source3/rpc_server/srv_netlog_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997.
   7  *  Copyright (C) Jeremy Allison               1998-2001.
   8  *  Copyright (C) Andrew Bartlett                   2001.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 3 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  22  */
  23
  24 /* This is the implementation of the netlogon pipe. */
  25
  26 #include "includes.h"
  27
  28 extern userdom_struct current_user_info;
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_RPC_SRV
  32
  33 /*************************************************************************
  34  init_net_r_req_chal:
  35  *************************************************************************/
  36
  37 static void init_net_r_req_chal(struct netr_Credential *r,
  38                                 struct netr_Credential *srv_chal)
  39 {
  40         DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__));
  41
  42         memcpy(r->data, srv_chal->data, sizeof(r->data));
  43 }
  44
  45 /*******************************************************************
  46  Inits a netr_NETLOGON_INFO_1 structure.
  47 ********************************************************************/
  48
  49 static void init_netlogon_info1(struct netr_NETLOGON_INFO_1 *r,
  50                                 uint32_t flags,
  51                                 uint32_t pdc_connection_status)
  52 {
  53         r->flags = flags;
  54         r->pdc_connection_status = pdc_connection_status;
  55 }
  56
  57 /*******************************************************************
  58  Inits a netr_NETLOGON_INFO_2 structure.
  59 ********************************************************************/
  60
  61 static void init_netlogon_info2(struct netr_NETLOGON_INFO_2 *r,
  62                                 uint32_t flags,
  63                                 uint32_t pdc_connection_status,
  64                                 const char *trusted_dc_name,
  65                                 uint32_t tc_connection_status)
  66 {
  67         r->flags = flags;
  68         r->pdc_connection_status = pdc_connection_status;
  69         r->trusted_dc_name = trusted_dc_name;
  70         r->tc_connection_status = tc_connection_status;
  71 }
  72
  73 /*******************************************************************
  74  Inits a netr_NETLOGON_INFO_3 structure.
  75 ********************************************************************/
  76
  77 static void init_netlogon_info3(struct netr_NETLOGON_INFO_3 *r,
  78                                 uint32_t flags,
  79                                 uint32_t logon_attempts)
  80 {
  81         r->flags = flags;
  82         r->logon_attempts = logon_attempts;
  83 }
  84
  85 /*************************************************************************
  86  _netr_LogonControl
  87  *************************************************************************/
  88
  89 WERROR _netr_LogonControl(pipes_struct *p,
  90                           struct netr_LogonControl *r)
  91 {
  92         struct netr_NETLOGON_INFO_1 *info1;
  93         uint32_t flags = 0x0;
  94         uint32_t pdc_connection_status = W_ERROR_V(WERR_OK);
  95
  96         /* Setup the Logon Control response */
  97
  98         switch (r->in.level) {
  99                 case 1:
 100                         info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
 101                         if (!info1) {
 102                                 return WERR_NOMEM;
 103                         }
 104                         init_netlogon_info1(info1,
 105                                             flags,
 106                                             pdc_connection_status);
 107                         r->out.info->info1 = info1;
 108                         break;
 109                 default:
 110                         return WERR_UNKNOWN_LEVEL;
 111         }
 112
 113         return WERR_OK;
 114 }
 115
 116 /****************************************************************************
 117 Send a message to smbd to do a sam synchronisation
 118 **************************************************************************/
 119
 120 static void send_sync_message(void)
 121 {
 122         DEBUG(3, ("sending sam synchronisation message\n"));
 123         message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
 124                          NULL);
 125 }
 126
 127 /*************************************************************************
 128  _netr_LogonControl2
 129  *************************************************************************/
 130
 131 WERROR _netr_LogonControl2(pipes_struct *p,
 132                            struct netr_LogonControl2 *r)
 133 {
 134         uint32 flags = 0x0;
 135         uint32 pdc_connection_status = 0x0;
 136         uint32 logon_attempts = 0x0;
 137         uint32 tc_status;
 138         fstring dc_name, dc_name2;
 139         struct sockaddr_storage dc_ss;
 140         const char *domain = NULL;
 141         struct netr_NETLOGON_INFO_1 *info1;
 142         struct netr_NETLOGON_INFO_2 *info2;
 143         struct netr_NETLOGON_INFO_3 *info3;
 144
 145         tc_status = W_ERROR_V(WERR_NO_SUCH_DOMAIN);
 146         fstrcpy( dc_name, "" );
 147
 148         switch (r->in.function_code) {
 149                 case NETLOGON_CONTROL_TC_QUERY:
 150                         domain = r->in.data->domain;
 151
 152                         if ( !is_trusted_domain( domain ) )
 153                                 break;
 154
 155                         if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
 156                                 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
 157                                 break;
 158                         }
 159
 160                         fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
 161
 162                         tc_status = W_ERROR_V(WERR_OK);
 163
 164                         break;
 165
 166                 case NETLOGON_CONTROL_REDISCOVER:
 167                         domain = r->in.data->domain;
 168
 169                         if ( !is_trusted_domain( domain ) )
 170                                 break;
 171
 172                         if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
 173                                 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
 174                                 break;
 175                         }
 176
 177                         fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
 178
 179                         tc_status = W_ERROR_V(WERR_OK);
 180
 181                         break;
 182
 183                 default:
 184                         /* no idea what this should be */
 185                         DEBUG(0,("_netr_LogonControl2: unimplemented function level [%d]\n",
 186                                 r->in.function_code));
 187                         return WERR_UNKNOWN_LEVEL;
 188         }
 189
 190         /* prepare the response */
 191
 192         switch (r->in.level) {
 193                 case 1:
 194                         info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
 195                         W_ERROR_HAVE_NO_MEMORY(info1);
 196
 197                         init_netlogon_info1(info1,
 198                                             flags,
 199                                             pdc_connection_status);
 200                         r->out.query->info1 = info1;
 201                         break;
 202                 case 2:
 203                         info2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_2);
 204                         W_ERROR_HAVE_NO_MEMORY(info2);
 205
 206                         init_netlogon_info2(info2,
 207                                             flags,
 208                                             pdc_connection_status,
 209                                             dc_name,
 210                                             tc_status);
 211                         r->out.query->info2 = info2;
 212                         break;
 213                 case 3:
 214                         info3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_3);
 215                         W_ERROR_HAVE_NO_MEMORY(info3);
 216
 217                         init_netlogon_info3(info3,
 218                                             flags,
 219                                             logon_attempts);
 220                         r->out.query->info3 = info3;
 221                         break;
 222                 default:
 223                         return WERR_UNKNOWN_LEVEL;
 224         }
 225
 226         if (lp_server_role() == ROLE_DOMAIN_BDC) {
 227                 send_sync_message();
 228         }
 229
 230         return WERR_OK;
 231 }
 232
 233 /*************************************************************************
 234  _netr_NetrEnumerateTrustedDomains
 235  *************************************************************************/
 236
 237 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
 238                                          struct netr_NetrEnumerateTrustedDomains *r)
 239 {
 240         struct netr_Blob trusted_domains_blob;
 241         DATA_BLOB blob;
 242
 243         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 244
 245         /* set up the Trusted Domain List response */
 246
 247         blob = data_blob_talloc_zero(p->mem_ctx, 2);
 248         trusted_domains_blob.data = blob.data;
 249         trusted_domains_blob.length = blob.length;
 250
 251         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 252
 253         *r->out.trusted_domains_blob = trusted_domains_blob;
 254
 255         return WERR_OK;
 256 }
 257
 258 /******************************************************************
 259  gets a machine password entry.  checks access rights of the host.
 260  ******************************************************************/
 261
 262 static NTSTATUS get_md4pw(char *md4pw, const char *mach_acct, uint16 sec_chan_type)
 263 {
 264         struct samu *sampass = NULL;
 265         const uint8 *pass;
 266         bool ret;
 267         uint32 acct_ctrl;
 268
 269 #if 0
 270         char addr[INET6_ADDRSTRLEN];
 271
 272     /*
 273      * Currently this code is redundent as we already have a filter
 274      * by hostname list. What this code really needs to do is to
 275      * get a hosts allowed/hosts denied list from the SAM database
 276      * on a per user basis, and make the access decision there.
 277      * I will leave this code here for now as a reminder to implement
 278      * this at a later date. JRA.
 279      */
 280
 281         if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
 282                         client_name(get_client_fd()),
 283                         client_addr(get_client_fd(),addr,sizeof(addr)))) {
 284                 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
 285                 return False;
 286         }
 287 #endif /* 0 */
 288
 289         if ( !(sampass = samu_new( NULL )) ) {
 290                 return NT_STATUS_NO_MEMORY;
 291         }
 292
 293         /* JRA. This is ok as it is only used for generating the challenge. */
 294         become_root();
 295         ret = pdb_getsampwnam(sampass, mach_acct);
 296         unbecome_root();
 297
 298         if (!ret) {
 299                 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
 300                 TALLOC_FREE(sampass);
 301                 return NT_STATUS_ACCESS_DENIED;
 302         }
 303
 304         acct_ctrl = pdb_get_acct_ctrl(sampass);
 305         if (acct_ctrl & ACB_DISABLED) {
 306                 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
 307                 TALLOC_FREE(sampass);
 308                 return NT_STATUS_ACCOUNT_DISABLED;
 309         }
 310
 311         if (!(acct_ctrl & ACB_SVRTRUST) &&
 312             !(acct_ctrl & ACB_WSTRUST) &&
 313             !(acct_ctrl & ACB_DOMTRUST))
 314         {
 315                 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
 316                 TALLOC_FREE(sampass);
 317                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 318         }
 319
 320         switch (sec_chan_type) {
 321                 case SEC_CHAN_BDC:
 322                         if (!(acct_ctrl & ACB_SVRTRUST)) {
 323                                 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
 324                                          "but not a server trust account\n", mach_acct));
 325                                 TALLOC_FREE(sampass);
 326                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 327                         }
 328                         break;
 329                 case SEC_CHAN_WKSTA:
 330                         if (!(acct_ctrl & ACB_WSTRUST)) {
 331                                 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
 332                                          "but not a workstation trust account\n", mach_acct));
 333                                 TALLOC_FREE(sampass);
 334                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 335                         }
 336                         break;
 337                 case SEC_CHAN_DOMAIN:
 338                         if (!(acct_ctrl & ACB_DOMTRUST)) {
 339                                 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
 340                                          "but not a interdomain trust account\n", mach_acct));
 341                                 TALLOC_FREE(sampass);
 342                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 343                         }
 344                         break;
 345                 default:
 346                         break;
 347         }
 348
 349         if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
 350                 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
 351                 TALLOC_FREE(sampass);
 352                 return NT_STATUS_LOGON_FAILURE;
 353         }
 354
 355         memcpy(md4pw, pass, 16);
 356         dump_data(5, (uint8 *)md4pw, 16);
 357
 358         TALLOC_FREE(sampass);
 359
 360         return NT_STATUS_OK;
 361
 362
 363 }
 364
 365 /*************************************************************************
 366  _netr_ServerReqChallenge
 367  *************************************************************************/
 368
 369 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
 370                                   struct netr_ServerReqChallenge *r)
 371 {
 372         if (!p->dc) {
 373                 p->dc = TALLOC_ZERO_P(p->pipe_state_mem_ctx, struct dcinfo);
 374                 if (!p->dc) {
 375                         return NT_STATUS_NO_MEMORY;
 376                 }
 377         } else {
 378                 DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
 379                 ZERO_STRUCTP(p->dc);
 380         }
 381
 382         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 383
 384         /* Save the client challenge to the server. */
 385         memcpy(p->dc->clnt_chal.data, r->in.credentials->data,
 386                 sizeof(r->in.credentials->data));
 387
 388         /* Create a server challenge for the client */
 389         /* Set this to a random value. */
 390         generate_random_buffer(p->dc->srv_chal.data, 8);
 391
 392         /* set up the LSA REQUEST CHALLENGE response */
 393         init_net_r_req_chal(r->out.return_credentials, &p->dc->srv_chal);
 394
 395         p->dc->challenge_sent = True;
 396
 397         return NT_STATUS_OK;
 398 }
 399
 400 /*************************************************************************
 401  _netr_ServerAuthenticate
 402  Create the initial credentials.
 403  *************************************************************************/
 404
 405 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
 406                                   struct netr_ServerAuthenticate *r)
 407 {
 408         NTSTATUS status;
 409         struct netr_Credential srv_chal_out;
 410
 411         if (!p->dc || !p->dc->challenge_sent) {
 412                 return NT_STATUS_ACCESS_DENIED;
 413         }
 414
 415         status = get_md4pw((char *)p->dc->mach_pw,
 416                            r->in.account_name,
 417                            r->in.secure_channel_type);
 418         if (!NT_STATUS_IS_OK(status)) {
 419                 DEBUG(0,("_netr_ServerAuthenticate: get_md4pw failed. Failed to "
 420                         "get password for machine account %s "
 421                         "from client %s: %s\n",
 422                         r->in.account_name,
 423                         r->in.computer_name,
 424                         nt_errstr(status) ));
 425                 /* always return NT_STATUS_ACCESS_DENIED */
 426                 return NT_STATUS_ACCESS_DENIED;
 427         }
 428
 429         /* From the client / server challenges and md4 password, generate sess key */
 430         creds_server_init(0,                    /* No neg flags. */
 431                         p->dc,
 432                         &p->dc->clnt_chal,      /* Stored client chal. */
 433                         &p->dc->srv_chal,       /* Stored server chal. */
 434                         p->dc->mach_pw,
 435                         &srv_chal_out);
 436
 437         /* Check client credentials are valid. */
 438         if (!netlogon_creds_server_check(p->dc, r->in.credentials)) {
 439                 DEBUG(0,("_netr_ServerAuthenticate: netlogon_creds_server_check failed. Rejecting auth "
 440                         "request from client %s machine account %s\n",
 441                         r->in.computer_name,
 442                         r->in.account_name));
 443                 return NT_STATUS_ACCESS_DENIED;
 444         }
 445
 446         fstrcpy(p->dc->mach_acct, r->in.account_name);
 447         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 448         p->dc->authenticated = True;
 449
 450         /* set up the LSA AUTH response */
 451         /* Return the server credentials. */
 452
 453         memcpy(r->out.return_credentials->data, &srv_chal_out.data,
 454                sizeof(r->out.return_credentials->data));
 455
 456         return NT_STATUS_OK;
 457 }
 458
 459 /*************************************************************************
 460  _netr_ServerAuthenticate2
 461  *************************************************************************/
 462
 463 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
 464                                    struct netr_ServerAuthenticate2 *r)
 465 {
 466         NTSTATUS status;
 467         uint32_t srv_flgs;
 468         struct netr_Credential srv_chal_out;
 469
 470         /* We use this as the key to store the creds: */
 471         /* r->in.computer_name */
 472
 473         if (!p->dc || !p->dc->challenge_sent) {
 474                 DEBUG(0,("_netr_ServerAuthenticate2: no challenge sent to client %s\n",
 475                         r->in.computer_name));
 476                 return NT_STATUS_ACCESS_DENIED;
 477         }
 478
 479         if ( (lp_server_schannel() == true) &&
 480              ((*r->in.negotiate_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
 481
 482                 /* schannel must be used, but client did not offer it. */
 483                 DEBUG(0,("_netr_ServerAuthenticate2: schannel required but client failed "
 484                         "to offer it. Client was %s\n",
 485                         r->in.account_name));
 486                 return NT_STATUS_ACCESS_DENIED;
 487         }
 488
 489         status = get_md4pw((char *)p->dc->mach_pw,
 490                            r->in.account_name,
 491                            r->in.secure_channel_type);
 492         if (!NT_STATUS_IS_OK(status)) {
 493                 DEBUG(0,("_netr_ServerAuthenticate2: failed to get machine password for "
 494                         "account %s: %s\n",
 495                         r->in.account_name, nt_errstr(status) ));
 496                 /* always return NT_STATUS_ACCESS_DENIED */
 497                 return NT_STATUS_ACCESS_DENIED;
 498         }
 499
 500         /* From the client / server challenges and md4 password, generate sess key */
 501         creds_server_init(*r->in.negotiate_flags,
 502                         p->dc,
 503                         &p->dc->clnt_chal,      /* Stored client chal. */
 504                         &p->dc->srv_chal,       /* Stored server chal. */
 505                         p->dc->mach_pw,
 506                         &srv_chal_out);
 507
 508         /* Check client credentials are valid. */
 509         if (!netlogon_creds_server_check(p->dc, r->in.credentials)) {
 510                 DEBUG(0,("_netr_ServerAuthenticate2: netlogon_creds_server_check failed. Rejecting auth "
 511                         "request from client %s machine account %s\n",
 512                         r->in.computer_name,
 513                         r->in.account_name));
 514                 return NT_STATUS_ACCESS_DENIED;
 515         }
 516
 517         srv_flgs = 0x000001ff;
 518
 519         if (lp_server_schannel() != false) {
 520                 srv_flgs |= NETLOGON_NEG_SCHANNEL;
 521         }
 522
 523         /* set up the LSA AUTH 2 response */
 524         memcpy(r->out.return_credentials->data, &srv_chal_out.data,
 525                sizeof(r->out.return_credentials->data));
 526         *r->out.negotiate_flags = srv_flgs;
 527
 528         fstrcpy(p->dc->mach_acct, r->in.account_name);
 529         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 530         fstrcpy(p->dc->domain, lp_workgroup() );
 531
 532         p->dc->authenticated = True;
 533
 534         /* Store off the state so we can continue after client disconnect. */
 535         become_root();
 536         secrets_store_schannel_session_info(p->mem_ctx,
 537                                             r->in.computer_name,
 538                                             p->dc);
 539         unbecome_root();
 540
 541         return NT_STATUS_OK;
 542 }
 543
 544 /*************************************************************************
 545  _netr_ServerPasswordSet
 546  *************************************************************************/
 547
 548 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
 549                                  struct netr_ServerPasswordSet *r)
 550 {
 551         NTSTATUS status = NT_STATUS_OK;
 552         fstring remote_machine;
 553         struct samu *sampass=NULL;
 554         bool ret = False;
 555         unsigned char pwd[16];
 556         int i;
 557         uint32 acct_ctrl;
 558         struct netr_Authenticator cred_out;
 559         const uchar *old_pw;
 560
 561         DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
 562
 563         /* We need the remote machine name for the creds lookup. */
 564         fstrcpy(remote_machine, r->in.computer_name);
 565
 566         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 567                 /* 'server schannel = yes' should enforce use of
 568                    schannel, the client did offer it in auth2, but
 569                    obviously did not use it. */
 570                 DEBUG(0,("_netr_ServerPasswordSet: client %s not using schannel for netlogon\n",
 571                         remote_machine ));
 572                 return NT_STATUS_ACCESS_DENIED;
 573         }
 574
 575         if (!p->dc) {
 576                 /* Restore the saved state of the netlogon creds. */
 577                 become_root();
 578                 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 579                                                         remote_machine,
 580                                                         &p->dc);
 581                 unbecome_root();
 582                 if (!ret) {
 583                         return NT_STATUS_INVALID_HANDLE;
 584                 }
 585         }
 586
 587         if (!p->dc || !p->dc->authenticated) {
 588                 return NT_STATUS_INVALID_HANDLE;
 589         }
 590
 591         DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
 592                         remote_machine, p->dc->mach_acct));
 593
 594         /* Step the creds chain forward. */
 595         if (!netlogon_creds_server_step(p->dc, r->in.credential, &cred_out)) {
 596                 DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
 597                         "request from client %s machine account %s\n",
 598                         remote_machine, p->dc->mach_acct ));
 599                 return NT_STATUS_INVALID_PARAMETER;
 600         }
 601
 602         /* We must store the creds state after an update. */
 603         sampass = samu_new( NULL );
 604         if (!sampass) {
 605                 return NT_STATUS_NO_MEMORY;
 606         }
 607
 608         become_root();
 609         secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 610                                                 remote_machine,
 611                                                 p->dc);
 612         ret = pdb_getsampwnam(sampass, p->dc->mach_acct);
 613         unbecome_root();
 614
 615         if (!ret) {
 616                 TALLOC_FREE(sampass);
 617                 return NT_STATUS_ACCESS_DENIED;
 618         }
 619
 620         /* Ensure the account exists and is a machine account. */
 621
 622         acct_ctrl = pdb_get_acct_ctrl(sampass);
 623
 624         if (!(acct_ctrl & ACB_WSTRUST ||
 625                       acct_ctrl & ACB_SVRTRUST ||
 626                       acct_ctrl & ACB_DOMTRUST)) {
 627                 TALLOC_FREE(sampass);
 628                 return NT_STATUS_NO_SUCH_USER;
 629         }
 630
 631         if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
 632                 TALLOC_FREE(sampass);
 633                 return NT_STATUS_ACCOUNT_DISABLED;
 634         }
 635
 636         /* Woah - what does this to to the credential chain ? JRA */
 637         cred_hash3(pwd, r->in.new_password->hash, p->dc->sess_key, 0);
 638
 639         DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
 640         for(i = 0; i < sizeof(pwd); i++)
 641                 DEBUG(100,("%02X ", pwd[i]));
 642         DEBUG(100,("\n"));
 643
 644         old_pw = pdb_get_nt_passwd(sampass);
 645
 646         if (old_pw && memcmp(pwd, old_pw, 16) == 0) {
 647                 /* Avoid backend modificiations and other fun if the
 648                    client changed the password to the *same thing* */
 649
 650                 ret = True;
 651         } else {
 652
 653                 /* LM password should be NULL for machines */
 654                 if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
 655                         TALLOC_FREE(sampass);
 656                         return NT_STATUS_NO_MEMORY;
 657                 }
 658
 659                 if (!pdb_set_nt_passwd(sampass, pwd, PDB_CHANGED)) {
 660                         TALLOC_FREE(sampass);
 661                         return NT_STATUS_NO_MEMORY;
 662                 }
 663
 664                 if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
 665                         TALLOC_FREE(sampass);
 666                         /* Not quite sure what this one qualifies as, but this will do */
 667                         return NT_STATUS_UNSUCCESSFUL;
 668                 }
 669
 670                 become_root();
 671                 status = pdb_update_sam_account(sampass);
 672                 unbecome_root();
 673         }
 674
 675         /* set up the LSA Server Password Set response */
 676
 677         memcpy(r->out.return_authenticator, &cred_out,
 678                sizeof(r->out.return_authenticator));
 679
 680         TALLOC_FREE(sampass);
 681         return status;
 682 }
 683
 684 /*************************************************************************
 685  _netr_LogonSamLogoff
 686  *************************************************************************/
 687
 688 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
 689                               struct netr_LogonSamLogoff *r)
 690 {
 691         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 692                 /* 'server schannel = yes' should enforce use of
 693                    schannel, the client did offer it in auth2, but
 694                    obviously did not use it. */
 695                 DEBUG(0,("_netr_LogonSamLogoff: client %s not using schannel for netlogon\n",
 696                         get_remote_machine_name() ));
 697                 return NT_STATUS_ACCESS_DENIED;
 698         }
 699
 700
 701         if (!get_valid_user_struct(p->vuid))
 702                 return NT_STATUS_NO_SUCH_USER;
 703
 704         /* Using the remote machine name for the creds store: */
 705         /* r->in.computer_name */
 706
 707         if (!p->dc) {
 708                 /* Restore the saved state of the netlogon creds. */
 709                 bool ret;
 710
 711                 become_root();
 712                 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 713                                                             r->in.computer_name,
 714                                                             &p->dc);
 715                 unbecome_root();
 716                 if (!ret) {
 717                         return NT_STATUS_INVALID_HANDLE;
 718                 }
 719         }
 720
 721         if (!p->dc || !p->dc->authenticated) {
 722                 return NT_STATUS_INVALID_HANDLE;
 723         }
 724
 725         /* checks and updates credentials.  creates reply credentials */
 726         if (!netlogon_creds_server_step(p->dc, r->in.credential, r->out.return_authenticator)) {
 727                 DEBUG(2,("_netr_LogonSamLogoff: netlogon_creds_server_step failed. Rejecting auth "
 728                         "request from client %s machine account %s\n",
 729                         r->in.computer_name, p->dc->mach_acct ));
 730                 return NT_STATUS_INVALID_PARAMETER;
 731         }
 732
 733         /* We must store the creds state after an update. */
 734         become_root();
 735         secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 736                                             r->in.computer_name,
 737                                             p->dc);
 738         unbecome_root();
 739
 740         return NT_STATUS_OK;
 741 }
 742
 743 /*******************************************************************
 744  gets a domain user's groups from their already-calculated NT_USER_TOKEN
 745  ********************************************************************/
 746
 747 static NTSTATUS nt_token_to_group_list(TALLOC_CTX *mem_ctx,
 748                                        const DOM_SID *domain_sid,
 749                                        size_t num_sids,
 750                                        const DOM_SID *sids,
 751                                        int *numgroups, DOM_GID **pgids)
 752 {
 753         int i;
 754
 755         *numgroups=0;
 756         *pgids = NULL;
 757
 758         for (i=0; i<num_sids; i++) {
 759                 DOM_GID gid;
 760                 if (!sid_peek_check_rid(domain_sid, &sids[i], &gid.g_rid)) {
 761                         continue;
 762                 }
 763                 gid.attr = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
 764                             SE_GROUP_ENABLED);
 765                 ADD_TO_ARRAY(mem_ctx, DOM_GID, gid, pgids, numgroups);
 766                 if (*pgids == NULL) {
 767                         return NT_STATUS_NO_MEMORY;
 768                 }
 769         }
 770         return NT_STATUS_OK;
 771 }
 772
 773 /*************************************************************************
 774  _netr_LogonSamLogon
 775  *************************************************************************/
 776
 777 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
 778                              struct netr_LogonSamLogon *r)
 779 {
 780         NTSTATUS status = NT_STATUS_OK;
 781         struct netr_SamInfo3 *sam3 = NULL;
 782         union netr_LogonLevel *logon = r->in.logon;
 783         fstring nt_username, nt_domain, nt_workstation;
 784         auth_usersupplied_info *user_info = NULL;
 785         auth_serversupplied_info *server_info = NULL;
 786         struct samu *sampw;
 787         struct auth_context *auth_context = NULL;
 788         bool process_creds = true;
 789
 790         switch (p->hdr_req.opnum) {
 791                 case NDR_NETR_LOGONSAMLOGON:
 792                         process_creds = true;
 793                         break;
 794                 case NDR_NETR_LOGONSAMLOGONEX:
 795                 default:
 796                         process_creds = false;
 797         }
 798
 799         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 800                 /* 'server schannel = yes' should enforce use of
 801                    schannel, the client did offer it in auth2, but
 802                    obviously did not use it. */
 803                 DEBUG(0,("_netr_LogonSamLogon: client %s not using schannel for netlogon\n",
 804                         get_remote_machine_name() ));
 805                 return NT_STATUS_ACCESS_DENIED;
 806         }
 807
 808         sam3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo3);
 809         if (!sam3) {
 810                 return NT_STATUS_NO_MEMORY;
 811         }
 812
 813         /* store the user information, if there is any. */
 814         r->out.validation->sam3 = sam3;
 815         *r->out.authoritative = true; /* authoritative response */
 816         if (r->in.validation_level != 2 && r->in.validation_level != 3) {
 817                 DEBUG(0,("_netr_LogonSamLogon: bad validation_level value %d.\n",
 818                         (int)r->in.validation_level));
 819                 return NT_STATUS_ACCESS_DENIED;
 820         }
 821
 822         if (!get_valid_user_struct(p->vuid))
 823                 return NT_STATUS_NO_SUCH_USER;
 824
 825         if (process_creds) {
 826                 fstring remote_machine;
 827
 828                 /* Get the remote machine name for the creds store. */
 829                 /* Note this is the remote machine this request is coming from (member server),
 830                    not neccessarily the workstation name the user is logging onto.
 831                 */
 832
 833                 fstrcpy(remote_machine, r->in.computer_name);
 834
 835                 if (!p->dc) {
 836                         /* Restore the saved state of the netlogon creds. */
 837                         bool ret;
 838
 839                         become_root();
 840                         ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 841                                         remote_machine,
 842                                         &p->dc);
 843                         unbecome_root();
 844                         if (!ret) {
 845                                 return NT_STATUS_INVALID_HANDLE;
 846                         }
 847                 }
 848
 849                 if (!p->dc || !p->dc->authenticated) {
 850                         return NT_STATUS_INVALID_HANDLE;
 851                 }
 852
 853                 /* checks and updates credentials.  creates reply credentials */
 854                 if (!netlogon_creds_server_step(p->dc, r->in.credential,  r->out.return_authenticator)) {
 855                         DEBUG(2,("_netr_LogonSamLogon: creds_server_step failed. Rejecting auth "
 856                                 "request from client %s machine account %s\n",
 857                                 remote_machine, p->dc->mach_acct ));
 858                         return NT_STATUS_INVALID_PARAMETER;
 859                 }
 860
 861                 /* We must store the creds state after an update. */
 862                 become_root();
 863                 secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 864                                         remote_machine,
 865                                         p->dc);
 866                 unbecome_root();
 867         }
 868
 869         switch (r->in.logon_level) {
 870         case INTERACTIVE_LOGON_TYPE:
 871                 fstrcpy(nt_username,
 872                         logon->password->identity_info.account_name.string);
 873                 fstrcpy(nt_domain,
 874                         logon->password->identity_info.domain_name.string);
 875                 fstrcpy(nt_workstation,
 876                         logon->password->identity_info.workstation.string);
 877
 878                 DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
 879                 break;
 880         case NET_LOGON_TYPE:
 881                 fstrcpy(nt_username,
 882                         logon->network->identity_info.account_name.string);
 883                 fstrcpy(nt_domain,
 884                         logon->network->identity_info.domain_name.string);
 885                 fstrcpy(nt_workstation,
 886                         logon->network->identity_info.workstation.string);
 887
 888                 DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
 889                 break;
 890         default:
 891                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 892                 return NT_STATUS_INVALID_INFO_CLASS;
 893         } /* end switch */
 894
 895         DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
 896         fstrcpy(current_user_info.smb_name, nt_username);
 897         sub_set_smb_name(nt_username);
 898
 899         DEBUG(5,("Attempting validation level %d for unmapped username %s.\n",
 900                 r->in.validation_level, nt_username));
 901
 902         status = NT_STATUS_OK;
 903
 904         switch (r->in.logon_level) {
 905         case NET_LOGON_TYPE:
 906         {
 907                 const char *wksname = nt_workstation;
 908
 909                 status = make_auth_context_fixed(&auth_context,
 910                                                  logon->network->challenge);
 911                 if (!NT_STATUS_IS_OK(status)) {
 912                         return status;
 913                 }
 914
 915                 /* For a network logon, the workstation name comes in with two
 916                  * backslashes in the front. Strip them if they are there. */
 917
 918                 if (*wksname == '\\') wksname++;
 919                 if (*wksname == '\\') wksname++;
 920
 921                 /* Standard challenge/response authenticaion */
 922                 if (!make_user_info_netlogon_network(&user_info,
 923                                                      nt_username, nt_domain,
 924                                                      wksname,
 925                                                      logon->network->identity_info.parameter_control,
 926                                                      logon->network->lm.data,
 927                                                      logon->network->lm.length,
 928                                                      logon->network->nt.data,
 929                                                      logon->network->nt.length)) {
 930                         status = NT_STATUS_NO_MEMORY;
 931                 }
 932                 break;
 933         }
 934         case INTERACTIVE_LOGON_TYPE:
 935                 /* 'Interactive' authentication, supplies the password in its
 936                    MD4 form, encrypted with the session key.  We will convert
 937                    this to challenge/response for the auth subsystem to chew
 938                    on */
 939         {
 940                 const uint8 *chal;
 941
 942                 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
 943                         return status;
 944                 }
 945
 946                 chal = auth_context->get_ntlm_challenge(auth_context);
 947
 948                 if (!make_user_info_netlogon_interactive(&user_info,
 949                                                          nt_username, nt_domain,
 950                                                          nt_workstation,
 951                                                          logon->password->identity_info.parameter_control,
 952                                                          chal,
 953                                                          logon->password->lmpassword.hash,
 954                                                          logon->password->ntpassword.hash,
 955                                                          p->dc->sess_key)) {
 956                         status = NT_STATUS_NO_MEMORY;
 957                 }
 958                 break;
 959         }
 960         default:
 961                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 962                 return NT_STATUS_INVALID_INFO_CLASS;
 963         } /* end switch */
 964
 965         if ( NT_STATUS_IS_OK(status) ) {
 966                 status = auth_context->check_ntlm_password(auth_context,
 967                         user_info, &server_info);
 968         }
 969
 970         (auth_context->free)(&auth_context);
 971         free_user_info(&user_info);
 972
 973         DEBUG(5,("_netr_LogonSamLogon: check_password returned status %s\n",
 974                   nt_errstr(status)));
 975
 976         /* Check account and password */
 977
 978         if (!NT_STATUS_IS_OK(status)) {
 979                 /* If we don't know what this domain is, we need to
 980                    indicate that we are not authoritative.  This
 981                    allows the client to decide if it needs to try
 982                    a local user.  Fix by jpjanosi@us.ibm.com, #2976 */
 983                 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
 984                      && !strequal(nt_domain, get_global_sam_name())
 985                      && !is_trusted_domain(nt_domain) )
 986                         *r->out.authoritative = false; /* We are not authoritative */
 987
 988                 TALLOC_FREE(server_info);
 989                 return status;
 990         }
 991
 992         if (server_info->guest) {
 993                 /* We don't like guest domain logons... */
 994                 DEBUG(5,("_netr_LogonSamLogon: Attempted domain logon as GUEST "
 995                          "denied.\n"));
 996                 TALLOC_FREE(server_info);
 997                 return NT_STATUS_LOGON_FAILURE;
 998         }
 999
1000         /* This is the point at which, if the login was successful, that
1001            the SAM Local Security Authority should record that the user is
1002            logged in to the domain.  */
1003
1004         {
1005                 DOM_GID *gids = NULL;
1006                 const DOM_SID *user_sid = NULL;
1007                 const DOM_SID *group_sid = NULL;
1008                 DOM_SID domain_sid;
1009                 uint32 user_rid, group_rid;
1010
1011                 int num_gids = 0;
1012                 const char *my_name;
1013
1014                 struct netr_UserSessionKey user_session_key;
1015                 struct netr_LMSessionKey lm_session_key;
1016                 unsigned char pipe_session_key[16];
1017
1018                 NTTIME last_logon, last_logoff, acct_expiry, last_password_change;
1019                 NTTIME allow_password_change, force_password_change;
1020                 struct samr_RidWithAttributeArray groups;
1021                 int i;
1022                 struct dom_sid2 *sid = NULL;
1023
1024                 ZERO_STRUCT(user_session_key);
1025                 ZERO_STRUCT(lm_session_key);
1026
1027                 sampw = server_info->sam_account;
1028
1029                 user_sid = pdb_get_user_sid(sampw);
1030                 group_sid = pdb_get_group_sid(sampw);
1031
1032                 if ((user_sid == NULL) || (group_sid == NULL)) {
1033                         DEBUG(1, ("_netr_LogonSamLogon: User without group or user SID\n"));
1034                         return NT_STATUS_UNSUCCESSFUL;
1035                 }
1036
1037                 sid_copy(&domain_sid, user_sid);
1038                 sid_split_rid(&domain_sid, &user_rid);
1039
1040                 sid = sid_dup_talloc(p->mem_ctx, &domain_sid);
1041                 if (!sid) {
1042                         return NT_STATUS_NO_MEMORY;
1043                 }
1044
1045                 if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) {
1046                         DEBUG(1, ("_netr_LogonSamLogon: user %s\\%s has user sid "
1047                                   "%s\n but group sid %s.\n"
1048                                   "The conflicting domain portions are not "
1049                                   "supported for NETLOGON calls\n",
1050                                   pdb_get_domain(sampw),
1051                                   pdb_get_username(sampw),
1052                                   sid_string_dbg(user_sid),
1053                                   sid_string_dbg(group_sid)));
1054                         return NT_STATUS_UNSUCCESSFUL;
1055                 }
1056
1057                 if(server_info->login_server) {
1058                         my_name = server_info->login_server;
1059                 } else {
1060                         my_name = global_myname();
1061                 }
1062
1063                 status = nt_token_to_group_list(p->mem_ctx, &domain_sid,
1064                                                 server_info->num_sids,
1065                                                 server_info->sids,
1066                                                 &num_gids, &gids);
1067
1068                 if (!NT_STATUS_IS_OK(status)) {
1069                         return status;
1070                 }
1071
1072                 if (server_info->user_session_key.length) {
1073                         memcpy(user_session_key.key,
1074                                server_info->user_session_key.data,
1075                                MIN(sizeof(user_session_key.key),
1076                                    server_info->user_session_key.length));
1077                         if (process_creds) {
1078                                 /* Get the pipe session key from the creds. */
1079                                 memcpy(pipe_session_key, p->dc->sess_key, 16);
1080                         } else {
1081                                 /* Get the pipe session key from the schannel. */
1082                                 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1083                                         return NT_STATUS_INVALID_HANDLE;
1084                                 }
1085                                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1086                         }
1087                         SamOEMhash(user_session_key.key, pipe_session_key, 16);
1088                         memset(pipe_session_key, '\0', 16);
1089                 }
1090                 if (server_info->lm_session_key.length) {
1091                         memcpy(lm_session_key.key,
1092                                server_info->lm_session_key.data,
1093                                MIN(sizeof(lm_session_key.key),
1094                                    server_info->lm_session_key.length));
1095                         if (process_creds) {
1096                                 /* Get the pipe session key from the creds. */
1097                                 memcpy(pipe_session_key, p->dc->sess_key, 16);
1098                         } else {
1099                                 /* Get the pipe session key from the schannel. */
1100                                 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1101                                         return NT_STATUS_INVALID_HANDLE;
1102                                 }
1103                                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1104                         }
1105                         SamOEMhash(lm_session_key.key, pipe_session_key, 16);
1106                         memset(pipe_session_key, '\0', 16);
1107                 }
1108
1109                 groups.count = num_gids;
1110                 groups.rids = TALLOC_ARRAY(p->mem_ctx, struct samr_RidWithAttribute,
1111                                            groups.count);
1112                 if (!groups.rids) {
1113                         return NT_STATUS_NO_MEMORY;
1114                 }
1115
1116                 for (i=0; i < groups.count; i++) {
1117                         groups.rids[i].rid = gids[i].g_rid;
1118                         groups.rids[i].attributes = gids[i].attr;
1119                 }
1120
1121                 unix_to_nt_time(&last_logon, pdb_get_logon_time(sampw));
1122                 unix_to_nt_time(&last_logoff, get_time_t_max());
1123                 unix_to_nt_time(&acct_expiry, get_time_t_max());
1124                 unix_to_nt_time(&last_password_change, pdb_get_pass_last_set_time(sampw));
1125                 unix_to_nt_time(&allow_password_change, pdb_get_pass_can_change_time(sampw));
1126                 unix_to_nt_time(&force_password_change, pdb_get_pass_must_change_time(sampw));
1127
1128                 init_netr_SamInfo3(sam3,
1129                                    last_logon,
1130                                    last_logoff,
1131                                    acct_expiry,
1132                                    last_password_change,
1133                                    allow_password_change,
1134                                    force_password_change,
1135                                    talloc_strdup(p->mem_ctx, pdb_get_username(sampw)),
1136                                    talloc_strdup(p->mem_ctx, pdb_get_fullname(sampw)),
1137                                    talloc_strdup(p->mem_ctx, pdb_get_logon_script(sampw)),
1138                                    talloc_strdup(p->mem_ctx, pdb_get_profile_path(sampw)),
1139                                    talloc_strdup(p->mem_ctx, pdb_get_homedir(sampw)),
1140                                    talloc_strdup(p->mem_ctx, pdb_get_dir_drive(sampw)),
1141                                    0, /* logon_count */
1142                                    0, /* bad_password_count */
1143                                    user_rid,
1144                                    group_rid,
1145                                    groups,
1146                                    NETLOGON_EXTRA_SIDS,
1147                                    user_session_key,
1148                                    my_name,
1149                                    talloc_strdup(p->mem_ctx, pdb_get_domain(sampw)),
1150                                    sid,
1151                                    lm_session_key,
1152                                    pdb_get_acct_ctrl(sampw),
1153                                    0, /* sidcount */
1154                                    NULL); /* struct netr_SidAttr *sids */
1155                 ZERO_STRUCT(user_session_key);
1156                 ZERO_STRUCT(lm_session_key);
1157         }
1158         TALLOC_FREE(server_info);
1159         return status;
1160 }
1161
1162 /*************************************************************************
1163  _netr_LogonSamLogonEx
1164  - no credential chaining. Map into net sam logon.
1165  *************************************************************************/
1166
1167 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1168                                struct netr_LogonSamLogonEx *r)
1169 {
1170         struct netr_LogonSamLogon q;
1171
1172         /* Only allow this if the pipe is protected. */
1173         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1174                 DEBUG(0,("_net_sam_logon_ex: client %s not using schannel for netlogon\n",
1175                         get_remote_machine_name() ));
1176                 return NT_STATUS_INVALID_PARAMETER;
1177         }
1178
1179         q.in.server_name        = r->in.server_name;
1180         q.in.computer_name      = r->in.computer_name;
1181         q.in.logon_level        = r->in.logon_level;
1182         q.in.logon              = r->in.logon;
1183         q.in.validation_level   = r->in.validation_level;
1184         /* we do not handle the flags */
1185         /*                      = r->in.flags; */
1186
1187         q.out.validation        = r->out.validation;
1188         q.out.authoritative     = r->out.authoritative;
1189         /* we do not handle the flags */
1190         /*                      = r->out.flags; */
1191
1192         return _netr_LogonSamLogon(p, &q);
1193 }
1194
1195 /*************************************************************************
1196  _ds_enum_dom_trusts
1197  *************************************************************************/
1198 #if 0   /* JERRY -- not correct */
1199  NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1200                              DS_R_ENUM_DOM_TRUSTS *r_u)
1201 {
1202         NTSTATUS status = NT_STATUS_OK;
1203
1204         /* TODO: According to MSDN, the can only be executed against a
1205            DC or domain member running Windows 2000 or later.  Need
1206            to test against a standalone 2k server and see what it
1207            does.  A windows 2000 DC includes its own domain in the
1208            list.  --jerry */
1209
1210         return status;
1211 }
1212 #endif  /* JERRY */
1213
1214
1215 /****************************************************************
1216 ****************************************************************/
1217
1218 WERROR _netr_LogonUasLogon(pipes_struct *p,
1219                            struct netr_LogonUasLogon *r)
1220 {
1221         p->rng_fault_state = true;
1222         return WERR_NOT_SUPPORTED;
1223 }
1224
1225 /****************************************************************
1226 ****************************************************************/
1227
1228 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1229                             struct netr_LogonUasLogoff *r)
1230 {
1231         p->rng_fault_state = true;
1232         return WERR_NOT_SUPPORTED;
1233 }
1234
1235 /****************************************************************
1236 ****************************************************************/
1237
1238 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1239                               struct netr_DatabaseDeltas *r)
1240 {
1241         p->rng_fault_state = true;
1242         return NT_STATUS_NOT_IMPLEMENTED;
1243 }
1244
1245 /****************************************************************
1246 ****************************************************************/
1247
1248 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1249                             struct netr_DatabaseSync *r)
1250 {
1251         p->rng_fault_state = true;
1252         return NT_STATUS_NOT_IMPLEMENTED;
1253 }
1254
1255 /****************************************************************
1256 ****************************************************************/
1257
1258 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1259                              struct netr_AccountDeltas *r)
1260 {
1261         p->rng_fault_state = true;
1262         return NT_STATUS_NOT_IMPLEMENTED;
1263 }
1264
1265 /****************************************************************
1266 ****************************************************************/
1267
1268 NTSTATUS _netr_AccountSync(pipes_struct *p,
1269                            struct netr_AccountSync *r)
1270 {
1271         p->rng_fault_state = true;
1272         return NT_STATUS_NOT_IMPLEMENTED;
1273 }
1274
1275 /****************************************************************
1276 ****************************************************************/
1277
1278 WERROR _netr_GetDcName(pipes_struct *p,
1279                        struct netr_GetDcName *r)
1280 {
1281         p->rng_fault_state = true;
1282         return WERR_NOT_SUPPORTED;
1283 }
1284
1285 /****************************************************************
1286 ****************************************************************/
1287
1288 WERROR _netr_GetAnyDCName(pipes_struct *p,
1289                           struct netr_GetAnyDCName *r)
1290 {
1291         p->rng_fault_state = true;
1292         return WERR_NOT_SUPPORTED;
1293 }
1294
1295 /****************************************************************
1296 ****************************************************************/
1297
1298 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1299                              struct netr_DatabaseSync2 *r)
1300 {
1301         p->rng_fault_state = true;
1302         return NT_STATUS_NOT_IMPLEMENTED;
1303 }
1304
1305 /****************************************************************
1306 ****************************************************************/
1307
1308 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1309                             struct netr_DatabaseRedo *r)
1310 {
1311         p->rng_fault_state = true;
1312         return NT_STATUS_NOT_IMPLEMENTED;
1313 }
1314
1315 /****************************************************************
1316 ****************************************************************/
1317
1318 WERROR _netr_LogonControl2Ex(pipes_struct *p,
1319                              struct netr_LogonControl2Ex *r)
1320 {
1321         p->rng_fault_state = true;
1322         return WERR_NOT_SUPPORTED;
1323 }
1324
1325 /****************************************************************
1326 ****************************************************************/
1327
1328 WERROR _netr_DsRGetDCName(pipes_struct *p,
1329                           struct netr_DsRGetDCName *r)
1330 {
1331         p->rng_fault_state = true;
1332         return WERR_NOT_SUPPORTED;
1333 }
1334
1335 /****************************************************************
1336 ****************************************************************/
1337
1338 WERROR _netr_NETRLOGONDUMMYROUTINE1(pipes_struct *p,
1339                                     struct netr_NETRLOGONDUMMYROUTINE1 *r)
1340 {
1341         p->rng_fault_state = true;
1342         return WERR_NOT_SUPPORTED;
1343 }
1344
1345 /****************************************************************
1346 ****************************************************************/
1347
1348 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1349                                      struct netr_NETRLOGONSETSERVICEBITS *r)
1350 {
1351         p->rng_fault_state = true;
1352         return WERR_NOT_SUPPORTED;
1353 }
1354
1355 /****************************************************************
1356 ****************************************************************/
1357
1358 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1359                               struct netr_LogonGetTrustRid *r)
1360 {
1361         p->rng_fault_state = true;
1362         return WERR_NOT_SUPPORTED;
1363 }
1364
1365 /****************************************************************
1366 ****************************************************************/
1367
1368 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1369                                           struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1370 {
1371         p->rng_fault_state = true;
1372         return WERR_NOT_SUPPORTED;
1373 }
1374
1375 /****************************************************************
1376 ****************************************************************/
1377
1378 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1379                                           struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1380 {
1381         p->rng_fault_state = true;
1382         return WERR_NOT_SUPPORTED;
1383 }
1384
1385 /****************************************************************
1386 ****************************************************************/
1387
1388 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
1389                                    struct netr_ServerAuthenticate3 *r)
1390 {
1391         p->rng_fault_state = true;
1392         return NT_STATUS_NOT_IMPLEMENTED;
1393 }
1394
1395 /****************************************************************
1396 ****************************************************************/
1397
1398 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1399                             struct netr_DsRGetDCNameEx *r)
1400 {
1401         p->rng_fault_state = true;
1402         return WERR_NOT_SUPPORTED;
1403 }
1404
1405 /****************************************************************
1406 ****************************************************************/
1407
1408 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1409                             struct netr_DsRGetSiteName *r)
1410 {
1411         p->rng_fault_state = true;
1412         return WERR_NOT_SUPPORTED;
1413 }
1414
1415 /****************************************************************
1416 ****************************************************************/
1417
1418 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1419                                   struct netr_LogonGetDomainInfo *r)
1420 {
1421         p->rng_fault_state = true;
1422         return NT_STATUS_NOT_IMPLEMENTED;
1423 }
1424
1425 /****************************************************************
1426 ****************************************************************/
1427
1428 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
1429                                   struct netr_ServerPasswordSet2 *r)
1430 {
1431         p->rng_fault_state = true;
1432         return NT_STATUS_NOT_IMPLEMENTED;
1433 }
1434
1435 /****************************************************************
1436 ****************************************************************/
1437
1438 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1439                                struct netr_ServerPasswordGet *r)
1440 {
1441         p->rng_fault_state = true;
1442         return WERR_NOT_SUPPORTED;
1443 }
1444
1445 /****************************************************************
1446 ****************************************************************/
1447
1448 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1449                                 struct netr_NETRLOGONSENDTOSAM *r)
1450 {
1451         p->rng_fault_state = true;
1452         return WERR_NOT_SUPPORTED;
1453 }
1454
1455 /****************************************************************
1456 ****************************************************************/
1457
1458 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1459                                     struct netr_DsRAddressToSitenamesW *r)
1460 {
1461         p->rng_fault_state = true;
1462         return WERR_NOT_SUPPORTED;
1463 }
1464
1465 /****************************************************************
1466 ****************************************************************/
1467
1468 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1469                              struct netr_DsRGetDCNameEx2 *r)
1470 {
1471         p->rng_fault_state = true;
1472         return WERR_NOT_SUPPORTED;
1473 }
1474
1475 /****************************************************************
1476 ****************************************************************/
1477
1478 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1479                                                  struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1480 {
1481         p->rng_fault_state = true;
1482         return WERR_NOT_SUPPORTED;
1483 }
1484
1485 /****************************************************************
1486 ****************************************************************/
1487
1488 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1489                                            struct netr_NetrEnumerateTrustedDomainsEx *r)
1490 {
1491         p->rng_fault_state = true;
1492         return WERR_NOT_SUPPORTED;
1493 }
1494
1495 /****************************************************************
1496 ****************************************************************/
1497
1498 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1499                                       struct netr_DsRAddressToSitenamesExW *r)
1500 {
1501         p->rng_fault_state = true;
1502         return WERR_NOT_SUPPORTED;
1503 }
1504
1505 /****************************************************************
1506 ****************************************************************/
1507
1508 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1509                                    struct netr_DsrGetDcSiteCoverageW *r)
1510 {
1511         p->rng_fault_state = true;
1512         return WERR_NOT_SUPPORTED;
1513 }
1514
1515 /****************************************************************
1516 ****************************************************************/
1517
1518 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1519                                       struct netr_DsrEnumerateDomainTrusts *r)
1520 {
1521         p->rng_fault_state = true;
1522         return WERR_NOT_SUPPORTED;
1523 }
1524
1525 /****************************************************************
1526 ****************************************************************/
1527
1528 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1529                                          struct netr_DsrDeregisterDNSHostRecords *r)
1530 {
1531         p->rng_fault_state = true;
1532         return WERR_NOT_SUPPORTED;
1533 }
1534
1535 /****************************************************************
1536 ****************************************************************/
1537
1538 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1539                                        struct netr_ServerTrustPasswordsGet *r)
1540 {
1541         p->rng_fault_state = true;
1542         return NT_STATUS_NOT_IMPLEMENTED;
1543 }
1544
1545 /****************************************************************
1546 ****************************************************************/
1547
1548 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1549                                           struct netr_DsRGetForestTrustInformation *r)
1550 {
1551         p->rng_fault_state = true;
1552         return WERR_NOT_SUPPORTED;
1553 }
1554
1555 /****************************************************************
1556 ****************************************************************/
1557
1558 WERROR _netr_GetForestTrustInformation(pipes_struct *p,
1559                                        struct netr_GetForestTrustInformation *r)
1560 {
1561         p->rng_fault_state = true;
1562         return WERR_NOT_SUPPORTED;
1563 }
1564
1565 /****************************************************************
1566 ****************************************************************/
1567
1568 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1569                                       struct netr_LogonSamLogonWithFlags *r)
1570 {
1571         p->rng_fault_state = true;
1572         return NT_STATUS_NOT_IMPLEMENTED;
1573 }
1574
1575 /****************************************************************
1576 ****************************************************************/
1577
1578 WERROR _netr_NETRSERVERGETTRUSTINFO(pipes_struct *p,
1579                                     struct netr_NETRSERVERGETTRUSTINFO *r)
1580 {
1581         p->rng_fault_state = true;
1582         return WERR_NOT_SUPPORTED;
1583 }
1584