group_sid_string, group_sid)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
pstrcpy(my_name, global_myname);
strupper(my_name);
@@ -677,12 +700,10 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *
gids = NULL;
get_domain_user_groups(p->mem_ctx, &num_gids, &gids, server_info->sam_account);
-
- sampw = server_info->sam_account;
init_net_user_info3(p->mem_ctx, usr_info,
- pdb_get_user_rid(sampw),
- pdb_get_group_rid(sampw),
+ user_rid,
+ group_rid,
pdb_get_username(sampw),
pdb_get_fullname(sampw),
@@ -704,8 +725,10 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *
0x20 , /* uint32 user_flgs (?) */
NULL, /* uchar sess_key[16] */
my_name , /* char *logon_srv */
- my_workgroup, /* char *logon_dom */
- &global_sam_sid, /* DOM_SID *dom_sid */
+ pdb_get_domain(sampw),
+ &domain_sid, /* DOM_SID *dom_sid */
+ /* Should be users domain sid, not servers - for trusted domains */
+
NULL); /* char *other_sids */
}
free_server_info(&server_info);
diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index 70574b4cdd..b7be415abc 100644
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -39,6 +39,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
{
unsigned char *hash = p->ntlmssp_hash;
@@ -432,7 +435,7 @@ failed authentication on named pipe %s.\n", domain, user_name, wks, p->name ));
/* Set up pipe user group membership. */
initialise_groups(p->pipe_user_name, p->pipe_user.uid, p->pipe_user.gid);
- get_current_groups( &p->pipe_user.ngroups, &p->pipe_user.groups);
+ get_current_groups(p->pipe_user.gid, &p->pipe_user.ngroups, &p->pipe_user.groups);
if (server_info->ptok)
add_supplementary_nt_login_groups(&p->pipe_user.ngroups, &p->pipe_user.groups, &server_info->ptok);
@@ -1148,7 +1151,7 @@ BOOL api_pipe_request(pipes_struct *p)
********************************************************************/
BOOL api_rpcTNP(pipes_struct *p, char *rpc_name,
- struct api_struct *api_rpc_cmds)
+ const struct api_struct *api_rpc_cmds)
{
int fn_num;
fstring name;
diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c
index 44dd5fac65..cc6e4b95f9 100644
--- a/source3/rpc_server/srv_pipe_hnd.c
+++ b/source3/rpc_server/srv_pipe_hnd.c
@@ -22,6 +22,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
#define PIPE "\\PIPE\\"
#define PIPELEN strlen(PIPE)
@@ -32,6 +35,23 @@ static int pipes_open;
#define MAX_OPEN_PIPES 2048
#endif
+/*
+ * Sometimes I can't decide if I hate Windows printer driver
+ * writers more than I hate the Windows spooler service driver
+ * writers. This gets around a combination of bugs in the spooler
+ * and the HP 8500 PCL driver that causes a spooler spin. JRA.
+ *
+ * bumped up from 20 -> 64 after viewing traffic from WordPerfect
+ * 2002 running on NT 4.- SP6
+ * bumped up from 64 -> 256 after viewing traffic from con2prt
+ * for lots of printers on a WinNT 4.x SP6 box.
+ */
+
+#ifndef MAX_OPEN_SPOOLSS_PIPES
+#define MAX_OPEN_SPOOLSS_PIPES 256
+#endif
+static int current_spoolss_pipes_open;
+
static smb_np_struct *Pipes;
static pipes_struct *InternalPipes;
static struct bitmap *bmap;
@@ -99,6 +119,7 @@ void set_pipe_handle_offset(int max_open_files)
/****************************************************************************
Reset pipe chain handle number.
****************************************************************************/
+
void reset_chain_p(void)
{
chain_p = NULL;
@@ -155,11 +176,20 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name,
int i;
smb_np_struct *p, *p_it;
static int next_pipe;
+ BOOL is_spoolss_pipe = False;
DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
pipe_name, pipes_open));
-
+ if (strstr(pipe_name, "spoolss"))
+ is_spoolss_pipe = True;
+
+ if (is_spoolss_pipe && current_spoolss_pipes_open >= MAX_OPEN_SPOOLSS_PIPES) {
+ DEBUG(10,("open_rpc_pipe_p: spooler bug workaround. Denying open on pipe %s\n",
+ pipe_name ));
+ return NULL;
+ }
+
/* not repeating pipe numbers makes it easier to track things in
log files and prevents client bugs where pipe numbers are reused
over connection restarts */
@@ -180,8 +210,7 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name,
p = (smb_np_struct *)malloc(sizeof(*p));
- if (!p)
- {
+ if (!p) {
DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
return NULL;
}
@@ -198,13 +227,11 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name,
p->np_state = p->namedpipe_create(pipe_name, conn, vuid);
if (p->np_state == NULL) {
-
DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
SAFE_FREE(p);
return NULL;
}
-
DLIST_ADD(Pipes, p);
/*
@@ -244,7 +271,7 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name,
}
/****************************************************************************
- * make an internal namedpipes structure
+ Make an internal namedpipes structure
****************************************************************************/
static void *make_internal_rpc_pipe_p(char *pipe_name,
@@ -298,6 +325,10 @@ static void *make_internal_rpc_pipe_p(char *pipe_name,
DLIST_ADD(InternalPipes, p);
p->conn = conn;
+
+ /* Ensure the connection isn't idled whilst this pipe is open. */
+ p->conn->num_files_open++;
+
p->vuid = vuid;
p->ntlmssp_chal_flags = 0;
@@ -313,9 +344,10 @@ static void *make_internal_rpc_pipe_p(char *pipe_name,
p->pipe_user.uid = (uid_t)-1;
p->pipe_user.gid = (gid_t)-1;
- /* Store the session key */
+ /* Store the session key and NT_TOKEN */
if (vuser) {
memcpy(p->session_key, vuser->session_key, sizeof(p->session_key));
+ p->pipe_user.nt_user_token = dup_nt_token(vuser->nt_user_token);
}
/*
@@ -1055,7 +1087,7 @@ BOOL close_rpc_pipe_hnd(smb_np_struct *p)
ZERO_STRUCTP(p);
SAFE_FREE(p);
-
+
return True;
}
@@ -1085,6 +1117,8 @@ static BOOL close_internal_rpc_pipe_hnd(void *np_conn)
DLIST_REMOVE(InternalPipes, p);
+ p->conn->num_files_open--;
+
ZERO_STRUCTP(p);
SAFE_FREE(p);
diff --git a/source3/rpc_server/srv_reg.c b/source3/rpc_server/srv_reg.c
index 569f3fb8b1..a096325860 100644
--- a/source3/rpc_server/srv_reg.c
+++ b/source3/rpc_server/srv_reg.c
@@ -1,11 +1,12 @@
-/*
+/*
* Unix SMB/CIFS implementation.
* RPC Pipe client / server routines
* Copyright (C) Andrew Tridgell 1992-1997,
* Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
* Copyright (C) Paul Ashton 1997.
- * Copyright (C) Marc Jacobsen 2000.
- * Copyright (C) Jeremy Allison 2001.
+ * Copyright (C) Marc Jacobsen 2000.
+ * Copyright (C) Jeremy Allison 2001.
+ * Copyright (C) Gerald Carter 2002.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -26,6 +27,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
/*******************************************************************
api_reg_close
********************************************************************/
@@ -53,10 +57,10 @@ static BOOL api_reg_close(pipes_struct *p)
}
/*******************************************************************
- api_reg_open
+ api_reg_open_khlm
********************************************************************/
-static BOOL api_reg_open(pipes_struct *p)
+static BOOL api_reg_open_hklm(pipes_struct *p)
{
REG_Q_OPEN_HKLM q_u;
REG_R_OPEN_HKLM r_u;
@@ -70,7 +74,7 @@ static BOOL api_reg_open(pipes_struct *p)
if(!reg_io_q_open_hklm("", &q_u, data, 0))
return False;
- r_u.status = _reg_open(p, &q_u, &r_u);
+ r_u.status = _reg_open_hklm(p, &q_u, &r_u);
if(!reg_io_r_open_hklm("", &r_u, rdata, 0))
return False;
@@ -79,6 +83,33 @@ static BOOL api_reg_open(pipes_struct *p)
}
/*******************************************************************
+ api_reg_open_khlm
+ ********************************************************************/
+
+static BOOL api_reg_open_hku(pipes_struct *p)
+{
+ REG_Q_OPEN_HKU q_u;
+ REG_R_OPEN_HKU r_u;
+ prs_struct *data = &p->in_data.data;
+ prs_struct *rdata = &p->out_data.rdata;
+
+ ZERO_STRUCT(q_u);
+ ZERO_STRUCT(r_u);
+
+ /* grab the reg open */
+ if(!reg_io_q_open_hku("", &q_u, data, 0))
+ return False;
+
+ r_u.status = _reg_open_hku(p, &q_u, &r_u);
+
+ if(!reg_io_r_open_hku("", &r_u, rdata, 0))
+ return False;
+
+ return True;
+}
+
+
+/*******************************************************************
api_reg_open_entry
********************************************************************/
@@ -185,17 +216,98 @@ static BOOL api_reg_abort_shutdown(pipes_struct *p)
/*******************************************************************
+ api_reg_query_key
+ ********************************************************************/
+
+static BOOL api_reg_query_key(pipes_struct *p)
+{
+ REG_Q_QUERY_KEY q_u;
+ REG_R_QUERY_KEY r_u;
+ prs_struct *data = &p->in_data.data;
+ prs_struct *rdata = &p->out_data.rdata;
+
+ ZERO_STRUCT(q_u);
+ ZERO_STRUCT(r_u);
+
+ if(!reg_io_q_query_key("", &q_u, data, 0))
+ return False;
+
+ r_u.status = _reg_query_key(p, &q_u, &r_u);
+
+ if(!reg_io_r_query_key("", &r_u, rdata, 0))
+ return False;
+
+ return True;
+}
+
+/*******************************************************************
+ api_reg_unknown_1a
+ ********************************************************************/
+
+static BOOL api_reg_unknown_1a(pipes_struct *p)
+{
+ REG_Q_UNKNOWN_1A q_u;
+ REG_R_UNKNOWN_1A r_u;
+ prs_struct *data = &p->in_data.data;
+ prs_struct *rdata = &p->out_data.rdata;
+
+ ZERO_STRUCT(q_u);
+ ZERO_STRUCT(r_u);
+
+ if(!reg_io_q_unknown_1a("", &q_u, data, 0))
+ return False;
+
+ r_u.status = _reg_unknown_1a(p, &q_u, &r_u);
+
+ if(!reg_io_r_unknown_1a("", &r_u, rdata, 0))
+ return False;
+
+ return True;
+}
+
+/*******************************************************************
+ api_reg_enum_key
+ ********************************************************************/
+
+static BOOL api_reg_enum_key(pipes_struct *p)
+{
+ REG_Q_ENUM_KEY q_u;
+ REG_R_ENUM_KEY r_u;
+ prs_struct *data = &p->in_data.data;
+ prs_struct *rdata = &p->out_data.rdata;
+
+ ZERO_STRUCT(q_u);
+ ZERO_STRUCT(r_u);
+
+ if(!reg_io_q_enum_key("", &q_u, data, 0))
+ return False;
+
+ r_u.status = _reg_enum_key(p, &q_u, &r_u);
+
+ if(!reg_io_r_enum_key("", &r_u, rdata, 0))
+ return False;
+
+ return True;
+}
+
+
+
+/*******************************************************************
array of \PIPE\reg operations
********************************************************************/
static struct api_struct api_reg_cmds[] =
{
- { "REG_CLOSE" , REG_CLOSE , api_reg_close },
- { "REG_OPEN_ENTRY" , REG_OPEN_ENTRY , api_reg_open_entry },
- { "REG_OPEN" , REG_OPEN_HKLM , api_reg_open },
- { "REG_INFO" , REG_INFO , api_reg_info },
- { "REG_SHUTDOWN" , REG_SHUTDOWN , api_reg_shutdown },
- { "REG_ABORT_SHUTDOWN", REG_ABORT_SHUTDOWN, api_reg_abort_shutdown },
- { NULL, 0 , NULL }
+ { "REG_CLOSE" , REG_CLOSE , api_reg_close },
+ { "REG_OPEN_ENTRY" , REG_OPEN_ENTRY , api_reg_open_entry },
+ { "REG_OPEN_HKLM" , REG_OPEN_HKLM , api_reg_open_hklm },
+ { "REG_OPEN_HKU" , REG_OPEN_HKU , api_reg_open_hku },
+ { "REG_ENUM_KEY" , REG_ENUM_KEY , api_reg_enum_key },
+ { "REG_QUERY_KEY" , REG_QUERY_KEY , api_reg_query_key },
+ { "REG_INFO" , REG_INFO , api_reg_info },
+ { "REG_SHUTDOWN" , REG_SHUTDOWN , api_reg_shutdown },
+ { "REG_ABORT_SHUTDOWN" , REG_ABORT_SHUTDOWN , api_reg_abort_shutdown },
+ { "REG_UNKNOWN_1A" , REG_UNKNOWN_1A , api_reg_unknown_1a },
+ { NULL , 0 , NULL }
};
/*******************************************************************
diff --git a/source3/rpc_server/srv_reg_nt.c b/source3/rpc_server/srv_reg_nt.c
index adedd4a8fa..3f07e4aaea 100644
--- a/source3/rpc_server/srv_reg_nt.c
+++ b/source3/rpc_server/srv_reg_nt.c
@@ -5,7 +5,8 @@
* Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
* Copyright (C) Paul Ashton 1997.
* Copyright (C) Hewlett-Packard Company 1999.
- * Copyright (C) Jeremy Allison 2001.
+ * Copyright (C) Jeremy Allison 2001.
+ * Copyright (C) Gerald Carter 2002.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -26,20 +27,479 @@
#include "includes.h"
-struct reg_info {
- /* for use by \PIPE\winreg */
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
+#define KEY_HKLM "HKLM"
+#define KEY_HKU "HKU"
+
+#define OUR_HANDLE(hnd) (((hnd)==NULL)?"NULL":(IVAL((hnd)->data5,4)==(uint32)sys_getpid()?"OURS":"OTHER")), \
+((unsigned int)IVAL((hnd)->data5,4)),((unsigned int)sys_getpid())
+
+/* structure to store the registry handles */
+
+typedef struct _RegistryKey {
+ struct _RegistryKey *prev, *next;
+
fstring name; /* name of registry key */
-};
+ POLICY_HND hnd;
+
+} Registry_Key;
+
+static Registry_Key *regkeys_list;
+static TDB_CONTEXT *tdb_reg;
+
+/***********************************************************************
+ Add subkey strings to the registry tdb under a defined key
+ fmt is the same format as tdb_pack except this function only supports
+ fstrings
+ ***********************************************************************/
+
+static BOOL store_reg_keys( TDB_CONTEXT *tdb, char *keyname, char **subkeys, uint32 num_subkeys )
+{
+ TDB_DATA kbuf, dbuf;
+ char *buffer, *tmpbuf;
+ int i = 0;
+ uint32 len, buflen;
+ BOOL ret = True;
+
+ if ( !keyname )
+ return False;
+
+ /* allocate some initial memory */
+
+ buffer = malloc(sizeof(pstring));
+ buflen = sizeof(pstring);
+ len = 0;
+
+ /* store the number of subkeys */
+
+ len += tdb_pack(buffer+len, buflen-len, "d", num_subkeys);
+
+ /* pack all the strings */
+
+ for (i=0; i<num_subkeys; i++) {
+ len += tdb_pack(buffer+len, buflen-len, "f", subkeys[i]);
+ if ( len > buflen ) {
+ /* allocate some extra space */
+ if ((tmpbuf = Realloc( buffer, len*2 )) == NULL) {
+ DEBUG(0,("store_reg_keys: Failed to realloc memory of size [%d]\n", len*2));
+ ret = False;
+ goto done;
+ }
+ buffer = tmpbuf;
+ buflen = len*2;
+
+ len = tdb_pack(buffer+len, buflen-len, "f", subkeys[i]);
+ }
+ }
+
+ /* finally write out the data */
+
+ kbuf.dptr = keyname;
+ kbuf.dsize = strlen(keyname)+1;
+ dbuf.dptr = buffer;
+ dbuf.dsize = len;
+ if ( tdb_store( tdb, kbuf, dbuf, TDB_REPLACE ) == -1) {
+ ret = False;
+ goto done;
+ }
+
+done:
+ SAFE_FREE( buffer );
+ return ret;
+}
+
+/***********************************************************************
+ Retrieve an array of strings containing subkeys. Memory should be
+ released by the caller. The subkeys are stored in a catenated string
+ of null terminated character strings
+ ***********************************************************************/
+
+static int fetch_reg_keys( TDB_CONTEXT *tdb, char* key, char **subkeys )
+{
+ pstring path;
+ uint32 num_items;
+ TDB_DATA dbuf;
+ char *buf;
+ uint32 buflen, len;
+ int i;
+ char *s;
+
+
+ pstrcpy( path, key );
+
+ /* convert to key format */
+ pstring_sub( path, "\\", "/" );
+
+ dbuf = tdb_fetch_by_string( tdb, path );
+
+ buf = dbuf.dptr;
+ buflen = dbuf.dsize;
+
+ if ( !buf ) {
+ DEBUG(5,("fetch_reg_keys: Failed to fetch any subkeys for [%s]\n", key));
+ return 0;
+ }
+
+ len = tdb_unpack( buf, buflen, "d", &num_items);
+ if (num_items) {
+ if ( (*subkeys = (char*)malloc(sizeof(fstring)*num_items)) == NULL ) {
+ DEBUG(0,("fetch_reg_keys: Failed to malloc memory for subkey array containing [%d] items!\n",
+ num_items));
+ num_items = -1;
+ goto done;
+ }
+ }
+
+ s = *subkeys;
+ for (i=0; i<num_items; i++) {
+ len += tdb_unpack( buf+len, buflen-len, "f", s );
+ s += strlen(s) + 1;
+ }
+
+done:
+ SAFE_FREE(dbuf.dptr);
+ return num_items;
+}
+
+/***********************************************************************
+ count the number of subkeys dtored in the registry
+ ***********************************************************************/
+
+static int fetch_reg_keys_count( TDB_CONTEXT *tdb, char* key )
+{
+ pstring path;
+ uint32 num_items;
+ TDB_DATA dbuf;
+ char *buf;
+ uint32 buflen, len;
+
+
+ pstrcpy( path, key );
+
+ /* convert to key format */
+ pstring_sub( path, "\\", "/" );
+
+ dbuf = tdb_fetch_by_string( tdb, path );
+
+ buf = dbuf.dptr;
+ buflen = dbuf.dsize;
+
+ if ( !buf ) {
+ DEBUG(5,("fetch_reg_keys: Failed to fetch any subkeys for [%s]\n", key));
+ return 0;
+ }
+
+ len = tdb_unpack( buf, buflen, "d", &num_items);
+
+ SAFE_FREE( buf );
+
+ return num_items;
+}
+
+/***********************************************************************
+ retreive a specific subkey specified by index. The subkey parameter
+ is assumed to be an fstring.
+ ***********************************************************************/
+
+static BOOL fetch_reg_keys_specific( TDB_CONTEXT *tdb, char* key, char* subkey,
+ uint32 key_index )
+{
+ int num_subkeys, i;
+ char *subkeys = NULL;
+ char *s;
+
+ num_subkeys = fetch_reg_keys( tdb_reg, key, &subkeys );
+ if ( num_subkeys == -1 )
+ return False;
+
+ s = subkeys;
+ for ( i=0; i<num_subkeys; i++ ) {
+ /* copy the key if the index matches */
+ if ( i == key_index ) {
+ fstrcpy( subkey, s );
+ break;
+ }
+
+ /* go onto the next string */
+ s += strlen(s) + 1;
+ }
+
+ SAFE_FREE(subkeys);
+
+ return True;
+}
+
+
+/***********************************************************************
+ Open the registry database
+ ***********************************************************************/
+
+static BOOL init_registry_data( TDB_CONTEXT* registry_tdb )
+{
+ pstring keyname;
+ char *subkeys[3];
+
+ /* HKEY_LOCAL_MACHINE */
+
+ pstrcpy( keyname, KEY_HKLM );
+ subkeys[0] = "SYSTEM";
+ if ( !store_reg_keys( registry_tdb, keyname, subkeys, 1 ))
+ return False;
+
+ pstrcpy( keyname, KEY_HKLM );
+ pstrcat( keyname, "/SYSTEM" );
+ subkeys[0] = "CurrentControlSet";
+ if ( !store_reg_keys( registry_tdb, keyname, subkeys, 1 ))
+ return False;
+
+ pstrcpy( keyname, KEY_HKLM );
+ pstrcat( keyname, "/SYSTEM/CurrentControlSet" );
+ subkeys[0] = "Control";
+ subkeys[1] = "services";
+ if ( !store_reg_keys( registry_tdb, keyname, subkeys, 2 ))
+ return False;
+
+ pstrcpy( keyname, KEY_HKLM );
+ pstrcat( keyname, "/SYSTEM/CurrentControlSet/Control" );
+ subkeys[0] = "Print";
+ subkeys[1] = "ProduceOptions";
+ if ( !store_reg_keys( registry_tdb, keyname, subkeys, 2 ))
+ return False;
+
+ pstrcpy( keyname, KEY_HKLM );
+ pstrcat( keyname, "/SYSTEM/CurrentControlSet/Control/Print" );
+ subkeys[0] = "Environments";
+ subkeys[1] = "Forms";
+ subkeys[2] = "Printers";
+ if ( !store_reg_keys( registry_tdb, keyname, subkeys, 3 ))
+ return False;
+
+ pstrcpy( keyname, KEY_HKLM );
+ pstrcat( keyname, "/SYSTEM/CurrentControlSet/Control/ProductOptions" );
+ if ( !store_reg_keys( registry_tdb, keyname, subkeys, 0 ))
+ return False;
+
+ pstrcpy( keyname, KEY_HKLM );
+ pstrcat( keyname, "/SYSTEM/CurrentControlSet/services" );
+ subkeys[0] = "Netlogon";
+ if ( !store_reg_keys( registry_tdb, keyname, subkeys, 1 ))
+ return False;
+
+ pstrcpy( keyname, KEY_HKLM );
+ pstrcat( keyname, "/SYSTEM/CurrentControlSet/services/Netlogon" );
+ subkeys[0] = "parameters";
+ if ( !store_reg_keys( registry_tdb, keyname, subkeys, 1 ))
+ return False;
+
+ pstrcpy( keyname, KEY_HKLM );
+ pstrcat( keyname, "/SYSTEM/CurrentControlSet/services/Netlogon/parameters" );
+ if ( !store_reg_keys( registry_tdb, keyname, subkeys, 0 ))
+ return False;
+
+
+ /* HKEY_USER */
+
+ pstrcpy( keyname, KEY_HKU );
+ if ( !store_reg_keys( registry_tdb, keyname, subkeys, 0 ) )
+ return False;
+
+ return True;
+}
+
+/***********************************************************************
+ Open the registry database
+ ***********************************************************************/
+
+BOOL init_registry( void )
+{
+ static pid_t local_pid;
+
+
+ if (tdb_reg && local_pid == sys_getpid())
+ return True;
+
+ /*
+ * try to open first without creating so we can determine
+ * if we need to init the data in the registry
+ */
+
+ tdb_reg = tdb_open_log(lock_path("registry.tdb"), 0, TDB_DEFAULT, O_RDWR, 0600);
+ if ( !tdb_reg )
+ {
+ tdb_reg = tdb_open_log(lock_path("registry.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
+ if ( !tdb_reg ) {
+ DEBUG(0,("init_registry: Failed to open registry %s (%s)\n",
+ lock_path("registry.tdb"), strerror(errno) ));
+ return False;
+ }
+
+ DEBUG(10,("init_registry: Successfully created registry tdb\n"));
+
+ /* create the registry here */
+ if ( !init_registry_data( tdb_reg ) ) {
+ DEBUG(0,("init_registry: Failed to initiailize data in registry!\n"));
+ return False;
+ }
+ }
+
+ local_pid = sys_getpid();
+
+ return True;
+}
+
+/******************************************************************
+ Find a registry key handle and return a Registry_Key
+ *****************************************************************/
+
+static Registry_Key *find_regkey_index_by_hnd(pipes_struct *p, POLICY_HND *hnd)
+{
+ Registry_Key *regkey = NULL;
+
+ if(!find_policy_by_hnd(p,hnd,(void **)&regkey)) {
+ DEBUG(2,("find_regkey_index_by_hnd: Registry Key not found: "));
+ return NULL;
+ }
+ return regkey;
+}
+
+
+/******************************************************************
+ free() function for Registry_Key
+ *****************************************************************/
+
static void free_reg_info(void *ptr)
{
- struct reg_info *info = (struct reg_info *)ptr;
+ Registry_Key *info = (Registry_Key*)ptr;
+
+ DLIST_REMOVE(regkeys_list, info);
SAFE_FREE(info);
}
/*******************************************************************
- reg_reply_unknown_1
+ Function for open a new registry handle and creating a handle
+ Note that P should be valid & hnd should already have space
+ *******************************************************************/
+
+static BOOL open_registry_key(pipes_struct *p, POLICY_HND *hnd, char *name,
+ uint32 access_granted)
+{
+ Registry_Key *regkey = NULL;
+
+ DEBUG(7,("open_registry_key: name = [%s]\n", name));
+
+ /* All registry keys **must** have a name of non-zero length */
+
+ if (!name || !*name )
+ return False;
+
+ if ((regkey=(Registry_Key*)malloc(sizeof(Registry_Key))) == NULL)
+ return False;
+
+ ZERO_STRUCTP( regkey );
+
+ DLIST_ADD( regkeys_list, regkey );
+
+ /* copy the name and obtain a handle */
+
+ fstrcpy( regkey->name, name );
+
+ DEBUG(7,("open_registry_key: exit\n"));
+
+ return create_policy_hnd( p, hnd, free_reg_info, regkey );
+}
+
+/*******************************************************************
+ Function for open a new registry handle and creating a handle
+ Note that P should be valid & hnd should already have space
+ *******************************************************************/
+
+static BOOL close_registry_key(pipes_struct *p, POLICY_HND *hnd)
+{
+ Registry_Key *regkey = find_regkey_index_by_hnd(p, hnd);
+
+ if ( !regkey ) {
+ DEBUG(2,("close_registry_key: Invalid handle (%s:%u:%u)\n", OUR_HANDLE(hnd)));
+ return False;
+ }
+
+ close_policy_hnd(p, hnd);
+
+ return True;
+}
+
+/********************************************************************
+ retrieve information about the subkeys
+ *******************************************************************/
+
+static BOOL get_subkey_information( Registry_Key *key, uint32 *maxnum, uint32 *maxlen )
+{
+ int num_subkeys, i;
+ uint32 max_len;
+ char *subkeys = NULL;
+ uint32 len;
+ char *s;
+
+ if ( !key )
+ return False;
+
+ num_subkeys = fetch_reg_keys( tdb_reg, key->name, &subkeys );
+ if ( num_subkeys == -1 )
+ return False;
+
+ /* find the longest string */
+
+ max_len = 0;
+ s = subkeys;
+ for ( i=0; i<num_subkeys; i++ ) {
+ len = strlen(s);
+ max_len = MAX(max_len, len);
+ s += len + 1;
+ }
+
+ *maxnum = num_subkeys;
+ *maxlen = max_len*2;
+
+ SAFE_FREE(subkeys);
+
+ return True;
+}
+
+/********************************************************************
+ retrieve information about the values. We don't store values
+ here. The registry tdb is intended to be a frontend to oether
+ Samba tdb's (such as ntdrivers.tdb).
+ *******************************************************************/
+
+static BOOL get_value_information( Registry_Key *key, uint32 *maxnum,
+ uint32 *maxlen, uint32 *maxsize )
+{
+ if ( !key )
+ return False;
+
+ /* Hard coded key names first */
+ /* nothing has valuies right now */
+
+ *maxnum = 0;
+ *maxlen = 0;
+ *maxsize = 0;
+ return True;
+
+#if 0 /* JERRY */
+ /*
+ * FIXME!!! Need to add routines to look up values in other
+ * databases --jerry
+ */
+
+ return False;
+#endif
+}
+
+/********************************************************************
+ reg_close
********************************************************************/
NTSTATUS _reg_close(pipes_struct *p, REG_Q_CLOSE *q_u, REG_R_CLOSE *r_u)
@@ -48,7 +508,7 @@ NTSTATUS _reg_close(pipes_struct *p, REG_Q_CLOSE *q_u, REG_R_CLOSE *r_u)
ZERO_STRUCT(r_u->pol);
/* close the policy handle */
- if (!close_policy_hnd(p, &q_u->pol))
+ if (!close_registry_key(p, &q_u->pol))
return NT_STATUS_OBJECT_NAME_INVALID;
return NT_STATUS_OK;
@@ -58,9 +518,21 @@ NTSTATUS _reg_close(pipes_struct *p, REG_Q_CLOSE *q_u, REG_R_CLOSE *r_u)
reg_reply_open
********************************************************************/
-NTSTATUS _reg_open(pipes_struct *p, REG_Q_OPEN_HKLM *q_u, REG_R_OPEN_HKLM *r_u)
+NTSTATUS _reg_open_hklm(pipes_struct *p, REG_Q_OPEN_HKLM *q_u, REG_R_OPEN_HKLM *r_u)
+{
+ if (!open_registry_key(p, &r_u->pol, KEY_HKLM, 0x0))
+ return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+
+ return NT_STATUS_OK;
+}
+
+/*******************************************************************
+ reg_reply_open
+ ********************************************************************/
+
+NTSTATUS _reg_open_hku(pipes_struct *p, REG_Q_OPEN_HKU *q_u, REG_R_OPEN_HKU *r_u)
{
- if (!create_policy_hnd(p, &r_u->pol, free_reg_info, NULL))
+ if (!open_registry_key(p, &r_u->pol, KEY_HKU, 0x0))
return NT_STATUS_OBJECT_NAME_NOT_FOUND;
return NT_STATUS_OK;
@@ -74,34 +546,36 @@ NTSTATUS _reg_open_entry(pipes_struct *p, REG_Q_OPEN_ENTRY *q_u, REG_R_OPEN_ENTR
{
POLICY_HND pol;
fstring name;
- struct reg_info *info = NULL;
+ pstring path;
+ int num_subkeys;
+ Registry_Key *key = find_regkey_index_by_hnd(p, &q_u->pol);
- DEBUG(5,("reg_open_entry: %d\n", __LINE__));
+ DEBUG(5,("reg_open_entry: Enter\n"));
- if (!find_policy_by_hnd(p, &q_u->pol, NULL))
+ if ( !key )
return NT_STATUS_INVALID_HANDLE;
rpcstr_pull(name,q_u->uni_name.buffer,sizeof(name),q_u->uni_name.uni_str_len*2,0);
- DEBUG(5,("reg_open_entry: %s\n", name));
-
- /* lkcl XXXX do a check on the name, here */
- if (!strequal(name, "SYSTEM\\CurrentControlSet\\Control\\ProductOptions") &&
- !strequal(name, "System\\CurrentControlSet\\services\\Netlogon\\parameters\\"))
- return NT_STATUS_ACCESS_DENIED;
+ /* store the full path in the regkey_list */
+
+ pstrcpy( path, key->name );
+ pstrcat( path, "\\" );
+ pstrcat( path, name );
- if ((info = (struct reg_info *)malloc(sizeof(struct reg_info))) == NULL)
- return NT_STATUS_NO_MEMORY;
+ DEBUG(5,("reg_open_entry: %s\n", path));
- ZERO_STRUCTP(info);
- fstrcpy(info->name, name);
+ /* do a check on the name, here */
+
+ if ( (num_subkeys=fetch_reg_keys_count( tdb_reg, path )) == -1 )
+ return NT_STATUS_ACCESS_DENIED;
- if (!create_policy_hnd(p, &pol, free_reg_info, (void *)info))
- return NT_STATUS_TOO_MANY_SECRETS; /* ha ha very droll */
+ if (!open_registry_key(p, &pol, path, 0x0))
+ return NT_STATUS_TOO_MANY_SECRETS;
init_reg_r_open_entry(r_u, &pol, NT_STATUS_OK);
- DEBUG(5,("reg_open_entry: %d\n", __LINE__));
+ DEBUG(5,("reg_open_entry: Exitn"));
return r_u->status;
}
@@ -113,21 +587,23 @@ NTSTATUS _reg_open_entry(pipes_struct *p, REG_Q_OPEN_ENTRY *q_u, REG_R_OPEN_ENTR
NTSTATUS _reg_info(pipes_struct *p, REG_Q_INFO *q_u, REG_R_INFO *r_u)
{
NTSTATUS status = NT_STATUS_OK;
- char *key = NULL;
- uint32 type=0x1; /* key type: REG_SZ */
-
+ char *value = NULL;
+ uint32 type = 0x1; /* key type: REG_SZ */
UNISTR2 *uni_key = NULL;
BUFFER2 *buf = NULL;
fstring name;
+ Registry_Key *key = find_regkey_index_by_hnd( p, &q_u->pol );
- DEBUG(5,("_reg_info: %d\n", __LINE__));
+ DEBUG(5,("_reg_info: Enter\n"));
- if (!find_policy_by_hnd(p, &q_u->pol, NULL))
+ if ( !key )
return NT_STATUS_INVALID_HANDLE;
+
+ DEBUG(7,("_reg_info: policy key name = [%s]\n", key->name));
rpcstr_pull(name, q_u->uni_type.buffer, sizeof(name), q_u->uni_type.uni_str_len*2, 0);
- DEBUG(5,("reg_info: checking key: %s\n", name));
+ DEBUG(5,("reg_info: checking subkey: %s\n", name));
uni_key = (UNISTR2 *)talloc_zero(p->mem_ctx, sizeof(UNISTR2));
buf = (BUFFER2 *)talloc_zero(p->mem_ctx, sizeof(BUFFER2));
@@ -147,33 +623,126 @@ NTSTATUS _reg_info(pipes_struct *p, REG_Q_INFO *q_u, REG_R_INFO *r_u)
}
switch (lp_server_role()) {
- case ROLE_DOMAIN_PDC:
- case ROLE_DOMAIN_BDC:
- key = "LanmanNT";
- break;
- case ROLE_STANDALONE:
- key = "ServerNT";
- break;
- case ROLE_DOMAIN_MEMBER:
- key = "WinNT";
- break;
+ case ROLE_DOMAIN_PDC:
+ case ROLE_DOMAIN_BDC:
+ value = "LanmanNT";
+ break;
+ case ROLE_STANDALONE:
+ value = "ServerNT";
+ break;
+ case ROLE_DOMAIN_MEMBER:
+ value = "WinNT";
+ break;
}
/* This makes the server look like a member server to clients */
/* which tells clients that we have our own local user and */
/* group databases and helps with ACL support. */
- init_unistr2(uni_key, key, strlen(key)+1);
+ init_unistr2(uni_key, value, strlen(value)+1);
init_buffer2(buf, (uint8*)uni_key->buffer, uni_key->uni_str_len*2);
out:
init_reg_r_info(q_u->ptr_buf, r_u, buf, type, status);
- DEBUG(5,("reg_open_entry: %d\n", __LINE__));
+ DEBUG(5,("reg_open_entry: Exit\n"));
+
+ return status;
+}
+
+
+/*****************************************************************************
+ Implementation of REG_QUERY_KEY
+ ****************************************************************************/
+
+NTSTATUS _reg_query_key(pipes_struct *p, REG_Q_QUERY_KEY *q_u, REG_R_QUERY_KEY *r_u)
+{
+ NTSTATUS status = NT_STATUS_OK;
+ Registry_Key *regkey = find_regkey_index_by_hnd( p, &q_u->pol );
+
+ DEBUG(5,("_reg_query_key: Enter\n"));
+
+ if ( !regkey )
+ return NT_STATUS_INVALID_HANDLE;
+
+ if ( !get_subkey_information( regkey, &r_u->num_subkeys, &r_u->max_subkeylen ) )
+ return NT_STATUS_ACCESS_DENIED;
+
+ if ( !get_value_information( regkey, &r_u->num_values, &r_u->max_valnamelen, &r_u->max_valbufsize ) )
+ return NT_STATUS_ACCESS_DENIED;
+
+ r_u->sec_desc = 0x00000078; /* size for key's sec_desc */
+
+ /* Win9x set this to 0x0 since it does not keep timestamps.
+ Doing the same here for simplicity --jerry */
+
+ ZERO_STRUCT(r_u->mod_time);
+
+ DEBUG(5,("_reg_query_key: Exit\n"));
+
+ return status;
+}
+
+
+/*****************************************************************************
+ Implementation of REG_UNKNOWN_1A
+ ****************************************************************************/
+
+NTSTATUS _reg_unknown_1a(pipes_struct *p, REG_Q_UNKNOWN_1A *q_u, REG_R_UNKNOWN_1A *r_u)
+{
+ NTSTATUS status = NT_STATUS_OK;
+ Registry_Key *regkey = find_regkey_index_by_hnd( p, &q_u->pol );
+
+ DEBUG(5,("_reg_unknown_1a: Enter\n"));
+
+ if ( !regkey )
+ return NT_STATUS_INVALID_HANDLE;
+
+ r_u->unknown = 0x00000005; /* seems to be consistent...no idea what it means */
+
+ DEBUG(5,("_reg_unknown_1a: Exit\n"));
+
+ return status;
+}
+
+/*****************************************************************************
+ Implementation of REG_ENUM_KEY
+ ****************************************************************************/
+
+NTSTATUS _reg_enum_key(pipes_struct *p, REG_Q_ENUM_KEY *q_u, REG_R_ENUM_KEY *r_u)
+{
+ NTSTATUS status = NT_STATUS_OK;
+ Registry_Key *regkey = find_regkey_index_by_hnd( p, &q_u->pol );
+ fstring subkey;
+
+
+ DEBUG(5,("_reg_enum_key: Enter\n"));
+
+ if ( !regkey )
+ return NT_STATUS_INVALID_HANDLE;
+
+ DEBUG(8,("_reg_enum_key: enumerating key [%s]\n", regkey->name));
+
+ if ( !fetch_reg_keys_specific( tdb_reg, regkey->name, subkey, q_u->key_index ) )
+ {
+ status = werror_to_ntstatus( WERR_NO_MORE_ITEMS );
+ goto done;
+ }
+
+ DEBUG(10,("_reg_enum_key: retrieved subkey named [%s]\n", subkey));
+
+ /* subkey has the string name now */
+
+ init_reg_r_enum_key( r_u, subkey, q_u->unknown_1, q_u->unknown_2 );
+
+ DEBUG(5,("_reg_enum_key: Exit\n"));
+
+done:
return status;
}
+
/*******************************************************************
reg_shutdwon
********************************************************************/
@@ -219,6 +788,10 @@ NTSTATUS _reg_shutdown(pipes_struct *p, REG_Q_SHUTDOWN *q_u, REG_R_SHUTDOWN *r_u
return status;
}
+/*******************************************************************
+ reg_abort_shutdwon
+ ********************************************************************/
+
NTSTATUS _reg_abort_shutdown(pipes_struct *p, REG_Q_ABORT_SHUTDOWN *q_u, REG_R_ABORT_SHUTDOWN *r_u)
{
NTSTATUS status = NT_STATUS_OK;
@@ -234,3 +807,5 @@ NTSTATUS _reg_abort_shutdown(pipes_struct *p, REG_Q_ABORT_SHUTDOWN *q_u, REG_R_A
return status;
}
+
+
diff --git a/source3/rpc_server/srv_samr.c b/source3/rpc_server/srv_samr.c
index c555305bce..f002a7d1c9 100644
--- a/source3/rpc_server/srv_samr.c
+++ b/source3/rpc_server/srv_samr.c
@@ -32,6 +32,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
/*******************************************************************
api_samr_close_hnd
********************************************************************/
@@ -124,6 +127,37 @@ static BOOL api_samr_get_usrdom_pwinfo(pipes_struct *p)
}
/*******************************************************************
+ api_samr_set_sec_obj
+ ********************************************************************/
+
+static BOOL api_samr_set_sec_obj(pipes_struct *p)
+{
+ SAMR_Q_SET_SEC_OBJ q_u;
+ SAMR_R_SET_SEC_OBJ r_u;
+
+ prs_struct *data = &p->in_data.data;
+ prs_struct *rdata = &p->out_data.rdata;
+
+ ZERO_STRUCT(q_u);
+ ZERO_STRUCT(r_u);
+
+ if(!samr_io_q_set_sec_obj("", &q_u, data, 0)) {
+ DEBUG(0,("api_samr_set_sec_obj: unable to unmarshall SAMR_Q_SET_SEC_OBJ.\n"));
+ return False;
+ }
+
+ r_u.status = _samr_set_sec_obj(p, &q_u, &r_u);
+
+ if(!samr_io_r_set_sec_obj("", &r_u, rdata, 0)) {
+ DEBUG(0,("api_samr_set_sec_obj: unable to marshall SAMR_R_SET_SEC_OBJ.\n"));
+ return False;
+ }
+
+
+ return True;
+}
+
+/*******************************************************************
api_samr_query_sec_obj
********************************************************************/
@@ -1427,6 +1461,7 @@ static struct api_struct api_samr_cmds [] =
{"SAMR_LOOKUP_DOMAIN" , SAMR_LOOKUP_DOMAIN , api_samr_lookup_domain },
{"SAMR_QUERY_SEC_OBJECT" , SAMR_QUERY_SEC_OBJECT , api_samr_query_sec_obj },
+ {"SAMR_SET_SEC_OBJECT" , SAMR_SET_SEC_OBJECT , api_samr_set_sec_obj },
{"SAMR_GET_USRDOM_PWINFO" , SAMR_GET_USRDOM_PWINFO, api_samr_get_usrdom_pwinfo},
{"SAMR_UNKNOWN_2E" , SAMR_UNKNOWN_2E , api_samr_unknown_2e },
{"SAMR_SET_DOMAIN_INFO" , SAMR_SET_DOMAIN_INFO , api_samr_set_dom_info },
diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 106d7c1923..88d728d810 100644
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -29,9 +29,11 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
extern fstring global_myworkgroup;
extern pstring global_myname;
-extern DOM_SID global_sam_sid;
extern DOM_SID global_sid_Builtin;
extern rid_name domain_group_rids[];
@@ -52,9 +54,69 @@ struct samr_info {
/* for use by the \PIPE\samr policy */
DOM_SID sid;
uint32 status; /* some sort of flag. best to record it. comes from opnum 0x39 */
+ uint32 acc_granted;
DISP_INFO disp_info;
+
+ TALLOC_CTX *mem_ctx;
};
+struct generic_mapping sam_generic_mapping = {SAMR_READ, SAMR_WRITE, SAMR_EXECUTE, SAMR_ALL_ACCESS};
+struct generic_mapping dom_generic_mapping = {DOMAIN_READ, DOMAIN_WRITE, DOMAIN_EXECUTE, DOMAIN_ALL_ACCESS};
+struct generic_mapping usr_generic_mapping = {USER_READ, USER_WRITE, USER_EXECUTE, USER_ALL_ACCESS};
+struct generic_mapping grp_generic_mapping = {GROUP_READ, GROUP_WRITE, GROUP_EXECUTE, GROUP_ALL_ACCESS};
+struct generic_mapping ali_generic_mapping = {ALIAS_READ, ALIAS_WRITE, ALIAS_EXECUTE, ALIAS_ALL_ACCESS};
+
+static NTSTATUS samr_make_dom_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *d_size);
+
+
+/*******************************************************************
+ Checks if access to an object should be granted, and returns that
+ level of access for further checks.
+********************************************************************/
+
+NTSTATUS access_check_samr_object(SEC_DESC *psd, NT_USER_TOKEN *nt_user_token, uint32 des_access,
+ uint32 *acc_granted, const char *debug)
+{
+ NTSTATUS status = NT_STATUS_ACCESS_DENIED;
+
+ if (!se_access_check(psd, nt_user_token, des_access, acc_granted, &status)) {
+ if (geteuid() == sec_initial_uid()) {
+ DEBUG(4,("%s: ACCESS should be DENIED (requested: %#010x)\n",
+ debug, des_access));
+ DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
+ status = NT_STATUS_OK;
+ }
+ else {
+ DEBUG(2,("%s: ACCESS DENIED (requested: %#010x)\n",
+ debug, des_access));
+ }
+ }
+ return status;
+}
+
+/*******************************************************************
+ Checks if access to a function can be granted
+********************************************************************/
+
+NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
+{
+ DEBUG(5,("%s: access check ((granted: %#010x; required: %#010x)\n",
+ debug, acc_granted, acc_required));
+ if ((acc_granted & acc_required) != acc_required) {
+ if (geteuid() == sec_initial_uid()) {
+ DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
+ debug, acc_granted, acc_required));
+ DEBUGADD(4,("but overwritten by euid == 0\n"));
+ return NT_STATUS_OK;
+ }
+ DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: %#010x)\n",
+ debug, acc_granted, acc_required));
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ return NT_STATUS_OK;
+}
+
+
/*******************************************************************
Create a samr_info struct.
********************************************************************/
@@ -63,17 +125,27 @@ static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
{
struct samr_info *info;
fstring sid_str;
+ TALLOC_CTX *mem_ctx;
+
+ if (psid) {
+ sid_to_string(sid_str, psid);
+ } else {
+ fstrcpy(sid_str,"(NULL)");
+ }
+
+ mem_ctx = talloc_init_named("samr_info for domain sid %s", sid_str);
- if ((info = (struct samr_info *)malloc(sizeof(struct samr_info))) == NULL)
+ if ((info = (struct samr_info *)talloc(mem_ctx, sizeof(struct samr_info))) == NULL)
return NULL;
ZERO_STRUCTP(info);
+ DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
if (psid) {
- DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_to_string(sid_str, psid) ));
sid_copy( &info->sid, psid);
} else {
DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
}
+ info->mem_ctx = mem_ctx;
return info;
}
@@ -84,18 +156,13 @@ static void free_samr_db(struct samr_info *info)
{
int i;
- if (info->disp_info.group_dbloaded) {
- for (i=0; i<info->disp_info.num_group_account; i++)
- SAFE_FREE(info->disp_info.disp_group_info[i].grp);
-
- SAFE_FREE(info->disp_info.disp_group_info);
- }
+ /* Groups are talloced */
if (info->disp_info.user_dbloaded){
- for (i=0; i<info->disp_info.num_user_account; i++)
+ for (i=0; i<info->disp_info.num_user_account; i++) {
+ /* Not really a free, actually a 'clear' */
pdb_free_sam(&info->disp_info.disp_user_info[i].sam);
-
- SAFE_FREE(info->disp_info.disp_user_info);
+ }
}
info->disp_info.user_dbloaded=False;
@@ -110,26 +177,13 @@ static void free_samr_info(void *ptr)
struct samr_info *info=(struct samr_info *) ptr;
free_samr_db(info);
- SAFE_FREE(info);
+ talloc_destroy(info->mem_ctx);
}
/*******************************************************************
Ensure password info is never given out. Paranioa... JRA.
********************************************************************/
-static void samr_clear_passwd_fields( SAM_USER_INFO_21 *pass, int num_entries)
-{
- int i;
-
- if (!pass)
- return;
-
- for (i = 0; i < num_entries; i++) {
- memset(&pass[i].lm_pwd, '\0', sizeof(pass[i].lm_pwd));
- memset(&pass[i].nt_pwd, '\0', sizeof(pass[i].nt_pwd));
- }
-}
-
static void samr_clear_sam_passwd(SAM_ACCOUNT *sam_pass)
{
@@ -147,6 +201,8 @@ static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask)
{
SAM_ACCOUNT *pwd = NULL;
DISP_USER_INFO *pwd_array = NULL;
+ NTSTATUS nt_status = NT_STATUS_OK;
+ TALLOC_CTX *mem_ctx = info->mem_ctx;
DEBUG(10,("load_sampwd_entries\n"));
@@ -161,7 +217,8 @@ static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask)
return NT_STATUS_ACCESS_DENIED;
}
- for (pdb_init_sam(&pwd); pdb_getsampwent(pwd) == True; pwd=NULL, pdb_init_sam(&pwd) ) {
+ for (; (NT_STATUS_IS_OK(nt_status = pdb_init_sam_talloc(mem_ctx, &pwd)))
+ && pdb_getsampwent(pwd) == True; pwd=NULL) {
if (acb_mask != 0 && !(pdb_get_acct_ctrl(pwd) & acb_mask)) {
pdb_free_sam(&pwd);
@@ -173,7 +230,7 @@ static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask)
if (info->disp_info.num_user_account % MAX_SAM_ENTRIES == 0) {
DEBUG(10,("load_sampwd_entries: allocating more memory\n"));
- pwd_array=(DISP_USER_INFO *)Realloc(info->disp_info.disp_user_info,
+ pwd_array=(DISP_USER_INFO *)talloc_realloc(mem_ctx, info->disp_info.disp_user_info,
(info->disp_info.num_user_account+MAX_SAM_ENTRIES)*sizeof(DISP_USER_INFO));
if (pwd_array==NULL)
@@ -198,7 +255,7 @@ static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask)
DEBUG(12,("load_sampwd_entries: done\n"));
- return NT_STATUS_OK;
+ return nt_status;
}
static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid)
@@ -207,6 +264,7 @@ static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid)
DISP_GROUP_INFO *grp_array = NULL;
uint32 group_entries = 0;
uint32 i;
+ TALLOC_CTX *mem_ctx = info->mem_ctx;
DEBUG(10,("load_group_domain_entries\n"));
@@ -216,11 +274,13 @@ static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid)
return NT_STATUS_OK;
}
- enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV);
+ if (!enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV)) {
+ return NT_STATUS_NO_MEMORY;
+ }
info->disp_info.num_group_account=group_entries;
- grp_array=(DISP_GROUP_INFO *)malloc(info->disp_info.num_group_account*sizeof(DISP_GROUP_INFO));
+ grp_array=(DISP_GROUP_INFO *)talloc(mem_ctx, info->disp_info.num_group_account*sizeof(DISP_GROUP_INFO));
if (group_entries!=0 && grp_array==NULL) {
SAFE_FREE(map);
@@ -231,7 +291,7 @@ static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid)
for (i=0; i<group_entries; i++) {
- grp_array[i].grp=(DOMAIN_GRP *)malloc(sizeof(DOMAIN_GRP));
+ grp_array[i].grp=(DOMAIN_GRP *)talloc(mem_ctx, sizeof(DOMAIN_GRP));
fstrcpy(grp_array[i].grp->name, map[i].nt_name);
fstrcpy(grp_array[i].grp->comment, map[i].comment);
@@ -252,84 +312,6 @@ static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid)
/*******************************************************************
- This next function should be replaced with something that
- dynamically returns the correct user info..... JRA.
- ********************************************************************/
-
-static NTSTATUS get_sampwd_entries(SAM_USER_INFO_21 *pw_buf, int start_idx,
- int *total_entries, int *num_entries,
- int max_num_entries, uint16 acb_mask)
-{
- SAM_ACCOUNT *pwd = NULL;
- BOOL not_finished = True;
-
- (*num_entries) = 0;
- (*total_entries) = 0;
-
- if (pw_buf == NULL)
- return NT_STATUS_NO_MEMORY;
-
- pdb_init_sam(&pwd);
-
- if (!pdb_setsampwent(False)) {
- DEBUG(0, ("get_sampwd_entries: Unable to open passdb.\n"));
- pdb_free_sam(&pwd);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- while (((not_finished = pdb_getsampwent(pwd)) != False)
- && (*num_entries) < max_num_entries)
- {
- int user_name_len;
-
- if (start_idx > 0) {
-
- pdb_reset_sam(pwd);
-
- /* skip the requested number of entries.
- not very efficient, but hey... */
- start_idx--;
- continue;
- }
-
- user_name_len = strlen(pdb_get_username(pwd))+1;
- init_unistr2(&pw_buf[(*num_entries)].uni_user_name, pdb_get_username(pwd), user_name_len);
- init_uni_hdr(&pw_buf[(*num_entries)].hdr_user_name, user_name_len);
- pw_buf[(*num_entries)].user_rid = pdb_get_user_rid(pwd);
- memset((char *)pw_buf[(*num_entries)].nt_pwd, '\0', 16);
-
- /* Now check if the NT compatible password is available. */
- if (pdb_get_nt_passwd(pwd))
- memcpy( pw_buf[(*num_entries)].nt_pwd , pdb_get_nt_passwd(pwd), 16);
-
- pw_buf[(*num_entries)].acb_info = pdb_get_acct_ctrl(pwd);
-
- DEBUG(5, ("entry idx: %d user %s, rid 0x%x, acb %x",
- (*num_entries), pdb_get_username(pwd), pdb_get_user_rid(pwd), pdb_get_acct_ctrl(pwd) ));
-
- if (acb_mask == 0 || (pdb_get_acct_ctrl(pwd) & acb_mask)) {
- DEBUG(5,(" acb_mask %x accepts\n", acb_mask));
- (*num_entries)++;
- } else {
- DEBUG(5,(" acb_mask %x rejects\n", acb_mask));
- }
-
- (*total_entries)++;
-
- pdb_reset_sam(pwd);
-
- }
-
- pdb_endsampwent();
- pdb_free_sam(&pwd);
-
- if (not_finished)
- return STATUS_MORE_ENTRIES;
- else
- return NT_STATUS_OK;
-}
-
-/*******************************************************************
_samr_close_hnd
********************************************************************/
@@ -352,17 +334,37 @@ NTSTATUS _samr_close_hnd(pipes_struct *p, SAMR_Q_CLOSE_HND *q_u, SAMR_R_CLOSE_HN
NTSTATUS _samr_open_domain(pipes_struct *p, SAMR_Q_OPEN_DOMAIN *q_u, SAMR_R_OPEN_DOMAIN *r_u)
{
- struct samr_info *info;
+ struct samr_info *info;
+ SEC_DESC *psd = NULL;
+ uint32 acc_granted;
+ uint32 des_access = q_u->flags;
+ size_t sd_size;
+ NTSTATUS status;
r_u->status = NT_STATUS_OK;
/* find the connection policy handle. */
- if (!find_policy_by_hnd(p, &q_u->pol, NULL))
+ if (!find_policy_by_hnd(p, &q_u->pol, (void**)&info))
return NT_STATUS_INVALID_HANDLE;
+ if (!NT_STATUS_IS_OK(status = access_check_samr_function(info->acc_granted, SAMR_ACCESS_OPEN_DOMAIN,"_samr_open_domain"))) {
+ return status;
+ }
+
+ /*check if access can be granted as requested by client. */
+ samr_make_dom_obj_sd(p->mem_ctx, &psd, &sd_size);
+ se_map_generic(&des_access,&dom_generic_mapping);
+
+ if (!NT_STATUS_IS_OK(status =
+ access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ des_access, &acc_granted, "_samr_open_domain"))) {
+ return status;
+ }
+
/* associate the domain SID with the (unique) handle. */
if ((info = get_samr_info_by_sid(&q_u->dom_sid.sid))==NULL)
return NT_STATUS_NO_MEMORY;
+ info->acc_granted = acc_granted;
/* get a (unique) handle. open a policy on it. */
if (!create_policy_hnd(p, &r_u->domain_pol, free_samr_info, (void *)info))
@@ -402,11 +404,90 @@ NTSTATUS _samr_get_usrdom_pwinfo(pipes_struct *p, SAMR_Q_GET_USRDOM_PWINFO *q_u,
return r_u->status;
}
+
+/*******************************************************************
+ samr_make_sam_obj_sd
+ ********************************************************************/
+
+static NTSTATUS samr_make_sam_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
+{
+ extern DOM_SID global_sid_World;
+ DOM_SID adm_sid;
+ DOM_SID act_sid;
+
+ SEC_ACE ace[3];
+ SEC_ACCESS mask;
+
+ SEC_ACL *psa = NULL;
+
+ sid_copy(&adm_sid, &global_sid_Builtin);
+ sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
+
+ sid_copy(&act_sid, &global_sid_Builtin);
+ sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
+
+ /*basic access for every one*/
+ init_sec_access(&mask, SAMR_EXECUTE | SAMR_READ);
+ init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+
+ /*full access for builtin aliases Administrators and Account Operators*/
+ init_sec_access(&mask, SAMR_ALL_ACCESS);
+ init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+ init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+
+ if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
+ return NT_STATUS_NO_MEMORY;
+
+ if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, sd_size)) == NULL)
+ return NT_STATUS_NO_MEMORY;
+
+ return NT_STATUS_OK;
+}
+
+/*******************************************************************
+ samr_make_dom_obj_sd
+ ********************************************************************/
+
+static NTSTATUS samr_make_dom_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
+{
+ extern DOM_SID global_sid_World;
+ DOM_SID adm_sid;
+ DOM_SID act_sid;
+
+ SEC_ACE ace[3];
+ SEC_ACCESS mask;
+
+ SEC_ACL *psa = NULL;
+
+ sid_copy(&adm_sid, &global_sid_Builtin);
+ sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
+
+ sid_copy(&act_sid, &global_sid_Builtin);
+ sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
+
+ /*basic access for every one*/
+ init_sec_access(&mask, DOMAIN_EXECUTE | DOMAIN_READ);
+ init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+
+ /*full access for builtin aliases Administrators and Account Operators*/
+ init_sec_access(&mask, DOMAIN_ALL_ACCESS);
+ init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+ init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+
+ if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
+ return NT_STATUS_NO_MEMORY;
+
+ if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, sd_size)) == NULL)
+ return NT_STATUS_NO_MEMORY;
+
+ return NT_STATUS_OK;
+}
+
/*******************************************************************
samr_make_usr_obj_sd
********************************************************************/
-static NTSTATUS samr_make_usr_obj_sd(TALLOC_CTX *ctx, SEC_DESC_BUF **buf, DOM_SID *usr_sid)
+static NTSTATUS samr_make_usr_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size, DOM_SID *usr_sid)
{
extern DOM_SID global_sid_World;
DOM_SID adm_sid;
@@ -416,8 +497,6 @@ static NTSTATUS samr_make_usr_obj_sd(TALLOC_CTX *ctx, SEC_DESC_BUF **buf, DOM_SI
SEC_ACCESS mask;
SEC_ACL *psa = NULL;
- SEC_DESC *psd = NULL;
- size_t sd_size;
sid_copy(&adm_sid, &global_sid_Builtin);
sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
@@ -425,29 +504,107 @@ static NTSTATUS samr_make_usr_obj_sd(TALLOC_CTX *ctx, SEC_DESC_BUF **buf, DOM_SI
sid_copy(&act_sid, &global_sid_Builtin);
sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
- init_sec_access(&mask, 0x2035b);
+ /*basic access for every one*/
+ init_sec_access(&mask, USER_EXECUTE | USER_READ);
init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
- init_sec_access(&mask, 0xf07ff);
+ /*full access for builtin aliases Administrators and Account Operators*/
+ init_sec_access(&mask, USER_ALL_ACCESS);
init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
- init_sec_access(&mask,0x20044);
+ /*extended access for the user*/
+ init_sec_access(&mask,READ_CONTROL_ACCESS | USER_ACCESS_CHANGE_PASSWORD | USER_ACCESS_SET_LOC_COM);
init_sec_ace(&ace[3], usr_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
- if((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 4, ace)) == NULL)
+ if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 4, ace)) == NULL)
+ return NT_STATUS_NO_MEMORY;
+
+ if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, sd_size)) == NULL)
return NT_STATUS_NO_MEMORY;
- if((psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, &sd_size)) == NULL)
+ return NT_STATUS_OK;
+}
+
+/*******************************************************************
+ samr_make_grp_obj_sd
+ ********************************************************************/
+
+static NTSTATUS samr_make_grp_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
+{
+ extern DOM_SID global_sid_World;
+ DOM_SID adm_sid;
+ DOM_SID act_sid;
+
+ SEC_ACE ace[3];
+ SEC_ACCESS mask;
+
+ SEC_ACL *psa = NULL;
+
+ sid_copy(&adm_sid, &global_sid_Builtin);
+ sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
+
+ sid_copy(&act_sid, &global_sid_Builtin);
+ sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
+
+ /*basic access for every one*/
+ init_sec_access(&mask, GROUP_EXECUTE | GROUP_READ);
+ init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+
+ /*full access for builtin aliases Administrators and Account Operators*/
+ init_sec_access(&mask, GROUP_ALL_ACCESS);
+ init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+ init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+
+ if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
return NT_STATUS_NO_MEMORY;
- if((*buf = make_sec_desc_buf(ctx, sd_size, psd)) == NULL)
+ if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, sd_size)) == NULL)
return NT_STATUS_NO_MEMORY;
return NT_STATUS_OK;
}
-static BOOL get_lsa_policy_samr_sid(pipes_struct *p, POLICY_HND *pol, DOM_SID *sid)
+/*******************************************************************
+ samr_make_ali_obj_sd
+ ********************************************************************/
+
+static NTSTATUS samr_make_ali_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
+{
+ extern DOM_SID global_sid_World;
+ DOM_SID adm_sid;
+ DOM_SID act_sid;
+
+ SEC_ACE ace[3];
+ SEC_ACCESS mask;
+
+ SEC_ACL *psa = NULL;
+
+ sid_copy(&adm_sid, &global_sid_Builtin);
+ sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
+
+ sid_copy(&act_sid, &global_sid_Builtin);
+ sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
+
+ /*basic access for every one*/
+ init_sec_access(&mask, ALIAS_EXECUTE | ALIAS_READ);
+ init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+
+ /*full access for builtin aliases Administrators and Account Operators*/
+ init_sec_access(&mask, ALIAS_ALL_ACCESS);
+ init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+ init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
+
+ if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
+ return NT_STATUS_NO_MEMORY;
+
+ if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, sd_size)) == NULL)
+ return NT_STATUS_NO_MEMORY;
+
+ return NT_STATUS_OK;
+}
+
+static BOOL get_lsa_policy_samr_sid(pipes_struct *p, POLICY_HND *pol, DOM_SID *sid, uint32 *acc_granted)
{
struct samr_info *info = NULL;
@@ -459,10 +616,22 @@ static BOOL get_lsa_policy_samr_sid(pipes_struct *p, POLICY_HND *pol, DOM_SID *s
return False;
*sid = info->sid;
+ *acc_granted = info->acc_granted;
return True;
}
/*******************************************************************
+ _samr_set_sec_obj
+ ********************************************************************/
+
+NTSTATUS _samr_set_sec_obj(pipes_struct *p, SAMR_Q_SET_SEC_OBJ *q_u, SAMR_R_SET_SEC_OBJ *r_u)
+{
+ DEBUG(0,("_samr_set_sec_obj: Not yet implemented!\n"));
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+
+/*******************************************************************
_samr_query_sec_obj
********************************************************************/
@@ -470,17 +639,52 @@ NTSTATUS _samr_query_sec_obj(pipes_struct *p, SAMR_Q_QUERY_SEC_OBJ *q_u, SAMR_R_
{
DOM_SID pol_sid;
fstring str_sid;
+ SEC_DESC * psd = NULL;
+ size_t sd_size;
+ uint32 acc_granted;
r_u->status = NT_STATUS_OK;
/* Get the SID. */
-
- if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &pol_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &pol_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+
+
DEBUG(10,("_samr_query_sec_obj: querying security on SID: %s\n", sid_to_string(str_sid, &pol_sid)));
- r_u->status = samr_make_usr_obj_sd(p->mem_ctx, &r_u->buf, &pol_sid);
+ /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
+
+ /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
+ if (pol_sid.sid_rev_num == 0)
+ {
+ DEBUG(5,("_samr_query_sec_obj: querying security on SAM\n"));
+ r_u->status = samr_make_sam_obj_sd(p->mem_ctx, &psd, &sd_size);
+ }
+ else if (sid_equal(&pol_sid,get_global_sam_sid())) /* check if it is our domain SID */
+
+ {
+ DEBUG(5,("_samr_query_sec_obj: querying security on Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
+ r_u->status = samr_make_dom_obj_sd(p->mem_ctx, &psd, &sd_size);
+ }
+ else if (sid_equal(&pol_sid,&global_sid_Builtin)) /* check if it is the Builtin Domain */
+ {
+ /* TODO: Builtin probably needs a different SD with restricted write access*/
+ DEBUG(5,("_samr_query_sec_obj: querying security on Builtin Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
+ r_u->status = samr_make_dom_obj_sd(p->mem_ctx, &psd, &sd_size);
+ }
+ else if (sid_check_is_in_our_domain(&pol_sid) ||
+ sid_check_is_in_builtin(&pol_sid))
+ {
+ /* TODO: different SDs have to be generated for aliases groups and users.
+ Currently all three get a default user SD */
+ DEBUG(10,("_samr_query_sec_obj: querying security on Object with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
+ r_u->status = samr_make_usr_obj_sd(p->mem_ctx, &psd,&sd_size, &pol_sid);
+ }
+ else return NT_STATUS_OBJECT_TYPE_MISMATCH;
+
+ if ((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
+ return NT_STATUS_NO_MEMORY;
if (NT_STATUS_IS_OK(r_u->status))
r_u->ptr = 1;
@@ -492,69 +696,123 @@ NTSTATUS _samr_query_sec_obj(pipes_struct *p, SAMR_Q_QUERY_SEC_OBJ *q_u, SAMR_R_
makes a SAM_ENTRY / UNISTR2* structure from a user list.
********************************************************************/
-static void make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UNISTR2 **uni_name_pp,
- uint32 num_sam_entries, SAM_USER_INFO_21 *pass)
+static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UNISTR2 **uni_name_pp,
+ uint32 num_entries, uint32 start_idx, DISP_USER_INFO *disp_user_info,
+ DOM_SID *domain_sid)
{
uint32 i;
SAM_ENTRY *sam;
UNISTR2 *uni_name;
-
+ SAM_ACCOUNT *pwd = NULL;
+ UNISTR2 uni_temp_name;
+ const char *temp_name;
+ const DOM_SID *user_sid;
+ uint32 user_rid;
+ fstring user_sid_string;
+ fstring domain_sid_string;
+
*sam_pp = NULL;
*uni_name_pp = NULL;
- if (num_sam_entries == 0)
- return;
+ if (num_entries == 0)
+ return NT_STATUS_OK;
- sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
+ sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_entries);
- uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
+ uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_entries);
if (sam == NULL || uni_name == NULL) {
- DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
- return;
+ DEBUG(0, ("make_user_sam_entry_list: talloc_zero failed!\n"));
+ return NT_STATUS_NO_MEMORY;
}
- ZERO_STRUCTP(sam);
- ZERO_STRUCTP(uni_name);
-
- for (i = 0; i < num_sam_entries; i++) {
- int len = pass[i].uni_user_name.uni_str_len;
+ for (i = 0; i < num_entries; i++) {
+ int len = uni_temp_name.uni_str_len;
+
+ pwd = disp_user_info[i+start_idx].sam;
+ temp_name = pdb_get_username(pwd);
+ init_unistr2(&uni_temp_name, temp_name, strlen(temp_name)+1);
+ user_sid = pdb_get_user_sid(pwd);
+
+ if (!sid_peek_check_rid(domain_sid, user_sid, &user_rid)) {
+ DEBUG(0, ("make_user_sam_entry_list: User %s has SID %s, which conflicts with "
+ "the domain sid %s. Failing operation.\n",
+ temp_name,
+ sid_to_string(user_sid_string, user_sid),
+ sid_to_string(domain_sid_string, domain_sid)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
- init_sam_entry(&sam[i], len, pass[i].user_rid);
- copy_unistr2(&uni_name[i], &pass[i].uni_user_name);
+ init_sam_entry(&sam[i], len, user_rid);
+ copy_unistr2(&uni_name[i], &uni_temp_name);
}
*sam_pp = sam;
*uni_name_pp = uni_name;
+ return NT_STATUS_OK;
}
/*******************************************************************
samr_reply_enum_dom_users
********************************************************************/
-NTSTATUS _samr_enum_dom_users(pipes_struct *p, SAMR_Q_ENUM_DOM_USERS *q_u, SAMR_R_ENUM_DOM_USERS *r_u)
+NTSTATUS _samr_enum_dom_users(pipes_struct *p, SAMR_Q_ENUM_DOM_USERS *q_u,
+ SAMR_R_ENUM_DOM_USERS *r_u)
{
- SAM_USER_INFO_21 pass[MAX_SAM_ENTRIES];
- int num_entries = 0;
- int total_entries = 0;
+ struct samr_info *info = NULL;
+ uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
+ int num_account;
+ uint32 enum_context=q_u->start_idx;
+ uint32 max_size=q_u->max_size;
+ uint32 temp_size;
+ enum remote_arch_types ra_type = get_remote_arch();
+ int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
+ uint32 max_entries = max_sam_entries;
+ DOM_SID domain_sid;
r_u->status = NT_STATUS_OK;
/* find the policy handle. open a policy on it. */
- if (!find_policy_by_hnd(p, &q_u->pol, NULL))
+ if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
return NT_STATUS_INVALID_HANDLE;
+ domain_sid = info->sid;
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
+ DOMAIN_ACCESS_ENUM_ACCOUNTS,
+ "_samr_enum_dom_users"))) {
+ return r_u->status;
+ }
+
DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
become_root();
- r_u->status = get_sampwd_entries(pass, q_u->start_idx, &total_entries, &num_entries,
- MAX_SAM_ENTRIES, q_u->acb_mask);
+ r_u->status=load_sampwd_entries(info, q_u->acb_mask);
unbecome_root();
-
- if (NT_STATUS_IS_ERR(r_u->status))
+
+ if (!NT_STATUS_IS_OK(r_u->status))
return r_u->status;
- samr_clear_passwd_fields(pass, num_entries);
+ num_account = info->disp_info.num_user_account;
+
+ if (enum_context > num_account) {
+ DEBUG(5, ("_samr_enum_dom_users: enumeration handle over total entries\n"));
+ return NT_STATUS_OK;
+ }
+
+ /* verify we won't overflow */
+ if (max_entries > num_account-enum_context) {
+ max_entries = num_account-enum_context;
+ DEBUG(5, ("_samr_enum_dom_users: only %d entries to return\n", max_entries));
+ }
+
+ /* calculate the size and limit on the number of entries we will return */
+ temp_size=max_entries*struct_size;
+
+ if (temp_size>max_size) {
+ max_entries=MIN((max_size/struct_size),max_entries);;
+ DEBUG(5, ("_samr_enum_dom_users: buffer size limits to only %d entries\n", max_entries));
+ }
/*
* Note from JRA. total_entries is not being used here. Currently if there is a
@@ -569,9 +827,20 @@ NTSTATUS _samr_enum_dom_users(pipes_struct *p, SAMR_Q_ENUM_DOM_USERS *q_u, SAMR_
* value (again I think this is wrong).
*/
- make_user_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_acct_name, num_entries, pass);
+ r_u->status = make_user_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_acct_name,
+ max_entries, enum_context,
+ info->disp_info.disp_user_info,
+ &domain_sid);
- init_samr_r_enum_dom_users(r_u, q_u->start_idx + num_entries, num_entries);
+ if (!NT_STATUS_IS_OK(r_u->status))
+ return r_u->status;
+
+ if (enum_context+max_entries < num_account)
+ r_u->status = STATUS_MORE_ENTRIES;
+
+ DEBUG(5, ("_samr_enum_dom_users: %d\n", __LINE__));
+
+ init_samr_r_enum_dom_users(r_u, q_u->start_idx + max_entries, max_entries);
DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
@@ -654,13 +923,12 @@ static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM
}
SAFE_FREE(map);
- } else if (sid_equal(sid, &global_sam_sid) && !lp_hide_local_users()) {
+ } else if (sid_equal(sid, get_global_sam_sid()) && !lp_hide_local_users()) {
struct sys_grent *glist;
struct sys_grent *grp;
struct passwd *pw;
gid_t winbind_gid_low, winbind_gid_high;
-
- lp_winbind_gid(&winbind_gid_low, &winbind_gid_high);
+ BOOL winbind_groups_exist = lp_winbind_gid(&winbind_gid_low, &winbind_gid_high);
/* local aliases */
/* we return the UNIX groups here. This seems to be the right */
@@ -690,24 +958,15 @@ static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM
continue;
/* Don't return winbind groups as they are not local! */
- if ((grp->gr_gid >= winbind_gid_low)&&(grp->gr_gid <= winbind_gid_high)) {
+ if (winbind_groups_exist && (grp->gr_gid >= winbind_gid_low)&&(grp->gr_gid <= winbind_gid_high)) {
DEBUG(10,("get_group_alias_entries: not returing %s, not local.\n", smap.nt_name ));
continue;
}
/* Don't return user private groups... */
-
- /*
- * We used to do a Get_Pwnam() here, but this has been
- * trimmed back to the common case for private groups
- * to save lookups and to use the _alloc interface.
- *
- * This also matches the group mapping code
- */
- if ((pw = getpwnam_alloc(smap.nt_name)) != 0) {
+ if ((pw = Get_Pwnam(smap.nt_name)) != 0) {
DEBUG(10,("get_group_alias_entries: not returing %s, clashes with user.\n", smap.nt_name ));
- passwd_free(&pw);
continue;
}
@@ -808,11 +1067,16 @@ NTSTATUS _samr_enum_dom_groups(pipes_struct *p, SAMR_Q_ENUM_DOM_GROUPS *q_u, SAM
DOMAIN_GRP *grp=NULL;
uint32 num_entries;
DOM_SID sid;
+ uint32 acc_granted;
r_u->status = NT_STATUS_OK;
- if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_ENUM_ACCOUNTS, "_samr_enum_dom_groups"))) {
+ return r_u->status;
+ }
DEBUG(5,("samr_reply_enum_dom_groups: %d\n", __LINE__));
@@ -840,12 +1104,17 @@ NTSTATUS _samr_enum_dom_aliases(pipes_struct *p, SAMR_Q_ENUM_DOM_ALIASES *q_u, S
fstring sid_str;
DOM_SID sid;
NTSTATUS status;
+ uint32 acc_granted;
r_u->status = NT_STATUS_OK;
- if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_ENUM_ACCOUNTS, "_samr_enum_dom_aliases"))) {
+ return r_u->status;
+ }
+
sid_to_string(sid_str, &sid);
DEBUG(5,("samr_reply_enum_dom_aliases: sid %s\n", sid_str));
@@ -867,7 +1136,8 @@ NTSTATUS _samr_enum_dom_aliases(pipes_struct *p, SAMR_Q_ENUM_DOM_ALIASES *q_u, S
/*******************************************************************
samr_reply_query_dispinfo
********************************************************************/
-NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_R_QUERY_DISPINFO *r_u)
+NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
+ SAMR_R_QUERY_DISPINFO *r_u)
{
struct samr_info *info = NULL;
uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
@@ -882,9 +1152,8 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
NTSTATUS disp_ret;
uint32 num_account = 0;
enum remote_arch_types ra_type = get_remote_arch();
- int max_sam_entries;
-
- max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
+ int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
+ DOM_SID domain_sid;
DEBUG(5, ("samr_reply_query_dispinfo: %d\n", __LINE__));
r_u->status = NT_STATUS_OK;
@@ -893,6 +1162,8 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
return NT_STATUS_INVALID_HANDLE;
+ domain_sid = info->sid;
+
/*
* calculate how many entries we will return.
* based on
@@ -936,7 +1207,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
become_root();
r_u->status=load_sampwd_entries(info, acb_mask);
unbecome_root();
- if (NT_STATUS_IS_ERR(r_u->status)) {
+ if (!NT_STATUS_IS_OK(r_u->status)) {
DEBUG(5, ("_samr_query_dispinfo: load_sampwd_entries failed\n"));
return r_u->status;
}
@@ -945,7 +1216,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
case 0x3:
case 0x5:
r_u->status = load_group_domain_entries(info, &info->sid);
- if (NT_STATUS_IS_ERR(r_u->status))
+ if (!NT_STATUS_IS_OK(r_u->status))
return r_u->status;
num_account = info->disp_info.num_group_account;
break;
@@ -962,7 +1233,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
if (enum_context > num_account) {
DEBUG(5, ("samr_reply_query_dispinfo: enumeration handle over total entries\n"));
- return NT_STATUS_OK;
+ return NT_STATUS_NO_MORE_ENTRIES;
}
/* verify we won't overflow */
@@ -991,8 +1262,9 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
if (!(ctr->sam.info1 = (SAM_DISPINFO_1 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_1))))
return NT_STATUS_NO_MEMORY;
}
- disp_ret = init_sam_dispinfo_1(p->mem_ctx, ctr->sam.info1, max_entries, enum_context, info->disp_info.disp_user_info);
- if (NT_STATUS_IS_ERR(disp_ret))
+ disp_ret = init_sam_dispinfo_1(p->mem_ctx, ctr->sam.info1, max_entries, enum_context,
+ info->disp_info.disp_user_info, &domain_sid);
+ if (!NT_STATUS_IS_OK(disp_ret))
return disp_ret;
break;
case 0x2:
@@ -1000,8 +1272,9 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
if (!(ctr->sam.info2 = (SAM_DISPINFO_2 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_2))))
return NT_STATUS_NO_MEMORY;
}
- disp_ret = init_sam_dispinfo_2(p->mem_ctx, ctr->sam.info2, max_entries, enum_context, info->disp_info.disp_user_info);
- if (NT_STATUS_IS_ERR(disp_ret))
+ disp_ret = init_sam_dispinfo_2(p->mem_ctx, ctr->sam.info2, max_entries, enum_context,
+ info->disp_info.disp_user_info, &domain_sid);
+ if (!NT_STATUS_IS_OK(disp_ret))
return disp_ret;
break;
case 0x3:
@@ -1010,7 +1283,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
return NT_STATUS_NO_MEMORY;
}
disp_ret = init_sam_dispinfo_3(p->mem_ctx, ctr->sam.info3, max_entries, enum_context, info->disp_info.disp_group_info);
- if (NT_STATUS_IS_ERR(disp_ret))
+ if (!NT_STATUS_IS_OK(disp_ret))
return disp_ret;
break;
case 0x4:
@@ -1019,7 +1292,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
return NT_STATUS_NO_MEMORY;
}
disp_ret = init_sam_dispinfo_4(p->mem_ctx, ctr->sam.info4, max_entries, enum_context, info->disp_info.disp_user_info);
- if (NT_STATUS_IS_ERR(disp_ret))
+ if (!NT_STATUS_IS_OK(disp_ret))
return disp_ret;
break;
case 0x5:
@@ -1028,7 +1301,7 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
return NT_STATUS_NO_MEMORY;
}
disp_ret = init_sam_dispinfo_5(p->mem_ctx, ctr->sam.info5, max_entries, enum_context, info->disp_info.disp_group_info);
- if (NT_STATUS_IS_ERR(disp_ret))
+ if (!NT_STATUS_IS_OK(disp_ret))
return disp_ret;
break;
@@ -1057,22 +1330,26 @@ NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_
NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAMR_R_QUERY_ALIASINFO *r_u)
{
- struct samr_info *info = NULL;
+ DOM_SID sid;
GROUP_MAP map;
+ uint32 acc_granted;
r_u->status = NT_STATUS_OK;
DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
/* find the policy handle. open a policy on it. */
- if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, ALIAS_ACCESS_LOOKUP_INFO, "_samr_query_aliasinfo"))) {
+ return r_u->status;
+ }
- if (!sid_check_is_in_our_domain(&info->sid) &&
- !sid_check_is_in_builtin(&info->sid))
+ if (!sid_check_is_in_our_domain(&sid) &&
+ !sid_check_is_in_builtin(&sid))
return NT_STATUS_OBJECT_TYPE_MISMATCH;
- if(!get_local_group_from_sid(info->sid, &map, MAPPING_WITHOUT_PRIV))
+ if (!get_local_group_from_sid(sid, &map, MAPPING_WITHOUT_PRIV))
return NT_STATUS_NO_SUCH_ALIAS;
switch (q_u->switch_level) {
@@ -1169,6 +1446,7 @@ NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LO
int num_rids = q_u->num_names2;
DOM_SID pol_sid;
fstring sid_str;
+ uint32 acc_granted;
r_u->status = NT_STATUS_OK;
@@ -1177,10 +1455,14 @@ NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LO
ZERO_ARRAY(rid);
ZERO_ARRAY(type);
- if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid)) {
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted)) {
init_samr_r_lookup_names(p->mem_ctx, r_u, 0, NULL, NULL, NT_STATUS_OBJECT_TYPE_MISMATCH);
return r_u->status;
}
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, 0, "_samr_lookup_names"))) { /* Don't know the acc_bits yet */
+ return r_u->status;
+ }
if (num_rids > MAX_SAM_ENTRIES) {
num_rids = MAX_SAM_ENTRIES;
@@ -1324,13 +1606,14 @@ NTSTATUS _samr_lookup_rids(pipes_struct *p, SAMR_Q_LOOKUP_RIDS *q_u, SAMR_R_LOOK
DOM_SID pol_sid;
int num_rids = q_u->num_rids1;
int i;
+ uint32 acc_granted;
r_u->status = NT_STATUS_OK;
DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
/* find the policy handle. open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (num_rids > MAX_SAM_ENTRIES) {
@@ -1356,7 +1639,7 @@ NTSTATUS _samr_lookup_rids(pipes_struct *p, SAMR_Q_LOOKUP_RIDS *q_u, SAMR_R_LOOK
group_attrs[i] = SID_NAME_UNKNOWN;
*group_names[i] = '\0';
- if (sid_equal(&pol_sid, &global_sam_sid)) {
+ if (sid_equal(&pol_sid, get_global_sam_sid())) {
sid_copy(&sid, &pol_sid);
sid_append_rid(&sid, q_u->rid[i]);
@@ -1390,42 +1673,58 @@ NTSTATUS _api_samr_open_user(pipes_struct *p, SAMR_Q_OPEN_USER *q_u, SAMR_R_OPEN
SAM_ACCOUNT *sampass=NULL;
DOM_SID sid;
POLICY_HND domain_pol = q_u->domain_pol;
- uint32 user_rid = q_u->user_rid;
POLICY_HND *user_pol = &r_u->user_pol;
struct samr_info *info = NULL;
+ SEC_DESC *psd = NULL;
+ uint32 acc_granted;
+ uint32 des_access = q_u->access_mask;
+ size_t sd_size;
BOOL ret;
+ NTSTATUS nt_status;
r_u->status = NT_STATUS_OK;
- /* find the domain policy handle. */
- if (!find_policy_by_hnd(p, &domain_pol, NULL))
+ /* find the domain policy handle and get domain SID / access bits in the domain policy. */
+ if (!get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+
+ if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_OPEN_ACCOUNT, "_samr_open_user"))) {
+ return nt_status;
+ }
- pdb_init_sam(&sampass);
+ nt_status = pdb_init_sam_talloc(p->mem_ctx, &sampass);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+
+ /* append the user's RID to it */
+ if (!sid_append_rid(&sid, q_u->user_rid))
+ return NT_STATUS_NO_SUCH_USER;
+
+ /* check if access can be granted as requested by client. */
+ samr_make_usr_obj_sd(p->mem_ctx, &psd, &sd_size, &sid);
+ se_map_generic(&des_access, &usr_generic_mapping);
+ if (!NT_STATUS_IS_OK(nt_status =
+ access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ des_access, &acc_granted, "_samr_open_user"))) {
+ return nt_status;
+ }
become_root();
- ret=pdb_getsampwrid(sampass, user_rid);
+ ret=pdb_getsampwsid(sampass, &sid);
unbecome_root();
- /* check that the RID exists in our domain. */
+ /* check that the SID exists in our domain. */
if (ret == False) {
- pdb_free_sam(&sampass);
return NT_STATUS_NO_SUCH_USER;
}
pdb_free_sam(&sampass);
- /* Get the domain SID stored in the domain policy */
- if(!get_lsa_policy_samr_sid(p, &domain_pol, &sid))
- return NT_STATUS_INVALID_HANDLE;
-
- /* append the user's RID to it */
- if(!sid_append_rid(&sid, user_rid))
- return NT_STATUS_NO_SUCH_USER;
-
- /* associate the user's SID with the new handle. */
+ /* associate the user's SID and access bits with the new handle. */
if ((info = get_samr_info_by_sid(&sid)) == NULL)
return NT_STATUS_NO_MEMORY;
+ info->acc_granted = acc_granted;
/* get a (unique) handle. open a policy on it. */
if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info))
@@ -1438,21 +1737,25 @@ NTSTATUS _api_samr_open_user(pipes_struct *p, SAMR_Q_OPEN_USER *q_u, SAMR_R_OPEN
get_user_info_10. Safe. Only gives out acb bits.
*************************************************************************/
-static BOOL get_user_info_10(SAM_USER_INFO_10 *id10, uint32 user_rid)
+static NTSTATUS get_user_info_10(TALLOC_CTX *mem_ctx, SAM_USER_INFO_10 *id10, DOM_SID *user_sid)
{
SAM_ACCOUNT *smbpass=NULL;
BOOL ret;
+ NTSTATUS nt_status;
- pdb_init_sam(&smbpass);
+ nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
+
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
become_root();
- ret = pdb_getsampwrid(smbpass, user_rid);
+ ret = pdb_getsampwsid(smbpass, user_sid);
unbecome_root();
if (ret==False) {
- DEBUG(4,("User 0x%x not found\n", user_rid));
- pdb_free_sam(&smbpass);
- return False;
+ DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
+ return NT_STATUS_NO_SUCH_USER;
}
DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
@@ -1462,7 +1765,7 @@ static BOOL get_user_info_10(SAM_USER_INFO_10 *id10, uint32 user_rid)
pdb_free_sam(&smbpass);
- return True;
+ return NT_STATUS_OK;
}
/*************************************************************************
@@ -1471,10 +1774,11 @@ static BOOL get_user_info_10(SAM_USER_INFO_10 *id10, uint32 user_rid)
user. JRA.
*************************************************************************/
-static NTSTATUS get_user_info_12(pipes_struct *p, SAM_USER_INFO_12 * id12, uint32 user_rid)
+static NTSTATUS get_user_info_12(pipes_struct *p, TALLOC_CTX *mem_ctx, SAM_USER_INFO_12 * id12, DOM_SID *user_sid)
{
SAM_ACCOUNT *smbpass=NULL;
BOOL ret;
+ NTSTATUS nt_status;
if (!p->ntlmssp_auth_validated)
return NT_STATUS_ACCESS_DENIED;
@@ -1485,12 +1789,17 @@ static NTSTATUS get_user_info_12(pipes_struct *p, SAM_USER_INFO_12 * id12, uint3
/*
* Do *NOT* do become_root()/unbecome_root() here ! JRA.
*/
- pdb_init_sam(&smbpass);
- ret = pdb_getsampwrid(smbpass, user_rid);
+ nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
+
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+
+ ret = pdb_getsampwsid(smbpass, user_sid);
if (ret == False) {
- DEBUG(4, ("User 0x%x not found\n", user_rid));
+ DEBUG(4, ("User %s not found\n", sid_string_static(user_sid)));
pdb_free_sam(&smbpass);
return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
}
@@ -1514,21 +1823,20 @@ static NTSTATUS get_user_info_12(pipes_struct *p, SAM_USER_INFO_12 * id12, uint3
get_user_info_20
*************************************************************************/
-static BOOL get_user_info_20(SAM_USER_INFO_20 *id20, uint32 user_rid)
+static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx, SAM_USER_INFO_20 *id20, DOM_SID *user_sid)
{
SAM_ACCOUNT *sampass=NULL;
BOOL ret;
- pdb_init_sam(&sampass);
+ pdb_init_sam_talloc(mem_ctx, &sampass);
become_root();
- ret = pdb_getsampwrid(sampass, user_rid);
+ ret = pdb_getsampwsid(sampass, user_sid);
unbecome_root();
if (ret == False) {
- DEBUG(4,("User 0x%x not found\n", user_rid));
- pdb_free_sam(&sampass);
- return False;
+ DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
+ return NT_STATUS_NO_SUCH_USER;
}
samr_clear_sam_passwd(sampass);
@@ -1540,28 +1848,32 @@ static BOOL get_user_info_20(SAM_USER_INFO_20 *id20, uint32 user_rid)
pdb_free_sam(&sampass);
- return True;
+ return NT_STATUS_OK;
}
/*************************************************************************
get_user_info_21
*************************************************************************/
-static BOOL get_user_info_21(SAM_USER_INFO_21 *id21, uint32 user_rid)
+static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx, SAM_USER_INFO_21 *id21,
+ DOM_SID *user_sid, DOM_SID *domain_sid)
{
SAM_ACCOUNT *sampass=NULL;
BOOL ret;
+ NTSTATUS nt_status;
- pdb_init_sam(&sampass);
+ nt_status = pdb_init_sam_talloc(mem_ctx, &sampass);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
become_root();
- ret = pdb_getsampwrid(sampass, user_rid);
+ ret = pdb_getsampwsid(sampass, user_sid);
unbecome_root();
if (ret == False) {
- DEBUG(4,("User 0x%x not found\n", user_rid));
- pdb_free_sam(&sampass);
- return False;
+ DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
+ return NT_STATUS_NO_SUCH_USER;
}
samr_clear_sam_passwd(sampass);
@@ -1569,11 +1881,11 @@ static BOOL get_user_info_21(SAM_USER_INFO_21 *id21, uint32 user_rid)
DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
ZERO_STRUCTP(id21);
- init_sam_user_info21A(id21, sampass);
+ nt_status = init_sam_user_info21A(id21, sampass, domain_sid);
pdb_free_sam(&sampass);
- return True;
+ return NT_STATUS_OK;
}
/*******************************************************************
@@ -1583,21 +1895,24 @@ static BOOL get_user_info_21(SAM_USER_INFO_21 *id21, uint32 user_rid)
NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_R_QUERY_USERINFO *r_u)
{
SAM_USERINFO_CTR *ctr;
- uint32 rid = 0;
struct samr_info *info = NULL;
-
+ DOM_SID domain_sid;
+ uint32 rid;
+
r_u->status=NT_STATUS_OK;
/* search for the handle */
if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
return NT_STATUS_INVALID_HANDLE;
+ domain_sid = info->sid;
+
+ sid_split_rid(&domain_sid, &rid);
+
if (!sid_check_is_in_our_domain(&info->sid))
return NT_STATUS_OBJECT_TYPE_MISMATCH;
- sid_peek_rid(&info->sid, &rid);
-
- DEBUG(5,("_samr_query_userinfo: rid:0x%x\n", rid));
+ DEBUG(5,("_samr_query_userinfo: sid:%s\n", sid_string_static(&info->sid)));
ctr = (SAM_USERINFO_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_USERINFO_CTR));
if (!ctr)
@@ -1614,8 +1929,8 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
if (ctr->info.id10 == NULL)
return NT_STATUS_NO_MEMORY;
- if (!get_user_info_10(ctr->info.id10, rid))
- return NT_STATUS_NO_SUCH_USER;
+ if (!NT_STATUS_IS_OK(r_u->status = get_user_info_10(p->mem_ctx, ctr->info.id10, &info->sid)))
+ return r_u->status;
break;
#if 0
@@ -1649,24 +1964,25 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
if (ctr->info.id12 == NULL)
return NT_STATUS_NO_MEMORY;
- if (NT_STATUS_IS_ERR(r_u->status = get_user_info_12(p, ctr->info.id12, rid)))
+ if (!NT_STATUS_IS_OK(r_u->status = get_user_info_12(p, p->mem_ctx, ctr->info.id12, &info->sid)))
return r_u->status;
break;
-
+
case 20:
ctr->info.id20 = (SAM_USER_INFO_20 *)talloc_zero(p->mem_ctx,sizeof(SAM_USER_INFO_20));
if (ctr->info.id20 == NULL)
return NT_STATUS_NO_MEMORY;
- if (!get_user_info_20(ctr->info.id20, rid))
- return NT_STATUS_NO_SUCH_USER;
+ if (!NT_STATUS_IS_OK(r_u->status = get_user_info_20(p->mem_ctx, ctr->info.id20, &info->sid)))
+ return r_u->status;
break;
case 21:
ctr->info.id21 = (SAM_USER_INFO_21 *)talloc_zero(p->mem_ctx,sizeof(SAM_USER_INFO_21));
if (ctr->info.id21 == NULL)
return NT_STATUS_NO_MEMORY;
- if (!get_user_info_21(ctr->info.id21, rid))
- return NT_STATUS_NO_SUCH_USER;
+ if (!NT_STATUS_IS_OK(r_u->status = get_user_info_21(p->mem_ctx, ctr->info.id21,
+ &info->sid, &domain_sid)))
+ return r_u->status;
break;
default:
@@ -1676,7 +1992,7 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
init_samr_r_query_userinfo(r_u, ctr, r_u->status);
DEBUG(5,("_samr_query_userinfo: %d\n", __LINE__));
-
+
return r_u->status;
}
@@ -1687,10 +2003,10 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, SAMR_R_QUERY_USERGROUPS *r_u)
{
SAM_ACCOUNT *sam_pass=NULL;
+ DOM_SID sid;
DOM_GID *gids = NULL;
int num_groups = 0;
- uint32 rid;
- struct samr_info *info = NULL;
+ uint32 acc_granted;
BOOL ret;
/*
@@ -1710,37 +2026,39 @@ NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, S
DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
/* find the policy handle. open a policy on it. */
- if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, USER_ACCESS_GET_GROUPS, "_samr_query_usergroups"))) {
+ return r_u->status;
+ }
- if (!sid_check_is_in_our_domain(&info->sid))
+ if (!sid_check_is_in_our_domain(&sid))
return NT_STATUS_OBJECT_TYPE_MISMATCH;
- sid_peek_rid(&info->sid, &rid);
-
pdb_init_sam(&sam_pass);
-
+
become_root();
- ret = pdb_getsampwrid(sam_pass, rid);
+ ret = pdb_getsampwsid(sam_pass, &sid);
unbecome_root();
if (ret == False) {
pdb_free_sam(&sam_pass);
return NT_STATUS_NO_SUCH_USER;
}
-
+
if(!get_domain_user_groups(p->mem_ctx, &num_groups, &gids, sam_pass)) {
pdb_free_sam(&sam_pass);
return NT_STATUS_NO_SUCH_GROUP;
}
-
+
/* construct the response. lkclXXXX: gids are not copied! */
init_samr_r_query_usergroups(r_u, num_groups, gids, r_u->status);
-
+
DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
pdb_free_sam(&sam_pass);
-
+
return r_u->status;
}
@@ -1771,13 +2089,13 @@ NTSTATUS _samr_query_dom_info(pipes_struct *p, SAMR_Q_QUERY_DOMAIN_INFO *q_u, SA
ZERO_STRUCTP(ctr);
r_u->status = NT_STATUS_OK;
-
+
DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__));
-
+
/* find the policy handle. open a policy on it. */
if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
return NT_STATUS_INVALID_HANDLE;
-
+
switch (q_u->switch_value) {
case 0x01:
account_policy_get(AP_MIN_PASSWORD_LEN, &min_pass_len);
@@ -1796,15 +2114,15 @@ NTSTATUS _samr_query_dom_info(pipes_struct *p, SAMR_Q_QUERY_DOMAIN_INFO *q_u, SA
become_root();
r_u->status=load_sampwd_entries(info, ACB_NORMAL);
unbecome_root();
- if (NT_STATUS_IS_ERR(r_u->status)) {
+ if (!NT_STATUS_IS_OK(r_u->status)) {
DEBUG(5, ("_samr_query_dispinfo: load_sampwd_entries failed\n"));
return r_u->status;
}
num_users=info->disp_info.num_user_account;
free_samr_db(info);
- r_u->status=load_group_domain_entries(info, &global_sam_sid);
- if (NT_STATUS_IS_ERR(r_u->status)) {
+ r_u->status=load_group_domain_entries(info, get_global_sam_sid());
+ if (!NT_STATUS_IS_OK(r_u->status)) {
DEBUG(5, ("_samr_query_dispinfo: load_group_domain_entries failed\n"));
return r_u->status;
}
@@ -1842,12 +2160,12 @@ NTSTATUS _samr_query_dom_info(pipes_struct *p, SAMR_Q_QUERY_DOMAIN_INFO *q_u, SA
break;
default:
return NT_STATUS_INVALID_INFO_CLASS;
- }
-
+ }
+
init_samr_r_query_dom_info(r_u, q_u->switch_value, ctr, NT_STATUS_OK);
-
+
DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__));
-
+
return r_u->status;
}
@@ -1871,11 +2189,19 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_
BOOL ret;
NTSTATUS nt_status;
struct passwd *pw;
+ uint32 acc_granted;
+ SEC_DESC *psd;
+ size_t sd_size;
+ uint32 des_access;
- /* find the policy handle. open a policy on it. */
- if (!find_policy_by_hnd(p, &dom_pol, NULL))
+ /* Get the domain SID stored in the domain policy */
+ if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+ if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_CREATE_USER, "_samr_create_user"))) {
+ return nt_status;
+ }
+
/* find the account: tell the caller if it exists.
lkclXXXX i have *no* idea if this is a problem or not
or even if you are supposed to construct a different
@@ -1944,7 +2270,7 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_
else
pstrcpy(add_script, lp_adduser_script());
- if(*add_script) {
+ if (*add_script) {
int add_ret;
all_string_sub(add_script, "%u", account, sizeof(account));
add_ret = smbrun(add_script,NULL);
@@ -1990,16 +2316,15 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_
return NT_STATUS_ACCESS_DENIED;
}
- /* Get the domain SID stored in the domain policy */
- if(!get_lsa_policy_samr_sid(p, &dom_pol, &sid)) {
- pdb_free_sam(&sam_pass);
- return NT_STATUS_INVALID_HANDLE;
- }
-
- /* append the user's RID to it */
- if(!sid_append_rid(&sid, pdb_get_user_rid(sam_pass) )) {
- pdb_free_sam(&sam_pass);
- return NT_STATUS_NO_SUCH_USER;
+ /* Get the user's SID */
+ sid_copy(&sid, pdb_get_user_sid(sam_pass));
+
+ samr_make_usr_obj_sd(p->mem_ctx, &psd, &sd_size, &sid);
+ se_map_generic(&des_access, &usr_generic_mapping);
+ if (!NT_STATUS_IS_OK(nt_status =
+ access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ des_access, &acc_granted, "_samr_create_user"))) {
+ return nt_status;
}
/* associate the user's SID with the new handle. */
@@ -2010,6 +2335,7 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_
ZERO_STRUCTP(info);
info->sid = sid;
+ info->acc_granted = acc_granted;
/* get a (unique) handle. open a policy on it. */
if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info)) {
@@ -2033,21 +2359,29 @@ NTSTATUS _samr_connect_anon(pipes_struct *p, SAMR_Q_CONNECT_ANON *q_u, SAMR_R_CO
{
struct samr_info *info = NULL;
- /* set up the SAMR connect_anon response */
+ /* Access check */
- r_u->status = NT_STATUS_OK;
+ if (!pipe_access_check(p)) {
+ DEBUG(3, ("access denied to samr_connect_anon\n"));
+ r_u->status = NT_STATUS_ACCESS_DENIED;
+ return r_u->status;
+ }
- /* associate the user's SID with the new handle. */
- if ((info = get_samr_info_by_sid(NULL)) == NULL)
- return NT_STATUS_NO_MEMORY;
+ /* set up the SAMR connect_anon response */
- info->status = q_u->unknown_0;
+ r_u->status = NT_STATUS_OK;
- /* get a (unique) handle. open a policy on it. */
- if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
- return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ /* associate the user's SID with the new handle. */
+ if ((info = get_samr_info_by_sid(NULL)) == NULL)
+ return NT_STATUS_NO_MEMORY;
- return r_u->status;
+ info->status = q_u->unknown_0;
+
+ /* get a (unique) handle. open a policy on it. */
+ if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
+ return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+
+ return r_u->status;
}
/*******************************************************************
@@ -2057,24 +2391,47 @@ NTSTATUS _samr_connect_anon(pipes_struct *p, SAMR_Q_CONNECT_ANON *q_u, SAMR_R_CO
NTSTATUS _samr_connect(pipes_struct *p, SAMR_Q_CONNECT *q_u, SAMR_R_CONNECT *r_u)
{
struct samr_info *info = NULL;
+ SEC_DESC *psd = NULL;
+ uint32 acc_granted;
+ uint32 des_access = q_u->access_mask;
+ size_t sd_size;
+ NTSTATUS nt_status;
- DEBUG(5,("_samr_connect: %d\n", __LINE__));
- r_u->status = NT_STATUS_OK;
+ DEBUG(5,("_samr_connect: %d\n", __LINE__));
+
+ /* Access check */
+
+ if (!pipe_access_check(p)) {
+ DEBUG(3, ("access denied to samr_connect\n"));
+ r_u->status = NT_STATUS_ACCESS_DENIED;
+ return r_u->status;
+ }
+
+ samr_make_sam_obj_sd(p->mem_ctx, &psd, &sd_size);
+ se_map_generic(&des_access, &sam_generic_mapping);
+ if (!NT_STATUS_IS_OK(nt_status =
+ access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ des_access, &acc_granted, "_samr_connect"))) {
+ return nt_status;
+ }
- /* associate the user's SID with the new handle. */
+ r_u->status = NT_STATUS_OK;
+
+ /* associate the user's SID and access granted with the new handle. */
if ((info = get_samr_info_by_sid(NULL)) == NULL)
- return NT_STATUS_NO_MEMORY;
+ return NT_STATUS_NO_MEMORY;
- info->status = q_u->access_mask;
+ info->acc_granted = acc_granted;
+ info->status = q_u->access_mask;
- /* get a (unique) handle. open a policy on it. */
- if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
- return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ /* get a (unique) handle. open a policy on it. */
+ if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
+ return NT_STATUS_OBJECT_NAME_NOT_FOUND;
- DEBUG(5,("_samr_connect: %d\n", __LINE__));
+ DEBUG(5,("_samr_connect: %d\n", __LINE__));
- return r_u->status;
+ return r_u->status;
}
/**********************************************************************
@@ -2083,14 +2440,19 @@ NTSTATUS _samr_connect(pipes_struct *p, SAMR_Q_CONNECT *q_u, SAMR_R_CONNECT *r_u
NTSTATUS _samr_lookup_domain(pipes_struct *p, SAMR_Q_LOOKUP_DOMAIN *q_u, SAMR_R_LOOKUP_DOMAIN *r_u)
{
+ struct samr_info *info;
fstring domain_name;
DOM_SID sid;
r_u->status = NT_STATUS_OK;
- if (!find_policy_by_hnd(p, &q_u->connect_pol, NULL))
+ if (!find_policy_by_hnd(p, &q_u->connect_pol, (void**)&info))
return NT_STATUS_INVALID_HANDLE;
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SAMR_ACCESS_OPEN_DOMAIN, "_samr_lookup_domain"))) {
+ return r_u->status;
+ }
+
rpcstr_pull(domain_name, q_u->uni_domain.buffer, sizeof(domain_name), q_u->uni_domain.uni_str_len*2, 0);
ZERO_STRUCT(sid);
@@ -2150,11 +2512,19 @@ static BOOL make_enum_domains(TALLOC_CTX *ctx, SAM_ENTRY **pp_sam,
NTSTATUS _samr_enum_domains(pipes_struct *p, SAMR_Q_ENUM_DOMAINS *q_u, SAMR_R_ENUM_DOMAINS *r_u)
{
+ struct samr_info *info;
uint32 num_entries = 2;
fstring dom[2];
char *name;
r_u->status = NT_STATUS_OK;
+
+ if (!find_policy_by_hnd(p, &q_u->pol, (void**)&info))
+ return NT_STATUS_INVALID_HANDLE;
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SAMR_ACCESS_ENUM_DOMAINS, "_samr_enum_domains"))) {
+ return r_u->status;
+ }
switch (lp_server_role()) {
case ROLE_DOMAIN_PDC:
@@ -2187,21 +2557,35 @@ NTSTATUS _api_samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OP
POLICY_HND domain_pol = q_u->dom_pol;
uint32 alias_rid = q_u->rid_alias;
POLICY_HND *alias_pol = &r_u->pol;
- struct samr_info *info = NULL;
+ struct samr_info *info = NULL;
+ SEC_DESC *psd = NULL;
+ uint32 acc_granted;
+ uint32 des_access = q_u->access_mask;
+ size_t sd_size;
+ NTSTATUS status;
r_u->status = NT_STATUS_OK;
- /* get the domain policy. */
- if (!find_policy_by_hnd(p, &domain_pol, NULL))
- return NT_STATUS_INVALID_HANDLE;
-
- /* Get the domain SID stored in the domain policy */
- if(!get_lsa_policy_samr_sid(p, &domain_pol, &sid))
+ /* find the domain policy and get the SID / access bits stored in the domain policy */
+ if (!get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+
+ if (!NT_STATUS_IS_OK(status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_OPEN_ACCOUNT, "_samr_open_alias"))) {
+ return status;
+ }
/* append the alias' RID to it */
- if(!sid_append_rid(&sid, alias_rid))
+ if (!sid_append_rid(&sid, alias_rid))
return NT_STATUS_NO_SUCH_USER;
+
+ /*check if access can be granted as requested by client. */
+ samr_make_ali_obj_sd(p->mem_ctx, &psd, &sd_size);
+ se_map_generic(&des_access,&ali_generic_mapping);
+ if (!NT_STATUS_IS_OK(status =
+ access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ des_access, &acc_granted, "_samr_open_alias"))) {
+ return status;
+ }
/*
* we should check if the rid really exist !!!
@@ -2211,6 +2595,8 @@ NTSTATUS _api_samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OP
/* associate the user's SID with the new handle. */
if ((info = get_samr_info_by_sid(&sid)) == NULL)
return NT_STATUS_NO_MEMORY;
+
+ info->acc_granted = acc_granted;
/* get a (unique) handle. open a policy on it. */
if (!create_policy_hnd(p, alias_pol, free_samr_info, (void *)info))
@@ -2223,14 +2609,14 @@ NTSTATUS _api_samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OP
set_user_info_10
********************************************************************/
-static BOOL set_user_info_10(const SAM_USER_INFO_10 *id10, uint32 rid)
+static BOOL set_user_info_10(const SAM_USER_INFO_10 *id10, DOM_SID *sid)
{
SAM_ACCOUNT *pwd =NULL;
BOOL ret;
pdb_init_sam(&pwd);
- ret = pdb_getsampwrid(pwd, rid);
+ ret = pdb_getsampwsid(pwd, sid);
if(ret==False) {
pdb_free_sam(&pwd);
@@ -2262,13 +2648,13 @@ static BOOL set_user_info_10(const SAM_USER_INFO_10 *id10, uint32 rid)
set_user_info_12
********************************************************************/
-static BOOL set_user_info_12(SAM_USER_INFO_12 *id12, uint32 rid)
+static BOOL set_user_info_12(SAM_USER_INFO_12 *id12, DOM_SID *sid)
{
SAM_ACCOUNT *pwd = NULL;
pdb_init_sam(&pwd);
- if(!pdb_getsampwrid(pwd, rid)) {
+ if(!pdb_getsampwsid(pwd, sid)) {
pdb_free_sam(&pwd);
return False;
}
@@ -2305,7 +2691,7 @@ static BOOL set_user_info_12(SAM_USER_INFO_12 *id12, uint32 rid)
set_user_info_21
********************************************************************/
-static BOOL set_user_info_21(SAM_USER_INFO_21 *id21, uint32 rid)
+static BOOL set_user_info_21(SAM_USER_INFO_21 *id21, DOM_SID *sid)
{
SAM_ACCOUNT *pwd = NULL;
@@ -2316,7 +2702,7 @@ static BOOL set_user_info_21(SAM_USER_INFO_21 *id21, uint32 rid)
pdb_init_sam(&pwd);
- if (!pdb_getsampwrid(pwd, rid)) {
+ if (!pdb_getsampwsid(pwd, sid)) {
pdb_free_sam(&pwd);
return False;
}
@@ -2345,7 +2731,7 @@ static BOOL set_user_info_21(SAM_USER_INFO_21 *id21, uint32 rid)
set_user_info_23
********************************************************************/
-static BOOL set_user_info_23(SAM_USER_INFO_23 *id23, uint32 rid)
+static BOOL set_user_info_23(SAM_USER_INFO_23 *id23, DOM_SID *sid)
{
SAM_ACCOUNT *pwd = NULL;
pstring plaintext_buf;
@@ -2359,7 +2745,7 @@ static BOOL set_user_info_23(SAM_USER_INFO_23 *id23, uint32 rid)
pdb_init_sam(&pwd);
- if (!pdb_getsampwrid(pwd, rid)) {
+ if (!pdb_getsampwsid(pwd, sid)) {
pdb_free_sam(&pwd);
return False;
}
@@ -2412,7 +2798,7 @@ static BOOL set_user_info_23(SAM_USER_INFO_23 *id23, uint32 rid)
set_user_info_pw
********************************************************************/
-static BOOL set_user_info_pw(char *pass, uint32 rid)
+static BOOL set_user_info_pw(char *pass, DOM_SID *sid)
{
SAM_ACCOUNT *pwd = NULL;
uint32 len;
@@ -2421,7 +2807,7 @@ static BOOL set_user_info_pw(char *pass, uint32 rid)
pdb_init_sam(&pwd);
- if (!pdb_getsampwrid(pwd, rid)) {
+ if (!pdb_getsampwsid(pwd, sid)) {
pdb_free_sam(&pwd);
return False;
}
@@ -2480,23 +2866,27 @@ static BOOL set_user_info_pw(char *pass, uint32 rid)
NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SET_USERINFO *r_u)
{
- uint32 rid = 0x0;
DOM_SID sid;
POLICY_HND *pol = &q_u->pol;
uint16 switch_value = q_u->switch_value;
SAM_USERINFO_CTR *ctr = q_u->ctr;
+ uint32 acc_granted;
+ uint32 acc_required;
DEBUG(5, ("_samr_set_userinfo: %d\n", __LINE__));
r_u->status = NT_STATUS_OK;
/* find the policy handle. open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, pol, &sid))
+ if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
- sid_split_rid(&sid, &rid);
-
- DEBUG(5, ("_samr_set_userinfo: rid:0x%x, level:%d\n", rid, switch_value));
+
+ acc_required = USER_ACCESS_SET_LOC_COM | USER_ACCESS_SET_ATTRIBUTES; /* This is probably wrong */
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo"))) {
+ return r_u->status;
+ }
+
+ DEBUG(5, ("_samr_set_userinfo: sid:%s, level:%d\n", sid_string_static(&sid), switch_value));
if (ctr == NULL) {
DEBUG(5, ("_samr_set_userinfo: NULL info level\n"));
@@ -2506,7 +2896,7 @@ NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SE
/* ok! user info levels (lots: see MSDEV help), off we go... */
switch (switch_value) {
case 0x12:
- if (!set_user_info_12(ctr->info.id12, rid))
+ if (!set_user_info_12(ctr->info.id12, &sid))
return NT_STATUS_ACCESS_DENIED;
break;
@@ -2515,7 +2905,7 @@ NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SE
dump_data(100, (char *)ctr->info.id24->pass, 516);
- if (!set_user_info_pw((char *)ctr->info.id24->pass, rid))
+ if (!set_user_info_pw((char *)ctr->info.id24->pass, &sid))
return NT_STATUS_ACCESS_DENIED;
break;
@@ -2533,7 +2923,7 @@ NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SE
dump_data(100, (char *)ctr->info.id25->pass, 532);
- if (!set_user_info_pw(ctr->info.id25->pass, rid))
+ if (!set_user_info_pw(ctr->info.id25->pass, &sid))
return NT_STATUS_ACCESS_DENIED;
break;
#endif
@@ -2544,7 +2934,7 @@ NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SE
dump_data(100, (char *)ctr->info.id23->pass, 516);
- if (!set_user_info_23(ctr->info.id23, rid))
+ if (!set_user_info_23(ctr->info.id23, &sid))
return NT_STATUS_ACCESS_DENIED;
break;
@@ -2562,22 +2952,26 @@ NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SE
NTSTATUS _samr_set_userinfo2(pipes_struct *p, SAMR_Q_SET_USERINFO2 *q_u, SAMR_R_SET_USERINFO2 *r_u)
{
DOM_SID sid;
- uint32 rid = 0x0;
SAM_USERINFO_CTR *ctr = q_u->ctr;
POLICY_HND *pol = &q_u->pol;
uint16 switch_value = q_u->switch_value;
+ uint32 acc_granted;
+ uint32 acc_required;
DEBUG(5, ("samr_reply_set_userinfo2: %d\n", __LINE__));
r_u->status = NT_STATUS_OK;
/* find the policy handle. open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, pol, &sid))
+ if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+
+ acc_required = USER_ACCESS_SET_LOC_COM | USER_ACCESS_SET_ATTRIBUTES; /* This is probably wrong */
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo2"))) {
+ return r_u->status;
+ }
- sid_split_rid(&sid, &rid);
-
- DEBUG(5, ("samr_reply_set_userinfo2: rid:0x%x\n", rid));
+ DEBUG(5, ("samr_reply_set_userinfo2: sid:%s\n", sid_string_static(&sid)));
if (ctr == NULL) {
DEBUG(5, ("samr_reply_set_userinfo2: NULL info level\n"));
@@ -2589,16 +2983,16 @@ NTSTATUS _samr_set_userinfo2(pipes_struct *p, SAMR_Q_SET_USERINFO2 *q_u, SAMR_R_
/* ok! user info levels (lots: see MSDEV help), off we go... */
switch (switch_value) {
case 21:
- if (!set_user_info_21(ctr->info.id21, rid))
+ if (!set_user_info_21(ctr->info.id21, &sid))
return NT_STATUS_ACCESS_DENIED;
break;
case 16:
- if (!set_user_info_10(ctr->info.id10, rid))
+ if (!set_user_info_10(ctr->info.id10, &sid))
return NT_STATUS_ACCESS_DENIED;
break;
case 18:
/* Used by AS/U JRA. */
- if (!set_user_info_12(ctr->info.id12, rid))
+ if (!set_user_info_12(ctr->info.id12, &sid))
return NT_STATUS_ACCESS_DENIED;
break;
default:
@@ -2642,6 +3036,10 @@ NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u,
/* find the policy handle. open a policy on it. */
if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
return NT_STATUS_INVALID_HANDLE;
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, USER_ACCESS_GET_GROUPS, "_samr_query_useraliases"))) {
+ return r_u->status;
+ }
if (!sid_check_is_domain(&info->sid) &&
!sid_check_is_builtin(&info->sid))
@@ -2656,7 +3054,7 @@ NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u,
* if there is an error, we just continue as
* it can be an unfound user or group
*/
- if (NT_STATUS_IS_ERR(r_u->status)) {
+ if (!NT_STATUS_IS_OK(r_u->status)) {
DEBUG(10,("_samr_query_useraliases: an error occured while getting groups\n"));
continue;
}
@@ -2706,11 +3104,16 @@ NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_
SAM_ACCOUNT *sam_user = NULL;
BOOL check;
+ uint32 acc_granted;
/* find the policy handle. open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, ALIAS_ACCESS_GET_MEMBERS, "_samr_query_aliasmem"))) {
+ return r_u->status;
+ }
+
sid_copy(&als_sid, &alias_sid);
sid_to_string(alias_sid_str, &alias_sid);
sid_split_rid(&alias_sid, &alias_rid);
@@ -2722,7 +3125,7 @@ NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_
if(!get_local_group_from_sid(als_sid, &map, MAPPING_WITHOUT_PRIV))
return NT_STATUS_NO_SUCH_ALIAS;
} else {
- if (sid_equal(&alias_sid, &global_sam_sid)) {
+ if (sid_equal(&alias_sid, get_global_sam_sid())) {
DEBUG(10, ("lookup on Server SID\n"));
if(!get_local_group_from_sid(als_sid, &map, MAPPING_WITHOUT_PRIV))
return NT_STATUS_NO_SUCH_ALIAS;
@@ -2741,12 +3144,12 @@ NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_
struct passwd *pass;
uint32 rid;
- sid_copy(&temp_sid, &global_sam_sid);
+ sid_copy(&temp_sid, get_global_sam_sid());
pass = getpwuid_alloc(uid[i]);
if (!pass) continue;
- if (NT_STATUS_IS_ERR(pdb_init_sam(&sam_user))) {
+ if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_user))) {
passwd_free(&pass);
continue;
}
@@ -2802,12 +3205,16 @@ NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_
SAM_ACCOUNT *sam_user = NULL;
BOOL check;
-
+ uint32 acc_granted;
/* find the policy handle. open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, GROUP_ACCESS_GET_MEMBERS, "_samr_query_groupmem"))) {
+ return r_u->status;
+ }
+
/* todo: change to use sid_compare_front */
sid_split_rid(&group_sid, &group_rid);
@@ -2815,7 +3222,7 @@ NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_
DEBUG(10, ("sid is %s\n", group_sid_str));
/* can we get a query for an SID outside our domain ? */
- if (!sid_equal(&group_sid, &global_sam_sid))
+ if (!sid_equal(&group_sid, get_global_sam_sid()))
return NT_STATUS_NO_SUCH_GROUP;
sid_append_rid(&group_sid, group_rid);
@@ -2840,7 +3247,7 @@ NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_
pass = getpwuid_alloc(uid[i]);
if (!pass) continue;
- if (NT_STATUS_IS_ERR(pdb_init_sam(&sam_user))) {
+ if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_user))) {
passwd_free(&pass);
continue;
}
@@ -2886,20 +3293,24 @@ NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_AD
struct passwd *pwd;
struct group *grp;
fstring grp_name;
- uint32 rid;
GROUP_MAP map;
NTSTATUS ret;
SAM_ACCOUNT *sam_user = NULL;
BOOL check;
+ uint32 acc_granted;
/* Find the policy handle. Open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, ALIAS_ACCESS_ADD_MEMBER, "_samr_add_aliasmem"))) {
+ return r_u->status;
+ }
+
sid_to_string(alias_sid_str, &alias_sid);
DEBUG(10, ("sid is %s\n", alias_sid_str));
- if (sid_compare(&alias_sid, &global_sam_sid)>0) {
+ if (sid_compare(&alias_sid, get_global_sam_sid())>0) {
DEBUG(10, ("adding member on Server SID\n"));
if(!get_local_group_from_sid(alias_sid, &map, MAPPING_WITHOUT_PRIV))
return NT_STATUS_NO_SUCH_ALIAS;
@@ -2914,13 +3325,11 @@ NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_AD
return NT_STATUS_NO_SUCH_ALIAS;
}
- sid_split_rid(&q_u->sid.sid, &rid);
-
ret = pdb_init_sam(&sam_user);
- if (NT_STATUS_IS_ERR(ret))
+ if (!NT_STATUS_IS_OK(ret))
return ret;
- check = pdb_getsampwrid(sam_user, rid);
+ check = pdb_getsampwsid(sam_user, &q_u->sid.sid);
if (check != True) {
pdb_free_sam(&sam_user);
@@ -2935,8 +3344,11 @@ NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_AD
pdb_free_sam(&sam_user);
- if ((pwd=getpwuid(uid)) == NULL)
+ if ((pwd=getpwuid_alloc(uid)) == NULL) {
return NT_STATUS_NO_SUCH_USER;
+ } else {
+ passwd_free(&pwd);
+ }
if ((grp=getgrgid(map.gid)) == NULL)
return NT_STATUS_NO_SUCH_ALIAS;
@@ -2971,14 +3383,18 @@ NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DE
fstring alias_sid_str;
struct group *grp;
fstring grp_name;
- uint32 rid;
GROUP_MAP map;
SAM_ACCOUNT *sam_pass=NULL;
+ uint32 acc_granted;
/* Find the policy handle. Open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, ALIAS_ACCESS_REMOVE_MEMBER, "_samr_del_aliasmem"))) {
+ return r_u->status;
+ }
+
sid_to_string(alias_sid_str, &alias_sid);
DEBUG(10, ("_samr_del_aliasmem:sid is %s\n", alias_sid_str));
@@ -2997,11 +3413,9 @@ NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DE
/* we need to copy the name otherwise it's overloaded in user_in_group_list */
fstrcpy(grp_name, grp->gr_name);
- sid_peek_rid(&q_u->sid.sid, &rid);
-
/* check if the user exists before trying to remove it from the group */
pdb_init_sam(&sam_pass);
- if(!pdb_getsampwrid(sam_pass, rid)) {
+ if(!pdb_getsampwsid(sam_pass, &q_u->sid.sid)) {
DEBUG(5,("_samr_del_aliasmem:User %s doesn't exist.\n", pdb_get_username(sam_pass)));
pdb_free_sam(&sam_pass);
return NT_STATUS_NO_SUCH_USER;
@@ -3032,6 +3446,7 @@ NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DE
NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_ADD_GROUPMEM *r_u)
{
DOM_SID group_sid;
+ DOM_SID user_sid;
fstring group_sid_str;
struct passwd *pwd;
struct group *grp;
@@ -3041,15 +3456,20 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD
NTSTATUS ret;
SAM_ACCOUNT *sam_user;
BOOL check;
+ uint32 acc_granted;
/* Find the policy handle. Open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, GROUP_ACCESS_ADD_MEMBER, "_samr_add_groupmem"))) {
+ return r_u->status;
+ }
sid_to_string(group_sid_str, &group_sid);
DEBUG(10, ("sid is %s\n", group_sid_str));
- if (sid_compare(&group_sid, &global_sam_sid)<=0)
+ if (sid_compare(&group_sid, get_global_sam_sid())<=0)
return NT_STATUS_NO_SUCH_GROUP;
DEBUG(10, ("lookup on Domain SID\n"));
@@ -3057,11 +3477,14 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD
if(!get_domain_group_from_sid(group_sid, &map, MAPPING_WITHOUT_PRIV))
return NT_STATUS_NO_SUCH_GROUP;
+ sid_copy(&user_sid, get_global_sam_sid());
+ sid_append_rid(&user_sid, q_u->rid);
+
ret = pdb_init_sam(&sam_user);
- if (NT_STATUS_IS_ERR(ret))
+ if (!NT_STATUS_IS_OK(ret))
return ret;
- check = pdb_getsampwrid(sam_user, q_u->rid);
+ check = pdb_getsampwsid(sam_user, &user_sid);
if (check != True) {
pdb_free_sam(&sam_user);
@@ -3076,8 +3499,11 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD
pdb_free_sam(&sam_user);
- if ((pwd=getpwuid(uid)) == NULL)
+ if ((pwd=getpwuid_alloc(uid)) == NULL) {
return NT_STATUS_NO_SUCH_USER;
+ } else {
+ passwd_free(&pwd);
+ }
if ((grp=getgrgid(map.gid)) == NULL)
return NT_STATUS_NO_SUCH_GROUP;
@@ -3111,11 +3537,12 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD
NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DEL_GROUPMEM *r_u)
{
DOM_SID group_sid;
+ DOM_SID user_sid;
SAM_ACCOUNT *sam_pass=NULL;
- uint32 rid;
GROUP_MAP map;
fstring grp_name;
struct group *grp;
+ uint32 acc_granted;
/*
* delete the group member named q_u->rid
@@ -3124,15 +3551,20 @@ NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DE
*/
/* Find the policy handle. Open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
- if(!sid_check_is_in_our_domain(&group_sid))
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, GROUP_ACCESS_REMOVE_MEMBER, "_samr_del_groupmem"))) {
+ return r_u->status;
+ }
+
+ if (!sid_check_is_in_our_domain(&group_sid))
return NT_STATUS_NO_SUCH_GROUP;
- rid=q_u->rid;
+ sid_copy(&user_sid, get_global_sam_sid());
+ sid_append_rid(&user_sid, q_u->rid);
- if(!get_domain_group_from_sid(group_sid, &map, MAPPING_WITHOUT_PRIV))
+ if (!get_domain_group_from_sid(group_sid, &map, MAPPING_WITHOUT_PRIV))
return NT_STATUS_NO_SUCH_GROUP;
if ((grp=getgrgid(map.gid)) == NULL)
@@ -3143,14 +3575,14 @@ NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DE
/* check if the user exists before trying to remove it from the group */
pdb_init_sam(&sam_pass);
- if(!pdb_getsampwrid(sam_pass, rid)) {
+ if (!pdb_getsampwsid(sam_pass, &user_sid)) {
DEBUG(5,("User %s doesn't exist.\n", pdb_get_username(sam_pass)));
pdb_free_sam(&sam_pass);
return NT_STATUS_NO_SUCH_USER;
}
/* if the user is not in the group */
- if(!user_in_group_list(pdb_get_username(sam_pass), grp_name)) {
+ if (!user_in_group_list(pdb_get_username(sam_pass), grp_name)) {
pdb_free_sam(&sam_pass);
return NT_STATUS_MEMBER_NOT_IN_GROUP;
}
@@ -3158,7 +3590,7 @@ NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DE
smb_delete_user_group(grp_name, pdb_get_username(sam_pass));
/* check if the user has been removed then ... */
- if(user_in_group_list(pdb_get_username(sam_pass), grp_name)) {
+ if (user_in_group_list(pdb_get_username(sam_pass), grp_name)) {
pdb_free_sam(&sam_pass);
return NT_STATUS_ACCESS_DENIED; /* don't know what to reply else */
}
@@ -3168,6 +3600,24 @@ NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DE
}
+/****************************************************************************
+ Delete a UNIX user on demand.
+****************************************************************************/
+
+static int smb_delete_user(const char *unix_user)
+{
+ pstring del_script;
+ int ret;
+
+ pstrcpy(del_script, lp_deluser_script());
+ if (! *del_script)
+ return -1;
+ all_string_sub(del_script, "%u", unix_user, sizeof(pstring));
+ ret = smbrun(del_script,NULL);
+ DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
+ return ret;
+}
+
/*********************************************************************
_samr_delete_dom_user
*********************************************************************/
@@ -3176,22 +3626,24 @@ NTSTATUS _samr_delete_dom_user(pipes_struct *p, SAMR_Q_DELETE_DOM_USER *q_u, SAM
{
DOM_SID user_sid;
SAM_ACCOUNT *sam_pass=NULL;
- uint32 rid;
+ uint32 acc_granted;
DEBUG(5, ("_samr_delete_dom_user: %d\n", __LINE__));
/* Find the policy handle. Open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &user_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &user_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DELETE_ACCESS, "_samr_delete_dom_user"))) {
+ return r_u->status;
+ }
+
if (!sid_check_is_in_our_domain(&user_sid))
return NT_STATUS_CANNOT_DELETE;
- sid_peek_rid(&user_sid, &rid);
-
/* check if the user exists before trying to delete */
pdb_init_sam(&sam_pass);
- if(!pdb_getsampwrid(sam_pass, rid)) {
+ if(!pdb_getsampwsid(sam_pass, &user_sid)) {
DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n", pdb_get_username(sam_pass)));
pdb_free_sam(&sam_pass);
return NT_STATUS_NO_SUCH_USER;
@@ -3233,13 +3685,18 @@ NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, S
gid_t gid;
struct group *grp;
GROUP_MAP map;
+ uint32 acc_granted;
DEBUG(5, ("samr_delete_dom_group: %d\n", __LINE__));
/* Find the policy handle. Open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DELETE_ACCESS, "_samr_delete_dom_group"))) {
+ return r_u->status;
+ }
+
sid_copy(&dom_sid, &group_sid);
sid_to_string(group_sid_str, &dom_sid);
sid_split_rid(&dom_sid, &group_rid);
@@ -3247,7 +3704,7 @@ NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, S
DEBUG(10, ("sid is %s\n", group_sid_str));
/* we check if it's our SID before deleting */
- if (!sid_equal(&dom_sid, &global_sam_sid))
+ if (!sid_equal(&dom_sid, get_global_sam_sid()))
return NT_STATUS_NO_SUCH_GROUP;
DEBUG(10, ("lookup on Domain SID\n"));
@@ -3290,13 +3747,18 @@ NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, S
gid_t gid;
struct group *grp;
GROUP_MAP map;
+ uint32 acc_granted;
DEBUG(5, ("_samr_delete_dom_alias: %d\n", __LINE__));
/* Find the policy handle. Open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DELETE_ACCESS, "_samr_delete_dom_alias"))) {
+ return r_u->status;
+ }
+
sid_copy(&dom_sid, &alias_sid);
sid_to_string(alias_sid_str, &dom_sid);
sid_split_rid(&dom_sid, &alias_rid);
@@ -3304,7 +3766,7 @@ NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, S
DEBUG(10, ("sid is %s\n", alias_sid_str));
/* we check if it's our SID before deleting */
- if (!sid_equal(&dom_sid, &global_sam_sid))
+ if (!sid_equal(&dom_sid, get_global_sam_sid()))
return NT_STATUS_NO_SUCH_ALIAS;
DEBUG(10, ("lookup on Local SID\n"));
@@ -3347,14 +3809,19 @@ NTSTATUS _samr_create_dom_group(pipes_struct *p, SAMR_Q_CREATE_DOM_GROUP *q_u, S
struct group *grp;
struct samr_info *info;
PRIVILEGE_SET priv_set;
+ uint32 acc_granted;
init_privilege(&priv_set);
/* Find the policy handle. Open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->pol, &dom_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &dom_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
- if (!sid_equal(&dom_sid, &global_sam_sid))
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_CREATE_GROUP, "_samr_create_dom_group"))) {
+ return r_u->status;
+ }
+
+ if (!sid_equal(&dom_sid, get_global_sam_sid()))
return NT_STATUS_ACCESS_DENIED;
/* TODO: check if allowed to create group and add a become_root/unbecome_root pair.*/
@@ -3375,7 +3842,7 @@ NTSTATUS _samr_create_dom_group(pipes_struct *p, SAMR_Q_CREATE_DOM_GROUP *q_u, S
r_u->rid=pdb_gid_to_group_rid(grp->gr_gid);
/* add the group to the mapping table */
- sid_copy(&info_sid, &global_sam_sid);
+ sid_copy(&info_sid, get_global_sam_sid());
sid_append_rid(&info_sid, r_u->rid);
sid_to_string(sid_string, &info_sid);
@@ -3405,14 +3872,19 @@ NTSTATUS _samr_create_dom_alias(pipes_struct *p, SAMR_Q_CREATE_DOM_ALIAS *q_u, S
struct group *grp;
struct samr_info *info;
PRIVILEGE_SET priv_set;
+ uint32 acc_granted;
init_privilege(&priv_set);
/* Find the policy handle. Open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
- if (!sid_equal(&dom_sid, &global_sam_sid))
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_CREATE_ALIAS, "_samr_create_alias"))) {
+ return r_u->status;
+ }
+
+ if (!sid_equal(&dom_sid, get_global_sam_sid()))
return NT_STATUS_ACCESS_DENIED;
/* TODO: check if allowed to create group and add a become_root/unbecome_root pair.*/
@@ -3432,7 +3904,7 @@ NTSTATUS _samr_create_dom_alias(pipes_struct *p, SAMR_Q_CREATE_DOM_ALIAS *q_u, S
r_u->rid=pdb_gid_to_group_rid(grp->gr_gid);
- sid_copy(&info_sid, &global_sam_sid);
+ sid_copy(&info_sid, get_global_sam_sid());
sid_append_rid(&info_sid, r_u->rid);
sid_to_string(sid_string, &info_sid);
@@ -3464,10 +3936,15 @@ NTSTATUS _samr_query_groupinfo(pipes_struct *p, SAMR_Q_QUERY_GROUPINFO *q_u, SAM
uid_t *uid=NULL;
int num_uids=0;
GROUP_INFO_CTR *ctr;
+ uint32 acc_granted;
- if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, GROUP_ACCESS_LOOKUP_INFO, "_samr_query_groupinfo"))) {
+ return r_u->status;
+ }
+
if (!get_domain_group_from_sid(group_sid, &map, MAPPING_WITHOUT_PRIV))
return NT_STATUS_INVALID_HANDLE;
@@ -3511,10 +3988,15 @@ NTSTATUS _samr_set_groupinfo(pipes_struct *p, SAMR_Q_SET_GROUPINFO *q_u, SAMR_R_
DOM_SID group_sid;
GROUP_MAP map;
GROUP_INFO_CTR *ctr;
+ uint32 acc_granted;
- if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, GROUP_ACCESS_SET_INFO, "_samr_set_groupinfo"))) {
+ return r_u->status;
+ }
+
if (!get_domain_group_from_sid(group_sid, &map, MAPPING_WITH_PRIV))
return NT_STATUS_NO_SUCH_GROUP;
@@ -3553,10 +4035,15 @@ NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_
DOM_SID group_sid;
GROUP_MAP map;
ALIAS_INFO_CTR *ctr;
+ uint32 acc_granted;
- if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &group_sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
-
+
+ if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, ALIAS_ACCESS_SET_INFO, "_samr_set_aliasinfo"))) {
+ return r_u->status;
+ }
+
if (!get_local_group_from_sid(group_sid, &map, MAPPING_WITH_PRIV))
return NT_STATUS_NO_SUCH_GROUP;
@@ -3587,7 +4074,18 @@ NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_
NTSTATUS _samr_get_dom_pwinfo(pipes_struct *p, SAMR_Q_GET_DOM_PWINFO *q_u, SAMR_R_GET_DOM_PWINFO *r_u)
{
+ /* Perform access check. Since this rpc does not require a
+ policy handle it will not be caught by the access checks on
+ SAMR_CONNECT or SAMR_CONNECT_ANON. */
+
+ if (!pipe_access_check(p)) {
+ DEBUG(3, ("access denied to samr_get_dom_pwinfo\n"));
+ r_u->status = NT_STATUS_ACCESS_DENIED;
+ return r_u->status;
+ }
+
/* Actually, returning zeros here works quite well :-). */
+
return NT_STATUS_OK;
}
@@ -3601,21 +4099,42 @@ NTSTATUS _samr_open_group(pipes_struct *p, SAMR_Q_OPEN_GROUP *q_u, SAMR_R_OPEN_G
DOM_SID info_sid;
GROUP_MAP map;
struct samr_info *info;
+ SEC_DESC *psd = NULL;
+ uint32 acc_granted;
+ uint32 des_access;
+ size_t sd_size;
+ NTSTATUS status;
fstring sid_string;
- if (!get_lsa_policy_samr_sid(p, &q_u->domain_pol, &sid))
+ if (!get_lsa_policy_samr_sid(p, &q_u->domain_pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
+
+ if (!NT_STATUS_IS_OK(status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_OPEN_ACCOUNT, "_samr_open_group"))) {
+ return status;
+ }
+
+ /*check if access can be granted as requested by client. */
+ samr_make_grp_obj_sd(p->mem_ctx, &psd, &sd_size);
+ se_map_generic(&des_access,&grp_generic_mapping);
+ if (!NT_STATUS_IS_OK(status =
+ access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ des_access, &acc_granted, "_samr_open_group"))) {
+ return status;
+ }
+
/* this should not be hard-coded like this */
- if (!sid_equal(&sid, &global_sam_sid))
+ if (!sid_equal(&sid, get_global_sam_sid()))
return NT_STATUS_ACCESS_DENIED;
- sid_copy(&info_sid, &global_sam_sid);
+ sid_copy(&info_sid, get_global_sam_sid());
sid_append_rid(&info_sid, q_u->rid_group);
sid_to_string(sid_string, &info_sid);
if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
return NT_STATUS_NO_MEMORY;
+
+ info->acc_granted = acc_granted;
DEBUG(10, ("_samr_open_group:Opening SID: %s\n", sid_string));
@@ -3692,14 +4211,14 @@ NTSTATUS _samr_unknown_2e(pipes_struct *p, SAMR_Q_UNKNOWN_2E *q_u, SAMR_R_UNKNOW
become_root();
r_u->status=load_sampwd_entries(info, ACB_NORMAL);
unbecome_root();
- if (NT_STATUS_IS_ERR(r_u->status)) {
+ if (!NT_STATUS_IS_OK(r_u->status)) {
DEBUG(5, ("_samr_query_dispinfo: load_sampwd_entries failed\n"));
return r_u->status;
}
num_users=info->disp_info.num_user_account;
free_samr_db(info);
- r_u->status=load_group_domain_entries(info, &global_sam_sid);
+ r_u->status=load_group_domain_entries(info, get_global_sam_sid());
if (NT_STATUS_IS_ERR(r_u->status)) {
DEBUG(5, ("_samr_query_dispinfo: load_group_domain_entries failed\n"));
return r_u->status;
diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c
index c7dc5d27ff..6e3463e79b 100755
--- a/source3/rpc_server/srv_spoolss.c
+++ b/source3/rpc_server/srv_spoolss.c
@@ -4,7 +4,8 @@
* Copyright (C) Andrew Tridgell 1992-2000,
* Copyright (C) Luke Kenneth Casson Leighton 1996-2000,
* Copyright (C) Jean François Micouleau 1998-2000.
- * Copyright (C) Jeremy Allison 2001.
+ * Copyright (C) Jeremy Allison 2001.
+ * Copyright (C) Gerald Carter 2001-2002.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -23,6 +24,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
/********************************************************************
* api_spoolss_open_printer_ex (rarely seen - older call)
********************************************************************/
@@ -1399,6 +1403,119 @@ static BOOL api_spoolss_getprintprocessordirectory(pipes_struct *p)
return True;
}
+/****************************************************************************
+****************************************************************************/
+
+static BOOL api_spoolss_deleteprinterdataex(pipes_struct *p)
+{
+ SPOOL_Q_DELETEPRINTERDATAEX q_u;
+ SPOOL_R_DELETEPRINTERDATAEX r_u;
+ prs_struct *data = &p->in_data.data;
+ prs_struct *rdata = &p->out_data.rdata;
+
+ ZERO_STRUCT(q_u);
+ ZERO_STRUCT(r_u);
+
+ if(!spoolss_io_q_deleteprinterdataex("", &q_u, data, 0)) {
+ DEBUG(0,("spoolss_io_q_deleteprinterdataex: unable to unmarshall SPOOL_Q_DELETEPRINTERDATAEX.\n"));
+ return False;
+ }
+
+ r_u.status = _spoolss_deleteprinterdataex(p, &q_u, &r_u);
+
+ if(!spoolss_io_r_deleteprinterdataex("", &r_u, rdata, 0)) {
+ DEBUG(0,("spoolss_io_r_deleteprinterdataex: unable to marshall SPOOL_R_DELETEPRINTERDATAEX.\n"));
+ return False;
+ }
+
+ return True;
+}
+
+/****************************************************************************
+****************************************************************************/
+
+static BOOL api_spoolss_deleteprinterkey(pipes_struct *p)
+{
+ SPOOL_Q_DELETEPRINTERKEY q_u;
+ SPOOL_R_DELETEPRINTERKEY r_u;
+ prs_struct *data = &p->in_data.data;
+ prs_struct *rdata = &p->out_data.rdata;
+
+ ZERO_STRUCT(q_u);
+ ZERO_STRUCT(r_u);
+
+ if(!spoolss_io_q_deleteprinterkey("", &q_u, data, 0)) {
+ DEBUG(0,("spoolss_io_q_deleteprinterkey: unable to unmarshall SPOOL_Q_DELETEPRINTERKEY.\n"));
+ return False;
+ }
+
+ r_u.status = _spoolss_deleteprinterkey(p, &q_u, &r_u);
+
+ if(!spoolss_io_r_deleteprinterkey("", &r_u, rdata, 0)) {
+ DEBUG(0,("spoolss_io_r_deleteprinterkey: unable to marshall SPOOL_R_DELETEPRINTERKEY.\n"));
+ return False;
+ }
+
+ return True;
+}
+
+/****************************************************************************
+****************************************************************************/
+
+static BOOL api_spoolss_addprinterdriverex(pipes_struct *p)
+{
+ SPOOL_Q_ADDPRINTERDRIVEREX q_u;
+ SPOOL_R_ADDPRINTERDRIVEREX r_u;
+ prs_struct *data = &p->in_data.data;
+ prs_struct *rdata = &p->out_data.rdata;
+
+ ZERO_STRUCT(q_u);
+ ZERO_STRUCT(r_u);
+
+ if(!spoolss_io_q_addprinterdriverex("", &q_u, data, 0)) {
+ DEBUG(0,("spoolss_io_q_addprinterdriverex: unable to unmarshall SPOOL_Q_ADDPRINTERDRIVEREX.\n"));
+ return False;
+ }
+
+ r_u.status = _spoolss_addprinterdriverex(p, &q_u, &r_u);
+
+ if(!spoolss_io_r_addprinterdriverex("", &r_u, rdata, 0)) {
+ DEBUG(0,("spoolss_io_r_addprinterdriverex: unable to marshall SPOOL_R_ADDPRINTERDRIVEREX.\n"));
+ return False;
+ }
+
+ return True;
+}
+
+/****************************************************************************
+****************************************************************************/
+
+static BOOL api_spoolss_deleteprinterdriverex(pipes_struct *p)
+{
+ SPOOL_Q_DELETEPRINTERDRIVEREX q_u;
+ SPOOL_R_DELETEPRINTERDRIVEREX r_u;
+ prs_struct *data = &p->in_data.data;
+ prs_struct *rdata = &p->out_data.rdata;
+
+ ZERO_STRUCT(q_u);
+ ZERO_STRUCT(r_u);
+
+ if(!spoolss_io_q_deleteprinterdriverex("", &q_u, data, 0)) {
+ DEBUG(0,("spoolss_io_q_deleteprinterdriverex: unable to unmarshall SPOOL_Q_DELETEPRINTERDRIVEREX.\n"));
+ return False;
+ }
+
+ r_u.status = _spoolss_deleteprinterdriverex(p, &q_u, &r_u);
+
+ if(!spoolss_io_r_deleteprinterdriverex("", &r_u, rdata, 0)) {
+ DEBUG(0,("spoolss_io_r_deleteprinterdriverex: unable to marshall SPOOL_R_DELETEPRINTERDRIVEREX.\n"));
+ return False;
+ }
+
+ return True;
+}
+
+
/*******************************************************************
\pipe\spoolss commands
********************************************************************/
@@ -1449,9 +1566,13 @@ struct api_struct api_spoolss_cmds[] =
{"SPOOLSS_ENUMPRINTPROCDATATYPES", SPOOLSS_ENUMPRINTPROCDATATYPES, api_spoolss_enumprintprocdatatypes },
{"SPOOLSS_GETPRINTERDATAEX", SPOOLSS_GETPRINTERDATAEX, api_spoolss_getprinterdataex },
{"SPOOLSS_SETPRINTERDATAEX", SPOOLSS_SETPRINTERDATAEX, api_spoolss_setprinterdataex },
- {"SPOOLSS_ENUMPRINTERKEY", SPOOLSS_ENUMPRINTERKEY, api_spoolss_enumprinterkey },
+ {"SPOOLSS_DELETEPRINTERDATAEX", SPOOLSS_DELETEPRINTERDATAEX, api_spoolss_deleteprinterdataex },
{"SPOOLSS_ENUMPRINTERDATAEX", SPOOLSS_ENUMPRINTERDATAEX, api_spoolss_enumprinterdataex },
+ {"SPOOLSS_ENUMPRINTERKEY", SPOOLSS_ENUMPRINTERKEY, api_spoolss_enumprinterkey },
+ {"SPOOLSS_DELETEPRINTERKEY", SPOOLSS_DELETEPRINTERKEY, api_spoolss_deleteprinterkey },
{"SPOOLSS_GETPRINTPROCESSORDIRECTORY",SPOOLSS_GETPRINTPROCESSORDIRECTORY,api_spoolss_getprintprocessordirectory},
+ {"SPOOLSS_ADDPRINTERDRIVEREX", SPOOLSS_ADDPRINTERDRIVEREX, api_spoolss_addprinterdriverex },
+ {"SPOOLSS_DELETEPRINTERDRIVEREX", SPOOLSS_DELETEPRINTERDRIVEREX, api_spoolss_deleteprinterdriverex },
{ NULL, 0, NULL }
};
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 322efa22b5..68c792f8b0 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -5,7 +5,7 @@
* Copyright (C) Luke Kenneth Casson Leighton 1996-2000,
* Copyright (C) Jean François Micouleau 1998-2000,
* Copyright (C) Jeremy Allison 2001,
- * Copyright (C) Gerald Carter 2000-2001,
+ * Copyright (C) Gerald Carter 2000-2002,
* Copyright (C) Tim Potter 2001-2002.
*
* This program is free software; you can redistribute it and/or modify
@@ -28,6 +28,10 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+/* #define EMULATE_WIN2K_HACK 1 */
+
#ifndef MAX_OPEN_PRINTER_EXS
#define MAX_OPEN_PRINTER_EXS 50
#endif
@@ -37,6 +41,15 @@
#define PRINTER_HANDLE_IS_PRINTER 0
#define PRINTER_HANDLE_IS_PRINTSERVER 1
+/* Table to map the driver version */
+/* to OS */
+char * drv_ver_to_os[] = {
+ "WIN9X", /* driver version/cversion 0 */
+ "", /* unused ? */
+ "WINNT", /* driver version/cversion 2 */
+ "WIN2K", /* driver version/cversion 3 */
+};
+
struct table_node {
char *long_archi;
char *short_archi;
@@ -68,6 +81,7 @@ typedef struct _Printer{
SPOOL_NOTIFY_OPTION *option;
POLICY_HND client_hnd;
uint32 client_connected;
+ uint32 change;
} notify;
struct {
fstring machine;
@@ -178,10 +192,10 @@ static void srv_spoolss_replycloseprinter(POLICY_HND *handle)
/* if it's the last connection, deconnect the IPC$ share */
if (smb_connections==1) {
- if(!spoolss_disconnect_from_client(&cli))
- return;
-
- message_deregister(MSG_PRINTER_NOTIFY);
+ cli_nt_session_close(&cli);
+ cli_ulogoff(&cli);
+ cli_shutdown(&cli);
+ message_deregister(MSG_PRINTER_NOTIFY2);
}
smb_connections--;
@@ -426,7 +440,7 @@ static BOOL set_printer_hnd_name(Printer_entry *Printer, char *handlename)
* anymore, so I've simplified this loop greatly. Here
* we are just verifying that the printer name is a valid
* printer service defined in smb.conf
- * --jerry [Fri Feb 15 11:17:46 CST 2002]
+ * --jerry [Fri Feb 15 11:17:46 CST 2002]
*/
for (snum=0; snum<n_services; snum++) {
@@ -535,229 +549,417 @@ static BOOL alloc_buffer_size(NEW_BUFFER *buffer, uint32 buffer_size)
return True;
}
+
/***************************************************************************
- Always give preference Printer_entry.notify.option over
- Printer_entry.notify.flags. Return True if we should send notification
- events using SPOOLSS_RRPCN. False means that we should use
- SPOOLSS_ROUTERREPLYPRINTER.
+ check to see if the client motify handle is monitoring the notification
+ given by (notify_type, notify_field).
**************************************************************************/
-static BOOL valid_notify_options(Printer_entry *printer)
+
+static BOOL is_monitoring_event_flags(uint32 flags, uint16 notify_type,
+ uint16 notify_field)
{
- if (printer->notify.option == NULL)
- return False;
-
return True;
}
-/***************************************************************************
- Simple check to see if the client motify handle is set to watch for events
- represented by 'flags'
-
- FIXME!!!! only a stub right now --jerry
- **************************************************************************/
-
-static BOOL is_client_monitoring_event(Printer_entry *p, uint32 flags)
+static BOOL is_monitoring_event(Printer_entry *p, uint16 notify_type,
+ uint16 notify_field)
{
+ SPOOL_NOTIFY_OPTION *option = p->notify.option;
+ uint32 i, j;
+
+ if (p->notify.flags)
+ return is_monitoring_event_flags(
+ p->notify.flags, notify_type, notify_field);
- return True;
-}
+ for (i = 0; i < option->count; i++) {
+
+ /* Check match for notify_type */
+
+ if (option->ctr.type[i].type != notify_type)
+ continue;
-/***************************************************************************
- Server wrapper for cli_spoolss_routerreplyprinter() since the client
- function can only send a single change notification at a time.
-
- FIXME!!! only handles one change currently (PRINTER_CHANGE_SET_PRINTER_DRIVER)
- --jerry
- **************************************************************************/
-
-static WERROR srv_spoolss_routerreplyprinter (struct cli_state *reply_cli, TALLOC_CTX *mem_ctx,
- POLICY_HND *pol, PRINTER_MESSAGE_INFO *info,
- NT_PRINTER_INFO_LEVEL *printer)
-{
- WERROR result;
- uint32 condition = 0x0;
+ /* Check match for field */
+
+ for (j = 0; j < option->ctr.type[i].count; j++) {
+ if (option->ctr.type[i].fields[j] == notify_field) {
+ return True;
+ }
+ }
+ }
- if (info->flags & PRINTER_MESSAGE_DRIVER)
- condition = PRINTER_CHANGE_SET_PRINTER_DRIVER;
+ DEBUG(10, ("%s is not monitoring 0x%02x/0x%02x\n",
+ (p->printer_type == PRINTER_HANDLE_IS_PRINTER) ?
+ p->dev.handlename : p->dev.printerservername,
+ notify_type, notify_field));
- result = cli_spoolss_routerreplyprinter(reply_cli, mem_ctx, pol, condition,
- printer->info_2->changeid);
+ return False;
+}
- return result;
+/* Convert a notification message to a SPOOL_NOTIFY_INFO_DATA struct */
+
+static void notify_one_value(struct spoolss_notify_msg *msg,
+ SPOOL_NOTIFY_INFO_DATA *data,
+ TALLOC_CTX *mem_ctx)
+{
+ data->notify_data.value[0] = msg->notify.value[0];
+ data->notify_data.value[1] = 0;
}
-/***********************************************************************
- Wrapper around the decision of which RPC use to in the change
- notification
- **********************************************************************/
-
-static WERROR srv_spoolss_send_event_to_client(Printer_entry* Printer,
- struct cli_state *send_cli, PRINTER_MESSAGE_INFO *msg,
- NT_PRINTER_INFO_LEVEL *info)
+static void notify_string(struct spoolss_notify_msg *msg,
+ SPOOL_NOTIFY_INFO_DATA *data,
+ TALLOC_CTX *mem_ctx)
{
- WERROR result;
+ UNISTR2 unistr;
- if (valid_notify_options(Printer)) {
- /* This is a single call that can send information about multiple changes */
- if (Printer->printer_type == PRINTER_HANDLE_IS_PRINTSERVER)
- msg->flags |= PRINTER_MESSAGE_ATTRIBUTES;
+ /* The length of the message includes the trailing \0 */
- result = cli_spoolss_reply_rrpcn(send_cli, send_cli->mem_ctx, &Printer->notify.client_hnd,
- msg, info);
- }
- else {
- /* This requires that the server send an individual event notification for each change */
- result = srv_spoolss_routerreplyprinter(send_cli, send_cli->mem_ctx, &Printer->notify.client_hnd,
- msg, info);
+ init_unistr2(&unistr, msg->notify.data, msg->len);
+
+ data->notify_data.data.length = msg->len * 2;
+ data->notify_data.data.string = (uint16 *)talloc(mem_ctx, msg->len * 2);
+
+ if (!data->notify_data.data.string) {
+ data->notify_data.data.length = 0;
+ return;
}
- return result;
+ memcpy(data->notify_data.data.string, unistr.buffer, msg->len * 2);
+}
+
+static void notify_system_time(struct spoolss_notify_msg *msg,
+ SPOOL_NOTIFY_INFO_DATA *data,
+ TALLOC_CTX *mem_ctx)
+{
+ SYSTEMTIME systime;
+ prs_struct ps;
+
+ if (msg->len != sizeof(time_t)) {
+ DEBUG(5, ("notify_system_time: received wrong sized message (%d)\n",
+ msg->len));
+ return;
+ }
+
+ if (!prs_init(&ps, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL)) {
+ DEBUG(5, ("notify_system_time: prs_init() failed\n"));
+ return;
+ }
+
+ if (!make_systemtime(&systime, localtime((time_t *)msg->notify.data))) {
+ DEBUG(5, ("notify_system_time: unable to make systemtime\n"));
+ return;
+ }
+
+ if (!spoolss_io_system_time("", &ps, 0, &systime))
+ return;
+
+ data->notify_data.data.length = prs_offset(&ps);
+ data->notify_data.data.string =
+ talloc(mem_ctx, prs_offset(&ps));
+
+ memcpy(data->notify_data.data.string, prs_data_p(&ps), prs_offset(&ps));
+
+ prs_mem_free(&ps);
}
+struct notify2_message_table {
+ char *name;
+ void (*fn)(struct spoolss_notify_msg *msg,
+ SPOOL_NOTIFY_INFO_DATA *data, TALLOC_CTX *mem_ctx);
+};
+
+static struct notify2_message_table printer_notify_table[] = {
+ /* 0x00 */ { "PRINTER_NOTIFY_SERVER_NAME", NULL },
+ /* 0x01 */ { "PRINTER_NOTIFY_PRINTER_NAME", NULL },
+ /* 0x02 */ { "PRINTER_NOTIFY_SHARE_NAME", NULL },
+ /* 0x03 */ { "PRINTER_NOTIFY_PORT_NAME", NULL },
+ /* 0x04 */ { "PRINTER_NOTIFY_DRIVER_NAME", NULL },
+ /* 0x05 */ { "PRINTER_NOTIFY_COMMENT", NULL },
+ /* 0x06 */ { "PRINTER_NOTIFY_LOCATION", NULL },
+ /* 0x07 */ { "PRINTER_NOTIFY_DEVMODE", NULL },
+ /* 0x08 */ { "PRINTER_NOTIFY_SEPFILE", NULL },
+ /* 0x09 */ { "PRINTER_NOTIFY_PRINT_PROCESSOR", NULL },
+ /* 0x0a */ { "PRINTER_NOTIFY_PARAMETERS", NULL },
+ /* 0x0b */ { "PRINTER_NOTIFY_DATATYPE", NULL },
+ /* 0x0c */ { "PRINTER_NOTIFY_SECURITY_DESCRIPTOR", NULL },
+ /* 0x0d */ { "PRINTER_NOTIFY_ATTRIBUTES", NULL },
+ /* 0x0e */ { "PRINTER_NOTIFY_PRIORITY", NULL },
+ /* 0x0f */ { "PRINTER_NOTIFY_DEFAULT_PRIORITY", NULL },
+ /* 0x10 */ { "PRINTER_NOTIFY_START_TIME", NULL },
+ /* 0x11 */ { "PRINTER_NOTIFY_UNTIL_TIME", NULL },
+ /* 0x12 */ { "PRINTER_NOTIFY_STATUS", notify_one_value },
+};
+
+static struct notify2_message_table job_notify_table[] = {
+ /* 0x00 */ { "JOB_NOTIFY_PRINTER_NAME", NULL },
+ /* 0x01 */ { "JOB_NOTIFY_MACHINE_NAME", NULL },
+ /* 0x02 */ { "JOB_NOTIFY_PORT_NAME", NULL },
+ /* 0x03 */ { "JOB_NOTIFY_USER_NAME", notify_string },
+ /* 0x04 */ { "JOB_NOTIFY_NOTIFY_NAME", NULL },
+ /* 0x05 */ { "JOB_NOTIFY_DATATYPE", NULL },
+ /* 0x06 */ { "JOB_NOTIFY_PRINT_PROCESSOR", NULL },
+ /* 0x07 */ { "JOB_NOTIFY_PARAMETERS", NULL },
+ /* 0x08 */ { "JOB_NOTIFY_DRIVER_NAME", NULL },
+ /* 0x09 */ { "JOB_NOTIFY_DEVMODE", NULL },
+ /* 0x0a */ { "JOB_NOTIFY_STATUS", notify_one_value },
+ /* 0x0b */ { "JOB_NOTIFY_STATUS_STRING", NULL },
+ /* 0x0c */ { "JOB_NOTIFY_SECURITY_DESCRIPTOR", NULL },
+ /* 0x0d */ { "JOB_NOTIFY_DOCUMENT", notify_string },
+ /* 0x0e */ { "JOB_NOTIFY_PRIORITY", NULL },
+ /* 0x0f */ { "JOB_NOTIFY_POSITION", NULL },
+ /* 0x10 */ { "JOB_NOTIFY_SUBMITTED", notify_system_time },
+ /* 0x11 */ { "JOB_NOTIFY_START_TIME", NULL },
+ /* 0x12 */ { "JOB_NOTIFY_UNTIL_TIME", NULL },
+ /* 0x13 */ { "JOB_NOTIFY_TIME", NULL },
+ /* 0x14 */ { "JOB_NOTIFY_TOTAL_PAGES", notify_one_value },
+ /* 0x15 */ { "JOB_NOTIFY_PAGES_PRINTED", NULL },
+ /* 0x16 */ { "JOB_NOTIFY_TOTAL_BYTES", notify_one_value },
+ /* 0x17 */ { "JOB_NOTIFY_BYTES_PRINTED", NULL },
+};
/***********************************************************************
Send a change notication message on all handles which have a call
back registered
**********************************************************************/
-static void send_spoolss_event_notification(PRINTER_MESSAGE_INFO *msg)
+static void process_notify2_message(struct spoolss_notify_msg *msg,
+ TALLOC_CTX *mem_ctx)
{
- Printer_entry *find_printer;
- WERROR result;
- NT_PRINTER_INFO_LEVEL *printer = NULL;
+ Printer_entry *p;
- if (!msg) {
- DEBUG(0,("send_spoolss_event_notification: NULL msg pointer!\n"));
- return;
- }
+ for (p = printers_list; p; p = p->next) {
+ SPOOL_NOTIFY_INFO_DATA *data;
+ uint32 data_len = 1;
+ uint32 id;
- for(find_printer = printers_list; find_printer; find_printer = find_printer->next) {
+ /* Is there notification on this handle? */
- /*
- * If the entry has a connected client we send the message. There should
- * only be one of these normally when dealing with the NT/2k spooler.
- * However, iterate over all to make sure we deal with user applications
- * in addition to spooler service.
- *
- * While we are only maintaining a single connection to the client,
- * the FindFirstPrinterChangeNotification() call is made on a printer
- * handle, so "client_connected" represents the whether or not the
- * client asked for change notication on this handle.
- *
- * --jerry
- */
+ if (!p->notify.client_connected)
+ continue;
- if (find_printer->notify.client_connected==True) {
-
- /* does the client care about what changed? */
+ /* For this printer? Print servers always receive
+ notifications. */
- if (msg->flags && !is_client_monitoring_event(find_printer, msg->flags)) {
- DEBUG(10,("send_spoolss_event_notification: Client [%s] not monitoring these events\n",
- find_printer->client.machine));
- continue;
- }
+ if (p->printer_type == PRINTER_HANDLE_IS_PRINTER &&
+ !strequal(msg->printer, p->dev.handlename))
+ continue;
- if (find_printer->printer_type == PRINTER_HANDLE_IS_PRINTSERVER)
- DEBUG(10,("send_spoolss_event_notification: printserver [%s]\n", find_printer->dev.printerservername ));
- else
- DEBUG(10,("send_spoolss_event_notification: printer [%s]\n", find_printer->dev.handlename));
+ /* Are we monitoring this event? */
- /*
- * if handle is a printer, only send if the printer_name matches.
- * ...else if handle is a printerserver, send to all
- */
+ if (!is_monitoring_event(p, msg->type, msg->field))
+ continue;
- if (*msg->printer_name && (find_printer->printer_type==PRINTER_HANDLE_IS_PRINTER)
- && !strequal(msg->printer_name, find_printer->dev.handlename))
- {
- DEBUG(10,("send_spoolss_event_notification: ignoring message sent to %s [%s]\n",
- msg->printer_name, find_printer->dev.handlename ));
- continue;
+ /* OK - send the event to the client */
+
+ data = talloc(mem_ctx, sizeof(SPOOL_NOTIFY_INFO_DATA));
+
+ ZERO_STRUCTP(data);
+
+ /* Convert unix jobid to smb jobid */
+
+ id = msg->id;
+
+ if (msg->flags & SPOOLSS_NOTIFY_MSG_UNIX_JOBID) {
+
+ id = sysjob_to_jobid(msg->id);
+
+ if (id == -1) {
+ DEBUG(3, ("no such unix jobid %d\n", msg->id));
+ goto done;
}
+ }
+ construct_info_data(data, msg->type, msg->field, id);
- /* lookup the printer if we have a name if we don't already have a
- valid NT_PRINTER_INFO_LEVEL structure. And yes I'm assuming we
- will always have a non-empty msg.printer_name */
-
- if (!printer || !printer->info_2 || strcmp(msg->printer_name, printer->info_2->printername))
- {
-
- if (printer) {
- free_a_printer(&printer, 2);
- printer = NULL;
- }
-
- result = get_a_printer(&printer, 2, msg->printer_name);
- if (!W_ERROR_IS_OK(result))
- continue;
+ switch(msg->type) {
+ case PRINTER_NOTIFY_TYPE:
+ if (printer_notify_table[msg->field].fn)
+ printer_notify_table[msg->field].fn(
+ msg, data, mem_ctx);
+ else
+ goto done;
+ break;
+ case JOB_NOTIFY_TYPE:
+ if (job_notify_table[msg->field].fn)
+ job_notify_table[msg->field].fn(
+ msg, data, mem_ctx);
+ else
+ goto done;
+ break;
+ default:
+ DEBUG(5, ("Unknown notification type %d\n",
+ msg->type));
+ goto done;
+ }
+
+ if (!p->notify.flags)
+ cli_spoolss_rrpcn(
+ &cli, mem_ctx, &p->notify.client_hnd,
+ data_len, data, p->notify.change, 0);
+ else {
+ NT_PRINTER_INFO_LEVEL *printer = NULL;
+
+ get_a_printer(&printer, 2, msg->printer);
+
+ if (!printer) {
+ DEBUG(5, ("unable to load info2 for %s\n",
+ msg->printer));
+ goto done;
}
- /* issue the client call */
+ /* XXX: This needs to be updated for
+ PRINTER_CHANGE_SET_PRINTER_DRIVER. */
- result = srv_spoolss_send_event_to_client(find_printer, &cli, msg, printer);
-
- if (!W_ERROR_IS_OK(result)) {
- DEBUG(5,("send_spoolss_event_notification: Event notification failed [%s]\n",
- dos_errstr(result)));
+ cli_spoolss_routerreplyprinter(
+ &cli, mem_ctx, &p->notify.client_hnd,
+ 0, printer->info_2->changeid);
+
+ free_a_printer(&printer, 2);
}
}
-}
-
+done:
return;
}
-/***************************************************************************
- Receive the notify message and decode the message. Do not send
- notification if we sent this originally as that would result in
- duplicates.
-****************************************************************************/
-static void srv_spoolss_receive_message(int msg_type, pid_t src, void *buf, size_t len)
+/* Receive a notify2 message */
+
+static void receive_notify2_message(int msg_type, pid_t src, void *buf,
+ size_t len)
{
- PRINTER_MESSAGE_INFO msg;
-
- if (len < sizeof(msg)) {
- DEBUG(2,("srv_spoolss_receive_message: got incorrect message size (%u)!\n", (unsigned int)len));
- return;
- }
+ struct spoolss_notify_msg msg;
+ int offset = 0;
+ TALLOC_CTX *mem_ctx = talloc_init();
- memcpy(&msg, buf, sizeof(PRINTER_MESSAGE_INFO));
-
- DEBUG(10,("srv_spoolss_receive_message: Got message printer change [queue = %s] low=0x%x high=0x%x flags=0x%x\n",
- msg.printer_name, (unsigned int)msg.low, (unsigned int)msg.high, msg.flags ));
+ /* Unpack message */
- /* Iterate the printer list */
-
- send_spoolss_event_notification(&msg);
+ ZERO_STRUCT(msg);
+
+ offset += tdb_unpack((char *)buf + offset, len - offset, "f",
+ msg.printer);
+ offset += tdb_unpack((char *)buf + offset, len - offset, "ddddd",
+ &msg.type, &msg.field, &msg.id, &msg.len, &msg.flags);
+
+ if (msg.len == 0)
+ tdb_unpack((char *)buf + offset, len - offset, "dd",
+ &msg.notify.value[0], &msg.notify.value[1]);
+ else
+ tdb_unpack((char *)buf + offset, len - offset, "B",
+ &msg.len, &msg.notify.data);
+
+ DEBUG(3, ("got NOTIFY2 message, type %d, field 0x%02x, flags 0x%04x\n",
+ msg.type, msg.field, msg.flags));
+
+ if (msg.len == 0)
+ DEBUG(3, ("value1 = %d, value2 = %d\n", msg.notify.value[0],
+ msg.notify.value[1]));
+ else
+ dump_data(3, msg.notify.data, msg.len);
+
+ /* Process message */
+
+ process_notify2_message(&msg, mem_ctx);
+
+ /* Free message */
+
+ if (msg.len > 0)
+ free(msg.notify.data);
+
+ talloc_destroy(mem_ctx);
}
/***************************************************************************
- Send a notify event.
-****************************************************************************/
-
-static BOOL srv_spoolss_sendnotify(char* printer_name, uint32 high, uint32 low, uint32 flags)
+ Server wrapper for cli_spoolss_routerreplyprinter() since the client
+ function can only send a single change notification at a time.
+
+ FIXME!!! only handles one change currently (PRINTER_CHANGE_SET_PRINTER_DRIVER)
+ --jerry
+ **************************************************************************/
+
+static WERROR srv_spoolss_routerreplyprinter (struct cli_state *reply_cli, TALLOC_CTX *mem_ctx,
+ POLICY_HND *pol, PRINTER_MESSAGE_INFO *info,
+ NT_PRINTER_INFO_LEVEL *printer)
{
- char msg[sizeof(PRINTER_MESSAGE_INFO)];
- PRINTER_MESSAGE_INFO info;
+ WERROR result;
+ uint32 condition = 0x0;
- ZERO_STRUCT(info);
+ if (info->flags & PRINTER_MESSAGE_DRIVER)
+ condition = PRINTER_CHANGE_SET_PRINTER_DRIVER;
+
+ result = cli_spoolss_routerreplyprinter(reply_cli, mem_ctx, pol, condition,
+ printer->info_2->changeid);
+
+ return result;
+}
- info.low = low;
- info.high = high;
- info.flags = flags;
- fstrcpy(info.printer_name, printer_name);
+/********************************************************************
+ Send a message to ourself about new driver being installed
+ so we can upgrade the information for each printer bound to this
+ driver
+ ********************************************************************/
+
+static BOOL srv_spoolss_drv_upgrade_printer(char* drivername)
+{
+ int len = strlen(drivername);
- memcpy(msg, &info, sizeof(PRINTER_MESSAGE_INFO));
+ if (!len)
+ return False;
- DEBUG(10,("srv_spoolss_sendnotify: printer change low=0x%x high=0x%x [%s], flags=0x%x\n",
- low, high, printer_name, flags));
+ DEBUG(10,("srv_spoolss_drv_upgrade_printer: Sending message about driver upgrade [%s]\n",
+ drivername));
- message_send_all(conn_tdb_ctx(), MSG_PRINTER_NOTIFY, msg, sizeof(PRINTER_MESSAGE_INFO),
- False, NULL);
+ message_send_pid(sys_getpid(), MSG_PRINTER_DRVUPGRADE, drivername, len+1, False);
return True;
-}
+}
+
+/**********************************************************************
+ callback to receive a MSG_PRINTER_DRVUPGRADE message and interate
+ over all printers, upgrading ones as neessary
+ **********************************************************************/
+
+void do_drv_upgrade_printer(int msg_type, pid_t src, void *buf, size_t len)
+{
+ fstring drivername;
+ int snum;
+ int n_services = lp_numservices();
+
+ len = MIN(len,sizeof(drivername)-1);
+ strncpy(drivername, buf, len);
+
+ DEBUG(10,("do_drv_upgrade_printer: Got message for new driver [%s]\n", drivername ));
+
+ /* Iterate the printer list */
+
+ for (snum=0; snum<n_services; snum++)
+ {
+ if (lp_snum_ok(snum) && lp_print_ok(snum) )
+ {
+ WERROR result;
+ NT_PRINTER_INFO_LEVEL *printer = NULL;
+
+ result = get_a_printer(&printer, 2, lp_servicename(snum));
+ if (!W_ERROR_IS_OK(result))
+ continue;
+
+ if (printer && printer->info_2 && !strcmp(drivername, printer->info_2->drivername))
+ {
+ DEBUG(6,("Updating printer [%s]\n", printer->info_2->printername));
+
+ /* all we care about currently is the change_id */
+
+ result = mod_a_printer(*printer, 2);
+ if (!W_ERROR_IS_OK(result)) {
+ DEBUG(3,("do_drv_upgrade_printer: mod_a_printer() failed with status [%s]\n",
+ dos_errstr(result)));
+ }
+ }
+
+ free_a_printer(&printer, 2);
+ }
+ }
+
+ /* all done */
+}
/********************************************************************
Copy routines used by convert_to_openprinterex()
@@ -924,16 +1126,6 @@ Can't find printer handle we created for printer %s\n", name ));
return WERR_INVALID_PRINTER_NAME;
}
-/*
- if (printer_default->datatype_ptr != NULL)
- {
- unistr2_to_ascii(datatype, printer_default->datatype, sizeof(datatype)-1);
- set_printer_hnd_datatype(handle, datatype);
- }
- else
- set_printer_hnd_datatype(handle, "");
-*/
-
/*
First case: the user is opening the print server:
@@ -997,7 +1189,7 @@ Can't find printer handle we created for printer %s\n", name ));
user_in_list(uidtoname(user.uid),
lp_printer_admin(snum)))
return WERR_OK;
-
+
close_printer_handle(p, handle);
return WERR_ACCESS_DENIED;
}
@@ -1031,7 +1223,9 @@ Can't find printer handle we created for printer %s\n", name ));
printer_default->access_required = PRINTER_ACCESS_USE;
}
- if (!print_access_check(&user, snum, printer_default->access_required)) {
+ /* check smb.conf parameters and the the sec_desc */
+
+ if (!user_ok(uidtoname(user.uid), snum) || !print_access_check(&user, snum, printer_default->access_required)) {
DEBUG(3, ("access DENIED for printer open\n"));
close_printer_handle(p, handle);
return WERR_ACCESS_DENIED;
@@ -1308,10 +1502,6 @@ WERROR _spoolss_deleteprinter(pipes_struct *p, SPOOL_Q_DELETEPRINTER *q_u, SPOOL
update_c_setprinter(False);
- if (W_ERROR_IS_OK(result)) {
- srv_spoolss_sendnotify(Printer->dev.handlename, 0, PRINTER_CHANGE_DELETE_PRINTER, 0x0);
- }
-
return result;
}
@@ -1344,26 +1534,17 @@ static int get_version_id (char * arch)
/********************************************************************
* _spoolss_deleteprinterdriver
- *
- * We currently delete the driver for the architecture only.
- * This can leave the driver for other archtectures. However,
- * since every printer associates a "Windows NT x86" driver name
- * and we cannot delete that one while it is in use, **and** since
- * it is impossible to assign a driver to a Samba printer without
- * having the "Windows NT x86" driver installed,...
- *
- * ....we should not get into trouble here.
- *
- * --jerry
********************************************************************/
-WERROR _spoolss_deleteprinterdriver(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIVER *q_u,
- SPOOL_R_DELETEPRINTERDRIVER *r_u)
+WERROR _spoolss_deleteprinterdriver(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIVER *q_u, SPOOL_R_DELETEPRINTERDRIVER *r_u)
{
fstring driver;
fstring arch;
NT_PRINTER_DRIVER_INFO_LEVEL info;
int version;
+ struct current_user user;
+
+ get_current_user(&user, p);
unistr2_to_ascii(driver, &q_u->driver, sizeof(driver)-1 );
unistr2_to_ascii(arch, &q_u->arch, sizeof(arch)-1 );
@@ -1373,21 +1554,89 @@ WERROR _spoolss_deleteprinterdriver(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIVER
/* this is what NT returns */
return WERR_INVALID_ENVIRONMENT;
}
+
+ /* if they said "Windows NT x86", then try for version 2 & 3 */
+
+ if ( version == 2 )
+ version = DRIVER_ANY_VERSION;
ZERO_STRUCT(info);
- if (!W_ERROR_IS_OK(get_a_printer_driver(&info, 3, driver, arch, version))) {
+
+ if (!W_ERROR_IS_OK(get_a_printer_driver(&info, 3, driver, arch, version)))
return WERR_UNKNOWN_PRINTER_DRIVER;
- }
+ if (printer_driver_in_use(info.info_3))
+ return WERR_PRINTER_DRIVER_IN_USE;
- if (printer_driver_in_use(arch, driver))
- {
+ return delete_printer_driver(info.info_3, &user, DRIVER_ANY_VERSION, False);
+}
+
+/********************************************************************
+ * spoolss_deleteprinterdriverex
+ ********************************************************************/
+
+WERROR _spoolss_deleteprinterdriverex(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIVEREX *q_u, SPOOL_R_DELETEPRINTERDRIVEREX *r_u)
+{
+ fstring driver;
+ fstring arch;
+ NT_PRINTER_DRIVER_INFO_LEVEL info;
+ int version;
+ uint32 flags = q_u->delete_flags;
+ BOOL delete_files;
+ struct current_user user;
+
+ get_current_user(&user, p);
+
+ unistr2_to_ascii(driver, &q_u->driver, sizeof(driver)-1 );
+ unistr2_to_ascii(arch, &q_u->arch, sizeof(arch)-1 );
+
+ /* check that we have a valid driver name first */
+ if ((version=get_version_id(arch)) == -1) {
+ /* this is what NT returns */
+ return WERR_INVALID_ENVIRONMENT;
+ }
+
+ if ( flags & DPD_DELETE_SPECIFIC_VERSION )
+ version = q_u->version;
+ else if ( version == 2 )
+ /* if they said "Windows NT x86", then try for version 2 & 3 */
+ version = DRIVER_ANY_VERSION;
+
+ ZERO_STRUCT(info);
+
+ if (!W_ERROR_IS_OK(get_a_printer_driver(&info, 3, driver, arch, version)))
+ return WERR_UNKNOWN_PRINTER_DRIVER;
+
+ if ( printer_driver_in_use(info.info_3) )
return WERR_PRINTER_DRIVER_IN_USE;
+
+ /*
+ * we have a couple of cases to consider.
+ * (1) Are any files in use? If so and DPD_DELTE_ALL_FILE is set,
+ * then the delete should fail if **any** files overlap with
+ * other drivers
+ * (2) If DPD_DELTE_UNUSED_FILES is sert, then delete all
+ * non-overlapping files
+ * (3) If neither DPD_DELTE_ALL_FILE nor DPD_DELTE_ALL_FILES
+ * is set, the do not delete any files
+ * Refer to MSDN docs on DeletePrinterDriverEx() for details.
+ */
+
+ delete_files = flags & (DPD_DELETE_ALL_FILES|DPD_DELETE_UNUSED_FILES);
+
+ if ( delete_files )
+ {
+ /* fail if any files are in use and DPD_DELETE_ALL_FILES is set */
+
+ if ( printer_driver_files_in_use(info.info_3) & (flags&DPD_DELETE_ALL_FILES) )
+ /* no idea of the correct error here */
+ return WERR_ACCESS_DENIED;
}
- return delete_printer_driver(info.info_3);
+ return delete_printer_driver(info.info_3, &user, version, delete_files);
}
+
/********************************************************************
GetPrinterData on a printer server Handle.
********************************************************************/
@@ -1438,7 +1687,11 @@ static BOOL getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint32
*type = 0x4;
if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
return False;
+#ifndef EMULATE_WIN2K_HACK /* JERRY */
SIVAL(*data, 0, 2);
+#else
+ SIVAL(*data, 0, 3);
+#endif
*needed = 0x4;
return True;
}
@@ -1606,6 +1859,96 @@ WERROR _spoolss_getprinterdata(pipes_struct *p, SPOOL_Q_GETPRINTERDATA *q_u, SPO
return WERR_OK;
}
+/*********************************************************
+ Connect to the client machine.
+**********************************************************/
+
+static BOOL spoolss_connect_to_client(struct cli_state *the_cli, char *remote_machine)
+{
+ extern pstring global_myname;
+
+ ZERO_STRUCTP(the_cli);
+ if(cli_initialise(the_cli) == NULL) {
+ DEBUG(0,("connect_to_client: unable to initialize client connection.\n"));
+ return False;
+ }
+
+ if(!resolve_name( remote_machine, &the_cli->dest_ip, 0x20)) {
+ DEBUG(0,("connect_to_client: Can't resolve address for %s\n", remote_machine));
+ cli_shutdown(the_cli);
+ return False;
+ }
+
+ if (ismyip(the_cli->dest_ip)) {
+ DEBUG(0,("connect_to_client: Machine %s is one of our addresses. Cannot add to ourselves.\n", remote_machine));
+ cli_shutdown(the_cli);
+ return False;
+ }
+
+ if (!cli_connect(the_cli, remote_machine, &the_cli->dest_ip)) {
+ DEBUG(0,("connect_to_client: unable to connect to SMB server on machine %s. Error was : %s.\n", remote_machine, cli_errstr(the_cli) ));
+ cli_shutdown(the_cli);
+ return False;
+ }
+
+ if (!attempt_netbios_session_request(the_cli, global_myname, remote_machine, &the_cli->dest_ip)) {
+ DEBUG(0,("connect_to_client: machine %s rejected the NetBIOS session request.\n",
+ remote_machine));
+ return False;
+ }
+
+ the_cli->protocol = PROTOCOL_NT1;
+
+ if (!cli_negprot(the_cli)) {
+ DEBUG(0,("connect_to_client: machine %s rejected the negotiate protocol. Error was : %s.\n", remote_machine, cli_errstr(the_cli) ));
+ cli_shutdown(the_cli);
+ return False;
+ }
+
+ if (the_cli->protocol != PROTOCOL_NT1) {
+ DEBUG(0,("connect_to_client: machine %s didn't negotiate NT protocol.\n", remote_machine));
+ cli_shutdown(the_cli);
+ return False;
+ }
+
+ /*
+ * Do an anonymous session setup.
+ */
+
+ if (!cli_session_setup(the_cli, "", "", 0, "", 0, "")) {
+ DEBUG(0,("connect_to_client: machine %s rejected the session setup. Error was : %s.\n", remote_machine, cli_errstr(the_cli) ));
+ cli_shutdown(the_cli);
+ return False;
+ }
+
+ if (!(the_cli->sec_mode & 1)) {
+ DEBUG(0,("connect_to_client: machine %s isn't in user level security mode\n", remote_machine));
+ cli_shutdown(the_cli);
+ return False;
+ }
+
+ if (!cli_send_tconX(the_cli, "IPC$", "IPC", "", 1)) {
+ DEBUG(0,("connect_to_client: machine %s rejected the tconX on the IPC$ share. Error was : %s.\n", remote_machine, cli_errstr(the_cli) ));
+ cli_shutdown(the_cli);
+ return False;
+ }
+
+ /*
+ * Ok - we have an anonymous connection to the IPC$ share.
+ * Now start the NT Domain stuff :-).
+ */
+
+ if(cli_nt_session_open(the_cli, PIPE_SPOOLSS) == False) {
+ DEBUG(0,("connect_to_client: unable to open the domain client session to machine %s. Error was : %s.\n", remote_machine, cli_errstr(the_cli)));
+ cli_nt_session_close(the_cli);
+ cli_ulogoff(the_cli);
+ cli_shutdown(the_cli);
+ return False;
+ }
+
+ return True;
+}
+
/***************************************************************************
Connect to the client.
****************************************************************************/
@@ -1626,15 +1969,14 @@ static BOOL srv_spoolss_replyopenprinter(char *printer, uint32 localprinter, uin
if(!spoolss_connect_to_client(&cli, unix_printer))
return False;
- message_register(MSG_PRINTER_NOTIFY, srv_spoolss_receive_message);
-
+ message_register(MSG_PRINTER_NOTIFY2, receive_notify2_message);
}
smb_connections++;
result = cli_spoolss_reply_open_printer(&cli, cli.mem_ctx, printer, localprinter,
type, handle);
-
+
if (!W_ERROR_IS_OK(result))
DEBUG(5,("srv_spoolss_reply_open_printer: Client RPC returned [%s]\n",
dos_errstr(result)));
@@ -1646,9 +1988,8 @@ static BOOL srv_spoolss_replyopenprinter(char *printer, uint32 localprinter, uin
* _spoolss_rffpcnex
* ReplyFindFirstPrinterChangeNotifyEx
*
- * jfmxxxx: before replying OK: status=0
- * should do a rpc call to the workstation asking ReplyOpenPrinter
- * have to code it, later.
+ * before replying OK: status=0 a rpc call is made to the workstation
+ * asking ReplyOpenPrinter
*
* in fact ReplyOpenPrinter is the changenotify equivalent on the spoolss pipe
* called from api_spoolss_rffpcnex
@@ -1681,15 +2022,17 @@ WERROR _spoolss_rffpcnex(pipes_struct *p, SPOOL_Q_RFFPCNEX *q_u, SPOOL_R_RFFPCNE
Printer->notify.option=dup_spool_notify_option(option);
- unistr2_to_ascii(Printer->notify.localmachine, localmachine, sizeof(Printer->notify.localmachine)-1);
+ unistr2_to_ascii(Printer->notify.localmachine, localmachine,
+ sizeof(Printer->notify.localmachine)-1);
+
+ /* Connect to the client machine and send a ReplyOpenPrinter */
- /* connect to the client machine and send a ReplyOpenPrinter */
- if(srv_spoolss_replyopenprinter(Printer->notify.localmachine,
+ if(!srv_spoolss_replyopenprinter(Printer->notify.localmachine,
Printer->notify.printerlocal, 1,
&Printer->notify.client_hnd))
- {
- Printer->notify.client_connected=True;
- }
+ return WERR_SERVER_UNAVAILABLE;
+
+ Printer->notify.client_connected=True;
return WERR_OK;
}
@@ -1711,7 +2054,7 @@ void spoolss_notify_server_name(int snum,
len = rpcstr_push(temp, temp_name, sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -1746,7 +2089,7 @@ void spoolss_notify_printer_name(int snum,
len = rpcstr_push(temp, p, sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -1772,7 +2115,7 @@ void spoolss_notify_share_name(int snum,
len = rpcstr_push(temp, lp_servicename(snum), sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -1800,7 +2143,7 @@ void spoolss_notify_port_name(int snum,
len = rpcstr_push(temp, printer->info_2->portname, sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -1826,7 +2169,8 @@ void spoolss_notify_driver_name(int snum,
uint32 len;
len = rpcstr_push(temp, printer->info_2->drivername, sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -1855,7 +2199,7 @@ void spoolss_notify_comment(int snum,
else
len = rpcstr_push(temp, printer->info_2->comment, sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -1882,7 +2226,7 @@ void spoolss_notify_location(int snum,
len = rpcstr_push(temp, printer->info_2->location,sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -1921,7 +2265,7 @@ void spoolss_notify_sepfile(int snum,
len = rpcstr_push(temp, printer->info_2->sepfile, sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -1948,7 +2292,7 @@ void spoolss_notify_print_processor(int snum,
len = rpcstr_push(temp, printer->info_2->printprocessor, sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -1975,7 +2319,7 @@ void spoolss_notify_parameters(int snum,
len = rpcstr_push(temp, printer->info_2->parameters, sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -2002,7 +2346,7 @@ void spoolss_notify_datatype(int snum,
len = rpcstr_push(temp, printer->info_2->datatype, sizeof(pstring)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -2162,7 +2506,7 @@ static void spoolss_notify_username(int snum,
len = rpcstr_push(temp, queue->fs_user, sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -2202,7 +2546,7 @@ static void spoolss_notify_job_name(int snum,
len = rpcstr_push(temp, queue->fs_file, sizeof(temp)-2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -2252,7 +2596,7 @@ static void spoolss_notify_job_status_string(int snum,
len = rpcstr_push(temp, p, sizeof(temp) - 2, STR_TERMINATE);
- data->notify_data.data.length = len / 2 - 1;
+ data->notify_data.data.length = len;
data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
if (!data->notify_data.data.string) {
@@ -2376,8 +2720,6 @@ static void spoolss_notify_submitted_time(int snum,
SSVAL(p, 14, st.milliseconds);
}
-#define END 65535
-
struct s_notify_info_data_table
{
uint16 type;
@@ -2389,59 +2731,61 @@ struct s_notify_info_data_table
NT_PRINTER_INFO_LEVEL *printer, TALLOC_CTX *mem_ctx);
};
+/* A table describing the various print notification constants and
+ whether the notification data is a pointer to a variable sized
+ buffer, a one value uint32 or a two value uint32. */
+
struct s_notify_info_data_table notify_info_data_table[] =
{
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_SERVER_NAME, "PRINTER_NOTIFY_SERVER_NAME", POINTER, spoolss_notify_server_name },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PRINTER_NAME, "PRINTER_NOTIFY_PRINTER_NAME", POINTER, spoolss_notify_printer_name },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_SHARE_NAME, "PRINTER_NOTIFY_SHARE_NAME", POINTER, spoolss_notify_share_name },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PORT_NAME, "PRINTER_NOTIFY_PORT_NAME", POINTER, spoolss_notify_port_name },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_DRIVER_NAME, "PRINTER_NOTIFY_DRIVER_NAME", POINTER, spoolss_notify_driver_name },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_COMMENT, "PRINTER_NOTIFY_COMMENT", POINTER, spoolss_notify_comment },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_LOCATION, "PRINTER_NOTIFY_LOCATION", POINTER, spoolss_notify_location },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_DEVMODE, "PRINTER_NOTIFY_DEVMODE", POINTER, spoolss_notify_devmode },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_SEPFILE, "PRINTER_NOTIFY_SEPFILE", POINTER, spoolss_notify_sepfile },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PRINT_PROCESSOR, "PRINTER_NOTIFY_PRINT_PROCESSOR", POINTER, spoolss_notify_print_processor },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PARAMETERS, "PRINTER_NOTIFY_PARAMETERS", POINTER, spoolss_notify_parameters },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_DATATYPE, "PRINTER_NOTIFY_DATATYPE", POINTER, spoolss_notify_datatype },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_SECURITY_DESCRIPTOR, "PRINTER_NOTIFY_SECURITY_DESCRIPTOR", POINTER, spoolss_notify_security_desc },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_ATTRIBUTES, "PRINTER_NOTIFY_ATTRIBUTES", ONE_VALUE, spoolss_notify_attributes },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PRIORITY, "PRINTER_NOTIFY_PRIORITY", ONE_VALUE, spoolss_notify_priority },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_DEFAULT_PRIORITY, "PRINTER_NOTIFY_DEFAULT_PRIORITY", ONE_VALUE, spoolss_notify_default_priority },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_START_TIME, "PRINTER_NOTIFY_START_TIME", ONE_VALUE, spoolss_notify_start_time },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_UNTIL_TIME, "PRINTER_NOTIFY_UNTIL_TIME", ONE_VALUE, spoolss_notify_until_time },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_STATUS, "PRINTER_NOTIFY_STATUS", ONE_VALUE, spoolss_notify_status },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_STATUS_STRING, "PRINTER_NOTIFY_STATUS_STRING", POINTER, NULL },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_CJOBS, "PRINTER_NOTIFY_CJOBS", ONE_VALUE, spoolss_notify_cjobs },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_AVERAGE_PPM, "PRINTER_NOTIFY_AVERAGE_PPM", ONE_VALUE, spoolss_notify_average_ppm },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_TOTAL_PAGES, "PRINTER_NOTIFY_TOTAL_PAGES", POINTER, NULL },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PAGES_PRINTED, "PRINTER_NOTIFY_PAGES_PRINTED", POINTER, NULL },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_TOTAL_BYTES, "PRINTER_NOTIFY_TOTAL_BYTES", POINTER, NULL },
-{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_BYTES_PRINTED, "PRINTER_NOTIFY_BYTES_PRINTED", POINTER, NULL },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PRINTER_NAME, "JOB_NOTIFY_PRINTER_NAME", POINTER, spoolss_notify_printer_name },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_MACHINE_NAME, "JOB_NOTIFY_MACHINE_NAME", POINTER, spoolss_notify_server_name },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PORT_NAME, "JOB_NOTIFY_PORT_NAME", POINTER, spoolss_notify_port_name },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_USER_NAME, "JOB_NOTIFY_USER_NAME", POINTER, spoolss_notify_username },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_NOTIFY_NAME, "JOB_NOTIFY_NOTIFY_NAME", POINTER, spoolss_notify_username },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_DATATYPE, "JOB_NOTIFY_DATATYPE", POINTER, spoolss_notify_datatype },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PRINT_PROCESSOR, "JOB_NOTIFY_PRINT_PROCESSOR", POINTER, spoolss_notify_print_processor },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PARAMETERS, "JOB_NOTIFY_PARAMETERS", POINTER, spoolss_notify_parameters },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_DRIVER_NAME, "JOB_NOTIFY_DRIVER_NAME", POINTER, spoolss_notify_driver_name },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_DEVMODE, "JOB_NOTIFY_DEVMODE", POINTER, spoolss_notify_devmode },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_STATUS, "JOB_NOTIFY_STATUS", ONE_VALUE, spoolss_notify_job_status },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_STATUS_STRING, "JOB_NOTIFY_STATUS_STRING", POINTER, spoolss_notify_job_status_string },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_SECURITY_DESCRIPTOR, "JOB_NOTIFY_SECURITY_DESCRIPTOR", POINTER, NULL },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_DOCUMENT, "JOB_NOTIFY_DOCUMENT", POINTER, spoolss_notify_job_name },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PRIORITY, "JOB_NOTIFY_PRIORITY", ONE_VALUE, spoolss_notify_priority },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_POSITION, "JOB_NOTIFY_POSITION", ONE_VALUE, spoolss_notify_job_position },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_SUBMITTED, "JOB_NOTIFY_SUBMITTED", POINTER, spoolss_notify_submitted_time },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_START_TIME, "JOB_NOTIFY_START_TIME", ONE_VALUE, spoolss_notify_start_time },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_UNTIL_TIME, "JOB_NOTIFY_UNTIL_TIME", ONE_VALUE, spoolss_notify_until_time },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_TIME, "JOB_NOTIFY_TIME", ONE_VALUE, spoolss_notify_job_time },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_TOTAL_PAGES, "JOB_NOTIFY_TOTAL_PAGES", ONE_VALUE, spoolss_notify_total_pages },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PAGES_PRINTED, "JOB_NOTIFY_PAGES_PRINTED", ONE_VALUE, spoolss_notify_pages_printed },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_TOTAL_BYTES, "JOB_NOTIFY_TOTAL_BYTES", ONE_VALUE, spoolss_notify_job_size },
-{ JOB_NOTIFY_TYPE, JOB_NOTIFY_BYTES_PRINTED, "JOB_NOTIFY_BYTES_PRINTED", ONE_VALUE, NULL },
-{ END, END, "", END, NULL }
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_SERVER_NAME, "PRINTER_NOTIFY_SERVER_NAME", NOTIFY_STRING, spoolss_notify_server_name },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PRINTER_NAME, "PRINTER_NOTIFY_PRINTER_NAME", NOTIFY_STRING, spoolss_notify_printer_name },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_SHARE_NAME, "PRINTER_NOTIFY_SHARE_NAME", NOTIFY_STRING, spoolss_notify_share_name },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PORT_NAME, "PRINTER_NOTIFY_PORT_NAME", NOTIFY_STRING, spoolss_notify_port_name },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_DRIVER_NAME, "PRINTER_NOTIFY_DRIVER_NAME", NOTIFY_STRING, spoolss_notify_driver_name },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_COMMENT, "PRINTER_NOTIFY_COMMENT", NOTIFY_STRING, spoolss_notify_comment },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_LOCATION, "PRINTER_NOTIFY_LOCATION", NOTIFY_STRING, spoolss_notify_location },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_DEVMODE, "PRINTER_NOTIFY_DEVMODE", NOTIFY_POINTER, spoolss_notify_devmode },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_SEPFILE, "PRINTER_NOTIFY_SEPFILE", NOTIFY_STRING, spoolss_notify_sepfile },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PRINT_PROCESSOR, "PRINTER_NOTIFY_PRINT_PROCESSOR", NOTIFY_STRING, spoolss_notify_print_processor },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PARAMETERS, "PRINTER_NOTIFY_PARAMETERS", NOTIFY_STRING, spoolss_notify_parameters },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_DATATYPE, "PRINTER_NOTIFY_DATATYPE", NOTIFY_STRING, spoolss_notify_datatype },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_SECURITY_DESCRIPTOR, "PRINTER_NOTIFY_SECURITY_DESCRIPTOR", NOTIFY_POINTER, spoolss_notify_security_desc },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_ATTRIBUTES, "PRINTER_NOTIFY_ATTRIBUTES", NOTIFY_ONE_VALUE, spoolss_notify_attributes },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PRIORITY, "PRINTER_NOTIFY_PRIORITY", NOTIFY_ONE_VALUE, spoolss_notify_priority },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_DEFAULT_PRIORITY, "PRINTER_NOTIFY_DEFAULT_PRIORITY", NOTIFY_ONE_VALUE, spoolss_notify_default_priority },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_START_TIME, "PRINTER_NOTIFY_START_TIME", NOTIFY_ONE_VALUE, spoolss_notify_start_time },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_UNTIL_TIME, "PRINTER_NOTIFY_UNTIL_TIME", NOTIFY_ONE_VALUE, spoolss_notify_until_time },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_STATUS, "PRINTER_NOTIFY_STATUS", NOTIFY_ONE_VALUE, spoolss_notify_status },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_STATUS_STRING, "PRINTER_NOTIFY_STATUS_STRING", NOTIFY_POINTER, NULL },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_CJOBS, "PRINTER_NOTIFY_CJOBS", NOTIFY_ONE_VALUE, spoolss_notify_cjobs },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_AVERAGE_PPM, "PRINTER_NOTIFY_AVERAGE_PPM", NOTIFY_ONE_VALUE, spoolss_notify_average_ppm },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_TOTAL_PAGES, "PRINTER_NOTIFY_TOTAL_PAGES", NOTIFY_POINTER, NULL },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_PAGES_PRINTED, "PRINTER_NOTIFY_PAGES_PRINTED", NOTIFY_POINTER, NULL },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_TOTAL_BYTES, "PRINTER_NOTIFY_TOTAL_BYTES", NOTIFY_POINTER, NULL },
+{ PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_BYTES_PRINTED, "PRINTER_NOTIFY_BYTES_PRINTED", NOTIFY_POINTER, NULL },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PRINTER_NAME, "JOB_NOTIFY_PRINTER_NAME", NOTIFY_STRING, spoolss_notify_printer_name },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_MACHINE_NAME, "JOB_NOTIFY_MACHINE_NAME", NOTIFY_STRING, spoolss_notify_server_name },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PORT_NAME, "JOB_NOTIFY_PORT_NAME", NOTIFY_STRING, spoolss_notify_port_name },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_USER_NAME, "JOB_NOTIFY_USER_NAME", NOTIFY_STRING, spoolss_notify_username },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_NOTIFY_NAME, "JOB_NOTIFY_NOTIFY_NAME", NOTIFY_STRING, spoolss_notify_username },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_DATATYPE, "JOB_NOTIFY_DATATYPE", NOTIFY_STRING, spoolss_notify_datatype },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PRINT_PROCESSOR, "JOB_NOTIFY_PRINT_PROCESSOR", NOTIFY_STRING, spoolss_notify_print_processor },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PARAMETERS, "JOB_NOTIFY_PARAMETERS", NOTIFY_STRING, spoolss_notify_parameters },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_DRIVER_NAME, "JOB_NOTIFY_DRIVER_NAME", NOTIFY_STRING, spoolss_notify_driver_name },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_DEVMODE, "JOB_NOTIFY_DEVMODE", NOTIFY_POINTER, spoolss_notify_devmode },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_STATUS, "JOB_NOTIFY_STATUS", NOTIFY_ONE_VALUE, spoolss_notify_job_status },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_STATUS_STRING, "JOB_NOTIFY_STATUS_STRING", NOTIFY_STRING, spoolss_notify_job_status_string },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_SECURITY_DESCRIPTOR, "JOB_NOTIFY_SECURITY_DESCRIPTOR", NOTIFY_POINTER, NULL },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_DOCUMENT, "JOB_NOTIFY_DOCUMENT", NOTIFY_STRING, spoolss_notify_job_name },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PRIORITY, "JOB_NOTIFY_PRIORITY", NOTIFY_ONE_VALUE, spoolss_notify_priority },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_POSITION, "JOB_NOTIFY_POSITION", NOTIFY_ONE_VALUE, spoolss_notify_job_position },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_SUBMITTED, "JOB_NOTIFY_SUBMITTED", NOTIFY_POINTER, spoolss_notify_submitted_time },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_START_TIME, "JOB_NOTIFY_START_TIME", NOTIFY_ONE_VALUE, spoolss_notify_start_time },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_UNTIL_TIME, "JOB_NOTIFY_UNTIL_TIME", NOTIFY_ONE_VALUE, spoolss_notify_until_time },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_TIME, "JOB_NOTIFY_TIME", NOTIFY_ONE_VALUE, spoolss_notify_job_time },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_TOTAL_PAGES, "JOB_NOTIFY_TOTAL_PAGES", NOTIFY_ONE_VALUE, spoolss_notify_total_pages },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_PAGES_PRINTED, "JOB_NOTIFY_PAGES_PRINTED", NOTIFY_ONE_VALUE, spoolss_notify_pages_printed },
+{ JOB_NOTIFY_TYPE, JOB_NOTIFY_TOTAL_BYTES, "JOB_NOTIFY_TOTAL_BYTES", NOTIFY_ONE_VALUE, spoolss_notify_job_size },
};
/*******************************************************************
@@ -2452,43 +2796,46 @@ static uint32 size_of_notify_info_data(uint16 type, uint16 field)
{
int i=0;
- while (notify_info_data_table[i].type != END)
- {
- if ( (notify_info_data_table[i].type == type ) &&
- (notify_info_data_table[i].field == field ) )
- {
- return (notify_info_data_table[i].size);
+ for (i = 0; i < sizeof(notify_info_data_table); i++) {
+ if (notify_info_data_table[i].type == type &&
+ notify_info_data_table[i].field == field) {
+ switch(notify_info_data_table[i].size) {
+ case NOTIFY_ONE_VALUE:
+ case NOTIFY_TWO_VALUE:
+ return 1;
+ case NOTIFY_STRING:
+ return 2;
+
+ /* The only pointer notify data I have seen on
+ the wire is the submitted time and this has
+ the notify size set to 4. -tpot */
+
+ case NOTIFY_POINTER:
+ return 4;
+ }
}
- i++;
}
- return (65535);
+
+ DEBUG(5, ("invalid notify data type %d/%d\n", type, field));
+
+ return 0;
}
/*******************************************************************
Return the type of notify_info_data.
********************************************************************/
-static BOOL type_of_notify_info_data(uint16 type, uint16 field)
+static int type_of_notify_info_data(uint16 type, uint16 field)
{
int i=0;
- while (notify_info_data_table[i].type != END)
- {
- if ( (notify_info_data_table[i].type == type ) &&
- (notify_info_data_table[i].field == field ) )
- {
- if (notify_info_data_table[i].size == POINTER)
- {
- return (False);
- }
- else
- {
- return (True);
- }
- }
- i++;
+ for (i = 0; i < sizeof(notify_info_data_table); i++) {
+ if (notify_info_data_table[i].type == type &&
+ notify_info_data_table[i].field == field)
+ return notify_info_data_table[i].size;
}
- return (False);
+
+ return False;
}
/****************************************************************************
@@ -2496,21 +2843,18 @@ static BOOL type_of_notify_info_data(uint16 type, uint16 field)
static int search_notify(uint16 type, uint16 field, int *value)
{
- int j;
- BOOL found;
+ int i;
- for (j=0, found=False; found==False && notify_info_data_table[j].type != END ; j++)
- {
- if ( (notify_info_data_table[j].type == type ) &&
- (notify_info_data_table[j].field == field ) )
- found=True;
+ for (i = 0; i < sizeof(notify_info_data_table); i++) {
+ if (notify_info_data_table[i].type == type &&
+ notify_info_data_table[i].field == field &&
+ notify_info_data_table[i].fn != NULL) {
+ *value = i;
+ return True;
+ }
}
- *value=--j;
-
- if ( found && (notify_info_data_table[j].fn != NULL) )
- return True;
- else
- return False;
+
+ return False;
}
/****************************************************************************
@@ -2521,7 +2865,12 @@ void construct_info_data(SPOOL_NOTIFY_INFO_DATA *info_data, uint16 type, uint16
info_data->type = type;
info_data->field = field;
info_data->reserved = 0;
- info_data->id = id;
+
+ if (type == JOB_NOTIFY_TYPE)
+ info_data->id = id;
+ else
+ info_data->id = 0;
+
info_data->size = size_of_notify_info_data(type, field);
info_data->enc_type = type_of_notify_info_data(type, field);
}
@@ -2570,7 +2919,7 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
current_data=&info->data[info->count];
- construct_info_data(current_data, type, field, id);
+ construct_info_data(current_data, type, field, id);
DEBUG(10,("construct_notify_printer_info: calling [%s] snum=%d printername=[%s])\n",
notify_info_data_table[j].name, snum, printer->info_2->printername ));
@@ -2812,7 +3161,6 @@ static WERROR printer_notify_info(pipes_struct *p, POLICY_HND *hnd, SPOOL_NOTIFY
WERROR _spoolss_rfnpcnex( pipes_struct *p, SPOOL_Q_RFNPCNEX *q_u, SPOOL_R_RFNPCNEX *r_u)
{
POLICY_HND *handle = &q_u->handle;
-/* uint32 change = q_u->change; - notused. */
/* SPOOL_NOTIFY_OPTION *option = q_u->option; - notused. */
SPOOL_NOTIFY_INFO *info = &r_u->info;
@@ -2830,17 +3178,19 @@ WERROR _spoolss_rfnpcnex( pipes_struct *p, SPOOL_Q_RFNPCNEX *q_u, SPOOL_R_RFNPCN
DEBUG(4,("Printer type %x\n",Printer->printer_type));
- /* jfm: the change value isn't used right now.
- * we will honour it when
- * a) we'll be able to send notification to the client
- * b) we'll have a way to communicate between the spoolss process.
- *
- * same thing for option->flags
+ /*
+ * We are now using the change value, and
* I should check for PRINTER_NOTIFY_OPTIONS_REFRESH but as
* I don't have a global notification system, I'm sending back all the
* informations even when _NOTHING_ has changed.
*/
+ /* We need to keep track of the change value to send back in
+ RRPCN replies otherwise our updates are ignored. */
+
+ if (Printer->notify.client_connected)
+ Printer->notify.change = q_u->change;
+
/* just ignore the SPOOL_NOTIFY_OPTION */
switch (Printer->printer_type) {
@@ -2932,7 +3282,7 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum)
printer->global_counter = global_counter;
printer->total_pages = 0;
-#if 0 /* JERRY */
+#ifndef EMULATE_WIN2K_HACK /* JERRY */
printer->major_version = 0x0004; /* NT 4 */
printer->build_version = 0x0565; /* build 1381 */
#else
@@ -2971,7 +3321,6 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum)
* construct_printer_info_1
* fill a printer_info_1 struct
********************************************************************/
-
static BOOL construct_printer_info_1(uint32 flags, PRINTER_INFO_1 *printer, int snum)
{
pstring chaine;
@@ -3046,8 +3395,10 @@ static DEVICEMODE *construct_dev_mode(int snum)
if (printer->info_2->devmode)
ntdevmode = dup_nt_devicemode(printer->info_2->devmode);
- if (ntdevmode == NULL)
+ if (ntdevmode == NULL) {
+ DEBUG(5, ("BONG! There was no device mode!\n"));
goto fail;
+ }
DEBUGADD(8,("loading DEVICEMODE\n"));
@@ -3408,10 +3759,26 @@ static WERROR enum_all_printers_info_1_remote(fstring name, NEW_BUFFER *buffer,
enum_all_printers_info_1_network.
*********************************************************************/
-static WERROR enum_all_printers_info_1_network(NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
+static WERROR enum_all_printers_info_1_network(fstring name, NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
{
+ char *s = name;
+
DEBUG(4,("enum_all_printers_info_1_network\n"));
+ /* If we respond to a enum_printers level 1 on our name with flags
+ set to PRINTER_ENUM_REMOTE with a list of printers then these
+ printers incorrectly appear in the APW browse list.
+ Specifically the printers for the server appear at the workgroup
+ level where all the other servers in the domain are
+ listed. Windows responds to this call with a
+ WERR_CAN_NOT_COMPLETE so we should do the same. */
+
+ if (name[0] == '\\' && name[1] == '\\')
+ s = name + 2;
+
+ if (is_myname_or_ipaddr(s))
+ return WERR_CAN_NOT_COMPLETE;
+
return enum_all_printers_info_1(PRINTER_ENUM_UNKNOWN_8, buffer, offered, needed, returned);
}
@@ -3449,9 +3816,9 @@ static WERROR enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint3
}
/* check the required size. */
- for (i=0; i<*returned; i++)
+ for (i=0; i<*returned; i++)
(*needed) += spoolss_size_printer_info_2(&printers[i]);
-
+
if (!alloc_buffer_size(buffer, *needed)) {
for (i=0; i<*returned; i++) {
free_devmode(printers[i].devmode);
@@ -3498,7 +3865,7 @@ static WERROR enumprinters_level1( uint32 flags, fstring name,
return enum_all_printers_info_1_remote(name, buffer, offered, needed, returned);
if (flags & PRINTER_ENUM_NETWORK)
- return enum_all_printers_info_1_network(buffer, offered, needed, returned);
+ return enum_all_printers_info_1_network(name, buffer, offered, needed, returned);
return WERR_OK; /* NT4sp5 does that */
}
@@ -3681,7 +4048,7 @@ static WERROR getprinter_level_2(int snum, NEW_BUFFER *buffer, uint32 offered, u
/* check the required size. */
*needed += spoolss_size_printer_info_2(printer);
-
+
if (!alloc_buffer_size(buffer, *needed)) {
free_printer_info_2(printer);
return WERR_INSUFFICIENT_BUFFER;
@@ -4728,6 +5095,7 @@ static BOOL check_printer_ok(NT_PRINTER_INFO_LEVEL_2 *info, int snum)
static BOOL add_printer_hook(NT_PRINTER_INFO_LEVEL *printer)
{
+ extern userdom_struct current_user_info;
char *cmd = lp_addprinter_cmd();
char **qlines;
pstring command;
@@ -4742,13 +5110,13 @@ static BOOL add_printer_hook(NT_PRINTER_INFO_LEVEL *printer)
get_called_name());
/* change \ to \\ for the shell */
all_string_sub(driverlocation,"\\","\\\\",sizeof(pstring));
-
+ standard_sub_basic(current_user_info.smb_name, remote_machine,sizeof(remote_machine));
+
slprintf(command, sizeof(command)-1, "%s \"%s\" \"%s\" \"%s\" \"%s\" \"%s\" \"%s\" \"%s\"",
cmd, printer->info_2->printername, printer->info_2->sharename,
printer->info_2->portname, printer->info_2->drivername,
printer->info_2->location, driverlocation, remote_machine);
- /* Convert script args to unix-codepage */
DEBUG(10,("Running [%s]\n", command));
ret = smbrun(command, &fd);
DEBUGADD(10,("returned [%d]\n", ret));
@@ -5039,13 +5407,10 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level,
int snum;
NT_PRINTER_INFO_LEVEL *printer = NULL, *old_printer = NULL;
Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
- PRINTER_MESSAGE_INFO msg;
WERROR result;
DEBUG(8,("update_printer\n"));
-
- ZERO_STRUCT(msg);
-
+
result = WERR_OK;
if (level!=2) {
@@ -5159,8 +5524,11 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level,
* bound to the printer, simulating what happens in the Windows arch.
*/
if (!strequal(printer->info_2->drivername, old_printer->info_2->drivername)){
- set_driver_init(printer, 2);
- msg.flags |= PRINTER_MESSAGE_DRIVER;
+ if (!set_driver_init(printer, 2)) {
+ DEBUG(5,("update_printer: Error restoring driver initialization data for driver [%s]!\n",
+ printer->info_2->drivername));
+ }
+ notify_printer_driver(snum, printer->info_2->drivername);
}
}
@@ -5171,28 +5539,18 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level,
all the possible changes */
if (!strequal(printer->info_2->comment, old_printer->info_2->comment))
- msg.flags |= PRINTER_MESSAGE_COMMENT;
+ notify_printer_comment(snum, printer->info_2->comment);
if (!strequal(printer->info_2->sharename, old_printer->info_2->sharename))
- msg.flags |= PRINTER_MESSAGE_SHARENAME;
+ notify_printer_sharename(snum, printer->info_2->sharename);
if (!strequal(printer->info_2->portname, old_printer->info_2->portname))
- msg.flags |= PRINTER_MESSAGE_PORT;
+ notify_printer_port(snum, printer->info_2->portname);
if (!strequal(printer->info_2->location, old_printer->info_2->location))
- msg.flags |= PRINTER_MESSAGE_LOCATION;
-
- ZERO_STRUCT(msg);
-
- msg.low = PRINTER_CHANGE_ADD_PRINTER;
- fstrcpy(msg.printer_name, printer->info_2->printername);
-
- /* only send a notify if something changed */
- if (msg.flags) {
- srv_spoolss_sendnotify(msg.printer_name, 0, PRINTER_CHANGE_ADD_PRINTER, msg.flags);
- }
+ notify_printer_location(snum, printer->info_2->location);
- done:
+done:
free_a_printer(&printer, 2);
free_a_printer(&old_printer, 2);
@@ -5310,7 +5668,7 @@ static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue,
static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
int position, int snum,
- NT_PRINTER_INFO_LEVEL *ntprinter,
+ NT_PRINTER_INFO_LEVEL *ntprinter,
DEVICEMODE *devmode)
{
pstring temp_name;
@@ -5427,7 +5785,7 @@ static WERROR enumjobs_level2(print_queue_struct *queue, int snum,
*returned = 0;
goto done;
}
-
+
if (!(devmode = construct_dev_mode(snum))) {
*returned = 0;
result = WERR_NOMEM;
@@ -5470,6 +5828,7 @@ static WERROR enumjobs_level2(print_queue_struct *queue, int snum,
SAFE_FREE(info);
return result;
+
}
/****************************************************************************
@@ -5538,8 +5897,6 @@ WERROR _spoolss_setjob(pipes_struct *p, SPOOL_Q_SETJOB *q_u, SPOOL_R_SETJOB *r_u
{
POLICY_HND *handle = &q_u->handle;
uint32 jobid = q_u->jobid;
-/* uint32 level = q_u->level; - notused. */
-/* JOB_INFO *ctr = &q_u->ctr; - notused. */
uint32 command = q_u->command;
struct current_user user;
@@ -5597,9 +5954,7 @@ static WERROR enumprinterdrivers_level1(fstring servername, fstring architecture
*returned=0;
-#define MAX_VERSION 4
-
- for (version=0; version<MAX_VERSION; version++) {
+ for (version=0; version<DRIVER_MAX_VERSION; version++) {
list=NULL;
ndrivers=get_ntdrivers(&list, architecture, version);
DEBUGADD(4,("we have:[%d] drivers in environment [%s] and version [%d]\n", ndrivers, architecture, version));
@@ -5678,9 +6033,7 @@ static WERROR enumprinterdrivers_level2(fstring servername, fstring architecture
*returned=0;
-#define MAX_VERSION 4
-
- for (version=0; version<MAX_VERSION; version++) {
+ for (version=0; version<DRIVER_MAX_VERSION; version++) {
list=NULL;
ndrivers=get_ntdrivers(&list, architecture, version);
DEBUGADD(4,("we have:[%d] drivers in environment [%s] and version [%d]\n", ndrivers, architecture, version));
@@ -5760,9 +6113,7 @@ static WERROR enumprinterdrivers_level3(fstring servername, fstring architecture
*returned=0;
-#define MAX_VERSION 4
-
- for (version=0; version<MAX_VERSION; version++) {
+ for (version=0; version<DRIVER_MAX_VERSION; version++) {
list=NULL;
ndrivers=get_ntdrivers(&list, architecture, version);
DEBUGADD(4,("we have:[%d] drivers in environment [%s] and version [%d]\n", ndrivers, architecture, version));
@@ -6415,9 +6766,6 @@ static WERROR spoolss_addprinterex_level_2( pipes_struct *p, const UNISTR2 *uni_
}
update_c_setprinter(False);
-
- srv_spoolss_sendnotify(printer->info_2->printername, 0, PRINTER_CHANGE_ADD_PRINTER, 0x0);
-
free_a_printer(&printer,2);
return WERR_OK;
@@ -6462,10 +6810,12 @@ WERROR _spoolss_addprinterdriver(pipes_struct *p, SPOOL_Q_ADDPRINTERDRIVER *q_u,
WERROR err = WERR_OK;
NT_PRINTER_DRIVER_INFO_LEVEL driver;
struct current_user user;
-
+ fstring driver_name;
+ uint32 version;
+
ZERO_STRUCT(driver);
- get_current_user(&user, p);
+ get_current_user(&user, p);
if (!convert_printer_driver_info(info, &driver, level)) {
err = WERR_NOMEM;
@@ -6489,11 +6839,131 @@ WERROR _spoolss_addprinterdriver(pipes_struct *p, SPOOL_Q_ADDPRINTERDRIVER *q_u,
goto done;
}
- done:
+ /* BEGIN_ADMIN_LOG */
+ switch(level) {
+ case 3:
+ sys_adminlog(LOG_INFO,"Added printer driver. Print driver name: %s. Print driver OS: %s. Administrator name: %s.",
+ driver.info_3->name,drv_ver_to_os[driver.info_3->cversion],uidtoname(user.uid));
+ fstrcpy(driver_name, driver.info_3->name);
+ break;
+ case 6:
+ sys_adminlog(LOG_INFO,"Added printer driver. Print driver name: %s. Print driver OS: %s. Administrator name: %s.",
+ driver.info_6->name,drv_ver_to_os[driver.info_6->version],uidtoname(user.uid));
+ fstrcpy(driver_name, driver.info_6->name);
+ break;
+ }
+ /* END_ADMIN_LOG */
+
+ /*
+ * I think this is where he DrvUpgradePrinter() hook would be
+ * be called in a driver's interface DLL on a Windows NT 4.0/2k
+ * server. Right now, we just need to send ourselves a message
+ * to update each printer bound to this driver. --jerry
+ */
+
+ if (!srv_spoolss_drv_upgrade_printer(driver_name)) {
+ DEBUG(0,("_spoolss_addprinterdriver: Failed to send message about upgrading driver [%s]!\n",
+ driver_name));
+ }
+
+ /*
+ * Based on the version (e.g. driver destination dir: 0=9x,2=Nt/2k,3=2k/Xp),
+ * decide if the driver init data should be deleted. The rules are:
+ * 1) never delete init data if it is a 9x driver, they don't use it anyway
+ * 2) delete init data only if there is no 2k/Xp driver
+ * 3) always delete init data
+ * The generalized rule is always use init data from the highest order driver.
+ * It is necessary to follow the driver install by an initialization step to
+ * finish off this process.
+ */
+ if (level == 3)
+ version = driver.info_3->cversion;
+ else if (level == 6)
+ version = driver.info_6->version;
+ else
+ version = -1;
+ switch (version) {
+ /*
+ * 9x printer driver - never delete init data
+ */
+ case 0:
+ DEBUG(10,("_spoolss_addprinterdriver: init data not deleted for 9x driver [%s]\n",
+ driver_name));
+ break;
+
+ /*
+ * Nt or 2k (compatiblity mode) printer driver - only delete init data if
+ * there is no 2k/Xp driver init data for this driver name.
+ */
+ case 2:
+ {
+ NT_PRINTER_DRIVER_INFO_LEVEL driver1;
+
+ if (!W_ERROR_IS_OK(get_a_printer_driver(&driver1, 3, driver_name, "Windows NT x86", 3))) {
+ /*
+ * No 2k/Xp driver found, delete init data (if any) for the new Nt driver.
+ */
+ if (!del_driver_init(driver_name))
+ DEBUG(6,("_spoolss_addprinterdriver: del_driver_init(%s) Nt failed!\n", driver_name));
+ } else {
+ /*
+ * a 2k/Xp driver was found, don't delete init data because Nt driver will use it.
+ */
+ free_a_printer_driver(driver1,3);
+ DEBUG(10,("_spoolss_addprinterdriver: init data not deleted for Nt driver [%s]\n",
+ driver_name));
+ }
+ }
+ break;
+
+ /*
+ * 2k or Xp printer driver - always delete init data
+ */
+ case 3:
+ if (!del_driver_init(driver_name))
+ DEBUG(6,("_spoolss_addprinterdriver: del_driver_init(%s) 2k/Xp failed!\n", driver_name));
+ break;
+
+ default:
+ DEBUG(0,("_spoolss_addprinterdriver: invalid level=%d\n", level));
+ break;
+ }
+
+
+done:
free_a_printer_driver(driver, level);
return err;
}
+/********************************************************************
+ * spoolss_addprinterdriverex
+ ********************************************************************/
+
+WERROR _spoolss_addprinterdriverex(pipes_struct *p, SPOOL_Q_ADDPRINTERDRIVEREX *q_u, SPOOL_R_ADDPRINTERDRIVEREX *r_u)
+{
+ SPOOL_Q_ADDPRINTERDRIVER q_u_local;
+ SPOOL_R_ADDPRINTERDRIVER r_u_local;
+
+ /*
+ * we only support the semantics of AddPrinterDriver()
+ * i.e. only copy files that are newer than existing ones
+ */
+
+ if ( q_u->copy_flags != APD_COPY_NEW_FILES )
+ return WERR_ACCESS_DENIED;
+
+ /* just pass the information off to _spoolss_addprinterdriver() */
+ ZERO_STRUCT(q_u_local);
+ ZERO_STRUCT(r_u_local);
+
+ q_u_local.server_name_ptr = q_u->server_name_ptr;
+ copy_unistr2(&q_u_local.server_name, &q_u->server_name);
+ q_u_local.level = q_u->level;
+ memcpy( &q_u_local.info, &q_u->info, sizeof(SPOOL_PRINTER_DRIVER_INFO_LEVEL) );
+
+ return _spoolss_addprinterdriver( p, &q_u_local, &r_u_local );
+}
+
/****************************************************************************
****************************************************************************/
@@ -6632,23 +7102,6 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
if ( (in_value_len==0) && (in_data_len==0) ) {
DEBUGADD(6,("Activating NT mega-hack to find sizes\n"));
-#if 0
- /*
- * NT can ask for a specific parameter size - we need to return NO_MORE_ITEMS
- * if this parameter size doesn't exist.
- * Ok - my opinion here is that the client is not asking for the greatest
- * possible size of all the parameters, but is asking specifically for the size needed
- * for this specific parameter. In that case we can remove the loop below and
- * simplify this lookup code considerably. JF - comments welcome. JRA.
- */
-
- if (!get_specific_param_by_index(*printer, 2, idx, value, &data, &type, &data_len)) {
- SAFE_FREE(data);
- free_a_printer(&printer, 2);
- return WERR_NO_MORE_ITEMS;
- }
-#endif
-
SAFE_FREE(data);
param_index=0;
@@ -6692,7 +7145,7 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
if((*out_value=(uint16 *)talloc_zero(p->mem_ctx, in_value_len*sizeof(uint8))) == NULL)
return WERR_NOMEM;
- *out_value_len = rpcstr_push((char *)*out_value, "", in_value_len, 0);
+ *out_value_len = (uint32)rpcstr_push((char *)*out_value, "", in_value_len, 0);
/* the data is counted in bytes */
*out_max_data_len = in_data_len;
@@ -6720,7 +7173,7 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
return WERR_NOMEM;
}
- *out_value_len = rpcstr_push((char *)*out_value,value, in_value_len, 0);
+ *out_value_len = (uint32)rpcstr_push((char *)*out_value,value, in_value_len, 0);
*out_type=type;
@@ -6747,10 +7200,8 @@ WERROR _spoolss_setprinterdata( pipes_struct *p, SPOOL_Q_SETPRINTERDATA *q_u, SP
POLICY_HND *handle = &q_u->handle;
UNISTR2 *value = &q_u->value;
uint32 type = q_u->type;
-/* uint32 max_len = q_u->max_len; - notused. */
uint8 *data = q_u->data;
uint32 real_len = q_u->real_len;
-/* uint32 numeric_data = q_u->numeric_data; - notused. */
NT_PRINTER_INFO_LEVEL *printer = NULL;
NT_PRINTER_PARAM *param = NULL, old_param;
@@ -7022,8 +7473,6 @@ done:
WERROR _spoolss_setform(pipes_struct *p, SPOOL_Q_SETFORM *q_u, SPOOL_R_SETFORM *r_u)
{
POLICY_HND *handle = &q_u->handle;
-/* UNISTR2 *uni_name = &q_u->name; - notused. */
-/* uint32 level = q_u->level; - notused. */
FORM *form = &q_u->form;
nt_forms_struct tmpForm;
int snum;
@@ -7114,12 +7563,10 @@ static WERROR enumprintprocessors_level_1(NEW_BUFFER *buffer, uint32 offered, ui
WERROR _spoolss_enumprintprocessors(pipes_struct *p, SPOOL_Q_ENUMPRINTPROCESSORS *q_u, SPOOL_R_ENUMPRINTPROCESSORS *r_u)
{
-/* UNISTR2 *name = &q_u->name; - notused. */
-/* UNISTR2 *environment = &q_u->environment; - notused. */
uint32 level = q_u->level;
- NEW_BUFFER *buffer = NULL;
+ NEW_BUFFER *buffer = NULL;
uint32 offered = q_u->offered;
- uint32 *needed = &r_u->needed;
+ uint32 *needed = &r_u->needed;
uint32 *returned = &r_u->returned;
/* that's an [in out] buffer */
@@ -7183,8 +7630,6 @@ static WERROR enumprintprocdatatypes_level_1(NEW_BUFFER *buffer, uint32 offered,
WERROR _spoolss_enumprintprocdatatypes(pipes_struct *p, SPOOL_Q_ENUMPRINTPROCDATATYPES *q_u, SPOOL_R_ENUMPRINTPROCDATATYPES *r_u)
{
-/* UNISTR2 *name = &q_u->name; - notused. */
-/* UNISTR2 *processor = &q_u->processor; - notused. */
uint32 level = q_u->level;
NEW_BUFFER *buffer = NULL;
uint32 offered = q_u->offered;
@@ -7279,11 +7724,10 @@ static WERROR enumprintmonitors_level_2(NEW_BUFFER *buffer, uint32 offered, uint
WERROR _spoolss_enumprintmonitors(pipes_struct *p, SPOOL_Q_ENUMPRINTMONITORS *q_u, SPOOL_R_ENUMPRINTMONITORS *r_u)
{
-/* UNISTR2 *name = &q_u->name; - notused. */
uint32 level = q_u->level;
- NEW_BUFFER *buffer = NULL;
+ NEW_BUFFER *buffer = NULL;
uint32 offered = q_u->offered;
- uint32 *needed = &r_u->needed;
+ uint32 *needed = &r_u->needed;
uint32 *returned = &r_u->returned;
/* that's an [in out] buffer */
@@ -7427,7 +7871,7 @@ static WERROR getjob_level_2(print_queue_struct *queue, int count, int snum, uin
free_job_info_2(info_2); /* Also frees devmode */
SAFE_FREE(info_2);
free_a_printer(&ntprinter, 2);
-
+
return ret;
}
@@ -7594,6 +8038,34 @@ WERROR _spoolss_setprinterdataex(pipes_struct *p, SPOOL_Q_SETPRINTERDATAEX *q_u,
return _spoolss_setprinterdata(p, &q_u_local, &r_u_local);
}
+
+/********************************************************************
+ * spoolss_deleteprinterdataex
+ ********************************************************************/
+
+WERROR _spoolss_deleteprinterdataex(pipes_struct *p, SPOOL_Q_DELETEPRINTERDATAEX *q_u, SPOOL_R_DELETEPRINTERDATAEX *r_u)
+{
+ SPOOL_Q_DELETEPRINTERDATA q_u_local;
+ SPOOL_R_DELETEPRINTERDATA r_u_local;
+ fstring key;
+
+ /* From MSDN documentation of SetPrinterDataEx: pass request to
+ SetPrinterData if key is "PrinterDriverData" */
+
+ unistr2_to_ascii(key, &q_u->keyname, sizeof(key) - 1);
+
+ if (strcmp(key, "PrinterDriverData") != 0)
+ return WERR_INVALID_PARAM;
+
+ memcpy(&q_u_local.handle, &q_u->handle, sizeof(POLICY_HND));
+ copy_unistr2(&q_u_local.valuename, &q_u->valuename);
+
+ return _spoolss_deleteprinterdata( p, &q_u_local, &r_u_local );
+}
+
+
+
+
/********************************************************************
* spoolss_enumprinterkey
********************************************************************/
@@ -7661,6 +8133,34 @@ WERROR _spoolss_enumprinterkey(pipes_struct *p, SPOOL_Q_ENUMPRINTERKEY *q_u, SPO
}
/********************************************************************
+ * spoolss_deleteprinterkey
+ ********************************************************************/
+
+WERROR _spoolss_deleteprinterkey(pipes_struct *p, SPOOL_Q_DELETEPRINTERKEY *q_u, SPOOL_R_DELETEPRINTERKEY *r_u)
+{
+ Printer_entry *Printer = find_printer_index_by_hnd(p, &q_u->handle);
+ fstring key;
+
+ if (!Printer) {
+ DEBUG(2,("_spoolss_deleteprinterkey: Invalid handle (%s:%u:%u).\n", OUR_HANDLE(&q_u->handle)));
+ return WERR_BADFID;
+ }
+
+ unistr2_to_ascii(key, &q_u->keyname, sizeof(key) - 1);
+
+ if (strcmp(key, "PrinterDriverData") != 0)
+ return WERR_INVALID_PARAM;
+
+ /*
+ * this is what 2k returns when you try to delete the "PrinterDriverData"
+ * key
+ */
+
+ return WERR_ACCESS_DENIED;
+}
+
+
+/********************************************************************
* spoolss_enumprinterdataex
********************************************************************/
@@ -7801,7 +8301,7 @@ static WERROR getprintprocessordirectory_level_1(UNISTR2 *name,
unistr2_to_ascii(long_archi, environment, sizeof(long_archi)-1);
- if (get_short_archi(short_archi, long_archi)==FALSE)
+ if (get_short_archi(short_archi, long_archi)==False)
return WERR_INVALID_ENVIRONMENT;
if((info=(PRINTPROCESSOR_DIRECTORY_1 *)malloc(sizeof(PRINTPROCESSOR_DIRECTORY_1))) == NULL)
@@ -7834,6 +8334,7 @@ WERROR _spoolss_getprintprocessordirectory(pipes_struct *p, SPOOL_Q_GETPRINTPROC
NEW_BUFFER *buffer = NULL;
uint32 offered = q_u->offered;
uint32 *needed = &r_u->needed;
+ WERROR result;
/* that's an [in out] buffer */
spoolss_move_buffer(q_u->buffer, &r_u->buffer);
@@ -7845,12 +8346,13 @@ WERROR _spoolss_getprintprocessordirectory(pipes_struct *p, SPOOL_Q_GETPRINTPROC
switch(level) {
case 1:
- return getprintprocessordirectory_level_1
+ result = getprintprocessordirectory_level_1
(&q_u->name, &q_u->environment, buffer, offered, needed);
default:
- return WERR_UNKNOWN_LEVEL;
+ result = WERR_UNKNOWN_LEVEL;
}
- return WERR_ACCESS_DENIED;
+ return result;
}
+
diff --git a/source3/rpc_server/srv_srvsvc.c b/source3/rpc_server/srv_srvsvc.c
index ee4ec8aa0a..5e1c005d54 100644
--- a/source3/rpc_server/srv_srvsvc.c
+++ b/source3/rpc_server/srv_srvsvc.c
@@ -25,6 +25,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
/*******************************************************************
api_srv_net_srv_get_info
********************************************************************/
@@ -492,25 +495,25 @@ static BOOL api_srv_net_file_set_secdesc(pipes_struct *p)
\PIPE\srvsvc commands
********************************************************************/
-struct api_struct api_srv_cmds[] =
+static const struct api_struct api_srv_cmds[] =
{
- { "SRV_NETCONNENUM" , SRV_NETCONNENUM , api_srv_net_conn_enum },
- { "SRV_NETSESSENUM" , SRV_NETSESSENUM , api_srv_net_sess_enum },
- { "SRV_NETSHAREENUM_ALL" , SRV_NETSHAREENUM_ALL , api_srv_net_share_enum_all },
- { "SRV_NETSHAREENUM" , SRV_NETSHAREENUM , api_srv_net_share_enum },
- { "SRV_NET_SHARE_ADD" , SRV_NET_SHARE_ADD , api_srv_net_share_add },
- { "SRV_NET_SHARE_DEL" , SRV_NET_SHARE_DEL , api_srv_net_share_del },
- { "SRV_NET_SHARE_GET_INFO", SRV_NET_SHARE_GET_INFO, api_srv_net_share_get_info },
- { "SRV_NET_SHARE_SET_INFO", SRV_NET_SHARE_SET_INFO, api_srv_net_share_set_info },
- { "SRV_NETFILEENUM" , SRV_NETFILEENUM , api_srv_net_file_enum },
- { "SRV_NET_SRV_GET_INFO" , SRV_NET_SRV_GET_INFO , api_srv_net_srv_get_info },
- { "SRV_NET_SRV_SET_INFO" , SRV_NET_SRV_SET_INFO , api_srv_net_srv_set_info },
- { "SRV_NET_REMOTE_TOD" , SRV_NET_REMOTE_TOD , api_srv_net_remote_tod },
- { "SRV_NET_DISK_ENUM" , SRV_NET_DISK_ENUM , api_srv_net_disk_enum },
- { "SRV_NET_NAME_VALIDATE" , SRV_NET_NAME_VALIDATE , api_srv_net_name_validate},
- { "SRV_NETFILEQUERYSECDESC",SRV_NETFILEQUERYSECDESC,api_srv_net_file_query_secdesc},
- { "SRV_NETFILESETSECDESC" , SRV_NETFILESETSECDESC , api_srv_net_file_set_secdesc},
- { NULL , 0 , NULL }
+ { "SRV_NET_CONN_ENUM" , SRV_NET_CONN_ENUM , api_srv_net_conn_enum },
+ { "SRV_NET_SESS_ENUM" , SRV_NET_SESS_ENUM , api_srv_net_sess_enum },
+ { "SRV_NET_SHARE_ENUM_ALL" , SRV_NET_SHARE_ENUM_ALL , api_srv_net_share_enum_all },
+ { "SRV_NET_SHARE_ENUM" , SRV_NET_SHARE_ENUM , api_srv_net_share_enum },
+ { "SRV_NET_SHARE_ADD" , SRV_NET_SHARE_ADD , api_srv_net_share_add },
+ { "SRV_NET_SHARE_DEL" , SRV_NET_SHARE_DEL , api_srv_net_share_del },
+ { "SRV_NET_SHARE_GET_INFO", SRV_NET_SHARE_GET_INFO, api_srv_net_share_get_info },
+ { "SRV_NET_SHARE_SET_INFO", SRV_NET_SHARE_SET_INFO, api_srv_net_share_set_info },
+ { "SRV_NET_FILE_ENUM" , SRV_NET_FILE_ENUM , api_srv_net_file_enum },
+ { "SRV_NET_SRV_GET_INFO" , SRV_NET_SRV_GET_INFO , api_srv_net_srv_get_info },
+ { "SRV_NET_SRV_SET_INFO" , SRV_NET_SRV_SET_INFO , api_srv_net_srv_set_info },
+ { "SRV_NET_REMOTE_TOD" , SRV_NET_REMOTE_TOD , api_srv_net_remote_tod },
+ { "SRV_NET_DISK_ENUM" , SRV_NET_DISK_ENUM , api_srv_net_disk_enum },
+ { "SRV_NET_NAME_VALIDATE" , SRV_NET_NAME_VALIDATE , api_srv_net_name_validate},
+ { "SRV_NET_FILE_QUERY_SECDESC",SRV_NET_FILE_QUERY_SECDESC, api_srv_net_file_query_secdesc},
+ { "SRV_NET_FILE_SET_SECDESC" , SRV_NET_FILE_SET_SECDESC , api_srv_net_file_set_secdesc},
+ { NULL , 0 , NULL }
};
/*******************************************************************
diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c
index 1f3b1945e3..b5f6bd2f07 100644
--- a/source3/rpc_server/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srv_srvsvc_nt.c
@@ -23,6 +23,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
extern pstring global_myname;
/*******************************************************************
@@ -38,7 +41,7 @@ static void init_srv_share_info_1(pipes_struct *p, SRV_SHARE_INFO_1 *sh1, int sn
pstrcpy(net_name, lp_servicename(snum));
pstrcpy(remark, lp_comment(snum));
- standard_sub_conn(p->conn, remark);
+ standard_sub_conn(p->conn, remark,sizeof(remark));
len_net_name = strlen(net_name);
/* work out the share type */
@@ -70,7 +73,7 @@ static void init_srv_share_info_2(pipes_struct *p, SRV_SHARE_INFO_2 *sh2, int sn
pstrcpy(net_name, lp_servicename(snum));
pstrcpy(remark, lp_comment(snum));
- standard_sub_conn(p->conn, remark);
+ standard_sub_conn(p->conn, remark,sizeof(remark));
pstrcpy(path, "C:");
pstrcat(path, lp_pathname(snum));
@@ -308,7 +311,7 @@ void map_generic_share_sd_bits(SEC_DESC *psd)
Can this user access with share with the required permissions ?
********************************************************************/
-BOOL share_access_check(connection_struct *conn, int snum, uint16 vuid, uint32 desired_access)
+BOOL share_access_check(connection_struct *conn, int snum, user_struct *vuser, uint32 desired_access)
{
uint32 granted;
NTSTATUS status;
@@ -316,7 +319,6 @@ BOOL share_access_check(connection_struct *conn, int snum, uint16 vuid, uint32 d
SEC_DESC *psd = NULL;
size_t sd_size;
NT_USER_TOKEN *token = NULL;
- user_struct *vuser = get_valid_user_struct(vuid);
BOOL ret = True;
mem_ctx = talloc_init();
@@ -355,7 +357,7 @@ static void init_srv_share_info_501(pipes_struct *p, SRV_SHARE_INFO_501 *sh501,
pstrcpy(net_name, lp_servicename(snum));
pstrcpy(remark, lp_comment(snum));
- standard_sub_conn(p->conn, remark);
+ standard_sub_conn(p->conn, remark, sizeof(remark));
len_net_name = strlen(net_name);
@@ -394,7 +396,7 @@ static void init_srv_share_info_502(pipes_struct *p, SRV_SHARE_INFO_502 *sh502,
pstrcpy(net_name, lp_servicename(snum));
pstrcpy(remark, lp_comment(snum));
- standard_sub_conn(p->conn, remark);
+ standard_sub_conn(p->conn, remark,sizeof(remark));
pstrcpy(path, "C:");
pstrcat(path, lp_pathname(snum));
@@ -638,11 +640,13 @@ static void init_srv_sess_0_info(SESS_INFO_0 *se0, SESS_INFO_0_STR *str0, char *
static void init_srv_sess_info_0(SRV_SESS_INFO_0 *ss0, uint32 *snum, uint32 *stot)
{
+ struct sessionid *session_list;
uint32 num_entries = 0;
- (*stot) = 1;
+ (*stot) = list_sessions(&session_list);
if (ss0 == NULL) {
(*snum) = 0;
+ SAFE_FREE(session_list);
return;
}
@@ -651,7 +655,7 @@ static void init_srv_sess_info_0(SRV_SESS_INFO_0 *ss0, uint32 *snum, uint32 *sto
if (snum) {
for (; (*snum) < (*stot) && num_entries < MAX_SESS_ENTRIES; (*snum)++) {
init_srv_sess_0_info(&ss0->info_0[num_entries],
- &ss0->info_0_str[num_entries], "MACHINE");
+ &ss0->info_0_str[num_entries], session_list[(*snum)].remote_machine);
/* move on to creating next session */
/* move on to creating next sess */
@@ -671,6 +675,7 @@ static void init_srv_sess_info_0(SRV_SESS_INFO_0 *ss0, uint32 *snum, uint32 *sto
ss0->ptr_sess_info = 0;
ss0->num_entries_read2 = 0;
}
+ SAFE_FREE(session_list);
}
/*******************************************************************
@@ -693,11 +698,13 @@ static void init_srv_sess_1_info(SESS_INFO_1 *se1, SESS_INFO_1_STR *str1,
static void init_srv_sess_info_1(SRV_SESS_INFO_1 *ss1, uint32 *snum, uint32 *stot)
{
+ struct sessionid *session_list;
uint32 num_entries = 0;
- (*stot) = 1;
+ (*stot) = list_sessions(&session_list);
if (ss1 == NULL) {
(*snum) = 0;
+ SAFE_FREE(session_list);
return;
}
@@ -706,8 +713,10 @@ static void init_srv_sess_info_1(SRV_SESS_INFO_1 *ss1, uint32 *snum, uint32 *sto
if (snum) {
for (; (*snum) < (*stot) && num_entries < MAX_SESS_ENTRIES; (*snum)++) {
init_srv_sess_1_info(&ss1->info_1[num_entries],
- &ss1->info_1_str[num_entries],
- "MACHINE", "dummy_user", 1, 10, 5, 0);
+ &ss1->info_1_str[num_entries],
+ session_list[*snum].remote_machine,
+ session_list[*snum].username,
+ 1, 10, 5, 0);
/* move on to creating next session */
/* move on to creating next sess */
@@ -942,73 +951,45 @@ static void init_srv_r_net_conn_enum(SRV_R_NET_CONN_ENUM *r_n,
}
/*******************************************************************
- fill in a file info level 3 structure.
- ********************************************************************/
-
-static void init_srv_file_3_info(FILE_INFO_3 *fl3, FILE_INFO_3_STR *str3,
- uint32 fnum, uint32 perms, uint32 num_locks,
- char *path_name, char *user_name)
-{
- init_srv_file_info3(fl3 , fnum, perms, num_locks, path_name, user_name);
- init_srv_file_info3_str(str3, path_name, user_name);
-}
-
-/*******************************************************************
- fill in a file info level 3 structure.
- ********************************************************************/
-
-static void init_srv_file_info_3(SRV_FILE_INFO_3 *fl3, uint32 *fnum, uint32 *ftot)
-{
- uint32 num_entries = 0;
- (*ftot) = 1;
-
- if (fl3 == NULL) {
- (*fnum) = 0;
- return;
- }
-
- DEBUG(5,("init_srv_file_3_fl3\n"));
-
- for (; (*fnum) < (*ftot) && num_entries < MAX_FILE_ENTRIES; (*fnum)++) {
- init_srv_file_3_info(&fl3->info_3[num_entries],
- &fl3->info_3_str[num_entries],
- (*fnum), 0x35, 0, "\\PIPE\\samr", "dummy user");
-
- /* move on to creating next file */
- num_entries++;
- }
-
- fl3->num_entries_read = num_entries;
- fl3->ptr_file_info = num_entries > 0 ? 1 : 0;
- fl3->num_entries_read2 = num_entries;
-
- if ((*fnum) >= (*ftot)) {
- (*fnum) = 0;
- }
-}
-
-/*******************************************************************
makes a SRV_R_NET_FILE_ENUM structure.
********************************************************************/
-static WERROR init_srv_file_info_ctr(SRV_FILE_INFO_CTR *ctr,
+static WERROR init_srv_file_info_ctr(pipes_struct *p, SRV_FILE_INFO_CTR *ctr,
int switch_value, uint32 *resume_hnd, uint32 *total_entries)
{
WERROR status = WERR_OK;
+ TALLOC_CTX *ctx = p->mem_ctx;
DEBUG(5,("init_srv_file_info_ctr: %d\n", __LINE__));
+ *total_entries = 1; /* dummy entries only, for */
ctr->switch_value = switch_value;
+ ctr->num_entries = *total_entries - *resume_hnd;
+ if (ctr->num_entries < 0)
+ ctr->num_entries = 0;
+ ctr->num_entries2 = ctr->num_entries;
switch (switch_value) {
- case 3:
- init_srv_file_info_3(&ctr->file.info3, resume_hnd, total_entries);
- ctr->ptr_file_ctr = 1;
+ case 3: {
+ int i;
+ if (*total_entries > 0) {
+ ctr->ptr_entries = 1;
+ ctr->file.info3 = talloc(ctx, ctr->num_entries *
+ sizeof(SRV_FILE_INFO_3));
+ }
+ for (i=0 ;i<ctr->num_entries;i++) {
+ init_srv_file_info3(&ctr->file.info3[i].info_3, i+*resume_hnd, 0x35, 0, "\\PIPE\\samr", "dummy user");
+ init_srv_file_info3_str(&ctr->file.info3[i].info_3_str, "\\PIPE\\samr", "dummy user");
+
+ }
+ ctr->ptr_file_info = 1;
+ *resume_hnd = 0;
break;
+ }
default:
DEBUG(5,("init_srv_file_info_ctr: unsupported switch value %d\n", switch_value));
(*resume_hnd = 0);
(*total_entries) = 0;
- ctr->ptr_file_ctr = 0;
+ ctr->ptr_entries = 0;
status = WERR_UNKNOWN_LEVEL;
break;
}
@@ -1020,7 +1001,7 @@ static WERROR init_srv_file_info_ctr(SRV_FILE_INFO_CTR *ctr,
makes a SRV_R_NET_FILE_ENUM structure.
********************************************************************/
-static void init_srv_r_net_file_enum(SRV_R_NET_FILE_ENUM *r_n,
+static void init_srv_r_net_file_enum(pipes_struct *p, SRV_R_NET_FILE_ENUM *r_n,
uint32 resume_hnd, int file_level, int switch_value)
{
DEBUG(5,("init_srv_r_net_file_enum: %d\n", __LINE__));
@@ -1029,7 +1010,7 @@ static void init_srv_r_net_file_enum(SRV_R_NET_FILE_ENUM *r_n,
if (file_level == 0)
r_n->status = WERR_UNKNOWN_LEVEL;
else
- r_n->status = init_srv_file_info_ctr(r_n->ctr, switch_value, &resume_hnd, &(r_n->total_entries));
+ r_n->status = init_srv_file_info_ctr(p, &r_n->ctr, switch_value, &resume_hnd, &(r_n->total_entries));
if (!W_ERROR_IS_OK(r_n->status))
resume_hnd = 0;
@@ -1053,11 +1034,21 @@ WERROR _srv_net_srv_get_info(pipes_struct *p, SRV_Q_NET_SRV_GET_INFO *q_u, SRV_R
DEBUG(5,("srv_net_srv_get_info: %d\n", __LINE__));
+ if (!pipe_access_check(p)) {
+ DEBUG(3, ("access denied to srv_net_srv_get_info\n"));
+ return WERR_ACCESS_DENIED;
+ }
+
switch (q_u->switch_value) {
+
+ /* Technically level 102 should only be available to
+ Administrators but there isn't anything super-secret
+ here, as most of it is made up. */
+
case 102:
init_srv_info_102(&ctr->srv.sv102,
500, global_myname,
- string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH),
+ string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH),
lp_major_announce_version(), lp_minor_announce_version(),
lp_default_server_announce(),
0xffffffff, /* users */
@@ -1116,19 +1107,13 @@ net file enum
WERROR _srv_net_file_enum(pipes_struct *p, SRV_Q_NET_FILE_ENUM *q_u, SRV_R_NET_FILE_ENUM *r_u)
{
- r_u->ctr = (SRV_FILE_INFO_CTR *)talloc(p->mem_ctx, sizeof(SRV_FILE_INFO_CTR));
- if (!r_u->ctr)
- return WERR_NOMEM;
-
- ZERO_STRUCTP(r_u->ctr);
-
DEBUG(5,("srv_net_file_enum: %d\n", __LINE__));
/* set up the */
- init_srv_r_net_file_enum(r_u,
+ init_srv_r_net_file_enum(p, r_u,
get_enum_hnd(&q_u->enum_hnd),
q_u->file_level,
- q_u->ctr->switch_value);
+ q_u->ctr.switch_value);
DEBUG(5,("srv_net_file_enum: %d\n", __LINE__));
@@ -1193,6 +1178,11 @@ WERROR _srv_net_share_enum_all(pipes_struct *p, SRV_Q_NET_SHARE_ENUM *q_u, SRV_R
{
DEBUG(5,("_srv_net_share_enum: %d\n", __LINE__));
+ if (!pipe_access_check(p)) {
+ DEBUG(3, ("access denied to srv_net_share_enum_all\n"));
+ return WERR_ACCESS_DENIED;
+ }
+
/* Create the list of shares for the response. */
init_srv_r_net_share_enum(p, r_u,
q_u->ctr.info_level,
@@ -1211,6 +1201,11 @@ WERROR _srv_net_share_enum(pipes_struct *p, SRV_Q_NET_SHARE_ENUM *q_u, SRV_R_NET
{
DEBUG(5,("_srv_net_share_enum: %d\n", __LINE__));
+ if (!pipe_access_check(p)) {
+ DEBUG(3, ("access denied to srv_net_share_enum\n"));
+ return WERR_ACCESS_DENIED;
+ }
+
/* Create the list of shares for the response. */
init_srv_r_net_share_enum(p, r_u,
q_u->ctr.info_level,
@@ -1829,7 +1824,7 @@ WERROR _srv_net_file_set_secdesc(pipes_struct *p, SRV_Q_NET_FILE_SET_SECDESC *q_
"Nigel Williams" <nigel@veritas.com>.
***********************************************************************************/
-const char *server_disks[] = {"C:"};
+static const char *server_disks[] = {"C:"};
static uint32 get_server_disk_count(void)
{
diff --git a/source3/rpc_server/srv_util.c b/source3/rpc_server/srv_util.c
index 53bbebb95e..f896d1d9d8 100644
--- a/source3/rpc_server/srv_util.c
+++ b/source3/rpc_server/srv_util.c
@@ -38,6 +38,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
/*
* A list of the rids of well known BUILTIN and Domain users
* and groups.
@@ -93,6 +96,7 @@ NTSTATUS get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, ui
uint32 *rids=NULL, *new_rids=NULL;
gid_t winbind_gid_low, winbind_gid_high;
BOOL ret;
+ BOOL winbind_groups_exist;
/*
* this code is far from perfect.
@@ -108,17 +112,15 @@ NTSTATUS get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, ui
*prids=NULL;
*numgroups=0;
- lp_winbind_gid(&winbind_gid_low, &winbind_gid_high);
+ winbind_groups_exist = lp_winbind_gid(&winbind_gid_low, &winbind_gid_high);
DEBUG(10,("get_alias_user_groups: looking if SID %s is a member of groups in the SID domain %s\n",
sid_to_string(str_qsid, q_sid), sid_to_string(str_domsid, sid)));
- sid_peek_rid(q_sid, &rid);
-
pdb_init_sam(&sam_pass);
become_root();
- ret = pdb_getsampwrid(sam_pass, rid);
+ ret = pdb_getsampwsid(sam_pass, q_sid);
unbecome_root();
if (ret == False) {
pdb_free_sam(&sam_pass);
@@ -157,7 +159,7 @@ NTSTATUS get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, ui
}
/* Don't return winbind groups as they are not local! */
- if ((grp->gr_gid >= winbind_gid_low) && (grp->gr_gid <= winbind_gid_high)) {
+ if (winbind_groups_exist && (grp->gr_gid >= winbind_gid_low) && (grp->gr_gid <= winbind_gid_high)) {
DEBUG(10,("get_alias_user_groups: not returing %s, not local.\n", map.nt_name));
continue;
}
@@ -226,7 +228,7 @@ NTSTATUS get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, ui
}
/* Don't return winbind groups as they are not local! */
- if ((gid >= winbind_gid_low) && (gid <= winbind_gid_high)) {
+ if (winbind_groups_exist && (gid >= winbind_gid_low) && (gid <= winbind_gid_high)) {
DEBUG(10,("get_alias_user_groups: not returing %s, not local.\n", map.nt_name ));
goto done;
}
@@ -404,6 +406,8 @@ NTSTATUS local_lookup_alias_name(uint32 rid, char *alias_name, uint32 *type)
return NT_STATUS_NONE_MAPPED;
}
+
+#if 0 /*Nobody uses this function just now*/
/*******************************************************************
Look up a local user rid and return a name and type.
********************************************************************/
@@ -448,6 +452,8 @@ NTSTATUS local_lookup_user_name(uint32 rid, char *user_name, uint32 *type)
return NT_STATUS_NONE_MAPPED;
}
+#endif
+
/*******************************************************************
Look up a local (domain) group name and return a rid
********************************************************************/
diff --git a/source3/rpc_server/srv_wkssvc.c b/source3/rpc_server/srv_wkssvc.c
index 8eb5b3002e..c783becbbe 100644
--- a/source3/rpc_server/srv_wkssvc.c
+++ b/source3/rpc_server/srv_wkssvc.c
@@ -24,6 +24,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
/*******************************************************************
api_wks_query_info
********************************************************************/
@@ -55,7 +58,7 @@ static BOOL api_wks_query_info(pipes_struct *p)
/*******************************************************************
\PIPE\wkssvc commands
********************************************************************/
-struct api_struct api_wks_cmds[] =
+static struct api_struct api_wks_cmds[] =
{
{ "WKS_Q_QUERY_INFO", WKS_QUERY_INFO, api_wks_query_info },
{ NULL , 0 , NULL }
diff --git a/source3/rpc_server/srv_wkssvc_nt.c b/source3/rpc_server/srv_wkssvc_nt.c
index 637c95af69..7687e7b00a 100644
--- a/source3/rpc_server/srv_wkssvc_nt.c
+++ b/source3/rpc_server/srv_wkssvc_nt.c
@@ -25,6 +25,9 @@
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
extern pstring global_myname;
/*******************************************************************
generated by cgit (git 2.34.1) at 2024-06-30 17:01:05 +0000