2 Unix SMB/CIFS implementation.
4 DNS server handler for queries
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/service_task.h"
24 #include "libcli/util/werror.h"
25 #include "librpc/ndr/libndr.h"
26 #include "librpc/gen_ndr/ndr_dns.h"
27 #include "librpc/gen_ndr/ndr_dnsp.h"
29 #include "param/param.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "dns_server/dns_server.h"
33 #include "libcli/dns/libdns.h"
34 #include "lib/util/util_net.h"
35 #include "lib/util/tevent_werror.h"
36 #include "auth/auth.h"
37 #include "auth/credentials/credentials.h"
38 #include "auth/gensec/gensec.h"
41 #define DBGC_CLASS DBGC_DNS
43 static WERROR
create_response_rr(const struct dns_name_question
*question
,
44 const struct dnsp_DnssrvRpcRecord
*rec
,
45 struct dns_res_rec
**answers
, uint16_t *ancount
)
47 struct dns_res_rec
*ans
= *answers
;
48 uint16_t ai
= *ancount
;
56 ans
[ai
].rdata
.cname_record
= talloc_strdup(ans
, rec
->data
.cname
);
57 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.cname_record
);
60 ans
[ai
].rdata
.ipv4_record
= talloc_strdup(ans
, rec
->data
.ipv4
);
61 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ipv4_record
);
64 ans
[ai
].rdata
.ipv6_record
= talloc_strdup(ans
, rec
->data
.ipv6
);
65 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ipv6_record
);
68 ans
[ai
].rdata
.ns_record
= talloc_strdup(ans
, rec
->data
.ns
);
69 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ns_record
);
72 ans
[ai
].rdata
.srv_record
.priority
= rec
->data
.srv
.wPriority
;
73 ans
[ai
].rdata
.srv_record
.weight
= rec
->data
.srv
.wWeight
;
74 ans
[ai
].rdata
.srv_record
.port
= rec
->data
.srv
.wPort
;
75 ans
[ai
].rdata
.srv_record
.target
= talloc_strdup(
76 ans
, rec
->data
.srv
.nameTarget
);
77 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.srv_record
.target
);
80 ans
[ai
].rdata
.soa_record
.mname
= talloc_strdup(
81 ans
, rec
->data
.soa
.mname
);
82 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.soa_record
.mname
);
83 ans
[ai
].rdata
.soa_record
.rname
= talloc_strdup(
84 ans
, rec
->data
.soa
.rname
);
85 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.soa_record
.rname
);
86 ans
[ai
].rdata
.soa_record
.serial
= rec
->data
.soa
.serial
;
87 ans
[ai
].rdata
.soa_record
.refresh
= rec
->data
.soa
.refresh
;
88 ans
[ai
].rdata
.soa_record
.retry
= rec
->data
.soa
.retry
;
89 ans
[ai
].rdata
.soa_record
.expire
= rec
->data
.soa
.expire
;
90 ans
[ai
].rdata
.soa_record
.minimum
= rec
->data
.soa
.minimum
;
93 ans
[ai
].rdata
.ptr_record
= talloc_strdup(ans
, rec
->data
.ptr
);
96 ans
[ai
].rdata
.mx_record
.preference
= rec
->data
.mx
.wPriority
;
97 ans
[ai
].rdata
.mx_record
.exchange
= talloc_strdup(
98 ans
, rec
->data
.mx
.nameTarget
);
99 if (ans
[ai
].rdata
.mx_record
.exchange
== NULL
) {
104 tmp
= talloc_asprintf(ans
, "\"%s\"", rec
->data
.txt
.str
[0]);
105 W_ERROR_HAVE_NO_MEMORY(tmp
);
106 for (i
=1; i
<rec
->data
.txt
.count
; i
++) {
107 tmp
= talloc_asprintf_append_buffer(
108 tmp
, " \"%s\"", rec
->data
.txt
.str
[i
]);
109 W_ERROR_HAVE_NO_MEMORY(tmp
);
111 ans
[ai
].rdata
.txt_record
.txt
= tmp
;
114 DEBUG(0, ("Got unhandled type %u query.\n", rec
->wType
));
115 return DNS_ERR(NOT_IMPLEMENTED
);
118 ans
[ai
].name
= talloc_strdup(ans
, question
->name
);
119 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].name
);
120 ans
[ai
].rr_type
= rec
->wType
;
121 ans
[ai
].rr_class
= DNS_QCLASS_IN
;
122 ans
[ai
].ttl
= rec
->dwTtlSeconds
;
123 ans
[ai
].length
= UINT16_MAX
;
132 struct ask_forwarder_state
{
133 struct tevent_context
*ev
;
135 struct dns_name_packet in_packet
;
138 static void ask_forwarder_done(struct tevent_req
*subreq
);
140 static struct tevent_req
*ask_forwarder_send(
141 struct dns_server
*dns
,
142 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
143 const char *forwarder
, struct dns_name_question
*question
)
145 struct tevent_req
*req
, *subreq
;
146 struct ask_forwarder_state
*state
;
147 struct dns_res_rec
*options
;
148 struct dns_name_packet out_packet
= { 0, };
150 enum ndr_err_code ndr_err
;
153 req
= tevent_req_create(mem_ctx
, &state
, struct ask_forwarder_state
);
158 generate_random_buffer((uint8_t *)&state
->id
, sizeof(state
->id
));
160 if (!is_ipaddress(forwarder
)) {
161 DEBUG(0, ("Invalid 'dns forwarder' setting '%s', needs to be "
162 "an IP address\n", forwarder
));
163 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
164 return tevent_req_post(req
, ev
);
167 out_packet
.id
= state
->id
;
168 out_packet
.operation
|= DNS_OPCODE_QUERY
| DNS_FLAG_RECURSION_DESIRED
;
169 out_packet
.qdcount
= 1;
170 out_packet
.questions
= question
;
172 werr
= dns_generate_options(dns
, state
, &options
);
173 if (!W_ERROR_IS_OK(werr
)) {
174 tevent_req_werror(req
, werr
);
175 return tevent_req_post(req
, ev
);
178 out_packet
.arcount
= 1;
179 out_packet
.additional
= options
;
181 ndr_err
= ndr_push_struct_blob(
182 &out_blob
, state
, &out_packet
,
183 (ndr_push_flags_fn_t
)ndr_push_dns_name_packet
);
184 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
185 tevent_req_werror(req
, DNS_ERR(SERVER_FAILURE
));
186 return tevent_req_post(req
, ev
);
188 subreq
= dns_udp_request_send(state
, ev
, forwarder
, out_blob
.data
,
190 if (tevent_req_nomem(subreq
, req
)) {
191 return tevent_req_post(req
, ev
);
193 tevent_req_set_callback(subreq
, ask_forwarder_done
, req
);
197 static void ask_forwarder_done(struct tevent_req
*subreq
)
199 struct tevent_req
*req
= tevent_req_callback_data(
200 subreq
, struct tevent_req
);
201 struct ask_forwarder_state
*state
= tevent_req_data(
202 req
, struct ask_forwarder_state
);
204 enum ndr_err_code ndr_err
;
207 ret
= dns_udp_request_recv(subreq
, state
,
208 &in_blob
.data
, &in_blob
.length
);
210 if (tevent_req_werror(req
, ret
)) {
214 ndr_err
= ndr_pull_struct_blob(
215 &in_blob
, state
, &state
->in_packet
,
216 (ndr_pull_flags_fn_t
)ndr_pull_dns_name_packet
);
217 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
218 tevent_req_werror(req
, DNS_ERR(SERVER_FAILURE
));
221 if (state
->in_packet
.id
!= state
->id
) {
222 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
225 tevent_req_done(req
);
228 static WERROR
ask_forwarder_recv(
229 struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
230 struct dns_res_rec
**answers
, uint16_t *ancount
,
231 struct dns_res_rec
**nsrecs
, uint16_t *nscount
,
232 struct dns_res_rec
**additional
, uint16_t *arcount
)
234 struct ask_forwarder_state
*state
= tevent_req_data(
235 req
, struct ask_forwarder_state
);
236 struct dns_name_packet
*in_packet
= &state
->in_packet
;
239 if (tevent_req_is_werror(req
, &err
)) {
243 *ancount
= in_packet
->ancount
;
244 *answers
= talloc_move(mem_ctx
, &in_packet
->answers
);
246 *nscount
= in_packet
->nscount
;
247 *nsrecs
= talloc_move(mem_ctx
, &in_packet
->nsrecs
);
249 *arcount
= in_packet
->arcount
;
250 *additional
= talloc_move(mem_ctx
, &in_packet
->additional
);
255 static WERROR
handle_question(struct dns_server
*dns
,
257 const struct dns_name_question
*question
,
258 struct dns_res_rec
**answers
, uint16_t *ancount
)
260 struct dns_res_rec
*ans
= *answers
;
263 struct dnsp_DnssrvRpcRecord
*recs
;
264 uint16_t rec_count
, ai
= *ancount
;
265 struct ldb_dn
*dn
= NULL
;
267 werror
= dns_name2dn(dns
, mem_ctx
, question
->name
, &dn
);
268 W_ERROR_NOT_OK_RETURN(werror
);
270 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &recs
, &rec_count
);
271 W_ERROR_NOT_OK_RETURN(werror
);
273 ans
= talloc_realloc(mem_ctx
, ans
, struct dns_res_rec
, rec_count
+ ai
);
278 for (ri
= 0; ri
< rec_count
; ri
++) {
279 if ((recs
[ri
].wType
== DNS_TYPE_CNAME
) &&
280 ((question
->question_type
== DNS_QTYPE_A
) ||
281 (question
->question_type
== DNS_QTYPE_AAAA
))) {
282 struct dns_name_question
*new_q
=
283 talloc(mem_ctx
, struct dns_name_question
);
289 /* We reply with one more record, so grow the array */
290 ans
= talloc_realloc(mem_ctx
, ans
, struct dns_res_rec
,
297 /* First put in the CNAME record */
298 werror
= create_response_rr(question
, &recs
[ri
], &ans
, &ai
);
299 if (!W_ERROR_IS_OK(werror
)) {
303 /* And then look up the name it points at.. */
305 /* First build up the new question */
306 new_q
->question_type
= question
->question_type
;
307 new_q
->question_class
= question
->question_class
;
308 if (new_q
->question_type
== DNS_QTYPE_A
) {
309 new_q
->name
= talloc_strdup(new_q
, recs
[ri
].data
.ipv4
);
310 } else if (new_q
->question_type
== DNS_QTYPE_AAAA
) {
311 new_q
->name
= talloc_strdup(new_q
, recs
[ri
].data
.ipv6
);
313 if (new_q
->name
== NULL
) {
317 /* and then call the lookup again */
318 werror
= handle_question(dns
, mem_ctx
, new_q
, &ans
, &ai
);
319 if (!W_ERROR_IS_OK(werror
)) {
326 if ((question
->question_type
!= DNS_QTYPE_ALL
) &&
327 (recs
[ri
].wType
!= question
->question_type
)) {
330 werror
= create_response_rr(question
, &recs
[ri
], &ans
, &ai
);
331 if (!W_ERROR_IS_OK(werror
)) {
337 return DNS_ERR(NAME_ERROR
);
346 static NTSTATUS
create_tkey(struct dns_server
*dns
,
348 const char* algorithm
,
349 struct dns_server_tkey
**tkey
)
352 struct dns_server_tkey_store
*store
= dns
->tkeys
;
353 struct dns_server_tkey
*k
= talloc_zero(store
, struct dns_server_tkey
);
356 return NT_STATUS_NO_MEMORY
;
359 k
->name
= talloc_strdup(k
, name
);
361 if (k
->name
== NULL
) {
362 return NT_STATUS_NO_MEMORY
;
365 k
->algorithm
= talloc_strdup(k
, algorithm
);
366 if (k
->algorithm
== NULL
) {
367 return NT_STATUS_NO_MEMORY
;
370 status
= samba_server_gensec_start(k
,
371 dns
->task
->event_ctx
,
374 dns
->server_credentials
,
377 if (!NT_STATUS_IS_OK(status
)) {
378 DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status
)));
383 gensec_want_feature(k
->gensec
, GENSEC_FEATURE_SIGN
);
385 status
= gensec_start_mech_by_oid(k
->gensec
, GENSEC_OID_SPNEGO
);
387 if (!NT_STATUS_IS_OK(status
)) {
388 DEBUG(1, ("Failed to start GENSEC server code: %s\n",
394 if (store
->tkeys
[store
->next_idx
] != NULL
) {
395 TALLOC_FREE(store
->tkeys
[store
->next_idx
]);
398 store
->tkeys
[store
->next_idx
] = k
;
400 store
->next_idx
%= store
->size
;
406 static NTSTATUS
accept_gss_ticket(TALLOC_CTX
*mem_ctx
,
407 struct dns_server
*dns
,
408 struct dns_server_tkey
*tkey
,
409 const DATA_BLOB
*key
,
411 uint16_t *dns_auth_error
)
415 status
= gensec_update(tkey
->gensec
, mem_ctx
, dns
->task
->event_ctx
,
418 if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED
, status
)) {
419 *dns_auth_error
= DNS_RCODE_OK
;
423 if (NT_STATUS_IS_OK(status
)) {
425 status
= gensec_session_info(tkey
->gensec
, tkey
, &tkey
->session_info
);
426 if (!NT_STATUS_IS_OK(status
)) {
427 *dns_auth_error
= DNS_RCODE_BADKEY
;
430 *dns_auth_error
= DNS_RCODE_OK
;
436 static WERROR
handle_tkey(struct dns_server
*dns
,
438 const struct dns_name_packet
*in
,
439 struct dns_request_state
*state
,
440 struct dns_res_rec
**answers
,
443 struct dns_res_rec
*in_tkey
= NULL
;
444 struct dns_res_rec
*ret_tkey
;
447 for (i
= 0; i
< in
->arcount
; i
++) {
448 if (in
->additional
[i
].rr_type
== DNS_QTYPE_TKEY
) {
449 in_tkey
= &in
->additional
[i
];
454 /* If this is a TKEY query, it should have a TKEY RR.
455 * Behaviour is not really specified in RFC 2930 or RFC 3645, but
456 * FORMAT_ERROR seems to be what BIND uses .*/
457 if (in_tkey
== NULL
) {
458 return DNS_ERR(FORMAT_ERROR
);
461 ret_tkey
= talloc_zero(mem_ctx
, struct dns_res_rec
);
462 if (ret_tkey
== NULL
) {
466 ret_tkey
->name
= talloc_strdup(ret_tkey
, in_tkey
->name
);
467 if (ret_tkey
->name
== NULL
) {
471 ret_tkey
->rr_type
= DNS_QTYPE_TKEY
;
472 ret_tkey
->rr_class
= DNS_QCLASS_ANY
;
473 ret_tkey
->length
= UINT16_MAX
;
475 ret_tkey
->rdata
.tkey_record
.algorithm
= talloc_strdup(ret_tkey
,
476 in_tkey
->rdata
.tkey_record
.algorithm
);
477 if (ret_tkey
->rdata
.tkey_record
.algorithm
== NULL
) {
481 ret_tkey
->rdata
.tkey_record
.inception
= in_tkey
->rdata
.tkey_record
.inception
;
482 ret_tkey
->rdata
.tkey_record
.expiration
= in_tkey
->rdata
.tkey_record
.expiration
;
483 ret_tkey
->rdata
.tkey_record
.mode
= in_tkey
->rdata
.tkey_record
.mode
;
485 switch (in_tkey
->rdata
.tkey_record
.mode
) {
486 case DNS_TKEY_MODE_DH
:
487 /* FIXME: According to RFC 2930, we MUST support this, but we don't.
488 * Still, claim it's a bad key instead of a bad mode */
489 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
491 case DNS_TKEY_MODE_GSSAPI
: {
493 struct dns_server_tkey
*tkey
;
497 tkey
= dns_find_tkey(dns
->tkeys
, in
->questions
[0].name
);
498 if (tkey
!= NULL
&& tkey
->complete
) {
499 /* TODO: check if the key is still valid */
500 DEBUG(1, ("Rejecting tkey negotiation for already established key\n"));
501 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADNAME
;
506 status
= create_tkey(dns
, in
->questions
[0].name
,
507 in_tkey
->rdata
.tkey_record
.algorithm
,
509 if (!NT_STATUS_IS_OK(status
)) {
510 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
511 return ntstatus_to_werror(status
);
515 key
.data
= in_tkey
->rdata
.tkey_record
.key_data
;
516 key
.length
= in_tkey
->rdata
.tkey_record
.key_size
;
518 status
= accept_gss_ticket(ret_tkey
, dns
, tkey
, &key
, &reply
,
519 &ret_tkey
->rdata
.tkey_record
.error
);
520 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
521 DEBUG(1, ("More processing required\n"));
522 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
523 } else if (NT_STATUS_IS_OK(status
)) {
524 DEBUG(1, ("Tkey handshake completed\n"));
525 ret_tkey
->rdata
.tkey_record
.key_size
= reply
.length
;
526 ret_tkey
->rdata
.tkey_record
.key_data
= talloc_memdup(ret_tkey
,
530 state
->key_name
= talloc_strdup(mem_ctx
, tkey
->name
);
531 if (state
->key_name
== NULL
) {
535 DEBUG(1, ("GSS key negotiation returned %s\n", nt_errstr(status
)));
536 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
541 case DNS_TKEY_MODE_DELETE
:
542 /* TODO: implement me */
543 DEBUG(1, ("Should delete tkey here\n"));
544 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_OK
;
546 case DNS_TKEY_MODE_NULL
:
547 case DNS_TKEY_MODE_SERVER
:
548 case DNS_TKEY_MODE_CLIENT
:
549 case DNS_TKEY_MODE_LAST
:
550 /* We don't have to implement these, return a mode error */
551 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADMODE
;
554 DEBUG(1, ("Unsupported TKEY mode %d\n",
555 in_tkey
->rdata
.tkey_record
.mode
));
564 struct dns_server_process_query_state
{
565 struct dns_res_rec
*answers
;
567 struct dns_res_rec
*nsrecs
;
569 struct dns_res_rec
*additional
;
573 static void dns_server_process_query_got_response(struct tevent_req
*subreq
);
575 struct tevent_req
*dns_server_process_query_send(
576 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
577 struct dns_server
*dns
, struct dns_request_state
*req_state
,
578 const struct dns_name_packet
*in
)
580 struct tevent_req
*req
, *subreq
;
581 struct dns_server_process_query_state
*state
;
583 req
= tevent_req_create(mem_ctx
, &state
,
584 struct dns_server_process_query_state
);
588 if (in
->qdcount
!= 1) {
589 tevent_req_werror(req
, DNS_ERR(FORMAT_ERROR
));
590 return tevent_req_post(req
, ev
);
593 /* Windows returns NOT_IMPLEMENTED on this as well */
594 if (in
->questions
[0].question_class
== DNS_QCLASS_NONE
) {
595 tevent_req_werror(req
, DNS_ERR(NOT_IMPLEMENTED
));
596 return tevent_req_post(req
, ev
);
599 if (in
->questions
[0].question_type
== DNS_QTYPE_TKEY
) {
602 err
= handle_tkey(dns
, state
, in
, req_state
,
603 &state
->answers
, &state
->ancount
);
604 if (tevent_req_werror(req
, err
)) {
605 return tevent_req_post(req
, ev
);
607 tevent_req_done(req
);
608 return tevent_req_post(req
, ev
);
611 if (dns_authorative_for_zone(dns
, in
->questions
[0].name
)) {
614 req_state
->flags
|= DNS_FLAG_AUTHORITATIVE
;
615 err
= handle_question(dns
, state
, &in
->questions
[0],
616 &state
->answers
, &state
->ancount
);
617 if (tevent_req_werror(req
, err
)) {
618 return tevent_req_post(req
, ev
);
620 tevent_req_done(req
);
621 return tevent_req_post(req
, ev
);
624 if ((req_state
->flags
& DNS_FLAG_RECURSION_DESIRED
) &&
625 (req_state
->flags
& DNS_FLAG_RECURSION_AVAIL
)) {
626 DEBUG(2, ("Not authoritative for '%s', forwarding\n",
627 in
->questions
[0].name
));
629 subreq
= ask_forwarder_send(
631 state
, ev
, lpcfg_dns_forwarder(dns
->task
->lp_ctx
),
633 if (tevent_req_nomem(subreq
, req
)) {
634 return tevent_req_post(req
, ev
);
636 tevent_req_set_callback(
637 subreq
, dns_server_process_query_got_response
, req
);
641 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
642 return tevent_req_post(req
, ev
);
645 static void dns_server_process_query_got_response(struct tevent_req
*subreq
)
647 struct tevent_req
*req
= tevent_req_callback_data(
648 subreq
, struct tevent_req
);
649 struct dns_server_process_query_state
*state
= tevent_req_data(
650 req
, struct dns_server_process_query_state
);
653 err
= ask_forwarder_recv(subreq
, state
,
654 &state
->answers
, &state
->ancount
,
655 &state
->nsrecs
, &state
->nscount
,
656 &state
->additional
, &state
->arcount
);
658 if (tevent_req_werror(req
, err
)) {
661 tevent_req_done(req
);
664 WERROR
dns_server_process_query_recv(
665 struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
666 struct dns_res_rec
**answers
, uint16_t *ancount
,
667 struct dns_res_rec
**nsrecs
, uint16_t *nscount
,
668 struct dns_res_rec
**additional
, uint16_t *arcount
)
670 struct dns_server_process_query_state
*state
= tevent_req_data(
671 req
, struct dns_server_process_query_state
);
674 if (tevent_req_is_werror(req
, &err
)) {
677 *answers
= talloc_move(mem_ctx
, &state
->answers
);
678 *ancount
= state
->ancount
;
679 *nsrecs
= talloc_move(mem_ctx
, &state
->nsrecs
);
680 *nscount
= state
->nscount
;
681 *additional
= talloc_move(mem_ctx
, &state
->additional
);
682 *arcount
= state
->arcount
;