From f7c26ead133ab9b67c6802a2303a22fd98e3c41a Mon Sep 17 00:00:00 2001

From: Samuel Cabrero <scabrero@suse.de>

Date: Wed, 21 Dec 2022 15:53:04 +0100

Subject: [PATCH 1/9] CVE-2022-38023 s3:rpc_server/netlogon: 'server schannel

 != yes' warning to dcesrv_interface_netlogon_bind

Follow s4 netlogon server changes and move the checks to the RPC bind

hook. Next commits will remove the s3 netr_creds_server_step_check()

function.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>

Reviewed-by: Andreas Schneider <asn@samba.org>

(cherry picked from commit 8141eae47aad849741beb138fae866c772e4ec4c)

---

 source3/rpc_server/netlogon/srv_netlog_nt.c | 39 +++++++++++++++------

 1 file changed, 28 insertions(+), 11 deletions(-)

diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c

index 5906464a9f3..a3853d482df 100644

--- a/source3/rpc_server/netlogon/srv_netlog_nt.c

+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c

@@ -1081,7 +1081,6 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p,

 	enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NONE;

 	uint16_t opnum = dce_call->pkt.u.request.opnum;

 	const char *opname = "<unknown>";

-	static bool warned_global_once = false;

 	if (creds_out != NULL) {

 		*creds_out = NULL;

@@ -1143,16 +1142,6 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p,

 		return NT_STATUS_ACCESS_DENIED;

 	}

-	if (!schannel_global_required && !warned_global_once) {

-		/*

-		 * We want admins to notice their misconfiguration!

-		 */

-		DBG_ERR("CVE-2020-1472(ZeroLogon): "

-			"Please configure 'server schannel = yes', "

-			"See https://bugzilla.samba.org/show_bug.cgi?id=14497\n");

-		warned_global_once = true;

-	}

-

 	if (auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {

 		DBG_ERR("CVE-2020-1472(ZeroLogon): "

 			"%s request (opnum[%u]) WITH schannel from "

@@ -2997,5 +2986,33 @@ NTSTATUS _netr_DsrUpdateReadOnlyServerDnsRecords(struct pipes_struct *p,

 	return NT_STATUS_NOT_IMPLEMENTED;

 }

+/*

+ * Define the bind function that will be used by ndr_netlogon_scompat.c,

+ * included at the bottom of this file.

+ */

+#define DCESRV_INTERFACE_NETLOGON_BIND(context, iface) \

+       dcesrv_interface_netlogon_bind(context, iface)

+

+static NTSTATUS dcesrv_interface_netlogon_bind(struct dcesrv_connection_context *context,

+					       const struct dcesrv_interface *iface)

+{

+	struct loadparm_context *lp_ctx = context->conn->dce_ctx->lp_ctx;

+	int schannel = lpcfg_server_schannel(lp_ctx);

+	bool schannel_global_required = (schannel == true);

+	static bool warned_global_schannel_once = false;

+

+	if (!schannel_global_required && !warned_global_schannel_once) {

+		/*

+		 * We want admins to notice their misconfiguration!

+		 */

+		D_ERR("CVE-2020-1472(ZeroLogon): "

+		      "Please configure 'server schannel = yes' (the default), "

+		      "See https://bugzilla.samba.org/show_bug.cgi?id=14497\n");

+		warned_global_schannel_once = true;

+	}

+

+	return NT_STATUS_OK;

+}

+

 /* include the generated boilerplate */

 #include "librpc/gen_ndr/ndr_netlogon_scompat.c"

-- 

2.39.0

From 1790cc254c10dfc0deb5ff84ff18a5f24bfd3f44 Mon Sep 17 00:00:00 2001

From: Samuel Cabrero <scabrero@suse.de>

Date: Thu, 22 Dec 2022 16:46:15 +0100

Subject: [PATCH 2/9] CVE-2022-38023 selftest:Samba3: avoid global 'server

 schannel = auto'

Instead of using the generic deprecated option use the specific

server require schannel:COMPUTERACCOUNT = no in order to allow

legacy tests for pass.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>

Reviewed-by: Andreas Schneider <asn@samba.org>

(cherry picked from commit 3cd18690f83d2f85e847fc703ac127b4b04189fc)

---

 selftest/target/Samba3.pm | 16 +++++++++++++++-

 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm

index 0b720a68927..b58f3d45118 100755

--- a/selftest/target/Samba3.pm

+++ b/selftest/target/Samba3.pm

@@ -271,9 +271,23 @@ sub setup_nt4_dc

 	lanman auth = yes

 	ntlm auth = yes

 	raw NTLMv2 auth = yes

-	server schannel = auto

 	rpc start on demand helpers = false

+	CVE_2020_1472:warn_about_unused_debug_level = 3

+	server require schannel:schannel0\$ = no

+	server require schannel:schannel1\$ = no

+	server require schannel:schannel2\$ = no

+	server require schannel:schannel3\$ = no

+	server require schannel:schannel4\$ = no

+	server require schannel:schannel5\$ = no

+	server require schannel:schannel6\$ = no

+	server require schannel:schannel7\$ = no

+	server require schannel:schannel8\$ = no

+	server require schannel:schannel9\$ = no

+	server require schannel:schannel10\$ = no

+	server require schannel:schannel11\$ = no

+	server require schannel:torturetest\$ = no

+

 	fss: sequence timeout = 1

 	check parent directory delete on close = yes

 ";

-- 

2.39.0

From 0e7e7ddbf5524b8aec595227a04cb09599c61a81 Mon Sep 17 00:00:00 2001

From: Samuel Cabrero <scabrero@samba.org>

Date: Thu, 5 Jan 2023 18:13:09 +0100

Subject: [PATCH 3/9] CVE-2022-38023 s4:rpc_server:wscript: Reformat following

 pycodestyle

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>

Reviewed-by: Andreas Schneider <asn@samba.org>

(cherry picked from commit d9e6b490db3ead7e79bb3ff0c1f9ef8ab8bdc65b)

---

 source4/rpc_server/wscript_build | 290 ++++++++++++++++++-------------

 1 file changed, 168 insertions(+), 122 deletions(-)

diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build

index 8c756721232..e7bb773d719 100644

--- a/source4/rpc_server/wscript_build

+++ b/source4/rpc_server/wscript_build

@@ -1,174 +1,220 @@

 #!/usr/bin/env python

 bld.SAMBA_SUBSYSTEM('DCERPC_SHARE',

-	source='common/share_info.c',

-	autoproto='common/share.h',

-	deps='ldb share',

-	enabled=bld.CONFIG_SET('WITH_NTVFS_FILESERVER'),

-	)

+                    source='common/share_info.c',

+                    autoproto='common/share.h',

+                    deps='ldb share',

+                    enabled=bld.CONFIG_SET('WITH_NTVFS_FILESERVER'),

+                    )

 bld.SAMBA_SUBSYSTEM('DCERPC_COMMON',

-	source='common/server_info.c common/forward.c common/loadparm.c',

-	autoproto='common/proto.h',

-	deps='ldb DCERPC_SHARE',

-	enabled=bld.AD_DC_BUILD_IS_ENABLED()

-	)

+                    source='''

+                           common/server_info.c

+                           common/forward.c

+                           common/loadparm.c

+                           ''',

+                    autoproto='common/proto.h',

+                    deps='ldb DCERPC_SHARE',

+                    enabled=bld.AD_DC_BUILD_IS_ENABLED()

+                    )

 bld.SAMBA_LIBRARY('dcerpc_server',

-	source='dcerpc_server.c',

-	pc_files='dcerpc_server.pc',

-	deps='LIBCLI_AUTH ndr samba_server_gensec service auth',

-	public_deps='dcerpc dcerpc-server-core',

-	autoproto='dcerpc_server_proto.h',

-	public_headers='dcerpc_server.h',

-	vnum='0.0.1',

-	enabled=bld.AD_DC_BUILD_IS_ENABLED()

-	)

+                  source='dcerpc_server.c',

+                  pc_files='dcerpc_server.pc',

+                  deps='LIBCLI_AUTH ndr samba_server_gensec service auth',

+                  public_deps='dcerpc dcerpc-server-core',

+                  autoproto='dcerpc_server_proto.h',

+                  public_headers='dcerpc_server.h',

+                  vnum='0.0.1',

+                  enabled=bld.AD_DC_BUILD_IS_ENABLED()

+                  )

 bld.SAMBA_MODULE('dcerpc_rpcecho',

-	source='echo/rpc_echo.c',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_rpcecho_init',

-	deps='ndr-standard events'

-	)

+                 source='echo/rpc_echo.c',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_rpcecho_init',

+                 deps='ndr-standard events'

+                 )

 bld.SAMBA_MODULE('dcerpc_epmapper',

-	source='epmapper/rpc_epmapper.c',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_epmapper_init',

-	deps='NDR_EPMAPPER'

-	)

+                 source='epmapper/rpc_epmapper.c',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_epmapper_init',

+                 deps='NDR_EPMAPPER'

+                 )

 bld.SAMBA_MODULE('dcerpc_remote',

-	source='remote/dcesrv_remote.c',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_remote_init',

-	deps='LIBCLI_SMB ndr-table'

-	)

+                 source='remote/dcesrv_remote.c',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_remote_init',

+                 deps='LIBCLI_SMB ndr-table'

+                 )

 bld.SAMBA_MODULE('dcerpc_srvsvc',

-	source='srvsvc/dcesrv_srvsvc.c srvsvc/srvsvc_ntvfs.c',

-	autoproto='srvsvc/proto.h',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_srvsvc_init',

-	deps='DCERPC_COMMON NDR_SRVSVC share ntvfs',

-	enabled=bld.CONFIG_SET('WITH_NTVFS_FILESERVER')

-	)

+                 source='srvsvc/dcesrv_srvsvc.c srvsvc/srvsvc_ntvfs.c',

+                 autoproto='srvsvc/proto.h',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_srvsvc_init',

+                 deps='DCERPC_COMMON NDR_SRVSVC share ntvfs',

+                 enabled=bld.CONFIG_SET('WITH_NTVFS_FILESERVER')

+                 )

 bld.SAMBA_MODULE('dcerpc_wkssvc',

-	source='wkssvc/dcesrv_wkssvc.c',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_wkssvc_init',

-	deps='DCERPC_COMMON ndr-standard'

-	)

+                 source='wkssvc/dcesrv_wkssvc.c',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_wkssvc_init',

+                 deps='DCERPC_COMMON ndr-standard'

+                 )

 bld.SAMBA_MODULE('dcerpc_unixinfo',

-	source='unixinfo/dcesrv_unixinfo.c',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_unixinfo_init',

-	deps='DCERPC_COMMON samdb NDR_UNIXINFO LIBWBCLIENT_OLD'

-	)

+                 source='unixinfo/dcesrv_unixinfo.c',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_unixinfo_init',

+                 deps='DCERPC_COMMON samdb NDR_UNIXINFO LIBWBCLIENT_OLD'

+                 )

 bld.SAMBA_MODULE('dcesrv_samr',

-	source='samr/dcesrv_samr.c samr/samr_password.c',

-	autoproto='samr/proto.h',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_samr_init',

-	deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS DCERPC_HELPER'

-	)

+                 source='samr/dcesrv_samr.c samr/samr_password.c',

+                 autoproto='samr/proto.h',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_samr_init',

+                 deps='''

+                      samdb

+                      DCERPC_COMMON

+                      ndr-standard

+                      auth4_sam

+                      GNUTLS_HELPERS

+                      DCERPC_HELPER

+                      '''

+                 )

 bld.SAMBA_MODULE('dcerpc_winreg',

-	source='winreg/rpc_winreg.c',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_winreg_init',

-	deps='registry ndr-standard',

-	internal_module=True,

-	enabled=bld.CONFIG_SET('WITH_NTVFS_FILESERVER')

-	)

+                 source='winreg/rpc_winreg.c',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_winreg_init',

+                 deps='registry ndr-standard',

+                 internal_module=True,

+                 enabled=bld.CONFIG_SET('WITH_NTVFS_FILESERVER')

+                 )

 bld.SAMBA_MODULE('dcerpc_netlogon',

-	source='netlogon/dcerpc_netlogon.c',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_netlogon_init',

-	deps='''DCERPC_COMMON RPC_NDR_IRPC COMMON_SCHANNEL ndr-standard auth4_sam samba-hostconfig DSDB_MODULE_HELPERS

-        util_str_escape'''

-	)

+                 source='netlogon/dcerpc_netlogon.c',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_netlogon_init',

+                 deps='''

+                      DCERPC_COMMON

+                      RPC_NDR_IRPC

+                      COMMON_SCHANNEL

+                      ndr-standard

+                      auth4_sam

+                      samba-hostconfig

+                      DSDB_MODULE_HELPERS

+                      util_str_escape

+                      '''

+                 )

 bld.SAMBA_MODULE('dcerpc_lsarpc',

-	source='lsa/dcesrv_lsa.c lsa/lsa_init.c lsa/lsa_lookup.c',

-	autoproto='lsa/proto.h',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_lsa_init',

-	deps='samdb DCERPC_COMMON ndr-standard LIBCLI_AUTH NDR_DSSETUP com_err samba-security UTIL_LSARPC'

-	)

+                 source='lsa/dcesrv_lsa.c lsa/lsa_init.c lsa/lsa_lookup.c',

+                 autoproto='lsa/proto.h',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_lsa_init',

+                 deps='''

+                      samdb

+                      DCERPC_COMMON

+                      ndr-standard

+                      LIBCLI_AUTH

+                      NDR_DSSETUP

+                      com_err

+                      samba-security

+                      UTIL_LSARPC

+                      '''

+                 )

 bld.SAMBA_MODULE('dcerpc_backupkey',

-		 source='backupkey/dcesrv_backupkey.c ',

-		 autoproto='backupkey/proto.h',

-		 subsystem='dcerpc_server',

-		 init_function='dcerpc_server_backupkey_init',

-		 deps='samdb DCERPC_COMMON NDR_BACKUPKEY RPC_NDR_BACKUPKEY gnutls GNUTLS_HELPERS',

-		 )

+                 source='backupkey/dcesrv_backupkey.c ',

+                 autoproto='backupkey/proto.h',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_backupkey_init',

+                 deps='''

+                      samdb

+                      DCERPC_COMMON

+                      NDR_BACKUPKEY

+                      RPC_NDR_BACKUPKEY

+                      gnutls

+                      GNUTLS_HELPERS

+                      ''',

+                 )

 bld.SAMBA_MODULE('dcerpc_drsuapi',

-	source='drsuapi/dcesrv_drsuapi.c drsuapi/updaterefs.c drsuapi/getncchanges.c drsuapi/addentry.c drsuapi/writespn.c drsuapi/drsutil.c',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_drsuapi_init',

-	deps='samdb DCERPC_COMMON NDR_DRSUAPI samba-security'

-	)

+                 source='''

+                        drsuapi/dcesrv_drsuapi.c

+                        drsuapi/updaterefs.c

+                        drsuapi/getncchanges.c

+                        drsuapi/addentry.c

+                        drsuapi/writespn.c

+                        drsuapi/drsutil.c

+                        ''',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_drsuapi_init',

+                 deps='samdb DCERPC_COMMON NDR_DRSUAPI samba-security'

+                 )

 bld.SAMBA_MODULE('dcerpc_browser',

-	source='browser/dcesrv_browser.c',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_browser_init',

-	deps='DCERPC_COMMON NDR_BROWSER'

-	)

+                 source='browser/dcesrv_browser.c',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_browser_init',

+                 deps='DCERPC_COMMON NDR_BROWSER'

+                 )

 bld.SAMBA_MODULE('dcerpc_eventlog',

-	source='eventlog/dcesrv_eventlog6.c',

-	subsystem='dcerpc_server',

-	init_function='dcerpc_server_eventlog6_init',

-	deps='DCERPC_COMMON'

-	)

+                 source='eventlog/dcesrv_eventlog6.c',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_eventlog6_init',

+                 deps='DCERPC_COMMON'

+                 )

 bld.SAMBA_MODULE('dcerpc_dnsserver',

-    source='dnsserver/dcerpc_dnsserver.c dnsserver/dnsutils.c dnsserver/dnsdata.c dnsserver/dnsdb.c',

-    subsystem='dcerpc_server',

-    init_function='dcerpc_server_dnsserver_init',

-    deps='DCERPC_COMMON dnsserver_common netif'

-    )

+                 source='''

+                        dnsserver/dcerpc_dnsserver.c

+                        dnsserver/dnsutils.c

+                        dnsserver/dnsdata.c

+                        dnsserver/dnsdb.c

+                        ''',

+                 subsystem='dcerpc_server',

+                 init_function='dcerpc_server_dnsserver_init',

+                 deps='DCERPC_COMMON dnsserver_common netif'

+                 )

 bld.SAMBA_MODULE('service_dcerpc',

-	source='service_rpc.c',

-	autoproto='service_rpc.h',

-	subsystem='service',

-	init_function='server_service_rpc_init',

-	internal_module=False,

-	deps='dcerpc_server'

-	)

-

-bld.SAMBA_BINARY(

-    'test_rpc_dns_server_dnsutils',

-    source='tests/rpc_dns_server_dnsutils_test.c',

-    deps='''

-            dnsserver_common

-            dcerpc_server

-            cmocka

-            talloc

-    ''',

-    for_selftest=True,

-    enabled=bld.AD_DC_BUILD_IS_ENABLED()

-)

+                 source='service_rpc.c',

+                 autoproto='service_rpc.h',

+                 subsystem='service',

+                 init_function='server_service_rpc_init',

+                 internal_module=False,

+                 deps='dcerpc_server'

+                 )

+

+bld.SAMBA_BINARY('test_rpc_dns_server_dnsutils',

+                 source='tests/rpc_dns_server_dnsutils_test.c',

+                 deps='''

+                      dnsserver_common

+                      dcerpc_server

+                      cmocka

+                      talloc

+                      ''',

+                 for_selftest=True,

+                 enabled=bld.AD_DC_BUILD_IS_ENABLED()

+                 )

-- 

2.39.0

From 740422fb6609dac3b0e2c1bb91d61b87e99c64aa Mon Sep 17 00:00:00 2001

From: Samuel Cabrero <scabrero@suse.de>

Date: Thu, 22 Dec 2022 14:03:23 +0100

Subject: [PATCH 4/9] CVE-2022-38023 s4:rpc_server/netlogon: Move schannel and

 credentials check functions to librpc

Will be used later by s3 netlogon server.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Samuel Cabrero <scabrero@samba.org>

Reviewed-by: Andreas Schneider <asn@samba.org>

(cherry picked from commit 121e7b0e39478c5291100652ac92c263f406076b)

---

 librpc/rpc/server/netlogon/schannel_util.c    | 576 ++++++++++++++++++

 librpc/rpc/server/netlogon/schannel_util.h    |  54 ++

 librpc/wscript_build                          |  12 +

 source4/rpc_server/netlogon/dcerpc_netlogon.c | 546 +----------------

 source4/rpc_server/wscript_build              |   2 +-

 5 files changed, 644 insertions(+), 546 deletions(-)

 create mode 100644 librpc/rpc/server/netlogon/schannel_util.c

 create mode 100644 librpc/rpc/server/netlogon/schannel_util.h

diff --git a/librpc/rpc/server/netlogon/schannel_util.c b/librpc/rpc/server/netlogon/schannel_util.c

new file mode 100644

index 00000000000..9b2a88a2628

--- /dev/null

+++ b/librpc/rpc/server/netlogon/schannel_util.c

@@ -0,0 +1,576 @@

+/*

+   Unix SMB/CIFS implementation.

+

+   netlogon schannel utility functions

+

+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2008

+   Copyright (C) Stefan Metzmacher <metze@samba.org>  2005

+   Copyright (C) Matthias Dieter Wallnöfer            2009-2010

+

+   This program is free software; you can redistribute it and/or modify

+   it under the terms of the GNU General Public License as published by

+   the Free Software Foundation; either version 3 of the License, or

+   (at your option) any later version.

+

+   This program is distributed in the hope that it will be useful,

+   but WITHOUT ANY WARRANTY; without even the implied warranty of

+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+   GNU General Public License for more details.

+

+   You should have received a copy of the GNU General Public License

+   along with this program.  If not, see <http://www.gnu.org/licenses/>.

+*/

+

+#include "includes.h"

+#include "schannel_util.h"

+#include "param/param.h"

+#include "libcli/security/dom_sid.h"

+#include "libcli/auth/schannel.h"

+#include "librpc/rpc/dcesrv_core.h"

+#include "librpc/gen_ndr/ndr_netlogon.h"

+#include "lib/util/util_str_escape.h"

+

+struct dcesrv_netr_check_schannel_state {

+	struct dom_sid account_sid;

+	enum dcerpc_AuthType auth_type;

+	enum dcerpc_AuthLevel auth_level;

+

+	bool schannel_global_required;

+	bool schannel_required;

+	bool schannel_explicitly_set;

+

+	bool seal_global_required;

+	bool seal_required;

+	bool seal_explicitly_set;

+

+	NTSTATUS result;

+};

+

+static NTSTATUS dcesrv_netr_check_schannel_get_state(struct dcesrv_call_state *dce_call,

+						     const struct netlogon_creds_CredentialState *creds,

+						     enum dcerpc_AuthType auth_type,

+						     enum dcerpc_AuthLevel auth_level,

+						     struct dcesrv_netr_check_schannel_state **_s)

+{

+	struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;

+	int schannel = lpcfg_server_schannel(lp_ctx);

+	bool schannel_global_required = (schannel == true);

+	bool schannel_required = schannel_global_required;

+	const char *explicit_opt = NULL;

+	bool global_require_seal = lpcfg_server_schannel_require_seal(lp_ctx);

+	bool require_seal = global_require_seal;

+	const char *explicit_seal_opt = NULL;

+#define DCESRV_NETR_CHECK_SCHANNEL_STATE_MAGIC (NETLOGON_SERVER_PIPE_STATE_MAGIC+1)

+	struct dcesrv_netr_check_schannel_state *s = NULL;

+	NTSTATUS status;

+

+	*_s = NULL;

+

+	s = dcesrv_iface_state_find_conn(dce_call,

+			DCESRV_NETR_CHECK_SCHANNEL_STATE_MAGIC,

+			struct dcesrv_netr_check_schannel_state);

+	if (s != NULL) {

+		if (!dom_sid_equal(&s->account_sid, creds->sid)) {

+			goto new_state;

+		}

+		if (s->auth_type != auth_type) {

+			goto new_state;

+		}

+		if (s->auth_level != auth_level) {

+			goto new_state;

+		}

+

+		*_s = s;

+		return NT_STATUS_OK;

+	}

+

+new_state:

+	TALLOC_FREE(s);

+	s = talloc_zero(dce_call,

+			struct dcesrv_netr_check_schannel_state);

+	if (s == NULL) {

+		return NT_STATUS_NO_MEMORY;

+	}

+

+	s->account_sid = *creds->sid;

+	s->auth_type = auth_type;

+	s->auth_level = auth_level;

+	s->result = NT_STATUS_MORE_PROCESSING_REQUIRED;

+

+	/*

+	 * We don't use lpcfg_parm_bool(), as we

+	 * need the explicit_opt pointer in order to

+	 * adjust the debug messages.

+	 */

+	explicit_seal_opt = lpcfg_get_parametric(lp_ctx,

+						 NULL,

+						 "server schannel require seal",

+						 creds->account_name);

+	if (explicit_seal_opt != NULL) {

+		require_seal = lp_bool(explicit_seal_opt);

+	}

+

+	/*

+	 * We don't use lpcfg_parm_bool(), as we

+	 * need the explicit_opt pointer in order to

+	 * adjust the debug messages.

+	 */

+	explicit_opt = lpcfg_get_parametric(lp_ctx,

+					    NULL,

+					    "server require schannel",

+					    creds->account_name);

+	if (explicit_opt != NULL) {

+		schannel_required = lp_bool(explicit_opt);

+	}

+

+	s->schannel_global_required = schannel_global_required;

+	s->schannel_required = schannel_required;

+	s->schannel_explicitly_set = explicit_opt != NULL;

+

+	s->seal_global_required = global_require_seal;

+	s->seal_required = require_seal;

+	s->seal_explicitly_set = explicit_seal_opt != NULL;

+

+	status = dcesrv_iface_state_store_conn(dce_call,

+			DCESRV_NETR_CHECK_SCHANNEL_STATE_MAGIC,

+			s);

+	if (!NT_STATUS_IS_OK(status)) {

+		return status;

+	}

+

+	*_s = s;

+	return NT_STATUS_OK;

+}

+

+static NTSTATUS dcesrv_netr_check_schannel_once(struct dcesrv_call_state *dce_call,

+						struct dcesrv_netr_check_schannel_state *s,

+						const struct netlogon_creds_CredentialState *creds,

+						uint16_t opnum)

+{

+	struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;

+	int CVE_2020_1472_warn_level = lpcfg_parm_int(lp_ctx, NULL,

+		"CVE_2020_1472", "warn_about_unused_debug_level", DBGLVL_ERR);

+	int CVE_2020_1472_error_level = lpcfg_parm_int(lp_ctx, NULL,

+		"CVE_2020_1472", "error_debug_level", DBGLVL_ERR);

+	int CVE_2022_38023_warn_level = lpcfg_parm_int(lp_ctx, NULL,

+		"CVE_2022_38023", "warn_about_unused_debug_level", DBGLVL_ERR);

+	int CVE_2022_38023_error_level = lpcfg_parm_int(lp_ctx, NULL,

+		"CVE_2022_38023", "error_debug_level", DBGLVL_ERR);

+	TALLOC_CTX *frame = talloc_stackframe();

+	unsigned int dbg_lvl = DBGLVL_DEBUG;

+	const char *opname = "<unknown>";

+	const char *reason = "<unknown>";

+

+	if (opnum < ndr_table_netlogon.num_calls) {

+		opname = ndr_table_netlogon.calls[opnum].name;

+	}

+

+	if (s->auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {

+		if (s->auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {

+			reason = "WITH SEALED";

+		} else if (s->auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {

+			reason = "WITH SIGNED";

+		} else {

+			reason = "WITH INVALID";

+			dbg_lvl = DBGLVL_ERR;

+			s->result = NT_STATUS_INTERNAL_ERROR;

+		}

+	} else {

+		reason = "WITHOUT";

+	}

+

+	if (!NT_STATUS_EQUAL(s->result, NT_STATUS_MORE_PROCESSING_REQUIRED)) {

+		if (!NT_STATUS_IS_OK(s->result)) {

+			dbg_lvl = MIN(dbg_lvl, DBGLVL_INFO);