Changeset 745 for trunk/server/source4/rpc_server/netlogon

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/rpc_server/netlogon/dcerpc_netlogon.c (modified) (87 diffs)

trunk/server/source4/rpc_server/netlogon/dcerpc_netlogon.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
 
@@ -6 +6 @@
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2008
    Copyright (C) Stefan Metzmacher <metze@samba.org>  2005
-   Copyright (C) Matthias Dieter Wallnöfer            2009
-   
+   Copyright (C) Matthias Dieter Wallnöfer            2009-2010
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -29 +29 @@
 #include "../lib/util/util_ldb.h"
 #include "../libcli/auth/schannel.h"
-#include "auth/gensec/schannel_state.h"
 #include "libcli/security/security.h"
 #include "param/param.h"
 #include "lib/messaging/irpc.h"
+#include "librpc/gen_ndr/ndr_irpc_c.h"
+#include "../libcli/ldap/ldap_ndr.h"
+#include "cldap_server/cldap_server.h"
+#include "lib/tsocket/tsocket.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
 #include "librpc/gen_ndr/ndr_irpc.h"
 
@@ -40 +44 @@
 };
 
-
 static NTSTATUS dcesrv_netr_ServerReqChallenge(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                                         struct netr_ServerReqChallenge *r)
@@ -55 +58 @@
                 dce_call->context->private_data = NULL;
         }
-        
+
         pipe_state = talloc(dce_call->context, struct netlogon_server_pipe_state);
         NT_STATUS_HAVE_NO_MEMORY(pipe_state);
@@ -61 +64 @@
         pipe_state->client_challenge = *r->in.credentials;
 
-        generate_random_buffer(pipe_state->server_challenge.data, 
+        generate_random_buffer(pipe_state->server_challenge.data,
                                sizeof(pipe_state->server_challenge.data));
 
@@ -77 +80 @@
                 talloc_get_type(dce_call->context->private_data, struct netlogon_server_pipe_state);
         struct netlogon_creds_CredentialState *creds;
-        struct ldb_context *schannel_ldb;
         struct ldb_context *sam_ctx;
         struct samr_Password *mach_pwd;
@@ -84 +86 @@
         struct ldb_message **msgs;
         NTSTATUS nt_status;
-        const char *attrs[] = {"unicodePwd", "userAccountControl", 
+        const char *attrs[] = {"unicodePwd", "userAccountControl",
                                "objectSid", NULL};
 
@@ -124 +126 @@
                                   NETLOGON_NEG_AUTHENTICATED_RPC;
 
-        if (!pipe_state) {
-                DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, 
-                                system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+        switch (r->in.secure_channel_type) {
+        case SEC_CHAN_WKSTA:
+        case SEC_CHAN_DNS_DOMAIN:
+        case SEC_CHAN_DOMAIN:
+        case SEC_CHAN_BDC:
+        case SEC_CHAN_RODC:
+                break;
+        default:
+                DEBUG(1, ("Client asked for an invalid secure channel type: %d\n",
+                          r->in.secure_channel_type));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx,
+                                system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
@@ -150 +160 @@
                 num_records = gendb_search(sam_ctx, mem_ctx, NULL, &msgs,
                                            trust_dom_attrs,
-                                           "(&(trustPartner=%s)(objectclass=trustedDomain))", 
+                                           "(&(trustPartner=%s)(objectclass=trustedDomain))",
                                            encoded_account);
-                
+
                 if (num_records == 0) {
-                        DEBUG(3,("Couldn't find trust [%s] in samdb.\n", 
+                        DEBUG(3,("Couldn't find trust [%s] in samdb.\n",
                                  encoded_account));
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-                
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
+                }
+
                 if (num_records > 1) {
                         DEBUG(0,("Found %d records matching user [%s]\n", num_records, r->in.account_name));
                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
                 }
-                
+
                 flatname = ldb_msg_find_attr_as_string(msgs[0], "flatname", NULL);
                 if (!flatname) {
                         /* No flatname for this trust - we can't proceed */
-                        return NT_STATUS_ACCESS_DENIED;
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
                 }
                 account_name = talloc_asprintf(mem_ctx, "%s$", flatname);
@@ -174 +184 @@
                         return NT_STATUS_NO_MEMORY;
                 }
-                
+
         } else {
                 account_name = r->in.account_name;
         }
-        
+
         /* pull the user attributes */
         num_records = gendb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
-                                   "(&(sAMAccountName=%s)(objectclass=user))", 
+                                   "(&(sAMAccountName=%s)(objectclass=user))",
                                    ldb_binary_encode_string(mem_ctx, account_name));
 
         if (num_records == 0) {
-                DEBUG(3,("Couldn't find user [%s] in samdb.\n", 
+                DEBUG(3,("Couldn't find user [%s] in samdb.\n",
                          r->in.account_name));
-                return NT_STATUS_ACCESS_DENIED;
+                return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
         }
 
@@ -195 +205 @@
         }
 
-        
         user_account_control = ldb_msg_find_attr_as_uint(msgs[0], "userAccountControl", 0);
 
         if (user_account_control & UF_ACCOUNTDISABLE) {
                 DEBUG(1, ("Account [%s] is disabled\n", r->in.account_name));
-                return NT_STATUS_ACCESS_DENIED;
+                return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
         }
 
@@ -206 +215 @@
                 if (!(user_account_control & UF_WORKSTATION_TRUST_ACCOUNT)) {
                         DEBUG(1, ("Client asked for a workstation secure channel, but is not a workstation (member server) acb flags: 0x%x\n", user_account_control));
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        } else if (r->in.secure_channel_type == SEC_CHAN_DOMAIN || 
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
+                }
+        } else if (r->in.secure_channel_type == SEC_CHAN_DOMAIN ||
                    r->in.secure_channel_type == SEC_CHAN_DNS_DOMAIN) {
                 if (!(user_account_control & UF_INTERDOMAIN_TRUST_ACCOUNT)) {
                         DEBUG(1, ("Client asked for a trusted domain secure channel, but is not a trusted domain: acb flags: 0x%x\n", user_account_control));
-                        
-                        return NT_STATUS_ACCESS_DENIED;
+
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
                 }
         } else if (r->in.secure_channel_type == SEC_CHAN_BDC) {
                 if (!(user_account_control & UF_SERVER_TRUST_ACCOUNT)) {
                         DEBUG(1, ("Client asked for a server secure channel, but is not a server (domain controller): acb flags: 0x%x\n", user_account_control));
-                        return NT_STATUS_ACCESS_DENIED;
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
+                }
+        } else if (r->in.secure_channel_type == SEC_CHAN_RODC) {
+                if (!(user_account_control & UF_PARTIAL_SECRETS_ACCOUNT)) {
+                        DEBUG(1, ("Client asked for a RODC secure channel, but is not a RODC: acb flags: 0x%x\n", user_account_control));
+                        return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
                 }
         } else {
-                DEBUG(1, ("Client asked for an invalid secure channel type: %d\n", 
-                          r->in.secure_channel_type));
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        *r->out.rid = samdb_result_rid_from_sid(mem_ctx, msgs[0], 
+                /* we should never reach this */
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        *r->out.rid = samdb_result_rid_from_sid(mem_ctx, msgs[0],
                                                 "objectSid", 0);
 
@@ -234 +247 @@
         }
 
-        creds = netlogon_creds_server_init(mem_ctx,     
+        if (!pipe_state) {
+                DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        creds = netlogon_creds_server_init(mem_ctx,
                                            r->in.account_name,
                                            r->in.computer_name,
                                            r->in.secure_channel_type,
-                                           &pipe_state->client_challenge, 
-                                           &pipe_state->server_challenge, 
+                                           &pipe_state->client_challenge,
+                                           &pipe_state->server_challenge,
                                            mach_pwd,
                                            r->in.credentials,
                                            r->out.return_credentials,
                                            *r->in.negotiate_flags);
-        
+
         if (!creds) {
                 return NT_STATUS_ACCESS_DENIED;
@@ -251 +269 @@
         creds->sid = samdb_result_dom_sid(creds, msgs[0], "objectSid");
 
-        schannel_ldb = schannel_db_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx);
-        if (!schannel_ldb) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        nt_status = schannel_store_session_key_ldb(schannel_ldb, mem_ctx, creds);
-        talloc_free(schannel_ldb);
+        nt_status = schannel_save_creds_state(mem_ctx,
+                                              lpcfg_private_dir(dce_call->conn->dce_ctx->lp_ctx),
+                                              creds);
 
         return nt_status;
 }
-                                                 
+
 static NTSTATUS dcesrv_netr_ServerAuthenticate(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                                         struct netr_ServerAuthenticate *r)
@@ -267 +281 @@
         struct netr_ServerAuthenticate3 a;
         uint32_t rid;
-        /* TODO: 
+        /* TODO:
          * negotiate_flags is used as an [in] parameter
          * so it need to be initialised.
@@ -305 +319 @@
         r3.out.negotiate_flags = r->out.negotiate_flags;
         r3.out.rid = &rid;
-        
+
         return dcesrv_netr_ServerAuthenticate3(dce_call, mem_ctx, &r3);
 }
 
 /*
-  Validate an incoming authenticator against the credentials for the remote machine.
-
-  The credentials are (re)read and from the schannel database, and
-  written back after the caclulations are performed.
-
-  The creds_out parameter (if not NULL) returns the credentials, if
-  the caller needs some of that information.
-
-*/
+ * NOTE: The following functions are nearly identical to the ones available in
+ * source3/rpc_server/srv_nelog_nt.c
+ * The reason we keep 2 copies is that they use different structures to
+ * represent the auth_info and the decrpc pipes.
+ */
+
+/*
+ * If schannel is required for this call test that it actually is available.
+ */
+static NTSTATUS schannel_check_required(struct dcerpc_auth *auth_info,
+                                        const char *computer_name,
+                                        bool integrity, bool privacy)
+{
+
+        if (auth_info && auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
+                if (!privacy && !integrity) {
+                        return NT_STATUS_OK;
+                }
+
+                if ((!privacy && integrity) &&
+                    auth_info->auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
+                        return NT_STATUS_OK;
+                }
+
+                if ((privacy || integrity) &&
+                    auth_info->auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
+                        return NT_STATUS_OK;
+                }
+        }
+
+        /* test didn't pass */
+        DEBUG(0, ("schannel_check_required: [%s] is not using schannel\n",
+                  computer_name));
+
+        return NT_STATUS_ACCESS_DENIED;
+}
+
 static NTSTATUS dcesrv_netr_creds_server_step_check(struct dcesrv_call_state *dce_call,
-                                                    TALLOC_CTX *mem_ctx, 
+                                                    TALLOC_CTX *mem_ctx,
                                                     const char *computer_name,
                                                     struct netr_Authenticator *received_authenticator,
                                                     struct netr_Authenticator *return_authenticator,
-                                                    struct netlogon_creds_CredentialState **creds_out) 
+                                                    struct netlogon_creds_CredentialState **creds_out)
 {
         NTSTATUS nt_status;
-        struct ldb_context *ldb;
-        bool schannel_global_required = false; /* Should be lp_schannel_server() == true */
-        bool schannel_in_use = dce_call->conn->auth_state.auth_info
-                && dce_call->conn->auth_state.auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL
-                && (dce_call->conn->auth_state.auth_info->auth_level == DCERPC_AUTH_LEVEL_INTEGRITY 
-                    || dce_call->conn->auth_state.auth_info->auth_level == DCERPC_AUTH_LEVEL_PRIVACY);
-
-        ldb = schannel_db_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx);
-        if (!ldb) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-        nt_status = schannel_creds_server_step_check_ldb(ldb, mem_ctx,
-                                                         computer_name,
-                                                         schannel_global_required,
-                                                         schannel_in_use,
-                                                         received_authenticator,
-                                                         return_authenticator, creds_out);
-        talloc_free(ldb);
+        struct dcerpc_auth *auth_info = dce_call->conn->auth_state.auth_info;
+        bool schannel_global_required = false; /* Should be lpcfg_schannel_server() == true */
+
+        if (schannel_global_required) {
+                nt_status = schannel_check_required(auth_info,
+                                                    computer_name,
+                                                    true, false);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+        }
+
+        nt_status = schannel_check_creds_state(mem_ctx,
+                                               lpcfg_private_dir(dce_call->conn->dce_ctx->lp_ctx),
+                                               computer_name,
+                                               received_authenticator,
+                                               return_authenticator,
+                                               creds_out);
         return nt_status;
 }
 
-/* 
+/*
   Change the machine account password for the currently connected
   client.  Supplies only the NT#.
@@ -358 +400 @@
         struct netlogon_creds_CredentialState *creds;
         struct ldb_context *sam_ctx;
+        const char * const attrs[] = { "unicodePwd", NULL };
+        struct ldb_message **res;
+        struct samr_Password *oldNtHash;
         NTSTATUS nt_status;
+        int ret;
 
         nt_status = dcesrv_netr_creds_server_step_check(dce_call,
-                                                        mem_ctx, 
-                                                        r->in.computer_name, 
+                                                        mem_ctx,
+                                                        r->in.computer_name,
                                                         r->in.credential, r->out.return_authenticator,
                                                         &creds);
         NT_STATUS_NOT_OK_RETURN(nt_status);
 
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
@@ -374 +420 @@
         netlogon_creds_des_decrypt(creds, r->in.new_password);
 
+        /* fetch the old password hashes (the NT hash has to exist) */
+
+        ret = gendb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
+                           "(&(objectClass=user)(objectSid=%s))",
+                           ldap_encode_ndr_dom_sid(mem_ctx, creds->sid));
+        if (ret != 1) {
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
+        nt_status = samdb_result_passwords(mem_ctx,
+                                           dce_call->conn->dce_ctx->lp_ctx,
+                                           res[0], NULL, &oldNtHash);
+        if (!NT_STATUS_IS_OK(nt_status) || !oldNtHash) {
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
         /* Using the sid for the account as the key, set the password */
-        nt_status = samdb_set_password_sid(sam_ctx, mem_ctx, 
+        nt_status = samdb_set_password_sid(sam_ctx, mem_ctx,
                                            creds->sid,
                                            NULL, /* Don't have plaintext */
                                            NULL, r->in.new_password,
-                                           true, /* Password change */
+                                           NULL, oldNtHash, /* Password change */
                                            NULL, NULL);
         return nt_status;
 }
 
-/* 
+/*
   Change the machine account password for the currently connected
   client.  Supplies new plaintext.
@@ -393 +455 @@
         struct netlogon_creds_CredentialState *creds;
         struct ldb_context *sam_ctx;
+        const char * const attrs[] = { "dBCSPwd", "unicodePwd", NULL };
+        struct ldb_message **res;
+        struct samr_Password *oldLmHash, *oldNtHash;
         NTSTATUS nt_status;
         DATA_BLOB new_password;
+        int ret;
 
         struct samr_CryptPassword password_buf;
 
         nt_status = dcesrv_netr_creds_server_step_check(dce_call,
-                                                        mem_ctx, 
-                                                        r->in.computer_name, 
+                                                        mem_ctx,
+                                                        r->in.computer_name,
                                                         r->in.credential, r->out.return_authenticator,
                                                         &creds);
         NT_STATUS_NOT_OK_RETURN(nt_status);
 
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
@@ -418 +484 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-                
+
+        /* fetch the old password hashes (at least one of both has to exist) */
+
+        ret = gendb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
+                           "(&(objectClass=user)(objectSid=%s))",
+                           ldap_encode_ndr_dom_sid(mem_ctx, creds->sid));
+        if (ret != 1) {
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
+        nt_status = samdb_result_passwords(mem_ctx,
+                                           dce_call->conn->dce_ctx->lp_ctx,
+                                           res[0], &oldLmHash, &oldNtHash);
+        if (!NT_STATUS_IS_OK(nt_status) || (!oldLmHash && !oldNtHash)) {
+                return NT_STATUS_WRONG_PASSWORD;
+        }
+
         /* Using the sid for the account as the key, set the password */
         nt_status = samdb_set_password_sid(sam_ctx, mem_ctx,
@@ -424 +506 @@
                                            &new_password, /* we have plaintext */
                                            NULL, NULL,
-                                           true, /* Password change */
+                                           oldLmHash, oldNtHash, /* Password change */
                                            NULL, NULL);
         return nt_status;
@@ -430 +512 @@
 
 
-/* 
-  netr_LogonUasLogon 
+/*
+  netr_LogonUasLogon
 */
 static WERROR dcesrv_netr_LogonUasLogon(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -440 +522 @@
 
 
-/* 
-  netr_LogonUasLogoff 
+/*
+  netr_LogonUasLogoff
 */
 static WERROR dcesrv_netr_LogonUasLogoff(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -450 +532 @@
 
 
-/* 
+static NTSTATUS dcesrv_netr_LogonSamLogon_check(const struct netr_LogonSamLogonEx *r)
+{
+        switch (r->in.logon_level) {
+        case NetlogonInteractiveInformation:
+        case NetlogonServiceInformation:
+        case NetlogonInteractiveTransitiveInformation:
+        case NetlogonServiceTransitiveInformation:
+                if (r->in.logon->password == NULL) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                switch (r->in.validation_level) {
+                case NetlogonValidationSamInfo:  /* 2 */
+                case NetlogonValidationSamInfo2: /* 3 */
+                case NetlogonValidationSamInfo4: /* 6 */
+                        break;
+                default:
+                        return NT_STATUS_INVALID_INFO_CLASS;
+                }
+
+                break;
+        case NetlogonNetworkInformation:
+        case NetlogonNetworkTransitiveInformation:
+                if (r->in.logon->network == NULL) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                switch (r->in.validation_level) {
+                case NetlogonValidationSamInfo:  /* 2 */
+                case NetlogonValidationSamInfo2: /* 3 */
+                case NetlogonValidationSamInfo4: /* 6 */
+                        break;
+                default:
+                        return NT_STATUS_INVALID_INFO_CLASS;
+                }
+
+                break;
+
+        case NetlogonGenericInformation:
+                if (r->in.logon->generic == NULL) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                switch (r->in.validation_level) {
+                /* TODO: case NetlogonValidationGenericInfo: 4 */
+                case NetlogonValidationGenericInfo2: /* 5 */
+                        break;
+                default:
+                        return NT_STATUS_INVALID_INFO_CLASS;
+                }
+
+                break;
+        default:
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        return NT_STATUS_OK;
+}
+
+/*
   netr_LogonSamLogon_base
 
@@ -462 +603 @@
         struct auth_context *auth_context;
         struct auth_usersupplied_info *user_info;
-        struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
         NTSTATUS nt_status;
         static const char zeros[16];
@@ -469 +610 @@
         struct netr_SamInfo3 *sam3;
         struct netr_SamInfo6 *sam6;
-        
-        user_info = talloc(mem_ctx, struct auth_usersupplied_info);
+
+        *r->out.authoritative = 1;
+
+        user_info = talloc_zero(mem_ctx, struct auth_usersupplied_info);
         NT_STATUS_HAVE_NO_MEMORY(user_info);
-
-        user_info->flags = 0;
-        user_info->mapped_state = false;
-        user_info->remote_host = NULL;
 
         switch (r->in.logon_level) {
@@ -483 +622 @@
         case NetlogonServiceTransitiveInformation:
                 if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
-                        netlogon_creds_arcfour_crypt(creds, 
+                        netlogon_creds_arcfour_crypt(creds,
                                             r->in.logon->password->lmpassword.hash,
                                             sizeof(r->in.logon->password->lmpassword.hash));
-                        netlogon_creds_arcfour_crypt(creds, 
+                        netlogon_creds_arcfour_crypt(creds,
                                             r->in.logon->password->ntpassword.hash,
                                             sizeof(r->in.logon->password->ntpassword.hash));
@@ -495 +634 @@
 
                 /* TODO: we need to deny anonymous access here */
-                nt_status = auth_context_create(mem_ctx, 
+                nt_status = auth_context_create(mem_ctx,
                                                 dce_call->event_ctx, dce_call->msg_ctx,
                                                 dce_call->conn->dce_ctx->lp_ctx,
@@ -505 +644 @@
                 user_info->client.domain_name = r->in.logon->password->identity_info.domain_name.string;
                 user_info->workstation_name = r->in.logon->password->identity_info.workstation.string;
-                
+
                 user_info->flags |= USER_INFO_INTERACTIVE_LOGON;
                 user_info->password_state = AUTH_PASSWORD_HASH;
@@ -522 +661 @@
 
                 /* TODO: we need to deny anonymous access here */
-                nt_status = auth_context_create(mem_ctx, 
+                nt_status = auth_context_create(mem_ctx,
                                                 dce_call->event_ctx, dce_call->msg_ctx,
                                                 dce_call->conn->dce_ctx->lp_ctx,
@@ -535 +674 @@
                 user_info->client.domain_name = r->in.logon->network->identity_info.domain_name.string;
                 user_info->workstation_name = r->in.logon->network->identity_info.workstation.string;
-                
+
                 user_info->password_state = AUTH_PASSWORD_RESPONSE;
                 user_info->password.response.lanman = data_blob_talloc(mem_ctx, r->in.logon->network->lm.data, r->in.logon->network->lm.length);
                 user_info->password.response.nt = data_blob_talloc(mem_ctx, r->in.logon->network->nt.data, r->in.logon->network->nt.length);
-        
+
                 break;
 
-                
+
         case NetlogonGenericInformation:
         {
                 if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
-                        netlogon_creds_arcfour_crypt(creds, 
+                        netlogon_creds_arcfour_crypt(creds,
                                             r->in.logon->generic->data, r->in.logon->generic->length);
                 } else {
@@ -555 +694 @@
                 if (strcmp(r->in.logon->generic->package_name.string, "Kerberos") == 0) {
                         NTSTATUS status;
-                        struct server_id *kdc;
+                        struct dcerpc_binding_handle *irpc_handle;
                         struct kdc_check_generic_kerberos check;
                         struct netr_GenericInfo2 *generic = talloc_zero(mem_ctx, struct netr_GenericInfo2);
                         NT_STATUS_HAVE_NO_MEMORY(generic);
                         *r->out.authoritative = 1;
-                        
+
                         /* TODO: Describe and deal with these flags */
                         *r->out.flags = 0;
 
                         r->out.validation->generic = generic;
-        
-                        kdc = irpc_servers_byname(dce_call->msg_ctx, mem_ctx, "kdc_server");
-                        if ((kdc == NULL) || (kdc[0].id == 0)) {
+
+                        irpc_handle = irpc_binding_handle_by_name(mem_ctx,
+                                                                  dce_call->msg_ctx,
+                                                                  "kdc_server",
+                                                                  &ndr_table_irpc);
+                        if (irpc_handle == NULL) {
                                 return NT_STATUS_NO_LOGON_SERVERS;
                         }
-                        
-                        check.in.generic_request = 
+
+                        check.in.generic_request =
                                 data_blob_const(r->in.logon->generic->data,
                                                 r->in.logon->generic->length);
-                        
-                        status = irpc_call(dce_call->msg_ctx, kdc[0],
-                                           &ndr_table_irpc, NDR_KDC_CHECK_GENERIC_KERBEROS,
-                                           &check, mem_ctx);
+
+                        status = dcerpc_kdc_check_generic_kerberos_r(irpc_handle,
+                                                                     mem_ctx,
+                                                                     &check);
                         if (!NT_STATUS_IS_OK(status)) {
                                 return status;
@@ -592 +734 @@
                 return NT_STATUS_INVALID_PARAMETER;
         }
-        
-        nt_status = auth_check_password(auth_context, mem_ctx, user_info, &server_info);
+
+        nt_status = auth_check_password(auth_context, mem_ctx, user_info, &user_info_dc);
+        /* TODO: set *r->out.authoritative = 0 on specific errors */
         NT_STATUS_NOT_OK_RETURN(nt_status);
 
-        nt_status = auth_convert_server_info_sambaseinfo(mem_ctx, server_info, &sam);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
+        switch (r->in.validation_level) {
+        case 2:
+                nt_status = auth_convert_user_info_dc_sambaseinfo(mem_ctx, user_info_dc, &sam);
+                NT_STATUS_NOT_OK_RETURN(nt_status);
+
+                sam2 = talloc_zero(mem_ctx, struct netr_SamInfo2);
+                NT_STATUS_HAVE_NO_MEMORY(sam2);
+                sam2->base = *sam;
+
+                /* And put into the talloc tree */
+                talloc_steal(sam2, sam);
+                r->out.validation->sam2 = sam2;
+
+                sam = &sam2->base;
+                break;
+
+        case 3:
+                nt_status = auth_convert_user_info_dc_saminfo3(mem_ctx,
+                                                              user_info_dc,
+                                                              &sam3);
+                NT_STATUS_NOT_OK_RETURN(nt_status);
+
+                r->out.validation->sam3 = sam3;
+
+                sam = &sam3->base;
+                break;
+
+        case 6:
+                nt_status = auth_convert_user_info_dc_saminfo3(mem_ctx,
+                                                           user_info_dc,
+                                                           &sam3);
+                NT_STATUS_NOT_OK_RETURN(nt_status);
+
+                sam6 = talloc_zero(mem_ctx, struct netr_SamInfo6);
+                NT_STATUS_HAVE_NO_MEMORY(sam6);
+                sam6->base = sam3->base;
+                sam = &sam6->base;
+                sam6->sidcount = sam3->sidcount;
+                sam6->sids = sam3->sids;
+
+                sam6->dns_domainname.string = lpcfg_dnsdomain(dce_call->conn->dce_ctx->lp_ctx);
+                sam6->principle.string = talloc_asprintf(mem_ctx, "%s@%s",
+                                                         sam->account_name.string, sam6->dns_domainname.string);
+                NT_STATUS_HAVE_NO_MEMORY(sam6->principle.string);
+                /* And put into the talloc tree */
+                talloc_steal(sam6, sam3);
+
+                r->out.validation->sam6 = sam6;
+                break;
+
+        default:
+                return NT_STATUS_INVALID_INFO_CLASS;
+        }
 
         /* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
@@ -605 +799 @@
                 /* This key is sent unencrypted without the ARCFOUR flag set */
                 if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
-                        netlogon_creds_arcfour_crypt(creds, 
-                                            sam->key.key, 
+                        netlogon_creds_arcfour_crypt(creds,
+                                            sam->key.key,
                                             sizeof(sam->key.key));
                 }
@@ -616 +810 @@
             memcmp(sam->LMSessKey.key, zeros, sizeof(sam->LMSessKey.key)) != 0) {
                 if (creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
-                        netlogon_creds_arcfour_crypt(creds, 
-                                            sam->LMSessKey.key, 
+                        netlogon_creds_arcfour_crypt(creds,
+                                            sam->LMSessKey.key,
                                             sizeof(sam->LMSessKey.key));
                 } else {
-                        netlogon_creds_des_encrypt_LMKey(creds, 
+                        netlogon_creds_des_encrypt_LMKey(creds,
                                                 &sam->LMSessKey);
                 }
         }
-
-        switch (r->in.validation_level) {
-        case 2:
-                sam2 = talloc_zero(mem_ctx, struct netr_SamInfo2);
-                NT_STATUS_HAVE_NO_MEMORY(sam2);
-                sam2->base = *sam;
-                r->out.validation->sam2 = sam2;
-                break;
-
-        case 3:
-                sam3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
-                NT_STATUS_HAVE_NO_MEMORY(sam3);
-                sam3->base = *sam;
-                r->out.validation->sam3 = sam3;
-                break;
-
-        case 6:
-                sam6 = talloc_zero(mem_ctx, struct netr_SamInfo6);
-                NT_STATUS_HAVE_NO_MEMORY(sam6);
-                sam6->base = *sam;
-                sam6->forest.string = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
-                sam6->principle.string = talloc_asprintf(mem_ctx, "%s@%s", 
-                                                         sam->account_name.string, sam6->forest.string);
-                NT_STATUS_HAVE_NO_MEMORY(sam6->principle.string);
-                r->out.validation->sam6 = sam6;
-                break;
-
-        default:
-                break;
-        }
-
-        *r->out.authoritative = 1;
 
         /* TODO: Describe and deal with these flags */
@@ -664 +826 @@
 
 static NTSTATUS dcesrv_netr_LogonSamLogonEx(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                                     struct netr_LogonSamLogonEx *r) 
+                                     struct netr_LogonSamLogonEx *r)
 {
         NTSTATUS nt_status;
         struct netlogon_creds_CredentialState *creds;
-        struct ldb_context *ldb = schannel_db_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx);
-        if (!ldb) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-        
-        nt_status = schannel_fetch_session_key_ldb(ldb, mem_ctx, r->in.computer_name, &creds);
+
+        *r->out.authoritative = 1;
+
+        nt_status = dcesrv_netr_LogonSamLogon_check(r);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        nt_status = schannel_get_creds_state(mem_ctx,
+                                             lpcfg_private_dir(dce_call->conn->dce_ctx->lp_ctx),
+                                             r->in.computer_name, &creds);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
@@ -685 +852 @@
 }
 
-/* 
+/*
   netr_LogonSamLogonWithFlags
 
@@ -697 +864 @@
 
         struct netr_Authenticator *return_authenticator;
-
-        return_authenticator = talloc(mem_ctx, struct netr_Authenticator);
-        NT_STATUS_HAVE_NO_MEMORY(return_authenticator);
-
-        nt_status = dcesrv_netr_creds_server_step_check(dce_call,
-                                                        mem_ctx, 
-                                                        r->in.computer_name, 
-                                                        r->in.credential, return_authenticator,
-                                                        &creds);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
 
         ZERO_STRUCT(r2);
@@ -720 +877 @@
         r2.out.flags            = r->out.flags;
 
+        *r->out.authoritative = 1;
+
+        nt_status = dcesrv_netr_LogonSamLogon_check(&r2);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        return_authenticator = talloc(mem_ctx, struct netr_Authenticator);
+        NT_STATUS_HAVE_NO_MEMORY(return_authenticator);
+
+        nt_status = dcesrv_netr_creds_server_step_check(dce_call,
+                                                        mem_ctx,
+                                                        r->in.computer_name,
+                                                        r->in.credential, return_authenticator,
+                                                        &creds);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+
         nt_status = dcesrv_netr_LogonSamLogon_base(dce_call, mem_ctx, &r2, creds);
 
@@ -727 +901 @@
 }
 
-/* 
+/*
   netr_LogonSamLogon
 */
@@ -759 +933 @@
 
 
-/* 
-  netr_LogonSamLogoff 
+/*
+  netr_LogonSamLogoff
 */
 static NTSTATUS dcesrv_netr_LogonSamLogoff(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -770 +944 @@
 
 
-/* 
-  netr_DatabaseDeltas 
+/*
+  netr_DatabaseDeltas
 */
 static NTSTATUS dcesrv_netr_DatabaseDeltas(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -780 +954 @@
 
 
-/* 
-  netr_DatabaseSync2 
+/*
+  netr_DatabaseSync2
 */
 static NTSTATUS dcesrv_netr_DatabaseSync2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -791 +965 @@
 
 
-/* 
-  netr_DatabaseSync 
+/*
+  netr_DatabaseSync
 */
 static NTSTATUS dcesrv_netr_DatabaseSync(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -818 +992 @@
 
 
-/* 
-  netr_AccountDeltas 
+/*
+  netr_AccountDeltas
 */
 static NTSTATUS dcesrv_netr_AccountDeltas(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -829 +1003 @@
 
 
-/* 
-  netr_AccountSync 
+/*
+  netr_AccountSync
 */
 static NTSTATUS dcesrv_netr_AccountSync(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -840 +1014 @@
 
 
-/* 
-  netr_GetDcName 
+/*
+  netr_GetDcName
 */
 static WERROR dcesrv_netr_GetDcName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -853 +1027 @@
         const char *dcname;
 
+        /*
+         * [MS-NRPC] 3.5.5.3.4 NetrGetDCName says
+         * that the domainname needs to be a valid netbios domain
+         * name, if it is not NULL.
+         */
+        if (r->in.domainname) {
+                const char *dot = strchr(r->in.domainname, '.');
+                size_t len = strlen(r->in.domainname);
+
+                if (dot || len > 15) {
+                        return WERR_DCNOTFOUND;
+                }
+
+                /*
+                 * TODO: Should we also varify that only valid
+                 *       netbios name characters are used?
+                 */
+        }
+
         sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
                                 dce_call->conn->dce_ctx->lp_ctx,
-                                dce_call->conn->auth_state.session_info);
+                                dce_call->conn->auth_state.session_info, 0);
         if (sam_ctx == NULL) {
                 return WERR_DS_UNAVAILABLE;
@@ -876 +1069 @@
          */
         dcname = talloc_asprintf(mem_ctx, "\\\\%s",
-                                 lp_netbios_name(dce_call->conn->dce_ctx->lp_ctx));
+                                 lpcfg_netbios_name(dce_call->conn->dce_ctx->lp_ctx));
         W_ERROR_HAVE_NO_MEMORY(dcname);
 
@@ -884 +1077 @@
 
 
-/* 
-  netr_LogonControl2Ex 
+/*
+  netr_LogonControl2Ex
 */
 static WERROR dcesrv_netr_LogonControl2Ex(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -894 +1087 @@
 
 
-/* 
-  netr_LogonControl 
+/*
+  netr_LogonControl
 */
 static WERROR dcesrv_netr_LogonControl(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -923 +1116 @@
 
 
-/* 
-  netr_LogonControl2 
+/*
+  netr_LogonControl2
 */
 static WERROR dcesrv_netr_LogonControl2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -945 +1138 @@
 }
 
-
-/* 
-  netr_GetAnyDCName 
+static WERROR fill_trusted_domains_array(TALLOC_CTX *mem_ctx,
+                                         struct ldb_context *sam_ctx,
+                                         struct netr_DomainTrustList *trusts,
+                                         uint32_t trust_flags);
+
+/*
+  netr_GetAnyDCName
 */
 static WERROR dcesrv_netr_GetAnyDCName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                        struct netr_GetAnyDCName *r)
 {
-        struct netr_GetDcName r2;
+        struct netr_DomainTrustList *trusts;
+        struct ldb_context *sam_ctx;
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        uint32_t i;
         WERROR werr;
 
-        ZERO_STRUCT(r2);
-
-        r2.in.logon_server      = r->in.logon_server;
-        r2.in.domainname        = r->in.domainname;
-        r2.out.dcname           = r->out.dcname;
-
-        werr = dcesrv_netr_GetDcName(dce_call, mem_ctx, &r2);
-
-        return werr;
-}
-
-
-/* 
-  netr_DatabaseRedo 
+        *r->out.dcname = NULL;
+
+        if ((r->in.domainname == NULL) || (r->in.domainname[0] == '\0')) {
+                /* if the domainname parameter wasn't set assume our domain */
+                r->in.domainname = lpcfg_workgroup(lp_ctx);
+        }
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return WERR_DS_UNAVAILABLE;
+        }
+
+        if (strcasecmp(r->in.domainname, lpcfg_workgroup(lp_ctx)) == 0) {
+                /* well we asked for a DC of our own domain */
+                if (samdb_is_pdc(sam_ctx)) {
+                        /* we are the PDC of the specified domain */
+                        return WERR_NO_SUCH_DOMAIN;
+                }
+
+                *r->out.dcname = talloc_asprintf(mem_ctx, "\\%s",
+                                                lpcfg_netbios_name(lp_ctx));
+                W_ERROR_HAVE_NO_MEMORY(*r->out.dcname);
+
+                return WERR_OK;
+        }
+
+        /* Okay, now we have to consider the trusted domains */
+
+        trusts = talloc_zero(mem_ctx, struct netr_DomainTrustList);
+        W_ERROR_HAVE_NO_MEMORY(trusts);
+
+        trusts->count = 0;
+
+        werr = fill_trusted_domains_array(mem_ctx, sam_ctx, trusts,
+                                          NETR_TRUST_FLAG_INBOUND
+                                          | NETR_TRUST_FLAG_OUTBOUND);
+        W_ERROR_NOT_OK_RETURN(werr);
+
+        for (i = 0; i < trusts->count; i++) {
+                if (strcasecmp(r->in.domainname, trusts->array[i].netbios_name) == 0) {
+                        /* FIXME: Here we need to find a DC for the specified
+                         * trusted domain. */
+
+                        /* return WERR_OK; */
+                        return WERR_NO_SUCH_DOMAIN;
+                }
+        }
+
+        return WERR_NO_SUCH_DOMAIN;
+}
+
+
+/*
+  netr_DatabaseRedo
 */
 static NTSTATUS dcesrv_netr_DatabaseRedo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -977 +1218 @@
 
 
-/* 
-  netr_NetrEnumerateTurstedDomains
-*/
-static WERROR dcesrv_netr_NetrEnumerateTrustedDomains(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+/*
+  netr_NetrEnumerateTrustedDomains
+*/
+static NTSTATUS dcesrv_netr_NetrEnumerateTrustedDomains(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                        struct netr_NetrEnumerateTrustedDomains *r)
 {
@@ -987 +1228 @@
 
 
-/* 
+/*
   netr_LogonGetCapabilities
 */
@@ -998 +1239 @@
 
 
-/* 
-  netr_NETRLOGONSETSERVICEBITS 
+/*
+  netr_NETRLOGONSETSERVICEBITS
 */
 static WERROR dcesrv_netr_NETRLOGONSETSERVICEBITS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1018 +1259 @@
 
 
-/* 
-  netr_NETRLOGONCOMPUTESERVERDIGEST 
+/*
+  netr_NETRLOGONCOMPUTESERVERDIGEST
 */
 static WERROR dcesrv_netr_NETRLOGONCOMPUTESERVERDIGEST(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1028 +1269 @@
 
 
-/* 
-  netr_NETRLOGONCOMPUTECLIENTDIGEST 
+/*
+  netr_NETRLOGONCOMPUTECLIENTDIGEST
 */
 static WERROR dcesrv_netr_NETRLOGONCOMPUTECLIENTDIGEST(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1039 +1280 @@
 
 
-/* 
+/*
   netr_DsRGetSiteName
 */
@@ -1045 +1286 @@
                                   struct netr_DsRGetSiteName *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+        struct ldb_context *sam_ctx;
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return WERR_DS_UNAVAILABLE;
+        }
+
+        *r->out.site = samdb_server_site_name(sam_ctx, mem_ctx);
+        W_ERROR_HAVE_NO_MEMORY(*r->out.site);
+
+        return WERR_OK;
 }
 
@@ -1065 +1318 @@
                 info->trust_extension.info = talloc_zero(mem_ctx, struct netr_trust_extension);
                 info->trust_extension.length = 16;
-                info->trust_extension.info->flags = 
+                info->trust_extension.info->flags =
                         NETR_TRUST_FLAG_TREEROOT |
-                        NETR_TRUST_FLAG_IN_FOREST | 
+                        NETR_TRUST_FLAG_IN_FOREST |
                         NETR_TRUST_FLAG_PRIMARY |
                         NETR_TRUST_FLAG_NATIVE;
@@ -1081 +1334 @@
                 info->dns_forestname.string = NULL;
         } else {
-                char *p;
-                /* TODO: we need a common function for pulling the forest */
-                info->dns_forestname.string = ldb_dn_canonical_string(info, ldb_get_root_basedn(sam_ctx));
-                if (!info->dns_forestname.string) {
-                        return NT_STATUS_NO_SUCH_DOMAIN;                
-                }
-                p = strchr(info->dns_forestname.string, '/');
-                if (p) {
-                        *p = '\0';
-                }
+                info->dns_forestname.string = samdb_forest_name(sam_ctx, mem_ctx);
+                NT_STATUS_HAVE_NO_MEMORY(info->dns_forestname.string);
                 info->dns_forestname.string = talloc_asprintf(mem_ctx, "%s.", info->dns_forestname.string);
-                                        
+                NT_STATUS_HAVE_NO_MEMORY(info->dns_forestname.string);
         }
 
         if (is_local) {
-                info->domainname.string = lp_sam_name(lp_ctx);
-                info->dns_domainname.string = lp_realm(lp_ctx);
+                info->domainname.string = lpcfg_workgroup(lp_ctx);
+                info->dns_domainname.string = lpcfg_dnsdomain(lp_ctx);
                 info->domain_guid = samdb_result_guid(res, "objectGUID");
                 info->domain_sid = samdb_result_dom_sid(mem_ctx, res, "objectSid");
         } else {
-                info->domainname.string = samdb_result_string(res, "flatName", NULL);
-                info->dns_domainname.string = samdb_result_string(res, "trustPartner", NULL);
+                info->domainname.string = ldb_msg_find_attr_as_string(res, "flatName", NULL);
+                info->dns_domainname.string = ldb_msg_find_attr_as_string(res, "trustPartner", NULL);
                 info->domain_guid = samdb_result_guid(res, "objectGUID");
                 info->domain_sid = samdb_result_dom_sid(mem_ctx, res, "securityIdentifier");
@@ -1113 +1358 @@
 }
 
-/* 
+/*
   netr_LogonGetDomainInfo
   this is called as part of the ADS domain logon procedure.
@@ -1126 +1371 @@
         const char * const attrs[] = { "objectSid", "objectGUID", "flatName",
                 "securityIdentifier", "trustPartner", NULL };
-        const char *temp_str;
-        const char *old_dns_hostname;
+        const char * const attrs2[] = { "sAMAccountName", "dNSHostName",
+                "msDS-SupportedEncryptionTypes", NULL };
+        const char *sam_account_name, *old_dns_hostname, *prefix1, *prefix2;
         struct ldb_context *sam_ctx;
-        struct ldb_message **res1, **res2, *new_msg;
+        struct ldb_message **res1, **res2, **res3, *new_msg;
         struct ldb_dn *workstation_dn;
         struct netr_DomainInformation *domain_info;
         struct netr_LsaPolicyInformation *lsa_policy_info;
-        struct netr_OsVersionInfoEx *os_version;
         uint32_t default_supported_enc_types = 0xFFFFFFFF;
-        int ret1, ret2, i;
+        bool update_dns_hostname = true;
+        int ret, ret3, i;
         NTSTATUS status;
 
         status = dcesrv_netr_creds_server_step_check(dce_call,
-                                                     mem_ctx, 
-                                                     r->in.computer_name, 
-                                                     r->in.credential, 
+                                                     mem_ctx,
+                                                     r->in.computer_name,
+                                                     r->in.credential,
                                                      r->out.return_authenticator,
                                                      &creds);
@@ -1150 +1396 @@
 
         sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx,
-                dce_call->conn->dce_ctx->lp_ctx,
-                system_session(mem_ctx, dce_call->conn->dce_ctx->lp_ctx));
+                                dce_call->conn->dce_ctx->lp_ctx,
+                                system_session(dce_call->conn->dce_ctx->lp_ctx), 0);
         if (sam_ctx == NULL) {
                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
@@ -1159 +1405 @@
         case 1: /* Domain information */
 
-                /* TODO: check NTSTATUS results - and fail also on SAMDB
-                 * errors (needs some testing against Windows Server 2008) */
+                if (r->in.query->workstation_info == NULL) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                /* Prepares the workstation DN */
+                workstation_dn = ldb_dn_new_fmt(mem_ctx, sam_ctx, "<SID=%s>",
+                                                dom_sid_string(mem_ctx, creds->sid));
+                NT_STATUS_HAVE_NO_MEMORY(workstation_dn);
+
+                /* Lookup for attributes in workstation object */
+                ret = gendb_search_dn(sam_ctx, mem_ctx, workstation_dn, &res1,
+                                      attrs2);
+                if (ret != 1) {
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+
+                /* Gets the sam account name which is checked against the DNS
+                 * hostname parameter. */
+                sam_account_name = ldb_msg_find_attr_as_string(res1[0],
+                                                               "sAMAccountName",
+                                                               NULL);
+                if (sam_account_name == NULL) {
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
 
                 /*
-                 * Check that the computer name parameter matches as prefix with
-                 * the DNS hostname in the workstation info structure.
+                 * Checks that the sam account name without a possible "$"
+                 * matches as prefix with the DNS hostname in the workstation
+                 * info structure.
                  */
-                temp_str = strndup(r->in.query->workstation_info->dns_hostname,
-                        strcspn(r->in.query->workstation_info->dns_hostname,
-                        "."));
-                if (strcasecmp(r->in.computer_name, temp_str) != 0)
-                        return NT_STATUS_INVALID_PARAMETER;
-
-                workstation_dn = ldb_dn_new_fmt(mem_ctx, sam_ctx, "<SID=%s>",
-                        dom_sid_string(mem_ctx, creds->sid));
-                NT_STATUS_HAVE_NO_MEMORY(workstation_dn);
+                prefix1 = talloc_strndup(mem_ctx, sam_account_name,
+                                         strcspn(sam_account_name, "$"));
+                NT_STATUS_HAVE_NO_MEMORY(prefix1);
+                if (r->in.query->workstation_info->dns_hostname != NULL) {
+                        prefix2 = talloc_strndup(mem_ctx,
+                                                 r->in.query->workstation_info->dns_hostname,
+                                                 strcspn(r->in.query->workstation_info->dns_hostname, "."));
+                        NT_STATUS_HAVE_NO_MEMORY(prefix2);
+
+                        if (strcasecmp(prefix1, prefix2) != 0) {
+                                update_dns_hostname = false;
+                        }
+                } else {
+                        update_dns_hostname = false;
+                }
 
                 /* Gets the old DNS hostname */
-                old_dns_hostname = samdb_search_string(sam_ctx, mem_ctx,
-                                                        workstation_dn,
-                                                        "dNSHostName",
-                                                        NULL);
-
-                /* Gets host informations and put them in our directory */
+                old_dns_hostname = ldb_msg_find_attr_as_string(res1[0],
+                                                               "dNSHostName",
+                                                               NULL);
+
+                /*
+                 * Updates the DNS hostname when the client wishes that the
+                 * server should handle this for him
+                 * ("NETR_WS_FLAG_HANDLES_SPN_UPDATE" not set). And this is
+                 * obviously only checked when we do already have a
+                 * "dNSHostName".
+                 * See MS-NRPC section 3.5.4.3.9
+                 */
+                if ((old_dns_hostname != NULL) &&
+                    (r->in.query->workstation_info->workstation_flags
+                    & NETR_WS_FLAG_HANDLES_SPN_UPDATE) != 0) {
+                        update_dns_hostname = false;
+                }
+
+                /* Gets host information and put them into our directory */
+
                 new_msg = ldb_msg_new(mem_ctx);
                 NT_STATUS_HAVE_NO_MEMORY(new_msg);
@@ -1188 +1477 @@
                 new_msg->dn = workstation_dn;
 
-                /* Deletes old OS version values */
-                samdb_msg_add_delete(sam_ctx, mem_ctx, new_msg,
-                        "operatingSystemServicePack");
-                samdb_msg_add_delete(sam_ctx, mem_ctx, new_msg,
-                        "operatingSystemVersion");
-
-                if (samdb_replace(sam_ctx, mem_ctx, new_msg) != LDB_SUCCESS) {
-                        DEBUG(3,("Impossible to update samdb: %s\n",
-                                ldb_errstring(sam_ctx)));
-                }
-
-                talloc_free(new_msg);
-
-                new_msg = ldb_msg_new(mem_ctx);
-                NT_STATUS_HAVE_NO_MEMORY(new_msg);
-
-                new_msg->dn = workstation_dn;
-
                 /* Sets the OS name */
-                samdb_msg_set_string(sam_ctx, mem_ctx, new_msg,
-                        "operatingSystem",
-                        r->in.query->workstation_info->os_name.string);
-
-                if (r->in.query->workstation_info->dns_hostname) {
-                        /* TODO: should this always be done? */
-                        samdb_msg_add_string(sam_ctx, mem_ctx, new_msg,
-                                             "dNSHostname",
-                                             r->in.query->workstation_info->dns_hostname);
+
+                if (r->in.query->workstation_info->os_name.string == NULL) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                ret = ldb_msg_add_string(new_msg, "operatingSystem",
+                                         r->in.query->workstation_info->os_name.string);
+                if (ret != LDB_SUCCESS) {
+                        return NT_STATUS_NO_MEMORY;
                 }
 
                 /*
-                 * Sets informations from "os_version". On a empty structure
+                 * Sets information from "os_version". On an empty structure
                  * the values are cleared.
                  */
                 if (r->in.query->workstation_info->os_version.os != NULL) {
+                        struct netr_OsVersionInfoEx *os_version;
+                        const char *os_version_str;
+
                         os_version = &r->in.query->workstation_info->os_version.os->os;
 
-                        samdb_msg_set_string(sam_ctx, mem_ctx, new_msg,
-                                             "operatingSystemServicePack",
-                                             os_version->CSDVersion);
-
-                        samdb_msg_set_string(sam_ctx, mem_ctx, new_msg,
-                                "operatingSystemVersion",
-                                talloc_asprintf(mem_ctx, "%d.%d (%d)",
-                                        os_version->MajorVersion,
-                                        os_version->MinorVersion,
-                                        os_version->BuildNumber
-                                )
-                        );
+                        if (os_version->CSDVersion == NULL) {
+                                return NT_STATUS_INVALID_PARAMETER;
+                        }
+
+                        os_version_str = talloc_asprintf(new_msg, "%u.%u (%u)",
+                                                         os_version->MajorVersion,
+                                                         os_version->MinorVersion,
+                                                         os_version->BuildNumber);
+                        NT_STATUS_HAVE_NO_MEMORY(os_version_str);
+
+                        ret = ldb_msg_add_string(new_msg,
+                                                 "operatingSystemServicePack",
+                                                 os_version->CSDVersion);
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+
+                        ret = ldb_msg_add_string(new_msg,
+                                                 "operatingSystemVersion",
+                                                 os_version_str);
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                } else {
+                        ret = samdb_msg_add_delete(sam_ctx, mem_ctx, new_msg,
+                                                   "operatingSystemServicePack");
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+
+                        ret = samdb_msg_add_delete(sam_ctx, mem_ctx, new_msg,
+                                                   "operatingSystemVersion");
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
                 }
 
                 /*
-                 * Updates the "dNSHostname" and the "servicePrincipalName"s
-                 * since the client wishes that the server should handle this
-                 * for him ("NETR_WS_FLAG_HANDLES_SPN_UPDATE" not set).
-                 * See MS-NRPC section 3.5.4.3.9
+                 * If the boolean "update_dns_hostname" remained true, then we
+                 * are fine to start the update.
                  */
-                if ((r->in.query->workstation_info->workstation_flags
-                        & NETR_WS_FLAG_HANDLES_SPN_UPDATE) == 0) {
-
-                        samdb_msg_add_string(sam_ctx, mem_ctx, new_msg,
-                                "servicePrincipalName",
-                                talloc_asprintf(mem_ctx, "HOST/%s",
-                                r->in.computer_name)
-                        );
-                        samdb_msg_add_string(sam_ctx, mem_ctx, new_msg,
-                                "servicePrincipalName",
-                                talloc_asprintf(mem_ctx, "HOST/%s",
-                                r->in.query->workstation_info->dns_hostname)
-                        );
-                }
-
-                if (samdb_replace(sam_ctx, mem_ctx, new_msg) != LDB_SUCCESS) {
+                if (update_dns_hostname) {
+                        ret = ldb_msg_add_string(new_msg,
+                                                 "dNSHostname",
+                                                 r->in.query->workstation_info->dns_hostname);
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+
+                        /* This manual "servicePrincipalName" generation is
+                         * still needed! Since the update in the samldb LDB
+                         * module does only work if the entries already exist
+                         * which isn't always the case. */
+                        ret = ldb_msg_add_string(new_msg,
+                                                 "servicePrincipalName",
+                                                 talloc_asprintf(new_msg, "HOST/%s",
+                                                 r->in.computer_name));
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+
+                        ret = ldb_msg_add_string(new_msg,
+                                                 "servicePrincipalName",
+                                                 talloc_asprintf(new_msg, "HOST/%s",
+                                                 r->in.query->workstation_info->dns_hostname));
+                        if (ret != LDB_SUCCESS) {
+                                return NT_STATUS_NO_MEMORY;
+                        }
+                }
+
+                if (dsdb_replace(sam_ctx, new_msg, 0) != LDB_SUCCESS) {
                         DEBUG(3,("Impossible to update samdb: %s\n",
                                 ldb_errstring(sam_ctx)));
@@ -1274 +1583 @@
                    put the primary domain into the lists of returned trusts as
                    well. */
-                ret1 = gendb_search_dn(sam_ctx, mem_ctx, samdb_base_dn(sam_ctx),
-                        &res1, attrs);
-                if (ret1 != 1) {
+                ret = gendb_search_dn(sam_ctx, mem_ctx, ldb_get_default_basedn(sam_ctx),
+                        &res2, attrs);
+                if (ret != 1) {
                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
                 }
 
-                ret2 = gendb_search(sam_ctx, mem_ctx, NULL, &res2, attrs,
+                ret3 = gendb_search(sam_ctx, mem_ctx, NULL, &res3, attrs,
                         "(objectClass=trustedDomain)");
-                if (ret2 == -1) {
+                if (ret3 == -1) {
                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
                 }
@@ -1295 +1604 @@
                 status = fill_one_domain_info(mem_ctx,
                         dce_call->conn->dce_ctx->lp_ctx,
-                        sam_ctx, res1[0], &domain_info->primary_domain,
+                        sam_ctx, res2[0], &domain_info->primary_domain,
                         true, false);
                 NT_STATUS_NOT_OK_RETURN(status);
 
-                domain_info->trusted_domain_count = ret2 + 1;
+                domain_info->trusted_domain_count = ret3 + 1;
                 domain_info->trusted_domains = talloc_array(mem_ctx,
                         struct netr_OneDomainInfo,
@@ -1305 +1614 @@
                 NT_STATUS_HAVE_NO_MEMORY(domain_info->trusted_domains);
 
-                for (i=0;i<ret2;i++) {
+                for (i=0;i<ret3;i++) {
                         status = fill_one_domain_info(mem_ctx,
                                 dce_call->conn->dce_ctx->lp_ctx,
-                                sam_ctx, res2[i],
+                                sam_ctx, res3[i],
                                 &domain_info->trusted_domains[i],
                                 false, true);
@@ -1315 +1624 @@
 
                 status = fill_one_domain_info(mem_ctx,
-                        dce_call->conn->dce_ctx->lp_ctx, sam_ctx, res1[0],
+                        dce_call->conn->dce_ctx->lp_ctx, sam_ctx, res2[0],
                         &domain_info->trusted_domains[i], true, true);
                 NT_STATUS_NOT_OK_RETURN(status);
 
                 /* Sets the supported encryption types */
-                domain_info->supported_enc_types = samdb_search_uint(
-                        sam_ctx, mem_ctx,
-                        default_supported_enc_types, workstation_dn,
-                        "msDS-SupportedEncryptionTypes", NULL);
-
-                /* Other host domain informations */
+                domain_info->supported_enc_types = ldb_msg_find_attr_as_uint(res1[0],
+                        "msDS-SupportedEncryptionTypes",
+                        default_supported_enc_types);
+
+                /* Other host domain information */
 
                 lsa_policy_info = talloc(mem_ctx,
@@ -1334 +1642 @@
                 domain_info->lsa_policy = *lsa_policy_info;
 
-                domain_info->dns_hostname.string = old_dns_hostname;
+                /* The DNS hostname is only returned back when there is a chance
+                 * for a change. */
+                if ((r->in.query->workstation_info->workstation_flags
+                    & NETR_WS_FLAG_HANDLES_SPN_UPDATE) != 0) {
+                        domain_info->dns_hostname.string = old_dns_hostname;
+                } else {
+                        domain_info->dns_hostname.string = NULL;
+                }
+
                 domain_info->workstation_flags =
                         r->in.query->workstation_info->workstation_flags;
@@ -1357 +1673 @@
 
 
-
 /*
   netr_ServerPasswordGet
@@ -1368 +1683 @@
 
 
-/* 
-  netr_NETRLOGONSENDTOSAM 
+/*
+  netr_NETRLOGONSENDTOSAM
 */
 static WERROR dcesrv_netr_NETRLOGONSENDTOSAM(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1378 +1693 @@
 
 
-/* 
-  netr_DsRAddressToSitenamesW 
-*/
-static WERROR dcesrv_netr_DsRAddressToSitenamesW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct netr_DsRAddressToSitenamesW *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/* 
+/*
   netr_DsRGetDCNameEx2
 */
-static WERROR dcesrv_netr_DsRGetDCNameEx2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                                   struct netr_DsRGetDCNameEx2 *r)
-{
-        const char * const attrs[] = { "objectGUID", NULL };
+static WERROR dcesrv_netr_DsRGetDCNameEx2(struct dcesrv_call_state *dce_call,
+                                          TALLOC_CTX *mem_ctx,
+                                          struct netr_DsRGetDCNameEx2 *r)
+{
         struct ldb_context *sam_ctx;
-        struct ldb_message **res;
-        struct ldb_dn *domain_dn;
-        int ret;
         struct netr_DsRGetDCNameInfo *info;
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        const struct tsocket_address *remote_address;
+        char *addr = NULL;
+        const char *server_site_name;
+        char *guid_str;
+        struct netlogon_samlogon_response response;
+        NTSTATUS status;
+        const char *dc_name = NULL;
+        const char *domain_name = NULL;
 
         ZERO_STRUCTP(r->out.info);
 
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info);
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
         if (sam_ctx == NULL) {
                 return WERR_DS_UNAVAILABLE;
         }
 
-        /* Win7-beta will send the domain name in the form the user typed, so we have to cope
-           with both the short and long form here */
-        if (r->in.domain_name != NULL && !lp_is_my_domain_or_realm(dce_call->conn->dce_ctx->lp_ctx, 
-                                                                r->in.domain_name)) {
+        remote_address = dcesrv_connection_get_remote_address(dce_call->conn);
+        if (tsocket_address_is_inet(remote_address, "ip")) {
+                addr = tsocket_address_inet_addr_string(remote_address, mem_ctx);
+                W_ERROR_HAVE_NO_MEMORY(addr);
+        }
+
+        /* "server_unc" is ignored by w2k3 */
+
+        if (r->in.flags & ~(DSGETDC_VALID_FLAGS)) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        if (r->in.flags & DS_GC_SERVER_REQUIRED &&
+            r->in.flags & DS_PDC_REQUIRED &&
+            r->in.flags & DS_KDC_REQUIRED) {
+                return WERR_INVALID_FLAGS;
+        }
+        if (r->in.flags & DS_IS_FLAT_NAME &&
+            r->in.flags & DS_IS_DNS_NAME) {
+                return WERR_INVALID_FLAGS;
+        }
+        if (r->in.flags & DS_RETURN_DNS_NAME &&
+            r->in.flags & DS_RETURN_FLAT_NAME) {
+                return WERR_INVALID_FLAGS;
+        }
+        if (r->in.flags & DS_DIRECTORY_SERVICE_REQUIRED &&
+            r->in.flags & DS_DIRECTORY_SERVICE_6_REQUIRED) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        if (r->in.flags & DS_GOOD_TIMESERV_PREFERRED &&
+            r->in.flags &
+            (DS_DIRECTORY_SERVICE_REQUIRED |
+             DS_DIRECTORY_SERVICE_PREFERRED |
+             DS_GC_SERVER_REQUIRED |
+             DS_PDC_REQUIRED |
+             DS_KDC_REQUIRED)) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        if (r->in.flags & DS_TRY_NEXTCLOSEST_SITE &&
+            r->in.site_name) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        /* Proof server site parameter "site_name" if it was specified */
+        server_site_name = samdb_server_site_name(sam_ctx, mem_ctx);
+        W_ERROR_HAVE_NO_MEMORY(server_site_name);
+        if ((r->in.site_name != NULL) && (strcasecmp(r->in.site_name,
+                                                     server_site_name) != 0)) {
                 return WERR_NO_SUCH_DOMAIN;
         }
 
-        domain_dn = ldb_get_default_basedn(sam_ctx);
-        if (domain_dn == NULL) {
-                return WERR_DS_UNAVAILABLE;
-        }
-
-        ret = gendb_search_dn(sam_ctx, mem_ctx,
-                              domain_dn, &res, attrs);
-        if (ret != 1) {
+        guid_str = r->in.domain_guid != NULL ?
+                 GUID_string(mem_ctx, r->in.domain_guid) : NULL;
+
+        status = fill_netlogon_samlogon_response(sam_ctx, mem_ctx,
+                                                 r->in.domain_name,
+                                                 r->in.domain_name,
+                                                 NULL, guid_str,
+                                                 r->in.client_account,
+                                                 r->in.mask, addr,
+                                                 NETLOGON_NT_VERSION_5EX_WITH_IP,
+                                                 lp_ctx, &response, true);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+
+        if (r->in.flags & DS_RETURN_DNS_NAME) {
+                dc_name = response.data.nt5_ex.pdc_dns_name;
+                domain_name = response.data.nt5_ex.dns_domain;
+        } else if (r->in.flags & DS_RETURN_FLAT_NAME) {
+                dc_name = response.data.nt5_ex.pdc_name;
+                domain_name = response.data.nt5_ex.domain_name;
+        } else {
+
+                /*
+                 * TODO: autodetect what we need to return
+                 * based on the given arguments
+                 */
+                dc_name = response.data.nt5_ex.pdc_name;
+                domain_name = response.data.nt5_ex.domain_name;
+        }
+
+        if (!dc_name || !dc_name[0]) {
+                return WERR_NO_SUCH_DOMAIN;
+        }
+
+        if (!domain_name || !domain_name[0]) {
+                return WERR_NO_SUCH_DOMAIN;
         }
 
         info = talloc(mem_ctx, struct netr_DsRGetDCNameInfo);
         W_ERROR_HAVE_NO_MEMORY(info);
-
-        /* TODO: - return real IP address
-         *       - check all r->in.* parameters (server_unc is ignored by w2k3!)
-         */
-        info->dc_unc                    = talloc_asprintf(mem_ctx, "\\\\%s.%s",
-                                                          lp_netbios_name(dce_call->conn->dce_ctx->lp_ctx), 
-                                                          lp_realm(dce_call->conn->dce_ctx->lp_ctx));
+        info->dc_unc           = talloc_asprintf(mem_ctx, "\\\\%s", dc_name);
         W_ERROR_HAVE_NO_MEMORY(info->dc_unc);
-        info->dc_address                = talloc_strdup(mem_ctx, "\\\\0.0.0.0");
+        info->dc_address = talloc_asprintf(mem_ctx, "\\\\%s",
+                                           response.data.nt5_ex.sockaddr.pdc_ip);
         W_ERROR_HAVE_NO_MEMORY(info->dc_address);
-        info->dc_address_type           = DS_ADDRESS_TYPE_INET;
-        info->domain_guid               = samdb_result_guid(res[0], "objectGUID");
-        info->domain_name               = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
-        info->forest_name               = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
-        info->dc_flags                  = DS_DNS_FOREST |
-                                          DS_DNS_DOMAIN |
-                                          DS_DNS_CONTROLLER |
-                                          DS_SERVER_WRITABLE |
-                                          DS_SERVER_CLOSEST |
-                                          DS_SERVER_TIMESERV |
-                                          DS_SERVER_KDC |
-                                          DS_SERVER_DS |
-                                          DS_SERVER_LDAP |
-                                          DS_SERVER_GC |
-                                          DS_SERVER_PDC;
-        info->dc_site_name      = talloc_strdup(mem_ctx, "Default-First-Site-Name");
-        W_ERROR_HAVE_NO_MEMORY(info->dc_site_name);
-        info->client_site_name  = talloc_strdup(mem_ctx, "Default-First-Site-Name");
-        W_ERROR_HAVE_NO_MEMORY(info->client_site_name);
+        info->dc_address_type  = DS_ADDRESS_TYPE_INET; /* TODO: make this dynamic? for ipv6 */
+        info->domain_guid      = response.data.nt5_ex.domain_uuid;
+        info->domain_name      = domain_name;
+        info->forest_name      = response.data.nt5_ex.forest;
+        info->dc_flags         = response.data.nt5_ex.server_type;
+        info->dc_site_name     = response.data.nt5_ex.server_site;
+        info->client_site_name = response.data.nt5_ex.client_site;
 
         *r->out.info = info;
@@ -1462 +1832 @@
 }
 
-/* 
+/*
   netr_DsRGetDCNameEx
 */
@@ -1487 +1857 @@
 }
 
-/* 
+/*
   netr_DsRGetDCName
 */
@@ -1503 +1873 @@
         r2.in.domain_name = r->in.domain_name;
         r2.in.domain_guid = r->in.domain_guid;
-        
-        r2.in.site_name = NULL; /* should fill in from site GUID */
+
+        r2.in.site_name = NULL; /* this is correct, we should ignore site GUID */
         r2.in.flags = r->in.flags;
         r2.out.info = r->out.info;
@@ -1512 +1882 @@
         return werr;
 }
-/* 
-  netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN 
+/*
+  netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN
 */
 static WERROR dcesrv_netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
@@ -1532 +1902 @@
 
 
-/* 
-  netr_DsRAddressToSitenamesExW 
+/*
+  netr_DsRAddressToSitenamesExW
 */
 static WERROR dcesrv_netr_DsRAddressToSitenamesExW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                                                    struct netr_DsRAddressToSitenamesExW *r)
 {
+        struct ldb_context *sam_ctx;
         struct netr_DsRAddressToSitenamesExWCtr *ctr;
-        int i;
-
-        /* we should map the provided IPs to site names, once we have
-         * sites support
-         */
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        sa_family_t sin_family;
+        struct sockaddr_in *addr;
+#ifdef HAVE_IPV6
+        struct sockaddr_in6 *addr6;
+        char addr_str[INET6_ADDRSTRLEN];
+#else
+        char addr_str[INET_ADDRSTRLEN];
+#endif
+        char *subnet_name;
+        const char *res;
+        uint32_t i;
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return WERR_DS_UNAVAILABLE;
+        }
+
         ctr = talloc(mem_ctx, struct netr_DsRAddressToSitenamesExWCtr);
         W_ERROR_HAVE_NO_MEMORY(ctr);
@@ -1556 +1941 @@
 
         for (i=0; i<ctr->count; i++) {
-                ctr->sitename[i].string   = "Default-First-Site-Name";
+                ctr->sitename[i].string = NULL;
                 ctr->subnetname[i].string = NULL;
+
+                if (r->in.addresses[i].size < sizeof(sa_family_t)) {
+                        continue;
+                }
+                /* The first two byte of the buffer are reserved for the
+                 * "sin_family" but for now only the first one is used. */
+                sin_family = r->in.addresses[i].buffer[0];
+
+                switch (sin_family) {
+                case AF_INET:
+                        if (r->in.addresses[i].size < sizeof(struct sockaddr_in)) {
+                                continue;
+                        }
+                        addr = (struct sockaddr_in *) r->in.addresses[i].buffer;
+                        res = inet_ntop(AF_INET, &addr->sin_addr,
+                                        addr_str, sizeof(addr_str));
+                        break;
+#ifdef HAVE_IPV6
+                case AF_INET6:
+                        if (r->in.addresses[i].size < sizeof(struct sockaddr_in6)) {
+                                continue;
+                        }
+                        addr6 = (struct sockaddr_in6 *) r->in.addresses[i].buffer;
+                        res = inet_ntop(AF_INET6, &addr6->sin6_addr,
+                                        addr_str, sizeof(addr_str));
+                        break;
+#endif
+                default:
+                        continue;
+                }
+
+                if (res == NULL) {
+                        continue;
+                }
+
+                ctr->sitename[i].string   = samdb_client_site_name(sam_ctx,
+                                                                   mem_ctx,
+                                                                   addr_str,
+                                                                   &subnet_name);
+                W_ERROR_HAVE_NO_MEMORY(ctr->sitename[i].string);
+                ctr->subnetname[i].string = subnet_name;
         }
 
@@ -1564 +1990 @@
 
 
-/* 
+/*
+  netr_DsRAddressToSitenamesW
+*/
+static WERROR dcesrv_netr_DsRAddressToSitenamesW(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                       struct netr_DsRAddressToSitenamesW *r)
+{
+        struct netr_DsRAddressToSitenamesExW r2;
+        struct netr_DsRAddressToSitenamesWCtr *ctr;
+        uint32_t i;
+        WERROR werr;
+
+        ZERO_STRUCT(r2);
+
+        r2.in.server_name = r->in.server_name;
+        r2.in.count = r->in.count;
+        r2.in.addresses = r->in.addresses;
+
+        r2.out.ctr = talloc(mem_ctx, struct netr_DsRAddressToSitenamesExWCtr *);
+        W_ERROR_HAVE_NO_MEMORY(r2.out.ctr);
+
+        ctr = talloc(mem_ctx, struct netr_DsRAddressToSitenamesWCtr);
+        W_ERROR_HAVE_NO_MEMORY(ctr);
+
+        *r->out.ctr = ctr;
+
+        ctr->count = r->in.count;
+        ctr->sitename = talloc_array(ctr, struct lsa_String, ctr->count);
+        W_ERROR_HAVE_NO_MEMORY(ctr->sitename);
+
+        werr = dcesrv_netr_DsRAddressToSitenamesExW(dce_call, mem_ctx, &r2);
+
+        for (i=0; i<ctr->count; i++) {
+                ctr->sitename[i].string   = (*r2.out.ctr)->sitename[i].string;
+        }
+
+        return werr;
+}
+
+
+/*
   netr_DsrGetDcSiteCoverageW
 */
@@ -1570 +2035 @@
                        struct netr_DsrGetDcSiteCoverageW *r)
 {
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/* 
-  netr_DsrEnumerateDomainTrusts 
-*/
-static WERROR dcesrv_netr_DsrEnumerateDomainTrusts(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                                              struct netr_DsrEnumerateDomainTrusts *r)
+        struct ldb_context *sam_ctx;
+        struct DcSitesCtr *ctr;
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return WERR_DS_UNAVAILABLE;
+        }
+
+        ctr = talloc(mem_ctx, struct DcSitesCtr);
+        W_ERROR_HAVE_NO_MEMORY(ctr);
+
+        *r->out.ctr = ctr;
+
+        /* For now only return our default site */
+        ctr->num_sites = 1;
+        ctr->sites = talloc_array(ctr, struct lsa_String, ctr->num_sites);
+        W_ERROR_HAVE_NO_MEMORY(ctr->sites);
+        ctr->sites[0].string = samdb_server_site_name(sam_ctx, mem_ctx);
+        W_ERROR_HAVE_NO_MEMORY(ctr->sites[0].string);
+
+        return WERR_OK;
+}
+
+
+#define GET_CHECK_STR(dest, mem, msg, attr) \
+do {\
+        const char *s; \
+        s = ldb_msg_find_attr_as_string(msg, attr, NULL); \
+        if (!s) { \
+                DEBUG(0, ("DB Error, TustedDomain entry (%s) " \
+                          "without flatname\n", \
+                          ldb_dn_get_linearized(msg->dn))); \
+                continue; \
+        } \
+        dest = talloc_strdup(mem, s); \
+        W_ERROR_HAVE_NO_MEMORY(dest); \
+} while(0)
+
+
+static WERROR fill_trusted_domains_array(TALLOC_CTX *mem_ctx,
+                                         struct ldb_context *sam_ctx,
+                                         struct netr_DomainTrustList *trusts,
+                                         uint32_t trust_flags)
+{
+        struct ldb_dn *system_dn;
+        struct ldb_message **dom_res = NULL;
+        const char *trust_attrs[] = { "flatname", "trustPartner",
+                                      "securityIdentifier", "trustDirection",
+                                      "trustType", "trustAttributes", NULL };
+        uint32_t n;
+        int i;
+        int ret;
+
+        if (!(trust_flags & (NETR_TRUST_FLAG_INBOUND |
+                             NETR_TRUST_FLAG_OUTBOUND))) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        system_dn = samdb_search_dn(sam_ctx, mem_ctx,
+                                    ldb_get_default_basedn(sam_ctx),
+                                    "(&(objectClass=container)(cn=System))");
+        if (!system_dn) {
+                return WERR_GENERAL_FAILURE;
+        }
+
+        ret = gendb_search(sam_ctx, mem_ctx, system_dn,
+                           &dom_res, trust_attrs,
+                           "(objectclass=trustedDomain)");
+
+        for (i = 0; i < ret; i++) {
+                unsigned int trust_dir;
+                uint32_t flags = 0;
+
+                trust_dir = ldb_msg_find_attr_as_uint(dom_res[i],
+                                                      "trustDirection", 0);
+
+                if (trust_dir & LSA_TRUST_DIRECTION_INBOUND) {
+                        flags |= NETR_TRUST_FLAG_INBOUND;
+                }
+                if (trust_dir & LSA_TRUST_DIRECTION_OUTBOUND) {
+                        flags |= NETR_TRUST_FLAG_OUTBOUND;
+                }
+
+                if (!(flags & trust_flags)) {
+                        /* this trust direction was not requested */
+                        continue;
+                }
+
+                n = trusts->count;
+                trusts->array = talloc_realloc(trusts, trusts->array,
+                                               struct netr_DomainTrust,
+                                               n + 1);
+                W_ERROR_HAVE_NO_MEMORY(trusts->array);
+
+                GET_CHECK_STR(trusts->array[n].netbios_name, trusts,
+                              dom_res[i], "flatname");
+                GET_CHECK_STR(trusts->array[n].dns_name, trusts,
+                              dom_res[i], "trustPartner");
+
+                trusts->array[n].trust_flags = flags;
+                if ((trust_flags & NETR_TRUST_FLAG_IN_FOREST) &&
+                    !(flags & NETR_TRUST_FLAG_TREEROOT)) {
+                        /* TODO: find if we have parent in the list */
+                        trusts->array[n].parent_index = 0;
+                }
+
+                trusts->array[n].trust_type =
+                                ldb_msg_find_attr_as_uint(dom_res[i],
+                                                  "trustType", 0);
+                trusts->array[n].trust_attributes =
+                                ldb_msg_find_attr_as_uint(dom_res[i],
+                                                  "trustAttributes", 0);
+
+                if ((trusts->array[n].trust_type == NETR_TRUST_TYPE_MIT) ||
+                    (trusts->array[n].trust_type == NETR_TRUST_TYPE_DCE)) {
+                        struct dom_sid zero_sid;
+                        ZERO_STRUCT(zero_sid);
+                        trusts->array[n].sid =
+                                dom_sid_dup(trusts, &zero_sid);
+                } else {
+                        trusts->array[n].sid =
+                                samdb_result_dom_sid(trusts, dom_res[i],
+                                                     "securityIdentifier");
+                }
+                trusts->array[n].guid = GUID_zero();
+
+                trusts->count = n + 1;
+        }
+
+        talloc_free(dom_res);
+        return WERR_OK;
+}
+
+/*
+  netr_DsrEnumerateDomainTrusts
+*/
+static WERROR dcesrv_netr_DsrEnumerateDomainTrusts(struct dcesrv_call_state *dce_call,
+                                                   TALLOC_CTX *mem_ctx,
+                                                   struct netr_DsrEnumerateDomainTrusts *r)
 {
         struct netr_DomainTrustList *trusts;
@@ -1585 +2182 @@
         struct ldb_message **dom_res;
         const char * const dom_attrs[] = { "objectSid", "objectGUID", NULL };
-
-        ZERO_STRUCT(r->out);
-
-        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, dce_call->conn->auth_state.session_info);
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        const char *dnsdomain = lpcfg_dnsdomain(lp_ctx);
+        const char *p;
+        WERROR werr;
+
+        if (r->in.trust_flags & 0xFFFFFE00) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        /* TODO: turn to hard check once we are sure this is 100% correct */
+        if (!r->in.server_name) {
+                DEBUG(3, ("Invalid domain! Expected name in domain [%s]. "
+                          "But received NULL!\n", dnsdomain));
+        } else {
+                p = strchr(r->in.server_name, '.');
+                if (!p) {
+                        DEBUG(3, ("Invalid domain! Expected name in domain "
+                                  "[%s]. But received [%s]!\n",
+                                  dnsdomain, r->in.server_name));
+                        p = r->in.server_name;
+                } else {
+                        p++;
+                }
+                if (strcasecmp(p, dnsdomain)) {
+                        DEBUG(3, ("Invalid domain! Expected name in domain "
+                                  "[%s]. But received [%s]!\n",
+                                  dnsdomain, r->in.server_name));
+                }
+        }
+
+        trusts = talloc_zero(mem_ctx, struct netr_DomainTrustList);
+        W_ERROR_HAVE_NO_MEMORY(trusts);
+
+        trusts->count = 0;
+        r->out.trusts = trusts;
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
         if (sam_ctx == NULL) {
                 return WERR_GENERAL_FAILURE;
         }
 
-        ret = gendb_search_dn(sam_ctx, mem_ctx, NULL,
-                              &dom_res, dom_attrs);
-        if (ret == -1) {
-                return WERR_GENERAL_FAILURE;            
-        }
+        if ((r->in.trust_flags & NETR_TRUST_FLAG_INBOUND) ||
+            (r->in.trust_flags & NETR_TRUST_FLAG_OUTBOUND)) {
+
+                werr = fill_trusted_domains_array(mem_ctx, sam_ctx,
+                                                  trusts, r->in.trust_flags);
+                W_ERROR_NOT_OK_RETURN(werr);
+        }
+
+        /* NOTE: we currently are always the root of the forest */
+        if (r->in.trust_flags & NETR_TRUST_FLAG_IN_FOREST) {
+                uint32_t n = trusts->count;
+
+                ret = gendb_search_dn(sam_ctx, mem_ctx, NULL,
+                                      &dom_res, dom_attrs);
+                if (ret != 1) {
+                        return WERR_GENERAL_FAILURE;
+                }
+
+                trusts->count = n + 1;
+                trusts->array = talloc_realloc(trusts, trusts->array,
+                                               struct netr_DomainTrust,
+                                               trusts->count);
+                W_ERROR_HAVE_NO_MEMORY(trusts->array);
+
+                trusts->array[n].netbios_name = lpcfg_workgroup(lp_ctx);
+                trusts->array[n].dns_name = lpcfg_dnsdomain(lp_ctx);
+                trusts->array[n].trust_flags =
+                        NETR_TRUST_FLAG_NATIVE |
+                        NETR_TRUST_FLAG_TREEROOT |
+                        NETR_TRUST_FLAG_IN_FOREST |
+                        NETR_TRUST_FLAG_PRIMARY;
+                /* we are always the root domain for now */
+                trusts->array[n].parent_index = 0;
+                trusts->array[n].trust_type = NETR_TRUST_TYPE_UPLEVEL;
+                trusts->array[n].trust_attributes = 0;
+                trusts->array[n].sid = samdb_result_dom_sid(mem_ctx,
+                                                            dom_res[0],
+                                                            "objectSid");
+                trusts->array[n].guid = samdb_result_guid(dom_res[0],
+                                                          "objectGUID");
+                talloc_free(dom_res);
+        }
+
+        return WERR_OK;
+}
+
+
+/*
+  netr_DsrDeregisterDNSHostRecords
+*/
+static WERROR dcesrv_netr_DsrDeregisterDNSHostRecords(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                       struct netr_DsrDeregisterDNSHostRecords *r)
+{
+        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+}
+
+
+/*
+  netr_ServerTrustPasswordsGet
+*/
+static NTSTATUS dcesrv_netr_ServerTrustPasswordsGet(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                       struct netr_ServerTrustPasswordsGet *r)
+{
+        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+}
+
+
+static WERROR fill_forest_trust_array(TALLOC_CTX *mem_ctx,
+                                      struct ldb_context *sam_ctx,
+                                      struct loadparm_context *lp_ctx,
+                                      struct lsa_ForestTrustInformation *info)
+{
+        struct lsa_ForestTrustDomainInfo *domain_info;
+        struct lsa_ForestTrustRecord *e;
+        struct ldb_message **dom_res;
+        const char * const dom_attrs[] = { "objectSid", NULL };
+        int ret;
+
+        /* we need to provide 2 entries:
+         * 1. the Root Forest name
+         * 2. the Domain Information
+         */
+
+        info->count = 2;
+        info->entries = talloc_array(info, struct lsa_ForestTrustRecord *, 2);
+        W_ERROR_HAVE_NO_MEMORY(info->entries);
+
+        /* Forest root info */
+        e = talloc(info, struct lsa_ForestTrustRecord);
+        W_ERROR_HAVE_NO_MEMORY(e);
+
+        e->flags = 0;
+        e->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME;
+        e->time = 0; /* so far always 0 in trces. */
+        e->forest_trust_data.top_level_name.string = samdb_forest_name(sam_ctx,
+                                                                       mem_ctx);
+        W_ERROR_HAVE_NO_MEMORY(e->forest_trust_data.top_level_name.string);
+
+        info->entries[0] = e;
+
+        /* Domain info */
+        e = talloc(info, struct lsa_ForestTrustRecord);
+        W_ERROR_HAVE_NO_MEMORY(e);
+
+        /* get our own domain info */
+        ret = gendb_search_dn(sam_ctx, mem_ctx, NULL, &dom_res, dom_attrs);
         if (ret != 1) {
                 return WERR_GENERAL_FAILURE;
         }
 
-        trusts = talloc(mem_ctx, struct netr_DomainTrustList);
-        W_ERROR_HAVE_NO_MEMORY(trusts);
-
-        trusts->array = talloc_array(trusts, struct netr_DomainTrust, ret);
-        W_ERROR_HAVE_NO_MEMORY(trusts->array);
-
-        trusts->count = 1; /* ?? */
-
-        r->out.trusts = trusts;
-
-        /* TODO: add filtering by trust_flags, and correct trust_type
-           and attributes */
-        trusts->array[0].netbios_name = lp_sam_name(dce_call->conn->dce_ctx->lp_ctx);
-        trusts->array[0].dns_name     = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
-        trusts->array[0].trust_flags =
-                NETR_TRUST_FLAG_TREEROOT | 
-                NETR_TRUST_FLAG_IN_FOREST | 
-                NETR_TRUST_FLAG_PRIMARY;
-        trusts->array[0].parent_index = 0;
-        trusts->array[0].trust_type = 2;
-        trusts->array[0].trust_attributes = 0;
-        trusts->array[0].sid  = samdb_result_dom_sid(mem_ctx, dom_res[0], "objectSid");
-        trusts->array[0].guid = samdb_result_guid(dom_res[0], "objectGUID");
+        /* TODO: check if disabled and set flags accordingly */
+        e->flags = 0;
+        e->type = LSA_FOREST_TRUST_DOMAIN_INFO;
+        e->time = 0; /* so far always 0 in traces. */
+
+        domain_info = &e->forest_trust_data.domain_info;
+        domain_info->domain_sid = samdb_result_dom_sid(info, dom_res[0],
+                                                       "objectSid");
+        domain_info->dns_domain_name.string = lpcfg_dnsdomain(lp_ctx);
+        domain_info->netbios_domain_name.string = lpcfg_workgroup(lp_ctx);
+
+        info->entries[1] = e;
+
+        talloc_free(dom_res);
 
         return WERR_OK;
 }
 
-
-/*
-  netr_DsrDeregisterDNSHostRecords
-*/
-static WERROR dcesrv_netr_DsrDeregisterDNSHostRecords(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct netr_DsrDeregisterDNSHostRecords *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/*
-  netr_ServerTrustPasswordsGet
-*/
-static NTSTATUS dcesrv_netr_ServerTrustPasswordsGet(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct netr_ServerTrustPasswordsGet *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
-/* 
-  netr_DsRGetForestTrustInformation 
-*/
-static WERROR dcesrv_netr_DsRGetForestTrustInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct netr_DsRGetForestTrustInformation *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+/*
+  netr_DsRGetForestTrustInformation
+*/
+static WERROR dcesrv_netr_DsRGetForestTrustInformation(struct dcesrv_call_state *dce_call,
+                                                       TALLOC_CTX *mem_ctx,
+                                                       struct netr_DsRGetForestTrustInformation *r)
+{
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        struct lsa_ForestTrustInformation *info, **info_ptr;
+        struct ldb_context *sam_ctx;
+        WERROR werr;
+
+        if (r->in.flags & 0xFFFFFFFE) {
+                return WERR_INVALID_FLAGS;
+        }
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return WERR_GENERAL_FAILURE;
+        }
+
+        if (r->in.flags & DS_GFTI_UPDATE_TDO) {
+                if (!samdb_is_pdc(sam_ctx)) {
+                        return WERR_NERR_NOTPRIMARY;
+                }
+
+                if (r->in.trusted_domain_name == NULL) {
+                        return WERR_INVALID_FLAGS;
+                }
+
+                /* TODO: establish an schannel connection with
+                 * r->in.trusted_domain_name and perform a
+                 * netr_GetForestTrustInformation call against it */
+
+                /* for now return not implementd */
+                return WERR_CALL_NOT_IMPLEMENTED;
+        }
+
+        /* TODO: check r->in.server_name is our name */
+
+        info_ptr = talloc(mem_ctx, struct lsa_ForestTrustInformation *);
+        W_ERROR_HAVE_NO_MEMORY(info_ptr);
+
+        info = talloc_zero(info_ptr, struct lsa_ForestTrustInformation);
+        W_ERROR_HAVE_NO_MEMORY(info);
+
+        werr = fill_forest_trust_array(mem_ctx, sam_ctx, lp_ctx, info);
+        W_ERROR_NOT_OK_RETURN(werr);
+
+        *info_ptr = info;
+        r->out.forest_trust_info = info_ptr;
+
+        return WERR_OK;
 }
 
@@ -1663 +2412 @@
   netr_GetForestTrustInformation
 */
-static WERROR dcesrv_netr_GetForestTrustInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-                       struct netr_GetForestTrustInformation *r)
-{
-        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+static NTSTATUS dcesrv_netr_GetForestTrustInformation(struct dcesrv_call_state *dce_call,
+                                                      TALLOC_CTX *mem_ctx,
+                                                      struct netr_GetForestTrustInformation *r)
+{
+        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
+        struct netlogon_creds_CredentialState *creds;
+        struct lsa_ForestTrustInformation *info, **info_ptr;
+        struct ldb_context *sam_ctx;
+        NTSTATUS status;
+        WERROR werr;
+
+        status = dcesrv_netr_creds_server_step_check(dce_call,
+                                                     mem_ctx,
+                                                     r->in.computer_name,
+                                                     r->in.credential,
+                                                     r->out.return_authenticator,
+                                                     &creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        if ((creds->secure_channel_type != SEC_CHAN_DNS_DOMAIN) &&
+            (creds->secure_channel_type != SEC_CHAN_DOMAIN)) {
+                return NT_STATUS_NOT_IMPLEMENTED;
+        }
+
+        sam_ctx = samdb_connect(mem_ctx, dce_call->event_ctx, lp_ctx,
+                                dce_call->conn->auth_state.session_info, 0);
+        if (sam_ctx == NULL) {
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        /* TODO: check r->in.server_name is our name */
+
+        info_ptr = talloc(mem_ctx, struct lsa_ForestTrustInformation *);
+        if (!info_ptr) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        info = talloc_zero(info_ptr, struct lsa_ForestTrustInformation);
+        if (!info) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        werr = fill_forest_trust_array(mem_ctx, sam_ctx, lp_ctx, info);
+        if (!W_ERROR_IS_OK(werr)) {
+                return werror_to_ntstatus(werr);
+        }
+
+        *info_ptr = info;
+        r->out.forest_trust_info = info_ptr;
+
+        return NT_STATUS_OK;
 }
 
@@ -1679 +2476 @@
 }
 
+/*
+  netr_Unused47
+*/
+static NTSTATUS dcesrv_netr_Unused47(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                                     struct netr_Unused47 *r)
+{
+        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+}
+
+
+struct netr_dnsupdate_RODC_state {
+        struct dcesrv_call_state *dce_call;
+        struct netr_DsrUpdateReadOnlyServerDnsRecords *r;
+        struct dnsupdate_RODC *r2;
+};
+
+/*
+  called when the forwarded RODC dns update request is finished
+ */
+static void netr_dnsupdate_RODC_callback(struct tevent_req *subreq)
+{
+        struct netr_dnsupdate_RODC_state *st =
+                tevent_req_callback_data(subreq,
+                                         struct netr_dnsupdate_RODC_state);
+        NTSTATUS status;
+
+        status = dcerpc_dnsupdate_RODC_r_recv(subreq, st->dce_call);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,(__location__ ": IRPC callback failed %s\n", nt_errstr(status)));
+                st->dce_call->fault_code = DCERPC_FAULT_CANT_PERFORM;
+        }
+
+        st->r->out.dns_names = talloc_steal(st->dce_call, st->r2->out.dns_names);
+
+        status = dcesrv_reply(st->dce_call);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,(__location__ ": dcesrv_reply() failed - %s\n", nt_errstr(status)));
+        }
+}
+
+/*
+  netr_DsrUpdateReadOnlyServerDnsRecords
+*/
+static NTSTATUS dcesrv_netr_DsrUpdateReadOnlyServerDnsRecords(struct dcesrv_call_state *dce_call,
+                                                              TALLOC_CTX *mem_ctx,
+                                                              struct netr_DsrUpdateReadOnlyServerDnsRecords *r)
+{
+        struct netlogon_creds_CredentialState *creds;
+        NTSTATUS nt_status;
+        struct dcerpc_binding_handle *binding_handle;
+        struct netr_dnsupdate_RODC_state *st;
+        struct tevent_req *subreq;
+
+        nt_status = dcesrv_netr_creds_server_step_check(dce_call,
+                                                        mem_ctx,
+                                                        r->in.computer_name,
+                                                        r->in.credential,
+                                                        r->out.return_authenticator,
+                                                        &creds);
+        NT_STATUS_NOT_OK_RETURN(nt_status);
+
+        if (creds->secure_channel_type != SEC_CHAN_RODC) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        st = talloc_zero(mem_ctx, struct netr_dnsupdate_RODC_state);
+        NT_STATUS_HAVE_NO_MEMORY(st);
+
+        st->dce_call = dce_call;
+        st->r = r;
+        st->r2 = talloc_zero(st, struct dnsupdate_RODC);
+        NT_STATUS_HAVE_NO_MEMORY(st->r2);
+
+        st->r2->in.dom_sid = creds->sid;
+        st->r2->in.site_name = r->in.site_name;
+        st->r2->in.dns_ttl = r->in.dns_ttl;
+        st->r2->in.dns_names = r->in.dns_names;
+        st->r2->out.dns_names = r->out.dns_names;
+
+        binding_handle = irpc_binding_handle_by_name(st, dce_call->msg_ctx,
+                                                     "dnsupdate", &ndr_table_irpc);
+        if (binding_handle == NULL) {
+                DEBUG(0,("Failed to get binding_handle for dnsupdate task\n"));
+                dce_call->fault_code = DCERPC_FAULT_CANT_PERFORM;
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+
+        /* forward the call */
+        subreq = dcerpc_dnsupdate_RODC_r_send(st, dce_call->event_ctx,
+                                              binding_handle, st->r2);
+        NT_STATUS_HAVE_NO_MEMORY(subreq);
+
+        dce_call->state_flags |= DCESRV_CALL_STATE_FLAG_ASYNC;
+
+        /* setup the callback */
+        tevent_req_set_callback(subreq, netr_dnsupdate_RODC_callback, st);
+
+        return NT_STATUS_OK;
+}
+
 
 /* include the generated boilerplate */