2 Unix SMB/CIFS implementation.
6 Copyright (C) Amitay Isaacs 2011
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "dnsserver.h"
24 #include "lib/util/dlinklist.h"
25 #include "librpc/gen_ndr/ndr_dnsp.h"
26 #include "librpc/gen_ndr/ndr_security.h"
27 #include "librpc/gen_ndr/ndr_misc.h"
28 #include "dsdb/samdb/samdb.h"
29 #include "libcli/security/security.h"
30 #include "dsdb/common/util.h"
32 /* There are only 2 fixed partitions for DNS */
33 struct dnsserver_partition
*dnsserver_db_enumerate_partitions(TALLOC_CTX
*mem_ctx
,
34 struct dnsserver_serverinfo
*serverinfo
,
35 struct ldb_context
*samdb
)
37 struct dnsserver_partition
*partitions
, *p
;
41 /* Domain partition */
42 p
= talloc_zero(mem_ctx
, struct dnsserver_partition
);
47 p
->partition_dn
= ldb_dn_new(p
, samdb
, serverinfo
->pszDomainDirectoryPartition
);
48 if (p
->partition_dn
== NULL
) {
52 p
->pszDpFqdn
= samdb_dn_to_dns_domain(p
, p
->partition_dn
);
53 p
->dwDpFlags
= DNS_DP_AUTOCREATED
| DNS_DP_DOMAIN_DEFAULT
| DNS_DP_ENLISTED
;
56 DLIST_ADD_END(partitions
, p
, NULL
);
58 /* Forest Partition */
59 p
= talloc_zero(mem_ctx
, struct dnsserver_partition
);
64 p
->partition_dn
= ldb_dn_new(p
, samdb
, serverinfo
->pszForestDirectoryPartition
);
65 if (p
->partition_dn
== NULL
) {
69 p
->pszDpFqdn
= samdb_dn_to_dns_domain(p
, p
->partition_dn
);
70 p
->dwDpFlags
= DNS_DP_AUTOCREATED
| DNS_DP_FOREST_DEFAULT
| DNS_DP_ENLISTED
;
73 DLIST_ADD_END(partitions
, p
, NULL
);
83 /* Search for all dnsZone records */
84 struct dnsserver_zone
*dnsserver_db_enumerate_zones(TALLOC_CTX
*mem_ctx
,
85 struct ldb_context
*samdb
,
86 struct dnsserver_partition
*p
)
89 const char * const attrs
[] = {"name", NULL
};
91 struct ldb_result
*res
;
92 struct dnsserver_zone
*zones
, *z
;
95 tmp_ctx
= talloc_new(mem_ctx
);
96 if (tmp_ctx
== NULL
) {
100 dn
= ldb_dn_copy(tmp_ctx
, p
->partition_dn
);
104 if (!ldb_dn_add_child_fmt(dn
, "CN=MicrosoftDNS")) {
108 ret
= ldb_search(samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_SUBTREE
,
109 attrs
, "(objectClass=dnsZone)");
110 if (ret
!= LDB_SUCCESS
) {
111 DEBUG(0, ("dnsserver: Failed to find DNS Zones in %s\n",
112 ldb_dn_get_linearized(dn
)));
117 for(i
=0; i
<res
->count
; i
++) {
119 z
= talloc_zero(mem_ctx
, struct dnsserver_zone
);
125 name
= talloc_strdup(z
,
126 ldb_msg_find_attr_as_string(res
->msgs
[i
], "name", NULL
));
127 if (strcmp(name
, "..TrustAnchors") == 0) {
131 if (strcmp(name
, "RootDNSServers") == 0) {
133 z
->name
= talloc_strdup(z
, ".");
137 z
->zone_dn
= talloc_steal(z
, res
->msgs
[i
]->dn
);
139 DLIST_ADD_END(zones
, z
, NULL
);
140 DEBUG(2, ("dnsserver: Found DNS zone %s\n", z
->name
));
146 talloc_free(tmp_ctx
);
151 /* Find DNS partition information */
152 struct dnsserver_partition_info
*dnsserver_db_partition_info(TALLOC_CTX
*mem_ctx
,
153 struct ldb_context
*samdb
,
154 struct dnsserver_partition
*p
)
156 const char * const attrs
[] = { "instanceType", "msDs-masteredBy", NULL
};
157 const char * const attrs_none
[] = { NULL
};
158 struct ldb_result
*res
;
159 struct ldb_message_element
*el
;
161 struct dnsserver_partition_info
*partinfo
;
162 int i
, ret
, instance_type
;
165 tmp_ctx
= talloc_new(mem_ctx
);
166 if (tmp_ctx
== NULL
) {
170 partinfo
= talloc_zero(mem_ctx
, struct dnsserver_partition_info
);
171 if (partinfo
== NULL
) {
172 talloc_free(tmp_ctx
);
176 /* Search for the active replica and state */
177 ret
= ldb_search(samdb
, tmp_ctx
, &res
, p
->partition_dn
, LDB_SCOPE_BASE
,
179 if (ret
!= LDB_SUCCESS
|| res
->count
!= 1) {
183 /* Set the state of the partition */
184 instance_type
= ldb_msg_find_attr_as_int(res
->msgs
[0], "instanceType", -1);
185 if (instance_type
== -1) {
186 partinfo
->dwState
= DNS_DP_STATE_UNKNOWN
;
187 } else if (instance_type
& INSTANCE_TYPE_NC_COMING
) {
188 partinfo
->dwState
= DNS_DP_STATE_REPL_INCOMING
;
189 } else if (instance_type
& INSTANCE_TYPE_NC_GOING
) {
190 partinfo
->dwState
= DNS_DP_STATE_REPL_OUTGOING
;
192 partinfo
->dwState
= DNS_DP_OKAY
;
195 el
= ldb_msg_find_element(res
->msgs
[0], "msDs-masteredBy");
197 partinfo
->dwReplicaCount
= 0;
198 partinfo
->ReplicaArray
= NULL
;
200 partinfo
->dwReplicaCount
= el
->num_values
;
201 partinfo
->ReplicaArray
= talloc_zero_array(partinfo
,
202 struct DNS_RPC_DP_REPLICA
*,
204 if (partinfo
->ReplicaArray
== NULL
) {
207 for (i
=0; i
<el
->num_values
; i
++) {
208 partinfo
->ReplicaArray
[i
] = talloc_zero(partinfo
,
209 struct DNS_RPC_DP_REPLICA
);
210 if (partinfo
->ReplicaArray
[i
] == NULL
) {
213 partinfo
->ReplicaArray
[i
]->pszReplicaDn
= talloc_strdup(
215 (const char *)el
->values
[i
].data
);
216 if (partinfo
->ReplicaArray
[i
]->pszReplicaDn
== NULL
) {
223 /* Search for cross-reference object */
224 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_config_basedn(samdb
));
229 ret
= ldb_search(samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_DEFAULT
, attrs_none
,
230 "(nCName=%s)", ldb_dn_get_linearized(p
->partition_dn
));
231 if (ret
!= LDB_SUCCESS
|| res
->count
!= 1) {
234 partinfo
->pszCrDn
= talloc_strdup(partinfo
, ldb_dn_get_linearized(res
->msgs
[0]->dn
));
235 if (partinfo
->pszCrDn
== NULL
) {
240 talloc_free(tmp_ctx
);
244 talloc_free(tmp_ctx
);
245 talloc_free(partinfo
);
250 /* Increment serial number and update timestamp */
251 static unsigned int dnsserver_update_soa(TALLOC_CTX
*mem_ctx
,
252 struct ldb_context
*samdb
,
253 struct dnsserver_zone
*z
)
255 const char * const attrs
[] = { "dnsRecord", NULL
};
256 struct ldb_result
*res
;
257 struct dnsp_DnssrvRpcRecord rec
;
258 struct ldb_message_element
*el
;
259 enum ndr_err_code ndr_err
;
260 int ret
, i
, serial
= -1;
263 unix_to_nt_time(&t
, time(NULL
));
264 t
/= 10*1000*1000; /* convert to seconds (NT time is in 100ns units) */
265 t
/= 3600; /* convert to hours */
267 ret
= ldb_search(samdb
, mem_ctx
, &res
, z
->zone_dn
, LDB_SCOPE_ONELEVEL
, attrs
,
268 "(&(objectClass=dnsNode)(name=@))");
269 if (ret
!= LDB_SUCCESS
|| res
->count
== 0) {
273 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
278 for (i
=0; i
<el
->num_values
; i
++) {
279 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], mem_ctx
, &rec
,
280 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
281 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
285 if (rec
.wType
== DNS_TYPE_SOA
) {
286 serial
= rec
.data
.soa
.serial
+ 1;
287 rec
.dwSerial
= serial
;
288 rec
.dwTimeStamp
= (uint32_t)t
;
289 rec
.data
.soa
.serial
= serial
;
291 ndr_err
= ndr_push_struct_blob(&el
->values
[i
], mem_ctx
, &rec
,
292 (ndr_push_flags_fn_t
)ndr_push_dnsp_DnssrvRpcRecord
);
293 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
301 el
->flags
= LDB_FLAG_MOD_REPLACE
;
302 ret
= ldb_modify(samdb
, res
->msgs
[0]);
303 if (ret
!= LDB_SUCCESS
) {
312 /* Add DNS record to the database */
313 static WERROR
dnsserver_db_do_add_rec(TALLOC_CTX
*mem_ctx
,
314 struct ldb_context
*samdb
,
317 struct dnsp_DnssrvRpcRecord
*rec
)
319 struct ldb_message
*msg
;
322 enum ndr_err_code ndr_err
;
325 msg
= ldb_msg_new(mem_ctx
);
326 W_ERROR_HAVE_NO_MEMORY(msg
);
329 ret
= ldb_msg_add_string(msg
, "objectClass", "dnsNode");
330 if (ret
!= LDB_SUCCESS
) {
334 if (num_rec
> 0 && rec
) {
335 for (i
=0; i
<num_rec
; i
++) {
336 ndr_err
= ndr_push_struct_blob(&v
, mem_ctx
, &rec
[i
],
337 (ndr_push_flags_fn_t
)ndr_push_dnsp_DnssrvRpcRecord
);
338 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
339 return WERR_GENERAL_FAILURE
;
342 ret
= ldb_msg_add_value(msg
, "dnsRecord", &v
, NULL
);
343 if (ret
!= LDB_SUCCESS
) {
349 ret
= ldb_add(samdb
, msg
);
350 if (ret
!= LDB_SUCCESS
) {
351 return WERR_INTERNAL_DB_ERROR
;
358 /* Add dnsNode record to the database with DNS record */
359 WERROR
dnsserver_db_add_empty_node(TALLOC_CTX
*mem_ctx
,
360 struct ldb_context
*samdb
,
361 struct dnsserver_zone
*z
,
364 const char * const attrs
[] = { "name", NULL
};
365 struct ldb_result
*res
;
369 ret
= ldb_search(samdb
, mem_ctx
, &res
, z
->zone_dn
, LDB_SCOPE_BASE
, attrs
,
370 "(&(objectClass=dnsNode)(name=%s))", name
);
371 if (ret
!= LDB_SUCCESS
) {
372 return WERR_INTERNAL_DB_ERROR
;
375 if (res
->count
> 0) {
377 return WERR_DNS_ERROR_RECORD_ALREADY_EXISTS
;
380 dn
= ldb_dn_copy(mem_ctx
, z
->zone_dn
);
381 W_ERROR_HAVE_NO_MEMORY(dn
);
383 if (!ldb_dn_add_child_fmt(dn
, "DC=%s", name
)) {
387 return dnsserver_db_do_add_rec(mem_ctx
, samdb
, dn
, 0, NULL
);
391 /* Add a DNS record */
392 WERROR
dnsserver_db_add_record(TALLOC_CTX
*mem_ctx
,
393 struct ldb_context
*samdb
,
394 struct dnsserver_zone
*z
,
396 struct DNS_RPC_RECORD
*add_record
)
398 const char * const attrs
[] = { "dnsRecord", "dNSTombstoned", NULL
};
399 struct ldb_result
*res
;
400 struct dnsp_DnssrvRpcRecord
*rec
;
401 struct ldb_message_element
*el
;
403 enum ndr_err_code ndr_err
;
407 bool was_tombstoned
= false;
409 rec
= dns_to_dnsp_copy(mem_ctx
, add_record
);
410 W_ERROR_HAVE_NO_MEMORY(rec
);
412 /* Set the correct rank for the record. */
413 if (z
->zoneinfo
->dwZoneType
== DNS_ZONE_TYPE_PRIMARY
) {
414 if (strcmp(name
, "@") != 0 && rec
->wType
== DNS_TYPE_NS
) {
415 rec
->rank
= DNS_RANK_NS_GLUE
;
417 rec
->rank
|= DNS_RANK_ZONE
;
419 } else if (strcmp(z
->name
, ".") == 0) {
420 rec
->rank
|= DNS_RANK_ROOT_HINT
;
423 serial
= dnsserver_update_soa(mem_ctx
, samdb
, z
);
425 return WERR_INTERNAL_DB_ERROR
;
428 unix_to_nt_time(&t
, time(NULL
));
429 t
/= 10*1000*1000; /* convert to seconds (NT time is in 100ns units) */
430 t
/= 3600; /* convert to hours */
432 rec
->dwSerial
= serial
;
433 rec
->dwTimeStamp
= t
;
435 ret
= ldb_search(samdb
, mem_ctx
, &res
, z
->zone_dn
, LDB_SCOPE_ONELEVEL
, attrs
,
436 "(&(objectClass=dnsNode)(name=%s))", name
);
437 if (ret
!= LDB_SUCCESS
) {
438 return WERR_INTERNAL_DB_ERROR
;
441 if (res
->count
== 0) {
442 dn
= dnsserver_name_to_dn(mem_ctx
, z
, name
);
443 W_ERROR_HAVE_NO_MEMORY(dn
);
445 return dnsserver_db_do_add_rec(mem_ctx
, samdb
, dn
, 1, rec
);
448 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
450 ret
= ldb_msg_add_empty(res
->msgs
[0], "dnsRecord", 0, &el
);
451 if (ret
!= LDB_SUCCESS
) {
456 was_tombstoned
= ldb_msg_find_attr_as_bool(res
->msgs
[0],
457 "dNSTombstoned", false);
458 if (was_tombstoned
) {
462 for (i
=0; i
<el
->num_values
; i
++) {
463 struct dnsp_DnssrvRpcRecord rec2
;
465 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], mem_ctx
, &rec2
,
466 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
467 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
468 return WERR_GENERAL_FAILURE
;
471 if (dns_record_match(rec
, &rec2
)) {
475 if (i
< el
->num_values
) {
476 return WERR_DNS_ERROR_RECORD_ALREADY_EXISTS
;
478 if (i
== el
->num_values
) {
479 /* adding a new value */
480 el
->values
= talloc_realloc(el
, el
->values
, struct ldb_val
, el
->num_values
+1);
481 W_ERROR_HAVE_NO_MEMORY(el
->values
);
485 ndr_err
= ndr_push_struct_blob(&el
->values
[i
], mem_ctx
, rec
,
486 (ndr_push_flags_fn_t
)ndr_push_dnsp_DnssrvRpcRecord
);
487 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
488 return WERR_GENERAL_FAILURE
;
491 el
->flags
= LDB_FLAG_MOD_REPLACE
;
493 el
= ldb_msg_find_element(res
->msgs
[0], "dNSTombstoned");
495 el
->flags
= LDB_FLAG_MOD_DELETE
;
498 ret
= ldb_modify(samdb
, res
->msgs
[0]);
499 if (ret
!= LDB_SUCCESS
) {
500 return WERR_INTERNAL_DB_ERROR
;
507 /* Update a DNS record */
508 WERROR
dnsserver_db_update_record(TALLOC_CTX
*mem_ctx
,
509 struct ldb_context
*samdb
,
510 struct dnsserver_zone
*z
,
512 struct DNS_RPC_RECORD
*add_record
,
513 struct DNS_RPC_RECORD
*del_record
)
515 const char * const attrs
[] = { "dnsRecord", NULL
};
516 struct ldb_result
*res
;
517 struct dnsp_DnssrvRpcRecord
*arec
, *drec
;
518 struct ldb_message_element
*el
;
519 enum ndr_err_code ndr_err
;
524 arec
= dns_to_dnsp_copy(mem_ctx
, add_record
);
525 W_ERROR_HAVE_NO_MEMORY(arec
);
527 drec
= dns_to_dnsp_copy(mem_ctx
, del_record
);
528 W_ERROR_HAVE_NO_MEMORY(drec
);
530 unix_to_nt_time(&t
, time(NULL
));
533 arec
->dwTimeStamp
= t
;
535 ret
= ldb_search(samdb
, mem_ctx
, &res
, z
->zone_dn
, LDB_SCOPE_ONELEVEL
, attrs
,
536 "(&(objectClass=dnsNode)(name=%s)(!(dNSTombstoned=TRUE)))", name
);
537 if (ret
!= LDB_SUCCESS
) {
538 return WERR_INTERNAL_DB_ERROR
;
541 if (res
->count
== 0) {
542 return WERR_DNS_ERROR_RECORD_DOES_NOT_EXIST
;
545 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
546 if (el
== NULL
|| el
->num_values
== 0) {
547 return WERR_DNS_ERROR_RECORD_DOES_NOT_EXIST
;
550 for (i
=0; i
<el
->num_values
; i
++) {
551 struct dnsp_DnssrvRpcRecord rec2
;
553 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], mem_ctx
, &rec2
,
554 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
555 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
556 return WERR_GENERAL_FAILURE
;
559 if (dns_record_match(arec
, &rec2
)) {
563 if (i
< el
->num_values
) {
564 return WERR_DNS_ERROR_RECORD_ALREADY_EXISTS
;
568 for (i
=0; i
<el
->num_values
; i
++) {
569 struct dnsp_DnssrvRpcRecord rec2
;
571 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], mem_ctx
, &rec2
,
572 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
573 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
574 return WERR_GENERAL_FAILURE
;
577 if (dns_record_match(drec
, &rec2
)) {
581 if (i
== el
->num_values
) {
582 return WERR_DNS_ERROR_RECORD_DOES_NOT_EXIST
;
585 /* If updating SOA record, use specified serial, otherwise increment */
586 if (arec
->wType
!= DNS_TYPE_SOA
) {
587 serial
= dnsserver_update_soa(mem_ctx
, samdb
, z
);
589 return WERR_INTERNAL_DB_ERROR
;
591 arec
->dwSerial
= serial
;
594 ndr_err
= ndr_push_struct_blob(&el
->values
[i
], mem_ctx
, arec
,
595 (ndr_push_flags_fn_t
)ndr_push_dnsp_DnssrvRpcRecord
);
596 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
597 return WERR_GENERAL_FAILURE
;
600 el
->flags
= LDB_FLAG_MOD_REPLACE
;
601 ret
= ldb_modify(samdb
, res
->msgs
[0]);
602 if (ret
!= LDB_SUCCESS
) {
603 return WERR_INTERNAL_DB_ERROR
;
610 /* Delete a DNS record */
611 WERROR
dnsserver_db_delete_record(TALLOC_CTX
*mem_ctx
,
612 struct ldb_context
*samdb
,
613 struct dnsserver_zone
*z
,
615 struct DNS_RPC_RECORD
*del_record
)
617 const char * const attrs
[] = { "dnsRecord", NULL
};
618 struct ldb_result
*res
;
619 struct dnsp_DnssrvRpcRecord
*rec
;
620 struct ldb_message_element
*el
;
621 enum ndr_err_code ndr_err
;
625 serial
= dnsserver_update_soa(mem_ctx
, samdb
, z
);
627 return WERR_INTERNAL_DB_ERROR
;
630 rec
= dns_to_dnsp_copy(mem_ctx
, del_record
);
631 W_ERROR_HAVE_NO_MEMORY(rec
);
633 ret
= ldb_search(samdb
, mem_ctx
, &res
, z
->zone_dn
, LDB_SCOPE_ONELEVEL
, attrs
,
634 "(&(objectClass=dnsNode)(name=%s))", name
);
635 if (ret
!= LDB_SUCCESS
) {
636 return WERR_INTERNAL_DB_ERROR
;
639 if (res
->count
== 0) {
640 return WERR_DNS_ERROR_RECORD_DOES_NOT_EXIST
;
643 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
644 if (el
== NULL
|| el
->num_values
== 0) {
645 return WERR_DNS_ERROR_RECORD_DOES_NOT_EXIST
;
648 for (i
=0; i
<el
->num_values
; i
++) {
649 struct dnsp_DnssrvRpcRecord rec2
;
651 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], mem_ctx
, &rec2
,
652 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
653 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
654 return WERR_GENERAL_FAILURE
;
657 if (dns_record_match(rec
, &rec2
)) {
661 if (i
== el
->num_values
) {
662 return WERR_DNS_ERROR_RECORD_DOES_NOT_EXIST
;
664 if (i
< el
->num_values
-1) {
665 memmove(&el
->values
[i
], &el
->values
[i
+1], sizeof(el
->values
[0])*((el
->num_values
-1)-i
));
669 if (el
->num_values
== 0) {
670 ret
= ldb_delete(samdb
, res
->msgs
[0]->dn
);
672 el
->flags
= LDB_FLAG_MOD_REPLACE
;
673 ret
= ldb_modify(samdb
, res
->msgs
[0]);
675 if (ret
!= LDB_SUCCESS
) {
676 return WERR_INTERNAL_DB_ERROR
;
683 static bool dnsserver_db_msg_add_dnsproperty(TALLOC_CTX
*mem_ctx
,
684 struct ldb_message
*msg
,
685 struct dnsp_DnsProperty
*prop
)
687 DATA_BLOB
*prop_blob
;
688 enum ndr_err_code ndr_err
;
691 prop_blob
= talloc_zero(mem_ctx
, DATA_BLOB
);
692 if (prop_blob
== NULL
) return false;
694 ndr_err
= ndr_push_struct_blob(prop_blob
, mem_ctx
, prop
,
695 (ndr_push_flags_fn_t
)ndr_push_dnsp_DnsProperty
);
696 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
699 ret
= ldb_msg_add_steal_value(msg
, "dNSProperty", prop_blob
);
700 if (ret
!= LDB_SUCCESS
) {
707 /* Create dnsZone record to database and set security descriptor */
708 static WERROR
dnsserver_db_do_create_zone(TALLOC_CTX
*tmp_ctx
,
709 struct ldb_context
*samdb
,
710 struct ldb_dn
*zone_dn
,
711 struct dnsserver_zone
*z
)
713 const char * const attrs
[] = { "objectSID", NULL
};
714 struct ldb_message
*msg
;
715 struct ldb_result
*res
;
716 struct ldb_message_element
*el
;
717 const char sddl_template
[] = "D:AI(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;CC;;;AU)(A;;RPLCLORC;;;WD)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;CI;RPWPCRCCDCLCRCWOWDSDDTSW;;;ED)(A;CIID;RPWPCRCCDCLCRCWOWDSDDTSW;;;%s)(A;CIID;RPWPCRCCDCLCRCWOWDSDDTSW;;;ED)(OA;CIID;RPWPCR;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)(A;CIID;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)(A;CIID;LC;;;RU)(A;CIID;RPWPCRCCLCLORCWOWDSDSW;;;BA)S:AI";
719 struct dom_sid dnsadmins_sid
;
720 const struct dom_sid
*domain_sid
;
721 struct security_descriptor
*secdesc
;
722 struct dnsp_DnsProperty
*prop
;
723 DATA_BLOB
*sd_encoded
;
724 enum ndr_err_code ndr_err
;
727 /* Get DnsAdmins SID */
728 ret
= ldb_search(samdb
, tmp_ctx
, &res
, ldb_get_default_basedn(samdb
),
729 LDB_SCOPE_DEFAULT
, attrs
, "(sAMAccountName=DnsAdmins)");
730 if (ret
!= LDB_SUCCESS
|| res
->count
!= 1) {
731 return WERR_INTERNAL_DB_ERROR
;
734 el
= ldb_msg_find_element(res
->msgs
[0], "objectSID");
735 if (el
== NULL
|| el
->num_values
!= 1) {
736 return WERR_INTERNAL_DB_ERROR
;
739 ndr_err
= ndr_pull_struct_blob(&el
->values
[0], tmp_ctx
, &dnsadmins_sid
,
740 (ndr_pull_flags_fn_t
)ndr_pull_dom_sid
);
741 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
742 return WERR_INTERNAL_DB_ERROR
;
745 /* create security descriptor with DnsAdmins GUID in sddl template */
746 sddl
= talloc_asprintf(tmp_ctx
, sddl_template
,
747 dom_sid_string(tmp_ctx
, &dnsadmins_sid
));
753 domain_sid
= samdb_domain_sid(samdb
);
754 if (domain_sid
== NULL
) {
755 return WERR_INTERNAL_DB_ERROR
;
758 secdesc
= sddl_decode(tmp_ctx
, sddl
, domain_sid
);
759 if (secdesc
== NULL
) {
760 return WERR_GENERAL_FAILURE
;
763 msg
= ldb_msg_new(tmp_ctx
);
764 W_ERROR_HAVE_NO_MEMORY(msg
);
767 ret
= ldb_msg_add_string(msg
, "objectClass", "dnsZone");
768 if (ret
!= LDB_SUCCESS
) {
772 sd_encoded
= talloc_zero(tmp_ctx
, DATA_BLOB
);
773 W_ERROR_HAVE_NO_MEMORY(sd_encoded
);
775 ndr_err
= ndr_push_struct_blob(sd_encoded
, tmp_ctx
, secdesc
,
776 (ndr_push_flags_fn_t
)ndr_push_security_descriptor
);
777 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
778 return WERR_GENERAL_FAILURE
;
781 ret
= ldb_msg_add_steal_value(msg
, "nTSecurityDescriptor", sd_encoded
);
782 if (ret
!= LDB_SUCCESS
) {
786 /* dns zone Properties */
787 prop
= talloc_zero(tmp_ctx
, struct dnsp_DnsProperty
);
788 W_ERROR_HAVE_NO_MEMORY(prop
);
793 prop
->id
= DSPROPERTY_ZONE_TYPE
;
794 prop
->data
.zone_type
= z
->zoneinfo
->dwZoneType
;
795 if (!dnsserver_db_msg_add_dnsproperty(tmp_ctx
, msg
, prop
)) {
800 prop
->id
= DSPROPERTY_ZONE_ALLOW_UPDATE
;
801 prop
->data
.allow_update_flag
= z
->zoneinfo
->fAllowUpdate
;
802 if (!dnsserver_db_msg_add_dnsproperty(tmp_ctx
, msg
, prop
)) {
807 prop
->id
= DSPROPERTY_ZONE_SECURE_TIME
;
808 prop
->data
.zone_secure_time
= 0;
809 if (!dnsserver_db_msg_add_dnsproperty(tmp_ctx
, msg
, prop
)) {
813 /* norefresh interval */
814 prop
->id
= DSPROPERTY_ZONE_NOREFRESH_INTERVAL
;
815 prop
->data
.norefresh_hours
= 168;
816 if (!dnsserver_db_msg_add_dnsproperty(tmp_ctx
, msg
, prop
)) {
820 /* refresh interval */
821 prop
->id
= DSPROPERTY_ZONE_REFRESH_INTERVAL
;
822 prop
->data
.refresh_hours
= 168;
823 if (!dnsserver_db_msg_add_dnsproperty(tmp_ctx
, msg
, prop
)) {
828 prop
->id
= DSPROPERTY_ZONE_AGING_STATE
;
829 prop
->data
.aging_enabled
= z
->zoneinfo
->fAging
;
830 if (!dnsserver_db_msg_add_dnsproperty(tmp_ctx
, msg
, prop
)) {
834 /* aging enabled time */
835 prop
->id
= DSPROPERTY_ZONE_AGING_ENABLED_TIME
;
836 prop
->data
.next_scavenging_cycle_hours
= 0;
837 if (!dnsserver_db_msg_add_dnsproperty(tmp_ctx
, msg
, prop
)) {
843 ret
= ldb_add(samdb
, msg
);
844 if (ret
!= LDB_SUCCESS
) {
845 DEBUG(0, ("dnsserver: Failed to create zone (%s): %s\n",
846 z
->name
, ldb_errstring(samdb
)));
847 return WERR_INTERNAL_DB_ERROR
;
854 /* Create new dnsZone record and @ record (SOA + NS) */
855 WERROR
dnsserver_db_create_zone(struct ldb_context
*samdb
,
856 struct dnsserver_partition
*partitions
,
857 struct dnsserver_zone
*zone
,
858 struct loadparm_context
*lp_ctx
)
860 struct dnsserver_partition
*p
;
861 bool in_forest
= false;
865 struct dnsp_DnssrvRpcRecord
*dns_rec
;
867 char *tmpstr
, *server_fqdn
, *soa_email
;
870 /* We only support primary zones for now */
871 if (zone
->zoneinfo
->dwZoneType
!= DNS_ZONE_TYPE_PRIMARY
) {
872 return WERR_CALL_NOT_IMPLEMENTED
;
875 /* Get the correct partition */
876 if (zone
->partition
->dwDpFlags
& DNS_DP_FOREST_DEFAULT
) {
879 for (p
= partitions
; p
; p
= p
->next
) {
880 if (in_forest
== p
->is_forest
) {
885 return WERR_DNS_ERROR_DP_DOES_NOT_EXIST
;
888 tmp_ctx
= talloc_new(NULL
);
889 W_ERROR_HAVE_NO_MEMORY(tmp_ctx
);
891 dn
= ldb_dn_copy(tmp_ctx
, p
->partition_dn
);
892 W_ERROR_HAVE_NO_MEMORY_AND_FREE(dn
, tmp_ctx
);
894 if(!ldb_dn_add_child_fmt(dn
, "DC=%s,CN=MicrosoftDNS", zone
->name
)) {
895 talloc_free(tmp_ctx
);
899 /* Add dnsZone record */
900 status
= dnsserver_db_do_create_zone(tmp_ctx
, samdb
, dn
, zone
);
901 if (!W_ERROR_IS_OK(status
)) {
902 talloc_free(tmp_ctx
);
906 if (!ldb_dn_add_child_fmt(dn
, "DC=@")) {
907 talloc_free(tmp_ctx
);
911 dns_rec
= talloc_zero_array(tmp_ctx
, struct dnsp_DnssrvRpcRecord
, 2);
912 W_ERROR_HAVE_NO_MEMORY_AND_FREE(dns_rec
, tmp_ctx
);
914 tmpstr
= talloc_asprintf(tmp_ctx
, "%s.%s",
915 lpcfg_netbios_name(lp_ctx
),
916 lpcfg_realm(lp_ctx
));
917 W_ERROR_HAVE_NO_MEMORY_AND_FREE(tmpstr
, tmp_ctx
);
918 server_fqdn
= strlower_talloc(tmp_ctx
, tmpstr
);
919 W_ERROR_HAVE_NO_MEMORY_AND_FREE(server_fqdn
, tmp_ctx
);
922 tmpstr
= talloc_asprintf(tmp_ctx
, "hostmaster.%s",
923 lpcfg_realm(lp_ctx
));
924 W_ERROR_HAVE_NO_MEMORY_AND_FREE(tmpstr
, tmp_ctx
);
925 soa_email
= strlower_talloc(tmp_ctx
, tmpstr
);
926 W_ERROR_HAVE_NO_MEMORY_AND_FREE(soa_email
, tmp_ctx
);
929 unix_to_nt_time(&t
, time(NULL
));
930 t
/= 10*1000*1000; /* convert to seconds (NT time is in 100ns units) */
931 t
/= 3600; /* convert to hours */
933 /* SOA Record - values same as defined in provision/sambadns.py */
939 soa
.mname
= server_fqdn
;
940 soa
.rname
= soa_email
;
942 dns_rec
[0].wType
= DNS_TYPE_SOA
;
943 dns_rec
[0].rank
= DNS_RANK_ZONE
;
944 dns_rec
[0].dwSerial
= soa
.serial
;
945 dns_rec
[0].dwTtlSeconds
= 3600;
946 dns_rec
[0].dwTimeStamp
= (uint32_t)t
;
947 dns_rec
[0].data
.soa
= soa
;
950 dns_rec
[1].wType
= DNS_TYPE_NS
;
951 dns_rec
[1].rank
= DNS_RANK_ZONE
;
952 dns_rec
[1].dwSerial
= soa
.serial
;
953 dns_rec
[1].dwTtlSeconds
= 3600;
954 dns_rec
[1].dwTimeStamp
= (uint32_t)t
;
955 dns_rec
[1].data
.ns
= server_fqdn
;
958 status
= dnsserver_db_do_add_rec(tmp_ctx
, samdb
, dn
, 2, dns_rec
);
960 talloc_free(tmp_ctx
);
965 /* Delete dnsZone record and all DNS records in the zone */
966 WERROR
dnsserver_db_delete_zone(struct ldb_context
*samdb
,
967 struct dnsserver_zone
*zone
)
971 ret
= ldb_transaction_start(samdb
);
972 if (ret
!= LDB_SUCCESS
) {
973 return WERR_INTERNAL_DB_ERROR
;
976 ret
= dsdb_delete(samdb
, zone
->zone_dn
, DSDB_TREE_DELETE
);
977 if (ret
!= LDB_SUCCESS
) {
978 ldb_transaction_cancel(samdb
);
979 return WERR_INTERNAL_DB_ERROR
;
982 ret
= ldb_transaction_commit(samdb
);
983 if (ret
!= LDB_SUCCESS
) {
984 return WERR_INTERNAL_DB_ERROR
;