2 Unix SMB/CIFS implementation.
4 DNS server handler for queries
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/service_task.h"
24 #include "libcli/util/werror.h"
25 #include "librpc/ndr/libndr.h"
26 #include "librpc/gen_ndr/ndr_dns.h"
27 #include "librpc/gen_ndr/ndr_dnsp.h"
29 #include "param/param.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "dns_server/dns_server.h"
33 #include "libcli/dns/libdns.h"
34 #include "lib/util/util_net.h"
35 #include "lib/util/tevent_werror.h"
36 #include "auth/auth.h"
37 #include "auth/credentials/credentials.h"
38 #include "auth/gensec/gensec.h"
40 static WERROR
create_response_rr(const struct dns_name_question
*question
,
41 const struct dnsp_DnssrvRpcRecord
*rec
,
42 struct dns_res_rec
**answers
, uint16_t *ancount
)
44 struct dns_res_rec
*ans
= *answers
;
45 uint16_t ai
= *ancount
;
53 ans
[ai
].rdata
.cname_record
= talloc_strdup(ans
, rec
->data
.cname
);
54 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.cname_record
);
57 ans
[ai
].rdata
.ipv4_record
= talloc_strdup(ans
, rec
->data
.ipv4
);
58 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ipv4_record
);
61 ans
[ai
].rdata
.ipv6_record
= talloc_strdup(ans
, rec
->data
.ipv6
);
62 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ipv6_record
);
65 ans
[ai
].rdata
.ns_record
= talloc_strdup(ans
, rec
->data
.ns
);
66 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ns_record
);
69 ans
[ai
].rdata
.srv_record
.priority
= rec
->data
.srv
.wPriority
;
70 ans
[ai
].rdata
.srv_record
.weight
= rec
->data
.srv
.wWeight
;
71 ans
[ai
].rdata
.srv_record
.port
= rec
->data
.srv
.wPort
;
72 ans
[ai
].rdata
.srv_record
.target
= talloc_strdup(
73 ans
, rec
->data
.srv
.nameTarget
);
74 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.srv_record
.target
);
77 ans
[ai
].rdata
.soa_record
.mname
= talloc_strdup(
78 ans
, rec
->data
.soa
.mname
);
79 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.soa_record
.mname
);
80 ans
[ai
].rdata
.soa_record
.rname
= talloc_strdup(
81 ans
, rec
->data
.soa
.rname
);
82 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.soa_record
.rname
);
83 ans
[ai
].rdata
.soa_record
.serial
= rec
->data
.soa
.serial
;
84 ans
[ai
].rdata
.soa_record
.refresh
= rec
->data
.soa
.refresh
;
85 ans
[ai
].rdata
.soa_record
.retry
= rec
->data
.soa
.retry
;
86 ans
[ai
].rdata
.soa_record
.expire
= rec
->data
.soa
.expire
;
87 ans
[ai
].rdata
.soa_record
.minimum
= rec
->data
.soa
.minimum
;
90 ans
[ai
].rdata
.ptr_record
= talloc_strdup(ans
, rec
->data
.ptr
);
93 ans
[ai
].rdata
.mx_record
.preference
= rec
->data
.mx
.wPriority
;
94 ans
[ai
].rdata
.mx_record
.exchange
= talloc_strdup(
95 ans
, rec
->data
.mx
.nameTarget
);
96 if (ans
[ai
].rdata
.mx_record
.exchange
== NULL
) {
101 tmp
= talloc_asprintf(ans
, "\"%s\"", rec
->data
.txt
.str
[0]);
102 W_ERROR_HAVE_NO_MEMORY(tmp
);
103 for (i
=1; i
<rec
->data
.txt
.count
; i
++) {
104 tmp
= talloc_asprintf_append_buffer(
105 tmp
, " \"%s\"", rec
->data
.txt
.str
[i
]);
106 W_ERROR_HAVE_NO_MEMORY(tmp
);
108 ans
[ai
].rdata
.txt_record
.txt
= tmp
;
111 DEBUG(0, ("Got unhandled type %u query.\n", rec
->wType
));
112 return DNS_ERR(NOT_IMPLEMENTED
);
115 ans
[ai
].name
= talloc_strdup(ans
, question
->name
);
116 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].name
);
117 ans
[ai
].rr_type
= rec
->wType
;
118 ans
[ai
].rr_class
= DNS_QCLASS_IN
;
119 ans
[ai
].ttl
= rec
->dwTtlSeconds
;
120 ans
[ai
].length
= UINT16_MAX
;
129 struct ask_forwarder_state
{
130 struct tevent_context
*ev
;
132 struct dns_name_packet in_packet
;
135 static void ask_forwarder_done(struct tevent_req
*subreq
);
137 static struct tevent_req
*ask_forwarder_send(
138 struct dns_server
*dns
,
139 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
140 const char *forwarder
, struct dns_name_question
*question
)
142 struct tevent_req
*req
, *subreq
;
143 struct ask_forwarder_state
*state
;
144 struct dns_res_rec
*options
;
145 struct dns_name_packet out_packet
= { 0, };
147 enum ndr_err_code ndr_err
;
150 req
= tevent_req_create(mem_ctx
, &state
, struct ask_forwarder_state
);
155 generate_random_buffer((uint8_t *)&state
->id
, sizeof(state
->id
));
157 if (!is_ipaddress(forwarder
)) {
158 DEBUG(0, ("Invalid 'dns forwarder' setting '%s', needs to be "
159 "an IP address\n", forwarder
));
160 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
161 return tevent_req_post(req
, ev
);
164 out_packet
.id
= state
->id
;
165 out_packet
.operation
|= DNS_OPCODE_QUERY
| DNS_FLAG_RECURSION_DESIRED
;
166 out_packet
.qdcount
= 1;
167 out_packet
.questions
= question
;
169 werr
= dns_generate_options(dns
, state
, &options
);
170 if (!W_ERROR_IS_OK(werr
)) {
171 tevent_req_werror(req
, werr
);
172 return tevent_req_post(req
, ev
);
175 out_packet
.arcount
= 1;
176 out_packet
.additional
= options
;
178 ndr_err
= ndr_push_struct_blob(
179 &out_blob
, state
, &out_packet
,
180 (ndr_push_flags_fn_t
)ndr_push_dns_name_packet
);
181 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
182 tevent_req_werror(req
, DNS_ERR(SERVER_FAILURE
));
183 return tevent_req_post(req
, ev
);
185 subreq
= dns_udp_request_send(state
, ev
, forwarder
, out_blob
.data
,
187 if (tevent_req_nomem(subreq
, req
)) {
188 return tevent_req_post(req
, ev
);
190 tevent_req_set_callback(subreq
, ask_forwarder_done
, req
);
194 static void ask_forwarder_done(struct tevent_req
*subreq
)
196 struct tevent_req
*req
= tevent_req_callback_data(
197 subreq
, struct tevent_req
);
198 struct ask_forwarder_state
*state
= tevent_req_data(
199 req
, struct ask_forwarder_state
);
201 enum ndr_err_code ndr_err
;
204 ret
= dns_udp_request_recv(subreq
, state
,
205 &in_blob
.data
, &in_blob
.length
);
207 if (tevent_req_werror(req
, ret
)) {
211 ndr_err
= ndr_pull_struct_blob(
212 &in_blob
, state
, &state
->in_packet
,
213 (ndr_pull_flags_fn_t
)ndr_pull_dns_name_packet
);
214 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
215 tevent_req_werror(req
, DNS_ERR(SERVER_FAILURE
));
218 if (state
->in_packet
.id
!= state
->id
) {
219 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
222 tevent_req_done(req
);
225 static WERROR
ask_forwarder_recv(
226 struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
227 struct dns_res_rec
**answers
, uint16_t *ancount
,
228 struct dns_res_rec
**nsrecs
, uint16_t *nscount
,
229 struct dns_res_rec
**additional
, uint16_t *arcount
)
231 struct ask_forwarder_state
*state
= tevent_req_data(
232 req
, struct ask_forwarder_state
);
233 struct dns_name_packet
*in_packet
= &state
->in_packet
;
236 if (tevent_req_is_werror(req
, &err
)) {
240 *ancount
= in_packet
->ancount
;
241 *answers
= talloc_move(mem_ctx
, &in_packet
->answers
);
243 *nscount
= in_packet
->nscount
;
244 *nsrecs
= talloc_move(mem_ctx
, &in_packet
->nsrecs
);
246 *arcount
= in_packet
->arcount
;
247 *additional
= talloc_move(mem_ctx
, &in_packet
->additional
);
252 static WERROR
handle_question(struct dns_server
*dns
,
254 const struct dns_name_question
*question
,
255 struct dns_res_rec
**answers
, uint16_t *ancount
)
257 struct dns_res_rec
*ans
= *answers
;
258 WERROR werror
, werror_return
;
260 struct dnsp_DnssrvRpcRecord
*recs
;
261 uint16_t rec_count
, ai
= *ancount
;
262 struct ldb_dn
*dn
= NULL
;
264 werror
= dns_name2dn(dns
, mem_ctx
, question
->name
, &dn
);
265 W_ERROR_NOT_OK_RETURN(werror
);
267 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &recs
, &rec_count
);
268 W_ERROR_NOT_OK_RETURN(werror
);
270 ans
= talloc_realloc(mem_ctx
, ans
, struct dns_res_rec
, rec_count
+ ai
);
275 /* Set up for an NXDOMAIN reply if no match is found */
276 werror_return
= DNS_ERR(NAME_ERROR
);
278 for (ri
= 0; ri
< rec_count
; ri
++) {
279 if ((recs
[ri
].wType
== DNS_TYPE_CNAME
) &&
280 ((question
->question_type
== DNS_QTYPE_A
) ||
281 (question
->question_type
== DNS_QTYPE_AAAA
))) {
282 struct dns_name_question
*new_q
=
283 talloc(mem_ctx
, struct dns_name_question
);
289 /* We reply with one more record, so grow the array */
290 ans
= talloc_realloc(mem_ctx
, ans
, struct dns_res_rec
,
297 /* First put in the CNAME record */
298 werror
= create_response_rr(question
, &recs
[ri
], &ans
, &ai
);
299 if (!W_ERROR_IS_OK(werror
)) {
303 /* And then look up the name it points at.. */
305 /* First build up the new question */
306 new_q
->question_type
= question
->question_type
;
307 new_q
->question_class
= question
->question_class
;
308 if (new_q
->question_type
== DNS_QTYPE_A
) {
309 new_q
->name
= talloc_strdup(new_q
, recs
[ri
].data
.ipv4
);
310 } else if (new_q
->question_type
== DNS_QTYPE_AAAA
) {
311 new_q
->name
= talloc_strdup(new_q
, recs
[ri
].data
.ipv6
);
313 if (new_q
->name
== NULL
) {
317 /* and then call the lookup again */
318 werror
= handle_question(dns
, mem_ctx
, new_q
, &ans
, &ai
);
319 if (!W_ERROR_IS_OK(werror
)) {
322 werror_return
= WERR_OK
;
327 if ((question
->question_type
!= DNS_QTYPE_ALL
) &&
328 (recs
[ri
].wType
!= question
->question_type
)) {
329 werror_return
= WERR_OK
;
332 werror
= create_response_rr(question
, &recs
[ri
], &ans
, &ai
);
333 if (!W_ERROR_IS_OK(werror
)) {
336 werror_return
= WERR_OK
;
342 return werror_return
;
345 static NTSTATUS
create_tkey(struct dns_server
*dns
,
347 const char* algorithm
,
348 struct dns_server_tkey
**tkey
)
351 struct dns_server_tkey_store
*store
= dns
->tkeys
;
352 struct dns_server_tkey
*k
= talloc_zero(store
, struct dns_server_tkey
);
355 return NT_STATUS_NO_MEMORY
;
358 k
->name
= talloc_strdup(k
, name
);
360 if (k
->name
== NULL
) {
361 return NT_STATUS_NO_MEMORY
;
364 k
->algorithm
= talloc_strdup(k
, algorithm
);
365 if (k
->algorithm
== NULL
) {
366 return NT_STATUS_NO_MEMORY
;
369 status
= samba_server_gensec_start(k
,
370 dns
->task
->event_ctx
,
373 dns
->server_credentials
,
376 if (!NT_STATUS_IS_OK(status
)) {
377 DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status
)));
382 gensec_want_feature(k
->gensec
, GENSEC_FEATURE_SIGN
);
384 status
= gensec_start_mech_by_oid(k
->gensec
, GENSEC_OID_SPNEGO
);
386 if (!NT_STATUS_IS_OK(status
)) {
387 DEBUG(1, ("Failed to start GENSEC server code: %s\n",
393 if (store
->tkeys
[store
->next_idx
] != NULL
) {
394 TALLOC_FREE(store
->tkeys
[store
->next_idx
]);
397 store
->tkeys
[store
->next_idx
] = k
;
399 store
->next_idx
%= store
->size
;
405 static NTSTATUS
accept_gss_ticket(TALLOC_CTX
*mem_ctx
,
406 struct dns_server
*dns
,
407 struct dns_server_tkey
*tkey
,
408 const DATA_BLOB
*key
,
410 uint16_t *dns_auth_error
)
414 status
= gensec_update(tkey
->gensec
, mem_ctx
, dns
->task
->event_ctx
,
417 if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED
, status
)) {
418 *dns_auth_error
= DNS_RCODE_OK
;
422 if (NT_STATUS_IS_OK(status
)) {
424 status
= gensec_session_info(tkey
->gensec
, tkey
, &tkey
->session_info
);
425 if (!NT_STATUS_IS_OK(status
)) {
426 *dns_auth_error
= DNS_RCODE_BADKEY
;
429 *dns_auth_error
= DNS_RCODE_OK
;
435 static WERROR
handle_tkey(struct dns_server
*dns
,
437 const struct dns_name_packet
*in
,
438 struct dns_request_state
*state
,
439 struct dns_res_rec
**answers
,
442 struct dns_res_rec
*in_tkey
= NULL
;
443 struct dns_res_rec
*ret_tkey
;
446 for (i
= 0; i
< in
->arcount
; i
++) {
447 if (in
->additional
[i
].rr_type
== DNS_QTYPE_TKEY
) {
448 in_tkey
= &in
->additional
[i
];
453 /* If this is a TKEY query, it should have a TKEY RR.
454 * Behaviour is not really specified in RFC 2930 or RFC 3645, but
455 * FORMAT_ERROR seems to be what BIND uses .*/
456 if (in_tkey
== NULL
) {
457 return DNS_ERR(FORMAT_ERROR
);
460 ret_tkey
= talloc_zero(mem_ctx
, struct dns_res_rec
);
461 if (ret_tkey
== NULL
) {
465 ret_tkey
->name
= talloc_strdup(ret_tkey
, in_tkey
->name
);
466 if (ret_tkey
->name
== NULL
) {
470 ret_tkey
->rr_type
= DNS_QTYPE_TKEY
;
471 ret_tkey
->rr_class
= DNS_QCLASS_ANY
;
472 ret_tkey
->length
= UINT16_MAX
;
474 ret_tkey
->rdata
.tkey_record
.algorithm
= talloc_strdup(ret_tkey
,
475 in_tkey
->rdata
.tkey_record
.algorithm
);
476 if (ret_tkey
->rdata
.tkey_record
.algorithm
== NULL
) {
480 ret_tkey
->rdata
.tkey_record
.inception
= in_tkey
->rdata
.tkey_record
.inception
;
481 ret_tkey
->rdata
.tkey_record
.expiration
= in_tkey
->rdata
.tkey_record
.expiration
;
482 ret_tkey
->rdata
.tkey_record
.mode
= in_tkey
->rdata
.tkey_record
.mode
;
484 switch (in_tkey
->rdata
.tkey_record
.mode
) {
485 case DNS_TKEY_MODE_DH
:
486 /* FIXME: According to RFC 2930, we MUST support this, but we don't.
487 * Still, claim it's a bad key instead of a bad mode */
488 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
490 case DNS_TKEY_MODE_GSSAPI
: {
492 struct dns_server_tkey
*tkey
;
496 tkey
= dns_find_tkey(dns
->tkeys
, in
->questions
[0].name
);
497 if (tkey
!= NULL
&& tkey
->complete
) {
498 /* TODO: check if the key is still valid */
499 DEBUG(1, ("Rejecting tkey negotiation for already established key\n"));
500 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADNAME
;
505 status
= create_tkey(dns
, in
->questions
[0].name
,
506 in_tkey
->rdata
.tkey_record
.algorithm
,
508 if (!NT_STATUS_IS_OK(status
)) {
509 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
510 return ntstatus_to_werror(status
);
514 key
.data
= in_tkey
->rdata
.tkey_record
.key_data
;
515 key
.length
= in_tkey
->rdata
.tkey_record
.key_size
;
517 status
= accept_gss_ticket(ret_tkey
, dns
, tkey
, &key
, &reply
,
518 &ret_tkey
->rdata
.tkey_record
.error
);
519 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
520 DEBUG(1, ("More processing required\n"));
521 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
522 } else if (NT_STATUS_IS_OK(status
)) {
523 DEBUG(1, ("Tkey handshake completed\n"));
524 ret_tkey
->rdata
.tkey_record
.key_size
= reply
.length
;
525 ret_tkey
->rdata
.tkey_record
.key_data
= talloc_memdup(ret_tkey
,
529 state
->key_name
= talloc_strdup(mem_ctx
, tkey
->name
);
530 if (state
->key_name
== NULL
) {
534 DEBUG(1, ("GSS key negotiation returned %s\n", nt_errstr(status
)));
535 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
540 case DNS_TKEY_MODE_DELETE
:
541 /* TODO: implement me */
542 DEBUG(1, ("Should delete tkey here\n"));
543 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_OK
;
545 case DNS_TKEY_MODE_NULL
:
546 case DNS_TKEY_MODE_SERVER
:
547 case DNS_TKEY_MODE_CLIENT
:
548 case DNS_TKEY_MODE_LAST
:
549 /* We don't have to implement these, return a mode error */
550 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADMODE
;
553 DEBUG(1, ("Unsupported TKEY mode %d\n",
554 in_tkey
->rdata
.tkey_record
.mode
));
563 struct dns_server_process_query_state
{
564 struct dns_res_rec
*answers
;
566 struct dns_res_rec
*nsrecs
;
568 struct dns_res_rec
*additional
;
572 static void dns_server_process_query_got_response(struct tevent_req
*subreq
);
574 struct tevent_req
*dns_server_process_query_send(
575 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
576 struct dns_server
*dns
, struct dns_request_state
*req_state
,
577 const struct dns_name_packet
*in
)
579 struct tevent_req
*req
, *subreq
;
580 struct dns_server_process_query_state
*state
;
582 req
= tevent_req_create(mem_ctx
, &state
,
583 struct dns_server_process_query_state
);
587 if (in
->qdcount
!= 1) {
588 tevent_req_werror(req
, DNS_ERR(FORMAT_ERROR
));
589 return tevent_req_post(req
, ev
);
592 /* Windows returns NOT_IMPLEMENTED on this as well */
593 if (in
->questions
[0].question_class
== DNS_QCLASS_NONE
) {
594 tevent_req_werror(req
, DNS_ERR(NOT_IMPLEMENTED
));
595 return tevent_req_post(req
, ev
);
598 if (in
->questions
[0].question_type
== DNS_QTYPE_TKEY
) {
601 err
= handle_tkey(dns
, state
, in
, req_state
,
602 &state
->answers
, &state
->ancount
);
603 if (tevent_req_werror(req
, err
)) {
604 return tevent_req_post(req
, ev
);
606 tevent_req_done(req
);
607 return tevent_req_post(req
, ev
);
610 if (dns_authorative_for_zone(dns
, in
->questions
[0].name
)) {
613 req_state
->flags
|= DNS_FLAG_AUTHORITATIVE
;
614 err
= handle_question(dns
, state
, &in
->questions
[0],
615 &state
->answers
, &state
->ancount
);
616 if (tevent_req_werror(req
, err
)) {
617 return tevent_req_post(req
, ev
);
619 tevent_req_done(req
);
620 return tevent_req_post(req
, ev
);
623 if ((req_state
->flags
& DNS_FLAG_RECURSION_DESIRED
) &&
624 (req_state
->flags
& DNS_FLAG_RECURSION_AVAIL
)) {
625 DEBUG(2, ("Not authoritative for '%s', forwarding\n",
626 in
->questions
[0].name
));
628 subreq
= ask_forwarder_send(
630 state
, ev
, lpcfg_dns_forwarder(dns
->task
->lp_ctx
),
632 if (tevent_req_nomem(subreq
, req
)) {
633 return tevent_req_post(req
, ev
);
635 tevent_req_set_callback(
636 subreq
, dns_server_process_query_got_response
, req
);
640 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
641 return tevent_req_post(req
, ev
);
644 static void dns_server_process_query_got_response(struct tevent_req
*subreq
)
646 struct tevent_req
*req
= tevent_req_callback_data(
647 subreq
, struct tevent_req
);
648 struct dns_server_process_query_state
*state
= tevent_req_data(
649 req
, struct dns_server_process_query_state
);
652 err
= ask_forwarder_recv(subreq
, state
,
653 &state
->answers
, &state
->ancount
,
654 &state
->nsrecs
, &state
->nscount
,
655 &state
->additional
, &state
->arcount
);
657 if (tevent_req_werror(req
, err
)) {
660 tevent_req_done(req
);
663 WERROR
dns_server_process_query_recv(
664 struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
665 struct dns_res_rec
**answers
, uint16_t *ancount
,
666 struct dns_res_rec
**nsrecs
, uint16_t *nscount
,
667 struct dns_res_rec
**additional
, uint16_t *arcount
)
669 struct dns_server_process_query_state
*state
= tevent_req_data(
670 req
, struct dns_server_process_query_state
);
673 if (tevent_req_is_werror(req
, &err
)) {
676 *answers
= talloc_move(mem_ctx
, &state
->answers
);
677 *ancount
= state
->ancount
;
678 *nsrecs
= talloc_move(mem_ctx
, &state
->nsrecs
);
679 *nscount
= state
->nscount
;
680 *additional
= talloc_move(mem_ctx
, &state
->additional
);
681 *arcount
= state
->arcount
;