2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997.
7 * Copyright (C) Jeremy Allison 1998-2001.
8 * Copyright (C) Andrew Bartlett 2001.
9 * Copyright (C) Guenther Deschner 2008.
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 /* This is the implementation of the netlogon pipe. */
28 #include "../libcli/auth/libcli_auth.h"
29 #include "../libcli/auth/schannel_state.h"
30 #include "../libcli/auth/schannel.h"
32 extern userdom_struct current_user_info
;
35 #define DBGC_CLASS DBGC_RPC_SRV
37 struct netlogon_server_pipe_state
{
38 struct netr_Credential client_challenge
;
39 struct netr_Credential server_challenge
;
42 /*************************************************************************
44 *************************************************************************/
46 WERROR
_netr_LogonControl(pipes_struct
*p
,
47 struct netr_LogonControl
*r
)
49 struct netr_LogonControl2Ex l
;
51 switch (r
->in
.level
) {
55 return WERR_NOT_SUPPORTED
;
57 return WERR_UNKNOWN_LEVEL
;
60 l
.in
.logon_server
= r
->in
.logon_server
;
61 l
.in
.function_code
= r
->in
.function_code
;
62 l
.in
.level
= r
->in
.level
;
64 l
.out
.query
= r
->out
.query
;
66 return _netr_LogonControl2Ex(p
, &l
);
69 /****************************************************************************
70 Send a message to smbd to do a sam synchronisation
71 **************************************************************************/
73 static void send_sync_message(void)
75 DEBUG(3, ("sending sam synchronisation message\n"));
76 message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC
, NULL
, 0,
80 /*************************************************************************
82 *************************************************************************/
84 WERROR
_netr_LogonControl2(pipes_struct
*p
,
85 struct netr_LogonControl2
*r
)
87 struct netr_LogonControl2Ex l
;
89 l
.in
.logon_server
= r
->in
.logon_server
;
90 l
.in
.function_code
= r
->in
.function_code
;
91 l
.in
.level
= r
->in
.level
;
92 l
.in
.data
= r
->in
.data
;
93 l
.out
.query
= r
->out
.query
;
95 return _netr_LogonControl2Ex(p
, &l
);
98 /****************************************************************
100 ****************************************************************/
102 WERROR
_netr_LogonControl2Ex(pipes_struct
*p
,
103 struct netr_LogonControl2Ex
*r
)
105 uint32_t flags
= 0x0;
106 WERROR pdc_connection_status
= WERR_OK
;
107 uint32_t logon_attempts
= 0x0;
110 const char *dc_name
= NULL
;
111 struct sockaddr_storage dc_ss
;
112 const char *domain
= NULL
;
113 struct netr_NETLOGON_INFO_1
*info1
;
114 struct netr_NETLOGON_INFO_2
*info2
;
115 struct netr_NETLOGON_INFO_3
*info3
;
118 switch (p
->hdr_req
.opnum
) {
119 case NDR_NETR_LOGONCONTROL
:
120 fn
= "_netr_LogonControl";
122 case NDR_NETR_LOGONCONTROL2
:
123 fn
= "_netr_LogonControl2";
125 case NDR_NETR_LOGONCONTROL2EX
:
126 fn
= "_netr_LogonControl2Ex";
129 return WERR_INVALID_PARAM
;
132 tc_status
= WERR_NO_SUCH_DOMAIN
;
134 switch (r
->in
.function_code
) {
135 case NETLOGON_CONTROL_TC_QUERY
:
136 domain
= r
->in
.data
->domain
;
138 if ( !is_trusted_domain( domain
) )
141 if ( !get_dc_name( domain
, NULL
, dc_name2
, &dc_ss
) ) {
142 tc_status
= WERR_NO_LOGON_SERVERS
;
146 dc_name
= talloc_asprintf(p
->mem_ctx
, "\\\\%s", dc_name2
);
155 case NETLOGON_CONTROL_REDISCOVER
:
156 domain
= r
->in
.data
->domain
;
158 if ( !is_trusted_domain( domain
) )
161 if ( !get_dc_name( domain
, NULL
, dc_name2
, &dc_ss
) ) {
162 tc_status
= WERR_NO_LOGON_SERVERS
;
166 dc_name
= talloc_asprintf(p
->mem_ctx
, "\\\\%s", dc_name2
);
176 /* no idea what this should be */
177 DEBUG(0,("%s: unimplemented function level [%d]\n",
178 fn
, r
->in
.function_code
));
179 return WERR_UNKNOWN_LEVEL
;
182 /* prepare the response */
184 switch (r
->in
.level
) {
186 info1
= TALLOC_ZERO_P(p
->mem_ctx
, struct netr_NETLOGON_INFO_1
);
187 W_ERROR_HAVE_NO_MEMORY(info1
);
189 info1
->flags
= flags
;
190 info1
->pdc_connection_status
= pdc_connection_status
;
192 r
->out
.query
->info1
= info1
;
195 info2
= TALLOC_ZERO_P(p
->mem_ctx
, struct netr_NETLOGON_INFO_2
);
196 W_ERROR_HAVE_NO_MEMORY(info2
);
198 info2
->flags
= flags
;
199 info2
->pdc_connection_status
= pdc_connection_status
;
200 info2
->trusted_dc_name
= dc_name
;
201 info2
->tc_connection_status
= tc_status
;
203 r
->out
.query
->info2
= info2
;
206 info3
= TALLOC_ZERO_P(p
->mem_ctx
, struct netr_NETLOGON_INFO_3
);
207 W_ERROR_HAVE_NO_MEMORY(info3
);
209 info3
->flags
= flags
;
210 info3
->logon_attempts
= logon_attempts
;
212 r
->out
.query
->info3
= info3
;
215 return WERR_UNKNOWN_LEVEL
;
218 if (lp_server_role() == ROLE_DOMAIN_BDC
) {
225 /*************************************************************************
226 _netr_NetrEnumerateTrustedDomains
227 *************************************************************************/
229 WERROR
_netr_NetrEnumerateTrustedDomains(pipes_struct
*p
,
230 struct netr_NetrEnumerateTrustedDomains
*r
)
234 struct trustdom_info
**domains
;
235 uint32_t num_domains
;
236 const char **trusted_domains
;
239 DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__
));
241 /* set up the Trusted Domain List response */
244 status
= pdb_enum_trusteddoms(p
->mem_ctx
, &num_domains
, &domains
);
247 if (!NT_STATUS_IS_OK(status
)) {
248 return ntstatus_to_werror(status
);
251 trusted_domains
= talloc_zero_array(p
->mem_ctx
, const char *, num_domains
+ 1);
252 if (!trusted_domains
) {
256 for (i
= 0; i
< num_domains
; i
++) {
257 trusted_domains
[i
] = talloc_strdup(trusted_domains
, domains
[i
]->name
);
258 if (!trusted_domains
[i
]) {
259 TALLOC_FREE(trusted_domains
);
264 if (!push_reg_multi_sz(trusted_domains
, &blob
, trusted_domains
)) {
265 TALLOC_FREE(trusted_domains
);
269 r
->out
.trusted_domains_blob
->data
= blob
.data
;
270 r
->out
.trusted_domains_blob
->length
= blob
.length
;
272 DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__
));
277 /******************************************************************
278 gets a machine password entry. checks access rights of the host.
279 ******************************************************************/
281 static NTSTATUS
get_md4pw(struct samr_Password
*md4pw
, const char *mach_acct
,
282 uint16_t sec_chan_type
, struct dom_sid
*sid
)
284 struct samu
*sampass
= NULL
;
290 char addr
[INET6_ADDRSTRLEN
];
293 * Currently this code is redundent as we already have a filter
294 * by hostname list. What this code really needs to do is to
295 * get a hosts allowed/hosts denied list from the SAM database
296 * on a per user basis, and make the access decision there.
297 * I will leave this code here for now as a reminder to implement
298 * this at a later date. JRA.
301 if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
302 client_name(get_client_fd()),
303 client_addr(get_client_fd(),addr
,sizeof(addr
)))) {
304 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct
));
309 if ( !(sampass
= samu_new( NULL
)) ) {
310 return NT_STATUS_NO_MEMORY
;
313 /* JRA. This is ok as it is only used for generating the challenge. */
315 ret
= pdb_getsampwnam(sampass
, mach_acct
);
319 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct
));
320 TALLOC_FREE(sampass
);
321 return NT_STATUS_ACCESS_DENIED
;
324 acct_ctrl
= pdb_get_acct_ctrl(sampass
);
325 if (acct_ctrl
& ACB_DISABLED
) {
326 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct
));
327 TALLOC_FREE(sampass
);
328 return NT_STATUS_ACCOUNT_DISABLED
;
331 if (!(acct_ctrl
& ACB_SVRTRUST
) &&
332 !(acct_ctrl
& ACB_WSTRUST
) &&
333 !(acct_ctrl
& ACB_DOMTRUST
))
335 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct
));
336 TALLOC_FREE(sampass
);
337 return NT_STATUS_NO_TRUST_SAM_ACCOUNT
;
340 switch (sec_chan_type
) {
342 if (!(acct_ctrl
& ACB_SVRTRUST
)) {
343 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
344 "but not a server trust account\n", mach_acct
));
345 TALLOC_FREE(sampass
);
346 return NT_STATUS_NO_TRUST_SAM_ACCOUNT
;
350 if (!(acct_ctrl
& ACB_WSTRUST
)) {
351 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
352 "but not a workstation trust account\n", mach_acct
));
353 TALLOC_FREE(sampass
);
354 return NT_STATUS_NO_TRUST_SAM_ACCOUNT
;
357 case SEC_CHAN_DOMAIN
:
358 if (!(acct_ctrl
& ACB_DOMTRUST
)) {
359 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
360 "but not a interdomain trust account\n", mach_acct
));
361 TALLOC_FREE(sampass
);
362 return NT_STATUS_NO_TRUST_SAM_ACCOUNT
;
369 if ((pass
= pdb_get_nt_passwd(sampass
)) == NULL
) {
370 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct
));
371 TALLOC_FREE(sampass
);
372 return NT_STATUS_LOGON_FAILURE
;
375 memcpy(md4pw
->hash
, pass
, 16);
376 dump_data(5, md4pw
->hash
, 16);
378 sid_copy(sid
, pdb_get_user_sid(sampass
));
380 TALLOC_FREE(sampass
);
387 /*************************************************************************
388 _netr_ServerReqChallenge
389 *************************************************************************/
391 NTSTATUS
_netr_ServerReqChallenge(pipes_struct
*p
,
392 struct netr_ServerReqChallenge
*r
)
394 struct netlogon_server_pipe_state
*pipe_state
=
395 talloc_get_type(p
->private_data
, struct netlogon_server_pipe_state
);
398 DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
399 talloc_free(pipe_state
);
400 p
->private_data
= NULL
;
403 pipe_state
= talloc(p
, struct netlogon_server_pipe_state
);
404 NT_STATUS_HAVE_NO_MEMORY(pipe_state
);
406 pipe_state
->client_challenge
= *r
->in
.credentials
;
408 generate_random_buffer(pipe_state
->server_challenge
.data
,
409 sizeof(pipe_state
->server_challenge
.data
));
411 *r
->out
.return_credentials
= pipe_state
->server_challenge
;
413 p
->private_data
= pipe_state
;
418 /*************************************************************************
419 _netr_ServerAuthenticate
420 Create the initial credentials.
421 *************************************************************************/
423 NTSTATUS
_netr_ServerAuthenticate(pipes_struct
*p
,
424 struct netr_ServerAuthenticate
*r
)
426 struct netr_ServerAuthenticate3 a
;
427 uint32_t negotiate_flags
= 0;
430 a
.in
.server_name
= r
->in
.server_name
;
431 a
.in
.account_name
= r
->in
.account_name
;
432 a
.in
.secure_channel_type
= r
->in
.secure_channel_type
;
433 a
.in
.computer_name
= r
->in
.computer_name
;
434 a
.in
.credentials
= r
->in
.credentials
;
435 a
.in
.negotiate_flags
= &negotiate_flags
;
437 a
.out
.return_credentials
= r
->out
.return_credentials
;
439 a
.out
.negotiate_flags
= &negotiate_flags
;
441 return _netr_ServerAuthenticate3(p
, &a
);
445 /*************************************************************************
446 _netr_ServerAuthenticate3
447 *************************************************************************/
449 NTSTATUS
_netr_ServerAuthenticate3(pipes_struct
*p
,
450 struct netr_ServerAuthenticate3
*r
)
454 /* r->in.negotiate_flags is an aliased pointer to r->out.negotiate_flags,
455 * so use a copy to avoid destroying the client values. */
456 uint32_t in_neg_flags
= *r
->in
.negotiate_flags
;
459 struct samr_Password mach_pwd
;
460 struct netlogon_creds_CredentialState
*creds
;
461 struct netlogon_server_pipe_state
*pipe_state
=
462 talloc_get_type(p
->private_data
, struct netlogon_server_pipe_state
);
464 /* According to Microsoft (see bugid #6099)
465 * Windows 7 looks at the negotiate_flags
466 * returned in this structure *even if the
467 * call fails with access denied* ! So in order
468 * to allow Win7 to connect to a Samba NT style
469 * PDC we set the flags before we know if it's
474 srv_flgs
= NETLOGON_NEG_ACCOUNT_LOCKOUT
|
475 NETLOGON_NEG_PERSISTENT_SAMREPL
|
476 NETLOGON_NEG_ARCFOUR
|
477 NETLOGON_NEG_PROMOTION_COUNT
|
478 NETLOGON_NEG_CHANGELOG_BDC
|
479 NETLOGON_NEG_FULL_SYNC_REPL
|
480 NETLOGON_NEG_MULTIPLE_SIDS
|
482 NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL
|
483 NETLOGON_NEG_PASSWORD_SET2
;
485 /* Ensure we support strong (128-bit) keys. */
486 if (in_neg_flags
& NETLOGON_NEG_STRONG_KEYS
) {
487 srv_flgs
|= NETLOGON_NEG_STRONG_KEYS
;
490 if (lp_server_schannel() != false) {
491 srv_flgs
|= NETLOGON_NEG_SCHANNEL
;
494 switch (p
->hdr_req
.opnum
) {
495 case NDR_NETR_SERVERAUTHENTICATE
:
496 fn
= "_netr_ServerAuthenticate";
498 case NDR_NETR_SERVERAUTHENTICATE2
:
499 fn
= "_netr_ServerAuthenticate2";
501 case NDR_NETR_SERVERAUTHENTICATE3
:
502 fn
= "_netr_ServerAuthenticate3";
505 return NT_STATUS_INTERNAL_ERROR
;
508 /* We use this as the key to store the creds: */
509 /* r->in.computer_name */
512 DEBUG(0,("%s: no challenge sent to client %s\n", fn
,
513 r
->in
.computer_name
));
514 status
= NT_STATUS_ACCESS_DENIED
;
518 if ( (lp_server_schannel() == true) &&
519 ((in_neg_flags
& NETLOGON_NEG_SCHANNEL
) == 0) ) {
521 /* schannel must be used, but client did not offer it. */
522 DEBUG(0,("%s: schannel required but client failed "
523 "to offer it. Client was %s\n",
524 fn
, r
->in
.account_name
));
525 status
= NT_STATUS_ACCESS_DENIED
;
529 status
= get_md4pw(&mach_pwd
,
531 r
->in
.secure_channel_type
,
533 if (!NT_STATUS_IS_OK(status
)) {
534 DEBUG(0,("%s: failed to get machine password for "
536 fn
, r
->in
.account_name
, nt_errstr(status
) ));
537 /* always return NT_STATUS_ACCESS_DENIED */
538 status
= NT_STATUS_ACCESS_DENIED
;
542 /* From the client / server challenges and md4 password, generate sess key */
543 /* Check client credentials are valid. */
544 creds
= netlogon_creds_server_init(p
->mem_ctx
,
547 r
->in
.secure_channel_type
,
548 &pipe_state
->client_challenge
,
549 &pipe_state
->server_challenge
,
552 r
->out
.return_credentials
,
553 *r
->in
.negotiate_flags
);
555 DEBUG(0,("%s: netlogon_creds_server_check failed. Rejecting auth "
556 "request from client %s machine account %s\n",
557 fn
, r
->in
.computer_name
,
558 r
->in
.account_name
));
559 status
= NT_STATUS_ACCESS_DENIED
;
563 creds
->sid
= sid_dup_talloc(creds
, &sid
);
565 status
= NT_STATUS_NO_MEMORY
;
569 /* Store off the state so we can continue after client disconnect. */
571 status
= schannel_store_session_key(p
->mem_ctx
, creds
);
574 if (!NT_STATUS_IS_OK(status
)) {
578 sid_peek_rid(&sid
, r
->out
.rid
);
580 status
= NT_STATUS_OK
;
584 *r
->out
.negotiate_flags
= srv_flgs
;
588 /*************************************************************************
589 _netr_ServerAuthenticate2
590 *************************************************************************/
592 NTSTATUS
_netr_ServerAuthenticate2(pipes_struct
*p
,
593 struct netr_ServerAuthenticate2
*r
)
595 struct netr_ServerAuthenticate3 a
;
598 a
.in
.server_name
= r
->in
.server_name
;
599 a
.in
.account_name
= r
->in
.account_name
;
600 a
.in
.secure_channel_type
= r
->in
.secure_channel_type
;
601 a
.in
.computer_name
= r
->in
.computer_name
;
602 a
.in
.credentials
= r
->in
.credentials
;
603 a
.in
.negotiate_flags
= r
->in
.negotiate_flags
;
605 a
.out
.return_credentials
= r
->out
.return_credentials
;
607 a
.out
.negotiate_flags
= r
->out
.negotiate_flags
;
609 return _netr_ServerAuthenticate3(p
, &a
);
612 /*************************************************************************
613 *************************************************************************/
615 static NTSTATUS
netr_creds_server_step_check(pipes_struct
*p
,
617 const char *computer_name
,
618 struct netr_Authenticator
*received_authenticator
,
619 struct netr_Authenticator
*return_authenticator
,
620 struct netlogon_creds_CredentialState
**creds_out
)
623 struct tdb_context
*tdb
;
624 bool schannel_global_required
= (lp_server_schannel() == true) ? true:false;
625 bool schannel_in_use
= (p
->auth
.auth_type
== PIPE_AUTH_TYPE_SCHANNEL
) ? true:false; /* &&
626 (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY ||
627 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY); */
629 tdb
= open_schannel_session_store(mem_ctx
);
631 return NT_STATUS_ACCESS_DENIED
;
634 status
= schannel_creds_server_step_check_tdb(tdb
, mem_ctx
,
636 schannel_global_required
,
638 received_authenticator
,
639 return_authenticator
,
646 /*************************************************************************
647 *************************************************************************/
649 static NTSTATUS
netr_find_machine_account(TALLOC_CTX
*mem_ctx
,
650 const char *account_name
,
651 struct samu
**sampassp
)
653 struct samu
*sampass
;
657 sampass
= samu_new(mem_ctx
);
659 return NT_STATUS_NO_MEMORY
;
663 ret
= pdb_getsampwnam(sampass
, account_name
);
667 TALLOC_FREE(sampass
);
668 return NT_STATUS_ACCESS_DENIED
;
671 /* Ensure the account exists and is a machine account. */
673 acct_ctrl
= pdb_get_acct_ctrl(sampass
);
675 if (!(acct_ctrl
& ACB_WSTRUST
||
676 acct_ctrl
& ACB_SVRTRUST
||
677 acct_ctrl
& ACB_DOMTRUST
)) {
678 TALLOC_FREE(sampass
);
679 return NT_STATUS_NO_SUCH_USER
;
682 if (acct_ctrl
& ACB_DISABLED
) {
683 TALLOC_FREE(sampass
);
684 return NT_STATUS_ACCOUNT_DISABLED
;
692 /*************************************************************************
693 *************************************************************************/
695 static NTSTATUS
netr_set_machine_account_password(TALLOC_CTX
*mem_ctx
,
696 struct samu
*sampass
,
697 DATA_BLOB
*plaintext_blob
,
698 struct samr_Password
*nt_hash
,
699 struct samr_Password
*lm_hash
)
703 const char *plaintext
= NULL
;
704 size_t plaintext_len
;
705 struct samr_Password nt_hash_local
;
708 return NT_STATUS_INVALID_PARAMETER
;
711 if (plaintext_blob
) {
712 if (!convert_string_talloc(mem_ctx
, CH_UTF16
, CH_UNIX
,
713 plaintext_blob
->data
, plaintext_blob
->length
,
714 &plaintext
, &plaintext_len
, false))
717 mdfour(nt_hash_local
.hash
, plaintext_blob
->data
, plaintext_blob
->length
);
718 nt_hash
= &nt_hash_local
;
723 if (!pdb_set_plaintext_passwd(sampass
, plaintext
)) {
724 return NT_STATUS_ACCESS_DENIED
;
731 old_pw
= pdb_get_nt_passwd(sampass
);
733 if (old_pw
&& memcmp(nt_hash
->hash
, old_pw
, 16) == 0) {
734 /* Avoid backend modificiations and other fun if the
735 client changed the password to the *same thing* */
737 /* LM password should be NULL for machines */
738 if (!pdb_set_lanman_passwd(sampass
, NULL
, PDB_CHANGED
)) {
739 return NT_STATUS_NO_MEMORY
;
741 if (!pdb_set_nt_passwd(sampass
, nt_hash
->hash
, PDB_CHANGED
)) {
742 return NT_STATUS_NO_MEMORY
;
745 if (!pdb_set_pass_last_set_time(sampass
, time(NULL
), PDB_CHANGED
)) {
746 /* Not quite sure what this one qualifies as, but this will do */
747 return NT_STATUS_UNSUCCESSFUL
;
754 status
= pdb_update_sam_account(sampass
);
760 /*************************************************************************
761 _netr_ServerPasswordSet
762 *************************************************************************/
764 NTSTATUS
_netr_ServerPasswordSet(pipes_struct
*p
,
765 struct netr_ServerPasswordSet
*r
)
767 NTSTATUS status
= NT_STATUS_OK
;
768 struct samu
*sampass
=NULL
;
770 struct netlogon_creds_CredentialState
*creds
;
772 DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__
));
775 status
= netr_creds_server_step_check(p
, p
->mem_ctx
,
778 r
->out
.return_authenticator
,
782 if (!NT_STATUS_IS_OK(status
)) {
783 DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
784 "request from client %s machine account %s\n",
785 r
->in
.computer_name
, creds
->computer_name
));
790 DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
791 r
->in
.computer_name
, creds
->computer_name
));
793 netlogon_creds_des_decrypt(creds
, r
->in
.new_password
);
795 DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
796 for(i
= 0; i
< sizeof(r
->in
.new_password
->hash
); i
++)
797 DEBUG(100,("%02X ", r
->in
.new_password
->hash
[i
]));
800 status
= netr_find_machine_account(p
->mem_ctx
,
803 if (!NT_STATUS_IS_OK(status
)) {
807 status
= netr_set_machine_account_password(sampass
,
812 TALLOC_FREE(sampass
);
816 /****************************************************************
817 _netr_ServerPasswordSet2
818 ****************************************************************/
820 NTSTATUS
_netr_ServerPasswordSet2(pipes_struct
*p
,
821 struct netr_ServerPasswordSet2
*r
)
824 struct netlogon_creds_CredentialState
*creds
;
825 struct samu
*sampass
;
827 struct samr_CryptPassword password_buf
;
830 status
= netr_creds_server_step_check(p
, p
->mem_ctx
,
833 r
->out
.return_authenticator
,
837 if (!NT_STATUS_IS_OK(status
)) {
838 DEBUG(2,("_netr_ServerPasswordSet2: netlogon_creds_server_step "
839 "failed. Rejecting auth request from client %s machine account %s\n",
840 r
->in
.computer_name
, creds
->computer_name
));
845 memcpy(password_buf
.data
, r
->in
.new_password
->data
, 512);
846 SIVAL(password_buf
.data
, 512, r
->in
.new_password
->length
);
847 netlogon_creds_arcfour_crypt(creds
, password_buf
.data
, 516);
849 if (!extract_pw_from_buffer(p
->mem_ctx
, password_buf
.data
, &plaintext
)) {
850 return NT_STATUS_WRONG_PASSWORD
;
853 status
= netr_find_machine_account(p
->mem_ctx
,
856 if (!NT_STATUS_IS_OK(status
)) {
860 status
= netr_set_machine_account_password(sampass
,
865 TALLOC_FREE(sampass
);
869 /*************************************************************************
871 *************************************************************************/
873 NTSTATUS
_netr_LogonSamLogoff(pipes_struct
*p
,
874 struct netr_LogonSamLogoff
*r
)
877 struct netlogon_creds_CredentialState
*creds
;
880 status
= netr_creds_server_step_check(p
, p
->mem_ctx
,
883 r
->out
.return_authenticator
,
890 /*************************************************************************
891 _netr_LogonSamLogon_base
892 *************************************************************************/
894 static NTSTATUS
_netr_LogonSamLogon_base(pipes_struct
*p
,
895 struct netr_LogonSamLogonEx
*r
,
896 struct netlogon_creds_CredentialState
*creds
)
898 NTSTATUS status
= NT_STATUS_OK
;
899 union netr_LogonLevel
*logon
= r
->in
.logon
;
900 const char *nt_username
, *nt_domain
, *nt_workstation
;
901 auth_usersupplied_info
*user_info
= NULL
;
902 auth_serversupplied_info
*server_info
= NULL
;
903 struct auth_context
*auth_context
= NULL
;
904 uint8_t pipe_session_key
[16];
905 bool process_creds
= true;
908 switch (p
->hdr_req
.opnum
) {
909 case NDR_NETR_LOGONSAMLOGON
:
910 process_creds
= true;
911 fn
= "_netr_LogonSamLogon";
913 case NDR_NETR_LOGONSAMLOGONWITHFLAGS
:
914 process_creds
= true;
915 fn
= "_netr_LogonSamLogonWithFlags";
917 case NDR_NETR_LOGONSAMLOGONEX
:
918 process_creds
= false;
919 fn
= "_netr_LogonSamLogonEx";
922 return NT_STATUS_INTERNAL_ERROR
;
925 *r
->out
.authoritative
= true; /* authoritative response */
927 switch (r
->in
.validation_level
) {
929 r
->out
.validation
->sam2
= TALLOC_ZERO_P(p
->mem_ctx
, struct netr_SamInfo2
);
930 if (!r
->out
.validation
->sam2
) {
931 return NT_STATUS_NO_MEMORY
;
935 r
->out
.validation
->sam3
= TALLOC_ZERO_P(p
->mem_ctx
, struct netr_SamInfo3
);
936 if (!r
->out
.validation
->sam3
) {
937 return NT_STATUS_NO_MEMORY
;
941 r
->out
.validation
->sam6
= TALLOC_ZERO_P(p
->mem_ctx
, struct netr_SamInfo6
);
942 if (!r
->out
.validation
->sam6
) {
943 return NT_STATUS_NO_MEMORY
;
947 DEBUG(0,("%s: bad validation_level value %d.\n",
948 fn
, (int)r
->in
.validation_level
));
949 return NT_STATUS_INVALID_INFO_CLASS
;
952 switch (r
->in
.logon_level
) {
953 case NetlogonInteractiveInformation
:
954 case NetlogonServiceInformation
:
955 case NetlogonInteractiveTransitiveInformation
:
956 case NetlogonServiceTransitiveInformation
:
957 nt_username
= logon
->password
->identity_info
.account_name
.string
;
958 nt_domain
= logon
->password
->identity_info
.domain_name
.string
;
959 nt_workstation
= logon
->password
->identity_info
.workstation
.string
;
961 DEBUG(3,("SAM Logon (Interactive). Domain:[%s]. ", lp_workgroup()));
963 case NetlogonNetworkInformation
:
964 case NetlogonNetworkTransitiveInformation
:
965 nt_username
= logon
->network
->identity_info
.account_name
.string
;
966 nt_domain
= logon
->network
->identity_info
.domain_name
.string
;
967 nt_workstation
= logon
->network
->identity_info
.workstation
.string
;
969 DEBUG(3,("SAM Logon (Network). Domain:[%s]. ", lp_workgroup()));
972 DEBUG(2,("SAM Logon: unsupported switch value\n"));
973 return NT_STATUS_INVALID_INFO_CLASS
;
976 DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username
, nt_workstation
, nt_domain
));
977 fstrcpy(current_user_info
.smb_name
, nt_username
);
978 sub_set_smb_name(nt_username
);
980 DEBUG(5,("Attempting validation level %d for unmapped username %s.\n",
981 r
->in
.validation_level
, nt_username
));
983 status
= NT_STATUS_OK
;
985 switch (r
->in
.logon_level
) {
986 case NetlogonNetworkInformation
:
987 case NetlogonNetworkTransitiveInformation
:
989 const char *wksname
= nt_workstation
;
991 status
= make_auth_context_fixed(&auth_context
,
992 logon
->network
->challenge
);
993 if (!NT_STATUS_IS_OK(status
)) {
997 /* For a network logon, the workstation name comes in with two
998 * backslashes in the front. Strip them if they are there. */
1000 if (*wksname
== '\\') wksname
++;
1001 if (*wksname
== '\\') wksname
++;
1003 /* Standard challenge/response authenticaion */
1004 if (!make_user_info_netlogon_network(&user_info
,
1005 nt_username
, nt_domain
,
1007 logon
->network
->identity_info
.parameter_control
,
1008 logon
->network
->lm
.data
,
1009 logon
->network
->lm
.length
,
1010 logon
->network
->nt
.data
,
1011 logon
->network
->nt
.length
)) {
1012 status
= NT_STATUS_NO_MEMORY
;
1016 case NetlogonInteractiveInformation
:
1017 case NetlogonServiceInformation
:
1018 case NetlogonInteractiveTransitiveInformation
:
1019 case NetlogonServiceTransitiveInformation
:
1021 /* 'Interactive' authentication, supplies the password in its
1022 MD4 form, encrypted with the session key. We will convert
1023 this to challenge/response for the auth subsystem to chew
1028 if (!NT_STATUS_IS_OK(status
= make_auth_context_subsystem(&auth_context
))) {
1032 auth_context
->get_ntlm_challenge(auth_context
, chal
);
1034 if (!make_user_info_netlogon_interactive(&user_info
,
1035 nt_username
, nt_domain
,
1037 logon
->password
->identity_info
.parameter_control
,
1039 logon
->password
->lmpassword
.hash
,
1040 logon
->password
->ntpassword
.hash
,
1041 creds
->session_key
)) {
1042 status
= NT_STATUS_NO_MEMORY
;
1047 DEBUG(2,("SAM Logon: unsupported switch value\n"));
1048 return NT_STATUS_INVALID_INFO_CLASS
;
1051 if ( NT_STATUS_IS_OK(status
) ) {
1052 status
= auth_context
->check_ntlm_password(auth_context
,
1053 user_info
, &server_info
);
1056 (auth_context
->free
)(&auth_context
);
1057 free_user_info(&user_info
);
1059 DEBUG(5,("%s: check_password returned status %s\n",
1060 fn
, nt_errstr(status
)));
1062 /* Check account and password */
1064 if (!NT_STATUS_IS_OK(status
)) {
1065 /* If we don't know what this domain is, we need to
1066 indicate that we are not authoritative. This
1067 allows the client to decide if it needs to try
1068 a local user. Fix by jpjanosi@us.ibm.com, #2976 */
1069 if ( NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_USER
)
1070 && !strequal(nt_domain
, get_global_sam_name())
1071 && !is_trusted_domain(nt_domain
) )
1072 *r
->out
.authoritative
= false; /* We are not authoritative */
1074 TALLOC_FREE(server_info
);
1078 if (server_info
->guest
) {
1079 /* We don't like guest domain logons... */
1080 DEBUG(5,("%s: Attempted domain logon as GUEST "
1082 TALLOC_FREE(server_info
);
1083 return NT_STATUS_LOGON_FAILURE
;
1086 /* This is the point at which, if the login was successful, that
1087 the SAM Local Security Authority should record that the user is
1088 logged in to the domain. */
1090 if (process_creds
) {
1091 /* Get the pipe session key from the creds. */
1092 memcpy(pipe_session_key
, creds
->session_key
, 16);
1094 /* Get the pipe session key from the schannel. */
1095 if ((p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
)
1096 || (p
->auth
.a_u
.schannel_auth
== NULL
)) {
1097 return NT_STATUS_INVALID_HANDLE
;
1099 memcpy(pipe_session_key
, p
->auth
.a_u
.schannel_auth
->creds
->session_key
, 16);
1102 switch (r
->in
.validation_level
) {
1104 status
= serverinfo_to_SamInfo2(server_info
, pipe_session_key
, 16,
1105 r
->out
.validation
->sam2
);
1108 status
= serverinfo_to_SamInfo3(server_info
, pipe_session_key
, 16,
1109 r
->out
.validation
->sam3
);
1112 status
= serverinfo_to_SamInfo6(server_info
, pipe_session_key
, 16,
1113 r
->out
.validation
->sam6
);
1117 TALLOC_FREE(server_info
);
1122 /****************************************************************
1123 _netr_LogonSamLogonWithFlags
1124 ****************************************************************/
1126 NTSTATUS
_netr_LogonSamLogonWithFlags(pipes_struct
*p
,
1127 struct netr_LogonSamLogonWithFlags
*r
)
1130 struct netlogon_creds_CredentialState
*creds
;
1131 struct netr_LogonSamLogonEx r2
;
1132 struct netr_Authenticator return_authenticator
;
1135 status
= netr_creds_server_step_check(p
, p
->mem_ctx
,
1136 r
->in
.computer_name
,
1138 &return_authenticator
,
1141 if (!NT_STATUS_IS_OK(status
)) {
1145 r2
.in
.server_name
= r
->in
.server_name
;
1146 r2
.in
.computer_name
= r
->in
.computer_name
;
1147 r2
.in
.logon_level
= r
->in
.logon_level
;
1148 r2
.in
.logon
= r
->in
.logon
;
1149 r2
.in
.validation_level
= r
->in
.validation_level
;
1150 r2
.in
.flags
= r
->in
.flags
;
1151 r2
.out
.validation
= r
->out
.validation
;
1152 r2
.out
.authoritative
= r
->out
.authoritative
;
1153 r2
.out
.flags
= r
->out
.flags
;
1155 status
= _netr_LogonSamLogon_base(p
, &r2
, creds
);
1157 *r
->out
.return_authenticator
= return_authenticator
;
1162 /*************************************************************************
1164 *************************************************************************/
1166 NTSTATUS
_netr_LogonSamLogon(pipes_struct
*p
,
1167 struct netr_LogonSamLogon
*r
)
1170 struct netr_LogonSamLogonWithFlags r2
;
1173 r2
.in
.server_name
= r
->in
.server_name
;
1174 r2
.in
.computer_name
= r
->in
.computer_name
;
1175 r2
.in
.credential
= r
->in
.credential
;
1176 r2
.in
.logon_level
= r
->in
.logon_level
;
1177 r2
.in
.logon
= r
->in
.logon
;
1178 r2
.in
.validation_level
= r
->in
.validation_level
;
1179 r2
.in
.return_authenticator
= r
->in
.return_authenticator
;
1180 r2
.in
.flags
= &flags
;
1181 r2
.out
.validation
= r
->out
.validation
;
1182 r2
.out
.authoritative
= r
->out
.authoritative
;
1183 r2
.out
.flags
= &flags
;
1184 r2
.out
.return_authenticator
= r
->out
.return_authenticator
;
1186 status
= _netr_LogonSamLogonWithFlags(p
, &r2
);
1191 /*************************************************************************
1192 _netr_LogonSamLogonEx
1193 - no credential chaining. Map into net sam logon.
1194 *************************************************************************/
1196 NTSTATUS
_netr_LogonSamLogonEx(pipes_struct
*p
,
1197 struct netr_LogonSamLogonEx
*r
)
1200 struct netlogon_creds_CredentialState
*creds
= NULL
;
1203 status
= schannel_fetch_session_key(p
->mem_ctx
, r
->in
.computer_name
, &creds
);
1205 if (!NT_STATUS_IS_OK(status
)) {
1209 /* Only allow this if the pipe is protected. */
1210 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
1211 DEBUG(0,("_netr_LogonSamLogonEx: client %s not using schannel for netlogon\n",
1212 get_remote_machine_name() ));
1213 return NT_STATUS_INVALID_PARAMETER
;
1216 status
= _netr_LogonSamLogon_base(p
, r
, creds
);
1222 /*************************************************************************
1224 *************************************************************************/
1225 #if 0 /* JERRY -- not correct */
1226 NTSTATUS
_ds_enum_dom_trusts(pipes_struct
*p
, DS_Q_ENUM_DOM_TRUSTS
*q_u
,
1227 DS_R_ENUM_DOM_TRUSTS
*r_u
)
1229 NTSTATUS status
= NT_STATUS_OK
;
1231 /* TODO: According to MSDN, the can only be executed against a
1232 DC or domain member running Windows 2000 or later. Need
1233 to test against a standalone 2k server and see what it
1234 does. A windows 2000 DC includes its own domain in the
1242 /****************************************************************
1243 ****************************************************************/
1245 WERROR
_netr_LogonUasLogon(pipes_struct
*p
,
1246 struct netr_LogonUasLogon
*r
)
1248 p
->rng_fault_state
= true;
1249 return WERR_NOT_SUPPORTED
;
1252 /****************************************************************
1253 ****************************************************************/
1255 WERROR
_netr_LogonUasLogoff(pipes_struct
*p
,
1256 struct netr_LogonUasLogoff
*r
)
1258 p
->rng_fault_state
= true;
1259 return WERR_NOT_SUPPORTED
;
1262 /****************************************************************
1263 ****************************************************************/
1265 NTSTATUS
_netr_DatabaseDeltas(pipes_struct
*p
,
1266 struct netr_DatabaseDeltas
*r
)
1268 p
->rng_fault_state
= true;
1269 return NT_STATUS_NOT_IMPLEMENTED
;
1272 /****************************************************************
1273 ****************************************************************/
1275 NTSTATUS
_netr_DatabaseSync(pipes_struct
*p
,
1276 struct netr_DatabaseSync
*r
)
1278 p
->rng_fault_state
= true;
1279 return NT_STATUS_NOT_IMPLEMENTED
;
1282 /****************************************************************
1283 ****************************************************************/
1285 NTSTATUS
_netr_AccountDeltas(pipes_struct
*p
,
1286 struct netr_AccountDeltas
*r
)
1288 p
->rng_fault_state
= true;
1289 return NT_STATUS_NOT_IMPLEMENTED
;
1292 /****************************************************************
1293 ****************************************************************/
1295 NTSTATUS
_netr_AccountSync(pipes_struct
*p
,
1296 struct netr_AccountSync
*r
)
1298 p
->rng_fault_state
= true;
1299 return NT_STATUS_NOT_IMPLEMENTED
;
1302 /****************************************************************
1303 ****************************************************************/
1305 WERROR
_netr_GetDcName(pipes_struct
*p
,
1306 struct netr_GetDcName
*r
)
1308 p
->rng_fault_state
= true;
1309 return WERR_NOT_SUPPORTED
;
1312 /****************************************************************
1313 ****************************************************************/
1315 WERROR
_netr_GetAnyDCName(pipes_struct
*p
,
1316 struct netr_GetAnyDCName
*r
)
1318 p
->rng_fault_state
= true;
1319 return WERR_NOT_SUPPORTED
;
1322 /****************************************************************
1323 ****************************************************************/
1325 NTSTATUS
_netr_DatabaseSync2(pipes_struct
*p
,
1326 struct netr_DatabaseSync2
*r
)
1328 p
->rng_fault_state
= true;
1329 return NT_STATUS_NOT_IMPLEMENTED
;
1332 /****************************************************************
1333 ****************************************************************/
1335 NTSTATUS
_netr_DatabaseRedo(pipes_struct
*p
,
1336 struct netr_DatabaseRedo
*r
)
1338 p
->rng_fault_state
= true;
1339 return NT_STATUS_NOT_IMPLEMENTED
;
1342 /****************************************************************
1343 ****************************************************************/
1345 WERROR
_netr_DsRGetDCName(pipes_struct
*p
,
1346 struct netr_DsRGetDCName
*r
)
1348 p
->rng_fault_state
= true;
1349 return WERR_NOT_SUPPORTED
;
1352 /****************************************************************
1353 ****************************************************************/
1355 NTSTATUS
_netr_LogonGetCapabilities(pipes_struct
*p
,
1356 struct netr_LogonGetCapabilities
*r
)
1358 return NT_STATUS_NOT_IMPLEMENTED
;
1361 /****************************************************************
1362 ****************************************************************/
1364 WERROR
_netr_NETRLOGONSETSERVICEBITS(pipes_struct
*p
,
1365 struct netr_NETRLOGONSETSERVICEBITS
*r
)
1367 p
->rng_fault_state
= true;
1368 return WERR_NOT_SUPPORTED
;
1371 /****************************************************************
1372 ****************************************************************/
1374 WERROR
_netr_LogonGetTrustRid(pipes_struct
*p
,
1375 struct netr_LogonGetTrustRid
*r
)
1377 p
->rng_fault_state
= true;
1378 return WERR_NOT_SUPPORTED
;
1381 /****************************************************************
1382 ****************************************************************/
1384 WERROR
_netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct
*p
,
1385 struct netr_NETRLOGONCOMPUTESERVERDIGEST
*r
)
1387 p
->rng_fault_state
= true;
1388 return WERR_NOT_SUPPORTED
;
1391 /****************************************************************
1392 ****************************************************************/
1394 WERROR
_netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct
*p
,
1395 struct netr_NETRLOGONCOMPUTECLIENTDIGEST
*r
)
1397 p
->rng_fault_state
= true;
1398 return WERR_NOT_SUPPORTED
;
1401 /****************************************************************
1402 ****************************************************************/
1404 WERROR
_netr_DsRGetDCNameEx(pipes_struct
*p
,
1405 struct netr_DsRGetDCNameEx
*r
)
1407 p
->rng_fault_state
= true;
1408 return WERR_NOT_SUPPORTED
;
1411 /****************************************************************
1412 ****************************************************************/
1414 WERROR
_netr_DsRGetSiteName(pipes_struct
*p
,
1415 struct netr_DsRGetSiteName
*r
)
1417 p
->rng_fault_state
= true;
1418 return WERR_NOT_SUPPORTED
;
1421 /****************************************************************
1422 ****************************************************************/
1424 NTSTATUS
_netr_LogonGetDomainInfo(pipes_struct
*p
,
1425 struct netr_LogonGetDomainInfo
*r
)
1427 p
->rng_fault_state
= true;
1428 return NT_STATUS_NOT_IMPLEMENTED
;
1431 /****************************************************************
1432 ****************************************************************/
1434 WERROR
_netr_ServerPasswordGet(pipes_struct
*p
,
1435 struct netr_ServerPasswordGet
*r
)
1437 p
->rng_fault_state
= true;
1438 return WERR_NOT_SUPPORTED
;
1441 /****************************************************************
1442 ****************************************************************/
1444 WERROR
_netr_NETRLOGONSENDTOSAM(pipes_struct
*p
,
1445 struct netr_NETRLOGONSENDTOSAM
*r
)
1447 p
->rng_fault_state
= true;
1448 return WERR_NOT_SUPPORTED
;
1451 /****************************************************************
1452 ****************************************************************/
1454 WERROR
_netr_DsRAddressToSitenamesW(pipes_struct
*p
,
1455 struct netr_DsRAddressToSitenamesW
*r
)
1457 p
->rng_fault_state
= true;
1458 return WERR_NOT_SUPPORTED
;
1461 /****************************************************************
1462 ****************************************************************/
1464 WERROR
_netr_DsRGetDCNameEx2(pipes_struct
*p
,
1465 struct netr_DsRGetDCNameEx2
*r
)
1467 p
->rng_fault_state
= true;
1468 return WERR_NOT_SUPPORTED
;
1471 /****************************************************************
1472 ****************************************************************/
1474 WERROR
_netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct
*p
,
1475 struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN
*r
)
1477 p
->rng_fault_state
= true;
1478 return WERR_NOT_SUPPORTED
;
1481 /****************************************************************
1482 ****************************************************************/
1484 WERROR
_netr_NetrEnumerateTrustedDomainsEx(pipes_struct
*p
,
1485 struct netr_NetrEnumerateTrustedDomainsEx
*r
)
1487 p
->rng_fault_state
= true;
1488 return WERR_NOT_SUPPORTED
;
1491 /****************************************************************
1492 ****************************************************************/
1494 WERROR
_netr_DsRAddressToSitenamesExW(pipes_struct
*p
,
1495 struct netr_DsRAddressToSitenamesExW
*r
)
1497 p
->rng_fault_state
= true;
1498 return WERR_NOT_SUPPORTED
;
1501 /****************************************************************
1502 ****************************************************************/
1504 WERROR
_netr_DsrGetDcSiteCoverageW(pipes_struct
*p
,
1505 struct netr_DsrGetDcSiteCoverageW
*r
)
1507 p
->rng_fault_state
= true;
1508 return WERR_NOT_SUPPORTED
;
1511 /****************************************************************
1512 ****************************************************************/
1514 WERROR
_netr_DsrEnumerateDomainTrusts(pipes_struct
*p
,
1515 struct netr_DsrEnumerateDomainTrusts
*r
)
1517 p
->rng_fault_state
= true;
1518 return WERR_NOT_SUPPORTED
;
1521 /****************************************************************
1522 ****************************************************************/
1524 WERROR
_netr_DsrDeregisterDNSHostRecords(pipes_struct
*p
,
1525 struct netr_DsrDeregisterDNSHostRecords
*r
)
1527 p
->rng_fault_state
= true;
1528 return WERR_NOT_SUPPORTED
;
1531 /****************************************************************
1532 ****************************************************************/
1534 NTSTATUS
_netr_ServerTrustPasswordsGet(pipes_struct
*p
,
1535 struct netr_ServerTrustPasswordsGet
*r
)
1537 p
->rng_fault_state
= true;
1538 return NT_STATUS_NOT_IMPLEMENTED
;
1541 /****************************************************************
1542 ****************************************************************/
1544 WERROR
_netr_DsRGetForestTrustInformation(pipes_struct
*p
,
1545 struct netr_DsRGetForestTrustInformation
*r
)
1547 p
->rng_fault_state
= true;
1548 return WERR_NOT_SUPPORTED
;
1551 /****************************************************************
1552 ****************************************************************/
1554 WERROR
_netr_GetForestTrustInformation(pipes_struct
*p
,
1555 struct netr_GetForestTrustInformation
*r
)
1557 p
->rng_fault_state
= true;
1558 return WERR_NOT_SUPPORTED
;
1561 /****************************************************************
1562 ****************************************************************/
1564 NTSTATUS
_netr_ServerGetTrustInfo(pipes_struct
*p
,
1565 struct netr_ServerGetTrustInfo
*r
)
1567 p
->rng_fault_state
= true;
1568 return NT_STATUS_NOT_IMPLEMENTED
;