2 Unix SMB/CIFS implementation.
4 bind9 dlz driver for Samba
6 Copyright (C) 2010 Andrew Tridgell
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "param/param.h"
25 #include "lib/events/events.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "dsdb/common/util.h"
28 #include "auth/auth.h"
29 #include "auth/session.h"
30 #include "auth/gensec/gensec.h"
31 #include "librpc/gen_ndr/security.h"
32 #include "auth/credentials/credentials.h"
33 #include "system/kerberos.h"
34 #include "auth/kerberos/kerberos.h"
35 #include "gen_ndr/ndr_dnsp.h"
36 #include "gen_ndr/server_id.h"
37 #include "messaging/messaging.h"
38 #include "lib/cmdline/popt_common.h"
39 #include "dlz_minimal.h"
47 struct dlz_bind9_data
{
48 struct b9_options options
;
49 struct ldb_context
*samdb
;
50 struct tevent_context
*ev_ctx
;
51 struct loadparm_context
*lp
;
52 int *transaction_token
;
55 /* Used for dynamic update */
56 struct smb_krb5_context
*smb_krb5_ctx
;
57 struct auth4_context
*auth_context
;
58 struct auth_session_info
*session_info
;
61 /* helper functions from the dlz_dlopen driver */
63 dns_sdlz_putrr_t
*putrr
;
64 dns_sdlz_putnamedrr_t
*putnamedrr
;
65 dns_dlz_writeablezone_t
*writeable_zone
;
68 static struct dlz_bind9_data
*dlz_bind9_state
= NULL
;
69 static int dlz_bind9_state_ref_count
= 0;
71 static const char *zone_prefixes
[] = {
72 "CN=MicrosoftDNS,DC=DomainDnsZones",
73 "CN=MicrosoftDNS,DC=ForestDnsZones",
74 "CN=MicrosoftDNS,CN=System",
79 return the version of the API
81 _PUBLIC_
int dlz_version(unsigned int *flags
)
83 return DLZ_DLOPEN_VERSION
;
87 remember a helper function from the bind9 dlz_dlopen driver
89 static void b9_add_helper(struct dlz_bind9_data
*state
, const char *helper_name
, void *ptr
)
91 if (strcmp(helper_name
, "log") == 0) {
94 if (strcmp(helper_name
, "putrr") == 0) {
97 if (strcmp(helper_name
, "putnamedrr") == 0) {
98 state
->putnamedrr
= ptr
;
100 if (strcmp(helper_name
, "writeable_zone") == 0) {
101 state
->writeable_zone
= ptr
;
106 format a record for bind9
108 static bool b9_format(struct dlz_bind9_data
*state
,
110 struct dnsp_DnssrvRpcRecord
*rec
,
111 const char **type
, const char **data
)
116 switch (rec
->wType
) {
119 *data
= rec
->data
.ipv4
;
124 *data
= rec
->data
.ipv6
;
129 *data
= rec
->data
.cname
;
134 tmp
= talloc_asprintf(mem_ctx
, "\"%s\"", rec
->data
.txt
.str
[0]);
135 for (i
=1; i
<rec
->data
.txt
.count
; i
++) {
136 tmp
= talloc_asprintf_append(tmp
, " \"%s\"", rec
->data
.txt
.str
[i
]);
143 *data
= rec
->data
.ptr
;
148 *data
= talloc_asprintf(mem_ctx
, "%u %u %u %s",
149 rec
->data
.srv
.wPriority
,
150 rec
->data
.srv
.wWeight
,
152 rec
->data
.srv
.nameTarget
);
157 *data
= talloc_asprintf(mem_ctx
, "%u %s",
158 rec
->data
.mx
.wPriority
,
159 rec
->data
.mx
.nameTarget
);
164 *data
= talloc_asprintf(mem_ctx
, "%s %s",
171 *data
= rec
->data
.ns
;
178 /* we need to fake the authoritative nameserver to
179 * point at ourselves. This is how AD DNS servers
180 * force clients to send updates to the right local DC
182 mname
= talloc_asprintf(mem_ctx
, "%s.%s",
183 lpcfg_netbios_name(state
->lp
), lpcfg_dnsdomain(state
->lp
));
187 mname
= strlower_talloc(mem_ctx
, mname
);
192 state
->soa_serial
= rec
->data
.soa
.serial
;
194 *data
= talloc_asprintf(mem_ctx
, "%s %s %u %u %u %u %u",
197 rec
->data
.soa
.serial
,
198 rec
->data
.soa
.refresh
,
200 rec
->data
.soa
.expire
,
201 rec
->data
.soa
.minimum
);
206 state
->log(ISC_LOG_ERROR
, "samba b9_putrr: unhandled record type %u",
214 static const struct {
215 enum dns_record_type dns_type
;
219 { DNS_TYPE_A
, "A" , false},
220 { DNS_TYPE_AAAA
, "AAAA" , false},
221 { DNS_TYPE_CNAME
, "CNAME" , true},
222 { DNS_TYPE_TXT
, "TXT" , false},
223 { DNS_TYPE_PTR
, "PTR" , false},
224 { DNS_TYPE_SRV
, "SRV" , false},
225 { DNS_TYPE_MX
, "MX" , false},
226 { DNS_TYPE_HINFO
, "HINFO" , false},
227 { DNS_TYPE_NS
, "NS" , false},
228 { DNS_TYPE_SOA
, "SOA" , true},
233 see if a DNS type is single valued
235 static bool b9_single_valued(enum dns_record_type dns_type
)
238 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
239 if (dns_typemap
[i
].dns_type
== dns_type
) {
240 return dns_typemap
[i
].single_valued
;
247 see if a DNS type is single valued
249 static bool b9_dns_type(const char *type
, enum dns_record_type
*dtype
)
252 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
253 if (strcasecmp(dns_typemap
[i
].typestr
, type
) == 0) {
254 *dtype
= dns_typemap
[i
].dns_type
;
262 #define DNS_PARSE_STR(ret, str, sep, saveptr) do { \
263 (ret) = strtok_r(str, sep, &saveptr); \
264 if ((ret) == NULL) return false; \
267 #define DNS_PARSE_UINT(ret, str, sep, saveptr) do { \
268 char *istr = strtok_r(str, sep, &saveptr); \
269 if ((istr) == NULL) return false; \
270 (ret) = strtoul(istr, NULL, 10); \
274 parse a record from bind9
276 static bool b9_parse(struct dlz_bind9_data
*state
,
277 const char *rdatastr
,
278 struct dnsp_DnssrvRpcRecord
*rec
)
280 char *full_name
, *dclass
, *type
;
281 char *str
, *tmp
, *saveptr
=NULL
;
284 str
= talloc_strdup(rec
, rdatastr
);
289 /* parse the SDLZ string form */
290 DNS_PARSE_STR(full_name
, str
, "\t", saveptr
);
291 DNS_PARSE_UINT(rec
->dwTtlSeconds
, NULL
, "\t", saveptr
);
292 DNS_PARSE_STR(dclass
, NULL
, "\t", saveptr
);
293 DNS_PARSE_STR(type
, NULL
, "\t", saveptr
);
295 /* construct the record */
296 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
297 if (strcasecmp(type
, dns_typemap
[i
].typestr
) == 0) {
298 rec
->wType
= dns_typemap
[i
].dns_type
;
302 if (i
== ARRAY_SIZE(dns_typemap
)) {
303 state
->log(ISC_LOG_ERROR
, "samba_dlz: unsupported record type '%s' for '%s'",
308 switch (rec
->wType
) {
310 DNS_PARSE_STR(rec
->data
.ipv4
, NULL
, " ", saveptr
);
314 DNS_PARSE_STR(rec
->data
.ipv6
, NULL
, " ", saveptr
);
318 DNS_PARSE_STR(rec
->data
.cname
, NULL
, " ", saveptr
);
322 rec
->data
.txt
.count
= 0;
323 rec
->data
.txt
.str
= talloc_array(rec
, const char *, rec
->data
.txt
.count
);
324 tmp
= strtok_r(NULL
, "\t", &saveptr
);
326 rec
->data
.txt
.str
= talloc_realloc(rec
, rec
->data
.txt
.str
, const char *,
327 rec
->data
.txt
.count
+1);
330 rec
->data
.txt
.str
[rec
->data
.txt
.count
] = talloc_strndup(rec
, &tmp
[1], strlen(tmp
)-2);
332 rec
->data
.txt
.str
[rec
->data
.txt
.count
] = talloc_strdup(rec
, tmp
);
334 rec
->data
.txt
.count
++;
335 tmp
= strtok_r(NULL
, " ", &saveptr
);
340 DNS_PARSE_STR(rec
->data
.ptr
, NULL
, " ", saveptr
);
344 DNS_PARSE_UINT(rec
->data
.srv
.wPriority
, NULL
, " ", saveptr
);
345 DNS_PARSE_UINT(rec
->data
.srv
.wWeight
, NULL
, " ", saveptr
);
346 DNS_PARSE_UINT(rec
->data
.srv
.wPort
, NULL
, " ", saveptr
);
347 DNS_PARSE_STR(rec
->data
.srv
.nameTarget
, NULL
, " ", saveptr
);
351 DNS_PARSE_UINT(rec
->data
.mx
.wPriority
, NULL
, " ", saveptr
);
352 DNS_PARSE_STR(rec
->data
.mx
.nameTarget
, NULL
, " ", saveptr
);
356 DNS_PARSE_STR(rec
->data
.hinfo
.cpu
, NULL
, " ", saveptr
);
357 DNS_PARSE_STR(rec
->data
.hinfo
.os
, NULL
, " ", saveptr
);
361 DNS_PARSE_STR(rec
->data
.ns
, NULL
, " ", saveptr
);
365 DNS_PARSE_STR(rec
->data
.soa
.mname
, NULL
, " ", saveptr
);
366 DNS_PARSE_STR(rec
->data
.soa
.rname
, NULL
, " ", saveptr
);
367 DNS_PARSE_UINT(rec
->data
.soa
.serial
, NULL
, " ", saveptr
);
368 DNS_PARSE_UINT(rec
->data
.soa
.refresh
, NULL
, " ", saveptr
);
369 DNS_PARSE_UINT(rec
->data
.soa
.retry
, NULL
, " ", saveptr
);
370 DNS_PARSE_UINT(rec
->data
.soa
.expire
, NULL
, " ", saveptr
);
371 DNS_PARSE_UINT(rec
->data
.soa
.minimum
, NULL
, " ", saveptr
);
375 state
->log(ISC_LOG_ERROR
, "samba b9_parse: unhandled record type %u",
380 /* we should be at the end of the buffer now */
381 if (strtok_r(NULL
, "\t ", &saveptr
) != NULL
) {
382 state
->log(ISC_LOG_ERROR
, "samba b9_parse: expected data at end of string for '%s'");
390 send a resource recond to bind9
392 static isc_result_t
b9_putrr(struct dlz_bind9_data
*state
,
393 void *handle
, struct dnsp_DnssrvRpcRecord
*rec
,
397 const char *type
, *data
;
398 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
400 if (!b9_format(state
, tmp_ctx
, rec
, &type
, &data
)) {
401 return ISC_R_FAILURE
;
405 talloc_free(tmp_ctx
);
406 return ISC_R_NOMEMORY
;
411 for (i
=0; types
[i
]; i
++) {
412 if (strcmp(types
[i
], type
) == 0) break;
414 if (types
[i
] == NULL
) {
416 return ISC_R_SUCCESS
;
420 result
= state
->putrr(handle
, type
, rec
->dwTtlSeconds
, data
);
421 if (result
!= ISC_R_SUCCESS
) {
422 state
->log(ISC_LOG_ERROR
, "Failed to put rr");
424 talloc_free(tmp_ctx
);
430 send a named resource recond to bind9
432 static isc_result_t
b9_putnamedrr(struct dlz_bind9_data
*state
,
433 void *handle
, const char *name
,
434 struct dnsp_DnssrvRpcRecord
*rec
)
437 const char *type
, *data
;
438 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
440 if (!b9_format(state
, tmp_ctx
, rec
, &type
, &data
)) {
441 return ISC_R_FAILURE
;
445 talloc_free(tmp_ctx
);
446 return ISC_R_NOMEMORY
;
449 result
= state
->putnamedrr(handle
, name
, type
, rec
->dwTtlSeconds
, data
);
450 if (result
!= ISC_R_SUCCESS
) {
451 state
->log(ISC_LOG_ERROR
, "Failed to put named rr '%s'", name
);
453 talloc_free(tmp_ctx
);
460 static isc_result_t
parse_options(struct dlz_bind9_data
*state
,
461 unsigned int argc
, char *argv
[],
462 struct b9_options
*options
)
466 struct poptOption long_options
[] = {
467 { "url", 'H', POPT_ARG_STRING
, &options
->url
, 0, "database URL", "URL" },
468 { "debug", 'd', POPT_ARG_STRING
, &options
->debug
, 0, "debug level", "DEBUG" },
472 pc
= poptGetContext("dlz_bind9", argc
, (const char **)argv
, long_options
,
473 POPT_CONTEXT_KEEP_FIRST
);
474 while ((opt
= poptGetNextOpt(pc
)) != -1) {
477 state
->log(ISC_LOG_ERROR
, "dlz_bind9: Invalid option %s: %s",
478 poptBadOption(pc
, 0), poptStrerror(opt
));
479 return ISC_R_FAILURE
;
483 return ISC_R_SUCCESS
;
488 * Create session info from PAC
489 * This is called as auth_context->generate_session_info_pac()
491 static NTSTATUS
b9_generate_session_info_pac(struct auth4_context
*auth_context
,
493 struct smb_krb5_context
*smb_krb5_context
,
495 const char *principal_name
,
496 const struct tsocket_address
*remote_addr
,
497 uint32_t session_info_flags
,
498 struct auth_session_info
**session_info
)
501 struct auth_user_info_dc
*user_info_dc
;
504 tmp_ctx
= talloc_new(mem_ctx
);
505 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
507 status
= kerberos_pac_blob_to_user_info_dc(tmp_ctx
,
509 smb_krb5_context
->krb5_context
,
513 if (!NT_STATUS_IS_OK(status
)) {
514 talloc_free(tmp_ctx
);
518 if (user_info_dc
->info
->authenticated
) {
519 session_info_flags
|= AUTH_SESSION_INFO_AUTHENTICATED
;
522 session_info_flags
|= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES
;
524 status
= auth_generate_session_info(mem_ctx
, NULL
, NULL
, user_info_dc
,
525 session_info_flags
, session_info
);
526 if (!NT_STATUS_IS_OK(status
)) {
527 talloc_free(tmp_ctx
);
531 talloc_free(tmp_ctx
);
535 /* Callback for the DEBUG() system, to catch the remaining messages */
536 static void b9_debug(void *private_ptr
, int msg_level
, const char *msg
)
538 static const int isc_log_map
[] = {
539 ISC_LOG_CRITICAL
, /* 0 */
540 ISC_LOG_ERROR
, /* 1 */
541 ISC_LOG_WARNING
, /* 2 */
542 ISC_LOG_NOTICE
/* 3 */
544 struct dlz_bind9_data
*state
= private_ptr
;
547 if (msg_level
>= ARRAY_SIZE(isc_log_map
) || msg_level
< 0) {
548 isc_log_level
= ISC_LOG_INFO
;
550 isc_log_level
= isc_log_map
[msg_level
];
552 state
->log(isc_log_level
, "samba_dlz: %s", msg
);
555 int dlz_state_debug_unregister(struct dlz_bind9_data
*state
)
557 /* Stop logging (to the bind9 logs) */
558 debug_set_callback(NULL
, NULL
);
562 called to initialise the driver
564 _PUBLIC_ isc_result_t
dlz_create(const char *dlzname
,
565 unsigned int argc
, char *argv
[],
568 struct dlz_bind9_data
*state
;
569 const char *helper_name
;
575 if (dlz_bind9_state
!= NULL
) {
576 *dbdata
= dlz_bind9_state
;
577 dlz_bind9_state_ref_count
++;
578 return ISC_R_SUCCESS
;
581 state
= talloc_zero(NULL
, struct dlz_bind9_data
);
583 return ISC_R_NOMEMORY
;
586 talloc_set_destructor(state
, dlz_state_debug_unregister
);
588 /* fill in the helper functions */
589 va_start(ap
, dbdata
);
590 while ((helper_name
= va_arg(ap
, const char *)) != NULL
) {
591 b9_add_helper(state
, helper_name
, va_arg(ap
, void*));
595 /* Do not install samba signal handlers */
596 fault_setup_disable();
598 /* Start logging (to the bind9 logs) */
599 debug_set_callback(state
, b9_debug
);
601 state
->ev_ctx
= s4_event_context_init(state
);
602 if (state
->ev_ctx
== NULL
) {
603 result
= ISC_R_NOMEMORY
;
607 result
= parse_options(state
, argc
, argv
, &state
->options
);
608 if (result
!= ISC_R_SUCCESS
) {
612 state
->lp
= loadparm_init_global(true);
613 if (state
->lp
== NULL
) {
614 result
= ISC_R_NOMEMORY
;
618 if (state
->options
.debug
) {
619 lpcfg_do_global_parameter(state
->lp
, "log level", state
->options
.debug
);
621 lpcfg_do_global_parameter(state
->lp
, "log level", "0");
624 if (smb_krb5_init_context(state
, state
->ev_ctx
, state
->lp
, &state
->smb_krb5_ctx
) != 0) {
625 result
= ISC_R_NOMEMORY
;
629 nt_status
= gensec_init();
630 if (!NT_STATUS_IS_OK(nt_status
)) {
631 result
= ISC_R_NOMEMORY
;
635 state
->auth_context
= talloc_zero(state
, struct auth4_context
);
636 if (state
->auth_context
== NULL
) {
637 result
= ISC_R_NOMEMORY
;
641 if (state
->options
.url
== NULL
) {
642 state
->options
.url
= lpcfg_private_path(state
, state
->lp
, "dns/sam.ldb");
643 if (state
->options
.url
== NULL
) {
644 result
= ISC_R_NOMEMORY
;
649 state
->samdb
= samdb_connect_url(state
, state
->ev_ctx
, state
->lp
,
650 system_session(state
->lp
), 0, state
->options
.url
);
651 if (state
->samdb
== NULL
) {
652 state
->log(ISC_LOG_ERROR
, "samba_dlz: Failed to connect to %s",
654 result
= ISC_R_FAILURE
;
658 dn
= ldb_get_default_basedn(state
->samdb
);
660 state
->log(ISC_LOG_ERROR
, "samba_dlz: Unable to get basedn for %s - %s",
661 state
->options
.url
, ldb_errstring(state
->samdb
));
662 result
= ISC_R_FAILURE
;
666 state
->log(ISC_LOG_INFO
, "samba_dlz: started for DN %s",
667 ldb_dn_get_linearized(dn
));
669 state
->auth_context
->event_ctx
= state
->ev_ctx
;
670 state
->auth_context
->lp_ctx
= state
->lp
;
671 state
->auth_context
->sam_ctx
= state
->samdb
;
672 state
->auth_context
->generate_session_info_pac
= b9_generate_session_info_pac
;
675 dlz_bind9_state
= state
;
676 dlz_bind9_state_ref_count
++;
678 return ISC_R_SUCCESS
;
688 _PUBLIC_
void dlz_destroy(void *dbdata
)
690 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
691 state
->log(ISC_LOG_INFO
, "samba_dlz: shutting down");
693 dlz_bind9_state_ref_count
--;
694 if (dlz_bind9_state_ref_count
== 0) {
695 talloc_unlink(state
, state
->samdb
);
697 dlz_bind9_state
= NULL
;
703 return the base DN for a zone
705 static isc_result_t
b9_find_zone_dn(struct dlz_bind9_data
*state
, const char *zone_name
,
706 TALLOC_CTX
*mem_ctx
, struct ldb_dn
**zone_dn
)
709 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
710 const char *attrs
[] = { NULL
};
713 for (i
=0; zone_prefixes
[i
]; i
++) {
715 struct ldb_result
*res
;
717 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
719 talloc_free(tmp_ctx
);
720 return ISC_R_NOMEMORY
;
723 if (!ldb_dn_add_child_fmt(dn
, "DC=%s,%s", zone_name
, zone_prefixes
[i
])) {
724 talloc_free(tmp_ctx
);
725 return ISC_R_NOMEMORY
;
728 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsZone");
729 if (ret
== LDB_SUCCESS
) {
730 if (zone_dn
!= NULL
) {
731 *zone_dn
= talloc_steal(mem_ctx
, dn
);
733 talloc_free(tmp_ctx
);
734 return ISC_R_SUCCESS
;
739 talloc_free(tmp_ctx
);
740 return ISC_R_NOTFOUND
;
745 return the DN for a name. The record does not need to exist, but the
748 static isc_result_t
b9_find_name_dn(struct dlz_bind9_data
*state
, const char *name
,
749 TALLOC_CTX
*mem_ctx
, struct ldb_dn
**dn
)
753 /* work through the name piece by piece, until we find a zone */
756 result
= b9_find_zone_dn(state
, p
, mem_ctx
, dn
);
757 if (result
== ISC_R_SUCCESS
) {
758 /* we found a zone, now extend the DN to get
763 ret
= ldb_dn_add_child_fmt(*dn
, "DC=@");
765 ret
= ldb_dn_add_child_fmt(*dn
, "DC=%.*s", (int)(p
-name
)-1, name
);
769 return ISC_R_NOMEMORY
;
771 return ISC_R_SUCCESS
;
779 return ISC_R_NOTFOUND
;
784 see if we handle a given zone
786 _PUBLIC_ isc_result_t
dlz_findzonedb(void *dbdata
, const char *name
)
788 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
789 return b9_find_zone_dn(state
, name
, NULL
, NULL
);
796 static isc_result_t
dlz_lookup_types(struct dlz_bind9_data
*state
,
797 const char *zone
, const char *name
,
798 dns_sdlzlookup_t
*lookup
,
801 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
802 const char *attrs
[] = { "dnsRecord", NULL
};
803 int ret
= LDB_SUCCESS
, i
;
804 struct ldb_result
*res
;
805 struct ldb_message_element
*el
;
808 for (i
=0; zone_prefixes
[i
]; i
++) {
809 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
811 talloc_free(tmp_ctx
);
812 return ISC_R_NOMEMORY
;
815 if (!ldb_dn_add_child_fmt(dn
, "DC=%s,DC=%s,%s", name
, zone
, zone_prefixes
[i
])) {
816 talloc_free(tmp_ctx
);
817 return ISC_R_NOMEMORY
;
820 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
,
821 attrs
, "objectClass=dnsNode");
822 if (ret
== LDB_SUCCESS
) {
826 if (ret
!= LDB_SUCCESS
) {
827 talloc_free(tmp_ctx
);
828 return ISC_R_NOTFOUND
;
831 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
832 if (el
== NULL
|| el
->num_values
== 0) {
833 talloc_free(tmp_ctx
);
834 return ISC_R_NOTFOUND
;
837 for (i
=0; i
<el
->num_values
; i
++) {
838 struct dnsp_DnssrvRpcRecord rec
;
839 enum ndr_err_code ndr_err
;
842 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], tmp_ctx
, &rec
,
843 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
844 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
845 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
846 ldb_dn_get_linearized(dn
));
847 talloc_free(tmp_ctx
);
848 return ISC_R_FAILURE
;
851 result
= b9_putrr(state
, lookup
, &rec
, types
);
852 if (result
!= ISC_R_SUCCESS
) {
853 talloc_free(tmp_ctx
);
858 talloc_free(tmp_ctx
);
859 return ISC_R_SUCCESS
;
865 #ifdef BIND_VERSION_9_8
866 _PUBLIC_ isc_result_t
dlz_lookup(const char *zone
, const char *name
,
867 void *dbdata
, dns_sdlzlookup_t
*lookup
)
869 _PUBLIC_ isc_result_t
dlz_lookup(const char *zone
, const char *name
,
870 void *dbdata
, dns_sdlzlookup_t
*lookup
,
871 dns_clientinfomethods_t
*methods
,
872 dns_clientinfo_t
*clientinfo
)
875 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
876 return dlz_lookup_types(state
, zone
, name
, lookup
, NULL
);
881 see if a zone transfer is allowed
883 _PUBLIC_ isc_result_t
dlz_allowzonexfr(void *dbdata
, const char *name
, const char *client
)
885 /* just say yes for all our zones for now */
886 return dlz_findzonedb(dbdata
, name
);
890 perform a zone transfer
892 _PUBLIC_ isc_result_t
dlz_allnodes(const char *zone
, void *dbdata
,
893 dns_sdlzallnodes_t
*allnodes
)
895 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
896 const char *attrs
[] = { "dnsRecord", NULL
};
897 int ret
= LDB_SUCCESS
, i
, j
;
899 struct ldb_result
*res
;
900 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
902 for (i
=0; zone_prefixes
[i
]; i
++) {
903 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
905 talloc_free(tmp_ctx
);
906 return ISC_R_NOMEMORY
;
909 if (!ldb_dn_add_child_fmt(dn
, "DC=%s,%s", zone
, zone_prefixes
[i
])) {
910 talloc_free(tmp_ctx
);
911 return ISC_R_NOMEMORY
;
914 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_SUBTREE
,
915 attrs
, "objectClass=dnsNode");
916 if (ret
== LDB_SUCCESS
) {
920 if (ret
!= LDB_SUCCESS
) {
921 talloc_free(tmp_ctx
);
922 return ISC_R_NOTFOUND
;
925 for (i
=0; i
<res
->count
; i
++) {
926 struct ldb_message_element
*el
;
927 TALLOC_CTX
*el_ctx
= talloc_new(tmp_ctx
);
928 const char *rdn
, *name
;
929 const struct ldb_val
*v
;
931 el
= ldb_msg_find_element(res
->msgs
[i
], "dnsRecord");
932 if (el
== NULL
|| el
->num_values
== 0) {
933 state
->log(ISC_LOG_INFO
, "failed to find dnsRecord for %s",
934 ldb_dn_get_linearized(dn
));
939 v
= ldb_dn_get_rdn_val(res
->msgs
[i
]->dn
);
941 state
->log(ISC_LOG_INFO
, "failed to find RDN for %s",
942 ldb_dn_get_linearized(dn
));
947 rdn
= talloc_strndup(el_ctx
, (char *)v
->data
, v
->length
);
949 talloc_free(tmp_ctx
);
950 return ISC_R_NOMEMORY
;
953 if (strcmp(rdn
, "@") == 0) {
956 name
= talloc_asprintf(el_ctx
, "%s.%s", rdn
, zone
);
959 talloc_free(tmp_ctx
);
960 return ISC_R_NOMEMORY
;
963 for (j
=0; j
<el
->num_values
; j
++) {
964 struct dnsp_DnssrvRpcRecord rec
;
965 enum ndr_err_code ndr_err
;
968 ndr_err
= ndr_pull_struct_blob(&el
->values
[j
], el_ctx
, &rec
,
969 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
970 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
971 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
972 ldb_dn_get_linearized(dn
));
976 result
= b9_putnamedrr(state
, allnodes
, name
, &rec
);
977 if (result
!= ISC_R_SUCCESS
) {
983 talloc_free(tmp_ctx
);
985 return ISC_R_SUCCESS
;
992 _PUBLIC_ isc_result_t
dlz_newversion(const char *zone
, void *dbdata
, void **versionp
)
994 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
996 state
->log(ISC_LOG_INFO
, "samba_dlz: starting transaction on zone %s", zone
);
998 if (state
->transaction_token
!= NULL
) {
999 state
->log(ISC_LOG_INFO
, "samba_dlz: transaction already started for zone %s", zone
);
1000 return ISC_R_FAILURE
;
1003 state
->transaction_token
= talloc_zero(state
, int);
1004 if (state
->transaction_token
== NULL
) {
1005 return ISC_R_NOMEMORY
;
1008 if (ldb_transaction_start(state
->samdb
) != LDB_SUCCESS
) {
1009 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to start a transaction for zone %s", zone
);
1010 talloc_free(state
->transaction_token
);
1011 state
->transaction_token
= NULL
;
1012 return ISC_R_FAILURE
;
1015 *versionp
= (void *)state
->transaction_token
;
1017 return ISC_R_SUCCESS
;
1023 _PUBLIC_
void dlz_closeversion(const char *zone
, isc_boolean_t commit
,
1024 void *dbdata
, void **versionp
)
1026 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1028 if (state
->transaction_token
!= (int *)*versionp
) {
1029 state
->log(ISC_LOG_INFO
, "samba_dlz: transaction not started for zone %s", zone
);
1034 if (ldb_transaction_commit(state
->samdb
) != LDB_SUCCESS
) {
1035 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to commit a transaction for zone %s", zone
);
1038 state
->log(ISC_LOG_INFO
, "samba_dlz: committed transaction on zone %s", zone
);
1040 if (ldb_transaction_cancel(state
->samdb
) != LDB_SUCCESS
) {
1041 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to cancel a transaction for zone %s", zone
);
1044 state
->log(ISC_LOG_INFO
, "samba_dlz: cancelling transaction on zone %s", zone
);
1047 talloc_free(state
->transaction_token
);
1048 state
->transaction_token
= NULL
;
1054 see if there is a SOA record for a zone
1056 static bool b9_has_soa(struct dlz_bind9_data
*state
, struct ldb_dn
*dn
, const char *zone
)
1058 const char *attrs
[] = { "dnsRecord", NULL
};
1059 struct ldb_result
*res
;
1060 struct ldb_message_element
*el
;
1061 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
1064 if (!ldb_dn_add_child_fmt(dn
, "DC=@,DC=%s", zone
)) {
1065 talloc_free(tmp_ctx
);
1069 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
,
1070 attrs
, "objectClass=dnsNode");
1071 if (ret
!= LDB_SUCCESS
) {
1072 talloc_free(tmp_ctx
);
1076 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1078 talloc_free(tmp_ctx
);
1081 for (i
=0; i
<el
->num_values
; i
++) {
1082 struct dnsp_DnssrvRpcRecord rec
;
1083 enum ndr_err_code ndr_err
;
1085 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], tmp_ctx
, &rec
,
1086 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1087 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1090 if (rec
.wType
== DNS_TYPE_SOA
) {
1091 talloc_free(tmp_ctx
);
1096 talloc_free(tmp_ctx
);
1101 configure a writeable zone
1103 _PUBLIC_ isc_result_t
dlz_configure(dns_view_t
*view
, void *dbdata
)
1105 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1106 TALLOC_CTX
*tmp_ctx
;
1110 state
->log(ISC_LOG_INFO
, "samba_dlz: starting configure");
1111 if (state
->writeable_zone
== NULL
) {
1112 state
->log(ISC_LOG_INFO
, "samba_dlz: no writeable_zone method available");
1113 return ISC_R_FAILURE
;
1116 tmp_ctx
= talloc_new(state
);
1118 for (i
=0; zone_prefixes
[i
]; i
++) {
1119 const char *attrs
[] = { "name", NULL
};
1121 struct ldb_result
*res
;
1123 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
1125 talloc_free(tmp_ctx
);
1126 return ISC_R_NOMEMORY
;
1129 if (!ldb_dn_add_child_fmt(dn
, "%s", zone_prefixes
[i
])) {
1130 talloc_free(tmp_ctx
);
1131 return ISC_R_NOMEMORY
;
1134 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_SUBTREE
,
1135 attrs
, "objectClass=dnsZone");
1136 if (ret
!= LDB_SUCCESS
) {
1140 for (j
=0; j
<res
->count
; j
++) {
1141 isc_result_t result
;
1142 const char *zone
= ldb_msg_find_attr_as_string(res
->msgs
[j
], "name", NULL
);
1143 struct ldb_dn
*zone_dn
;
1148 zone_dn
= ldb_dn_copy(tmp_ctx
, dn
);
1149 if (zone_dn
== NULL
) {
1150 talloc_free(tmp_ctx
);
1151 return ISC_R_NOMEMORY
;
1154 if (!b9_has_soa(state
, zone_dn
, zone
)) {
1157 result
= state
->writeable_zone(view
, zone
);
1158 if (result
!= ISC_R_SUCCESS
) {
1159 state
->log(ISC_LOG_ERROR
, "samba_dlz: Failed to configure zone '%s'",
1161 talloc_free(tmp_ctx
);
1164 state
->log(ISC_LOG_INFO
, "samba_dlz: configured writeable zone '%s'", zone
);
1168 talloc_free(tmp_ctx
);
1169 return ISC_R_SUCCESS
;
1173 authorize a zone update
1175 _PUBLIC_ isc_boolean_t
dlz_ssumatch(const char *signer
, const char *name
, const char *tcpaddr
,
1176 const char *type
, const char *key
, uint32_t keydatalen
, uint8_t *keydata
,
1179 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1180 TALLOC_CTX
*tmp_ctx
;
1182 struct cli_credentials
*server_credentials
;
1187 struct gensec_security
*gensec_ctx
;
1188 struct auth_session_info
*session_info
;
1190 isc_result_t result
;
1191 struct ldb_result
*res
;
1192 const char * attrs
[] = { NULL
};
1193 uint32_t access_mask
;
1195 /* Remove cached credentials, if any */
1196 if (state
->session_info
) {
1197 talloc_free(state
->session_info
);
1198 state
->session_info
= NULL
;
1200 if (state
->update_name
) {
1201 talloc_free(state
->update_name
);
1202 state
->update_name
= NULL
;
1205 tmp_ctx
= talloc_new(NULL
);
1206 if (tmp_ctx
== NULL
) {
1207 state
->log(ISC_LOG_ERROR
, "samba_dlz: no memory");
1211 ap_req
= data_blob_const(keydata
, keydatalen
);
1212 server_credentials
= cli_credentials_init(tmp_ctx
);
1213 if (!server_credentials
) {
1214 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to init server credentials");
1215 talloc_free(tmp_ctx
);
1219 cli_credentials_set_krb5_context(server_credentials
, state
->smb_krb5_ctx
);
1220 cli_credentials_set_conf(server_credentials
, state
->lp
);
1222 keytab_name
= talloc_asprintf(tmp_ctx
, "file:%s/dns.keytab",
1223 lpcfg_private_dir(state
->lp
));
1224 ret
= cli_credentials_set_keytab_name(server_credentials
, state
->lp
, keytab_name
,
1227 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to obtain server credentials from %s",
1229 talloc_free(tmp_ctx
);
1232 talloc_free(keytab_name
);
1234 nt_status
= gensec_server_start(tmp_ctx
,
1235 lpcfg_gensec_settings(tmp_ctx
, state
->lp
),
1236 state
->auth_context
, &gensec_ctx
);
1237 if (!NT_STATUS_IS_OK(nt_status
)) {
1238 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to start gensec server");
1239 talloc_free(tmp_ctx
);
1243 gensec_set_credentials(gensec_ctx
, server_credentials
);
1245 nt_status
= gensec_start_mech_by_name(gensec_ctx
, "spnego");
1246 if (!NT_STATUS_IS_OK(nt_status
)) {
1247 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to start spnego");
1248 talloc_free(tmp_ctx
);
1252 nt_status
= gensec_update(gensec_ctx
, tmp_ctx
, state
->ev_ctx
, ap_req
, &ap_req
);
1253 if (!NT_STATUS_IS_OK(nt_status
)) {
1254 state
->log(ISC_LOG_ERROR
, "samba_dlz: spnego update failed");
1255 talloc_free(tmp_ctx
);
1259 nt_status
= gensec_session_info(gensec_ctx
, tmp_ctx
, &session_info
);
1260 if (!NT_STATUS_IS_OK(nt_status
)) {
1261 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to create session info");
1262 talloc_free(tmp_ctx
);
1266 /* Get the DN from name */
1267 result
= b9_find_name_dn(state
, name
, tmp_ctx
, &dn
);
1268 if (result
!= ISC_R_SUCCESS
) {
1269 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to find name %s", name
);
1270 talloc_free(tmp_ctx
);
1274 /* make sure the dn exists, or find parent dn in case new object is being added */
1275 ldb_ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
,
1276 attrs
, "objectClass=dnsNode");
1277 if (ldb_ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1278 ldb_dn_remove_child_components(dn
, 1);
1279 access_mask
= SEC_ADS_CREATE_CHILD
;
1281 } else if (ldb_ret
== LDB_SUCCESS
) {
1282 access_mask
= SEC_STD_REQUIRED
| SEC_ADS_SELF_WRITE
;
1285 talloc_free(tmp_ctx
);
1290 ldb_ret
= dsdb_check_access_on_dn(state
->samdb
, tmp_ctx
, dn
,
1291 session_info
->security_token
,
1293 if (ldb_ret
!= LDB_SUCCESS
) {
1294 state
->log(ISC_LOG_INFO
,
1295 "samba_dlz: disallowing update of signer=%s name=%s type=%s error=%s",
1296 signer
, name
, type
, ldb_strerror(ldb_ret
));
1297 talloc_free(tmp_ctx
);
1301 /* Cache session_info, so it can be used in the actual add/delete operation */
1302 state
->update_name
= talloc_strdup(state
, name
);
1303 if (state
->update_name
== NULL
) {
1304 state
->log(ISC_LOG_ERROR
, "samba_dlz: memory allocation error");
1305 talloc_free(tmp_ctx
);
1308 state
->session_info
= talloc_steal(state
, session_info
);
1310 state
->log(ISC_LOG_INFO
, "samba_dlz: allowing update of signer=%s name=%s tcpaddr=%s type=%s key=%s",
1311 signer
, name
, tcpaddr
, type
, key
);
1313 talloc_free(tmp_ctx
);
1321 static isc_result_t
b9_add_record(struct dlz_bind9_data
*state
, const char *name
,
1323 struct dnsp_DnssrvRpcRecord
*rec
)
1325 struct ldb_message
*msg
;
1326 enum ndr_err_code ndr_err
;
1330 msg
= ldb_msg_new(rec
);
1332 return ISC_R_NOMEMORY
;
1335 ret
= ldb_msg_add_string(msg
, "objectClass", "dnsNode");
1336 if (ret
!= LDB_SUCCESS
) {
1337 return ISC_R_FAILURE
;
1340 ndr_err
= ndr_push_struct_blob(&v
, rec
, rec
, (ndr_push_flags_fn_t
)ndr_push_dnsp_DnssrvRpcRecord
);
1341 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1342 return ISC_R_FAILURE
;
1344 ret
= ldb_msg_add_value(msg
, "dnsRecord", &v
, NULL
);
1345 if (ret
!= LDB_SUCCESS
) {
1346 return ISC_R_FAILURE
;
1349 ret
= ldb_add(state
->samdb
, msg
);
1350 if (ret
!= LDB_SUCCESS
) {
1351 return ISC_R_FAILURE
;
1354 return ISC_R_SUCCESS
;
1358 see if two DNS names are the same
1360 static bool dns_name_equal(const char *name1
, const char *name2
)
1362 size_t len1
= strlen(name1
);
1363 size_t len2
= strlen(name2
);
1364 if (name1
[len1
-1] == '.') len1
--;
1365 if (name2
[len2
-1] == '.') len2
--;
1369 return strncasecmp_m(name1
, name2
, len1
) == 0;
1374 see if two dns records match
1376 static bool b9_record_match(struct dlz_bind9_data
*state
,
1377 struct dnsp_DnssrvRpcRecord
*rec1
, struct dnsp_DnssrvRpcRecord
*rec2
)
1382 if (rec1
->wType
!= rec2
->wType
) {
1385 /* see if this type is single valued */
1386 if (b9_single_valued(rec1
->wType
)) {
1390 /* see if the data matches */
1391 switch (rec1
->wType
) {
1393 return strcmp(rec1
->data
.ipv4
, rec2
->data
.ipv4
) == 0;
1395 return strcmp(rec1
->data
.ipv6
, rec2
->data
.ipv6
) == 0;
1396 case DNS_TYPE_CNAME
:
1397 return dns_name_equal(rec1
->data
.cname
, rec2
->data
.cname
);
1399 status
= (rec1
->data
.txt
.count
== rec2
->data
.txt
.count
);
1400 if (!status
) return status
;
1401 for (i
=0; i
<rec1
->data
.txt
.count
; i
++) {
1402 status
&= (strcmp(rec1
->data
.txt
.str
[i
], rec2
->data
.txt
.str
[i
]) == 0);
1406 return dns_name_equal(rec1
->data
.ptr
, rec2
->data
.ptr
);
1408 return dns_name_equal(rec1
->data
.ns
, rec2
->data
.ns
);
1411 return rec1
->data
.srv
.wPriority
== rec2
->data
.srv
.wPriority
&&
1412 rec1
->data
.srv
.wWeight
== rec2
->data
.srv
.wWeight
&&
1413 rec1
->data
.srv
.wPort
== rec2
->data
.srv
.wPort
&&
1414 dns_name_equal(rec1
->data
.srv
.nameTarget
, rec2
->data
.srv
.nameTarget
);
1417 return rec1
->data
.mx
.wPriority
== rec2
->data
.mx
.wPriority
&&
1418 dns_name_equal(rec1
->data
.mx
.nameTarget
, rec2
->data
.mx
.nameTarget
);
1420 case DNS_TYPE_HINFO
:
1421 return strcmp(rec1
->data
.hinfo
.cpu
, rec2
->data
.hinfo
.cpu
) == 0 &&
1422 strcmp(rec1
->data
.hinfo
.os
, rec2
->data
.hinfo
.os
) == 0;
1425 return dns_name_equal(rec1
->data
.soa
.mname
, rec2
->data
.soa
.mname
) &&
1426 dns_name_equal(rec1
->data
.soa
.rname
, rec2
->data
.soa
.rname
) &&
1427 rec1
->data
.soa
.serial
== rec2
->data
.soa
.serial
&&
1428 rec1
->data
.soa
.refresh
== rec2
->data
.soa
.refresh
&&
1429 rec1
->data
.soa
.retry
== rec2
->data
.soa
.retry
&&
1430 rec1
->data
.soa
.expire
== rec2
->data
.soa
.expire
&&
1431 rec1
->data
.soa
.minimum
== rec2
->data
.soa
.minimum
;
1433 state
->log(ISC_LOG_ERROR
, "samba b9_putrr: unhandled record type %u",
1442 * Update session_info on samdb using the cached credentials
1444 static bool b9_set_session_info(struct dlz_bind9_data
*state
, const char *name
)
1448 if (state
->update_name
== NULL
|| state
->session_info
== NULL
) {
1449 state
->log(ISC_LOG_ERROR
, "samba_dlz: invalid credentials");
1453 /* Do not use client credentials, if we not updating the client specified name */
1454 if (strcmp(state
->update_name
, name
) != 0) {
1458 ret
= ldb_set_opaque(state
->samdb
, "sessionInfo", state
->session_info
);
1459 if (ret
!= LDB_SUCCESS
) {
1460 state
->log(ISC_LOG_ERROR
, "samba_dlz: unable to set session info");
1468 * Reset session_info on samdb as system session
1470 static void b9_reset_session_info(struct dlz_bind9_data
*state
)
1472 ldb_set_opaque(state
->samdb
, "sessionInfo", system_session(state
->lp
));
1476 add or modify a rdataset
1478 _PUBLIC_ isc_result_t
dlz_addrdataset(const char *name
, const char *rdatastr
, void *dbdata
, void *version
)
1480 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1481 struct dnsp_DnssrvRpcRecord
*rec
;
1483 isc_result_t result
;
1484 struct ldb_result
*res
;
1485 const char *attrs
[] = { "dnsRecord", NULL
};
1487 struct ldb_message_element
*el
;
1488 enum ndr_err_code ndr_err
;
1491 if (state
->transaction_token
!= (void*)version
) {
1492 state
->log(ISC_LOG_INFO
, "samba_dlz: bad transaction version");
1493 return ISC_R_FAILURE
;
1496 rec
= talloc_zero(state
, struct dnsp_DnssrvRpcRecord
);
1498 return ISC_R_NOMEMORY
;
1501 unix_to_nt_time(&t
, time(NULL
));
1502 t
/= 10*1000*1000; /* convert to seconds (NT time is in 100ns units) */
1503 t
/= 3600; /* convert to hours */
1505 rec
->rank
= DNS_RANK_ZONE
;
1506 rec
->dwSerial
= state
->soa_serial
;
1507 rec
->dwTimeStamp
= (uint32_t)t
;
1509 if (!b9_parse(state
, rdatastr
, rec
)) {
1510 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to parse rdataset '%s'", rdatastr
);
1512 return ISC_R_FAILURE
;
1515 /* find the DN of the record */
1516 result
= b9_find_name_dn(state
, name
, rec
, &dn
);
1517 if (result
!= ISC_R_SUCCESS
) {
1522 /* get any existing records */
1523 ret
= ldb_search(state
->samdb
, rec
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsNode");
1524 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1525 if (!b9_set_session_info(state
, name
)) {
1527 return ISC_R_FAILURE
;
1529 result
= b9_add_record(state
, name
, dn
, rec
);
1530 b9_reset_session_info(state
);
1532 if (result
== ISC_R_SUCCESS
) {
1533 state
->log(ISC_LOG_INFO
, "samba_dlz: added %s %s", name
, rdatastr
);
1538 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1540 ret
= ldb_msg_add_empty(res
->msgs
[0], "dnsRecord", LDB_FLAG_MOD_ADD
, &el
);
1541 if (ret
!= LDB_SUCCESS
) {
1542 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to add dnsRecord for %s",
1543 ldb_dn_get_linearized(dn
));
1545 return ISC_R_FAILURE
;
1549 /* there are existing records. We need to see if this will
1550 * replace a record or add to it
1552 for (i
=0; i
<el
->num_values
; i
++) {
1553 struct dnsp_DnssrvRpcRecord rec2
;
1555 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], rec
, &rec2
,
1556 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1557 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1558 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
1559 ldb_dn_get_linearized(dn
));
1561 return ISC_R_FAILURE
;
1564 if (b9_record_match(state
, rec
, &rec2
)) {
1568 if (i
== el
->num_values
) {
1569 /* adding a new value */
1570 el
->values
= talloc_realloc(el
, el
->values
, struct ldb_val
, el
->num_values
+1);
1571 if (el
->values
== NULL
) {
1573 return ISC_R_NOMEMORY
;
1578 ndr_err
= ndr_push_struct_blob(&el
->values
[i
], rec
, rec
,
1579 (ndr_push_flags_fn_t
)ndr_push_dnsp_DnssrvRpcRecord
);
1580 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1581 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to push dnsRecord for %s",
1582 ldb_dn_get_linearized(dn
));
1584 return ISC_R_FAILURE
;
1588 if (!b9_set_session_info(state
, name
)) {
1590 return ISC_R_FAILURE
;
1593 /* modify the record */
1594 el
->flags
= LDB_FLAG_MOD_REPLACE
;
1595 ret
= ldb_modify(state
->samdb
, res
->msgs
[0]);
1596 b9_reset_session_info(state
);
1597 if (ret
!= LDB_SUCCESS
) {
1598 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to modify %s - %s",
1599 ldb_dn_get_linearized(dn
), ldb_errstring(state
->samdb
));
1601 return ISC_R_FAILURE
;
1604 state
->log(ISC_LOG_INFO
, "samba_dlz: added rdataset %s '%s'", name
, rdatastr
);
1607 return ISC_R_SUCCESS
;
1613 _PUBLIC_ isc_result_t
dlz_subrdataset(const char *name
, const char *rdatastr
, void *dbdata
, void *version
)
1615 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1616 struct dnsp_DnssrvRpcRecord
*rec
;
1618 isc_result_t result
;
1619 struct ldb_result
*res
;
1620 const char *attrs
[] = { "dnsRecord", NULL
};
1622 struct ldb_message_element
*el
;
1623 enum ndr_err_code ndr_err
;
1625 if (state
->transaction_token
!= (void*)version
) {
1626 state
->log(ISC_LOG_ERROR
, "samba_dlz: bad transaction version");
1627 return ISC_R_FAILURE
;
1630 rec
= talloc_zero(state
, struct dnsp_DnssrvRpcRecord
);
1632 return ISC_R_NOMEMORY
;
1635 if (!b9_parse(state
, rdatastr
, rec
)) {
1636 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse rdataset '%s'", rdatastr
);
1638 return ISC_R_FAILURE
;
1641 /* find the DN of the record */
1642 result
= b9_find_name_dn(state
, name
, rec
, &dn
);
1643 if (result
!= ISC_R_SUCCESS
) {
1648 /* get the existing records */
1649 ret
= ldb_search(state
->samdb
, rec
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsNode");
1650 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1652 return ISC_R_NOTFOUND
;
1655 /* there are existing records. We need to see if any match
1657 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1658 if (el
== NULL
|| el
->num_values
== 0) {
1659 state
->log(ISC_LOG_ERROR
, "samba_dlz: no dnsRecord attribute for %s",
1660 ldb_dn_get_linearized(dn
));
1662 return ISC_R_FAILURE
;
1665 for (i
=0; i
<el
->num_values
; i
++) {
1666 struct dnsp_DnssrvRpcRecord rec2
;
1668 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], rec
, &rec2
,
1669 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1670 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1671 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
1672 ldb_dn_get_linearized(dn
));
1674 return ISC_R_FAILURE
;
1677 if (b9_record_match(state
, rec
, &rec2
)) {
1681 if (i
== el
->num_values
) {
1683 return ISC_R_NOTFOUND
;
1686 if (i
< el
->num_values
-1) {
1687 memmove(&el
->values
[i
], &el
->values
[i
+1], sizeof(el
->values
[0])*((el
->num_values
-1)-i
));
1691 if (!b9_set_session_info(state
, name
)) {
1693 return ISC_R_FAILURE
;
1696 if (el
->num_values
== 0) {
1697 el
->flags
= LDB_FLAG_MOD_DELETE
;
1699 el
->flags
= LDB_FLAG_MOD_REPLACE
;
1701 ret
= ldb_modify(state
->samdb
, res
->msgs
[0]);
1703 b9_reset_session_info(state
);
1704 if (ret
!= LDB_SUCCESS
) {
1705 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to modify %s - %s",
1706 ldb_dn_get_linearized(dn
), ldb_errstring(state
->samdb
));
1708 return ISC_R_FAILURE
;
1711 state
->log(ISC_LOG_INFO
, "samba_dlz: subtracted rdataset %s '%s'", name
, rdatastr
);
1714 return ISC_R_SUCCESS
;
1719 delete all records of the given type
1721 _PUBLIC_ isc_result_t
dlz_delrdataset(const char *name
, const char *type
, void *dbdata
, void *version
)
1723 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1724 TALLOC_CTX
*tmp_ctx
;
1726 isc_result_t result
;
1727 struct ldb_result
*res
;
1728 const char *attrs
[] = { "dnsRecord", NULL
};
1730 struct ldb_message_element
*el
;
1731 enum ndr_err_code ndr_err
;
1732 enum dns_record_type dns_type
;
1735 if (state
->transaction_token
!= (void*)version
) {
1736 state
->log(ISC_LOG_ERROR
, "samba_dlz: bad transaction version");
1737 return ISC_R_FAILURE
;
1740 if (!b9_dns_type(type
, &dns_type
)) {
1741 state
->log(ISC_LOG_ERROR
, "samba_dlz: bad dns type %s in delete", type
);
1742 return ISC_R_FAILURE
;
1745 tmp_ctx
= talloc_new(state
);
1747 /* find the DN of the record */
1748 result
= b9_find_name_dn(state
, name
, tmp_ctx
, &dn
);
1749 if (result
!= ISC_R_SUCCESS
) {
1750 talloc_free(tmp_ctx
);
1754 /* get the existing records */
1755 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsNode");
1756 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1757 talloc_free(tmp_ctx
);
1758 return ISC_R_NOTFOUND
;
1761 /* there are existing records. We need to see if any match the type
1763 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1764 if (el
== NULL
|| el
->num_values
== 0) {
1765 talloc_free(tmp_ctx
);
1766 return ISC_R_NOTFOUND
;
1769 for (i
=0; i
<el
->num_values
; i
++) {
1770 struct dnsp_DnssrvRpcRecord rec2
;
1772 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], tmp_ctx
, &rec2
,
1773 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1774 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1775 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
1776 ldb_dn_get_linearized(dn
));
1777 talloc_free(tmp_ctx
);
1778 return ISC_R_FAILURE
;
1781 if (dns_type
== rec2
.wType
) {
1782 if (i
< el
->num_values
-1) {
1783 memmove(&el
->values
[i
], &el
->values
[i
+1],
1784 sizeof(el
->values
[0])*((el
->num_values
-1)-i
));
1793 talloc_free(tmp_ctx
);
1794 return ISC_R_FAILURE
;
1797 if (!b9_set_session_info(state
, name
)) {
1798 talloc_free(tmp_ctx
);
1799 return ISC_R_FAILURE
;
1802 if (el
->num_values
== 0) {
1803 el
->flags
= LDB_FLAG_MOD_DELETE
;
1805 el
->flags
= LDB_FLAG_MOD_REPLACE
;
1807 ret
= ldb_modify(state
->samdb
, res
->msgs
[0]);
1809 b9_reset_session_info(state
);
1810 if (ret
!= LDB_SUCCESS
) {
1811 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to delete type %s in %s - %s",
1812 type
, ldb_dn_get_linearized(dn
), ldb_errstring(state
->samdb
));
1813 talloc_free(tmp_ctx
);
1814 return ISC_R_FAILURE
;
1817 state
->log(ISC_LOG_INFO
, "samba_dlz: deleted rdataset %s of type %s", name
, type
);
1819 talloc_free(tmp_ctx
);
1820 return ISC_R_SUCCESS
;