source3/rpc_server/srv_netlog_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997.
   7  *  Copyright (C) Jeremy Allison               1998-2001.
   8  *  Copyright (C) Andrew Bartlett                   2001.
   9  *  Copyright (C) Guenther Deschner                 2008.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 3 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25 /* This is the implementation of the netlogon pipe. */
  26
  27 #include "includes.h"
  28
  29 extern userdom_struct current_user_info;
  30
  31 #undef DBGC_CLASS
  32 #define DBGC_CLASS DBGC_RPC_SRV
  33
  34 /*************************************************************************
  35  init_net_r_req_chal:
  36  *************************************************************************/
  37
  38 static void init_net_r_req_chal(struct netr_Credential *r,
  39                                 struct netr_Credential *srv_chal)
  40 {
  41         DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__));
  42
  43         memcpy(r->data, srv_chal->data, sizeof(r->data));
  44 }
  45
  46 /*******************************************************************
  47  Inits a netr_NETLOGON_INFO_1 structure.
  48 ********************************************************************/
  49
  50 static void init_netlogon_info1(struct netr_NETLOGON_INFO_1 *r,
  51                                 uint32_t flags,
  52                                 uint32_t pdc_connection_status)
  53 {
  54         r->flags = flags;
  55         r->pdc_connection_status = pdc_connection_status;
  56 }
  57
  58 /*******************************************************************
  59  Inits a netr_NETLOGON_INFO_2 structure.
  60 ********************************************************************/
  61
  62 static void init_netlogon_info2(struct netr_NETLOGON_INFO_2 *r,
  63                                 uint32_t flags,
  64                                 uint32_t pdc_connection_status,
  65                                 const char *trusted_dc_name,
  66                                 uint32_t tc_connection_status)
  67 {
  68         r->flags = flags;
  69         r->pdc_connection_status = pdc_connection_status;
  70         r->trusted_dc_name = trusted_dc_name;
  71         r->tc_connection_status = tc_connection_status;
  72 }
  73
  74 /*******************************************************************
  75  Inits a netr_NETLOGON_INFO_3 structure.
  76 ********************************************************************/
  77
  78 static void init_netlogon_info3(struct netr_NETLOGON_INFO_3 *r,
  79                                 uint32_t flags,
  80                                 uint32_t logon_attempts)
  81 {
  82         r->flags = flags;
  83         r->logon_attempts = logon_attempts;
  84 }
  85
  86 /*************************************************************************
  87  _netr_LogonControl
  88  *************************************************************************/
  89
  90 WERROR _netr_LogonControl(pipes_struct *p,
  91                           struct netr_LogonControl *r)
  92 {
  93         struct netr_LogonControl2Ex l;
  94
  95         switch (r->in.level) {
  96         case 1:
  97                 break;
  98         case 2:
  99                 return WERR_NOT_SUPPORTED;
 100         default:
 101                 return WERR_UNKNOWN_LEVEL;
 102         }
 103
 104         l.in.logon_server       = r->in.logon_server;
 105         l.in.function_code      = r->in.function_code;
 106         l.in.level              = r->in.level;
 107         l.in.data               = NULL;
 108         l.out.query             = r->out.info;
 109
 110         return _netr_LogonControl2Ex(p, &l);
 111 }
 112
 113 /****************************************************************************
 114 Send a message to smbd to do a sam synchronisation
 115 **************************************************************************/
 116
 117 static void send_sync_message(void)
 118 {
 119         DEBUG(3, ("sending sam synchronisation message\n"));
 120         message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
 121                          NULL);
 122 }
 123
 124 /*************************************************************************
 125  _netr_LogonControl2
 126  *************************************************************************/
 127
 128 WERROR _netr_LogonControl2(pipes_struct *p,
 129                            struct netr_LogonControl2 *r)
 130 {
 131         struct netr_LogonControl2Ex l;
 132
 133         l.in.logon_server       = r->in.logon_server;
 134         l.in.function_code      = r->in.function_code;
 135         l.in.level              = r->in.level;
 136         l.in.data               = r->in.data;
 137         l.out.query             = r->out.query;
 138
 139         return _netr_LogonControl2Ex(p, &l);
 140 }
 141
 142 /****************************************************************
 143  _netr_LogonControl2Ex
 144 ****************************************************************/
 145
 146 WERROR _netr_LogonControl2Ex(pipes_struct *p,
 147                              struct netr_LogonControl2Ex *r)
 148 {
 149         uint32 flags = 0x0;
 150         uint32 pdc_connection_status = 0x0;
 151         uint32 logon_attempts = 0x0;
 152         uint32 tc_status;
 153         fstring dc_name2;
 154         const char *dc_name = NULL;
 155         struct sockaddr_storage dc_ss;
 156         const char *domain = NULL;
 157         struct netr_NETLOGON_INFO_1 *info1;
 158         struct netr_NETLOGON_INFO_2 *info2;
 159         struct netr_NETLOGON_INFO_3 *info3;
 160
 161         tc_status = W_ERROR_V(WERR_NO_SUCH_DOMAIN);
 162
 163         switch (r->in.function_code) {
 164                 case NETLOGON_CONTROL_TC_QUERY:
 165                         domain = r->in.data->domain;
 166
 167                         if ( !is_trusted_domain( domain ) )
 168                                 break;
 169
 170                         if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
 171                                 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
 172                                 break;
 173                         }
 174
 175                         dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
 176                         if (!dc_name) {
 177                                 return WERR_NOMEM;
 178                         }
 179
 180                         tc_status = W_ERROR_V(WERR_OK);
 181
 182                         break;
 183
 184                 case NETLOGON_CONTROL_REDISCOVER:
 185                         domain = r->in.data->domain;
 186
 187                         if ( !is_trusted_domain( domain ) )
 188                                 break;
 189
 190                         if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
 191                                 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
 192                                 break;
 193                         }
 194
 195                         dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
 196                         if (!dc_name) {
 197                                 return WERR_NOMEM;
 198                         }
 199
 200                         tc_status = W_ERROR_V(WERR_OK);
 201
 202                         break;
 203
 204                 default:
 205                         /* no idea what this should be */
 206                         DEBUG(0,("_netr_LogonControl2: unimplemented function level [%d]\n",
 207                                 r->in.function_code));
 208                         return WERR_UNKNOWN_LEVEL;
 209         }
 210
 211         /* prepare the response */
 212
 213         switch (r->in.level) {
 214                 case 1:
 215                         info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
 216                         W_ERROR_HAVE_NO_MEMORY(info1);
 217
 218                         init_netlogon_info1(info1,
 219                                             flags,
 220                                             pdc_connection_status);
 221                         r->out.query->info1 = info1;
 222                         break;
 223                 case 2:
 224                         info2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_2);
 225                         W_ERROR_HAVE_NO_MEMORY(info2);
 226
 227                         init_netlogon_info2(info2,
 228                                             flags,
 229                                             pdc_connection_status,
 230                                             dc_name,
 231                                             tc_status);
 232                         r->out.query->info2 = info2;
 233                         break;
 234                 case 3:
 235                         info3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_3);
 236                         W_ERROR_HAVE_NO_MEMORY(info3);
 237
 238                         init_netlogon_info3(info3,
 239                                             flags,
 240                                             logon_attempts);
 241                         r->out.query->info3 = info3;
 242                         break;
 243                 default:
 244                         return WERR_UNKNOWN_LEVEL;
 245         }
 246
 247         if (lp_server_role() == ROLE_DOMAIN_BDC) {
 248                 send_sync_message();
 249         }
 250
 251         return WERR_OK;
 252 }
 253
 254 /*************************************************************************
 255  _netr_NetrEnumerateTrustedDomains
 256  *************************************************************************/
 257
 258 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
 259                                          struct netr_NetrEnumerateTrustedDomains *r)
 260 {
 261         struct netr_Blob trusted_domains_blob;
 262         DATA_BLOB blob;
 263
 264         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 265
 266         /* set up the Trusted Domain List response */
 267
 268         blob = data_blob_talloc_zero(p->mem_ctx, 2);
 269         trusted_domains_blob.data = blob.data;
 270         trusted_domains_blob.length = blob.length;
 271
 272         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 273
 274         *r->out.trusted_domains_blob = trusted_domains_blob;
 275
 276         return WERR_OK;
 277 }
 278
 279 /******************************************************************
 280  gets a machine password entry.  checks access rights of the host.
 281  ******************************************************************/
 282
 283 static NTSTATUS get_md4pw(char *md4pw, const char *mach_acct, uint16 sec_chan_type)
 284 {
 285         struct samu *sampass = NULL;
 286         const uint8 *pass;
 287         bool ret;
 288         uint32 acct_ctrl;
 289
 290 #if 0
 291         char addr[INET6_ADDRSTRLEN];
 292
 293     /*
 294      * Currently this code is redundent as we already have a filter
 295      * by hostname list. What this code really needs to do is to
 296      * get a hosts allowed/hosts denied list from the SAM database
 297      * on a per user basis, and make the access decision there.
 298      * I will leave this code here for now as a reminder to implement
 299      * this at a later date. JRA.
 300      */
 301
 302         if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
 303                         client_name(get_client_fd()),
 304                         client_addr(get_client_fd(),addr,sizeof(addr)))) {
 305                 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
 306                 return False;
 307         }
 308 #endif /* 0 */
 309
 310         if ( !(sampass = samu_new( NULL )) ) {
 311                 return NT_STATUS_NO_MEMORY;
 312         }
 313
 314         /* JRA. This is ok as it is only used for generating the challenge. */
 315         become_root();
 316         ret = pdb_getsampwnam(sampass, mach_acct);
 317         unbecome_root();
 318
 319         if (!ret) {
 320                 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
 321                 TALLOC_FREE(sampass);
 322                 return NT_STATUS_ACCESS_DENIED;
 323         }
 324
 325         acct_ctrl = pdb_get_acct_ctrl(sampass);
 326         if (acct_ctrl & ACB_DISABLED) {
 327                 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
 328                 TALLOC_FREE(sampass);
 329                 return NT_STATUS_ACCOUNT_DISABLED;
 330         }
 331
 332         if (!(acct_ctrl & ACB_SVRTRUST) &&
 333             !(acct_ctrl & ACB_WSTRUST) &&
 334             !(acct_ctrl & ACB_DOMTRUST))
 335         {
 336                 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
 337                 TALLOC_FREE(sampass);
 338                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 339         }
 340
 341         switch (sec_chan_type) {
 342                 case SEC_CHAN_BDC:
 343                         if (!(acct_ctrl & ACB_SVRTRUST)) {
 344                                 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
 345                                          "but not a server trust account\n", mach_acct));
 346                                 TALLOC_FREE(sampass);
 347                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 348                         }
 349                         break;
 350                 case SEC_CHAN_WKSTA:
 351                         if (!(acct_ctrl & ACB_WSTRUST)) {
 352                                 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
 353                                          "but not a workstation trust account\n", mach_acct));
 354                                 TALLOC_FREE(sampass);
 355                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 356                         }
 357                         break;
 358                 case SEC_CHAN_DOMAIN:
 359                         if (!(acct_ctrl & ACB_DOMTRUST)) {
 360                                 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
 361                                          "but not a interdomain trust account\n", mach_acct));
 362                                 TALLOC_FREE(sampass);
 363                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 364                         }
 365                         break;
 366                 default:
 367                         break;
 368         }
 369
 370         if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
 371                 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
 372                 TALLOC_FREE(sampass);
 373                 return NT_STATUS_LOGON_FAILURE;
 374         }
 375
 376         memcpy(md4pw, pass, 16);
 377         dump_data(5, (uint8 *)md4pw, 16);
 378
 379         TALLOC_FREE(sampass);
 380
 381         return NT_STATUS_OK;
 382
 383
 384 }
 385
 386 /*************************************************************************
 387  _netr_ServerReqChallenge
 388  *************************************************************************/
 389
 390 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
 391                                   struct netr_ServerReqChallenge *r)
 392 {
 393         if (!p->dc) {
 394                 p->dc = TALLOC_ZERO_P(p, struct dcinfo);
 395                 if (!p->dc) {
 396                         return NT_STATUS_NO_MEMORY;
 397                 }
 398         } else {
 399                 DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
 400                 ZERO_STRUCTP(p->dc);
 401         }
 402
 403         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 404
 405         /* Save the client challenge to the server. */
 406         memcpy(p->dc->clnt_chal.data, r->in.credentials->data,
 407                 sizeof(r->in.credentials->data));
 408
 409         /* Create a server challenge for the client */
 410         /* Set this to a random value. */
 411         generate_random_buffer(p->dc->srv_chal.data, 8);
 412
 413         /* set up the LSA REQUEST CHALLENGE response */
 414         init_net_r_req_chal(r->out.return_credentials, &p->dc->srv_chal);
 415
 416         p->dc->challenge_sent = True;
 417
 418         return NT_STATUS_OK;
 419 }
 420
 421 /*************************************************************************
 422  _netr_ServerAuthenticate
 423  Create the initial credentials.
 424  *************************************************************************/
 425
 426 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
 427                                   struct netr_ServerAuthenticate *r)
 428 {
 429         NTSTATUS status;
 430         struct netr_Credential srv_chal_out;
 431
 432         if (!p->dc || !p->dc->challenge_sent) {
 433                 return NT_STATUS_ACCESS_DENIED;
 434         }
 435
 436         status = get_md4pw((char *)p->dc->mach_pw,
 437                            r->in.account_name,
 438                            r->in.secure_channel_type);
 439         if (!NT_STATUS_IS_OK(status)) {
 440                 DEBUG(0,("_netr_ServerAuthenticate: get_md4pw failed. Failed to "
 441                         "get password for machine account %s "
 442                         "from client %s: %s\n",
 443                         r->in.account_name,
 444                         r->in.computer_name,
 445                         nt_errstr(status) ));
 446                 /* always return NT_STATUS_ACCESS_DENIED */
 447                 return NT_STATUS_ACCESS_DENIED;
 448         }
 449
 450         /* From the client / server challenges and md4 password, generate sess key */
 451         creds_server_init(0,                    /* No neg flags. */
 452                         p->dc,
 453                         &p->dc->clnt_chal,      /* Stored client chal. */
 454                         &p->dc->srv_chal,       /* Stored server chal. */
 455                         p->dc->mach_pw,
 456                         &srv_chal_out);
 457
 458         /* Check client credentials are valid. */
 459         if (!netlogon_creds_server_check(p->dc, r->in.credentials)) {
 460                 DEBUG(0,("_netr_ServerAuthenticate: netlogon_creds_server_check failed. Rejecting auth "
 461                         "request from client %s machine account %s\n",
 462                         r->in.computer_name,
 463                         r->in.account_name));
 464                 return NT_STATUS_ACCESS_DENIED;
 465         }
 466
 467         fstrcpy(p->dc->mach_acct, r->in.account_name);
 468         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 469         p->dc->authenticated = True;
 470
 471         /* set up the LSA AUTH response */
 472         /* Return the server credentials. */
 473
 474         memcpy(r->out.return_credentials->data, &srv_chal_out.data,
 475                sizeof(r->out.return_credentials->data));
 476
 477         return NT_STATUS_OK;
 478 }
 479
 480 /*************************************************************************
 481  _netr_ServerAuthenticate2
 482  *************************************************************************/
 483
 484 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
 485                                    struct netr_ServerAuthenticate2 *r)
 486 {
 487         NTSTATUS status;
 488         uint32_t srv_flgs;
 489         struct netr_Credential srv_chal_out;
 490
 491         /* We use this as the key to store the creds: */
 492         /* r->in.computer_name */
 493
 494         if (!p->dc || !p->dc->challenge_sent) {
 495                 DEBUG(0,("_netr_ServerAuthenticate2: no challenge sent to client %s\n",
 496                         r->in.computer_name));
 497                 return NT_STATUS_ACCESS_DENIED;
 498         }
 499
 500         if ( (lp_server_schannel() == true) &&
 501              ((*r->in.negotiate_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
 502
 503                 /* schannel must be used, but client did not offer it. */
 504                 DEBUG(0,("_netr_ServerAuthenticate2: schannel required but client failed "
 505                         "to offer it. Client was %s\n",
 506                         r->in.account_name));
 507                 return NT_STATUS_ACCESS_DENIED;
 508         }
 509
 510         status = get_md4pw((char *)p->dc->mach_pw,
 511                            r->in.account_name,
 512                            r->in.secure_channel_type);
 513         if (!NT_STATUS_IS_OK(status)) {
 514                 DEBUG(0,("_netr_ServerAuthenticate2: failed to get machine password for "
 515                         "account %s: %s\n",
 516                         r->in.account_name, nt_errstr(status) ));
 517                 /* always return NT_STATUS_ACCESS_DENIED */
 518                 return NT_STATUS_ACCESS_DENIED;
 519         }
 520
 521         /* From the client / server challenges and md4 password, generate sess key */
 522         creds_server_init(*r->in.negotiate_flags,
 523                         p->dc,
 524                         &p->dc->clnt_chal,      /* Stored client chal. */
 525                         &p->dc->srv_chal,       /* Stored server chal. */
 526                         p->dc->mach_pw,
 527                         &srv_chal_out);
 528
 529         /* Check client credentials are valid. */
 530         if (!netlogon_creds_server_check(p->dc, r->in.credentials)) {
 531                 DEBUG(0,("_netr_ServerAuthenticate2: netlogon_creds_server_check failed. Rejecting auth "
 532                         "request from client %s machine account %s\n",
 533                         r->in.computer_name,
 534                         r->in.account_name));
 535                 return NT_STATUS_ACCESS_DENIED;
 536         }
 537
 538         /* 0x000001ff */
 539         srv_flgs = NETLOGON_NEG_ACCOUNT_LOCKOUT |
 540                    NETLOGON_NEG_PERSISTENT_SAMREPL |
 541                    NETLOGON_NEG_ARCFOUR |
 542                    NETLOGON_NEG_PROMOTION_COUNT |
 543                    NETLOGON_NEG_CHANGELOG_BDC |
 544                    NETLOGON_NEG_FULL_SYNC_REPL |
 545                    NETLOGON_NEG_MULTIPLE_SIDS |
 546                    NETLOGON_NEG_REDO |
 547                    NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL;
 548
 549         if (lp_server_schannel() != false) {
 550                 srv_flgs |= NETLOGON_NEG_SCHANNEL;
 551         }
 552
 553         /* set up the LSA AUTH 2 response */
 554         memcpy(r->out.return_credentials->data, &srv_chal_out.data,
 555                sizeof(r->out.return_credentials->data));
 556         *r->out.negotiate_flags = srv_flgs;
 557
 558         fstrcpy(p->dc->mach_acct, r->in.account_name);
 559         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 560         fstrcpy(p->dc->domain, lp_workgroup() );
 561
 562         p->dc->authenticated = True;
 563
 564         /* Store off the state so we can continue after client disconnect. */
 565         become_root();
 566         secrets_store_schannel_session_info(p->mem_ctx,
 567                                             r->in.computer_name,
 568                                             p->dc);
 569         unbecome_root();
 570
 571         return NT_STATUS_OK;
 572 }
 573
 574 /*************************************************************************
 575  _netr_ServerPasswordSet
 576  *************************************************************************/
 577
 578 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
 579                                  struct netr_ServerPasswordSet *r)
 580 {
 581         NTSTATUS status = NT_STATUS_OK;
 582         fstring remote_machine;
 583         struct samu *sampass=NULL;
 584         bool ret = False;
 585         unsigned char pwd[16];
 586         int i;
 587         uint32 acct_ctrl;
 588         struct netr_Authenticator cred_out;
 589         const uchar *old_pw;
 590
 591         DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
 592
 593         /* We need the remote machine name for the creds lookup. */
 594         fstrcpy(remote_machine, r->in.computer_name);
 595
 596         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 597                 /* 'server schannel = yes' should enforce use of
 598                    schannel, the client did offer it in auth2, but
 599                    obviously did not use it. */
 600                 DEBUG(0,("_netr_ServerPasswordSet: client %s not using schannel for netlogon\n",
 601                         remote_machine ));
 602                 return NT_STATUS_ACCESS_DENIED;
 603         }
 604
 605         if (!p->dc) {
 606                 /* Restore the saved state of the netlogon creds. */
 607                 become_root();
 608                 ret = secrets_restore_schannel_session_info(p, remote_machine,
 609                                                             &p->dc);
 610                 unbecome_root();
 611                 if (!ret) {
 612                         return NT_STATUS_INVALID_HANDLE;
 613                 }
 614         }
 615
 616         if (!p->dc || !p->dc->authenticated) {
 617                 return NT_STATUS_INVALID_HANDLE;
 618         }
 619
 620         DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
 621                         remote_machine, p->dc->mach_acct));
 622
 623         /* Step the creds chain forward. */
 624         if (!netlogon_creds_server_step(p->dc, r->in.credential, &cred_out)) {
 625                 DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
 626                         "request from client %s machine account %s\n",
 627                         remote_machine, p->dc->mach_acct ));
 628                 return NT_STATUS_INVALID_PARAMETER;
 629         }
 630
 631         /* We must store the creds state after an update. */
 632         sampass = samu_new( NULL );
 633         if (!sampass) {
 634                 return NT_STATUS_NO_MEMORY;
 635         }
 636
 637         become_root();
 638         secrets_store_schannel_session_info(p, remote_machine, p->dc);
 639         ret = pdb_getsampwnam(sampass, p->dc->mach_acct);
 640         unbecome_root();
 641
 642         if (!ret) {
 643                 TALLOC_FREE(sampass);
 644                 return NT_STATUS_ACCESS_DENIED;
 645         }
 646
 647         /* Ensure the account exists and is a machine account. */
 648
 649         acct_ctrl = pdb_get_acct_ctrl(sampass);
 650
 651         if (!(acct_ctrl & ACB_WSTRUST ||
 652                       acct_ctrl & ACB_SVRTRUST ||
 653                       acct_ctrl & ACB_DOMTRUST)) {
 654                 TALLOC_FREE(sampass);
 655                 return NT_STATUS_NO_SUCH_USER;
 656         }
 657
 658         if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
 659                 TALLOC_FREE(sampass);
 660                 return NT_STATUS_ACCOUNT_DISABLED;
 661         }
 662
 663         /* Woah - what does this to to the credential chain ? JRA */
 664         cred_hash3(pwd, r->in.new_password->hash, p->dc->sess_key, 0);
 665
 666         DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
 667         for(i = 0; i < sizeof(pwd); i++)
 668                 DEBUG(100,("%02X ", pwd[i]));
 669         DEBUG(100,("\n"));
 670
 671         old_pw = pdb_get_nt_passwd(sampass);
 672
 673         if (old_pw && memcmp(pwd, old_pw, 16) == 0) {
 674                 /* Avoid backend modificiations and other fun if the
 675                    client changed the password to the *same thing* */
 676
 677                 ret = True;
 678         } else {
 679
 680                 /* LM password should be NULL for machines */
 681                 if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
 682                         TALLOC_FREE(sampass);
 683                         return NT_STATUS_NO_MEMORY;
 684                 }
 685
 686                 if (!pdb_set_nt_passwd(sampass, pwd, PDB_CHANGED)) {
 687                         TALLOC_FREE(sampass);
 688                         return NT_STATUS_NO_MEMORY;
 689                 }
 690
 691                 if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
 692                         TALLOC_FREE(sampass);
 693                         /* Not quite sure what this one qualifies as, but this will do */
 694                         return NT_STATUS_UNSUCCESSFUL;
 695                 }
 696
 697                 become_root();
 698                 status = pdb_update_sam_account(sampass);
 699                 unbecome_root();
 700         }
 701
 702         /* set up the LSA Server Password Set response */
 703
 704         memcpy(r->out.return_authenticator, &cred_out,
 705                sizeof(r->out.return_authenticator));
 706
 707         TALLOC_FREE(sampass);
 708         return status;
 709 }
 710
 711 /*************************************************************************
 712  _netr_LogonSamLogoff
 713  *************************************************************************/
 714
 715 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
 716                               struct netr_LogonSamLogoff *r)
 717 {
 718         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 719                 /* 'server schannel = yes' should enforce use of
 720                    schannel, the client did offer it in auth2, but
 721                    obviously did not use it. */
 722                 DEBUG(0,("_netr_LogonSamLogoff: client %s not using schannel for netlogon\n",
 723                         get_remote_machine_name() ));
 724                 return NT_STATUS_ACCESS_DENIED;
 725         }
 726
 727
 728         /* Using the remote machine name for the creds store: */
 729         /* r->in.computer_name */
 730
 731         if (!p->dc) {
 732                 /* Restore the saved state of the netlogon creds. */
 733                 bool ret;
 734
 735                 become_root();
 736                 ret = secrets_restore_schannel_session_info(
 737                         p, r->in.computer_name, &p->dc);
 738                 unbecome_root();
 739                 if (!ret) {
 740                         return NT_STATUS_INVALID_HANDLE;
 741                 }
 742         }
 743
 744         if (!p->dc || !p->dc->authenticated) {
 745                 return NT_STATUS_INVALID_HANDLE;
 746         }
 747
 748         /* checks and updates credentials.  creates reply credentials */
 749         if (!netlogon_creds_server_step(p->dc, r->in.credential, r->out.return_authenticator)) {
 750                 DEBUG(2,("_netr_LogonSamLogoff: netlogon_creds_server_step failed. Rejecting auth "
 751                         "request from client %s machine account %s\n",
 752                         r->in.computer_name, p->dc->mach_acct ));
 753                 return NT_STATUS_INVALID_PARAMETER;
 754         }
 755
 756         /* We must store the creds state after an update. */
 757         become_root();
 758         secrets_store_schannel_session_info(p, r->in.computer_name, p->dc);
 759         unbecome_root();
 760
 761         return NT_STATUS_OK;
 762 }
 763
 764 /*************************************************************************
 765  _netr_LogonSamLogon
 766  *************************************************************************/
 767
 768 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
 769                              struct netr_LogonSamLogon *r)
 770 {
 771         NTSTATUS status = NT_STATUS_OK;
 772         struct netr_SamInfo3 *sam3 = NULL;
 773         union netr_LogonLevel *logon = r->in.logon;
 774         fstring nt_username, nt_domain, nt_workstation;
 775         auth_usersupplied_info *user_info = NULL;
 776         auth_serversupplied_info *server_info = NULL;
 777         struct auth_context *auth_context = NULL;
 778         uint8_t pipe_session_key[16];
 779         bool process_creds = true;
 780
 781         switch (p->hdr_req.opnum) {
 782                 case NDR_NETR_LOGONSAMLOGON:
 783                         process_creds = true;
 784                         break;
 785                 case NDR_NETR_LOGONSAMLOGONEX:
 786                 default:
 787                         process_creds = false;
 788         }
 789
 790         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 791                 /* 'server schannel = yes' should enforce use of
 792                    schannel, the client did offer it in auth2, but
 793                    obviously did not use it. */
 794                 DEBUG(0,("_netr_LogonSamLogon: client %s not using schannel for netlogon\n",
 795                         get_remote_machine_name() ));
 796                 return NT_STATUS_ACCESS_DENIED;
 797         }
 798
 799         sam3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo3);
 800         if (!sam3) {
 801                 return NT_STATUS_NO_MEMORY;
 802         }
 803
 804         /* store the user information, if there is any. */
 805         r->out.validation->sam3 = sam3;
 806         *r->out.authoritative = true; /* authoritative response */
 807         if (r->in.validation_level != 2 && r->in.validation_level != 3) {
 808                 DEBUG(0,("_netr_LogonSamLogon: bad validation_level value %d.\n",
 809                         (int)r->in.validation_level));
 810                 return NT_STATUS_ACCESS_DENIED;
 811         }
 812
 813         if (process_creds) {
 814
 815                 /* Get the remote machine name for the creds store. */
 816                 /* Note this is the remote machine this request is coming from (member server),
 817                    not neccessarily the workstation name the user is logging onto.
 818                 */
 819
 820                 if (!p->dc) {
 821                         /* Restore the saved state of the netlogon creds. */
 822                         bool ret;
 823
 824                         become_root();
 825                         ret = secrets_restore_schannel_session_info(
 826                                 p, r->in.computer_name, &p->dc);
 827                         unbecome_root();
 828                         if (!ret) {
 829                                 return NT_STATUS_INVALID_HANDLE;
 830                         }
 831                 }
 832
 833                 if (!p->dc || !p->dc->authenticated) {
 834                         return NT_STATUS_INVALID_HANDLE;
 835                 }
 836
 837                 /* checks and updates credentials.  creates reply credentials */
 838                 if (!netlogon_creds_server_step(p->dc, r->in.credential,  r->out.return_authenticator)) {
 839                         DEBUG(2,("_netr_LogonSamLogon: creds_server_step failed. Rejecting auth "
 840                                 "request from client %s machine account %s\n",
 841                                 r->in.computer_name, p->dc->mach_acct ));
 842                         return NT_STATUS_INVALID_PARAMETER;
 843                 }
 844
 845                 /* We must store the creds state after an update. */
 846                 become_root();
 847                 secrets_store_schannel_session_info(p, r->in.computer_name, p->dc);
 848                 unbecome_root();
 849         }
 850
 851         switch (r->in.logon_level) {
 852         case NetlogonInteractiveInformation:
 853                 fstrcpy(nt_username,
 854                         logon->password->identity_info.account_name.string);
 855                 fstrcpy(nt_domain,
 856                         logon->password->identity_info.domain_name.string);
 857                 fstrcpy(nt_workstation,
 858                         logon->password->identity_info.workstation.string);
 859
 860                 DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
 861                 break;
 862         case NetlogonNetworkInformation:
 863                 fstrcpy(nt_username,
 864                         logon->network->identity_info.account_name.string);
 865                 fstrcpy(nt_domain,
 866                         logon->network->identity_info.domain_name.string);
 867                 fstrcpy(nt_workstation,
 868                         logon->network->identity_info.workstation.string);
 869
 870                 DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
 871                 break;
 872         default:
 873                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 874                 return NT_STATUS_INVALID_INFO_CLASS;
 875         } /* end switch */
 876
 877         DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
 878         fstrcpy(current_user_info.smb_name, nt_username);
 879         sub_set_smb_name(nt_username);
 880
 881         DEBUG(5,("Attempting validation level %d for unmapped username %s.\n",
 882                 r->in.validation_level, nt_username));
 883
 884         status = NT_STATUS_OK;
 885
 886         switch (r->in.logon_level) {
 887         case NetlogonNetworkInformation:
 888         {
 889                 const char *wksname = nt_workstation;
 890
 891                 status = make_auth_context_fixed(&auth_context,
 892                                                  logon->network->challenge);
 893                 if (!NT_STATUS_IS_OK(status)) {
 894                         return status;
 895                 }
 896
 897                 /* For a network logon, the workstation name comes in with two
 898                  * backslashes in the front. Strip them if they are there. */
 899
 900                 if (*wksname == '\\') wksname++;
 901                 if (*wksname == '\\') wksname++;
 902
 903                 /* Standard challenge/response authenticaion */
 904                 if (!make_user_info_netlogon_network(&user_info,
 905                                                      nt_username, nt_domain,
 906                                                      wksname,
 907                                                      logon->network->identity_info.parameter_control,
 908                                                      logon->network->lm.data,
 909                                                      logon->network->lm.length,
 910                                                      logon->network->nt.data,
 911                                                      logon->network->nt.length)) {
 912                         status = NT_STATUS_NO_MEMORY;
 913                 }
 914                 break;
 915         }
 916         case NetlogonInteractiveInformation:
 917                 /* 'Interactive' authentication, supplies the password in its
 918                    MD4 form, encrypted with the session key.  We will convert
 919                    this to challenge/response for the auth subsystem to chew
 920                    on */
 921         {
 922                 const uint8 *chal;
 923
 924                 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
 925                         return status;
 926                 }
 927
 928                 chal = auth_context->get_ntlm_challenge(auth_context);
 929
 930                 if (!make_user_info_netlogon_interactive(&user_info,
 931                                                          nt_username, nt_domain,
 932                                                          nt_workstation,
 933                                                          logon->password->identity_info.parameter_control,
 934                                                          chal,
 935                                                          logon->password->lmpassword.hash,
 936                                                          logon->password->ntpassword.hash,
 937                                                          p->dc->sess_key)) {
 938                         status = NT_STATUS_NO_MEMORY;
 939                 }
 940                 break;
 941         }
 942         default:
 943                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 944                 return NT_STATUS_INVALID_INFO_CLASS;
 945         } /* end switch */
 946
 947         if ( NT_STATUS_IS_OK(status) ) {
 948                 status = auth_context->check_ntlm_password(auth_context,
 949                         user_info, &server_info);
 950         }
 951
 952         (auth_context->free)(&auth_context);
 953         free_user_info(&user_info);
 954
 955         DEBUG(5,("_netr_LogonSamLogon: check_password returned status %s\n",
 956                   nt_errstr(status)));
 957
 958         /* Check account and password */
 959
 960         if (!NT_STATUS_IS_OK(status)) {
 961                 /* If we don't know what this domain is, we need to
 962                    indicate that we are not authoritative.  This
 963                    allows the client to decide if it needs to try
 964                    a local user.  Fix by jpjanosi@us.ibm.com, #2976 */
 965                 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
 966                      && !strequal(nt_domain, get_global_sam_name())
 967                      && !is_trusted_domain(nt_domain) )
 968                         *r->out.authoritative = false; /* We are not authoritative */
 969
 970                 TALLOC_FREE(server_info);
 971                 return status;
 972         }
 973
 974         if (server_info->guest) {
 975                 /* We don't like guest domain logons... */
 976                 DEBUG(5,("_netr_LogonSamLogon: Attempted domain logon as GUEST "
 977                          "denied.\n"));
 978                 TALLOC_FREE(server_info);
 979                 return NT_STATUS_LOGON_FAILURE;
 980         }
 981
 982         /* This is the point at which, if the login was successful, that
 983            the SAM Local Security Authority should record that the user is
 984            logged in to the domain.  */
 985
 986         if (process_creds) {
 987                 /* Get the pipe session key from the creds. */
 988                 memcpy(pipe_session_key, p->dc->sess_key, 16);
 989         } else {
 990                 /* Get the pipe session key from the schannel. */
 991                 if ((p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL)
 992                     || (p->auth.a_u.schannel_auth == NULL)) {
 993                         return NT_STATUS_INVALID_HANDLE;
 994                 }
 995                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
 996         }
 997
 998         status = serverinfo_to_SamInfo3(server_info, pipe_session_key, 16, sam3);
 999         TALLOC_FREE(server_info);
1000         return status;
1001 }
1002
1003 /*************************************************************************
1004  _netr_LogonSamLogonEx
1005  - no credential chaining. Map into net sam logon.
1006  *************************************************************************/
1007
1008 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1009                                struct netr_LogonSamLogonEx *r)
1010 {
1011         struct netr_LogonSamLogon q;
1012
1013         /* Only allow this if the pipe is protected. */
1014         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1015                 DEBUG(0,("_net_sam_logon_ex: client %s not using schannel for netlogon\n",
1016                         get_remote_machine_name() ));
1017                 return NT_STATUS_INVALID_PARAMETER;
1018         }
1019
1020         q.in.server_name        = r->in.server_name;
1021         q.in.computer_name      = r->in.computer_name;
1022         q.in.logon_level        = r->in.logon_level;
1023         q.in.logon              = r->in.logon;
1024         q.in.validation_level   = r->in.validation_level;
1025         /* we do not handle the flags */
1026         /*                      = r->in.flags; */
1027
1028         q.out.validation        = r->out.validation;
1029         q.out.authoritative     = r->out.authoritative;
1030         /* we do not handle the flags */
1031         /*                      = r->out.flags; */
1032
1033         return _netr_LogonSamLogon(p, &q);
1034 }
1035
1036 /*************************************************************************
1037  _ds_enum_dom_trusts
1038  *************************************************************************/
1039 #if 0   /* JERRY -- not correct */
1040  NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1041                              DS_R_ENUM_DOM_TRUSTS *r_u)
1042 {
1043         NTSTATUS status = NT_STATUS_OK;
1044
1045         /* TODO: According to MSDN, the can only be executed against a
1046            DC or domain member running Windows 2000 or later.  Need
1047            to test against a standalone 2k server and see what it
1048            does.  A windows 2000 DC includes its own domain in the
1049            list.  --jerry */
1050
1051         return status;
1052 }
1053 #endif  /* JERRY */
1054
1055
1056 /****************************************************************
1057 ****************************************************************/
1058
1059 WERROR _netr_LogonUasLogon(pipes_struct *p,
1060                            struct netr_LogonUasLogon *r)
1061 {
1062         p->rng_fault_state = true;
1063         return WERR_NOT_SUPPORTED;
1064 }
1065
1066 /****************************************************************
1067 ****************************************************************/
1068
1069 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1070                             struct netr_LogonUasLogoff *r)
1071 {
1072         p->rng_fault_state = true;
1073         return WERR_NOT_SUPPORTED;
1074 }
1075
1076 /****************************************************************
1077 ****************************************************************/
1078
1079 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1080                               struct netr_DatabaseDeltas *r)
1081 {
1082         p->rng_fault_state = true;
1083         return NT_STATUS_NOT_IMPLEMENTED;
1084 }
1085
1086 /****************************************************************
1087 ****************************************************************/
1088
1089 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1090                             struct netr_DatabaseSync *r)
1091 {
1092         p->rng_fault_state = true;
1093         return NT_STATUS_NOT_IMPLEMENTED;
1094 }
1095
1096 /****************************************************************
1097 ****************************************************************/
1098
1099 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1100                              struct netr_AccountDeltas *r)
1101 {
1102         p->rng_fault_state = true;
1103         return NT_STATUS_NOT_IMPLEMENTED;
1104 }
1105
1106 /****************************************************************
1107 ****************************************************************/
1108
1109 NTSTATUS _netr_AccountSync(pipes_struct *p,
1110                            struct netr_AccountSync *r)
1111 {
1112         p->rng_fault_state = true;
1113         return NT_STATUS_NOT_IMPLEMENTED;
1114 }
1115
1116 /****************************************************************
1117 ****************************************************************/
1118
1119 WERROR _netr_GetDcName(pipes_struct *p,
1120                        struct netr_GetDcName *r)
1121 {
1122         p->rng_fault_state = true;
1123         return WERR_NOT_SUPPORTED;
1124 }
1125
1126 /****************************************************************
1127 ****************************************************************/
1128
1129 WERROR _netr_GetAnyDCName(pipes_struct *p,
1130                           struct netr_GetAnyDCName *r)
1131 {
1132         p->rng_fault_state = true;
1133         return WERR_NOT_SUPPORTED;
1134 }
1135
1136 /****************************************************************
1137 ****************************************************************/
1138
1139 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1140                              struct netr_DatabaseSync2 *r)
1141 {
1142         p->rng_fault_state = true;
1143         return NT_STATUS_NOT_IMPLEMENTED;
1144 }
1145
1146 /****************************************************************
1147 ****************************************************************/
1148
1149 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1150                             struct netr_DatabaseRedo *r)
1151 {
1152         p->rng_fault_state = true;
1153         return NT_STATUS_NOT_IMPLEMENTED;
1154 }
1155
1156 /****************************************************************
1157 ****************************************************************/
1158
1159 WERROR _netr_DsRGetDCName(pipes_struct *p,
1160                           struct netr_DsRGetDCName *r)
1161 {
1162         p->rng_fault_state = true;
1163         return WERR_NOT_SUPPORTED;
1164 }
1165
1166 /****************************************************************
1167 ****************************************************************/
1168
1169 WERROR _netr_NETRLOGONDUMMYROUTINE1(pipes_struct *p,
1170                                     struct netr_NETRLOGONDUMMYROUTINE1 *r)
1171 {
1172         p->rng_fault_state = true;
1173         return WERR_NOT_SUPPORTED;
1174 }
1175
1176 /****************************************************************
1177 ****************************************************************/
1178
1179 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1180                                      struct netr_NETRLOGONSETSERVICEBITS *r)
1181 {
1182         p->rng_fault_state = true;
1183         return WERR_NOT_SUPPORTED;
1184 }
1185
1186 /****************************************************************
1187 ****************************************************************/
1188
1189 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1190                               struct netr_LogonGetTrustRid *r)
1191 {
1192         p->rng_fault_state = true;
1193         return WERR_NOT_SUPPORTED;
1194 }
1195
1196 /****************************************************************
1197 ****************************************************************/
1198
1199 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1200                                           struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1201 {
1202         p->rng_fault_state = true;
1203         return WERR_NOT_SUPPORTED;
1204 }
1205
1206 /****************************************************************
1207 ****************************************************************/
1208
1209 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1210                                           struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1211 {
1212         p->rng_fault_state = true;
1213         return WERR_NOT_SUPPORTED;
1214 }
1215
1216 /****************************************************************
1217 ****************************************************************/
1218
1219 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
1220                                    struct netr_ServerAuthenticate3 *r)
1221 {
1222         p->rng_fault_state = true;
1223         return NT_STATUS_NOT_IMPLEMENTED;
1224 }
1225
1226 /****************************************************************
1227 ****************************************************************/
1228
1229 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1230                             struct netr_DsRGetDCNameEx *r)
1231 {
1232         p->rng_fault_state = true;
1233         return WERR_NOT_SUPPORTED;
1234 }
1235
1236 /****************************************************************
1237 ****************************************************************/
1238
1239 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1240                             struct netr_DsRGetSiteName *r)
1241 {
1242         p->rng_fault_state = true;
1243         return WERR_NOT_SUPPORTED;
1244 }
1245
1246 /****************************************************************
1247 ****************************************************************/
1248
1249 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1250                                   struct netr_LogonGetDomainInfo *r)
1251 {
1252         p->rng_fault_state = true;
1253         return NT_STATUS_NOT_IMPLEMENTED;
1254 }
1255
1256 /****************************************************************
1257 ****************************************************************/
1258
1259 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
1260                                   struct netr_ServerPasswordSet2 *r)
1261 {
1262         p->rng_fault_state = true;
1263         return NT_STATUS_NOT_IMPLEMENTED;
1264 }
1265
1266 /****************************************************************
1267 ****************************************************************/
1268
1269 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1270                                struct netr_ServerPasswordGet *r)
1271 {
1272         p->rng_fault_state = true;
1273         return WERR_NOT_SUPPORTED;
1274 }
1275
1276 /****************************************************************
1277 ****************************************************************/
1278
1279 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1280                                 struct netr_NETRLOGONSENDTOSAM *r)
1281 {
1282         p->rng_fault_state = true;
1283         return WERR_NOT_SUPPORTED;
1284 }
1285
1286 /****************************************************************
1287 ****************************************************************/
1288
1289 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1290                                     struct netr_DsRAddressToSitenamesW *r)
1291 {
1292         p->rng_fault_state = true;
1293         return WERR_NOT_SUPPORTED;
1294 }
1295
1296 /****************************************************************
1297 ****************************************************************/
1298
1299 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1300                              struct netr_DsRGetDCNameEx2 *r)
1301 {
1302         p->rng_fault_state = true;
1303         return WERR_NOT_SUPPORTED;
1304 }
1305
1306 /****************************************************************
1307 ****************************************************************/
1308
1309 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1310                                                  struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1311 {
1312         p->rng_fault_state = true;
1313         return WERR_NOT_SUPPORTED;
1314 }
1315
1316 /****************************************************************
1317 ****************************************************************/
1318
1319 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1320                                            struct netr_NetrEnumerateTrustedDomainsEx *r)
1321 {
1322         p->rng_fault_state = true;
1323         return WERR_NOT_SUPPORTED;
1324 }
1325
1326 /****************************************************************
1327 ****************************************************************/
1328
1329 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1330                                       struct netr_DsRAddressToSitenamesExW *r)
1331 {
1332         p->rng_fault_state = true;
1333         return WERR_NOT_SUPPORTED;
1334 }
1335
1336 /****************************************************************
1337 ****************************************************************/
1338
1339 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1340                                    struct netr_DsrGetDcSiteCoverageW *r)
1341 {
1342         p->rng_fault_state = true;
1343         return WERR_NOT_SUPPORTED;
1344 }
1345
1346 /****************************************************************
1347 ****************************************************************/
1348
1349 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1350                                       struct netr_DsrEnumerateDomainTrusts *r)
1351 {
1352         p->rng_fault_state = true;
1353         return WERR_NOT_SUPPORTED;
1354 }
1355
1356 /****************************************************************
1357 ****************************************************************/
1358
1359 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1360                                          struct netr_DsrDeregisterDNSHostRecords *r)
1361 {
1362         p->rng_fault_state = true;
1363         return WERR_NOT_SUPPORTED;
1364 }
1365
1366 /****************************************************************
1367 ****************************************************************/
1368
1369 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1370                                        struct netr_ServerTrustPasswordsGet *r)
1371 {
1372         p->rng_fault_state = true;
1373         return NT_STATUS_NOT_IMPLEMENTED;
1374 }
1375
1376 /****************************************************************
1377 ****************************************************************/
1378
1379 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1380                                           struct netr_DsRGetForestTrustInformation *r)
1381 {
1382         p->rng_fault_state = true;
1383         return WERR_NOT_SUPPORTED;
1384 }
1385
1386 /****************************************************************
1387 ****************************************************************/
1388
1389 WERROR _netr_GetForestTrustInformation(pipes_struct *p,
1390                                        struct netr_GetForestTrustInformation *r)
1391 {
1392         p->rng_fault_state = true;
1393         return WERR_NOT_SUPPORTED;
1394 }
1395
1396 /****************************************************************
1397 ****************************************************************/
1398
1399 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1400                                       struct netr_LogonSamLogonWithFlags *r)
1401 {
1402         p->rng_fault_state = true;
1403         return NT_STATUS_NOT_IMPLEMENTED;
1404 }
1405
1406 /****************************************************************
1407 ****************************************************************/
1408
1409 NTSTATUS _netr_ServerGetTrustInfo(pipes_struct *p,
1410                                   struct netr_ServerGetTrustInfo *r)
1411 {
1412         p->rng_fault_state = true;
1413         return NT_STATUS_NOT_IMPLEMENTED;
1414 }
1415