source3/rpc_server/srv_netlog_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997.
   7  *  Copyright (C) Jeremy Allison               1998-2001.
   8  *  Copyright (C) Andrew Bartlett                   2001.
   9  *  Copyright (C) Guenther Deschner                 2008.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 3 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25 /* This is the implementation of the netlogon pipe. */
  26
  27 #include "includes.h"
  28 #include "../libcli/auth/libcli_auth.h"
  29 #include "../libcli/auth/schannel_state.h"
  30 #include "../libcli/auth/schannel.h"
  31
  32 extern userdom_struct current_user_info;
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_RPC_SRV
  36
  37 struct netlogon_server_pipe_state {
  38         struct netr_Credential client_challenge;
  39         struct netr_Credential server_challenge;
  40 };
  41
  42 /*************************************************************************
  43  _netr_LogonControl
  44  *************************************************************************/
  45
  46 WERROR _netr_LogonControl(pipes_struct *p,
  47                           struct netr_LogonControl *r)
  48 {
  49         struct netr_LogonControl2Ex l;
  50
  51         switch (r->in.level) {
  52         case 1:
  53                 break;
  54         case 2:
  55                 return WERR_NOT_SUPPORTED;
  56         default:
  57                 return WERR_UNKNOWN_LEVEL;
  58         }
  59
  60         l.in.logon_server       = r->in.logon_server;
  61         l.in.function_code      = r->in.function_code;
  62         l.in.level              = r->in.level;
  63         l.in.data               = NULL;
  64         l.out.query             = r->out.query;
  65
  66         return _netr_LogonControl2Ex(p, &l);
  67 }
  68
  69 /****************************************************************************
  70 Send a message to smbd to do a sam synchronisation
  71 **************************************************************************/
  72
  73 static void send_sync_message(void)
  74 {
  75         DEBUG(3, ("sending sam synchronisation message\n"));
  76         message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
  77                          NULL);
  78 }
  79
  80 /*************************************************************************
  81  _netr_LogonControl2
  82  *************************************************************************/
  83
  84 WERROR _netr_LogonControl2(pipes_struct *p,
  85                            struct netr_LogonControl2 *r)
  86 {
  87         struct netr_LogonControl2Ex l;
  88
  89         l.in.logon_server       = r->in.logon_server;
  90         l.in.function_code      = r->in.function_code;
  91         l.in.level              = r->in.level;
  92         l.in.data               = r->in.data;
  93         l.out.query             = r->out.query;
  94
  95         return _netr_LogonControl2Ex(p, &l);
  96 }
  97
  98 /****************************************************************
  99  _netr_LogonControl2Ex
 100 ****************************************************************/
 101
 102 WERROR _netr_LogonControl2Ex(pipes_struct *p,
 103                              struct netr_LogonControl2Ex *r)
 104 {
 105         uint32_t flags = 0x0;
 106         WERROR pdc_connection_status = WERR_OK;
 107         uint32_t logon_attempts = 0x0;
 108         WERROR tc_status;
 109         fstring dc_name2;
 110         const char *dc_name = NULL;
 111         struct sockaddr_storage dc_ss;
 112         const char *domain = NULL;
 113         struct netr_NETLOGON_INFO_1 *info1;
 114         struct netr_NETLOGON_INFO_2 *info2;
 115         struct netr_NETLOGON_INFO_3 *info3;
 116         const char *fn;
 117
 118         switch (p->hdr_req.opnum) {
 119         case NDR_NETR_LOGONCONTROL:
 120                 fn = "_netr_LogonControl";
 121                 break;
 122         case NDR_NETR_LOGONCONTROL2:
 123                 fn = "_netr_LogonControl2";
 124                 break;
 125         case NDR_NETR_LOGONCONTROL2EX:
 126                 fn = "_netr_LogonControl2Ex";
 127                 break;
 128         default:
 129                 return WERR_INVALID_PARAM;
 130         }
 131
 132         tc_status = WERR_NO_SUCH_DOMAIN;
 133
 134         switch (r->in.function_code) {
 135         case NETLOGON_CONTROL_TC_QUERY:
 136                 domain = r->in.data->domain;
 137
 138                 if (!is_trusted_domain(domain)) {
 139                         break;
 140                 }
 141
 142                 if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
 143                         tc_status = WERR_NO_LOGON_SERVERS;
 144                         break;
 145                 }
 146
 147                 dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
 148                 if (!dc_name) {
 149                         return WERR_NOMEM;
 150                 }
 151
 152                 tc_status = WERR_OK;
 153
 154                 break;
 155
 156         case NETLOGON_CONTROL_REDISCOVER:
 157                 domain = r->in.data->domain;
 158
 159                 if (!is_trusted_domain(domain)) {
 160                         break;
 161                 }
 162
 163                 if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
 164                         tc_status = WERR_NO_LOGON_SERVERS;
 165                         break;
 166                 }
 167
 168                 dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
 169                 if (!dc_name) {
 170                         return WERR_NOMEM;
 171                 }
 172
 173                 tc_status = WERR_OK;
 174
 175                 break;
 176
 177         default:
 178                 /* no idea what this should be */
 179                 DEBUG(0,("%s: unimplemented function level [%d]\n",
 180                         fn, r->in.function_code));
 181                 return WERR_UNKNOWN_LEVEL;
 182         }
 183
 184         /* prepare the response */
 185
 186         switch (r->in.level) {
 187         case 1:
 188                 info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
 189                 W_ERROR_HAVE_NO_MEMORY(info1);
 190
 191                 info1->flags                    = flags;
 192                 info1->pdc_connection_status    = pdc_connection_status;
 193
 194                 r->out.query->info1 = info1;
 195                 break;
 196         case 2:
 197                 info2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_2);
 198                 W_ERROR_HAVE_NO_MEMORY(info2);
 199
 200                 info2->flags                    = flags;
 201                 info2->pdc_connection_status    = pdc_connection_status;
 202                 info2->trusted_dc_name          = dc_name;
 203                 info2->tc_connection_status     = tc_status;
 204
 205                 r->out.query->info2 = info2;
 206                 break;
 207         case 3:
 208                 info3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_3);
 209                 W_ERROR_HAVE_NO_MEMORY(info3);
 210
 211                 info3->flags                    = flags;
 212                 info3->logon_attempts           = logon_attempts;
 213
 214                 r->out.query->info3 = info3;
 215                 break;
 216         default:
 217                 return WERR_UNKNOWN_LEVEL;
 218         }
 219
 220         if (lp_server_role() == ROLE_DOMAIN_BDC) {
 221                 send_sync_message();
 222         }
 223
 224         return WERR_OK;
 225 }
 226
 227 /*************************************************************************
 228  _netr_NetrEnumerateTrustedDomains
 229  *************************************************************************/
 230
 231 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
 232                                          struct netr_NetrEnumerateTrustedDomains *r)
 233 {
 234         NTSTATUS status;
 235         DATA_BLOB blob;
 236         struct trustdom_info **domains;
 237         uint32_t num_domains;
 238         const char **trusted_domains;
 239         int i;
 240
 241         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 242
 243         /* set up the Trusted Domain List response */
 244
 245         become_root();
 246         status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
 247         unbecome_root();
 248
 249         if (!NT_STATUS_IS_OK(status)) {
 250                 return ntstatus_to_werror(status);
 251         }
 252
 253         trusted_domains = talloc_zero_array(p->mem_ctx, const char *, num_domains + 1);
 254         if (!trusted_domains) {
 255                 return WERR_NOMEM;
 256         }
 257
 258         for (i = 0; i < num_domains; i++) {
 259                 trusted_domains[i] = talloc_strdup(trusted_domains, domains[i]->name);
 260                 if (!trusted_domains[i]) {
 261                         TALLOC_FREE(trusted_domains);
 262                         return WERR_NOMEM;
 263                 }
 264         }
 265
 266         if (!push_reg_multi_sz(trusted_domains, &blob, trusted_domains)) {
 267                 TALLOC_FREE(trusted_domains);
 268                 return WERR_NOMEM;
 269         }
 270
 271         r->out.trusted_domains_blob->data = blob.data;
 272         r->out.trusted_domains_blob->length = blob.length;
 273
 274         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 275
 276         return WERR_OK;
 277 }
 278
 279 /******************************************************************
 280  gets a machine password entry.  checks access rights of the host.
 281  ******************************************************************/
 282
 283 static NTSTATUS get_md4pw(struct samr_Password *md4pw, const char *mach_acct,
 284                           enum netr_SchannelType sec_chan_type, struct dom_sid *sid)
 285 {
 286         struct samu *sampass = NULL;
 287         const uint8 *pass;
 288         bool ret;
 289         uint32 acct_ctrl;
 290
 291 #if 0
 292         char addr[INET6_ADDRSTRLEN];
 293
 294     /*
 295      * Currently this code is redundent as we already have a filter
 296      * by hostname list. What this code really needs to do is to
 297      * get a hosts allowed/hosts denied list from the SAM database
 298      * on a per user basis, and make the access decision there.
 299      * I will leave this code here for now as a reminder to implement
 300      * this at a later date. JRA.
 301      */
 302
 303         if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
 304                         client_name(get_client_fd()),
 305                         client_addr(get_client_fd(),addr,sizeof(addr)))) {
 306                 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
 307                 return False;
 308         }
 309 #endif /* 0 */
 310
 311         if ( !(sampass = samu_new( NULL )) ) {
 312                 return NT_STATUS_NO_MEMORY;
 313         }
 314
 315         /* JRA. This is ok as it is only used for generating the challenge. */
 316         become_root();
 317         ret = pdb_getsampwnam(sampass, mach_acct);
 318         unbecome_root();
 319
 320         if (!ret) {
 321                 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
 322                 TALLOC_FREE(sampass);
 323                 return NT_STATUS_ACCESS_DENIED;
 324         }
 325
 326         acct_ctrl = pdb_get_acct_ctrl(sampass);
 327         if (acct_ctrl & ACB_DISABLED) {
 328                 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
 329                 TALLOC_FREE(sampass);
 330                 return NT_STATUS_ACCOUNT_DISABLED;
 331         }
 332
 333         if (!(acct_ctrl & ACB_SVRTRUST) &&
 334             !(acct_ctrl & ACB_WSTRUST) &&
 335             !(acct_ctrl & ACB_DOMTRUST))
 336         {
 337                 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
 338                 TALLOC_FREE(sampass);
 339                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 340         }
 341
 342         switch (sec_chan_type) {
 343                 case SEC_CHAN_BDC:
 344                         if (!(acct_ctrl & ACB_SVRTRUST)) {
 345                                 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
 346                                          "but not a server trust account\n", mach_acct));
 347                                 TALLOC_FREE(sampass);
 348                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 349                         }
 350                         break;
 351                 case SEC_CHAN_WKSTA:
 352                         if (!(acct_ctrl & ACB_WSTRUST)) {
 353                                 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
 354                                          "but not a workstation trust account\n", mach_acct));
 355                                 TALLOC_FREE(sampass);
 356                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 357                         }
 358                         break;
 359                 case SEC_CHAN_DOMAIN:
 360                         if (!(acct_ctrl & ACB_DOMTRUST)) {
 361                                 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
 362                                          "but not a interdomain trust account\n", mach_acct));
 363                                 TALLOC_FREE(sampass);
 364                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 365                         }
 366                         break;
 367                 default:
 368                         break;
 369         }
 370
 371         if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
 372                 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
 373                 TALLOC_FREE(sampass);
 374                 return NT_STATUS_LOGON_FAILURE;
 375         }
 376
 377         memcpy(md4pw->hash, pass, 16);
 378         dump_data(5, md4pw->hash, 16);
 379
 380         sid_copy(sid, pdb_get_user_sid(sampass));
 381
 382         TALLOC_FREE(sampass);
 383
 384         return NT_STATUS_OK;
 385
 386
 387 }
 388
 389 /*************************************************************************
 390  _netr_ServerReqChallenge
 391  *************************************************************************/
 392
 393 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
 394                                   struct netr_ServerReqChallenge *r)
 395 {
 396         struct netlogon_server_pipe_state *pipe_state =
 397                 talloc_get_type(p->private_data, struct netlogon_server_pipe_state);
 398
 399         if (pipe_state) {
 400                 DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
 401                 talloc_free(pipe_state);
 402                 p->private_data = NULL;
 403         }
 404
 405         pipe_state = talloc(p, struct netlogon_server_pipe_state);
 406         NT_STATUS_HAVE_NO_MEMORY(pipe_state);
 407
 408         pipe_state->client_challenge = *r->in.credentials;
 409
 410         generate_random_buffer(pipe_state->server_challenge.data,
 411                                sizeof(pipe_state->server_challenge.data));
 412
 413         *r->out.return_credentials = pipe_state->server_challenge;
 414
 415         p->private_data = pipe_state;
 416
 417         return NT_STATUS_OK;
 418 }
 419
 420 /*************************************************************************
 421  _netr_ServerAuthenticate
 422  Create the initial credentials.
 423  *************************************************************************/
 424
 425 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
 426                                   struct netr_ServerAuthenticate *r)
 427 {
 428         struct netr_ServerAuthenticate3 a;
 429         uint32_t negotiate_flags = 0;
 430         uint32_t rid;
 431
 432         a.in.server_name                = r->in.server_name;
 433         a.in.account_name               = r->in.account_name;
 434         a.in.secure_channel_type        = r->in.secure_channel_type;
 435         a.in.computer_name              = r->in.computer_name;
 436         a.in.credentials                = r->in.credentials;
 437         a.in.negotiate_flags            = &negotiate_flags;
 438
 439         a.out.return_credentials        = r->out.return_credentials;
 440         a.out.rid                       = &rid;
 441         a.out.negotiate_flags           = &negotiate_flags;
 442
 443         return _netr_ServerAuthenticate3(p, &a);
 444
 445 }
 446
 447 /*************************************************************************
 448  _netr_ServerAuthenticate3
 449  *************************************************************************/
 450
 451 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
 452                                    struct netr_ServerAuthenticate3 *r)
 453 {
 454         NTSTATUS status;
 455         uint32_t srv_flgs;
 456         /* r->in.negotiate_flags is an aliased pointer to r->out.negotiate_flags,
 457          * so use a copy to avoid destroying the client values. */
 458         uint32_t in_neg_flags = *r->in.negotiate_flags;
 459         const char *fn;
 460         struct dom_sid sid;
 461         struct samr_Password mach_pwd;
 462         struct netlogon_creds_CredentialState *creds;
 463         struct netlogon_server_pipe_state *pipe_state =
 464                 talloc_get_type(p->private_data, struct netlogon_server_pipe_state);
 465
 466         /* According to Microsoft (see bugid #6099)
 467          * Windows 7 looks at the negotiate_flags
 468          * returned in this structure *even if the
 469          * call fails with access denied* ! So in order
 470          * to allow Win7 to connect to a Samba NT style
 471          * PDC we set the flags before we know if it's
 472          * an error or not.
 473          */
 474
 475         /* 0x000001ff */
 476         srv_flgs = NETLOGON_NEG_ACCOUNT_LOCKOUT |
 477                    NETLOGON_NEG_PERSISTENT_SAMREPL |
 478                    NETLOGON_NEG_ARCFOUR |
 479                    NETLOGON_NEG_PROMOTION_COUNT |
 480                    NETLOGON_NEG_CHANGELOG_BDC |
 481                    NETLOGON_NEG_FULL_SYNC_REPL |
 482                    NETLOGON_NEG_MULTIPLE_SIDS |
 483                    NETLOGON_NEG_REDO |
 484                    NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL |
 485                    NETLOGON_NEG_PASSWORD_SET2;
 486
 487         /* Ensure we support strong (128-bit) keys. */
 488         if (in_neg_flags & NETLOGON_NEG_STRONG_KEYS) {
 489                 srv_flgs |= NETLOGON_NEG_STRONG_KEYS;
 490         }
 491
 492         if (lp_server_schannel() != false) {
 493                 srv_flgs |= NETLOGON_NEG_SCHANNEL;
 494         }
 495
 496         switch (p->hdr_req.opnum) {
 497                 case NDR_NETR_SERVERAUTHENTICATE:
 498                         fn = "_netr_ServerAuthenticate";
 499                         break;
 500                 case NDR_NETR_SERVERAUTHENTICATE2:
 501                         fn = "_netr_ServerAuthenticate2";
 502                         break;
 503                 case NDR_NETR_SERVERAUTHENTICATE3:
 504                         fn = "_netr_ServerAuthenticate3";
 505                         break;
 506                 default:
 507                         return NT_STATUS_INTERNAL_ERROR;
 508         }
 509
 510         /* We use this as the key to store the creds: */
 511         /* r->in.computer_name */
 512
 513         if (!pipe_state) {
 514                 DEBUG(0,("%s: no challenge sent to client %s\n", fn,
 515                         r->in.computer_name));
 516                 status = NT_STATUS_ACCESS_DENIED;
 517                 goto out;
 518         }
 519
 520         if ( (lp_server_schannel() == true) &&
 521              ((in_neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
 522
 523                 /* schannel must be used, but client did not offer it. */
 524                 DEBUG(0,("%s: schannel required but client failed "
 525                         "to offer it. Client was %s\n",
 526                         fn, r->in.account_name));
 527                 status = NT_STATUS_ACCESS_DENIED;
 528                 goto out;
 529         }
 530
 531         status = get_md4pw(&mach_pwd,
 532                            r->in.account_name,
 533                            r->in.secure_channel_type,
 534                            &sid);
 535         if (!NT_STATUS_IS_OK(status)) {
 536                 DEBUG(0,("%s: failed to get machine password for "
 537                         "account %s: %s\n",
 538                         fn, r->in.account_name, nt_errstr(status) ));
 539                 /* always return NT_STATUS_ACCESS_DENIED */
 540                 status = NT_STATUS_ACCESS_DENIED;
 541                 goto out;
 542         }
 543
 544         /* From the client / server challenges and md4 password, generate sess key */
 545         /* Check client credentials are valid. */
 546         creds = netlogon_creds_server_init(p->mem_ctx,
 547                                            r->in.account_name,
 548                                            r->in.computer_name,
 549                                            r->in.secure_channel_type,
 550                                            &pipe_state->client_challenge,
 551                                            &pipe_state->server_challenge,
 552                                            &mach_pwd,
 553                                            r->in.credentials,
 554                                            r->out.return_credentials,
 555                                            *r->in.negotiate_flags);
 556         if (!creds) {
 557                 DEBUG(0,("%s: netlogon_creds_server_check failed. Rejecting auth "
 558                         "request from client %s machine account %s\n",
 559                         fn, r->in.computer_name,
 560                         r->in.account_name));
 561                 status = NT_STATUS_ACCESS_DENIED;
 562                 goto out;
 563         }
 564
 565         creds->sid = sid_dup_talloc(creds, &sid);
 566         if (!creds->sid) {
 567                 status = NT_STATUS_NO_MEMORY;
 568                 goto out;
 569         }
 570
 571         /* Store off the state so we can continue after client disconnect. */
 572         become_root();
 573         status = schannel_store_session_key(p->mem_ctx, creds);
 574         unbecome_root();
 575
 576         if (!NT_STATUS_IS_OK(status)) {
 577                 goto out;
 578         }
 579
 580         sid_peek_rid(&sid, r->out.rid);
 581
 582         status = NT_STATUS_OK;
 583
 584   out:
 585
 586         *r->out.negotiate_flags = srv_flgs;
 587         return status;
 588 }
 589
 590 /*************************************************************************
 591  _netr_ServerAuthenticate2
 592  *************************************************************************/
 593
 594 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
 595                                    struct netr_ServerAuthenticate2 *r)
 596 {
 597         struct netr_ServerAuthenticate3 a;
 598         uint32_t rid;
 599
 600         a.in.server_name                = r->in.server_name;
 601         a.in.account_name               = r->in.account_name;
 602         a.in.secure_channel_type        = r->in.secure_channel_type;
 603         a.in.computer_name              = r->in.computer_name;
 604         a.in.credentials                = r->in.credentials;
 605         a.in.negotiate_flags            = r->in.negotiate_flags;
 606
 607         a.out.return_credentials        = r->out.return_credentials;
 608         a.out.rid                       = &rid;
 609         a.out.negotiate_flags           = r->out.negotiate_flags;
 610
 611         return _netr_ServerAuthenticate3(p, &a);
 612 }
 613
 614 /*************************************************************************
 615  *************************************************************************/
 616
 617 static NTSTATUS netr_creds_server_step_check(pipes_struct *p,
 618                                              TALLOC_CTX *mem_ctx,
 619                                              const char *computer_name,
 620                                              struct netr_Authenticator *received_authenticator,
 621                                              struct netr_Authenticator *return_authenticator,
 622                                              struct netlogon_creds_CredentialState **creds_out)
 623 {
 624         NTSTATUS status;
 625         struct tdb_context *tdb;
 626         bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
 627         bool schannel_in_use = (p->auth.auth_type == PIPE_AUTH_TYPE_SCHANNEL) ? true:false; /* &&
 628                 (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY ||
 629                  p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY); */
 630
 631         tdb = open_schannel_session_store(mem_ctx);
 632         if (!tdb) {
 633                 return NT_STATUS_ACCESS_DENIED;
 634         }
 635
 636         status = schannel_creds_server_step_check_tdb(tdb, mem_ctx,
 637                                                       computer_name,
 638                                                       schannel_global_required,
 639                                                       schannel_in_use,
 640                                                       received_authenticator,
 641                                                       return_authenticator,
 642                                                       creds_out);
 643         tdb_close(tdb);
 644
 645         return status;
 646 }
 647
 648 /*************************************************************************
 649  *************************************************************************/
 650
 651 static NTSTATUS netr_find_machine_account(TALLOC_CTX *mem_ctx,
 652                                           const char *account_name,
 653                                           struct samu **sampassp)
 654 {
 655         struct samu *sampass;
 656         bool ret = false;
 657         uint32_t acct_ctrl;
 658
 659         sampass = samu_new(mem_ctx);
 660         if (!sampass) {
 661                 return NT_STATUS_NO_MEMORY;
 662         }
 663
 664         become_root();
 665         ret = pdb_getsampwnam(sampass, account_name);
 666         unbecome_root();
 667
 668         if (!ret) {
 669                 TALLOC_FREE(sampass);
 670                 return NT_STATUS_ACCESS_DENIED;
 671         }
 672
 673         /* Ensure the account exists and is a machine account. */
 674
 675         acct_ctrl = pdb_get_acct_ctrl(sampass);
 676
 677         if (!(acct_ctrl & ACB_WSTRUST ||
 678               acct_ctrl & ACB_SVRTRUST ||
 679               acct_ctrl & ACB_DOMTRUST)) {
 680                 TALLOC_FREE(sampass);
 681                 return NT_STATUS_NO_SUCH_USER;
 682         }
 683
 684         if (acct_ctrl & ACB_DISABLED) {
 685                 TALLOC_FREE(sampass);
 686                 return NT_STATUS_ACCOUNT_DISABLED;
 687         }
 688
 689         *sampassp = sampass;
 690
 691         return NT_STATUS_OK;
 692 }
 693
 694 /*************************************************************************
 695  *************************************************************************/
 696
 697 static NTSTATUS netr_set_machine_account_password(TALLOC_CTX *mem_ctx,
 698                                                   struct samu *sampass,
 699                                                   DATA_BLOB *plaintext_blob,
 700                                                   struct samr_Password *nt_hash,
 701                                                   struct samr_Password *lm_hash)
 702 {
 703         NTSTATUS status;
 704         const uchar *old_pw;
 705         const char *plaintext = NULL;
 706         size_t plaintext_len;
 707         struct samr_Password nt_hash_local;
 708
 709         if (!sampass) {
 710                 return NT_STATUS_INVALID_PARAMETER;
 711         }
 712
 713         if (plaintext_blob) {
 714                 if (!convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX,
 715                                            plaintext_blob->data, plaintext_blob->length,
 716                                            &plaintext, &plaintext_len, false))
 717                 {
 718                         plaintext = NULL;
 719                         mdfour(nt_hash_local.hash, plaintext_blob->data, plaintext_blob->length);
 720                         nt_hash = &nt_hash_local;
 721                 }
 722         }
 723
 724         if (plaintext) {
 725                 if (!pdb_set_plaintext_passwd(sampass, plaintext)) {
 726                         return NT_STATUS_ACCESS_DENIED;
 727                 }
 728
 729                 goto done;
 730         }
 731
 732         if (nt_hash) {
 733                 old_pw = pdb_get_nt_passwd(sampass);
 734
 735                 if (old_pw && memcmp(nt_hash->hash, old_pw, 16) == 0) {
 736                         /* Avoid backend modificiations and other fun if the
 737                            client changed the password to the *same thing* */
 738                 } else {
 739                         /* LM password should be NULL for machines */
 740                         if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
 741                                 return NT_STATUS_NO_MEMORY;
 742                         }
 743                         if (!pdb_set_nt_passwd(sampass, nt_hash->hash, PDB_CHANGED)) {
 744                                 return NT_STATUS_NO_MEMORY;
 745                         }
 746
 747                         if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
 748                                 /* Not quite sure what this one qualifies as, but this will do */
 749                                 return NT_STATUS_UNSUCCESSFUL;
 750                         }
 751                 }
 752         }
 753
 754  done:
 755         become_root();
 756         status = pdb_update_sam_account(sampass);
 757         unbecome_root();
 758
 759         return status;
 760 }
 761
 762 /*************************************************************************
 763  _netr_ServerPasswordSet
 764  *************************************************************************/
 765
 766 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
 767                                  struct netr_ServerPasswordSet *r)
 768 {
 769         NTSTATUS status = NT_STATUS_OK;
 770         struct samu *sampass=NULL;
 771         int i;
 772         struct netlogon_creds_CredentialState *creds;
 773
 774         DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
 775
 776         become_root();
 777         status = netr_creds_server_step_check(p, p->mem_ctx,
 778                                               r->in.computer_name,
 779                                               r->in.credential,
 780                                               r->out.return_authenticator,
 781                                               &creds);
 782         unbecome_root();
 783
 784         if (!NT_STATUS_IS_OK(status)) {
 785                 DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
 786                         "request from client %s machine account %s\n",
 787                         r->in.computer_name, creds->computer_name));
 788                 TALLOC_FREE(creds);
 789                 return status;
 790         }
 791
 792         DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
 793                         r->in.computer_name, creds->computer_name));
 794
 795         netlogon_creds_des_decrypt(creds, r->in.new_password);
 796
 797         DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
 798         for(i = 0; i < sizeof(r->in.new_password->hash); i++)
 799                 DEBUG(100,("%02X ", r->in.new_password->hash[i]));
 800         DEBUG(100,("\n"));
 801
 802         status = netr_find_machine_account(p->mem_ctx,
 803                                            creds->account_name,
 804                                            &sampass);
 805         if (!NT_STATUS_IS_OK(status)) {
 806                 return status;
 807         }
 808
 809         status = netr_set_machine_account_password(sampass,
 810                                                    sampass,
 811                                                    NULL,
 812                                                    r->in.new_password,
 813                                                    NULL);
 814         TALLOC_FREE(sampass);
 815         return status;
 816 }
 817
 818 /****************************************************************
 819  _netr_ServerPasswordSet2
 820 ****************************************************************/
 821
 822 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
 823                                   struct netr_ServerPasswordSet2 *r)
 824 {
 825         NTSTATUS status;
 826         struct netlogon_creds_CredentialState *creds;
 827         struct samu *sampass;
 828         DATA_BLOB plaintext;
 829         struct samr_CryptPassword password_buf;
 830         struct samr_Password nt_hash;
 831
 832         become_root();
 833         status = netr_creds_server_step_check(p, p->mem_ctx,
 834                                               r->in.computer_name,
 835                                               r->in.credential,
 836                                               r->out.return_authenticator,
 837                                               &creds);
 838         unbecome_root();
 839
 840         if (!NT_STATUS_IS_OK(status)) {
 841                 DEBUG(2,("_netr_ServerPasswordSet2: netlogon_creds_server_step "
 842                         "failed. Rejecting auth request from client %s machine account %s\n",
 843                         r->in.computer_name, creds->computer_name));
 844                 TALLOC_FREE(creds);
 845                 return status;
 846         }
 847
 848         memcpy(password_buf.data, r->in.new_password->data, 512);
 849         SIVAL(password_buf.data, 512, r->in.new_password->length);
 850         netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
 851
 852         if (!extract_pw_from_buffer(p->mem_ctx, password_buf.data, &plaintext)) {
 853                 return NT_STATUS_WRONG_PASSWORD;
 854         }
 855
 856         mdfour(nt_hash.hash, plaintext.data, plaintext.length);
 857
 858         status = netr_find_machine_account(p->mem_ctx,
 859                                            creds->account_name,
 860                                            &sampass);
 861         if (!NT_STATUS_IS_OK(status)) {
 862                 return status;
 863         }
 864
 865         status = netr_set_machine_account_password(sampass,
 866                                                    sampass,
 867                                                    NULL,
 868                                                    &nt_hash,
 869                                                    NULL);
 870         TALLOC_FREE(sampass);
 871         return status;
 872 }
 873
 874 /*************************************************************************
 875  _netr_LogonSamLogoff
 876  *************************************************************************/
 877
 878 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
 879                               struct netr_LogonSamLogoff *r)
 880 {
 881         NTSTATUS status;
 882         struct netlogon_creds_CredentialState *creds;
 883
 884         become_root();
 885         status = netr_creds_server_step_check(p, p->mem_ctx,
 886                                               r->in.computer_name,
 887                                               r->in.credential,
 888                                               r->out.return_authenticator,
 889                                               &creds);
 890         unbecome_root();
 891
 892         return status;
 893 }
 894
 895 /*************************************************************************
 896  _netr_LogonSamLogon_base
 897  *************************************************************************/
 898
 899 static NTSTATUS _netr_LogonSamLogon_base(pipes_struct *p,
 900                                          struct netr_LogonSamLogonEx *r,
 901                                          struct netlogon_creds_CredentialState *creds)
 902 {
 903         NTSTATUS status = NT_STATUS_OK;
 904         union netr_LogonLevel *logon = r->in.logon;
 905         const char *nt_username, *nt_domain, *nt_workstation;
 906         auth_usersupplied_info *user_info = NULL;
 907         auth_serversupplied_info *server_info = NULL;
 908         struct auth_context *auth_context = NULL;
 909         uint8_t pipe_session_key[16];
 910         bool process_creds = true;
 911         const char *fn;
 912
 913         switch (p->hdr_req.opnum) {
 914                 case NDR_NETR_LOGONSAMLOGON:
 915                         process_creds = true;
 916                         fn = "_netr_LogonSamLogon";
 917                         break;
 918                 case NDR_NETR_LOGONSAMLOGONWITHFLAGS:
 919                         process_creds = true;
 920                         fn = "_netr_LogonSamLogonWithFlags";
 921                         break;
 922                 case NDR_NETR_LOGONSAMLOGONEX:
 923                         process_creds = false;
 924                         fn = "_netr_LogonSamLogonEx";
 925                         break;
 926                 default:
 927                         return NT_STATUS_INTERNAL_ERROR;
 928         }
 929
 930         *r->out.authoritative = true; /* authoritative response */
 931
 932         switch (r->in.validation_level) {
 933         case 2:
 934                 r->out.validation->sam2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo2);
 935                 if (!r->out.validation->sam2) {
 936                         return NT_STATUS_NO_MEMORY;
 937                 }
 938                 break;
 939         case 3:
 940                 r->out.validation->sam3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo3);
 941                 if (!r->out.validation->sam3) {
 942                         return NT_STATUS_NO_MEMORY;
 943                 }
 944                 break;
 945         case 6:
 946                 r->out.validation->sam6 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo6);
 947                 if (!r->out.validation->sam6) {
 948                         return NT_STATUS_NO_MEMORY;
 949                 }
 950                 break;
 951         default:
 952                 DEBUG(0,("%s: bad validation_level value %d.\n",
 953                         fn, (int)r->in.validation_level));
 954                 return NT_STATUS_INVALID_INFO_CLASS;
 955         }
 956
 957         switch (r->in.logon_level) {
 958         case NetlogonInteractiveInformation:
 959         case NetlogonServiceInformation:
 960         case NetlogonInteractiveTransitiveInformation:
 961         case NetlogonServiceTransitiveInformation:
 962                 nt_username     = logon->password->identity_info.account_name.string;
 963                 nt_domain       = logon->password->identity_info.domain_name.string;
 964                 nt_workstation  = logon->password->identity_info.workstation.string;
 965
 966                 DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
 967                 break;
 968         case NetlogonNetworkInformation:
 969         case NetlogonNetworkTransitiveInformation:
 970                 nt_username     = logon->network->identity_info.account_name.string;
 971                 nt_domain       = logon->network->identity_info.domain_name.string;
 972                 nt_workstation  = logon->network->identity_info.workstation.string;
 973
 974                 DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
 975                 break;
 976         default:
 977                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 978                 return NT_STATUS_INVALID_INFO_CLASS;
 979         } /* end switch */
 980
 981         DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
 982         fstrcpy(current_user_info.smb_name, nt_username);
 983         sub_set_smb_name(nt_username);
 984
 985         DEBUG(5,("Attempting validation level %d for unmapped username %s.\n",
 986                 r->in.validation_level, nt_username));
 987
 988         status = NT_STATUS_OK;
 989
 990         switch (r->in.logon_level) {
 991         case NetlogonNetworkInformation:
 992         case NetlogonNetworkTransitiveInformation:
 993         {
 994                 const char *wksname = nt_workstation;
 995
 996                 status = make_auth_context_fixed(&auth_context,
 997                                                  logon->network->challenge);
 998                 if (!NT_STATUS_IS_OK(status)) {
 999                         return status;
1000                 }
1001
1002                 /* For a network logon, the workstation name comes in with two
1003                  * backslashes in the front. Strip them if they are there. */
1004
1005                 if (*wksname == '\\') wksname++;
1006                 if (*wksname == '\\') wksname++;
1007
1008                 /* Standard challenge/response authenticaion */
1009                 if (!make_user_info_netlogon_network(&user_info,
1010                                                      nt_username, nt_domain,
1011                                                      wksname,
1012                                                      logon->network->identity_info.parameter_control,
1013                                                      logon->network->lm.data,
1014                                                      logon->network->lm.length,
1015                                                      logon->network->nt.data,
1016                                                      logon->network->nt.length)) {
1017                         status = NT_STATUS_NO_MEMORY;
1018                 }
1019                 break;
1020         }
1021         case NetlogonInteractiveInformation:
1022         case NetlogonServiceInformation:
1023         case NetlogonInteractiveTransitiveInformation:
1024         case NetlogonServiceTransitiveInformation:
1025
1026                 /* 'Interactive' authentication, supplies the password in its
1027                    MD4 form, encrypted with the session key.  We will convert
1028                    this to challenge/response for the auth subsystem to chew
1029                    on */
1030         {
1031                 uint8_t chal[8];
1032
1033                 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
1034                         return status;
1035                 }
1036
1037                 auth_context->get_ntlm_challenge(auth_context, chal);
1038
1039                 if (!make_user_info_netlogon_interactive(&user_info,
1040                                                          nt_username, nt_domain,
1041                                                          nt_workstation,
1042                                                          logon->password->identity_info.parameter_control,
1043                                                          chal,
1044                                                          logon->password->lmpassword.hash,
1045                                                          logon->password->ntpassword.hash,
1046                                                          creds->session_key)) {
1047                         status = NT_STATUS_NO_MEMORY;
1048                 }
1049                 break;
1050         }
1051         default:
1052                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
1053                 return NT_STATUS_INVALID_INFO_CLASS;
1054         } /* end switch */
1055
1056         if ( NT_STATUS_IS_OK(status) ) {
1057                 status = auth_context->check_ntlm_password(auth_context,
1058                         user_info, &server_info);
1059         }
1060
1061         (auth_context->free)(&auth_context);
1062         free_user_info(&user_info);
1063
1064         DEBUG(5,("%s: check_password returned status %s\n",
1065                   fn, nt_errstr(status)));
1066
1067         /* Check account and password */
1068
1069         if (!NT_STATUS_IS_OK(status)) {
1070                 /* If we don't know what this domain is, we need to
1071                    indicate that we are not authoritative.  This
1072                    allows the client to decide if it needs to try
1073                    a local user.  Fix by jpjanosi@us.ibm.com, #2976 */
1074                 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
1075                      && !strequal(nt_domain, get_global_sam_name())
1076                      && !is_trusted_domain(nt_domain) )
1077                         *r->out.authoritative = false; /* We are not authoritative */
1078
1079                 TALLOC_FREE(server_info);
1080                 return status;
1081         }
1082
1083         if (server_info->guest) {
1084                 /* We don't like guest domain logons... */
1085                 DEBUG(5,("%s: Attempted domain logon as GUEST "
1086                          "denied.\n", fn));
1087                 TALLOC_FREE(server_info);
1088                 return NT_STATUS_LOGON_FAILURE;
1089         }
1090
1091         /* This is the point at which, if the login was successful, that
1092            the SAM Local Security Authority should record that the user is
1093            logged in to the domain.  */
1094
1095         if (process_creds) {
1096                 /* Get the pipe session key from the creds. */
1097                 memcpy(pipe_session_key, creds->session_key, 16);
1098         } else {
1099                 /* Get the pipe session key from the schannel. */
1100                 if ((p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL)
1101                     || (p->auth.a_u.schannel_auth == NULL)) {
1102                         return NT_STATUS_INVALID_HANDLE;
1103                 }
1104                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->creds->session_key, 16);
1105         }
1106
1107         switch (r->in.validation_level) {
1108         case 2:
1109                 status = serverinfo_to_SamInfo2(server_info, pipe_session_key, 16,
1110                                                 r->out.validation->sam2);
1111                 break;
1112         case 3:
1113                 status = serverinfo_to_SamInfo3(server_info, pipe_session_key, 16,
1114                                                 r->out.validation->sam3);
1115                 break;
1116         case 6:
1117                 status = serverinfo_to_SamInfo6(server_info, pipe_session_key, 16,
1118                                                 r->out.validation->sam6);
1119                 break;
1120         }
1121
1122         TALLOC_FREE(server_info);
1123
1124         return status;
1125 }
1126
1127 /****************************************************************
1128  _netr_LogonSamLogonWithFlags
1129 ****************************************************************/
1130
1131 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1132                                       struct netr_LogonSamLogonWithFlags *r)
1133 {
1134         NTSTATUS status;
1135         struct netlogon_creds_CredentialState *creds;
1136         struct netr_LogonSamLogonEx r2;
1137         struct netr_Authenticator return_authenticator;
1138
1139         become_root();
1140         status = netr_creds_server_step_check(p, p->mem_ctx,
1141                                               r->in.computer_name,
1142                                               r->in.credential,
1143                                               &return_authenticator,
1144                                               &creds);
1145         unbecome_root();
1146         if (!NT_STATUS_IS_OK(status)) {
1147                 return status;
1148         }
1149
1150         r2.in.server_name       = r->in.server_name;
1151         r2.in.computer_name     = r->in.computer_name;
1152         r2.in.logon_level       = r->in.logon_level;
1153         r2.in.logon             = r->in.logon;
1154         r2.in.validation_level  = r->in.validation_level;
1155         r2.in.flags             = r->in.flags;
1156         r2.out.validation       = r->out.validation;
1157         r2.out.authoritative    = r->out.authoritative;
1158         r2.out.flags            = r->out.flags;
1159
1160         status = _netr_LogonSamLogon_base(p, &r2, creds);
1161
1162         *r->out.return_authenticator = return_authenticator;
1163
1164         return status;
1165 }
1166
1167 /*************************************************************************
1168  _netr_LogonSamLogon
1169  *************************************************************************/
1170
1171 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
1172                              struct netr_LogonSamLogon *r)
1173 {
1174         NTSTATUS status;
1175         struct netr_LogonSamLogonWithFlags r2;
1176         uint32_t flags = 0;
1177
1178         r2.in.server_name               = r->in.server_name;
1179         r2.in.computer_name             = r->in.computer_name;
1180         r2.in.credential                = r->in.credential;
1181         r2.in.logon_level               = r->in.logon_level;
1182         r2.in.logon                     = r->in.logon;
1183         r2.in.validation_level          = r->in.validation_level;
1184         r2.in.return_authenticator      = r->in.return_authenticator;
1185         r2.in.flags                     = &flags;
1186         r2.out.validation               = r->out.validation;
1187         r2.out.authoritative            = r->out.authoritative;
1188         r2.out.flags                    = &flags;
1189         r2.out.return_authenticator     = r->out.return_authenticator;
1190
1191         status = _netr_LogonSamLogonWithFlags(p, &r2);
1192
1193         return status;
1194 }
1195
1196 /*************************************************************************
1197  _netr_LogonSamLogonEx
1198  - no credential chaining. Map into net sam logon.
1199  *************************************************************************/
1200
1201 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1202                                struct netr_LogonSamLogonEx *r)
1203 {
1204         NTSTATUS status;
1205         struct netlogon_creds_CredentialState *creds = NULL;
1206
1207         become_root();
1208         status = schannel_fetch_session_key(p->mem_ctx, r->in.computer_name, &creds);
1209         unbecome_root();
1210         if (!NT_STATUS_IS_OK(status)) {
1211                 return status;
1212         }
1213
1214         /* Only allow this if the pipe is protected. */
1215         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1216                 DEBUG(0,("_netr_LogonSamLogonEx: client %s not using schannel for netlogon\n",
1217                         get_remote_machine_name() ));
1218                 return NT_STATUS_INVALID_PARAMETER;
1219         }
1220
1221         status = _netr_LogonSamLogon_base(p, r, creds);
1222         TALLOC_FREE(creds);
1223
1224         return status;
1225 }
1226
1227 /*************************************************************************
1228  _ds_enum_dom_trusts
1229  *************************************************************************/
1230 #if 0   /* JERRY -- not correct */
1231  NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1232                              DS_R_ENUM_DOM_TRUSTS *r_u)
1233 {
1234         NTSTATUS status = NT_STATUS_OK;
1235
1236         /* TODO: According to MSDN, the can only be executed against a
1237            DC or domain member running Windows 2000 or later.  Need
1238            to test against a standalone 2k server and see what it
1239            does.  A windows 2000 DC includes its own domain in the
1240            list.  --jerry */
1241
1242         return status;
1243 }
1244 #endif  /* JERRY */
1245
1246
1247 /****************************************************************
1248 ****************************************************************/
1249
1250 WERROR _netr_LogonUasLogon(pipes_struct *p,
1251                            struct netr_LogonUasLogon *r)
1252 {
1253         p->rng_fault_state = true;
1254         return WERR_NOT_SUPPORTED;
1255 }
1256
1257 /****************************************************************
1258 ****************************************************************/
1259
1260 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1261                             struct netr_LogonUasLogoff *r)
1262 {
1263         p->rng_fault_state = true;
1264         return WERR_NOT_SUPPORTED;
1265 }
1266
1267 /****************************************************************
1268 ****************************************************************/
1269
1270 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1271                               struct netr_DatabaseDeltas *r)
1272 {
1273         p->rng_fault_state = true;
1274         return NT_STATUS_NOT_IMPLEMENTED;
1275 }
1276
1277 /****************************************************************
1278 ****************************************************************/
1279
1280 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1281                             struct netr_DatabaseSync *r)
1282 {
1283         p->rng_fault_state = true;
1284         return NT_STATUS_NOT_IMPLEMENTED;
1285 }
1286
1287 /****************************************************************
1288 ****************************************************************/
1289
1290 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1291                              struct netr_AccountDeltas *r)
1292 {
1293         p->rng_fault_state = true;
1294         return NT_STATUS_NOT_IMPLEMENTED;
1295 }
1296
1297 /****************************************************************
1298 ****************************************************************/
1299
1300 NTSTATUS _netr_AccountSync(pipes_struct *p,
1301                            struct netr_AccountSync *r)
1302 {
1303         p->rng_fault_state = true;
1304         return NT_STATUS_NOT_IMPLEMENTED;
1305 }
1306
1307 /****************************************************************
1308 ****************************************************************/
1309
1310 WERROR _netr_GetDcName(pipes_struct *p,
1311                        struct netr_GetDcName *r)
1312 {
1313         p->rng_fault_state = true;
1314         return WERR_NOT_SUPPORTED;
1315 }
1316
1317 /****************************************************************
1318 ****************************************************************/
1319
1320 WERROR _netr_GetAnyDCName(pipes_struct *p,
1321                           struct netr_GetAnyDCName *r)
1322 {
1323         p->rng_fault_state = true;
1324         return WERR_NOT_SUPPORTED;
1325 }
1326
1327 /****************************************************************
1328 ****************************************************************/
1329
1330 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1331                              struct netr_DatabaseSync2 *r)
1332 {
1333         p->rng_fault_state = true;
1334         return NT_STATUS_NOT_IMPLEMENTED;
1335 }
1336
1337 /****************************************************************
1338 ****************************************************************/
1339
1340 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1341                             struct netr_DatabaseRedo *r)
1342 {
1343         p->rng_fault_state = true;
1344         return NT_STATUS_NOT_IMPLEMENTED;
1345 }
1346
1347 /****************************************************************
1348 ****************************************************************/
1349
1350 WERROR _netr_DsRGetDCName(pipes_struct *p,
1351                           struct netr_DsRGetDCName *r)
1352 {
1353         p->rng_fault_state = true;
1354         return WERR_NOT_SUPPORTED;
1355 }
1356
1357 /****************************************************************
1358 ****************************************************************/
1359
1360 NTSTATUS _netr_LogonGetCapabilities(pipes_struct *p,
1361                                     struct netr_LogonGetCapabilities *r)
1362 {
1363         return NT_STATUS_NOT_IMPLEMENTED;
1364 }
1365
1366 /****************************************************************
1367 ****************************************************************/
1368
1369 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1370                                      struct netr_NETRLOGONSETSERVICEBITS *r)
1371 {
1372         p->rng_fault_state = true;
1373         return WERR_NOT_SUPPORTED;
1374 }
1375
1376 /****************************************************************
1377 ****************************************************************/
1378
1379 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1380                               struct netr_LogonGetTrustRid *r)
1381 {
1382         p->rng_fault_state = true;
1383         return WERR_NOT_SUPPORTED;
1384 }
1385
1386 /****************************************************************
1387 ****************************************************************/
1388
1389 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1390                                           struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1391 {
1392         p->rng_fault_state = true;
1393         return WERR_NOT_SUPPORTED;
1394 }
1395
1396 /****************************************************************
1397 ****************************************************************/
1398
1399 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1400                                           struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1401 {
1402         p->rng_fault_state = true;
1403         return WERR_NOT_SUPPORTED;
1404 }
1405
1406 /****************************************************************
1407 ****************************************************************/
1408
1409 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1410                             struct netr_DsRGetDCNameEx *r)
1411 {
1412         p->rng_fault_state = true;
1413         return WERR_NOT_SUPPORTED;
1414 }
1415
1416 /****************************************************************
1417 ****************************************************************/
1418
1419 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1420                             struct netr_DsRGetSiteName *r)
1421 {
1422         p->rng_fault_state = true;
1423         return WERR_NOT_SUPPORTED;
1424 }
1425
1426 /****************************************************************
1427 ****************************************************************/
1428
1429 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1430                                   struct netr_LogonGetDomainInfo *r)
1431 {
1432         p->rng_fault_state = true;
1433         return NT_STATUS_NOT_IMPLEMENTED;
1434 }
1435
1436 /****************************************************************
1437 ****************************************************************/
1438
1439 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1440                                struct netr_ServerPasswordGet *r)
1441 {
1442         p->rng_fault_state = true;
1443         return WERR_NOT_SUPPORTED;
1444 }
1445
1446 /****************************************************************
1447 ****************************************************************/
1448
1449 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1450                                 struct netr_NETRLOGONSENDTOSAM *r)
1451 {
1452         p->rng_fault_state = true;
1453         return WERR_NOT_SUPPORTED;
1454 }
1455
1456 /****************************************************************
1457 ****************************************************************/
1458
1459 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1460                                     struct netr_DsRAddressToSitenamesW *r)
1461 {
1462         p->rng_fault_state = true;
1463         return WERR_NOT_SUPPORTED;
1464 }
1465
1466 /****************************************************************
1467 ****************************************************************/
1468
1469 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1470                              struct netr_DsRGetDCNameEx2 *r)
1471 {
1472         p->rng_fault_state = true;
1473         return WERR_NOT_SUPPORTED;
1474 }
1475
1476 /****************************************************************
1477 ****************************************************************/
1478
1479 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1480                                                  struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1481 {
1482         p->rng_fault_state = true;
1483         return WERR_NOT_SUPPORTED;
1484 }
1485
1486 /****************************************************************
1487 ****************************************************************/
1488
1489 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1490                                            struct netr_NetrEnumerateTrustedDomainsEx *r)
1491 {
1492         p->rng_fault_state = true;
1493         return WERR_NOT_SUPPORTED;
1494 }
1495
1496 /****************************************************************
1497 ****************************************************************/
1498
1499 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1500                                       struct netr_DsRAddressToSitenamesExW *r)
1501 {
1502         p->rng_fault_state = true;
1503         return WERR_NOT_SUPPORTED;
1504 }
1505
1506 /****************************************************************
1507 ****************************************************************/
1508
1509 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1510                                    struct netr_DsrGetDcSiteCoverageW *r)
1511 {
1512         p->rng_fault_state = true;
1513         return WERR_NOT_SUPPORTED;
1514 }
1515
1516 /****************************************************************
1517 ****************************************************************/
1518
1519 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1520                                       struct netr_DsrEnumerateDomainTrusts *r)
1521 {
1522         p->rng_fault_state = true;
1523         return WERR_NOT_SUPPORTED;
1524 }
1525
1526 /****************************************************************
1527 ****************************************************************/
1528
1529 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1530                                          struct netr_DsrDeregisterDNSHostRecords *r)
1531 {
1532         p->rng_fault_state = true;
1533         return WERR_NOT_SUPPORTED;
1534 }
1535
1536 /****************************************************************
1537 ****************************************************************/
1538
1539 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1540                                        struct netr_ServerTrustPasswordsGet *r)
1541 {
1542         p->rng_fault_state = true;
1543         return NT_STATUS_NOT_IMPLEMENTED;
1544 }
1545
1546 /****************************************************************
1547 ****************************************************************/
1548
1549 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1550                                           struct netr_DsRGetForestTrustInformation *r)
1551 {
1552         p->rng_fault_state = true;
1553         return WERR_NOT_SUPPORTED;
1554 }
1555
1556 /****************************************************************
1557 ****************************************************************/
1558
1559 WERROR _netr_GetForestTrustInformation(pipes_struct *p,
1560                                        struct netr_GetForestTrustInformation *r)
1561 {
1562         p->rng_fault_state = true;
1563         return WERR_NOT_SUPPORTED;
1564 }
1565
1566 /****************************************************************
1567 ****************************************************************/
1568
1569 NTSTATUS _netr_ServerGetTrustInfo(pipes_struct *p,
1570                                   struct netr_ServerGetTrustInfo *r)
1571 {
1572         p->rng_fault_state = true;
1573         return NT_STATUS_NOT_IMPLEMENTED;
1574 }
1575