sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-12-07 20:23:50 +03:00
Code Activity

security descs in spoolss. needs parse_sec.c nttrans.c broken.

Browse Source
This commit is contained in:
Luke Leighton
-
parent 96fd33b898
commit f9f2a04fdb
9 changed files with 1242 additions and 992 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
source/include/nt_printing.h
View File

@@ -244,7 +244,7 @@ typedef struct nt_printer_info_level_2
fstring datatype;
fstring parameters;
NT_PRINTER_PARAM *specific;
/* SEC_DESC_BUF *secdesc; */
SEC_DESC_BUF secdesc;
/* not used but ... and how ??? */
uint32 changeid;
uint32 c_setprinter;

1165
source/include/proto.h
View File

File diff suppressed because it is too large Load Diff

6
source/include/rpc_secdes.h
View File

@@ -2,9 +2,8 @@
Unix SMB/Netbios implementation.
Version 1.9.
SMB parameters and setup
Copyright (C) Andrew Tridgell 1992-1997
Copyright (C) Luke Kenneth Casson Leighton 1996-1997
Copyright (C) Paul Ashton 1997
Copyright (C) Andrew Tridgell 1992-2000
Copyright (C) Luke Kenneth Casson Leighton 1996-2000
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -114,6 +113,7 @@ typedef struct security_acl_info
} SEC_ACL;
/* SEC_DESC */
typedef struct security_descriptor_info
{

28
source/include/rpc_spoolss.h
View File

@@ -151,6 +151,8 @@
#define PRINTER_ACCESS_USE 0x00000008
#define JOB_ACCESS_ADMINISTER 0x00000010
#define PRINTER_MANAGE_DOCUMENTS 0x10000000 /* i think dis right ... */
#define STANDARD_RIGHTS_READ 0x00020000
#define STANDARD_RIGHTS_WRITE STANDARD_RIGHTS_READ
#define STANDARD_RIGHTS_EXECUTE STANDARD_RIGHTS_READ
@@ -779,7 +781,7 @@ typedef struct printer_info_2
UNISTR printprocessor;
UNISTR datatype;
UNISTR parameters;
/*SECURITY_DESCRIPTOR securitydescriptor; */
SEC_DESC *secdesc;
uint32 attributes;
uint32 priority;
uint32 defaultpriority;
@@ -791,6 +793,13 @@ typedef struct printer_info_2
}
PRINTER_INFO_2;
typedef struct printer_info_3
{
uint32 flags;
SEC_DESC sec;
}
PRINTER_INFO_3;
typedef struct spool_q_enumprinters
{
uint32 flags;
@@ -807,6 +816,7 @@ typedef struct printer_info_ctr_info
PRINTER_INFO_0 *printers_0;
PRINTER_INFO_1 *printers_1;
PRINTER_INFO_2 *printers_2;
PRINTER_INFO_3 *printers_3;
}
PRINTER_INFO_CTR;
@@ -1237,12 +1247,19 @@ typedef struct spool_printer_info_level_2
}
SPOOL_PRINTER_INFO_LEVEL_2;
typedef struct spool_printer_info_level_3
{
uint32 secdesc_ptr;
}
SPOOL_PRINTER_INFO_LEVEL_3;
typedef struct spool_printer_info_level
{
uint32 level;
uint32 info_ptr;
SPOOL_PRINTER_INFO_LEVEL_1 *info_1;
SPOOL_PRINTER_INFO_LEVEL_2 *info_2;
SPOOL_PRINTER_INFO_LEVEL_3 *info_3;
}
SPOOL_PRINTER_INFO_LEVEL;
@@ -1350,16 +1367,9 @@ typedef struct spool_q_setprinter
POLICY_HND handle;
uint32 level;
SPOOL_PRINTER_INFO_LEVEL info;
SEC_DESC_BUF secdesc_ctr;
DEVMODE_CTR devmode_ctr;
/* lkclXXXX jean-francois, see SEC_DESC_BUF code */
struct
{
uint32 size_of_buffer;
uint32 data;
}
security;
uint32 command;
}

3
source/include/smb.h
View File

@@ -1683,8 +1683,9 @@ struct ntdom_info
int max_xmit_frag;
};
#include "nt_printing.h"
#include "rpc_creds.h"
#include "rpc_secdes.h"
#include "nt_printing.h"
#include "ntdomain.h"
#include "client.h"

4
source/printing/nt_printing.c
View File

@@ -41,9 +41,8 @@ int nt_printing_init(void)
if (tdb && local_pid == sys_getpid()) return True;
tdb = tdb_open(lock_path("ntdrivers.tdb"), 0, 0, O_RDWR|O_CREAT, 0600);
if (!tdb) {
DEBUG(0,("Failed to open nt drivers database\n"));
}
local_pid = sys_getpid();
/* handle a Samba upgrade */
@@ -757,6 +756,7 @@ static void free_nt_printer_info_level_2(NT_PRINTER_INFO_LEVEL_2 **info_ptr)
DEBUG(106,("free_nt_printer_info_level_2: deleting info\n"));
free_nt_devicemode(&info->devmode);
free_sec_desc_buf(&info->secdesc);
for(param_ptr = info->specific; param_ptr; ) {
NT_PRINTER_PARAM *tofree = param_ptr;

809
source/rpc_parse/parse_sec.c
View File

@@ -2,10 +2,10 @@
* Unix SMB/Netbios implementation.
* Version 1.9.
* RPC Pipe client / server routines
* Copyright (C) Andrew Tridgell 1992-1998,
* Copyright (C) Jeremy R. Allison 1995-1998
* Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
* Copyright (C) Paul Ashton 1997-1998.
* Copyright (C) Andrew Tridgell 1992-1999,
* Copyright (C) Jeremy R. Allison 1995-1999
* Copyright (C) Luke Kenneth Casson Leighton 1996-1999,
* Copyright (C) Paul Ashton 1997-1999.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -24,18 +24,20 @@
#include "includes.h"
#include "rpc_parse.h"
extern int DEBUGLEVEL;
#define SD_HEADER_SIZE 0x14
/*******************************************************************
Sets up a SEC_ACCESS structure.
********************************************************************/
void init_sec_access(SEC_ACCESS *t, uint32 mask)
BOOL make_sec_access(SEC_ACCESS * t, uint32 mask)
{
ZERO_STRUCTP(t);
t->mask = mask;
return True;
}
/*******************************************************************
@@ -50,11 +52,9 @@ BOOL sec_io_access(char *desc, SEC_ACCESS *t, prs_struct *ps, int depth)
prs_debug(ps, depth, desc, "sec_io_access");
depth++;
if(!prs_align(ps))
return False;
prs_align(ps);
if(!prs_uint32("mask", ps, depth, &(t->mask)))
return False;
prs_uint32("mask", ps, depth, &(t->mask));
return True;
}
@@ -64,57 +64,57 @@ BOOL sec_io_access(char *desc, SEC_ACCESS *t, prs_struct *ps, int depth)
Sets up a SEC_ACE structure.
********************************************************************/
void init_sec_ace(SEC_ACE *t, DOM_SID *sid, uint8 type, SEC_ACCESS mask, uint8 flag)
static size_t sec_ace_get_size(const SEC_ACE *ace)
{
if (ace == NULL)
return 0;
return sid_size(&ace->sid) + 8;
}
BOOL make_sec_ace(SEC_ACE * t, const DOM_SID *sid, uint8 type,
SEC_ACCESS mask, uint8 flag)
{
ZERO_STRUCTP(t);
t->type = type;
t->flags = flag;
t->size = sid_size(sid) + 8;
t->info = mask;
ZERO_STRUCTP(&t->sid);
sid_copy(&t->sid, sid);
t->size = sec_ace_get_size(t);
return True;
}
/*******************************************************************
Reads or writes a SEC_ACE structure.
********************************************************************/
BOOL sec_io_ace(char *desc, SEC_ACE *psa, prs_struct *ps, int depth)
static BOOL sec_io_ace(char *desc, SEC_ACE * t, prs_struct *ps, int depth)
{
uint32 old_offset;
uint32 offset_ace_size;
if (psa == NULL)
if (t == NULL)
return False;
prs_debug(ps, depth, desc, "sec_io_ace");
depth++;
if(!prs_align(ps))
return False;
prs_align(ps);
old_offset = prs_offset(ps);
if(!prs_uint8("type ", ps, depth, &psa->type))
return False;
prs_uint8("type ", ps, depth, &(t->type));
prs_uint8("flags", ps, depth, &(t->flags));
prs_uint16_pre("size ", ps, depth, &(t->size), &offset_ace_size);
if(!prs_uint8("flags", ps, depth, &psa->flags))
return False;
sec_io_access("info ", &t->info, ps, depth);
prs_align(ps);
smb_io_dom_sid("sid ", &t->sid, ps, depth);
prs_align(ps);
if(!prs_uint16_pre("size ", ps, depth, &psa->size, &offset_ace_size))
return False;
if(!sec_io_access("info ", &psa->info, ps, depth))
return False;
if(!prs_align(ps))
return False;
if(!smb_io_dom_sid("sid ", &psa->sid , ps, depth))
return False;
if(!prs_uint16_post("size ", ps, depth, &psa->size, offset_ace_size, old_offset))
return False;
prs_uint16_post("size ", ps, depth, &t->size, offset_ace_size,
old_offset);
return True;
}
@@ -122,497 +122,482 @@ BOOL sec_io_ace(char *desc, SEC_ACE *psa, prs_struct *ps, int depth)
/*******************************************************************
Create a SEC_ACL structure.
********************************************************************/
SEC_ACL *make_sec_acl(uint16 revision, int num_aces, SEC_ACE *ace_list)
{
SEC_ACL *dst;
int i;
if((dst = (SEC_ACL *)malloc(sizeof(SEC_ACL))) == NULL)
return NULL;
ZERO_STRUCTP(dst);
dst->revision = revision;
dst->num_aces = num_aces;
dst->size = 8;
if((dst->ace = (SEC_ACE *)malloc( sizeof(SEC_ACE) * num_aces )) == NULL) {
free_sec_acl(&dst);
return NULL;
}
for (i = 0; i < num_aces; i++) {
dst->ace[i] = ace_list[i]; /* Structure copy. */
dst->size += ace_list[i].size;
}
return dst;
}
/*******************************************************************
Duplicate a SEC_ACL structure.
********************************************************************/
SEC_ACL *dup_sec_acl( SEC_ACL *src)
{
if(src == NULL)
return NULL;
return make_sec_acl( src->revision, src->num_aces, src->ace);
}
/*******************************************************************
Delete a SEC_ACL structure.
********************************************************************/
void free_sec_acl(SEC_ACL **ppsa)
{
SEC_ACL *psa;
if(ppsa == NULL || *ppsa == NULL)
return;
psa = *ppsa;
if (psa->ace != NULL)
free(psa->ace);
free(psa);
*ppsa = NULL;
}
/*******************************************************************
Reads or writes a SEC_ACL structure.
First of the xx_io_xx functions that allocates its data structures
for you as it reads them.
********************************************************************/
BOOL sec_io_acl(char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth)
BOOL make_sec_acl(SEC_ACL * t, uint16 revision, int num_aces, SEC_ACE * ace)
{
int i;
uint32 old_offset;
uint32 offset_acl_size;
SEC_ACL *psa;
if (ppsa == NULL)
return False;
ZERO_STRUCTP(t);
psa = *ppsa;
t->revision = revision;
t->num_aces = num_aces;
t->size = 8;
t->ace = ace;
if(UNMARSHALLING(ps) && psa == NULL) {
/*
* This is a read and we must allocate the stuct to read into.
*/
if((psa = (SEC_ACL *)malloc(sizeof(SEC_ACL))) == NULL)
return False;
ZERO_STRUCTP(psa);
*ppsa = psa;
for (i = 0; i < num_aces; i++)
{
t->size += sec_ace_get_size(&ace[i]);
}
prs_debug(ps, depth, desc, "sec_io_acl");
depth++;
if(!prs_align(ps))
return False;
old_offset = prs_offset(ps);
if(!prs_uint16("revision", ps, depth, &psa->revision))
return False;
if(!prs_uint16_pre("size ", ps, depth, &psa->size, &offset_acl_size))
return False;
if(!prs_uint32("num_aces ", ps, depth, &psa->num_aces))
return False;
if (UNMARSHALLING(ps) && psa->num_aces != 0) {
/* reading */
if((psa->ace = malloc(sizeof(psa->ace[0]) * psa->num_aces)) == NULL)
return False;
ZERO_STRUCTP(psa->ace);
}
for (i = 0; i < psa->num_aces; i++) {
fstring tmp;
slprintf(tmp, sizeof(tmp)-1, "ace_list[%02d]: ", i);
if(!sec_io_ace(tmp, &psa->ace[i], ps, depth))
return False;
}
if(!prs_align(ps))
return False;
if(!prs_uint16_post("size ", ps, depth, &psa->size, offset_acl_size, old_offset))
return False;
return True;
}
/*******************************************************************
Creates a SEC_DESC structure
Duplicate a SEC_ACL structure.
********************************************************************/
SEC_DESC *make_sec_desc(uint16 revision, uint16 type,
DOM_SID *owner_sid, DOM_SID *grp_sid,
SEC_ACL *sacl, SEC_ACL *dacl, size_t *sec_desc_size)
SEC_ACL *dup_sec_acl( SEC_ACL *src)
{
SEC_DESC *dst;
uint32 offset;
*sec_desc_size = 0;
if(( dst = (SEC_DESC *)malloc(sizeof(SEC_DESC))) == NULL)
return NULL;
ZERO_STRUCTP(dst);
dst->revision = revision;
dst->type = type;
dst->off_owner_sid = 0;
dst->off_grp_sid = 0;
dst->off_sacl = 0;
dst->off_dacl = 0;
if(owner_sid && ((dst->owner_sid = sid_dup(owner_sid)) == NULL))
goto error_exit;
if(grp_sid && ((dst->grp_sid = sid_dup(grp_sid)) == NULL))
goto error_exit;
if(sacl && ((dst->sacl = dup_sec_acl(sacl)) == NULL))
goto error_exit;
if(dacl && ((dst->dacl = dup_sec_acl(dacl)) == NULL))
goto error_exit;
offset = 0x0;
/*
* Work out the linearization sizes.
*/
if (dst->owner_sid != NULL) {
if (offset == 0)
offset = SD_HEADER_SIZE;
dst->off_owner_sid = offset;
offset += ((sid_size(dst->owner_sid) + 3) & ~3);
}
if (dst->grp_sid != NULL) {
if (offset == 0)
offset = SD_HEADER_SIZE;
dst->off_grp_sid = offset;
offset += ((sid_size(dst->grp_sid) + 3) & ~3);
}
if (dst->sacl != NULL) {
if (offset == 0)
offset = SD_HEADER_SIZE;
dst->off_sacl = offset;
offset += ((sacl->size + 3) & ~3);
}
if (dst->dacl != NULL) {
if (offset == 0)
offset = SD_HEADER_SIZE;
dst->off_dacl = offset;
offset += ((dacl->size + 3) & ~3);
}
*sec_desc_size = (size_t)((offset == 0) ? SD_HEADER_SIZE : offset);
return dst;
error_exit:
*sec_desc_size = 0;
free_sec_desc(&dst);
return NULL;
}
/*******************************************************************
Duplicate a SEC_DESC structure.
********************************************************************/
SEC_DESC *dup_sec_desc( SEC_DESC *src)
{
size_t dummy;
if(src == NULL)
return NULL;
return make_sec_desc( src->revision, src->type,
src->owner_sid, src->grp_sid, src->sacl,
src->dacl, &dummy);
return NULL;
}
/*******************************************************************
Deletes a SEC_DESC structure
frees a structure.
********************************************************************/
void free_sec_desc(SEC_DESC **ppsd)
void free_sec_acl(SEC_ACL * t)
{
SEC_DESC *psd;
if(ppsd == NULL || *ppsd == NULL)
if (t == NULL)
return;
psd = *ppsd;
free_sec_acl(&psd->dacl);
free_sec_acl(&psd->dacl);
free(psd->owner_sid);
free(psd->grp_sid);
free(psd);
*ppsd = NULL;
if (t->ace != NULL)
{
free(t->ace);
t->ace = NULL;
}
t->num_aces = 0;
}
/*******************************************************************
Creates a SEC_DESC structure with typical defaults.
Reads or writes a structure.
First of the xx_io_xx functions that allocates its data structures
for you as it reads them.
********************************************************************/
SEC_DESC *make_standard_sec_desc(DOM_SID *owner_sid, DOM_SID *grp_sid,
SEC_ACL *dacl, size_t *sec_desc_size)
static BOOL sec_io_acl(char *desc, SEC_ACL * t, prs_struct *ps, int depth)
{
return make_sec_desc(1, SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
owner_sid, grp_sid, NULL, dacl, sec_desc_size);
uint32 i;
uint32 old_offset;
uint32 offset_acl_size;
if (t == NULL)
return False;
prs_debug(ps, depth, desc, "sec_io_acl");
depth++;
prs_align(ps);
old_offset = prs_offset(ps);
prs_uint16("revision", ps, depth, &(t->revision));
prs_uint16_pre("size ", ps, depth, &(t->size), &offset_acl_size);
prs_uint32("num_aces ", ps, depth, &(t->num_aces));
if (ps->io && t->num_aces != 0)
{
/* reading */
t->ace = (SEC_ACE *) malloc(sizeof(t->ace[0]) * t->num_aces);
ZERO_STRUCTP(t->ace);
}
if (t->ace == NULL && t->num_aces != 0)
{
DEBUG(0, ("INVALID ACL\n"));
prs_set_offset(ps, 0xfffffffe);
return False;
}
for (i = 0; i < MIN(t->num_aces, MAX_SEC_ACES); i++)
{
fstring tmp;
slprintf(tmp, sizeof(tmp) - 1, "ace[%02d]: ", i);
if(!sec_io_ace(tmp, &t->ace[i], ps, depth))
return False;
}
prs_align(ps);
prs_uint16_post("size ", ps, depth, &t->size, offset_acl_size,
old_offset);
return True;
}
/*******************************************************************
Reads or writes a SEC_DESC structure.
If reading and the *ppsd = NULL, allocates the structure.
Creates a SEC_DESC structure
********************************************************************/
BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth)
int make_sec_desc(SEC_DESC * t, uint16 revision, uint16 type,
DOM_SID *owner_sid, DOM_SID *grp_sid,
SEC_ACL * sacl, SEC_ACL * dacl)
{
uint32 offset;
ZERO_STRUCTP(t);
t->revision = revision;
t->type = type;
t->off_owner_sid = 0;
t->off_grp_sid = 0;
t->off_sacl = 0;
t->off_dacl = 0;
t->dacl = dacl;
t->sacl = sacl;
t->owner_sid = owner_sid;
t->grp_sid = grp_sid;
offset = 0x0;
if (dacl != NULL)
{
if (offset == 0)
{
offset = 0x14;
}
t->off_dacl = offset;
offset += dacl->size;
offset = ((offset + 3) & ~3);
}
if (sacl != NULL)
{
if (offset == 0)
{
offset = 0x14;
}
t->off_sacl = offset;
offset += sacl->size;
offset = ((offset + 3) & ~3);
}
if (owner_sid != NULL)
{
if (offset == 0)
{
offset = 0x14;
}
t->off_owner_sid = offset;
offset += sid_size(owner_sid);
offset = ((offset + 3) & ~3);
}
if (grp_sid != NULL)
{
if (offset == 0)
{
offset = 0x14;
}
t->off_grp_sid = offset;
offset += sid_size(grp_sid);
}
return (offset == 0) ? 0x14 : offset;
}
/*******************************************************************
frees a structure
********************************************************************/
void free_sec_desc(SEC_DESC * t)
{
if (t->dacl != NULL)
{
free_sec_acl(t->dacl);
}
if (t->sacl != NULL)
{
free_sec_acl(t->dacl);
}
if (t->owner_sid != NULL)
{
free(t->owner_sid);
t->owner_sid = NULL;
}
if (t->grp_sid != NULL)
{
free(t->grp_sid);
t->grp_sid = NULL;
}
}
/*******************************************************************
reads or writes a structure.
********************************************************************/
BOOL sec_io_desc(char *desc, SEC_DESC * t, prs_struct *ps, int depth)
{
#if 0
uint32 off_owner_sid;
uint32 off_grp_sid;
uint32 off_sacl;
uint32 off_dacl;
#endif
uint32 old_offset;
uint32 max_offset = 0; /* after we're done, move offset to end */
SEC_DESC *psd;
if (ppsd == NULL)
if (t == NULL)
return False;
psd = *ppsd;
if(UNMARSHALLING(ps) && psd == NULL) {
if((psd = (SEC_DESC *)malloc(sizeof(SEC_DESC))) == NULL)
return False;
ZERO_STRUCTP(psd);
*ppsd = psd;
}
prs_debug(ps, depth, desc, "sec_io_desc");
depth++;
if(!prs_align(ps))
return False;
prs_align(ps);
/* start of security descriptor stored for back-calc offset purposes */
old_offset = prs_offset(ps);
max_offset = old_offset;
if(!prs_uint16("revision ", ps, depth, &psd->revision))
return False;
if(!prs_uint16("type ", ps, depth, &psd->type))
return False;
if(!prs_uint32("off_owner_sid", ps, depth, &psd->off_owner_sid))
return False;
if(!prs_uint32("off_grp_sid ", ps, depth, &psd->off_grp_sid))
return False;
if(!prs_uint32("off_sacl ", ps, depth, &psd->off_sacl))
return False;
if(!prs_uint32("off_dacl ", ps, depth, &psd->off_dacl))
return False;
prs_uint16("revision ", ps, depth, &(t->revision));
prs_uint16("type ", ps, depth, &(t->type));
prs_uint32("off_owner_sid", ps, depth, &(t->off_owner_sid));
prs_uint32("off_grp_sid ", ps, depth, &(t->off_grp_sid));
prs_uint32("off_sacl ", ps, depth, &(t->off_sacl));
prs_uint32("off_dacl ", ps, depth, &(t->off_dacl));
#if 0
prs_uint32_pre("off_owner_sid", ps, depth, &(t->off_owner_sid),
&off_owner_sid);
prs_uint32_pre("off_grp_sid ", ps, depth, &(t->off_grp_sid),
&off_grp_sid);
prs_uint32_pre("off_sacl ", ps, depth, &(t->off_sacl), &off_sacl);
prs_uint32_pre("off_dacl ", ps, depth, &(t->off_dacl), &off_dacl);
#endif
max_offset = MAX(max_offset, prs_offset(ps));
if (psd->off_owner_sid != 0) {
if (UNMARSHALLING(ps)) {
if(!prs_set_offset(ps, old_offset + psd->off_owner_sid))
if (IS_BITS_SET_ALL(t->type, SEC_DESC_DACL_PRESENT))
{
#if 0
prs_uint32_post("off_dacl ", ps, depth, &(t->off_dacl),
off_dacl, prs_offset(ps) - old_offset);
#endif
if(!prs_set_offset(ps, old_offset + t->off_dacl))
return False;
if (ps->io)
{
/* reading */
if((psd->owner_sid = malloc(sizeof(*psd->owner_sid))) == NULL)
return False;
ZERO_STRUCTP(psd->owner_sid);
t->dacl = (SEC_ACL *) malloc(sizeof(*t->dacl));
ZERO_STRUCTP(t->dacl);
}
if(!smb_io_dom_sid("owner_sid ", psd->owner_sid , ps, depth))
return False;
if(!prs_align(ps))
if (t->dacl == NULL)
{
DEBUG(0, ("INVALID DACL\n"));
prs_set_offset(ps, 0xfffffffe);
return False;
}
if(!sec_io_acl("dacl", t->dacl, ps, depth))
return False;
prs_align(ps);
}
#if 0
else
{
prs_uint32_post("off_dacl ", ps, depth, &(t->off_dacl),
off_dacl, 0);
}
#endif
max_offset = MAX(max_offset, prs_offset(ps));
if (psd->off_grp_sid != 0) {
if (UNMARSHALLING(ps)) {
if (IS_BITS_SET_ALL(t->type, SEC_DESC_SACL_PRESENT))
{
#if 0
prs_uint32_post("off_sacl ", ps, depth, &(t->off_sacl),
off_sacl, prs_offset(ps) - old_offset);
#endif
if(!prs_set_offset(ps, old_offset + t->off_sacl))
return False;
if (ps->io)
{
/* reading */
if(!prs_set_offset(ps, old_offset + psd->off_grp_sid))
return False;
if((psd->grp_sid = malloc(sizeof(*psd->grp_sid))) == NULL)
return False;
ZERO_STRUCTP(psd->grp_sid);
t->sacl = (SEC_ACL *) malloc(sizeof(*t->sacl));
ZERO_STRUCTP(t->sacl);
}
if(!smb_io_dom_sid("grp_sid", psd->grp_sid, ps, depth))
if (t->sacl == NULL)
{
DEBUG(0, ("INVALID SACL\n"));
prs_set_offset(ps, 0xfffffffe);
return False;
if(!prs_align(ps))
}
if(!sec_io_acl("sacl", t->sacl, ps, depth))
return False;
prs_align(ps);
}
#if 0
else
{
prs_uint32_post("off_sacl ", ps, depth, &(t->off_sacl),
off_sacl, 0);
}
#endif
max_offset = MAX(max_offset, prs_offset(ps));
#if 0
prs_uint32_post("off_owner_sid", ps, depth, &(t->off_owner_sid),
off_owner_sid, prs_offset(ps) - old_offset);
#endif
if (t->off_owner_sid != 0)
{
if (ps->io)
{
if(!prs_set_offset(ps, old_offset + t->off_owner_sid))
return False;
}
if (ps->io)
{
/* reading */
t->owner_sid =
(DOM_SID *)malloc(sizeof(*t->owner_sid));
ZERO_STRUCTP(t->owner_sid);
}
if (t->owner_sid == NULL)
{
DEBUG(0, ("INVALID OWNER SID\n"));
prs_set_offset(ps, 0xfffffffe);
return False;
}
smb_io_dom_sid("owner_sid ", t->owner_sid, ps, depth);
prs_align(ps);
}
max_offset = MAX(max_offset, prs_offset(ps));
if (IS_BITS_SET_ALL(psd->type, SEC_DESC_SACL_PRESENT) && psd->off_sacl) {
if(!prs_set_offset(ps, old_offset + psd->off_sacl))
#if 0
prs_uint32_post("off_grp_sid ", ps, depth, &(t->off_grp_sid),
off_grp_sid, prs_offset(ps) - old_offset);
#endif
if (t->off_grp_sid != 0)
{
if (ps->io)
{
if(!prs_set_offset(ps, old_offset + t->off_grp_sid))
return False;
if(!sec_io_acl("sacl", &psd->sacl, ps, depth))
return False;
if(!prs_align(ps))
}
if (ps->io)
{
/* reading */
t->grp_sid = (DOM_SID *)malloc(sizeof(*t->grp_sid));
ZERO_STRUCTP(t->grp_sid);
}
if (t->grp_sid == NULL)
{
DEBUG(0, ("INVALID GROUP SID\n"));
prs_set_offset(ps, 0xfffffffe);
return False;
}
max_offset = MAX(max_offset, prs_offset(ps));
if (IS_BITS_SET_ALL(psd->type, SEC_DESC_DACL_PRESENT) && psd->off_dacl != 0) {
if(!prs_set_offset(ps, old_offset + psd->off_dacl))
return False;
if(!sec_io_acl("dacl", &psd->dacl, ps, depth))
return False;
if(!prs_align(ps))
return False;
smb_io_dom_sid("grp_sid", t->grp_sid, ps, depth);
prs_align(ps);
}
max_offset = MAX(max_offset, prs_offset(ps));
if(!prs_set_offset(ps, max_offset))
return False;
return True;
}
/*******************************************************************
Creates a SEC_DESC_BUF structure.
creates a SEC_DESC_BUF structure.
********************************************************************/
SEC_DESC_BUF *make_sec_desc_buf(int len, SEC_DESC *sec_desc)
BOOL make_sec_desc_buf(SEC_DESC_BUF * buf, int len, SEC_DESC * data)
{
SEC_DESC_BUF *dst;
if((dst = (SEC_DESC_BUF *)malloc(sizeof(SEC_DESC_BUF))) == NULL)
return NULL;
ZERO_STRUCTP(dst);
ZERO_STRUCTP(buf);
/* max buffer size (allocated size) */
dst->max_len = len;
dst->len = len;
buf->max_len = len;
buf->undoc = 0;
buf->len = data != NULL ? len : 0;
buf->sec = data;
if(sec_desc && ((dst->sec = dup_sec_desc(sec_desc)) == NULL)) {
free_sec_desc_buf(&dst);
return NULL;
}
return dst;
return True;
}
/*******************************************************************
Duplicates a SEC_DESC_BUF structure.
frees a SEC_DESC_BUF structure.
********************************************************************/
SEC_DESC_BUF *dup_sec_desc_buf(SEC_DESC_BUF *src)
void free_sec_desc_buf(SEC_DESC_BUF * buf)
{
if(src == NULL)
return NULL;
return make_sec_desc_buf( src->len, src->sec);
}
/*******************************************************************
Deletes a SEC_DESC_BUF structure.
********************************************************************/
void free_sec_desc_buf(SEC_DESC_BUF **ppsdb)
{
SEC_DESC_BUF *psdb;
if(ppsdb == NULL || *ppsdb == NULL)
if (buf == NULL)
return;
psdb = *ppsdb;
free_sec_desc(&psdb->sec);
free(psdb);
*ppsdb = NULL;
if (buf->sec != NULL)
{
free_sec_desc(buf->sec);
free(buf->sec);
buf->sec = NULL;
}
}
/*******************************************************************
Reads or writes a SEC_DESC_BUF structure.
reads or writes a SEC_DESC_BUF structure.
********************************************************************/
BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth)
BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF * sec, prs_struct *ps,
int depth)
{
uint32 off_len;
uint32 off_max_len;
uint32 old_offset;
uint32 size;
SEC_DESC_BUF *psdb;
if (ppsdb == NULL)
if (sec == NULL)
return False;
psdb = *ppsdb;
if (UNMARSHALLING(ps) && psdb == NULL) {
if((psdb = (SEC_DESC_BUF *)malloc(sizeof(SEC_DESC_BUF))) == NULL)
return False;
ZERO_STRUCTP(psdb);
*ppsdb = psdb;
}
prs_debug(ps, depth, desc, "sec_io_desc_buf");
depth++;
if(!prs_align(ps))
return False;
prs_align(ps);
if(!prs_uint32_pre("max_len", ps, depth, &psdb->max_len, &off_max_len))
return False;
if(!prs_uint32 ("undoc ", ps, depth, &psdb->undoc))
return False;
if(!prs_uint32_pre("len ", ps, depth, &psdb->len, &off_len))
return False;
prs_uint32_pre("max_len", ps, depth, &(sec->max_len), &off_max_len);
prs_uint32("undoc ", ps, depth, &(sec->undoc));
prs_uint32_pre("len ", ps, depth, &(sec->len), &off_len);
old_offset = prs_offset(ps);
/* reading, length is non-zero; writing, descriptor is non-NULL */
if ((psdb->len != 0 || MARSHALLING(ps)) && psdb->sec != NULL) {
if(!sec_io_desc("sec ", &psdb->sec, ps, depth))
if (sec->len != 0 && ps->io)
{
/* reading */
sec->sec = (SEC_DESC *) malloc(sizeof(*sec->sec));
ZERO_STRUCTP(sec->sec);
if (sec->sec == NULL)
{
DEBUG(0, ("INVALID SEC_DESC\n"));
prs_set_offset(ps, 0xfffffffe);
return False;
}
}
size = prs_offset(ps) - old_offset;
if(!prs_uint32_post("max_len", ps, depth, &psdb->max_len, off_max_len, size == 0 ? psdb->max_len : size))
return False;
/* reading, length is non-zero; writing, descriptor is non-NULL */
if ((sec->len != 0 || (!ps->io)) && sec->sec != NULL)
{
sec_io_desc("sec ", sec->sec, ps, depth);
}
if(!prs_uint32_post("len ", ps, depth, &psdb->len, off_len, size))
prs_align(ps);
size = prs_offset(ps) - old_offset - 8;
prs_uint32_post("max_len", ps, depth, &(sec->max_len), off_max_len,
size == 0 ? sec->max_len : size + 8);
prs_uint32_post("len ", ps, depth, &(sec->len), off_len,
size == 0 ? 0 : size + 8);
if(!prs_set_offset(ps, old_offset + size + 8))
return False;
return True;

159
source/rpc_parse/parse_spoolss.c
View File

@@ -1295,6 +1295,14 @@ static uint32 size_of_relative_string(UNISTR *string)
return size;
}
/*******************************************************************
* return the length of a uint32 + sec desc
********************************************************************/
static uint32 size_of_sec_desc(SEC_DESC *sec)
{
return 4+1024;
}
/*******************************************************************
* return the length of a uint32 (obvious, but the code is clean)
********************************************************************/
@@ -1483,6 +1491,63 @@ static BOOL new_smb_io_relarraystr(char *desc, NEW_BUFFER *buffer, int depth, ui
}
/*******************************************************************
Parse a DEVMODE structure and its relative pointer.
********************************************************************/
static BOOL new_smb_io_relsecdesc(char *desc, NEW_BUFFER *buffer, int depth,
SEC_DESC **secdesc)
{
prs_struct *ps=&(buffer->prs);
prs_debug(ps, depth, desc, "new_smb_io_relsecdesc");
depth++;
if (MARSHALLING(ps))
{
uint32 struct_offset = prs_offset(ps);
uint32 relative_offset;
if (*secdesc != NULL)
{
buffer->string_at_end -= 256; /* HACK! */
prs_set_offset(ps, buffer->string_at_end);
/* write the secdesc */
if (!sec_io_desc(desc, *secdesc, ps, depth))
return False;
prs_set_offset(ps, struct_offset);
}
relative_offset=buffer->string_at_end - buffer->struct_start;
/* write its offset */
if (!prs_uint32("offset", ps, depth, &relative_offset))
return False;
}
else
{
uint32 old_offset;
/* read the offset */
if (!prs_uint32("offset", ps, depth, &(buffer->string_at_end)))
return False;
old_offset = prs_offset(ps);
prs_set_offset(ps, buffer->string_at_end + buffer->struct_start);
/* read the sd */
*secdesc = g_new(SEC_DESC, 1);
if (*secdesc == NULL)
return False;
if (!sec_io_desc(desc, *secdesc, ps, depth))
return False;
prs_set_offset(ps, old_offset);
}
return True;
}
/*******************************************************************
Parse a DEVMODE structure and its relative pointer.
********************************************************************/
@@ -1663,9 +1728,6 @@ BOOL new_smb_io_printer_info_1(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_1 *i
********************************************************************/
BOOL new_smb_io_printer_info_2(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_2 *info, int depth)
{
/* hack for the SEC DESC */
uint32 pipo=0;
prs_struct *ps=&(buffer->prs);
prs_debug(ps, depth, desc, "new_smb_io_printer_info_2");
@@ -1701,8 +1763,9 @@ BOOL new_smb_io_printer_info_2(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_2 *i
if (!new_smb_io_relstr("parameters", buffer, depth, &info->parameters))
return False;
if (!prs_uint32("security descriptor", ps, depth, &pipo))
if (!new_smb_io_relsecdesc("secdesc", buffer, depth, &info->secdesc))
return False;
if (!prs_uint32("attributes", ps, depth, &info->attributes))
return False;
if (!prs_uint32("priority", ps, depth, &info->priority))
@@ -1723,6 +1786,26 @@ BOOL new_smb_io_printer_info_2(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_2 *i
return True;
}
/*******************************************************************
Parse a PRINTER_INFO_3 structure.
********************************************************************/
BOOL new_smb_io_printer_info_3(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_3 *info, int depth)
{
prs_struct *ps=&(buffer->prs);
prs_debug(ps, depth, desc, "new_smb_io_printer_info_3");
depth++;
buffer->struct_start=prs_offset(ps);
if (!prs_uint32("flags", ps, depth, &info->flags))
return False;
if (!sec_io_desc("sec_desc", &info->sec, ps, depth))
return False;
return True;
}
/*******************************************************************
Parse a DRIVER_INFO_1 structure.
********************************************************************/
@@ -2281,7 +2364,7 @@ uint32 spoolss_size_printer_info_2(PRINTER_INFO_2 *info)
{
int size=0;
size+=4; /* the security descriptor */
size += size_of_sec_desc( info->secdesc );
size+=size_of_device_mode( info->devmode );
@@ -2309,6 +2392,18 @@ uint32 spoolss_size_printer_info_2(PRINTER_INFO_2 *info)
return size;
}
/*******************************************************************
return the size required by a struct in the stream
********************************************************************/
uint32 spoolss_size_printer_info_3(PRINTER_INFO_3 *info)
{
/* well, we don't actually *know* the damn size of the
* security descriptor. spoolss is a stupidly designed
* api.
*/
return size_of_sec_desc( &info->sec );
}
/*******************************************************************
return the size required by a struct in the stream
********************************************************************/
@@ -2829,9 +2924,7 @@ BOOL spoolss_io_q_setprinter(char *desc, SPOOL_Q_SETPRINTER *q_u, prs_struct *ps
if (!spoolss_io_devmode_cont(desc, &q_u->devmode_ctr, ps, depth))
return False;
if(!prs_uint32("security.size_of_buffer", ps, depth, &q_u->security.size_of_buffer))
return False;
if(!prs_uint32("security.data", ps, depth, &q_u->security.data))
if (!sec_io_desc_buf(desc, &q_u->secdesc_ctr, ps, depth))
return False;
if(!prs_uint32("command", ps, depth, &q_u->command))
@@ -3289,6 +3382,23 @@ BOOL spool_io_printer_info_level_1(char *desc, SPOOL_PRINTER_INFO_LEVEL_1 *il, p
return True;
}
/*******************************************************************
Parse a SPOOL_PRINTER_INFO_LEVEL_3 structure.
********************************************************************/
BOOL spool_io_printer_info_level_3(char *desc, SPOOL_PRINTER_INFO_LEVEL_3 *il, prs_struct *ps, int depth)
{
prs_debug(ps, depth, desc, "spool_io_printer_info_level_3");
depth++;
if(!prs_align(ps))
return False;
if(!prs_uint32("secdesc_ptr", ps, depth, &il->secdesc_ptr))
return False;
return True;
}
/*******************************************************************
Parse a SPOOL_PRINTER_INFO_LEVEL_2 structure.
********************************************************************/
@@ -3406,23 +3516,36 @@ BOOL spool_io_printer_info_level(char *desc, SPOOL_PRINTER_INFO_LEVEL *il, prs_s
* and by setprinter when updating printer's info
*/
case 1:
{
if (UNMARSHALLING(ps)) {
il->info_1=(SPOOL_PRINTER_INFO_LEVEL_1 *)malloc(sizeof(SPOOL_PRINTER_INFO_LEVEL_1));
il->info_1=g_new(SPOOL_PRINTER_INFO_LEVEL_1, 1);
if(il->info_1 == NULL)
return False;
}
if (!spool_io_printer_info_level_1("", il->info_1, ps, depth))
return False;
break;
}
case 2:
if (UNMARSHALLING(ps)) {
il->info_2=(SPOOL_PRINTER_INFO_LEVEL_2 *)malloc(sizeof(SPOOL_PRINTER_INFO_LEVEL_2));
il->info_2=g_new(SPOOL_PRINTER_INFO_LEVEL_2, 1);
if(il->info_2 == NULL)
return False;
}
if (!spool_io_printer_info_level_2("", il->info_2, ps, depth))
return False;
break;
case 3:
{
if (UNMARSHALLING(ps)) {
il->info_3=g_new(SPOOL_PRINTER_INFO_LEVEL_3, 1);
if(il->info_3 == NULL)
return False;
}
if (!spool_io_printer_info_level_3("", il->info_3, ps, depth))
return False;
break;
}
}
return True;
@@ -4607,11 +4730,27 @@ void free_devmode(DEVICEMODE *devmode)
}
}
void free_printer_info_3(PRINTER_INFO_3 *printer)
{
if (printer!=NULL)
{
free_sec_desc(&printer->sec);
free(printer);
}
}
void free_printer_info_2(PRINTER_INFO_2 *printer)
{
if (printer!=NULL)
{
free_devmode(printer->devmode);
printer->devmode = NULL;
if (printer->secdesc != NULL)
{
free_sec_desc(printer->secdesc);
free(printer->secdesc);
printer->secdesc = NULL;
}
free(printer);
}
}

80
source/rpc_server/srv_spoolss_nt.c
View File

@@ -587,8 +587,8 @@ static BOOL convert_printer_driver_info(const SPOOL_PRINTER_DRIVER_INFO_LEVEL *u
static BOOL convert_devicemode(DEVICEMODE devmode, NT_DEVICEMODE *nt_devmode)
{
unistr_to_dos(nt_devmode->devicename, (char *)devmode.devicename.buffer, 31);
unistr_to_dos(nt_devmode->formname, (char *)devmode.formname.buffer, 31);
unistr_to_ascii(nt_devmode->devicename, (char *)devmode.devicename.buffer, 31);
unistr_to_ascii(nt_devmode->formname, (char *)devmode.formname.buffer, 31);
nt_devmode->specversion=devmode.specversion;
nt_devmode->driverversion=devmode.driverversion;
@@ -1892,6 +1892,17 @@ static BOOL construct_printer_info_2(fstring servername, PRINTER_INFO_2 *printer
printer->devmode=devmode;
if (ntprinter.info_2->secdesc.len != 0)
{
/* steal the printer info sec_desc structure. [badly done]. */
printer->secdesc = ntprinter.info_2->secdesc.sec;
ZERO_STRUCT(ntprinter.info_2->secdesc);
}
else
{
printer->secdesc = NULL;
}
safe_free(queue);
free_a_printer(ntprinter, 2);
return True;
@@ -1903,6 +1914,31 @@ static BOOL construct_printer_info_2(fstring servername, PRINTER_INFO_2 *printer
return False;
}
/********************************************************************
* construct_printer_info_3
* fill a printer_info_3 struct
********************************************************************/
static BOOL construct_printer_info_3(fstring servername,
PRINTER_INFO_3 *printer, int snum)
{
NT_PRINTER_INFO_LEVEL ntprinter;
if (get_a_printer(&ntprinter, 2, lp_servicename(snum)) !=0 )
return False;
printer->flags = 4; /* no idea, yet. see MSDN. */
if (ntprinter.info_2->secdesc.len != 0)
{
/* steal the printer info sec_desc structure. [badly done]. */
printer->sec = *ntprinter.info_2->secdesc.sec;
safe_free(ntprinter.info_2->secdesc.sec);
ZERO_STRUCT(ntprinter.info_2->secdesc);
}
free_a_printer(ntprinter, 2);
return True;
}
/********************************************************************
Spoolss_enumprinters.
********************************************************************/
@@ -2337,6 +2373,41 @@ static uint32 getprinter_level_2(fstring servername, int snum, NEW_BUFFER *buffe
return NT_STATUS_NO_PROBLEMO;
}
/****************************************************************************
****************************************************************************/
static uint32 getprinter_level_3(fstring servername, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
{
PRINTER_INFO_3 *printer=NULL;
fstring temp;
if((printer=(PRINTER_INFO_3*)malloc(sizeof(PRINTER_INFO_3)))==NULL)
return ERROR_NOT_ENOUGH_MEMORY;
fstrcpy(temp, "\\\\");
fstrcat(temp, servername);
construct_printer_info_3(temp, printer, snum);
/* check the required size. */
*needed += spoolss_size_printer_info_3(printer);
if (!alloc_buffer_size(buffer, *needed)) {
safe_free(printer);
return ERROR_INSUFFICIENT_BUFFER;
}
/* fill the buffer with the structures */
new_smb_io_printer_info_3("", buffer, printer, 0);
/* clear memory */
free_sec_desc(&printer->sec);
if (*needed > offered) {
return ERROR_INSUFFICIENT_BUFFER;
}
else
return NT_STATUS_NO_PROBLEMO;
}
/****************************************************************************
****************************************************************************/
uint32 _spoolss_getprinter(POLICY_HND *handle, uint32 level,
@@ -2355,13 +2426,12 @@ uint32 _spoolss_getprinter(POLICY_HND *handle, uint32 level,
switch (level) {
case 0:
return getprinter_level_0(servername, snum, buffer, offered, needed);
break;
case 1:
return getprinter_level_1(servername,snum, buffer, offered, needed);
break;
case 2:
return getprinter_level_2(servername,snum, buffer, offered, needed);
break;
case 3:
return getprinter_level_3(servername,snum, buffer, offered, needed);
default:
return ERROR_INVALID_LEVEL;
break;