source4/dns_server/dns_update.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DNS server handler for update requests
   5
   6    Copyright (C) 2010 Kai Blin  <kai@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/util/ntstatus.h"
  24 #include "librpc/ndr/libndr.h"
  25 #include "librpc/gen_ndr/ndr_dns.h"
  26 #include "librpc/gen_ndr/ndr_dnsp.h"
  27 #include <ldb.h>
  28 #include "param/param.h"
  29 #include "param/loadparm.h"
  30 #include "dsdb/samdb/samdb.h"
  31 #include "dsdb/common/util.h"
  32 #include "smbd/service_task.h"
  33 #include "dns_server/dns_server.h"
  34
  35 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
  36                              const struct dns_res_rec *rrec,
  37                              struct dnsp_DnssrvRpcRecord *r);
  38
  39 static WERROR check_one_prerequisite(struct dns_server *dns,
  40                                      TALLOC_CTX *mem_ctx,
  41                                      const struct dns_name_question *zone,
  42                                      const struct dns_res_rec *pr,
  43                                      bool *final_result)
  44 {
  45         bool match;
  46         WERROR werror;
  47         struct ldb_dn *dn;
  48         uint16_t i;
  49         bool found = false;
  50         struct dnsp_DnssrvRpcRecord *rec = NULL;
  51         struct dnsp_DnssrvRpcRecord *ans;
  52         uint16_t acount;
  53
  54         size_t host_part_len = 0;
  55
  56         *final_result = true;
  57
  58         if (pr->ttl != 0) {
  59                 return DNS_ERR(FORMAT_ERROR);
  60         }
  61
  62         match = dns_name_match(zone->name, pr->name, &host_part_len);
  63         if (!match) {
  64                 return DNS_ERR(NOTZONE);
  65         }
  66
  67         werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
  68         W_ERROR_NOT_OK_RETURN(werror);
  69
  70         if (pr->rr_class == DNS_QCLASS_ANY) {
  71
  72                 if (pr->length != 0) {
  73                         return DNS_ERR(FORMAT_ERROR);
  74                 }
  75
  76
  77                 if (pr->rr_type == DNS_QTYPE_ALL) {
  78                         /*
  79                          */
  80                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
  81                         W_ERROR_NOT_OK_RETURN(werror);
  82
  83                         if (acount == 0) {
  84                                 return DNS_ERR(NAME_ERROR);
  85                         }
  86                 } else {
  87                         /*
  88                          */
  89                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
  90                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
  91                                 return DNS_ERR(NXRRSET);
  92                         }
  93                         W_ERROR_NOT_OK_RETURN(werror);
  94
  95                         for (i = 0; i < acount; i++) {
  96                                 if (ans[i].wType == pr->rr_type) {
  97                                         found = true;
  98                                         break;
  99                                 }
 100                         }
 101                         if (!found) {
 102                                 return DNS_ERR(NXRRSET);
 103                         }
 104                 }
 105
 106                 /*
 107                  * RFC2136 3.2.5 doesn't actually mention the need to return
 108                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 109                  * later on. This also matches Microsoft DNS behavior.
 110                  */
 111                 return WERR_OK;
 112         }
 113
 114         if (pr->rr_class == DNS_QCLASS_NONE) {
 115                 if (pr->length != 0) {
 116                         return DNS_ERR(FORMAT_ERROR);
 117                 }
 118
 119                 if (pr->rr_type == DNS_QTYPE_ALL) {
 120                         /*
 121                          */
 122                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 123                         if (W_ERROR_EQUAL(werror, WERR_OK)) {
 124                                 return DNS_ERR(YXDOMAIN);
 125                         }
 126                 } else {
 127                         /*
 128                          */
 129                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 130                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 131                                 werror = WERR_OK;
 132                                 ans = NULL;
 133                                 acount = 0;
 134                         }
 135
 136                         for (i = 0; i < acount; i++) {
 137                                 if (ans[i].wType == pr->rr_type) {
 138                                         found = true;
 139                                         break;
 140                                 }
 141                         }
 142                         if (found) {
 143                                 return DNS_ERR(YXRRSET);
 144                         }
 145                 }
 146
 147                 /*
 148                  * RFC2136 3.2.5 doesn't actually mention the need to return
 149                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 150                  * later on. This also matches Microsoft DNS behavior.
 151                  */
 152                 return WERR_OK;
 153         }
 154
 155         if (pr->rr_class != zone->question_class) {
 156                 return DNS_ERR(FORMAT_ERROR);
 157         }
 158
 159         *final_result = false;
 160
 161         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 162         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 163                 return DNS_ERR(NXRRSET);
 164         }
 165         W_ERROR_NOT_OK_RETURN(werror);
 166
 167         rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
 168         W_ERROR_HAVE_NO_MEMORY(rec);
 169
 170         werror = dns_rr_to_dnsp(rec, pr, rec);
 171         W_ERROR_NOT_OK_RETURN(werror);
 172
 173         for (i = 0; i < acount; i++) {
 174                 if (dns_records_match(rec, &ans[i])) {
 175                         found = true;
 176                         break;
 177                 }
 178         }
 179
 180         if (!found) {
 181                 return DNS_ERR(NXRRSET);
 182         }
 183
 184         return WERR_OK;
 185 }
 186
 187 static WERROR check_prerequisites(struct dns_server *dns,
 188                                   TALLOC_CTX *mem_ctx,
 189                                   const struct dns_name_question *zone,
 190                                   const struct dns_res_rec *prereqs, uint16_t count)
 191 {
 192         uint16_t i;
 193         WERROR final_error = WERR_OK;
 194
 195         for (i = 0; i < count; i++) {
 196                 bool final;
 197                 WERROR werror;
 198
 199                 werror = check_one_prerequisite(dns, mem_ctx, zone,
 200                                                 &prereqs[i], &final);
 201                 if (!W_ERROR_IS_OK(werror)) {
 202                         if (final) {
 203                                 return werror;
 204                         }
 205                         if (W_ERROR_IS_OK(final_error)) {
 206                                 final_error = werror;
 207                         }
 208                 }
 209         }
 210
 211         if (!W_ERROR_IS_OK(final_error)) {
 212                 return final_error;
 213         }
 214
 215         return WERR_OK;
 216 }
 217
 218 static WERROR update_prescan(const struct dns_name_question *zone,
 219                              const struct dns_res_rec *updates, uint16_t count)
 220 {
 221         const struct dns_res_rec *r;
 222         uint16_t i;
 223         size_t host_part_len;
 224         bool match;
 225
 226         for (i = 0; i < count; i++) {
 227                 r = &updates[i];
 228                 match = dns_name_match(zone->name, r->name, &host_part_len);
 229                 if (!match) {
 230                         return DNS_ERR(NOTZONE);
 231                 }
 232                 if (zone->question_class == r->rr_class) {
 233                         if (r->rr_type == DNS_QTYPE_ALL) {
 234                                 return DNS_ERR(FORMAT_ERROR);
 235                         }
 236                         if (r->rr_type == DNS_QTYPE_AXFR) {
 237                                 return DNS_ERR(FORMAT_ERROR);
 238                         }
 239                         if (r->rr_type == DNS_QTYPE_MAILB) {
 240                                 return DNS_ERR(FORMAT_ERROR);
 241                         }
 242                         if (r->rr_type == DNS_QTYPE_MAILA) {
 243                                 return DNS_ERR(FORMAT_ERROR);
 244                         }
 245                 } else if (r->rr_class == DNS_QCLASS_ANY) {
 246                         if (r->ttl != 0) {
 247                                 return DNS_ERR(FORMAT_ERROR);
 248                         }
 249                         if (r->length != 0) {
 250                                 return DNS_ERR(FORMAT_ERROR);
 251                         }
 252                         if (r->rr_type == DNS_QTYPE_AXFR) {
 253                                 return DNS_ERR(FORMAT_ERROR);
 254                         }
 255                         if (r->rr_type == DNS_QTYPE_MAILB) {
 256                                 return DNS_ERR(FORMAT_ERROR);
 257                         }
 258                         if (r->rr_type == DNS_QTYPE_MAILA) {
 259                                 return DNS_ERR(FORMAT_ERROR);
 260                         }
 261                 } else if (r->rr_class == DNS_QCLASS_NONE) {
 262                         if (r->ttl != 0) {
 263                                 return DNS_ERR(FORMAT_ERROR);
 264                         }
 265                         if (r->rr_type == DNS_QTYPE_ALL) {
 266                                 return DNS_ERR(FORMAT_ERROR);
 267                         }
 268                         if (r->rr_type == DNS_QTYPE_AXFR) {
 269                                 return DNS_ERR(FORMAT_ERROR);
 270                         }
 271                         if (r->rr_type == DNS_QTYPE_MAILB) {
 272                                 return DNS_ERR(FORMAT_ERROR);
 273                         }
 274                         if (r->rr_type == DNS_QTYPE_MAILA) {
 275                                 return DNS_ERR(FORMAT_ERROR);
 276                         }
 277                 } else {
 278                         return DNS_ERR(FORMAT_ERROR);
 279                 }
 280         }
 281         return WERR_OK;
 282 }
 283
 284 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
 285                              const struct dns_res_rec *rrec,
 286                              struct dnsp_DnssrvRpcRecord *r)
 287 {
 288         char *tmp;
 289         char *txt_record_txt;
 290         char *saveptr = NULL;
 291
 292         if (rrec->rr_type == DNS_QTYPE_ALL) {
 293                 return DNS_ERR(FORMAT_ERROR);
 294         }
 295
 296         ZERO_STRUCTP(r);
 297
 298         r->wType = rrec->rr_type;
 299         r->dwTtlSeconds = rrec->ttl;
 300         r->rank = DNS_RANK_ZONE;
 301         /* TODO: Autogenerate this somehow */
 302         r->dwSerial = 110;
 303
 304         /* If we get QCLASS_ANY, we're done here */
 305         if (rrec->rr_class == DNS_QCLASS_ANY) {
 306                 goto done;
 307         }
 308
 309         switch(rrec->rr_type) {
 310         case DNS_QTYPE_A:
 311                 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
 312                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
 313                 break;
 314         case DNS_QTYPE_AAAA:
 315                 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
 316                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
 317                 break;
 318         case DNS_QTYPE_NS:
 319                 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
 320                 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
 321                 break;
 322         case DNS_QTYPE_CNAME:
 323                 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
 324                 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
 325                 break;
 326         case DNS_QTYPE_SRV:
 327                 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
 328                 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
 329                 r->data.srv.wPort = rrec->rdata.srv_record.port;
 330                 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
 331                                 rrec->rdata.srv_record.target);
 332                 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
 333                 break;
 334         case DNS_QTYPE_PTR:
 335                 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
 336                 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
 337                 break;
 338         case DNS_QTYPE_MX:
 339                 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
 340                 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
 341                                 rrec->rdata.mx_record.exchange);
 342                 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
 343                 break;
 344         case DNS_QTYPE_TXT:
 345                 r->data.txt.count = 0;
 346                 r->data.txt.str = talloc_array(mem_ctx, const char *,
 347                                                r->data.txt.count);
 348                 W_ERROR_HAVE_NO_MEMORY(r->data.txt.str);
 349
 350                 txt_record_txt = talloc_strdup(r->data.txt.str,
 351                                                rrec->rdata.txt_record.txt);
 352                 W_ERROR_HAVE_NO_MEMORY(txt_record_txt);
 353
 354                 tmp = strtok_r(txt_record_txt, "\"", &saveptr);
 355                 while (tmp) {
 356                         if (strcmp(tmp, " ") == 0) {
 357                                 tmp = strtok_r(NULL, "\"", &saveptr);
 358                                 continue;
 359                         }
 360                         r->data.txt.str = talloc_realloc(mem_ctx, r->data.txt.str, const char *,
 361                                                         r->data.txt.count+1);
 362                         r->data.txt.str[r->data.txt.count] = talloc_strdup(r->data.txt.str, tmp);
 363                         W_ERROR_HAVE_NO_MEMORY(r->data.txt.str[r->data.txt.count]);
 364
 365                         r->data.txt.count++;
 366                         tmp = strtok_r(NULL, "\"", &saveptr);
 367                 }
 368
 369                 break;
 370         default:
 371                 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
 372                 return DNS_ERR(NOT_IMPLEMENTED);
 373         }
 374
 375 done:
 376
 377         return WERR_OK;
 378 }
 379
 380
 381 static WERROR handle_one_update(struct dns_server *dns,
 382                                 TALLOC_CTX *mem_ctx,
 383                                 const struct dns_name_question *zone,
 384                                 const struct dns_res_rec *update)
 385 {
 386         struct dnsp_DnssrvRpcRecord *recs = NULL;
 387         uint16_t rcount = 0;
 388         struct ldb_dn *dn;
 389         uint16_t i;
 390         WERROR werror;
 391         bool needs_add = false;
 392
 393         DEBUG(2, ("Looking at record: \n"));
 394         if (DEBUGLVL(2)) {
 395                 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
 396         }
 397
 398         switch (update->rr_type) {
 399         case DNS_QTYPE_A:
 400         case DNS_QTYPE_NS:
 401         case DNS_QTYPE_CNAME:
 402         case DNS_QTYPE_SOA:
 403         case DNS_QTYPE_PTR:
 404         case DNS_QTYPE_MX:
 405         case DNS_QTYPE_AAAA:
 406         case DNS_QTYPE_SRV:
 407         case DNS_QTYPE_TXT:
 408                 break;
 409         default:
 410                 DEBUG(0, ("Can't handle updates of type %u yet\n",
 411                           update->rr_type));
 412                 return DNS_ERR(NOT_IMPLEMENTED);
 413         }
 414
 415         werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
 416         W_ERROR_NOT_OK_RETURN(werror);
 417
 418         werror = dns_lookup_records(dns, mem_ctx, dn, &recs, &rcount);
 419         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 420                 recs = NULL;
 421                 rcount = 0;
 422                 needs_add = true;
 423                 werror = WERR_OK;
 424         }
 425         W_ERROR_NOT_OK_RETURN(werror);
 426
 427         if (update->rr_class == zone->question_class) {
 428                 if (update->rr_type == DNS_QTYPE_CNAME) {
 429                         /*
 430                          * If there is a record in the directory
 431                          * that's not a CNAME, ignore update
 432                          */
 433                         for (i = 0; i < rcount; i++) {
 434                                 if (recs[i].wType != DNS_TYPE_CNAME) {
 435                                         DEBUG(0, ("Skipping update\n"));
 436                                         return WERR_OK;
 437                                 }
 438                                 break;
 439                         }
 440
 441                         /*
 442                          * There should be no entries besides one CNAME record
 443                          * per name, so replace everything with the new CNAME
 444                          */
 445
 446                         rcount = 1;
 447                         recs = talloc_realloc(mem_ctx, recs,
 448                                         struct dnsp_DnssrvRpcRecord, rcount);
 449                         W_ERROR_HAVE_NO_MEMORY(recs);
 450
 451                         werror = dns_rr_to_dnsp(recs, update, &recs[0]);
 452                         W_ERROR_NOT_OK_RETURN(werror);
 453
 454                         werror = dns_replace_records(dns, mem_ctx, dn,
 455                                                      needs_add, recs, rcount);
 456                         W_ERROR_NOT_OK_RETURN(werror);
 457
 458                         return WERR_OK;
 459                 } else {
 460                         /*
 461                          * If there is a CNAME record for this name,
 462                          * ignore update
 463                          */
 464                         for (i = 0; i < rcount; i++) {
 465                                 if (recs[i].wType == DNS_TYPE_CNAME) {
 466                                         DEBUG(0, ("Skipping update\n"));
 467                                         return WERR_OK;
 468                                 }
 469                         }
 470                 }
 471                 if (update->rr_type == DNS_QTYPE_SOA) {
 472                         bool found = false;
 473
 474                         /*
 475                          * If the zone has no SOA record?? or update's
 476                          * serial number is smaller than existing SOA's,
 477                          * ignore update
 478                          */
 479                         for (i = 0; i < rcount; i++) {
 480                                 if (recs[i].wType == DNS_TYPE_SOA) {
 481                                         uint16_t n, o;
 482
 483                                         n = update->rdata.soa_record.serial;
 484                                         o = recs[i].data.soa.serial;
 485                                         /*
 486                                          * TODO: Implement RFC 1982 comparison
 487                                          * logic for RFC2136
 488                                          */
 489                                         if (n <= o) {
 490                                                 DEBUG(0, ("Skipping update\n"));
 491                                                 return WERR_OK;
 492                                         }
 493                                         found = true;
 494                                         break;
 495                                 }
 496                         }
 497                         if (!found) {
 498                                 DEBUG(0, ("Skipping update\n"));
 499                                 return WERR_OK;
 500                         }
 501
 502                         werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
 503                         W_ERROR_NOT_OK_RETURN(werror);
 504
 505                         for (i++; i < rcount; i++) {
 506                                 if (recs[i].wType != DNS_TYPE_SOA) {
 507                                         continue;
 508                                 }
 509
 510                                 ZERO_STRUCT(recs[i]);
 511                         }
 512
 513                         werror = dns_replace_records(dns, mem_ctx, dn,
 514                                                      needs_add, recs, rcount);
 515                         W_ERROR_NOT_OK_RETURN(werror);
 516
 517                         return WERR_OK;
 518                 }
 519
 520                 recs = talloc_realloc(mem_ctx, recs,
 521                                 struct dnsp_DnssrvRpcRecord, rcount+1);
 522                 W_ERROR_HAVE_NO_MEMORY(recs);
 523
 524                 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
 525                 W_ERROR_NOT_OK_RETURN(werror);
 526
 527                 for (i = 0; i < rcount; i++) {
 528                         if (!dns_records_match(&recs[i], &recs[rcount])) {
 529                                 continue;
 530                         }
 531
 532                         recs[i] = recs[rcount];
 533
 534                         werror = dns_replace_records(dns, mem_ctx, dn,
 535                                                      needs_add, recs, rcount);
 536                         W_ERROR_NOT_OK_RETURN(werror);
 537
 538                         return WERR_OK;
 539                 }
 540
 541                 werror = dns_replace_records(dns, mem_ctx, dn,
 542                                              needs_add, recs, rcount+1);
 543                 W_ERROR_NOT_OK_RETURN(werror);
 544
 545                 return WERR_OK;
 546         } else if (update->rr_class == DNS_QCLASS_ANY) {
 547                 if (update->rr_type == DNS_QTYPE_ALL) {
 548                         if (dns_name_equal(update->name, zone->name)) {
 549                                 for (i = 0; i < rcount; i++) {
 550
 551                                         if (recs[i].wType == DNS_TYPE_SOA) {
 552                                                 continue;
 553                                         }
 554
 555                                         if (recs[i].wType == DNS_TYPE_NS) {
 556                                                 continue;
 557                                         }
 558
 559                                         ZERO_STRUCT(recs[i]);
 560                                 }
 561
 562                         } else {
 563                                 for (i = 0; i < rcount; i++) {
 564                                         ZERO_STRUCT(recs[i]);
 565                                 }
 566                         }
 567
 568                 } else if (dns_name_equal(update->name, zone->name)) {
 569
 570                         if (update->rr_type == DNS_QTYPE_SOA) {
 571                                 return WERR_OK;
 572                         }
 573
 574                         if (update->rr_type == DNS_QTYPE_NS) {
 575                                 return WERR_OK;
 576                         }
 577                 }
 578                 for (i = 0; i < rcount; i++) {
 579                         if (recs[i].wType == update->rr_type) {
 580                                 ZERO_STRUCT(recs[i]);
 581                         }
 582                 }
 583
 584                 werror = dns_replace_records(dns, mem_ctx, dn,
 585                                              needs_add, recs, rcount);
 586                 W_ERROR_NOT_OK_RETURN(werror);
 587
 588                 return WERR_OK;
 589         } else if (update->rr_class == DNS_QCLASS_NONE) {
 590                 struct dnsp_DnssrvRpcRecord *del_rec;
 591
 592                 if (update->rr_type == DNS_QTYPE_SOA) {
 593                         return WERR_OK;
 594                 }
 595                 if (update->rr_type == DNS_QTYPE_NS) {
 596                         bool found = false;
 597                         struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
 598                                                 struct dnsp_DnssrvRpcRecord);
 599                         W_ERROR_HAVE_NO_MEMORY(ns_rec);
 600
 601
 602                         werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
 603                         W_ERROR_NOT_OK_RETURN(werror);
 604
 605                         for (i = 0; i < rcount; i++) {
 606                                 if (dns_records_match(ns_rec, &recs[i])) {
 607                                         found = true;
 608                                         break;
 609                                 }
 610                         }
 611                         if (found) {
 612                                 return WERR_OK;
 613                         }
 614                 }
 615
 616                 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
 617                 W_ERROR_HAVE_NO_MEMORY(del_rec);
 618
 619                 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
 620                 W_ERROR_NOT_OK_RETURN(werror);
 621
 622                 for (i = 0; i < rcount; i++) {
 623                         if (dns_records_match(del_rec, &recs[i])) {
 624                                 ZERO_STRUCT(recs[i]);
 625                         }
 626                 }
 627
 628                 werror = dns_replace_records(dns, mem_ctx, dn,
 629                                              needs_add, recs, rcount);
 630                 W_ERROR_NOT_OK_RETURN(werror);
 631         }
 632
 633         return WERR_OK;
 634 }
 635
 636 static WERROR handle_updates(struct dns_server *dns,
 637                              TALLOC_CTX *mem_ctx,
 638                              const struct dns_name_question *zone,
 639                              const struct dns_res_rec *prereqs, uint16_t pcount,
 640                              struct dns_res_rec *updates, uint16_t upd_count)
 641 {
 642         struct ldb_dn *zone_dn = NULL;
 643         WERROR werror = WERR_OK;
 644         int ret;
 645         uint16_t ri;
 646         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 647
 648         werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
 649         W_ERROR_NOT_OK_RETURN(werror);
 650
 651         ret = ldb_transaction_start(dns->samdb);
 652         if (ret != LDB_SUCCESS) {
 653                 return DNS_ERR(SERVER_FAILURE);
 654         }
 655
 656         werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
 657         W_ERROR_NOT_OK_GOTO(werror, failed);
 658
 659         DEBUG(0, ("update count is %u\n", upd_count));
 660
 661         for (ri = 0; ri < upd_count; ri++) {
 662                 werror = handle_one_update(dns, tmp_ctx, zone,
 663                                            &updates[ri]);
 664                 W_ERROR_NOT_OK_GOTO(werror, failed);
 665         }
 666
 667         ldb_transaction_commit(dns->samdb);
 668         TALLOC_FREE(tmp_ctx);
 669         return WERR_OK;
 670
 671 failed:
 672         ldb_transaction_cancel(dns->samdb);
 673         TALLOC_FREE(tmp_ctx);
 674         return werror;
 675
 676 }
 677
 678 WERROR dns_server_process_update(struct dns_server *dns,
 679                                  struct dns_request_state *state,
 680                                  TALLOC_CTX *mem_ctx,
 681                                  struct dns_name_packet *in,
 682                                  struct dns_res_rec **prereqs,    uint16_t *prereq_count,
 683                                  struct dns_res_rec **updates,    uint16_t *update_count,
 684                                  struct dns_res_rec **additional, uint16_t *arcount)
 685 {
 686         struct dns_name_question *zone;
 687         const struct dns_server_zone *z;
 688         size_t host_part_len = 0;
 689         WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
 690
 691         if (in->qdcount != 1) {
 692                 return DNS_ERR(FORMAT_ERROR);
 693         }
 694
 695         zone = &in->questions[0];
 696
 697         if (zone->question_class != DNS_QCLASS_IN &&
 698             zone->question_class != DNS_QCLASS_ANY) {
 699                 return DNS_ERR(NOT_IMPLEMENTED);
 700         }
 701
 702         if (zone->question_type != DNS_QTYPE_SOA) {
 703                 return DNS_ERR(FORMAT_ERROR);
 704         }
 705
 706         DEBUG(2, ("Got a dns update request.\n"));
 707
 708         for (z = dns->zones; z != NULL; z = z->next) {
 709                 bool match;
 710
 711                 match = dns_name_match(z->name, zone->name, &host_part_len);
 712                 if (match) {
 713                         break;
 714                 }
 715         }
 716
 717         if (z == NULL) {
 718                 DEBUG(0, ("We're not authoritative for this zone\n"));
 719                 return DNS_ERR(NOTAUTH);
 720         }
 721
 722         if (host_part_len != 0) {
 723                 /* TODO: We need to delegate this one */
 724                 DEBUG(0, ("Would have to delegate zones.\n"));
 725                 return DNS_ERR(NOT_IMPLEMENTED);
 726         }
 727
 728         *prereq_count = in->ancount;
 729         *prereqs = in->answers;
 730         werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
 731                                      *prereq_count);
 732         W_ERROR_NOT_OK_RETURN(werror);
 733
 734         /* TODO: Check if update is allowed, we probably want "always",
 735          * key-based GSSAPI, key-based bind-style TSIG and "never" as
 736          * smb.conf options. */
 737         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
 738                 DEBUG(0, ("Update not allowed.\n"));
 739                 return DNS_ERR(REFUSED);
 740         }
 741         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_SIGNED &&
 742             state->authenticated == false ) {
 743                 DEBUG(0, ("Update not allowed for unsigned packet.\n"));
 744                 return DNS_ERR(REFUSED);
 745         }
 746
 747         *update_count = in->nscount;
 748         *updates = in->nsrecs;
 749         werror = update_prescan(in->questions, *updates, *update_count);
 750         W_ERROR_NOT_OK_RETURN(werror);
 751
 752
 753         werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
 754                                 *prereq_count, *updates, *update_count);
 755         W_ERROR_NOT_OK_RETURN(werror);
 756
 757         return werror;
 758 }