source/rpc_client/cli_netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    NT Domain Authentication SMB / MSRPC client
   4    Copyright (C) Andrew Tridgell 1992-2000
   5    Copyright (C) Luke Kenneth Casson Leighton 1996-2000
   6    Copyright (C) Tim Potter 2001
   7    Copyright (C) Paul Ashton                       1997.
   8    Copyright (C) Jeremy Allison                    1998.
   9    Copyright (C) Andrew Bartlett                   2001.
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 2 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program; if not, write to the Free Software
  23    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24 */
  25
  26 #include "includes.h"
  27
  28 /* LSA Request Challenge. Sends our challenge to server, then gets
  29    server response. These are used to generate the credentials. */
  30
  31 NTSTATUS cli_net_req_chal(struct cli_state *cli, DOM_CHAL *clnt_chal,
  32                           DOM_CHAL *srv_chal)
  33 {
  34         prs_struct qbuf, rbuf;
  35         NET_Q_REQ_CHAL q;
  36         NET_R_REQ_CHAL r;
  37         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  38         extern pstring global_myname;
  39
  40         prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
  41         prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
  42
  43         /* create and send a MSRPC command with api NET_REQCHAL */
  44
  45         DEBUG(4,("cli_net_req_chal: LSA Request Challenge from %s to %s: %s\n",
  46                  global_myname, cli->desthost, credstr(clnt_chal->data)));
  47
  48         /* store the parameters */
  49         init_q_req_chal(&q, cli->srv_name_slash, global_myname, clnt_chal);
  50
  51         /* Marshall data and send request */
  52
  53         if (!net_io_q_req_chal("", &q,  &qbuf, 0) ||
  54             !rpc_api_pipe_req(cli, NET_REQCHAL, &qbuf, &rbuf)) {
  55                 goto done;
  56         }
  57
  58         /* Unmarhall response */
  59
  60         if (!net_io_r_req_chal("", &r, &rbuf, 0)) {
  61                 goto done;
  62         }
  63
  64         result = r.status;
  65
  66         /* Return result */
  67
  68         if (NT_STATUS_IS_OK(result)) {
  69                 memcpy(srv_chal, r.srv_chal.data, sizeof(srv_chal->data));
  70         }
  71
  72  done:
  73         prs_mem_free(&qbuf);
  74         prs_mem_free(&rbuf);
  75
  76         return result;
  77 }
  78
  79 /****************************************************************************
  80 LSA Authenticate 2
  81
  82 Send the client credential, receive back a server credential.
  83 Ensure that the server credential returned matches the session key
  84 encrypt of the server challenge originally received. JRA.
  85 ****************************************************************************/
  86
  87 NTSTATUS cli_net_auth2(struct cli_state *cli,
  88                        uint16 sec_chan,
  89                        uint32 neg_flags, DOM_CHAL *srv_chal)
  90 {
  91         prs_struct qbuf, rbuf;
  92         NET_Q_AUTH_2 q;
  93         NET_R_AUTH_2 r;
  94         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  95         extern pstring global_myname;
  96
  97         prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
  98         prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
  99
 100         /* create and send a MSRPC command with api NET_AUTH2 */
 101
 102         DEBUG(4,("cli_net_auth2: srv:%s acct:%s sc:%x mc: %s chal %s neg: %x\n",
 103                  cli->srv_name_slash, cli->mach_acct, sec_chan, global_myname,
 104                  credstr(cli->clnt_cred.challenge.data), neg_flags));
 105
 106         /* store the parameters */
 107         init_q_auth_2(&q, cli->srv_name_slash, cli->mach_acct,
 108                       sec_chan, global_myname, &cli->clnt_cred.challenge,
 109                       neg_flags);
 110
 111         /* turn parameters into data stream */
 112
 113         if (!net_io_q_auth_2("", &q,  &qbuf, 0) ||
 114             !rpc_api_pipe_req(cli, NET_AUTH2, &qbuf, &rbuf)) {
 115                 goto done;
 116         }
 117
 118         /* Unmarshall response */
 119
 120         if (!net_io_r_auth_2("", &r, &rbuf, 0)) {
 121                 goto done;
 122         }
 123
 124         result = r.status;
 125
 126         if (NT_STATUS_IS_OK(result)) {
 127                 UTIME zerotime;
 128
 129                 /*
 130                  * Check the returned value using the initial
 131                  * server received challenge.
 132                  */
 133
 134                 zerotime.time = 0;
 135                 if (cred_assert( &r.srv_chal, cli->sess_key, srv_chal,
 136                                  zerotime) == 0) {
 137
 138                         /*
 139                          * Server replied with bad credential. Fail.
 140                          */
 141                         DEBUG(0,("cli_net_auth2: server %s replied with bad credential (bad machine \
 142 password ?).\n", cli->desthost ));
 143                         result = NT_STATUS_ACCESS_DENIED;
 144                         goto done;
 145                 }
 146         }
 147
 148  done:
 149         prs_mem_free(&qbuf);
 150         prs_mem_free(&rbuf);
 151
 152         return result;
 153 }
 154
 155 /* Initialize domain session credentials */
 156
 157 NTSTATUS cli_nt_setup_creds(struct cli_state *cli,
 158                             uint16 sec_chan,
 159                             const unsigned char mach_pwd[16])
 160 {
 161         DOM_CHAL clnt_chal;
 162         DOM_CHAL srv_chal;
 163         UTIME zerotime;
 164         NTSTATUS result;
 165
 166         /******************* Request Challenge ********************/
 167
 168         generate_random_buffer(clnt_chal.data, 8, False);
 169
 170         /* send a client challenge; receive a server challenge */
 171         result = cli_net_req_chal(cli, &clnt_chal, &srv_chal);
 172
 173         if (!NT_STATUS_IS_OK(result)) {
 174                 DEBUG(0,("cli_nt_setup_creds: request challenge failed\n"));
 175                 return result;
 176         }
 177
 178         /**************** Long-term Session key **************/
 179
 180         /* calculate the session key */
 181         cred_session_key(&clnt_chal, &srv_chal, mach_pwd,
 182                          cli->sess_key);
 183         memset((char *)cli->sess_key+8, '\0', 8);
 184
 185         /******************* Authenticate 2 ********************/
 186
 187         /* calculate auth-2 credentials */
 188         zerotime.time = 0;
 189         cred_create(cli->sess_key, &clnt_chal, zerotime,
 190                     &cli->clnt_cred.challenge);
 191
 192         /*
 193          * Send client auth-2 challenge.
 194          * Receive an auth-2 challenge response and check it.
 195          */
 196
 197         result = cli_net_auth2(cli, sec_chan, 0x000001ff, &srv_chal);
 198
 199         if (!NT_STATUS_IS_OK(result)) {
 200                 DEBUG(1,("cli_nt_setup_creds: auth2 challenge failed %s\n",
 201                          nt_errstr(result)));
 202         }
 203
 204         return result;
 205 }
 206
 207 /* Logon Control 2 */
 208
 209 NTSTATUS cli_netlogon_logon_ctrl2(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 210                                   uint32 query_level)
 211 {
 212         prs_struct qbuf, rbuf;
 213         NET_Q_LOGON_CTRL2 q;
 214         NET_R_LOGON_CTRL2 r;
 215         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 216
 217         ZERO_STRUCT(q);
 218         ZERO_STRUCT(r);
 219
 220         /* Initialise parse structures */
 221
 222         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 223         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 224
 225         /* Initialise input parameters */
 226
 227         init_net_q_logon_ctrl2(&q, cli->srv_name_slash, query_level);
 228
 229         /* Marshall data and send request */
 230
 231         if (!net_io_q_logon_ctrl2("", &q, &qbuf, 0) ||
 232             !rpc_api_pipe_req(cli, NET_LOGON_CTRL2, &qbuf, &rbuf)) {
 233                 result = NT_STATUS_UNSUCCESSFUL;
 234                 goto done;
 235         }
 236
 237         /* Unmarshall response */
 238
 239         if (!net_io_r_logon_ctrl2("", &r, &rbuf, 0)) {
 240                 result = NT_STATUS_UNSUCCESSFUL;
 241                 goto done;
 242         }
 243
 244         result = r.status;
 245
 246  done:
 247         prs_mem_free(&qbuf);
 248         prs_mem_free(&rbuf);
 249
 250         return result;
 251 }
 252
 253 /****************************************************************************
 254 Generate the next creds to use.  Yuck - this is a cut&paste from another
 255 file.  They should be combined at some stage.  )-:
 256 ****************************************************************************/
 257
 258 static void gen_next_creds( struct cli_state *cli, DOM_CRED *new_clnt_cred)
 259 {
 260   /*
 261    * Create the new client credentials.
 262    */
 263
 264   cli->clnt_cred.timestamp.time = time(NULL);
 265
 266   memcpy(new_clnt_cred, &cli->clnt_cred, sizeof(*new_clnt_cred));
 267
 268   /* Calculate the new credentials. */
 269   cred_create(cli->sess_key, &(cli->clnt_cred.challenge),
 270               new_clnt_cred->timestamp, &(new_clnt_cred->challenge));
 271
 272 }
 273
 274 /* Sam synchronisation */
 275
 276 NTSTATUS cli_netlogon_sam_sync(struct cli_state *cli, TALLOC_CTX *mem_ctx, DOM_CRED *ret_creds,
 277                                uint32 database_id, uint32 *num_deltas,
 278                                SAM_DELTA_HDR **hdr_deltas,
 279                                SAM_DELTA_CTR **deltas)
 280 {
 281         prs_struct qbuf, rbuf;
 282         NET_Q_SAM_SYNC q;
 283         NET_R_SAM_SYNC r;
 284         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 285         DOM_CRED clnt_creds;
 286
 287         ZERO_STRUCT(q);
 288         ZERO_STRUCT(r);
 289
 290         /* Initialise parse structures */
 291
 292         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 293         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 294
 295         /* Initialise input parameters */
 296
 297         gen_next_creds(cli, &clnt_creds);
 298
 299         init_net_q_sam_sync(&q, cli->srv_name_slash, cli->clnt_name_slash + 2,
 300                             &clnt_creds, ret_creds, database_id);
 301
 302         /* Marshall data and send request */
 303
 304         if (!net_io_q_sam_sync("", &q, &qbuf, 0) ||
 305             !rpc_api_pipe_req(cli, NET_SAM_SYNC, &qbuf, &rbuf)) {
 306                 result = NT_STATUS_UNSUCCESSFUL;
 307                 goto done;
 308         }
 309
 310         /* Unmarshall response */
 311
 312         if (!net_io_r_sam_sync("", cli->sess_key, &r, &rbuf, 0)) {
 313                 result = NT_STATUS_UNSUCCESSFUL;
 314                 goto done;
 315         }
 316
 317         /* Return results */
 318
 319         result = r.status;
 320         *num_deltas = r.num_deltas2;
 321         *hdr_deltas = r.hdr_deltas;
 322         *deltas = r.deltas;
 323
 324         memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds));
 325
 326  done:
 327         prs_mem_free(&qbuf);
 328         prs_mem_free(&rbuf);
 329
 330         return result;
 331 }
 332
 333 /* Sam synchronisation */
 334
 335 NTSTATUS cli_netlogon_sam_deltas(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 336                                  uint32 database_id, UINT64_S seqnum,
 337                                  uint32 *num_deltas,
 338                                  SAM_DELTA_HDR **hdr_deltas,
 339                                  SAM_DELTA_CTR **deltas)
 340 {
 341         prs_struct qbuf, rbuf;
 342         NET_Q_SAM_DELTAS q;
 343         NET_R_SAM_DELTAS r;
 344         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 345         DOM_CRED clnt_creds;
 346
 347         ZERO_STRUCT(q);
 348         ZERO_STRUCT(r);
 349
 350         /* Initialise parse structures */
 351
 352         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 353         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 354
 355         /* Initialise input parameters */
 356
 357         gen_next_creds(cli, &clnt_creds);
 358
 359         init_net_q_sam_deltas(&q, cli->srv_name_slash,
 360                               cli->clnt_name_slash + 2, &clnt_creds,
 361                               database_id, seqnum);
 362
 363         /* Marshall data and send request */
 364
 365         if (!net_io_q_sam_deltas("", &q, &qbuf, 0) ||
 366             !rpc_api_pipe_req(cli, NET_SAM_DELTAS, &qbuf, &rbuf)) {
 367                 result = NT_STATUS_UNSUCCESSFUL;
 368                 goto done;
 369         }
 370
 371         /* Unmarshall response */
 372
 373         if (!net_io_r_sam_deltas("", cli->sess_key, &r, &rbuf, 0)) {
 374                 result = NT_STATUS_UNSUCCESSFUL;
 375                 goto done;
 376         }
 377
 378         /* Return results */
 379
 380         result = r.status;
 381         *num_deltas = r.num_deltas2;
 382         *hdr_deltas = r.hdr_deltas;
 383         *deltas = r.deltas;
 384
 385  done:
 386         prs_mem_free(&qbuf);
 387         prs_mem_free(&rbuf);
 388
 389         return result;
 390 }
 391
 392 /* Logon domain user */
 393
 394 NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 395                                 char *username, char *password,
 396                                 int logon_type)
 397 {
 398         prs_struct qbuf, rbuf;
 399         NET_Q_SAM_LOGON q;
 400         NET_R_SAM_LOGON r;
 401         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 402         DOM_CRED clnt_creds, dummy_rtn_creds;
 403         extern pstring global_myname;
 404         NET_ID_INFO_CTR ctr;
 405         NET_USER_INFO_3 user;
 406         int validation_level = 3;
 407
 408         ZERO_STRUCT(q);
 409         ZERO_STRUCT(r);
 410
 411         /* Initialise parse structures */
 412
 413         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 414         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 415
 416         /* Initialise input parameters */
 417
 418         gen_next_creds(cli, &clnt_creds);
 419
 420         q.validation_level = validation_level;
 421
 422         memset(&dummy_rtn_creds, '\0', sizeof(dummy_rtn_creds));
 423         dummy_rtn_creds.timestamp.time = time(NULL);
 424
 425         ctr.switch_value = logon_type;
 426
 427         switch (logon_type) {
 428         case INTERACTIVE_LOGON_TYPE: {
 429                 unsigned char lm_owf_user_pwd[16], nt_owf_user_pwd[16];
 430
 431                 nt_lm_owf_gen(password, nt_owf_user_pwd, lm_owf_user_pwd);
 432
 433                 init_id_info1(&ctr.auth.id1, lp_workgroup(),
 434                               0, /* param_ctrl */
 435                               0xdead, 0xbeef, /* LUID? */
 436                               username, cli->clnt_name_slash,
 437                               cli->sess_key, lm_owf_user_pwd,
 438                               nt_owf_user_pwd);
 439
 440                 break;
 441         }
 442         case NET_LOGON_TYPE: {
 443                 uint8 chal[8];
 444                 unsigned char local_lm_response[24];
 445                 unsigned char local_nt_response[24];
 446
 447                 generate_random_buffer(chal, 8, False);
 448
 449                 SMBencrypt(password, chal, local_lm_response);
 450                 SMBNTencrypt(password, chal, local_nt_response);
 451
 452                 init_id_info2(&ctr.auth.id2, lp_workgroup(),
 453                               0, /* param_ctrl */
 454                               0xdead, 0xbeef, /* LUID? */
 455                               username, cli->clnt_name_slash, chal,
 456                               local_lm_response, 24, local_nt_response, 24);
 457                 break;
 458         }
 459         default:
 460                 DEBUG(0, ("switch value %d not supported\n",
 461                           ctr.switch_value));
 462                 goto done;
 463         }
 464
 465         init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname,
 466                       &clnt_creds, &dummy_rtn_creds, logon_type,
 467                       &ctr);
 468
 469         /* Marshall data and send request */
 470
 471         if (!net_io_q_sam_logon("", &q, &qbuf, 0) ||
 472             !rpc_api_pipe_req(cli, NET_SAMLOGON, &qbuf, &rbuf)) {
 473                 goto done;
 474         }
 475
 476         /* Unmarshall response */
 477
 478         r.user = &user;
 479
 480         if (!net_io_r_sam_logon("", &r, &rbuf, 0)) {
 481                 goto done;
 482         }
 483
 484         /* Return results */
 485
 486         result = r.status;
 487
 488  done:
 489         prs_mem_free(&qbuf);
 490         prs_mem_free(&rbuf);
 491
 492         return result;
 493 }
 494
 495
 496 /**
 497  * Logon domain user with an 'network' SAM logon
 498  *
 499  * @param info3 Pointer to a NET_USER_INFO_3 already allocated by the caller.
 500  **/
 501
 502 NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 503                                         const char *username, const char *domain, const char *workstation,
 504                                         const uint8 chal[8],
 505                                         DATA_BLOB lm_response, DATA_BLOB nt_response,
 506                                         NET_USER_INFO_3 *info3)
 507
 508 {
 509         prs_struct qbuf, rbuf;
 510         NET_Q_SAM_LOGON q;
 511         NET_R_SAM_LOGON r;
 512         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 513         DOM_CRED clnt_creds, dummy_rtn_creds;
 514         NET_ID_INFO_CTR ctr;
 515         extern pstring global_myname;
 516         int validation_level = 3;
 517         char *workstation_name_slash;
 518
 519         ZERO_STRUCT(q);
 520         ZERO_STRUCT(r);
 521
 522         workstation_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", workstation);
 523
 524         if (!workstation_name_slash) {
 525                 DEBUG(0, ("talloc_asprintf failed!\n"));
 526                 return NT_STATUS_NO_MEMORY;
 527         }
 528
 529         /* Initialise parse structures */
 530
 531         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 532         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 533
 534         /* Initialise input parameters */
 535
 536         gen_next_creds(cli, &clnt_creds);
 537
 538         q.validation_level = validation_level;
 539
 540         memset(&dummy_rtn_creds, '\0', sizeof(dummy_rtn_creds));
 541         dummy_rtn_creds.timestamp.time = time(NULL);
 542
 543         ctr.switch_value = NET_LOGON_TYPE;
 544
 545         init_id_info2(&ctr.auth.id2, domain,
 546                       0, /* param_ctrl */
 547                       0xdead, 0xbeef, /* LUID? */
 548                       username, workstation_name_slash, (const uchar*)chal,
 549                       lm_response.data, lm_response.length, nt_response.data, nt_response.length);
 550
 551         init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname,
 552                       &clnt_creds, &dummy_rtn_creds, NET_LOGON_TYPE,
 553                       &ctr);
 554
 555         /* Marshall data and send request */
 556
 557         if (!net_io_q_sam_logon("", &q, &qbuf, 0) ||
 558             !rpc_api_pipe_req(cli, NET_SAMLOGON, &qbuf, &rbuf)) {
 559                 goto done;
 560         }
 561
 562         /* Unmarshall response */
 563
 564         r.user = info3;
 565
 566         if (!net_io_r_sam_logon("", &r, &rbuf, 0)) {
 567                 goto done;
 568         }
 569
 570         /* Return results */
 571
 572         result = r.status;
 573
 574  done:
 575         prs_mem_free(&qbuf);
 576         prs_mem_free(&rbuf);
 577
 578         return result;
 579 }
 580
 581 /***************************************************************************
 582 LSA Server Password Set.
 583 ****************************************************************************/
 584
 585 NTSTATUS cli_net_srv_pwset(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 586                            char* machine_name, uint8 hashed_mach_pwd[16])
 587 {
 588         prs_struct rbuf;
 589         prs_struct qbuf;
 590         DOM_CRED new_clnt_cred;
 591         NET_Q_SRV_PWSET q_s;
 592         uint16 sec_chan_type = 2;
 593         NTSTATUS nt_status;
 594         char *mach_acct;
 595
 596         gen_next_creds( cli, &new_clnt_cred);
 597
 598         prs_init(&qbuf , 1024, mem_ctx, MARSHALL);
 599         prs_init(&rbuf, 0,    mem_ctx, UNMARSHALL);
 600
 601         /* create and send a MSRPC command with api NET_SRV_PWSET */
 602
 603         mach_acct = talloc_asprintf(mem_ctx, "%s$", machine_name);
 604
 605         if (!mach_acct) {
 606                 DEBUG(0,("talloc_asprintf failed!\n"));
 607                 nt_status = NT_STATUS_NO_MEMORY;
 608                 goto done;
 609         }
 610
 611         DEBUG(4,("cli_net_srv_pwset: srv:%s acct:%s sc: %d mc: %s clnt %s %x\n",
 612                  cli->srv_name_slash, mach_acct, sec_chan_type, machine_name,
 613                  credstr(new_clnt_cred.challenge.data), new_clnt_cred.timestamp.time));
 614
 615         /* store the parameters */
 616         init_q_srv_pwset(&q_s, cli->srv_name_slash, cli->sess_key,
 617                          mach_acct, sec_chan_type, machine_name,
 618                          &new_clnt_cred, (char *)hashed_mach_pwd);
 619
 620         /* turn parameters into data stream */
 621         if(!net_io_q_srv_pwset("", &q_s,  &qbuf, 0)) {
 622                 DEBUG(0,("cli_net_srv_pwset: Error : failed to marshall NET_Q_SRV_PWSET struct.\n"));
 623                 nt_status = NT_STATUS_UNSUCCESSFUL;
 624                 goto done;
 625         }
 626
 627         /* send the data on \PIPE\ */
 628         if (rpc_api_pipe_req(cli, NET_SRVPWSET, &qbuf, &rbuf))
 629         {
 630                 NET_R_SRV_PWSET r_s;
 631
 632                 if (!net_io_r_srv_pwset("", &r_s, &rbuf, 0)) {
 633                         nt_status =  NT_STATUS_UNSUCCESSFUL;
 634                         goto done;
 635                 }
 636
 637                 nt_status = r_s.status;
 638
 639                 if (!NT_STATUS_IS_OK(r_s.status))
 640                 {
 641                         /* report error code */
 642                         DEBUG(0,("cli_net_srv_pwset: %s\n", nt_errstr(nt_status)));
 643                         goto done;
 644                 }
 645
 646                 /* Update the credentials. */
 647                 if (!clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &(r_s.srv_cred)))
 648                 {
 649                         /*
 650                          * Server replied with bad credential. Fail.
 651                          */
 652                         DEBUG(0,("cli_net_srv_pwset: server %s replied with bad credential (bad machine \
 653 password ?).\n", cli->desthost ));
 654                         nt_status = NT_STATUS_UNSUCCESSFUL;
 655                 }
 656         }
 657
 658  done:
 659         prs_mem_free(&qbuf);
 660         prs_mem_free(&rbuf);
 661
 662         return nt_status;
 663 }
 664