source4/rpc_server/netlogon/dcerpc_netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    endpoint server for the netlogon pipe
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
   7    Copyright (C) Stefan Metzmacher <metze@samba.org>  2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "librpc/gen_ndr/ndr_netlogon.h"
  26 #include "rpc_server/dcerpc_server.h"
  27 #include "rpc_server/common/common.h"
  28 #include "librpc/gen_ndr/ndr_dcom.h"
  29 #include "lib/ldb/include/ldb.h"
  30 #include "auth/auth.h"
  31
  32 struct server_pipe_state {
  33         struct netr_Credential client_challenge;
  34         struct netr_Credential server_challenge;
  35         struct creds_CredentialState *creds;
  36 };
  37
  38
  39 /*
  40   a client has connected to the netlogon server using schannel, so we need
  41   to re-establish the credentials state
  42 */
  43 static NTSTATUS netlogon_schannel_setup(struct dcesrv_call_state *dce_call)
  44 {
  45         struct server_pipe_state *state;
  46         NTSTATUS status;
  47
  48         /* We want the client and server challenge zero */
  49         state = talloc_zero(dce_call->conn, struct server_pipe_state);
  50         if (state == NULL) {
  51                 return NT_STATUS_NO_MEMORY;
  52         }
  53
  54         status = dcerpc_schannel_creds(dce_call->conn->auth_state.gensec_security,
  55                                        state,
  56                                        &state->creds);
  57
  58         if (!NT_STATUS_IS_OK(status)) {
  59                 DEBUG(3, ("getting schannel credentials failed with %s\n", nt_errstr(status)));
  60                 talloc_free(state);
  61                 return status;
  62         }
  63
  64         dce_call->context->private = state;
  65
  66         return NT_STATUS_OK;
  67 }
  68
  69 /*
  70   a hook for bind on the netlogon pipe
  71 */
  72 static NTSTATUS netlogon_bind(struct dcesrv_call_state *dce_call, const struct dcesrv_interface *di)
  73 {
  74         dce_call->context->private = NULL;
  75
  76         /* if this is a schannel bind then we need to reconstruct the pipe state */
  77         if (dce_call->conn->auth_state.auth_info &&
  78             dce_call->conn->auth_state.auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
  79                 NTSTATUS status;
  80
  81                 DEBUG(5, ("schannel bind on netlogon\n"));
  82
  83                 status = netlogon_schannel_setup(dce_call);
  84                 if (!NT_STATUS_IS_OK(status)) {
  85                         DEBUG(3, ("schannel bind on netlogon failed with %s\n", nt_errstr(status)));
  86                         return status;
  87                 }
  88         }
  89
  90         return NT_STATUS_OK;
  91 }
  92
  93 #define DCESRV_INTERFACE_NETLOGON_BIND netlogon_bind
  94
  95 static NTSTATUS netr_ServerReqChallenge(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
  96                                         struct netr_ServerReqChallenge *r)
  97 {
  98         struct server_pipe_state *pipe_state = dce_call->context->private;
  99
 100         ZERO_STRUCTP(r->out.credentials);
 101
 102         /* destroyed on pipe shutdown */
 103
 104         if (pipe_state) {
 105                 talloc_free(pipe_state);
 106                 dce_call->context->private = NULL;
 107         }
 108
 109         pipe_state = talloc(dce_call->context, struct server_pipe_state);
 110         if (!pipe_state) {
 111                 return NT_STATUS_NO_MEMORY;
 112         }
 113
 114         pipe_state->creds = NULL;
 115
 116         pipe_state->client_challenge = *r->in.credentials;
 117
 118         generate_random_buffer(pipe_state->server_challenge.data,
 119                                sizeof(pipe_state->server_challenge.data));
 120
 121         *r->out.credentials = pipe_state->server_challenge;
 122
 123         dce_call->context->private = pipe_state;
 124
 125         return NT_STATUS_OK;
 126 }
 127
 128 static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 129                                          struct netr_ServerAuthenticate3 *r)
 130 {
 131         struct server_pipe_state *pipe_state = dce_call->context->private;
 132         void *sam_ctx;
 133         struct samr_Password *mach_pwd;
 134         uint16_t acct_flags;
 135         int num_records;
 136         struct ldb_message **msgs;
 137         NTSTATUS nt_status;
 138         const char *attrs[] = {"unicodePwd", "lmPwdHash", "ntPwdHash", "userAccountControl",
 139                                "objectSid", NULL};
 140
 141         ZERO_STRUCTP(r->out.credentials);
 142         *r->out.rid = 0;
 143         *r->out.negotiate_flags = *r->in.negotiate_flags;
 144
 145         if (!pipe_state) {
 146                 DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
 147                 return NT_STATUS_ACCESS_DENIED;
 148         }
 149
 150         sam_ctx = samdb_connect(mem_ctx, system_session(mem_ctx));
 151         if (sam_ctx == NULL) {
 152                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 153         }
 154         /* pull the user attributes */
 155         num_records = gendb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
 156                                    "(&(sAMAccountName=%s)(objectclass=user))",
 157                                    r->in.account_name);
 158
 159         if (num_records == 0) {
 160                 DEBUG(3,("Couldn't find user [%s] in samdb.\n",
 161                          r->in.account_name));
 162                 return NT_STATUS_ACCESS_DENIED;
 163         }
 164
 165         if (num_records > 1) {
 166                 DEBUG(0,("Found %d records matching user [%s]\n", num_records, r->in.account_name));
 167                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 168         }
 169
 170         acct_flags = samdb_result_acct_flags(msgs[0],
 171                                              "userAccountControl");
 172
 173         if (acct_flags & ACB_DISABLED) {
 174                 DEBUG(1, ("Account [%s] is disabled\n", r->in.account_name));
 175                 return NT_STATUS_ACCESS_DENIED;
 176         }
 177
 178         if (r->in.secure_channel_type == SEC_CHAN_WKSTA) {
 179                 if (!(acct_flags & ACB_WSTRUST)) {
 180                         DEBUG(1, ("Client asked for a workstation secure channel, but is not a workstation (member server) acb flags: 0x%x\n", acct_flags));
 181                         return NT_STATUS_ACCESS_DENIED;
 182                 }
 183         } else if (r->in.secure_channel_type == SEC_CHAN_DOMAIN) {
 184                 if (!(acct_flags & ACB_DOMTRUST)) {
 185                         DEBUG(1, ("Client asked for a trusted domain secure channel, but is not a trusted domain: acb flags: 0x%x\n", acct_flags));
 186                         return NT_STATUS_ACCESS_DENIED;
 187                 }
 188         } else if (r->in.secure_channel_type == SEC_CHAN_BDC) {
 189                 if (!(acct_flags & ACB_SVRTRUST)) {
 190                         DEBUG(1, ("Client asked for a server secure channel, but is not a server (domain controller): acb flags: 0x%x\n", acct_flags));
 191                         return NT_STATUS_ACCESS_DENIED;
 192                 }
 193         } else {
 194                 DEBUG(1, ("Client asked for an invalid secure channel type: %d\n",
 195                           r->in.secure_channel_type));
 196                 return NT_STATUS_ACCESS_DENIED;
 197         }
 198
 199
 200         *r->out.rid = samdb_result_rid_from_sid(mem_ctx, msgs[0], "objectSid", 0);
 201
 202         nt_status = samdb_result_passwords(mem_ctx, msgs[0], NULL, &mach_pwd);
 203         if (!NT_STATUS_IS_OK(nt_status) || mach_pwd == NULL) {
 204                 return NT_STATUS_ACCESS_DENIED;
 205         }
 206
 207         if (pipe_state->creds) {
 208                 talloc_free(pipe_state->creds);
 209         }
 210         pipe_state->creds = talloc(pipe_state, struct creds_CredentialState);
 211         if (!pipe_state->creds) {
 212                 return NT_STATUS_NO_MEMORY;
 213         }
 214
 215         creds_server_init(pipe_state->creds, &pipe_state->client_challenge,
 216                           &pipe_state->server_challenge, mach_pwd,
 217                           r->out.credentials,
 218                           *r->in.negotiate_flags);
 219
 220         if (!creds_server_check(pipe_state->creds, r->in.credentials)) {
 221                 talloc_free(pipe_state->creds);
 222                 pipe_state->creds = NULL;
 223                 return NT_STATUS_ACCESS_DENIED;
 224         }
 225
 226         pipe_state->creds->account_name = talloc_steal(pipe_state->creds, r->in.account_name);
 227
 228         pipe_state->creds->computer_name = talloc_steal(pipe_state->creds, r->in.computer_name);
 229
 230         pipe_state->creds->secure_channel_type = r->in.secure_channel_type;
 231
 232         pipe_state->creds->sid = samdb_result_dom_sid(pipe_state->creds, msgs[0], "objectSid");
 233
 234         pipe_state->creds->domain = talloc_strdup(pipe_state->creds, lp_workgroup());
 235
 236         /* remember this session key state */
 237         nt_status = schannel_store_session_key(mem_ctx, pipe_state->creds);
 238
 239         return nt_status;
 240 }
 241
 242 static NTSTATUS netr_ServerAuthenticate(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 243                                         struct netr_ServerAuthenticate *r)
 244 {
 245         struct netr_ServerAuthenticate3 r3;
 246         uint32_t rid = 0;
 247         /* TODO:
 248          * negotiate_flags is used as an [in] parameter
 249          * so it need to be initialised.
 250          *
 251          * (I think ... = 0; seems wrong here --metze)
 252          */
 253         uint32_t negotiate_flags = 0;
 254
 255         r3.in.server_name = r->in.server_name;
 256         r3.in.account_name = r->in.account_name;
 257         r3.in.secure_channel_type = r->in.secure_channel_type;
 258         r3.in.computer_name = r->in.computer_name;
 259         r3.in.credentials = r->in.credentials;
 260         r3.out.credentials = r->out.credentials;
 261         r3.in.negotiate_flags = &negotiate_flags;
 262         r3.out.negotiate_flags = &negotiate_flags;
 263         r3.out.rid = &rid;
 264
 265         return netr_ServerAuthenticate3(dce_call, mem_ctx, &r3);
 266 }
 267
 268 static NTSTATUS netr_ServerAuthenticate2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 269                                          struct netr_ServerAuthenticate2 *r)
 270 {
 271         struct netr_ServerAuthenticate3 r3;
 272         uint32_t rid = 0;
 273
 274         r3.in.server_name = r->in.server_name;
 275         r3.in.account_name = r->in.account_name;
 276         r3.in.secure_channel_type = r->in.secure_channel_type;
 277         r3.in.computer_name = r->in.computer_name;
 278         r3.in.credentials = r->in.credentials;
 279         r3.out.credentials = r->out.credentials;
 280         r3.in.negotiate_flags = r->in.negotiate_flags;
 281         r3.out.negotiate_flags = r->out.negotiate_flags;
 282         r3.out.rid = &rid;
 283
 284         return netr_ServerAuthenticate3(dce_call, mem_ctx, &r3);
 285 }
 286
 287
 288 static NTSTATUS netr_creds_server_step_check(struct server_pipe_state *pipe_state,
 289                                              struct netr_Authenticator *received_authenticator,
 290                                              struct netr_Authenticator *return_authenticator)
 291 {
 292         if (!pipe_state) {
 293                 DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
 294                 return NT_STATUS_ACCESS_DENIED;
 295         }
 296
 297         return creds_server_step_check(pipe_state->creds,
 298                                        received_authenticator,
 299                                        return_authenticator);
 300 }
 301
 302
 303 static NTSTATUS netr_ServerPasswordSet(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 304                                        struct netr_ServerPasswordSet *r)
 305 {
 306         struct server_pipe_state *pipe_state = dce_call->context->private;
 307
 308         struct ldb_context *sam_ctx;
 309         NTSTATUS nt_status;
 310
 311         nt_status = netr_creds_server_step_check(pipe_state, &r->in.credential, &r->out.return_authenticator);
 312         NT_STATUS_NOT_OK_RETURN(nt_status);
 313
 314         sam_ctx = samdb_connect(mem_ctx, system_session(mem_ctx));
 315         if (sam_ctx == NULL) {
 316                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 317         }
 318
 319         creds_des_decrypt(pipe_state->creds, &r->in.new_password);
 320
 321         /* Using the sid for the account as the key, set the password */
 322         nt_status = samdb_set_password_sid(sam_ctx, mem_ctx,
 323                                            pipe_state->creds->sid,
 324                                            NULL, /* Don't have plaintext */
 325                                            NULL, &r->in.new_password,
 326                                            False, /* This is not considered a password change */
 327                                            False, /* don't restrict this password change (match w2k3) */
 328                                            NULL, NULL);
 329         return nt_status;
 330 }
 331
 332
 333 /*
 334   netr_LogonUasLogon
 335 */
 336 static WERROR netr_LogonUasLogon(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 337                                  struct netr_LogonUasLogon *r)
 338 {
 339         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 340 }
 341
 342
 343 /*
 344   netr_LogonUasLogoff
 345 */
 346 static WERROR netr_LogonUasLogoff(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 347                        struct netr_LogonUasLogoff *r)
 348 {
 349         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 350 }
 351
 352
 353 /*
 354   netr_LogonSamLogonEx
 355
 356   This version of the function allows other wrappers to say 'do not check the credentials'
 357 */
 358 static NTSTATUS netr_LogonSamLogonEx(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 359                                      struct netr_LogonSamLogonEx *r)
 360 {
 361         struct server_pipe_state *pipe_state = dce_call->context->private;
 362
 363         struct auth_context *auth_context;
 364         struct auth_usersupplied_info *user_info;
 365         struct auth_serversupplied_info *server_info;
 366         NTSTATUS nt_status;
 367         static const char zeros[16];
 368         struct netr_SamBaseInfo *sam;
 369         struct netr_SamInfo2 *sam2;
 370         struct netr_SamInfo3 *sam3;
 371         struct netr_SamInfo6 *sam6;
 372
 373         user_info = talloc(mem_ctx, struct auth_usersupplied_info);
 374         if (!user_info) {
 375                 return NT_STATUS_NO_MEMORY;
 376         }
 377
 378         user_info->flags = 0;
 379         user_info->mapped_state = False;
 380         user_info->remote_host = NULL;
 381
 382         switch (r->in.logon_level) {
 383         case 1:
 384         case 3:
 385         case 5:
 386                 if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
 387                         creds_arcfour_crypt(pipe_state->creds,
 388                                             r->in.logon.password->lmpassword.hash,
 389                                             sizeof(r->in.logon.password->lmpassword.hash));
 390                         creds_arcfour_crypt(pipe_state->creds,
 391                                             r->in.logon.password->ntpassword.hash,
 392                                             sizeof(r->in.logon.password->ntpassword.hash));
 393                 } else {
 394                         creds_des_decrypt(pipe_state->creds, &r->in.logon.password->lmpassword);
 395                         creds_des_decrypt(pipe_state->creds, &r->in.logon.password->ntpassword);
 396                 }
 397
 398                 /* TODO: we need to deny anonymous access here */
 399                 nt_status = auth_context_create(mem_ctx, lp_auth_methods(), &auth_context,
 400                                                 dce_call->event_ctx);
 401                 NT_STATUS_NOT_OK_RETURN(nt_status);
 402
 403                 user_info->logon_parameters = r->in.logon.password->identity_info.parameter_control;
 404                 user_info->client.account_name = r->in.logon.password->identity_info.account_name.string;
 405                 user_info->client.domain_name = r->in.logon.password->identity_info.domain_name.string;
 406                 user_info->workstation_name = r->in.logon.password->identity_info.workstation.string;
 407
 408                 user_info->password_state = AUTH_PASSWORD_HASH;
 409                 user_info->password.hash.lanman = talloc(user_info, struct samr_Password);
 410                 if (!user_info->password.hash.lanman) {
 411                         return NT_STATUS_NO_MEMORY;
 412                 }
 413                 *user_info->password.hash.lanman = r->in.logon.password->lmpassword;
 414
 415                 user_info->password.hash.nt = talloc(user_info, struct samr_Password);
 416                 if (!user_info->password.hash.nt) {
 417                         return NT_STATUS_NO_MEMORY;
 418                 }
 419                 *user_info->password.hash.nt = r->in.logon.password->ntpassword;
 420
 421                 user_info->flags |= USER_INFO_INTERACTIVE_LOGON;
 422
 423                 break;
 424         case 2:
 425         case 6:
 426
 427                 /* TODO: we need to deny anonymous access here */
 428                 nt_status = auth_context_create(mem_ctx, lp_auth_methods(), &auth_context,
 429                                                 dce_call->event_ctx);
 430                 NT_STATUS_NOT_OK_RETURN(nt_status);
 431
 432                 nt_status = auth_context_set_challenge(auth_context, r->in.logon.network->challenge, "netr_LogonSamLogonWithFlags");
 433                 NT_STATUS_NOT_OK_RETURN(nt_status);
 434
 435                 user_info->logon_parameters = r->in.logon.network->identity_info.parameter_control;
 436                 user_info->client.account_name = r->in.logon.network->identity_info.account_name.string;
 437                 user_info->client.domain_name = r->in.logon.network->identity_info.domain_name.string;
 438                 user_info->workstation_name = r->in.logon.network->identity_info.workstation.string;
 439
 440                 user_info->password_state = AUTH_PASSWORD_RESPONSE;
 441                 user_info->password.response.lanman = data_blob(r->in.logon.network->lm.data, r->in.logon.network->lm.length);
 442                 user_info->password.response.nt = data_blob(r->in.logon.network->nt.data, r->in.logon.network->nt.length);
 443
 444                 break;
 445         default:
 446                 return NT_STATUS_INVALID_PARAMETER;
 447         }
 448
 449         nt_status = auth_check_password(auth_context, mem_ctx, user_info, &server_info);
 450         NT_STATUS_NOT_OK_RETURN(nt_status);
 451
 452         nt_status = auth_convert_server_info_sambaseinfo(mem_ctx, server_info, &sam);
 453
 454         NT_STATUS_NOT_OK_RETURN(nt_status);
 455
 456         /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
 457         /* It appears that level 6 is not individually encrypted */
 458         if ((r->in.validation_level != 6)
 459             && memcmp(sam->key.key, zeros,
 460                       sizeof(sam->key.key)) != 0) {
 461
 462                 /* This key is sent unencrypted without the ARCFOUR flag set */
 463                 if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
 464                         creds_arcfour_crypt(pipe_state->creds,
 465                                             sam->key.key,
 466                                             sizeof(sam->key.key));
 467                 }
 468         }
 469
 470         /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
 471         /* It appears that level 6 is not individually encrypted */
 472         if ((r->in.validation_level != 6)
 473             && memcmp(sam->LMSessKey.key, zeros,
 474                       sizeof(sam->LMSessKey.key)) != 0) {
 475                 if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
 476                         creds_arcfour_crypt(pipe_state->creds,
 477                                             sam->LMSessKey.key,
 478                                             sizeof(sam->LMSessKey.key));
 479                 } else {
 480                         creds_des_encrypt_LMKey(pipe_state->creds,
 481                                                 &sam->LMSessKey);
 482                 }
 483         }
 484
 485         switch (r->in.validation_level) {
 486         case 2:
 487                 sam2 = talloc_zero(mem_ctx, struct netr_SamInfo2);
 488                 NT_STATUS_HAVE_NO_MEMORY(sam2);
 489                 sam2->base = *sam;
 490                 r->out.validation.sam2 = sam2;
 491                 break;
 492
 493         case 3:
 494                 sam3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 495                 NT_STATUS_HAVE_NO_MEMORY(sam3);
 496                 sam3->base = *sam;
 497                 r->out.validation.sam3 = sam3;
 498                 break;
 499
 500         case 6:
 501                 sam6 = talloc_zero(mem_ctx, struct netr_SamInfo6);
 502                 NT_STATUS_HAVE_NO_MEMORY(sam6);
 503                 sam6->base = *sam;
 504                 sam6->forest.string = lp_realm();
 505                 sam6->principle.string = talloc_asprintf(mem_ctx, "%s@%s",
 506                                                          sam->account_name.string, sam6->forest.string);
 507                 NT_STATUS_HAVE_NO_MEMORY(sam6->principle.string);
 508                 r->out.validation.sam6 = sam6;
 509                 break;
 510
 511         default:
 512                 break;
 513         }
 514
 515         r->out.authoritative = 1;
 516
 517         /* TODO: Describe and deal with these flags */
 518         r->out.flags = 0;
 519
 520         return NT_STATUS_OK;
 521 }
 522
 523 /*
 524   netr_LogonSamLogonWithFlags
 525
 526 */
 527 static NTSTATUS netr_LogonSamLogonWithFlags(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 528                                             struct netr_LogonSamLogonWithFlags *r)
 529 {
 530         struct server_pipe_state *pipe_state = dce_call->context->private;
 531         NTSTATUS nt_status;
 532         struct netr_LogonSamLogonEx r2;
 533
 534         struct netr_Authenticator *return_authenticator;
 535
 536         return_authenticator = talloc(mem_ctx, struct netr_Authenticator);
 537         NT_STATUS_HAVE_NO_MEMORY(return_authenticator);
 538
 539         nt_status = netr_creds_server_step_check(pipe_state, r->in.credential, return_authenticator);
 540         NT_STATUS_NOT_OK_RETURN(nt_status);
 541
 542         ZERO_STRUCT(r2);
 543
 544         r2.in.server_name       = r->in.server_name;
 545         r2.in.workstation       = r->in.workstation;
 546         r2.in.logon_level       = r->in.logon_level;
 547         r2.in.logon             = r->in.logon;
 548         r2.in.validation_level  = r->in.validation_level;
 549         r2.in.flags             = r->in.flags;
 550
 551         nt_status = netr_LogonSamLogonEx(dce_call, mem_ctx, &r2);
 552
 553         r->out.return_authenticator     = return_authenticator;
 554         r->out.validation               = r2.out.validation;
 555         r->out.authoritative            = r2.out.authoritative;
 556         r->out.flags                    = r2.out.flags;
 557
 558         return nt_status;
 559 }
 560
 561 /*
 562   netr_LogonSamLogon
 563 */
 564 static NTSTATUS netr_LogonSamLogon(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 565                                    struct netr_LogonSamLogon *r)
 566 {
 567         struct netr_LogonSamLogonWithFlags r2;
 568         NTSTATUS status;
 569
 570         ZERO_STRUCT(r2);
 571
 572         r2.in.server_name = r->in.server_name;
 573         r2.in.workstation = r->in.workstation;
 574         r2.in.credential  = r->in.credential;
 575         r2.in.return_authenticator = r->in.return_authenticator;
 576         r2.in.logon_level = r->in.logon_level;
 577         r2.in.logon = r->in.logon;
 578         r2.in.validation_level = r->in.validation_level;
 579         r2.in.flags = 0;
 580
 581         status = netr_LogonSamLogonWithFlags(dce_call, mem_ctx, &r2);
 582
 583         r->out.return_authenticator = r2.out.return_authenticator;
 584         r->out.validation = r2.out.validation;
 585         r->out.authoritative = r2.out.authoritative;
 586
 587         return status;
 588 }
 589
 590
 591 /*
 592   netr_LogonSamLogoff
 593 */
 594 static NTSTATUS netr_LogonSamLogoff(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 595                        struct netr_LogonSamLogoff *r)
 596 {
 597         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 598 }
 599
 600
 601
 602 /*
 603   netr_DatabaseDeltas
 604 */
 605 static NTSTATUS netr_DatabaseDeltas(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 606                        struct netr_DatabaseDeltas *r)
 607 {
 608         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 609 }
 610
 611
 612 /*
 613   netr_DatabaseSync
 614 */
 615 static NTSTATUS netr_DatabaseSync(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 616                        struct netr_DatabaseSync *r)
 617 {
 618         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 619 }
 620
 621
 622 /*
 623   netr_AccountDeltas
 624 */
 625 static NTSTATUS netr_AccountDeltas(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 626                        struct netr_AccountDeltas *r)
 627 {
 628         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 629 }
 630
 631
 632 /*
 633   netr_AccountSync
 634 */
 635 static NTSTATUS netr_AccountSync(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 636                        struct netr_AccountSync *r)
 637 {
 638         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 639 }
 640
 641
 642 /*
 643   netr_GetDcName
 644 */
 645 static NTSTATUS netr_GetDcName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 646                        struct netr_GetDcName *r)
 647 {
 648         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 649 }
 650
 651
 652 /*
 653   netr_LogonControl
 654 */
 655 static WERROR netr_LogonControl(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 656                        struct netr_LogonControl *r)
 657 {
 658         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 659 }
 660
 661
 662 /*
 663   netr_GetAnyDCName
 664 */
 665 static WERROR netr_GetAnyDCName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 666                        struct netr_GetAnyDCName *r)
 667 {
 668         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 669 }
 670
 671
 672 /*
 673   netr_LogonControl2
 674 */
 675 static WERROR netr_LogonControl2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 676                        struct netr_LogonControl2 *r)
 677 {
 678         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 679 }
 680
 681
 682 /*
 683   netr_DatabaseSync2
 684 */
 685 static NTSTATUS netr_DatabaseSync2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 686                        struct netr_DatabaseSync2 *r)
 687 {
 688         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 689 }
 690
 691
 692 /*
 693   netr_DatabaseRedo
 694 */
 695 static NTSTATUS netr_DatabaseRedo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 696                        struct netr_DatabaseRedo *r)
 697 {
 698         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 699 }
 700
 701
 702 /*
 703   netr_LogonControl2Ex
 704 */
 705 static WERROR netr_LogonControl2Ex(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 706                        struct netr_LogonControl2Ex *r)
 707 {
 708         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 709 }
 710
 711
 712 /*
 713   netr_NETRENUMERATETRUSTEDDOMAINS
 714 */
 715 static WERROR netr_NETRENUMERATETRUSTEDDOMAINS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 716                        struct netr_NETRENUMERATETRUSTEDDOMAINS *r)
 717 {
 718         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 719 }
 720
 721
 722 /*
 723   netr_DSRGETDCNAME
 724 */
 725 static WERROR netr_DSRGETDCNAME(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 726                        struct netr_DSRGETDCNAME *r)
 727 {
 728         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 729 }
 730
 731
 732 /*
 733   netr_NETRLOGONDUMMYROUTINE1
 734 */
 735 static WERROR netr_NETRLOGONDUMMYROUTINE1(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 736                        struct netr_NETRLOGONDUMMYROUTINE1 *r)
 737 {
 738         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 739 }
 740
 741
 742 /*
 743   netr_NETRLOGONSETSERVICEBITS
 744 */
 745 static WERROR netr_NETRLOGONSETSERVICEBITS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 746                        struct netr_NETRLOGONSETSERVICEBITS *r)
 747 {
 748         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 749 }
 750
 751
 752 /*
 753   netr_NETRLOGONGETTRUSTRID
 754 */
 755 static WERROR netr_NETRLOGONGETTRUSTRID(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 756                        struct netr_NETRLOGONGETTRUSTRID *r)
 757 {
 758         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 759 }
 760
 761
 762 /*
 763   netr_NETRLOGONCOMPUTESERVERDIGEST
 764 */
 765 static WERROR netr_NETRLOGONCOMPUTESERVERDIGEST(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 766                        struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
 767 {
 768         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 769 }
 770
 771
 772 /*
 773   netr_NETRLOGONCOMPUTECLIENTDIGEST
 774 */
 775 static WERROR netr_NETRLOGONCOMPUTECLIENTDIGEST(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 776                        struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
 777 {
 778         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 779 }
 780
 781
 782 /*
 783   netr_DSRGETDCNAMEX
 784 */
 785 static WERROR netr_DSRGETDCNAMEX(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 786                        struct netr_DSRGETDCNAMEX *r)
 787 {
 788         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 789 }
 790
 791
 792 /*
 793   netr_DSRGETSITENAME
 794 */
 795 static WERROR netr_DSRGETSITENAME(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 796                        struct netr_DSRGETSITENAME *r)
 797 {
 798         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 799 }
 800
 801
 802 /*
 803   fill in a netr_DomainTrustInfo from a ldb search result
 804 */
 805 static NTSTATUS fill_domain_primary_info(TALLOC_CTX *mem_ctx, struct ldb_message *res,
 806                                          struct netr_DomainTrustInfo *info,
 807                                          const char *local_domain)
 808 {
 809         ZERO_STRUCTP(info);
 810
 811         info->domainname.string = local_domain;
 812         info->fulldomainname.string = talloc_asprintf(info, "%s.", samdb_result_string(res, "dnsDomain", NULL));
 813         /* TODO: we need proper forest support */
 814         info->forest.string = info->fulldomainname.string;
 815         info->guid = samdb_result_guid(res, "objectGUID");
 816         info->sid = samdb_result_dom_sid(mem_ctx, res, "objectSid");
 817
 818         return NT_STATUS_OK;
 819 }
 820
 821 /*
 822   fill in a netr_DomainTrustInfo from a ldb search result
 823 */
 824 static NTSTATUS fill_domain_trust_info(TALLOC_CTX *mem_ctx, struct ldb_message *res,
 825                                        struct netr_DomainTrustInfo *info,
 826                                        const char *local_domain, BOOL is_local)
 827 {
 828         ZERO_STRUCTP(info);
 829
 830         if (is_local) {
 831                 info->domainname.string = local_domain;
 832                 info->fulldomainname.string = samdb_result_string(res, "dnsDomain", NULL);
 833                 info->forest.string = NULL;
 834                 info->guid = samdb_result_guid(res, "objectGUID");
 835                 info->sid = samdb_result_dom_sid(mem_ctx, res, "objectSid");
 836         } else {
 837                 info->domainname.string = samdb_result_string(res, "flatName", NULL);
 838                 info->fulldomainname.string = samdb_result_string(res, "name", NULL);
 839                 info->forest.string = NULL;
 840                 info->guid = samdb_result_guid(res, "objectGUID");
 841                 info->sid = samdb_result_dom_sid(mem_ctx, res, "securityIdentifier");
 842         }
 843
 844         return NT_STATUS_OK;
 845 }
 846
 847 /*
 848   netr_LogonGetDomainInfo
 849   this is called as part of the ADS domain logon procedure.
 850 */
 851 static NTSTATUS netr_LogonGetDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 852                                         struct netr_LogonGetDomainInfo *r)
 853 {
 854         struct server_pipe_state *pipe_state = dce_call->context->private;
 855         const char * const attrs[] = { "dnsDomain", "objectSid",
 856                                        "objectGUID", "flatName", "securityIdentifier",
 857                                        NULL };
 858         const char * const ref_attrs[] = { "nETBIOSName", NULL };
 859         struct ldb_context *sam_ctx;
 860         struct ldb_message **res1, **res2, **ref_res;
 861         struct netr_DomainInfo1 *info1;
 862         int ret, ret1, ret2, i;
 863         NTSTATUS status;
 864
 865         const char *local_domain;
 866
 867         status = netr_creds_server_step_check(pipe_state,
 868                                               r->in.credential, r->out.return_authenticator);
 869         if (!NT_STATUS_IS_OK(status)) {
 870                 return status;
 871         }
 872
 873         sam_ctx = samdb_connect(mem_ctx, dce_call->conn->auth_state.session_info);
 874         if (sam_ctx == NULL) {
 875                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 876         }
 877
 878         /* we need to do two searches. The first will pull our primary
 879            domain and the second will pull any trusted domains. Our
 880            primary domain is also a "trusted" domain, so we need to
 881            put the primary domain into the lists of returned trusts as
 882            well */
 883         ret1 = gendb_search(sam_ctx, mem_ctx, NULL, &res1, attrs, "(objectClass=domainDNS)");
 884         if (ret1 != 1) {
 885                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 886         }
 887
 888         /* try and find the domain */
 889         ret = gendb_search(sam_ctx, mem_ctx, NULL,
 890                            &ref_res, ref_attrs,
 891                            "(&(objectClass=crossRef)(ncName=%s))",
 892                            ldb_dn_linearize(mem_ctx, res1[0]->dn));
 893         if (ret != 1) {
 894                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 895         }
 896
 897         local_domain = samdb_result_string(ref_res[0], "nETBIOSName", NULL);
 898
 899         ret2 = gendb_search(sam_ctx, mem_ctx, NULL, &res2, attrs, "(objectClass=trustedDomain)");
 900         if (ret2 == -1) {
 901                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 902         }
 903
 904         info1 = talloc(mem_ctx, struct netr_DomainInfo1);
 905         if (info1 == NULL) {
 906                 return NT_STATUS_NO_MEMORY;
 907         }
 908
 909         ZERO_STRUCTP(info1);
 910
 911         info1->num_trusts = ret2 + 1;
 912         info1->trusts = talloc_array(mem_ctx, struct netr_DomainTrustInfo,
 913                                        info1->num_trusts);
 914         if (info1->trusts == NULL) {
 915                 return NT_STATUS_NO_MEMORY;
 916         }
 917
 918         status = fill_domain_primary_info(mem_ctx, res1[0], &info1->domaininfo, local_domain);
 919         if (!NT_STATUS_IS_OK(status)) {
 920                 return status;
 921         }
 922
 923         for (i=0;i<ret2;i++) {
 924                 status = fill_domain_trust_info(mem_ctx, res2[i], &info1->trusts[i], NULL, False);
 925                 if (!NT_STATUS_IS_OK(status)) {
 926                         return status;
 927                 }
 928         }
 929
 930         status = fill_domain_trust_info(mem_ctx, res1[0], &info1->trusts[i], local_domain, True);
 931         if (!NT_STATUS_IS_OK(status)) {
 932                 return status;
 933         }
 934
 935         r->out.info.info1 = info1;
 936
 937         return NT_STATUS_OK;
 938 }
 939
 940
 941 /*
 942   netr_ServerPasswordSet2
 943 */
 944 static NTSTATUS netr_ServerPasswordSet2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 945                                        struct netr_ServerPasswordSet2 *r)
 946 {
 947         struct server_pipe_state *pipe_state = dce_call->context->private;
 948
 949         struct ldb_context *sam_ctx;
 950         NTSTATUS nt_status;
 951         char new_pass[512];
 952         uint32_t new_pass_len;
 953         BOOL ret;
 954
 955         struct samr_CryptPassword password_buf;
 956
 957         nt_status = netr_creds_server_step_check(pipe_state, &r->in.credential, &r->out.return_authenticator);
 958         NT_STATUS_NOT_OK_RETURN(nt_status);
 959
 960         sam_ctx = samdb_connect(mem_ctx, system_session(mem_ctx));
 961         if (sam_ctx == NULL) {
 962                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 963         }
 964
 965         memcpy(password_buf.data, r->in.new_password.data, 512);
 966         SIVAL(password_buf.data,512,r->in.new_password.length);
 967         creds_arcfour_crypt(pipe_state->creds, password_buf.data, 516);
 968
 969         ret = decode_pw_buffer(password_buf.data, new_pass, sizeof(new_pass),
 970                                &new_pass_len, STR_UNICODE);
 971         if (!ret) {
 972                 DEBUG(3,("netr_ServerPasswordSet2: failed to decode password buffer\n"));
 973                 return NT_STATUS_ACCESS_DENIED;
 974         }
 975
 976         /* Using the sid for the account as the key, set the password */
 977         nt_status = samdb_set_password_sid(sam_ctx, mem_ctx,
 978                                            pipe_state->creds->sid,
 979                                            new_pass, /* we have plaintext */
 980                                            NULL, NULL,
 981                                            False, /* This is not considered a password change */
 982                                            False, /* don't restrict this password change (match w2k3) */
 983                                            NULL, NULL);
 984         return nt_status;
 985 }
 986
 987
 988 /*
 989   netr_NETRSERVERPASSWORDGET
 990 */
 991 static WERROR netr_NETRSERVERPASSWORDGET(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 992                        struct netr_NETRSERVERPASSWORDGET *r)
 993 {
 994         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 995 }
 996
 997
 998 /*
 999   netr_NETRLOGONSENDTOSAM
1000 */
1001 static WERROR netr_NETRLOGONSENDTOSAM(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1002                        struct netr_NETRLOGONSENDTOSAM *r)
1003 {
1004         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1005 }
1006
1007
1008 /*
1009   netr_DSRADDRESSTOSITENAMESW
1010 */
1011 static WERROR netr_DSRADDRESSTOSITENAMESW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1012                        struct netr_DSRADDRESSTOSITENAMESW *r)
1013 {
1014         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1015 }
1016
1017
1018 /*
1019   netr_DrsGetDCNameEx2
1020 */
1021 static WERROR netr_DrsGetDCNameEx2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1022                        struct netr_DrsGetDCNameEx2 *r)
1023 {
1024         const char * const attrs[] = { "dnsDomain", "objectGUID", NULL };
1025         void *sam_ctx;
1026         struct ldb_message **res;
1027         int ret;
1028
1029         ZERO_STRUCT(r->out);
1030
1031         sam_ctx = samdb_connect(mem_ctx, dce_call->conn->auth_state.session_info);
1032         if (sam_ctx == NULL) {
1033                 return WERR_DS_SERVICE_UNAVAILABLE;
1034         }
1035
1036         ret = gendb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
1037                                 "(&(objectClass=domainDNS)(dnsDomain=%s))",
1038                                 r->in.domain_name);
1039         if (ret != 1) {
1040                 return WERR_NO_SUCH_DOMAIN;
1041         }
1042
1043         r->out.info = talloc(mem_ctx, struct netr_DrsGetDCNameEx2Info);
1044         if (!r->out.info) {
1045                 return WERR_NOMEM;
1046         }
1047
1048         /* TODO: - return real IP address
1049          *       - check all r->in.* parameters (server_unc is ignored by w2k3!)
1050          */
1051         r->out.info->dc_unc             = talloc_asprintf(mem_ctx, "\\\\%s.%s", lp_netbios_name(),lp_realm());
1052         r->out.info->dc_address = talloc_strdup(mem_ctx, "\\\\0.0.0.0");
1053         r->out.info->dc_address_type    = 1;
1054         r->out.info->domain_guid        = samdb_result_guid(res[0], "objectGUID");
1055         r->out.info->domain_name        = samdb_result_string(res[0], "dnsDomain", NULL);
1056         r->out.info->forest_name        = samdb_result_string(res[0], "dnsDomain", NULL);
1057         r->out.info->dc_flags           = 0xE00001FD;
1058         r->out.info->dc_site_name       = talloc_strdup(mem_ctx, "Default-First-Site-Name");
1059         r->out.info->client_site_name   = talloc_strdup(mem_ctx, "Default-First-Site-Name");
1060
1061         return WERR_OK;
1062 }
1063
1064
1065 /*
1066   netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN
1067 */
1068 static WERROR netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1069                        struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1070 {
1071         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1072 }
1073
1074
1075 /*
1076   netr_NETRENUMERATETRUSTEDDOMAINSEX
1077 */
1078 static WERROR netr_NETRENUMERATETRUSTEDDOMAINSEX(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1079                        struct netr_NETRENUMERATETRUSTEDDOMAINSEX *r)
1080 {
1081         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1082 }
1083
1084
1085 /*
1086   netr_DSRADDRESSTOSITENAMESEXW
1087 */
1088 static WERROR netr_DSRADDRESSTOSITENAMESEXW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1089                        struct netr_DSRADDRESSTOSITENAMESEXW *r)
1090 {
1091         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1092 }
1093
1094
1095 /*
1096   netr_DSRGETDCSITECOVERAGEW
1097 */
1098 static WERROR netr_DSRGETDCSITECOVERAGEW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1099                        struct netr_DSRGETDCSITECOVERAGEW *r)
1100 {
1101         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1102 }
1103
1104
1105 /*
1106   netr_DsrEnumerateDomainTrusts
1107 */
1108 static WERROR netr_DsrEnumerateDomainTrusts(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1109                                               struct netr_DsrEnumerateDomainTrusts *r)
1110 {
1111         struct netr_DomainTrust *trusts;
1112         void *sam_ctx;
1113         int ret;
1114         struct ldb_message **dom_res, **ref_res;
1115         const char * const dom_attrs[] = { "dnsDomain", "objectSid", "objectGUID", NULL };
1116         const char * const ref_attrs[] = { "nETBIOSName", NULL };
1117
1118         ZERO_STRUCT(r->out);
1119
1120         sam_ctx = samdb_connect(mem_ctx, dce_call->conn->auth_state.session_info);
1121         if (sam_ctx == NULL) {
1122                 return WERR_GENERAL_FAILURE;
1123         }
1124
1125         ret = gendb_search_dn(sam_ctx, mem_ctx, samdb_base_dn(mem_ctx), &dom_res, dom_attrs);
1126         if (ret == -1) {
1127                 return WERR_GENERAL_FAILURE;
1128         }
1129
1130         if (ret != 1) {
1131                 return WERR_GENERAL_FAILURE;
1132         }
1133
1134         ret = gendb_search(sam_ctx, mem_ctx, NULL, &ref_res, ref_attrs,
1135                            "(&(objectClass=crossRef)(ncName=%s))",
1136                            ldb_dn_linearize(mem_ctx, dom_res[0]->dn));
1137         if (ret == -1) {
1138                 return WERR_GENERAL_FAILURE;
1139         }
1140
1141         if (ret != 1) {
1142                 return WERR_GENERAL_FAILURE;
1143         }
1144
1145
1146
1147         trusts = talloc_array(mem_ctx, struct netr_DomainTrust, ret);
1148         if (trusts == NULL) {
1149                 return WERR_NOMEM;
1150         }
1151
1152         r->out.count = 1;
1153         r->out.trusts = trusts;
1154
1155         /* TODO: add filtering by trust_flags, and correct trust_type
1156            and attributes */
1157         trusts[0].netbios_name = samdb_result_string(ref_res[0], "nETBIOSName", NULL);
1158         trusts[0].dns_name     = samdb_result_string(dom_res[0], "dnsDomain", NULL);
1159         trusts[0].trust_flags =
1160                 NETR_TRUST_FLAG_TREEROOT |
1161                 NETR_TRUST_FLAG_IN_FOREST |
1162                 NETR_TRUST_FLAG_PRIMARY;
1163         trusts[0].parent_index = 0;
1164         trusts[0].trust_type = 2;
1165         trusts[0].trust_attributes = 0;
1166         trusts[0].sid  = samdb_result_dom_sid(mem_ctx, dom_res[0], "objectSid");
1167         trusts[0].guid = samdb_result_guid(dom_res[0], "objectGUID");
1168
1169         return WERR_OK;
1170 }
1171
1172
1173 /*
1174   netr_DSRDEREGISTERDNSHOSTRECORDS
1175 */
1176 static WERROR netr_DSRDEREGISTERDNSHOSTRECORDS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1177                        struct netr_DSRDEREGISTERDNSHOSTRECORDS *r)
1178 {
1179         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1180 }
1181
1182
1183 /*
1184   netr_NETRSERVERTRUSTPASSWORDSGET
1185 */
1186 static WERROR netr_NETRSERVERTRUSTPASSWORDSGET(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1187                        struct netr_NETRSERVERTRUSTPASSWORDSGET *r)
1188 {
1189         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1190 }
1191
1192
1193 /*
1194   netr_DSRGETFORESTTRUSTINFORMATION
1195 */
1196 static WERROR netr_DSRGETFORESTTRUSTINFORMATION(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1197                        struct netr_DSRGETFORESTTRUSTINFORMATION *r)
1198 {
1199         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1200 }
1201
1202
1203 /*
1204   netr_NETRGETFORESTTRUSTINFORMATION
1205 */
1206 static WERROR netr_NETRGETFORESTTRUSTINFORMATION(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1207                        struct netr_NETRGETFORESTTRUSTINFORMATION *r)
1208 {
1209         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1210 }
1211
1212
1213 /*
1214   netr_NETRSERVERGETTRUSTINFO
1215 */
1216 static WERROR netr_NETRSERVERGETTRUSTINFO(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1217                        struct netr_NETRSERVERGETTRUSTINFO *r)
1218 {
1219         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1220 }
1221
1222
1223 /* include the generated boilerplate */
1224 #include "librpc/gen_ndr/ndr_netlogon_s.c"