?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:winbind: Remove no longer used domain's private_data pointer
[Samba.git] / source4 / dns_server / dns_update.c
blob2d5f353671e918166ac2670f1e247b7b5cd5b614
1 /*
2 Unix SMB/CIFS implementation.
3
4 DNS server handler for update requests
5
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
27 #include <ldb.h>
28 #include "param/param.h"
29 #include "param/loadparm.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "samba/service_task.h"
33 #include "dns_server/dns_server.h"
34 #include "auth/auth.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_DNS
38
39 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
40 const struct dns_res_rec *rrec,
41 struct dnsp_DnssrvRpcRecord *r,
42 bool name_is_static);
43
44 static WERROR check_one_prerequisite(struct dns_server *dns,
45 TALLOC_CTX *mem_ctx,
46 const struct dns_name_question *zone,
47 const struct dns_res_rec *pr,
48 bool *final_result)
49 {
50 bool match;
51 WERROR werror;
52 struct ldb_dn *dn;
53 uint16_t i;
54 bool found = false;
55 struct dnsp_DnssrvRpcRecord *rec = NULL;
56 struct dnsp_DnssrvRpcRecord *ans;
57 uint16_t acount;
58
59 size_t host_part_len = 0;
60
61 *final_result = true;
62
63 if (pr->ttl != 0) {
64 return DNS_ERR(FORMAT_ERROR);
65 }
66
67 match = dns_name_match(zone->name, pr->name, &host_part_len);
68 if (!match) {
69 return DNS_ERR(NOTZONE);
70 }
71
72 werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
73 W_ERROR_NOT_OK_RETURN(werror);
74
75 if (pr->rr_class == DNS_QCLASS_ANY) {
76
77 if (pr->length != 0) {
78 return DNS_ERR(FORMAT_ERROR);
79 }
80
81
82 if (pr->rr_type == DNS_QTYPE_ALL) {
83 /*
84 */
85 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
86 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
87 return DNS_ERR(NAME_ERROR);
88 }
89 W_ERROR_NOT_OK_RETURN(werror);
90
91 if (acount == 0) {
92 return DNS_ERR(NAME_ERROR);
93 }
94 } else {
95 /*
96 */
97 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
98 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
99 return DNS_ERR(NXRRSET);
100 }
101 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
102 return DNS_ERR(NXRRSET);
103 }
104 W_ERROR_NOT_OK_RETURN(werror);
105
106 for (i = 0; i < acount; i++) {
107 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
108 found = true;
109 break;
110 }
111 }
112 if (!found) {
113 return DNS_ERR(NXRRSET);
114 }
115 }
116
117 /*
118 * RFC2136 3.2.5 doesn't actually mention the need to return
119 * OK here, but otherwise we'd always return a FORMAT_ERROR
120 * later on. This also matches Microsoft DNS behavior.
121 */
122 return WERR_OK;
123 }
124
125 if (pr->rr_class == DNS_QCLASS_NONE) {
126 if (pr->length != 0) {
127 return DNS_ERR(FORMAT_ERROR);
128 }
129
130 if (pr->rr_type == DNS_QTYPE_ALL) {
131 /*
132 */
133 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
134 if (W_ERROR_EQUAL(werror, WERR_OK)) {
135 return DNS_ERR(YXDOMAIN);
136 }
137 } else {
138 /*
139 */
140 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
141 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
142 werror = WERR_OK;
143 }
144 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
145 werror = WERR_OK;
146 }
147
148 for (i = 0; i < acount; i++) {
149 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
150 found = true;
151 break;
152 }
153 }
154 if (found) {
155 return DNS_ERR(YXRRSET);
156 }
157 }
158
159 /*
160 * RFC2136 3.2.5 doesn't actually mention the need to return
161 * OK here, but otherwise we'd always return a FORMAT_ERROR
162 * later on. This also matches Microsoft DNS behavior.
163 */
164 return WERR_OK;
165 }
166
167 if (pr->rr_class != zone->question_class) {
168 return DNS_ERR(FORMAT_ERROR);
169 }
170
171 *final_result = false;
172
173 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
174 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
175 return DNS_ERR(NXRRSET);
176 }
177 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
178 return DNS_ERR(NXRRSET);
179 }
180 W_ERROR_NOT_OK_RETURN(werror);
181
182 rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
183 W_ERROR_HAVE_NO_MEMORY(rec);
184
185 werror = dns_rr_to_dnsp(rec, pr, rec, dns_name_is_static(ans, acount));
186 W_ERROR_NOT_OK_RETURN(werror);
187
188 for (i = 0; i < acount; i++) {
189 if (dns_record_match(rec, &ans[i])) {
190 found = true;
191 break;
192 }
193 }
194
195 if (!found) {
196 return DNS_ERR(NXRRSET);
197 }
198
199 return WERR_OK;
200 }
201
202 static WERROR check_prerequisites(struct dns_server *dns,
203 TALLOC_CTX *mem_ctx,
204 const struct dns_name_question *zone,
205 const struct dns_res_rec *prereqs, uint16_t count)
206 {
207 uint16_t i;
208 WERROR final_error = WERR_OK;
209
210 for (i = 0; i < count; i++) {
211 bool final;
212 WERROR werror;
213
214 werror = check_one_prerequisite(dns, mem_ctx, zone,
215 &prereqs[i], &final);
216 if (!W_ERROR_IS_OK(werror)) {
217 if (final) {
218 return werror;
219 }
220 if (W_ERROR_IS_OK(final_error)) {
221 final_error = werror;
222 }
223 }
224 }
225
226 if (!W_ERROR_IS_OK(final_error)) {
227 return final_error;
228 }
229
230 return WERR_OK;
231 }
232
233 static WERROR update_prescan(const struct dns_name_question *zone,
234 const struct dns_res_rec *updates, uint16_t count)
235 {
236 const struct dns_res_rec *r;
237 uint16_t i;
238 size_t host_part_len;
239 bool match;
240
241 for (i = 0; i < count; i++) {
242 r = &updates[i];
243 match = dns_name_match(zone->name, r->name, &host_part_len);
244 if (!match) {
245 return DNS_ERR(NOTZONE);
246 }
247 if (zone->question_class == r->rr_class) {
248 if (r->rr_type == DNS_QTYPE_ALL) {
249 return DNS_ERR(FORMAT_ERROR);
250 }
251 if (r->rr_type == DNS_QTYPE_AXFR) {
252 return DNS_ERR(FORMAT_ERROR);
253 }
254 if (r->rr_type == DNS_QTYPE_MAILB) {
255 return DNS_ERR(FORMAT_ERROR);
256 }
257 if (r->rr_type == DNS_QTYPE_MAILA) {
258 return DNS_ERR(FORMAT_ERROR);
259 }
260 } else if (r->rr_class == DNS_QCLASS_ANY) {
261 if (r->ttl != 0) {
262 return DNS_ERR(FORMAT_ERROR);
263 }
264 if (r->length != 0) {
265 return DNS_ERR(FORMAT_ERROR);
266 }
267 if (r->rr_type == DNS_QTYPE_AXFR) {
268 return DNS_ERR(FORMAT_ERROR);
269 }
270 if (r->rr_type == DNS_QTYPE_MAILB) {
271 return DNS_ERR(FORMAT_ERROR);
272 }
273 if (r->rr_type == DNS_QTYPE_MAILA) {
274 return DNS_ERR(FORMAT_ERROR);
275 }
276 } else if (r->rr_class == DNS_QCLASS_NONE) {
277 if (r->ttl != 0) {
278 return DNS_ERR(FORMAT_ERROR);
279 }
280 if (r->rr_type == DNS_QTYPE_ALL) {
281 return DNS_ERR(FORMAT_ERROR);
282 }
283 if (r->rr_type == DNS_QTYPE_AXFR) {
284 return DNS_ERR(FORMAT_ERROR);
285 }
286 if (r->rr_type == DNS_QTYPE_MAILB) {
287 return DNS_ERR(FORMAT_ERROR);
288 }
289 if (r->rr_type == DNS_QTYPE_MAILA) {
290 return DNS_ERR(FORMAT_ERROR);
291 }
292 } else {
293 return DNS_ERR(FORMAT_ERROR);
294 }
295 }
296 return WERR_OK;
297 }
298
299 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
300 const struct dns_res_rec *rrec,
301 struct dnsp_DnssrvRpcRecord *r,
302 bool name_is_static)
303 {
304 enum ndr_err_code ndr_err;
305
306 if (rrec->rr_type == DNS_QTYPE_ALL) {
307 return DNS_ERR(FORMAT_ERROR);
308 }
309
310 ZERO_STRUCTP(r);
311
312 r->wType = (enum dns_record_type) rrec->rr_type;
313 r->dwTtlSeconds = rrec->ttl;
314 r->rank = DNS_RANK_ZONE;
315 if (name_is_static) {
316 r->dwTimeStamp = 0;
317 } else {
318 r->dwTimeStamp = unix_to_dns_timestamp(time(NULL));
319 }
320
321 /* If we get QCLASS_ANY, we're done here */
322 if (rrec->rr_class == DNS_QCLASS_ANY) {
323 goto done;
324 }
325
326 switch(rrec->rr_type) {
327 case DNS_QTYPE_A:
328 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
329 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
330 break;
331 case DNS_QTYPE_AAAA:
332 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
333 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
334 break;
335 case DNS_QTYPE_NS:
336 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
337 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
338 break;
339 case DNS_QTYPE_CNAME:
340 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
341 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
342 break;
343 case DNS_QTYPE_SRV:
344 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
345 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
346 r->data.srv.wPort = rrec->rdata.srv_record.port;
347 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
348 rrec->rdata.srv_record.target);
349 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
350 break;
351 case DNS_QTYPE_PTR:
352 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
353 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
354 break;
355 case DNS_QTYPE_MX:
356 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
357 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
358 rrec->rdata.mx_record.exchange);
359 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
360 break;
361 case DNS_QTYPE_TXT:
362 ndr_err = ndr_dnsp_string_list_copy(mem_ctx,
363 &rrec->rdata.txt_record.txt,
364 &r->data.txt);
365 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
366 return WERR_NOT_ENOUGH_MEMORY;
367 }
368
369 break;
370 default:
371 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
372 return DNS_ERR(NOT_IMPLEMENTED);
373 }
374
375 done:
376
377 return WERR_OK;
378 }
379
380
381 static WERROR handle_one_update(struct dns_server *dns,
382 TALLOC_CTX *mem_ctx,
383 const struct dns_name_question *zone,
384 const struct dns_res_rec *update,
385 const struct dns_server_tkey *tkey)
386 {
387 struct dnsp_DnssrvRpcRecord *recs = NULL;
388 uint16_t rcount = 0;
389 struct ldb_dn *dn;
390 uint16_t i;
391 uint16_t first = 0;
392 WERROR werror;
393 bool tombstoned = false;
394 bool needs_add = false;
395 bool name_is_static;
396
397 DEBUG(2, ("Looking at record: \n"));
398 if (DEBUGLVL(2)) {
399 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
400 }
401
402 switch (update->rr_type) {
403 case DNS_QTYPE_A:
404 case DNS_QTYPE_NS:
405 case DNS_QTYPE_CNAME:
406 case DNS_QTYPE_SOA:
407 case DNS_QTYPE_PTR:
408 case DNS_QTYPE_MX:
409 case DNS_QTYPE_AAAA:
410 case DNS_QTYPE_SRV:
411 case DNS_QTYPE_TXT:
412 case DNS_QTYPE_ALL:
413 break;
414 default:
415 DEBUG(0, ("Can't handle updates of type %u yet\n",
416 update->rr_type));
417 return DNS_ERR(NOT_IMPLEMENTED);
418 }
419
420 werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
421 W_ERROR_NOT_OK_RETURN(werror);
422
423 werror = dns_common_lookup(dns->samdb, mem_ctx, dn,
424 &recs, &rcount, &tombstoned);
425 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
426 needs_add = true;
427 werror = WERR_OK;
428 }
429 W_ERROR_NOT_OK_RETURN(werror);
430
431 if (tombstoned) {
432 /*
433 * we need to keep the existing tombstone record
434 * and ignore it.
435 *
436 * There *should* only be a single record of type TOMBSTONE,
437 * but we don't insist.
438 */
439 if (rcount != 1) {
440 DBG_WARNING("Tombstoned dnsNode has %u records, "
441 "expected 1\n", rcount);
442 if (DEBUGLVL(1)) {
443 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
444 }
445 }
446 first = rcount;
447 }
448
449 name_is_static = dns_name_is_static(recs, rcount);
450
451 if (update->rr_class == zone->question_class) {
452 if (update->rr_type == DNS_QTYPE_CNAME) {
453 /*
454 * If there is a record in the directory
455 * that's not a CNAME, ignore update
456 */
457 for (i = first; i < rcount; i++) {
458 if (recs[i].wType != DNS_TYPE_CNAME) {
459 DEBUG(5, ("Skipping update\n"));
460 return WERR_OK;
461 }
462 break;
463 }
464
465 /*
466 * There should be no entries besides one CNAME record
467 * per name, so replace everything with the new CNAME
468 */
469
470 rcount = first;
471 recs = talloc_realloc(mem_ctx, recs,
472 struct dnsp_DnssrvRpcRecord, rcount + 1);
473 W_ERROR_HAVE_NO_MEMORY(recs);
474
475 werror = dns_rr_to_dnsp(
476 recs, update, &recs[rcount], name_is_static);
477 W_ERROR_NOT_OK_RETURN(werror);
478 rcount += 1;
479
480 werror = dns_replace_records(dns, mem_ctx, dn,
481 needs_add, recs, rcount);
482 W_ERROR_NOT_OK_RETURN(werror);
483
484 return WERR_OK;
485 } else {
486 /*
487 * If there is a CNAME record for this name,
488 * ignore update
489 */
490 for (i = first; i < rcount; i++) {
491 if (recs[i].wType == DNS_TYPE_CNAME) {
492 DEBUG(5, ("Skipping update\n"));
493 return WERR_OK;
494 }
495 }
496 }
497 if (update->rr_type == DNS_QTYPE_SOA) {
498 bool found = false;
499
500 /*
501 * If the zone has no SOA record?? or update's
502 * serial number is smaller than existing SOA's,
503 * ignore update
504 */
505 for (i = first; i < rcount; i++) {
506 if (recs[i].wType == DNS_TYPE_SOA) {
507 uint16_t n, o;
508
509 n = update->rdata.soa_record.serial;
510 o = recs[i].data.soa.serial;
511 /*
512 * TODO: Implement RFC 1982 comparison
513 * logic for RFC2136
514 */
515 if (n <= o) {
516 DEBUG(5, ("Skipping update\n"));
517 return WERR_OK;
518 }
519 found = true;
520 break;
521 }
522 }
523 if (!found) {
524 DEBUG(5, ("Skipping update\n"));
525 return WERR_OK;
526 }
527
528 werror = dns_rr_to_dnsp(
529 mem_ctx, update, &recs[i], name_is_static);
530 W_ERROR_NOT_OK_RETURN(werror);
531
532 /*
533 * There should only be one SOA, which we have already
534 * found and replaced. We now check for and tombstone
535 * any others.
536 */
537 for (i++; i < rcount; i++) {
538 if (recs[i].wType != DNS_TYPE_SOA) {
539 continue;
540 }
541 DBG_ERR("Duplicate SOA records found.\n");
542 if (DEBUGLVL(0)) {
543 NDR_PRINT_DEBUG(dns_res_rec,
544 discard_const(update));
545 }
546 recs[i] = (struct dnsp_DnssrvRpcRecord) {
547 .wType = DNS_TYPE_TOMBSTONE,
548 };
549 }
550
551 werror = dns_replace_records(dns, mem_ctx, dn,
552 needs_add, recs, rcount);
553 W_ERROR_NOT_OK_RETURN(werror);
554
555 return WERR_OK;
556 }
557 /* All but CNAME, SOA */
558 recs = talloc_realloc(mem_ctx, recs,
559 struct dnsp_DnssrvRpcRecord, rcount+1);
560 W_ERROR_HAVE_NO_MEMORY(recs);
561
562 werror =
563 dns_rr_to_dnsp(recs, update, &recs[rcount], name_is_static);
564 W_ERROR_NOT_OK_RETURN(werror);
565
566 for (i = first; i < rcount; i++) {
567 if (!dns_record_match(&recs[i], &recs[rcount])) {
568 continue;
569 }
570
571 recs[i].data = recs[rcount].data;
572 recs[i].wType = recs[rcount].wType;
573 recs[i].dwTtlSeconds = recs[rcount].dwTtlSeconds;
574 recs[i].rank = recs[rcount].rank;
575 recs[i].dwReserved = 0;
576 recs[i].flags = 0;
577 werror = dns_replace_records(dns, mem_ctx, dn,
578 needs_add, recs, rcount);
579 W_ERROR_NOT_OK_RETURN(werror);
580
581 return WERR_OK;
582 }
583 /* we did not find a matching record. This is new. */
584 werror = dns_replace_records(dns, mem_ctx, dn,
585 needs_add, recs, rcount+1);
586 W_ERROR_NOT_OK_RETURN(werror);
587
588 return WERR_OK;
589 } else if (update->rr_class == DNS_QCLASS_ANY) {
590 /*
591 * Mass-deleting records by type, which we do by adding a
592 * tombstone with zero timestamp. dns_replace_records() will
593 * work out if the node as a whole needs tombstoning.
594 */
595 if (update->rr_type == DNS_QTYPE_ALL) {
596 if (dns_name_equal(update->name, zone->name)) {
597 for (i = first; i < rcount; i++) {
598
599 if (recs[i].wType == DNS_TYPE_SOA) {
600 continue;
601 }
602
603 if (recs[i].wType == DNS_TYPE_NS) {
604 continue;
605 }
606
607 recs[i] = (struct dnsp_DnssrvRpcRecord) {
608 .wType = DNS_TYPE_TOMBSTONE,
609 };
610 }
611
612 } else {
613 for (i = first; i < rcount; i++) {
614 recs[i] = (struct dnsp_DnssrvRpcRecord) {
615 .wType = DNS_TYPE_TOMBSTONE,
616 };
617 }
618 }
619
620 } else if (dns_name_equal(update->name, zone->name)) {
621
622 if (update->rr_type == DNS_QTYPE_SOA) {
623 return WERR_OK;
624 }
625
626 if (update->rr_type == DNS_QTYPE_NS) {
627 return WERR_OK;
628 }
629 }
630 for (i = first; i < rcount; i++) {
631 if (recs[i].wType == (enum dns_record_type) update->rr_type) {
632 recs[i] = (struct dnsp_DnssrvRpcRecord) {
633 .wType = DNS_TYPE_TOMBSTONE,
634 };
635 }
636 }
637
638 werror = dns_replace_records(dns, mem_ctx, dn,
639 needs_add, recs, rcount);
640 W_ERROR_NOT_OK_RETURN(werror);
641
642 return WERR_OK;
643 } else if (update->rr_class == DNS_QCLASS_NONE) {
644 /* deleting individual records */
645 struct dnsp_DnssrvRpcRecord *del_rec;
646
647 if (update->rr_type == DNS_QTYPE_SOA) {
648 return WERR_OK;
649 }
650 if (update->rr_type == DNS_QTYPE_NS) {
651 bool found = false;
652 struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
653 struct dnsp_DnssrvRpcRecord);
654 W_ERROR_HAVE_NO_MEMORY(ns_rec);
655
656 werror = dns_rr_to_dnsp(
657 ns_rec, update, ns_rec, name_is_static);
658 W_ERROR_NOT_OK_RETURN(werror);
659
660 for (i = first; i < rcount; i++) {
661 if (dns_record_match(ns_rec, &recs[i])) {
662 found = true;
663 break;
664 }
665 }
666 if (found) {
667 return WERR_OK;
668 }
669 }
670
671 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
672 W_ERROR_HAVE_NO_MEMORY(del_rec);
673
674 werror =
675 dns_rr_to_dnsp(del_rec, update, del_rec, name_is_static);
676 W_ERROR_NOT_OK_RETURN(werror);
677
678 for (i = first; i < rcount; i++) {
679 if (dns_record_match(del_rec, &recs[i])) {
680 recs[i] = (struct dnsp_DnssrvRpcRecord) {
681 .wType = DNS_TYPE_TOMBSTONE,
682 };
683 }
684 }
685
686 werror = dns_replace_records(dns, mem_ctx, dn,
687 needs_add, recs, rcount);
688 W_ERROR_NOT_OK_RETURN(werror);
689 }
690
691 return WERR_OK;
692 }
693
694 static WERROR handle_updates(struct dns_server *dns,
695 TALLOC_CTX *mem_ctx,
696 const struct dns_name_question *zone,
697 const struct dns_res_rec *prereqs, uint16_t pcount,
698 struct dns_res_rec *updates, uint16_t upd_count,
699 struct dns_server_tkey *tkey)
700 {
701 struct ldb_dn *zone_dn = NULL;
702 WERROR werror = WERR_OK;
703 int ret;
704 uint16_t ri;
705 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
706
707 if (tkey != NULL) {
708 ret = ldb_set_opaque(
709 dns->samdb,
710 DSDB_SESSION_INFO,
711 tkey->session_info);
712 if (ret != LDB_SUCCESS) {
713 DEBUG(1, ("unable to set session info\n"));
714 werror = DNS_ERR(SERVER_FAILURE);
715 goto failed;
716 }
717 }
718
719 werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
720 W_ERROR_NOT_OK_GOTO(werror, failed);
721
722 ret = ldb_transaction_start(dns->samdb);
723 if (ret != LDB_SUCCESS) {
724 werror = DNS_ERR(SERVER_FAILURE);
725 goto failed;
726 }
727
728 werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
729 W_ERROR_NOT_OK_GOTO(werror, failed);
730
731 DBG_DEBUG("dns update count is %u\n", upd_count);
732
733 for (ri = 0; ri < upd_count; ri++) {
734 werror = handle_one_update(dns, tmp_ctx, zone,
735 &updates[ri], tkey);
736 W_ERROR_NOT_OK_GOTO(werror, failed);
737 }
738
739 ldb_transaction_commit(dns->samdb);
740 TALLOC_FREE(tmp_ctx);
741
742 if (tkey != NULL) {
743 ldb_set_opaque(
744 dns->samdb,
745 DSDB_SESSION_INFO,
746 system_session(dns->task->lp_ctx));
747 }
748
749 return WERR_OK;
750
751 failed:
752 ldb_transaction_cancel(dns->samdb);
753
754 if (tkey != NULL) {
755 ldb_set_opaque(
756 dns->samdb,
757 DSDB_SESSION_INFO,
758 system_session(dns->task->lp_ctx));
759 }
760
761 TALLOC_FREE(tmp_ctx);
762 return werror;
763
764 }
765
766 static WERROR dns_update_allowed(struct dns_server *dns,
767 const struct dns_request_state *state,
768 struct dns_server_tkey **tkey)
769 {
770 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
771 DEBUG(2, ("All updates allowed.\n"));
772 return WERR_OK;
773 }
774
775 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
776 DEBUG(2, ("Updates disabled.\n"));
777 return DNS_ERR(REFUSED);
778 }
779
780 if (state->authenticated == false ) {
781 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
782 return DNS_ERR(REFUSED);
783 }
784
785 *tkey = dns_find_tkey(dns->tkeys, state->key_name);
786 if (*tkey == NULL) {
787 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
788 return DNS_ERR(REFUSED);
789 }
790
791 return WERR_OK;
792 }
793
794
795 WERROR dns_server_process_update(struct dns_server *dns,
796 const struct dns_request_state *state,
797 TALLOC_CTX *mem_ctx,
798 const struct dns_name_packet *in,
799 struct dns_res_rec **prereqs, uint16_t *prereq_count,
800 struct dns_res_rec **updates, uint16_t *update_count,
801 struct dns_res_rec **additional, uint16_t *arcount)
802 {
803 struct dns_name_question *zone;
804 const struct dns_server_zone *z;
805 size_t host_part_len = 0;
806 WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
807 struct dns_server_tkey *tkey = NULL;
808
809 if (in->qdcount != 1) {
810 return DNS_ERR(FORMAT_ERROR);
811 }
812
813 zone = &in->questions[0];
814
815 if (zone->question_class != DNS_QCLASS_IN &&
816 zone->question_class != DNS_QCLASS_ANY) {
817 return DNS_ERR(NOT_IMPLEMENTED);
818 }
819
820 if (zone->question_type != DNS_QTYPE_SOA) {
821 return DNS_ERR(FORMAT_ERROR);
822 }
823
824 DEBUG(2, ("Got a dns update request.\n"));
825
826 for (z = dns->zones; z != NULL; z = z->next) {
827 bool match;
828
829 match = dns_name_match(z->name, zone->name, &host_part_len);
830 if (match) {
831 break;
832 }
833 }
834
835 if (z == NULL) {
836 DEBUG(1, ("We're not authoritative for this zone\n"));
837 return DNS_ERR(NOTAUTH);
838 }
839
840 if (host_part_len != 0) {
841 /* TODO: We need to delegate this one */
842 DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
843 return DNS_ERR(NOT_IMPLEMENTED);
844 }
845
846 *prereq_count = in->ancount;
847 *prereqs = in->answers;
848 werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
849 *prereq_count);
850 W_ERROR_NOT_OK_RETURN(werror);
851
852 werror = dns_update_allowed(dns, state, &tkey);
853 if (!W_ERROR_IS_OK(werror)) {
854 return werror;
855 }
856
857 *update_count = in->nscount;
858 *updates = in->nsrecs;
859 werror = update_prescan(in->questions, *updates, *update_count);
860 W_ERROR_NOT_OK_RETURN(werror);
861
862 werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
863 *prereq_count, *updates, *update_count, tkey);
864 W_ERROR_NOT_OK_RETURN(werror);
865
866 return werror;
867 }
Samba GIT mirror