2 Unix SMB/CIFS implementation.
4 DNS server handler for queries
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/service_task.h"
24 #include "libcli/util/werror.h"
25 #include "librpc/ndr/libndr.h"
26 #include "librpc/gen_ndr/ndr_dns.h"
27 #include "librpc/gen_ndr/ndr_dnsp.h"
29 #include "param/param.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "dns_server/dns_server.h"
33 #include "libcli/dns/libdns.h"
34 #include "lib/util/util_net.h"
35 #include "lib/util/tevent_werror.h"
36 #include "auth/auth.h"
37 #include "auth/credentials/credentials.h"
38 #include "auth/gensec/gensec.h"
39 #include "lib/util/dlinklist.h"
41 static WERROR
create_response_rr(const struct dns_name_question
*question
,
42 const struct dnsp_DnssrvRpcRecord
*rec
,
43 struct dns_res_rec
**answers
, uint16_t *ancount
)
45 struct dns_res_rec
*ans
= *answers
;
46 uint16_t ai
= *ancount
;
54 ans
[ai
].rdata
.cname_record
= talloc_strdup(ans
, rec
->data
.cname
);
55 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.cname_record
);
58 ans
[ai
].rdata
.ipv4_record
= talloc_strdup(ans
, rec
->data
.ipv4
);
59 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ipv4_record
);
62 ans
[ai
].rdata
.ipv6_record
= talloc_strdup(ans
, rec
->data
.ipv6
);
63 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ipv6_record
);
66 ans
[ai
].rdata
.ns_record
= talloc_strdup(ans
, rec
->data
.ns
);
67 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ns_record
);
70 ans
[ai
].rdata
.srv_record
.priority
= rec
->data
.srv
.wPriority
;
71 ans
[ai
].rdata
.srv_record
.weight
= rec
->data
.srv
.wWeight
;
72 ans
[ai
].rdata
.srv_record
.port
= rec
->data
.srv
.wPort
;
73 ans
[ai
].rdata
.srv_record
.target
= talloc_strdup(
74 ans
, rec
->data
.srv
.nameTarget
);
75 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.srv_record
.target
);
78 ans
[ai
].rdata
.soa_record
.mname
= talloc_strdup(
79 ans
, rec
->data
.soa
.mname
);
80 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.soa_record
.mname
);
81 ans
[ai
].rdata
.soa_record
.rname
= talloc_strdup(
82 ans
, rec
->data
.soa
.rname
);
83 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.soa_record
.rname
);
84 ans
[ai
].rdata
.soa_record
.serial
= rec
->data
.soa
.serial
;
85 ans
[ai
].rdata
.soa_record
.refresh
= rec
->data
.soa
.refresh
;
86 ans
[ai
].rdata
.soa_record
.retry
= rec
->data
.soa
.retry
;
87 ans
[ai
].rdata
.soa_record
.expire
= rec
->data
.soa
.expire
;
88 ans
[ai
].rdata
.soa_record
.minimum
= rec
->data
.soa
.minimum
;
91 ans
[ai
].rdata
.ptr_record
= talloc_strdup(ans
, rec
->data
.ptr
);
94 tmp
= talloc_asprintf(ans
, "\"%s\"", rec
->data
.txt
.str
[0]);
95 W_ERROR_HAVE_NO_MEMORY(tmp
);
96 for (i
=1; i
<rec
->data
.txt
.count
; i
++) {
97 tmp
= talloc_asprintf_append_buffer(
98 tmp
, " \"%s\"", rec
->data
.txt
.str
[i
]);
99 W_ERROR_HAVE_NO_MEMORY(tmp
);
101 ans
[ai
].rdata
.txt_record
.txt
= tmp
;
104 DEBUG(0, ("Got unhandled type %u query.\n", rec
->wType
));
105 return DNS_ERR(NOT_IMPLEMENTED
);
108 ans
[ai
].name
= talloc_strdup(ans
, question
->name
);
109 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].name
);
110 ans
[ai
].rr_type
= rec
->wType
;
111 ans
[ai
].rr_class
= DNS_QCLASS_IN
;
112 ans
[ai
].ttl
= rec
->dwTtlSeconds
;
113 ans
[ai
].length
= UINT16_MAX
;
122 struct ask_forwarder_state
{
123 struct tevent_context
*ev
;
125 struct dns_name_packet in_packet
;
128 static void ask_forwarder_done(struct tevent_req
*subreq
);
130 static struct tevent_req
*ask_forwarder_send(
131 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
132 const char *forwarder
, struct dns_name_question
*question
)
134 struct tevent_req
*req
, *subreq
;
135 struct ask_forwarder_state
*state
;
136 struct dns_name_packet out_packet
= { 0, };
138 enum ndr_err_code ndr_err
;
140 req
= tevent_req_create(mem_ctx
, &state
, struct ask_forwarder_state
);
145 generate_random_buffer((uint8_t *)&state
->id
, sizeof(state
->id
));
147 if (!is_ipaddress(forwarder
)) {
148 DEBUG(0, ("Invalid 'dns forwarder' setting '%s', needs to be "
149 "an IP address\n", forwarder
));
150 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
151 return tevent_req_post(req
, ev
);
154 out_packet
.id
= state
->id
;
155 out_packet
.operation
|= DNS_OPCODE_QUERY
| DNS_FLAG_RECURSION_DESIRED
;
156 out_packet
.qdcount
= 1;
157 out_packet
.questions
= question
;
159 ndr_err
= ndr_push_struct_blob(
160 &out_blob
, state
, &out_packet
,
161 (ndr_push_flags_fn_t
)ndr_push_dns_name_packet
);
162 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
163 tevent_req_werror(req
, DNS_ERR(SERVER_FAILURE
));
164 return tevent_req_post(req
, ev
);
166 subreq
= dns_udp_request_send(state
, ev
, forwarder
, out_blob
.data
,
168 if (tevent_req_nomem(subreq
, req
)) {
169 return tevent_req_post(req
, ev
);
171 tevent_req_set_callback(subreq
, ask_forwarder_done
, req
);
175 static void ask_forwarder_done(struct tevent_req
*subreq
)
177 struct tevent_req
*req
= tevent_req_callback_data(
178 subreq
, struct tevent_req
);
179 struct ask_forwarder_state
*state
= tevent_req_data(
180 req
, struct ask_forwarder_state
);
182 enum ndr_err_code ndr_err
;
185 ret
= dns_udp_request_recv(subreq
, state
,
186 &in_blob
.data
, &in_blob
.length
);
188 if (tevent_req_werror(req
, ret
)) {
192 ndr_err
= ndr_pull_struct_blob(
193 &in_blob
, state
, &state
->in_packet
,
194 (ndr_pull_flags_fn_t
)ndr_pull_dns_name_packet
);
195 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
196 tevent_req_werror(req
, DNS_ERR(SERVER_FAILURE
));
199 if (state
->in_packet
.id
!= state
->id
) {
200 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
203 tevent_req_done(req
);
206 static WERROR
ask_forwarder_recv(
207 struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
208 struct dns_res_rec
**answers
, uint16_t *ancount
,
209 struct dns_res_rec
**nsrecs
, uint16_t *nscount
,
210 struct dns_res_rec
**additional
, uint16_t *arcount
)
212 struct ask_forwarder_state
*state
= tevent_req_data(
213 req
, struct ask_forwarder_state
);
214 struct dns_name_packet
*in_packet
= &state
->in_packet
;
217 if (tevent_req_is_werror(req
, &err
)) {
221 *ancount
= in_packet
->ancount
;
222 *answers
= talloc_move(mem_ctx
, &in_packet
->answers
);
224 *nscount
= in_packet
->nscount
;
225 *nsrecs
= talloc_move(mem_ctx
, &in_packet
->nsrecs
);
227 *arcount
= in_packet
->arcount
;
228 *additional
= talloc_move(mem_ctx
, &in_packet
->additional
);
233 static WERROR
handle_question(struct dns_server
*dns
,
235 const struct dns_name_question
*question
,
236 struct dns_res_rec
**answers
, uint16_t *ancount
)
238 struct dns_res_rec
*ans
= *answers
;
241 struct dnsp_DnssrvRpcRecord
*recs
;
242 uint16_t rec_count
, ai
= *ancount
;
243 struct ldb_dn
*dn
= NULL
;
245 werror
= dns_name2dn(dns
, mem_ctx
, question
->name
, &dn
);
246 W_ERROR_NOT_OK_RETURN(werror
);
248 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &recs
, &rec_count
);
249 W_ERROR_NOT_OK_RETURN(werror
);
251 ans
= talloc_realloc(mem_ctx
, ans
, struct dns_res_rec
, rec_count
+ ai
);
256 for (ri
= 0; ri
< rec_count
; ri
++) {
257 if ((recs
[ri
].wType
== DNS_TYPE_CNAME
) &&
258 ((question
->question_type
== DNS_QTYPE_A
) ||
259 (question
->question_type
== DNS_QTYPE_AAAA
))) {
260 struct dns_name_question
*new_q
=
261 talloc(mem_ctx
, struct dns_name_question
);
267 /* We reply with one more record, so grow the array */
268 ans
= talloc_realloc(mem_ctx
, ans
, struct dns_res_rec
,
275 /* First put in the CNAME record */
276 werror
= create_response_rr(question
, &recs
[ri
], &ans
, &ai
);
277 if (!W_ERROR_IS_OK(werror
)) {
281 /* And then look up the name it points at.. */
283 /* First build up the new question */
284 new_q
->question_type
= question
->question_type
;
285 new_q
->question_class
= question
->question_class
;
286 if (new_q
->question_type
== DNS_QTYPE_A
) {
287 new_q
->name
= talloc_strdup(new_q
, recs
[ri
].data
.ipv4
);
288 } else if (new_q
->question_type
== DNS_QTYPE_AAAA
) {
289 new_q
->name
= talloc_strdup(new_q
, recs
[ri
].data
.ipv6
);
291 if (new_q
->name
== NULL
) {
295 /* and then call the lookup again */
296 werror
= handle_question(dns
, mem_ctx
, new_q
, &ans
, &ai
);
297 if (!W_ERROR_IS_OK(werror
)) {
304 if ((question
->question_type
!= DNS_QTYPE_ALL
) &&
305 (recs
[ri
].wType
!= question
->question_type
)) {
308 werror
= create_response_rr(question
, &recs
[ri
], &ans
, &ai
);
309 if (!W_ERROR_IS_OK(werror
)) {
315 return DNS_ERR(NAME_ERROR
);
324 static NTSTATUS
create_new_tkey(TALLOC_CTX
*mem_ctx
,
325 struct dns_server
*dns
,
326 struct dns_server_tkey
**tkey
,
330 struct dns_server_tkey
*k
= talloc_zero(mem_ctx
, struct dns_server_tkey
);
333 return NT_STATUS_NO_MEMORY
;
336 k
->name
= talloc_strdup(mem_ctx
, name
);
338 if (k
->name
== NULL
) {
339 return NT_STATUS_NO_MEMORY
;
342 status
= samba_server_gensec_start(k
,
343 dns
->task
->event_ctx
,
346 dns
->server_credentials
,
349 if (!NT_STATUS_IS_OK(status
)) {
350 DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status
)));
355 gensec_want_feature(k
->gensec
, GENSEC_FEATURE_SIGN
);
357 status
= gensec_start_mech_by_oid(k
->gensec
, GENSEC_OID_SPNEGO
);
359 if (!NT_STATUS_IS_OK(status
)) {
360 DEBUG(1, ("Failed to start GENSEC server code: %s\n",
370 static NTSTATUS
accept_gss_ticket(TALLOC_CTX
*mem_ctx
,
371 struct dns_server
*dns
,
372 struct dns_server_tkey
*tkey
,
373 const DATA_BLOB
*key
,
375 uint16_t *dns_auth_error
)
379 status
= gensec_update(tkey
->gensec
, mem_ctx
, dns
->task
->event_ctx
,
382 if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED
, status
)) {
383 *dns_auth_error
= DNS_RCODE_OK
;
387 if (NT_STATUS_IS_OK(status
)) {
389 status
= gensec_session_info(tkey
->gensec
, tkey
, &tkey
->session_info
);
390 if (!NT_STATUS_IS_OK(status
)) {
391 *dns_auth_error
= DNS_RCODE_BADKEY
;
394 *dns_auth_error
= DNS_RCODE_OK
;
400 static struct dns_server_tkey
*find_tkey(struct dns_server
*dns
,
403 struct dns_server_tkey
*tkey
= NULL
;
405 for (tkey
= dns
->tkeys
; tkey
!= NULL
; tkey
= tkey
->next
) {
406 if (dns_name_equal(name
, tkey
->name
)) {
414 static WERROR
handle_tkey(struct dns_server
*dns
,
416 const struct dns_name_packet
*in
,
417 struct dns_res_rec
**answers
,
420 struct dns_res_rec
*in_tkey
= NULL
;
421 struct dns_res_rec
*ret_tkey
;
424 for (i
= 0; i
< in
->arcount
; i
++) {
425 if (in
->additional
[i
].rr_type
== DNS_QTYPE_TKEY
) {
426 in_tkey
= &in
->additional
[i
];
431 /* If this is a TKEY query, it should have a TKEY RR.
432 * Behaviour is not really specified in RFC 2930 or RFC 3645, but
433 * FORMAT_ERROR seems to be what BIND uses .*/
434 if (in_tkey
== NULL
) {
435 return DNS_ERR(FORMAT_ERROR
);
438 ret_tkey
= talloc_zero(mem_ctx
, struct dns_res_rec
);
439 if (ret_tkey
== NULL
) {
443 ret_tkey
->name
= talloc_strdup(ret_tkey
, in_tkey
->name
);
444 if (ret_tkey
->name
== NULL
) {
448 ret_tkey
->rr_type
= DNS_QTYPE_TKEY
;
449 ret_tkey
->rr_class
= DNS_QCLASS_ANY
;
450 ret_tkey
->length
= UINT16_MAX
;
452 ret_tkey
->rdata
.tkey_record
.algorithm
= talloc_strdup(ret_tkey
, ret_tkey
->name
);
453 if (ret_tkey
->rdata
.tkey_record
.algorithm
== NULL
) {
457 ret_tkey
->rdata
.tkey_record
.inception
= in_tkey
->rdata
.tkey_record
.inception
;
458 ret_tkey
->rdata
.tkey_record
.expiration
= in_tkey
->rdata
.tkey_record
.expiration
;
459 ret_tkey
->rdata
.tkey_record
.mode
= in_tkey
->rdata
.tkey_record
.mode
;
461 switch (in_tkey
->rdata
.tkey_record
.mode
) {
462 case DNS_TKEY_MODE_DH
:
463 /* FIXME: According to RFC 2930, we MUST support this, but we don't.
464 * Still, claim it's a bad key instead of a bad mode */
465 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
467 case DNS_TKEY_MODE_GSSAPI
: {
469 struct dns_server_tkey
*tkey
;
473 tkey
= find_tkey(dns
, in
->questions
[0].name
);
474 if (tkey
!= NULL
&& tkey
->complete
) {
475 /* TODO: check if the key is still valid */
476 DEBUG(1, ("Rejecting tkey negotiation for already established key\n"));
477 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADNAME
;
482 status
= create_new_tkey(dns
, dns
, &tkey
,
483 in
->questions
[0].name
);
484 if (!NT_STATUS_IS_OK(status
)) {
485 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
486 return ntstatus_to_werror(status
);
489 DLIST_ADD_END(dns
->tkeys
, tkey
, NULL
);
492 key
.data
= in_tkey
->rdata
.tkey_record
.key_data
;
493 key
.length
= in_tkey
->rdata
.tkey_record
.key_size
;
495 status
= accept_gss_ticket(ret_tkey
, dns
, tkey
, &key
, &reply
,
496 &ret_tkey
->rdata
.tkey_record
.error
);
497 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
498 DEBUG(1, ("More processing required\n"));
499 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
500 } else if (NT_STATUS_IS_OK(status
)) {
501 DEBUG(1, ("Tkey handshake completed\n"));
503 DEBUG(0, ("GSS key negotiation returned %s\n", nt_errstr(status
)));
504 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
509 case DNS_TKEY_MODE_DELETE
:
510 /* TODO: implement me */
511 DEBUG(1, ("Should delete tkey here\n"));
512 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_OK
;
514 case DNS_TKEY_MODE_NULL
:
515 case DNS_TKEY_MODE_SERVER
:
516 case DNS_TKEY_MODE_CLIENT
:
517 case DNS_TKEY_MODE_LAST
:
518 /* We don't have to implement these, return a mode error */
519 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADMODE
;
522 DEBUG(1, ("Unsupported TKEY mode %d\n",
523 in_tkey
->rdata
.tkey_record
.mode
));
532 struct dns_server_process_query_state
{
533 struct dns_res_rec
*answers
;
535 struct dns_res_rec
*nsrecs
;
537 struct dns_res_rec
*additional
;
541 static void dns_server_process_query_got_response(struct tevent_req
*subreq
);
543 struct tevent_req
*dns_server_process_query_send(
544 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
545 struct dns_server
*dns
, struct dns_request_state
*req_state
,
546 const struct dns_name_packet
*in
)
548 struct tevent_req
*req
, *subreq
;
549 struct dns_server_process_query_state
*state
;
551 req
= tevent_req_create(mem_ctx
, &state
,
552 struct dns_server_process_query_state
);
556 if (in
->qdcount
!= 1) {
557 tevent_req_werror(req
, DNS_ERR(FORMAT_ERROR
));
558 return tevent_req_post(req
, ev
);
561 /* Windows returns NOT_IMPLEMENTED on this as well */
562 if (in
->questions
[0].question_class
== DNS_QCLASS_NONE
) {
563 tevent_req_werror(req
, DNS_ERR(NOT_IMPLEMENTED
));
564 return tevent_req_post(req
, ev
);
567 if (in
->questions
[0].question_type
== DNS_QTYPE_TKEY
) {
570 err
= handle_tkey(dns
, state
, in
, &state
->answers
,
572 if (tevent_req_werror(req
, err
)) {
573 return tevent_req_post(req
, ev
);
575 tevent_req_done(req
);
576 return tevent_req_post(req
, ev
);
579 if (dns_authorative_for_zone(dns
, in
->questions
[0].name
)) {
582 req_state
->flags
|= DNS_FLAG_AUTHORITATIVE
;
583 err
= handle_question(dns
, state
, &in
->questions
[0],
584 &state
->answers
, &state
->ancount
);
585 if (tevent_req_werror(req
, err
)) {
586 return tevent_req_post(req
, ev
);
588 tevent_req_done(req
);
589 return tevent_req_post(req
, ev
);
592 if ((req_state
->flags
& DNS_FLAG_RECURSION_DESIRED
) &&
593 (req_state
->flags
& DNS_FLAG_RECURSION_AVAIL
)) {
594 DEBUG(2, ("Not authoritative for '%s', forwarding\n",
595 in
->questions
[0].name
));
597 subreq
= ask_forwarder_send(
598 state
, ev
, lpcfg_dns_forwarder(dns
->task
->lp_ctx
),
600 if (tevent_req_nomem(subreq
, req
)) {
601 return tevent_req_post(req
, ev
);
603 tevent_req_set_callback(
604 subreq
, dns_server_process_query_got_response
, req
);
608 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
609 return tevent_req_post(req
, ev
);
612 static void dns_server_process_query_got_response(struct tevent_req
*subreq
)
614 struct tevent_req
*req
= tevent_req_callback_data(
615 subreq
, struct tevent_req
);
616 struct dns_server_process_query_state
*state
= tevent_req_data(
617 req
, struct dns_server_process_query_state
);
620 err
= ask_forwarder_recv(subreq
, state
,
621 &state
->answers
, &state
->ancount
,
622 &state
->nsrecs
, &state
->nscount
,
623 &state
->additional
, &state
->arcount
);
625 if (tevent_req_werror(req
, err
)) {
628 tevent_req_done(req
);
631 WERROR
dns_server_process_query_recv(
632 struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
633 struct dns_res_rec
**answers
, uint16_t *ancount
,
634 struct dns_res_rec
**nsrecs
, uint16_t *nscount
,
635 struct dns_res_rec
**additional
, uint16_t *arcount
)
637 struct dns_server_process_query_state
*state
= tevent_req_data(
638 req
, struct dns_server_process_query_state
);
641 if (tevent_req_is_werror(req
, &err
)) {
644 *answers
= talloc_move(mem_ctx
, &state
->answers
);
645 *ancount
= state
->ancount
;
646 *nsrecs
= talloc_move(mem_ctx
, &state
->nsrecs
);
647 *nscount
= state
->nscount
;
648 *additional
= talloc_move(mem_ctx
, &state
->additional
);
649 *arcount
= state
->arcount
;