2 Unix SMB/CIFS implementation.
4 bind9 dlz driver for Samba
6 Copyright (C) 2010 Andrew Tridgell
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "param/param.h"
25 #include "lib/events/events.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "dsdb/common/util.h"
28 #include "auth/auth.h"
29 #include "auth/session.h"
30 #include "auth/gensec/gensec.h"
31 #include "librpc/gen_ndr/security.h"
32 #include "auth/credentials/credentials.h"
33 #include "system/kerberos.h"
34 #include "auth/kerberos/kerberos.h"
35 #include "gen_ndr/ndr_dnsp.h"
36 #include "gen_ndr/server_id.h"
37 #include "messaging/messaging.h"
39 #include "lib/util/dlinklist.h"
40 #include "dlz_minimal.h"
41 #include "dnsserver_common.h"
50 struct b9_zone
*prev
, *next
;
53 struct dlz_bind9_data
{
54 struct b9_options options
;
55 struct ldb_context
*samdb
;
56 struct tevent_context
*ev_ctx
;
57 struct loadparm_context
*lp
;
58 int *transaction_token
;
60 struct b9_zone
*zonelist
;
62 /* Used for dynamic update */
63 struct smb_krb5_context
*smb_krb5_ctx
;
64 struct auth4_context
*auth_context
;
65 struct auth_session_info
*session_info
;
68 /* helper functions from the dlz_dlopen driver */
70 dns_sdlz_putrr_t
*putrr
;
71 dns_sdlz_putnamedrr_t
*putnamedrr
;
72 dns_dlz_writeablezone_t
*writeable_zone
;
75 static struct dlz_bind9_data
*dlz_bind9_state
= NULL
;
76 static int dlz_bind9_state_ref_count
= 0;
78 static const char *zone_prefixes
[] = {
79 "CN=MicrosoftDNS,DC=DomainDnsZones",
80 "CN=MicrosoftDNS,DC=ForestDnsZones",
81 "CN=MicrosoftDNS,CN=System",
86 return the version of the API
88 _PUBLIC_
int dlz_version(unsigned int *flags
)
90 return DLZ_DLOPEN_VERSION
;
94 remember a helper function from the bind9 dlz_dlopen driver
96 static void b9_add_helper(struct dlz_bind9_data
*state
, const char *helper_name
, void *ptr
)
98 if (strcmp(helper_name
, "log") == 0) {
101 if (strcmp(helper_name
, "putrr") == 0) {
104 if (strcmp(helper_name
, "putnamedrr") == 0) {
105 state
->putnamedrr
= ptr
;
107 if (strcmp(helper_name
, "writeable_zone") == 0) {
108 state
->writeable_zone
= ptr
;
113 * Add a trailing '.' if it's missing
115 static const char *b9_format_fqdn(TALLOC_CTX
*mem_ctx
, const char *str
)
120 if (str
== NULL
|| str
[0] == '\0') {
125 if (str
[len
-1] != '.') {
126 tmp
= talloc_asprintf(mem_ctx
, "%s.", str
);
134 format a record for bind9
136 static bool b9_format(struct dlz_bind9_data
*state
,
138 struct dnsp_DnssrvRpcRecord
*rec
,
139 const char **type
, const char **data
)
145 switch (rec
->wType
) {
148 *data
= rec
->data
.ipv4
;
153 *data
= rec
->data
.ipv6
;
158 *data
= b9_format_fqdn(mem_ctx
, rec
->data
.cname
);
163 tmp
= talloc_asprintf(mem_ctx
, "\"%s\"", rec
->data
.txt
.str
[0]);
164 for (i
=1; i
<rec
->data
.txt
.count
; i
++) {
165 tmp
= talloc_asprintf_append(tmp
, " \"%s\"", rec
->data
.txt
.str
[i
]);
172 *data
= b9_format_fqdn(mem_ctx
, rec
->data
.ptr
);
177 fqdn
= b9_format_fqdn(mem_ctx
, rec
->data
.srv
.nameTarget
);
181 *data
= talloc_asprintf(mem_ctx
, "%u %u %u %s",
182 rec
->data
.srv
.wPriority
,
183 rec
->data
.srv
.wWeight
,
190 fqdn
= b9_format_fqdn(mem_ctx
, rec
->data
.mx
.nameTarget
);
194 *data
= talloc_asprintf(mem_ctx
, "%u %s",
195 rec
->data
.mx
.wPriority
, fqdn
);
200 *data
= talloc_asprintf(mem_ctx
, "%s %s",
207 *data
= b9_format_fqdn(mem_ctx
, rec
->data
.ns
);
214 /* we need to fake the authoritative nameserver to
215 * point at ourselves. This is how AD DNS servers
216 * force clients to send updates to the right local DC
218 mname
= talloc_asprintf(mem_ctx
, "%s.%s.",
219 lpcfg_netbios_name(state
->lp
),
220 lpcfg_dnsdomain(state
->lp
));
224 mname
= strlower_talloc(mem_ctx
, mname
);
229 fqdn
= b9_format_fqdn(mem_ctx
, rec
->data
.soa
.rname
);
234 state
->soa_serial
= rec
->data
.soa
.serial
;
236 *data
= talloc_asprintf(mem_ctx
, "%s %s %u %u %u %u %u",
238 rec
->data
.soa
.serial
,
239 rec
->data
.soa
.refresh
,
241 rec
->data
.soa
.expire
,
242 rec
->data
.soa
.minimum
);
247 state
->log(ISC_LOG_ERROR
, "samba_dlz b9_format: unhandled record type %u",
255 static const struct {
256 enum dns_record_type dns_type
;
260 { DNS_TYPE_A
, "A" , false},
261 { DNS_TYPE_AAAA
, "AAAA" , false},
262 { DNS_TYPE_CNAME
, "CNAME" , true},
263 { DNS_TYPE_TXT
, "TXT" , false},
264 { DNS_TYPE_PTR
, "PTR" , false},
265 { DNS_TYPE_SRV
, "SRV" , false},
266 { DNS_TYPE_MX
, "MX" , false},
267 { DNS_TYPE_HINFO
, "HINFO" , false},
268 { DNS_TYPE_NS
, "NS" , false},
269 { DNS_TYPE_SOA
, "SOA" , true},
274 see if a DNS type is single valued
276 static bool b9_single_valued(enum dns_record_type dns_type
)
279 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
280 if (dns_typemap
[i
].dns_type
== dns_type
) {
281 return dns_typemap
[i
].single_valued
;
288 see if a DNS type is single valued
290 static bool b9_dns_type(const char *type
, enum dns_record_type
*dtype
)
293 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
294 if (strcasecmp(dns_typemap
[i
].typestr
, type
) == 0) {
295 *dtype
= dns_typemap
[i
].dns_type
;
303 #define DNS_PARSE_STR(ret, str, sep, saveptr) do { \
304 (ret) = strtok_r(str, sep, &saveptr); \
305 if ((ret) == NULL) return false; \
308 #define DNS_PARSE_UINT(ret, str, sep, saveptr) do { \
309 char *istr = strtok_r(str, sep, &saveptr); \
310 if ((istr) == NULL) return false; \
311 (ret) = strtoul(istr, NULL, 10); \
315 parse a record from bind9
317 static bool b9_parse(struct dlz_bind9_data
*state
,
318 const char *rdatastr
,
319 struct dnsp_DnssrvRpcRecord
*rec
)
321 char *full_name
, *dclass
, *type
;
322 char *str
, *tmp
, *saveptr
=NULL
;
325 str
= talloc_strdup(rec
, rdatastr
);
330 /* parse the SDLZ string form */
331 DNS_PARSE_STR(full_name
, str
, "\t", saveptr
);
332 DNS_PARSE_UINT(rec
->dwTtlSeconds
, NULL
, "\t", saveptr
);
333 DNS_PARSE_STR(dclass
, NULL
, "\t", saveptr
);
334 DNS_PARSE_STR(type
, NULL
, "\t", saveptr
);
336 /* construct the record */
337 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
338 if (strcasecmp(type
, dns_typemap
[i
].typestr
) == 0) {
339 rec
->wType
= dns_typemap
[i
].dns_type
;
343 if (i
== ARRAY_SIZE(dns_typemap
)) {
344 state
->log(ISC_LOG_ERROR
, "samba_dlz: unsupported record type '%s' for '%s'",
349 switch (rec
->wType
) {
351 DNS_PARSE_STR(rec
->data
.ipv4
, NULL
, " ", saveptr
);
355 DNS_PARSE_STR(rec
->data
.ipv6
, NULL
, " ", saveptr
);
359 DNS_PARSE_STR(rec
->data
.cname
, NULL
, " ", saveptr
);
363 rec
->data
.txt
.count
= 0;
364 rec
->data
.txt
.str
= talloc_array(rec
, const char *, rec
->data
.txt
.count
);
365 tmp
= strtok_r(NULL
, "\t", &saveptr
);
367 rec
->data
.txt
.str
= talloc_realloc(rec
, rec
->data
.txt
.str
, const char *,
368 rec
->data
.txt
.count
+1);
371 rec
->data
.txt
.str
[rec
->data
.txt
.count
] = talloc_strndup(rec
, &tmp
[1], strlen(tmp
)-2);
373 rec
->data
.txt
.str
[rec
->data
.txt
.count
] = talloc_strdup(rec
, tmp
);
375 rec
->data
.txt
.count
++;
376 tmp
= strtok_r(NULL
, " ", &saveptr
);
381 DNS_PARSE_STR(rec
->data
.ptr
, NULL
, " ", saveptr
);
385 DNS_PARSE_UINT(rec
->data
.srv
.wPriority
, NULL
, " ", saveptr
);
386 DNS_PARSE_UINT(rec
->data
.srv
.wWeight
, NULL
, " ", saveptr
);
387 DNS_PARSE_UINT(rec
->data
.srv
.wPort
, NULL
, " ", saveptr
);
388 DNS_PARSE_STR(rec
->data
.srv
.nameTarget
, NULL
, " ", saveptr
);
392 DNS_PARSE_UINT(rec
->data
.mx
.wPriority
, NULL
, " ", saveptr
);
393 DNS_PARSE_STR(rec
->data
.mx
.nameTarget
, NULL
, " ", saveptr
);
397 DNS_PARSE_STR(rec
->data
.hinfo
.cpu
, NULL
, " ", saveptr
);
398 DNS_PARSE_STR(rec
->data
.hinfo
.os
, NULL
, " ", saveptr
);
402 DNS_PARSE_STR(rec
->data
.ns
, NULL
, " ", saveptr
);
406 DNS_PARSE_STR(rec
->data
.soa
.mname
, NULL
, " ", saveptr
);
407 DNS_PARSE_STR(rec
->data
.soa
.rname
, NULL
, " ", saveptr
);
408 DNS_PARSE_UINT(rec
->data
.soa
.serial
, NULL
, " ", saveptr
);
409 DNS_PARSE_UINT(rec
->data
.soa
.refresh
, NULL
, " ", saveptr
);
410 DNS_PARSE_UINT(rec
->data
.soa
.retry
, NULL
, " ", saveptr
);
411 DNS_PARSE_UINT(rec
->data
.soa
.expire
, NULL
, " ", saveptr
);
412 DNS_PARSE_UINT(rec
->data
.soa
.minimum
, NULL
, " ", saveptr
);
416 state
->log(ISC_LOG_ERROR
, "samba_dlz b9_parse: unhandled record type %u",
421 /* we should be at the end of the buffer now */
422 if (strtok_r(NULL
, "\t ", &saveptr
) != NULL
) {
423 state
->log(ISC_LOG_ERROR
, "samba_dlz b9_parse: unexpected data at end of string for '%s'",
432 send a resource record to bind9
434 static isc_result_t
b9_putrr(struct dlz_bind9_data
*state
,
435 void *handle
, struct dnsp_DnssrvRpcRecord
*rec
,
439 const char *type
, *data
;
440 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
442 if (!b9_format(state
, tmp_ctx
, rec
, &type
, &data
)) {
443 return ISC_R_FAILURE
;
447 talloc_free(tmp_ctx
);
448 return ISC_R_NOMEMORY
;
453 for (i
=0; types
[i
]; i
++) {
454 if (strcmp(types
[i
], type
) == 0) break;
456 if (types
[i
] == NULL
) {
458 return ISC_R_SUCCESS
;
462 result
= state
->putrr(handle
, type
, rec
->dwTtlSeconds
, data
);
463 if (result
!= ISC_R_SUCCESS
) {
464 state
->log(ISC_LOG_ERROR
, "Failed to put rr");
466 talloc_free(tmp_ctx
);
472 send a named resource record to bind9
474 static isc_result_t
b9_putnamedrr(struct dlz_bind9_data
*state
,
475 void *handle
, const char *name
,
476 struct dnsp_DnssrvRpcRecord
*rec
)
479 const char *type
, *data
;
480 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
482 if (!b9_format(state
, tmp_ctx
, rec
, &type
, &data
)) {
483 return ISC_R_FAILURE
;
487 talloc_free(tmp_ctx
);
488 return ISC_R_NOMEMORY
;
491 result
= state
->putnamedrr(handle
, name
, type
, rec
->dwTtlSeconds
, data
);
492 if (result
!= ISC_R_SUCCESS
) {
493 state
->log(ISC_LOG_ERROR
, "Failed to put named rr '%s'", name
);
495 talloc_free(tmp_ctx
);
502 static isc_result_t
parse_options(struct dlz_bind9_data
*state
,
503 unsigned int argc
, const char **argv
,
504 struct b9_options
*options
)
508 struct poptOption long_options
[] = {
509 { "url", 'H', POPT_ARG_STRING
, &options
->url
, 0, "database URL", "URL" },
510 { "debug", 'd', POPT_ARG_STRING
, &options
->debug
, 0, "debug level", "DEBUG" },
514 pc
= poptGetContext("dlz_bind9", argc
, argv
, long_options
,
515 POPT_CONTEXT_KEEP_FIRST
);
516 while ((opt
= poptGetNextOpt(pc
)) != -1) {
519 state
->log(ISC_LOG_ERROR
, "dlz_bind9: Invalid option %s: %s",
520 poptBadOption(pc
, 0), poptStrerror(opt
));
521 return ISC_R_FAILURE
;
525 return ISC_R_SUCCESS
;
530 * Create session info from PAC
531 * This is called as auth_context->generate_session_info_pac()
533 static NTSTATUS
b9_generate_session_info_pac(struct auth4_context
*auth_context
,
535 struct smb_krb5_context
*smb_krb5_context
,
537 const char *principal_name
,
538 const struct tsocket_address
*remote_addr
,
539 uint32_t session_info_flags
,
540 struct auth_session_info
**session_info
)
543 struct auth_user_info_dc
*user_info_dc
;
546 tmp_ctx
= talloc_new(mem_ctx
);
547 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
549 status
= kerberos_pac_blob_to_user_info_dc(tmp_ctx
,
551 smb_krb5_context
->krb5_context
,
555 if (!NT_STATUS_IS_OK(status
)) {
556 talloc_free(tmp_ctx
);
560 if (user_info_dc
->info
->authenticated
) {
561 session_info_flags
|= AUTH_SESSION_INFO_AUTHENTICATED
;
564 session_info_flags
|= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES
;
566 status
= auth_generate_session_info(mem_ctx
, NULL
, NULL
, user_info_dc
,
567 session_info_flags
, session_info
);
568 if (!NT_STATUS_IS_OK(status
)) {
569 talloc_free(tmp_ctx
);
573 talloc_free(tmp_ctx
);
577 /* Callback for the DEBUG() system, to catch the remaining messages */
578 static void b9_debug(void *private_ptr
, int msg_level
, const char *msg
)
580 static const int isc_log_map
[] = {
581 ISC_LOG_CRITICAL
, /* 0 */
582 ISC_LOG_ERROR
, /* 1 */
583 ISC_LOG_WARNING
, /* 2 */
584 ISC_LOG_NOTICE
/* 3 */
586 struct dlz_bind9_data
*state
= private_ptr
;
589 if (msg_level
>= ARRAY_SIZE(isc_log_map
) || msg_level
< 0) {
590 isc_log_level
= ISC_LOG_INFO
;
592 isc_log_level
= isc_log_map
[msg_level
];
594 state
->log(isc_log_level
, "samba_dlz: %s", msg
);
597 static int dlz_state_debug_unregister(struct dlz_bind9_data
*state
)
599 /* Stop logging (to the bind9 logs) */
600 debug_set_callback(NULL
, NULL
);
605 called to initialise the driver
607 _PUBLIC_ isc_result_t
dlz_create(const char *dlzname
,
608 unsigned int argc
, const char **argv
,
611 struct dlz_bind9_data
*state
;
612 const char *helper_name
;
618 char *errstring
= NULL
;
620 if (dlz_bind9_state
!= NULL
) {
621 dlz_bind9_state
->log(ISC_LOG_ERROR
,
622 "samba_dlz: dlz_create ignored, #refs=%d",
623 dlz_bind9_state_ref_count
);
624 *dbdata
= dlz_bind9_state
;
625 dlz_bind9_state_ref_count
++;
626 return ISC_R_SUCCESS
;
629 state
= talloc_zero(NULL
, struct dlz_bind9_data
);
631 return ISC_R_NOMEMORY
;
634 talloc_set_destructor(state
, dlz_state_debug_unregister
);
636 /* fill in the helper functions */
637 va_start(ap
, dbdata
);
638 while ((helper_name
= va_arg(ap
, const char *)) != NULL
) {
639 b9_add_helper(state
, helper_name
, va_arg(ap
, void*));
643 /* Do not install samba signal handlers */
644 fault_setup_disable();
646 /* Start logging (to the bind9 logs) */
647 debug_set_callback(state
, b9_debug
);
649 state
->ev_ctx
= s4_event_context_init(state
);
650 if (state
->ev_ctx
== NULL
) {
651 result
= ISC_R_NOMEMORY
;
655 result
= parse_options(state
, argc
, argv
, &state
->options
);
656 if (result
!= ISC_R_SUCCESS
) {
660 state
->lp
= loadparm_init_global(true);
661 if (state
->lp
== NULL
) {
662 result
= ISC_R_NOMEMORY
;
666 if (state
->options
.debug
) {
667 lpcfg_do_global_parameter(state
->lp
, "log level", state
->options
.debug
);
669 lpcfg_do_global_parameter(state
->lp
, "log level", "0");
672 if (smb_krb5_init_context(state
, state
->lp
, &state
->smb_krb5_ctx
) != 0) {
673 result
= ISC_R_NOMEMORY
;
677 nt_status
= gensec_init();
678 if (!NT_STATUS_IS_OK(nt_status
)) {
679 result
= ISC_R_NOMEMORY
;
683 state
->auth_context
= talloc_zero(state
, struct auth4_context
);
684 if (state
->auth_context
== NULL
) {
685 result
= ISC_R_NOMEMORY
;
689 if (state
->options
.url
== NULL
) {
690 state
->options
.url
= talloc_asprintf(state
,
692 lpcfg_binddns_dir(state
->lp
));
693 if (state
->options
.url
== NULL
) {
694 result
= ISC_R_NOMEMORY
;
698 if (!file_exist(state
->options
.url
)) {
699 state
->options
.url
= talloc_asprintf(state
,
701 lpcfg_private_dir(state
->lp
));
702 if (state
->options
.url
== NULL
) {
703 result
= ISC_R_NOMEMORY
;
709 ret
= samdb_connect_url(state
,
712 system_session(state
->lp
),
718 if (ret
!= LDB_SUCCESS
) {
719 state
->log(ISC_LOG_ERROR
,
720 "samba_dlz: Failed to connect to %s: %s",
721 errstring
, ldb_strerror(ret
));
722 result
= ISC_R_FAILURE
;
726 dn
= ldb_get_default_basedn(state
->samdb
);
728 state
->log(ISC_LOG_ERROR
, "samba_dlz: Unable to get basedn for %s - %s",
729 state
->options
.url
, ldb_errstring(state
->samdb
));
730 result
= ISC_R_FAILURE
;
734 state
->log(ISC_LOG_INFO
, "samba_dlz: started for DN %s",
735 ldb_dn_get_linearized(dn
));
737 state
->auth_context
->event_ctx
= state
->ev_ctx
;
738 state
->auth_context
->lp_ctx
= state
->lp
;
739 state
->auth_context
->sam_ctx
= state
->samdb
;
740 state
->auth_context
->generate_session_info_pac
= b9_generate_session_info_pac
;
743 dlz_bind9_state
= state
;
744 dlz_bind9_state_ref_count
++;
746 return ISC_R_SUCCESS
;
749 state
->log(ISC_LOG_INFO
,
750 "samba_dlz: FAILED dlz_create call result=%d #refs=%d",
752 dlz_bind9_state_ref_count
);
760 _PUBLIC_
void dlz_destroy(void *dbdata
)
762 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
764 dlz_bind9_state_ref_count
--;
765 if (dlz_bind9_state_ref_count
== 0) {
766 state
->log(ISC_LOG_INFO
, "samba_dlz: shutting down");
767 talloc_unlink(state
, state
->samdb
);
769 dlz_bind9_state
= NULL
;
771 state
->log(ISC_LOG_INFO
,
772 "samba_dlz: dlz_destroy called. %d refs remaining.",
773 dlz_bind9_state_ref_count
);
779 return the base DN for a zone
781 static isc_result_t
b9_find_zone_dn(struct dlz_bind9_data
*state
, const char *zone_name
,
782 TALLOC_CTX
*mem_ctx
, struct ldb_dn
**zone_dn
)
785 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
786 const char *attrs
[] = { NULL
};
789 for (i
=0; zone_prefixes
[i
]; i
++) {
790 const char *casefold
;
792 struct ldb_result
*res
;
793 struct ldb_val zone_name_val
794 = data_blob_string_const(zone_name
);
796 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
798 talloc_free(tmp_ctx
);
799 return ISC_R_NOMEMORY
;
803 * This dance ensures that it is not possible to put
804 * (eg) an extra DC=x, into the DNS name being
808 if (!ldb_dn_add_child_fmt(dn
,
811 talloc_free(tmp_ctx
);
812 return ISC_R_NOMEMORY
;
815 ret
= ldb_dn_set_component(dn
,
819 if (ret
!= LDB_SUCCESS
) {
820 talloc_free(tmp_ctx
);
821 return ISC_R_NOMEMORY
;
825 * Check if this is a plausibly valid DN early
826 * (time spent here will be saved during the
827 * search due to an internal cache)
829 casefold
= ldb_dn_get_casefold(dn
);
831 if (casefold
== NULL
) {
832 talloc_free(tmp_ctx
);
833 return ISC_R_NOTFOUND
;
836 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsZone");
837 if (ret
== LDB_SUCCESS
) {
838 if (zone_dn
!= NULL
) {
839 *zone_dn
= talloc_steal(mem_ctx
, dn
);
841 talloc_free(tmp_ctx
);
842 return ISC_R_SUCCESS
;
847 talloc_free(tmp_ctx
);
848 return ISC_R_NOTFOUND
;
853 return the DN for a name. The record does not need to exist, but the
856 static isc_result_t
b9_find_name_dn(struct dlz_bind9_data
*state
, const char *name
,
857 TALLOC_CTX
*mem_ctx
, struct ldb_dn
**dn
)
861 /* work through the name piece by piece, until we find a zone */
864 result
= b9_find_zone_dn(state
, p
, mem_ctx
, dn
);
865 if (result
== ISC_R_SUCCESS
) {
866 const char *casefold
;
868 /* we found a zone, now extend the DN to get
873 ret
= ldb_dn_add_child_fmt(*dn
, "DC=@");
876 return ISC_R_NOMEMORY
;
879 struct ldb_val name_val
880 = data_blob_const(name
,
883 if (!ldb_dn_add_child_val(*dn
,
887 return ISC_R_NOMEMORY
;
892 * Check if this is a plausibly valid DN early
893 * (time spent here will be saved during the
894 * search due to an internal cache)
896 casefold
= ldb_dn_get_casefold(*dn
);
898 if (casefold
== NULL
) {
899 return ISC_R_NOTFOUND
;
902 return ISC_R_SUCCESS
;
910 return ISC_R_NOTFOUND
;
915 see if we handle a given zone
917 #if DLZ_DLOPEN_VERSION < 3
918 _PUBLIC_ isc_result_t
dlz_findzonedb(void *dbdata
, const char *name
)
920 _PUBLIC_ isc_result_t
dlz_findzonedb(void *dbdata
, const char *name
,
921 dns_clientinfomethods_t
*methods
,
922 dns_clientinfo_t
*clientinfo
)
925 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
926 return b9_find_zone_dn(state
, name
, NULL
, NULL
);
933 static isc_result_t
dlz_lookup_types(struct dlz_bind9_data
*state
,
934 const char *zone
, const char *name
,
935 dns_sdlzlookup_t
*lookup
,
938 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
940 WERROR werr
= WERR_DNS_ERROR_NAME_DOES_NOT_EXIST
;
941 struct dnsp_DnssrvRpcRecord
*records
= NULL
;
942 uint16_t num_records
= 0, i
;
943 struct ldb_val zone_name_val
944 = data_blob_string_const(zone
);
945 struct ldb_val name_val
946 = data_blob_string_const(name
);
948 for (i
=0; zone_prefixes
[i
]; i
++) {
950 const char *casefold
;
951 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
953 talloc_free(tmp_ctx
);
954 return ISC_R_NOMEMORY
;
958 * This dance ensures that it is not possible to put
959 * (eg) an extra DC=x, into the DNS name being
963 if (!ldb_dn_add_child_fmt(dn
,
966 talloc_free(tmp_ctx
);
967 return ISC_R_NOMEMORY
;
970 ret
= ldb_dn_set_component(dn
,
974 if (ret
!= LDB_SUCCESS
) {
975 talloc_free(tmp_ctx
);
976 return ISC_R_NOMEMORY
;
979 ret
= ldb_dn_set_component(dn
,
983 if (ret
!= LDB_SUCCESS
) {
984 talloc_free(tmp_ctx
);
985 return ISC_R_NOMEMORY
;
989 * Check if this is a plausibly valid DN early
990 * (time spent here will be saved during the
991 * search due to an internal cache)
993 casefold
= ldb_dn_get_casefold(dn
);
995 if (casefold
== NULL
) {
996 talloc_free(tmp_ctx
);
997 return ISC_R_NOTFOUND
;
1000 werr
= dns_common_wildcard_lookup(state
->samdb
, tmp_ctx
, dn
,
1001 &records
, &num_records
);
1002 if (W_ERROR_IS_OK(werr
)) {
1006 if (!W_ERROR_IS_OK(werr
)) {
1007 talloc_free(tmp_ctx
);
1008 return ISC_R_NOTFOUND
;
1011 for (i
=0; i
< num_records
; i
++) {
1012 isc_result_t result
;
1014 result
= b9_putrr(state
, lookup
, &records
[i
], types
);
1015 if (result
!= ISC_R_SUCCESS
) {
1016 talloc_free(tmp_ctx
);
1021 talloc_free(tmp_ctx
);
1022 return ISC_R_SUCCESS
;
1028 #if DLZ_DLOPEN_VERSION == 1
1029 _PUBLIC_ isc_result_t
dlz_lookup(const char *zone
, const char *name
,
1030 void *dbdata
, dns_sdlzlookup_t
*lookup
)
1032 _PUBLIC_ isc_result_t
dlz_lookup(const char *zone
, const char *name
,
1033 void *dbdata
, dns_sdlzlookup_t
*lookup
,
1034 dns_clientinfomethods_t
*methods
,
1035 dns_clientinfo_t
*clientinfo
)
1038 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1039 return dlz_lookup_types(state
, zone
, name
, lookup
, NULL
);
1044 see if a zone transfer is allowed
1046 _PUBLIC_ isc_result_t
dlz_allowzonexfr(void *dbdata
, const char *name
, const char *client
)
1048 /* just say yes for all our zones for now */
1049 struct dlz_bind9_data
*state
= talloc_get_type(
1050 dbdata
, struct dlz_bind9_data
);
1051 return b9_find_zone_dn(state
, name
, NULL
, NULL
);
1055 perform a zone transfer
1057 _PUBLIC_ isc_result_t
dlz_allnodes(const char *zone
, void *dbdata
,
1058 dns_sdlzallnodes_t
*allnodes
)
1060 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1061 const char *attrs
[] = { "dnsRecord", NULL
};
1062 int ret
= LDB_ERR_NO_SUCH_OBJECT
;
1064 struct ldb_dn
*dn
= NULL
;
1065 struct ldb_result
*res
;
1066 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
1067 struct ldb_val zone_name_val
= data_blob_string_const(zone
);
1069 for (i
=0; zone_prefixes
[i
]; i
++) {
1070 const char *casefold
;
1072 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
1074 talloc_free(tmp_ctx
);
1075 return ISC_R_NOMEMORY
;
1079 * This dance ensures that it is not possible to put
1080 * (eg) an extra DC=x, into the DNS name being
1084 if (!ldb_dn_add_child_fmt(dn
,
1086 zone_prefixes
[i
])) {
1087 talloc_free(tmp_ctx
);
1088 return ISC_R_NOMEMORY
;
1091 ret
= ldb_dn_set_component(dn
,
1095 if (ret
!= LDB_SUCCESS
) {
1096 talloc_free(tmp_ctx
);
1097 return ISC_R_NOMEMORY
;
1101 * Check if this is a plausibly valid DN early
1102 * (time spent here will be saved during the
1103 * search due to an internal cache)
1105 casefold
= ldb_dn_get_casefold(dn
);
1107 if (casefold
== NULL
) {
1108 return ISC_R_NOTFOUND
;
1111 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_SUBTREE
,
1112 attrs
, "objectClass=dnsNode");
1113 if (ret
== LDB_SUCCESS
) {
1117 if (ret
!= LDB_SUCCESS
|| dn
== NULL
) {
1118 talloc_free(tmp_ctx
);
1119 return ISC_R_NOTFOUND
;
1122 for (i
=0; i
<res
->count
; i
++) {
1123 struct ldb_message_element
*el
;
1124 TALLOC_CTX
*el_ctx
= talloc_new(tmp_ctx
);
1125 const char *rdn
, *name
;
1126 const struct ldb_val
*v
;
1128 struct dnsp_DnssrvRpcRecord
*recs
= NULL
;
1129 uint16_t num_recs
= 0;
1131 el
= ldb_msg_find_element(res
->msgs
[i
], "dnsRecord");
1132 if (el
== NULL
|| el
->num_values
== 0) {
1133 state
->log(ISC_LOG_INFO
, "failed to find dnsRecord for %s",
1134 ldb_dn_get_linearized(dn
));
1135 talloc_free(el_ctx
);
1139 v
= ldb_dn_get_rdn_val(res
->msgs
[i
]->dn
);
1141 state
->log(ISC_LOG_INFO
, "failed to find RDN for %s",
1142 ldb_dn_get_linearized(dn
));
1143 talloc_free(el_ctx
);
1147 rdn
= talloc_strndup(el_ctx
, (char *)v
->data
, v
->length
);
1149 talloc_free(tmp_ctx
);
1150 return ISC_R_NOMEMORY
;
1153 if (strcmp(rdn
, "@") == 0) {
1156 name
= talloc_asprintf(el_ctx
, "%s.%s", rdn
, zone
);
1158 name
= b9_format_fqdn(el_ctx
, name
);
1160 talloc_free(tmp_ctx
);
1161 return ISC_R_NOMEMORY
;
1164 werr
= dns_common_extract(state
->samdb
, el
, el_ctx
, &recs
, &num_recs
);
1165 if (!W_ERROR_IS_OK(werr
)) {
1166 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s, %s",
1167 ldb_dn_get_linearized(dn
), win_errstr(werr
));
1168 talloc_free(el_ctx
);
1172 for (j
=0; j
< num_recs
; j
++) {
1173 isc_result_t result
;
1175 result
= b9_putnamedrr(state
, allnodes
, name
, &recs
[j
]);
1176 if (result
!= ISC_R_SUCCESS
) {
1181 talloc_free(el_ctx
);
1184 talloc_free(tmp_ctx
);
1186 return ISC_R_SUCCESS
;
1193 _PUBLIC_ isc_result_t
dlz_newversion(const char *zone
, void *dbdata
, void **versionp
)
1195 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1197 state
->log(ISC_LOG_INFO
, "samba_dlz: starting transaction on zone %s", zone
);
1199 if (state
->transaction_token
!= NULL
) {
1200 state
->log(ISC_LOG_INFO
, "samba_dlz: transaction already started for zone %s", zone
);
1201 return ISC_R_FAILURE
;
1204 state
->transaction_token
= talloc_zero(state
, int);
1205 if (state
->transaction_token
== NULL
) {
1206 return ISC_R_NOMEMORY
;
1209 if (ldb_transaction_start(state
->samdb
) != LDB_SUCCESS
) {
1210 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to start a transaction for zone %s", zone
);
1211 talloc_free(state
->transaction_token
);
1212 state
->transaction_token
= NULL
;
1213 return ISC_R_FAILURE
;
1216 *versionp
= (void *)state
->transaction_token
;
1218 return ISC_R_SUCCESS
;
1224 _PUBLIC_
void dlz_closeversion(const char *zone
, isc_boolean_t commit
,
1225 void *dbdata
, void **versionp
)
1227 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1229 if (state
->transaction_token
!= (int *)*versionp
) {
1230 state
->log(ISC_LOG_INFO
, "samba_dlz: transaction not started for zone %s", zone
);
1235 if (ldb_transaction_commit(state
->samdb
) != LDB_SUCCESS
) {
1236 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to commit a transaction for zone %s", zone
);
1239 state
->log(ISC_LOG_INFO
, "samba_dlz: committed transaction on zone %s", zone
);
1241 if (ldb_transaction_cancel(state
->samdb
) != LDB_SUCCESS
) {
1242 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to cancel a transaction for zone %s", zone
);
1245 state
->log(ISC_LOG_INFO
, "samba_dlz: cancelling transaction on zone %s", zone
);
1248 talloc_free(state
->transaction_token
);
1249 state
->transaction_token
= NULL
;
1255 see if there is a SOA record for a zone
1257 static bool b9_has_soa(struct dlz_bind9_data
*state
, struct ldb_dn
*dn
, const char *zone
)
1259 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
1261 struct dnsp_DnssrvRpcRecord
*records
= NULL
;
1262 uint16_t num_records
= 0, i
;
1263 struct ldb_val zone_name_val
1264 = data_blob_string_const(zone
);
1267 * This dance ensures that it is not possible to put
1268 * (eg) an extra DC=x, into the DNS name being
1272 if (!ldb_dn_add_child_val(dn
,
1275 talloc_free(tmp_ctx
);
1279 werr
= dns_common_lookup(state
->samdb
, tmp_ctx
, dn
,
1280 &records
, &num_records
, NULL
);
1281 if (!W_ERROR_IS_OK(werr
)) {
1282 talloc_free(tmp_ctx
);
1286 for (i
=0; i
< num_records
; i
++) {
1287 if (records
[i
].wType
== DNS_TYPE_SOA
) {
1288 talloc_free(tmp_ctx
);
1293 talloc_free(tmp_ctx
);
1297 static bool b9_zone_add(struct dlz_bind9_data
*state
, const char *name
)
1299 struct b9_zone
*zone
;
1301 zone
= talloc_zero(state
, struct b9_zone
);
1306 zone
->name
= talloc_strdup(zone
, name
);
1307 if (zone
->name
== NULL
) {
1312 DLIST_ADD(state
->zonelist
, zone
);
1316 static bool b9_zone_exists(struct dlz_bind9_data
*state
, const char *name
)
1318 struct b9_zone
*zone
= state
->zonelist
;
1321 while (zone
!= NULL
) {
1322 if (strcasecmp(name
, zone
->name
) == 0) {
1334 configure a writeable zone
1336 #if DLZ_DLOPEN_VERSION < 3
1337 _PUBLIC_ isc_result_t
dlz_configure(dns_view_t
*view
, void *dbdata
)
1339 _PUBLIC_ isc_result_t
dlz_configure(dns_view_t
*view
, dns_dlzdb_t
*dlzdb
,
1343 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1344 TALLOC_CTX
*tmp_ctx
;
1348 state
->log(ISC_LOG_INFO
, "samba_dlz: starting configure");
1349 if (state
->writeable_zone
== NULL
) {
1350 state
->log(ISC_LOG_INFO
, "samba_dlz: no writeable_zone method available");
1351 return ISC_R_FAILURE
;
1354 tmp_ctx
= talloc_new(state
);
1356 for (i
=0; zone_prefixes
[i
]; i
++) {
1357 const char *attrs
[] = { "name", NULL
};
1359 struct ldb_result
*res
;
1361 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
1363 talloc_free(tmp_ctx
);
1364 return ISC_R_NOMEMORY
;
1367 if (!ldb_dn_add_child_fmt(dn
, "%s", zone_prefixes
[i
])) {
1368 talloc_free(tmp_ctx
);
1369 return ISC_R_NOMEMORY
;
1372 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_SUBTREE
,
1373 attrs
, "objectClass=dnsZone");
1374 if (ret
!= LDB_SUCCESS
) {
1378 for (j
=0; j
<res
->count
; j
++) {
1379 isc_result_t result
;
1380 const char *zone
= ldb_msg_find_attr_as_string(res
->msgs
[j
], "name", NULL
);
1381 struct ldb_dn
*zone_dn
;
1386 /* Ignore zones that are not handled in BIND */
1387 if ((strcmp(zone
, "RootDNSServers") == 0) ||
1388 (strcmp(zone
, "..TrustAnchors") == 0)) {
1391 zone_dn
= ldb_dn_copy(tmp_ctx
, dn
);
1392 if (zone_dn
== NULL
) {
1393 talloc_free(tmp_ctx
);
1394 return ISC_R_NOMEMORY
;
1397 if (!b9_has_soa(state
, zone_dn
, zone
)) {
1401 if (b9_zone_exists(state
, zone
)) {
1402 state
->log(ISC_LOG_WARNING
, "samba_dlz: Ignoring duplicate zone '%s' from '%s'",
1403 zone
, ldb_dn_get_linearized(zone_dn
));
1407 if (!b9_zone_add(state
, zone
)) {
1408 talloc_free(tmp_ctx
);
1409 return ISC_R_NOMEMORY
;
1412 #if DLZ_DLOPEN_VERSION < 3
1413 result
= state
->writeable_zone(view
, zone
);
1415 result
= state
->writeable_zone(view
, dlzdb
, zone
);
1417 if (result
!= ISC_R_SUCCESS
) {
1418 state
->log(ISC_LOG_ERROR
, "samba_dlz: Failed to configure zone '%s'",
1420 talloc_free(tmp_ctx
);
1423 state
->log(ISC_LOG_INFO
, "samba_dlz: configured writeable zone '%s'", zone
);
1427 talloc_free(tmp_ctx
);
1428 return ISC_R_SUCCESS
;
1432 authorize a zone update
1434 _PUBLIC_ isc_boolean_t
dlz_ssumatch(const char *signer
, const char *name
, const char *tcpaddr
,
1435 const char *type
, const char *key
, uint32_t keydatalen
, uint8_t *keydata
,
1438 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1439 TALLOC_CTX
*tmp_ctx
;
1441 struct cli_credentials
*server_credentials
;
1443 char *keytab_file
= NULL
;
1447 struct gensec_security
*gensec_ctx
;
1448 struct auth_session_info
*session_info
;
1450 isc_result_t result
;
1451 struct ldb_result
*res
;
1452 const char * attrs
[] = { NULL
};
1453 uint32_t access_mask
;
1454 struct gensec_settings
*settings
= NULL
;
1455 const struct gensec_security_ops
**backends
= NULL
;
1458 /* Remove cached credentials, if any */
1459 if (state
->session_info
) {
1460 talloc_free(state
->session_info
);
1461 state
->session_info
= NULL
;
1463 if (state
->update_name
) {
1464 talloc_free(state
->update_name
);
1465 state
->update_name
= NULL
;
1468 tmp_ctx
= talloc_new(NULL
);
1469 if (tmp_ctx
== NULL
) {
1470 state
->log(ISC_LOG_ERROR
, "samba_dlz: no memory");
1474 ap_req
= data_blob_const(keydata
, keydatalen
);
1475 server_credentials
= cli_credentials_init(tmp_ctx
);
1476 if (!server_credentials
) {
1477 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to init server credentials");
1478 talloc_free(tmp_ctx
);
1482 cli_credentials_set_krb5_context(server_credentials
, state
->smb_krb5_ctx
);
1483 cli_credentials_set_conf(server_credentials
, state
->lp
);
1485 keytab_file
= talloc_asprintf(tmp_ctx
,
1487 lpcfg_binddns_dir(state
->lp
));
1488 if (keytab_file
== NULL
) {
1489 state
->log(ISC_LOG_ERROR
, "samba_dlz: Out of memory!");
1490 talloc_free(tmp_ctx
);
1494 if (!file_exist(keytab_file
)) {
1495 keytab_file
= talloc_asprintf(tmp_ctx
,
1497 lpcfg_private_dir(state
->lp
));
1498 if (keytab_file
== NULL
) {
1499 state
->log(ISC_LOG_ERROR
, "samba_dlz: Out of memory!");
1500 talloc_free(tmp_ctx
);
1505 keytab_name
= talloc_asprintf(tmp_ctx
, "FILE:%s", keytab_file
);
1506 if (keytab_name
== NULL
) {
1507 state
->log(ISC_LOG_ERROR
, "samba_dlz: Out of memory!");
1508 talloc_free(tmp_ctx
);
1512 ret
= cli_credentials_set_keytab_name(server_credentials
, state
->lp
, keytab_name
,
1515 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to obtain server credentials from %s",
1517 talloc_free(tmp_ctx
);
1520 talloc_free(keytab_name
);
1522 settings
= lpcfg_gensec_settings(tmp_ctx
, state
->lp
);
1523 if (settings
== NULL
) {
1524 state
->log(ISC_LOG_ERROR
, "samba_dlz: lpcfg_gensec_settings failed");
1525 talloc_free(tmp_ctx
);
1528 backends
= talloc_zero_array(settings
,
1529 const struct gensec_security_ops
*, 3);
1530 if (backends
== NULL
) {
1531 state
->log(ISC_LOG_ERROR
, "samba_dlz: talloc_zero_array gensec_security_ops failed");
1532 talloc_free(tmp_ctx
);
1535 settings
->backends
= backends
;
1539 backends
[idx
++] = gensec_security_by_oid(NULL
, GENSEC_OID_KERBEROS5
);
1540 backends
[idx
++] = gensec_security_by_oid(NULL
, GENSEC_OID_SPNEGO
);
1542 nt_status
= gensec_server_start(tmp_ctx
, settings
,
1543 state
->auth_context
, &gensec_ctx
);
1544 if (!NT_STATUS_IS_OK(nt_status
)) {
1545 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to start gensec server");
1546 talloc_free(tmp_ctx
);
1550 gensec_set_credentials(gensec_ctx
, server_credentials
);
1552 nt_status
= gensec_start_mech_by_oid(gensec_ctx
, GENSEC_OID_SPNEGO
);
1553 if (!NT_STATUS_IS_OK(nt_status
)) {
1554 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to start spnego");
1555 talloc_free(tmp_ctx
);
1560 * We only allow SPNEGO/KRB5 and make sure the backend
1561 * to is RPC/IPC free.
1563 * See gensec_gssapi_update_internal() as
1566 * It allows gensec_update() not to block.
1568 * If that changes in future we need to use
1569 * gensec_update_send/recv here!
1571 nt_status
= gensec_update(gensec_ctx
, tmp_ctx
, ap_req
, &ap_req
);
1572 if (!NT_STATUS_IS_OK(nt_status
)) {
1573 state
->log(ISC_LOG_ERROR
, "samba_dlz: spnego update failed");
1574 talloc_free(tmp_ctx
);
1578 nt_status
= gensec_session_info(gensec_ctx
, tmp_ctx
, &session_info
);
1579 if (!NT_STATUS_IS_OK(nt_status
)) {
1580 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to create session info");
1581 talloc_free(tmp_ctx
);
1585 /* Get the DN from name */
1586 result
= b9_find_name_dn(state
, name
, tmp_ctx
, &dn
);
1587 if (result
!= ISC_R_SUCCESS
) {
1588 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to find name %s", name
);
1589 talloc_free(tmp_ctx
);
1593 /* make sure the dn exists, or find parent dn in case new object is being added */
1594 ldb_ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
,
1595 attrs
, "objectClass=dnsNode");
1596 if (ldb_ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1597 ldb_dn_remove_child_components(dn
, 1);
1598 access_mask
= SEC_ADS_CREATE_CHILD
;
1600 } else if (ldb_ret
== LDB_SUCCESS
) {
1601 access_mask
= SEC_STD_REQUIRED
| SEC_ADS_SELF_WRITE
;
1604 talloc_free(tmp_ctx
);
1609 ldb_ret
= dsdb_check_access_on_dn(state
->samdb
, tmp_ctx
, dn
,
1610 session_info
->security_token
,
1612 if (ldb_ret
!= LDB_SUCCESS
) {
1613 state
->log(ISC_LOG_INFO
,
1614 "samba_dlz: disallowing update of signer=%s name=%s type=%s error=%s",
1615 signer
, name
, type
, ldb_strerror(ldb_ret
));
1616 talloc_free(tmp_ctx
);
1620 /* Cache session_info, so it can be used in the actual add/delete operation */
1621 state
->update_name
= talloc_strdup(state
, name
);
1622 if (state
->update_name
== NULL
) {
1623 state
->log(ISC_LOG_ERROR
, "samba_dlz: memory allocation error");
1624 talloc_free(tmp_ctx
);
1627 state
->session_info
= talloc_steal(state
, session_info
);
1629 state
->log(ISC_LOG_INFO
, "samba_dlz: allowing update of signer=%s name=%s tcpaddr=%s type=%s key=%s",
1630 signer
, name
, tcpaddr
, type
, key
);
1632 talloc_free(tmp_ctx
);
1637 see if two dns records match
1639 static bool b9_record_match(struct dlz_bind9_data
*state
,
1640 struct dnsp_DnssrvRpcRecord
*rec1
, struct dnsp_DnssrvRpcRecord
*rec2
)
1644 struct in6_addr rec1_in_addr6
;
1645 struct in6_addr rec2_in_addr6
;
1647 if (rec1
->wType
!= rec2
->wType
) {
1650 /* see if this type is single valued */
1651 if (b9_single_valued(rec1
->wType
)) {
1655 /* see if the data matches */
1656 switch (rec1
->wType
) {
1658 return strcmp(rec1
->data
.ipv4
, rec2
->data
.ipv4
) == 0;
1659 case DNS_TYPE_AAAA
: {
1662 ret
= inet_pton(AF_INET6
, rec1
->data
.ipv6
, &rec1_in_addr6
);
1666 ret
= inet_pton(AF_INET6
, rec2
->data
.ipv6
, &rec2_in_addr6
);
1671 return memcmp(&rec1_in_addr6
, &rec2_in_addr6
, sizeof(rec1_in_addr6
)) == 0;
1673 case DNS_TYPE_CNAME
:
1674 return dns_name_equal(rec1
->data
.cname
, rec2
->data
.cname
);
1676 status
= (rec1
->data
.txt
.count
== rec2
->data
.txt
.count
);
1677 if (!status
) return status
;
1678 for (i
=0; i
<rec1
->data
.txt
.count
; i
++) {
1679 status
&= (strcmp(rec1
->data
.txt
.str
[i
], rec2
->data
.txt
.str
[i
]) == 0);
1683 return dns_name_equal(rec1
->data
.ptr
, rec2
->data
.ptr
);
1685 return dns_name_equal(rec1
->data
.ns
, rec2
->data
.ns
);
1688 return rec1
->data
.srv
.wPriority
== rec2
->data
.srv
.wPriority
&&
1689 rec1
->data
.srv
.wWeight
== rec2
->data
.srv
.wWeight
&&
1690 rec1
->data
.srv
.wPort
== rec2
->data
.srv
.wPort
&&
1691 dns_name_equal(rec1
->data
.srv
.nameTarget
, rec2
->data
.srv
.nameTarget
);
1694 return rec1
->data
.mx
.wPriority
== rec2
->data
.mx
.wPriority
&&
1695 dns_name_equal(rec1
->data
.mx
.nameTarget
, rec2
->data
.mx
.nameTarget
);
1697 case DNS_TYPE_HINFO
:
1698 return strcmp(rec1
->data
.hinfo
.cpu
, rec2
->data
.hinfo
.cpu
) == 0 &&
1699 strcmp(rec1
->data
.hinfo
.os
, rec2
->data
.hinfo
.os
) == 0;
1702 return dns_name_equal(rec1
->data
.soa
.mname
, rec2
->data
.soa
.mname
) &&
1703 dns_name_equal(rec1
->data
.soa
.rname
, rec2
->data
.soa
.rname
) &&
1704 rec1
->data
.soa
.serial
== rec2
->data
.soa
.serial
&&
1705 rec1
->data
.soa
.refresh
== rec2
->data
.soa
.refresh
&&
1706 rec1
->data
.soa
.retry
== rec2
->data
.soa
.retry
&&
1707 rec1
->data
.soa
.expire
== rec2
->data
.soa
.expire
&&
1708 rec1
->data
.soa
.minimum
== rec2
->data
.soa
.minimum
;
1710 state
->log(ISC_LOG_ERROR
, "samba_dlz b9_record_match: unhandled record type %u",
1719 * Update session_info on samdb using the cached credentials
1721 static bool b9_set_session_info(struct dlz_bind9_data
*state
, const char *name
)
1725 if (state
->update_name
== NULL
|| state
->session_info
== NULL
) {
1726 state
->log(ISC_LOG_ERROR
, "samba_dlz: invalid credentials");
1730 /* Do not use client credentials, if we're not updating the client specified name */
1731 if (strcmp(state
->update_name
, name
) != 0) {
1735 ret
= ldb_set_opaque(
1738 state
->session_info
);
1739 if (ret
!= LDB_SUCCESS
) {
1740 state
->log(ISC_LOG_ERROR
, "samba_dlz: unable to set session info");
1748 * Reset session_info on samdb as system session
1750 static void b9_reset_session_info(struct dlz_bind9_data
*state
)
1755 system_session(state
->lp
));
1759 add or modify a rdataset
1761 _PUBLIC_ isc_result_t
dlz_addrdataset(const char *name
, const char *rdatastr
, void *dbdata
, void *version
)
1763 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1764 struct dnsp_DnssrvRpcRecord
*rec
;
1766 isc_result_t result
;
1767 bool tombstoned
= false;
1768 bool needs_add
= false;
1769 struct dnsp_DnssrvRpcRecord
*recs
= NULL
;
1770 uint16_t num_recs
= 0;
1776 if (state
->transaction_token
!= (void*)version
) {
1777 state
->log(ISC_LOG_INFO
, "samba_dlz: bad transaction version");
1778 return ISC_R_FAILURE
;
1781 rec
= talloc_zero(state
, struct dnsp_DnssrvRpcRecord
);
1783 return ISC_R_NOMEMORY
;
1786 rec
->rank
= DNS_RANK_ZONE
;
1788 if (!b9_parse(state
, rdatastr
, rec
)) {
1789 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to parse rdataset '%s'", rdatastr
);
1791 return ISC_R_FAILURE
;
1794 /* find the DN of the record */
1795 result
= b9_find_name_dn(state
, name
, rec
, &dn
);
1796 if (result
!= ISC_R_SUCCESS
) {
1801 /* get any existing records */
1802 werr
= dns_common_lookup(state
->samdb
, rec
, dn
,
1803 &recs
, &num_recs
, &tombstoned
);
1804 if (W_ERROR_EQUAL(werr
, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST
)) {
1808 if (!W_ERROR_IS_OK(werr
)) {
1809 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s, %s",
1810 ldb_dn_get_linearized(dn
), win_errstr(werr
));
1812 return ISC_R_FAILURE
;
1817 * we need to keep the existing tombstone record
1823 /* there are existing records. We need to see if this will
1824 * replace a record or add to it
1826 for (i
=first
; i
< num_recs
; i
++) {
1827 if (b9_record_match(state
, rec
, &recs
[i
])) {
1831 if (i
== UINT16_MAX
) {
1832 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to already %u dnsRecord values for %s",
1833 i
, ldb_dn_get_linearized(dn
));
1835 return ISC_R_FAILURE
;
1838 if (i
== num_recs
) {
1839 /* adding a new value */
1840 recs
= talloc_realloc(rec
, recs
,
1841 struct dnsp_DnssrvRpcRecord
,
1845 return ISC_R_NOMEMORY
;
1849 if (dns_name_is_static(recs
, num_recs
)) {
1850 rec
->dwTimeStamp
= 0;
1852 unix_to_nt_time(&t
, time(NULL
));
1853 t
/= 10 * 1000 * 1000; /* convert to seconds */
1854 t
/= 3600; /* convert to hours */
1855 rec
->dwTimeStamp
= (uint32_t)t
;
1861 if (!b9_set_session_info(state
, name
)) {
1863 return ISC_R_FAILURE
;
1866 /* modify the record */
1867 werr
= dns_common_replace(state
->samdb
, rec
, dn
,
1871 b9_reset_session_info(state
);
1872 if (!W_ERROR_IS_OK(werr
)) {
1873 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to %s %s - %s",
1874 needs_add
? "add" : "modify",
1875 ldb_dn_get_linearized(dn
), win_errstr(werr
));
1877 return ISC_R_FAILURE
;
1880 state
->log(ISC_LOG_INFO
, "samba_dlz: added rdataset %s '%s'", name
, rdatastr
);
1883 return ISC_R_SUCCESS
;
1889 _PUBLIC_ isc_result_t
dlz_subrdataset(const char *name
, const char *rdatastr
, void *dbdata
, void *version
)
1891 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1892 struct dnsp_DnssrvRpcRecord
*rec
;
1894 isc_result_t result
;
1895 struct dnsp_DnssrvRpcRecord
*recs
= NULL
;
1896 uint16_t num_recs
= 0;
1900 if (state
->transaction_token
!= (void*)version
) {
1901 state
->log(ISC_LOG_ERROR
, "samba_dlz: bad transaction version");
1902 return ISC_R_FAILURE
;
1905 rec
= talloc_zero(state
, struct dnsp_DnssrvRpcRecord
);
1907 return ISC_R_NOMEMORY
;
1910 if (!b9_parse(state
, rdatastr
, rec
)) {
1911 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse rdataset '%s'", rdatastr
);
1913 return ISC_R_FAILURE
;
1916 /* find the DN of the record */
1917 result
= b9_find_name_dn(state
, name
, rec
, &dn
);
1918 if (result
!= ISC_R_SUCCESS
) {
1923 /* get the existing records */
1924 werr
= dns_common_lookup(state
->samdb
, rec
, dn
,
1925 &recs
, &num_recs
, NULL
);
1926 if (!W_ERROR_IS_OK(werr
)) {
1928 return ISC_R_NOTFOUND
;
1931 for (i
=0; i
< num_recs
; i
++) {
1932 if (b9_record_match(state
, rec
, &recs
[i
])) {
1933 recs
[i
] = (struct dnsp_DnssrvRpcRecord
) {
1934 .wType
= DNS_TYPE_TOMBSTONE
,
1939 if (i
== num_recs
) {
1941 return ISC_R_NOTFOUND
;
1944 if (!b9_set_session_info(state
, name
)) {
1946 return ISC_R_FAILURE
;
1949 /* modify the record */
1950 werr
= dns_common_replace(state
->samdb
, rec
, dn
,
1951 false,/* needs_add */
1954 b9_reset_session_info(state
);
1955 if (!W_ERROR_IS_OK(werr
)) {
1956 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to modify %s - %s",
1957 ldb_dn_get_linearized(dn
), win_errstr(werr
));
1959 return ISC_R_FAILURE
;
1962 state
->log(ISC_LOG_INFO
, "samba_dlz: subtracted rdataset %s '%s'", name
, rdatastr
);
1965 return ISC_R_SUCCESS
;
1970 delete all records of the given type
1972 _PUBLIC_ isc_result_t
dlz_delrdataset(const char *name
, const char *type
, void *dbdata
, void *version
)
1974 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1975 TALLOC_CTX
*tmp_ctx
;
1977 isc_result_t result
;
1978 enum dns_record_type dns_type
;
1980 struct dnsp_DnssrvRpcRecord
*recs
= NULL
;
1981 uint16_t num_recs
= 0;
1985 if (state
->transaction_token
!= (void*)version
) {
1986 state
->log(ISC_LOG_ERROR
, "samba_dlz: bad transaction version");
1987 return ISC_R_FAILURE
;
1990 if (!b9_dns_type(type
, &dns_type
)) {
1991 state
->log(ISC_LOG_ERROR
, "samba_dlz: bad dns type %s in delete", type
);
1992 return ISC_R_FAILURE
;
1995 tmp_ctx
= talloc_new(state
);
1997 /* find the DN of the record */
1998 result
= b9_find_name_dn(state
, name
, tmp_ctx
, &dn
);
1999 if (result
!= ISC_R_SUCCESS
) {
2000 talloc_free(tmp_ctx
);
2004 /* get the existing records */
2005 werr
= dns_common_lookup(state
->samdb
, tmp_ctx
, dn
,
2006 &recs
, &num_recs
, NULL
);
2007 if (!W_ERROR_IS_OK(werr
)) {
2008 talloc_free(tmp_ctx
);
2009 return ISC_R_NOTFOUND
;
2012 for (ri
=0; ri
< num_recs
; ri
++) {
2013 if (dns_type
!= recs
[ri
].wType
) {
2018 recs
[ri
] = (struct dnsp_DnssrvRpcRecord
) {
2019 .wType
= DNS_TYPE_TOMBSTONE
,
2024 talloc_free(tmp_ctx
);
2025 return ISC_R_FAILURE
;
2028 if (!b9_set_session_info(state
, name
)) {
2029 talloc_free(tmp_ctx
);
2030 return ISC_R_FAILURE
;
2033 /* modify the record */
2034 werr
= dns_common_replace(state
->samdb
, tmp_ctx
, dn
,
2035 false,/* needs_add */
2038 b9_reset_session_info(state
);
2039 if (!W_ERROR_IS_OK(werr
)) {
2040 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to modify %s - %s",
2041 ldb_dn_get_linearized(dn
), win_errstr(werr
));
2042 talloc_free(tmp_ctx
);
2043 return ISC_R_FAILURE
;
2046 state
->log(ISC_LOG_INFO
, "samba_dlz: deleted rdataset %s of type %s", name
, type
);
2048 talloc_free(tmp_ctx
);
2049 return ISC_R_SUCCESS
;