source4/rpc_server/netlogon/dcerpc_netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    endpoint server for the netlogon pipe
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
   7    Copyright (C) Stefan Metzmacher <metze@samba.org>  2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "librpc/gen_ndr/ndr_netlogon.h"
  26 #include "rpc_server/dcerpc_server.h"
  27 #include "rpc_server/common/common.h"
  28 #include "librpc/gen_ndr/ndr_dcom.h"
  29 #include "auth/auth.h"
  30 #include "lib/ldb/include/ldb.h"
  31
  32 struct server_pipe_state {
  33         struct netr_Credential client_challenge;
  34         struct netr_Credential server_challenge;
  35         struct creds_CredentialState *creds;
  36 };
  37
  38
  39 /*
  40   a client has connected to the netlogon server using schannel, so we need
  41   to re-establish the credentials state
  42 */
  43 static NTSTATUS netlogon_schannel_setup(struct dcesrv_call_state *dce_call)
  44 {
  45         struct server_pipe_state *state;
  46         NTSTATUS status;
  47
  48         /* We want the client and server challenge zero */
  49         state = talloc_zero(dce_call->conn, struct server_pipe_state);
  50         if (state == NULL) {
  51                 return NT_STATUS_NO_MEMORY;
  52         }
  53
  54         status = dcerpc_schannel_creds(dce_call->conn->auth_state.gensec_security,
  55                                        state,
  56                                        &state->creds);
  57
  58         if (!NT_STATUS_IS_OK(status)) {
  59                 DEBUG(3, ("getting schannel credentials failed with %s\n", nt_errstr(status)));
  60                 talloc_free(state);
  61                 return status;
  62         }
  63
  64         dce_call->context->private = state;
  65
  66         return NT_STATUS_OK;
  67 }
  68
  69 /*
  70   a hook for bind on the netlogon pipe
  71 */
  72 static NTSTATUS netlogon_bind(struct dcesrv_call_state *dce_call, const struct dcesrv_interface *di)
  73 {
  74         dce_call->context->private = NULL;
  75
  76         /* if this is a schannel bind then we need to reconstruct the pipe state */
  77         if (dce_call->conn->auth_state.auth_info &&
  78             dce_call->conn->auth_state.auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
  79                 NTSTATUS status;
  80
  81                 DEBUG(5, ("schannel bind on netlogon\n"));
  82
  83                 status = netlogon_schannel_setup(dce_call);
  84                 if (!NT_STATUS_IS_OK(status)) {
  85                         DEBUG(3, ("schannel bind on netlogon failed with %s\n", nt_errstr(status)));
  86                         return status;
  87                 }
  88         }
  89
  90         return NT_STATUS_OK;
  91 }
  92
  93 #define DCESRV_INTERFACE_NETLOGON_BIND netlogon_bind
  94
  95 static NTSTATUS netr_ServerReqChallenge(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
  96                                         struct netr_ServerReqChallenge *r)
  97 {
  98         struct server_pipe_state *pipe_state = dce_call->context->private;
  99
 100         ZERO_STRUCTP(r->out.credentials);
 101
 102         /* destroyed on pipe shutdown */
 103
 104         if (pipe_state) {
 105                 talloc_free(pipe_state);
 106                 dce_call->context->private = NULL;
 107         }
 108
 109         pipe_state = talloc(dce_call->context, struct server_pipe_state);
 110         if (!pipe_state) {
 111                 return NT_STATUS_NO_MEMORY;
 112         }
 113
 114         pipe_state->creds = NULL;
 115
 116         pipe_state->client_challenge = *r->in.credentials;
 117
 118         generate_random_buffer(pipe_state->server_challenge.data,
 119                                sizeof(pipe_state->server_challenge.data));
 120
 121         *r->out.credentials = pipe_state->server_challenge;
 122
 123         dce_call->context->private = pipe_state;
 124
 125         return NT_STATUS_OK;
 126 }
 127
 128 static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 129                                          struct netr_ServerAuthenticate3 *r)
 130 {
 131         struct server_pipe_state *pipe_state = dce_call->context->private;
 132         void *sam_ctx;
 133         struct samr_Password *mach_pwd;
 134         uint16_t acct_flags;
 135         int num_records;
 136         struct ldb_message **msgs;
 137         NTSTATUS nt_status;
 138         const char *attrs[] = {"unicodePwd", "lmPwdHash", "ntPwdHash", "userAccountControl",
 139                                "objectSid", NULL};
 140
 141         ZERO_STRUCTP(r->out.credentials);
 142         *r->out.rid = 0;
 143         *r->out.negotiate_flags = *r->in.negotiate_flags;
 144
 145         if (!pipe_state) {
 146                 DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
 147                 return NT_STATUS_ACCESS_DENIED;
 148         }
 149
 150         sam_ctx = samdb_connect(mem_ctx);
 151         if (sam_ctx == NULL) {
 152                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 153         }
 154         /* pull the user attributes */
 155         num_records = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
 156                                    "(&(sAMAccountName=%s)(objectclass=user))",
 157                                    r->in.account_name);
 158
 159         if (num_records == 0) {
 160                 DEBUG(3,("Couldn't find user [%s] in samdb.\n",
 161                          r->in.account_name));
 162                 return NT_STATUS_NO_SUCH_USER;
 163         }
 164
 165         if (num_records > 1) {
 166                 DEBUG(0,("Found %d records matching user [%s]\n", num_records, r->in.account_name));
 167                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 168         }
 169
 170         acct_flags = samdb_result_acct_flags(msgs[0],
 171                                              "userAccountControl");
 172
 173         if (acct_flags & ACB_DISABLED) {
 174                 DEBUG(1, ("Account [%s] is disabled\n", r->in.account_name));
 175                 return NT_STATUS_ACCESS_DENIED;
 176         }
 177
 178         if (r->in.secure_channel_type == SEC_CHAN_WKSTA) {
 179                 if (!(acct_flags & ACB_WSTRUST)) {
 180                         DEBUG(1, ("Client asked for a workstation secure channel, but is not a workstation (member server) acb flags: 0x%x\n", acct_flags));
 181                         return NT_STATUS_ACCESS_DENIED;
 182                 }
 183         } else if (r->in.secure_channel_type == SEC_CHAN_DOMAIN) {
 184                 if (!(acct_flags & ACB_DOMTRUST)) {
 185                         DEBUG(1, ("Client asked for a trusted domain secure channel, but is not a trusted domain: acb flags: 0x%x\n", acct_flags));
 186                         return NT_STATUS_ACCESS_DENIED;
 187                 }
 188         } else if (r->in.secure_channel_type == SEC_CHAN_BDC) {
 189                 if (!(acct_flags & ACB_SVRTRUST)) {
 190                         DEBUG(1, ("Client asked for a server secure channel, but is not a server (domain controller): acb flags: 0x%x\n", acct_flags));
 191                         return NT_STATUS_ACCESS_DENIED;
 192                 }
 193         } else {
 194                 DEBUG(1, ("Client asked for an invalid secure channel type: %d\n",
 195                           r->in.secure_channel_type));
 196                 return NT_STATUS_ACCESS_DENIED;
 197         }
 198
 199
 200         *r->out.rid = samdb_result_rid_from_sid(mem_ctx, msgs[0], "objectSid", 0);
 201
 202         nt_status = samdb_result_passwords(mem_ctx, msgs[0], NULL, &mach_pwd);
 203         if (!NT_STATUS_IS_OK(nt_status) || mach_pwd == NULL) {
 204                 return NT_STATUS_ACCESS_DENIED;
 205         }
 206
 207         if (pipe_state->creds) {
 208                 talloc_free(pipe_state->creds);
 209         }
 210         pipe_state->creds = talloc(pipe_state, struct creds_CredentialState);
 211         if (!pipe_state->creds) {
 212                 return NT_STATUS_NO_MEMORY;
 213         }
 214
 215         creds_server_init(pipe_state->creds, &pipe_state->client_challenge,
 216                           &pipe_state->server_challenge, mach_pwd,
 217                           r->out.credentials,
 218                           *r->in.negotiate_flags);
 219
 220         if (!creds_server_check(pipe_state->creds, r->in.credentials)) {
 221                 talloc_free(pipe_state->creds);
 222                 pipe_state->creds = NULL;
 223                 return NT_STATUS_ACCESS_DENIED;
 224         }
 225
 226         pipe_state->creds->account_name = talloc_reference(pipe_state->creds, r->in.account_name);
 227
 228         pipe_state->creds->computer_name = talloc_reference(pipe_state->creds, r->in.computer_name);
 229
 230         pipe_state->creds->secure_channel_type = r->in.secure_channel_type;
 231
 232         pipe_state->creds->rid = *r->out.rid;
 233
 234         pipe_state->creds->domain = talloc_strdup(pipe_state->creds, lp_workgroup());
 235
 236         /* remember this session key state */
 237         nt_status = schannel_store_session_key(mem_ctx, pipe_state->creds);
 238
 239         return nt_status;
 240 }
 241
 242 static NTSTATUS netr_ServerAuthenticate(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 243                                         struct netr_ServerAuthenticate *r)
 244 {
 245         struct netr_ServerAuthenticate3 r3;
 246         uint32_t rid = 0;
 247         /* TODO:
 248          * negotiate_flags is used as an [in] parameter
 249          * so it need to be initialised.
 250          *
 251          * (I think ... = 0; seems wrong here --metze)
 252          */
 253         uint32_t negotiate_flags = 0;
 254
 255         r3.in.server_name = r->in.server_name;
 256         r3.in.account_name = r->in.account_name;
 257         r3.in.secure_channel_type = r->in.secure_channel_type;
 258         r3.in.computer_name = r->in.computer_name;
 259         r3.in.credentials = r->in.credentials;
 260         r3.out.credentials = r->out.credentials;
 261         r3.in.negotiate_flags = &negotiate_flags;
 262         r3.out.negotiate_flags = &negotiate_flags;
 263         r3.out.rid = &rid;
 264
 265         return netr_ServerAuthenticate3(dce_call, mem_ctx, &r3);
 266 }
 267
 268 static NTSTATUS netr_ServerAuthenticate2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 269                                          struct netr_ServerAuthenticate2 *r)
 270 {
 271         struct netr_ServerAuthenticate3 r3;
 272         uint32_t rid = 0;
 273
 274         r3.in.server_name = r->in.server_name;
 275         r3.in.account_name = r->in.account_name;
 276         r3.in.secure_channel_type = r->in.secure_channel_type;
 277         r3.in.computer_name = r->in.computer_name;
 278         r3.in.credentials = r->in.credentials;
 279         r3.out.credentials = r->out.credentials;
 280         r3.in.negotiate_flags = r->in.negotiate_flags;
 281         r3.out.negotiate_flags = r->out.negotiate_flags;
 282         r3.out.rid = &rid;
 283
 284         return netr_ServerAuthenticate3(dce_call, mem_ctx, &r3);
 285 }
 286
 287
 288 static NTSTATUS netr_creds_server_step_check(struct server_pipe_state *pipe_state,
 289                                              struct netr_Authenticator *received_authenticator,
 290                                              struct netr_Authenticator *return_authenticator)
 291 {
 292         if (!pipe_state) {
 293                 DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
 294                 return NT_STATUS_ACCESS_DENIED;
 295         }
 296
 297         return creds_server_step_check(pipe_state->creds,
 298                                        received_authenticator,
 299                                        return_authenticator);
 300 }
 301
 302
 303 static NTSTATUS netr_ServerPasswordSet(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 304                                        struct netr_ServerPasswordSet *r)
 305 {
 306         struct server_pipe_state *pipe_state = dce_call->context->private;
 307
 308         void *sam_ctx;
 309         int num_records;
 310         int num_records_domain;
 311         int ret;
 312         struct ldb_message **msgs;
 313         struct ldb_message **msgs_domain;
 314         NTSTATUS nt_status;
 315         struct ldb_message *mod;
 316         const char *domain_sid;
 317
 318         const char *attrs[] = {"objectSid", NULL };
 319
 320         const char **domain_attrs = attrs;
 321
 322         nt_status = netr_creds_server_step_check(pipe_state, &r->in.credential, &r->out.return_authenticator);
 323         NT_STATUS_NOT_OK_RETURN(nt_status);
 324
 325         sam_ctx = samdb_connect(mem_ctx);
 326         if (sam_ctx == NULL) {
 327                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 328         }
 329         /* pull the user attributes */
 330         num_records = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
 331                                    "(&(sAMAccountName=%s)(objectclass=user))",
 332                                    pipe_state->creds->account_name);
 333         if (num_records == -1) {
 334                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 335         }
 336
 337         if (num_records == 0) {
 338                 DEBUG(3,("Couldn't find user [%s] in samdb.\n",
 339                          pipe_state->creds->account_name));
 340                 return NT_STATUS_NO_SUCH_USER;
 341         }
 342
 343         if (num_records > 1) {
 344                 DEBUG(0,("Found %d records matching user [%s]\n", num_records,
 345                          pipe_state->creds->account_name));
 346                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 347         }
 348
 349         domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
 350         if (!domain_sid) {
 351                 DEBUG(0,("no objectSid in user record\n"));
 352                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 353         }
 354
 355         /* find the domain's DN */
 356         num_records_domain = samdb_search(sam_ctx, mem_ctx, NULL,
 357                                           &msgs_domain, domain_attrs,
 358                                           "(&(objectSid=%s)(objectclass=domain))",
 359                                           domain_sid);
 360         if (num_records_domain == -1) {
 361                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 362         }
 363
 364         if (num_records_domain == 0) {
 365                 DEBUG(3,("Couldn't find domain [%s] in samdb.\n",
 366                          domain_sid));
 367                 return NT_STATUS_NO_SUCH_USER;
 368         }
 369
 370         if (num_records_domain > 1) {
 371                 DEBUG(0,("Found %d records matching domain [%s]\n",
 372                          num_records_domain, domain_sid));
 373                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 374         }
 375
 376         mod = talloc_zero(mem_ctx, struct ldb_message);
 377         NT_STATUS_HAVE_NO_MEMORY(mod);
 378         mod->dn = talloc_reference(mod, msgs[0]->dn);
 379
 380         creds_des_decrypt(pipe_state->creds, &r->in.new_password);
 381
 382         /* set the password - samdb needs to know both the domain and user DNs,
 383            so the domain password policy can be used */
 384         nt_status = samdb_set_password(sam_ctx, mod,
 385                                        msgs[0]->dn,
 386                                        msgs_domain[0]->dn,
 387                                        mod,
 388                                        NULL, /* Don't have plaintext */
 389                                        NULL, &r->in.new_password,
 390                                        False, /* This is not considered a password change */
 391                                        False, /* don't restrict this password change (match w2k3) */
 392                                        NULL);
 393         NT_STATUS_NOT_OK_RETURN(nt_status);
 394
 395         ret = samdb_replace(sam_ctx, mem_ctx, mod);
 396         if (ret != 0) {
 397                 /* we really need samdb.c to return NTSTATUS */
 398                 return NT_STATUS_UNSUCCESSFUL;
 399         }
 400
 401         return NT_STATUS_OK;
 402 }
 403
 404
 405 /*
 406   netr_LogonUasLogon
 407 */
 408 static WERROR netr_LogonUasLogon(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 409                                  struct netr_LogonUasLogon *r)
 410 {
 411         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 412 }
 413
 414
 415 /*
 416   netr_LogonUasLogoff
 417 */
 418 static WERROR netr_LogonUasLogoff(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 419                        struct netr_LogonUasLogoff *r)
 420 {
 421         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 422 }
 423
 424
 425 /*
 426   netr_LogonSamLogonWithFlags
 427
 428   This version of the function allows other wrappers to say 'do not check the credentials'
 429 */
 430 static NTSTATUS netr_LogonSamLogonEx(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 431                                      struct netr_LogonSamLogonEx *r)
 432 {
 433         struct server_pipe_state *pipe_state = dce_call->context->private;
 434
 435         struct auth_context *auth_context;
 436         struct auth_usersupplied_info *user_info;
 437         struct auth_serversupplied_info *server_info;
 438         NTSTATUS nt_status;
 439         const uint8_t *chal;
 440         static const char zeros[16];
 441         struct netr_SamBaseInfo *sam;
 442         struct netr_SamInfo2 *sam2;
 443         struct netr_SamInfo3 *sam3;
 444         struct netr_SamInfo6 *sam6;
 445
 446         switch (r->in.logon_level) {
 447         case 1:
 448         case 3:
 449         case 5:
 450                 if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
 451                         creds_arcfour_crypt(pipe_state->creds,
 452                                             r->in.logon.password->lmpassword.hash,
 453                                             sizeof(r->in.logon.password->lmpassword.hash));
 454                         creds_arcfour_crypt(pipe_state->creds,
 455                                             r->in.logon.password->ntpassword.hash,
 456                                             sizeof(r->in.logon.password->ntpassword.hash));
 457                 } else {
 458                         creds_des_decrypt(pipe_state->creds, &r->in.logon.password->lmpassword);
 459                         creds_des_decrypt(pipe_state->creds, &r->in.logon.password->ntpassword);
 460                 }
 461
 462                 /* TODO: we need to deny anonymous access here */
 463                 nt_status = auth_context_create(mem_ctx, lp_auth_methods(), &auth_context);
 464                 NT_STATUS_NOT_OK_RETURN(nt_status);
 465
 466                 nt_status = auth_get_challenge(auth_context, &chal);
 467                 NT_STATUS_NOT_OK_RETURN(nt_status);
 468
 469                 nt_status = make_user_info_netlogon_interactive(mem_ctx,
 470                                                                 r->in.logon.password->identity_info.account_name.string,
 471                                                                 r->in.logon.password->identity_info.domain_name.string,
 472                                                                 r->in.logon.password->identity_info.workstation.string,
 473                                                                 chal,
 474                                                                 &r->in.logon.password->lmpassword,
 475                                                                 &r->in.logon.password->ntpassword,
 476                                                                 &user_info);
 477                 NT_STATUS_NOT_OK_RETURN(nt_status);
 478                 break;
 479         case 2:
 480         case 6:
 481                 /* TODO: we need to deny anonymous access here */
 482                 nt_status = auth_context_create(mem_ctx, lp_auth_methods(), &auth_context);
 483                 NT_STATUS_NOT_OK_RETURN(nt_status);
 484
 485                 nt_status = auth_context_set_challenge(auth_context, r->in.logon.network->challenge, "netr_LogonSamLogonWithFlags");
 486                 NT_STATUS_NOT_OK_RETURN(nt_status);
 487
 488                 nt_status = make_user_info_netlogon_network(auth_context,
 489                                                             r->in.logon.network->identity_info.account_name.string,
 490                                                             r->in.logon.network->identity_info.domain_name.string,
 491                                                             r->in.logon.network->identity_info.workstation.string,
 492                                                             r->in.logon.network->lm.data, r->in.logon.network->lm.length,
 493                                                             r->in.logon.network->nt.data, r->in.logon.network->nt.length,
 494                                                             &user_info);
 495                 NT_STATUS_NOT_OK_RETURN(nt_status);
 496                 break;
 497         default:
 498                 return NT_STATUS_INVALID_PARAMETER;
 499         }
 500
 501         nt_status = auth_check_password(auth_context, mem_ctx, user_info, &server_info);
 502         NT_STATUS_NOT_OK_RETURN(nt_status);
 503
 504         sam = talloc_zero(mem_ctx, struct netr_SamBaseInfo);
 505         NT_STATUS_HAVE_NO_MEMORY(sam);
 506
 507         sam->last_logon = server_info->last_logon;
 508         sam->last_logoff = server_info->last_logoff;
 509         sam->acct_expiry = server_info->acct_expiry;
 510         sam->last_password_change = server_info->last_password_change;
 511         sam->allow_password_change = server_info->allow_password_change;
 512         sam->force_password_change = server_info->force_password_change;
 513
 514         sam->account_name.string = server_info->account_name;
 515         sam->full_name.string = server_info->full_name;
 516         sam->logon_script.string = server_info->logon_script;
 517         sam->profile_path.string = server_info->profile_path;
 518         sam->home_directory.string = server_info->home_directory;
 519         sam->home_drive.string = server_info->home_drive;
 520
 521         sam->logon_count = server_info->logon_count;
 522         sam->bad_password_count = sam->bad_password_count;
 523         sam->rid = server_info->account_sid->sub_auths[server_info->account_sid->num_auths-1];
 524         sam->primary_gid = server_info->primary_group_sid->sub_auths[server_info->primary_group_sid->num_auths-1];
 525         sam->group_count = 0;
 526         sam->groupids = NULL;
 527         sam->user_flags = 0; /* TODO: w2k3 uses 0x120 - what is this? */
 528         sam->acct_flags = server_info->acct_flags;
 529         sam->logon_server.string = lp_netbios_name();
 530         sam->domain.string = server_info->domain_name;
 531
 532         sam->domain_sid = dom_sid_dup(mem_ctx, server_info->account_sid);
 533         NT_STATUS_HAVE_NO_MEMORY(sam->domain_sid);
 534         sam->domain_sid->num_auths--;
 535
 536         ZERO_STRUCT(sam->unknown);
 537
 538         ZERO_STRUCT(sam->key);
 539         if (server_info->user_session_key.length == sizeof(sam->key.key)) {
 540                 memcpy(sam->key.key, server_info->user_session_key.data, sizeof(sam->key.key));
 541         }
 542
 543         /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
 544         /* It appears that level 6 is not individually encrypted */
 545         if ((r->in.validation_level != 6)
 546             && memcmp(sam->key.key, zeros,
 547                       sizeof(sam->key.key)) != 0) {
 548
 549                 /* This key is sent unencrypted without the ARCFOUR flag set */
 550                 if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
 551                         creds_arcfour_crypt(pipe_state->creds,
 552                                             sam->key.key,
 553                                             sizeof(sam->key.key));
 554                 }
 555         }
 556
 557         ZERO_STRUCT(sam->LMSessKey);
 558         if (server_info->lm_session_key.length == sizeof(sam->LMSessKey.key)) {
 559                 memcpy(sam->LMSessKey.key, server_info->lm_session_key.data,
 560                        sizeof(sam->LMSessKey.key));
 561         }
 562
 563         /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
 564         /* It appears that level 6 is not individually encrypted */
 565         if ((r->in.validation_level != 6)
 566             && memcmp(sam->LMSessKey.key, zeros,
 567                       sizeof(sam->LMSessKey.key)) != 0) {
 568                 if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
 569                         creds_arcfour_crypt(pipe_state->creds,
 570                                             sam->LMSessKey.key,
 571                                             sizeof(sam->LMSessKey.key));
 572                 } else {
 573                         creds_des_encrypt_LMKey(pipe_state->creds,
 574                                                 &sam->LMSessKey);
 575                 }
 576         }
 577
 578         switch (r->in.validation_level) {
 579         case 2:
 580                 sam2 = talloc_zero(mem_ctx, struct netr_SamInfo2);
 581                 NT_STATUS_HAVE_NO_MEMORY(sam2);
 582                 sam2->base = *sam;
 583                 r->out.validation.sam2 = sam2;
 584                 break;
 585
 586         case 3:
 587                 sam3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 588                 NT_STATUS_HAVE_NO_MEMORY(sam3);
 589                 sam3->base = *sam;
 590                 r->out.validation.sam3 = sam3;
 591                 break;
 592
 593         case 6:
 594                 sam6 = talloc_zero(mem_ctx, struct netr_SamInfo6);
 595                 NT_STATUS_HAVE_NO_MEMORY(sam6);
 596                 sam6->base = *sam;
 597                 sam6->forest.string = lp_realm();
 598                 sam6->principle.string = talloc_asprintf(mem_ctx, "%s@%s",
 599                                                          sam->account_name.string, sam6->forest.string);
 600                 NT_STATUS_HAVE_NO_MEMORY(sam6->principle.string);
 601                 r->out.validation.sam6 = sam6;
 602                 break;
 603
 604         default:
 605                 break;
 606         }
 607
 608         r->out.authoritative = 1;
 609
 610         /* TODO: Describe and deal with these flags */
 611         r->out.flags = 0;
 612
 613         return NT_STATUS_OK;
 614 }
 615
 616 /*
 617   netr_LogonSamLogonWithFlags
 618
 619 */
 620 static NTSTATUS netr_LogonSamLogonWithFlags(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 621                                             struct netr_LogonSamLogonWithFlags *r)
 622 {
 623         struct server_pipe_state *pipe_state = dce_call->context->private;
 624         NTSTATUS nt_status;
 625         struct netr_LogonSamLogonEx r2;
 626
 627         struct netr_Authenticator *return_authenticator;
 628
 629         return_authenticator = talloc(mem_ctx, struct netr_Authenticator);
 630         NT_STATUS_HAVE_NO_MEMORY(return_authenticator);
 631
 632         nt_status = netr_creds_server_step_check(pipe_state, r->in.credential, return_authenticator);
 633         NT_STATUS_NOT_OK_RETURN(nt_status);
 634
 635         ZERO_STRUCT(r2);
 636
 637         r2.in.server_name       = r->in.server_name;
 638         r2.in.workstation       = r->in.workstation;
 639         r2.in.logon_level       = r->in.logon_level;
 640         r2.in.logon             = r->in.logon;
 641         r2.in.validation_level  = r->in.validation_level;
 642         r2.in.flags             = r->in.flags;
 643
 644         nt_status = netr_LogonSamLogonEx(dce_call, mem_ctx, &r2);
 645
 646         r->out.return_authenticator     = return_authenticator;
 647         r->out.validation               = r2.out.validation;
 648         r->out.authoritative            = r2.out.authoritative;
 649         r->out.flags                    = r2.out.flags;
 650
 651         return nt_status;
 652 }
 653
 654 /*
 655   netr_LogonSamLogon
 656 */
 657 static NTSTATUS netr_LogonSamLogon(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 658                                    struct netr_LogonSamLogon *r)
 659 {
 660         struct netr_LogonSamLogonWithFlags r2;
 661         NTSTATUS status;
 662
 663         ZERO_STRUCT(r2);
 664
 665         r2.in.server_name = r->in.server_name;
 666         r2.in.workstation = r->in.workstation;
 667         r2.in.credential  = r->in.credential;
 668         r2.in.return_authenticator = r->in.return_authenticator;
 669         r2.in.logon_level = r->in.logon_level;
 670         r2.in.logon = r->in.logon;
 671         r2.in.validation_level = r->in.validation_level;
 672         r2.in.flags = 0;
 673
 674         status = netr_LogonSamLogonWithFlags(dce_call, mem_ctx, &r2);
 675
 676         r->out.return_authenticator = r2.out.return_authenticator;
 677         r->out.validation = r2.out.validation;
 678         r->out.authoritative = r2.out.authoritative;
 679
 680         return status;
 681 }
 682
 683
 684 /*
 685   netr_LogonSamLogoff
 686 */
 687 static NTSTATUS netr_LogonSamLogoff(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 688                        struct netr_LogonSamLogoff *r)
 689 {
 690         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 691 }
 692
 693
 694
 695 /*
 696   netr_DatabaseDeltas
 697 */
 698 static NTSTATUS netr_DatabaseDeltas(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 699                        struct netr_DatabaseDeltas *r)
 700 {
 701         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 702 }
 703
 704
 705 /*
 706   netr_DatabaseSync
 707 */
 708 static NTSTATUS netr_DatabaseSync(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 709                        struct netr_DatabaseSync *r)
 710 {
 711         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 712 }
 713
 714
 715 /*
 716   netr_AccountDeltas
 717 */
 718 static NTSTATUS netr_AccountDeltas(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 719                        struct netr_AccountDeltas *r)
 720 {
 721         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 722 }
 723
 724
 725 /*
 726   netr_AccountSync
 727 */
 728 static NTSTATUS netr_AccountSync(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 729                        struct netr_AccountSync *r)
 730 {
 731         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 732 }
 733
 734
 735 /*
 736   netr_GetDcName
 737 */
 738 static NTSTATUS netr_GetDcName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 739                        struct netr_GetDcName *r)
 740 {
 741         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 742 }
 743
 744
 745 /*
 746   netr_LogonControl
 747 */
 748 static WERROR netr_LogonControl(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 749                        struct netr_LogonControl *r)
 750 {
 751         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 752 }
 753
 754
 755 /*
 756   netr_GetAnyDCName
 757 */
 758 static WERROR netr_GetAnyDCName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 759                        struct netr_GetAnyDCName *r)
 760 {
 761         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 762 }
 763
 764
 765 /*
 766   netr_LogonControl2
 767 */
 768 static WERROR netr_LogonControl2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 769                        struct netr_LogonControl2 *r)
 770 {
 771         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 772 }
 773
 774
 775 /*
 776   netr_DatabaseSync2
 777 */
 778 static NTSTATUS netr_DatabaseSync2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 779                        struct netr_DatabaseSync2 *r)
 780 {
 781         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 782 }
 783
 784
 785 /*
 786   netr_DatabaseRedo
 787 */
 788 static NTSTATUS netr_DatabaseRedo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 789                        struct netr_DatabaseRedo *r)
 790 {
 791         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 792 }
 793
 794
 795 /*
 796   netr_LogonControl2Ex
 797 */
 798 static WERROR netr_LogonControl2Ex(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 799                        struct netr_LogonControl2Ex *r)
 800 {
 801         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 802 }
 803
 804
 805 /*
 806   netr_NETRENUMERATETRUSTEDDOMAINS
 807 */
 808 static WERROR netr_NETRENUMERATETRUSTEDDOMAINS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 809                        struct netr_NETRENUMERATETRUSTEDDOMAINS *r)
 810 {
 811         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 812 }
 813
 814
 815 /*
 816   netr_DSRGETDCNAME
 817 */
 818 static WERROR netr_DSRGETDCNAME(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 819                        struct netr_DSRGETDCNAME *r)
 820 {
 821         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 822 }
 823
 824
 825 /*
 826   netr_NETRLOGONDUMMYROUTINE1
 827 */
 828 static WERROR netr_NETRLOGONDUMMYROUTINE1(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 829                        struct netr_NETRLOGONDUMMYROUTINE1 *r)
 830 {
 831         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 832 }
 833
 834
 835 /*
 836   netr_NETRLOGONSETSERVICEBITS
 837 */
 838 static WERROR netr_NETRLOGONSETSERVICEBITS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 839                        struct netr_NETRLOGONSETSERVICEBITS *r)
 840 {
 841         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 842 }
 843
 844
 845 /*
 846   netr_NETRLOGONGETTRUSTRID
 847 */
 848 static WERROR netr_NETRLOGONGETTRUSTRID(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 849                        struct netr_NETRLOGONGETTRUSTRID *r)
 850 {
 851         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 852 }
 853
 854
 855 /*
 856   netr_NETRLOGONCOMPUTESERVERDIGEST
 857 */
 858 static WERROR netr_NETRLOGONCOMPUTESERVERDIGEST(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 859                        struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
 860 {
 861         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 862 }
 863
 864
 865 /*
 866   netr_NETRLOGONCOMPUTECLIENTDIGEST
 867 */
 868 static WERROR netr_NETRLOGONCOMPUTECLIENTDIGEST(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 869                        struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
 870 {
 871         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 872 }
 873
 874
 875 /*
 876   netr_DSRGETDCNAMEX
 877 */
 878 static WERROR netr_DSRGETDCNAMEX(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 879                        struct netr_DSRGETDCNAMEX *r)
 880 {
 881         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 882 }
 883
 884
 885 /*
 886   netr_DSRGETSITENAME
 887 */
 888 static WERROR netr_DSRGETSITENAME(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 889                        struct netr_DSRGETSITENAME *r)
 890 {
 891         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 892 }
 893
 894
 895 /*
 896   fill in a netr_DomainTrustInfo from a ldb search result
 897 */
 898 static NTSTATUS fill_domain_trust_info(TALLOC_CTX *mem_ctx, struct ldb_message *res,
 899                                        struct netr_DomainTrustInfo *info, BOOL is_local)
 900 {
 901         ZERO_STRUCTP(info);
 902
 903         if (is_local) {
 904                 info->domainname.string = samdb_result_string(res, "name", NULL);
 905                 info->fulldomainname.string = samdb_result_string(res, "dnsDomain", NULL);
 906                 info->guid = samdb_result_guid(res, "objectGUID");
 907                 info->sid = samdb_result_dom_sid(mem_ctx, res, "objectSid");
 908         } else {
 909                 info->domainname.string = samdb_result_string(res, "flatName", NULL);
 910                 info->fulldomainname.string = samdb_result_string(res, "name", NULL);
 911                 info->guid = samdb_result_guid(res, "objectGUID");
 912                 info->sid = samdb_result_dom_sid(mem_ctx, res, "securityIdentifier");
 913         }
 914
 915         /* TODO: we need proper forest support */
 916         info->forest.string = info->fulldomainname.string;
 917
 918         return NT_STATUS_OK;
 919 }
 920
 921 /*
 922   netr_LogonGetDomainInfo
 923   this is called as part of the ADS domain logon procedure.
 924 */
 925 static NTSTATUS netr_LogonGetDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 926                                         struct netr_LogonGetDomainInfo *r)
 927 {
 928         struct server_pipe_state *pipe_state = dce_call->context->private;
 929         const char * const attrs[] = { "name", "dnsDomain", "objectSid",
 930                                        "objectGUID", "flatName", "securityIdentifier",
 931                                        NULL };
 932         void *sam_ctx;
 933         struct ldb_message **res1, **res2;
 934         struct netr_DomainInfo1 *info1;
 935         int ret1, ret2, i;
 936         NTSTATUS status;
 937
 938         status = netr_creds_server_step_check(pipe_state,
 939                                               r->in.credential, r->out.return_authenticator);
 940         if (!NT_STATUS_IS_OK(status)) {
 941                 return status;
 942         }
 943
 944         sam_ctx = samdb_connect(mem_ctx);
 945         if (sam_ctx == NULL) {
 946                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 947         }
 948
 949         /* we need to do two searches. The first will pull our primary
 950            domain and the second will pull any trusted domains. Our
 951            primary domain is also a "trusted" domain, so we need to
 952            put the primary domain into the lists of returned trusts as
 953            well */
 954         ret1 = samdb_search(sam_ctx, mem_ctx, NULL, &res1, attrs, "(objectClass=domainDNS)");
 955         if (ret1 != 1) {
 956                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 957         }
 958
 959         ret2 = samdb_search(sam_ctx, mem_ctx, NULL, &res2, attrs, "(objectClass=trustedDomain)");
 960         if (ret2 == -1) {
 961                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 962         }
 963
 964         info1 = talloc(mem_ctx, struct netr_DomainInfo1);
 965         if (info1 == NULL) {
 966                 return NT_STATUS_NO_MEMORY;
 967         }
 968
 969         ZERO_STRUCTP(info1);
 970
 971         info1->num_trusts = ret2 + 1;
 972         info1->trusts = talloc_array(mem_ctx, struct netr_DomainTrustInfo,
 973                                        info1->num_trusts);
 974         if (info1->trusts == NULL) {
 975                 return NT_STATUS_NO_MEMORY;
 976         }
 977
 978         status = fill_domain_trust_info(mem_ctx, res1[0], &info1->domaininfo, True);
 979         if (!NT_STATUS_IS_OK(status)) {
 980                 return status;
 981         }
 982
 983         status = fill_domain_trust_info(mem_ctx, res1[0], &info1->trusts[0], True);
 984         if (!NT_STATUS_IS_OK(status)) {
 985                 return status;
 986         }
 987
 988         for (i=0;i<ret2;i++) {
 989                 status = fill_domain_trust_info(mem_ctx, res2[i], &info1->trusts[i+1], False);
 990                 if (!NT_STATUS_IS_OK(status)) {
 991                         return status;
 992                 }
 993         }
 994
 995         r->out.info.info1 = info1;
 996
 997         return NT_STATUS_OK;
 998 }
 999
1000
1001 /*
1002   netr_ServerPasswordSet2
1003 */
1004 static NTSTATUS netr_ServerPasswordSet2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1005                                        struct netr_ServerPasswordSet2 *r)
1006 {
1007         struct server_pipe_state *pipe_state = dce_call->context->private;
1008
1009         void *sam_ctx;
1010         int num_records;
1011         int num_records_domain;
1012         int ret;
1013         struct ldb_message **msgs;
1014         struct ldb_message **msgs_domain;
1015         NTSTATUS nt_status;
1016         struct ldb_message *mod;
1017         const char *domain_sid;
1018         char new_pass[512];
1019         uint32_t new_pass_len;
1020
1021         const char *attrs[] = {"objectSid", NULL };
1022
1023         const char **domain_attrs = attrs;
1024
1025         nt_status = netr_creds_server_step_check(pipe_state, &r->in.credential, &r->out.return_authenticator);
1026         NT_STATUS_NOT_OK_RETURN(nt_status);
1027
1028         sam_ctx = samdb_connect(mem_ctx);
1029         if (sam_ctx == NULL) {
1030                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
1031         }
1032         /* pull the user attributes */
1033         num_records = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
1034                                    "(&(sAMAccountName=%s)(objectclass=user))",
1035                                    pipe_state->creds->account_name);
1036         if (num_records == -1) {
1037                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1038         }
1039
1040         if (num_records == 0) {
1041                 DEBUG(3,("Couldn't find user [%s] in samdb.\n",
1042                          pipe_state->creds->account_name));
1043                 return NT_STATUS_NO_SUCH_USER;
1044         }
1045
1046         if (num_records > 1) {
1047                 DEBUG(0,("Found %d records matching user [%s]\n", num_records,
1048                          pipe_state->creds->account_name));
1049                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1050         }
1051
1052         domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
1053         if (!domain_sid) {
1054                 DEBUG(0,("no objectSid in user record\n"));
1055                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1056         }
1057
1058         /* find the domain's DN */
1059         num_records_domain = samdb_search(sam_ctx, mem_ctx, NULL,
1060                                           &msgs_domain, domain_attrs,
1061                                           "(&(objectSid=%s)(objectclass=domain))",
1062                                           domain_sid);
1063         if (num_records_domain == -1) {
1064                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1065         }
1066
1067         if (num_records_domain == 0) {
1068                 DEBUG(3,("Couldn't find domain [%s] in samdb.\n",
1069                          domain_sid));
1070                 return NT_STATUS_NO_SUCH_USER;
1071         }
1072
1073         if (num_records_domain > 1) {
1074                 DEBUG(0,("Found %d records matching domain [%s]\n",
1075                          num_records_domain, domain_sid));
1076                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1077         }
1078
1079         mod = talloc_zero(mem_ctx, struct ldb_message);
1080         NT_STATUS_HAVE_NO_MEMORY(mod);
1081         mod->dn = talloc_reference(mod, msgs[0]->dn);
1082
1083         creds_arcfour_crypt(pipe_state->creds, r->in.new_password.data, 516);
1084
1085         ret = decode_pw_buffer(r->in.new_password.data, new_pass, sizeof(new_pass),
1086                               &new_pass_len, STR_UNICODE);
1087         if (!ret) {
1088                 DEBUG(3,("netr_ServerPasswordSet2: failed to decode password buffer\n"));
1089                 return NT_STATUS_ACCESS_DENIED;
1090         }
1091
1092         /* set the password - samdb needs to know both the domain and user DNs,
1093            so the domain password policy can be used */
1094         nt_status = samdb_set_password(sam_ctx, mod,
1095                                        msgs[0]->dn,
1096                                        msgs_domain[0]->dn,
1097                                        mod, new_pass, /* we have plaintext */
1098                                        NULL, NULL,
1099                                        False, /* This is not considered a password change */
1100                                        False, /* don't restrict this password change (match w2k3) */
1101                                        NULL);
1102         ZERO_STRUCT(new_pass);
1103         NT_STATUS_NOT_OK_RETURN(nt_status);
1104
1105         ret = samdb_replace(sam_ctx, mem_ctx, mod);
1106         if (ret != 0) {
1107                 /* we really need samdb.c to return NTSTATUS */
1108                 return NT_STATUS_UNSUCCESSFUL;
1109         }
1110
1111         return NT_STATUS_OK;
1112 }
1113
1114
1115 /*
1116   netr_NETRSERVERPASSWORDGET
1117 */
1118 static WERROR netr_NETRSERVERPASSWORDGET(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1119                        struct netr_NETRSERVERPASSWORDGET *r)
1120 {
1121         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1122 }
1123
1124
1125 /*
1126   netr_NETRLOGONSENDTOSAM
1127 */
1128 static WERROR netr_NETRLOGONSENDTOSAM(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1129                        struct netr_NETRLOGONSENDTOSAM *r)
1130 {
1131         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1132 }
1133
1134
1135 /*
1136   netr_DSRADDRESSTOSITENAMESW
1137 */
1138 static WERROR netr_DSRADDRESSTOSITENAMESW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1139                        struct netr_DSRADDRESSTOSITENAMESW *r)
1140 {
1141         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1142 }
1143
1144
1145 /*
1146   netr_DrsGetDCNameEx2
1147 */
1148 static WERROR netr_DrsGetDCNameEx2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1149                        struct netr_DrsGetDCNameEx2 *r)
1150 {
1151         const char * const attrs[] = { "dnsDomain", "objectGUID", NULL };
1152         void *sam_ctx;
1153         struct ldb_message **res;
1154         int ret;
1155
1156         ZERO_STRUCT(r->out);
1157
1158         sam_ctx = samdb_connect(mem_ctx);
1159         if (sam_ctx == NULL) {
1160                 return WERR_DS_SERVICE_UNAVAILABLE;
1161         }
1162
1163         ret = samdb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
1164                                 "(&(objectClass=domainDNS)(dnsDomain=%s))",
1165                                 r->in.domain_name);
1166         if (ret != 1) {
1167                 return WERR_NO_SUCH_DOMAIN;
1168         }
1169
1170         r->out.info = talloc(mem_ctx, struct netr_DrsGetDCNameEx2Info);
1171         if (!r->out.info) {
1172                 return WERR_NOMEM;
1173         }
1174
1175         /* TODO: - return real IP address
1176          *       - check all r->in.* parameters (server_unc is ignored by w2k3!)
1177          */
1178         r->out.info->dc_unc             = talloc_asprintf(mem_ctx, "\\\\%s.%s", lp_netbios_name(),lp_realm());
1179         r->out.info->dc_address = talloc_strdup(mem_ctx, "\\\\0.0.0.0");
1180         r->out.info->dc_address_type    = 1;
1181         r->out.info->domain_guid        = samdb_result_guid(res[0], "objectGUID");
1182         r->out.info->domain_name        = samdb_result_string(res[0], "dnsDomain", NULL);
1183         r->out.info->forest_name        = samdb_result_string(res[0], "dnsDomain", NULL);
1184         r->out.info->dc_flags           = 0xE00001FD;
1185         r->out.info->dc_site_name       = talloc_strdup(mem_ctx, "Default-First-Site-Name");
1186         r->out.info->client_site_name   = talloc_strdup(mem_ctx, "Default-First-Site-Name");
1187
1188         return WERR_OK;
1189 }
1190
1191
1192 /*
1193   netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN
1194 */
1195 static WERROR netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1196                        struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1197 {
1198         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1199 }
1200
1201
1202 /*
1203   netr_NETRENUMERATETRUSTEDDOMAINSEX
1204 */
1205 static WERROR netr_NETRENUMERATETRUSTEDDOMAINSEX(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1206                        struct netr_NETRENUMERATETRUSTEDDOMAINSEX *r)
1207 {
1208         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1209 }
1210
1211
1212 /*
1213   netr_DSRADDRESSTOSITENAMESEXW
1214 */
1215 static WERROR netr_DSRADDRESSTOSITENAMESEXW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1216                        struct netr_DSRADDRESSTOSITENAMESEXW *r)
1217 {
1218         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1219 }
1220
1221
1222 /*
1223   netr_DSRGETDCSITECOVERAGEW
1224 */
1225 static WERROR netr_DSRGETDCSITECOVERAGEW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1226                        struct netr_DSRGETDCSITECOVERAGEW *r)
1227 {
1228         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1229 }
1230
1231
1232 /*
1233   netr_DsrEnumerateDomainTrusts
1234 */
1235 static WERROR netr_DsrEnumerateDomainTrusts(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1236                                               struct netr_DsrEnumerateDomainTrusts *r)
1237 {
1238         struct netr_DomainTrust *trusts;
1239         void *sam_ctx;
1240         int ret, i;
1241         struct ldb_message **res;
1242         const char * const attrs[] = { "name", "dnsDomain", "objectSid", "objectGUID", NULL };
1243
1244         ZERO_STRUCT(r->out);
1245
1246         sam_ctx = samdb_connect(mem_ctx);
1247         if (sam_ctx == NULL) {
1248                 return WERR_GENERAL_FAILURE;
1249         }
1250
1251         ret = samdb_search(sam_ctx, mem_ctx, NULL, &res, attrs, "(objectClass=domainDNS)");
1252         if (ret == -1) {
1253                 return WERR_GENERAL_FAILURE;
1254         }
1255
1256         if (ret == 0) {
1257                 return WERR_OK;
1258         }
1259
1260         trusts = talloc_array(mem_ctx, struct netr_DomainTrust, ret);
1261         if (trusts == NULL) {
1262                 return WERR_NOMEM;
1263         }
1264
1265         r->out.count = ret;
1266         r->out.trusts = trusts;
1267
1268         /* TODO: add filtering by trust_flags, and correct trust_type
1269            and attributes */
1270         for (i=0;i<ret;i++) {
1271                 trusts[i].netbios_name = samdb_result_string(res[i], "name", NULL);
1272                 trusts[i].dns_name     = samdb_result_string(res[i], "dnsDomain", NULL);
1273                 trusts[i].trust_flags =
1274                         NETR_TRUST_FLAG_TREEROOT |
1275                         NETR_TRUST_FLAG_IN_FOREST |
1276                         NETR_TRUST_FLAG_PRIMARY;
1277                 trusts[i].parent_index = 0;
1278                 trusts[i].trust_type = 2;
1279                 trusts[i].trust_attributes = 0;
1280                 trusts[i].sid  = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
1281                 trusts[i].guid = samdb_result_guid(res[i], "objectGUID");
1282         }
1283
1284
1285         return WERR_OK;
1286 }
1287
1288
1289 /*
1290   netr_DSRDEREGISTERDNSHOSTRECORDS
1291 */
1292 static WERROR netr_DSRDEREGISTERDNSHOSTRECORDS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1293                        struct netr_DSRDEREGISTERDNSHOSTRECORDS *r)
1294 {
1295         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1296 }
1297
1298
1299 /*
1300   netr_NETRSERVERTRUSTPASSWORDSGET
1301 */
1302 static WERROR netr_NETRSERVERTRUSTPASSWORDSGET(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1303                        struct netr_NETRSERVERTRUSTPASSWORDSGET *r)
1304 {
1305         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1306 }
1307
1308
1309 /*
1310   netr_DSRGETFORESTTRUSTINFORMATION
1311 */
1312 static WERROR netr_DSRGETFORESTTRUSTINFORMATION(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1313                        struct netr_DSRGETFORESTTRUSTINFORMATION *r)
1314 {
1315         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1316 }
1317
1318
1319 /*
1320   netr_NETRGETFORESTTRUSTINFORMATION
1321 */
1322 static WERROR netr_NETRGETFORESTTRUSTINFORMATION(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1323                        struct netr_NETRGETFORESTTRUSTINFORMATION *r)
1324 {
1325         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1326 }
1327
1328
1329 /*
1330   netr_NETRSERVERGETTRUSTINFO
1331 */
1332 static WERROR netr_NETRSERVERGETTRUSTINFO(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1333                        struct netr_NETRSERVERGETTRUSTINFO *r)
1334 {
1335         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1336 }
1337
1338
1339 /* include the generated boilerplate */
1340 #include "librpc/gen_ndr/ndr_netlogon_s.c"