| 1 | /*
|
|---|
| 2 | Unix SMB/CIFS implementation.
|
|---|
| 3 | Printing routines that bridge to spoolss
|
|---|
| 4 | Copyright (C) Simo Sorce 2010
|
|---|
| 5 |
|
|---|
| 6 | This program is free software; you can redistribute it and/or modify
|
|---|
| 7 | it under the terms of the GNU General Public License as published by
|
|---|
| 8 | the Free Software Foundation; either version 3 of the License, or
|
|---|
| 9 | (at your option) any later version.
|
|---|
| 10 |
|
|---|
| 11 | This program is distributed in the hope that it will be useful,
|
|---|
| 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|---|
| 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|---|
| 14 | GNU General Public License for more details.
|
|---|
| 15 |
|
|---|
| 16 | You should have received a copy of the GNU General Public License
|
|---|
| 17 | along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|---|
| 18 | */
|
|---|
| 19 |
|
|---|
| 20 | #include "includes.h"
|
|---|
| 21 | #include "printing.h"
|
|---|
| 22 | #include "rpc_client/rpc_client.h"
|
|---|
| 23 | #include "../librpc/gen_ndr/ndr_spoolss_c.h"
|
|---|
| 24 | #include "rpc_server/rpc_ncacn_np.h"
|
|---|
| 25 | #include "smbd/globals.h"
|
|---|
| 26 | #include "../libcli/security/security.h"
|
|---|
| 27 |
|
|---|
| 28 | void print_spool_terminate(struct connection_struct *conn,
|
|---|
| 29 | struct print_file_data *print_file);
|
|---|
| 30 |
|
|---|
| 31 | /***************************************************************************
|
|---|
| 32 | * Open a Document over spoolss
|
|---|
| 33 | ***************************************************************************/
|
|---|
| 34 |
|
|---|
| 35 | #define DOCNAME_DEFAULT "Remote Downlevel Document"
|
|---|
| 36 | #ifndef PRINT_SPOOL_PREFIX
|
|---|
| 37 | #define PRINT_SPOOL_PREFIX "smbprn."
|
|---|
| 38 | #endif
|
|---|
| 39 |
|
|---|
| 40 | NTSTATUS print_spool_open(files_struct *fsp,
|
|---|
| 41 | const char *fname,
|
|---|
| 42 | uint16_t current_vuid)
|
|---|
| 43 | {
|
|---|
| 44 | NTSTATUS status;
|
|---|
| 45 | TALLOC_CTX *tmp_ctx;
|
|---|
| 46 | struct print_file_data *pf;
|
|---|
| 47 | struct dcerpc_binding_handle *b = NULL;
|
|---|
| 48 | struct spoolss_DevmodeContainer devmode_ctr;
|
|---|
| 49 | union spoolss_DocumentInfo info;
|
|---|
| 50 | int fd = -1;
|
|---|
| 51 | WERROR werr;
|
|---|
| 52 |
|
|---|
| 53 | tmp_ctx = talloc_new(fsp);
|
|---|
| 54 | if (!tmp_ctx) {
|
|---|
| 55 | return NT_STATUS_NO_MEMORY;
|
|---|
| 56 | }
|
|---|
| 57 |
|
|---|
| 58 | pf = talloc_zero(fsp, struct print_file_data);
|
|---|
| 59 | if (!pf) {
|
|---|
| 60 | status = NT_STATUS_NO_MEMORY;
|
|---|
| 61 | goto done;
|
|---|
| 62 | }
|
|---|
| 63 | pf->svcname = talloc_strdup(pf, lp_servicename(SNUM(fsp->conn)));
|
|---|
| 64 |
|
|---|
| 65 | /* the document name is derived from the file name.
|
|---|
| 66 | * "Remote Downlevel Document" is added in front to
|
|---|
| 67 | * mimic what windows does in this case */
|
|---|
| 68 | pf->docname = talloc_strdup(pf, DOCNAME_DEFAULT);
|
|---|
| 69 | if (!pf->docname) {
|
|---|
| 70 | status = NT_STATUS_NO_MEMORY;
|
|---|
| 71 | goto done;
|
|---|
| 72 | }
|
|---|
| 73 | if (fname) {
|
|---|
| 74 | const char *p = strrchr(fname, '/');
|
|---|
| 75 | if (!p) {
|
|---|
| 76 | p = fname;
|
|---|
| 77 | }
|
|---|
| 78 | pf->docname = talloc_asprintf_append(pf->docname, " %s", p);
|
|---|
| 79 | if (!pf->docname) {
|
|---|
| 80 | status = NT_STATUS_NO_MEMORY;
|
|---|
| 81 | goto done;
|
|---|
| 82 | }
|
|---|
| 83 | }
|
|---|
| 84 |
|
|---|
| 85 | /*
|
|---|
| 86 | * Ok, now we have to open an actual file.
|
|---|
| 87 | * Here is the reason:
|
|---|
| 88 | * We want to write the spool job to this file in
|
|---|
| 89 | * smbd for scalability reason (and also because
|
|---|
| 90 | * apparently window printer drivers can seek when
|
|---|
| 91 | * spooling to a file).
|
|---|
| 92 | * So we first create a file, and then we pass it
|
|---|
| 93 | * to spoolss in output_file so it can monitor and
|
|---|
| 94 | * take over once we call EndDocPrinter().
|
|---|
| 95 | * Of course we will not start writing until
|
|---|
| 96 | * StartDocPrinter() actually gives the ok.
|
|---|
| 97 | * smbd spooler files do not include a print jobid
|
|---|
| 98 | * path component, as the jobid is only known after
|
|---|
| 99 | * calling StartDocPrinter().
|
|---|
| 100 | */
|
|---|
| 101 |
|
|---|
| 102 | pf->filename = talloc_asprintf(pf, "%s/%sXXXXXX",
|
|---|
| 103 | lp_pathname(SNUM(fsp->conn)),
|
|---|
| 104 | PRINT_SPOOL_PREFIX);
|
|---|
| 105 | if (!pf->filename) {
|
|---|
| 106 | status = NT_STATUS_NO_MEMORY;
|
|---|
| 107 | goto done;
|
|---|
| 108 | }
|
|---|
| 109 | errno = 0;
|
|---|
| 110 | fd = mkstemp(pf->filename);
|
|---|
| 111 | if (fd == -1) {
|
|---|
| 112 | if (errno == EACCES) {
|
|---|
| 113 | /* Common setup error, force a report. */
|
|---|
| 114 | DEBUG(0, ("Insufficient permissions "
|
|---|
| 115 | "to open spool file %s.\n",
|
|---|
| 116 | pf->filename));
|
|---|
| 117 | } else {
|
|---|
| 118 | /* Normal case, report at level 3 and above. */
|
|---|
| 119 | DEBUG(3, ("can't open spool file %s,\n",
|
|---|
| 120 | pf->filename));
|
|---|
| 121 | DEBUGADD(3, ("errno = %d (%s).\n",
|
|---|
| 122 | errno, strerror(errno)));
|
|---|
| 123 | }
|
|---|
| 124 | status = map_nt_error_from_unix(errno);
|
|---|
| 125 | goto done;
|
|---|
| 126 | }
|
|---|
| 127 |
|
|---|
| 128 | /* now open a document over spoolss so that it does
|
|---|
| 129 | * all printer verification, and eventually assigns
|
|---|
| 130 | * a job id */
|
|---|
| 131 |
|
|---|
| 132 | status = rpc_pipe_open_interface(fsp->conn,
|
|---|
| 133 | &ndr_table_spoolss.syntax_id,
|
|---|
| 134 | fsp->conn->session_info,
|
|---|
| 135 | &fsp->conn->sconn->client_id,
|
|---|
| 136 | fsp->conn->sconn->msg_ctx,
|
|---|
| 137 | &fsp->conn->spoolss_pipe);
|
|---|
| 138 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 139 | goto done;
|
|---|
| 140 | }
|
|---|
| 141 | b = fsp->conn->spoolss_pipe->binding_handle;
|
|---|
| 142 |
|
|---|
| 143 | ZERO_STRUCT(devmode_ctr);
|
|---|
| 144 |
|
|---|
| 145 | status = dcerpc_spoolss_OpenPrinter(b, pf, pf->svcname,
|
|---|
| 146 | "RAW", devmode_ctr,
|
|---|
| 147 | PRINTER_ACCESS_USE,
|
|---|
| 148 | &pf->handle, &werr);
|
|---|
| 149 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 150 | goto done;
|
|---|
| 151 | }
|
|---|
| 152 | if (!W_ERROR_IS_OK(werr)) {
|
|---|
| 153 | status = werror_to_ntstatus(werr);
|
|---|
| 154 | goto done;
|
|---|
| 155 | }
|
|---|
| 156 |
|
|---|
| 157 | info.info1 = talloc(tmp_ctx, struct spoolss_DocumentInfo1);
|
|---|
| 158 | if (!info.info1) {
|
|---|
| 159 | status = NT_STATUS_NO_MEMORY;
|
|---|
| 160 | goto done;
|
|---|
| 161 | }
|
|---|
| 162 | info.info1->document_name = pf->docname;
|
|---|
| 163 | info.info1->output_file = pf->filename;
|
|---|
| 164 | info.info1->datatype = "RAW";
|
|---|
| 165 |
|
|---|
| 166 | status = dcerpc_spoolss_StartDocPrinter(b, tmp_ctx, &pf->handle,
|
|---|
| 167 | 1, info, &pf->jobid, &werr);
|
|---|
| 168 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 169 | goto done;
|
|---|
| 170 | }
|
|---|
| 171 | if (!W_ERROR_IS_OK(werr)) {
|
|---|
| 172 | status = werror_to_ntstatus(werr);
|
|---|
| 173 | goto done;
|
|---|
| 174 | }
|
|---|
| 175 |
|
|---|
| 176 | /* Convert to RAP id. */
|
|---|
| 177 | pf->rap_jobid = pjobid_to_rap(pf->svcname, pf->jobid);
|
|---|
| 178 | if (pf->rap_jobid == 0) {
|
|---|
| 179 | /* No errno around here */
|
|---|
| 180 | status = NT_STATUS_ACCESS_DENIED;
|
|---|
| 181 | goto done;
|
|---|
| 182 | }
|
|---|
| 183 |
|
|---|
| 184 | /* setup a full fsp */
|
|---|
| 185 | status = create_synthetic_smb_fname(fsp, pf->filename, NULL,
|
|---|
| 186 | NULL, &fsp->fsp_name);
|
|---|
| 187 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 188 | goto done;
|
|---|
| 189 | }
|
|---|
| 190 |
|
|---|
| 191 | if (sys_fstat(fd, &fsp->fsp_name->st, false) != 0) {
|
|---|
| 192 | status = map_nt_error_from_unix(errno);
|
|---|
| 193 | goto done;
|
|---|
| 194 | }
|
|---|
| 195 |
|
|---|
| 196 | fsp->file_id = vfs_file_id_from_sbuf(fsp->conn, &fsp->fsp_name->st);
|
|---|
| 197 | fsp->mode = fsp->fsp_name->st.st_ex_mode;
|
|---|
| 198 | fsp->fh->fd = fd;
|
|---|
| 199 |
|
|---|
| 200 | fsp->vuid = current_vuid;
|
|---|
| 201 | fsp->can_lock = false;
|
|---|
| 202 | fsp->can_read = false;
|
|---|
| 203 | fsp->access_mask = FILE_GENERIC_WRITE;
|
|---|
| 204 | fsp->can_write = true;
|
|---|
| 205 | fsp->modified = false;
|
|---|
| 206 | fsp->oplock_type = NO_OPLOCK;
|
|---|
| 207 | fsp->sent_oplock_break = NO_BREAK_SENT;
|
|---|
| 208 | fsp->is_directory = false;
|
|---|
| 209 |
|
|---|
| 210 | fsp->print_file = pf;
|
|---|
| 211 |
|
|---|
| 212 | status = NT_STATUS_OK;
|
|---|
| 213 | done:
|
|---|
| 214 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 215 | if (fd != -1) {
|
|---|
| 216 | close(fd);
|
|---|
| 217 | if (fsp->print_file) {
|
|---|
| 218 | unlink(fsp->print_file->filename);
|
|---|
| 219 | }
|
|---|
| 220 | }
|
|---|
| 221 | /* We need to delete the job from spoolss too */
|
|---|
| 222 | if (pf->jobid) {
|
|---|
| 223 | print_spool_terminate(fsp->conn, pf);
|
|---|
| 224 | }
|
|---|
| 225 | }
|
|---|
| 226 | talloc_free(tmp_ctx);
|
|---|
| 227 | return status;
|
|---|
| 228 | }
|
|---|
| 229 |
|
|---|
| 230 | int print_spool_write(files_struct *fsp,
|
|---|
| 231 | const char *data, uint32_t size,
|
|---|
| 232 | SMB_OFF_T offset, uint32_t *written)
|
|---|
| 233 | {
|
|---|
| 234 | SMB_STRUCT_STAT st;
|
|---|
| 235 | ssize_t n;
|
|---|
| 236 | int ret;
|
|---|
| 237 |
|
|---|
| 238 | *written = 0;
|
|---|
| 239 |
|
|---|
| 240 | /* first of all stat file to find out if it is still there.
|
|---|
| 241 | * spoolss may have deleted it to signal someone has killed
|
|---|
| 242 | * the job through it's interface */
|
|---|
| 243 |
|
|---|
| 244 | if (sys_fstat(fsp->fh->fd, &st, false) != 0) {
|
|---|
| 245 | ret = errno;
|
|---|
| 246 | DEBUG(3, ("printfile_offset: sys_fstat failed on %s (%s)\n",
|
|---|
| 247 | fsp_str_dbg(fsp), strerror(ret)));
|
|---|
| 248 | return ret;
|
|---|
| 249 | }
|
|---|
| 250 |
|
|---|
| 251 | /* check if the file is unlinked, this will signal spoolss has
|
|---|
| 252 | * killed it, just return an error and close the file */
|
|---|
| 253 | if (st.st_ex_nlink == 0) {
|
|---|
| 254 | close(fsp->fh->fd);
|
|---|
| 255 | return EBADF;
|
|---|
| 256 | }
|
|---|
| 257 |
|
|---|
| 258 | /* When print files go beyond 4GB, the 32-bit offset sent in
|
|---|
| 259 | * old SMBwrite calls is relative to the current 4GB chunk
|
|---|
| 260 | * we're writing to.
|
|---|
| 261 | * Discovered by Sebastian Kloska <oncaphillis@snafu.de>.
|
|---|
| 262 | */
|
|---|
| 263 | if (offset < 0xffffffff00000000LL) {
|
|---|
| 264 | offset = (st.st_ex_size & 0xffffffff00000000LL) + offset;
|
|---|
| 265 | }
|
|---|
| 266 |
|
|---|
| 267 | n = write_data_at_offset(fsp->fh->fd, data, size, offset);
|
|---|
| 268 | if (n == -1) {
|
|---|
| 269 | ret = errno;
|
|---|
| 270 | print_spool_terminate(fsp->conn, fsp->print_file);
|
|---|
| 271 | } else {
|
|---|
| 272 | *written = n;
|
|---|
| 273 | ret = 0;
|
|---|
| 274 | }
|
|---|
| 275 |
|
|---|
| 276 | return ret;
|
|---|
| 277 | }
|
|---|
| 278 |
|
|---|
| 279 | void print_spool_end(files_struct *fsp, enum file_close_type close_type)
|
|---|
| 280 | {
|
|---|
| 281 | NTSTATUS status;
|
|---|
| 282 | WERROR werr;
|
|---|
| 283 | struct dcerpc_binding_handle *b = NULL;
|
|---|
| 284 |
|
|---|
| 285 | b = fsp->conn->spoolss_pipe->binding_handle;
|
|---|
| 286 |
|
|---|
| 287 | switch (close_type) {
|
|---|
| 288 | case NORMAL_CLOSE:
|
|---|
| 289 | case SHUTDOWN_CLOSE:
|
|---|
| 290 | /* this also automatically calls spoolss_EndDocPrinter */
|
|---|
| 291 | status = dcerpc_spoolss_ClosePrinter(b, fsp->print_file,
|
|---|
| 292 | &fsp->print_file->handle,
|
|---|
| 293 | &werr);
|
|---|
| 294 | if (!NT_STATUS_IS_OK(status) ||
|
|---|
| 295 | !NT_STATUS_IS_OK(status = werror_to_ntstatus(werr))) {
|
|---|
| 296 | DEBUG(3, ("Failed to close printer %s [%s]\n",
|
|---|
| 297 | fsp->print_file->svcname, nt_errstr(status)));
|
|---|
| 298 | }
|
|---|
| 299 | break;
|
|---|
| 300 | case ERROR_CLOSE:
|
|---|
| 301 | print_spool_terminate(fsp->conn, fsp->print_file);
|
|---|
| 302 | break;
|
|---|
| 303 | }
|
|---|
| 304 | }
|
|---|
| 305 |
|
|---|
| 306 |
|
|---|
| 307 | void print_spool_terminate(struct connection_struct *conn,
|
|---|
| 308 | struct print_file_data *print_file)
|
|---|
| 309 | {
|
|---|
| 310 | NTSTATUS status;
|
|---|
| 311 | WERROR werr;
|
|---|
| 312 | struct dcerpc_binding_handle *b = NULL;
|
|---|
| 313 |
|
|---|
| 314 | rap_jobid_delete(print_file->svcname, print_file->jobid);
|
|---|
| 315 |
|
|---|
| 316 | status = rpc_pipe_open_interface(conn,
|
|---|
| 317 | &ndr_table_spoolss.syntax_id,
|
|---|
| 318 | conn->session_info,
|
|---|
| 319 | &conn->sconn->client_id,
|
|---|
| 320 | conn->sconn->msg_ctx,
|
|---|
| 321 | &conn->spoolss_pipe);
|
|---|
| 322 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 323 | DEBUG(0, ("print_spool_terminate: "
|
|---|
| 324 | "Failed to get spoolss pipe [%s]\n",
|
|---|
| 325 | nt_errstr(status)));
|
|---|
| 326 | return;
|
|---|
| 327 | }
|
|---|
| 328 | b = conn->spoolss_pipe->binding_handle;
|
|---|
| 329 |
|
|---|
| 330 | status = dcerpc_spoolss_SetJob(b, print_file,
|
|---|
| 331 | &print_file->handle,
|
|---|
| 332 | print_file->jobid,
|
|---|
| 333 | NULL, SPOOLSS_JOB_CONTROL_DELETE,
|
|---|
| 334 | &werr);
|
|---|
| 335 | if (!NT_STATUS_IS_OK(status) ||
|
|---|
| 336 | !NT_STATUS_IS_OK(status = werror_to_ntstatus(werr))) {
|
|---|
| 337 | DEBUG(3, ("Failed to delete job %d [%s]\n",
|
|---|
| 338 | print_file->jobid, nt_errstr(status)));
|
|---|
| 339 | return;
|
|---|
| 340 | }
|
|---|
| 341 | status = dcerpc_spoolss_ClosePrinter(b, print_file,
|
|---|
| 342 | &print_file->handle,
|
|---|
| 343 | &werr);
|
|---|
| 344 | if (!NT_STATUS_IS_OK(status) ||
|
|---|
| 345 | !NT_STATUS_IS_OK(status = werror_to_ntstatus(werr))) {
|
|---|
| 346 | DEBUG(3, ("Failed to close printer %s [%s]\n",
|
|---|
| 347 | print_file->svcname, nt_errstr(status)));
|
|---|
| 348 | return;
|
|---|
| 349 | }
|
|---|
| 350 | }
|
|---|