2 Unix SMB/CIFS implementation.
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/service_task.h"
24 #include "smbd/service.h"
25 #include "smbd/service_stream.h"
26 #include "smbd/process_model.h"
27 #include "lib/events/events.h"
28 #include "lib/socket/socket.h"
29 #include "lib/tsocket/tsocket.h"
30 #include "libcli/util/tstream.h"
31 #include "libcli/util/ntstatus.h"
32 #include "system/network.h"
33 #include "lib/stream/packet.h"
34 #include "lib/socket/netif.h"
35 #include "dns_server/dns_server.h"
36 #include "param/param.h"
37 #include "librpc/ndr/libndr.h"
38 #include "librpc/gen_ndr/ndr_dns.h"
39 #include "librpc/gen_ndr/ndr_dnsp.h"
41 #include "dsdb/samdb/samdb.h"
42 #include "dsdb/common/util.h"
43 #include "auth/session.h"
44 #include "lib/util/dlinklist.h"
45 #include "lib/util/tevent_werror.h"
46 #include "auth/auth.h"
47 #include "auth/credentials/credentials.h"
49 NTSTATUS
server_service_dns_init(void);
51 /* hold information about one dns socket */
53 struct dns_server
*dns
;
54 struct tsocket_address
*local_address
;
57 struct dns_udp_socket
{
58 struct dns_socket
*dns_socket
;
59 struct tdgram_context
*dgram
;
60 struct tevent_queue
*send_queue
;
64 state of an open tcp connection
66 struct dns_tcp_connection
{
67 /* stream connection we belong to */
68 struct stream_connection
*conn
;
70 /* the dns_server the connection belongs to */
71 struct dns_socket
*dns_socket
;
73 struct tstream_context
*tstream
;
75 struct tevent_queue
*send_queue
;
78 static void dns_tcp_terminate_connection(struct dns_tcp_connection
*dnsconn
, const char *reason
)
80 stream_terminate_connection(dnsconn
->conn
, reason
);
83 static void dns_tcp_recv(struct stream_connection
*conn
, uint16_t flags
)
85 struct dns_tcp_connection
*dnsconn
= talloc_get_type(conn
->private_data
,
86 struct dns_tcp_connection
);
87 /* this should never be triggered! */
88 dns_tcp_terminate_connection(dnsconn
, "dns_tcp_recv: called");
91 static void dns_tcp_send(struct stream_connection
*conn
, uint16_t flags
)
93 struct dns_tcp_connection
*dnsconn
= talloc_get_type(conn
->private_data
,
94 struct dns_tcp_connection
);
95 /* this should never be triggered! */
96 dns_tcp_terminate_connection(dnsconn
, "dns_tcp_send: called");
99 struct dns_process_state
{
101 struct dns_server
*dns
;
102 struct dns_name_packet in_packet
;
103 struct dns_request_state state
;
105 struct dns_name_packet out_packet
;
109 static void dns_process_done(struct tevent_req
*subreq
);
111 static struct tevent_req
*dns_process_send(TALLOC_CTX
*mem_ctx
,
112 struct tevent_context
*ev
,
113 struct dns_server
*dns
,
116 struct tevent_req
*req
, *subreq
;
117 struct dns_process_state
*state
;
118 enum ndr_err_code ndr_err
;
120 const char *forwarder
= lpcfg_dns_forwarder(dns
->task
->lp_ctx
);
121 req
= tevent_req_create(mem_ctx
, &state
, struct dns_process_state
);
129 if (in
->length
< 12) {
130 tevent_req_werror(req
, WERR_INVALID_PARAM
);
131 return tevent_req_post(req
, ev
);
133 dump_data(8, in
->data
, in
->length
);
135 ndr_err
= ndr_pull_struct_blob(
136 in
, state
, &state
->in_packet
,
137 (ndr_pull_flags_fn_t
)ndr_pull_dns_name_packet
);
139 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
140 state
->dns_err
= DNS_RCODE_FORMERR
;
141 tevent_req_done(req
);
142 return tevent_req_post(req
, ev
);
145 NDR_PRINT_DEBUG(dns_name_packet
, &state
->in_packet
);
148 ret
= dns_verify_tsig(dns
, state
, &state
->state
, &state
->in_packet
, in
);
149 if (!W_ERROR_IS_OK(ret
)) {
150 DEBUG(1, ("Failed to verify TSIG!\n"));
151 state
->dns_err
= werr_to_dns_err(ret
);
152 tevent_req_done(req
);
153 return tevent_req_post(req
, ev
);
156 if (state
->in_packet
.operation
& DNS_FLAG_REPLY
) {
157 DEBUG(1, ("Won't reply to replies.\n"));
158 tevent_req_werror(req
, WERR_INVALID_PARAM
);
159 return tevent_req_post(req
, ev
);
162 state
->state
.flags
= state
->in_packet
.operation
;
163 state
->state
.flags
|= DNS_FLAG_REPLY
;
166 if (forwarder
&& *forwarder
) {
167 state
->state
.flags
|= DNS_FLAG_RECURSION_AVAIL
;
170 state
->out_packet
= state
->in_packet
;
172 switch (state
->in_packet
.operation
& DNS_OPCODE
) {
173 case DNS_OPCODE_QUERY
:
174 subreq
= dns_server_process_query_send(
175 state
, ev
, dns
, &state
->state
, &state
->in_packet
);
176 if (tevent_req_nomem(subreq
, req
)) {
177 return tevent_req_post(req
, ev
);
179 tevent_req_set_callback(subreq
, dns_process_done
, req
);
181 case DNS_OPCODE_UPDATE
:
182 ret
= dns_server_process_update(
183 dns
, &state
->state
, state
, &state
->in_packet
,
184 &state
->out_packet
.answers
, &state
->out_packet
.ancount
,
185 &state
->out_packet
.nsrecs
, &state
->out_packet
.nscount
,
186 &state
->out_packet
.additional
,
187 &state
->out_packet
.arcount
);
190 ret
= WERR_DNS_ERROR_RCODE_NOT_IMPLEMENTED
;
192 if (!W_ERROR_IS_OK(ret
)) {
193 state
->dns_err
= werr_to_dns_err(ret
);
195 tevent_req_done(req
);
196 return tevent_req_post(req
, ev
);
199 static void dns_process_done(struct tevent_req
*subreq
)
201 struct tevent_req
*req
= tevent_req_callback_data(
202 subreq
, struct tevent_req
);
203 struct dns_process_state
*state
= tevent_req_data(
204 req
, struct dns_process_state
);
207 ret
= dns_server_process_query_recv(
209 &state
->out_packet
.answers
, &state
->out_packet
.ancount
,
210 &state
->out_packet
.nsrecs
, &state
->out_packet
.nscount
,
211 &state
->out_packet
.additional
, &state
->out_packet
.arcount
);
214 if (!W_ERROR_IS_OK(ret
)) {
215 state
->dns_err
= werr_to_dns_err(ret
);
217 tevent_req_done(req
);
220 static WERROR
dns_process_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
223 struct dns_process_state
*state
= tevent_req_data(
224 req
, struct dns_process_state
);
225 enum ndr_err_code ndr_err
;
228 if (tevent_req_is_werror(req
, &ret
)) {
231 if (state
->dns_err
!= DNS_RCODE_OK
) {
234 state
->out_packet
.operation
|= state
->state
.flags
;
236 if (state
->state
.sign
) {
237 ret
= dns_sign_tsig(state
->dns
, mem_ctx
, &state
->state
,
238 &state
->out_packet
, 0);
239 if (!W_ERROR_IS_OK(ret
)) {
240 state
->dns_err
= DNS_RCODE_SERVFAIL
;
245 ndr_err
= ndr_push_struct_blob(
246 out
, mem_ctx
, &state
->out_packet
,
247 (ndr_push_flags_fn_t
)ndr_push_dns_name_packet
);
248 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
249 DEBUG(1, ("Failed to push packet: %s!\n",
250 ndr_errstr(ndr_err
)));
251 state
->dns_err
= DNS_RCODE_SERVFAIL
;
257 *out
= data_blob_talloc(mem_ctx
, state
->in
->data
, state
->in
->length
);
258 if (out
->data
== NULL
) {
261 out
->data
[2] |= 0x80; /* Toggle DNS_FLAG_REPLY */
262 out
->data
[3] |= state
->dns_err
;
266 struct dns_tcp_call
{
267 struct dns_tcp_connection
*dns_conn
;
271 struct iovec out_iov
[2];
274 static void dns_tcp_call_process_done(struct tevent_req
*subreq
);
275 static void dns_tcp_call_writev_done(struct tevent_req
*subreq
);
277 static void dns_tcp_call_loop(struct tevent_req
*subreq
)
279 struct dns_tcp_connection
*dns_conn
= tevent_req_callback_data(subreq
,
280 struct dns_tcp_connection
);
281 struct dns_server
*dns
= dns_conn
->dns_socket
->dns
;
282 struct dns_tcp_call
*call
;
285 call
= talloc(dns_conn
, struct dns_tcp_call
);
287 dns_tcp_terminate_connection(dns_conn
, "dns_tcp_call_loop: "
288 "no memory for dns_tcp_call");
291 call
->dns_conn
= dns_conn
;
293 status
= tstream_read_pdu_blob_recv(subreq
,
297 if (!NT_STATUS_IS_OK(status
)) {
300 reason
= talloc_asprintf(call
, "dns_tcp_call_loop: "
301 "tstream_read_pdu_blob_recv() - %s",
304 reason
= nt_errstr(status
);
307 dns_tcp_terminate_connection(dns_conn
, reason
);
311 DEBUG(10,("Received DNS TCP packet of length %lu from %s\n",
312 (long) call
->in
.length
,
313 tsocket_address_string(dns_conn
->conn
->remote_address
, call
)));
315 /* skip length header */
317 call
->in
.length
-= 2;
319 subreq
= dns_process_send(call
, dns
->task
->event_ctx
, dns
,
321 if (subreq
== NULL
) {
322 dns_tcp_terminate_connection(
323 dns_conn
, "dns_tcp_call_loop: dns_process_send "
327 tevent_req_set_callback(subreq
, dns_tcp_call_process_done
, call
);
330 * The dns tcp pdu's has the length as 2 byte (initial_read_size),
331 * packet_full_request_u16 provides the pdu length then.
333 subreq
= tstream_read_pdu_blob_send(dns_conn
,
334 dns_conn
->conn
->event
.ctx
,
336 2, /* initial_read_size */
337 packet_full_request_u16
,
339 if (subreq
== NULL
) {
340 dns_tcp_terminate_connection(dns_conn
, "dns_tcp_call_loop: "
341 "no memory for tstream_read_pdu_blob_send");
344 tevent_req_set_callback(subreq
, dns_tcp_call_loop
, dns_conn
);
347 static void dns_tcp_call_process_done(struct tevent_req
*subreq
)
349 struct dns_tcp_call
*call
= tevent_req_callback_data(subreq
,
350 struct dns_tcp_call
);
351 struct dns_tcp_connection
*dns_conn
= call
->dns_conn
;
354 err
= dns_process_recv(subreq
, call
, &call
->out
);
356 if (!W_ERROR_IS_OK(err
)) {
357 DEBUG(1, ("dns_process returned %s\n", win_errstr(err
)));
358 dns_tcp_terminate_connection(dns_conn
,
359 "dns_tcp_call_loop: process function failed");
363 /* First add the length of the out buffer */
364 RSSVAL(call
->out_hdr
, 0, call
->out
.length
);
365 call
->out_iov
[0].iov_base
= (char *) call
->out_hdr
;
366 call
->out_iov
[0].iov_len
= 2;
368 call
->out_iov
[1].iov_base
= (char *) call
->out
.data
;
369 call
->out_iov
[1].iov_len
= call
->out
.length
;
371 subreq
= tstream_writev_queue_send(call
,
372 dns_conn
->conn
->event
.ctx
,
374 dns_conn
->send_queue
,
376 if (subreq
== NULL
) {
377 dns_tcp_terminate_connection(dns_conn
, "dns_tcp_call_loop: "
378 "no memory for tstream_writev_queue_send");
381 tevent_req_set_callback(subreq
, dns_tcp_call_writev_done
, call
);
384 static void dns_tcp_call_writev_done(struct tevent_req
*subreq
)
386 struct dns_tcp_call
*call
= tevent_req_callback_data(subreq
,
387 struct dns_tcp_call
);
391 rc
= tstream_writev_queue_recv(subreq
, &sys_errno
);
396 reason
= talloc_asprintf(call
, "dns_tcp_call_writev_done: "
397 "tstream_writev_queue_recv() - %d:%s",
398 sys_errno
, strerror(sys_errno
));
400 reason
= "dns_tcp_call_writev_done: tstream_writev_queue_recv() failed";
403 dns_tcp_terminate_connection(call
->dns_conn
, reason
);
407 /* We don't care about errors */
413 called when we get a new connection
415 static void dns_tcp_accept(struct stream_connection
*conn
)
417 struct dns_socket
*dns_socket
;
418 struct dns_tcp_connection
*dns_conn
;
419 struct tevent_req
*subreq
;
422 dns_conn
= talloc_zero(conn
, struct dns_tcp_connection
);
423 if (dns_conn
== NULL
) {
424 stream_terminate_connection(conn
,
425 "dns_tcp_accept: out of memory");
429 dns_conn
->send_queue
= tevent_queue_create(conn
, "dns_tcp_accept");
430 if (dns_conn
->send_queue
== NULL
) {
431 stream_terminate_connection(conn
,
432 "dns_tcp_accept: out of memory");
436 dns_socket
= talloc_get_type(conn
->private_data
, struct dns_socket
);
438 TALLOC_FREE(conn
->event
.fde
);
440 rc
= tstream_bsd_existing_socket(dns_conn
,
441 socket_get_fd(conn
->socket
),
444 stream_terminate_connection(conn
,
445 "dns_tcp_accept: out of memory");
449 dns_conn
->conn
= conn
;
450 dns_conn
->dns_socket
= dns_socket
;
451 conn
->private_data
= dns_conn
;
454 * The dns tcp pdu's has the length as 2 byte (initial_read_size),
455 * packet_full_request_u16 provides the pdu length then.
457 subreq
= tstream_read_pdu_blob_send(dns_conn
,
458 dns_conn
->conn
->event
.ctx
,
460 2, /* initial_read_size */
461 packet_full_request_u16
,
463 if (subreq
== NULL
) {
464 dns_tcp_terminate_connection(dns_conn
, "dns_tcp_accept: "
465 "no memory for tstream_read_pdu_blob_send");
468 tevent_req_set_callback(subreq
, dns_tcp_call_loop
, dns_conn
);
471 static const struct stream_server_ops dns_tcp_stream_ops
= {
473 .accept_connection
= dns_tcp_accept
,
474 .recv_handler
= dns_tcp_recv
,
475 .send_handler
= dns_tcp_send
478 struct dns_udp_call
{
479 struct dns_udp_socket
*sock
;
480 struct tsocket_address
*src
;
485 static void dns_udp_call_process_done(struct tevent_req
*subreq
);
486 static void dns_udp_call_sendto_done(struct tevent_req
*subreq
);
488 static void dns_udp_call_loop(struct tevent_req
*subreq
)
490 struct dns_udp_socket
*sock
= tevent_req_callback_data(subreq
,
491 struct dns_udp_socket
);
492 struct dns_server
*dns
= sock
->dns_socket
->dns
;
493 struct dns_udp_call
*call
;
498 call
= talloc(sock
, struct dns_udp_call
);
505 len
= tdgram_recvfrom_recv(subreq
, &sys_errno
,
506 call
, &buf
, &call
->src
);
514 call
->in
.length
= len
;
516 DEBUG(10,("Received DNS UDP packet of length %lu from %s\n",
517 (long)call
->in
.length
,
518 tsocket_address_string(call
->src
, call
)));
520 subreq
= dns_process_send(call
, dns
->task
->event_ctx
, dns
,
522 if (subreq
== NULL
) {
526 tevent_req_set_callback(subreq
, dns_udp_call_process_done
, call
);
529 subreq
= tdgram_recvfrom_send(sock
,
530 sock
->dns_socket
->dns
->task
->event_ctx
,
532 if (subreq
== NULL
) {
533 task_server_terminate(sock
->dns_socket
->dns
->task
,
534 "no memory for tdgram_recvfrom_send",
538 tevent_req_set_callback(subreq
, dns_udp_call_loop
, sock
);
541 static void dns_udp_call_process_done(struct tevent_req
*subreq
)
543 struct dns_udp_call
*call
= tevent_req_callback_data(
544 subreq
, struct dns_udp_call
);
545 struct dns_udp_socket
*sock
= call
->sock
;
546 struct dns_server
*dns
= sock
->dns_socket
->dns
;
549 err
= dns_process_recv(subreq
, call
, &call
->out
);
551 if (!W_ERROR_IS_OK(err
)) {
552 DEBUG(1, ("dns_process returned %s\n", win_errstr(err
)));
557 subreq
= tdgram_sendto_queue_send(call
,
558 dns
->task
->event_ctx
,
564 if (subreq
== NULL
) {
568 tevent_req_set_callback(subreq
, dns_udp_call_sendto_done
, call
);
571 static void dns_udp_call_sendto_done(struct tevent_req
*subreq
)
573 struct dns_udp_call
*call
= tevent_req_callback_data(subreq
,
574 struct dns_udp_call
);
577 tdgram_sendto_queue_recv(subreq
, &sys_errno
);
579 /* We don't care about errors */
585 start listening on the given address
587 static NTSTATUS
dns_add_socket(struct dns_server
*dns
,
588 const struct model_ops
*model_ops
,
593 struct dns_socket
*dns_socket
;
594 struct dns_udp_socket
*dns_udp_socket
;
595 struct tevent_req
*udpsubreq
;
599 dns_socket
= talloc(dns
, struct dns_socket
);
600 NT_STATUS_HAVE_NO_MEMORY(dns_socket
);
602 dns_socket
->dns
= dns
;
604 ret
= tsocket_address_inet_from_strings(dns_socket
, "ip",
606 &dns_socket
->local_address
);
608 status
= map_nt_error_from_unix_common(errno
);
612 status
= stream_setup_socket(dns
->task
,
613 dns
->task
->event_ctx
,
617 "ip", address
, &port
,
618 lpcfg_socket_options(dns
->task
->lp_ctx
),
620 if (!NT_STATUS_IS_OK(status
)) {
621 DEBUG(0,("Failed to bind to %s:%u TCP - %s\n",
622 address
, port
, nt_errstr(status
)));
623 talloc_free(dns_socket
);
627 dns_udp_socket
= talloc(dns_socket
, struct dns_udp_socket
);
628 NT_STATUS_HAVE_NO_MEMORY(dns_udp_socket
);
630 dns_udp_socket
->dns_socket
= dns_socket
;
632 ret
= tdgram_inet_udp_socket(dns_socket
->local_address
,
635 &dns_udp_socket
->dgram
);
637 status
= map_nt_error_from_unix_common(errno
);
638 DEBUG(0,("Failed to bind to %s:%u UDP - %s\n",
639 address
, port
, nt_errstr(status
)));
643 dns_udp_socket
->send_queue
= tevent_queue_create(dns_udp_socket
,
644 "dns_udp_send_queue");
645 NT_STATUS_HAVE_NO_MEMORY(dns_udp_socket
->send_queue
);
647 udpsubreq
= tdgram_recvfrom_send(dns_udp_socket
,
648 dns
->task
->event_ctx
,
649 dns_udp_socket
->dgram
);
650 NT_STATUS_HAVE_NO_MEMORY(udpsubreq
);
651 tevent_req_set_callback(udpsubreq
, dns_udp_call_loop
, dns_udp_socket
);
657 setup our listening sockets on the configured network interfaces
659 static NTSTATUS
dns_startup_interfaces(struct dns_server
*dns
,
660 struct interface
*ifaces
)
662 const struct model_ops
*model_ops
;
664 TALLOC_CTX
*tmp_ctx
= talloc_new(dns
);
668 /* within the dns task we want to be a single process, so
669 ask for the single process model ops and pass these to the
670 stream_setup_socket() call. */
671 model_ops
= process_model_startup("single");
673 DEBUG(0,("Can't find 'single' process model_ops\n"));
674 return NT_STATUS_INTERNAL_ERROR
;
677 if (ifaces
!= NULL
) {
678 num_interfaces
= iface_list_count(ifaces
);
680 for (i
=0; i
<num_interfaces
; i
++) {
681 const char *address
= talloc_strdup(tmp_ctx
,
682 iface_list_n_ip(ifaces
, i
));
684 status
= dns_add_socket(dns
, model_ops
, "dns", address
,
686 NT_STATUS_NOT_OK_RETURN(status
);
691 wcard
= iface_list_wildcard(tmp_ctx
);
693 DEBUG(0, ("No wildcard address available\n"));
694 return NT_STATUS_INTERNAL_ERROR
;
696 for (i
= 0; wcard
[i
] != NULL
; i
++) {
697 status
= dns_add_socket(dns
, model_ops
, "dns", wcard
[i
],
699 if (NT_STATUS_IS_OK(status
)) {
703 if (num_binds
== 0) {
704 talloc_free(tmp_ctx
);
705 return NT_STATUS_INVALID_PARAMETER_MIX
;
709 talloc_free(tmp_ctx
);
714 static int dns_server_sort_zones(struct ldb_message
**m1
, struct ldb_message
**m2
)
719 n1
= ldb_msg_find_attr_as_string(*m1
, "name", NULL
);
720 n2
= ldb_msg_find_attr_as_string(*m2
, "name", NULL
);
725 /* If the string lengths are not equal just sort by length */
727 /* If m1 is the larger zone name, return it first */
731 /*TODO: We need to compare DNs here, we want the DomainDNSZones first */
735 static struct dns_server_tkey_store
*tkey_store_init(TALLOC_CTX
*mem_ctx
,
738 struct dns_server_tkey_store
*buffer
= talloc_zero(mem_ctx
,
739 struct dns_server_tkey_store
);
741 if (buffer
== NULL
) {
746 buffer
->next_idx
= 0;
748 buffer
->tkeys
= talloc_zero_array(buffer
, struct dns_server_tkey
*, size
);
749 if (buffer
->tkeys
== NULL
) {
756 static void dns_task_init(struct task_server
*task
)
758 struct dns_server
*dns
;
760 struct interface
*ifaces
= NULL
;
762 struct ldb_result
*res
;
763 static const char * const attrs
[] = { "name", NULL
};
764 static const char * const attrs_none
[] = { NULL
};
766 struct ldb_message
*dns_acc
;
767 char *hostname_lower
;
770 switch (lpcfg_server_role(task
->lp_ctx
)) {
771 case ROLE_STANDALONE
:
772 task_server_terminate(task
, "dns: no DNS required in standalone configuration", false);
774 case ROLE_DOMAIN_MEMBER
:
775 task_server_terminate(task
, "dns: no DNS required in member server configuration", false);
777 case ROLE_ACTIVE_DIRECTORY_DC
:
778 /* Yes, we want a DNS */
782 if (lpcfg_interfaces(task
->lp_ctx
) && lpcfg_bind_interfaces_only(task
->lp_ctx
)) {
783 load_interface_list(task
, task
->lp_ctx
, &ifaces
);
785 if (iface_list_count(ifaces
) == 0) {
786 task_server_terminate(task
, "dns: no network interfaces configured", false);
791 task_server_set_title(task
, "task[dns]");
793 dns
= talloc_zero(task
, struct dns_server
);
795 task_server_terminate(task
, "dns: out of memory", true);
800 /*FIXME: Make this a configurable option */
801 dns
->max_payload
= 4096;
803 dns
->server_credentials
= cli_credentials_init(dns
);
804 if (!dns
->server_credentials
) {
805 task_server_terminate(task
, "Failed to init server credentials\n", true);
809 dns
->samdb
= samdb_connect(dns
, dns
->task
->event_ctx
, dns
->task
->lp_ctx
,
810 system_session(dns
->task
->lp_ctx
), 0);
812 task_server_terminate(task
, "dns: samdb_connect failed", true);
816 cli_credentials_set_conf(dns
->server_credentials
, task
->lp_ctx
);
818 hostname_lower
= strlower_talloc(dns
, lpcfg_netbios_name(task
->lp_ctx
));
819 dns_spn
= talloc_asprintf(dns
, "DNS/%s.%s",
821 lpcfg_dnsdomain(task
->lp_ctx
));
822 TALLOC_FREE(hostname_lower
);
824 ret
= dsdb_search_one(dns
->samdb
, dns
, &dns_acc
,
825 ldb_get_default_basedn(dns
->samdb
), LDB_SCOPE_SUBTREE
,
826 attrs_none
, 0, "(servicePrincipalName=%s)",
828 if (ret
== LDB_SUCCESS
) {
829 TALLOC_FREE(dns_acc
);
831 task_server_terminate(task
, "dns: talloc_asprintf failed", true);
834 status
= cli_credentials_set_stored_principal(dns
->server_credentials
, task
->lp_ctx
, dns_spn
);
835 if (!NT_STATUS_IS_OK(status
)) {
836 task_server_terminate(task
,
837 talloc_asprintf(task
, "Failed to obtain server credentials for DNS, "
838 "despite finding it in the samdb! %s\n",
844 TALLOC_FREE(dns_spn
);
845 status
= cli_credentials_set_machine_account(dns
->server_credentials
, task
->lp_ctx
);
846 if (!NT_STATUS_IS_OK(status
)) {
847 task_server_terminate(task
,
848 talloc_asprintf(task
, "Failed to obtain server credentials, perhaps a standalone server?: %s\n",
855 dns
->tkeys
= tkey_store_init(dns
, TKEY_BUFFER_SIZE
);
857 task_server_terminate(task
, "Failed to allocate tkey storage\n", true);
861 // TODO: this search does not work against windows
862 ret
= dsdb_search(dns
->samdb
, dns
, &res
, NULL
, LDB_SCOPE_SUBTREE
,
863 attrs
, DSDB_SEARCH_SEARCH_ALL_PARTITIONS
, "(objectClass=dnsZone)");
864 if (ret
!= LDB_SUCCESS
) {
865 task_server_terminate(task
,
866 "dns: failed to look up root DNS zones",
871 TYPESAFE_QSORT(res
->msgs
, res
->count
, dns_server_sort_zones
);
873 for (i
=0; i
< res
->count
; i
++) {
874 struct dns_server_zone
*z
;
876 z
= talloc_zero(dns
, struct dns_server_zone
);
878 task_server_terminate(task
, "dns failed to allocate memory", true);
881 z
->name
= ldb_msg_find_attr_as_string(res
->msgs
[i
], "name", NULL
);
882 z
->dn
= talloc_move(z
, &res
->msgs
[i
]->dn
);
884 * Ignore the RootDNSServers zone and zones that we don't support yet
885 * RootDNSServers should never be returned (Windows DNS server don't)
886 * ..TrustAnchors should never be returned as is, (Windows returns
887 * TrustAnchors) and for the moment we don't support DNSSEC so we'd better
888 * not return this zone.
890 if ((strcmp(z
->name
, "RootDNSServers") == 0) ||
891 (strcmp(z
->name
, "..TrustAnchors") == 0))
893 DEBUG(10, ("Ignoring zone %s\n", z
->name
));
897 DLIST_ADD_END(dns
->zones
, z
, NULL
);
900 status
= dns_startup_interfaces(dns
, ifaces
);
901 if (!NT_STATUS_IS_OK(status
)) {
902 task_server_terminate(task
, "dns failed to setup interfaces", true);
907 NTSTATUS
server_service_dns_init(void)
909 return register_server_service("dns", dns_task_init
);