?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Enable build of pidl generated netlogon server.
[Samba/gebeck_regimport.git] / source / rpc_server / srv_netlog_nt.c
blob3a7075ecd6d1918b1e53fa528805e93d5372aded
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997.
7 * Copyright (C) Jeremy Allison 1998-2001.
8 * Copyright (C) Andrew Bartlett 2001.
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /* This is the implementation of the netlogon pipe. */
25
26 #include "includes.h"
27
28 extern userdom_struct current_user_info;
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_RPC_SRV
32
33 /*************************************************************************
34 init_net_r_req_chal:
35 *************************************************************************/
36
37 static void init_net_r_req_chal(NET_R_REQ_CHAL *r_c,
38 DOM_CHAL *srv_chal, NTSTATUS status)
39 {
40 DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__));
41 memcpy(r_c->srv_chal.data, srv_chal->data, sizeof(srv_chal->data));
42 r_c->status = status;
43 }
44
45 /*************************************************************************
46 net_reply_logon_ctrl:
47 *************************************************************************/
48
49 NTSTATUS _net_logon_ctrl(pipes_struct *p, NET_Q_LOGON_CTRL *q_u,
50 NET_R_LOGON_CTRL *r_u)
51 {
52 uint32 flags = 0x0;
53 uint32 pdc_connection_status = 0x00; /* Maybe a win32 error code? */
54
55 /* Setup the Logon Control response */
56
57 init_net_r_logon_ctrl(r_u, q_u->query_level, flags,
58 pdc_connection_status);
59
60 return r_u->status;
61 }
62
63 /****************************************************************************
64 Send a message to smbd to do a sam synchronisation
65 **************************************************************************/
66
67 static void send_sync_message(void)
68 {
69 DEBUG(3, ("sending sam synchronisation message\n"));
70 message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
71 NULL);
72 }
73
74 /*************************************************************************
75 net_reply_logon_ctrl2:
76 *************************************************************************/
77
78 NTSTATUS _net_logon_ctrl2(pipes_struct *p, NET_Q_LOGON_CTRL2 *q_u, NET_R_LOGON_CTRL2 *r_u)
79 {
80 uint32 flags = 0x0;
81 uint32 pdc_connection_status = 0x0;
82 uint32 logon_attempts = 0x0;
83 uint32 tc_status;
84 fstring servername, domain, dc_name, dc_name2;
85 struct sockaddr_storage dc_ss;
86
87 /* this should be \\global_myname() */
88 unistr2_to_ascii(servername, &q_u->uni_server_name, sizeof(servername));
89
90 r_u->status = NT_STATUS_OK;
91
92 tc_status = W_ERROR_V(WERR_NO_SUCH_DOMAIN);
93 fstrcpy( dc_name, "" );
94
95 switch ( q_u->function_code ) {
96 case NETLOGON_CONTROL_TC_QUERY:
97 unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain));
98
99 if ( !is_trusted_domain( domain ) )
100 break;
101
102 if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
103 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
104 break;
105 }
106
107 fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
108
109 tc_status = W_ERROR_V(WERR_OK);
110
111 break;
112
113 case NETLOGON_CONTROL_REDISCOVER:
114 unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain));
115
116 if ( !is_trusted_domain( domain ) )
117 break;
118
119 if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
120 tc_status = W_ERROR_V(WERR_NO_LOGON_SERVERS);
121 break;
122 }
123
124 fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
125
126 tc_status = W_ERROR_V(WERR_OK);
127
128 break;
129
130 default:
131 /* no idea what this should be */
132 DEBUG(0,("_net_logon_ctrl2: unimplemented function level [%d]\n",
133 q_u->function_code));
134 }
135
136 /* prepare the response */
137
138 init_net_r_logon_ctrl2( r_u, q_u->query_level, flags,
139 pdc_connection_status, logon_attempts, tc_status, dc_name );
140
141 if (lp_server_role() == ROLE_DOMAIN_BDC)
142 send_sync_message();
143
144 return r_u->status;
145 }
146
147 /*************************************************************************
148 net_reply_trust_dom_list:
149 *************************************************************************/
150
151 NTSTATUS _net_trust_dom_list(pipes_struct *p, NET_Q_TRUST_DOM_LIST *q_u, NET_R_TRUST_DOM_LIST *r_u)
152 {
153 const char *trusted_domain = "test_domain";
154 uint32 num_trust_domains = 1;
155
156 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__));
157
158 /* set up the Trusted Domain List response */
159 init_r_trust_dom(r_u, num_trust_domains, trusted_domain);
160
161 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__));
162
163 return r_u->status;
164 }
165
166 /***********************************************************************************
167 init_net_r_srv_pwset:
168 ***********************************************************************************/
169
170 static void init_net_r_srv_pwset(NET_R_SRV_PWSET *r_s,
171 DOM_CRED *srv_cred, NTSTATUS status)
172 {
173 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
174
175 memcpy(&r_s->srv_cred, srv_cred, sizeof(r_s->srv_cred));
176 r_s->status = status;
177
178 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
179 }
180
181 /******************************************************************
182 gets a machine password entry. checks access rights of the host.
183 ******************************************************************/
184
185 static NTSTATUS get_md4pw(char *md4pw, char *mach_acct, uint16 sec_chan_type)
186 {
187 struct samu *sampass = NULL;
188 const uint8 *pass;
189 bool ret;
190 uint32 acct_ctrl;
191
192 #if 0
193 char addr[INET6_ADDRSTRLEN];
194
195 /*
196 * Currently this code is redundent as we already have a filter
197 * by hostname list. What this code really needs to do is to
198 * get a hosts allowed/hosts denied list from the SAM database
199 * on a per user basis, and make the access decision there.
200 * I will leave this code here for now as a reminder to implement
201 * this at a later date. JRA.
202 */
203
204 if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
205 client_name(get_client_fd()),
206 client_addr(get_client_fd(),addr,sizeof(addr)))) {
207 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
208 return False;
209 }
210 #endif /* 0 */
211
212 if ( !(sampass = samu_new( NULL )) ) {
213 return NT_STATUS_NO_MEMORY;
214 }
215
216 /* JRA. This is ok as it is only used for generating the challenge. */
217 become_root();
218 ret = pdb_getsampwnam(sampass, mach_acct);
219 unbecome_root();
220
221 if (!ret) {
222 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
223 TALLOC_FREE(sampass);
224 return NT_STATUS_ACCESS_DENIED;
225 }
226
227 acct_ctrl = pdb_get_acct_ctrl(sampass);
228 if (acct_ctrl & ACB_DISABLED) {
229 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
230 TALLOC_FREE(sampass);
231 return NT_STATUS_ACCOUNT_DISABLED;
232 }
233
234 if (!(acct_ctrl & ACB_SVRTRUST) &&
235 !(acct_ctrl & ACB_WSTRUST) &&
236 !(acct_ctrl & ACB_DOMTRUST))
237 {
238 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
239 TALLOC_FREE(sampass);
240 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
241 }
242
243 switch (sec_chan_type) {
244 case SEC_CHAN_BDC:
245 if (!(acct_ctrl & ACB_SVRTRUST)) {
246 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
247 "but not a server trust account\n", mach_acct));
248 TALLOC_FREE(sampass);
249 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
250 }
251 break;
252 case SEC_CHAN_WKSTA:
253 if (!(acct_ctrl & ACB_WSTRUST)) {
254 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
255 "but not a workstation trust account\n", mach_acct));
256 TALLOC_FREE(sampass);
257 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
258 }
259 break;
260 case SEC_CHAN_DOMAIN:
261 if (!(acct_ctrl & ACB_DOMTRUST)) {
262 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
263 "but not a interdomain trust account\n", mach_acct));
264 TALLOC_FREE(sampass);
265 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
266 }
267 break;
268 default:
269 break;
270 }
271
272 if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
273 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
274 TALLOC_FREE(sampass);
275 return NT_STATUS_LOGON_FAILURE;
276 }
277
278 memcpy(md4pw, pass, 16);
279 dump_data(5, (uint8 *)md4pw, 16);
280
281 TALLOC_FREE(sampass);
282
283 return NT_STATUS_OK;
284
285
286 }
287
288 /*************************************************************************
289 _net_req_chal
290 *************************************************************************/
291
292 NTSTATUS _net_req_chal(pipes_struct *p, NET_Q_REQ_CHAL *q_u, NET_R_REQ_CHAL *r_u)
293 {
294 if (!p->dc) {
295 p->dc = TALLOC_ZERO_P(p->pipe_state_mem_ctx, struct dcinfo);
296 if (!p->dc) {
297 return NT_STATUS_NO_MEMORY;
298 }
299 } else {
300 DEBUG(10,("_net_req_chal: new challenge requested. Clearing old state.\n"));
301 ZERO_STRUCTP(p->dc);
302 }
303
304 rpcstr_pull(p->dc->remote_machine,
305 q_u->uni_logon_clnt.buffer,
306 sizeof(fstring),q_u->uni_logon_clnt.uni_str_len*2,0);
307
308 /* Save the client challenge to the server. */
309 memcpy(p->dc->clnt_chal.data, q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data));
310
311 /* Create a server challenge for the client */
312 /* Set this to a random value. */
313 generate_random_buffer(p->dc->srv_chal.data, 8);
314
315 /* set up the LSA REQUEST CHALLENGE response */
316 init_net_r_req_chal(r_u, &p->dc->srv_chal, NT_STATUS_OK);
317
318 p->dc->challenge_sent = True;
319
320 return NT_STATUS_OK;
321 }
322
323 /*************************************************************************
324 init_net_r_auth:
325 *************************************************************************/
326
327 static void init_net_r_auth(NET_R_AUTH *r_a, DOM_CHAL *resp_cred, NTSTATUS status)
328 {
329 memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
330 r_a->status = status;
331 }
332
333 /*************************************************************************
334 _net_auth. Create the initial credentials.
335 *************************************************************************/
336
337 NTSTATUS _net_auth(pipes_struct *p, NET_Q_AUTH *q_u, NET_R_AUTH *r_u)
338 {
339 NTSTATUS status;
340 fstring mach_acct;
341 fstring remote_machine;
342 DOM_CHAL srv_chal_out;
343
344 if (!p->dc || !p->dc->challenge_sent) {
345 return NT_STATUS_ACCESS_DENIED;
346 }
347
348 rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
349 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
350 rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
351 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
352
353 status = get_md4pw((char *)p->dc->mach_pw, mach_acct, q_u->clnt_id.sec_chan);
354 if (!NT_STATUS_IS_OK(status)) {
355 DEBUG(0,("_net_auth: creds_server_check failed. Failed to "
356 "get password for machine account %s "
357 "from client %s: %s\n",
358 mach_acct, remote_machine, nt_errstr(status) ));
359 /* always return NT_STATUS_ACCESS_DENIED */
360 return NT_STATUS_ACCESS_DENIED;
361 }
362
363 /* From the client / server challenges and md4 password, generate sess key */
364 creds_server_init(0, /* No neg flags. */
365 p->dc,
366 &p->dc->clnt_chal, /* Stored client chal. */
367 &p->dc->srv_chal, /* Stored server chal. */
368 p->dc->mach_pw,
369 &srv_chal_out);
370
371 /* Check client credentials are valid. */
372 if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
373 DEBUG(0,("_net_auth: creds_server_check failed. Rejecting auth "
374 "request from client %s machine account %s\n",
375 remote_machine, mach_acct ));
376 return NT_STATUS_ACCESS_DENIED;
377 }
378
379 fstrcpy(p->dc->mach_acct, mach_acct);
380 fstrcpy(p->dc->remote_machine, remote_machine);
381 p->dc->authenticated = True;
382
383 /* set up the LSA AUTH response */
384 /* Return the server credentials. */
385 init_net_r_auth(r_u, &srv_chal_out, NT_STATUS_OK);
386
387 return r_u->status;
388 }
389
390 /*************************************************************************
391 init_net_r_auth_2:
392 *************************************************************************/
393
394 static void init_net_r_auth_2(NET_R_AUTH_2 *r_a,
395 DOM_CHAL *resp_cred, NEG_FLAGS *flgs, NTSTATUS status)
396 {
397 memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
398 memcpy(&r_a->srv_flgs, flgs, sizeof(r_a->srv_flgs));
399 r_a->status = status;
400 }
401
402 /*************************************************************************
403 _net_auth_2
404 *************************************************************************/
405
406 NTSTATUS _net_auth_2(pipes_struct *p, NET_Q_AUTH_2 *q_u, NET_R_AUTH_2 *r_u)
407 {
408 NTSTATUS status;
409 NEG_FLAGS srv_flgs;
410 fstring mach_acct;
411 fstring remote_machine;
412 DOM_CHAL srv_chal_out;
413
414 rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
415 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
416
417 /* We use this as the key to store the creds. */
418 rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
419 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
420
421 if (!p->dc || !p->dc->challenge_sent) {
422 DEBUG(0,("_net_auth2: no challenge sent to client %s\n",
423 remote_machine ));
424 return NT_STATUS_ACCESS_DENIED;
425 }
426
427 if ( (lp_server_schannel() == True) &&
428 ((q_u->clnt_flgs.neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
429
430 /* schannel must be used, but client did not offer it. */
431 DEBUG(0,("_net_auth2: schannel required but client failed "
432 "to offer it. Client was %s\n",
433 mach_acct ));
434 return NT_STATUS_ACCESS_DENIED;
435 }
436
437 status = get_md4pw((char *)p->dc->mach_pw, mach_acct, q_u->clnt_id.sec_chan);
438 if (!NT_STATUS_IS_OK(status)) {
439 DEBUG(0,("_net_auth2: failed to get machine password for "
440 "account %s: %s\n",
441 mach_acct, nt_errstr(status) ));
442 /* always return NT_STATUS_ACCESS_DENIED */
443 return NT_STATUS_ACCESS_DENIED;
444 }
445
446 /* From the client / server challenges and md4 password, generate sess key */
447 creds_server_init(q_u->clnt_flgs.neg_flags,
448 p->dc,
449 &p->dc->clnt_chal, /* Stored client chal. */
450 &p->dc->srv_chal, /* Stored server chal. */
451 p->dc->mach_pw,
452 &srv_chal_out);
453
454 /* Check client credentials are valid. */
455 if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
456 DEBUG(0,("_net_auth2: creds_server_check failed. Rejecting auth "
457 "request from client %s machine account %s\n",
458 remote_machine, mach_acct ));
459 return NT_STATUS_ACCESS_DENIED;
460 }
461
462 srv_flgs.neg_flags = 0x000001ff;
463
464 if (lp_server_schannel() != False) {
465 srv_flgs.neg_flags |= NETLOGON_NEG_SCHANNEL;
466 }
467
468 /* set up the LSA AUTH 2 response */
469 init_net_r_auth_2(r_u, &srv_chal_out, &srv_flgs, NT_STATUS_OK);
470
471 fstrcpy(p->dc->mach_acct, mach_acct);
472 fstrcpy(p->dc->remote_machine, remote_machine);
473 fstrcpy(p->dc->domain, lp_workgroup() );
474
475 p->dc->authenticated = True;
476
477 /* Store off the state so we can continue after client disconnect. */
478 become_root();
479 secrets_store_schannel_session_info(p->mem_ctx,
480 remote_machine,
481 p->dc);
482 unbecome_root();
483
484 return r_u->status;
485 }
486
487 /*************************************************************************
488 _net_srv_pwset
489 *************************************************************************/
490
491 NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *r_u)
492 {
493 fstring remote_machine;
494 struct samu *sampass=NULL;
495 bool ret = False;
496 unsigned char pwd[16];
497 int i;
498 uint32 acct_ctrl;
499 DOM_CRED cred_out;
500 const uchar *old_pw;
501
502 DEBUG(5,("_net_srv_pwset: %d\n", __LINE__));
503
504 /* We need the remote machine name for the creds lookup. */
505 rpcstr_pull(remote_machine,q_u->clnt_id.login.uni_comp_name.buffer,
506 sizeof(remote_machine),q_u->clnt_id.login.uni_comp_name.uni_str_len*2,0);
507
508 if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
509 /* 'server schannel = yes' should enforce use of
510 schannel, the client did offer it in auth2, but
511 obviously did not use it. */
512 DEBUG(0,("_net_srv_pwset: client %s not using schannel for netlogon\n",
513 remote_machine ));
514 return NT_STATUS_ACCESS_DENIED;
515 }
516
517 if (!p->dc) {
518 /* Restore the saved state of the netlogon creds. */
519 become_root();
520 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
521 remote_machine,
522 &p->dc);
523 unbecome_root();
524 if (!ret) {
525 return NT_STATUS_INVALID_HANDLE;
526 }
527 }
528
529 if (!p->dc || !p->dc->authenticated) {
530 return NT_STATUS_INVALID_HANDLE;
531 }
532
533 DEBUG(3,("_net_srv_pwset: Server Password Set by remote machine:[%s] on account [%s]\n",
534 remote_machine, p->dc->mach_acct));
535
536 /* Step the creds chain forward. */
537 if (!creds_server_step(p->dc, &q_u->clnt_id.cred, &cred_out)) {
538 DEBUG(2,("_net_srv_pwset: creds_server_step failed. Rejecting auth "
539 "request from client %s machine account %s\n",
540 remote_machine, p->dc->mach_acct ));
541 return NT_STATUS_INVALID_PARAMETER;
542 }
543
544 /* We must store the creds state after an update. */
545 sampass = samu_new( NULL );
546 if (!sampass) {
547 return NT_STATUS_NO_MEMORY;
548 }
549
550 become_root();
551 secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
552 remote_machine,
553 p->dc);
554 ret = pdb_getsampwnam(sampass, p->dc->mach_acct);
555 unbecome_root();
556
557 if (!ret) {
558 TALLOC_FREE(sampass);
559 return NT_STATUS_ACCESS_DENIED;
560 }
561
562 /* Ensure the account exists and is a machine account. */
563
564 acct_ctrl = pdb_get_acct_ctrl(sampass);
565
566 if (!(acct_ctrl & ACB_WSTRUST ||
567 acct_ctrl & ACB_SVRTRUST ||
568 acct_ctrl & ACB_DOMTRUST)) {
569 TALLOC_FREE(sampass);
570 return NT_STATUS_NO_SUCH_USER;
571 }
572
573 if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
574 TALLOC_FREE(sampass);
575 return NT_STATUS_ACCOUNT_DISABLED;
576 }
577
578 /* Woah - what does this to to the credential chain ? JRA */
579 cred_hash3( pwd, q_u->pwd, p->dc->sess_key, 0);
580
581 DEBUG(100,("Server password set : new given value was :\n"));
582 for(i = 0; i < sizeof(pwd); i++)
583 DEBUG(100,("%02X ", pwd[i]));
584 DEBUG(100,("\n"));
585
586 old_pw = pdb_get_nt_passwd(sampass);
587
588 if (old_pw && memcmp(pwd, old_pw, 16) == 0) {
589 /* Avoid backend modificiations and other fun if the
590 client changed the password to the *same thing* */
591
592 ret = True;
593 } else {
594
595 /* LM password should be NULL for machines */
596 if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
597 TALLOC_FREE(sampass);
598 return NT_STATUS_NO_MEMORY;
599 }
600
601 if (!pdb_set_nt_passwd(sampass, pwd, PDB_CHANGED)) {
602 TALLOC_FREE(sampass);
603 return NT_STATUS_NO_MEMORY;
604 }
605
606 if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
607 TALLOC_FREE(sampass);
608 /* Not quite sure what this one qualifies as, but this will do */
609 return NT_STATUS_UNSUCCESSFUL;
610 }
611
612 become_root();
613 r_u->status = pdb_update_sam_account(sampass);
614 unbecome_root();
615 }
616
617 /* set up the LSA Server Password Set response */
618 init_net_r_srv_pwset(r_u, &cred_out, r_u->status);
619
620 TALLOC_FREE(sampass);
621 return r_u->status;
622 }
623
624 /*************************************************************************
625 _net_sam_logoff:
626 *************************************************************************/
627
628 NTSTATUS _net_sam_logoff(pipes_struct *p, NET_Q_SAM_LOGOFF *q_u, NET_R_SAM_LOGOFF *r_u)
629 {
630 fstring remote_machine;
631
632 if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
633 /* 'server schannel = yes' should enforce use of
634 schannel, the client did offer it in auth2, but
635 obviously did not use it. */
636 DEBUG(0,("_net_sam_logoff: client %s not using schannel for netlogon\n",
637 get_remote_machine_name() ));
638 return NT_STATUS_ACCESS_DENIED;
639 }
640
641
642 if (!get_valid_user_struct(p->vuid))
643 return NT_STATUS_NO_SUCH_USER;
644
645 /* Get the remote machine name for the creds store. */
646 rpcstr_pull(remote_machine,q_u->sam_id.client.login.uni_comp_name.buffer,
647 sizeof(remote_machine),q_u->sam_id.client.login.uni_comp_name.uni_str_len*2,0);
648
649 if (!p->dc) {
650 /* Restore the saved state of the netlogon creds. */
651 bool ret;
652
653 become_root();
654 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
655 remote_machine,
656 &p->dc);
657 unbecome_root();
658 if (!ret) {
659 return NT_STATUS_INVALID_HANDLE;
660 }
661 }
662
663 if (!p->dc || !p->dc->authenticated) {
664 return NT_STATUS_INVALID_HANDLE;
665 }
666
667 r_u->buffer_creds = 1; /* yes, we have valid server credentials */
668
669 /* checks and updates credentials. creates reply credentials */
670 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) {
671 DEBUG(2,("_net_sam_logoff: creds_server_step failed. Rejecting auth "
672 "request from client %s machine account %s\n",
673 remote_machine, p->dc->mach_acct ));
674 return NT_STATUS_INVALID_PARAMETER;
675 }
676
677 /* We must store the creds state after an update. */
678 become_root();
679 secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
680 remote_machine,
681 p->dc);
682 unbecome_root();
683
684 r_u->status = NT_STATUS_OK;
685 return r_u->status;
686 }
687
688 /*******************************************************************
689 gets a domain user's groups from their already-calculated NT_USER_TOKEN
690 ********************************************************************/
691
692 static NTSTATUS nt_token_to_group_list(TALLOC_CTX *mem_ctx,
693 const DOM_SID *domain_sid,
694 size_t num_sids,
695 const DOM_SID *sids,
696 int *numgroups, DOM_GID **pgids)
697 {
698 int i;
699
700 *numgroups=0;
701 *pgids = NULL;
702
703 for (i=0; i<num_sids; i++) {
704 DOM_GID gid;
705 if (!sid_peek_check_rid(domain_sid, &sids[i], &gid.g_rid)) {
706 continue;
707 }
708 gid.attr = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
709 SE_GROUP_ENABLED);
710 ADD_TO_ARRAY(mem_ctx, DOM_GID, gid, pgids, numgroups);
711 if (*pgids == NULL) {
712 return NT_STATUS_NO_MEMORY;
713 }
714 }
715 return NT_STATUS_OK;
716 }
717
718 /*************************************************************************
719 _net_sam_logon
720 *************************************************************************/
721
722 static NTSTATUS _net_sam_logon_internal(pipes_struct *p,
723 NET_Q_SAM_LOGON *q_u,
724 NET_R_SAM_LOGON *r_u,
725 bool process_creds)
726 {
727 NTSTATUS status = NT_STATUS_OK;
728 NET_USER_INFO_3 *usr_info = NULL;
729 NET_ID_INFO_CTR *ctr = q_u->sam_id.ctr;
730 UNISTR2 *uni_samlogon_user = NULL;
731 UNISTR2 *uni_samlogon_domain = NULL;
732 UNISTR2 *uni_samlogon_workstation = NULL;
733 fstring nt_username, nt_domain, nt_workstation;
734 auth_usersupplied_info *user_info = NULL;
735 auth_serversupplied_info *server_info = NULL;
736 struct samu *sampw;
737 struct auth_context *auth_context = NULL;
738
739 if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
740 /* 'server schannel = yes' should enforce use of
741 schannel, the client did offer it in auth2, but
742 obviously did not use it. */
743 DEBUG(0,("_net_sam_logon_internal: client %s not using schannel for netlogon\n",
744 get_remote_machine_name() ));
745 return NT_STATUS_ACCESS_DENIED;
746 }
747
748 usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3);
749 if (!usr_info) {
750 return NT_STATUS_NO_MEMORY;
751 }
752
753 ZERO_STRUCTP(usr_info);
754
755 /* store the user information, if there is any. */
756 r_u->user = usr_info;
757 r_u->auth_resp = 1; /* authoritative response */
758 if (q_u->validation_level != 2 && q_u->validation_level != 3) {
759 DEBUG(0,("_net_sam_logon: bad validation_level value %d.\n", (int)q_u->validation_level ));
760 return NT_STATUS_ACCESS_DENIED;
761 }
762 /* We handle the return of USER_INFO_2 instead of 3 in the parse return. Sucks, I know... */
763 r_u->switch_value = q_u->validation_level; /* indicates type of validation user info */
764 r_u->buffer_creds = 1; /* Ensure we always return server creds. */
765
766 if (!get_valid_user_struct(p->vuid))
767 return NT_STATUS_NO_SUCH_USER;
768
769 if (process_creds) {
770 fstring remote_machine;
771
772 /* Get the remote machine name for the creds store. */
773 /* Note this is the remote machine this request is coming from (member server),
774 not neccessarily the workstation name the user is logging onto.
775 */
776 rpcstr_pull(remote_machine,q_u->sam_id.client.login.uni_comp_name.buffer,
777 sizeof(remote_machine),q_u->sam_id.client.login.uni_comp_name.uni_str_len*2,0);
778
779 if (!p->dc) {
780 /* Restore the saved state of the netlogon creds. */
781 bool ret;
782
783 become_root();
784 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
785 remote_machine,
786 &p->dc);
787 unbecome_root();
788 if (!ret) {
789 return NT_STATUS_INVALID_HANDLE;
790 }
791 }
792
793 if (!p->dc || !p->dc->authenticated) {
794 return NT_STATUS_INVALID_HANDLE;
795 }
796
797 /* checks and updates credentials. creates reply credentials */
798 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) {
799 DEBUG(2,("_net_sam_logon: creds_server_step failed. Rejecting auth "
800 "request from client %s machine account %s\n",
801 remote_machine, p->dc->mach_acct ));
802 return NT_STATUS_INVALID_PARAMETER;
803 }
804
805 /* We must store the creds state after an update. */
806 become_root();
807 secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
808 remote_machine,
809 p->dc);
810 unbecome_root();
811 }
812
813 switch (q_u->sam_id.logon_level) {
814 case INTERACTIVE_LOGON_TYPE:
815 uni_samlogon_user = &ctr->auth.id1.uni_user_name;
816 uni_samlogon_domain = &ctr->auth.id1.uni_domain_name;
817
818 uni_samlogon_workstation = &ctr->auth.id1.uni_wksta_name;
819
820 DEBUG(3,("SAM Logon (Interactive). Domain:[%s]. ", lp_workgroup()));
821 break;
822 case NET_LOGON_TYPE:
823 uni_samlogon_user = &ctr->auth.id2.uni_user_name;
824 uni_samlogon_domain = &ctr->auth.id2.uni_domain_name;
825 uni_samlogon_workstation = &ctr->auth.id2.uni_wksta_name;
826
827 DEBUG(3,("SAM Logon (Network). Domain:[%s]. ", lp_workgroup()));
828 break;
829 default:
830 DEBUG(2,("SAM Logon: unsupported switch value\n"));
831 return NT_STATUS_INVALID_INFO_CLASS;
832 } /* end switch */
833
834 rpcstr_pull(nt_username,uni_samlogon_user->buffer,sizeof(nt_username),uni_samlogon_user->uni_str_len*2,0);
835 rpcstr_pull(nt_domain,uni_samlogon_domain->buffer,sizeof(nt_domain),uni_samlogon_domain->uni_str_len*2,0);
836 rpcstr_pull(nt_workstation,uni_samlogon_workstation->buffer,sizeof(nt_workstation),uni_samlogon_workstation->uni_str_len*2,0);
837
838 DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
839 fstrcpy(current_user_info.smb_name, nt_username);
840 sub_set_smb_name(nt_username);
841
842 DEBUG(5,("Attempting validation level %d for unmapped username %s.\n", q_u->sam_id.ctr->switch_value, nt_username));
843
844 status = NT_STATUS_OK;
845
846 switch (ctr->switch_value) {
847 case NET_LOGON_TYPE:
848 {
849 const char *wksname = nt_workstation;
850
851 if (!NT_STATUS_IS_OK(status = make_auth_context_fixed(&auth_context, ctr->auth.id2.lm_chal))) {
852 return status;
853 }
854
855 /* For a network logon, the workstation name comes in with two
856 * backslashes in the front. Strip them if they are there. */
857
858 if (*wksname == '\\') wksname++;
859 if (*wksname == '\\') wksname++;
860
861 /* Standard challenge/response authenticaion */
862 if (!make_user_info_netlogon_network(&user_info,
863 nt_username, nt_domain,
864 wksname,
865 ctr->auth.id2.param_ctrl,
866 ctr->auth.id2.lm_chal_resp.buffer,
867 ctr->auth.id2.lm_chal_resp.str_str_len,
868 ctr->auth.id2.nt_chal_resp.buffer,
869 ctr->auth.id2.nt_chal_resp.str_str_len)) {
870 status = NT_STATUS_NO_MEMORY;
871 }
872 break;
873 }
874 case INTERACTIVE_LOGON_TYPE:
875 /* 'Interactive' authentication, supplies the password in its
876 MD4 form, encrypted with the session key. We will convert
877 this to challenge/response for the auth subsystem to chew
878 on */
879 {
880 const uint8 *chal;
881
882 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
883 return status;
884 }
885
886 chal = auth_context->get_ntlm_challenge(auth_context);
887
888 if (!make_user_info_netlogon_interactive(&user_info,
889 nt_username, nt_domain,
890 nt_workstation,
891 ctr->auth.id1.param_ctrl,
892 chal,
893 ctr->auth.id1.lm_owf.data,
894 ctr->auth.id1.nt_owf.data,
895 p->dc->sess_key)) {
896 status = NT_STATUS_NO_MEMORY;
897 }
898 break;
899 }
900 default:
901 DEBUG(2,("SAM Logon: unsupported switch value\n"));
902 return NT_STATUS_INVALID_INFO_CLASS;
903 } /* end switch */
904
905 if ( NT_STATUS_IS_OK(status) ) {
906 status = auth_context->check_ntlm_password(auth_context,
907 user_info, &server_info);
908 }
909
910 (auth_context->free)(&auth_context);
911 free_user_info(&user_info);
912
913 DEBUG(5, ("_net_sam_logon: check_password returned status %s\n",
914 nt_errstr(status)));
915
916 /* Check account and password */
917
918 if (!NT_STATUS_IS_OK(status)) {
919 /* If we don't know what this domain is, we need to
920 indicate that we are not authoritative. This
921 allows the client to decide if it needs to try
922 a local user. Fix by jpjanosi@us.ibm.com, #2976 */
923 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
924 && !strequal(nt_domain, get_global_sam_name())
925 && !is_trusted_domain(nt_domain) )
926 r_u->auth_resp = 0; /* We are not authoritative */
927
928 TALLOC_FREE(server_info);
929 return status;
930 }
931
932 if (server_info->guest) {
933 /* We don't like guest domain logons... */
934 DEBUG(5,("_net_sam_logon: Attempted domain logon as GUEST "
935 "denied.\n"));
936 TALLOC_FREE(server_info);
937 return NT_STATUS_LOGON_FAILURE;
938 }
939
940 /* This is the point at which, if the login was successful, that
941 the SAM Local Security Authority should record that the user is
942 logged in to the domain. */
943
944 {
945 DOM_GID *gids = NULL;
946 const DOM_SID *user_sid = NULL;
947 const DOM_SID *group_sid = NULL;
948 DOM_SID domain_sid;
949 uint32 user_rid, group_rid;
950
951 int num_gids = 0;
952 const char *my_name;
953 unsigned char user_session_key[16];
954 unsigned char lm_session_key[16];
955 unsigned char pipe_session_key[16];
956
957 sampw = server_info->sam_account;
958
959 /* set up pointer indicating user/password failed to be
960 * found */
961 usr_info->ptr_user_info = 0;
962
963 user_sid = pdb_get_user_sid(sampw);
964 group_sid = pdb_get_group_sid(sampw);
965
966 if ((user_sid == NULL) || (group_sid == NULL)) {
967 DEBUG(1, ("_net_sam_logon: User without group or user SID\n"));
968 return NT_STATUS_UNSUCCESSFUL;
969 }
970
971 sid_copy(&domain_sid, user_sid);
972 sid_split_rid(&domain_sid, &user_rid);
973
974 if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) {
975 DEBUG(1, ("_net_sam_logon: user %s\\%s has user sid "
976 "%s\n but group sid %s.\n"
977 "The conflicting domain portions are not "
978 "supported for NETLOGON calls\n",
979 pdb_get_domain(sampw),
980 pdb_get_username(sampw),
981 sid_string_dbg(user_sid),
982 sid_string_dbg(group_sid)));
983 return NT_STATUS_UNSUCCESSFUL;
984 }
985
986 if(server_info->login_server) {
987 my_name = server_info->login_server;
988 } else {
989 my_name = global_myname();
990 }
991
992 status = nt_token_to_group_list(p->mem_ctx, &domain_sid,
993 server_info->num_sids,
994 server_info->sids,
995 &num_gids, &gids);
996
997 if (!NT_STATUS_IS_OK(status)) {
998 return status;
999 }
1000
1001 if (server_info->user_session_key.length) {
1002 memcpy(user_session_key,
1003 server_info->user_session_key.data,
1004 MIN(sizeof(user_session_key),
1005 server_info->user_session_key.length));
1006 if (process_creds) {
1007 /* Get the pipe session key from the creds. */
1008 memcpy(pipe_session_key, p->dc->sess_key, 16);
1009 } else {
1010 /* Get the pipe session key from the schannel. */
1011 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1012 return NT_STATUS_INVALID_HANDLE;
1013 }
1014 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1015 }
1016 SamOEMhash(user_session_key, pipe_session_key, 16);
1017 memset(pipe_session_key, '\0', 16);
1018 }
1019 if (server_info->lm_session_key.length) {
1020 memcpy(lm_session_key,
1021 server_info->lm_session_key.data,
1022 MIN(sizeof(lm_session_key),
1023 server_info->lm_session_key.length));
1024 if (process_creds) {
1025 /* Get the pipe session key from the creds. */
1026 memcpy(pipe_session_key, p->dc->sess_key, 16);
1027 } else {
1028 /* Get the pipe session key from the schannel. */
1029 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1030 return NT_STATUS_INVALID_HANDLE;
1031 }
1032 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1033 }
1034 SamOEMhash(lm_session_key, pipe_session_key, 16);
1035 memset(pipe_session_key, '\0', 16);
1036 }
1037
1038 init_net_user_info3(p->mem_ctx, usr_info,
1039 user_rid,
1040 group_rid,
1041 pdb_get_username(sampw),
1042 pdb_get_fullname(sampw),
1043 pdb_get_homedir(sampw),
1044 pdb_get_dir_drive(sampw),
1045 pdb_get_logon_script(sampw),
1046 pdb_get_profile_path(sampw),
1047 pdb_get_logon_time(sampw),
1048 get_time_t_max(),
1049 get_time_t_max(),
1050 pdb_get_pass_last_set_time(sampw),
1051 pdb_get_pass_can_change_time(sampw),
1052 pdb_get_pass_must_change_time(sampw),
1053 0, /* logon_count */
1054 0, /* bad_pw_count */
1055 num_gids, /* uint32 num_groups */
1056 gids , /* DOM_GID *gids */
1057 NETLOGON_EXTRA_SIDS, /* uint32 user_flgs (?) */
1058 pdb_get_acct_ctrl(sampw),
1059 server_info->user_session_key.length ? user_session_key : NULL,
1060 server_info->lm_session_key.length ? lm_session_key : NULL,
1061 my_name , /* char *logon_srv */
1062 pdb_get_domain(sampw),
1063 &domain_sid); /* DOM_SID *dom_sid */
1064 ZERO_STRUCT(user_session_key);
1065 ZERO_STRUCT(lm_session_key);
1066 }
1067 TALLOC_FREE(server_info);
1068 return status;
1069 }
1070
1071 /*************************************************************************
1072 _net_sam_logon
1073 *************************************************************************/
1074
1075 NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *r_u)
1076 {
1077 return _net_sam_logon_internal(p, q_u, r_u, True);
1078 }
1079
1080 /*************************************************************************
1081 _net_sam_logon_ex - no credential chaining. Map into net sam logon.
1082 *************************************************************************/
1083
1084 NTSTATUS _net_sam_logon_ex(pipes_struct *p, NET_Q_SAM_LOGON_EX *q_u, NET_R_SAM_LOGON_EX *r_u)
1085 {
1086 NET_Q_SAM_LOGON q;
1087 NET_R_SAM_LOGON r;
1088
1089 ZERO_STRUCT(q);
1090 ZERO_STRUCT(r);
1091
1092 /* Only allow this if the pipe is protected. */
1093 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1094 DEBUG(0,("_net_sam_logon_ex: client %s not using schannel for netlogon\n",
1095 get_remote_machine_name() ));
1096 return NT_STATUS_INVALID_PARAMETER;
1097 }
1098
1099 /* Map a NET_Q_SAM_LOGON_EX to NET_Q_SAM_LOGON. */
1100 q.validation_level = q_u->validation_level;
1101
1102 /* Map a DOM_SAM_INFO_EX into a DOM_SAM_INFO with no creds. */
1103 q.sam_id.client.login = q_u->sam_id.client;
1104 q.sam_id.logon_level = q_u->sam_id.logon_level;
1105 q.sam_id.ctr = q_u->sam_id.ctr;
1106
1107 r_u->status = _net_sam_logon_internal(p, &q, &r, False);
1108
1109 if (!NT_STATUS_IS_OK(r_u->status)) {
1110 return r_u->status;
1111 }
1112
1113 /* Map the NET_R_SAM_LOGON to NET_R_SAM_LOGON_EX. */
1114 r_u->switch_value = r.switch_value;
1115 r_u->user = r.user;
1116 r_u->auth_resp = r.auth_resp;
1117 r_u->flags = 0; /* FIXME ! */
1118 return r_u->status;
1119 }
1120
1121 /*************************************************************************
1122 _ds_enum_dom_trusts
1123 *************************************************************************/
1124 #if 0 /* JERRY -- not correct */
1125 NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1126 DS_R_ENUM_DOM_TRUSTS *r_u)
1127 {
1128 NTSTATUS status = NT_STATUS_OK;
1129
1130 /* TODO: According to MSDN, the can only be executed against a
1131 DC or domain member running Windows 2000 or later. Need
1132 to test against a standalone 2k server and see what it
1133 does. A windows 2000 DC includes its own domain in the
1134 list. --jerry */
1135
1136 return status;
1137 }
1138 #endif /* JERRY */
1139
1140
1141 /****************************************************************
1142 ****************************************************************/
1143
1144 WERROR _netr_LogonUasLogon(pipes_struct *p,
1145 struct netr_LogonUasLogon *r)
1146 {
1147 p->rng_fault_state = true;
1148 return WERR_NOT_SUPPORTED;
1149 }
1150
1151 /****************************************************************
1152 ****************************************************************/
1153
1154 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1155 struct netr_LogonUasLogoff *r)
1156 {
1157 p->rng_fault_state = true;
1158 return WERR_NOT_SUPPORTED;
1159 }
1160
1161 /****************************************************************
1162 ****************************************************************/
1163
1164 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
1165 struct netr_LogonSamLogon *r)
1166 {
1167 p->rng_fault_state = true;
1168 return NT_STATUS_NOT_IMPLEMENTED;
1169 }
1170
1171 /****************************************************************
1172 ****************************************************************/
1173
1174 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
1175 struct netr_LogonSamLogoff *r)
1176 {
1177 p->rng_fault_state = true;
1178 return NT_STATUS_NOT_IMPLEMENTED;
1179 }
1180
1181 /****************************************************************
1182 ****************************************************************/
1183
1184 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
1185 struct netr_ServerReqChallenge *r)
1186 {
1187 p->rng_fault_state = true;
1188 return NT_STATUS_NOT_IMPLEMENTED;
1189 }
1190
1191 /****************************************************************
1192 ****************************************************************/
1193
1194 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
1195 struct netr_ServerAuthenticate *r)
1196 {
1197 p->rng_fault_state = true;
1198 return NT_STATUS_NOT_IMPLEMENTED;
1199 }
1200
1201 /****************************************************************
1202 ****************************************************************/
1203
1204 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
1205 struct netr_ServerPasswordSet *r)
1206 {
1207 p->rng_fault_state = true;
1208 return NT_STATUS_NOT_IMPLEMENTED;
1209 }
1210
1211 /****************************************************************
1212 ****************************************************************/
1213
1214 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1215 struct netr_DatabaseDeltas *r)
1216 {
1217 p->rng_fault_state = true;
1218 return NT_STATUS_NOT_IMPLEMENTED;
1219 }
1220
1221 /****************************************************************
1222 ****************************************************************/
1223
1224 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1225 struct netr_DatabaseSync *r)
1226 {
1227 p->rng_fault_state = true;
1228 return NT_STATUS_NOT_IMPLEMENTED;
1229 }
1230
1231 /****************************************************************
1232 ****************************************************************/
1233
1234 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1235 struct netr_AccountDeltas *r)
1236 {
1237 p->rng_fault_state = true;
1238 return NT_STATUS_NOT_IMPLEMENTED;
1239 }
1240
1241 /****************************************************************
1242 ****************************************************************/
1243
1244 NTSTATUS _netr_AccountSync(pipes_struct *p,
1245 struct netr_AccountSync *r)
1246 {
1247 p->rng_fault_state = true;
1248 return NT_STATUS_NOT_IMPLEMENTED;
1249 }
1250
1251 /****************************************************************
1252 ****************************************************************/
1253
1254 WERROR _netr_LogonControl(pipes_struct *p,
1255 struct netr_LogonControl *r)
1256 {
1257 p->rng_fault_state = true;
1258 return WERR_NOT_SUPPORTED;
1259 }
1260
1261 /****************************************************************
1262 ****************************************************************/
1263
1264 WERROR _netr_GetDcName(pipes_struct *p,
1265 struct netr_GetDcName *r)
1266 {
1267 p->rng_fault_state = true;
1268 return WERR_NOT_SUPPORTED;
1269 }
1270
1271 /****************************************************************
1272 ****************************************************************/
1273
1274 WERROR _netr_GetAnyDCName(pipes_struct *p,
1275 struct netr_GetAnyDCName *r)
1276 {
1277 p->rng_fault_state = true;
1278 return WERR_NOT_SUPPORTED;
1279 }
1280
1281 /****************************************************************
1282 ****************************************************************/
1283
1284 WERROR _netr_LogonControl2(pipes_struct *p,
1285 struct netr_LogonControl2 *r)
1286 {
1287 p->rng_fault_state = true;
1288 return WERR_NOT_SUPPORTED;
1289 }
1290
1291 /****************************************************************
1292 ****************************************************************/
1293
1294 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
1295 struct netr_ServerAuthenticate2 *r)
1296 {
1297 p->rng_fault_state = true;
1298 return NT_STATUS_NOT_IMPLEMENTED;
1299 }
1300
1301 /****************************************************************
1302 ****************************************************************/
1303
1304 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1305 struct netr_DatabaseSync2 *r)
1306 {
1307 p->rng_fault_state = true;
1308 return NT_STATUS_NOT_IMPLEMENTED;
1309 }
1310
1311 /****************************************************************
1312 ****************************************************************/
1313
1314 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1315 struct netr_DatabaseRedo *r)
1316 {
1317 p->rng_fault_state = true;
1318 return NT_STATUS_NOT_IMPLEMENTED;
1319 }
1320
1321 /****************************************************************
1322 ****************************************************************/
1323
1324 WERROR _netr_LogonControl2Ex(pipes_struct *p,
1325 struct netr_LogonControl2Ex *r)
1326 {
1327 p->rng_fault_state = true;
1328 return WERR_NOT_SUPPORTED;
1329 }
1330
1331 /****************************************************************
1332 ****************************************************************/
1333
1334 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
1335 struct netr_NetrEnumerateTrustedDomains *r)
1336 {
1337 p->rng_fault_state = true;
1338 return WERR_NOT_SUPPORTED;
1339 }
1340
1341 /****************************************************************
1342 ****************************************************************/
1343
1344 WERROR _netr_DsRGetDCName(pipes_struct *p,
1345 struct netr_DsRGetDCName *r)
1346 {
1347 p->rng_fault_state = true;
1348 return WERR_NOT_SUPPORTED;
1349 }
1350
1351 /****************************************************************
1352 ****************************************************************/
1353
1354 WERROR _netr_NETRLOGONDUMMYROUTINE1(pipes_struct *p,
1355 struct netr_NETRLOGONDUMMYROUTINE1 *r)
1356 {
1357 p->rng_fault_state = true;
1358 return WERR_NOT_SUPPORTED;
1359 }
1360
1361 /****************************************************************
1362 ****************************************************************/
1363
1364 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1365 struct netr_NETRLOGONSETSERVICEBITS *r)
1366 {
1367 p->rng_fault_state = true;
1368 return WERR_NOT_SUPPORTED;
1369 }
1370
1371 /****************************************************************
1372 ****************************************************************/
1373
1374 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1375 struct netr_LogonGetTrustRid *r)
1376 {
1377 p->rng_fault_state = true;
1378 return WERR_NOT_SUPPORTED;
1379 }
1380
1381 /****************************************************************
1382 ****************************************************************/
1383
1384 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1385 struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1386 {
1387 p->rng_fault_state = true;
1388 return WERR_NOT_SUPPORTED;
1389 }
1390
1391 /****************************************************************
1392 ****************************************************************/
1393
1394 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1395 struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1396 {
1397 p->rng_fault_state = true;
1398 return WERR_NOT_SUPPORTED;
1399 }
1400
1401 /****************************************************************
1402 ****************************************************************/
1403
1404 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
1405 struct netr_ServerAuthenticate3 *r)
1406 {
1407 p->rng_fault_state = true;
1408 return NT_STATUS_NOT_IMPLEMENTED;
1409 }
1410
1411 /****************************************************************
1412 ****************************************************************/
1413
1414 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1415 struct netr_DsRGetDCNameEx *r)
1416 {
1417 p->rng_fault_state = true;
1418 return WERR_NOT_SUPPORTED;
1419 }
1420
1421 /****************************************************************
1422 ****************************************************************/
1423
1424 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1425 struct netr_DsRGetSiteName *r)
1426 {
1427 p->rng_fault_state = true;
1428 return WERR_NOT_SUPPORTED;
1429 }
1430
1431 /****************************************************************
1432 ****************************************************************/
1433
1434 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1435 struct netr_LogonGetDomainInfo *r)
1436 {
1437 p->rng_fault_state = true;
1438 return NT_STATUS_NOT_IMPLEMENTED;
1439 }
1440
1441 /****************************************************************
1442 ****************************************************************/
1443
1444 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
1445 struct netr_ServerPasswordSet2 *r)
1446 {
1447 p->rng_fault_state = true;
1448 return NT_STATUS_NOT_IMPLEMENTED;
1449 }
1450
1451 /****************************************************************
1452 ****************************************************************/
1453
1454 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1455 struct netr_ServerPasswordGet *r)
1456 {
1457 p->rng_fault_state = true;
1458 return WERR_NOT_SUPPORTED;
1459 }
1460
1461 /****************************************************************
1462 ****************************************************************/
1463
1464 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1465 struct netr_NETRLOGONSENDTOSAM *r)
1466 {
1467 p->rng_fault_state = true;
1468 return WERR_NOT_SUPPORTED;
1469 }
1470
1471 /****************************************************************
1472 ****************************************************************/
1473
1474 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1475 struct netr_DsRAddressToSitenamesW *r)
1476 {
1477 p->rng_fault_state = true;
1478 return WERR_NOT_SUPPORTED;
1479 }
1480
1481 /****************************************************************
1482 ****************************************************************/
1483
1484 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1485 struct netr_DsRGetDCNameEx2 *r)
1486 {
1487 p->rng_fault_state = true;
1488 return WERR_NOT_SUPPORTED;
1489 }
1490
1491 /****************************************************************
1492 ****************************************************************/
1493
1494 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1495 struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1496 {
1497 p->rng_fault_state = true;
1498 return WERR_NOT_SUPPORTED;
1499 }
1500
1501 /****************************************************************
1502 ****************************************************************/
1503
1504 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1505 struct netr_NetrEnumerateTrustedDomainsEx *r)
1506 {
1507 p->rng_fault_state = true;
1508 return WERR_NOT_SUPPORTED;
1509 }
1510
1511 /****************************************************************
1512 ****************************************************************/
1513
1514 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1515 struct netr_DsRAddressToSitenamesExW *r)
1516 {
1517 p->rng_fault_state = true;
1518 return WERR_NOT_SUPPORTED;
1519 }
1520
1521 /****************************************************************
1522 ****************************************************************/
1523
1524 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1525 struct netr_DsrGetDcSiteCoverageW *r)
1526 {
1527 p->rng_fault_state = true;
1528 return WERR_NOT_SUPPORTED;
1529 }
1530
1531 /****************************************************************
1532 ****************************************************************/
1533
1534 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1535 struct netr_LogonSamLogonEx *r)
1536 {
1537 p->rng_fault_state = true;
1538 return NT_STATUS_NOT_IMPLEMENTED;
1539 }
1540
1541 /****************************************************************
1542 ****************************************************************/
1543
1544 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1545 struct netr_DsrEnumerateDomainTrusts *r)
1546 {
1547 p->rng_fault_state = true;
1548 return WERR_NOT_SUPPORTED;
1549 }
1550
1551 /****************************************************************
1552 ****************************************************************/
1553
1554 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1555 struct netr_DsrDeregisterDNSHostRecords *r)
1556 {
1557 p->rng_fault_state = true;
1558 return WERR_NOT_SUPPORTED;
1559 }
1560
1561 /****************************************************************
1562 ****************************************************************/
1563
1564 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1565 struct netr_ServerTrustPasswordsGet *r)
1566 {
1567 p->rng_fault_state = true;
1568 return NT_STATUS_NOT_IMPLEMENTED;
1569 }
1570
1571 /****************************************************************
1572 ****************************************************************/
1573
1574 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1575 struct netr_DsRGetForestTrustInformation *r)
1576 {
1577 p->rng_fault_state = true;
1578 return WERR_NOT_SUPPORTED;
1579 }
1580
1581 /****************************************************************
1582 ****************************************************************/
1583
1584 WERROR _netr_GetForestTrustInformation(pipes_struct *p,
1585 struct netr_GetForestTrustInformation *r)
1586 {
1587 p->rng_fault_state = true;
1588 return WERR_NOT_SUPPORTED;
1589 }
1590
1591 /****************************************************************
1592 ****************************************************************/
1593
1594 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1595 struct netr_LogonSamLogonWithFlags *r)
1596 {
1597 p->rng_fault_state = true;
1598 return NT_STATUS_NOT_IMPLEMENTED;
1599 }
1600
1601 /****************************************************************
1602 ****************************************************************/
1603
1604 WERROR _netr_NETRSERVERGETTRUSTINFO(pipes_struct *p,
1605 struct netr_NETRSERVERGETTRUSTINFO *r)
1606 {
1607 p->rng_fault_state = true;
1608 return WERR_NOT_SUPPORTED;
1609 }
1610
reg import