Adding upstream version 2:4.20.0+dfsg.upstream/2%4.20.0+dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 2937 insertions, 0 deletions

diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
new file mode 100644
index 0000000..fa3e597
--- /dev/null
+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
@@ -0,0 +1,2937 @@
+/*
+ *  Unix SMB/CIFS implementation.
+ *  RPC Pipe client / server routines
+ *  Copyright (C) Andrew Tridgell              1992-1997,
+ *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
+ *  Copyright (C) Paul Ashton                       1997.
+ *  Copyright (C) Jeremy Allison               1998-2001.
+ *  Copyright (C) Andrew Bartlett                   2001.
+ *  Copyright (C) Guenther Deschner		    2008-2009.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* This is the implementation of the netlogon pipe. */
+
+#include "includes.h"
+#include "system/passwd.h" /* uid_wrapper */
+#include "ntdomain.h"
+#include "../libcli/auth/schannel.h"
+#include "librpc/rpc/dcesrv_core.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
+#include "librpc/gen_ndr/ndr_netlogon_scompat.h"
+#include "librpc/gen_ndr/ndr_samr_c.h"
+#include "librpc/gen_ndr/ndr_lsa_c.h"
+#include "rpc_client/cli_lsarpc.h"
+#include "rpc_client/init_lsa.h"
+#include "rpc_client/init_samr.h"
+#include "rpc_server/rpc_ncacn_np.h"
+#include "../libcli/security/security.h"
+#include "../libcli/security/dom_sid.h"
+#include "librpc/gen_ndr/ndr_drsblobs.h"
+#include "lib/crypto/md4.h"
+#include "nsswitch/libwbclient/wbclient.h"
+#include "../libcli/registry/util_reg.h"
+#include "passdb.h"
+#include "auth.h"
+#include "messages.h"
+#include "../lib/tsocket/tsocket.h"
+#include "lib/param/param.h"
+#include "libsmb/dsgetdcname.h"
+#include "lib/util/util_str_escape.h"
+#include "source3/lib/substitute.h"
+#include "librpc/rpc/server/netlogon/schannel_util.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_SRV
+
+/*************************************************************************
+ _netr_LogonControl
+ *************************************************************************/
+
+WERROR _netr_LogonControl(struct pipes_struct *p,
+			  struct netr_LogonControl *r)
+{
+	struct netr_LogonControl2Ex l;
+
+	switch (r->in.level) {
+	case 1:
+		break;
+	case 2:
+		return WERR_NOT_SUPPORTED;
+	default:
+		return WERR_INVALID_LEVEL;
+	}
+
+	switch (r->in.function_code) {
+	case NETLOGON_CONTROL_QUERY:
+	case NETLOGON_CONTROL_REPLICATE:
+	case NETLOGON_CONTROL_SYNCHRONIZE:
+	case NETLOGON_CONTROL_PDC_REPLICATE:
+	case NETLOGON_CONTROL_BREAKPOINT:
+	case NETLOGON_CONTROL_BACKUP_CHANGE_LOG:
+	case NETLOGON_CONTROL_TRUNCATE_LOG:
+		break;
+	default:
+		return WERR_NOT_SUPPORTED;
+	}
+
+	l.in.logon_server	= r->in.logon_server;
+	l.in.function_code	= r->in.function_code;
+	l.in.level		= r->in.level;
+	l.in.data		= NULL;
+	l.out.query		= r->out.query;
+
+	return _netr_LogonControl2Ex(p, &l);
+}
+
+/*************************************************************************
+ _netr_LogonControl2
+ *************************************************************************/
+
+WERROR _netr_LogonControl2(struct pipes_struct *p,
+			   struct netr_LogonControl2 *r)
+{
+	struct netr_LogonControl2Ex l;
+
+	l.in.logon_server	= r->in.logon_server;
+	l.in.function_code	= r->in.function_code;
+	l.in.level		= r->in.level;
+	l.in.data		= r->in.data;
+	l.out.query		= r->out.query;
+
+	return _netr_LogonControl2Ex(p, &l);
+}
+
+/*************************************************************************
+ *************************************************************************/
+
+static bool wb_change_trust_creds(const char *domain, WERROR *tc_status)
+{
+	wbcErr result;
+	struct wbcAuthErrorInfo *error = NULL;
+
+	result = wbcChangeTrustCredentials(domain, &error);
+	switch (result) {
+	case WBC_ERR_WINBIND_NOT_AVAILABLE:
+		return false;
+	case WBC_ERR_DOMAIN_NOT_FOUND:
+		*tc_status = WERR_NO_SUCH_DOMAIN;
+		return true;
+	case WBC_ERR_SUCCESS:
+		*tc_status = WERR_OK;
+		return true;
+	default:
+		break;
+	}
+
+	if (error && error->nt_status != 0) {
+		*tc_status = ntstatus_to_werror(NT_STATUS(error->nt_status));
+	} else {
+		*tc_status = WERR_TRUST_FAILURE;
+	}
+	wbcFreeMemory(error);
+	return true;
+}
+
+/*************************************************************************
+ *************************************************************************/
+
+static bool wb_check_trust_creds(const char *domain, WERROR *tc_status)
+{
+	wbcErr result;
+	struct wbcAuthErrorInfo *error = NULL;
+
+	result = wbcCheckTrustCredentials(domain, &error);
+	switch (result) {
+	case WBC_ERR_WINBIND_NOT_AVAILABLE:
+		return false;
+	case WBC_ERR_DOMAIN_NOT_FOUND:
+		*tc_status = WERR_NO_SUCH_DOMAIN;
+		return true;
+	case WBC_ERR_SUCCESS:
+		*tc_status = WERR_OK;
+		return true;
+	default:
+		break;
+	}
+
+	if (error && error->nt_status != 0) {
+		*tc_status = ntstatus_to_werror(NT_STATUS(error->nt_status));
+	} else {
+		*tc_status = WERR_TRUST_FAILURE;
+	}
+	wbcFreeMemory(error);
+	return true;
+}
+
+/****************************************************************
+ _netr_LogonControl2Ex
+****************************************************************/
+
+WERROR _netr_LogonControl2Ex(struct pipes_struct *p,
+			     struct netr_LogonControl2Ex *r)
+{
+	struct dcesrv_call_state *dce_call = p->dce_call;
+	struct auth_session_info *session_info =
+		dcesrv_call_session_info(dce_call);
+	uint32_t flags = 0x0;
+	WERROR pdc_connection_status = WERR_OK;
+	uint32_t logon_attempts = 0x0;
+	WERROR tc_status;
+	fstring dc_name2;
+	const char *dc_name = NULL;
+	struct sockaddr_storage dc_ss;
+	const char *domain = NULL;
+	struct netr_NETLOGON_INFO_1 *info1;
+	struct netr_NETLOGON_INFO_2 *info2;
+	struct netr_NETLOGON_INFO_3 *info3;
+	struct netr_NETLOGON_INFO_4 *info4;
+	const char *fn;
+	NTSTATUS status;
+	struct netr_DsRGetDCNameInfo *dc_info;
+
+	switch (dce_call->pkt.u.request.opnum) {
+	case NDR_NETR_LOGONCONTROL:
+		fn = "_netr_LogonControl";
+		break;
+	case NDR_NETR_LOGONCONTROL2:
+		fn = "_netr_LogonControl2";
+		break;
+	case NDR_NETR_LOGONCONTROL2EX:
+		fn = "_netr_LogonControl2Ex";
+		break;
+	default:
+		return WERR_INVALID_PARAMETER;
+	}
+
+	switch (r->in.level) {
+	case 1:
+	case 2:
+	case 3:
+	case 4:
+		break;
+	default:
+		return WERR_INVALID_LEVEL;
+	}
+
+	switch (r->in.function_code) {
+	case NETLOGON_CONTROL_QUERY:
+		break;
+	default:
+		if ((geteuid() != sec_initial_uid()) &&
+		    !nt_token_check_domain_rid(
+			    session_info->security_token, DOMAIN_RID_ADMINS) &&
+		    !nt_token_check_sid(
+			    &global_sid_Builtin_Administrators,
+			    session_info->security_token))
+		{
+			return WERR_ACCESS_DENIED;
+		}
+		break;
+	}
+
+	tc_status = WERR_NO_SUCH_DOMAIN;
+
+	switch (r->in.function_code) {
+	case NETLOGON_CONTROL_QUERY:
+		switch (r->in.level) {
+		case 1:
+		case 3:
+			break;
+		default:
+			return WERR_INVALID_PARAMETER;
+		}
+
+		tc_status = WERR_OK;
+		break;
+	case NETLOGON_CONTROL_REPLICATE:
+	case NETLOGON_CONTROL_SYNCHRONIZE:
+	case NETLOGON_CONTROL_PDC_REPLICATE:
+	case NETLOGON_CONTROL_BACKUP_CHANGE_LOG:
+	case NETLOGON_CONTROL_BREAKPOINT:
+	case NETLOGON_CONTROL_TRUNCATE_LOG:
+	case NETLOGON_CONTROL_TRANSPORT_NOTIFY:
+	case NETLOGON_CONTROL_FORCE_DNS_REG:
+	case NETLOGON_CONTROL_QUERY_DNS_REG:
+		return WERR_NOT_SUPPORTED;
+
+	case NETLOGON_CONTROL_FIND_USER:
+		if (!r->in.data || !r->in.data->user) {
+			return WERR_NOT_SUPPORTED;
+		}
+		break;
+	case NETLOGON_CONTROL_SET_DBFLAG:
+		if (!r->in.data) {
+			return WERR_NOT_SUPPORTED;
+		}
+		break;
+	case NETLOGON_CONTROL_TC_VERIFY:
+		if (!r->in.data || !r->in.data->domain) {
+			return WERR_NOT_SUPPORTED;
+		}
+
+		if (!wb_check_trust_creds(r->in.data->domain, &tc_status)) {
+			return WERR_NOT_SUPPORTED;
+		}
+		break;
+	case NETLOGON_CONTROL_TC_QUERY:
+		if (!r->in.data || !r->in.data->domain) {
+			return WERR_NOT_SUPPORTED;
+		}
+
+		domain = r->in.data->domain;
+
+		if (!is_trusted_domain(domain)) {
+			break;
+		}
+
+		if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
+			tc_status = WERR_NO_LOGON_SERVERS;
+			break;
+		}
+
+		dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
+		if (!dc_name) {
+			return WERR_NOT_ENOUGH_MEMORY;
+		}
+
+		tc_status = WERR_OK;
+
+		break;
+
+	case NETLOGON_CONTROL_REDISCOVER:
+		if (!r->in.data || !r->in.data->domain) {
+			return WERR_NOT_SUPPORTED;
+		}
+
+		domain = r->in.data->domain;
+
+		if (!is_trusted_domain(domain)) {
+			break;
+		}
+
+		status = dsgetdcname(p->mem_ctx, p->msg_ctx, domain, NULL, NULL,
+				     DS_FORCE_REDISCOVERY | DS_RETURN_FLAT_NAME,
+				     &dc_info);
+		if (!NT_STATUS_IS_OK(status)) {
+			tc_status = WERR_NO_LOGON_SERVERS;
+			break;
+		}
+
+		dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_info->dc_unc);
+		if (!dc_name) {
+			return WERR_NOT_ENOUGH_MEMORY;
+		}
+
+		tc_status = WERR_OK;
+
+		break;
+
+	case NETLOGON_CONTROL_CHANGE_PASSWORD:
+		if (!r->in.data || !r->in.data->domain) {
+			return WERR_NOT_SUPPORTED;
+		}
+
+		if (!wb_change_trust_creds(r->in.data->domain, &tc_status)) {
+			return WERR_NOT_SUPPORTED;
+		}
+		break;
+
+	default:
+		/* no idea what this should be */
+		DEBUG(0,("%s: unimplemented function level [%d]\n",
+			fn, r->in.function_code));
+		return WERR_NOT_SUPPORTED;
+	}
+
+	/* prepare the response */
+
+	switch (r->in.level) {
+	case 1:
+		info1 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_1);
+		W_ERROR_HAVE_NO_MEMORY(info1);
+
+		info1->flags			= flags;
+		info1->pdc_connection_status	= pdc_connection_status;
+
+		r->out.query->info1 = info1;
+		break;
+	case 2:
+		info2 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_2);
+		W_ERROR_HAVE_NO_MEMORY(info2);
+
+		info2->flags			= flags;
+		info2->pdc_connection_status	= pdc_connection_status;
+		info2->trusted_dc_name		= dc_name;
+		info2->tc_connection_status	= tc_status;
+
+		r->out.query->info2 = info2;
+		break;
+	case 3:
+		info3 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_3);
+		W_ERROR_HAVE_NO_MEMORY(info3);
+
+		info3->flags			= flags;
+		info3->logon_attempts		= logon_attempts;
+
+		r->out.query->info3 = info3;
+		break;
+	case 4:
+		info4 = talloc_zero(p->mem_ctx, struct netr_NETLOGON_INFO_4);
+		W_ERROR_HAVE_NO_MEMORY(info4);
+
+		info4->trusted_dc_name		= dc_name;
+		info4->trusted_domain_name	= r->in.data->domain;
+
+		r->out.query->info4 = info4;
+		break;
+	default:
+		return WERR_INVALID_LEVEL;
+	}
+
+	return WERR_OK;
+}
+
+/*************************************************************************
+ _netr_NetrEnumerateTrustedDomains
+ *************************************************************************/
+
+NTSTATUS _netr_NetrEnumerateTrustedDomains(struct pipes_struct *p,
+					   struct netr_NetrEnumerateTrustedDomains *r)
+{
+	struct dcesrv_call_state *dce_call = p->dce_call;
+	struct dcesrv_connection *dcesrv_conn = dce_call->conn;
+	const struct tsocket_address *local_address =
+		dcesrv_connection_get_local_address(dcesrv_conn);
+	const struct tsocket_address *remote_address =
+		dcesrv_connection_get_remote_address(dcesrv_conn);
+	struct auth_session_info *session_info =
+		dcesrv_call_session_info(dce_call);
+	NTSTATUS status;
+	NTSTATUS result = NT_STATUS_OK;
+	DATA_BLOB blob;
+	size_t num_domains = 0;
+	const char **trusted_domains = NULL;
+	struct lsa_DomainList domain_list;
+	struct dcerpc_binding_handle *h = NULL;
+	struct policy_handle pol;
+	uint32_t enum_ctx = 0;
+	uint32_t max_size = (uint32_t)-1;
+	union lsa_revision_info out_revision_info = {
+		.info1 = {
+			.revision = 0,
+		},
+	};
+	uint32_t out_version = 0;
+
+	ZERO_STRUCT(pol);
+	DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
+
+	status = rpcint_binding_handle(p->mem_ctx,
+				       &ndr_table_lsarpc,
+				       remote_address,
+				       local_address,
+				       session_info,
+				       p->msg_ctx,
+				       &h);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	status = dcerpc_lsa_open_policy_fallback(
+		h,
+		p->mem_ctx,
+		NULL,
+		true,
+		LSA_POLICY_VIEW_LOCAL_INFORMATION,
+		&out_version,
+		&out_revision_info,
+		&pol,
+		&result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	do {
+		uint32_t i;
+
+		/* Lookup list of trusted domains */
+		status = dcerpc_lsa_EnumTrustDom(h,
+						 p->mem_ctx,
+						 &pol,
+						 &enum_ctx,
+						 &domain_list,
+						 max_size,
+						 &result);
+		if (!NT_STATUS_IS_OK(status)) {
+			goto out;
+		}
+		if (!NT_STATUS_IS_OK(result) &&
+		    !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
+		    !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
+			status = result;
+			goto out;
+		}
+
+		for (i = 0; i < domain_list.count; i++) {
+			if (!add_string_to_array(p->mem_ctx, domain_list.domains[i].name.string,
+						 &trusted_domains, &num_domains)) {
+				status = NT_STATUS_NO_MEMORY;
+				goto out;
+			}
+		}
+	} while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
+
+	if (num_domains > 0) {
+		/* multi sz terminate */
+		trusted_domains = talloc_realloc(p->mem_ctx, trusted_domains, const char *, num_domains + 1);
+		if (trusted_domains == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto out;
+		}
+
+		trusted_domains[num_domains] = NULL;
+	}
+
+	if (!push_reg_multi_sz(trusted_domains, &blob, trusted_domains)) {
+		TALLOC_FREE(trusted_domains);
+		status = NT_STATUS_NO_MEMORY;
+		goto out;
+	}
+
+	r->out.trusted_domains_blob->data = blob.data;
+	r->out.trusted_domains_blob->length = blob.length;
+
+	DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
+
+	status = NT_STATUS_OK;
+
+ out:
+	if (is_valid_policy_hnd(&pol)) {
+		dcerpc_lsa_Close(h, p->mem_ctx, &pol, &result);
+	}
+
+	return status;
+}
+
+/*************************************************************************
+ *************************************************************************/
+
+static NTSTATUS samr_find_machine_account(TALLOC_CTX *mem_ctx,
+					  struct dcerpc_binding_handle *b,
+					  const char *account_name,
+					  uint32_t access_mask,
+					  struct dom_sid2 **domain_sid_p,
+					  uint32_t *user_rid_p,
+					  struct policy_handle *user_handle)
+{
+	NTSTATUS status;
+	NTSTATUS result = NT_STATUS_OK;
+	struct policy_handle connect_handle;
+	struct policy_handle domain_handle = { 0, };
+	struct lsa_String domain_name;
+	struct dom_sid2 *domain_sid;
+	struct lsa_String names;
+	struct samr_Ids rids;
+	struct samr_Ids types;
+	uint32_t rid;
+
+	status = dcerpc_samr_Connect2(b, mem_ctx,
+				      lp_netbios_name(),
+				      SAMR_ACCESS_CONNECT_TO_SERVER |
+				      SAMR_ACCESS_ENUM_DOMAINS |
+				      SAMR_ACCESS_LOOKUP_DOMAIN,
+				      &connect_handle,
+				      &result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	init_lsa_String(&domain_name, get_global_sam_name());
+
+	status = dcerpc_samr_LookupDomain(b, mem_ctx,
+					  &connect_handle,
+					  &domain_name,
+					  &domain_sid,
+					  &result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	status = dcerpc_samr_OpenDomain(b, mem_ctx,
+					&connect_handle,
+					SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
+					domain_sid,
+					&domain_handle,
+					&result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	init_lsa_String(&names, account_name);
+
+	status = dcerpc_samr_LookupNames(b, mem_ctx,
+					 &domain_handle,
+					 1,
+					 &names,
+					 &rids,
+					 &types,
+					 &result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	if (rids.count != 1) {
+		status = NT_STATUS_NO_SUCH_USER;
+		goto out;
+	}
+	if (types.count != 1) {
+		status = NT_STATUS_INVALID_PARAMETER;
+		goto out;
+	}
+	if (types.ids[0] != SID_NAME_USER) {
+		status = NT_STATUS_NO_SUCH_USER;
+		goto out;
+	}
+
+	rid = rids.ids[0];
+
+	status = dcerpc_samr_OpenUser(b, mem_ctx,
+				      &domain_handle,
+				      access_mask,
+				      rid,
+				      user_handle,
+				      &result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	if (user_rid_p) {
+		*user_rid_p = rid;
+	}
+
+	if (domain_sid_p) {
+		*domain_sid_p = domain_sid;
+	}
+
+ out:
+	if (is_valid_policy_hnd(&domain_handle)) {
+		dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
+	}
+	if (is_valid_policy_hnd(&connect_handle)) {
+		dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
+	}
+
+	return status;
+}
+
+/******************************************************************
+ gets a machine password entry.  checks access rights of the host.
+ ******************************************************************/
+
+static NTSTATUS get_md4pw(struct samr_Password *md4pw, const char *mach_acct,
+			  enum netr_SchannelType sec_chan_type,
+			  struct dom_sid *sid,
+			  struct messaging_context *msg_ctx)
+{
+	NTSTATUS status;
+	NTSTATUS result = NT_STATUS_OK;
+	TALLOC_CTX *mem_ctx = NULL;
+	struct dcerpc_binding_handle *h = NULL;
+	struct tsocket_address *local = NULL;
+	struct policy_handle user_handle = { .handle_type = 0 };
+	uint32_t user_rid = UINT32_MAX;
+	struct dom_sid *domain_sid = NULL;
+	uint32_t acct_ctrl = 0;
+	union samr_UserInfo *info = NULL;
+	struct auth_session_info *session_info = NULL;
+	int rc;
+
+#if 0
+
+    /*
+     * Currently this code is redundant as we already have a filter
+     * by hostname list. What this code really needs to do is to
+     * get a hosts allowed/hosts denied list from the SAM database
+     * on a per user basis, and make the access decision there.
+     * I will leave this code here for now as a reminder to implement
+     * this at a later date. JRA.
+     */
+
+	if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
+			  p->client_id.name,
+			  p->client_id.addr)) {
+		DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
+		return False;
+	}
+#endif /* 0 */
+
+	mem_ctx = talloc_stackframe();
+
+	status = make_session_info_system(mem_ctx, &session_info);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto out;
+	}
+
+	ZERO_STRUCT(user_handle);
+
+	rc = tsocket_address_inet_from_strings(mem_ctx,
+					       "ip",
+					       "127.0.0.1",
+					       0,
+					       &local);
+	if (rc < 0) {
+		status = NT_STATUS_NO_MEMORY;
+		goto out;
+	}
+
+	status = rpcint_binding_handle(mem_ctx,
+				       &ndr_table_samr,
+				       local,
+				       NULL,
+				       session_info,
+				       msg_ctx,
+				       &h);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto out;
+	}
+
+	status = samr_find_machine_account(mem_ctx, h, mach_acct,
+					   SEC_FLAG_MAXIMUM_ALLOWED,
+					   &domain_sid, &user_rid,
+					   &user_handle);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto out;
+	}
+
+	status = dcerpc_samr_QueryUserInfo2(h,
+					    mem_ctx,
+					    &user_handle,
+					    UserControlInformation,
+					    &info,
+					    &result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	acct_ctrl = info->info16.acct_flags;
+
+	if (acct_ctrl & ACB_DISABLED) {
+		DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
+		status = NT_STATUS_ACCOUNT_DISABLED;
+		goto out;
+	}
+
+	if (!(acct_ctrl & ACB_SVRTRUST) &&
+	    !(acct_ctrl & ACB_WSTRUST) &&
+	    !(acct_ctrl & ACB_DOMTRUST))
+	{
+		DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
+		status = NT_STATUS_NO_TRUST_SAM_ACCOUNT;
+		goto out;
+	}
+
+	switch (sec_chan_type) {
+		case SEC_CHAN_BDC:
+			if (!(acct_ctrl & ACB_SVRTRUST)) {
+				DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
+					 "but not a server trust account\n", mach_acct));
+				status = NT_STATUS_NO_TRUST_SAM_ACCOUNT;
+				goto out;
+			}
+			break;
+		case SEC_CHAN_WKSTA:
+			if (!(acct_ctrl & ACB_WSTRUST)) {
+				DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
+					 "but not a workstation trust account\n", mach_acct));
+				status = NT_STATUS_NO_TRUST_SAM_ACCOUNT;
+				goto out;
+			}
+			break;
+		case SEC_CHAN_DOMAIN:
+			if (!(acct_ctrl & ACB_DOMTRUST)) {
+				DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
+					 "but not a interdomain trust account\n", mach_acct));
+				status = NT_STATUS_NO_TRUST_SAM_ACCOUNT;
+				goto out;
+			}
+			break;
+		default:
+			break;
+	}
+
+	become_root();
+	status = dcerpc_samr_QueryUserInfo2(h,
+					    mem_ctx,
+					    &user_handle,
+					    UserInternal1Information,
+					    &info,
+					    &result);
+	unbecome_root();
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	if (info->info18.nt_pwd_active == 0) {
+		DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
+		status = NT_STATUS_LOGON_FAILURE;
+		goto out;
+	}
+
+	/* samr gives out nthash unencrypted (!) */
+	memcpy(md4pw->hash, info->info18.nt_pwd.hash, 16);
+
+	sid_compose(sid, domain_sid, user_rid);
+
+ out:
+	if (h && is_valid_policy_hnd(&user_handle)) {
+		dcerpc_samr_Close(h, mem_ctx, &user_handle, &result);
+	}
+
+	talloc_free(mem_ctx);
+
+	return status;
+}
+
+/*************************************************************************
+ _netr_ServerReqChallenge
+ *************************************************************************/
+
+NTSTATUS _netr_ServerReqChallenge(struct pipes_struct *p,
+				  struct netr_ServerReqChallenge *r)
+{
+	struct dcesrv_call_state *dce_call = p->dce_call;
+	struct netlogon_server_pipe_state *pipe_state = NULL;
+	NTSTATUS status;
+
+	pipe_state = dcesrv_iface_state_find_conn(
+		dce_call,
+		NETLOGON_SERVER_PIPE_STATE_MAGIC,
+		struct netlogon_server_pipe_state);
+
+	if (pipe_state) {
+		DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
+		talloc_free(pipe_state);
+	}
+
+	pipe_state = talloc(p->mem_ctx, struct netlogon_server_pipe_state);
+	NT_STATUS_HAVE_NO_MEMORY(pipe_state);
+
+	pipe_state->client_challenge = *r->in.credentials;
+
+	netlogon_creds_random_challenge(&pipe_state->server_challenge);
+
+	*r->out.return_credentials = pipe_state->server_challenge;
+
+	status = dcesrv_iface_state_store_conn(
+		dce_call,
+		NETLOGON_SERVER_PIPE_STATE_MAGIC,
+		pipe_state);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	return NT_STATUS_OK;
+}
+
+/*************************************************************************
+ _netr_ServerAuthenticate
+ Create the initial credentials.
+ *************************************************************************/
+
+NTSTATUS _netr_ServerAuthenticate(struct pipes_struct *p,
+				  struct netr_ServerAuthenticate *r)
+{
+	struct netr_ServerAuthenticate3 a;
+	uint32_t negotiate_flags = 0;
+	uint32_t rid;
+
+	a.in.server_name		= r->in.server_name;
+	a.in.account_name		= r->in.account_name;
+	a.in.secure_channel_type	= r->in.secure_channel_type;
+	a.in.computer_name		= r->in.computer_name;
+	a.in.credentials		= r->in.credentials;
+	a.in.negotiate_flags		= &negotiate_flags;
+
+	a.out.return_credentials	= r->out.return_credentials;
+	a.out.rid			= &rid;
+	a.out.negotiate_flags		= &negotiate_flags;
+
+	return _netr_ServerAuthenticate3(p, &a);
+
+}
+
+/*************************************************************************
+ _netr_ServerAuthenticate3
+ *************************************************************************/
+
+NTSTATUS _netr_ServerAuthenticate3(struct pipes_struct *p,
+				   struct netr_ServerAuthenticate3 *r)
+{
+	struct dcesrv_call_state *dce_call = p->dce_call;
+	NTSTATUS status;
+	uint32_t srv_flgs;
+	/* r->in.negotiate_flags is an aliased pointer to r->out.negotiate_flags,
+	 * so use a copy to avoid destroying the client values. */
+	uint32_t in_neg_flags = *r->in.negotiate_flags;
+	const char *fn;
+	struct loadparm_context *lp_ctx = p->dce_call->conn->dce_ctx->lp_ctx;
+	struct dom_sid sid;
+	struct samr_Password mach_pwd;
+	struct netlogon_creds_CredentialState *creds;
+	struct netlogon_server_pipe_state *pipe_state = NULL;
+
+	/* According to Microsoft (see bugid #6099)
+	 * Windows 7 looks at the negotiate_flags
+	 * returned in this structure *even if the
+	 * call fails with access denied* ! So in order
+	 * to allow Win7 to connect to a Samba NT style
+	 * PDC we set the flags before we know if it's
+	 * an error or not.
+	 */
+
+	/* 0x000001ff */
+	srv_flgs = NETLOGON_NEG_ACCOUNT_LOCKOUT |
+		   NETLOGON_NEG_PERSISTENT_SAMREPL |
+		   NETLOGON_NEG_ARCFOUR |
+		   NETLOGON_NEG_PROMOTION_COUNT |
+		   NETLOGON_NEG_CHANGELOG_BDC |
+		   NETLOGON_NEG_FULL_SYNC_REPL |
+		   NETLOGON_NEG_MULTIPLE_SIDS |
+		   NETLOGON_NEG_REDO |
+		   NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL |
+		   NETLOGON_NEG_PASSWORD_SET2;
+
+	/* Ensure we support strong (128-bit) keys. */
+	if (in_neg_flags & NETLOGON_NEG_STRONG_KEYS) {
+		srv_flgs |= NETLOGON_NEG_STRONG_KEYS;
+	}
+
+	if (in_neg_flags & NETLOGON_NEG_SUPPORTS_AES) {
+		srv_flgs |= NETLOGON_NEG_SUPPORTS_AES;
+	}
+
+	if (in_neg_flags & NETLOGON_NEG_SCHANNEL) {
+		srv_flgs |= NETLOGON_NEG_SCHANNEL;
+	}
+
+	/*
+	 * Support authentication of trusted domains.
+	 *
+	 * These flags are the minimum required set which works with win2k3
+	 * and win2k8.
+	 */
+	if (pdb_capabilities() & PDB_CAP_TRUSTED_DOMAINS_EX) {
+		srv_flgs |= NETLOGON_NEG_TRANSITIVE_TRUSTS |
+			    NETLOGON_NEG_DNS_DOMAIN_TRUSTS |
+			    NETLOGON_NEG_CROSS_FOREST_TRUSTS |
+			    NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION;
+	}
+
+	/*
+	 * If weak crypto is disabled, do not announce that we support RC4.
+	 */
+	if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED) {
+		srv_flgs &= ~NETLOGON_NEG_ARCFOUR;
+	}
+
+	switch (dce_call->pkt.u.request.opnum) {
+		case NDR_NETR_SERVERAUTHENTICATE:
+			fn = "_netr_ServerAuthenticate";
+			break;
+		case NDR_NETR_SERVERAUTHENTICATE2:
+			fn = "_netr_ServerAuthenticate2";
+			break;
+		case NDR_NETR_SERVERAUTHENTICATE3:
+			fn = "_netr_ServerAuthenticate3";
+			break;
+		default:
+			return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	/* We use this as the key to store the creds: */
+	/* r->in.computer_name */
+
+	pipe_state = dcesrv_iface_state_find_conn(
+		dce_call,
+		NETLOGON_SERVER_PIPE_STATE_MAGIC,
+		struct netlogon_server_pipe_state);
+
+	if (!pipe_state) {
+		DEBUG(0,("%s: no challenge sent to client %s\n", fn,
+			r->in.computer_name));
+		status = NT_STATUS_ACCESS_DENIED;
+		goto out;
+	}
+
+	status = get_md4pw(&mach_pwd,
+			   r->in.account_name,
+			   r->in.secure_channel_type,
+			   &sid, p->msg_ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0,("%s: failed to get machine password for "
+			"account %s: %s\n",
+			fn, r->in.account_name, nt_errstr(status) ));
+		/* always return NT_STATUS_ACCESS_DENIED */
+		status = NT_STATUS_ACCESS_DENIED;
+		goto out;
+	}
+
+	/* From the client / server challenges and md4 password, generate sess key */
+	/* Check client credentials are valid. */
+	creds = netlogon_creds_server_init(p->mem_ctx,
+					   r->in.account_name,
+					   r->in.computer_name,
+					   r->in.secure_channel_type,
+					   &pipe_state->client_challenge,
+					   &pipe_state->server_challenge,
+					   &mach_pwd,
+					   r->in.credentials,
+					   r->out.return_credentials,
+					   srv_flgs);
+	if (!creds) {
+		DEBUG(0,("%s: netlogon_creds_server_check failed. Rejecting auth "
+			"request from client %s machine account %s\n",
+			fn, r->in.computer_name,
+			r->in.account_name));
+		status = NT_STATUS_ACCESS_DENIED;
+		goto out;
+	}
+
+	creds->sid = dom_sid_dup(creds, &sid);
+	if (!creds->sid) {
+		status = NT_STATUS_NO_MEMORY;
+		goto out;
+	}
+
+	/* Store off the state so we can continue after client disconnect. */
+	become_root();
+	status = schannel_save_creds_state(p->mem_ctx, lp_ctx, creds);
+	unbecome_root();
+
+	if (!NT_STATUS_IS_OK(status)) {
+		ZERO_STRUCTP(r->out.return_credentials);
+		goto out;
+	}
+
+	sid_peek_rid(&sid, r->out.rid);
+
+	status = NT_STATUS_OK;
+
+  out:
+
+	*r->out.negotiate_flags = srv_flgs;
+	return status;
+}
+
+/*************************************************************************
+ _netr_ServerAuthenticate2
+ *************************************************************************/
+
+NTSTATUS _netr_ServerAuthenticate2(struct pipes_struct *p,
+				   struct netr_ServerAuthenticate2 *r)
+{
+	struct netr_ServerAuthenticate3 a;
+	uint32_t rid;
+
+	a.in.server_name		= r->in.server_name;
+	a.in.account_name		= r->in.account_name;
+	a.in.secure_channel_type	= r->in.secure_channel_type;
+	a.in.computer_name		= r->in.computer_name;
+	a.in.credentials		= r->in.credentials;
+	a.in.negotiate_flags		= r->in.negotiate_flags;
+
+	a.out.return_credentials	= r->out.return_credentials;
+	a.out.rid			= &rid;
+	a.out.negotiate_flags		= r->out.negotiate_flags;
+
+	return _netr_ServerAuthenticate3(p, &a);
+}
+
+/*************************************************************************
+ *************************************************************************/
+
+static NTSTATUS samr_open_machine_account(
+	struct dcerpc_binding_handle *b,
+	const struct dom_sid *machine_sid,
+	uint32_t access_mask,
+	struct policy_handle *machine_handle)
+{
+	TALLOC_CTX *frame = talloc_stackframe();
+	struct policy_handle connect_handle = { .handle_type = 0 };
+	struct policy_handle domain_handle = { .handle_type = 0 };
+	struct dom_sid domain_sid = *machine_sid;
+	uint32_t machine_rid;
+	NTSTATUS result = NT_STATUS_OK;
+	NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
+	bool ok;
+
+	ok = sid_split_rid(&domain_sid, &machine_rid);
+	if (!ok) {
+		goto out;
+	}
+
+	status = dcerpc_samr_Connect2(
+		b,
+		frame,
+		lp_netbios_name(),
+		SAMR_ACCESS_CONNECT_TO_SERVER |
+		SAMR_ACCESS_ENUM_DOMAINS |
+		SAMR_ACCESS_LOOKUP_DOMAIN,
+		&connect_handle,
+		&result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	status = dcerpc_samr_OpenDomain(
+		b,
+		frame,
+		&connect_handle,
+		SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
+		&domain_sid,
+		&domain_handle,
+		&result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	status = dcerpc_samr_OpenUser(
+		b,
+		frame,
+		&domain_handle,
+		SEC_FLAG_MAXIMUM_ALLOWED,
+		machine_rid,
+		machine_handle,
+		&result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+out:
+	if ((b != NULL) && is_valid_policy_hnd(&domain_handle)) {
+		dcerpc_samr_Close(b, frame, &domain_handle, &result);
+	}
+	if ((b != NULL) && is_valid_policy_hnd(&connect_handle)) {
+		dcerpc_samr_Close(b, frame, &connect_handle, &result);
+	}
+	TALLOC_FREE(frame);
+	return status;
+}
+
+struct _samr_Credentials_t {
+	enum {
+		CRED_TYPE_NT_HASH,
+		CRED_TYPE_PLAIN_TEXT,
+	} cred_type;
+	union {
+		struct samr_Password *nt_hash;
+		const char *password;
+	} creds;
+};
+
+
+static NTSTATUS netr_set_machine_account_password(
+	TALLOC_CTX *mem_ctx,
+	struct auth_session_info *session_info,
+	struct messaging_context *msg_ctx,
+	const struct dom_sid *machine_sid,
+	struct _samr_Credentials_t *cr)
+{
+	NTSTATUS status;
+	NTSTATUS result = NT_STATUS_OK;
+	struct dcerpc_binding_handle *h = NULL;
+	struct tsocket_address *local;
+	struct policy_handle user_handle = { .handle_type = 0 };
+	uint32_t acct_ctrl;
+	union samr_UserInfo *info;
+	struct samr_UserInfo18 info18;
+	struct samr_UserInfo26 info26;
+	DATA_BLOB in,out;
+	int rc;
+	DATA_BLOB session_key;
+	enum samr_UserInfoLevel infolevel;
+	TALLOC_CTX *frame = talloc_stackframe();
+
+	status = session_extract_session_key(session_info,
+					     &session_key,
+					     KEY_USE_16BYTES);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto out;
+	}
+
+	rc = tsocket_address_inet_from_strings(frame,
+					       "ip",
+					       "127.0.0.1",
+					       0,
+					       &local);
+	if (rc < 0) {
+		status = NT_STATUS_NO_MEMORY;
+		goto out;
+	}
+
+	status = rpcint_binding_handle(frame,
+				       &ndr_table_samr,
+				       local,
+				       NULL,
+				       get_session_info_system(),
+				       msg_ctx,
+				       &h);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto out;
+	}
+
+	status = samr_open_machine_account(
+		h, machine_sid, SEC_FLAG_MAXIMUM_ALLOWED, &user_handle);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto out;
+	}
+
+	status = dcerpc_samr_QueryUserInfo2(h,
+					    frame,
+					    &user_handle,
+					    UserControlInformation,
+					    &info,
+					    &result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+	acct_ctrl = info->info16.acct_flags;
+
+	if (!(acct_ctrl & ACB_WSTRUST ||
+	      acct_ctrl & ACB_SVRTRUST ||
+	      acct_ctrl & ACB_DOMTRUST)) {
+		status = NT_STATUS_NO_SUCH_USER;
+		goto out;
+	}
+
+	if (acct_ctrl & ACB_DISABLED) {
+		status = NT_STATUS_ACCOUNT_DISABLED;
+		goto out;
+	}
+
+	switch(cr->cred_type) {
+		case CRED_TYPE_NT_HASH:
+			ZERO_STRUCT(info18);
+
+			infolevel = UserInternal1Information;
+
+			in = data_blob_const(cr->creds.nt_hash, 16);
+			out = data_blob_talloc_zero(frame, 16);
+			if (out.data == NULL) {
+				status = NT_STATUS_NO_MEMORY;
+				goto out;
+			}
+			rc = sess_crypt_blob(&out, &in, &session_key, SAMBA_GNUTLS_ENCRYPT);
+			if (rc != 0) {
+				status = gnutls_error_to_ntstatus(rc,
+								  NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
+				goto out;
+			}
+			memcpy(info18.nt_pwd.hash, out.data, out.length);
+
+			info18.nt_pwd_active = true;
+
+			info->info18 = info18;
+		break;
+		case CRED_TYPE_PLAIN_TEXT:
+			ZERO_STRUCT(info26);
+
+			infolevel = UserInternal5InformationNew;
+
+			status = init_samr_CryptPasswordEx(cr->creds.password,
+							   &session_key,
+							   &info26.password);
+			if (!NT_STATUS_IS_OK(status)) {
+				goto out;
+			}
+
+			info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
+			info->info26 = info26;
+		break;
+		default:
+			status = NT_STATUS_INTERNAL_ERROR;
+			goto out;
+		break;
+	}
+
+	status = dcerpc_samr_SetUserInfo2(h,
+					  frame,
+					  &user_handle,
+					  infolevel,
+					  info,
+					  &result);
+	if (any_nt_status_not_ok(status, result, &status)) {
+		goto out;
+	}
+
+ out:
+	if (h && is_valid_policy_hnd(&user_handle)) {
+		dcerpc_samr_Close(h, frame, &user_handle, &result);
+	}
+	TALLOC_FREE(frame);
+
+	return status;
+}
+
+/*************************************************************************
+ _netr_ServerPasswordSet
+ *************************************************************************/
+
+NTSTATUS _netr_ServerPasswordSet(struct pipes_struct *p,
+				 struct netr_ServerPasswordSet *r)
+{
+	struct dcesrv_call_state *dce_call = p->dce_call;
+	struct auth_session_info *session_info =
+		dcesrv_call_session_info(dce_call);
+	NTSTATUS status = NT_STATUS_OK;
+	size_t i;
+	struct netlogon_creds_CredentialState *creds = NULL;
+	struct _samr_Credentials_t cr = { CRED_TYPE_NT_HASH, {0}};
+
+	DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
+
+	become_root();
+	status = dcesrv_netr_creds_server_step_check(p->dce_call,
+						p->mem_ctx,
+						r->in.computer_name,
+						r->in.credential,
+						r->out.return_authenticator,
+						&creds);
+	unbecome_root();
+
+	if (!NT_STATUS_IS_OK(status)) {
+		const char *computer_name = "<unknown>";
+
+		if (creds != NULL && creds->computer_name != NULL) {
+			computer_name = creds->computer_name;
+		}
+		DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
+			"request from client %s machine account %s\n",
+			r->in.computer_name, computer_name));
+		TALLOC_FREE(creds);
+		return status;
+	}
+
+	DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
+			r->in.computer_name, creds->computer_name));
+
+	status = netlogon_creds_des_decrypt(creds, r->in.new_password);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
+	for(i = 0; i < sizeof(r->in.new_password->hash); i++)
+		DEBUG(100,("%02X ", r->in.new_password->hash[i]));
+	DEBUG(100,("\n"));
+
+	cr.creds.nt_hash = r->in.new_password;
+	status = netr_set_machine_account_password(p->mem_ctx,
+						   session_info,
+						   p->msg_ctx,
+						   creds->sid,
+						   &cr);
+	return status;
+}
+
+/****************************************************************
+ _netr_ServerPasswordSet2
+****************************************************************/
+
+NTSTATUS _netr_ServerPasswordSet2(struct pipes_struct *p,
+				  struct netr_ServerPasswordSet2 *r)
+{
+	struct dcesrv_call_state *dce_call = p->dce_call;
+	struct auth_session_info *session_info =
+		dcesrv_call_session_info(dce_call);
+	NTSTATUS status;
+	struct netlogon_creds_CredentialState *creds = NULL;
+	DATA_BLOB plaintext = data_blob_null;
+	DATA_BLOB new_password = data_blob_null;
+	size_t confounder_len;
+	DATA_BLOB dec_blob = data_blob_null;
+	DATA_BLOB enc_blob = data_blob_null;
+	struct samr_CryptPassword password_buf;
+	struct _samr_Credentials_t cr = { CRED_TYPE_PLAIN_TEXT, {0}};
+	bool ok;
+
+	become_root();
+	status = dcesrv_netr_creds_server_step_check(p->dce_call,
+						p->mem_ctx,
+						r->in.computer_name,
+						r->in.credential,
+						r->out.return_authenticator,
+						&creds);
+	unbecome_root();
+
+	if (!NT_STATUS_IS_OK(status)) {
+		DBG_NOTICE("netlogon_creds_server_step failed. "
+			   "Rejecting auth request from client %s\n",
+			   r->in.computer_name);
+		TALLOC_FREE(creds);
+		return status;
+	}
+
+	DBG_NOTICE("Server Password Set2 by remote "
+		   "machine:[%s] on account [%s]\n",
+		   r->in.computer_name,
+		   creds->computer_name != NULL ?
+			creds->computer_name : "<unknown>");
+
+	memcpy(password_buf.data, r->in.new_password->data, 512);
+	SIVAL(password_buf.data, 512, r->in.new_password->length);
+
+	if (creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+		status = netlogon_creds_aes_decrypt(creds,
+						    password_buf.data,
+						    516);
+	} else {
+		status = netlogon_creds_arcfour_crypt(creds,
+						      password_buf.data,
+						      516);
+	}
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(creds);
+		return status;
+	}
+
+	if (!extract_pw_from_buffer(p->mem_ctx, password_buf.data, &new_password)) {
+		DEBUG(2,("_netr_ServerPasswordSet2: unable to extract password "
+			 "from a buffer. Rejecting auth request as a wrong password\n"));
+		TALLOC_FREE(creds);
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
+	/*
+	 * Make sure the length field was encrypted,
+	 * otherwise we are under attack.
+	 */
+	if (new_password.length == r->in.new_password->length) {
+		DBG_WARNING("Length[%zu] field not encrypted\n",
+			new_password.length);
+		TALLOC_FREE(creds);
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
+	/*
+	 * We don't allow empty passwords for machine accounts.
+	 */
+	if (new_password.length < 2) {
+		DBG_WARNING("Empty password Length[%zu]\n",
+			new_password.length);
+		TALLOC_FREE(creds);
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
+	/*
+	 * Make sure the confounder part of CryptPassword
+	 * buffer was encrypted, otherwise we are under attack.
+	 */
+	confounder_len = 512 - new_password.length;
+	enc_blob = data_blob_const(r->in.new_password->data, confounder_len);
+	dec_blob = data_blob_const(password_buf.data, confounder_len);
+	if (confounder_len > 0 && data_blob_equal_const_time(&dec_blob, &enc_blob)) {
+		DBG_WARNING("Confounder buffer not encrypted Length[%zu]\n",
+			    confounder_len);
+		TALLOC_FREE(creds);
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
+	/*
+	 * Check that the password part was actually encrypted,
+	 * otherwise we are under attack.
+	 */
+	enc_blob = data_blob_const(r->in.new_password->data + confounder_len,
+				   new_password.length);
+	dec_blob = data_blob_const(password_buf.data + confounder_len,
+				   new_password.length);
+	if (data_blob_equal_const_time(&dec_blob, &enc_blob)) {
+		DBG_WARNING("Password buffer not encrypted Length[%zu]\n",
+			    new_password.length);
+		TALLOC_FREE(creds);
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
+	/*
+	 * don't allow zero buffers
+	 */
+	if (all_zero(new_password.data, new_password.length)) {
+		DBG_WARNING("Password zero buffer Length[%zu]\n",
+			    new_password.length);
+		TALLOC_FREE(creds);
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
+	/* Convert from UTF16 -> plaintext. */
+	ok = convert_string_talloc(p->mem_ctx,
+				CH_UTF16,
+				CH_UNIX,
+				new_password.data,
+				new_password.length,
+				&plaintext.data,
+				&plaintext.length);
+	if (!ok) {
+		DBG_WARNING("unable to extract password from a buffer. "
+			    "Rejecting auth request as a wrong password\n");
+		TALLOC_FREE(creds);
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
+	/*
+	 * We don't allow empty passwords for machine accounts.
+	 */
+
+	cr.creds.password = (const char*) plaintext.data;
+	if (strlen(cr.creds.password) == 0) {
+		DBG_WARNING("Empty plaintext password\n");
+		TALLOC_FREE(creds);
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
+	status = netr_set_machine_account_password(p->mem_ctx,
+						   session_info,
+						   p->msg_ctx,
+						   creds->sid,
+						   &cr);
+	TALLOC_FREE(creds);
+	return status;
+}
+
+/*************************************************************************
+ _netr_LogonSamLogoff
+ *************************************************************************/
+
+NTSTATUS _netr_LogonSamLogoff(struct pipes_struct *p,
+			      struct netr_LogonSamLogoff *r)
+{
+	NTSTATUS status;
+	struct netlogon_creds_CredentialState *creds;
+
+	become_root();
+	status = dcesrv_netr_creds_server_step_check(p->dce_call,
+						p->mem_ctx,
+						r->in.computer_name,
+						r->in.credential,
+						r->out.return_authenticator,
+						&creds);
+	unbecome_root();
+
+	return status;
+}
+
+static NTSTATUS _netr_LogonSamLogon_check(const struct netr_LogonSamLogonEx *r)
+{
+	switch (r->in.logon_level) {
+	case NetlogonInteractiveInformation:
+	case NetlogonServiceInformation:
+	case NetlogonInteractiveTransitiveInformation:
+	case NetlogonServiceTransitiveInformation:
+		if (r->in.logon->password == NULL) {
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+
+		switch (r->in.validation_level) {
+		case NetlogonValidationSamInfo:  /* 2 */
+		case NetlogonValidationSamInfo2: /* 3 */
+			break;
+		case NetlogonValidationSamInfo4: /* 6 */
+			if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
+				DEBUG(10,("Not adding validation info level 6 "
+				   "without ADS passdb backend\n"));
+				return NT_STATUS_INVALID_INFO_CLASS;
+			}
+			break;
+		default:
+			return NT_STATUS_INVALID_INFO_CLASS;
+		}
+
+		break;
+	case NetlogonNetworkInformation:
+	case NetlogonNetworkTransitiveInformation:
+		if (r->in.logon->network == NULL) {
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+
+		switch (r->in.validation_level) {
+		case NetlogonValidationSamInfo:  /* 2 */
+		case NetlogonValidationSamInfo2: /* 3 */
+			break;
+		case NetlogonValidationSamInfo4: /* 6 */
+			if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
+				DEBUG(10,("Not adding validation info level 6 "
+				   "without ADS passdb backend\n"));
+				return NT_STATUS_INVALID_INFO_CLASS;
+			}
+			break;
+		default:
+			return NT_STATUS_INVALID_INFO_CLASS;
+		}
+
+		break;
+
+	case NetlogonGenericInformation:
+		if (r->in.logon->generic == NULL) {
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+
+		/* we don't support this here */
+		return NT_STATUS_INVALID_PARAMETER;
+#if 0
+		switch (r->in.validation_level) {
+		/* TODO: case NetlogonValidationGenericInfo: 4 */
+		case NetlogonValidationGenericInfo2: /* 5 */
+			break;
+		default:
+			return NT_STATUS_INVALID_INFO_CLASS;
+		}
+
+		break;
+#endif
+	default:
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	return NT_STATUS_OK;
+}
+
+/*************************************************************************
+ _netr_LogonSamLogon_base
+ *************************************************************************/
+
+static NTSTATUS _netr_LogonSamLogon_base(struct pipes_struct *p,
+					 struct netr_LogonSamLogonEx *r,
+					 struct netlogon_creds_CredentialState *creds)
+{
+	struct dcesrv_call_state *dce_call = p->dce_call;
+	struct dcesrv_connection *dcesrv_conn = dce_call->conn;
+	const struct tsocket_address *local_address =
+		dcesrv_connection_get_local_address(dcesrv_conn);
+	const struct tsocket_address *remote_address =
+		dcesrv_connection_get_remote_address(dcesrv_conn);
+	NTSTATUS status = NT_STATUS_OK;
+	union netr_LogonLevel *logon = r->in.logon;
+	const char *nt_username, *nt_domain, *nt_workstation;
+	char *sanitized_username = NULL;
+	struct auth_usersupplied_info *user_info = NULL;
+	struct auth_serversupplied_info *server_info = NULL;
+	struct auth_context *auth_context = NULL;
+	const char *fn;
+	enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NONE;
+	enum dcerpc_AuthLevel auth_level = DCERPC_AUTH_LEVEL_NONE;
+	uint16_t opnum = dce_call->pkt.u.request.opnum;
+
+	dcesrv_call_auth_info(dce_call, &auth_type, &auth_level);
+
+#ifdef DEBUG_PASSWORD
+	logon = netlogon_creds_shallow_copy_logon(p->mem_ctx,
+						  r->in.logon_level,
+						  r->in.logon);
+	if (logon == NULL) {
+		logon = r->in.logon;
+	}
+#endif
+
+	switch (opnum) {
+		case NDR_NETR_LOGONSAMLOGON:
+			fn = "_netr_LogonSamLogon";
+			/*
+			 * Already called netr_check_schannel() via
+			 * netr_creds_server_step_check()
+			 */
+			break;
+		case NDR_NETR_LOGONSAMLOGONWITHFLAGS:
+			fn = "_netr_LogonSamLogonWithFlags";
+			/*
+			 * Already called netr_check_schannel() via
+			 * netr_creds_server_step_check()
+			 */
+			break;
+		case NDR_NETR_LOGONSAMLOGONEX:
+			fn = "_netr_LogonSamLogonEx";
+
+			if (auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
+				return NT_STATUS_ACCESS_DENIED;
+			}
+
+			status = dcesrv_netr_check_schannel(p->dce_call,
+							    creds,
+							    auth_type,
+							    auth_level,
+							    opnum);
+			if (NT_STATUS_IS_ERR(status)) {
+				return status;
+			}
+
+			break;
+		default:
+			return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	*r->out.authoritative = 1; /* authoritative response */
+
+	switch (r->in.validation_level) {
+	case 2:
+		r->out.validation->sam2 = talloc_zero(p->mem_ctx, struct netr_SamInfo2);
+		if (!r->out.validation->sam2) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		break;
+	case 3:
+		r->out.validation->sam3 = talloc_zero(p->mem_ctx, struct netr_SamInfo3);
+		if (!r->out.validation->sam3) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		break;
+	case 6:
+		r->out.validation->sam6 = talloc_zero(p->mem_ctx, struct netr_SamInfo6);
+		if (!r->out.validation->sam6) {
+			return NT_STATUS_NO_MEMORY;
+		}
+		break;
+	default:
+		DEBUG(0,("%s: bad validation_level value %d.\n",
+			fn, (int)r->in.validation_level));
+		return NT_STATUS_INVALID_INFO_CLASS;
+	}
+
+	switch (r->in.logon_level) {
+	case NetlogonInteractiveInformation:
+	case NetlogonServiceInformation:
+	case NetlogonInteractiveTransitiveInformation:
+	case NetlogonServiceTransitiveInformation:
+		nt_username	= logon->password->identity_info.account_name.string ?
+				  logon->password->identity_info.account_name.string : "";
+		nt_domain	= logon->password->identity_info.domain_name.string ?
+				  logon->password->identity_info.domain_name.string : "";
+		nt_workstation	= logon->password->identity_info.workstation.string ?
+				  logon->password->identity_info.workstation.string : "";
+
+		DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
+		break;
+	case NetlogonNetworkInformation:
+	case NetlogonNetworkTransitiveInformation:
+		nt_username	= logon->network->identity_info.account_name.string ?
+				  logon->network->identity_info.account_name.string : "";
+		nt_domain	= logon->network->identity_info.domain_name.string ?
+				  logon->network->identity_info.domain_name.string : "";
+		nt_workstation	= logon->network->identity_info.workstation.string ?
+				  logon->network->identity_info.workstation.string : "";
+
+		DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
+		break;
+	default:
+		DEBUG(2,("SAM Logon: unsupported switch value\n"));
+		return NT_STATUS_INVALID_INFO_CLASS;
+	} /* end switch */
+
+	DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
+
+	DEBUG(5,("Attempting validation level %d for unmapped username %s.\n",
+		r->in.validation_level, nt_username));
+
+	status = netlogon_creds_decrypt_samlogon_logon(creds,
+						       r->in.logon_level,
+						       logon);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	status = make_auth3_context_for_netlogon(talloc_tos(), &auth_context);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	switch (r->in.logon_level) {
+	case NetlogonNetworkInformation:
+	case NetlogonNetworkTransitiveInformation:
+	{
+		const char *wksname = nt_workstation;
+		const char *workgroup = lp_workgroup();
+		bool ok;
+
+		ok = auth3_context_set_challenge(
+			auth_context, logon->network->challenge, "fixed");
+		if (!ok) {
+			return NT_STATUS_NO_MEMORY;
+		}
+
+		/* For a network logon, the workstation name comes in with two
+		 * backslashes in the front. Strip them if they are there. */
+
+		if (*wksname == '\\') wksname++;
+		if (*wksname == '\\') wksname++;
+
+		/* Standard challenge/response authentication */
+		if (!make_user_info_netlogon_network(talloc_tos(),
+						     &user_info,
+						     nt_username, nt_domain,
+						     wksname,
+						     remote_address,
+						     local_address,
+						     logon->network->identity_info.parameter_control,
+						     logon->network->lm.data,
+						     logon->network->lm.length,
+						     logon->network->nt.data,
+						     logon->network->nt.length)) {
+			status = NT_STATUS_NO_MEMORY;
+		}
+
+		if (NT_STATUS_IS_OK(status)) {
+			status = NTLMv2_RESPONSE_verify_netlogon_creds(
+						user_info->client.account_name,
+						user_info->client.domain_name,
+						user_info->password.response.nt,
+						creds, workgroup);
+		}
+		break;
+	}
+	case NetlogonInteractiveInformation:
+	case NetlogonServiceInformation:
+	case NetlogonInteractiveTransitiveInformation:
+	case NetlogonServiceTransitiveInformation:
+
+		/* 'Interactive' authentication, supplies the password in its
+		   MD4 form, encrypted with the session key.  We will convert
+		   this to challenge/response for the auth subsystem to chew
+		   on */
+	{
+		uint8_t chal[8];
+
+#ifdef DEBUG_PASSWORD
+		if (logon != r->in.logon) {
+			DEBUG(100,("lm owf password:"));
+			dump_data(100,
+				  r->in.logon->password->lmpassword.hash, 16);
+
+			DEBUG(100,("nt owf password:"));
+			dump_data(100,
+				  r->in.logon->password->ntpassword.hash, 16);
+		}
+
+		DEBUG(100,("decrypt of lm owf password:"));
+		dump_data(100, logon->password->lmpassword.hash, 16);
+
+		DEBUG(100,("decrypt of nt owf password:"));
+		dump_data(100, logon->password->ntpassword.hash, 16);
+#endif
+
+		auth_get_ntlm_challenge(auth_context, chal);
+
+		if (!make_user_info_netlogon_interactive(talloc_tos(),
+							 &user_info,
+							 nt_username, nt_domain,
+							 nt_workstation,
+							 remote_address,
+							 local_address,
+							 logon->password->identity_info.parameter_control,
+							 chal,
+							 logon->password->lmpassword.hash,
+							 logon->password->ntpassword.hash)) {
+			status = NT_STATUS_NO_MEMORY;
+		}
+		break;
+	}
+	default:
+		DEBUG(2,("SAM Logon: unsupported switch value\n"));
+		return NT_STATUS_INVALID_INFO_CLASS;
+	} /* end switch */
+
+	if ( NT_STATUS_IS_OK(status) ) {
+		status = auth_check_ntlm_password(p->mem_ctx,
+						  auth_context,
+						  user_info,
+						  &server_info,
+						  r->out.authoritative);
+	}
+
+	TALLOC_FREE(auth_context);
+	TALLOC_FREE(user_info);
+
+	DEBUG(5,("%s: check_password returned status %s\n",
+		  fn, nt_errstr(status)));
+
+	/* Check account and password */
+
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(server_info);
+		return status;
+	}
+
+	if (server_info->guest) {
+		/* We don't like guest domain logons... */
+		DEBUG(5,("%s: Attempted domain logon as GUEST "
+			 "denied.\n", fn));
+		TALLOC_FREE(server_info);
+		return NT_STATUS_LOGON_FAILURE;
+	}
+
+	sanitized_username = talloc_alpha_strcpy(talloc_tos(),
+						 nt_username,
+						 SAFE_NETBIOS_CHARS "$");
+	if (sanitized_username == NULL) {
+		TALLOC_FREE(server_info);
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	set_current_user_info(sanitized_username,
+			      server_info->unix_name,
+			      server_info->info3->base.logon_domain.string);
+	TALLOC_FREE(sanitized_username);
+
+	/* This is the point at which, if the login was successful, that
+           the SAM Local Security Authority should record that the user is
+           logged in to the domain.  */
+
+	switch (r->in.validation_level) {
+	case 2:
+		status = serverinfo_to_SamInfo2(server_info,
+						r->out.validation->sam2);
+		break;
+	case 3:
+		status = serverinfo_to_SamInfo3(server_info,
+						r->out.validation->sam3);
+		break;
+	case 6: {
+		/* Only allow this if the pipe is protected. */
+		if (auth_level < DCERPC_AUTH_LEVEL_PRIVACY) {
+			DEBUG(0,("netr_Validation6: client %s not using privacy for netlogon\n",
+				get_remote_machine_name()));
+			status = NT_STATUS_INVALID_PARAMETER;
+			break;
+		}
+
+		status = serverinfo_to_SamInfo6(server_info,
+						r->out.validation->sam6);
+		break;
+	}
+	}
+
+	TALLOC_FREE(server_info);
+
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	status = netlogon_creds_encrypt_samlogon_validation(creds,
+							    r->in.validation_level,
+							    r->out.validation);
+
+	return status;
+}
+
+/****************************************************************
+ _netr_LogonSamLogonWithFlags
+****************************************************************/
+
+NTSTATUS _netr_LogonSamLogonWithFlags(struct pipes_struct *p,
+				      struct netr_LogonSamLogonWithFlags *r)
+{
+	NTSTATUS status;
+	struct netlogon_creds_CredentialState *creds;
+	struct netr_LogonSamLogonEx r2;
+	struct netr_Authenticator return_authenticator;
+
+	*r->out.authoritative = true;
+
+	r2.in.server_name	= r->in.server_name;
+	r2.in.computer_name	= r->in.computer_name;
+	r2.in.logon_level	= r->in.logon_level;
+	r2.in.logon		= r->in.logon;
+	r2.in.validation_level	= r->in.validation_level;
+	r2.in.flags		= r->in.flags;
+	r2.out.validation	= r->out.validation;
+	r2.out.authoritative	= r->out.authoritative;
+	r2.out.flags		= r->out.flags;
+
+	status = _netr_LogonSamLogon_check(&r2);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	become_root();
+	status = dcesrv_netr_creds_server_step_check(p->dce_call,
+						p->mem_ctx,
+						r->in.computer_name,
+						r->in.credential,
+						&return_authenticator,
+						&creds);
+	unbecome_root();
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	status = _netr_LogonSamLogon_base(p, &r2, creds);
+
+	*r->out.return_authenticator = return_authenticator;
+
+	return status;
+}
+
+/*************************************************************************
+ _netr_LogonSamLogon
+ *************************************************************************/
+
+NTSTATUS _netr_LogonSamLogon(struct pipes_struct *p,
+			     struct netr_LogonSamLogon *r)
+{
+	NTSTATUS status;
+	struct netr_LogonSamLogonWithFlags r2;
+	uint32_t flags = 0;
+
+	r2.in.server_name		= r->in.server_name;
+	r2.in.computer_name		= r->in.computer_name;
+	r2.in.credential		= r->in.credential;
+	r2.in.logon_level		= r->in.logon_level;
+	r2.in.logon			= r->in.logon;
+	r2.in.validation_level		= r->in.validation_level;
+	r2.in.return_authenticator	= r->in.return_authenticator;
+	r2.in.flags			= &flags;
+	r2.out.validation		= r->out.validation;
+	r2.out.authoritative		= r->out.authoritative;
+	r2.out.flags			= &flags;
+	r2.out.return_authenticator	= r->out.return_authenticator;
+
+	status = _netr_LogonSamLogonWithFlags(p, &r2);
+
+	return status;
+}
+
+/*************************************************************************
+ _netr_LogonSamLogonEx
+ - no credential chaining. Map into net sam logon.
+ *************************************************************************/
+
+NTSTATUS _netr_LogonSamLogonEx(struct pipes_struct *p,
+			       struct netr_LogonSamLogonEx *r)
+{
+	NTSTATUS status;
+	struct netlogon_creds_CredentialState *creds = NULL;
+	struct loadparm_context *lp_ctx = p->dce_call->conn->dce_ctx->lp_ctx;
+
+	*r->out.authoritative = true;
+
+	status = _netr_LogonSamLogon_check(r);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	become_root();
+	status = schannel_get_creds_state(p->mem_ctx, lp_ctx,
+					  r->in.computer_name, &creds);
+	unbecome_root();
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	status = _netr_LogonSamLogon_base(p, r, creds);
+	TALLOC_FREE(creds);
+
+	return status;
+}
+
+/*************************************************************************
+ _ds_enum_dom_trusts
+ *************************************************************************/
+#if 0	/* JERRY -- not correct */
+ NTSTATUS _ds_enum_dom_trusts(struct pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
+			     DS_R_ENUM_DOM_TRUSTS *r_u)
+{
+	NTSTATUS status = NT_STATUS_OK;
+
+	/* TODO: According to MSDN, the can only be executed against a
+	   DC or domain member running Windows 2000 or later.  Need
+	   to test against a standalone 2k server and see what it
+	   does.  A windows 2000 DC includes its own domain in the
+	   list.  --jerry */
+
+	return status;
+}
+#endif	/* JERRY */
+
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_LogonUasLogon(struct pipes_struct *p,
+			   struct netr_LogonUasLogon *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_LogonUasLogoff(struct pipes_struct *p,
+			    struct netr_LogonUasLogoff *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_DatabaseDeltas(struct pipes_struct *p,
+			      struct netr_DatabaseDeltas *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_DatabaseSync(struct pipes_struct *p,
+			    struct netr_DatabaseSync *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_AccountDeltas(struct pipes_struct *p,
+			     struct netr_AccountDeltas *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_AccountSync(struct pipes_struct *p,
+			   struct netr_AccountSync *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+static bool wb_getdcname(TALLOC_CTX *mem_ctx,
+			 const char *domain,
+			 const char **dcname,
+			 uint32_t flags,
+			 WERROR *werr)
+{
+	wbcErr result;
+	struct wbcDomainControllerInfo *dc_info = NULL;
+
+	result = wbcLookupDomainController(domain,
+					   flags,
+					   &dc_info);
+	switch (result) {
+	case WBC_ERR_SUCCESS:
+		break;
+	case WBC_ERR_WINBIND_NOT_AVAILABLE:
+		return false;
+	case WBC_ERR_DOMAIN_NOT_FOUND:
+		*werr = WERR_NO_SUCH_DOMAIN;
+		return true;
+	default:
+		*werr = WERR_DOMAIN_CONTROLLER_NOT_FOUND;
+		return true;
+	}
+
+	*dcname = talloc_strdup(mem_ctx, dc_info->dc_name);
+	wbcFreeMemory(dc_info);
+	if (!*dcname) {
+		*werr = WERR_NOT_ENOUGH_MEMORY;
+		return false;
+	}
+
+	*werr = WERR_OK;
+
+	return true;
+}
+
+/****************************************************************
+ _netr_GetDcName
+****************************************************************/
+
+WERROR _netr_GetDcName(struct pipes_struct *p,
+		       struct netr_GetDcName *r)
+{
+	NTSTATUS status;
+	WERROR werr;
+	uint32_t flags;
+	struct netr_DsRGetDCNameInfo *info;
+	bool ret;
+
+	ret = wb_getdcname(p->mem_ctx,
+			   r->in.domainname,
+			   r->out.dcname,
+			   WBC_LOOKUP_DC_IS_FLAT_NAME |
+			   WBC_LOOKUP_DC_RETURN_FLAT_NAME |
+			   WBC_LOOKUP_DC_PDC_REQUIRED,
+			   &werr);
+	if (ret == true) {
+		return werr;
+	}
+
+	flags = DS_PDC_REQUIRED | DS_IS_FLAT_NAME | DS_RETURN_FLAT_NAME;
+
+	status = dsgetdcname(p->mem_ctx,
+			     p->msg_ctx,
+			     r->in.domainname,
+			     NULL,
+			     NULL,
+			     flags,
+			     &info);
+	if (!NT_STATUS_IS_OK(status)) {
+		return ntstatus_to_werror(status);
+	}
+
+	*r->out.dcname = talloc_strdup(p->mem_ctx, info->dc_unc);
+	talloc_free(info);
+	if (!*r->out.dcname) {
+		return WERR_NOT_ENOUGH_MEMORY;
+	}
+
+	return WERR_OK;
+}
+
+/****************************************************************
+ _netr_GetAnyDCName
+****************************************************************/
+
+WERROR _netr_GetAnyDCName(struct pipes_struct *p,
+			  struct netr_GetAnyDCName *r)
+{
+	NTSTATUS status;
+	WERROR werr;
+	uint32_t flags;
+	struct netr_DsRGetDCNameInfo *info;
+	bool ret;
+
+	ret = wb_getdcname(p->mem_ctx,
+			   r->in.domainname,
+			   r->out.dcname,
+			   WBC_LOOKUP_DC_IS_FLAT_NAME |
+			   WBC_LOOKUP_DC_RETURN_FLAT_NAME,
+			   &werr);
+	if (ret == true) {
+		return werr;
+	}
+
+	flags = DS_IS_FLAT_NAME | DS_RETURN_FLAT_NAME;
+
+	status = dsgetdcname(p->mem_ctx,
+			     p->msg_ctx,
+			     r->in.domainname,
+			     NULL,
+			     NULL,
+			     flags,
+			     &info);
+	if (!NT_STATUS_IS_OK(status)) {
+		return ntstatus_to_werror(status);
+	}
+
+	*r->out.dcname = talloc_strdup(p->mem_ctx, info->dc_unc);
+	talloc_free(info);
+	if (!*r->out.dcname) {
+		return WERR_NOT_ENOUGH_MEMORY;
+	}
+
+	return WERR_OK;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_DatabaseSync2(struct pipes_struct *p,
+			     struct netr_DatabaseSync2 *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_DatabaseRedo(struct pipes_struct *p,
+			    struct netr_DatabaseRedo *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_DsRGetDCName(struct pipes_struct *p,
+			  struct netr_DsRGetDCName *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p,
+				    struct netr_LogonGetCapabilities *r)
+{
+	struct netlogon_creds_CredentialState *creds;
+	NTSTATUS status;
+
+	switch (r->in.query_level) {
+	case 1:
+		break;
+	case 2:
+		/*
+		 * Until we know the details behind KB5028166
+		 * just return DCERPC_NCA_S_FAULT_INVALID_TAG
+		 * like an unpatched Windows Server.
+		 */
+		FALL_THROUGH;
+	default:
+		/*
+		 * There would not be a way to marshall the
+		 * the response. Which would mean our final
+		 * ndr_push would fail an we would return
+		 * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA.
+		 *
+		 * But it's important to match a Windows server
+		 * especially before KB5028166, see also our bug #15418
+		 * Otherwise Windows client would stop talking to us.
+		 */
+		p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG;
+		return NT_STATUS_NOT_SUPPORTED;
+	}
+
+	become_root();
+	status = dcesrv_netr_creds_server_step_check(p->dce_call,
+						p->mem_ctx,
+						r->in.computer_name,
+						r->in.credential,
+						r->out.return_authenticator,
+						&creds);
+	unbecome_root();
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	r->out.capabilities->server_capabilities = creds->negotiate_flags;
+
+	return NT_STATUS_OK;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_NETRLOGONSETSERVICEBITS(struct pipes_struct *p,
+				     struct netr_NETRLOGONSETSERVICEBITS *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_LogonGetTrustRid(struct pipes_struct *p,
+			      struct netr_LogonGetTrustRid *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(struct pipes_struct *p,
+					  struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(struct pipes_struct *p,
+					  struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_DsRGetDCNameEx(struct pipes_struct *p,
+			    struct netr_DsRGetDCNameEx *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_DsRGetSiteName(struct pipes_struct *p,
+			    struct netr_DsRGetSiteName *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_LogonGetDomainInfo(struct pipes_struct *p,
+				  struct netr_LogonGetDomainInfo *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_ServerPasswordGet(struct pipes_struct *p,
+				 struct netr_ServerPasswordGet *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_NetrLogonSendToSam(struct pipes_struct *p,
+				struct netr_NetrLogonSendToSam *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_DsRAddressToSitenamesW(struct pipes_struct *p,
+				    struct netr_DsRAddressToSitenamesW *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_DsRGetDCNameEx2(struct pipes_struct *p,
+			     struct netr_DsRGetDCNameEx2 *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(struct pipes_struct *p,
+						 struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_NetrEnumerateTrustedDomainsEx(struct pipes_struct *p,
+					   struct netr_NetrEnumerateTrustedDomainsEx *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_DsRAddressToSitenamesExW(struct pipes_struct *p,
+				      struct netr_DsRAddressToSitenamesExW *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_DsrGetDcSiteCoverageW(struct pipes_struct *p,
+				   struct netr_DsrGetDcSiteCoverageW *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_DsrEnumerateDomainTrusts(struct pipes_struct *p,
+				      struct netr_DsrEnumerateDomainTrusts *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_DsrDeregisterDNSHostRecords(struct pipes_struct *p,
+					 struct netr_DsrDeregisterDNSHostRecords *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_ServerTrustPasswordsGet(struct pipes_struct *p,
+				       struct netr_ServerTrustPasswordsGet *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS fill_forest_trust_array(TALLOC_CTX *mem_ctx,
+					struct lsa_ForestTrustInformation *info)
+{
+	struct lsa_ForestTrustRecord *e;
+	struct pdb_domain_info *dom_info;
+	struct lsa_ForestTrustDomainInfo *domain_info;
+	char **upn_suffixes = NULL;
+	uint32_t num_suffixes = 0;
+	uint32_t i = 0;
+	NTSTATUS status;
+
+	dom_info = pdb_get_domain_info(mem_ctx);
+	if (dom_info == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	info->count = 2;
+
+	become_root();
+	status = pdb_enum_upn_suffixes(info, &num_suffixes, &upn_suffixes);
+	unbecome_root();
+	if (NT_STATUS_IS_OK(status) && (num_suffixes > 0)) {
+		info->count += num_suffixes;
+	}
+
+	info->entries = talloc_array(info, struct lsa_ForestTrustRecord *, info->count);
+	if (info->entries == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	e = talloc(info, struct lsa_ForestTrustRecord);
+	if (e == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	e->flags = 0;
+	e->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME;
+	e->time = 0; /* so far always 0 in trces. */
+	e->forest_trust_data.top_level_name.string = talloc_steal(info,
+								  dom_info->dns_forest);
+
+	info->entries[0] = e;
+
+	if (num_suffixes > 0) {
+		for (i = 0; i < num_suffixes ; i++) {
+			e = talloc(info, struct lsa_ForestTrustRecord);
+			if (e == NULL) {
+				return NT_STATUS_NO_MEMORY;
+			}
+
+			e->flags = 0;
+			e->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME;
+			e->time = 0; /* so far always 0 in traces. */
+			e->forest_trust_data.top_level_name.string = upn_suffixes[i];
+			info->entries[1 + i] = e;
+		}
+	}
+
+	e = talloc(info, struct lsa_ForestTrustRecord);
+	if (e == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	/* TODO: check if disabled and set flags accordingly */
+	e->flags = 0;
+	e->type = LSA_FOREST_TRUST_DOMAIN_INFO;
+	e->time = 0; /* so far always 0 in traces. */
+
+	domain_info = &e->forest_trust_data.domain_info;
+	domain_info->domain_sid = dom_sid_dup(info, &dom_info->sid);
+
+	domain_info->dns_domain_name.string = talloc_steal(info,
+							   dom_info->dns_domain);
+	domain_info->netbios_domain_name.string = talloc_steal(info,
+							       dom_info->name);
+
+	info->entries[info->count - 1] = e;
+
+	return NT_STATUS_OK;
+}
+
+/****************************************************************
+****************************************************************/
+
+WERROR _netr_DsRGetForestTrustInformation(struct pipes_struct *p,
+					  struct netr_DsRGetForestTrustInformation *r)
+{
+	struct dcesrv_call_state *dce_call = p->dce_call;
+	struct auth_session_info *session_info =
+		dcesrv_call_session_info(dce_call);
+	NTSTATUS status;
+	struct lsa_ForestTrustInformation *info, **info_ptr;
+	enum security_user_level security_level;
+
+	security_level = security_session_user_level(session_info, NULL);
+	if (security_level < SECURITY_USER) {
+		return WERR_ACCESS_DENIED;
+	}
+
+	if (r->in.flags & (~DS_GFTI_UPDATE_TDO)) {
+		p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+		return WERR_INVALID_FLAGS;
+	}
+
+	if ((r->in.flags & DS_GFTI_UPDATE_TDO) && (lp_server_role() != ROLE_DOMAIN_PDC)) {
+		p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+		return WERR_NERR_NOTPRIMARY;
+	}
+
+	if ((r->in.trusted_domain_name == NULL) && (r->in.flags & DS_GFTI_UPDATE_TDO)) {
+		p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+		return WERR_INVALID_PARAMETER;
+	}
+
+	/* retrieve forest trust information and stop further processing */
+	if (r->in.trusted_domain_name == NULL) {
+		info_ptr = talloc(p->mem_ctx, struct lsa_ForestTrustInformation *);
+		if (info_ptr == NULL) {
+			p->fault_state = DCERPC_FAULT_CANT_PERFORM;
+			return WERR_NOT_ENOUGH_MEMORY;
+		}
+		info = talloc_zero(info_ptr, struct lsa_ForestTrustInformation);
+		if (info == NULL) {
+			p->fault_state = DCERPC_FAULT_CANT_PERFORM;
+			return WERR_NOT_ENOUGH_MEMORY;
+		}
+
+		/* Fill forest trust information and expand UPN suffixes list */
+		status = fill_forest_trust_array(p->mem_ctx, info);
+		if (!NT_STATUS_IS_OK(status)) {
+			p->fault_state = DCERPC_FAULT_CANT_PERFORM;
+			return WERR_NOT_ENOUGH_MEMORY;
+		}
+
+		*info_ptr = info;
+		r->out.forest_trust_info = info_ptr;
+
+		return WERR_OK;
+
+	}
+
+	/* TODO: implement remaining parts of DsrGetForestTrustInformation (opnum 43)
+	 *       when trusted_domain_name is not NULL */
+
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return WERR_NOT_SUPPORTED;
+}
+
+/****************************************************************
+ _netr_GetForestTrustInformation
+****************************************************************/
+
+NTSTATUS _netr_GetForestTrustInformation(struct pipes_struct *p,
+					 struct netr_GetForestTrustInformation *r)
+{
+	NTSTATUS status;
+	struct netlogon_creds_CredentialState *creds;
+	struct lsa_ForestTrustInformation *info, **info_ptr;
+
+	/* TODO: check server name */
+
+	become_root();
+	status = dcesrv_netr_creds_server_step_check(p->dce_call,
+						p->mem_ctx,
+						r->in.computer_name,
+						r->in.credential,
+						r->out.return_authenticator,
+						&creds);
+	unbecome_root();
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	if ((creds->secure_channel_type != SEC_CHAN_DNS_DOMAIN) &&
+	    (creds->secure_channel_type != SEC_CHAN_DOMAIN)) {
+		return NT_STATUS_NOT_IMPLEMENTED;
+	}
+
+	info_ptr = talloc(p->mem_ctx, struct lsa_ForestTrustInformation *);
+	if (!info_ptr) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	info = talloc_zero(info_ptr, struct lsa_ForestTrustInformation);
+	if (!info) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	/* Fill forest trust information, do expand UPN suffixes list */
+	status = fill_forest_trust_array(p->mem_ctx, info);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	*info_ptr = info;
+	r->out.forest_trust_info = info_ptr;
+
+	return NT_STATUS_OK;
+}
+
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS get_password_from_trustAuth(TALLOC_CTX *mem_ctx,
+					    const DATA_BLOB *trustAuth_blob,
+					    struct netlogon_creds_CredentialState *creds,
+					    struct samr_Password *current_pw_enc,
+					    struct samr_Password *previous_pw_enc)
+{
+	enum ndr_err_code ndr_err;
+	struct trustAuthInOutBlob trustAuth;
+	NTSTATUS status;
+
+	ndr_err = ndr_pull_struct_blob_all(trustAuth_blob, mem_ctx, &trustAuth,
+					   (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return NT_STATUS_UNSUCCESSFUL;
+	}
+
+	if (trustAuth.count != 0 && trustAuth.current.count != 0 &&
+	    trustAuth.current.array[0].AuthType == TRUST_AUTH_TYPE_CLEAR) {
+		mdfour(current_pw_enc->hash,
+		       trustAuth.current.array[0].AuthInfo.clear.password,
+		       trustAuth.current.array[0].AuthInfo.clear.size);
+		status = netlogon_creds_des_encrypt(creds, current_pw_enc);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+	} else {
+		return NT_STATUS_UNSUCCESSFUL;
+	}
+
+
+	if (trustAuth.previous.count != 0 &&
+	    trustAuth.previous.array[0].AuthType == TRUST_AUTH_TYPE_CLEAR) {
+		mdfour(previous_pw_enc->hash,
+		       trustAuth.previous.array[0].AuthInfo.clear.password,
+		       trustAuth.previous.array[0].AuthInfo.clear.size);
+		status = netlogon_creds_des_encrypt(creds, previous_pw_enc);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+	} else {
+		ZERO_STRUCTP(previous_pw_enc);
+	}
+
+	return NT_STATUS_OK;
+}
+
+/****************************************************************
+ _netr_ServerGetTrustInfo
+****************************************************************/
+
+NTSTATUS _netr_ServerGetTrustInfo(struct pipes_struct *p,
+				  struct netr_ServerGetTrustInfo *r)
+{
+	NTSTATUS status;
+	struct netlogon_creds_CredentialState *creds;
+	char *account_name;
+	size_t account_name_last;
+	bool trusted;
+	struct netr_TrustInfo *trust_info;
+	struct pdb_trusted_domain *td;
+
+	/* TODO: check server name */
+
+	become_root();
+	status = dcesrv_netr_creds_server_step_check(p->dce_call,
+						p->mem_ctx,
+						r->in.computer_name,
+						r->in.credential,
+						r->out.return_authenticator,
+						&creds);
+	unbecome_root();
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	account_name = talloc_strdup(p->mem_ctx, r->in.account_name);
+	if (account_name == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	account_name_last = strlen(account_name);
+	if (account_name_last == 0) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	account_name_last--;
+	if (account_name[account_name_last] == '.') {
+		account_name[account_name_last] = '\0';
+	}
+
+	if ((creds->secure_channel_type != SEC_CHAN_DNS_DOMAIN) &&
+	    (creds->secure_channel_type != SEC_CHAN_DOMAIN)) {
+		trusted = false;
+	} else {
+		trusted = true;
+	}
+
+
+	if (trusted) {
+		account_name_last = strlen(account_name);
+		if (account_name_last == 0) {
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+		account_name_last--;
+		if (account_name[account_name_last] == '$') {
+			account_name[account_name_last] = '\0';
+		}
+
+		status = pdb_get_trusted_domain(p->mem_ctx, account_name, &td);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+
+		if (r->out.trust_info != NULL) {
+			trust_info = talloc_zero(p->mem_ctx, struct netr_TrustInfo);
+			if (trust_info == NULL) {
+				return NT_STATUS_NO_MEMORY;
+			}
+			trust_info->count = 1;
+
+			trust_info->data = talloc_array(trust_info, uint32_t, 1);
+			if (trust_info->data == NULL) {
+				return NT_STATUS_NO_MEMORY;
+			}
+			trust_info->data[0] = td->trust_attributes;
+
+			*r->out.trust_info = trust_info;
+		}
+
+		if (td->trust_auth_incoming.data == NULL) {
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+
+		status = get_password_from_trustAuth(p->mem_ctx,
+						     &td->trust_auth_incoming,
+						     creds,
+						     r->out.new_owf_password,
+						     r->out.old_owf_password);
+
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+
+	} else {
+/* TODO: look for machine password */
+		ZERO_STRUCTP(r->out.new_owf_password);
+		ZERO_STRUCTP(r->out.old_owf_password);
+
+		return NT_STATUS_NOT_IMPLEMENTED;
+	}
+
+	return NT_STATUS_OK;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_Unused47(struct pipes_struct *p,
+			struct netr_Unused47 *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _netr_DsrUpdateReadOnlyServerDnsRecords(struct pipes_struct *p,
+						 struct netr_DsrUpdateReadOnlyServerDnsRecords *r)
+{
+	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/*
+ * Define the bind function that will be used by ndr_netlogon_scompat.c,
+ * included at the bottom of this file.
+ */
+#define DCESRV_INTERFACE_NETLOGON_BIND(context, iface) \
+       dcesrv_interface_netlogon_bind(context, iface)
+
+static NTSTATUS dcesrv_interface_netlogon_bind(struct dcesrv_connection_context *context,
+					       const struct dcesrv_interface *iface)
+{
+	struct loadparm_context *lp_ctx = context->conn->dce_ctx->lp_ctx;
+	int schannel = lpcfg_server_schannel(lp_ctx);
+	bool schannel_global_required = (schannel == true);
+	bool global_require_seal = lpcfg_server_schannel_require_seal(lp_ctx);
+	static bool warned_global_schannel_once = false;
+	static bool warned_global_seal_once = false;
+
+	if (!schannel_global_required && !warned_global_schannel_once) {
+		/*
+		 * We want admins to notice their misconfiguration!
+		 */
+		D_ERR("CVE-2020-1472(ZeroLogon): "
+		      "Please configure 'server schannel = yes' (the default), "
+		      "See https://bugzilla.samba.org/show_bug.cgi?id=14497\n");
+		warned_global_schannel_once = true;
+	}
+
+	if (!global_require_seal && !warned_global_seal_once) {
+		/*
+		 * We want admins to notice their misconfiguration!
+		 */
+		D_ERR("CVE-2022-38023 (and others): "
+		      "Please configure 'server schannel require seal = yes' (the default), "
+		      "See https://bugzilla.samba.org/show_bug.cgi?id=15240\n");
+		warned_global_seal_once = true;
+	}
+
+	return NT_STATUS_OK;
+}
+
+/* include the generated boilerplate */
+#include "librpc/gen_ndr/ndr_netlogon_scompat.c"