?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
tests/krb5: Add tests for account salt calculation
[Samba.git] / source4 / dns_server / dns_update.c
blobf9866611119739df42701ffb42db0f83aeb6cc87
1 /*
2 Unix SMB/CIFS implementation.
3
4 DNS server handler for update requests
5
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
27 #include <ldb.h>
28 #include "param/param.h"
29 #include "param/loadparm.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "smbd/service_task.h"
33 #include "dns_server/dns_server.h"
34 #include "auth/auth.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_DNS
38
39 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
40 const struct dns_res_rec *rrec,
41 struct dnsp_DnssrvRpcRecord *r,
42 bool name_is_static);
43
44 static WERROR check_one_prerequisite(struct dns_server *dns,
45 TALLOC_CTX *mem_ctx,
46 const struct dns_name_question *zone,
47 const struct dns_res_rec *pr,
48 bool *final_result)
49 {
50 bool match;
51 WERROR werror;
52 struct ldb_dn *dn;
53 uint16_t i;
54 bool found = false;
55 struct dnsp_DnssrvRpcRecord *rec = NULL;
56 struct dnsp_DnssrvRpcRecord *ans;
57 uint16_t acount;
58
59 size_t host_part_len = 0;
60
61 *final_result = true;
62
63 if (pr->ttl != 0) {
64 return DNS_ERR(FORMAT_ERROR);
65 }
66
67 match = dns_name_match(zone->name, pr->name, &host_part_len);
68 if (!match) {
69 return DNS_ERR(NOTZONE);
70 }
71
72 werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
73 W_ERROR_NOT_OK_RETURN(werror);
74
75 if (pr->rr_class == DNS_QCLASS_ANY) {
76
77 if (pr->length != 0) {
78 return DNS_ERR(FORMAT_ERROR);
79 }
80
81
82 if (pr->rr_type == DNS_QTYPE_ALL) {
83 /*
84 */
85 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
86 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
87 return DNS_ERR(NAME_ERROR);
88 }
89 W_ERROR_NOT_OK_RETURN(werror);
90
91 if (acount == 0) {
92 return DNS_ERR(NAME_ERROR);
93 }
94 } else {
95 /*
96 */
97 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
98 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
99 return DNS_ERR(NXRRSET);
100 }
101 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
102 return DNS_ERR(NXRRSET);
103 }
104 W_ERROR_NOT_OK_RETURN(werror);
105
106 for (i = 0; i < acount; i++) {
107 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
108 found = true;
109 break;
110 }
111 }
112 if (!found) {
113 return DNS_ERR(NXRRSET);
114 }
115 }
116
117 /*
118 * RFC2136 3.2.5 doesn't actually mention the need to return
119 * OK here, but otherwise we'd always return a FORMAT_ERROR
120 * later on. This also matches Microsoft DNS behavior.
121 */
122 return WERR_OK;
123 }
124
125 if (pr->rr_class == DNS_QCLASS_NONE) {
126 if (pr->length != 0) {
127 return DNS_ERR(FORMAT_ERROR);
128 }
129
130 if (pr->rr_type == DNS_QTYPE_ALL) {
131 /*
132 */
133 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
134 if (W_ERROR_EQUAL(werror, WERR_OK)) {
135 return DNS_ERR(YXDOMAIN);
136 }
137 } else {
138 /*
139 */
140 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
141 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
142 werror = WERR_OK;
143 }
144 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
145 werror = WERR_OK;
146 }
147
148 for (i = 0; i < acount; i++) {
149 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
150 found = true;
151 break;
152 }
153 }
154 if (found) {
155 return DNS_ERR(YXRRSET);
156 }
157 }
158
159 /*
160 * RFC2136 3.2.5 doesn't actually mention the need to return
161 * OK here, but otherwise we'd always return a FORMAT_ERROR
162 * later on. This also matches Microsoft DNS behavior.
163 */
164 return WERR_OK;
165 }
166
167 if (pr->rr_class != zone->question_class) {
168 return DNS_ERR(FORMAT_ERROR);
169 }
170
171 *final_result = false;
172
173 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
174 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
175 return DNS_ERR(NXRRSET);
176 }
177 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
178 return DNS_ERR(NXRRSET);
179 }
180 W_ERROR_NOT_OK_RETURN(werror);
181
182 rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
183 W_ERROR_HAVE_NO_MEMORY(rec);
184
185 werror = dns_rr_to_dnsp(rec, pr, rec, dns_name_is_static(ans, acount));
186 W_ERROR_NOT_OK_RETURN(werror);
187
188 for (i = 0; i < acount; i++) {
189 if (dns_records_match(rec, &ans[i])) {
190 found = true;
191 break;
192 }
193 }
194
195 if (!found) {
196 return DNS_ERR(NXRRSET);
197 }
198
199 return WERR_OK;
200 }
201
202 static WERROR check_prerequisites(struct dns_server *dns,
203 TALLOC_CTX *mem_ctx,
204 const struct dns_name_question *zone,
205 const struct dns_res_rec *prereqs, uint16_t count)
206 {
207 uint16_t i;
208 WERROR final_error = WERR_OK;
209
210 for (i = 0; i < count; i++) {
211 bool final;
212 WERROR werror;
213
214 werror = check_one_prerequisite(dns, mem_ctx, zone,
215 &prereqs[i], &final);
216 if (!W_ERROR_IS_OK(werror)) {
217 if (final) {
218 return werror;
219 }
220 if (W_ERROR_IS_OK(final_error)) {
221 final_error = werror;
222 }
223 }
224 }
225
226 if (!W_ERROR_IS_OK(final_error)) {
227 return final_error;
228 }
229
230 return WERR_OK;
231 }
232
233 static WERROR update_prescan(const struct dns_name_question *zone,
234 const struct dns_res_rec *updates, uint16_t count)
235 {
236 const struct dns_res_rec *r;
237 uint16_t i;
238 size_t host_part_len;
239 bool match;
240
241 for (i = 0; i < count; i++) {
242 r = &updates[i];
243 match = dns_name_match(zone->name, r->name, &host_part_len);
244 if (!match) {
245 return DNS_ERR(NOTZONE);
246 }
247 if (zone->question_class == r->rr_class) {
248 if (r->rr_type == DNS_QTYPE_ALL) {
249 return DNS_ERR(FORMAT_ERROR);
250 }
251 if (r->rr_type == DNS_QTYPE_AXFR) {
252 return DNS_ERR(FORMAT_ERROR);
253 }
254 if (r->rr_type == DNS_QTYPE_MAILB) {
255 return DNS_ERR(FORMAT_ERROR);
256 }
257 if (r->rr_type == DNS_QTYPE_MAILA) {
258 return DNS_ERR(FORMAT_ERROR);
259 }
260 } else if (r->rr_class == DNS_QCLASS_ANY) {
261 if (r->ttl != 0) {
262 return DNS_ERR(FORMAT_ERROR);
263 }
264 if (r->length != 0) {
265 return DNS_ERR(FORMAT_ERROR);
266 }
267 if (r->rr_type == DNS_QTYPE_AXFR) {
268 return DNS_ERR(FORMAT_ERROR);
269 }
270 if (r->rr_type == DNS_QTYPE_MAILB) {
271 return DNS_ERR(FORMAT_ERROR);
272 }
273 if (r->rr_type == DNS_QTYPE_MAILA) {
274 return DNS_ERR(FORMAT_ERROR);
275 }
276 } else if (r->rr_class == DNS_QCLASS_NONE) {
277 if (r->ttl != 0) {
278 return DNS_ERR(FORMAT_ERROR);
279 }
280 if (r->rr_type == DNS_QTYPE_ALL) {
281 return DNS_ERR(FORMAT_ERROR);
282 }
283 if (r->rr_type == DNS_QTYPE_AXFR) {
284 return DNS_ERR(FORMAT_ERROR);
285 }
286 if (r->rr_type == DNS_QTYPE_MAILB) {
287 return DNS_ERR(FORMAT_ERROR);
288 }
289 if (r->rr_type == DNS_QTYPE_MAILA) {
290 return DNS_ERR(FORMAT_ERROR);
291 }
292 } else {
293 return DNS_ERR(FORMAT_ERROR);
294 }
295 }
296 return WERR_OK;
297 }
298
299 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
300 const struct dns_res_rec *rrec,
301 struct dnsp_DnssrvRpcRecord *r,
302 bool name_is_static)
303 {
304 enum ndr_err_code ndr_err;
305 NTTIME t;
306
307 if (rrec->rr_type == DNS_QTYPE_ALL) {
308 return DNS_ERR(FORMAT_ERROR);
309 }
310
311 ZERO_STRUCTP(r);
312
313 r->wType = (enum dns_record_type) rrec->rr_type;
314 r->dwTtlSeconds = rrec->ttl;
315 r->rank = DNS_RANK_ZONE;
316 if (name_is_static) {
317 r->dwTimeStamp = 0;
318 } else {
319 unix_to_nt_time(&t, time(NULL));
320 t /= 10 * 1000 * 1000;
321 t /= 3600;
322 r->dwTimeStamp = t;
323 }
324
325 /* If we get QCLASS_ANY, we're done here */
326 if (rrec->rr_class == DNS_QCLASS_ANY) {
327 goto done;
328 }
329
330 switch(rrec->rr_type) {
331 case DNS_QTYPE_A:
332 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
333 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
334 break;
335 case DNS_QTYPE_AAAA:
336 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
337 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
338 break;
339 case DNS_QTYPE_NS:
340 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
341 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
342 break;
343 case DNS_QTYPE_CNAME:
344 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
345 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
346 break;
347 case DNS_QTYPE_SRV:
348 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
349 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
350 r->data.srv.wPort = rrec->rdata.srv_record.port;
351 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
352 rrec->rdata.srv_record.target);
353 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
354 break;
355 case DNS_QTYPE_PTR:
356 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
357 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
358 break;
359 case DNS_QTYPE_MX:
360 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
361 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
362 rrec->rdata.mx_record.exchange);
363 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
364 break;
365 case DNS_QTYPE_TXT:
366 ndr_err = ndr_dnsp_string_list_copy(mem_ctx,
367 &rrec->rdata.txt_record.txt,
368 &r->data.txt);
369 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
370 return WERR_NOT_ENOUGH_MEMORY;
371 }
372
373 break;
374 default:
375 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
376 return DNS_ERR(NOT_IMPLEMENTED);
377 }
378
379 done:
380
381 return WERR_OK;
382 }
383
384
385 static WERROR handle_one_update(struct dns_server *dns,
386 TALLOC_CTX *mem_ctx,
387 const struct dns_name_question *zone,
388 const struct dns_res_rec *update,
389 const struct dns_server_tkey *tkey)
390 {
391 struct dnsp_DnssrvRpcRecord *recs = NULL;
392 uint16_t rcount = 0;
393 struct ldb_dn *dn;
394 uint16_t i;
395 uint16_t first = 0;
396 WERROR werror;
397 bool tombstoned = false;
398 bool needs_add = false;
399 bool name_is_static;
400
401 DEBUG(2, ("Looking at record: \n"));
402 if (DEBUGLVL(2)) {
403 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
404 }
405
406 switch (update->rr_type) {
407 case DNS_QTYPE_A:
408 case DNS_QTYPE_NS:
409 case DNS_QTYPE_CNAME:
410 case DNS_QTYPE_SOA:
411 case DNS_QTYPE_PTR:
412 case DNS_QTYPE_MX:
413 case DNS_QTYPE_AAAA:
414 case DNS_QTYPE_SRV:
415 case DNS_QTYPE_TXT:
416 break;
417 default:
418 DEBUG(0, ("Can't handle updates of type %u yet\n",
419 update->rr_type));
420 return DNS_ERR(NOT_IMPLEMENTED);
421 }
422
423 werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
424 W_ERROR_NOT_OK_RETURN(werror);
425
426 werror = dns_common_lookup(dns->samdb, mem_ctx, dn,
427 &recs, &rcount, &tombstoned);
428 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
429 needs_add = true;
430 werror = WERR_OK;
431 }
432 W_ERROR_NOT_OK_RETURN(werror);
433
434 if (tombstoned) {
435 /*
436 * we need to keep the existing tombstone record
437 * and ignore it
438 */
439 first = rcount;
440 }
441
442 name_is_static = dns_name_is_static(recs, rcount);
443
444 if (update->rr_class == zone->question_class) {
445 if (update->rr_type == DNS_QTYPE_CNAME) {
446 /*
447 * If there is a record in the directory
448 * that's not a CNAME, ignore update
449 */
450 for (i = first; i < rcount; i++) {
451 if (recs[i].wType != DNS_TYPE_CNAME) {
452 DEBUG(5, ("Skipping update\n"));
453 return WERR_OK;
454 }
455 break;
456 }
457
458 /*
459 * There should be no entries besides one CNAME record
460 * per name, so replace everything with the new CNAME
461 */
462
463 rcount = first;
464 recs = talloc_realloc(mem_ctx, recs,
465 struct dnsp_DnssrvRpcRecord, rcount + 1);
466 W_ERROR_HAVE_NO_MEMORY(recs);
467
468 werror = dns_rr_to_dnsp(
469 recs, update, &recs[rcount], name_is_static);
470 W_ERROR_NOT_OK_RETURN(werror);
471 rcount += 1;
472
473 werror = dns_replace_records(dns, mem_ctx, dn,
474 needs_add, recs, rcount);
475 W_ERROR_NOT_OK_RETURN(werror);
476
477 return WERR_OK;
478 } else {
479 /*
480 * If there is a CNAME record for this name,
481 * ignore update
482 */
483 for (i = first; i < rcount; i++) {
484 if (recs[i].wType == DNS_TYPE_CNAME) {
485 DEBUG(5, ("Skipping update\n"));
486 return WERR_OK;
487 }
488 }
489 }
490 if (update->rr_type == DNS_QTYPE_SOA) {
491 bool found = false;
492
493 /*
494 * If the zone has no SOA record?? or update's
495 * serial number is smaller than existing SOA's,
496 * ignore update
497 */
498 for (i = first; i < rcount; i++) {
499 if (recs[i].wType == DNS_TYPE_SOA) {
500 uint16_t n, o;
501
502 n = update->rdata.soa_record.serial;
503 o = recs[i].data.soa.serial;
504 /*
505 * TODO: Implement RFC 1982 comparison
506 * logic for RFC2136
507 */
508 if (n <= o) {
509 DEBUG(5, ("Skipping update\n"));
510 return WERR_OK;
511 }
512 found = true;
513 break;
514 }
515 }
516 if (!found) {
517 DEBUG(5, ("Skipping update\n"));
518 return WERR_OK;
519 }
520
521 werror = dns_rr_to_dnsp(
522 mem_ctx, update, &recs[i], name_is_static);
523 W_ERROR_NOT_OK_RETURN(werror);
524
525 for (i++; i < rcount; i++) {
526 if (recs[i].wType != DNS_TYPE_SOA) {
527 continue;
528 }
529
530 recs[i] = (struct dnsp_DnssrvRpcRecord) {
531 .wType = DNS_TYPE_TOMBSTONE,
532 };
533 }
534
535 werror = dns_replace_records(dns, mem_ctx, dn,
536 needs_add, recs, rcount);
537 W_ERROR_NOT_OK_RETURN(werror);
538
539 return WERR_OK;
540 }
541
542 recs = talloc_realloc(mem_ctx, recs,
543 struct dnsp_DnssrvRpcRecord, rcount+1);
544 W_ERROR_HAVE_NO_MEMORY(recs);
545
546 werror =
547 dns_rr_to_dnsp(recs, update, &recs[rcount], name_is_static);
548 W_ERROR_NOT_OK_RETURN(werror);
549
550 for (i = first; i < rcount; i++) {
551 if (!dns_records_match(&recs[i], &recs[rcount])) {
552 continue;
553 }
554
555 recs[i].data = recs[rcount].data;
556 recs[i].wType = recs[rcount].wType;
557 recs[i].dwTtlSeconds = recs[rcount].dwTtlSeconds;
558 recs[i].rank = recs[rcount].rank;
559
560 werror = dns_replace_records(dns, mem_ctx, dn,
561 needs_add, recs, rcount);
562 W_ERROR_NOT_OK_RETURN(werror);
563
564 return WERR_OK;
565 }
566
567 werror = dns_replace_records(dns, mem_ctx, dn,
568 needs_add, recs, rcount+1);
569 W_ERROR_NOT_OK_RETURN(werror);
570
571 return WERR_OK;
572 } else if (update->rr_class == DNS_QCLASS_ANY) {
573 if (update->rr_type == DNS_QTYPE_ALL) {
574 if (dns_name_equal(update->name, zone->name)) {
575 for (i = first; i < rcount; i++) {
576
577 if (recs[i].wType == DNS_TYPE_SOA) {
578 continue;
579 }
580
581 if (recs[i].wType == DNS_TYPE_NS) {
582 continue;
583 }
584
585 recs[i] = (struct dnsp_DnssrvRpcRecord) {
586 .wType = DNS_TYPE_TOMBSTONE,
587 };
588 }
589
590 } else {
591 for (i = first; i < rcount; i++) {
592 recs[i] = (struct dnsp_DnssrvRpcRecord) {
593 .wType = DNS_TYPE_TOMBSTONE,
594 };
595 }
596 }
597
598 } else if (dns_name_equal(update->name, zone->name)) {
599
600 if (update->rr_type == DNS_QTYPE_SOA) {
601 return WERR_OK;
602 }
603
604 if (update->rr_type == DNS_QTYPE_NS) {
605 return WERR_OK;
606 }
607 }
608 for (i = first; i < rcount; i++) {
609 if (recs[i].wType == (enum dns_record_type) update->rr_type) {
610 recs[i] = (struct dnsp_DnssrvRpcRecord) {
611 .wType = DNS_TYPE_TOMBSTONE,
612 };
613 }
614 }
615
616 werror = dns_replace_records(dns, mem_ctx, dn,
617 needs_add, recs, rcount);
618 W_ERROR_NOT_OK_RETURN(werror);
619
620 return WERR_OK;
621 } else if (update->rr_class == DNS_QCLASS_NONE) {
622 struct dnsp_DnssrvRpcRecord *del_rec;
623
624 if (update->rr_type == DNS_QTYPE_SOA) {
625 return WERR_OK;
626 }
627 if (update->rr_type == DNS_QTYPE_NS) {
628 bool found = false;
629 struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
630 struct dnsp_DnssrvRpcRecord);
631 W_ERROR_HAVE_NO_MEMORY(ns_rec);
632
633 werror = dns_rr_to_dnsp(
634 ns_rec, update, ns_rec, name_is_static);
635 W_ERROR_NOT_OK_RETURN(werror);
636
637 for (i = first; i < rcount; i++) {
638 if (dns_records_match(ns_rec, &recs[i])) {
639 found = true;
640 break;
641 }
642 }
643 if (found) {
644 return WERR_OK;
645 }
646 }
647
648 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
649 W_ERROR_HAVE_NO_MEMORY(del_rec);
650
651 werror =
652 dns_rr_to_dnsp(del_rec, update, del_rec, name_is_static);
653 W_ERROR_NOT_OK_RETURN(werror);
654
655 for (i = first; i < rcount; i++) {
656 if (dns_records_match(del_rec, &recs[i])) {
657 recs[i] = (struct dnsp_DnssrvRpcRecord) {
658 .wType = DNS_TYPE_TOMBSTONE,
659 };
660 }
661 }
662
663 werror = dns_replace_records(dns, mem_ctx, dn,
664 needs_add, recs, rcount);
665 W_ERROR_NOT_OK_RETURN(werror);
666 }
667
668 return WERR_OK;
669 }
670
671 static WERROR handle_updates(struct dns_server *dns,
672 TALLOC_CTX *mem_ctx,
673 const struct dns_name_question *zone,
674 const struct dns_res_rec *prereqs, uint16_t pcount,
675 struct dns_res_rec *updates, uint16_t upd_count,
676 struct dns_server_tkey *tkey)
677 {
678 struct ldb_dn *zone_dn = NULL;
679 WERROR werror = WERR_OK;
680 int ret;
681 uint16_t ri;
682 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
683
684 if (tkey != NULL) {
685 ret = ldb_set_opaque(
686 dns->samdb,
687 DSDB_SESSION_INFO,
688 tkey->session_info);
689 if (ret != LDB_SUCCESS) {
690 DEBUG(1, ("unable to set session info\n"));
691 werror = DNS_ERR(SERVER_FAILURE);
692 goto failed;
693 }
694 }
695
696 werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
697 W_ERROR_NOT_OK_GOTO(werror, failed);
698
699 ret = ldb_transaction_start(dns->samdb);
700 if (ret != LDB_SUCCESS) {
701 werror = DNS_ERR(SERVER_FAILURE);
702 goto failed;
703 }
704
705 werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
706 W_ERROR_NOT_OK_GOTO(werror, failed);
707
708 DBG_DEBUG("dns update count is %u\n", upd_count);
709
710 for (ri = 0; ri < upd_count; ri++) {
711 werror = handle_one_update(dns, tmp_ctx, zone,
712 &updates[ri], tkey);
713 W_ERROR_NOT_OK_GOTO(werror, failed);
714 }
715
716 ldb_transaction_commit(dns->samdb);
717 TALLOC_FREE(tmp_ctx);
718
719 if (tkey != NULL) {
720 ldb_set_opaque(
721 dns->samdb,
722 DSDB_SESSION_INFO,
723 system_session(dns->task->lp_ctx));
724 }
725
726 return WERR_OK;
727
728 failed:
729 ldb_transaction_cancel(dns->samdb);
730
731 if (tkey != NULL) {
732 ldb_set_opaque(
733 dns->samdb,
734 DSDB_SESSION_INFO,
735 system_session(dns->task->lp_ctx));
736 }
737
738 TALLOC_FREE(tmp_ctx);
739 return werror;
740
741 }
742
743 static WERROR dns_update_allowed(struct dns_server *dns,
744 const struct dns_request_state *state,
745 struct dns_server_tkey **tkey)
746 {
747 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
748 DEBUG(2, ("All updates allowed.\n"));
749 return WERR_OK;
750 }
751
752 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
753 DEBUG(2, ("Updates disabled.\n"));
754 return DNS_ERR(REFUSED);
755 }
756
757 if (state->authenticated == false ) {
758 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
759 return DNS_ERR(REFUSED);
760 }
761
762 *tkey = dns_find_tkey(dns->tkeys, state->key_name);
763 if (*tkey == NULL) {
764 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
765 return DNS_ERR(REFUSED);
766 }
767
768 return WERR_OK;
769 }
770
771
772 WERROR dns_server_process_update(struct dns_server *dns,
773 const struct dns_request_state *state,
774 TALLOC_CTX *mem_ctx,
775 const struct dns_name_packet *in,
776 struct dns_res_rec **prereqs, uint16_t *prereq_count,
777 struct dns_res_rec **updates, uint16_t *update_count,
778 struct dns_res_rec **additional, uint16_t *arcount)
779 {
780 struct dns_name_question *zone;
781 const struct dns_server_zone *z;
782 size_t host_part_len = 0;
783 WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
784 struct dns_server_tkey *tkey = NULL;
785
786 if (in->qdcount != 1) {
787 return DNS_ERR(FORMAT_ERROR);
788 }
789
790 zone = &in->questions[0];
791
792 if (zone->question_class != DNS_QCLASS_IN &&
793 zone->question_class != DNS_QCLASS_ANY) {
794 return DNS_ERR(NOT_IMPLEMENTED);
795 }
796
797 if (zone->question_type != DNS_QTYPE_SOA) {
798 return DNS_ERR(FORMAT_ERROR);
799 }
800
801 DEBUG(2, ("Got a dns update request.\n"));
802
803 for (z = dns->zones; z != NULL; z = z->next) {
804 bool match;
805
806 match = dns_name_match(z->name, zone->name, &host_part_len);
807 if (match) {
808 break;
809 }
810 }
811
812 if (z == NULL) {
813 DEBUG(1, ("We're not authoritative for this zone\n"));
814 return DNS_ERR(NOTAUTH);
815 }
816
817 if (host_part_len != 0) {
818 /* TODO: We need to delegate this one */
819 DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
820 return DNS_ERR(NOT_IMPLEMENTED);
821 }
822
823 *prereq_count = in->ancount;
824 *prereqs = in->answers;
825 werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
826 *prereq_count);
827 W_ERROR_NOT_OK_RETURN(werror);
828
829 werror = dns_update_allowed(dns, state, &tkey);
830 if (!W_ERROR_IS_OK(werror)) {
831 return werror;
832 }
833
834 *update_count = in->nscount;
835 *updates = in->nsrecs;
836 werror = update_prescan(in->questions, *updates, *update_count);
837 W_ERROR_NOT_OK_RETURN(werror);
838
839 werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
840 *prereq_count, *updates, *update_count, tkey);
841 W_ERROR_NOT_OK_RETURN(werror);
842
843 return werror;
844 }
Samba GIT mirror