2 Unix SMB/CIFS implementation.
4 bind9 dlz driver for Samba
6 Copyright (C) 2010 Andrew Tridgell
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "param/param.h"
25 #include "lib/events/events.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "dsdb/common/util.h"
28 #include "auth/auth.h"
29 #include "auth/session.h"
30 #include "auth/gensec/gensec.h"
31 #include "librpc/gen_ndr/security.h"
32 #include "auth/credentials/credentials.h"
33 #include "system/kerberos.h"
34 #include "auth/kerberos/kerberos.h"
35 #include "gen_ndr/ndr_dnsp.h"
36 #include "gen_ndr/server_id.h"
37 #include "messaging/messaging.h"
38 #include "dlz_minimal.h"
45 struct dlz_bind9_data
{
46 struct b9_options options
;
47 struct ldb_context
*samdb
;
48 struct tevent_context
*ev_ctx
;
49 struct loadparm_context
*lp
;
50 int *transaction_token
;
53 /* Used for dynamic update */
54 struct smb_krb5_context
*smb_krb5_ctx
;
56 /* helper functions from the dlz_dlopen driver */
57 void (*log
)(int level
, const char *fmt
, ...);
58 isc_result_t (*putrr
)(dns_sdlzlookup_t
*handle
, const char *type
,
59 dns_ttl_t ttl
, const char *data
);
60 isc_result_t (*putnamedrr
)(dns_sdlzlookup_t
*handle
, const char *name
,
61 const char *type
, dns_ttl_t ttl
, const char *data
);
62 isc_result_t (*writeable_zone
)(dns_view_t
*view
, const char *zone_name
);
66 static const char *zone_prefixes
[] = {
67 "CN=MicrosoftDNS,DC=DomainDnsZones",
68 "CN=MicrosoftDNS,DC=ForestDnsZones",
69 "CN=MicrosoftDNS,CN=System",
74 return the version of the API
76 _PUBLIC_
int dlz_version(unsigned int *flags
)
78 return DLZ_DLOPEN_VERSION
;
82 remember a helper function from the bind9 dlz_dlopen driver
84 static void b9_add_helper(struct dlz_bind9_data
*state
, const char *helper_name
, void *ptr
)
86 if (strcmp(helper_name
, "log") == 0) {
89 if (strcmp(helper_name
, "putrr") == 0) {
92 if (strcmp(helper_name
, "putnamedrr") == 0) {
93 state
->putnamedrr
= ptr
;
95 if (strcmp(helper_name
, "writeable_zone") == 0) {
96 state
->writeable_zone
= ptr
;
101 format a record for bind9
103 static bool b9_format(struct dlz_bind9_data
*state
,
105 struct dnsp_DnssrvRpcRecord
*rec
,
106 const char **type
, const char **data
)
108 switch (rec
->wType
) {
111 *data
= rec
->data
.ipv4
;
116 *data
= rec
->data
.ipv6
;
121 *data
= rec
->data
.cname
;
126 *data
= rec
->data
.txt
;
131 *data
= rec
->data
.ptr
;
136 *data
= talloc_asprintf(mem_ctx
, "%u %u %u %s",
137 rec
->data
.srv
.wPriority
,
138 rec
->data
.srv
.wWeight
,
140 rec
->data
.srv
.nameTarget
);
145 *data
= talloc_asprintf(mem_ctx
, "%u %s",
146 rec
->data
.mx
.wPriority
,
147 rec
->data
.mx
.nameTarget
);
152 *data
= talloc_asprintf(mem_ctx
, "%s %s",
159 *data
= rec
->data
.ns
;
166 /* we need to fake the authoritative nameserver to
167 * point at ourselves. This is how AD DNS servers
168 * force clients to send updates to the right local DC
170 mname
= talloc_asprintf(mem_ctx
, "%s.%s",
171 lpcfg_netbios_name(state
->lp
), lpcfg_dnsdomain(state
->lp
));
175 mname
= strlower_talloc(mem_ctx
, mname
);
180 state
->soa_serial
= rec
->data
.soa
.serial
;
182 *data
= talloc_asprintf(mem_ctx
, "%s %s %u %u %u %u %u",
185 rec
->data
.soa
.serial
,
186 rec
->data
.soa
.refresh
,
188 rec
->data
.soa
.expire
,
189 rec
->data
.soa
.minimum
);
194 state
->log(ISC_LOG_ERROR
, "samba b9_putrr: unhandled record type %u",
202 static const struct {
203 enum dns_record_type dns_type
;
207 { DNS_TYPE_A
, "A" , false},
208 { DNS_TYPE_AAAA
, "AAAA" , false},
209 { DNS_TYPE_CNAME
, "CNAME" , true},
210 { DNS_TYPE_TXT
, "TXT" , false},
211 { DNS_TYPE_PTR
, "PTR" , false},
212 { DNS_TYPE_SRV
, "SRV" , false},
213 { DNS_TYPE_MX
, "MX" , false},
214 { DNS_TYPE_HINFO
, "HINFO" , false},
215 { DNS_TYPE_NS
, "NS" , false},
216 { DNS_TYPE_SOA
, "SOA" , true},
221 see if a DNS type is single valued
223 static bool b9_single_valued(enum dns_record_type dns_type
)
226 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
227 if (dns_typemap
[i
].dns_type
== dns_type
) {
228 return dns_typemap
[i
].single_valued
;
235 see if a DNS type is single valued
237 static bool b9_dns_type(const char *type
, enum dns_record_type
*dtype
)
240 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
241 if (strcasecmp(dns_typemap
[i
].typestr
, type
) == 0) {
242 *dtype
= dns_typemap
[i
].dns_type
;
250 #define DNS_PARSE_STR(ret, str, sep, saveptr) do { \
251 (ret) = strtok_r(str, sep, &saveptr); \
252 if ((ret) == NULL) return false; \
255 #define DNS_PARSE_UINT(ret, str, sep, saveptr) do { \
256 char *istr = strtok_r(str, sep, &saveptr); \
257 if ((istr) == NULL) return false; \
258 (ret) = strtoul(istr, NULL, 10); \
262 parse a record from bind9
264 static bool b9_parse(struct dlz_bind9_data
*state
,
265 const char *rdatastr
,
266 struct dnsp_DnssrvRpcRecord
*rec
)
268 char *full_name
, *dclass
, *type
;
269 char *str
, *saveptr
=NULL
;
272 str
= talloc_strdup(rec
, rdatastr
);
277 /* parse the SDLZ string form */
278 DNS_PARSE_STR(full_name
, str
, "\t", saveptr
);
279 DNS_PARSE_UINT(rec
->dwTtlSeconds
, NULL
, "\t", saveptr
);
280 DNS_PARSE_STR(dclass
, NULL
, "\t", saveptr
);
281 DNS_PARSE_STR(type
, NULL
, "\t", saveptr
);
283 /* construct the record */
284 for (i
=0; i
<ARRAY_SIZE(dns_typemap
); i
++) {
285 if (strcasecmp(type
, dns_typemap
[i
].typestr
) == 0) {
286 rec
->wType
= dns_typemap
[i
].dns_type
;
290 if (i
== ARRAY_SIZE(dns_typemap
)) {
291 state
->log(ISC_LOG_ERROR
, "samba_dlz: unsupported record type '%s' for '%s'",
296 switch (rec
->wType
) {
298 DNS_PARSE_STR(rec
->data
.ipv4
, NULL
, " ", saveptr
);
302 DNS_PARSE_STR(rec
->data
.ipv6
, NULL
, " ", saveptr
);
306 DNS_PARSE_STR(rec
->data
.cname
, NULL
, " ", saveptr
);
310 DNS_PARSE_STR(rec
->data
.txt
, NULL
, "\t", saveptr
);
314 DNS_PARSE_STR(rec
->data
.ptr
, NULL
, " ", saveptr
);
318 DNS_PARSE_UINT(rec
->data
.srv
.wPriority
, NULL
, " ", saveptr
);
319 DNS_PARSE_UINT(rec
->data
.srv
.wWeight
, NULL
, " ", saveptr
);
320 DNS_PARSE_UINT(rec
->data
.srv
.wPort
, NULL
, " ", saveptr
);
321 DNS_PARSE_STR(rec
->data
.srv
.nameTarget
, NULL
, " ", saveptr
);
325 DNS_PARSE_UINT(rec
->data
.mx
.wPriority
, NULL
, " ", saveptr
);
326 DNS_PARSE_STR(rec
->data
.mx
.nameTarget
, NULL
, " ", saveptr
);
330 DNS_PARSE_STR(rec
->data
.hinfo
.cpu
, NULL
, " ", saveptr
);
331 DNS_PARSE_STR(rec
->data
.hinfo
.os
, NULL
, " ", saveptr
);
335 DNS_PARSE_STR(rec
->data
.ns
, NULL
, " ", saveptr
);
339 DNS_PARSE_STR(rec
->data
.soa
.mname
, NULL
, " ", saveptr
);
340 DNS_PARSE_STR(rec
->data
.soa
.rname
, NULL
, " ", saveptr
);
341 DNS_PARSE_UINT(rec
->data
.soa
.serial
, NULL
, " ", saveptr
);
342 DNS_PARSE_UINT(rec
->data
.soa
.refresh
, NULL
, " ", saveptr
);
343 DNS_PARSE_UINT(rec
->data
.soa
.retry
, NULL
, " ", saveptr
);
344 DNS_PARSE_UINT(rec
->data
.soa
.expire
, NULL
, " ", saveptr
);
345 DNS_PARSE_UINT(rec
->data
.soa
.minimum
, NULL
, " ", saveptr
);
349 state
->log(ISC_LOG_ERROR
, "samba b9_parse: unhandled record type %u",
354 /* we should be at the end of the buffer now */
355 if (strtok_r(NULL
, "\t ", &saveptr
) != NULL
) {
356 state
->log(ISC_LOG_ERROR
, "samba b9_parse: expected data at end of string for '%s'");
364 send a resource recond to bind9
366 static isc_result_t
b9_putrr(struct dlz_bind9_data
*state
,
367 void *handle
, struct dnsp_DnssrvRpcRecord
*rec
,
371 const char *type
, *data
;
372 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
374 if (!b9_format(state
, tmp_ctx
, rec
, &type
, &data
)) {
375 return ISC_R_FAILURE
;
379 talloc_free(tmp_ctx
);
380 return ISC_R_NOMEMORY
;
385 for (i
=0; types
[i
]; i
++) {
386 if (strcmp(types
[i
], type
) == 0) break;
388 if (types
[i
] == NULL
) {
390 return ISC_R_SUCCESS
;
394 result
= state
->putrr(handle
, type
, rec
->dwTtlSeconds
, data
);
395 if (result
!= ISC_R_SUCCESS
) {
396 state
->log(ISC_LOG_ERROR
, "Failed to put rr");
398 talloc_free(tmp_ctx
);
404 send a named resource recond to bind9
406 static isc_result_t
b9_putnamedrr(struct dlz_bind9_data
*state
,
407 void *handle
, const char *name
,
408 struct dnsp_DnssrvRpcRecord
*rec
)
411 const char *type
, *data
;
412 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
414 if (!b9_format(state
, tmp_ctx
, rec
, &type
, &data
)) {
415 return ISC_R_FAILURE
;
419 talloc_free(tmp_ctx
);
420 return ISC_R_NOMEMORY
;
423 result
= state
->putnamedrr(handle
, name
, type
, rec
->dwTtlSeconds
, data
);
424 if (result
!= ISC_R_SUCCESS
) {
425 state
->log(ISC_LOG_ERROR
, "Failed to put named rr '%s'", name
);
427 talloc_free(tmp_ctx
);
434 static isc_result_t
parse_options(struct dlz_bind9_data
*state
,
435 unsigned int argc
, char *argv
[],
436 struct b9_options
*options
)
439 options
->url
= talloc_strdup(state
, argv
[1]);
440 if (options
->url
== NULL
) {
441 return ISC_R_NOMEMORY
;
443 state
->log(ISC_LOG_INFO
, "samba_dlz: Using samdb URL %s", options
->url
);
446 return ISC_R_SUCCESS
;
451 called to initialise the driver
453 _PUBLIC_ isc_result_t
dlz_create(const char *dlzname
,
454 unsigned int argc
, char *argv
[],
457 struct dlz_bind9_data
*state
;
458 const char *helper_name
;
465 state
= talloc_zero(NULL
, struct dlz_bind9_data
);
467 return ISC_R_NOMEMORY
;
470 tmp_ctx
= talloc_new(state
);
472 /* fill in the helper functions */
473 va_start(ap
, dbdata
);
474 while ((helper_name
= va_arg(ap
, const char *)) != NULL
) {
475 b9_add_helper(state
, helper_name
, va_arg(ap
, void*));
479 state
->ev_ctx
= s4_event_context_init(state
);
480 if (state
->ev_ctx
== NULL
) {
481 result
= ISC_R_NOMEMORY
;
485 result
= parse_options(state
, argc
, argv
, &state
->options
);
486 if (result
!= ISC_R_SUCCESS
) {
490 state
->lp
= loadparm_init_global(true);
491 if (state
->lp
== NULL
) {
492 result
= ISC_R_NOMEMORY
;
496 if (smb_krb5_init_context(state
, state
->ev_ctx
, state
->lp
, &state
->smb_krb5_ctx
) != 0) {
497 result
= ISC_R_NOMEMORY
;
501 nt_status
= gensec_init();
502 if (!NT_STATUS_IS_OK(nt_status
)) {
503 talloc_free(tmp_ctx
);
507 if (state
->options
.url
== NULL
) {
508 state
->options
.url
= lpcfg_private_path(state
, state
->lp
, "dns/sam.ldb");
509 if (state
->options
.url
== NULL
) {
510 result
= ISC_R_NOMEMORY
;
515 /* Do not install samba signal handlers */
516 fault_setup_disable();
518 state
->samdb
= samdb_connect_url(state
, state
->ev_ctx
, state
->lp
,
519 system_session(state
->lp
), 0, state
->options
.url
);
520 if (state
->samdb
== NULL
) {
521 state
->log(ISC_LOG_ERROR
, "samba_dlz: Failed to connect to %s",
523 result
= ISC_R_FAILURE
;
527 dn
= ldb_get_default_basedn(state
->samdb
);
529 state
->log(ISC_LOG_ERROR
, "samba_dlz: Unable to get basedn for %s - %s",
530 state
->options
.url
, ldb_errstring(state
->samdb
));
531 result
= ISC_R_FAILURE
;
535 state
->log(ISC_LOG_INFO
, "samba_dlz: started for DN %s",
536 ldb_dn_get_linearized(dn
));
540 talloc_free(tmp_ctx
);
541 return ISC_R_SUCCESS
;
551 _PUBLIC_
void dlz_destroy(void *dbdata
)
553 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
554 state
->log(ISC_LOG_INFO
, "samba_dlz: shutting down");
560 return the base DN for a zone
562 static isc_result_t
b9_find_zone_dn(struct dlz_bind9_data
*state
, const char *zone_name
,
563 TALLOC_CTX
*mem_ctx
, struct ldb_dn
**zone_dn
)
566 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
567 const char *attrs
[] = { NULL
};
570 for (i
=0; zone_prefixes
[i
]; i
++) {
572 struct ldb_result
*res
;
574 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
576 talloc_free(tmp_ctx
);
577 return ISC_R_NOMEMORY
;
580 if (!ldb_dn_add_child_fmt(dn
, "DC=%s,%s", zone_name
, zone_prefixes
[i
])) {
581 talloc_free(tmp_ctx
);
582 return ISC_R_NOMEMORY
;
585 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsZone");
586 if (ret
== LDB_SUCCESS
) {
587 if (zone_dn
!= NULL
) {
588 *zone_dn
= talloc_steal(mem_ctx
, dn
);
590 talloc_free(tmp_ctx
);
591 return ISC_R_SUCCESS
;
596 talloc_free(tmp_ctx
);
597 return ISC_R_NOTFOUND
;
602 return the DN for a name. The record does not need to exist, but the
605 static isc_result_t
b9_find_name_dn(struct dlz_bind9_data
*state
, const char *name
,
606 TALLOC_CTX
*mem_ctx
, struct ldb_dn
**dn
)
610 /* work through the name piece by piece, until we find a zone */
613 result
= b9_find_zone_dn(state
, p
, mem_ctx
, dn
);
614 if (result
== ISC_R_SUCCESS
) {
615 /* we found a zone, now extend the DN to get
620 ret
= ldb_dn_add_child_fmt(*dn
, "DC=@");
622 ret
= ldb_dn_add_child_fmt(*dn
, "DC=%.*s", (int)(p
-name
)-1, name
);
626 return ISC_R_NOMEMORY
;
628 return ISC_R_SUCCESS
;
636 return ISC_R_NOTFOUND
;
641 see if we handle a given zone
643 _PUBLIC_ isc_result_t
dlz_findzonedb(void *dbdata
, const char *name
)
645 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
646 return b9_find_zone_dn(state
, name
, NULL
, NULL
);
653 static isc_result_t
dlz_lookup_types(struct dlz_bind9_data
*state
,
654 const char *zone
, const char *name
,
655 dns_sdlzlookup_t
*lookup
,
658 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
659 const char *attrs
[] = { "dnsRecord", NULL
};
660 int ret
= LDB_SUCCESS
, i
;
661 struct ldb_result
*res
;
662 struct ldb_message_element
*el
;
665 for (i
=0; zone_prefixes
[i
]; i
++) {
666 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
668 talloc_free(tmp_ctx
);
669 return ISC_R_NOMEMORY
;
672 if (!ldb_dn_add_child_fmt(dn
, "DC=%s,DC=%s,%s", name
, zone
, zone_prefixes
[i
])) {
673 talloc_free(tmp_ctx
);
674 return ISC_R_NOMEMORY
;
677 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
,
678 attrs
, "objectClass=dnsNode");
679 if (ret
== LDB_SUCCESS
) {
683 if (ret
!= LDB_SUCCESS
) {
684 talloc_free(tmp_ctx
);
685 return ISC_R_NOTFOUND
;
688 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
689 if (el
== NULL
|| el
->num_values
== 0) {
690 talloc_free(tmp_ctx
);
691 return ISC_R_NOTFOUND
;
694 for (i
=0; i
<el
->num_values
; i
++) {
695 struct dnsp_DnssrvRpcRecord rec
;
696 enum ndr_err_code ndr_err
;
699 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], tmp_ctx
, &rec
,
700 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
701 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
702 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
703 ldb_dn_get_linearized(dn
));
704 talloc_free(tmp_ctx
);
705 return ISC_R_FAILURE
;
708 result
= b9_putrr(state
, lookup
, &rec
, types
);
709 if (result
!= ISC_R_SUCCESS
) {
710 talloc_free(tmp_ctx
);
715 talloc_free(tmp_ctx
);
716 return ISC_R_SUCCESS
;
722 _PUBLIC_ isc_result_t
dlz_lookup(const char *zone
, const char *name
,
723 void *dbdata
, dns_sdlzlookup_t
*lookup
)
725 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
726 return dlz_lookup_types(state
, zone
, name
, lookup
, NULL
);
731 see if a zone transfer is allowed
733 _PUBLIC_ isc_result_t
dlz_allowzonexfr(void *dbdata
, const char *name
, const char *client
)
735 /* just say yes for all our zones for now */
736 return dlz_findzonedb(dbdata
, name
);
740 perform a zone transfer
742 _PUBLIC_ isc_result_t
dlz_allnodes(const char *zone
, void *dbdata
,
743 dns_sdlzallnodes_t
*allnodes
)
745 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
746 const char *attrs
[] = { "dnsRecord", NULL
};
747 int ret
= LDB_SUCCESS
, i
, j
;
749 struct ldb_result
*res
;
750 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
752 for (i
=0; zone_prefixes
[i
]; i
++) {
753 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
755 talloc_free(tmp_ctx
);
756 return ISC_R_NOMEMORY
;
759 if (!ldb_dn_add_child_fmt(dn
, "DC=%s,%s", zone
, zone_prefixes
[i
])) {
760 talloc_free(tmp_ctx
);
761 return ISC_R_NOMEMORY
;
764 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_SUBTREE
,
765 attrs
, "objectClass=dnsNode");
766 if (ret
== LDB_SUCCESS
) {
770 if (ret
!= LDB_SUCCESS
) {
771 talloc_free(tmp_ctx
);
772 return ISC_R_NOTFOUND
;
775 for (i
=0; i
<res
->count
; i
++) {
776 struct ldb_message_element
*el
;
777 TALLOC_CTX
*el_ctx
= talloc_new(tmp_ctx
);
778 const char *rdn
, *name
;
779 const struct ldb_val
*v
;
781 el
= ldb_msg_find_element(res
->msgs
[i
], "dnsRecord");
782 if (el
== NULL
|| el
->num_values
== 0) {
783 state
->log(ISC_LOG_INFO
, "failed to find dnsRecord for %s",
784 ldb_dn_get_linearized(dn
));
789 v
= ldb_dn_get_rdn_val(res
->msgs
[i
]->dn
);
791 state
->log(ISC_LOG_INFO
, "failed to find RDN for %s",
792 ldb_dn_get_linearized(dn
));
797 rdn
= talloc_strndup(el_ctx
, (char *)v
->data
, v
->length
);
799 talloc_free(tmp_ctx
);
800 return ISC_R_NOMEMORY
;
803 if (strcmp(rdn
, "@") == 0) {
806 name
= talloc_asprintf(el_ctx
, "%s.%s", rdn
, zone
);
809 talloc_free(tmp_ctx
);
810 return ISC_R_NOMEMORY
;
813 for (j
=0; j
<el
->num_values
; j
++) {
814 struct dnsp_DnssrvRpcRecord rec
;
815 enum ndr_err_code ndr_err
;
818 ndr_err
= ndr_pull_struct_blob(&el
->values
[j
], el_ctx
, &rec
,
819 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
820 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
821 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
822 ldb_dn_get_linearized(dn
));
826 result
= b9_putnamedrr(state
, allnodes
, name
, &rec
);
827 if (result
!= ISC_R_SUCCESS
) {
833 talloc_free(tmp_ctx
);
835 return ISC_R_SUCCESS
;
842 _PUBLIC_ isc_result_t
dlz_newversion(const char *zone
, void *dbdata
, void **versionp
)
844 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
846 state
->log(ISC_LOG_INFO
, "samba_dlz: starting transaction on zone %s", zone
);
848 if (state
->transaction_token
!= NULL
) {
849 state
->log(ISC_LOG_INFO
, "samba_dlz: transaction already started for zone %s", zone
);
850 return ISC_R_FAILURE
;
853 state
->transaction_token
= talloc_zero(state
, int);
854 if (state
->transaction_token
== NULL
) {
855 return ISC_R_NOMEMORY
;
858 if (ldb_transaction_start(state
->samdb
) != LDB_SUCCESS
) {
859 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to start a transaction for zone %s", zone
);
860 talloc_free(state
->transaction_token
);
861 state
->transaction_token
= NULL
;
862 return ISC_R_FAILURE
;
865 *versionp
= (void *)state
->transaction_token
;
867 return ISC_R_SUCCESS
;
873 _PUBLIC_
void dlz_closeversion(const char *zone
, isc_boolean_t commit
,
874 void *dbdata
, void **versionp
)
876 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
878 if (state
->transaction_token
!= (int *)*versionp
) {
879 state
->log(ISC_LOG_INFO
, "samba_dlz: transaction not started for zone %s", zone
);
884 if (ldb_transaction_commit(state
->samdb
) != LDB_SUCCESS
) {
885 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to commit a transaction for zone %s", zone
);
888 state
->log(ISC_LOG_INFO
, "samba_dlz: committed transaction on zone %s", zone
);
890 if (ldb_transaction_cancel(state
->samdb
) != LDB_SUCCESS
) {
891 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to cancel a transaction for zone %s", zone
);
894 state
->log(ISC_LOG_INFO
, "samba_dlz: cancelling transaction on zone %s", zone
);
897 talloc_free(state
->transaction_token
);
898 state
->transaction_token
= NULL
;
904 see if there is a SOA record for a zone
906 static bool b9_has_soa(struct dlz_bind9_data
*state
, struct ldb_dn
*dn
, const char *zone
)
908 const char *attrs
[] = { "dnsRecord", NULL
};
909 struct ldb_result
*res
;
910 struct ldb_message_element
*el
;
911 TALLOC_CTX
*tmp_ctx
= talloc_new(state
);
914 if (!ldb_dn_add_child_fmt(dn
, "DC=@,DC=%s", zone
)) {
915 talloc_free(tmp_ctx
);
919 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
,
920 attrs
, "objectClass=dnsNode");
921 if (ret
!= LDB_SUCCESS
) {
922 talloc_free(tmp_ctx
);
926 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
928 talloc_free(tmp_ctx
);
931 for (i
=0; i
<el
->num_values
; i
++) {
932 struct dnsp_DnssrvRpcRecord rec
;
933 enum ndr_err_code ndr_err
;
935 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], tmp_ctx
, &rec
,
936 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
937 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
940 if (rec
.wType
== DNS_TYPE_SOA
) {
941 talloc_free(tmp_ctx
);
946 talloc_free(tmp_ctx
);
951 configure a writeable zone
953 _PUBLIC_ isc_result_t
dlz_configure(dns_view_t
*view
, void *dbdata
)
955 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
960 state
->log(ISC_LOG_INFO
, "samba_dlz: starting configure");
961 if (state
->writeable_zone
== NULL
) {
962 state
->log(ISC_LOG_INFO
, "samba_dlz: no writeable_zone method available");
963 return ISC_R_FAILURE
;
966 tmp_ctx
= talloc_new(state
);
968 for (i
=0; zone_prefixes
[i
]; i
++) {
969 const char *attrs
[] = { "name", NULL
};
971 struct ldb_result
*res
;
973 dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(state
->samdb
));
975 talloc_free(tmp_ctx
);
976 return ISC_R_NOMEMORY
;
979 if (!ldb_dn_add_child_fmt(dn
, "%s", zone_prefixes
[i
])) {
980 talloc_free(tmp_ctx
);
981 return ISC_R_NOMEMORY
;
984 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_SUBTREE
,
985 attrs
, "objectClass=dnsZone");
986 if (ret
!= LDB_SUCCESS
) {
990 for (j
=0; j
<res
->count
; j
++) {
992 const char *zone
= ldb_msg_find_attr_as_string(res
->msgs
[j
], "name", NULL
);
993 struct ldb_dn
*zone_dn
;
998 zone_dn
= ldb_dn_copy(tmp_ctx
, dn
);
999 if (zone_dn
== NULL
) {
1000 talloc_free(tmp_ctx
);
1001 return ISC_R_NOMEMORY
;
1004 if (!b9_has_soa(state
, zone_dn
, zone
)) {
1007 result
= state
->writeable_zone(view
, zone
);
1008 if (result
!= ISC_R_SUCCESS
) {
1009 state
->log(ISC_LOG_ERROR
, "samba_dlz: Failed to configure zone '%s'",
1011 talloc_free(tmp_ctx
);
1014 state
->log(ISC_LOG_INFO
, "samba_dlz: configured writeable zone '%s'", zone
);
1018 talloc_free(tmp_ctx
);
1019 return ISC_R_SUCCESS
;
1022 static char *strlower(char *str
)
1026 for (i
=0; i
<strlen(str
); i
++) {
1027 str
[i
] = (char) tolower(str
[i
]);
1034 authorize a zone update
1036 _PUBLIC_ isc_boolean_t
dlz_ssumatch(const char *signer
, const char *name
, const char *tcpaddr
,
1037 const char *type
, const char *key
, uint32_t keydatalen
, uint8_t *keydata
,
1040 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1041 TALLOC_CTX
*tmp_ctx
;
1043 struct cli_credentials
*server_credentials
;
1044 char *keytab_name
, *username
;
1048 struct gensec_security
*gensec_ctx
;
1049 struct auth_session_info
*session_info
;
1051 isc_result_t result
;
1052 struct ldb_result
*res
;
1053 const char * attrs
[] = { NULL
};
1054 uint32_t access_mask
;
1056 tmp_ctx
= talloc_new(NULL
);
1057 if (tmp_ctx
== NULL
) {
1058 state
->log(ISC_LOG_ERROR
, "samba_dlz: no memory");
1062 ap_req
= data_blob_const(keydata
, keydatalen
);
1063 server_credentials
= cli_credentials_init(tmp_ctx
);
1064 if (!server_credentials
) {
1065 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to init server credentials");
1066 talloc_free(tmp_ctx
);
1070 cli_credentials_set_krb5_context(server_credentials
, state
->smb_krb5_ctx
);
1071 cli_credentials_set_conf(server_credentials
, state
->lp
);
1073 username
= talloc_asprintf(tmp_ctx
, "dns-%s", lpcfg_netbios_name(state
->lp
));
1074 username
= strlower(username
);
1075 cli_credentials_set_username(server_credentials
, username
, CRED_SPECIFIED
);
1076 talloc_free(username
);
1078 keytab_name
= talloc_asprintf(tmp_ctx
, "file:%s/dns.keytab",
1079 lpcfg_private_dir(state
->lp
));
1080 ret
= cli_credentials_set_keytab_name(server_credentials
, state
->lp
, keytab_name
,
1082 talloc_free(keytab_name
);
1084 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to obtain server credentials for %s",
1086 talloc_free(tmp_ctx
);
1090 nt_status
= gensec_server_start(tmp_ctx
,
1091 lpcfg_gensec_settings(tmp_ctx
, state
->lp
),
1093 if (!NT_STATUS_IS_OK(nt_status
)) {
1094 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to start gensec server");
1095 talloc_free(tmp_ctx
);
1099 gensec_set_credentials(gensec_ctx
, server_credentials
);
1100 gensec_set_target_service(gensec_ctx
, "dns");
1102 nt_status
= gensec_start_mech_by_name(gensec_ctx
, "spnego");
1103 if (!NT_STATUS_IS_OK(nt_status
)) {
1104 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to start spnego");
1105 talloc_free(tmp_ctx
);
1109 nt_status
= gensec_update(gensec_ctx
, tmp_ctx
, state
->ev_ctx
, ap_req
, &ap_req
);
1110 if (!NT_STATUS_IS_OK(nt_status
)) {
1111 state
->log(ISC_LOG_ERROR
, "samba_dlz: spnego update failed");
1112 talloc_free(tmp_ctx
);
1116 nt_status
= gensec_session_info(gensec_ctx
, tmp_ctx
, &session_info
);
1117 if (!NT_STATUS_IS_OK(nt_status
)) {
1118 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to create session info");
1119 talloc_free(tmp_ctx
);
1123 /* Get the DN from name */
1124 result
= b9_find_name_dn(state
, name
, tmp_ctx
, &dn
);
1125 if (result
!= ISC_R_SUCCESS
) {
1126 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to find name %s", name
);
1127 talloc_free(tmp_ctx
);
1131 /* make sure the dn exists, or find parent dn in case new object is being added */
1132 ldb_ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
,
1133 attrs
, "objectClass=dnsNode");
1134 if (ldb_ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1135 ldb_dn_remove_child_components(dn
, 1);
1136 access_mask
= SEC_STD_REQUIRED
| SEC_ADS_CREATE_CHILD
;
1138 } else if (ldb_ret
== LDB_SUCCESS
) {
1139 access_mask
= SEC_STD_REQUIRED
| SEC_ADS_SELF_WRITE
;
1142 talloc_free(tmp_ctx
);
1147 ldb_ret
= dsdb_check_access_on_dn(state
->samdb
, tmp_ctx
, dn
,
1148 session_info
->security_token
,
1150 if (ldb_ret
!= LDB_SUCCESS
) {
1151 state
->log(ISC_LOG_INFO
,
1152 "samba_dlz: disallowing update of signer=%s name=%s type=%s error=%s",
1153 signer
, name
, type
, ldb_strerror(ldb_ret
));
1154 talloc_free(tmp_ctx
);
1158 state
->log(ISC_LOG_INFO
, "samba_dlz: allowing update of signer=%s name=%s tcpaddr=%s type=%s key=%s",
1159 signer
, name
, tcpaddr
, type
, key
);
1161 talloc_free(tmp_ctx
);
1169 static isc_result_t
b9_add_record(struct dlz_bind9_data
*state
, const char *name
,
1171 struct dnsp_DnssrvRpcRecord
*rec
)
1173 struct ldb_message
*msg
;
1174 enum ndr_err_code ndr_err
;
1178 msg
= ldb_msg_new(rec
);
1180 return ISC_R_NOMEMORY
;
1183 ret
= ldb_msg_add_string(msg
, "objectClass", "dnsNode");
1184 if (ret
!= LDB_SUCCESS
) {
1185 return ISC_R_FAILURE
;
1188 ndr_err
= ndr_push_struct_blob(&v
, rec
, rec
, (ndr_push_flags_fn_t
)ndr_push_dnsp_DnssrvRpcRecord
);
1189 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1190 return ISC_R_FAILURE
;
1192 ret
= ldb_msg_add_value(msg
, "dnsRecord", &v
, NULL
);
1193 if (ret
!= LDB_SUCCESS
) {
1194 return ISC_R_FAILURE
;
1197 ret
= ldb_add(state
->samdb
, msg
);
1198 if (ret
!= LDB_SUCCESS
) {
1199 return ISC_R_FAILURE
;
1202 return ISC_R_SUCCESS
;
1206 see if two DNS names are the same
1208 static bool dns_name_equal(const char *name1
, const char *name2
)
1210 size_t len1
= strlen(name1
);
1211 size_t len2
= strlen(name2
);
1212 if (name1
[len1
-1] == '.') len1
--;
1213 if (name2
[len2
-1] == '.') len2
--;
1217 return strncasecmp_m(name1
, name2
, len1
) == 0;
1222 see if two dns records match
1224 static bool b9_record_match(struct dlz_bind9_data
*state
,
1225 struct dnsp_DnssrvRpcRecord
*rec1
, struct dnsp_DnssrvRpcRecord
*rec2
)
1227 if (rec1
->wType
!= rec2
->wType
) {
1230 /* see if this type is single valued */
1231 if (b9_single_valued(rec1
->wType
)) {
1235 /* see if the data matches */
1236 switch (rec1
->wType
) {
1238 return strcmp(rec1
->data
.ipv4
, rec2
->data
.ipv4
) == 0;
1240 return strcmp(rec1
->data
.ipv6
, rec2
->data
.ipv6
) == 0;
1241 case DNS_TYPE_CNAME
:
1242 return dns_name_equal(rec1
->data
.cname
, rec2
->data
.cname
);
1244 return strcmp(rec1
->data
.txt
, rec2
->data
.txt
) == 0;
1246 return strcmp(rec1
->data
.ptr
, rec2
->data
.ptr
) == 0;
1248 return dns_name_equal(rec1
->data
.ns
, rec2
->data
.ns
);
1251 return rec1
->data
.srv
.wPriority
== rec2
->data
.srv
.wPriority
&&
1252 rec1
->data
.srv
.wWeight
== rec2
->data
.srv
.wWeight
&&
1253 rec1
->data
.srv
.wPort
== rec2
->data
.srv
.wPort
&&
1254 dns_name_equal(rec1
->data
.srv
.nameTarget
, rec2
->data
.srv
.nameTarget
);
1257 return rec1
->data
.mx
.wPriority
== rec2
->data
.mx
.wPriority
&&
1258 dns_name_equal(rec1
->data
.mx
.nameTarget
, rec2
->data
.mx
.nameTarget
);
1260 case DNS_TYPE_HINFO
:
1261 return strcmp(rec1
->data
.hinfo
.cpu
, rec2
->data
.hinfo
.cpu
) == 0 &&
1262 strcmp(rec1
->data
.hinfo
.os
, rec2
->data
.hinfo
.os
) == 0;
1265 return dns_name_equal(rec1
->data
.soa
.mname
, rec2
->data
.soa
.mname
) &&
1266 dns_name_equal(rec1
->data
.soa
.rname
, rec2
->data
.soa
.rname
) &&
1267 rec1
->data
.soa
.serial
== rec2
->data
.soa
.serial
&&
1268 rec1
->data
.soa
.refresh
== rec2
->data
.soa
.refresh
&&
1269 rec1
->data
.soa
.retry
== rec2
->data
.soa
.retry
&&
1270 rec1
->data
.soa
.expire
== rec2
->data
.soa
.expire
&&
1271 rec1
->data
.soa
.minimum
== rec2
->data
.soa
.minimum
;
1273 state
->log(ISC_LOG_ERROR
, "samba b9_putrr: unhandled record type %u",
1283 add or modify a rdataset
1285 _PUBLIC_ isc_result_t
dlz_addrdataset(const char *name
, const char *rdatastr
, void *dbdata
, void *version
)
1287 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1288 struct dnsp_DnssrvRpcRecord
*rec
;
1290 isc_result_t result
;
1291 struct ldb_result
*res
;
1292 const char *attrs
[] = { "dnsRecord", NULL
};
1294 struct ldb_message_element
*el
;
1295 enum ndr_err_code ndr_err
;
1298 if (state
->transaction_token
!= (void*)version
) {
1299 state
->log(ISC_LOG_INFO
, "samba_dlz: bad transaction version");
1300 return ISC_R_FAILURE
;
1303 rec
= talloc_zero(state
, struct dnsp_DnssrvRpcRecord
);
1305 return ISC_R_NOMEMORY
;
1308 unix_to_nt_time(&t
, time(NULL
));
1309 t
/= 10*1000*1000; /* convert to seconds (NT time is in 100ns units) */
1310 t
/= 3600; /* convert to hours */
1312 rec
->rank
= DNS_RANK_ZONE
;
1313 rec
->dwSerial
= state
->soa_serial
;
1314 rec
->dwTimeStamp
= (uint32_t)t
;
1316 if (!b9_parse(state
, rdatastr
, rec
)) {
1317 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to parse rdataset '%s'", rdatastr
);
1319 return ISC_R_FAILURE
;
1322 /* find the DN of the record */
1323 result
= b9_find_name_dn(state
, name
, rec
, &dn
);
1324 if (result
!= ISC_R_SUCCESS
) {
1329 /* get any existing records */
1330 ret
= ldb_search(state
->samdb
, rec
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsNode");
1331 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1332 result
= b9_add_record(state
, name
, dn
, rec
);
1334 if (result
== ISC_R_SUCCESS
) {
1335 state
->log(ISC_LOG_ERROR
, "samba_dlz: added %s %s", name
, rdatastr
);
1340 /* there are existing records. We need to see if this will
1341 * replace a record or add to it
1343 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1345 state
->log(ISC_LOG_ERROR
, "samba_dlz: no dnsRecord attribute for %s",
1346 ldb_dn_get_linearized(dn
));
1348 return ISC_R_FAILURE
;
1351 for (i
=0; i
<el
->num_values
; i
++) {
1352 struct dnsp_DnssrvRpcRecord rec2
;
1354 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], rec
, &rec2
,
1355 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1356 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1357 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
1358 ldb_dn_get_linearized(dn
));
1360 return ISC_R_FAILURE
;
1363 if (b9_record_match(state
, rec
, &rec2
)) {
1367 if (i
== el
->num_values
) {
1368 /* adding a new value */
1369 el
->values
= talloc_realloc(el
, el
->values
, struct ldb_val
, el
->num_values
+1);
1370 if (el
->values
== NULL
) {
1372 return ISC_R_NOMEMORY
;
1377 ndr_err
= ndr_push_struct_blob(&el
->values
[i
], rec
, rec
,
1378 (ndr_push_flags_fn_t
)ndr_push_dnsp_DnssrvRpcRecord
);
1379 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1380 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to push dnsRecord for %s",
1381 ldb_dn_get_linearized(dn
));
1383 return ISC_R_FAILURE
;
1386 /* modify the record */
1387 el
->flags
= LDB_FLAG_MOD_REPLACE
;
1388 ret
= ldb_modify(state
->samdb
, res
->msgs
[0]);
1389 if (ret
!= LDB_SUCCESS
) {
1390 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to modify %s - %s",
1391 ldb_dn_get_linearized(dn
), ldb_errstring(state
->samdb
));
1393 return ISC_R_FAILURE
;
1396 state
->log(ISC_LOG_INFO
, "samba_dlz: added rdataset %s '%s'", name
, rdatastr
);
1399 return ISC_R_SUCCESS
;
1405 _PUBLIC_ isc_result_t
dlz_subrdataset(const char *name
, const char *rdatastr
, void *dbdata
, void *version
)
1407 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1408 struct dnsp_DnssrvRpcRecord
*rec
;
1410 isc_result_t result
;
1411 struct ldb_result
*res
;
1412 const char *attrs
[] = { "dnsRecord", NULL
};
1414 struct ldb_message_element
*el
;
1415 enum ndr_err_code ndr_err
;
1417 if (state
->transaction_token
!= (void*)version
) {
1418 state
->log(ISC_LOG_INFO
, "samba_dlz: bad transaction version");
1419 return ISC_R_FAILURE
;
1422 rec
= talloc_zero(state
, struct dnsp_DnssrvRpcRecord
);
1424 return ISC_R_NOMEMORY
;
1427 if (!b9_parse(state
, rdatastr
, rec
)) {
1428 state
->log(ISC_LOG_INFO
, "samba_dlz: failed to parse rdataset '%s'", rdatastr
);
1430 return ISC_R_FAILURE
;
1433 /* find the DN of the record */
1434 result
= b9_find_name_dn(state
, name
, rec
, &dn
);
1435 if (result
!= ISC_R_SUCCESS
) {
1440 /* get the existing records */
1441 ret
= ldb_search(state
->samdb
, rec
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsNode");
1442 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1444 return ISC_R_NOTFOUND
;
1447 /* there are existing records. We need to see if any match
1449 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1450 if (el
== NULL
|| el
->num_values
== 0) {
1451 state
->log(ISC_LOG_ERROR
, "samba_dlz: no dnsRecord attribute for %s",
1452 ldb_dn_get_linearized(dn
));
1454 return ISC_R_FAILURE
;
1457 for (i
=0; i
<el
->num_values
; i
++) {
1458 struct dnsp_DnssrvRpcRecord rec2
;
1460 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], rec
, &rec2
,
1461 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1462 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1463 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
1464 ldb_dn_get_linearized(dn
));
1466 return ISC_R_FAILURE
;
1469 if (b9_record_match(state
, rec
, &rec2
)) {
1473 if (i
== el
->num_values
) {
1475 return ISC_R_NOTFOUND
;
1478 if (i
< el
->num_values
-1) {
1479 memmove(&el
->values
[i
], &el
->values
[i
+1], sizeof(el
->values
[0])*((el
->num_values
-1)-i
));
1483 if (el
->num_values
== 0) {
1484 /* delete the record */
1485 ret
= ldb_delete(state
->samdb
, dn
);
1487 /* modify the record */
1488 el
->flags
= LDB_FLAG_MOD_REPLACE
;
1489 ret
= ldb_modify(state
->samdb
, res
->msgs
[0]);
1491 if (ret
!= LDB_SUCCESS
) {
1492 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to modify %s - %s",
1493 ldb_dn_get_linearized(dn
), ldb_errstring(state
->samdb
));
1495 return ISC_R_FAILURE
;
1498 state
->log(ISC_LOG_INFO
, "samba_dlz: subtracted rdataset %s '%s'", name
, rdatastr
);
1501 return ISC_R_SUCCESS
;
1506 delete all records of the given type
1508 _PUBLIC_ isc_result_t
dlz_delrdataset(const char *name
, const char *type
, void *dbdata
, void *version
)
1510 struct dlz_bind9_data
*state
= talloc_get_type_abort(dbdata
, struct dlz_bind9_data
);
1511 TALLOC_CTX
*tmp_ctx
;
1513 isc_result_t result
;
1514 struct ldb_result
*res
;
1515 const char *attrs
[] = { "dnsRecord", NULL
};
1517 struct ldb_message_element
*el
;
1518 enum ndr_err_code ndr_err
;
1519 enum dns_record_type dns_type
;
1522 if (state
->transaction_token
!= (void*)version
) {
1523 state
->log(ISC_LOG_INFO
, "samba_dlz: bad transaction version");
1524 return ISC_R_FAILURE
;
1527 if (!b9_dns_type(type
, &dns_type
)) {
1528 state
->log(ISC_LOG_INFO
, "samba_dlz: bad dns type %s in delete", type
);
1529 return ISC_R_FAILURE
;
1532 tmp_ctx
= talloc_new(state
);
1534 /* find the DN of the record */
1535 result
= b9_find_name_dn(state
, name
, tmp_ctx
, &dn
);
1536 if (result
!= ISC_R_SUCCESS
) {
1537 talloc_free(tmp_ctx
);
1541 /* get the existing records */
1542 ret
= ldb_search(state
->samdb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, "objectClass=dnsNode");
1543 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
1544 talloc_free(tmp_ctx
);
1545 return ISC_R_NOTFOUND
;
1548 /* there are existing records. We need to see if any match the type
1550 el
= ldb_msg_find_element(res
->msgs
[0], "dnsRecord");
1551 if (el
== NULL
|| el
->num_values
== 0) {
1552 talloc_free(tmp_ctx
);
1553 return ISC_R_NOTFOUND
;
1556 for (i
=0; i
<el
->num_values
; i
++) {
1557 struct dnsp_DnssrvRpcRecord rec2
;
1559 ndr_err
= ndr_pull_struct_blob(&el
->values
[i
], tmp_ctx
, &rec2
,
1560 (ndr_pull_flags_fn_t
)ndr_pull_dnsp_DnssrvRpcRecord
);
1561 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1562 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to parse dnsRecord for %s",
1563 ldb_dn_get_linearized(dn
));
1564 talloc_free(tmp_ctx
);
1565 return ISC_R_FAILURE
;
1568 if (dns_type
== rec2
.wType
) {
1569 if (i
< el
->num_values
-1) {
1570 memmove(&el
->values
[i
], &el
->values
[i
+1],
1571 sizeof(el
->values
[0])*((el
->num_values
-1)-i
));
1580 talloc_free(tmp_ctx
);
1581 return ISC_R_FAILURE
;
1584 if (el
->num_values
== 0) {
1585 /* delete the record */
1586 ret
= ldb_delete(state
->samdb
, dn
);
1588 /* modify the record */
1589 el
->flags
= LDB_FLAG_MOD_REPLACE
;
1590 ret
= ldb_modify(state
->samdb
, res
->msgs
[0]);
1592 if (ret
!= LDB_SUCCESS
) {
1593 state
->log(ISC_LOG_ERROR
, "samba_dlz: failed to delete type %s in %s - %s",
1594 type
, ldb_dn_get_linearized(dn
), ldb_errstring(state
->samdb
));
1595 talloc_free(tmp_ctx
);
1596 return ISC_R_FAILURE
;
1599 state
->log(ISC_LOG_INFO
, "samba_dlz: deleted rdataset %s of type %s", name
, type
);
1601 talloc_free(tmp_ctx
);
1602 return ISC_R_SUCCESS
;