source4/rpc_server/netlogon/dcerpc_netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    endpoint server for the netlogon pipe
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
   7    Copyright (C) Stefan Metzmacher <metze@samba.org>  2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "librpc/gen_ndr/ndr_netlogon.h"
  26 #include "rpc_server/dcerpc_server.h"
  27 #include "rpc_server/common/common.h"
  28 #include "librpc/gen_ndr/ndr_dcom.h"
  29 #include "auth/auth.h"
  30 #include "lib/ldb/include/ldb.h"
  31
  32 struct server_pipe_state {
  33         struct netr_Credential client_challenge;
  34         struct netr_Credential server_challenge;
  35         BOOL authenticated;
  36         char *account_name;
  37         char *computer_name;  /* for logging only */
  38         uint32_t acct_flags;
  39         uint16_t sec_chan_type;
  40         struct creds_CredentialState *creds;
  41 };
  42
  43
  44 /*
  45   a client has connected to the netlogon server using schannel, so we need
  46   to re-establish the credentials state
  47 */
  48 static NTSTATUS netlogon_schannel_setup(struct dcesrv_call_state *dce_call)
  49 {
  50         struct server_pipe_state *state;
  51         NTSTATUS status;
  52
  53         state = talloc_p(dce_call->conn, struct server_pipe_state);
  54         if (state == NULL) {
  55                 return NT_STATUS_NO_MEMORY;
  56         }
  57         ZERO_STRUCTP(state);
  58         state->authenticated = True;
  59
  60         if (dce_call->conn->auth_state.session_info == NULL) {
  61                 talloc_free(state);
  62                 smb_panic("No session info provided by schannel level setup!");
  63                 return NT_STATUS_NO_USER_SESSION_KEY;
  64         }
  65
  66         status = dcerpc_schannel_creds(dce_call->conn->auth_state.gensec_security,
  67                                        state,
  68                                        &state->creds);
  69
  70         if (!NT_STATUS_IS_OK(status)) {
  71                 DEBUG(3, ("getting schannel credentials failed with %s\n", nt_errstr(status)));
  72                 talloc_free(state);
  73                 return status;
  74         }
  75
  76         dce_call->conn->private = state;
  77
  78         return NT_STATUS_OK;
  79 }
  80
  81 /*
  82   a hook for bind on the netlogon pipe
  83 */
  84 static NTSTATUS netlogon_bind(struct dcesrv_call_state *dce_call, const struct dcesrv_interface *di)
  85 {
  86         dce_call->conn->private = NULL;
  87
  88         /* if this is a schannel bind then we need to reconstruct the pipe state */
  89         if (dce_call->conn->auth_state.auth_info &&
  90             dce_call->conn->auth_state.auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
  91                 NTSTATUS status;
  92
  93                 DEBUG(5, ("schannel bind on netlogon\n"));
  94
  95                 status = netlogon_schannel_setup(dce_call);
  96                 if (!NT_STATUS_IS_OK(status)) {
  97                         DEBUG(3, ("schannel bind on netlogon failed with %s\n", nt_errstr(status)));
  98                         return status;
  99                 }
 100         }
 101
 102         return NT_STATUS_OK;
 103 }
 104
 105 /* this function is called when the client disconnects the endpoint */
 106 static void netlogon_unbind(struct dcesrv_connection *conn, const struct dcesrv_interface *di)
 107 {
 108         struct server_pipe_state *pipe_state = conn->private;
 109
 110         if (pipe_state) {
 111                 talloc_free(pipe_state);
 112         }
 113
 114         conn->private = NULL;
 115 }
 116
 117 #define DCESRV_INTERFACE_NETLOGON_BIND netlogon_bind
 118 #define DCESRV_INTERFACE_NETLOGON_UNBIND netlogon_unbind
 119
 120 static NTSTATUS netr_ServerReqChallenge(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 121                                         struct netr_ServerReqChallenge *r)
 122 {
 123         struct server_pipe_state *pipe_state = dce_call->conn->private;
 124
 125         ZERO_STRUCTP(r->out.credentials);
 126
 127         /* destroyed on pipe shutdown */
 128
 129         if (pipe_state) {
 130                 talloc_free(pipe_state);
 131                 dce_call->conn->private = NULL;
 132         }
 133
 134         pipe_state = talloc_p(dce_call->conn, struct server_pipe_state);
 135         if (!pipe_state) {
 136                 return NT_STATUS_NO_MEMORY;
 137         }
 138
 139         pipe_state->authenticated = False;
 140         pipe_state->creds = NULL;
 141         pipe_state->account_name = NULL;
 142         pipe_state->computer_name = NULL;
 143
 144         pipe_state->client_challenge = *r->in.credentials;
 145
 146         generate_random_buffer(pipe_state->server_challenge.data,
 147                                sizeof(pipe_state->server_challenge.data));
 148
 149         *r->out.credentials = pipe_state->server_challenge;
 150
 151         dce_call->conn->private = pipe_state;
 152
 153         return NT_STATUS_OK;
 154 }
 155
 156 static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 157                                          struct netr_ServerAuthenticate3 *r)
 158 {
 159         struct server_pipe_state *pipe_state = dce_call->conn->private;
 160         void *sam_ctx;
 161         struct samr_Password *mach_pwd;
 162         uint16_t acct_flags;
 163         int num_records;
 164         struct ldb_message **msgs;
 165         NTSTATUS nt_status;
 166         const char *attrs[] = {"unicodePwd", "lmPwdHash", "ntPwdHash", "userAccountControl",
 167                                "objectSid", NULL};
 168
 169         ZERO_STRUCTP(r->out.credentials);
 170         *r->out.rid = 0;
 171         *r->out.negotiate_flags = *r->in.negotiate_flags;
 172
 173         if (!pipe_state) {
 174                 DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
 175                 return NT_STATUS_ACCESS_DENIED;
 176         }
 177
 178         sam_ctx = samdb_connect(mem_ctx);
 179         if (sam_ctx == NULL) {
 180                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 181         }
 182         /* pull the user attributes */
 183         num_records = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
 184                                    "(&(sAMAccountName=%s)(objectclass=user))",
 185                                    r->in.account_name);
 186
 187         if (num_records == 0) {
 188                 DEBUG(3,("Couldn't find user [%s] in samdb.\n",
 189                          r->in.account_name));
 190                 return NT_STATUS_NO_SUCH_USER;
 191         }
 192
 193         if (num_records > 1) {
 194                 DEBUG(0,("Found %d records matching user [%s]\n", num_records, r->in.account_name));
 195                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 196         }
 197
 198         acct_flags = samdb_result_acct_flags(msgs[0],
 199                                              "userAccountControl");
 200
 201         if (acct_flags & ACB_DISABLED) {
 202                 DEBUG(1, ("Account [%s] is disabled\n", r->in.account_name));
 203                 return NT_STATUS_ACCESS_DENIED;
 204         }
 205
 206         if (r->in.secure_channel_type == SEC_CHAN_WKSTA) {
 207                 if (!(acct_flags & ACB_WSTRUST)) {
 208                         DEBUG(1, ("Client asked for a workstation secure channel, but is not a workstation (member server) acb flags: 0x%x\n", acct_flags));
 209                         return NT_STATUS_ACCESS_DENIED;
 210                 }
 211         } else if (r->in.secure_channel_type == SEC_CHAN_DOMAIN) {
 212                 if (!(acct_flags & ACB_DOMTRUST)) {
 213                         DEBUG(1, ("Client asked for a trusted domain secure channel, but is not a trusted domain: acb flags: 0x%x\n", acct_flags));
 214                         return NT_STATUS_ACCESS_DENIED;
 215                 }
 216         } else if (r->in.secure_channel_type == SEC_CHAN_BDC) {
 217                 if (!(acct_flags & ACB_SVRTRUST)) {
 218                         DEBUG(1, ("Client asked for a server secure channel, but is not a server (domain controller): acb flags: 0x%x\n", acct_flags));
 219                         return NT_STATUS_ACCESS_DENIED;
 220                 }
 221         } else {
 222                 DEBUG(1, ("Client asked for an invalid secure channel type: %d\n",
 223                           r->in.secure_channel_type));
 224                 return NT_STATUS_ACCESS_DENIED;
 225         }
 226
 227         pipe_state->acct_flags = acct_flags;
 228         pipe_state->sec_chan_type = r->in.secure_channel_type;
 229
 230         *r->out.rid = samdb_result_rid_from_sid(mem_ctx, msgs[0], "objectSid", 0);
 231
 232         nt_status = samdb_result_passwords(mem_ctx, msgs[0], NULL, &mach_pwd);
 233         if (!NT_STATUS_IS_OK(nt_status) || mach_pwd == NULL) {
 234                 return NT_STATUS_ACCESS_DENIED;
 235         }
 236
 237         if (!pipe_state->creds) {
 238                 pipe_state->creds = talloc_p(pipe_state, struct creds_CredentialState);
 239                 if (!pipe_state->creds) {
 240                         return NT_STATUS_NO_MEMORY;
 241                 }
 242         }
 243
 244         creds_server_init(pipe_state->creds, &pipe_state->client_challenge,
 245                           &pipe_state->server_challenge, mach_pwd,
 246                           r->out.credentials,
 247                           *r->in.negotiate_flags);
 248
 249         if (!creds_server_check(pipe_state->creds, r->in.credentials)) {
 250                 return NT_STATUS_ACCESS_DENIED;
 251         }
 252
 253         pipe_state->authenticated = True;
 254
 255         if (pipe_state->account_name) {
 256                 /* We don't want a memory leak on this long-lived talloc context */
 257                 talloc_free(pipe_state->account_name);
 258         }
 259
 260         pipe_state->account_name = talloc_strdup(pipe_state, r->in.account_name);
 261
 262         if (pipe_state->computer_name) {
 263                 /* We don't want a memory leak on this long-lived talloc context */
 264                 talloc_free(pipe_state->computer_name);
 265         }
 266
 267         pipe_state->computer_name = talloc_strdup(pipe_state, r->in.computer_name);
 268
 269         /* remember this session key state */
 270         nt_status = schannel_store_session_key(mem_ctx, pipe_state->computer_name, pipe_state->creds);
 271
 272         return nt_status;
 273 }
 274
 275 static NTSTATUS netr_ServerAuthenticate(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 276                                         struct netr_ServerAuthenticate *r)
 277 {
 278         struct netr_ServerAuthenticate3 r3;
 279         uint32_t rid = 0;
 280         /* TODO:
 281          * negotiate_flags is used as an [in] parameter
 282          * so it need to be initialised.
 283          *
 284          * (I think ... = 0; seems wrong here --metze)
 285          */
 286         uint32 negotiate_flags = 0;
 287
 288         r3.in.server_name = r->in.server_name;
 289         r3.in.account_name = r->in.account_name;
 290         r3.in.secure_channel_type = r->in.secure_channel_type;
 291         r3.in.computer_name = r->in.computer_name;
 292         r3.in.credentials = r->in.credentials;
 293         r3.out.credentials = r->out.credentials;
 294         r3.in.negotiate_flags = &negotiate_flags;
 295         r3.out.negotiate_flags = &negotiate_flags;
 296         r3.out.rid = &rid;
 297
 298         return netr_ServerAuthenticate3(dce_call, mem_ctx, &r3);
 299 }
 300
 301 static NTSTATUS netr_ServerAuthenticate2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 302                                          struct netr_ServerAuthenticate2 *r)
 303 {
 304         struct netr_ServerAuthenticate3 r3;
 305         uint32 rid = 0;
 306
 307         r3.in.server_name = r->in.server_name;
 308         r3.in.account_name = r->in.account_name;
 309         r3.in.secure_channel_type = r->in.secure_channel_type;
 310         r3.in.computer_name = r->in.computer_name;
 311         r3.in.credentials = r->in.credentials;
 312         r3.out.credentials = r->out.credentials;
 313         r3.in.negotiate_flags = r->in.negotiate_flags;
 314         r3.out.negotiate_flags = r->out.negotiate_flags;
 315         r3.out.rid = &rid;
 316
 317         return netr_ServerAuthenticate3(dce_call, mem_ctx, &r3);
 318 }
 319
 320
 321 static NTSTATUS netr_creds_server_step_check(struct server_pipe_state *pipe_state,
 322                                              struct netr_Authenticator *received_authenticator,
 323                                              struct netr_Authenticator *return_authenticator)
 324 {
 325         if (!pipe_state) {
 326                 DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
 327                 return NT_STATUS_ACCESS_DENIED;
 328         }
 329
 330         if (!pipe_state->authenticated) {
 331                 return NT_STATUS_ACCESS_DENIED;
 332         }
 333         return creds_server_step_check(pipe_state->creds,
 334                                        received_authenticator,
 335                                        return_authenticator);
 336 }
 337
 338
 339 static NTSTATUS netr_ServerPasswordSet(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 340                                        struct netr_ServerPasswordSet *r)
 341 {
 342         struct server_pipe_state *pipe_state = dce_call->conn->private;
 343
 344         void *sam_ctx;
 345         int num_records;
 346         int num_records_domain;
 347         int ret;
 348         struct ldb_message **msgs;
 349         struct ldb_message **msgs_domain;
 350         NTSTATUS nt_status;
 351         struct ldb_message mod, *msg_set_pw = &mod;
 352         const char *domain_dn;
 353         const char *domain_sid;
 354
 355         const char *attrs[] = {"objectSid", NULL };
 356
 357         const char **domain_attrs = attrs;
 358         ZERO_STRUCT(mod);
 359
 360         nt_status = netr_creds_server_step_check(pipe_state, &r->in.credential, &r->out.return_authenticator);
 361         if (NT_STATUS_IS_OK(nt_status)) {
 362                 return nt_status;
 363         }
 364
 365         sam_ctx = samdb_connect(mem_ctx);
 366         if (sam_ctx == NULL) {
 367                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 368         }
 369         /* pull the user attributes */
 370         num_records = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
 371                                    "(&(sAMAccountName=%s)(objectclass=user))",
 372                                    pipe_state->account_name);
 373
 374         if (num_records == 0) {
 375                 DEBUG(3,("Couldn't find user [%s] in samdb.\n",
 376                          pipe_state->account_name));
 377                 return NT_STATUS_NO_SUCH_USER;
 378         }
 379
 380         if (num_records > 1) {
 381                 DEBUG(0,("Found %d records matching user [%s]\n", num_records,
 382                          pipe_state->account_name));
 383                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 384         }
 385
 386         domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
 387         if (!domain_sid) {
 388                 DEBUG(0,("no objectSid in user record\n"));
 389                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 390         }
 391
 392         /* find the domain's DN */
 393         num_records_domain = samdb_search(sam_ctx, mem_ctx, NULL,
 394                                           &msgs_domain, domain_attrs,
 395                                           "(&(objectSid=%s)(objectclass=domain))",
 396                                           domain_sid);
 397
 398         if (num_records_domain == 0) {
 399                 DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n",
 400                          domain_sid));
 401                 return NT_STATUS_NO_SUCH_USER;
 402         }
 403
 404         if (num_records_domain > 1) {
 405                 DEBUG(0,("Found %d records matching domain [%s]\n",
 406                          num_records_domain, domain_sid));
 407                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 408         }
 409
 410         domain_dn = msgs_domain[0]->dn;
 411
 412         mod.dn = talloc_strdup(mem_ctx, msgs[0]->dn);
 413         if (!mod.dn) {
 414                 return NT_STATUS_NO_MEMORY;
 415         }
 416
 417         creds_des_decrypt(pipe_state->creds, &r->in.new_password);
 418
 419         /* set the password - samdb needs to know both the domain and user DNs,
 420            so the domain password policy can be used */
 421         nt_status = samdb_set_password(sam_ctx, mem_ctx,
 422                                        msgs[0]->dn, domain_dn,
 423                                        msg_set_pw,
 424                                        NULL, /* Don't have plaintext */
 425                                        NULL, &r->in.new_password,
 426                                        False /* This is not considered a password change */,
 427                                        NULL);
 428
 429         if (!NT_STATUS_IS_OK(nt_status)) {
 430                 return nt_status;
 431         }
 432
 433         ret = samdb_replace(sam_ctx, mem_ctx, msg_set_pw);
 434         if (ret != 0) {
 435                 /* we really need samdb.c to return NTSTATUS */
 436                 return NT_STATUS_UNSUCCESSFUL;
 437         }
 438
 439         return NT_STATUS_OK;
 440 }
 441
 442
 443 /*
 444   netr_LogonUasLogon
 445 */
 446 static WERROR netr_LogonUasLogon(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 447                                  struct netr_LogonUasLogon *r)
 448 {
 449         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 450 }
 451
 452
 453 /*
 454   netr_LogonUasLogoff
 455 */
 456 static WERROR netr_LogonUasLogoff(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 457                        struct netr_LogonUasLogoff *r)
 458 {
 459         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 460 }
 461
 462
 463 /*
 464   netr_LogonSamLogonWithFlags
 465
 466   This version of the function allows other wrappers to say 'do not check the credentials'
 467 */
 468 static NTSTATUS netr_LogonSamLogonEx(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 469                                      struct netr_LogonSamLogonEx *r)
 470 {
 471         struct server_pipe_state *pipe_state = dce_call->conn->private;
 472
 473         struct auth_context *auth_context;
 474         struct auth_usersupplied_info *user_info;
 475         struct auth_serversupplied_info *server_info;
 476         NTSTATUS nt_status;
 477         const uint8_t *chal;
 478         static const char zeros[16];
 479         struct netr_SamBaseInfo *sam;
 480         struct netr_SamInfo2 *sam2;
 481         struct netr_SamInfo3 *sam3;
 482         struct netr_SamInfo6 *sam6;
 483
 484         switch (r->in.logon_level) {
 485         case 1:
 486         case 3:
 487         case 5:
 488                 if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
 489                         creds_arcfour_crypt(pipe_state->creds,
 490                                             r->in.logon.password->lmpassword.hash,
 491                                             sizeof(r->in.logon.password->lmpassword.hash));
 492                         creds_arcfour_crypt(pipe_state->creds,
 493                                             r->in.logon.password->ntpassword.hash,
 494                                             sizeof(r->in.logon.password->ntpassword.hash));
 495                 } else {
 496                         creds_des_decrypt(pipe_state->creds, &r->in.logon.password->lmpassword);
 497                         creds_des_decrypt(pipe_state->creds, &r->in.logon.password->ntpassword);
 498                 }
 499
 500                 /* TODO: we need to deny anonymous access here */
 501                 nt_status = auth_context_create(mem_ctx, lp_auth_methods(), &auth_context);
 502                 NT_STATUS_NOT_OK_RETURN(nt_status);
 503
 504                 nt_status = auth_get_challenge(auth_context, &chal);
 505                 NT_STATUS_NOT_OK_RETURN(nt_status);
 506
 507                 nt_status = make_user_info_netlogon_interactive(mem_ctx,
 508                                                                 r->in.logon.password->identity_info.account_name.string,
 509                                                                 r->in.logon.password->identity_info.domain_name.string,
 510                                                                 r->in.logon.password->identity_info.workstation.string,
 511                                                                 chal,
 512                                                                 &r->in.logon.password->lmpassword,
 513                                                                 &r->in.logon.password->ntpassword,
 514                                                                 &user_info);
 515                 NT_STATUS_NOT_OK_RETURN(nt_status);
 516                 break;
 517         case 2:
 518         case 6:
 519                 /* TODO: we need to deny anonymous access here */
 520                 nt_status = auth_context_create(mem_ctx, lp_auth_methods(), &auth_context);
 521                 NT_STATUS_NOT_OK_RETURN(nt_status);
 522
 523                 nt_status = auth_context_set_challenge(auth_context, r->in.logon.network->challenge, "netr_LogonSamLogonWithFlags");
 524                 NT_STATUS_NOT_OK_RETURN(nt_status);
 525
 526                 nt_status = make_user_info_netlogon_network(auth_context,
 527                                                             r->in.logon.network->identity_info.account_name.string,
 528                                                             r->in.logon.network->identity_info.domain_name.string,
 529                                                             r->in.logon.network->identity_info.workstation.string,
 530                                                             r->in.logon.network->lm.data, r->in.logon.network->lm.length,
 531                                                             r->in.logon.network->nt.data, r->in.logon.network->nt.length,
 532                                                             &user_info);
 533                 NT_STATUS_NOT_OK_RETURN(nt_status);
 534                 break;
 535         default:
 536                 return NT_STATUS_INVALID_PARAMETER;
 537         }
 538
 539         nt_status = auth_check_password(auth_context, mem_ctx, user_info, &server_info);
 540         NT_STATUS_NOT_OK_RETURN(nt_status);
 541
 542         sam = talloc_p(mem_ctx, struct netr_SamBaseInfo);
 543         NT_STATUS_HAVE_NO_MEMORY(sam);
 544
 545         sam->last_logon = server_info->last_logon;
 546         sam->last_logoff = server_info->last_logoff;
 547         sam->acct_expiry = server_info->acct_expiry;
 548         sam->last_password_change = server_info->last_password_change;
 549         sam->allow_password_change = server_info->allow_password_change;
 550         sam->force_password_change = server_info->force_password_change;
 551
 552         sam->account_name.string = server_info->account_name;
 553         sam->full_name.string = server_info->full_name;
 554         sam->logon_script.string = server_info->logon_script;
 555         sam->profile_path.string = server_info->profile_path;
 556         sam->home_directory.string = server_info->home_directory;
 557         sam->home_drive.string = server_info->home_drive;
 558
 559         sam->logon_count = server_info->logon_count;
 560         sam->bad_password_count = sam->bad_password_count;
 561         sam->rid = server_info->account_sid->sub_auths[server_info->account_sid->num_auths-1];
 562         sam->primary_gid = server_info->primary_group_sid->sub_auths[server_info->primary_group_sid->num_auths-1];
 563         sam->group_count = 0;
 564         sam->groupids = NULL;
 565         sam->user_flags = 0; /* TODO: w2k3 uses 0x120 - what is this? */
 566         sam->acct_flags = server_info->acct_flags;
 567         sam->logon_server.string = lp_netbios_name();
 568
 569         sam->domain.string = server_info->domain_name;
 570
 571         sam->domain_sid = dom_sid_dup(mem_ctx, server_info->account_sid);
 572         NT_STATUS_HAVE_NO_MEMORY(sam->domain_sid);
 573         sam->domain_sid->num_auths--;
 574
 575         if (server_info->user_session_key.length == sizeof(sam->key.key)) {
 576                 memcpy(sam->key.key, server_info->user_session_key.data, sizeof(sam->key.key));
 577         } else {
 578                 ZERO_STRUCT(sam->key.key);
 579         }
 580
 581         /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
 582         /* It appears that level 6 is not individually encrypted */
 583         if ((r->in.validation_level != 6)
 584             && memcmp(sam->key.key, zeros,
 585                       sizeof(sam->key.key)) != 0) {
 586
 587                 /* This key is sent unencrypted without the ARCFOUR flag set */
 588                 if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
 589                         creds_arcfour_crypt(pipe_state->creds,
 590                                             sam->key.key,
 591                                             sizeof(sam->key.key));
 592                 }
 593         }
 594
 595         if (server_info->lm_session_key.length == sizeof(sam->LMSessKey.key)) {
 596                 memcpy(sam->LMSessKey.key, server_info->lm_session_key.data,
 597                        sizeof(sam->LMSessKey.key));
 598         } else {
 599                 ZERO_STRUCT(sam->LMSessKey.key);
 600         }
 601
 602         /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
 603         /* It appears that level 6 is not individually encrypted */
 604         if ((r->in.validation_level != 6)
 605             && memcmp(sam->LMSessKey.key, zeros,
 606                       sizeof(sam->LMSessKey.key)) != 0) {
 607                 if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
 608                         creds_arcfour_crypt(pipe_state->creds,
 609                                             sam->LMSessKey.key,
 610                                             sizeof(sam->LMSessKey.key));
 611                 } else {
 612                         creds_des_encrypt_LMKey(pipe_state->creds,
 613                                                 &sam->LMSessKey);
 614                 }
 615         }
 616
 617         switch (r->in.validation_level) {
 618         case 2:
 619                 sam2 = talloc_p(mem_ctx, struct netr_SamInfo2);
 620                 NT_STATUS_HAVE_NO_MEMORY(sam2);
 621                 ZERO_STRUCTP(sam2);
 622                 sam2->base = *sam;
 623                 r->out.validation.sam2 = sam2;
 624                 break;
 625
 626         case 3:
 627                 sam3 = talloc_p(mem_ctx, struct netr_SamInfo3);
 628                 NT_STATUS_HAVE_NO_MEMORY(sam3);
 629                 ZERO_STRUCTP(sam3);
 630                 sam3->base = *sam;
 631                 r->out.validation.sam3 = sam3;
 632                 break;
 633
 634         case 6:
 635                 sam6 = talloc_p(mem_ctx, struct netr_SamInfo6);
 636                 NT_STATUS_HAVE_NO_MEMORY(sam6);
 637                 ZERO_STRUCTP(sam6);
 638                 sam6->base = *sam;
 639                 sam6->forest.string = lp_realm();
 640                 sam6->principle.string = talloc_asprintf(mem_ctx, "%s@%s",
 641                                                          sam->account_name.string, sam6->forest.string);
 642                 r->out.validation.sam6 = sam6;
 643                 break;
 644
 645         default:
 646                 break;
 647         }
 648
 649         r->out.authoritative = 1;
 650
 651         return NT_STATUS_OK;
 652 }
 653
 654 /*
 655   netr_LogonSamLogonWithFlags
 656
 657 */
 658 static NTSTATUS netr_LogonSamLogonWithFlags(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 659                                             struct netr_LogonSamLogonWithFlags *r)
 660 {
 661         NTSTATUS nt_status;
 662         struct netr_LogonSamLogonEx r2;
 663
 664         struct server_pipe_state *pipe_state = dce_call->conn->private;
 665
 666         r->out.return_authenticator = talloc_p(mem_ctx, struct netr_Authenticator);
 667         if (!r->out.return_authenticator) {
 668                 return NT_STATUS_NO_MEMORY;
 669         }
 670
 671         nt_status = netr_creds_server_step_check(pipe_state, r->in.credential, r->out.return_authenticator);
 672         if (!NT_STATUS_IS_OK(nt_status)) {
 673                 return nt_status;
 674         }
 675
 676         ZERO_STRUCT(r2);
 677
 678         r2.in.server_name = r->in.server_name;
 679         r2.in.workstation = r->in.workstation;
 680         r2.in.logon_level = r->in.logon_level;
 681         r2.in.logon = r->in.logon;
 682         r2.in.validation_level = r->in.validation_level;
 683         r2.in.flags = r->in.flags;
 684
 685         nt_status = netr_LogonSamLogonEx(dce_call, mem_ctx, &r2);
 686
 687         r->out.validation = r2.out.validation;
 688         r->out.authoritative = r2.out.authoritative;
 689
 690         return nt_status;
 691 }
 692
 693 /*
 694   netr_LogonSamLogon
 695 */
 696 static NTSTATUS netr_LogonSamLogon(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 697                                    struct netr_LogonSamLogon *r)
 698 {
 699         struct netr_LogonSamLogonWithFlags r2;
 700         NTSTATUS status;
 701
 702         ZERO_STRUCT(r2);
 703
 704         r2.in.server_name = r->in.server_name;
 705         r2.in.workstation = r->in.workstation;
 706         r2.in.credential  = r->in.credential;
 707         r2.in.return_authenticator = r->in.return_authenticator;
 708         r2.in.logon_level = r->in.logon_level;
 709         r2.in.logon = r->in.logon;
 710         r2.in.validation_level = r->in.validation_level;
 711         r2.in.flags = 0;
 712
 713         status = netr_LogonSamLogonWithFlags(dce_call, mem_ctx, &r2);
 714
 715         r->out.return_authenticator = r2.out.return_authenticator;
 716         r->out.validation = r2.out.validation;
 717         r->out.authoritative = r2.out.authoritative;
 718
 719         return status;
 720 }
 721
 722
 723 /*
 724   netr_LogonSamLogoff
 725 */
 726 static NTSTATUS netr_LogonSamLogoff(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 727                        struct netr_LogonSamLogoff *r)
 728 {
 729         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 730 }
 731
 732
 733
 734 /*
 735   netr_DatabaseDeltas
 736 */
 737 static NTSTATUS netr_DatabaseDeltas(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 738                        struct netr_DatabaseDeltas *r)
 739 {
 740         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 741 }
 742
 743
 744 /*
 745   netr_DatabaseSync
 746 */
 747 static NTSTATUS netr_DatabaseSync(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 748                        struct netr_DatabaseSync *r)
 749 {
 750         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 751 }
 752
 753
 754 /*
 755   netr_AccountDeltas
 756 */
 757 static NTSTATUS netr_AccountDeltas(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 758                        struct netr_AccountDeltas *r)
 759 {
 760         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 761 }
 762
 763
 764 /*
 765   netr_AccountSync
 766 */
 767 static NTSTATUS netr_AccountSync(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 768                        struct netr_AccountSync *r)
 769 {
 770         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 771 }
 772
 773
 774 /*
 775   netr_GetDcName
 776 */
 777 static NTSTATUS netr_GetDcName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 778                        struct netr_GetDcName *r)
 779 {
 780         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 781 }
 782
 783
 784 /*
 785   netr_LogonControl
 786 */
 787 static WERROR netr_LogonControl(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 788                        struct netr_LogonControl *r)
 789 {
 790         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 791 }
 792
 793
 794 /*
 795   netr_GetAnyDCName
 796 */
 797 static WERROR netr_GetAnyDCName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 798                        struct netr_GetAnyDCName *r)
 799 {
 800         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 801 }
 802
 803
 804 /*
 805   netr_LogonControl2
 806 */
 807 static WERROR netr_LogonControl2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 808                        struct netr_LogonControl2 *r)
 809 {
 810         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 811 }
 812
 813
 814 /*
 815   netr_DatabaseSync2
 816 */
 817 static NTSTATUS netr_DatabaseSync2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 818                        struct netr_DatabaseSync2 *r)
 819 {
 820         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 821 }
 822
 823
 824 /*
 825   netr_DatabaseRedo
 826 */
 827 static NTSTATUS netr_DatabaseRedo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 828                        struct netr_DatabaseRedo *r)
 829 {
 830         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 831 }
 832
 833
 834 /*
 835   netr_LogonControl2Ex
 836 */
 837 static WERROR netr_LogonControl2Ex(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 838                        struct netr_LogonControl2Ex *r)
 839 {
 840         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 841 }
 842
 843
 844 /*
 845   netr_NETRENUMERATETRUSTEDDOMAINS
 846 */
 847 static WERROR netr_NETRENUMERATETRUSTEDDOMAINS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 848                        struct netr_NETRENUMERATETRUSTEDDOMAINS *r)
 849 {
 850         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 851 }
 852
 853
 854 /*
 855   netr_DSRGETDCNAME
 856 */
 857 static WERROR netr_DSRGETDCNAME(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 858                        struct netr_DSRGETDCNAME *r)
 859 {
 860         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 861 }
 862
 863
 864 /*
 865   netr_NETRLOGONDUMMYROUTINE1
 866 */
 867 static WERROR netr_NETRLOGONDUMMYROUTINE1(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 868                        struct netr_NETRLOGONDUMMYROUTINE1 *r)
 869 {
 870         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 871 }
 872
 873
 874 /*
 875   netr_NETRLOGONSETSERVICEBITS
 876 */
 877 static WERROR netr_NETRLOGONSETSERVICEBITS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 878                        struct netr_NETRLOGONSETSERVICEBITS *r)
 879 {
 880         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 881 }
 882
 883
 884 /*
 885   netr_NETRLOGONGETTRUSTRID
 886 */
 887 static WERROR netr_NETRLOGONGETTRUSTRID(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 888                        struct netr_NETRLOGONGETTRUSTRID *r)
 889 {
 890         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 891 }
 892
 893
 894 /*
 895   netr_NETRLOGONCOMPUTESERVERDIGEST
 896 */
 897 static WERROR netr_NETRLOGONCOMPUTESERVERDIGEST(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 898                        struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
 899 {
 900         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 901 }
 902
 903
 904 /*
 905   netr_NETRLOGONCOMPUTECLIENTDIGEST
 906 */
 907 static WERROR netr_NETRLOGONCOMPUTECLIENTDIGEST(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 908                        struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
 909 {
 910         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 911 }
 912
 913
 914 /*
 915   netr_DSRGETDCNAMEX
 916 */
 917 static WERROR netr_DSRGETDCNAMEX(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 918                        struct netr_DSRGETDCNAMEX *r)
 919 {
 920         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 921 }
 922
 923
 924 /*
 925   netr_DSRGETSITENAME
 926 */
 927 static WERROR netr_DSRGETSITENAME(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 928                        struct netr_DSRGETSITENAME *r)
 929 {
 930         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 931 }
 932
 933
 934 /*
 935   fill in a netr_DomainTrustInfo from a ldb search result
 936 */
 937 static NTSTATUS fill_domain_trust_info(TALLOC_CTX *mem_ctx, struct ldb_message *res,
 938                                        struct netr_DomainTrustInfo *info, BOOL is_local)
 939 {
 940         ZERO_STRUCTP(info);
 941
 942         if (is_local) {
 943                 info->domainname.string = samdb_result_string(res, "name", NULL);
 944                 info->fulldomainname.string = samdb_result_string(res, "dnsDomain", NULL);
 945                 info->guid = samdb_result_guid(res, "objectGUID");
 946                 info->sid = samdb_result_dom_sid(mem_ctx, res, "objectSid");
 947         } else {
 948                 info->domainname.string = samdb_result_string(res, "flatName", NULL);
 949                 info->fulldomainname.string = samdb_result_string(res, "name", NULL);
 950                 info->guid = samdb_result_guid(res, "objectGUID");
 951                 info->sid = samdb_result_dom_sid(mem_ctx, res, "securityIdentifier");
 952         }
 953
 954         /* TODO: we need proper forest support */
 955         info->forest.string = info->fulldomainname.string;
 956
 957         return NT_STATUS_OK;
 958 }
 959
 960 /*
 961   netr_LogonGetDomainInfo
 962   this is called as part of the ADS domain logon procedure.
 963 */
 964 static NTSTATUS netr_LogonGetDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 965                                         struct netr_LogonGetDomainInfo *r)
 966 {
 967         struct server_pipe_state *pipe_state = dce_call->conn->private;
 968         const char * const attrs[] = { "name", "dnsDomain", "objectSid",
 969                                        "objectGUID", "flatName", "securityIdentifier",
 970                                        NULL };
 971         void *sam_ctx;
 972         struct ldb_message **res1, **res2;
 973         struct netr_DomainInfo1 *info1;
 974         int ret1, ret2, i;
 975         NTSTATUS status;
 976
 977         status = netr_creds_server_step_check(pipe_state,
 978                                               r->in.credential, r->out.credential);
 979         if (!NT_STATUS_IS_OK(status)) {
 980                 return status;
 981         }
 982
 983         sam_ctx = samdb_connect(mem_ctx);
 984         if (sam_ctx == NULL) {
 985                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 986         }
 987
 988         /* we need to do two searches. The first will pull our primary
 989            domain and the second will pull any trusted domains. Our
 990            primary domain is also a "trusted" domain, so we need to
 991            put the primary domain into the lists of returned trusts as
 992            well */
 993         ret1 = samdb_search(sam_ctx, mem_ctx, NULL, &res1, attrs, "(objectClass=domainDNS)");
 994         if (ret1 != 1) {
 995                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 996         }
 997
 998         ret2 = samdb_search(sam_ctx, mem_ctx, NULL, &res2, attrs, "(objectClass=trustedDomain)");
 999         if (ret2 == -1) {
1000                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1001         }
1002
1003         info1 = talloc_p(mem_ctx, struct netr_DomainInfo1);
1004         if (info1 == NULL) {
1005                 return NT_STATUS_NO_MEMORY;
1006         }
1007
1008         ZERO_STRUCTP(info1);
1009
1010         info1->num_trusts = ret2 + 1;
1011         info1->trusts = talloc_array_p(mem_ctx, struct netr_DomainTrustInfo,
1012                                        info1->num_trusts);
1013         if (info1->trusts == NULL) {
1014                 return NT_STATUS_NO_MEMORY;
1015         }
1016
1017         status = fill_domain_trust_info(mem_ctx, res1[0], &info1->domaininfo, True);
1018         if (!NT_STATUS_IS_OK(status)) {
1019                 return status;
1020         }
1021
1022         status = fill_domain_trust_info(mem_ctx, res1[0], &info1->trusts[0], True);
1023         if (!NT_STATUS_IS_OK(status)) {
1024                 return status;
1025         }
1026
1027         for (i=0;i<ret2;i++) {
1028                 status = fill_domain_trust_info(mem_ctx, res2[i], &info1->trusts[i+1], False);
1029                 if (!NT_STATUS_IS_OK(status)) {
1030                         return status;
1031                 }
1032         }
1033
1034         r->out.info.info1 = info1;
1035
1036         return NT_STATUS_OK;
1037 }
1038
1039
1040 /*
1041   netr_NETRSERVERPASSWORDSET2
1042 */
1043 static WERROR netr_NETRSERVERPASSWORDSET2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1044                        struct netr_NETRSERVERPASSWORDSET2 *r)
1045 {
1046         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1047 }
1048
1049
1050 /*
1051   netr_NETRSERVERPASSWORDGET
1052 */
1053 static WERROR netr_NETRSERVERPASSWORDGET(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1054                        struct netr_NETRSERVERPASSWORDGET *r)
1055 {
1056         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1057 }
1058
1059
1060 /*
1061   netr_NETRLOGONSENDTOSAM
1062 */
1063 static WERROR netr_NETRLOGONSENDTOSAM(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1064                        struct netr_NETRLOGONSENDTOSAM *r)
1065 {
1066         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1067 }
1068
1069
1070 /*
1071   netr_DSRADDRESSTOSITENAMESW
1072 */
1073 static WERROR netr_DSRADDRESSTOSITENAMESW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1074                        struct netr_DSRADDRESSTOSITENAMESW *r)
1075 {
1076         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1077 }
1078
1079
1080 /*
1081   netr_DrsGetDCNameEx2
1082 */
1083 static WERROR netr_DrsGetDCNameEx2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1084                        struct netr_DrsGetDCNameEx2 *r)
1085 {
1086         const char * const attrs[] = { "dnsDomain", "objectGUID", NULL };
1087         void *sam_ctx;
1088         struct ldb_message **res;
1089         int ret;
1090
1091         ZERO_STRUCT(r->out);
1092
1093         sam_ctx = samdb_connect(mem_ctx);
1094         if (sam_ctx == NULL) {
1095                 return WERR_DS_SERVICE_UNAVAILABLE;
1096         }
1097
1098         ret = samdb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
1099                                 "(&(objectClass=domainDNS)(dnsDomain=%s))",
1100                                 r->in.domain_name);
1101         if (ret != 1) {
1102                 return WERR_NO_SUCH_DOMAIN;
1103         }
1104
1105         r->out.info = talloc_p(mem_ctx, struct netr_DrsGetDCNameEx2Info);
1106         if (!r->out.info) {
1107                 return WERR_NOMEM;
1108         }
1109
1110         /* TODO: - return real IP address
1111          *       - check all r->in.* parameters (server_unc is ignored by w2k3!)
1112          */
1113         r->out.info->dc_unc             = talloc_asprintf(mem_ctx, "\\\\%s.%s", lp_netbios_name(),lp_realm());
1114         r->out.info->dc_address = talloc_strdup(mem_ctx, "\\\\0.0.0.0");
1115         r->out.info->dc_address_type    = 1;
1116         r->out.info->domain_guid        = samdb_result_guid(res[0], "objectGUID");
1117         r->out.info->domain_name        = samdb_result_string(res[0], "dnsDomain", NULL);
1118         r->out.info->forest_name        = samdb_result_string(res[0], "dnsDomain", NULL);
1119         r->out.info->dc_flags           = 0xE00001FD;
1120         r->out.info->dc_site_name       = talloc_strdup(mem_ctx, "Default-First-Site-Name");
1121         r->out.info->client_site_name   = talloc_strdup(mem_ctx, "Default-First-Site-Name");
1122
1123         return WERR_OK;
1124 }
1125
1126
1127 /*
1128   netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN
1129 */
1130 static WERROR netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1131                        struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1132 {
1133         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1134 }
1135
1136
1137 /*
1138   netr_NETRENUMERATETRUSTEDDOMAINSEX
1139 */
1140 static WERROR netr_NETRENUMERATETRUSTEDDOMAINSEX(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1141                        struct netr_NETRENUMERATETRUSTEDDOMAINSEX *r)
1142 {
1143         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1144 }
1145
1146
1147 /*
1148   netr_DSRADDRESSTOSITENAMESEXW
1149 */
1150 static WERROR netr_DSRADDRESSTOSITENAMESEXW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1151                        struct netr_DSRADDRESSTOSITENAMESEXW *r)
1152 {
1153         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1154 }
1155
1156
1157 /*
1158   netr_DSRGETDCSITECOVERAGEW
1159 */
1160 static WERROR netr_DSRGETDCSITECOVERAGEW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1161                        struct netr_DSRGETDCSITECOVERAGEW *r)
1162 {
1163         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1164 }
1165
1166
1167 /*
1168   netr_DsrEnumerateDomainTrusts
1169 */
1170 static WERROR netr_DsrEnumerateDomainTrusts(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1171                                               struct netr_DsrEnumerateDomainTrusts *r)
1172 {
1173         struct netr_DomainTrust *trusts;
1174         void *sam_ctx;
1175         int ret, i;
1176         struct ldb_message **res;
1177         const char * const attrs[] = { "name", "dnsDomain", "objectSid", "objectGUID", NULL };
1178
1179         ZERO_STRUCT(r->out);
1180
1181         sam_ctx = samdb_connect(mem_ctx);
1182         if (sam_ctx == NULL) {
1183                 return WERR_GENERAL_FAILURE;
1184         }
1185
1186         ret = samdb_search(sam_ctx, mem_ctx, NULL, &res, attrs, "(objectClass=domainDNS)");
1187         if (ret == -1) {
1188                 return WERR_GENERAL_FAILURE;
1189         }
1190
1191         if (ret == 0) {
1192                 return WERR_OK;
1193         }
1194
1195         trusts = talloc_array_p(mem_ctx, struct netr_DomainTrust, ret);
1196         if (trusts == NULL) {
1197                 return WERR_NOMEM;
1198         }
1199
1200         r->out.count = ret;
1201         r->out.trusts = trusts;
1202
1203         /* TODO: add filtering by trust_flags, and correct trust_type
1204            and attributes */
1205         for (i=0;i<ret;i++) {
1206                 trusts[i].netbios_name = samdb_result_string(res[i], "name", NULL);
1207                 trusts[i].dns_name     = samdb_result_string(res[i], "dnsDomain", NULL);
1208                 trusts[i].trust_flags =
1209                         NETR_TRUST_FLAG_TREEROOT |
1210                         NETR_TRUST_FLAG_IN_FOREST |
1211                         NETR_TRUST_FLAG_PRIMARY;
1212                 trusts[i].parent_index = 0;
1213                 trusts[i].trust_type = 2;
1214                 trusts[i].trust_attributes = 0;
1215                 trusts[i].sid  = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
1216                 trusts[i].guid = samdb_result_guid(res[i], "objectGUID");
1217         }
1218
1219
1220         return WERR_OK;
1221 }
1222
1223
1224 /*
1225   netr_DSRDEREGISTERDNSHOSTRECORDS
1226 */
1227 static WERROR netr_DSRDEREGISTERDNSHOSTRECORDS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1228                        struct netr_DSRDEREGISTERDNSHOSTRECORDS *r)
1229 {
1230         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1231 }
1232
1233
1234 /*
1235   netr_NETRSERVERTRUSTPASSWORDSGET
1236 */
1237 static WERROR netr_NETRSERVERTRUSTPASSWORDSGET(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1238                        struct netr_NETRSERVERTRUSTPASSWORDSGET *r)
1239 {
1240         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1241 }
1242
1243
1244 /*
1245   netr_DSRGETFORESTTRUSTINFORMATION
1246 */
1247 static WERROR netr_DSRGETFORESTTRUSTINFORMATION(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1248                        struct netr_DSRGETFORESTTRUSTINFORMATION *r)
1249 {
1250         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1251 }
1252
1253
1254 /*
1255   netr_NETRGETFORESTTRUSTINFORMATION
1256 */
1257 static WERROR netr_NETRGETFORESTTRUSTINFORMATION(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1258                        struct netr_NETRGETFORESTTRUSTINFORMATION *r)
1259 {
1260         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1261 }
1262
1263
1264 /*
1265   netr_NETRSERVERGETTRUSTINFO
1266 */
1267 static WERROR netr_NETRSERVERGETTRUSTINFO(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1268                        struct netr_NETRSERVERGETTRUSTINFO *r)
1269 {
1270         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1271 }
1272
1273
1274 /* include the generated boilerplate */
1275 #include "librpc/gen_ndr/ndr_netlogon_s.c"