source3/rpc_server/srv_netlog_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997.
   7  *  Copyright (C) Jeremy Allison               1998-2001.
   8  *  Copyright (C) Andrew Bartlett                   2001.
   9  *  Copyright (C) Guenther Deschner                 2008.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 3 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25 /* This is the implementation of the netlogon pipe. */
  26
  27 #include "includes.h"
  28 #include "../libcli/auth/libcli_auth.h"
  29 #include "../libcli/auth/schannel_state.h"
  30 #include "../libcli/auth/schannel.h"
  31
  32 extern userdom_struct current_user_info;
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_RPC_SRV
  36
  37 struct netlogon_server_pipe_state {
  38         struct netr_Credential client_challenge;
  39         struct netr_Credential server_challenge;
  40 };
  41
  42 /*************************************************************************
  43  _netr_LogonControl
  44  *************************************************************************/
  45
  46 WERROR _netr_LogonControl(pipes_struct *p,
  47                           struct netr_LogonControl *r)
  48 {
  49         struct netr_LogonControl2Ex l;
  50
  51         switch (r->in.level) {
  52         case 1:
  53                 break;
  54         case 2:
  55                 return WERR_NOT_SUPPORTED;
  56         default:
  57                 return WERR_UNKNOWN_LEVEL;
  58         }
  59
  60         l.in.logon_server       = r->in.logon_server;
  61         l.in.function_code      = r->in.function_code;
  62         l.in.level              = r->in.level;
  63         l.in.data               = NULL;
  64         l.out.query             = r->out.query;
  65
  66         return _netr_LogonControl2Ex(p, &l);
  67 }
  68
  69 /****************************************************************************
  70 Send a message to smbd to do a sam synchronisation
  71 **************************************************************************/
  72
  73 static void send_sync_message(void)
  74 {
  75         DEBUG(3, ("sending sam synchronisation message\n"));
  76         message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
  77                          NULL);
  78 }
  79
  80 /*************************************************************************
  81  _netr_LogonControl2
  82  *************************************************************************/
  83
  84 WERROR _netr_LogonControl2(pipes_struct *p,
  85                            struct netr_LogonControl2 *r)
  86 {
  87         struct netr_LogonControl2Ex l;
  88
  89         l.in.logon_server       = r->in.logon_server;
  90         l.in.function_code      = r->in.function_code;
  91         l.in.level              = r->in.level;
  92         l.in.data               = r->in.data;
  93         l.out.query             = r->out.query;
  94
  95         return _netr_LogonControl2Ex(p, &l);
  96 }
  97
  98 /*************************************************************************
  99  *************************************************************************/
 100
 101 static bool wb_change_trust_creds(const char *domain, WERROR *tc_status)
 102 {
 103         wbcErr result;
 104         struct wbcAuthErrorInfo *error = NULL;
 105
 106         result = wbcChangeTrustCredentials(domain, &error);
 107         switch (result) {
 108         case WBC_ERR_WINBIND_NOT_AVAILABLE:
 109                 return false;
 110         case WBC_ERR_DOMAIN_NOT_FOUND:
 111                 *tc_status = WERR_NO_SUCH_DOMAIN;
 112                 return true;
 113         case WBC_ERR_SUCCESS:
 114                 *tc_status = WERR_OK;
 115                 return true;
 116         default:
 117                 break;
 118         }
 119
 120         if (error && error->nt_status != 0) {
 121                 *tc_status = ntstatus_to_werror(NT_STATUS(error->nt_status));
 122         } else {
 123                 *tc_status = WERR_TRUST_FAILURE;
 124         }
 125         wbcFreeMemory(error);
 126         return true;
 127 }
 128
 129 /****************************************************************
 130  _netr_LogonControl2Ex
 131 ****************************************************************/
 132
 133 WERROR _netr_LogonControl2Ex(pipes_struct *p,
 134                              struct netr_LogonControl2Ex *r)
 135 {
 136         uint32_t flags = 0x0;
 137         WERROR pdc_connection_status = WERR_OK;
 138         uint32_t logon_attempts = 0x0;
 139         WERROR tc_status;
 140         fstring dc_name2;
 141         const char *dc_name = NULL;
 142         struct sockaddr_storage dc_ss;
 143         const char *domain = NULL;
 144         struct netr_NETLOGON_INFO_1 *info1;
 145         struct netr_NETLOGON_INFO_2 *info2;
 146         struct netr_NETLOGON_INFO_3 *info3;
 147         const char *fn;
 148
 149         switch (p->hdr_req.opnum) {
 150         case NDR_NETR_LOGONCONTROL:
 151                 fn = "_netr_LogonControl";
 152                 break;
 153         case NDR_NETR_LOGONCONTROL2:
 154                 fn = "_netr_LogonControl2";
 155                 break;
 156         case NDR_NETR_LOGONCONTROL2EX:
 157                 fn = "_netr_LogonControl2Ex";
 158                 break;
 159         default:
 160                 return WERR_INVALID_PARAM;
 161         }
 162
 163         tc_status = WERR_NO_SUCH_DOMAIN;
 164
 165         switch (r->in.function_code) {
 166         case NETLOGON_CONTROL_TC_QUERY:
 167                 domain = r->in.data->domain;
 168
 169                 if (!is_trusted_domain(domain)) {
 170                         break;
 171                 }
 172
 173                 if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
 174                         tc_status = WERR_NO_LOGON_SERVERS;
 175                         break;
 176                 }
 177
 178                 dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
 179                 if (!dc_name) {
 180                         return WERR_NOMEM;
 181                 }
 182
 183                 tc_status = WERR_OK;
 184
 185                 break;
 186
 187         case NETLOGON_CONTROL_REDISCOVER:
 188                 domain = r->in.data->domain;
 189
 190                 if (!is_trusted_domain(domain)) {
 191                         break;
 192                 }
 193
 194                 if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
 195                         tc_status = WERR_NO_LOGON_SERVERS;
 196                         break;
 197                 }
 198
 199                 dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
 200                 if (!dc_name) {
 201                         return WERR_NOMEM;
 202                 }
 203
 204                 tc_status = WERR_OK;
 205
 206                 break;
 207
 208         case NETLOGON_CONTROL_CHANGE_PASSWORD:
 209                 if (!r->in.data || !r->in.data->domain) {
 210                         return WERR_NOT_SUPPORTED;
 211                 }
 212
 213                 if (!wb_change_trust_creds(r->in.data->domain, &tc_status)) {
 214                         return WERR_NOT_SUPPORTED;
 215                 }
 216                 break;
 217
 218         default:
 219                 /* no idea what this should be */
 220                 DEBUG(0,("%s: unimplemented function level [%d]\n",
 221                         fn, r->in.function_code));
 222                 return WERR_UNKNOWN_LEVEL;
 223         }
 224
 225         /* prepare the response */
 226
 227         switch (r->in.level) {
 228         case 1:
 229                 info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
 230                 W_ERROR_HAVE_NO_MEMORY(info1);
 231
 232                 info1->flags                    = flags;
 233                 info1->pdc_connection_status    = pdc_connection_status;
 234
 235                 r->out.query->info1 = info1;
 236                 break;
 237         case 2:
 238                 info2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_2);
 239                 W_ERROR_HAVE_NO_MEMORY(info2);
 240
 241                 info2->flags                    = flags;
 242                 info2->pdc_connection_status    = pdc_connection_status;
 243                 info2->trusted_dc_name          = dc_name;
 244                 info2->tc_connection_status     = tc_status;
 245
 246                 r->out.query->info2 = info2;
 247                 break;
 248         case 3:
 249                 info3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_3);
 250                 W_ERROR_HAVE_NO_MEMORY(info3);
 251
 252                 info3->flags                    = flags;
 253                 info3->logon_attempts           = logon_attempts;
 254
 255                 r->out.query->info3 = info3;
 256                 break;
 257         default:
 258                 return WERR_UNKNOWN_LEVEL;
 259         }
 260
 261         if (lp_server_role() == ROLE_DOMAIN_BDC) {
 262                 send_sync_message();
 263         }
 264
 265         return WERR_OK;
 266 }
 267
 268 /*************************************************************************
 269  _netr_NetrEnumerateTrustedDomains
 270  *************************************************************************/
 271
 272 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
 273                                          struct netr_NetrEnumerateTrustedDomains *r)
 274 {
 275         NTSTATUS status;
 276         DATA_BLOB blob;
 277         struct trustdom_info **domains;
 278         uint32_t num_domains;
 279         const char **trusted_domains;
 280         int i;
 281
 282         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 283
 284         /* set up the Trusted Domain List response */
 285
 286         become_root();
 287         status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
 288         unbecome_root();
 289
 290         if (!NT_STATUS_IS_OK(status)) {
 291                 return ntstatus_to_werror(status);
 292         }
 293
 294         trusted_domains = talloc_zero_array(p->mem_ctx, const char *, num_domains + 1);
 295         if (!trusted_domains) {
 296                 return WERR_NOMEM;
 297         }
 298
 299         for (i = 0; i < num_domains; i++) {
 300                 trusted_domains[i] = talloc_strdup(trusted_domains, domains[i]->name);
 301                 if (!trusted_domains[i]) {
 302                         TALLOC_FREE(trusted_domains);
 303                         return WERR_NOMEM;
 304                 }
 305         }
 306
 307         if (!push_reg_multi_sz(trusted_domains, &blob, trusted_domains)) {
 308                 TALLOC_FREE(trusted_domains);
 309                 return WERR_NOMEM;
 310         }
 311
 312         r->out.trusted_domains_blob->data = blob.data;
 313         r->out.trusted_domains_blob->length = blob.length;
 314
 315         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 316
 317         return WERR_OK;
 318 }
 319
 320 /******************************************************************
 321  gets a machine password entry.  checks access rights of the host.
 322  ******************************************************************/
 323
 324 static NTSTATUS get_md4pw(struct samr_Password *md4pw, const char *mach_acct,
 325                           enum netr_SchannelType sec_chan_type, struct dom_sid *sid)
 326 {
 327         struct samu *sampass = NULL;
 328         const uint8 *pass;
 329         bool ret;
 330         uint32 acct_ctrl;
 331
 332 #if 0
 333         char addr[INET6_ADDRSTRLEN];
 334
 335     /*
 336      * Currently this code is redundent as we already have a filter
 337      * by hostname list. What this code really needs to do is to
 338      * get a hosts allowed/hosts denied list from the SAM database
 339      * on a per user basis, and make the access decision there.
 340      * I will leave this code here for now as a reminder to implement
 341      * this at a later date. JRA.
 342      */
 343
 344         if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
 345                         client_name(get_client_fd()),
 346                         client_addr(get_client_fd(),addr,sizeof(addr)))) {
 347                 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
 348                 return False;
 349         }
 350 #endif /* 0 */
 351
 352         if ( !(sampass = samu_new( NULL )) ) {
 353                 return NT_STATUS_NO_MEMORY;
 354         }
 355
 356         /* JRA. This is ok as it is only used for generating the challenge. */
 357         become_root();
 358         ret = pdb_getsampwnam(sampass, mach_acct);
 359         unbecome_root();
 360
 361         if (!ret) {
 362                 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
 363                 TALLOC_FREE(sampass);
 364                 return NT_STATUS_ACCESS_DENIED;
 365         }
 366
 367         acct_ctrl = pdb_get_acct_ctrl(sampass);
 368         if (acct_ctrl & ACB_DISABLED) {
 369                 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
 370                 TALLOC_FREE(sampass);
 371                 return NT_STATUS_ACCOUNT_DISABLED;
 372         }
 373
 374         if (!(acct_ctrl & ACB_SVRTRUST) &&
 375             !(acct_ctrl & ACB_WSTRUST) &&
 376             !(acct_ctrl & ACB_DOMTRUST))
 377         {
 378                 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
 379                 TALLOC_FREE(sampass);
 380                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 381         }
 382
 383         switch (sec_chan_type) {
 384                 case SEC_CHAN_BDC:
 385                         if (!(acct_ctrl & ACB_SVRTRUST)) {
 386                                 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
 387                                          "but not a server trust account\n", mach_acct));
 388                                 TALLOC_FREE(sampass);
 389                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 390                         }
 391                         break;
 392                 case SEC_CHAN_WKSTA:
 393                         if (!(acct_ctrl & ACB_WSTRUST)) {
 394                                 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
 395                                          "but not a workstation trust account\n", mach_acct));
 396                                 TALLOC_FREE(sampass);
 397                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 398                         }
 399                         break;
 400                 case SEC_CHAN_DOMAIN:
 401                         if (!(acct_ctrl & ACB_DOMTRUST)) {
 402                                 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
 403                                          "but not a interdomain trust account\n", mach_acct));
 404                                 TALLOC_FREE(sampass);
 405                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 406                         }
 407                         break;
 408                 default:
 409                         break;
 410         }
 411
 412         if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
 413                 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
 414                 TALLOC_FREE(sampass);
 415                 return NT_STATUS_LOGON_FAILURE;
 416         }
 417
 418         memcpy(md4pw->hash, pass, 16);
 419         dump_data(5, md4pw->hash, 16);
 420
 421         sid_copy(sid, pdb_get_user_sid(sampass));
 422
 423         TALLOC_FREE(sampass);
 424
 425         return NT_STATUS_OK;
 426
 427
 428 }
 429
 430 /*************************************************************************
 431  _netr_ServerReqChallenge
 432  *************************************************************************/
 433
 434 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
 435                                   struct netr_ServerReqChallenge *r)
 436 {
 437         struct netlogon_server_pipe_state *pipe_state =
 438                 talloc_get_type(p->private_data, struct netlogon_server_pipe_state);
 439
 440         if (pipe_state) {
 441                 DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
 442                 talloc_free(pipe_state);
 443                 p->private_data = NULL;
 444         }
 445
 446         pipe_state = talloc(p, struct netlogon_server_pipe_state);
 447         NT_STATUS_HAVE_NO_MEMORY(pipe_state);
 448
 449         pipe_state->client_challenge = *r->in.credentials;
 450
 451         generate_random_buffer(pipe_state->server_challenge.data,
 452                                sizeof(pipe_state->server_challenge.data));
 453
 454         *r->out.return_credentials = pipe_state->server_challenge;
 455
 456         p->private_data = pipe_state;
 457
 458         return NT_STATUS_OK;
 459 }
 460
 461 /*************************************************************************
 462  _netr_ServerAuthenticate
 463  Create the initial credentials.
 464  *************************************************************************/
 465
 466 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
 467                                   struct netr_ServerAuthenticate *r)
 468 {
 469         struct netr_ServerAuthenticate3 a;
 470         uint32_t negotiate_flags = 0;
 471         uint32_t rid;
 472
 473         a.in.server_name                = r->in.server_name;
 474         a.in.account_name               = r->in.account_name;
 475         a.in.secure_channel_type        = r->in.secure_channel_type;
 476         a.in.computer_name              = r->in.computer_name;
 477         a.in.credentials                = r->in.credentials;
 478         a.in.negotiate_flags            = &negotiate_flags;
 479
 480         a.out.return_credentials        = r->out.return_credentials;
 481         a.out.rid                       = &rid;
 482         a.out.negotiate_flags           = &negotiate_flags;
 483
 484         return _netr_ServerAuthenticate3(p, &a);
 485
 486 }
 487
 488 /*************************************************************************
 489  _netr_ServerAuthenticate3
 490  *************************************************************************/
 491
 492 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
 493                                    struct netr_ServerAuthenticate3 *r)
 494 {
 495         NTSTATUS status;
 496         uint32_t srv_flgs;
 497         /* r->in.negotiate_flags is an aliased pointer to r->out.negotiate_flags,
 498          * so use a copy to avoid destroying the client values. */
 499         uint32_t in_neg_flags = *r->in.negotiate_flags;
 500         const char *fn;
 501         struct dom_sid sid;
 502         struct samr_Password mach_pwd;
 503         struct netlogon_creds_CredentialState *creds;
 504         struct netlogon_server_pipe_state *pipe_state =
 505                 talloc_get_type(p->private_data, struct netlogon_server_pipe_state);
 506
 507         /* According to Microsoft (see bugid #6099)
 508          * Windows 7 looks at the negotiate_flags
 509          * returned in this structure *even if the
 510          * call fails with access denied* ! So in order
 511          * to allow Win7 to connect to a Samba NT style
 512          * PDC we set the flags before we know if it's
 513          * an error or not.
 514          */
 515
 516         /* 0x000001ff */
 517         srv_flgs = NETLOGON_NEG_ACCOUNT_LOCKOUT |
 518                    NETLOGON_NEG_PERSISTENT_SAMREPL |
 519                    NETLOGON_NEG_ARCFOUR |
 520                    NETLOGON_NEG_PROMOTION_COUNT |
 521                    NETLOGON_NEG_CHANGELOG_BDC |
 522                    NETLOGON_NEG_FULL_SYNC_REPL |
 523                    NETLOGON_NEG_MULTIPLE_SIDS |
 524                    NETLOGON_NEG_REDO |
 525                    NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL |
 526                    NETLOGON_NEG_PASSWORD_SET2;
 527
 528         /* Ensure we support strong (128-bit) keys. */
 529         if (in_neg_flags & NETLOGON_NEG_STRONG_KEYS) {
 530                 srv_flgs |= NETLOGON_NEG_STRONG_KEYS;
 531         }
 532
 533         if (lp_server_schannel() != false) {
 534                 srv_flgs |= NETLOGON_NEG_SCHANNEL;
 535         }
 536
 537         switch (p->hdr_req.opnum) {
 538                 case NDR_NETR_SERVERAUTHENTICATE:
 539                         fn = "_netr_ServerAuthenticate";
 540                         break;
 541                 case NDR_NETR_SERVERAUTHENTICATE2:
 542                         fn = "_netr_ServerAuthenticate2";
 543                         break;
 544                 case NDR_NETR_SERVERAUTHENTICATE3:
 545                         fn = "_netr_ServerAuthenticate3";
 546                         break;
 547                 default:
 548                         return NT_STATUS_INTERNAL_ERROR;
 549         }
 550
 551         /* We use this as the key to store the creds: */
 552         /* r->in.computer_name */
 553
 554         if (!pipe_state) {
 555                 DEBUG(0,("%s: no challenge sent to client %s\n", fn,
 556                         r->in.computer_name));
 557                 status = NT_STATUS_ACCESS_DENIED;
 558                 goto out;
 559         }
 560
 561         if ( (lp_server_schannel() == true) &&
 562              ((in_neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
 563
 564                 /* schannel must be used, but client did not offer it. */
 565                 DEBUG(0,("%s: schannel required but client failed "
 566                         "to offer it. Client was %s\n",
 567                         fn, r->in.account_name));
 568                 status = NT_STATUS_ACCESS_DENIED;
 569                 goto out;
 570         }
 571
 572         status = get_md4pw(&mach_pwd,
 573                            r->in.account_name,
 574                            r->in.secure_channel_type,
 575                            &sid);
 576         if (!NT_STATUS_IS_OK(status)) {
 577                 DEBUG(0,("%s: failed to get machine password for "
 578                         "account %s: %s\n",
 579                         fn, r->in.account_name, nt_errstr(status) ));
 580                 /* always return NT_STATUS_ACCESS_DENIED */
 581                 status = NT_STATUS_ACCESS_DENIED;
 582                 goto out;
 583         }
 584
 585         /* From the client / server challenges and md4 password, generate sess key */
 586         /* Check client credentials are valid. */
 587         creds = netlogon_creds_server_init(p->mem_ctx,
 588                                            r->in.account_name,
 589                                            r->in.computer_name,
 590                                            r->in.secure_channel_type,
 591                                            &pipe_state->client_challenge,
 592                                            &pipe_state->server_challenge,
 593                                            &mach_pwd,
 594                                            r->in.credentials,
 595                                            r->out.return_credentials,
 596                                            *r->in.negotiate_flags);
 597         if (!creds) {
 598                 DEBUG(0,("%s: netlogon_creds_server_check failed. Rejecting auth "
 599                         "request from client %s machine account %s\n",
 600                         fn, r->in.computer_name,
 601                         r->in.account_name));
 602                 status = NT_STATUS_ACCESS_DENIED;
 603                 goto out;
 604         }
 605
 606         creds->sid = sid_dup_talloc(creds, &sid);
 607         if (!creds->sid) {
 608                 status = NT_STATUS_NO_MEMORY;
 609                 goto out;
 610         }
 611
 612         /* Store off the state so we can continue after client disconnect. */
 613         become_root();
 614         status = schannel_store_session_key(p->mem_ctx, creds);
 615         unbecome_root();
 616
 617         if (!NT_STATUS_IS_OK(status)) {
 618                 goto out;
 619         }
 620
 621         sid_peek_rid(&sid, r->out.rid);
 622
 623         status = NT_STATUS_OK;
 624
 625   out:
 626
 627         *r->out.negotiate_flags = srv_flgs;
 628         return status;
 629 }
 630
 631 /*************************************************************************
 632  _netr_ServerAuthenticate2
 633  *************************************************************************/
 634
 635 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
 636                                    struct netr_ServerAuthenticate2 *r)
 637 {
 638         struct netr_ServerAuthenticate3 a;
 639         uint32_t rid;
 640
 641         a.in.server_name                = r->in.server_name;
 642         a.in.account_name               = r->in.account_name;
 643         a.in.secure_channel_type        = r->in.secure_channel_type;
 644         a.in.computer_name              = r->in.computer_name;
 645         a.in.credentials                = r->in.credentials;
 646         a.in.negotiate_flags            = r->in.negotiate_flags;
 647
 648         a.out.return_credentials        = r->out.return_credentials;
 649         a.out.rid                       = &rid;
 650         a.out.negotiate_flags           = r->out.negotiate_flags;
 651
 652         return _netr_ServerAuthenticate3(p, &a);
 653 }
 654
 655 /*************************************************************************
 656  *************************************************************************/
 657
 658 static NTSTATUS netr_creds_server_step_check(pipes_struct *p,
 659                                              TALLOC_CTX *mem_ctx,
 660                                              const char *computer_name,
 661                                              struct netr_Authenticator *received_authenticator,
 662                                              struct netr_Authenticator *return_authenticator,
 663                                              struct netlogon_creds_CredentialState **creds_out)
 664 {
 665         NTSTATUS status;
 666         struct tdb_context *tdb;
 667         bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
 668         bool schannel_in_use = (p->auth.auth_type == PIPE_AUTH_TYPE_SCHANNEL) ? true:false; /* &&
 669                 (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY ||
 670                  p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY); */
 671
 672         tdb = open_schannel_session_store(mem_ctx);
 673         if (!tdb) {
 674                 return NT_STATUS_ACCESS_DENIED;
 675         }
 676
 677         status = schannel_creds_server_step_check_tdb(tdb, mem_ctx,
 678                                                       computer_name,
 679                                                       schannel_global_required,
 680                                                       schannel_in_use,
 681                                                       received_authenticator,
 682                                                       return_authenticator,
 683                                                       creds_out);
 684         tdb_close(tdb);
 685
 686         return status;
 687 }
 688
 689 /*************************************************************************
 690  *************************************************************************/
 691
 692 static NTSTATUS netr_find_machine_account(TALLOC_CTX *mem_ctx,
 693                                           const char *account_name,
 694                                           struct samu **sampassp)
 695 {
 696         struct samu *sampass;
 697         bool ret = false;
 698         uint32_t acct_ctrl;
 699
 700         sampass = samu_new(mem_ctx);
 701         if (!sampass) {
 702                 return NT_STATUS_NO_MEMORY;
 703         }
 704
 705         become_root();
 706         ret = pdb_getsampwnam(sampass, account_name);
 707         unbecome_root();
 708
 709         if (!ret) {
 710                 TALLOC_FREE(sampass);
 711                 return NT_STATUS_ACCESS_DENIED;
 712         }
 713
 714         /* Ensure the account exists and is a machine account. */
 715
 716         acct_ctrl = pdb_get_acct_ctrl(sampass);
 717
 718         if (!(acct_ctrl & ACB_WSTRUST ||
 719               acct_ctrl & ACB_SVRTRUST ||
 720               acct_ctrl & ACB_DOMTRUST)) {
 721                 TALLOC_FREE(sampass);
 722                 return NT_STATUS_NO_SUCH_USER;
 723         }
 724
 725         if (acct_ctrl & ACB_DISABLED) {
 726                 TALLOC_FREE(sampass);
 727                 return NT_STATUS_ACCOUNT_DISABLED;
 728         }
 729
 730         *sampassp = sampass;
 731
 732         return NT_STATUS_OK;
 733 }
 734
 735 /*************************************************************************
 736  *************************************************************************/
 737
 738 static NTSTATUS netr_set_machine_account_password(TALLOC_CTX *mem_ctx,
 739                                                   struct samu *sampass,
 740                                                   DATA_BLOB *plaintext_blob,
 741                                                   struct samr_Password *nt_hash,
 742                                                   struct samr_Password *lm_hash)
 743 {
 744         NTSTATUS status;
 745         const uchar *old_pw;
 746         const char *plaintext = NULL;
 747         size_t plaintext_len;
 748         struct samr_Password nt_hash_local;
 749
 750         if (!sampass) {
 751                 return NT_STATUS_INVALID_PARAMETER;
 752         }
 753
 754         if (plaintext_blob) {
 755                 if (!convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX,
 756                                            plaintext_blob->data, plaintext_blob->length,
 757                                            &plaintext, &plaintext_len, false))
 758                 {
 759                         plaintext = NULL;
 760                         mdfour(nt_hash_local.hash, plaintext_blob->data, plaintext_blob->length);
 761                         nt_hash = &nt_hash_local;
 762                 }
 763         }
 764
 765         if (plaintext) {
 766                 if (!pdb_set_plaintext_passwd(sampass, plaintext)) {
 767                         return NT_STATUS_ACCESS_DENIED;
 768                 }
 769
 770                 goto done;
 771         }
 772
 773         if (nt_hash) {
 774                 old_pw = pdb_get_nt_passwd(sampass);
 775
 776                 if (old_pw && memcmp(nt_hash->hash, old_pw, 16) == 0) {
 777                         /* Avoid backend modificiations and other fun if the
 778                            client changed the password to the *same thing* */
 779                 } else {
 780                         /* LM password should be NULL for machines */
 781                         if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
 782                                 return NT_STATUS_NO_MEMORY;
 783                         }
 784                         if (!pdb_set_nt_passwd(sampass, nt_hash->hash, PDB_CHANGED)) {
 785                                 return NT_STATUS_NO_MEMORY;
 786                         }
 787
 788                         if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
 789                                 /* Not quite sure what this one qualifies as, but this will do */
 790                                 return NT_STATUS_UNSUCCESSFUL;
 791                         }
 792                 }
 793         }
 794
 795  done:
 796         become_root();
 797         status = pdb_update_sam_account(sampass);
 798         unbecome_root();
 799
 800         return status;
 801 }
 802
 803 /*************************************************************************
 804  _netr_ServerPasswordSet
 805  *************************************************************************/
 806
 807 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
 808                                  struct netr_ServerPasswordSet *r)
 809 {
 810         NTSTATUS status = NT_STATUS_OK;
 811         struct samu *sampass=NULL;
 812         int i;
 813         struct netlogon_creds_CredentialState *creds;
 814
 815         DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
 816
 817         become_root();
 818         status = netr_creds_server_step_check(p, p->mem_ctx,
 819                                               r->in.computer_name,
 820                                               r->in.credential,
 821                                               r->out.return_authenticator,
 822                                               &creds);
 823         unbecome_root();
 824
 825         if (!NT_STATUS_IS_OK(status)) {
 826                 DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
 827                         "request from client %s machine account %s\n",
 828                         r->in.computer_name, creds->computer_name));
 829                 TALLOC_FREE(creds);
 830                 return status;
 831         }
 832
 833         DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
 834                         r->in.computer_name, creds->computer_name));
 835
 836         netlogon_creds_des_decrypt(creds, r->in.new_password);
 837
 838         DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
 839         for(i = 0; i < sizeof(r->in.new_password->hash); i++)
 840                 DEBUG(100,("%02X ", r->in.new_password->hash[i]));
 841         DEBUG(100,("\n"));
 842
 843         status = netr_find_machine_account(p->mem_ctx,
 844                                            creds->account_name,
 845                                            &sampass);
 846         if (!NT_STATUS_IS_OK(status)) {
 847                 return status;
 848         }
 849
 850         status = netr_set_machine_account_password(sampass,
 851                                                    sampass,
 852                                                    NULL,
 853                                                    r->in.new_password,
 854                                                    NULL);
 855         TALLOC_FREE(sampass);
 856         return status;
 857 }
 858
 859 /****************************************************************
 860  _netr_ServerPasswordSet2
 861 ****************************************************************/
 862
 863 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
 864                                   struct netr_ServerPasswordSet2 *r)
 865 {
 866         NTSTATUS status;
 867         struct netlogon_creds_CredentialState *creds;
 868         struct samu *sampass;
 869         DATA_BLOB plaintext;
 870         struct samr_CryptPassword password_buf;
 871         struct samr_Password nt_hash;
 872
 873         become_root();
 874         status = netr_creds_server_step_check(p, p->mem_ctx,
 875                                               r->in.computer_name,
 876                                               r->in.credential,
 877                                               r->out.return_authenticator,
 878                                               &creds);
 879         unbecome_root();
 880
 881         if (!NT_STATUS_IS_OK(status)) {
 882                 DEBUG(2,("_netr_ServerPasswordSet2: netlogon_creds_server_step "
 883                         "failed. Rejecting auth request from client %s machine account %s\n",
 884                         r->in.computer_name, creds->computer_name));
 885                 TALLOC_FREE(creds);
 886                 return status;
 887         }
 888
 889         memcpy(password_buf.data, r->in.new_password->data, 512);
 890         SIVAL(password_buf.data, 512, r->in.new_password->length);
 891         netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
 892
 893         if (!extract_pw_from_buffer(p->mem_ctx, password_buf.data, &plaintext)) {
 894                 return NT_STATUS_WRONG_PASSWORD;
 895         }
 896
 897         mdfour(nt_hash.hash, plaintext.data, plaintext.length);
 898
 899         status = netr_find_machine_account(p->mem_ctx,
 900                                            creds->account_name,
 901                                            &sampass);
 902         if (!NT_STATUS_IS_OK(status)) {
 903                 return status;
 904         }
 905
 906         status = netr_set_machine_account_password(sampass,
 907                                                    sampass,
 908                                                    NULL,
 909                                                    &nt_hash,
 910                                                    NULL);
 911         TALLOC_FREE(sampass);
 912         return status;
 913 }
 914
 915 /*************************************************************************
 916  _netr_LogonSamLogoff
 917  *************************************************************************/
 918
 919 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
 920                               struct netr_LogonSamLogoff *r)
 921 {
 922         NTSTATUS status;
 923         struct netlogon_creds_CredentialState *creds;
 924
 925         become_root();
 926         status = netr_creds_server_step_check(p, p->mem_ctx,
 927                                               r->in.computer_name,
 928                                               r->in.credential,
 929                                               r->out.return_authenticator,
 930                                               &creds);
 931         unbecome_root();
 932
 933         return status;
 934 }
 935
 936 /*************************************************************************
 937  _netr_LogonSamLogon_base
 938  *************************************************************************/
 939
 940 static NTSTATUS _netr_LogonSamLogon_base(pipes_struct *p,
 941                                          struct netr_LogonSamLogonEx *r,
 942                                          struct netlogon_creds_CredentialState *creds)
 943 {
 944         NTSTATUS status = NT_STATUS_OK;
 945         union netr_LogonLevel *logon = r->in.logon;
 946         const char *nt_username, *nt_domain, *nt_workstation;
 947         auth_usersupplied_info *user_info = NULL;
 948         auth_serversupplied_info *server_info = NULL;
 949         struct auth_context *auth_context = NULL;
 950         uint8_t pipe_session_key[16];
 951         bool process_creds = true;
 952         const char *fn;
 953
 954         switch (p->hdr_req.opnum) {
 955                 case NDR_NETR_LOGONSAMLOGON:
 956                         process_creds = true;
 957                         fn = "_netr_LogonSamLogon";
 958                         break;
 959                 case NDR_NETR_LOGONSAMLOGONWITHFLAGS:
 960                         process_creds = true;
 961                         fn = "_netr_LogonSamLogonWithFlags";
 962                         break;
 963                 case NDR_NETR_LOGONSAMLOGONEX:
 964                         process_creds = false;
 965                         fn = "_netr_LogonSamLogonEx";
 966                         break;
 967                 default:
 968                         return NT_STATUS_INTERNAL_ERROR;
 969         }
 970
 971         *r->out.authoritative = true; /* authoritative response */
 972
 973         switch (r->in.validation_level) {
 974         case 2:
 975                 r->out.validation->sam2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo2);
 976                 if (!r->out.validation->sam2) {
 977                         return NT_STATUS_NO_MEMORY;
 978                 }
 979                 break;
 980         case 3:
 981                 r->out.validation->sam3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo3);
 982                 if (!r->out.validation->sam3) {
 983                         return NT_STATUS_NO_MEMORY;
 984                 }
 985                 break;
 986         case 6:
 987                 r->out.validation->sam6 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo6);
 988                 if (!r->out.validation->sam6) {
 989                         return NT_STATUS_NO_MEMORY;
 990                 }
 991                 break;
 992         default:
 993                 DEBUG(0,("%s: bad validation_level value %d.\n",
 994                         fn, (int)r->in.validation_level));
 995                 return NT_STATUS_INVALID_INFO_CLASS;
 996         }
 997
 998         switch (r->in.logon_level) {
 999         case NetlogonInteractiveInformation:
1000         case NetlogonServiceInformation:
1001         case NetlogonInteractiveTransitiveInformation:
1002         case NetlogonServiceTransitiveInformation:
1003                 nt_username     = logon->password->identity_info.account_name.string;
1004                 nt_domain       = logon->password->identity_info.domain_name.string;
1005                 nt_workstation  = logon->password->identity_info.workstation.string;
1006
1007                 DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
1008                 break;
1009         case NetlogonNetworkInformation:
1010         case NetlogonNetworkTransitiveInformation:
1011                 nt_username     = logon->network->identity_info.account_name.string;
1012                 nt_domain       = logon->network->identity_info.domain_name.string;
1013                 nt_workstation  = logon->network->identity_info.workstation.string;
1014
1015                 DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
1016                 break;
1017         default:
1018                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
1019                 return NT_STATUS_INVALID_INFO_CLASS;
1020         } /* end switch */
1021
1022         DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
1023         fstrcpy(current_user_info.smb_name, nt_username);
1024         sub_set_smb_name(nt_username);
1025
1026         DEBUG(5,("Attempting validation level %d for unmapped username %s.\n",
1027                 r->in.validation_level, nt_username));
1028
1029         status = NT_STATUS_OK;
1030
1031         switch (r->in.logon_level) {
1032         case NetlogonNetworkInformation:
1033         case NetlogonNetworkTransitiveInformation:
1034         {
1035                 const char *wksname = nt_workstation;
1036
1037                 status = make_auth_context_fixed(&auth_context,
1038                                                  logon->network->challenge);
1039                 if (!NT_STATUS_IS_OK(status)) {
1040                         return status;
1041                 }
1042
1043                 /* For a network logon, the workstation name comes in with two
1044                  * backslashes in the front. Strip them if they are there. */
1045
1046                 if (*wksname == '\\') wksname++;
1047                 if (*wksname == '\\') wksname++;
1048
1049                 /* Standard challenge/response authenticaion */
1050                 if (!make_user_info_netlogon_network(&user_info,
1051                                                      nt_username, nt_domain,
1052                                                      wksname,
1053                                                      logon->network->identity_info.parameter_control,
1054                                                      logon->network->lm.data,
1055                                                      logon->network->lm.length,
1056                                                      logon->network->nt.data,
1057                                                      logon->network->nt.length)) {
1058                         status = NT_STATUS_NO_MEMORY;
1059                 }
1060                 break;
1061         }
1062         case NetlogonInteractiveInformation:
1063         case NetlogonServiceInformation:
1064         case NetlogonInteractiveTransitiveInformation:
1065         case NetlogonServiceTransitiveInformation:
1066
1067                 /* 'Interactive' authentication, supplies the password in its
1068                    MD4 form, encrypted with the session key.  We will convert
1069                    this to challenge/response for the auth subsystem to chew
1070                    on */
1071         {
1072                 uint8_t chal[8];
1073
1074                 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
1075                         return status;
1076                 }
1077
1078                 auth_context->get_ntlm_challenge(auth_context, chal);
1079
1080                 if (!make_user_info_netlogon_interactive(&user_info,
1081                                                          nt_username, nt_domain,
1082                                                          nt_workstation,
1083                                                          logon->password->identity_info.parameter_control,
1084                                                          chal,
1085                                                          logon->password->lmpassword.hash,
1086                                                          logon->password->ntpassword.hash,
1087                                                          creds->session_key)) {
1088                         status = NT_STATUS_NO_MEMORY;
1089                 }
1090                 break;
1091         }
1092         default:
1093                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
1094                 return NT_STATUS_INVALID_INFO_CLASS;
1095         } /* end switch */
1096
1097         if ( NT_STATUS_IS_OK(status) ) {
1098                 status = auth_context->check_ntlm_password(auth_context,
1099                         user_info, &server_info);
1100         }
1101
1102         (auth_context->free)(&auth_context);
1103         free_user_info(&user_info);
1104
1105         DEBUG(5,("%s: check_password returned status %s\n",
1106                   fn, nt_errstr(status)));
1107
1108         /* Check account and password */
1109
1110         if (!NT_STATUS_IS_OK(status)) {
1111                 /* If we don't know what this domain is, we need to
1112                    indicate that we are not authoritative.  This
1113                    allows the client to decide if it needs to try
1114                    a local user.  Fix by jpjanosi@us.ibm.com, #2976 */
1115                 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
1116                      && !strequal(nt_domain, get_global_sam_name())
1117                      && !is_trusted_domain(nt_domain) )
1118                         *r->out.authoritative = false; /* We are not authoritative */
1119
1120                 TALLOC_FREE(server_info);
1121                 return status;
1122         }
1123
1124         if (server_info->guest) {
1125                 /* We don't like guest domain logons... */
1126                 DEBUG(5,("%s: Attempted domain logon as GUEST "
1127                          "denied.\n", fn));
1128                 TALLOC_FREE(server_info);
1129                 return NT_STATUS_LOGON_FAILURE;
1130         }
1131
1132         /* This is the point at which, if the login was successful, that
1133            the SAM Local Security Authority should record that the user is
1134            logged in to the domain.  */
1135
1136         if (process_creds) {
1137                 /* Get the pipe session key from the creds. */
1138                 memcpy(pipe_session_key, creds->session_key, 16);
1139         } else {
1140                 /* Get the pipe session key from the schannel. */
1141                 if ((p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL)
1142                     || (p->auth.a_u.schannel_auth == NULL)) {
1143                         return NT_STATUS_INVALID_HANDLE;
1144                 }
1145                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->creds->session_key, 16);
1146         }
1147
1148         switch (r->in.validation_level) {
1149         case 2:
1150                 status = serverinfo_to_SamInfo2(server_info, pipe_session_key, 16,
1151                                                 r->out.validation->sam2);
1152                 break;
1153         case 3:
1154                 status = serverinfo_to_SamInfo3(server_info, pipe_session_key, 16,
1155                                                 r->out.validation->sam3);
1156                 break;
1157         case 6:
1158                 status = serverinfo_to_SamInfo6(server_info, pipe_session_key, 16,
1159                                                 r->out.validation->sam6);
1160                 break;
1161         }
1162
1163         TALLOC_FREE(server_info);
1164
1165         return status;
1166 }
1167
1168 /****************************************************************
1169  _netr_LogonSamLogonWithFlags
1170 ****************************************************************/
1171
1172 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1173                                       struct netr_LogonSamLogonWithFlags *r)
1174 {
1175         NTSTATUS status;
1176         struct netlogon_creds_CredentialState *creds;
1177         struct netr_LogonSamLogonEx r2;
1178         struct netr_Authenticator return_authenticator;
1179
1180         become_root();
1181         status = netr_creds_server_step_check(p, p->mem_ctx,
1182                                               r->in.computer_name,
1183                                               r->in.credential,
1184                                               &return_authenticator,
1185                                               &creds);
1186         unbecome_root();
1187         if (!NT_STATUS_IS_OK(status)) {
1188                 return status;
1189         }
1190
1191         r2.in.server_name       = r->in.server_name;
1192         r2.in.computer_name     = r->in.computer_name;
1193         r2.in.logon_level       = r->in.logon_level;
1194         r2.in.logon             = r->in.logon;
1195         r2.in.validation_level  = r->in.validation_level;
1196         r2.in.flags             = r->in.flags;
1197         r2.out.validation       = r->out.validation;
1198         r2.out.authoritative    = r->out.authoritative;
1199         r2.out.flags            = r->out.flags;
1200
1201         status = _netr_LogonSamLogon_base(p, &r2, creds);
1202
1203         *r->out.return_authenticator = return_authenticator;
1204
1205         return status;
1206 }
1207
1208 /*************************************************************************
1209  _netr_LogonSamLogon
1210  *************************************************************************/
1211
1212 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
1213                              struct netr_LogonSamLogon *r)
1214 {
1215         NTSTATUS status;
1216         struct netr_LogonSamLogonWithFlags r2;
1217         uint32_t flags = 0;
1218
1219         r2.in.server_name               = r->in.server_name;
1220         r2.in.computer_name             = r->in.computer_name;
1221         r2.in.credential                = r->in.credential;
1222         r2.in.logon_level               = r->in.logon_level;
1223         r2.in.logon                     = r->in.logon;
1224         r2.in.validation_level          = r->in.validation_level;
1225         r2.in.return_authenticator      = r->in.return_authenticator;
1226         r2.in.flags                     = &flags;
1227         r2.out.validation               = r->out.validation;
1228         r2.out.authoritative            = r->out.authoritative;
1229         r2.out.flags                    = &flags;
1230         r2.out.return_authenticator     = r->out.return_authenticator;
1231
1232         status = _netr_LogonSamLogonWithFlags(p, &r2);
1233
1234         return status;
1235 }
1236
1237 /*************************************************************************
1238  _netr_LogonSamLogonEx
1239  - no credential chaining. Map into net sam logon.
1240  *************************************************************************/
1241
1242 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1243                                struct netr_LogonSamLogonEx *r)
1244 {
1245         NTSTATUS status;
1246         struct netlogon_creds_CredentialState *creds = NULL;
1247
1248         become_root();
1249         status = schannel_fetch_session_key(p->mem_ctx, r->in.computer_name, &creds);
1250         unbecome_root();
1251         if (!NT_STATUS_IS_OK(status)) {
1252                 return status;
1253         }
1254
1255         /* Only allow this if the pipe is protected. */
1256         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1257                 DEBUG(0,("_netr_LogonSamLogonEx: client %s not using schannel for netlogon\n",
1258                         get_remote_machine_name() ));
1259                 return NT_STATUS_INVALID_PARAMETER;
1260         }
1261
1262         status = _netr_LogonSamLogon_base(p, r, creds);
1263         TALLOC_FREE(creds);
1264
1265         return status;
1266 }
1267
1268 /*************************************************************************
1269  _ds_enum_dom_trusts
1270  *************************************************************************/
1271 #if 0   /* JERRY -- not correct */
1272  NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1273                              DS_R_ENUM_DOM_TRUSTS *r_u)
1274 {
1275         NTSTATUS status = NT_STATUS_OK;
1276
1277         /* TODO: According to MSDN, the can only be executed against a
1278            DC or domain member running Windows 2000 or later.  Need
1279            to test against a standalone 2k server and see what it
1280            does.  A windows 2000 DC includes its own domain in the
1281            list.  --jerry */
1282
1283         return status;
1284 }
1285 #endif  /* JERRY */
1286
1287
1288 /****************************************************************
1289 ****************************************************************/
1290
1291 WERROR _netr_LogonUasLogon(pipes_struct *p,
1292                            struct netr_LogonUasLogon *r)
1293 {
1294         p->rng_fault_state = true;
1295         return WERR_NOT_SUPPORTED;
1296 }
1297
1298 /****************************************************************
1299 ****************************************************************/
1300
1301 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1302                             struct netr_LogonUasLogoff *r)
1303 {
1304         p->rng_fault_state = true;
1305         return WERR_NOT_SUPPORTED;
1306 }
1307
1308 /****************************************************************
1309 ****************************************************************/
1310
1311 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1312                               struct netr_DatabaseDeltas *r)
1313 {
1314         p->rng_fault_state = true;
1315         return NT_STATUS_NOT_IMPLEMENTED;
1316 }
1317
1318 /****************************************************************
1319 ****************************************************************/
1320
1321 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1322                             struct netr_DatabaseSync *r)
1323 {
1324         p->rng_fault_state = true;
1325         return NT_STATUS_NOT_IMPLEMENTED;
1326 }
1327
1328 /****************************************************************
1329 ****************************************************************/
1330
1331 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1332                              struct netr_AccountDeltas *r)
1333 {
1334         p->rng_fault_state = true;
1335         return NT_STATUS_NOT_IMPLEMENTED;
1336 }
1337
1338 /****************************************************************
1339 ****************************************************************/
1340
1341 NTSTATUS _netr_AccountSync(pipes_struct *p,
1342                            struct netr_AccountSync *r)
1343 {
1344         p->rng_fault_state = true;
1345         return NT_STATUS_NOT_IMPLEMENTED;
1346 }
1347
1348 /****************************************************************
1349 ****************************************************************/
1350
1351 WERROR _netr_GetDcName(pipes_struct *p,
1352                        struct netr_GetDcName *r)
1353 {
1354         p->rng_fault_state = true;
1355         return WERR_NOT_SUPPORTED;
1356 }
1357
1358 /****************************************************************
1359 ****************************************************************/
1360
1361 WERROR _netr_GetAnyDCName(pipes_struct *p,
1362                           struct netr_GetAnyDCName *r)
1363 {
1364         p->rng_fault_state = true;
1365         return WERR_NOT_SUPPORTED;
1366 }
1367
1368 /****************************************************************
1369 ****************************************************************/
1370
1371 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1372                              struct netr_DatabaseSync2 *r)
1373 {
1374         p->rng_fault_state = true;
1375         return NT_STATUS_NOT_IMPLEMENTED;
1376 }
1377
1378 /****************************************************************
1379 ****************************************************************/
1380
1381 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1382                             struct netr_DatabaseRedo *r)
1383 {
1384         p->rng_fault_state = true;
1385         return NT_STATUS_NOT_IMPLEMENTED;
1386 }
1387
1388 /****************************************************************
1389 ****************************************************************/
1390
1391 WERROR _netr_DsRGetDCName(pipes_struct *p,
1392                           struct netr_DsRGetDCName *r)
1393 {
1394         p->rng_fault_state = true;
1395         return WERR_NOT_SUPPORTED;
1396 }
1397
1398 /****************************************************************
1399 ****************************************************************/
1400
1401 NTSTATUS _netr_LogonGetCapabilities(pipes_struct *p,
1402                                     struct netr_LogonGetCapabilities *r)
1403 {
1404         return NT_STATUS_NOT_IMPLEMENTED;
1405 }
1406
1407 /****************************************************************
1408 ****************************************************************/
1409
1410 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1411                                      struct netr_NETRLOGONSETSERVICEBITS *r)
1412 {
1413         p->rng_fault_state = true;
1414         return WERR_NOT_SUPPORTED;
1415 }
1416
1417 /****************************************************************
1418 ****************************************************************/
1419
1420 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1421                               struct netr_LogonGetTrustRid *r)
1422 {
1423         p->rng_fault_state = true;
1424         return WERR_NOT_SUPPORTED;
1425 }
1426
1427 /****************************************************************
1428 ****************************************************************/
1429
1430 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1431                                           struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1432 {
1433         p->rng_fault_state = true;
1434         return WERR_NOT_SUPPORTED;
1435 }
1436
1437 /****************************************************************
1438 ****************************************************************/
1439
1440 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1441                                           struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1442 {
1443         p->rng_fault_state = true;
1444         return WERR_NOT_SUPPORTED;
1445 }
1446
1447 /****************************************************************
1448 ****************************************************************/
1449
1450 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1451                             struct netr_DsRGetDCNameEx *r)
1452 {
1453         p->rng_fault_state = true;
1454         return WERR_NOT_SUPPORTED;
1455 }
1456
1457 /****************************************************************
1458 ****************************************************************/
1459
1460 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1461                             struct netr_DsRGetSiteName *r)
1462 {
1463         p->rng_fault_state = true;
1464         return WERR_NOT_SUPPORTED;
1465 }
1466
1467 /****************************************************************
1468 ****************************************************************/
1469
1470 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1471                                   struct netr_LogonGetDomainInfo *r)
1472 {
1473         p->rng_fault_state = true;
1474         return NT_STATUS_NOT_IMPLEMENTED;
1475 }
1476
1477 /****************************************************************
1478 ****************************************************************/
1479
1480 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1481                                struct netr_ServerPasswordGet *r)
1482 {
1483         p->rng_fault_state = true;
1484         return WERR_NOT_SUPPORTED;
1485 }
1486
1487 /****************************************************************
1488 ****************************************************************/
1489
1490 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1491                                 struct netr_NETRLOGONSENDTOSAM *r)
1492 {
1493         p->rng_fault_state = true;
1494         return WERR_NOT_SUPPORTED;
1495 }
1496
1497 /****************************************************************
1498 ****************************************************************/
1499
1500 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1501                                     struct netr_DsRAddressToSitenamesW *r)
1502 {
1503         p->rng_fault_state = true;
1504         return WERR_NOT_SUPPORTED;
1505 }
1506
1507 /****************************************************************
1508 ****************************************************************/
1509
1510 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1511                              struct netr_DsRGetDCNameEx2 *r)
1512 {
1513         p->rng_fault_state = true;
1514         return WERR_NOT_SUPPORTED;
1515 }
1516
1517 /****************************************************************
1518 ****************************************************************/
1519
1520 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1521                                                  struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1522 {
1523         p->rng_fault_state = true;
1524         return WERR_NOT_SUPPORTED;
1525 }
1526
1527 /****************************************************************
1528 ****************************************************************/
1529
1530 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1531                                            struct netr_NetrEnumerateTrustedDomainsEx *r)
1532 {
1533         p->rng_fault_state = true;
1534         return WERR_NOT_SUPPORTED;
1535 }
1536
1537 /****************************************************************
1538 ****************************************************************/
1539
1540 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1541                                       struct netr_DsRAddressToSitenamesExW *r)
1542 {
1543         p->rng_fault_state = true;
1544         return WERR_NOT_SUPPORTED;
1545 }
1546
1547 /****************************************************************
1548 ****************************************************************/
1549
1550 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1551                                    struct netr_DsrGetDcSiteCoverageW *r)
1552 {
1553         p->rng_fault_state = true;
1554         return WERR_NOT_SUPPORTED;
1555 }
1556
1557 /****************************************************************
1558 ****************************************************************/
1559
1560 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1561                                       struct netr_DsrEnumerateDomainTrusts *r)
1562 {
1563         p->rng_fault_state = true;
1564         return WERR_NOT_SUPPORTED;
1565 }
1566
1567 /****************************************************************
1568 ****************************************************************/
1569
1570 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1571                                          struct netr_DsrDeregisterDNSHostRecords *r)
1572 {
1573         p->rng_fault_state = true;
1574         return WERR_NOT_SUPPORTED;
1575 }
1576
1577 /****************************************************************
1578 ****************************************************************/
1579
1580 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1581                                        struct netr_ServerTrustPasswordsGet *r)
1582 {
1583         p->rng_fault_state = true;
1584         return NT_STATUS_NOT_IMPLEMENTED;
1585 }
1586
1587 /****************************************************************
1588 ****************************************************************/
1589
1590 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1591                                           struct netr_DsRGetForestTrustInformation *r)
1592 {
1593         p->rng_fault_state = true;
1594         return WERR_NOT_SUPPORTED;
1595 }
1596
1597 /****************************************************************
1598 ****************************************************************/
1599
1600 WERROR _netr_GetForestTrustInformation(pipes_struct *p,
1601                                        struct netr_GetForestTrustInformation *r)
1602 {
1603         p->rng_fault_state = true;
1604         return WERR_NOT_SUPPORTED;
1605 }
1606
1607 /****************************************************************
1608 ****************************************************************/
1609
1610 NTSTATUS _netr_ServerGetTrustInfo(pipes_struct *p,
1611                                   struct netr_ServerGetTrustInfo *r)
1612 {
1613         p->rng_fault_state = true;
1614         return NT_STATUS_NOT_IMPLEMENTED;
1615 }
1616