2 Unix SMB/CIFS implementation.
4 bind9 dlz driver for Samba
6 Copyright (C) 2010 Andrew Tridgell
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "param/param.h"
25 #include "lib/events/events.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "dsdb/common/util.h"
28 #include "auth/auth.h"
29 #include "auth/session.h"
30 #include "auth/gensec/gensec.h"
31 #include "librpc/gen_ndr/security.h"
32 #include "auth/credentials/credentials.h"
33 #include "system/kerberos.h"
34 #include "auth/kerberos/kerberos.h"
35 #include "gen_ndr/ndr_dnsp.h"
36 #include "gen_ndr/server_id.h"
37 #include "messaging/messaging.h"
38 #include "lib/cmdline/popt_common.h"
39 #include "dlz_minimal.h"
47 struct dlz_bind9_data
{
48 struct b9_options options
;
49 struct ldb_context
*samdb
;
50 struct tevent_context
*ev_ctx
;
51 struct loadparm_context
*lp
;
52 int *transaction_token
;
55 /* Used for dynamic update */
56 struct smb_krb5_context
*smb_krb5_ctx
;
57 struct auth4_context
*auth_context
;
58 struct auth_session_info
*session_info
;
61 /* helper functions from the dlz_dlopen driver */
63 dns_sdlz_putrr_t
*putrr
;
64 dns_sdlz_putnamedrr_t
*putnamedrr
;
65 dns_dlz_writeablezone_t
*writeable_zone
;
68 static struct dlz_bind9_data
*dlz_bind9_state
= NULL
;
69 static int dlz_bind9_state_ref_count
= 0;
71 static const char *zone_prefixes
[] = {
72 "CN=MicrosoftDNS,DC=DomainDnsZones",
73 "CN=MicrosoftDNS,DC=ForestDnsZones",
74 "CN=MicrosoftDNS,CN=System",
79 return the version of the API
81 _PUBLIC_
int dlz_version(unsigned int *flags
)
83 return DLZ_DLOPEN_VERSION
;
87 remember a helper function from the bind9 dlz_dlopen driver
89 static void b9_add_helper(struct dlz_bind9_data
*state
, const char *helper_name
, void *ptr
)
91 if (strcmp(helper_name
, "log") == 0) {
94 if (strcmp(helper_name
, "putrr") == 0) {
97 if (strcmp(helper_name
, "putnamedrr") == 0) {
98 state
->putnamedrr
= ptr
;
100 if (strcmp(helper_name
, "writeable_zone") == 0) {
101 state
->writeable_zone
= ptr
;
106 format a record for bind9
108 static bool b9_format(struct dlz_bind9_data
*state
,
110 struct dnsp_DnssrvRpcRecord
*rec
,
111 const char **type
, const char **data
)
116 switch (rec
->wType
) {
119 *data
= rec
->data
.ipv4
;
124 *data
= rec
->data
.ipv6
;
129 *data
= rec
->data
.cname
;
134 tmp
= talloc_asprintf(mem_ctx
, "\"%s\"", rec
->data
.txt
.str
[0]);
135 for (i
=1; i
<rec
->data
.txt
.count
; i
++) {
136 tmp
= talloc_asprintf_append(tmp
, " \"%s\"", rec
->data
.txt
.str
[i
]);
143 *data
= rec
->data
.ptr
;
148 *data
= talloc_asprintf(mem_ctx
, "%u %u %u %s",
149 rec
->data
.srv
.wPriority
,
150 rec
->data
.srv
.wWeight
,
152 rec
->data
.srv
.nameTarget
);
157 *data
= talloc_asprintf(mem_ctx
, "%u %s",
158 rec
->data
.mx
.wPriority
,
159 rec
->data
.mx
.nameTarget
);
164 *data
= talloc_asprintf(mem_ctx
, "%s %s",
171 *data
= rec
->data
.ns
;
178 /* we need to fake the authoritative nameserver to
179 * point at ourselves. This is how AD DNS servers
180 * force clients to send updates to the right local DC
182 mname
= talloc_asprintf(mem_ctx
, "%s.%s",
183 lpcfg_netbios_name(state
->lp
), lpcfg_dnsdomain(state
->lp
));
187 mname
= strlower_talloc(mem_ctx
, mname
);
192 state
->soa_serial
= rec
->data
.soa
.serial
;
194 *data
= talloc_asprintf(mem_ctx
, "%s %s %u %u %u %u %u",
197 rec
->data
.soa
.serial
,
198 rec
->data
.soa
.refresh
,
200 rec
->data
.soa
.expire
,
201 rec
->data
.soa
.minimum
);
206 state
->log(ISC_LOG_ERROR
, "samba b9_putrr: unhandled record type %u",
214 static const struct {
215 enum dns_record_type dns_type
;
219 { DNS_TYPE_A
, "A" , false},
220 { DNS_TYPE_AAAA
, "AAAA" , false},
221 { DNS_TYPE_CNAME
, "CNAME" , true},
222 { DNS_TYPE_TXT
, "TXT" , false},
223 { DNS_TYPE_PTR
, "PTR" , false},
224 { DNS_TYPE_SRV
, "SRV" , false},
225 { DNS_TYPE_MX
, "MX" , false},
226 { DNS_TYPE_HINFO
, "HINFO" , false},
227 { DNS_TYPE_NS
, "NS" , false},
228 { DNS_TYPE_SOA
, "SOA" , true},
233 see if a DNS type is single valued
235 static bool b9_single_valued(enum dns_record_type dns_type
)
238 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
239 if (dns_typemap
[i
].dns_type
== dns_type
) {
240 return dns_typemap
[i
].single_valued
;
247 see if a DNS type is single valued
249 static bool b9_dns_type(const char *type
, enum dns_record_type
*dtype
)
252 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
253 if (strcasecmp(dns_typemap
[i
].typestr
, type
) == 0) {
254 *dtype
= dns_typemap
[i
].dns_type
;
262 #define DNS_PARSE_STR(ret, str, sep, saveptr) do { \
263 (ret) = strtok_r(str, sep, &saveptr); \
264 if ((ret) == NULL) return false; \
267 #define DNS_PARSE_UINT(ret, str, sep, saveptr) do { \
268 char *istr = strtok_r(str, sep, &saveptr); \
269 if ((istr) == NULL) return false; \
270 (ret) = strtoul(istr, NULL, 10); \
274 parse a record from bind9
276 static bool b9_parse(struct dlz_bind9_data
*state
,
277 const char *rdatastr
,
278 struct dnsp_DnssrvRpcRecord
*rec
)
280 char *full_name
, *dclass
, *type
;
281 char *str
, *tmp
, *saveptr
=NULL
;
284 str
= talloc_strdup(rec
, rdatastr
);
289 /* parse the SDLZ string form */
290 DNS_PARSE_STR(full_name
, str
, "\t", saveptr
);
291 DNS_PARSE_UINT(rec
->dwTtlSeconds
, NULL
, "\t", saveptr
);
292 DNS_PARSE_STR(dclass
, NULL
, "\t", saveptr
);
293 DNS_PARSE_STR(type
, NULL
, "\t", saveptr
);
295 /* construct the record */
296 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
297 if (strcasecmp(type
, dns_typemap
[i
].typestr
) == 0) {
298 rec
->wType
= dns_typemap
[i
].dns_type
;
302 if (i
== ARRAY_SIZE(dns_typemap
)) {
303 state
->log(ISC_LOG_ERROR
, "samba_dlz: unsupported record type '%s' for '%s'",
308 switch (rec
->wType
) {
310 DNS_PARSE_STR(rec
->data
.ipv4
, NULL
, " ", saveptr
);
314 DNS_PARSE_STR(rec
->data
.ipv6
, NULL
, " ", saveptr
);
318 DNS_PARSE_STR(rec
->data
.cname
, NULL
, " ", saveptr
);
322 rec
->data
.txt
.count
= 0;
323 rec
->data
.txt
.str
= talloc_array(rec
, const char *, rec
->data
.txt
.count
);
324 tmp
= strtok_r(NULL
, "\t", &saveptr
);
326 rec
->data
.txt
.str
= talloc_realloc(rec
, rec
->data
.txt
.str
, const char *,
327 rec
->data
.txt
.count
+1);
330 rec
->data
.txt
.str
[rec
->data
.txt
.count
] = talloc_strndup(rec
, &tmp
[1], strlen(tmp
)-2);
332 rec
->data
.txt
.str
[rec
->data
.txt
.count
] = talloc_strdup(rec
, tmp
);
334 rec
->data
.txt
.count
++;
335 tmp
= strtok_r(NULL
, " ", &saveptr
);
340 DNS_PARSE_STR(rec
->data
.ptr
, NULL
, " ", saveptr
);
344 DNS_PARSE_UINT(rec
->data
.srv
.wPriority
, NULL
, " ", saveptr
);
345 DNS_PARSE_UINT(rec
->data
.srv
.wWeight
, NULL
, " ", saveptr
);
346 DNS_PARSE_UINT(rec
->data
.srv
.wPort
, NULL
, " ", saveptr
);
347 DNS_PARSE_STR(rec
->data
.srv
.nameTarget
, NULL
, " ", saveptr
);
351 DNS_PARSE_UINT(rec
->data
.mx
.wPriority
, NULL
, " ", saveptr
);
352 DNS_PARSE_STR(rec
->data
.mx
.nameTarget
, NULL
, " ", saveptr
);
356 DNS_PARSE_STR(rec
->data
.hinfo
.cpu
, NULL
, " ", saveptr
);
357 DNS_PARSE_STR(rec
->data
.hinfo
.os
, NULL
, " ", saveptr
);
361 DNS_PARSE_STR(rec
->data
.ns
, NULL
, " ", saveptr
);
365 DNS_PARSE_STR(rec
->data
.soa
.mname
, NULL
, " ", saveptr
);
366 DNS_PARSE_STR(rec
->data
.soa
.rname
, NULL
, " ", saveptr
);
367 DNS_PARSE_UINT(rec
->data
.soa
.serial
, NULL
, " ", saveptr
);
368 DNS_PARSE_UINT(rec
->data
.soa
.refresh
, NULL
, " ", saveptr
);
369 DNS_PARSE_UINT(rec
->data
.soa
.retry
, NULL
, " ", saveptr
);
370 DNS_PARSE_UINT(rec
->data
.soa
.expire
, NULL
, " ", saveptr
);
371 DNS_PARSE_UINT(rec
->data
.soa
.minimum
, NULL
, " ", saveptr
);
375 state
->log(ISC_LOG_ERROR
, "samba b9_parse: unhandled record type %u",
380 /* we should be at the end of the buffer now */
381 if (strtok_r(NULL
, "\t ", &saveptr
) != NULL
) {
382 state
->log(ISC_LOG_ERROR
, "samba b9_parse: expected data at end of string for '%s'");
390 send a resource recond to bind9
392 static isc_result_t
b9_putrr(struct dlz_bind9_data
*state
,
393 void *handle
, struct dnsp_DnssrvRpcRecord
*rec
,
397 const char *type
, *data
;
398 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
400 if (!b9_format(state
, tmp_ctx
, rec
, &type
, &data
)) {
401 return ISC_R_FAILURE
;
405 talloc_free(tmp_ctx
);
406 return ISC_R_NOMEMORY
;
411 for (i
=0; types
[i
]; i
++) {
412 if (strcmp(types
[i
], type
) == 0) break;
414 if (types
[i
] == NULL
) {
416 return ISC_R_SUCCESS
;
420 result
= state
->putrr(handle
, type
, rec
->dwTtlSeconds
, data
);
421 if (result
!= ISC_R_SUCCESS
) {
422 state
->log(ISC_LOG_ERROR
, "Failed to put rr");
424 talloc_free(tmp_ctx
);
430 send a named resource recond to bind9
432 static isc_result_t
b9_putnamedrr(struct dlz_bind9_data
*state
,
433 void *handle
, const char *name
,
434 struct dnsp_DnssrvRpcRecord
*rec
)
437 const char *type
, *data
;
438 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
440 if (!b9_format(state
, tmp_ctx
, rec
, &type
, &data
)) {
441 return ISC_R_FAILURE
;
445 talloc_free(tmp_ctx
);
446 return ISC_R_NOMEMORY
;
449 result
= state
->putnamedrr(handle
, name
, type
, rec
->dwTtlSeconds
, data
);
450 if (result
!= ISC_R_SUCCESS
) {
451 state
->log(ISC_LOG_ERROR
, "Failed to put named rr '%s'", name
);
453 talloc_free(tmp_ctx
);
460 static isc_result_t
parse_options(struct dlz_bind9_data
*state
,
461 unsigned int argc
, char *argv
[],
462 struct b9_options
*options
)
466 struct poptOption long_options
[] = {
467 { "url", 'H', POPT_ARG_STRING
, &options
->url
, 0, "database URL", "URL" },
468 { "debug", 'd', POPT_ARG_STRING
, &options
->debug
, 0, "debug level", "DEBUG" },
472 pc
= poptGetContext("dlz_bind9", argc
, (const char **)argv
, long_options
,
473 POPT_CONTEXT_KEEP_FIRST
);
474 while ((opt
= poptGetNextOpt(pc
)) != -1) {
477 state
->log(ISC_LOG_ERROR
, "dlz_bind9: Invalid option %s: %s",
478 poptBadOption(pc
, 0), poptStrerror(opt
));
479 return ISC_R_FAILURE
;
483 return ISC_R_SUCCESS
;
488 * Create session info from PAC
489 * This is called as auth_context->generate_session_info_pac()
491 static NTSTATUS
b9_generate_session_info_pac(struct auth4_context
*auth_context
,
493 struct smb_krb5_context
*smb_krb5_context
,
495 const char *principal_name
,
496 const struct tsocket_address
*remote_addr
,
497 uint32_t session_info_flags
,
498 struct auth_session_info
**session_info
)
501 struct auth_user_info_dc
*user_info_dc
;
504 tmp_ctx
= talloc_new(mem_ctx
);
505 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
507 status
= kerberos_pac_blob_to_user_info_dc(tmp_ctx
,
509 smb_krb5_context
->krb5_context
,
513 if (!NT_STATUS_IS_OK(status
)) {
514 talloc_free(tmp_ctx
);
518 if (user_info_dc
->info
->authenticated
) {
519 session_info_flags
|= AUTH_SESSION_INFO_AUTHENTICATED
;
522 session_info_flags
|= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES
;
524 status
= auth_generate_session_info(mem_ctx
, NULL
, NULL
, user_info_dc
,
525 session_info_flags
, session_info
);
526 if (!NT_STATUS_IS_OK(status
)) {
527 talloc_free(tmp_ctx
);
531 talloc_free(tmp_ctx
);
535 /* Callback for the DEBUG() system, to catch the remaining messages */
536 static void b9_debug(void *private_ptr
, int msg_level
, const char *msg
)
538 static const int isc_log_map
[] = {
539 ISC_LOG_CRITICAL
, /* 0 */
540 ISC_LOG_ERROR
, /* 1 */
541 ISC_LOG_WARNING
, /* 2 */
542 ISC_LOG_NOTICE
/* 3 */
544 struct dlz_bind9_data
*state
= private_ptr
;
547 if (msg_level
>= ARRAY_SIZE(isc_log_map
) || msg_level
< 0) {
548 isc_log_level
= ISC_LOG_INFO
;
550 isc_log_level
= isc_log_map
[msg_level
];
552 state
->log(isc_log_level
, "samba_dlz: %s", msg
);
555 static int dlz_state_debug_unregister(struct dlz_bind9_data
*state
)
557 /* Stop logging (to the bind9 logs) */
558 debug_set_callback(NULL
, NULL
);
563 called to initialise the driver
565 _PUBLIC_ isc_result_t
dlz_create(const char *dlzname
,
566 unsigned int argc
, char *argv
[],
569 struct dlz_bind9_data
*state
;
570 const char *helper_name
;
576 if (dlz_bind9_state
!= NULL
) {
577 *dbdata
= dlz_bind9_state
;
578 dlz_bind9_state_ref_count
++;
579 return ISC_R_SUCCESS
;
582 state
= talloc_zero(NULL
, struct dlz_bind9_data
);
584 return ISC_R_NOMEMORY
;
587 talloc_set_destructor(state
, dlz_state_debug_unregister
);
589 /* fill in the helper functions */
590 va_start(ap
, dbdata
);
591 while ((helper_name
= va_arg(ap
, const char *)) != NULL
) {
592 b9_add_helper(state
, helper_name
, va_arg(ap
, void*));
596 /* Do not install samba signal handlers */
597 fault_setup_disable();
599 /* Start logging (to the bind9 logs) */
600 debug_set_callback(state
, b9_debug
);
602 state
->ev_ctx
= s4_event_context_init(state
);
603 if (state
->ev_ctx
== NULL
) {
604 result
= ISC_R_NOMEMORY
;
608 result
= parse_options(state
, argc
, argv
, &state
->options
);
609 if (result
!= ISC_R_SUCCESS
) {
613 state
->lp
= loadparm_init_global(true);
614 if (state
->lp
== NULL
) {
615 result
= ISC_R_NOMEMORY
;
619 if (state
->options
.debug
) {
620 lpcfg_do_global_parameter(state
->lp
, "log level", state
->options
.debug
);
622 lpcfg_do_global_parameter(state
->lp
, "log level", "0");
625 if (smb_krb5_init_context(state
, state
->ev_ctx
, state
->lp
, &state
->smb_krb5_ctx
) != 0) {
626 result
= ISC_R_NOMEMORY
;
630 nt_status
= gensec_init();
631 if (!NT_STATUS_IS_OK(nt_status
)) {
632 result
= ISC_R_NOMEMORY
;
636 state
->auth_context
= talloc_zero(state
, struct auth4_context
);
637 if (state
->auth_context
== NULL
) {
638 result
= ISC_R_NOMEMORY
;
642 if (state
->options
.url
== NULL
) {
643 state
->options
.url
= lpcfg_private_path(state
, state
->lp
, "dns/sam.ldb");
644 if (state
->options
.url
== NULL
) {
645 result
= ISC_R_NOMEMORY
;
650 state
->samdb
= samdb_connect_url(state
, state
->ev_ctx
, state
->lp
,
651 system_session(state
->lp
), 0, state
->options
.url
);
652 if (state
->samdb
== NULL
) {
653 state
->log(ISC_LOG_ERROR
, "samba_dlz: Failed to connect to %s",
655 result
= ISC_R_FAILURE
;
659 dn
= ldb_get_default_basedn(state
->samdb
);
661 state
->log(ISC_LOG_ERROR
, "samba_dlz: Unable to get basedn for %s - %s",
662 state
->options
.url
, ldb_errstring(state
->samdb
));
663 result
= ISC_R_FAILURE
;
667 state
->log(ISC_LOG_INFO
, "samba_dlz: started for DN %s",
668 ldb_dn_get_linearized(dn
));
670 state
->auth_context
->event_ctx
= state
->ev_ctx
;
671 state
->auth_context
->lp_ctx
= state
->lp
;
672 state
->auth_context
->sam_ctx
= state
->samdb
;
673 state
->auth_context
->generate_session_info_pac
= b9_generate_session_info_pac
;
676 dlz_bind9_state
= state
;
677 dlz_bind9_state_ref_count
++;
679 return ISC_R_SUCCESS
;
689 _PUBLIC_
void dlz_destroy(void *dbdata
)
691 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
692 state
->log(ISC_LOG_INFO
, "samba_dlz: shutting down");
694 dlz_bind9_state_ref_count
--;
695 if (dlz_bind9_state_ref_count
== 0) {
696 talloc_unlink(state
, state
->samdb
);
698 dlz_bind9_state
= NULL
;
704 return the base DN for a zone
706 static isc_result_t
b9_find_zone_dn(struct dlz_bind9_data
*state
, const char *zone_name
,
707 TALLOC_CTX
*mem_ctx
, struct ldb_dn
**zone_dn
)
710 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
711 const char *attrs
[] = { NULL
};
714 for (i
=0; zone_prefixes
[i
]; i
++) {
716 struct ldb_result
*res
;
718 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
720 talloc_free(tmp_ctx
);
721 return ISC_R_NOMEMORY
;
724 if (!ldb_dn_add_child_fmt(dn
, "DC=%s,%s", zone_name
, zone_prefixes
[i
])) {
725 talloc_free(tmp_ctx
);
726 return ISC_R_NOMEMORY
;
729 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsZone");
730 if (ret
== LDB_SUCCESS
) {
731 if (zone_dn
!= NULL
) {
732 *zone_dn
= talloc_steal(mem_ctx
, dn
);
734 talloc_free(tmp_ctx
);
735 return ISC_R_SUCCESS
;
740 talloc_free(tmp_ctx
);
741 return ISC_R_NOTFOUND
;
746 return the DN for a name. The record does not need to exist, but the
749 static isc_result_t
b9_find_name_dn(struct dlz_bind9_data
*state
, const char *name
,
750 TALLOC_CTX
*mem_ctx
, struct ldb_dn
**dn
)
754 /* work through the name piece by piece, until we find a zone */
757 result
= b9_find_zone_dn(state
, p
, mem_ctx
, dn
);
758 if (result
== ISC_R_SUCCESS
) {
759 /* we found a zone, now extend the DN to get
764 ret
= ldb_dn_add_child_fmt(*dn
, "DC=@");
766 ret
= ldb_dn_add_child_fmt(*dn
, "DC=%.*s", (int)(p
-name
)-1, name
);
770 return ISC_R_NOMEMORY
;
772 return ISC_R_SUCCESS
;
780 return ISC_R_NOTFOUND
;
785 see if we handle a given zone
787 _PUBLIC_ isc_result_t
dlz_findzonedb(void *dbdata
, const char *name
)
789 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
790 return b9_find_zone_dn(state
, name
, NULL
, NULL
);
797 static isc_result_t
dlz_lookup_types(struct dlz_bind9_data
*state
,
798 const char *zone
, const char *name
,
799 dns_sdlzlookup_t
*lookup
,
802 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
803 const char *attrs
[] = { "dnsRecord", NULL
};
804 int ret
= LDB_SUCCESS
, i
;
805 struct ldb_result
*res
;
806 struct ldb_message_element
*el
;
809 for (i
=0; zone_prefixes
[i
]; i
++) {
810 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
812 talloc_free(tmp_ctx
);
813 return ISC_R_NOMEMORY
;
816 if (!ldb_dn_add_child_fmt(dn
, "DC=%s,DC=%s,%s", name
, zone
, zone_prefixes
[i
])) {
817 talloc_free(tmp_ctx
);
818 return ISC_R_NOMEMORY
;
821 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
,
822 attrs
, "objectClass=dnsNode");
823 if (ret
== LDB_SUCCESS
) {
827 if (ret
!= LDB_SUCCESS
) {
828 talloc_free(tmp_ctx
);
829 return ISC_R_NOTFOUND
;
832 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
833 if (el
== NULL
|| el
->num_values
== 0) {
834 talloc_free(tmp_ctx
);
835 return ISC_R_NOTFOUND
;
838 for (i
=0; i
<el
->num_values
; i
++) {
839 struct dnsp_DnssrvRpcRecord rec
;
840 enum ndr_err_code ndr_err
;
843 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], tmp_ctx
, &rec
,
844 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
845 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
846 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
847 ldb_dn_get_linearized(dn
));
848 talloc_free(tmp_ctx
);
849 return ISC_R_FAILURE
;
852 result
= b9_putrr(state
, lookup
, &rec
, types
);
853 if (result
!= ISC_R_SUCCESS
) {
854 talloc_free(tmp_ctx
);
859 talloc_free(tmp_ctx
);
860 return ISC_R_SUCCESS
;
866 #ifdef BIND_VERSION_9_8
867 _PUBLIC_ isc_result_t
dlz_lookup(const char *zone
, const char *name
,
868 void *dbdata
, dns_sdlzlookup_t
*lookup
)
870 _PUBLIC_ isc_result_t
dlz_lookup(const char *zone
, const char *name
,
871 void *dbdata
, dns_sdlzlookup_t
*lookup
,
872 dns_clientinfomethods_t
*methods
,
873 dns_clientinfo_t
*clientinfo
)
876 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
877 return dlz_lookup_types(state
, zone
, name
, lookup
, NULL
);
882 see if a zone transfer is allowed
884 _PUBLIC_ isc_result_t
dlz_allowzonexfr(void *dbdata
, const char *name
, const char *client
)
886 /* just say yes for all our zones for now */
887 return dlz_findzonedb(dbdata
, name
);
891 perform a zone transfer
893 _PUBLIC_ isc_result_t
dlz_allnodes(const char *zone
, void *dbdata
,
894 dns_sdlzallnodes_t
*allnodes
)
896 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
897 const char *attrs
[] = { "dnsRecord", NULL
};
898 int ret
= LDB_SUCCESS
, i
, j
;
900 struct ldb_result
*res
;
901 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
903 for (i
=0; zone_prefixes
[i
]; i
++) {
904 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
906 talloc_free(tmp_ctx
);
907 return ISC_R_NOMEMORY
;
910 if (!ldb_dn_add_child_fmt(dn
, "DC=%s,%s", zone
, zone_prefixes
[i
])) {
911 talloc_free(tmp_ctx
);
912 return ISC_R_NOMEMORY
;
915 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_SUBTREE
,
916 attrs
, "objectClass=dnsNode");
917 if (ret
== LDB_SUCCESS
) {
921 if (ret
!= LDB_SUCCESS
) {
922 talloc_free(tmp_ctx
);
923 return ISC_R_NOTFOUND
;
926 for (i
=0; i
<res
->count
; i
++) {
927 struct ldb_message_element
*el
;
928 TALLOC_CTX
*el_ctx
= talloc_new(tmp_ctx
);
929 const char *rdn
, *name
;
930 const struct ldb_val
*v
;
932 el
= ldb_msg_find_element(res
->msgs
[i
], "dnsRecord");
933 if (el
== NULL
|| el
->num_values
== 0) {
934 state
->log(ISC_LOG_INFO
, "failed to find dnsRecord for %s",
935 ldb_dn_get_linearized(dn
));
940 v
= ldb_dn_get_rdn_val(res
->msgs
[i
]->dn
);
942 state
->log(ISC_LOG_INFO
, "failed to find RDN for %s",
943 ldb_dn_get_linearized(dn
));
948 rdn
= talloc_strndup(el_ctx
, (char *)v
->data
, v
->length
);
950 talloc_free(tmp_ctx
);
951 return ISC_R_NOMEMORY
;
954 if (strcmp(rdn
, "@") == 0) {
957 name
= talloc_asprintf(el_ctx
, "%s.%s", rdn
, zone
);
960 talloc_free(tmp_ctx
);
961 return ISC_R_NOMEMORY
;
964 for (j
=0; j
<el
->num_values
; j
++) {
965 struct dnsp_DnssrvRpcRecord rec
;
966 enum ndr_err_code ndr_err
;
969 ndr_err
= ndr_pull_struct_blob(&el
->values
[j
], el_ctx
, &rec
,
970 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
971 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
972 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
973 ldb_dn_get_linearized(dn
));
977 result
= b9_putnamedrr(state
, allnodes
, name
, &rec
);
978 if (result
!= ISC_R_SUCCESS
) {
984 talloc_free(tmp_ctx
);
986 return ISC_R_SUCCESS
;
993 _PUBLIC_ isc_result_t
dlz_newversion(const char *zone
, void *dbdata
, void **versionp
)
995 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
997 state
->log(ISC_LOG_INFO
, "samba_dlz: starting transaction on zone %s", zone
);
999 if (state
->transaction_token
!= NULL
) {
1000 state
->log(ISC_LOG_INFO
, "samba_dlz: transaction already started for zone %s", zone
);
1001 return ISC_R_FAILURE
;
1004 state
->transaction_token
= talloc_zero(state
, int);
1005 if (state
->transaction_token
== NULL
) {
1006 return ISC_R_NOMEMORY
;
1009 if (ldb_transaction_start(state
->samdb
) != LDB_SUCCESS
) {
1010 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to start a transaction for zone %s", zone
);
1011 talloc_free(state
->transaction_token
);
1012 state
->transaction_token
= NULL
;
1013 return ISC_R_FAILURE
;
1016 *versionp
= (void *)state
->transaction_token
;
1018 return ISC_R_SUCCESS
;
1024 _PUBLIC_
void dlz_closeversion(const char *zone
, isc_boolean_t commit
,
1025 void *dbdata
, void **versionp
)
1027 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1029 if (state
->transaction_token
!= (int *)*versionp
) {
1030 state
->log(ISC_LOG_INFO
, "samba_dlz: transaction not started for zone %s", zone
);
1035 if (ldb_transaction_commit(state
->samdb
) != LDB_SUCCESS
) {
1036 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to commit a transaction for zone %s", zone
);
1039 state
->log(ISC_LOG_INFO
, "samba_dlz: committed transaction on zone %s", zone
);
1041 if (ldb_transaction_cancel(state
->samdb
) != LDB_SUCCESS
) {
1042 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to cancel a transaction for zone %s", zone
);
1045 state
->log(ISC_LOG_INFO
, "samba_dlz: cancelling transaction on zone %s", zone
);
1048 talloc_free(state
->transaction_token
);
1049 state
->transaction_token
= NULL
;
1055 see if there is a SOA record for a zone
1057 static bool b9_has_soa(struct dlz_bind9_data
*state
, struct ldb_dn
*dn
, const char *zone
)
1059 const char *attrs
[] = { "dnsRecord", NULL
};
1060 struct ldb_result
*res
;
1061 struct ldb_message_element
*el
;
1062 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
1065 if (!ldb_dn_add_child_fmt(dn
, "DC=@,DC=%s", zone
)) {
1066 talloc_free(tmp_ctx
);
1070 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
,
1071 attrs
, "objectClass=dnsNode");
1072 if (ret
!= LDB_SUCCESS
) {
1073 talloc_free(tmp_ctx
);
1077 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1079 talloc_free(tmp_ctx
);
1082 for (i
=0; i
<el
->num_values
; i
++) {
1083 struct dnsp_DnssrvRpcRecord rec
;
1084 enum ndr_err_code ndr_err
;
1086 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], tmp_ctx
, &rec
,
1087 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1088 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1091 if (rec
.wType
== DNS_TYPE_SOA
) {
1092 talloc_free(tmp_ctx
);
1097 talloc_free(tmp_ctx
);
1102 configure a writeable zone
1104 _PUBLIC_ isc_result_t
dlz_configure(dns_view_t
*view
, void *dbdata
)
1106 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1107 TALLOC_CTX
*tmp_ctx
;
1111 state
->log(ISC_LOG_INFO
, "samba_dlz: starting configure");
1112 if (state
->writeable_zone
== NULL
) {
1113 state
->log(ISC_LOG_INFO
, "samba_dlz: no writeable_zone method available");
1114 return ISC_R_FAILURE
;
1117 tmp_ctx
= talloc_new(state
);
1119 for (i
=0; zone_prefixes
[i
]; i
++) {
1120 const char *attrs
[] = { "name", NULL
};
1122 struct ldb_result
*res
;
1124 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
1126 talloc_free(tmp_ctx
);
1127 return ISC_R_NOMEMORY
;
1130 if (!ldb_dn_add_child_fmt(dn
, "%s", zone_prefixes
[i
])) {
1131 talloc_free(tmp_ctx
);
1132 return ISC_R_NOMEMORY
;
1135 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_SUBTREE
,
1136 attrs
, "objectClass=dnsZone");
1137 if (ret
!= LDB_SUCCESS
) {
1141 for (j
=0; j
<res
->count
; j
++) {
1142 isc_result_t result
;
1143 const char *zone
= ldb_msg_find_attr_as_string(res
->msgs
[j
], "name", NULL
);
1144 struct ldb_dn
*zone_dn
;
1149 zone_dn
= ldb_dn_copy(tmp_ctx
, dn
);
1150 if (zone_dn
== NULL
) {
1151 talloc_free(tmp_ctx
);
1152 return ISC_R_NOMEMORY
;
1155 if (!b9_has_soa(state
, zone_dn
, zone
)) {
1158 result
= state
->writeable_zone(view
, zone
);
1159 if (result
!= ISC_R_SUCCESS
) {
1160 state
->log(ISC_LOG_ERROR
, "samba_dlz: Failed to configure zone '%s'",
1162 talloc_free(tmp_ctx
);
1165 state
->log(ISC_LOG_INFO
, "samba_dlz: configured writeable zone '%s'", zone
);
1169 talloc_free(tmp_ctx
);
1170 return ISC_R_SUCCESS
;
1174 authorize a zone update
1176 _PUBLIC_ isc_boolean_t
dlz_ssumatch(const char *signer
, const char *name
, const char *tcpaddr
,
1177 const char *type
, const char *key
, uint32_t keydatalen
, uint8_t *keydata
,
1180 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1181 TALLOC_CTX
*tmp_ctx
;
1183 struct cli_credentials
*server_credentials
;
1188 struct gensec_security
*gensec_ctx
;
1189 struct auth_session_info
*session_info
;
1191 isc_result_t result
;
1192 struct ldb_result
*res
;
1193 const char * attrs
[] = { NULL
};
1194 uint32_t access_mask
;
1196 /* Remove cached credentials, if any */
1197 if (state
->session_info
) {
1198 talloc_free(state
->session_info
);
1199 state
->session_info
= NULL
;
1201 if (state
->update_name
) {
1202 talloc_free(state
->update_name
);
1203 state
->update_name
= NULL
;
1206 tmp_ctx
= talloc_new(NULL
);
1207 if (tmp_ctx
== NULL
) {
1208 state
->log(ISC_LOG_ERROR
, "samba_dlz: no memory");
1212 ap_req
= data_blob_const(keydata
, keydatalen
);
1213 server_credentials
= cli_credentials_init(tmp_ctx
);
1214 if (!server_credentials
) {
1215 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to init server credentials");
1216 talloc_free(tmp_ctx
);
1220 cli_credentials_set_krb5_context(server_credentials
, state
->smb_krb5_ctx
);
1221 cli_credentials_set_conf(server_credentials
, state
->lp
);
1223 keytab_name
= talloc_asprintf(tmp_ctx
, "file:%s/dns.keytab",
1224 lpcfg_private_dir(state
->lp
));
1225 ret
= cli_credentials_set_keytab_name(server_credentials
, state
->lp
, keytab_name
,
1228 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to obtain server credentials from %s",
1230 talloc_free(tmp_ctx
);
1233 talloc_free(keytab_name
);
1235 nt_status
= gensec_server_start(tmp_ctx
,
1236 lpcfg_gensec_settings(tmp_ctx
, state
->lp
),
1237 state
->auth_context
, &gensec_ctx
);
1238 if (!NT_STATUS_IS_OK(nt_status
)) {
1239 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to start gensec server");
1240 talloc_free(tmp_ctx
);
1244 gensec_set_credentials(gensec_ctx
, server_credentials
);
1246 nt_status
= gensec_start_mech_by_name(gensec_ctx
, "spnego");
1247 if (!NT_STATUS_IS_OK(nt_status
)) {
1248 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to start spnego");
1249 talloc_free(tmp_ctx
);
1253 nt_status
= gensec_update(gensec_ctx
, tmp_ctx
, state
->ev_ctx
, ap_req
, &ap_req
);
1254 if (!NT_STATUS_IS_OK(nt_status
)) {
1255 state
->log(ISC_LOG_ERROR
, "samba_dlz: spnego update failed");
1256 talloc_free(tmp_ctx
);
1260 nt_status
= gensec_session_info(gensec_ctx
, tmp_ctx
, &session_info
);
1261 if (!NT_STATUS_IS_OK(nt_status
)) {
1262 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to create session info");
1263 talloc_free(tmp_ctx
);
1267 /* Get the DN from name */
1268 result
= b9_find_name_dn(state
, name
, tmp_ctx
, &dn
);
1269 if (result
!= ISC_R_SUCCESS
) {
1270 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to find name %s", name
);
1271 talloc_free(tmp_ctx
);
1275 /* make sure the dn exists, or find parent dn in case new object is being added */
1276 ldb_ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
,
1277 attrs
, "objectClass=dnsNode");
1278 if (ldb_ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1279 ldb_dn_remove_child_components(dn
, 1);
1280 access_mask
= SEC_ADS_CREATE_CHILD
;
1282 } else if (ldb_ret
== LDB_SUCCESS
) {
1283 access_mask
= SEC_STD_REQUIRED
| SEC_ADS_SELF_WRITE
;
1286 talloc_free(tmp_ctx
);
1291 ldb_ret
= dsdb_check_access_on_dn(state
->samdb
, tmp_ctx
, dn
,
1292 session_info
->security_token
,
1294 if (ldb_ret
!= LDB_SUCCESS
) {
1295 state
->log(ISC_LOG_INFO
,
1296 "samba_dlz: disallowing update of signer=%s name=%s type=%s error=%s",
1297 signer
, name
, type
, ldb_strerror(ldb_ret
));
1298 talloc_free(tmp_ctx
);
1302 /* Cache session_info, so it can be used in the actual add/delete operation */
1303 state
->update_name
= talloc_strdup(state
, name
);
1304 if (state
->update_name
== NULL
) {
1305 state
->log(ISC_LOG_ERROR
, "samba_dlz: memory allocation error");
1306 talloc_free(tmp_ctx
);
1309 state
->session_info
= talloc_steal(state
, session_info
);
1311 state
->log(ISC_LOG_INFO
, "samba_dlz: allowing update of signer=%s name=%s tcpaddr=%s type=%s key=%s",
1312 signer
, name
, tcpaddr
, type
, key
);
1314 talloc_free(tmp_ctx
);
1322 static isc_result_t
b9_add_record(struct dlz_bind9_data
*state
, const char *name
,
1324 struct dnsp_DnssrvRpcRecord
*rec
)
1326 struct ldb_message
*msg
;
1327 enum ndr_err_code ndr_err
;
1331 msg
= ldb_msg_new(rec
);
1333 return ISC_R_NOMEMORY
;
1336 ret
= ldb_msg_add_string(msg
, "objectClass", "dnsNode");
1337 if (ret
!= LDB_SUCCESS
) {
1338 return ISC_R_FAILURE
;
1341 ndr_err
= ndr_push_struct_blob(&v
, rec
, rec
, (ndr_push_flags_fn_t
)ndr_push_dnsp_DnssrvRpcRecord
);
1342 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1343 return ISC_R_FAILURE
;
1345 ret
= ldb_msg_add_value(msg
, "dnsRecord", &v
, NULL
);
1346 if (ret
!= LDB_SUCCESS
) {
1347 return ISC_R_FAILURE
;
1350 ret
= ldb_add(state
->samdb
, msg
);
1351 if (ret
!= LDB_SUCCESS
) {
1352 return ISC_R_FAILURE
;
1355 return ISC_R_SUCCESS
;
1359 see if two DNS names are the same
1361 static bool dns_name_equal(const char *name1
, const char *name2
)
1363 size_t len1
= strlen(name1
);
1364 size_t len2
= strlen(name2
);
1365 if (name1
[len1
-1] == '.') len1
--;
1366 if (name2
[len2
-1] == '.') len2
--;
1370 return strncasecmp_m(name1
, name2
, len1
) == 0;
1375 see if two dns records match
1377 static bool b9_record_match(struct dlz_bind9_data
*state
,
1378 struct dnsp_DnssrvRpcRecord
*rec1
, struct dnsp_DnssrvRpcRecord
*rec2
)
1383 if (rec1
->wType
!= rec2
->wType
) {
1386 /* see if this type is single valued */
1387 if (b9_single_valued(rec1
->wType
)) {
1391 /* see if the data matches */
1392 switch (rec1
->wType
) {
1394 return strcmp(rec1
->data
.ipv4
, rec2
->data
.ipv4
) == 0;
1396 return strcmp(rec1
->data
.ipv6
, rec2
->data
.ipv6
) == 0;
1397 case DNS_TYPE_CNAME
:
1398 return dns_name_equal(rec1
->data
.cname
, rec2
->data
.cname
);
1400 status
= (rec1
->data
.txt
.count
== rec2
->data
.txt
.count
);
1401 if (!status
) return status
;
1402 for (i
=0; i
<rec1
->data
.txt
.count
; i
++) {
1403 status
&= (strcmp(rec1
->data
.txt
.str
[i
], rec2
->data
.txt
.str
[i
]) == 0);
1407 return dns_name_equal(rec1
->data
.ptr
, rec2
->data
.ptr
);
1409 return dns_name_equal(rec1
->data
.ns
, rec2
->data
.ns
);
1412 return rec1
->data
.srv
.wPriority
== rec2
->data
.srv
.wPriority
&&
1413 rec1
->data
.srv
.wWeight
== rec2
->data
.srv
.wWeight
&&
1414 rec1
->data
.srv
.wPort
== rec2
->data
.srv
.wPort
&&
1415 dns_name_equal(rec1
->data
.srv
.nameTarget
, rec2
->data
.srv
.nameTarget
);
1418 return rec1
->data
.mx
.wPriority
== rec2
->data
.mx
.wPriority
&&
1419 dns_name_equal(rec1
->data
.mx
.nameTarget
, rec2
->data
.mx
.nameTarget
);
1421 case DNS_TYPE_HINFO
:
1422 return strcmp(rec1
->data
.hinfo
.cpu
, rec2
->data
.hinfo
.cpu
) == 0 &&
1423 strcmp(rec1
->data
.hinfo
.os
, rec2
->data
.hinfo
.os
) == 0;
1426 return dns_name_equal(rec1
->data
.soa
.mname
, rec2
->data
.soa
.mname
) &&
1427 dns_name_equal(rec1
->data
.soa
.rname
, rec2
->data
.soa
.rname
) &&
1428 rec1
->data
.soa
.serial
== rec2
->data
.soa
.serial
&&
1429 rec1
->data
.soa
.refresh
== rec2
->data
.soa
.refresh
&&
1430 rec1
->data
.soa
.retry
== rec2
->data
.soa
.retry
&&
1431 rec1
->data
.soa
.expire
== rec2
->data
.soa
.expire
&&
1432 rec1
->data
.soa
.minimum
== rec2
->data
.soa
.minimum
;
1434 state
->log(ISC_LOG_ERROR
, "samba b9_putrr: unhandled record type %u",
1443 * Update session_info on samdb using the cached credentials
1445 static bool b9_set_session_info(struct dlz_bind9_data
*state
, const char *name
)
1449 if (state
->update_name
== NULL
|| state
->session_info
== NULL
) {
1450 state
->log(ISC_LOG_ERROR
, "samba_dlz: invalid credentials");
1454 /* Do not use client credentials, if we not updating the client specified name */
1455 if (strcmp(state
->update_name
, name
) != 0) {
1459 ret
= ldb_set_opaque(state
->samdb
, "sessionInfo", state
->session_info
);
1460 if (ret
!= LDB_SUCCESS
) {
1461 state
->log(ISC_LOG_ERROR
, "samba_dlz: unable to set session info");
1469 * Reset session_info on samdb as system session
1471 static void b9_reset_session_info(struct dlz_bind9_data
*state
)
1473 ldb_set_opaque(state
->samdb
, "sessionInfo", system_session(state
->lp
));
1477 add or modify a rdataset
1479 _PUBLIC_ isc_result_t
dlz_addrdataset(const char *name
, const char *rdatastr
, void *dbdata
, void *version
)
1481 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1482 struct dnsp_DnssrvRpcRecord
*rec
;
1484 isc_result_t result
;
1485 struct ldb_result
*res
;
1486 const char *attrs
[] = { "dnsRecord", NULL
};
1488 struct ldb_message_element
*el
;
1489 enum ndr_err_code ndr_err
;
1492 if (state
->transaction_token
!= (void*)version
) {
1493 state
->log(ISC_LOG_INFO
, "samba_dlz: bad transaction version");
1494 return ISC_R_FAILURE
;
1497 rec
= talloc_zero(state
, struct dnsp_DnssrvRpcRecord
);
1499 return ISC_R_NOMEMORY
;
1502 unix_to_nt_time(&t
, time(NULL
));
1503 t
/= 10*1000*1000; /* convert to seconds (NT time is in 100ns units) */
1504 t
/= 3600; /* convert to hours */
1506 rec
->rank
= DNS_RANK_ZONE
;
1507 rec
->dwSerial
= state
->soa_serial
;
1508 rec
->dwTimeStamp
= (uint32_t)t
;
1510 if (!b9_parse(state
, rdatastr
, rec
)) {
1511 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to parse rdataset '%s'", rdatastr
);
1513 return ISC_R_FAILURE
;
1516 /* find the DN of the record */
1517 result
= b9_find_name_dn(state
, name
, rec
, &dn
);
1518 if (result
!= ISC_R_SUCCESS
) {
1523 /* get any existing records */
1524 ret
= ldb_search(state
->samdb
, rec
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsNode");
1525 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1526 if (!b9_set_session_info(state
, name
)) {
1528 return ISC_R_FAILURE
;
1530 result
= b9_add_record(state
, name
, dn
, rec
);
1531 b9_reset_session_info(state
);
1533 if (result
== ISC_R_SUCCESS
) {
1534 state
->log(ISC_LOG_INFO
, "samba_dlz: added %s %s", name
, rdatastr
);
1539 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1541 ret
= ldb_msg_add_empty(res
->msgs
[0], "dnsRecord", LDB_FLAG_MOD_ADD
, &el
);
1542 if (ret
!= LDB_SUCCESS
) {
1543 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to add dnsRecord for %s",
1544 ldb_dn_get_linearized(dn
));
1546 return ISC_R_FAILURE
;
1550 /* there are existing records. We need to see if this will
1551 * replace a record or add to it
1553 for (i
=0; i
<el
->num_values
; i
++) {
1554 struct dnsp_DnssrvRpcRecord rec2
;
1556 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], rec
, &rec2
,
1557 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1558 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1559 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
1560 ldb_dn_get_linearized(dn
));
1562 return ISC_R_FAILURE
;
1565 if (b9_record_match(state
, rec
, &rec2
)) {
1569 if (i
== el
->num_values
) {
1570 /* adding a new value */
1571 el
->values
= talloc_realloc(el
, el
->values
, struct ldb_val
, el
->num_values
+1);
1572 if (el
->values
== NULL
) {
1574 return ISC_R_NOMEMORY
;
1579 ndr_err
= ndr_push_struct_blob(&el
->values
[i
], rec
, rec
,
1580 (ndr_push_flags_fn_t
)ndr_push_dnsp_DnssrvRpcRecord
);
1581 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1582 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to push dnsRecord for %s",
1583 ldb_dn_get_linearized(dn
));
1585 return ISC_R_FAILURE
;
1589 if (!b9_set_session_info(state
, name
)) {
1591 return ISC_R_FAILURE
;
1594 /* modify the record */
1595 el
->flags
= LDB_FLAG_MOD_REPLACE
;
1596 ret
= ldb_modify(state
->samdb
, res
->msgs
[0]);
1597 b9_reset_session_info(state
);
1598 if (ret
!= LDB_SUCCESS
) {
1599 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to modify %s - %s",
1600 ldb_dn_get_linearized(dn
), ldb_errstring(state
->samdb
));
1602 return ISC_R_FAILURE
;
1605 state
->log(ISC_LOG_INFO
, "samba_dlz: added rdataset %s '%s'", name
, rdatastr
);
1608 return ISC_R_SUCCESS
;
1614 _PUBLIC_ isc_result_t
dlz_subrdataset(const char *name
, const char *rdatastr
, void *dbdata
, void *version
)
1616 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1617 struct dnsp_DnssrvRpcRecord
*rec
;
1619 isc_result_t result
;
1620 struct ldb_result
*res
;
1621 const char *attrs
[] = { "dnsRecord", NULL
};
1623 struct ldb_message_element
*el
;
1624 enum ndr_err_code ndr_err
;
1626 if (state
->transaction_token
!= (void*)version
) {
1627 state
->log(ISC_LOG_ERROR
, "samba_dlz: bad transaction version");
1628 return ISC_R_FAILURE
;
1631 rec
= talloc_zero(state
, struct dnsp_DnssrvRpcRecord
);
1633 return ISC_R_NOMEMORY
;
1636 if (!b9_parse(state
, rdatastr
, rec
)) {
1637 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse rdataset '%s'", rdatastr
);
1639 return ISC_R_FAILURE
;
1642 /* find the DN of the record */
1643 result
= b9_find_name_dn(state
, name
, rec
, &dn
);
1644 if (result
!= ISC_R_SUCCESS
) {
1649 /* get the existing records */
1650 ret
= ldb_search(state
->samdb
, rec
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsNode");
1651 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1653 return ISC_R_NOTFOUND
;
1656 /* there are existing records. We need to see if any match
1658 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1659 if (el
== NULL
|| el
->num_values
== 0) {
1660 state
->log(ISC_LOG_ERROR
, "samba_dlz: no dnsRecord attribute for %s",
1661 ldb_dn_get_linearized(dn
));
1663 return ISC_R_FAILURE
;
1666 for (i
=0; i
<el
->num_values
; i
++) {
1667 struct dnsp_DnssrvRpcRecord rec2
;
1669 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], rec
, &rec2
,
1670 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1671 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1672 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
1673 ldb_dn_get_linearized(dn
));
1675 return ISC_R_FAILURE
;
1678 if (b9_record_match(state
, rec
, &rec2
)) {
1682 if (i
== el
->num_values
) {
1684 return ISC_R_NOTFOUND
;
1687 if (i
< el
->num_values
-1) {
1688 memmove(&el
->values
[i
], &el
->values
[i
+1], sizeof(el
->values
[0])*((el
->num_values
-1)-i
));
1692 if (!b9_set_session_info(state
, name
)) {
1694 return ISC_R_FAILURE
;
1697 if (el
->num_values
== 0) {
1698 el
->flags
= LDB_FLAG_MOD_DELETE
;
1700 el
->flags
= LDB_FLAG_MOD_REPLACE
;
1702 ret
= ldb_modify(state
->samdb
, res
->msgs
[0]);
1704 b9_reset_session_info(state
);
1705 if (ret
!= LDB_SUCCESS
) {
1706 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to modify %s - %s",
1707 ldb_dn_get_linearized(dn
), ldb_errstring(state
->samdb
));
1709 return ISC_R_FAILURE
;
1712 state
->log(ISC_LOG_INFO
, "samba_dlz: subtracted rdataset %s '%s'", name
, rdatastr
);
1715 return ISC_R_SUCCESS
;
1720 delete all records of the given type
1722 _PUBLIC_ isc_result_t
dlz_delrdataset(const char *name
, const char *type
, void *dbdata
, void *version
)
1724 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1725 TALLOC_CTX
*tmp_ctx
;
1727 isc_result_t result
;
1728 struct ldb_result
*res
;
1729 const char *attrs
[] = { "dnsRecord", NULL
};
1731 struct ldb_message_element
*el
;
1732 enum ndr_err_code ndr_err
;
1733 enum dns_record_type dns_type
;
1736 if (state
->transaction_token
!= (void*)version
) {
1737 state
->log(ISC_LOG_ERROR
, "samba_dlz: bad transaction version");
1738 return ISC_R_FAILURE
;
1741 if (!b9_dns_type(type
, &dns_type
)) {
1742 state
->log(ISC_LOG_ERROR
, "samba_dlz: bad dns type %s in delete", type
);
1743 return ISC_R_FAILURE
;
1746 tmp_ctx
= talloc_new(state
);
1748 /* find the DN of the record */
1749 result
= b9_find_name_dn(state
, name
, tmp_ctx
, &dn
);
1750 if (result
!= ISC_R_SUCCESS
) {
1751 talloc_free(tmp_ctx
);
1755 /* get the existing records */
1756 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsNode");
1757 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1758 talloc_free(tmp_ctx
);
1759 return ISC_R_NOTFOUND
;
1762 /* there are existing records. We need to see if any match the type
1764 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1765 if (el
== NULL
|| el
->num_values
== 0) {
1766 talloc_free(tmp_ctx
);
1767 return ISC_R_NOTFOUND
;
1770 for (i
=0; i
<el
->num_values
; i
++) {
1771 struct dnsp_DnssrvRpcRecord rec2
;
1773 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], tmp_ctx
, &rec2
,
1774 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1775 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1776 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
1777 ldb_dn_get_linearized(dn
));
1778 talloc_free(tmp_ctx
);
1779 return ISC_R_FAILURE
;
1782 if (dns_type
== rec2
.wType
) {
1783 if (i
< el
->num_values
-1) {
1784 memmove(&el
->values
[i
], &el
->values
[i
+1],
1785 sizeof(el
->values
[0])*((el
->num_values
-1)-i
));
1794 talloc_free(tmp_ctx
);
1795 return ISC_R_FAILURE
;
1798 if (!b9_set_session_info(state
, name
)) {
1799 talloc_free(tmp_ctx
);
1800 return ISC_R_FAILURE
;
1803 if (el
->num_values
== 0) {
1804 el
->flags
= LDB_FLAG_MOD_DELETE
;
1806 el
->flags
= LDB_FLAG_MOD_REPLACE
;
1808 ret
= ldb_modify(state
->samdb
, res
->msgs
[0]);
1810 b9_reset_session_info(state
);
1811 if (ret
!= LDB_SUCCESS
) {
1812 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to delete type %s in %s - %s",
1813 type
, ldb_dn_get_linearized(dn
), ldb_errstring(state
->samdb
));
1814 talloc_free(tmp_ctx
);
1815 return ISC_R_FAILURE
;
1818 state
->log(ISC_LOG_INFO
, "samba_dlz: deleted rdataset %s of type %s", name
, type
);
1820 talloc_free(tmp_ctx
);
1821 return ISC_R_SUCCESS
;