source3/rpc_server/srv_netlog_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997.
   7  *  Copyright (C) Jeremy Allison               1998-2001.
   8  *  Copyright (C) Andrew Bartlett                   2001.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 3 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  22  */
  23
  24 /* This is the implementation of the netlogon pipe. */
  25
  26 #include "includes.h"
  27
  28 extern userdom_struct current_user_info;
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_RPC_SRV
  32
  33 /*************************************************************************
  34  init_net_r_req_chal:
  35  *************************************************************************/
  36
  37 static void init_net_r_req_chal(struct netr_Credential *r,
  38                                 DOM_CHAL *srv_chal)
  39 {
  40         DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__));
  41
  42         memcpy(r->data, srv_chal->data, sizeof(r->data));
  43 }
  44
  45 /*******************************************************************
  46  Inits a netr_NETLOGON_INFO_1 structure.
  47 ********************************************************************/
  48
  49 static void init_netlogon_info1(struct netr_NETLOGON_INFO_1 *r,
  50                                 uint32_t flags,
  51                                 uint32_t pdc_connection_status)
  52 {
  53         r->flags = flags;
  54         r->pdc_connection_status = pdc_connection_status;
  55 }
  56
  57 /*******************************************************************
  58  Inits a netr_NETLOGON_INFO_2 structure.
  59 ********************************************************************/
  60
  61 static void init_netlogon_info2(struct netr_NETLOGON_INFO_2 *r,
  62                                 uint32_t flags,
  63                                 uint32_t pdc_connection_status,
  64                                 const char *trusted_dc_name,
  65                                 uint32_t tc_connection_status)
  66 {
  67         r->flags = flags;
  68         r->pdc_connection_status = pdc_connection_status;
  69         r->trusted_dc_name = trusted_dc_name;
  70         r->tc_connection_status = tc_connection_status;
  71 }
  72
  73 /*******************************************************************
  74  Inits a netr_NETLOGON_INFO_3 structure.
  75 ********************************************************************/
  76
  77 static void init_netlogon_info3(struct netr_NETLOGON_INFO_3 *r,
  78                                 uint32_t flags,
  79                                 uint32_t logon_attempts)
  80 {
  81         r->flags = flags;
  82         r->logon_attempts = logon_attempts;
  83 }
  84
  85 /*************************************************************************
  86  _netr_LogonControl
  87  *************************************************************************/
  88
  89 WERROR _netr_LogonControl(pipes_struct *p,
  90                           struct netr_LogonControl *r)
  91 {
  92         struct netr_NETLOGON_INFO_1 *info1;
  93         uint32_t flags = 0x0;
  94         uint32_t pdc_connection_status = W_ERROR_V(WERR_OK);
  95
  96         /* Setup the Logon Control response */
  97
  98         switch (r->in.level) {
  99                 case 1:
 100                         info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
 101                         if (!info1) {
 102                                 return WERR_NOMEM;
 103                         }
 104                         init_netlogon_info1(info1,
 105                                             flags,
 106                                             pdc_connection_status);
 107                         r->out.info->info1 = info1;
 108                         break;
 109                 default:
 110                         return WERR_UNKNOWN_LEVEL;
 111         }
 112
 113         return WERR_OK;
 114 }
 115
 116 /****************************************************************************
 117 Send a message to smbd to do a sam synchronisation
 118 **************************************************************************/
 119
 120 static void send_sync_message(void)
 121 {
 122         DEBUG(3, ("sending sam synchronisation message\n"));
 123         message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
 124                          NULL);
 125 }
 126
 127 /*************************************************************************
 128  _netr_LogonControl2
 129  *************************************************************************/
 130
 131 WERROR _netr_LogonControl2(pipes_struct *p,
 132                            struct netr_LogonControl2 *r)
 133 {
 134         uint32 flags = 0x0;
 135         uint32 pdc_connection_status = 0x0;
 136         uint32 logon_attempts = 0x0;
 137         uint32 tc_status;
 138         fstring dc_name, dc_name2;
 139         struct sockaddr_storage dc_ss;
 140         const char *domain = NULL;
 141         struct netr_NETLOGON_INFO_1 *info1;
 142         struct netr_NETLOGON_INFO_2 *info2;
 143         struct netr_NETLOGON_INFO_3 *info3;
 144
 145         tc_status = W_ERROR_V(WERR_NO_SUCH_DOMAIN);
 146         fstrcpy( dc_name, "" );
 147
 148         switch (r->in.function_code) {
 149                 case NETLOGON_CONTROL_TC_QUERY:
 150                         domain = r->in.data->domain;
 151
 152                         if ( !is_trusted_domain( domain ) )
 153                                 break;
 154
 155                         if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
 156                                 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
 157                                 break;
 158                         }
 159
 160                         fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
 161
 162                         tc_status = W_ERROR_V(WERR_OK);
 163
 164                         break;
 165
 166                 case NETLOGON_CONTROL_REDISCOVER:
 167                         domain = r->in.data->domain;
 168
 169                         if ( !is_trusted_domain( domain ) )
 170                                 break;
 171
 172                         if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
 173                                 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
 174                                 break;
 175                         }
 176
 177                         fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
 178
 179                         tc_status = W_ERROR_V(WERR_OK);
 180
 181                         break;
 182
 183                 default:
 184                         /* no idea what this should be */
 185                         DEBUG(0,("_netr_LogonControl2: unimplemented function level [%d]\n",
 186                                 r->in.function_code));
 187                         return WERR_UNKNOWN_LEVEL;
 188         }
 189
 190         /* prepare the response */
 191
 192         switch (r->in.level) {
 193                 case 1:
 194                         info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
 195                         W_ERROR_HAVE_NO_MEMORY(info1);
 196
 197                         init_netlogon_info1(info1,
 198                                             flags,
 199                                             pdc_connection_status);
 200                         r->out.query->info1 = info1;
 201                         break;
 202                 case 2:
 203                         info2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_2);
 204                         W_ERROR_HAVE_NO_MEMORY(info2);
 205
 206                         init_netlogon_info2(info2,
 207                                             flags,
 208                                             pdc_connection_status,
 209                                             dc_name,
 210                                             tc_status);
 211                         r->out.query->info2 = info2;
 212                         break;
 213                 case 3:
 214                         info3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_3);
 215                         W_ERROR_HAVE_NO_MEMORY(info3);
 216
 217                         init_netlogon_info3(info3,
 218                                             flags,
 219                                             logon_attempts);
 220                         r->out.query->info3 = info3;
 221                         break;
 222                 default:
 223                         return WERR_UNKNOWN_LEVEL;
 224         }
 225
 226         if (lp_server_role() == ROLE_DOMAIN_BDC) {
 227                 send_sync_message();
 228         }
 229
 230         return WERR_OK;
 231 }
 232
 233 /*************************************************************************
 234  _netr_NetrEnumerateTrustedDomains
 235  *************************************************************************/
 236
 237 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
 238                                          struct netr_NetrEnumerateTrustedDomains *r)
 239 {
 240         struct netr_Blob trusted_domains_blob;
 241         DATA_BLOB blob;
 242
 243         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 244
 245         /* set up the Trusted Domain List response */
 246
 247         blob = data_blob_talloc_zero(p->mem_ctx, 2);
 248         trusted_domains_blob.data = blob.data;
 249         trusted_domains_blob.length = blob.length;
 250
 251         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 252
 253         *r->out.trusted_domains_blob = trusted_domains_blob;
 254
 255         return WERR_OK;
 256 }
 257
 258 /******************************************************************
 259  gets a machine password entry.  checks access rights of the host.
 260  ******************************************************************/
 261
 262 static NTSTATUS get_md4pw(char *md4pw, const char *mach_acct, uint16 sec_chan_type)
 263 {
 264         struct samu *sampass = NULL;
 265         const uint8 *pass;
 266         bool ret;
 267         uint32 acct_ctrl;
 268
 269 #if 0
 270         char addr[INET6_ADDRSTRLEN];
 271
 272     /*
 273      * Currently this code is redundent as we already have a filter
 274      * by hostname list. What this code really needs to do is to
 275      * get a hosts allowed/hosts denied list from the SAM database
 276      * on a per user basis, and make the access decision there.
 277      * I will leave this code here for now as a reminder to implement
 278      * this at a later date. JRA.
 279      */
 280
 281         if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
 282                         client_name(get_client_fd()),
 283                         client_addr(get_client_fd(),addr,sizeof(addr)))) {
 284                 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
 285                 return False;
 286         }
 287 #endif /* 0 */
 288
 289         if ( !(sampass = samu_new( NULL )) ) {
 290                 return NT_STATUS_NO_MEMORY;
 291         }
 292
 293         /* JRA. This is ok as it is only used for generating the challenge. */
 294         become_root();
 295         ret = pdb_getsampwnam(sampass, mach_acct);
 296         unbecome_root();
 297
 298         if (!ret) {
 299                 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
 300                 TALLOC_FREE(sampass);
 301                 return NT_STATUS_ACCESS_DENIED;
 302         }
 303
 304         acct_ctrl = pdb_get_acct_ctrl(sampass);
 305         if (acct_ctrl & ACB_DISABLED) {
 306                 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
 307                 TALLOC_FREE(sampass);
 308                 return NT_STATUS_ACCOUNT_DISABLED;
 309         }
 310
 311         if (!(acct_ctrl & ACB_SVRTRUST) &&
 312             !(acct_ctrl & ACB_WSTRUST) &&
 313             !(acct_ctrl & ACB_DOMTRUST))
 314         {
 315                 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
 316                 TALLOC_FREE(sampass);
 317                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 318         }
 319
 320         switch (sec_chan_type) {
 321                 case SEC_CHAN_BDC:
 322                         if (!(acct_ctrl & ACB_SVRTRUST)) {
 323                                 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
 324                                          "but not a server trust account\n", mach_acct));
 325                                 TALLOC_FREE(sampass);
 326                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 327                         }
 328                         break;
 329                 case SEC_CHAN_WKSTA:
 330                         if (!(acct_ctrl & ACB_WSTRUST)) {
 331                                 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
 332                                          "but not a workstation trust account\n", mach_acct));
 333                                 TALLOC_FREE(sampass);
 334                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 335                         }
 336                         break;
 337                 case SEC_CHAN_DOMAIN:
 338                         if (!(acct_ctrl & ACB_DOMTRUST)) {
 339                                 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
 340                                          "but not a interdomain trust account\n", mach_acct));
 341                                 TALLOC_FREE(sampass);
 342                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 343                         }
 344                         break;
 345                 default:
 346                         break;
 347         }
 348
 349         if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
 350                 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
 351                 TALLOC_FREE(sampass);
 352                 return NT_STATUS_LOGON_FAILURE;
 353         }
 354
 355         memcpy(md4pw, pass, 16);
 356         dump_data(5, (uint8 *)md4pw, 16);
 357
 358         TALLOC_FREE(sampass);
 359
 360         return NT_STATUS_OK;
 361
 362
 363 }
 364
 365 /*************************************************************************
 366  _netr_ServerReqChallenge
 367  *************************************************************************/
 368
 369 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
 370                                   struct netr_ServerReqChallenge *r)
 371 {
 372         if (!p->dc) {
 373                 p->dc = TALLOC_ZERO_P(p->pipe_state_mem_ctx, struct dcinfo);
 374                 if (!p->dc) {
 375                         return NT_STATUS_NO_MEMORY;
 376                 }
 377         } else {
 378                 DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
 379                 ZERO_STRUCTP(p->dc);
 380         }
 381
 382         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 383
 384         /* Save the client challenge to the server. */
 385         memcpy(p->dc->clnt_chal.data, r->in.credentials->data,
 386                 sizeof(r->in.credentials->data));
 387
 388         /* Create a server challenge for the client */
 389         /* Set this to a random value. */
 390         generate_random_buffer(p->dc->srv_chal.data, 8);
 391
 392         /* set up the LSA REQUEST CHALLENGE response */
 393         init_net_r_req_chal(r->out.return_credentials, &p->dc->srv_chal);
 394
 395         p->dc->challenge_sent = True;
 396
 397         return NT_STATUS_OK;
 398 }
 399
 400 /*************************************************************************
 401  _netr_ServerAuthenticate
 402  Create the initial credentials.
 403  *************************************************************************/
 404
 405 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
 406                                   struct netr_ServerAuthenticate *r)
 407 {
 408         NTSTATUS status;
 409         DOM_CHAL srv_chal_out;
 410
 411         if (!p->dc || !p->dc->challenge_sent) {
 412                 return NT_STATUS_ACCESS_DENIED;
 413         }
 414
 415         status = get_md4pw((char *)p->dc->mach_pw,
 416                            r->in.account_name,
 417                            r->in.secure_channel_type);
 418         if (!NT_STATUS_IS_OK(status)) {
 419                 DEBUG(0,("_netr_ServerAuthenticate: get_md4pw failed. Failed to "
 420                         "get password for machine account %s "
 421                         "from client %s: %s\n",
 422                         r->in.account_name,
 423                         r->in.computer_name,
 424                         nt_errstr(status) ));
 425                 /* always return NT_STATUS_ACCESS_DENIED */
 426                 return NT_STATUS_ACCESS_DENIED;
 427         }
 428
 429         /* From the client / server challenges and md4 password, generate sess key */
 430         creds_server_init(0,                    /* No neg flags. */
 431                         p->dc,
 432                         &p->dc->clnt_chal,      /* Stored client chal. */
 433                         &p->dc->srv_chal,       /* Stored server chal. */
 434                         p->dc->mach_pw,
 435                         &srv_chal_out);
 436
 437         /* Check client credentials are valid. */
 438         if (!netlogon_creds_server_check(p->dc, r->in.credentials)) {
 439                 DEBUG(0,("_netr_ServerAuthenticate: netlogon_creds_server_check failed. Rejecting auth "
 440                         "request from client %s machine account %s\n",
 441                         r->in.computer_name,
 442                         r->in.account_name));
 443                 return NT_STATUS_ACCESS_DENIED;
 444         }
 445
 446         fstrcpy(p->dc->mach_acct, r->in.account_name);
 447         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 448         p->dc->authenticated = True;
 449
 450         /* set up the LSA AUTH response */
 451         /* Return the server credentials. */
 452
 453         memcpy(r->out.return_credentials->data, &srv_chal_out.data,
 454                sizeof(r->out.return_credentials->data));
 455
 456         return NT_STATUS_OK;
 457 }
 458
 459 /*************************************************************************
 460  _netr_ServerAuthenticate2
 461  *************************************************************************/
 462
 463 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
 464                                    struct netr_ServerAuthenticate2 *r)
 465 {
 466         NTSTATUS status;
 467         uint32_t srv_flgs;
 468         DOM_CHAL srv_chal_out;
 469
 470         /* We use this as the key to store the creds: */
 471         /* r->in.computer_name */
 472
 473         if (!p->dc || !p->dc->challenge_sent) {
 474                 DEBUG(0,("_netr_ServerAuthenticate2: no challenge sent to client %s\n",
 475                         r->in.computer_name));
 476                 return NT_STATUS_ACCESS_DENIED;
 477         }
 478
 479         if ( (lp_server_schannel() == true) &&
 480              ((*r->in.negotiate_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
 481
 482                 /* schannel must be used, but client did not offer it. */
 483                 DEBUG(0,("_netr_ServerAuthenticate2: schannel required but client failed "
 484                         "to offer it. Client was %s\n",
 485                         r->in.account_name));
 486                 return NT_STATUS_ACCESS_DENIED;
 487         }
 488
 489         status = get_md4pw((char *)p->dc->mach_pw,
 490                            r->in.account_name,
 491                            r->in.secure_channel_type);
 492         if (!NT_STATUS_IS_OK(status)) {
 493                 DEBUG(0,("_netr_ServerAuthenticate2: failed to get machine password for "
 494                         "account %s: %s\n",
 495                         r->in.account_name, nt_errstr(status) ));
 496                 /* always return NT_STATUS_ACCESS_DENIED */
 497                 return NT_STATUS_ACCESS_DENIED;
 498         }
 499
 500         /* From the client / server challenges and md4 password, generate sess key */
 501         creds_server_init(*r->in.negotiate_flags,
 502                         p->dc,
 503                         &p->dc->clnt_chal,      /* Stored client chal. */
 504                         &p->dc->srv_chal,       /* Stored server chal. */
 505                         p->dc->mach_pw,
 506                         &srv_chal_out);
 507
 508         /* Check client credentials are valid. */
 509         if (!netlogon_creds_server_check(p->dc, r->in.credentials)) {
 510                 DEBUG(0,("_netr_ServerAuthenticate2: netlogon_creds_server_check failed. Rejecting auth "
 511                         "request from client %s machine account %s\n",
 512                         r->in.computer_name,
 513                         r->in.account_name));
 514                 return NT_STATUS_ACCESS_DENIED;
 515         }
 516
 517         srv_flgs = 0x000001ff;
 518
 519         if (lp_server_schannel() != false) {
 520                 srv_flgs |= NETLOGON_NEG_SCHANNEL;
 521         }
 522
 523         /* set up the LSA AUTH 2 response */
 524         memcpy(r->out.return_credentials->data, &srv_chal_out.data,
 525                sizeof(r->out.return_credentials->data));
 526         *r->out.negotiate_flags = srv_flgs;
 527
 528         fstrcpy(p->dc->mach_acct, r->in.account_name);
 529         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 530         fstrcpy(p->dc->domain, lp_workgroup() );
 531
 532         p->dc->authenticated = True;
 533
 534         /* Store off the state so we can continue after client disconnect. */
 535         become_root();
 536         secrets_store_schannel_session_info(p->mem_ctx,
 537                                             r->in.computer_name,
 538                                             p->dc);
 539         unbecome_root();
 540
 541         return NT_STATUS_OK;
 542 }
 543
 544 /*************************************************************************
 545  _netr_ServerPasswordSet
 546  *************************************************************************/
 547
 548 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
 549                                  struct netr_ServerPasswordSet *r)
 550 {
 551         NTSTATUS status = NT_STATUS_OK;
 552         fstring remote_machine;
 553         struct samu *sampass=NULL;
 554         bool ret = False;
 555         unsigned char pwd[16];
 556         int i;
 557         uint32 acct_ctrl;
 558         struct netr_Authenticator cred_out;
 559         const uchar *old_pw;
 560
 561         DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
 562
 563         /* We need the remote machine name for the creds lookup. */
 564         fstrcpy(remote_machine, r->in.computer_name);
 565
 566         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 567                 /* 'server schannel = yes' should enforce use of
 568                    schannel, the client did offer it in auth2, but
 569                    obviously did not use it. */
 570                 DEBUG(0,("_netr_ServerPasswordSet: client %s not using schannel for netlogon\n",
 571                         remote_machine ));
 572                 return NT_STATUS_ACCESS_DENIED;
 573         }
 574
 575         if (!p->dc) {
 576                 /* Restore the saved state of the netlogon creds. */
 577                 become_root();
 578                 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 579                                                         remote_machine,
 580                                                         &p->dc);
 581                 unbecome_root();
 582                 if (!ret) {
 583                         return NT_STATUS_INVALID_HANDLE;
 584                 }
 585         }
 586
 587         if (!p->dc || !p->dc->authenticated) {
 588                 return NT_STATUS_INVALID_HANDLE;
 589         }
 590
 591         DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
 592                         remote_machine, p->dc->mach_acct));
 593
 594         /* Step the creds chain forward. */
 595         if (!netlogon_creds_server_step(p->dc, r->in.credential, &cred_out)) {
 596                 DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
 597                         "request from client %s machine account %s\n",
 598                         remote_machine, p->dc->mach_acct ));
 599                 return NT_STATUS_INVALID_PARAMETER;
 600         }
 601
 602         /* We must store the creds state after an update. */
 603         sampass = samu_new( NULL );
 604         if (!sampass) {
 605                 return NT_STATUS_NO_MEMORY;
 606         }
 607
 608         become_root();
 609         secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 610                                                 remote_machine,
 611                                                 p->dc);
 612         ret = pdb_getsampwnam(sampass, p->dc->mach_acct);
 613         unbecome_root();
 614
 615         if (!ret) {
 616                 TALLOC_FREE(sampass);
 617                 return NT_STATUS_ACCESS_DENIED;
 618         }
 619
 620         /* Ensure the account exists and is a machine account. */
 621
 622         acct_ctrl = pdb_get_acct_ctrl(sampass);
 623
 624         if (!(acct_ctrl & ACB_WSTRUST ||
 625                       acct_ctrl & ACB_SVRTRUST ||
 626                       acct_ctrl & ACB_DOMTRUST)) {
 627                 TALLOC_FREE(sampass);
 628                 return NT_STATUS_NO_SUCH_USER;
 629         }
 630
 631         if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
 632                 TALLOC_FREE(sampass);
 633                 return NT_STATUS_ACCOUNT_DISABLED;
 634         }
 635
 636         /* Woah - what does this to to the credential chain ? JRA */
 637         cred_hash3(pwd, r->in.new_password->hash, p->dc->sess_key, 0);
 638
 639         DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
 640         for(i = 0; i < sizeof(pwd); i++)
 641                 DEBUG(100,("%02X ", pwd[i]));
 642         DEBUG(100,("\n"));
 643
 644         old_pw = pdb_get_nt_passwd(sampass);
 645
 646         if (old_pw && memcmp(pwd, old_pw, 16) == 0) {
 647                 /* Avoid backend modificiations and other fun if the
 648                    client changed the password to the *same thing* */
 649
 650                 ret = True;
 651         } else {
 652
 653                 /* LM password should be NULL for machines */
 654                 if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
 655                         TALLOC_FREE(sampass);
 656                         return NT_STATUS_NO_MEMORY;
 657                 }
 658
 659                 if (!pdb_set_nt_passwd(sampass, pwd, PDB_CHANGED)) {
 660                         TALLOC_FREE(sampass);
 661                         return NT_STATUS_NO_MEMORY;
 662                 }
 663
 664                 if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
 665                         TALLOC_FREE(sampass);
 666                         /* Not quite sure what this one qualifies as, but this will do */
 667                         return NT_STATUS_UNSUCCESSFUL;
 668                 }
 669
 670                 become_root();
 671                 status = pdb_update_sam_account(sampass);
 672                 unbecome_root();
 673         }
 674
 675         /* set up the LSA Server Password Set response */
 676
 677         memcpy(r->out.return_authenticator, &cred_out,
 678                sizeof(r->out.return_authenticator));
 679
 680         TALLOC_FREE(sampass);
 681         return status;
 682 }
 683
 684 /*************************************************************************
 685  _netr_LogonSamLogoff
 686  *************************************************************************/
 687
 688 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
 689                               struct netr_LogonSamLogoff *r)
 690 {
 691         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 692                 /* 'server schannel = yes' should enforce use of
 693                    schannel, the client did offer it in auth2, but
 694                    obviously did not use it. */
 695                 DEBUG(0,("_netr_LogonSamLogoff: client %s not using schannel for netlogon\n",
 696                         get_remote_machine_name() ));
 697                 return NT_STATUS_ACCESS_DENIED;
 698         }
 699
 700
 701         if (!get_valid_user_struct(p->vuid))
 702                 return NT_STATUS_NO_SUCH_USER;
 703
 704         /* Using the remote machine name for the creds store: */
 705         /* r->in.computer_name */
 706
 707         if (!p->dc) {
 708                 /* Restore the saved state of the netlogon creds. */
 709                 bool ret;
 710
 711                 become_root();
 712                 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 713                                                             r->in.computer_name,
 714                                                             &p->dc);
 715                 unbecome_root();
 716                 if (!ret) {
 717                         return NT_STATUS_INVALID_HANDLE;
 718                 }
 719         }
 720
 721         if (!p->dc || !p->dc->authenticated) {
 722                 return NT_STATUS_INVALID_HANDLE;
 723         }
 724
 725         /* checks and updates credentials.  creates reply credentials */
 726         if (!netlogon_creds_server_step(p->dc, r->in.credential, r->out.return_authenticator)) {
 727                 DEBUG(2,("_netr_LogonSamLogoff: netlogon_creds_server_step failed. Rejecting auth "
 728                         "request from client %s machine account %s\n",
 729                         r->in.computer_name, p->dc->mach_acct ));
 730                 return NT_STATUS_INVALID_PARAMETER;
 731         }
 732
 733         /* We must store the creds state after an update. */
 734         become_root();
 735         secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 736                                             r->in.computer_name,
 737                                             p->dc);
 738         unbecome_root();
 739
 740         return NT_STATUS_OK;
 741 }
 742
 743 /*******************************************************************
 744  gets a domain user's groups from their already-calculated NT_USER_TOKEN
 745  ********************************************************************/
 746
 747 static NTSTATUS nt_token_to_group_list(TALLOC_CTX *mem_ctx,
 748                                        const DOM_SID *domain_sid,
 749                                        size_t num_sids,
 750                                        const DOM_SID *sids,
 751                                        int *numgroups, DOM_GID **pgids)
 752 {
 753         int i;
 754
 755         *numgroups=0;
 756         *pgids = NULL;
 757
 758         for (i=0; i<num_sids; i++) {
 759                 DOM_GID gid;
 760                 if (!sid_peek_check_rid(domain_sid, &sids[i], &gid.g_rid)) {
 761                         continue;
 762                 }
 763                 gid.attr = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
 764                             SE_GROUP_ENABLED);
 765                 ADD_TO_ARRAY(mem_ctx, DOM_GID, gid, pgids, numgroups);
 766                 if (*pgids == NULL) {
 767                         return NT_STATUS_NO_MEMORY;
 768                 }
 769         }
 770         return NT_STATUS_OK;
 771 }
 772
 773 /*************************************************************************
 774  _net_sam_logon
 775  *************************************************************************/
 776
 777 static NTSTATUS _net_sam_logon_internal(pipes_struct *p,
 778                                         NET_Q_SAM_LOGON *q_u,
 779                                         NET_R_SAM_LOGON *r_u,
 780                                         bool process_creds)
 781 {
 782         NTSTATUS status = NT_STATUS_OK;
 783         NET_USER_INFO_3 *usr_info = NULL;
 784         NET_ID_INFO_CTR *ctr = q_u->sam_id.ctr;
 785         UNISTR2 *uni_samlogon_user = NULL;
 786         UNISTR2 *uni_samlogon_domain = NULL;
 787         UNISTR2 *uni_samlogon_workstation = NULL;
 788         fstring nt_username, nt_domain, nt_workstation;
 789         auth_usersupplied_info *user_info = NULL;
 790         auth_serversupplied_info *server_info = NULL;
 791         struct samu *sampw;
 792         struct auth_context *auth_context = NULL;
 793
 794         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 795                 /* 'server schannel = yes' should enforce use of
 796                    schannel, the client did offer it in auth2, but
 797                    obviously did not use it. */
 798                 DEBUG(0,("_net_sam_logon_internal: client %s not using schannel for netlogon\n",
 799                         get_remote_machine_name() ));
 800                 return NT_STATUS_ACCESS_DENIED;
 801         }
 802
 803         usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3);
 804         if (!usr_info) {
 805                 return NT_STATUS_NO_MEMORY;
 806         }
 807
 808         ZERO_STRUCTP(usr_info);
 809
 810         /* store the user information, if there is any. */
 811         r_u->user = usr_info;
 812         r_u->auth_resp = 1; /* authoritative response */
 813         if (q_u->validation_level != 2 && q_u->validation_level != 3) {
 814                 DEBUG(0,("_net_sam_logon: bad validation_level value %d.\n", (int)q_u->validation_level ));
 815                 return NT_STATUS_ACCESS_DENIED;
 816         }
 817         /* We handle the return of USER_INFO_2 instead of 3 in the parse return. Sucks, I know... */
 818         r_u->switch_value = q_u->validation_level; /* indicates type of validation user info */
 819         r_u->buffer_creds = 1; /* Ensure we always return server creds. */
 820
 821         if (!get_valid_user_struct(p->vuid))
 822                 return NT_STATUS_NO_SUCH_USER;
 823
 824         if (process_creds) {
 825                 fstring remote_machine;
 826
 827                 /* Get the remote machine name for the creds store. */
 828                 /* Note this is the remote machine this request is coming from (member server),
 829                    not neccessarily the workstation name the user is logging onto.
 830                 */
 831                 rpcstr_pull(remote_machine,q_u->sam_id.client.login.uni_comp_name.buffer,
 832                     sizeof(remote_machine),q_u->sam_id.client.login.uni_comp_name.uni_str_len*2,0);
 833
 834                 if (!p->dc) {
 835                         /* Restore the saved state of the netlogon creds. */
 836                         bool ret;
 837
 838                         become_root();
 839                         ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 840                                         remote_machine,
 841                                         &p->dc);
 842                         unbecome_root();
 843                         if (!ret) {
 844                                 return NT_STATUS_INVALID_HANDLE;
 845                         }
 846                 }
 847
 848                 if (!p->dc || !p->dc->authenticated) {
 849                         return NT_STATUS_INVALID_HANDLE;
 850                 }
 851
 852                 /* checks and updates credentials.  creates reply credentials */
 853                 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred,  &r_u->srv_creds)) {
 854                         DEBUG(2,("_net_sam_logon: creds_server_step failed. Rejecting auth "
 855                                 "request from client %s machine account %s\n",
 856                                 remote_machine, p->dc->mach_acct ));
 857                         return NT_STATUS_INVALID_PARAMETER;
 858                 }
 859
 860                 /* We must store the creds state after an update. */
 861                 become_root();
 862                 secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 863                                         remote_machine,
 864                                         p->dc);
 865                 unbecome_root();
 866         }
 867
 868         switch (q_u->sam_id.logon_level) {
 869         case INTERACTIVE_LOGON_TYPE:
 870                 uni_samlogon_user = &ctr->auth.id1.uni_user_name;
 871                 uni_samlogon_domain = &ctr->auth.id1.uni_domain_name;
 872
 873                 uni_samlogon_workstation = &ctr->auth.id1.uni_wksta_name;
 874
 875                 DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
 876                 break;
 877         case NET_LOGON_TYPE:
 878                 uni_samlogon_user = &ctr->auth.id2.uni_user_name;
 879                 uni_samlogon_domain = &ctr->auth.id2.uni_domain_name;
 880                 uni_samlogon_workstation = &ctr->auth.id2.uni_wksta_name;
 881
 882                 DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
 883                 break;
 884         default:
 885                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 886                 return NT_STATUS_INVALID_INFO_CLASS;
 887         } /* end switch */
 888
 889         rpcstr_pull(nt_username,uni_samlogon_user->buffer,sizeof(nt_username),uni_samlogon_user->uni_str_len*2,0);
 890         rpcstr_pull(nt_domain,uni_samlogon_domain->buffer,sizeof(nt_domain),uni_samlogon_domain->uni_str_len*2,0);
 891         rpcstr_pull(nt_workstation,uni_samlogon_workstation->buffer,sizeof(nt_workstation),uni_samlogon_workstation->uni_str_len*2,0);
 892
 893         DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
 894         fstrcpy(current_user_info.smb_name, nt_username);
 895         sub_set_smb_name(nt_username);
 896
 897         DEBUG(5,("Attempting validation level %d for unmapped username %s.\n", q_u->sam_id.ctr->switch_value, nt_username));
 898
 899         status = NT_STATUS_OK;
 900
 901         switch (ctr->switch_value) {
 902         case NET_LOGON_TYPE:
 903         {
 904                 const char *wksname = nt_workstation;
 905
 906                 if (!NT_STATUS_IS_OK(status = make_auth_context_fixed(&auth_context, ctr->auth.id2.lm_chal))) {
 907                         return status;
 908                 }
 909
 910                 /* For a network logon, the workstation name comes in with two
 911                  * backslashes in the front. Strip them if they are there. */
 912
 913                 if (*wksname == '\\') wksname++;
 914                 if (*wksname == '\\') wksname++;
 915
 916                 /* Standard challenge/response authenticaion */
 917                 if (!make_user_info_netlogon_network(&user_info,
 918                                                      nt_username, nt_domain,
 919                                                      wksname,
 920                                                      ctr->auth.id2.param_ctrl,
 921                                                      ctr->auth.id2.lm_chal_resp.buffer,
 922                                                      ctr->auth.id2.lm_chal_resp.str_str_len,
 923                                                      ctr->auth.id2.nt_chal_resp.buffer,
 924                                                      ctr->auth.id2.nt_chal_resp.str_str_len)) {
 925                         status = NT_STATUS_NO_MEMORY;
 926                 }
 927                 break;
 928         }
 929         case INTERACTIVE_LOGON_TYPE:
 930                 /* 'Interactive' authentication, supplies the password in its
 931                    MD4 form, encrypted with the session key.  We will convert
 932                    this to challenge/response for the auth subsystem to chew
 933                    on */
 934         {
 935                 const uint8 *chal;
 936
 937                 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
 938                         return status;
 939                 }
 940
 941                 chal = auth_context->get_ntlm_challenge(auth_context);
 942
 943                 if (!make_user_info_netlogon_interactive(&user_info,
 944                                                          nt_username, nt_domain,
 945                                                          nt_workstation,
 946                                                          ctr->auth.id1.param_ctrl,
 947                                                          chal,
 948                                                          ctr->auth.id1.lm_owf.data,
 949                                                          ctr->auth.id1.nt_owf.data,
 950                                                          p->dc->sess_key)) {
 951                         status = NT_STATUS_NO_MEMORY;
 952                 }
 953                 break;
 954         }
 955         default:
 956                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 957                 return NT_STATUS_INVALID_INFO_CLASS;
 958         } /* end switch */
 959
 960         if ( NT_STATUS_IS_OK(status) ) {
 961                 status = auth_context->check_ntlm_password(auth_context,
 962                         user_info, &server_info);
 963         }
 964
 965         (auth_context->free)(&auth_context);
 966         free_user_info(&user_info);
 967
 968         DEBUG(5, ("_net_sam_logon: check_password returned status %s\n",
 969                   nt_errstr(status)));
 970
 971         /* Check account and password */
 972
 973         if (!NT_STATUS_IS_OK(status)) {
 974                 /* If we don't know what this domain is, we need to
 975                    indicate that we are not authoritative.  This
 976                    allows the client to decide if it needs to try
 977                    a local user.  Fix by jpjanosi@us.ibm.com, #2976 */
 978                 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
 979                      && !strequal(nt_domain, get_global_sam_name())
 980                      && !is_trusted_domain(nt_domain) )
 981                         r_u->auth_resp = 0; /* We are not authoritative */
 982
 983                 TALLOC_FREE(server_info);
 984                 return status;
 985         }
 986
 987         if (server_info->guest) {
 988                 /* We don't like guest domain logons... */
 989                 DEBUG(5,("_net_sam_logon: Attempted domain logon as GUEST "
 990                          "denied.\n"));
 991                 TALLOC_FREE(server_info);
 992                 return NT_STATUS_LOGON_FAILURE;
 993         }
 994
 995         /* This is the point at which, if the login was successful, that
 996            the SAM Local Security Authority should record that the user is
 997            logged in to the domain.  */
 998
 999         {
1000                 DOM_GID *gids = NULL;
1001                 const DOM_SID *user_sid = NULL;
1002                 const DOM_SID *group_sid = NULL;
1003                 DOM_SID domain_sid;
1004                 uint32 user_rid, group_rid;
1005
1006                 int num_gids = 0;
1007                 const char *my_name;
1008                 unsigned char user_session_key[16];
1009                 unsigned char lm_session_key[16];
1010                 unsigned char pipe_session_key[16];
1011
1012                 sampw = server_info->sam_account;
1013
1014                 /* set up pointer indicating user/password failed to be
1015                  * found */
1016                 usr_info->ptr_user_info = 0;
1017
1018                 user_sid = pdb_get_user_sid(sampw);
1019                 group_sid = pdb_get_group_sid(sampw);
1020
1021                 if ((user_sid == NULL) || (group_sid == NULL)) {
1022                         DEBUG(1, ("_net_sam_logon: User without group or user SID\n"));
1023                         return NT_STATUS_UNSUCCESSFUL;
1024                 }
1025
1026                 sid_copy(&domain_sid, user_sid);
1027                 sid_split_rid(&domain_sid, &user_rid);
1028
1029                 if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) {
1030                         DEBUG(1, ("_net_sam_logon: user %s\\%s has user sid "
1031                                   "%s\n but group sid %s.\n"
1032                                   "The conflicting domain portions are not "
1033                                   "supported for NETLOGON calls\n",
1034                                   pdb_get_domain(sampw),
1035                                   pdb_get_username(sampw),
1036                                   sid_string_dbg(user_sid),
1037                                   sid_string_dbg(group_sid)));
1038                         return NT_STATUS_UNSUCCESSFUL;
1039                 }
1040
1041                 if(server_info->login_server) {
1042                         my_name = server_info->login_server;
1043                 } else {
1044                         my_name = global_myname();
1045                 }
1046
1047                 status = nt_token_to_group_list(p->mem_ctx, &domain_sid,
1048                                                 server_info->num_sids,
1049                                                 server_info->sids,
1050                                                 &num_gids, &gids);
1051
1052                 if (!NT_STATUS_IS_OK(status)) {
1053                         return status;
1054                 }
1055
1056                 if (server_info->user_session_key.length) {
1057                         memcpy(user_session_key,
1058                                server_info->user_session_key.data,
1059                                MIN(sizeof(user_session_key),
1060                                    server_info->user_session_key.length));
1061                         if (process_creds) {
1062                                 /* Get the pipe session key from the creds. */
1063                                 memcpy(pipe_session_key, p->dc->sess_key, 16);
1064                         } else {
1065                                 /* Get the pipe session key from the schannel. */
1066                                 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1067                                         return NT_STATUS_INVALID_HANDLE;
1068                                 }
1069                                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1070                         }
1071                         SamOEMhash(user_session_key, pipe_session_key, 16);
1072                         memset(pipe_session_key, '\0', 16);
1073                 }
1074                 if (server_info->lm_session_key.length) {
1075                         memcpy(lm_session_key,
1076                                server_info->lm_session_key.data,
1077                                MIN(sizeof(lm_session_key),
1078                                    server_info->lm_session_key.length));
1079                         if (process_creds) {
1080                                 /* Get the pipe session key from the creds. */
1081                                 memcpy(pipe_session_key, p->dc->sess_key, 16);
1082                         } else {
1083                                 /* Get the pipe session key from the schannel. */
1084                                 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1085                                         return NT_STATUS_INVALID_HANDLE;
1086                                 }
1087                                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1088                         }
1089                         SamOEMhash(lm_session_key, pipe_session_key, 16);
1090                         memset(pipe_session_key, '\0', 16);
1091                 }
1092
1093                 init_net_user_info3(p->mem_ctx, usr_info,
1094                                     user_rid,
1095                                     group_rid,
1096                                     pdb_get_username(sampw),
1097                                     pdb_get_fullname(sampw),
1098                                     pdb_get_homedir(sampw),
1099                                     pdb_get_dir_drive(sampw),
1100                                     pdb_get_logon_script(sampw),
1101                                     pdb_get_profile_path(sampw),
1102                                     pdb_get_logon_time(sampw),
1103                                     get_time_t_max(),
1104                                     get_time_t_max(),
1105                                     pdb_get_pass_last_set_time(sampw),
1106                                     pdb_get_pass_can_change_time(sampw),
1107                                     pdb_get_pass_must_change_time(sampw),
1108                                     0, /* logon_count */
1109                                     0, /* bad_pw_count */
1110                                     num_gids,    /* uint32 num_groups */
1111                                     gids    , /* DOM_GID *gids */
1112                                     NETLOGON_EXTRA_SIDS, /* uint32 user_flgs (?) */
1113                                     pdb_get_acct_ctrl(sampw),
1114                                     server_info->user_session_key.length ? user_session_key : NULL,
1115                                     server_info->lm_session_key.length ? lm_session_key : NULL,
1116                                     my_name     , /* char *logon_srv */
1117                                     pdb_get_domain(sampw),
1118                                     &domain_sid);     /* DOM_SID *dom_sid */
1119                 ZERO_STRUCT(user_session_key);
1120                 ZERO_STRUCT(lm_session_key);
1121         }
1122         TALLOC_FREE(server_info);
1123         return status;
1124 }
1125
1126 /*************************************************************************
1127  _net_sam_logon
1128  *************************************************************************/
1129
1130 NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *r_u)
1131 {
1132         return _net_sam_logon_internal(p, q_u, r_u, True);
1133 }
1134
1135 /*************************************************************************
1136  _net_sam_logon_ex - no credential chaining. Map into net sam logon.
1137  *************************************************************************/
1138
1139 NTSTATUS _net_sam_logon_ex(pipes_struct *p, NET_Q_SAM_LOGON_EX *q_u, NET_R_SAM_LOGON_EX *r_u)
1140 {
1141         NET_Q_SAM_LOGON q;
1142         NET_R_SAM_LOGON r;
1143
1144         ZERO_STRUCT(q);
1145         ZERO_STRUCT(r);
1146
1147         /* Only allow this if the pipe is protected. */
1148         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1149                 DEBUG(0,("_net_sam_logon_ex: client %s not using schannel for netlogon\n",
1150                         get_remote_machine_name() ));
1151                 return NT_STATUS_INVALID_PARAMETER;
1152         }
1153
1154         /* Map a NET_Q_SAM_LOGON_EX to NET_Q_SAM_LOGON. */
1155         q.validation_level = q_u->validation_level;
1156
1157         /* Map a DOM_SAM_INFO_EX into a DOM_SAM_INFO with no creds. */
1158         q.sam_id.client.login = q_u->sam_id.client;
1159         q.sam_id.logon_level = q_u->sam_id.logon_level;
1160         q.sam_id.ctr = q_u->sam_id.ctr;
1161
1162         r_u->status = _net_sam_logon_internal(p, &q, &r, False);
1163
1164         if (!NT_STATUS_IS_OK(r_u->status)) {
1165                 return r_u->status;
1166         }
1167
1168         /* Map the NET_R_SAM_LOGON to NET_R_SAM_LOGON_EX. */
1169         r_u->switch_value = r.switch_value;
1170         r_u->user = r.user;
1171         r_u->auth_resp = r.auth_resp;
1172         r_u->flags = 0; /* FIXME ! */
1173         return r_u->status;
1174 }
1175
1176 /*************************************************************************
1177  _ds_enum_dom_trusts
1178  *************************************************************************/
1179 #if 0   /* JERRY -- not correct */
1180  NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1181                              DS_R_ENUM_DOM_TRUSTS *r_u)
1182 {
1183         NTSTATUS status = NT_STATUS_OK;
1184
1185         /* TODO: According to MSDN, the can only be executed against a
1186            DC or domain member running Windows 2000 or later.  Need
1187            to test against a standalone 2k server and see what it
1188            does.  A windows 2000 DC includes its own domain in the
1189            list.  --jerry */
1190
1191         return status;
1192 }
1193 #endif  /* JERRY */
1194
1195
1196 /****************************************************************
1197 ****************************************************************/
1198
1199 WERROR _netr_LogonUasLogon(pipes_struct *p,
1200                            struct netr_LogonUasLogon *r)
1201 {
1202         p->rng_fault_state = true;
1203         return WERR_NOT_SUPPORTED;
1204 }
1205
1206 /****************************************************************
1207 ****************************************************************/
1208
1209 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1210                             struct netr_LogonUasLogoff *r)
1211 {
1212         p->rng_fault_state = true;
1213         return WERR_NOT_SUPPORTED;
1214 }
1215
1216 /****************************************************************
1217 ****************************************************************/
1218
1219 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
1220                              struct netr_LogonSamLogon *r)
1221 {
1222         p->rng_fault_state = true;
1223         return NT_STATUS_NOT_IMPLEMENTED;
1224 }
1225
1226 /****************************************************************
1227 ****************************************************************/
1228
1229 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1230                               struct netr_DatabaseDeltas *r)
1231 {
1232         p->rng_fault_state = true;
1233         return NT_STATUS_NOT_IMPLEMENTED;
1234 }
1235
1236 /****************************************************************
1237 ****************************************************************/
1238
1239 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1240                             struct netr_DatabaseSync *r)
1241 {
1242         p->rng_fault_state = true;
1243         return NT_STATUS_NOT_IMPLEMENTED;
1244 }
1245
1246 /****************************************************************
1247 ****************************************************************/
1248
1249 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1250                              struct netr_AccountDeltas *r)
1251 {
1252         p->rng_fault_state = true;
1253         return NT_STATUS_NOT_IMPLEMENTED;
1254 }
1255
1256 /****************************************************************
1257 ****************************************************************/
1258
1259 NTSTATUS _netr_AccountSync(pipes_struct *p,
1260                            struct netr_AccountSync *r)
1261 {
1262         p->rng_fault_state = true;
1263         return NT_STATUS_NOT_IMPLEMENTED;
1264 }
1265
1266 /****************************************************************
1267 ****************************************************************/
1268
1269 WERROR _netr_GetDcName(pipes_struct *p,
1270                        struct netr_GetDcName *r)
1271 {
1272         p->rng_fault_state = true;
1273         return WERR_NOT_SUPPORTED;
1274 }
1275
1276 /****************************************************************
1277 ****************************************************************/
1278
1279 WERROR _netr_GetAnyDCName(pipes_struct *p,
1280                           struct netr_GetAnyDCName *r)
1281 {
1282         p->rng_fault_state = true;
1283         return WERR_NOT_SUPPORTED;
1284 }
1285
1286 /****************************************************************
1287 ****************************************************************/
1288
1289 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1290                              struct netr_DatabaseSync2 *r)
1291 {
1292         p->rng_fault_state = true;
1293         return NT_STATUS_NOT_IMPLEMENTED;
1294 }
1295
1296 /****************************************************************
1297 ****************************************************************/
1298
1299 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1300                             struct netr_DatabaseRedo *r)
1301 {
1302         p->rng_fault_state = true;
1303         return NT_STATUS_NOT_IMPLEMENTED;
1304 }
1305
1306 /****************************************************************
1307 ****************************************************************/
1308
1309 WERROR _netr_LogonControl2Ex(pipes_struct *p,
1310                              struct netr_LogonControl2Ex *r)
1311 {
1312         p->rng_fault_state = true;
1313         return WERR_NOT_SUPPORTED;
1314 }
1315
1316 /****************************************************************
1317 ****************************************************************/
1318
1319 WERROR _netr_DsRGetDCName(pipes_struct *p,
1320                           struct netr_DsRGetDCName *r)
1321 {
1322         p->rng_fault_state = true;
1323         return WERR_NOT_SUPPORTED;
1324 }
1325
1326 /****************************************************************
1327 ****************************************************************/
1328
1329 WERROR _netr_NETRLOGONDUMMYROUTINE1(pipes_struct *p,
1330                                     struct netr_NETRLOGONDUMMYROUTINE1 *r)
1331 {
1332         p->rng_fault_state = true;
1333         return WERR_NOT_SUPPORTED;
1334 }
1335
1336 /****************************************************************
1337 ****************************************************************/
1338
1339 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1340                                      struct netr_NETRLOGONSETSERVICEBITS *r)
1341 {
1342         p->rng_fault_state = true;
1343         return WERR_NOT_SUPPORTED;
1344 }
1345
1346 /****************************************************************
1347 ****************************************************************/
1348
1349 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1350                               struct netr_LogonGetTrustRid *r)
1351 {
1352         p->rng_fault_state = true;
1353         return WERR_NOT_SUPPORTED;
1354 }
1355
1356 /****************************************************************
1357 ****************************************************************/
1358
1359 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1360                                           struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1361 {
1362         p->rng_fault_state = true;
1363         return WERR_NOT_SUPPORTED;
1364 }
1365
1366 /****************************************************************
1367 ****************************************************************/
1368
1369 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1370                                           struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1371 {
1372         p->rng_fault_state = true;
1373         return WERR_NOT_SUPPORTED;
1374 }
1375
1376 /****************************************************************
1377 ****************************************************************/
1378
1379 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
1380                                    struct netr_ServerAuthenticate3 *r)
1381 {
1382         p->rng_fault_state = true;
1383         return NT_STATUS_NOT_IMPLEMENTED;
1384 }
1385
1386 /****************************************************************
1387 ****************************************************************/
1388
1389 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1390                             struct netr_DsRGetDCNameEx *r)
1391 {
1392         p->rng_fault_state = true;
1393         return WERR_NOT_SUPPORTED;
1394 }
1395
1396 /****************************************************************
1397 ****************************************************************/
1398
1399 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1400                             struct netr_DsRGetSiteName *r)
1401 {
1402         p->rng_fault_state = true;
1403         return WERR_NOT_SUPPORTED;
1404 }
1405
1406 /****************************************************************
1407 ****************************************************************/
1408
1409 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1410                                   struct netr_LogonGetDomainInfo *r)
1411 {
1412         p->rng_fault_state = true;
1413         return NT_STATUS_NOT_IMPLEMENTED;
1414 }
1415
1416 /****************************************************************
1417 ****************************************************************/
1418
1419 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
1420                                   struct netr_ServerPasswordSet2 *r)
1421 {
1422         p->rng_fault_state = true;
1423         return NT_STATUS_NOT_IMPLEMENTED;
1424 }
1425
1426 /****************************************************************
1427 ****************************************************************/
1428
1429 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1430                                struct netr_ServerPasswordGet *r)
1431 {
1432         p->rng_fault_state = true;
1433         return WERR_NOT_SUPPORTED;
1434 }
1435
1436 /****************************************************************
1437 ****************************************************************/
1438
1439 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1440                                 struct netr_NETRLOGONSENDTOSAM *r)
1441 {
1442         p->rng_fault_state = true;
1443         return WERR_NOT_SUPPORTED;
1444 }
1445
1446 /****************************************************************
1447 ****************************************************************/
1448
1449 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1450                                     struct netr_DsRAddressToSitenamesW *r)
1451 {
1452         p->rng_fault_state = true;
1453         return WERR_NOT_SUPPORTED;
1454 }
1455
1456 /****************************************************************
1457 ****************************************************************/
1458
1459 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1460                              struct netr_DsRGetDCNameEx2 *r)
1461 {
1462         p->rng_fault_state = true;
1463         return WERR_NOT_SUPPORTED;
1464 }
1465
1466 /****************************************************************
1467 ****************************************************************/
1468
1469 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1470                                                  struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1471 {
1472         p->rng_fault_state = true;
1473         return WERR_NOT_SUPPORTED;
1474 }
1475
1476 /****************************************************************
1477 ****************************************************************/
1478
1479 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1480                                            struct netr_NetrEnumerateTrustedDomainsEx *r)
1481 {
1482         p->rng_fault_state = true;
1483         return WERR_NOT_SUPPORTED;
1484 }
1485
1486 /****************************************************************
1487 ****************************************************************/
1488
1489 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1490                                       struct netr_DsRAddressToSitenamesExW *r)
1491 {
1492         p->rng_fault_state = true;
1493         return WERR_NOT_SUPPORTED;
1494 }
1495
1496 /****************************************************************
1497 ****************************************************************/
1498
1499 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1500                                    struct netr_DsrGetDcSiteCoverageW *r)
1501 {
1502         p->rng_fault_state = true;
1503         return WERR_NOT_SUPPORTED;
1504 }
1505
1506 /****************************************************************
1507 ****************************************************************/
1508
1509 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1510                                struct netr_LogonSamLogonEx *r)
1511 {
1512         p->rng_fault_state = true;
1513         return NT_STATUS_NOT_IMPLEMENTED;
1514 }
1515
1516 /****************************************************************
1517 ****************************************************************/
1518
1519 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1520                                       struct netr_DsrEnumerateDomainTrusts *r)
1521 {
1522         p->rng_fault_state = true;
1523         return WERR_NOT_SUPPORTED;
1524 }
1525
1526 /****************************************************************
1527 ****************************************************************/
1528
1529 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1530                                          struct netr_DsrDeregisterDNSHostRecords *r)
1531 {
1532         p->rng_fault_state = true;
1533         return WERR_NOT_SUPPORTED;
1534 }
1535
1536 /****************************************************************
1537 ****************************************************************/
1538
1539 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1540                                        struct netr_ServerTrustPasswordsGet *r)
1541 {
1542         p->rng_fault_state = true;
1543         return NT_STATUS_NOT_IMPLEMENTED;
1544 }
1545
1546 /****************************************************************
1547 ****************************************************************/
1548
1549 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1550                                           struct netr_DsRGetForestTrustInformation *r)
1551 {
1552         p->rng_fault_state = true;
1553         return WERR_NOT_SUPPORTED;
1554 }
1555
1556 /****************************************************************
1557 ****************************************************************/
1558
1559 WERROR _netr_GetForestTrustInformation(pipes_struct *p,
1560                                        struct netr_GetForestTrustInformation *r)
1561 {
1562         p->rng_fault_state = true;
1563         return WERR_NOT_SUPPORTED;
1564 }
1565
1566 /****************************************************************
1567 ****************************************************************/
1568
1569 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1570                                       struct netr_LogonSamLogonWithFlags *r)
1571 {
1572         p->rng_fault_state = true;
1573         return NT_STATUS_NOT_IMPLEMENTED;
1574 }
1575
1576 /****************************************************************
1577 ****************************************************************/
1578
1579 WERROR _netr_NETRSERVERGETTRUSTINFO(pipes_struct *p,
1580                                     struct netr_NETRSERVERGETTRUSTINFO *r)
1581 {
1582         p->rng_fault_state = true;
1583         return WERR_NOT_SUPPORTED;
1584 }
1585