source/rpc_server/srv_netlog_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997.
   7  *  Copyright (C) Jeremy Allison               1998-2001.
   8  *  Copyright (C) Andrew Bartlett                   2001.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 3 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  22  */
  23
  24 /* This is the implementation of the netlogon pipe. */
  25
  26 #include "includes.h"
  27
  28 extern userdom_struct current_user_info;
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_RPC_SRV
  32
  33 /*************************************************************************
  34  init_net_r_req_chal:
  35  *************************************************************************/
  36
  37 static void init_net_r_req_chal(struct netr_Credential *r,
  38                                 DOM_CHAL *srv_chal)
  39 {
  40         DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__));
  41
  42         memcpy(r->data, srv_chal->data, sizeof(r->data));
  43 }
  44
  45 /*******************************************************************
  46  Inits a netr_NETLOGON_INFO_1 structure.
  47 ********************************************************************/
  48
  49 static void init_netlogon_info1(struct netr_NETLOGON_INFO_1 *r,
  50                                 uint32_t flags,
  51                                 uint32_t pdc_connection_status)
  52 {
  53         r->flags = flags;
  54         r->pdc_connection_status = pdc_connection_status;
  55 }
  56
  57 /*******************************************************************
  58  Inits a netr_NETLOGON_INFO_2 structure.
  59 ********************************************************************/
  60
  61 static void init_netlogon_info2(struct netr_NETLOGON_INFO_2 *r,
  62                                 uint32_t flags,
  63                                 uint32_t pdc_connection_status,
  64                                 const char *trusted_dc_name,
  65                                 uint32_t tc_connection_status)
  66 {
  67         r->flags = flags;
  68         r->pdc_connection_status = pdc_connection_status;
  69         r->trusted_dc_name = trusted_dc_name;
  70         r->tc_connection_status = tc_connection_status;
  71 }
  72
  73 /*******************************************************************
  74  Inits a netr_NETLOGON_INFO_3 structure.
  75 ********************************************************************/
  76
  77 static void init_netlogon_info3(struct netr_NETLOGON_INFO_3 *r,
  78                                 uint32_t flags,
  79                                 uint32_t logon_attempts)
  80 {
  81         r->flags = flags;
  82         r->logon_attempts = logon_attempts;
  83 }
  84
  85 /*************************************************************************
  86  _netr_LogonControl
  87  *************************************************************************/
  88
  89 WERROR _netr_LogonControl(pipes_struct *p,
  90                           struct netr_LogonControl *r)
  91 {
  92         struct netr_NETLOGON_INFO_1 *info1;
  93         uint32_t flags = 0x0;
  94         uint32_t pdc_connection_status = W_ERROR_V(WERR_OK);
  95
  96         /* Setup the Logon Control response */
  97
  98         switch (r->in.level) {
  99                 case 1:
 100                         info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
 101                         if (!info1) {
 102                                 return WERR_NOMEM;
 103                         }
 104                         init_netlogon_info1(info1,
 105                                             flags,
 106                                             pdc_connection_status);
 107                         r->out.info->info1 = info1;
 108                         break;
 109                 default:
 110                         return WERR_UNKNOWN_LEVEL;
 111         }
 112
 113         return WERR_OK;
 114 }
 115
 116 /****************************************************************************
 117 Send a message to smbd to do a sam synchronisation
 118 **************************************************************************/
 119
 120 static void send_sync_message(void)
 121 {
 122         DEBUG(3, ("sending sam synchronisation message\n"));
 123         message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
 124                          NULL);
 125 }
 126
 127 /*************************************************************************
 128  _netr_LogonControl2
 129  *************************************************************************/
 130
 131 WERROR _netr_LogonControl2(pipes_struct *p,
 132                            struct netr_LogonControl2 *r)
 133 {
 134         uint32 flags = 0x0;
 135         uint32 pdc_connection_status = 0x0;
 136         uint32 logon_attempts = 0x0;
 137         uint32 tc_status;
 138         fstring dc_name, dc_name2;
 139         struct sockaddr_storage dc_ss;
 140         const char *domain = NULL;
 141         struct netr_NETLOGON_INFO_1 *info1;
 142         struct netr_NETLOGON_INFO_2 *info2;
 143         struct netr_NETLOGON_INFO_3 *info3;
 144
 145         tc_status = W_ERROR_V(WERR_NO_SUCH_DOMAIN);
 146         fstrcpy( dc_name, "" );
 147
 148         switch (r->in.function_code) {
 149                 case NETLOGON_CONTROL_TC_QUERY:
 150                         domain = r->in.data->domain;
 151
 152                         if ( !is_trusted_domain( domain ) )
 153                                 break;
 154
 155                         if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
 156                                 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
 157                                 break;
 158                         }
 159
 160                         fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
 161
 162                         tc_status = W_ERROR_V(WERR_OK);
 163
 164                         break;
 165
 166                 case NETLOGON_CONTROL_REDISCOVER:
 167                         domain = r->in.data->domain;
 168
 169                         if ( !is_trusted_domain( domain ) )
 170                                 break;
 171
 172                         if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
 173                                 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
 174                                 break;
 175                         }
 176
 177                         fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
 178
 179                         tc_status = W_ERROR_V(WERR_OK);
 180
 181                         break;
 182
 183                 default:
 184                         /* no idea what this should be */
 185                         DEBUG(0,("_netr_LogonControl2: unimplemented function level [%d]\n",
 186                                 r->in.function_code));
 187                         return WERR_UNKNOWN_LEVEL;
 188         }
 189
 190         /* prepare the response */
 191
 192         switch (r->in.level) {
 193                 case 1:
 194                         info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
 195                         W_ERROR_HAVE_NO_MEMORY(info1);
 196
 197                         init_netlogon_info1(info1,
 198                                             flags,
 199                                             pdc_connection_status);
 200                         r->out.query->info1 = info1;
 201                         break;
 202                 case 2:
 203                         info2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_2);
 204                         W_ERROR_HAVE_NO_MEMORY(info2);
 205
 206                         init_netlogon_info2(info2,
 207                                             flags,
 208                                             pdc_connection_status,
 209                                             dc_name,
 210                                             tc_status);
 211                         r->out.query->info2 = info2;
 212                         break;
 213                 case 3:
 214                         info3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_3);
 215                         W_ERROR_HAVE_NO_MEMORY(info3);
 216
 217                         init_netlogon_info3(info3,
 218                                             flags,
 219                                             logon_attempts);
 220                         r->out.query->info3 = info3;
 221                         break;
 222                 default:
 223                         return WERR_UNKNOWN_LEVEL;
 224         }
 225
 226         if (lp_server_role() == ROLE_DOMAIN_BDC) {
 227                 send_sync_message();
 228         }
 229
 230         return WERR_OK;
 231 }
 232
 233 /*************************************************************************
 234  _netr_NetrEnumerateTrustedDomains
 235  *************************************************************************/
 236
 237 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
 238                                          struct netr_NetrEnumerateTrustedDomains *r)
 239 {
 240         struct netr_Blob trusted_domains_blob;
 241         DATA_BLOB blob;
 242
 243         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 244
 245         /* set up the Trusted Domain List response */
 246
 247         blob = data_blob_talloc_zero(p->mem_ctx, 2);
 248         trusted_domains_blob.data = blob.data;
 249         trusted_domains_blob.length = blob.length;
 250
 251         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 252
 253         *r->out.trusted_domains_blob = trusted_domains_blob;
 254
 255         return WERR_OK;
 256 }
 257
 258 /******************************************************************
 259  gets a machine password entry.  checks access rights of the host.
 260  ******************************************************************/
 261
 262 static NTSTATUS get_md4pw(char *md4pw, const char *mach_acct, uint16 sec_chan_type)
 263 {
 264         struct samu *sampass = NULL;
 265         const uint8 *pass;
 266         bool ret;
 267         uint32 acct_ctrl;
 268
 269 #if 0
 270         char addr[INET6_ADDRSTRLEN];
 271
 272     /*
 273      * Currently this code is redundent as we already have a filter
 274      * by hostname list. What this code really needs to do is to
 275      * get a hosts allowed/hosts denied list from the SAM database
 276      * on a per user basis, and make the access decision there.
 277      * I will leave this code here for now as a reminder to implement
 278      * this at a later date. JRA.
 279      */
 280
 281         if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
 282                         client_name(get_client_fd()),
 283                         client_addr(get_client_fd(),addr,sizeof(addr)))) {
 284                 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
 285                 return False;
 286         }
 287 #endif /* 0 */
 288
 289         if ( !(sampass = samu_new( NULL )) ) {
 290                 return NT_STATUS_NO_MEMORY;
 291         }
 292
 293         /* JRA. This is ok as it is only used for generating the challenge. */
 294         become_root();
 295         ret = pdb_getsampwnam(sampass, mach_acct);
 296         unbecome_root();
 297
 298         if (!ret) {
 299                 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
 300                 TALLOC_FREE(sampass);
 301                 return NT_STATUS_ACCESS_DENIED;
 302         }
 303
 304         acct_ctrl = pdb_get_acct_ctrl(sampass);
 305         if (acct_ctrl & ACB_DISABLED) {
 306                 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
 307                 TALLOC_FREE(sampass);
 308                 return NT_STATUS_ACCOUNT_DISABLED;
 309         }
 310
 311         if (!(acct_ctrl & ACB_SVRTRUST) &&
 312             !(acct_ctrl & ACB_WSTRUST) &&
 313             !(acct_ctrl & ACB_DOMTRUST))
 314         {
 315                 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
 316                 TALLOC_FREE(sampass);
 317                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 318         }
 319
 320         switch (sec_chan_type) {
 321                 case SEC_CHAN_BDC:
 322                         if (!(acct_ctrl & ACB_SVRTRUST)) {
 323                                 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
 324                                          "but not a server trust account\n", mach_acct));
 325                                 TALLOC_FREE(sampass);
 326                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 327                         }
 328                         break;
 329                 case SEC_CHAN_WKSTA:
 330                         if (!(acct_ctrl & ACB_WSTRUST)) {
 331                                 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
 332                                          "but not a workstation trust account\n", mach_acct));
 333                                 TALLOC_FREE(sampass);
 334                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 335                         }
 336                         break;
 337                 case SEC_CHAN_DOMAIN:
 338                         if (!(acct_ctrl & ACB_DOMTRUST)) {
 339                                 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
 340                                          "but not a interdomain trust account\n", mach_acct));
 341                                 TALLOC_FREE(sampass);
 342                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 343                         }
 344                         break;
 345                 default:
 346                         break;
 347         }
 348
 349         if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
 350                 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
 351                 TALLOC_FREE(sampass);
 352                 return NT_STATUS_LOGON_FAILURE;
 353         }
 354
 355         memcpy(md4pw, pass, 16);
 356         dump_data(5, (uint8 *)md4pw, 16);
 357
 358         TALLOC_FREE(sampass);
 359
 360         return NT_STATUS_OK;
 361
 362
 363 }
 364
 365 /*************************************************************************
 366  _netr_ServerReqChallenge
 367  *************************************************************************/
 368
 369 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
 370                                   struct netr_ServerReqChallenge *r)
 371 {
 372         if (!p->dc) {
 373                 p->dc = TALLOC_ZERO_P(p->pipe_state_mem_ctx, struct dcinfo);
 374                 if (!p->dc) {
 375                         return NT_STATUS_NO_MEMORY;
 376                 }
 377         } else {
 378                 DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
 379                 ZERO_STRUCTP(p->dc);
 380         }
 381
 382         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 383
 384         /* Save the client challenge to the server. */
 385         memcpy(p->dc->clnt_chal.data, r->in.credentials->data,
 386                 sizeof(r->in.credentials->data));
 387
 388         /* Create a server challenge for the client */
 389         /* Set this to a random value. */
 390         generate_random_buffer(p->dc->srv_chal.data, 8);
 391
 392         /* set up the LSA REQUEST CHALLENGE response */
 393         init_net_r_req_chal(r->out.credentials, &p->dc->srv_chal);
 394
 395         p->dc->challenge_sent = True;
 396
 397         return NT_STATUS_OK;
 398 }
 399
 400 /*************************************************************************
 401  _netr_ServerAuthenticate
 402  Create the initial credentials.
 403  *************************************************************************/
 404
 405 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
 406                                   struct netr_ServerAuthenticate *r)
 407 {
 408         NTSTATUS status;
 409         DOM_CHAL srv_chal_out;
 410
 411         if (!p->dc || !p->dc->challenge_sent) {
 412                 return NT_STATUS_ACCESS_DENIED;
 413         }
 414
 415         status = get_md4pw((char *)p->dc->mach_pw,
 416                            r->in.account_name,
 417                            r->in.secure_channel_type);
 418         if (!NT_STATUS_IS_OK(status)) {
 419                 DEBUG(0,("_netr_ServerAuthenticate: get_md4pw failed. Failed to "
 420                         "get password for machine account %s "
 421                         "from client %s: %s\n",
 422                         r->in.account_name,
 423                         r->in.computer_name,
 424                         nt_errstr(status) ));
 425                 /* always return NT_STATUS_ACCESS_DENIED */
 426                 return NT_STATUS_ACCESS_DENIED;
 427         }
 428
 429         /* From the client / server challenges and md4 password, generate sess key */
 430         creds_server_init(0,                    /* No neg flags. */
 431                         p->dc,
 432                         &p->dc->clnt_chal,      /* Stored client chal. */
 433                         &p->dc->srv_chal,       /* Stored server chal. */
 434                         p->dc->mach_pw,
 435                         &srv_chal_out);
 436
 437         /* Check client credentials are valid. */
 438         if (!netlogon_creds_server_check(p->dc, r->in.credentials)) {
 439                 DEBUG(0,("_netr_ServerAuthenticate: netlogon_creds_server_check failed. Rejecting auth "
 440                         "request from client %s machine account %s\n",
 441                         r->in.computer_name,
 442                         r->in.account_name));
 443                 return NT_STATUS_ACCESS_DENIED;
 444         }
 445
 446         fstrcpy(p->dc->mach_acct, r->in.account_name);
 447         fstrcpy(p->dc->remote_machine, r->in.computer_name);
 448         p->dc->authenticated = True;
 449
 450         /* set up the LSA AUTH response */
 451         /* Return the server credentials. */
 452
 453         memcpy(r->out.credentials->data, &srv_chal_out.data,
 454                sizeof(r->out.credentials->data));
 455
 456         return NT_STATUS_OK;
 457 }
 458
 459 /*************************************************************************
 460  init_net_r_auth_2:
 461  *************************************************************************/
 462
 463 static void init_net_r_auth_2(NET_R_AUTH_2 *r_a,
 464                               DOM_CHAL *resp_cred, NEG_FLAGS *flgs, NTSTATUS status)
 465 {
 466         memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
 467         memcpy(&r_a->srv_flgs, flgs, sizeof(r_a->srv_flgs));
 468         r_a->status = status;
 469 }
 470
 471 /*************************************************************************
 472  _net_auth_2
 473  *************************************************************************/
 474
 475 NTSTATUS _net_auth_2(pipes_struct *p, NET_Q_AUTH_2 *q_u, NET_R_AUTH_2 *r_u)
 476 {
 477         NTSTATUS status;
 478         NEG_FLAGS srv_flgs;
 479         fstring mach_acct;
 480         fstring remote_machine;
 481         DOM_CHAL srv_chal_out;
 482
 483         rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
 484                                 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
 485
 486         /* We use this as the key to store the creds. */
 487         rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
 488                                 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
 489
 490         if (!p->dc || !p->dc->challenge_sent) {
 491                 DEBUG(0,("_net_auth2: no challenge sent to client %s\n",
 492                         remote_machine ));
 493                 return NT_STATUS_ACCESS_DENIED;
 494         }
 495
 496         if ( (lp_server_schannel() == True) &&
 497              ((q_u->clnt_flgs.neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
 498
 499                 /* schannel must be used, but client did not offer it. */
 500                 DEBUG(0,("_net_auth2: schannel required but client failed "
 501                         "to offer it. Client was %s\n",
 502                         mach_acct ));
 503                 return NT_STATUS_ACCESS_DENIED;
 504         }
 505
 506         status = get_md4pw((char *)p->dc->mach_pw, mach_acct, q_u->clnt_id.sec_chan);
 507         if (!NT_STATUS_IS_OK(status)) {
 508                 DEBUG(0,("_net_auth2: failed to get machine password for "
 509                         "account %s: %s\n",
 510                         mach_acct, nt_errstr(status) ));
 511                 /* always return NT_STATUS_ACCESS_DENIED */
 512                 return NT_STATUS_ACCESS_DENIED;
 513         }
 514
 515         /* From the client / server challenges and md4 password, generate sess key */
 516         creds_server_init(q_u->clnt_flgs.neg_flags,
 517                         p->dc,
 518                         &p->dc->clnt_chal,      /* Stored client chal. */
 519                         &p->dc->srv_chal,       /* Stored server chal. */
 520                         p->dc->mach_pw,
 521                         &srv_chal_out);
 522
 523         /* Check client credentials are valid. */
 524         if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
 525                 DEBUG(0,("_net_auth2: creds_server_check failed. Rejecting auth "
 526                         "request from client %s machine account %s\n",
 527                         remote_machine, mach_acct ));
 528                 return NT_STATUS_ACCESS_DENIED;
 529         }
 530
 531         srv_flgs.neg_flags = 0x000001ff;
 532
 533         if (lp_server_schannel() != False) {
 534                 srv_flgs.neg_flags |= NETLOGON_NEG_SCHANNEL;
 535         }
 536
 537         /* set up the LSA AUTH 2 response */
 538         init_net_r_auth_2(r_u, &srv_chal_out, &srv_flgs, NT_STATUS_OK);
 539
 540         fstrcpy(p->dc->mach_acct, mach_acct);
 541         fstrcpy(p->dc->remote_machine, remote_machine);
 542         fstrcpy(p->dc->domain, lp_workgroup() );
 543
 544         p->dc->authenticated = True;
 545
 546         /* Store off the state so we can continue after client disconnect. */
 547         become_root();
 548         secrets_store_schannel_session_info(p->mem_ctx,
 549                                         remote_machine,
 550                                         p->dc);
 551         unbecome_root();
 552
 553         return r_u->status;
 554 }
 555
 556 /*************************************************************************
 557  _netr_ServerPasswordSet
 558  *************************************************************************/
 559
 560 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
 561                                  struct netr_ServerPasswordSet *r)
 562 {
 563         NTSTATUS status = NT_STATUS_OK;
 564         fstring remote_machine;
 565         struct samu *sampass=NULL;
 566         bool ret = False;
 567         unsigned char pwd[16];
 568         int i;
 569         uint32 acct_ctrl;
 570         struct netr_Authenticator cred_out;
 571         const uchar *old_pw;
 572
 573         DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
 574
 575         /* We need the remote machine name for the creds lookup. */
 576         fstrcpy(remote_machine, r->in.computer_name);
 577
 578         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 579                 /* 'server schannel = yes' should enforce use of
 580                    schannel, the client did offer it in auth2, but
 581                    obviously did not use it. */
 582                 DEBUG(0,("_netr_ServerPasswordSet: client %s not using schannel for netlogon\n",
 583                         remote_machine ));
 584                 return NT_STATUS_ACCESS_DENIED;
 585         }
 586
 587         if (!p->dc) {
 588                 /* Restore the saved state of the netlogon creds. */
 589                 become_root();
 590                 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 591                                                         remote_machine,
 592                                                         &p->dc);
 593                 unbecome_root();
 594                 if (!ret) {
 595                         return NT_STATUS_INVALID_HANDLE;
 596                 }
 597         }
 598
 599         if (!p->dc || !p->dc->authenticated) {
 600                 return NT_STATUS_INVALID_HANDLE;
 601         }
 602
 603         DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
 604                         remote_machine, p->dc->mach_acct));
 605
 606         /* Step the creds chain forward. */
 607         if (!netlogon_creds_server_step(p->dc, r->in.credential, &cred_out)) {
 608                 DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
 609                         "request from client %s machine account %s\n",
 610                         remote_machine, p->dc->mach_acct ));
 611                 return NT_STATUS_INVALID_PARAMETER;
 612         }
 613
 614         /* We must store the creds state after an update. */
 615         sampass = samu_new( NULL );
 616         if (!sampass) {
 617                 return NT_STATUS_NO_MEMORY;
 618         }
 619
 620         become_root();
 621         secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 622                                                 remote_machine,
 623                                                 p->dc);
 624         ret = pdb_getsampwnam(sampass, p->dc->mach_acct);
 625         unbecome_root();
 626
 627         if (!ret) {
 628                 TALLOC_FREE(sampass);
 629                 return NT_STATUS_ACCESS_DENIED;
 630         }
 631
 632         /* Ensure the account exists and is a machine account. */
 633
 634         acct_ctrl = pdb_get_acct_ctrl(sampass);
 635
 636         if (!(acct_ctrl & ACB_WSTRUST ||
 637                       acct_ctrl & ACB_SVRTRUST ||
 638                       acct_ctrl & ACB_DOMTRUST)) {
 639                 TALLOC_FREE(sampass);
 640                 return NT_STATUS_NO_SUCH_USER;
 641         }
 642
 643         if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
 644                 TALLOC_FREE(sampass);
 645                 return NT_STATUS_ACCOUNT_DISABLED;
 646         }
 647
 648         /* Woah - what does this to to the credential chain ? JRA */
 649         cred_hash3(pwd, r->in.new_password->hash, p->dc->sess_key, 0);
 650
 651         DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
 652         for(i = 0; i < sizeof(pwd); i++)
 653                 DEBUG(100,("%02X ", pwd[i]));
 654         DEBUG(100,("\n"));
 655
 656         old_pw = pdb_get_nt_passwd(sampass);
 657
 658         if (old_pw && memcmp(pwd, old_pw, 16) == 0) {
 659                 /* Avoid backend modificiations and other fun if the
 660                    client changed the password to the *same thing* */
 661
 662                 ret = True;
 663         } else {
 664
 665                 /* LM password should be NULL for machines */
 666                 if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
 667                         TALLOC_FREE(sampass);
 668                         return NT_STATUS_NO_MEMORY;
 669                 }
 670
 671                 if (!pdb_set_nt_passwd(sampass, pwd, PDB_CHANGED)) {
 672                         TALLOC_FREE(sampass);
 673                         return NT_STATUS_NO_MEMORY;
 674                 }
 675
 676                 if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
 677                         TALLOC_FREE(sampass);
 678                         /* Not quite sure what this one qualifies as, but this will do */
 679                         return NT_STATUS_UNSUCCESSFUL;
 680                 }
 681
 682                 become_root();
 683                 status = pdb_update_sam_account(sampass);
 684                 unbecome_root();
 685         }
 686
 687         /* set up the LSA Server Password Set response */
 688
 689         memcpy(r->out.return_authenticator, &cred_out,
 690                sizeof(r->out.return_authenticator));
 691
 692         TALLOC_FREE(sampass);
 693         return status;
 694 }
 695
 696 /*************************************************************************
 697  _net_sam_logoff:
 698  *************************************************************************/
 699
 700 NTSTATUS _net_sam_logoff(pipes_struct *p, NET_Q_SAM_LOGOFF *q_u, NET_R_SAM_LOGOFF *r_u)
 701 {
 702         fstring remote_machine;
 703
 704         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 705                 /* 'server schannel = yes' should enforce use of
 706                    schannel, the client did offer it in auth2, but
 707                    obviously did not use it. */
 708                 DEBUG(0,("_net_sam_logoff: client %s not using schannel for netlogon\n",
 709                         get_remote_machine_name() ));
 710                 return NT_STATUS_ACCESS_DENIED;
 711         }
 712
 713
 714         if (!get_valid_user_struct(p->vuid))
 715                 return NT_STATUS_NO_SUCH_USER;
 716
 717         /* Get the remote machine name for the creds store. */
 718         rpcstr_pull(remote_machine,q_u->sam_id.client.login.uni_comp_name.buffer,
 719                     sizeof(remote_machine),q_u->sam_id.client.login.uni_comp_name.uni_str_len*2,0);
 720
 721         if (!p->dc) {
 722                 /* Restore the saved state of the netlogon creds. */
 723                 bool ret;
 724
 725                 become_root();
 726                 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 727                                                 remote_machine,
 728                                                 &p->dc);
 729                 unbecome_root();
 730                 if (!ret) {
 731                         return NT_STATUS_INVALID_HANDLE;
 732                 }
 733         }
 734
 735         if (!p->dc || !p->dc->authenticated) {
 736                 return NT_STATUS_INVALID_HANDLE;
 737         }
 738
 739         r_u->buffer_creds = 1; /* yes, we have valid server credentials */
 740
 741         /* checks and updates credentials.  creates reply credentials */
 742         if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) {
 743                 DEBUG(2,("_net_sam_logoff: creds_server_step failed. Rejecting auth "
 744                         "request from client %s machine account %s\n",
 745                         remote_machine, p->dc->mach_acct ));
 746                 return NT_STATUS_INVALID_PARAMETER;
 747         }
 748
 749         /* We must store the creds state after an update. */
 750         become_root();
 751         secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 752                                         remote_machine,
 753                                         p->dc);
 754         unbecome_root();
 755
 756         r_u->status = NT_STATUS_OK;
 757         return r_u->status;
 758 }
 759
 760 /*******************************************************************
 761  gets a domain user's groups from their already-calculated NT_USER_TOKEN
 762  ********************************************************************/
 763
 764 static NTSTATUS nt_token_to_group_list(TALLOC_CTX *mem_ctx,
 765                                        const DOM_SID *domain_sid,
 766                                        size_t num_sids,
 767                                        const DOM_SID *sids,
 768                                        int *numgroups, DOM_GID **pgids)
 769 {
 770         int i;
 771
 772         *numgroups=0;
 773         *pgids = NULL;
 774
 775         for (i=0; i<num_sids; i++) {
 776                 DOM_GID gid;
 777                 if (!sid_peek_check_rid(domain_sid, &sids[i], &gid.g_rid)) {
 778                         continue;
 779                 }
 780                 gid.attr = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
 781                             SE_GROUP_ENABLED);
 782                 ADD_TO_ARRAY(mem_ctx, DOM_GID, gid, pgids, numgroups);
 783                 if (*pgids == NULL) {
 784                         return NT_STATUS_NO_MEMORY;
 785                 }
 786         }
 787         return NT_STATUS_OK;
 788 }
 789
 790 /*************************************************************************
 791  _net_sam_logon
 792  *************************************************************************/
 793
 794 static NTSTATUS _net_sam_logon_internal(pipes_struct *p,
 795                                         NET_Q_SAM_LOGON *q_u,
 796                                         NET_R_SAM_LOGON *r_u,
 797                                         bool process_creds)
 798 {
 799         NTSTATUS status = NT_STATUS_OK;
 800         NET_USER_INFO_3 *usr_info = NULL;
 801         NET_ID_INFO_CTR *ctr = q_u->sam_id.ctr;
 802         UNISTR2 *uni_samlogon_user = NULL;
 803         UNISTR2 *uni_samlogon_domain = NULL;
 804         UNISTR2 *uni_samlogon_workstation = NULL;
 805         fstring nt_username, nt_domain, nt_workstation;
 806         auth_usersupplied_info *user_info = NULL;
 807         auth_serversupplied_info *server_info = NULL;
 808         struct samu *sampw;
 809         struct auth_context *auth_context = NULL;
 810
 811         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 812                 /* 'server schannel = yes' should enforce use of
 813                    schannel, the client did offer it in auth2, but
 814                    obviously did not use it. */
 815                 DEBUG(0,("_net_sam_logon_internal: client %s not using schannel for netlogon\n",
 816                         get_remote_machine_name() ));
 817                 return NT_STATUS_ACCESS_DENIED;
 818         }
 819
 820         usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3);
 821         if (!usr_info) {
 822                 return NT_STATUS_NO_MEMORY;
 823         }
 824
 825         ZERO_STRUCTP(usr_info);
 826
 827         /* store the user information, if there is any. */
 828         r_u->user = usr_info;
 829         r_u->auth_resp = 1; /* authoritative response */
 830         if (q_u->validation_level != 2 && q_u->validation_level != 3) {
 831                 DEBUG(0,("_net_sam_logon: bad validation_level value %d.\n", (int)q_u->validation_level ));
 832                 return NT_STATUS_ACCESS_DENIED;
 833         }
 834         /* We handle the return of USER_INFO_2 instead of 3 in the parse return. Sucks, I know... */
 835         r_u->switch_value = q_u->validation_level; /* indicates type of validation user info */
 836         r_u->buffer_creds = 1; /* Ensure we always return server creds. */
 837
 838         if (!get_valid_user_struct(p->vuid))
 839                 return NT_STATUS_NO_SUCH_USER;
 840
 841         if (process_creds) {
 842                 fstring remote_machine;
 843
 844                 /* Get the remote machine name for the creds store. */
 845                 /* Note this is the remote machine this request is coming from (member server),
 846                    not neccessarily the workstation name the user is logging onto.
 847                 */
 848                 rpcstr_pull(remote_machine,q_u->sam_id.client.login.uni_comp_name.buffer,
 849                     sizeof(remote_machine),q_u->sam_id.client.login.uni_comp_name.uni_str_len*2,0);
 850
 851                 if (!p->dc) {
 852                         /* Restore the saved state of the netlogon creds. */
 853                         bool ret;
 854
 855                         become_root();
 856                         ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 857                                         remote_machine,
 858                                         &p->dc);
 859                         unbecome_root();
 860                         if (!ret) {
 861                                 return NT_STATUS_INVALID_HANDLE;
 862                         }
 863                 }
 864
 865                 if (!p->dc || !p->dc->authenticated) {
 866                         return NT_STATUS_INVALID_HANDLE;
 867                 }
 868
 869                 /* checks and updates credentials.  creates reply credentials */
 870                 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred,  &r_u->srv_creds)) {
 871                         DEBUG(2,("_net_sam_logon: creds_server_step failed. Rejecting auth "
 872                                 "request from client %s machine account %s\n",
 873                                 remote_machine, p->dc->mach_acct ));
 874                         return NT_STATUS_INVALID_PARAMETER;
 875                 }
 876
 877                 /* We must store the creds state after an update. */
 878                 become_root();
 879                 secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 880                                         remote_machine,
 881                                         p->dc);
 882                 unbecome_root();
 883         }
 884
 885         switch (q_u->sam_id.logon_level) {
 886         case INTERACTIVE_LOGON_TYPE:
 887                 uni_samlogon_user = &ctr->auth.id1.uni_user_name;
 888                 uni_samlogon_domain = &ctr->auth.id1.uni_domain_name;
 889
 890                 uni_samlogon_workstation = &ctr->auth.id1.uni_wksta_name;
 891
 892                 DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
 893                 break;
 894         case NET_LOGON_TYPE:
 895                 uni_samlogon_user = &ctr->auth.id2.uni_user_name;
 896                 uni_samlogon_domain = &ctr->auth.id2.uni_domain_name;
 897                 uni_samlogon_workstation = &ctr->auth.id2.uni_wksta_name;
 898
 899                 DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
 900                 break;
 901         default:
 902                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 903                 return NT_STATUS_INVALID_INFO_CLASS;
 904         } /* end switch */
 905
 906         rpcstr_pull(nt_username,uni_samlogon_user->buffer,sizeof(nt_username),uni_samlogon_user->uni_str_len*2,0);
 907         rpcstr_pull(nt_domain,uni_samlogon_domain->buffer,sizeof(nt_domain),uni_samlogon_domain->uni_str_len*2,0);
 908         rpcstr_pull(nt_workstation,uni_samlogon_workstation->buffer,sizeof(nt_workstation),uni_samlogon_workstation->uni_str_len*2,0);
 909
 910         DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
 911         fstrcpy(current_user_info.smb_name, nt_username);
 912         sub_set_smb_name(nt_username);
 913
 914         DEBUG(5,("Attempting validation level %d for unmapped username %s.\n", q_u->sam_id.ctr->switch_value, nt_username));
 915
 916         status = NT_STATUS_OK;
 917
 918         switch (ctr->switch_value) {
 919         case NET_LOGON_TYPE:
 920         {
 921                 const char *wksname = nt_workstation;
 922
 923                 if (!NT_STATUS_IS_OK(status = make_auth_context_fixed(&auth_context, ctr->auth.id2.lm_chal))) {
 924                         return status;
 925                 }
 926
 927                 /* For a network logon, the workstation name comes in with two
 928                  * backslashes in the front. Strip them if they are there. */
 929
 930                 if (*wksname == '\\') wksname++;
 931                 if (*wksname == '\\') wksname++;
 932
 933                 /* Standard challenge/response authenticaion */
 934                 if (!make_user_info_netlogon_network(&user_info,
 935                                                      nt_username, nt_domain,
 936                                                      wksname,
 937                                                      ctr->auth.id2.param_ctrl,
 938                                                      ctr->auth.id2.lm_chal_resp.buffer,
 939                                                      ctr->auth.id2.lm_chal_resp.str_str_len,
 940                                                      ctr->auth.id2.nt_chal_resp.buffer,
 941                                                      ctr->auth.id2.nt_chal_resp.str_str_len)) {
 942                         status = NT_STATUS_NO_MEMORY;
 943                 }
 944                 break;
 945         }
 946         case INTERACTIVE_LOGON_TYPE:
 947                 /* 'Interactive' authentication, supplies the password in its
 948                    MD4 form, encrypted with the session key.  We will convert
 949                    this to challenge/response for the auth subsystem to chew
 950                    on */
 951         {
 952                 const uint8 *chal;
 953
 954                 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
 955                         return status;
 956                 }
 957
 958                 chal = auth_context->get_ntlm_challenge(auth_context);
 959
 960                 if (!make_user_info_netlogon_interactive(&user_info,
 961                                                          nt_username, nt_domain,
 962                                                          nt_workstation,
 963                                                          ctr->auth.id1.param_ctrl,
 964                                                          chal,
 965                                                          ctr->auth.id1.lm_owf.data,
 966                                                          ctr->auth.id1.nt_owf.data,
 967                                                          p->dc->sess_key)) {
 968                         status = NT_STATUS_NO_MEMORY;
 969                 }
 970                 break;
 971         }
 972         default:
 973                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 974                 return NT_STATUS_INVALID_INFO_CLASS;
 975         } /* end switch */
 976
 977         if ( NT_STATUS_IS_OK(status) ) {
 978                 status = auth_context->check_ntlm_password(auth_context,
 979                         user_info, &server_info);
 980         }
 981
 982         (auth_context->free)(&auth_context);
 983         free_user_info(&user_info);
 984
 985         DEBUG(5, ("_net_sam_logon: check_password returned status %s\n",
 986                   nt_errstr(status)));
 987
 988         /* Check account and password */
 989
 990         if (!NT_STATUS_IS_OK(status)) {
 991                 /* If we don't know what this domain is, we need to
 992                    indicate that we are not authoritative.  This
 993                    allows the client to decide if it needs to try
 994                    a local user.  Fix by jpjanosi@us.ibm.com, #2976 */
 995                 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
 996                      && !strequal(nt_domain, get_global_sam_name())
 997                      && !is_trusted_domain(nt_domain) )
 998                         r_u->auth_resp = 0; /* We are not authoritative */
 999
1000                 TALLOC_FREE(server_info);
1001                 return status;
1002         }
1003
1004         if (server_info->guest) {
1005                 /* We don't like guest domain logons... */
1006                 DEBUG(5,("_net_sam_logon: Attempted domain logon as GUEST "
1007                          "denied.\n"));
1008                 TALLOC_FREE(server_info);
1009                 return NT_STATUS_LOGON_FAILURE;
1010         }
1011
1012         /* This is the point at which, if the login was successful, that
1013            the SAM Local Security Authority should record that the user is
1014            logged in to the domain.  */
1015
1016         {
1017                 DOM_GID *gids = NULL;
1018                 const DOM_SID *user_sid = NULL;
1019                 const DOM_SID *group_sid = NULL;
1020                 DOM_SID domain_sid;
1021                 uint32 user_rid, group_rid;
1022
1023                 int num_gids = 0;
1024                 const char *my_name;
1025                 unsigned char user_session_key[16];
1026                 unsigned char lm_session_key[16];
1027                 unsigned char pipe_session_key[16];
1028
1029                 sampw = server_info->sam_account;
1030
1031                 /* set up pointer indicating user/password failed to be
1032                  * found */
1033                 usr_info->ptr_user_info = 0;
1034
1035                 user_sid = pdb_get_user_sid(sampw);
1036                 group_sid = pdb_get_group_sid(sampw);
1037
1038                 if ((user_sid == NULL) || (group_sid == NULL)) {
1039                         DEBUG(1, ("_net_sam_logon: User without group or user SID\n"));
1040                         return NT_STATUS_UNSUCCESSFUL;
1041                 }
1042
1043                 sid_copy(&domain_sid, user_sid);
1044                 sid_split_rid(&domain_sid, &user_rid);
1045
1046                 if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) {
1047                         DEBUG(1, ("_net_sam_logon: user %s\\%s has user sid "
1048                                   "%s\n but group sid %s.\n"
1049                                   "The conflicting domain portions are not "
1050                                   "supported for NETLOGON calls\n",
1051                                   pdb_get_domain(sampw),
1052                                   pdb_get_username(sampw),
1053                                   sid_string_dbg(user_sid),
1054                                   sid_string_dbg(group_sid)));
1055                         return NT_STATUS_UNSUCCESSFUL;
1056                 }
1057
1058                 if(server_info->login_server) {
1059                         my_name = server_info->login_server;
1060                 } else {
1061                         my_name = global_myname();
1062                 }
1063
1064                 status = nt_token_to_group_list(p->mem_ctx, &domain_sid,
1065                                                 server_info->num_sids,
1066                                                 server_info->sids,
1067                                                 &num_gids, &gids);
1068
1069                 if (!NT_STATUS_IS_OK(status)) {
1070                         return status;
1071                 }
1072
1073                 if (server_info->user_session_key.length) {
1074                         memcpy(user_session_key,
1075                                server_info->user_session_key.data,
1076                                MIN(sizeof(user_session_key),
1077                                    server_info->user_session_key.length));
1078                         if (process_creds) {
1079                                 /* Get the pipe session key from the creds. */
1080                                 memcpy(pipe_session_key, p->dc->sess_key, 16);
1081                         } else {
1082                                 /* Get the pipe session key from the schannel. */
1083                                 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1084                                         return NT_STATUS_INVALID_HANDLE;
1085                                 }
1086                                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1087                         }
1088                         SamOEMhash(user_session_key, pipe_session_key, 16);
1089                         memset(pipe_session_key, '\0', 16);
1090                 }
1091                 if (server_info->lm_session_key.length) {
1092                         memcpy(lm_session_key,
1093                                server_info->lm_session_key.data,
1094                                MIN(sizeof(lm_session_key),
1095                                    server_info->lm_session_key.length));
1096                         if (process_creds) {
1097                                 /* Get the pipe session key from the creds. */
1098                                 memcpy(pipe_session_key, p->dc->sess_key, 16);
1099                         } else {
1100                                 /* Get the pipe session key from the schannel. */
1101                                 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1102                                         return NT_STATUS_INVALID_HANDLE;
1103                                 }
1104                                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1105                         }
1106                         SamOEMhash(lm_session_key, pipe_session_key, 16);
1107                         memset(pipe_session_key, '\0', 16);
1108                 }
1109
1110                 init_net_user_info3(p->mem_ctx, usr_info,
1111                                     user_rid,
1112                                     group_rid,
1113                                     pdb_get_username(sampw),
1114                                     pdb_get_fullname(sampw),
1115                                     pdb_get_homedir(sampw),
1116                                     pdb_get_dir_drive(sampw),
1117                                     pdb_get_logon_script(sampw),
1118                                     pdb_get_profile_path(sampw),
1119                                     pdb_get_logon_time(sampw),
1120                                     get_time_t_max(),
1121                                     get_time_t_max(),
1122                                     pdb_get_pass_last_set_time(sampw),
1123                                     pdb_get_pass_can_change_time(sampw),
1124                                     pdb_get_pass_must_change_time(sampw),
1125                                     0, /* logon_count */
1126                                     0, /* bad_pw_count */
1127                                     num_gids,    /* uint32 num_groups */
1128                                     gids    , /* DOM_GID *gids */
1129                                     NETLOGON_EXTRA_SIDS, /* uint32 user_flgs (?) */
1130                                     pdb_get_acct_ctrl(sampw),
1131                                     server_info->user_session_key.length ? user_session_key : NULL,
1132                                     server_info->lm_session_key.length ? lm_session_key : NULL,
1133                                     my_name     , /* char *logon_srv */
1134                                     pdb_get_domain(sampw),
1135                                     &domain_sid);     /* DOM_SID *dom_sid */
1136                 ZERO_STRUCT(user_session_key);
1137                 ZERO_STRUCT(lm_session_key);
1138         }
1139         TALLOC_FREE(server_info);
1140         return status;
1141 }
1142
1143 /*************************************************************************
1144  _net_sam_logon
1145  *************************************************************************/
1146
1147 NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *r_u)
1148 {
1149         return _net_sam_logon_internal(p, q_u, r_u, True);
1150 }
1151
1152 /*************************************************************************
1153  _net_sam_logon_ex - no credential chaining. Map into net sam logon.
1154  *************************************************************************/
1155
1156 NTSTATUS _net_sam_logon_ex(pipes_struct *p, NET_Q_SAM_LOGON_EX *q_u, NET_R_SAM_LOGON_EX *r_u)
1157 {
1158         NET_Q_SAM_LOGON q;
1159         NET_R_SAM_LOGON r;
1160
1161         ZERO_STRUCT(q);
1162         ZERO_STRUCT(r);
1163
1164         /* Only allow this if the pipe is protected. */
1165         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1166                 DEBUG(0,("_net_sam_logon_ex: client %s not using schannel for netlogon\n",
1167                         get_remote_machine_name() ));
1168                 return NT_STATUS_INVALID_PARAMETER;
1169         }
1170
1171         /* Map a NET_Q_SAM_LOGON_EX to NET_Q_SAM_LOGON. */
1172         q.validation_level = q_u->validation_level;
1173
1174         /* Map a DOM_SAM_INFO_EX into a DOM_SAM_INFO with no creds. */
1175         q.sam_id.client.login = q_u->sam_id.client;
1176         q.sam_id.logon_level = q_u->sam_id.logon_level;
1177         q.sam_id.ctr = q_u->sam_id.ctr;
1178
1179         r_u->status = _net_sam_logon_internal(p, &q, &r, False);
1180
1181         if (!NT_STATUS_IS_OK(r_u->status)) {
1182                 return r_u->status;
1183         }
1184
1185         /* Map the NET_R_SAM_LOGON to NET_R_SAM_LOGON_EX. */
1186         r_u->switch_value = r.switch_value;
1187         r_u->user = r.user;
1188         r_u->auth_resp = r.auth_resp;
1189         r_u->flags = 0; /* FIXME ! */
1190         return r_u->status;
1191 }
1192
1193 /*************************************************************************
1194  _ds_enum_dom_trusts
1195  *************************************************************************/
1196 #if 0   /* JERRY -- not correct */
1197  NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1198                              DS_R_ENUM_DOM_TRUSTS *r_u)
1199 {
1200         NTSTATUS status = NT_STATUS_OK;
1201
1202         /* TODO: According to MSDN, the can only be executed against a
1203            DC or domain member running Windows 2000 or later.  Need
1204            to test against a standalone 2k server and see what it
1205            does.  A windows 2000 DC includes its own domain in the
1206            list.  --jerry */
1207
1208         return status;
1209 }
1210 #endif  /* JERRY */
1211
1212
1213 /****************************************************************
1214 ****************************************************************/
1215
1216 WERROR _netr_LogonUasLogon(pipes_struct *p,
1217                            struct netr_LogonUasLogon *r)
1218 {
1219         p->rng_fault_state = true;
1220         return WERR_NOT_SUPPORTED;
1221 }
1222
1223 /****************************************************************
1224 ****************************************************************/
1225
1226 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1227                             struct netr_LogonUasLogoff *r)
1228 {
1229         p->rng_fault_state = true;
1230         return WERR_NOT_SUPPORTED;
1231 }
1232
1233 /****************************************************************
1234 ****************************************************************/
1235
1236 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
1237                              struct netr_LogonSamLogon *r)
1238 {
1239         p->rng_fault_state = true;
1240         return NT_STATUS_NOT_IMPLEMENTED;
1241 }
1242
1243 /****************************************************************
1244 ****************************************************************/
1245
1246 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
1247                               struct netr_LogonSamLogoff *r)
1248 {
1249         p->rng_fault_state = true;
1250         return NT_STATUS_NOT_IMPLEMENTED;
1251 }
1252
1253 /****************************************************************
1254 ****************************************************************/
1255
1256 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1257                               struct netr_DatabaseDeltas *r)
1258 {
1259         p->rng_fault_state = true;
1260         return NT_STATUS_NOT_IMPLEMENTED;
1261 }
1262
1263 /****************************************************************
1264 ****************************************************************/
1265
1266 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1267                             struct netr_DatabaseSync *r)
1268 {
1269         p->rng_fault_state = true;
1270         return NT_STATUS_NOT_IMPLEMENTED;
1271 }
1272
1273 /****************************************************************
1274 ****************************************************************/
1275
1276 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1277                              struct netr_AccountDeltas *r)
1278 {
1279         p->rng_fault_state = true;
1280         return NT_STATUS_NOT_IMPLEMENTED;
1281 }
1282
1283 /****************************************************************
1284 ****************************************************************/
1285
1286 NTSTATUS _netr_AccountSync(pipes_struct *p,
1287                            struct netr_AccountSync *r)
1288 {
1289         p->rng_fault_state = true;
1290         return NT_STATUS_NOT_IMPLEMENTED;
1291 }
1292
1293 /****************************************************************
1294 ****************************************************************/
1295
1296 WERROR _netr_GetDcName(pipes_struct *p,
1297                        struct netr_GetDcName *r)
1298 {
1299         p->rng_fault_state = true;
1300         return WERR_NOT_SUPPORTED;
1301 }
1302
1303 /****************************************************************
1304 ****************************************************************/
1305
1306 WERROR _netr_GetAnyDCName(pipes_struct *p,
1307                           struct netr_GetAnyDCName *r)
1308 {
1309         p->rng_fault_state = true;
1310         return WERR_NOT_SUPPORTED;
1311 }
1312
1313 /****************************************************************
1314 ****************************************************************/
1315
1316 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
1317                                    struct netr_ServerAuthenticate2 *r)
1318 {
1319         p->rng_fault_state = true;
1320         return NT_STATUS_NOT_IMPLEMENTED;
1321 }
1322
1323 /****************************************************************
1324 ****************************************************************/
1325
1326 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1327                              struct netr_DatabaseSync2 *r)
1328 {
1329         p->rng_fault_state = true;
1330         return NT_STATUS_NOT_IMPLEMENTED;
1331 }
1332
1333 /****************************************************************
1334 ****************************************************************/
1335
1336 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1337                             struct netr_DatabaseRedo *r)
1338 {
1339         p->rng_fault_state = true;
1340         return NT_STATUS_NOT_IMPLEMENTED;
1341 }
1342
1343 /****************************************************************
1344 ****************************************************************/
1345
1346 WERROR _netr_LogonControl2Ex(pipes_struct *p,
1347                              struct netr_LogonControl2Ex *r)
1348 {
1349         p->rng_fault_state = true;
1350         return WERR_NOT_SUPPORTED;
1351 }
1352
1353 /****************************************************************
1354 ****************************************************************/
1355
1356 WERROR _netr_DsRGetDCName(pipes_struct *p,
1357                           struct netr_DsRGetDCName *r)
1358 {
1359         p->rng_fault_state = true;
1360         return WERR_NOT_SUPPORTED;
1361 }
1362
1363 /****************************************************************
1364 ****************************************************************/
1365
1366 WERROR _netr_NETRLOGONDUMMYROUTINE1(pipes_struct *p,
1367                                     struct netr_NETRLOGONDUMMYROUTINE1 *r)
1368 {
1369         p->rng_fault_state = true;
1370         return WERR_NOT_SUPPORTED;
1371 }
1372
1373 /****************************************************************
1374 ****************************************************************/
1375
1376 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1377                                      struct netr_NETRLOGONSETSERVICEBITS *r)
1378 {
1379         p->rng_fault_state = true;
1380         return WERR_NOT_SUPPORTED;
1381 }
1382
1383 /****************************************************************
1384 ****************************************************************/
1385
1386 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1387                               struct netr_LogonGetTrustRid *r)
1388 {
1389         p->rng_fault_state = true;
1390         return WERR_NOT_SUPPORTED;
1391 }
1392
1393 /****************************************************************
1394 ****************************************************************/
1395
1396 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1397                                           struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1398 {
1399         p->rng_fault_state = true;
1400         return WERR_NOT_SUPPORTED;
1401 }
1402
1403 /****************************************************************
1404 ****************************************************************/
1405
1406 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1407                                           struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1408 {
1409         p->rng_fault_state = true;
1410         return WERR_NOT_SUPPORTED;
1411 }
1412
1413 /****************************************************************
1414 ****************************************************************/
1415
1416 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
1417                                    struct netr_ServerAuthenticate3 *r)
1418 {
1419         p->rng_fault_state = true;
1420         return NT_STATUS_NOT_IMPLEMENTED;
1421 }
1422
1423 /****************************************************************
1424 ****************************************************************/
1425
1426 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1427                             struct netr_DsRGetDCNameEx *r)
1428 {
1429         p->rng_fault_state = true;
1430         return WERR_NOT_SUPPORTED;
1431 }
1432
1433 /****************************************************************
1434 ****************************************************************/
1435
1436 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1437                             struct netr_DsRGetSiteName *r)
1438 {
1439         p->rng_fault_state = true;
1440         return WERR_NOT_SUPPORTED;
1441 }
1442
1443 /****************************************************************
1444 ****************************************************************/
1445
1446 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1447                                   struct netr_LogonGetDomainInfo *r)
1448 {
1449         p->rng_fault_state = true;
1450         return NT_STATUS_NOT_IMPLEMENTED;
1451 }
1452
1453 /****************************************************************
1454 ****************************************************************/
1455
1456 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
1457                                   struct netr_ServerPasswordSet2 *r)
1458 {
1459         p->rng_fault_state = true;
1460         return NT_STATUS_NOT_IMPLEMENTED;
1461 }
1462
1463 /****************************************************************
1464 ****************************************************************/
1465
1466 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1467                                struct netr_ServerPasswordGet *r)
1468 {
1469         p->rng_fault_state = true;
1470         return WERR_NOT_SUPPORTED;
1471 }
1472
1473 /****************************************************************
1474 ****************************************************************/
1475
1476 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1477                                 struct netr_NETRLOGONSENDTOSAM *r)
1478 {
1479         p->rng_fault_state = true;
1480         return WERR_NOT_SUPPORTED;
1481 }
1482
1483 /****************************************************************
1484 ****************************************************************/
1485
1486 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1487                                     struct netr_DsRAddressToSitenamesW *r)
1488 {
1489         p->rng_fault_state = true;
1490         return WERR_NOT_SUPPORTED;
1491 }
1492
1493 /****************************************************************
1494 ****************************************************************/
1495
1496 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1497                              struct netr_DsRGetDCNameEx2 *r)
1498 {
1499         p->rng_fault_state = true;
1500         return WERR_NOT_SUPPORTED;
1501 }
1502
1503 /****************************************************************
1504 ****************************************************************/
1505
1506 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1507                                                  struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1508 {
1509         p->rng_fault_state = true;
1510         return WERR_NOT_SUPPORTED;
1511 }
1512
1513 /****************************************************************
1514 ****************************************************************/
1515
1516 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1517                                            struct netr_NetrEnumerateTrustedDomainsEx *r)
1518 {
1519         p->rng_fault_state = true;
1520         return WERR_NOT_SUPPORTED;
1521 }
1522
1523 /****************************************************************
1524 ****************************************************************/
1525
1526 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1527                                       struct netr_DsRAddressToSitenamesExW *r)
1528 {
1529         p->rng_fault_state = true;
1530         return WERR_NOT_SUPPORTED;
1531 }
1532
1533 /****************************************************************
1534 ****************************************************************/
1535
1536 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1537                                    struct netr_DsrGetDcSiteCoverageW *r)
1538 {
1539         p->rng_fault_state = true;
1540         return WERR_NOT_SUPPORTED;
1541 }
1542
1543 /****************************************************************
1544 ****************************************************************/
1545
1546 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1547                                struct netr_LogonSamLogonEx *r)
1548 {
1549         p->rng_fault_state = true;
1550         return NT_STATUS_NOT_IMPLEMENTED;
1551 }
1552
1553 /****************************************************************
1554 ****************************************************************/
1555
1556 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1557                                       struct netr_DsrEnumerateDomainTrusts *r)
1558 {
1559         p->rng_fault_state = true;
1560         return WERR_NOT_SUPPORTED;
1561 }
1562
1563 /****************************************************************
1564 ****************************************************************/
1565
1566 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1567                                          struct netr_DsrDeregisterDNSHostRecords *r)
1568 {
1569         p->rng_fault_state = true;
1570         return WERR_NOT_SUPPORTED;
1571 }
1572
1573 /****************************************************************
1574 ****************************************************************/
1575
1576 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1577                                        struct netr_ServerTrustPasswordsGet *r)
1578 {
1579         p->rng_fault_state = true;
1580         return NT_STATUS_NOT_IMPLEMENTED;
1581 }
1582
1583 /****************************************************************
1584 ****************************************************************/
1585
1586 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1587                                           struct netr_DsRGetForestTrustInformation *r)
1588 {
1589         p->rng_fault_state = true;
1590         return WERR_NOT_SUPPORTED;
1591 }
1592
1593 /****************************************************************
1594 ****************************************************************/
1595
1596 WERROR _netr_GetForestTrustInformation(pipes_struct *p,
1597                                        struct netr_GetForestTrustInformation *r)
1598 {
1599         p->rng_fault_state = true;
1600         return WERR_NOT_SUPPORTED;
1601 }
1602
1603 /****************************************************************
1604 ****************************************************************/
1605
1606 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1607                                       struct netr_LogonSamLogonWithFlags *r)
1608 {
1609         p->rng_fault_state = true;
1610         return NT_STATUS_NOT_IMPLEMENTED;
1611 }
1612
1613 /****************************************************************
1614 ****************************************************************/
1615
1616 WERROR _netr_NETRSERVERGETTRUSTINFO(pipes_struct *p,
1617                                     struct netr_NETRSERVERGETTRUSTINFO *r)
1618 {
1619         p->rng_fault_state = true;
1620         return WERR_NOT_SUPPORTED;
1621 }
1622