source3/rpc_server/srv_netlog_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997.
   7  *  Copyright (C) Jeremy Allison               1998-2001.
   8  *  Copyright (C) Andrew Bartlett                   2001.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 3 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  22  */
  23
  24 /* This is the implementation of the netlogon pipe. */
  25
  26 #include "includes.h"
  27
  28 extern userdom_struct current_user_info;
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_RPC_SRV
  32
  33 /*************************************************************************
  34  init_net_r_req_chal:
  35  *************************************************************************/
  36
  37 static void init_net_r_req_chal(NET_R_REQ_CHAL *r_c,
  38                                 DOM_CHAL *srv_chal, NTSTATUS status)
  39 {
  40         DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__));
  41         memcpy(r_c->srv_chal.data, srv_chal->data, sizeof(srv_chal->data));
  42         r_c->status = status;
  43 }
  44
  45 /*************************************************************************
  46  net_reply_logon_ctrl:
  47  *************************************************************************/
  48
  49 NTSTATUS _net_logon_ctrl(pipes_struct *p, NET_Q_LOGON_CTRL *q_u,
  50                        NET_R_LOGON_CTRL *r_u)
  51 {
  52         uint32 flags = 0x0;
  53         uint32 pdc_connection_status = 0x00; /* Maybe a win32 error code? */
  54
  55         /* Setup the Logon Control response */
  56
  57         init_net_r_logon_ctrl(r_u, q_u->query_level, flags,
  58                               pdc_connection_status);
  59
  60         return r_u->status;
  61 }
  62
  63 /****************************************************************************
  64 Send a message to smbd to do a sam synchronisation
  65 **************************************************************************/
  66
  67 static void send_sync_message(void)
  68 {
  69         DEBUG(3, ("sending sam synchronisation message\n"));
  70         message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
  71                          NULL);
  72 }
  73
  74 /*************************************************************************
  75  net_reply_logon_ctrl2:
  76  *************************************************************************/
  77
  78 NTSTATUS _net_logon_ctrl2(pipes_struct *p, NET_Q_LOGON_CTRL2 *q_u, NET_R_LOGON_CTRL2 *r_u)
  79 {
  80         uint32 flags = 0x0;
  81         uint32 pdc_connection_status = 0x0;
  82         uint32 logon_attempts = 0x0;
  83         uint32 tc_status;
  84         fstring servername, domain, dc_name, dc_name2;
  85         struct sockaddr_storage dc_ss;
  86
  87         /* this should be \\global_myname() */
  88         unistr2_to_ascii(servername, &q_u->uni_server_name, sizeof(servername));
  89
  90         r_u->status = NT_STATUS_OK;
  91
  92         tc_status = W_ERROR_V(WERR_NO_SUCH_DOMAIN);
  93         fstrcpy( dc_name, "" );
  94
  95         switch ( q_u->function_code ) {
  96                 case NETLOGON_CONTROL_TC_QUERY:
  97                         unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain));
  98
  99                         if ( !is_trusted_domain( domain ) )
 100                                 break;
 101
 102                         if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
 103                                 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
 104                                 break;
 105                         }
 106
 107                         fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
 108
 109                         tc_status = W_ERROR_V(WERR_OK);
 110
 111                         break;
 112
 113                 case NETLOGON_CONTROL_REDISCOVER:
 114                         unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain));
 115
 116                         if ( !is_trusted_domain( domain ) )
 117                                 break;
 118
 119                         if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
 120                                 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
 121                                 break;
 122                         }
 123
 124                         fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
 125
 126                         tc_status = W_ERROR_V(WERR_OK);
 127
 128                         break;
 129
 130                 default:
 131                         /* no idea what this should be */
 132                         DEBUG(0,("_net_logon_ctrl2: unimplemented function level [%d]\n",
 133                                 q_u->function_code));
 134         }
 135
 136         /* prepare the response */
 137
 138         init_net_r_logon_ctrl2( r_u, q_u->query_level, flags,
 139                 pdc_connection_status, logon_attempts, tc_status, dc_name );
 140
 141         if (lp_server_role() == ROLE_DOMAIN_BDC)
 142                 send_sync_message();
 143
 144         return r_u->status;
 145 }
 146
 147 /*************************************************************************
 148  net_reply_trust_dom_list:
 149  *************************************************************************/
 150
 151 NTSTATUS _net_trust_dom_list(pipes_struct *p, NET_Q_TRUST_DOM_LIST *q_u, NET_R_TRUST_DOM_LIST *r_u)
 152 {
 153         const char *trusted_domain = "test_domain";
 154         uint32 num_trust_domains = 1;
 155
 156         DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__));
 157
 158         /* set up the Trusted Domain List response */
 159         init_r_trust_dom(r_u, num_trust_domains, trusted_domain);
 160
 161         DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__));
 162
 163         return r_u->status;
 164 }
 165
 166 /***********************************************************************************
 167  init_net_r_srv_pwset:
 168  ***********************************************************************************/
 169
 170 static void init_net_r_srv_pwset(NET_R_SRV_PWSET *r_s,
 171                                  DOM_CRED *srv_cred, NTSTATUS status)
 172 {
 173         DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
 174
 175         memcpy(&r_s->srv_cred, srv_cred, sizeof(r_s->srv_cred));
 176         r_s->status = status;
 177
 178         DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
 179 }
 180
 181 /******************************************************************
 182  gets a machine password entry.  checks access rights of the host.
 183  ******************************************************************/
 184
 185 static NTSTATUS get_md4pw(char *md4pw, char *mach_acct, uint16 sec_chan_type)
 186 {
 187         struct samu *sampass = NULL;
 188         const uint8 *pass;
 189         bool ret;
 190         uint32 acct_ctrl;
 191
 192 #if 0
 193         char addr[INET6_ADDRSTRLEN];
 194
 195     /*
 196      * Currently this code is redundent as we already have a filter
 197      * by hostname list. What this code really needs to do is to
 198      * get a hosts allowed/hosts denied list from the SAM database
 199      * on a per user basis, and make the access decision there.
 200      * I will leave this code here for now as a reminder to implement
 201      * this at a later date. JRA.
 202      */
 203
 204         if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
 205                         client_name(get_client_fd()),
 206                         client_addr(get_client_fd(),addr,sizeof(addr)))) {
 207                 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
 208                 return False;
 209         }
 210 #endif /* 0 */
 211
 212         if ( !(sampass = samu_new( NULL )) ) {
 213                 return NT_STATUS_NO_MEMORY;
 214         }
 215
 216         /* JRA. This is ok as it is only used for generating the challenge. */
 217         become_root();
 218         ret = pdb_getsampwnam(sampass, mach_acct);
 219         unbecome_root();
 220
 221         if (!ret) {
 222                 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
 223                 TALLOC_FREE(sampass);
 224                 return NT_STATUS_ACCESS_DENIED;
 225         }
 226
 227         acct_ctrl = pdb_get_acct_ctrl(sampass);
 228         if (acct_ctrl & ACB_DISABLED) {
 229                 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
 230                 TALLOC_FREE(sampass);
 231                 return NT_STATUS_ACCOUNT_DISABLED;
 232         }
 233
 234         if (!(acct_ctrl & ACB_SVRTRUST) &&
 235             !(acct_ctrl & ACB_WSTRUST) &&
 236             !(acct_ctrl & ACB_DOMTRUST))
 237         {
 238                 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
 239                 TALLOC_FREE(sampass);
 240                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 241         }
 242
 243         switch (sec_chan_type) {
 244                 case SEC_CHAN_BDC:
 245                         if (!(acct_ctrl & ACB_SVRTRUST)) {
 246                                 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
 247                                          "but not a server trust account\n", mach_acct));
 248                                 TALLOC_FREE(sampass);
 249                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 250                         }
 251                         break;
 252                 case SEC_CHAN_WKSTA:
 253                         if (!(acct_ctrl & ACB_WSTRUST)) {
 254                                 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
 255                                          "but not a workstation trust account\n", mach_acct));
 256                                 TALLOC_FREE(sampass);
 257                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 258                         }
 259                         break;
 260                 case SEC_CHAN_DOMAIN:
 261                         if (!(acct_ctrl & ACB_DOMTRUST)) {
 262                                 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
 263                                          "but not a interdomain trust account\n", mach_acct));
 264                                 TALLOC_FREE(sampass);
 265                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 266                         }
 267                         break;
 268                 default:
 269                         break;
 270         }
 271
 272         if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
 273                 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
 274                 TALLOC_FREE(sampass);
 275                 return NT_STATUS_LOGON_FAILURE;
 276         }
 277
 278         memcpy(md4pw, pass, 16);
 279         dump_data(5, (uint8 *)md4pw, 16);
 280
 281         TALLOC_FREE(sampass);
 282
 283         return NT_STATUS_OK;
 284
 285
 286 }
 287
 288 /*************************************************************************
 289  _net_req_chal
 290  *************************************************************************/
 291
 292 NTSTATUS _net_req_chal(pipes_struct *p, NET_Q_REQ_CHAL *q_u, NET_R_REQ_CHAL *r_u)
 293 {
 294         if (!p->dc) {
 295                 p->dc = TALLOC_ZERO_P(p->pipe_state_mem_ctx, struct dcinfo);
 296                 if (!p->dc) {
 297                         return NT_STATUS_NO_MEMORY;
 298                 }
 299         } else {
 300                 DEBUG(10,("_net_req_chal: new challenge requested. Clearing old state.\n"));
 301                 ZERO_STRUCTP(p->dc);
 302         }
 303
 304         rpcstr_pull(p->dc->remote_machine,
 305                         q_u->uni_logon_clnt.buffer,
 306                         sizeof(fstring),q_u->uni_logon_clnt.uni_str_len*2,0);
 307
 308         /* Save the client challenge to the server. */
 309         memcpy(p->dc->clnt_chal.data, q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data));
 310
 311         /* Create a server challenge for the client */
 312         /* Set this to a random value. */
 313         generate_random_buffer(p->dc->srv_chal.data, 8);
 314
 315         /* set up the LSA REQUEST CHALLENGE response */
 316         init_net_r_req_chal(r_u, &p->dc->srv_chal, NT_STATUS_OK);
 317
 318         p->dc->challenge_sent = True;
 319
 320         return NT_STATUS_OK;
 321 }
 322
 323 /*************************************************************************
 324  init_net_r_auth:
 325  *************************************************************************/
 326
 327 static void init_net_r_auth(NET_R_AUTH *r_a, DOM_CHAL *resp_cred, NTSTATUS status)
 328 {
 329         memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
 330         r_a->status = status;
 331 }
 332
 333 /*************************************************************************
 334  _net_auth. Create the initial credentials.
 335  *************************************************************************/
 336
 337 NTSTATUS _net_auth(pipes_struct *p, NET_Q_AUTH *q_u, NET_R_AUTH *r_u)
 338 {
 339         NTSTATUS status;
 340         fstring mach_acct;
 341         fstring remote_machine;
 342         DOM_CHAL srv_chal_out;
 343
 344         if (!p->dc || !p->dc->challenge_sent) {
 345                 return NT_STATUS_ACCESS_DENIED;
 346         }
 347
 348         rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
 349                                 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
 350         rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
 351                                 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
 352
 353         status = get_md4pw((char *)p->dc->mach_pw, mach_acct, q_u->clnt_id.sec_chan);
 354         if (!NT_STATUS_IS_OK(status)) {
 355                 DEBUG(0,("_net_auth: creds_server_check failed. Failed to "
 356                         "get password for machine account %s "
 357                         "from client %s: %s\n",
 358                         mach_acct, remote_machine, nt_errstr(status) ));
 359                 /* always return NT_STATUS_ACCESS_DENIED */
 360                 return NT_STATUS_ACCESS_DENIED;
 361         }
 362
 363         /* From the client / server challenges and md4 password, generate sess key */
 364         creds_server_init(0,                    /* No neg flags. */
 365                         p->dc,
 366                         &p->dc->clnt_chal,      /* Stored client chal. */
 367                         &p->dc->srv_chal,       /* Stored server chal. */
 368                         p->dc->mach_pw,
 369                         &srv_chal_out);
 370
 371         /* Check client credentials are valid. */
 372         if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
 373                 DEBUG(0,("_net_auth: creds_server_check failed. Rejecting auth "
 374                         "request from client %s machine account %s\n",
 375                         remote_machine, mach_acct ));
 376                 return NT_STATUS_ACCESS_DENIED;
 377         }
 378
 379         fstrcpy(p->dc->mach_acct, mach_acct);
 380         fstrcpy(p->dc->remote_machine, remote_machine);
 381         p->dc->authenticated = True;
 382
 383         /* set up the LSA AUTH response */
 384         /* Return the server credentials. */
 385         init_net_r_auth(r_u, &srv_chal_out, NT_STATUS_OK);
 386
 387         return r_u->status;
 388 }
 389
 390 /*************************************************************************
 391  init_net_r_auth_2:
 392  *************************************************************************/
 393
 394 static void init_net_r_auth_2(NET_R_AUTH_2 *r_a,
 395                               DOM_CHAL *resp_cred, NEG_FLAGS *flgs, NTSTATUS status)
 396 {
 397         memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
 398         memcpy(&r_a->srv_flgs, flgs, sizeof(r_a->srv_flgs));
 399         r_a->status = status;
 400 }
 401
 402 /*************************************************************************
 403  _net_auth_2
 404  *************************************************************************/
 405
 406 NTSTATUS _net_auth_2(pipes_struct *p, NET_Q_AUTH_2 *q_u, NET_R_AUTH_2 *r_u)
 407 {
 408         NTSTATUS status;
 409         NEG_FLAGS srv_flgs;
 410         fstring mach_acct;
 411         fstring remote_machine;
 412         DOM_CHAL srv_chal_out;
 413
 414         rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
 415                                 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
 416
 417         /* We use this as the key to store the creds. */
 418         rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
 419                                 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
 420
 421         if (!p->dc || !p->dc->challenge_sent) {
 422                 DEBUG(0,("_net_auth2: no challenge sent to client %s\n",
 423                         remote_machine ));
 424                 return NT_STATUS_ACCESS_DENIED;
 425         }
 426
 427         if ( (lp_server_schannel() == True) &&
 428              ((q_u->clnt_flgs.neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
 429
 430                 /* schannel must be used, but client did not offer it. */
 431                 DEBUG(0,("_net_auth2: schannel required but client failed "
 432                         "to offer it. Client was %s\n",
 433                         mach_acct ));
 434                 return NT_STATUS_ACCESS_DENIED;
 435         }
 436
 437         status = get_md4pw((char *)p->dc->mach_pw, mach_acct, q_u->clnt_id.sec_chan);
 438         if (!NT_STATUS_IS_OK(status)) {
 439                 DEBUG(0,("_net_auth2: failed to get machine password for "
 440                         "account %s: %s\n",
 441                         mach_acct, nt_errstr(status) ));
 442                 /* always return NT_STATUS_ACCESS_DENIED */
 443                 return NT_STATUS_ACCESS_DENIED;
 444         }
 445
 446         /* From the client / server challenges and md4 password, generate sess key */
 447         creds_server_init(q_u->clnt_flgs.neg_flags,
 448                         p->dc,
 449                         &p->dc->clnt_chal,      /* Stored client chal. */
 450                         &p->dc->srv_chal,       /* Stored server chal. */
 451                         p->dc->mach_pw,
 452                         &srv_chal_out);
 453
 454         /* Check client credentials are valid. */
 455         if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
 456                 DEBUG(0,("_net_auth2: creds_server_check failed. Rejecting auth "
 457                         "request from client %s machine account %s\n",
 458                         remote_machine, mach_acct ));
 459                 return NT_STATUS_ACCESS_DENIED;
 460         }
 461
 462         srv_flgs.neg_flags = 0x000001ff;
 463
 464         if (lp_server_schannel() != False) {
 465                 srv_flgs.neg_flags |= NETLOGON_NEG_SCHANNEL;
 466         }
 467
 468         /* set up the LSA AUTH 2 response */
 469         init_net_r_auth_2(r_u, &srv_chal_out, &srv_flgs, NT_STATUS_OK);
 470
 471         fstrcpy(p->dc->mach_acct, mach_acct);
 472         fstrcpy(p->dc->remote_machine, remote_machine);
 473         fstrcpy(p->dc->domain, lp_workgroup() );
 474
 475         p->dc->authenticated = True;
 476
 477         /* Store off the state so we can continue after client disconnect. */
 478         become_root();
 479         secrets_store_schannel_session_info(p->mem_ctx,
 480                                         remote_machine,
 481                                         p->dc);
 482         unbecome_root();
 483
 484         return r_u->status;
 485 }
 486
 487 /*************************************************************************
 488  _net_srv_pwset
 489  *************************************************************************/
 490
 491 NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *r_u)
 492 {
 493         fstring remote_machine;
 494         struct samu *sampass=NULL;
 495         bool ret = False;
 496         unsigned char pwd[16];
 497         int i;
 498         uint32 acct_ctrl;
 499         DOM_CRED cred_out;
 500         const uchar *old_pw;
 501
 502         DEBUG(5,("_net_srv_pwset: %d\n", __LINE__));
 503
 504         /* We need the remote machine name for the creds lookup. */
 505         rpcstr_pull(remote_machine,q_u->clnt_id.login.uni_comp_name.buffer,
 506                     sizeof(remote_machine),q_u->clnt_id.login.uni_comp_name.uni_str_len*2,0);
 507
 508         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 509                 /* 'server schannel = yes' should enforce use of
 510                    schannel, the client did offer it in auth2, but
 511                    obviously did not use it. */
 512                 DEBUG(0,("_net_srv_pwset: client %s not using schannel for netlogon\n",
 513                         remote_machine ));
 514                 return NT_STATUS_ACCESS_DENIED;
 515         }
 516
 517         if (!p->dc) {
 518                 /* Restore the saved state of the netlogon creds. */
 519                 become_root();
 520                 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 521                                                         remote_machine,
 522                                                         &p->dc);
 523                 unbecome_root();
 524                 if (!ret) {
 525                         return NT_STATUS_INVALID_HANDLE;
 526                 }
 527         }
 528
 529         if (!p->dc || !p->dc->authenticated) {
 530                 return NT_STATUS_INVALID_HANDLE;
 531         }
 532
 533         DEBUG(3,("_net_srv_pwset: Server Password Set by remote machine:[%s] on account [%s]\n",
 534                         remote_machine, p->dc->mach_acct));
 535
 536         /* Step the creds chain forward. */
 537         if (!creds_server_step(p->dc, &q_u->clnt_id.cred, &cred_out)) {
 538                 DEBUG(2,("_net_srv_pwset: creds_server_step failed. Rejecting auth "
 539                         "request from client %s machine account %s\n",
 540                         remote_machine, p->dc->mach_acct ));
 541                 return NT_STATUS_INVALID_PARAMETER;
 542         }
 543
 544         /* We must store the creds state after an update. */
 545         sampass = samu_new( NULL );
 546         if (!sampass) {
 547                 return NT_STATUS_NO_MEMORY;
 548         }
 549
 550         become_root();
 551         secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 552                                                 remote_machine,
 553                                                 p->dc);
 554         ret = pdb_getsampwnam(sampass, p->dc->mach_acct);
 555         unbecome_root();
 556
 557         if (!ret) {
 558                 TALLOC_FREE(sampass);
 559                 return NT_STATUS_ACCESS_DENIED;
 560         }
 561
 562         /* Ensure the account exists and is a machine account. */
 563
 564         acct_ctrl = pdb_get_acct_ctrl(sampass);
 565
 566         if (!(acct_ctrl & ACB_WSTRUST ||
 567                       acct_ctrl & ACB_SVRTRUST ||
 568                       acct_ctrl & ACB_DOMTRUST)) {
 569                 TALLOC_FREE(sampass);
 570                 return NT_STATUS_NO_SUCH_USER;
 571         }
 572
 573         if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
 574                 TALLOC_FREE(sampass);
 575                 return NT_STATUS_ACCOUNT_DISABLED;
 576         }
 577
 578         /* Woah - what does this to to the credential chain ? JRA */
 579         cred_hash3( pwd, q_u->pwd, p->dc->sess_key, 0);
 580
 581         DEBUG(100,("Server password set : new given value was :\n"));
 582         for(i = 0; i < sizeof(pwd); i++)
 583                 DEBUG(100,("%02X ", pwd[i]));
 584         DEBUG(100,("\n"));
 585
 586         old_pw = pdb_get_nt_passwd(sampass);
 587
 588         if (old_pw && memcmp(pwd, old_pw, 16) == 0) {
 589                 /* Avoid backend modificiations and other fun if the
 590                    client changed the password to the *same thing* */
 591
 592                 ret = True;
 593         } else {
 594
 595                 /* LM password should be NULL for machines */
 596                 if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
 597                         TALLOC_FREE(sampass);
 598                         return NT_STATUS_NO_MEMORY;
 599                 }
 600
 601                 if (!pdb_set_nt_passwd(sampass, pwd, PDB_CHANGED)) {
 602                         TALLOC_FREE(sampass);
 603                         return NT_STATUS_NO_MEMORY;
 604                 }
 605
 606                 if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
 607                         TALLOC_FREE(sampass);
 608                         /* Not quite sure what this one qualifies as, but this will do */
 609                         return NT_STATUS_UNSUCCESSFUL;
 610                 }
 611
 612                 become_root();
 613                 r_u->status = pdb_update_sam_account(sampass);
 614                 unbecome_root();
 615         }
 616
 617         /* set up the LSA Server Password Set response */
 618         init_net_r_srv_pwset(r_u, &cred_out, r_u->status);
 619
 620         TALLOC_FREE(sampass);
 621         return r_u->status;
 622 }
 623
 624 /*************************************************************************
 625  _net_sam_logoff:
 626  *************************************************************************/
 627
 628 NTSTATUS _net_sam_logoff(pipes_struct *p, NET_Q_SAM_LOGOFF *q_u, NET_R_SAM_LOGOFF *r_u)
 629 {
 630         fstring remote_machine;
 631
 632         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 633                 /* 'server schannel = yes' should enforce use of
 634                    schannel, the client did offer it in auth2, but
 635                    obviously did not use it. */
 636                 DEBUG(0,("_net_sam_logoff: client %s not using schannel for netlogon\n",
 637                         get_remote_machine_name() ));
 638                 return NT_STATUS_ACCESS_DENIED;
 639         }
 640
 641
 642         if (!get_valid_user_struct(p->vuid))
 643                 return NT_STATUS_NO_SUCH_USER;
 644
 645         /* Get the remote machine name for the creds store. */
 646         rpcstr_pull(remote_machine,q_u->sam_id.client.login.uni_comp_name.buffer,
 647                     sizeof(remote_machine),q_u->sam_id.client.login.uni_comp_name.uni_str_len*2,0);
 648
 649         if (!p->dc) {
 650                 /* Restore the saved state of the netlogon creds. */
 651                 bool ret;
 652
 653                 become_root();
 654                 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 655                                                 remote_machine,
 656                                                 &p->dc);
 657                 unbecome_root();
 658                 if (!ret) {
 659                         return NT_STATUS_INVALID_HANDLE;
 660                 }
 661         }
 662
 663         if (!p->dc || !p->dc->authenticated) {
 664                 return NT_STATUS_INVALID_HANDLE;
 665         }
 666
 667         r_u->buffer_creds = 1; /* yes, we have valid server credentials */
 668
 669         /* checks and updates credentials.  creates reply credentials */
 670         if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) {
 671                 DEBUG(2,("_net_sam_logoff: creds_server_step failed. Rejecting auth "
 672                         "request from client %s machine account %s\n",
 673                         remote_machine, p->dc->mach_acct ));
 674                 return NT_STATUS_INVALID_PARAMETER;
 675         }
 676
 677         /* We must store the creds state after an update. */
 678         become_root();
 679         secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 680                                         remote_machine,
 681                                         p->dc);
 682         unbecome_root();
 683
 684         r_u->status = NT_STATUS_OK;
 685         return r_u->status;
 686 }
 687
 688 /*******************************************************************
 689  gets a domain user's groups from their already-calculated NT_USER_TOKEN
 690  ********************************************************************/
 691
 692 static NTSTATUS nt_token_to_group_list(TALLOC_CTX *mem_ctx,
 693                                        const DOM_SID *domain_sid,
 694                                        size_t num_sids,
 695                                        const DOM_SID *sids,
 696                                        int *numgroups, DOM_GID **pgids)
 697 {
 698         int i;
 699
 700         *numgroups=0;
 701         *pgids = NULL;
 702
 703         for (i=0; i<num_sids; i++) {
 704                 DOM_GID gid;
 705                 if (!sid_peek_check_rid(domain_sid, &sids[i], &gid.g_rid)) {
 706                         continue;
 707                 }
 708                 gid.attr = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
 709                             SE_GROUP_ENABLED);
 710                 ADD_TO_ARRAY(mem_ctx, DOM_GID, gid, pgids, numgroups);
 711                 if (*pgids == NULL) {
 712                         return NT_STATUS_NO_MEMORY;
 713                 }
 714         }
 715         return NT_STATUS_OK;
 716 }
 717
 718 /*************************************************************************
 719  _net_sam_logon
 720  *************************************************************************/
 721
 722 static NTSTATUS _net_sam_logon_internal(pipes_struct *p,
 723                                         NET_Q_SAM_LOGON *q_u,
 724                                         NET_R_SAM_LOGON *r_u,
 725                                         bool process_creds)
 726 {
 727         NTSTATUS status = NT_STATUS_OK;
 728         NET_USER_INFO_3 *usr_info = NULL;
 729         NET_ID_INFO_CTR *ctr = q_u->sam_id.ctr;
 730         UNISTR2 *uni_samlogon_user = NULL;
 731         UNISTR2 *uni_samlogon_domain = NULL;
 732         UNISTR2 *uni_samlogon_workstation = NULL;
 733         fstring nt_username, nt_domain, nt_workstation;
 734         auth_usersupplied_info *user_info = NULL;
 735         auth_serversupplied_info *server_info = NULL;
 736         struct samu *sampw;
 737         struct auth_context *auth_context = NULL;
 738
 739         if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
 740                 /* 'server schannel = yes' should enforce use of
 741                    schannel, the client did offer it in auth2, but
 742                    obviously did not use it. */
 743                 DEBUG(0,("_net_sam_logon_internal: client %s not using schannel for netlogon\n",
 744                         get_remote_machine_name() ));
 745                 return NT_STATUS_ACCESS_DENIED;
 746         }
 747
 748         usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3);
 749         if (!usr_info) {
 750                 return NT_STATUS_NO_MEMORY;
 751         }
 752
 753         ZERO_STRUCTP(usr_info);
 754
 755         /* store the user information, if there is any. */
 756         r_u->user = usr_info;
 757         r_u->auth_resp = 1; /* authoritative response */
 758         if (q_u->validation_level != 2 && q_u->validation_level != 3) {
 759                 DEBUG(0,("_net_sam_logon: bad validation_level value %d.\n", (int)q_u->validation_level ));
 760                 return NT_STATUS_ACCESS_DENIED;
 761         }
 762         /* We handle the return of USER_INFO_2 instead of 3 in the parse return. Sucks, I know... */
 763         r_u->switch_value = q_u->validation_level; /* indicates type of validation user info */
 764         r_u->buffer_creds = 1; /* Ensure we always return server creds. */
 765
 766         if (!get_valid_user_struct(p->vuid))
 767                 return NT_STATUS_NO_SUCH_USER;
 768
 769         if (process_creds) {
 770                 fstring remote_machine;
 771
 772                 /* Get the remote machine name for the creds store. */
 773                 /* Note this is the remote machine this request is coming from (member server),
 774                    not neccessarily the workstation name the user is logging onto.
 775                 */
 776                 rpcstr_pull(remote_machine,q_u->sam_id.client.login.uni_comp_name.buffer,
 777                     sizeof(remote_machine),q_u->sam_id.client.login.uni_comp_name.uni_str_len*2,0);
 778
 779                 if (!p->dc) {
 780                         /* Restore the saved state of the netlogon creds. */
 781                         bool ret;
 782
 783                         become_root();
 784                         ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
 785                                         remote_machine,
 786                                         &p->dc);
 787                         unbecome_root();
 788                         if (!ret) {
 789                                 return NT_STATUS_INVALID_HANDLE;
 790                         }
 791                 }
 792
 793                 if (!p->dc || !p->dc->authenticated) {
 794                         return NT_STATUS_INVALID_HANDLE;
 795                 }
 796
 797                 /* checks and updates credentials.  creates reply credentials */
 798                 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred,  &r_u->srv_creds)) {
 799                         DEBUG(2,("_net_sam_logon: creds_server_step failed. Rejecting auth "
 800                                 "request from client %s machine account %s\n",
 801                                 remote_machine, p->dc->mach_acct ));
 802                         return NT_STATUS_INVALID_PARAMETER;
 803                 }
 804
 805                 /* We must store the creds state after an update. */
 806                 become_root();
 807                 secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
 808                                         remote_machine,
 809                                         p->dc);
 810                 unbecome_root();
 811         }
 812
 813         switch (q_u->sam_id.logon_level) {
 814         case INTERACTIVE_LOGON_TYPE:
 815                 uni_samlogon_user = &ctr->auth.id1.uni_user_name;
 816                 uni_samlogon_domain = &ctr->auth.id1.uni_domain_name;
 817
 818                 uni_samlogon_workstation = &ctr->auth.id1.uni_wksta_name;
 819
 820                 DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
 821                 break;
 822         case NET_LOGON_TYPE:
 823                 uni_samlogon_user = &ctr->auth.id2.uni_user_name;
 824                 uni_samlogon_domain = &ctr->auth.id2.uni_domain_name;
 825                 uni_samlogon_workstation = &ctr->auth.id2.uni_wksta_name;
 826
 827                 DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
 828                 break;
 829         default:
 830                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 831                 return NT_STATUS_INVALID_INFO_CLASS;
 832         } /* end switch */
 833
 834         rpcstr_pull(nt_username,uni_samlogon_user->buffer,sizeof(nt_username),uni_samlogon_user->uni_str_len*2,0);
 835         rpcstr_pull(nt_domain,uni_samlogon_domain->buffer,sizeof(nt_domain),uni_samlogon_domain->uni_str_len*2,0);
 836         rpcstr_pull(nt_workstation,uni_samlogon_workstation->buffer,sizeof(nt_workstation),uni_samlogon_workstation->uni_str_len*2,0);
 837
 838         DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
 839         fstrcpy(current_user_info.smb_name, nt_username);
 840         sub_set_smb_name(nt_username);
 841
 842         DEBUG(5,("Attempting validation level %d for unmapped username %s.\n", q_u->sam_id.ctr->switch_value, nt_username));
 843
 844         status = NT_STATUS_OK;
 845
 846         switch (ctr->switch_value) {
 847         case NET_LOGON_TYPE:
 848         {
 849                 const char *wksname = nt_workstation;
 850
 851                 if (!NT_STATUS_IS_OK(status = make_auth_context_fixed(&auth_context, ctr->auth.id2.lm_chal))) {
 852                         return status;
 853                 }
 854
 855                 /* For a network logon, the workstation name comes in with two
 856                  * backslashes in the front. Strip them if they are there. */
 857
 858                 if (*wksname == '\\') wksname++;
 859                 if (*wksname == '\\') wksname++;
 860
 861                 /* Standard challenge/response authenticaion */
 862                 if (!make_user_info_netlogon_network(&user_info,
 863                                                      nt_username, nt_domain,
 864                                                      wksname,
 865                                                      ctr->auth.id2.param_ctrl,
 866                                                      ctr->auth.id2.lm_chal_resp.buffer,
 867                                                      ctr->auth.id2.lm_chal_resp.str_str_len,
 868                                                      ctr->auth.id2.nt_chal_resp.buffer,
 869                                                      ctr->auth.id2.nt_chal_resp.str_str_len)) {
 870                         status = NT_STATUS_NO_MEMORY;
 871                 }
 872                 break;
 873         }
 874         case INTERACTIVE_LOGON_TYPE:
 875                 /* 'Interactive' authentication, supplies the password in its
 876                    MD4 form, encrypted with the session key.  We will convert
 877                    this to challenge/response for the auth subsystem to chew
 878                    on */
 879         {
 880                 const uint8 *chal;
 881
 882                 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
 883                         return status;
 884                 }
 885
 886                 chal = auth_context->get_ntlm_challenge(auth_context);
 887
 888                 if (!make_user_info_netlogon_interactive(&user_info,
 889                                                          nt_username, nt_domain,
 890                                                          nt_workstation,
 891                                                          ctr->auth.id1.param_ctrl,
 892                                                          chal,
 893                                                          ctr->auth.id1.lm_owf.data,
 894                                                          ctr->auth.id1.nt_owf.data,
 895                                                          p->dc->sess_key)) {
 896                         status = NT_STATUS_NO_MEMORY;
 897                 }
 898                 break;
 899         }
 900         default:
 901                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
 902                 return NT_STATUS_INVALID_INFO_CLASS;
 903         } /* end switch */
 904
 905         if ( NT_STATUS_IS_OK(status) ) {
 906                 status = auth_context->check_ntlm_password(auth_context,
 907                         user_info, &server_info);
 908         }
 909
 910         (auth_context->free)(&auth_context);
 911         free_user_info(&user_info);
 912
 913         DEBUG(5, ("_net_sam_logon: check_password returned status %s\n",
 914                   nt_errstr(status)));
 915
 916         /* Check account and password */
 917
 918         if (!NT_STATUS_IS_OK(status)) {
 919                 /* If we don't know what this domain is, we need to
 920                    indicate that we are not authoritative.  This
 921                    allows the client to decide if it needs to try
 922                    a local user.  Fix by jpjanosi@us.ibm.com, #2976 */
 923                 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
 924                      && !strequal(nt_domain, get_global_sam_name())
 925                      && !is_trusted_domain(nt_domain) )
 926                         r_u->auth_resp = 0; /* We are not authoritative */
 927
 928                 TALLOC_FREE(server_info);
 929                 return status;
 930         }
 931
 932         if (server_info->guest) {
 933                 /* We don't like guest domain logons... */
 934                 DEBUG(5,("_net_sam_logon: Attempted domain logon as GUEST "
 935                          "denied.\n"));
 936                 TALLOC_FREE(server_info);
 937                 return NT_STATUS_LOGON_FAILURE;
 938         }
 939
 940         /* This is the point at which, if the login was successful, that
 941            the SAM Local Security Authority should record that the user is
 942            logged in to the domain.  */
 943
 944         {
 945                 DOM_GID *gids = NULL;
 946                 const DOM_SID *user_sid = NULL;
 947                 const DOM_SID *group_sid = NULL;
 948                 DOM_SID domain_sid;
 949                 uint32 user_rid, group_rid;
 950
 951                 int num_gids = 0;
 952                 const char *my_name;
 953                 unsigned char user_session_key[16];
 954                 unsigned char lm_session_key[16];
 955                 unsigned char pipe_session_key[16];
 956
 957                 sampw = server_info->sam_account;
 958
 959                 /* set up pointer indicating user/password failed to be
 960                  * found */
 961                 usr_info->ptr_user_info = 0;
 962
 963                 user_sid = pdb_get_user_sid(sampw);
 964                 group_sid = pdb_get_group_sid(sampw);
 965
 966                 if ((user_sid == NULL) || (group_sid == NULL)) {
 967                         DEBUG(1, ("_net_sam_logon: User without group or user SID\n"));
 968                         return NT_STATUS_UNSUCCESSFUL;
 969                 }
 970
 971                 sid_copy(&domain_sid, user_sid);
 972                 sid_split_rid(&domain_sid, &user_rid);
 973
 974                 if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) {
 975                         DEBUG(1, ("_net_sam_logon: user %s\\%s has user sid "
 976                                   "%s\n but group sid %s.\n"
 977                                   "The conflicting domain portions are not "
 978                                   "supported for NETLOGON calls\n",
 979                                   pdb_get_domain(sampw),
 980                                   pdb_get_username(sampw),
 981                                   sid_string_dbg(user_sid),
 982                                   sid_string_dbg(group_sid)));
 983                         return NT_STATUS_UNSUCCESSFUL;
 984                 }
 985
 986                 if(server_info->login_server) {
 987                         my_name = server_info->login_server;
 988                 } else {
 989                         my_name = global_myname();
 990                 }
 991
 992                 status = nt_token_to_group_list(p->mem_ctx, &domain_sid,
 993                                                 server_info->num_sids,
 994                                                 server_info->sids,
 995                                                 &num_gids, &gids);
 996
 997                 if (!NT_STATUS_IS_OK(status)) {
 998                         return status;
 999                 }
1000
1001                 if (server_info->user_session_key.length) {
1002                         memcpy(user_session_key,
1003                                server_info->user_session_key.data,
1004                                MIN(sizeof(user_session_key),
1005                                    server_info->user_session_key.length));
1006                         if (process_creds) {
1007                                 /* Get the pipe session key from the creds. */
1008                                 memcpy(pipe_session_key, p->dc->sess_key, 16);
1009                         } else {
1010                                 /* Get the pipe session key from the schannel. */
1011                                 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1012                                         return NT_STATUS_INVALID_HANDLE;
1013                                 }
1014                                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1015                         }
1016                         SamOEMhash(user_session_key, pipe_session_key, 16);
1017                         memset(pipe_session_key, '\0', 16);
1018                 }
1019                 if (server_info->lm_session_key.length) {
1020                         memcpy(lm_session_key,
1021                                server_info->lm_session_key.data,
1022                                MIN(sizeof(lm_session_key),
1023                                    server_info->lm_session_key.length));
1024                         if (process_creds) {
1025                                 /* Get the pipe session key from the creds. */
1026                                 memcpy(pipe_session_key, p->dc->sess_key, 16);
1027                         } else {
1028                                 /* Get the pipe session key from the schannel. */
1029                                 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1030                                         return NT_STATUS_INVALID_HANDLE;
1031                                 }
1032                                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1033                         }
1034                         SamOEMhash(lm_session_key, pipe_session_key, 16);
1035                         memset(pipe_session_key, '\0', 16);
1036                 }
1037
1038                 init_net_user_info3(p->mem_ctx, usr_info,
1039                                     user_rid,
1040                                     group_rid,
1041                                     pdb_get_username(sampw),
1042                                     pdb_get_fullname(sampw),
1043                                     pdb_get_homedir(sampw),
1044                                     pdb_get_dir_drive(sampw),
1045                                     pdb_get_logon_script(sampw),
1046                                     pdb_get_profile_path(sampw),
1047                                     pdb_get_logon_time(sampw),
1048                                     get_time_t_max(),
1049                                     get_time_t_max(),
1050                                     pdb_get_pass_last_set_time(sampw),
1051                                     pdb_get_pass_can_change_time(sampw),
1052                                     pdb_get_pass_must_change_time(sampw),
1053                                     0, /* logon_count */
1054                                     0, /* bad_pw_count */
1055                                     num_gids,    /* uint32 num_groups */
1056                                     gids    , /* DOM_GID *gids */
1057                                     NETLOGON_EXTRA_SIDS, /* uint32 user_flgs (?) */
1058                                     pdb_get_acct_ctrl(sampw),
1059                                     server_info->user_session_key.length ? user_session_key : NULL,
1060                                     server_info->lm_session_key.length ? lm_session_key : NULL,
1061                                     my_name     , /* char *logon_srv */
1062                                     pdb_get_domain(sampw),
1063                                     &domain_sid);     /* DOM_SID *dom_sid */
1064                 ZERO_STRUCT(user_session_key);
1065                 ZERO_STRUCT(lm_session_key);
1066         }
1067         TALLOC_FREE(server_info);
1068         return status;
1069 }
1070
1071 /*************************************************************************
1072  _net_sam_logon
1073  *************************************************************************/
1074
1075 NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *r_u)
1076 {
1077         return _net_sam_logon_internal(p, q_u, r_u, True);
1078 }
1079
1080 /*************************************************************************
1081  _net_sam_logon_ex - no credential chaining. Map into net sam logon.
1082  *************************************************************************/
1083
1084 NTSTATUS _net_sam_logon_ex(pipes_struct *p, NET_Q_SAM_LOGON_EX *q_u, NET_R_SAM_LOGON_EX *r_u)
1085 {
1086         NET_Q_SAM_LOGON q;
1087         NET_R_SAM_LOGON r;
1088
1089         ZERO_STRUCT(q);
1090         ZERO_STRUCT(r);
1091
1092         /* Only allow this if the pipe is protected. */
1093         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1094                 DEBUG(0,("_net_sam_logon_ex: client %s not using schannel for netlogon\n",
1095                         get_remote_machine_name() ));
1096                 return NT_STATUS_INVALID_PARAMETER;
1097         }
1098
1099         /* Map a NET_Q_SAM_LOGON_EX to NET_Q_SAM_LOGON. */
1100         q.validation_level = q_u->validation_level;
1101
1102         /* Map a DOM_SAM_INFO_EX into a DOM_SAM_INFO with no creds. */
1103         q.sam_id.client.login = q_u->sam_id.client;
1104         q.sam_id.logon_level = q_u->sam_id.logon_level;
1105         q.sam_id.ctr = q_u->sam_id.ctr;
1106
1107         r_u->status = _net_sam_logon_internal(p, &q, &r, False);
1108
1109         if (!NT_STATUS_IS_OK(r_u->status)) {
1110                 return r_u->status;
1111         }
1112
1113         /* Map the NET_R_SAM_LOGON to NET_R_SAM_LOGON_EX. */
1114         r_u->switch_value = r.switch_value;
1115         r_u->user = r.user;
1116         r_u->auth_resp = r.auth_resp;
1117         r_u->flags = 0; /* FIXME ! */
1118         return r_u->status;
1119 }
1120
1121 /*************************************************************************
1122  _ds_enum_dom_trusts
1123  *************************************************************************/
1124 #if 0   /* JERRY -- not correct */
1125  NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1126                              DS_R_ENUM_DOM_TRUSTS *r_u)
1127 {
1128         NTSTATUS status = NT_STATUS_OK;
1129
1130         /* TODO: According to MSDN, the can only be executed against a
1131            DC or domain member running Windows 2000 or later.  Need
1132            to test against a standalone 2k server and see what it
1133            does.  A windows 2000 DC includes its own domain in the
1134            list.  --jerry */
1135
1136         return status;
1137 }
1138 #endif  /* JERRY */
1139
1140
1141 /****************************************************************
1142 ****************************************************************/
1143
1144 WERROR _netr_LogonUasLogon(pipes_struct *p,
1145                            struct netr_LogonUasLogon *r)
1146 {
1147         p->rng_fault_state = true;
1148         return WERR_NOT_SUPPORTED;
1149 }
1150
1151 /****************************************************************
1152 ****************************************************************/
1153
1154 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1155                             struct netr_LogonUasLogoff *r)
1156 {
1157         p->rng_fault_state = true;
1158         return WERR_NOT_SUPPORTED;
1159 }
1160
1161 /****************************************************************
1162 ****************************************************************/
1163
1164 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
1165                              struct netr_LogonSamLogon *r)
1166 {
1167         p->rng_fault_state = true;
1168         return NT_STATUS_NOT_IMPLEMENTED;
1169 }
1170
1171 /****************************************************************
1172 ****************************************************************/
1173
1174 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
1175                               struct netr_LogonSamLogoff *r)
1176 {
1177         p->rng_fault_state = true;
1178         return NT_STATUS_NOT_IMPLEMENTED;
1179 }
1180
1181 /****************************************************************
1182 ****************************************************************/
1183
1184 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
1185                                   struct netr_ServerReqChallenge *r)
1186 {
1187         p->rng_fault_state = true;
1188         return NT_STATUS_NOT_IMPLEMENTED;
1189 }
1190
1191 /****************************************************************
1192 ****************************************************************/
1193
1194 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
1195                                   struct netr_ServerAuthenticate *r)
1196 {
1197         p->rng_fault_state = true;
1198         return NT_STATUS_NOT_IMPLEMENTED;
1199 }
1200
1201 /****************************************************************
1202 ****************************************************************/
1203
1204 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
1205                                  struct netr_ServerPasswordSet *r)
1206 {
1207         p->rng_fault_state = true;
1208         return NT_STATUS_NOT_IMPLEMENTED;
1209 }
1210
1211 /****************************************************************
1212 ****************************************************************/
1213
1214 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1215                               struct netr_DatabaseDeltas *r)
1216 {
1217         p->rng_fault_state = true;
1218         return NT_STATUS_NOT_IMPLEMENTED;
1219 }
1220
1221 /****************************************************************
1222 ****************************************************************/
1223
1224 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1225                             struct netr_DatabaseSync *r)
1226 {
1227         p->rng_fault_state = true;
1228         return NT_STATUS_NOT_IMPLEMENTED;
1229 }
1230
1231 /****************************************************************
1232 ****************************************************************/
1233
1234 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1235                              struct netr_AccountDeltas *r)
1236 {
1237         p->rng_fault_state = true;
1238         return NT_STATUS_NOT_IMPLEMENTED;
1239 }
1240
1241 /****************************************************************
1242 ****************************************************************/
1243
1244 NTSTATUS _netr_AccountSync(pipes_struct *p,
1245                            struct netr_AccountSync *r)
1246 {
1247         p->rng_fault_state = true;
1248         return NT_STATUS_NOT_IMPLEMENTED;
1249 }
1250
1251 /****************************************************************
1252 ****************************************************************/
1253
1254 WERROR _netr_LogonControl(pipes_struct *p,
1255                           struct netr_LogonControl *r)
1256 {
1257         p->rng_fault_state = true;
1258         return WERR_NOT_SUPPORTED;
1259 }
1260
1261 /****************************************************************
1262 ****************************************************************/
1263
1264 WERROR _netr_GetDcName(pipes_struct *p,
1265                        struct netr_GetDcName *r)
1266 {
1267         p->rng_fault_state = true;
1268         return WERR_NOT_SUPPORTED;
1269 }
1270
1271 /****************************************************************
1272 ****************************************************************/
1273
1274 WERROR _netr_GetAnyDCName(pipes_struct *p,
1275                           struct netr_GetAnyDCName *r)
1276 {
1277         p->rng_fault_state = true;
1278         return WERR_NOT_SUPPORTED;
1279 }
1280
1281 /****************************************************************
1282 ****************************************************************/
1283
1284 WERROR _netr_LogonControl2(pipes_struct *p,
1285                            struct netr_LogonControl2 *r)
1286 {
1287         p->rng_fault_state = true;
1288         return WERR_NOT_SUPPORTED;
1289 }
1290
1291 /****************************************************************
1292 ****************************************************************/
1293
1294 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
1295                                    struct netr_ServerAuthenticate2 *r)
1296 {
1297         p->rng_fault_state = true;
1298         return NT_STATUS_NOT_IMPLEMENTED;
1299 }
1300
1301 /****************************************************************
1302 ****************************************************************/
1303
1304 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1305                              struct netr_DatabaseSync2 *r)
1306 {
1307         p->rng_fault_state = true;
1308         return NT_STATUS_NOT_IMPLEMENTED;
1309 }
1310
1311 /****************************************************************
1312 ****************************************************************/
1313
1314 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1315                             struct netr_DatabaseRedo *r)
1316 {
1317         p->rng_fault_state = true;
1318         return NT_STATUS_NOT_IMPLEMENTED;
1319 }
1320
1321 /****************************************************************
1322 ****************************************************************/
1323
1324 WERROR _netr_LogonControl2Ex(pipes_struct *p,
1325                              struct netr_LogonControl2Ex *r)
1326 {
1327         p->rng_fault_state = true;
1328         return WERR_NOT_SUPPORTED;
1329 }
1330
1331 /****************************************************************
1332 ****************************************************************/
1333
1334 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
1335                                          struct netr_NetrEnumerateTrustedDomains *r)
1336 {
1337         p->rng_fault_state = true;
1338         return WERR_NOT_SUPPORTED;
1339 }
1340
1341 /****************************************************************
1342 ****************************************************************/
1343
1344 WERROR _netr_DsRGetDCName(pipes_struct *p,
1345                           struct netr_DsRGetDCName *r)
1346 {
1347         p->rng_fault_state = true;
1348         return WERR_NOT_SUPPORTED;
1349 }
1350
1351 /****************************************************************
1352 ****************************************************************/
1353
1354 WERROR _netr_NETRLOGONDUMMYROUTINE1(pipes_struct *p,
1355                                     struct netr_NETRLOGONDUMMYROUTINE1 *r)
1356 {
1357         p->rng_fault_state = true;
1358         return WERR_NOT_SUPPORTED;
1359 }
1360
1361 /****************************************************************
1362 ****************************************************************/
1363
1364 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1365                                      struct netr_NETRLOGONSETSERVICEBITS *r)
1366 {
1367         p->rng_fault_state = true;
1368         return WERR_NOT_SUPPORTED;
1369 }
1370
1371 /****************************************************************
1372 ****************************************************************/
1373
1374 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1375                               struct netr_LogonGetTrustRid *r)
1376 {
1377         p->rng_fault_state = true;
1378         return WERR_NOT_SUPPORTED;
1379 }
1380
1381 /****************************************************************
1382 ****************************************************************/
1383
1384 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1385                                           struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1386 {
1387         p->rng_fault_state = true;
1388         return WERR_NOT_SUPPORTED;
1389 }
1390
1391 /****************************************************************
1392 ****************************************************************/
1393
1394 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1395                                           struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1396 {
1397         p->rng_fault_state = true;
1398         return WERR_NOT_SUPPORTED;
1399 }
1400
1401 /****************************************************************
1402 ****************************************************************/
1403
1404 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
1405                                    struct netr_ServerAuthenticate3 *r)
1406 {
1407         p->rng_fault_state = true;
1408         return NT_STATUS_NOT_IMPLEMENTED;
1409 }
1410
1411 /****************************************************************
1412 ****************************************************************/
1413
1414 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1415                             struct netr_DsRGetDCNameEx *r)
1416 {
1417         p->rng_fault_state = true;
1418         return WERR_NOT_SUPPORTED;
1419 }
1420
1421 /****************************************************************
1422 ****************************************************************/
1423
1424 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1425                             struct netr_DsRGetSiteName *r)
1426 {
1427         p->rng_fault_state = true;
1428         return WERR_NOT_SUPPORTED;
1429 }
1430
1431 /****************************************************************
1432 ****************************************************************/
1433
1434 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1435                                   struct netr_LogonGetDomainInfo *r)
1436 {
1437         p->rng_fault_state = true;
1438         return NT_STATUS_NOT_IMPLEMENTED;
1439 }
1440
1441 /****************************************************************
1442 ****************************************************************/
1443
1444 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
1445                                   struct netr_ServerPasswordSet2 *r)
1446 {
1447         p->rng_fault_state = true;
1448         return NT_STATUS_NOT_IMPLEMENTED;
1449 }
1450
1451 /****************************************************************
1452 ****************************************************************/
1453
1454 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1455                                struct netr_ServerPasswordGet *r)
1456 {
1457         p->rng_fault_state = true;
1458         return WERR_NOT_SUPPORTED;
1459 }
1460
1461 /****************************************************************
1462 ****************************************************************/
1463
1464 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1465                                 struct netr_NETRLOGONSENDTOSAM *r)
1466 {
1467         p->rng_fault_state = true;
1468         return WERR_NOT_SUPPORTED;
1469 }
1470
1471 /****************************************************************
1472 ****************************************************************/
1473
1474 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1475                                     struct netr_DsRAddressToSitenamesW *r)
1476 {
1477         p->rng_fault_state = true;
1478         return WERR_NOT_SUPPORTED;
1479 }
1480
1481 /****************************************************************
1482 ****************************************************************/
1483
1484 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1485                              struct netr_DsRGetDCNameEx2 *r)
1486 {
1487         p->rng_fault_state = true;
1488         return WERR_NOT_SUPPORTED;
1489 }
1490
1491 /****************************************************************
1492 ****************************************************************/
1493
1494 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1495                                                  struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1496 {
1497         p->rng_fault_state = true;
1498         return WERR_NOT_SUPPORTED;
1499 }
1500
1501 /****************************************************************
1502 ****************************************************************/
1503
1504 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1505                                            struct netr_NetrEnumerateTrustedDomainsEx *r)
1506 {
1507         p->rng_fault_state = true;
1508         return WERR_NOT_SUPPORTED;
1509 }
1510
1511 /****************************************************************
1512 ****************************************************************/
1513
1514 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1515                                       struct netr_DsRAddressToSitenamesExW *r)
1516 {
1517         p->rng_fault_state = true;
1518         return WERR_NOT_SUPPORTED;
1519 }
1520
1521 /****************************************************************
1522 ****************************************************************/
1523
1524 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1525                                    struct netr_DsrGetDcSiteCoverageW *r)
1526 {
1527         p->rng_fault_state = true;
1528         return WERR_NOT_SUPPORTED;
1529 }
1530
1531 /****************************************************************
1532 ****************************************************************/
1533
1534 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1535                                struct netr_LogonSamLogonEx *r)
1536 {
1537         p->rng_fault_state = true;
1538         return NT_STATUS_NOT_IMPLEMENTED;
1539 }
1540
1541 /****************************************************************
1542 ****************************************************************/
1543
1544 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1545                                       struct netr_DsrEnumerateDomainTrusts *r)
1546 {
1547         p->rng_fault_state = true;
1548         return WERR_NOT_SUPPORTED;
1549 }
1550
1551 /****************************************************************
1552 ****************************************************************/
1553
1554 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1555                                          struct netr_DsrDeregisterDNSHostRecords *r)
1556 {
1557         p->rng_fault_state = true;
1558         return WERR_NOT_SUPPORTED;
1559 }
1560
1561 /****************************************************************
1562 ****************************************************************/
1563
1564 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1565                                        struct netr_ServerTrustPasswordsGet *r)
1566 {
1567         p->rng_fault_state = true;
1568         return NT_STATUS_NOT_IMPLEMENTED;
1569 }
1570
1571 /****************************************************************
1572 ****************************************************************/
1573
1574 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1575                                           struct netr_DsRGetForestTrustInformation *r)
1576 {
1577         p->rng_fault_state = true;
1578         return WERR_NOT_SUPPORTED;
1579 }
1580
1581 /****************************************************************
1582 ****************************************************************/
1583
1584 WERROR _netr_GetForestTrustInformation(pipes_struct *p,
1585                                        struct netr_GetForestTrustInformation *r)
1586 {
1587         p->rng_fault_state = true;
1588         return WERR_NOT_SUPPORTED;
1589 }
1590
1591 /****************************************************************
1592 ****************************************************************/
1593
1594 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1595                                       struct netr_LogonSamLogonWithFlags *r)
1596 {
1597         p->rng_fault_state = true;
1598         return NT_STATUS_NOT_IMPLEMENTED;
1599 }
1600
1601 /****************************************************************
1602 ****************************************************************/
1603
1604 WERROR _netr_NETRSERVERGETTRUSTINFO(pipes_struct *p,
1605                                     struct netr_NETRSERVERGETTRUSTINFO *r)
1606 {
1607         p->rng_fault_state = true;
1608         return WERR_NOT_SUPPORTED;
1609 }
1610