source4/dns_server/dns_update.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DNS server handler for update requests
   5
   6    Copyright (C) 2010 Kai Blin  <kai@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/util/ntstatus.h"
  24 #include "librpc/ndr/libndr.h"
  25 #include "librpc/gen_ndr/ndr_dns.h"
  26 #include "librpc/gen_ndr/ndr_dnsp.h"
  27 #include <ldb.h>
  28 #include "param/param.h"
  29 #include "param/loadparm.h"
  30 #include "dsdb/samdb/samdb.h"
  31 #include "dsdb/common/util.h"
  32 #include "smbd/service_task.h"
  33 #include "dns_server/dns_server.h"
  34 #include "auth/auth.h"
  35
  36 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
  37                              const struct dns_res_rec *rrec,
  38                              struct dnsp_DnssrvRpcRecord *r);
  39
  40 static WERROR check_one_prerequisite(struct dns_server *dns,
  41                                      TALLOC_CTX *mem_ctx,
  42                                      const struct dns_name_question *zone,
  43                                      const struct dns_res_rec *pr,
  44                                      bool *final_result)
  45 {
  46         bool match;
  47         WERROR werror;
  48         struct ldb_dn *dn;
  49         uint16_t i;
  50         bool found = false;
  51         struct dnsp_DnssrvRpcRecord *rec = NULL;
  52         struct dnsp_DnssrvRpcRecord *ans;
  53         uint16_t acount;
  54
  55         size_t host_part_len = 0;
  56
  57         *final_result = true;
  58
  59         if (pr->ttl != 0) {
  60                 return DNS_ERR(FORMAT_ERROR);
  61         }
  62
  63         match = dns_name_match(zone->name, pr->name, &host_part_len);
  64         if (!match) {
  65                 return DNS_ERR(NOTZONE);
  66         }
  67
  68         werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
  69         W_ERROR_NOT_OK_RETURN(werror);
  70
  71         if (pr->rr_class == DNS_QCLASS_ANY) {
  72
  73                 if (pr->length != 0) {
  74                         return DNS_ERR(FORMAT_ERROR);
  75                 }
  76
  77
  78                 if (pr->rr_type == DNS_QTYPE_ALL) {
  79                         /*
  80                          */
  81                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
  82                         W_ERROR_NOT_OK_RETURN(werror);
  83
  84                         if (acount == 0) {
  85                                 return DNS_ERR(NAME_ERROR);
  86                         }
  87                 } else {
  88                         /*
  89                          */
  90                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
  91                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
  92                                 return DNS_ERR(NXRRSET);
  93                         }
  94                         W_ERROR_NOT_OK_RETURN(werror);
  95
  96                         for (i = 0; i < acount; i++) {
  97                                 if (ans[i].wType == pr->rr_type) {
  98                                         found = true;
  99                                         break;
 100                                 }
 101                         }
 102                         if (!found) {
 103                                 return DNS_ERR(NXRRSET);
 104                         }
 105                 }
 106
 107                 /*
 108                  * RFC2136 3.2.5 doesn't actually mention the need to return
 109                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 110                  * later on. This also matches Microsoft DNS behavior.
 111                  */
 112                 return WERR_OK;
 113         }
 114
 115         if (pr->rr_class == DNS_QCLASS_NONE) {
 116                 if (pr->length != 0) {
 117                         return DNS_ERR(FORMAT_ERROR);
 118                 }
 119
 120                 if (pr->rr_type == DNS_QTYPE_ALL) {
 121                         /*
 122                          */
 123                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 124                         if (W_ERROR_EQUAL(werror, WERR_OK)) {
 125                                 return DNS_ERR(YXDOMAIN);
 126                         }
 127                 } else {
 128                         /*
 129                          */
 130                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 131                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 132                                 werror = WERR_OK;
 133                                 ans = NULL;
 134                                 acount = 0;
 135                         }
 136
 137                         for (i = 0; i < acount; i++) {
 138                                 if (ans[i].wType == pr->rr_type) {
 139                                         found = true;
 140                                         break;
 141                                 }
 142                         }
 143                         if (found) {
 144                                 return DNS_ERR(YXRRSET);
 145                         }
 146                 }
 147
 148                 /*
 149                  * RFC2136 3.2.5 doesn't actually mention the need to return
 150                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 151                  * later on. This also matches Microsoft DNS behavior.
 152                  */
 153                 return WERR_OK;
 154         }
 155
 156         if (pr->rr_class != zone->question_class) {
 157                 return DNS_ERR(FORMAT_ERROR);
 158         }
 159
 160         *final_result = false;
 161
 162         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 163         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 164                 return DNS_ERR(NXRRSET);
 165         }
 166         W_ERROR_NOT_OK_RETURN(werror);
 167
 168         rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
 169         W_ERROR_HAVE_NO_MEMORY(rec);
 170
 171         werror = dns_rr_to_dnsp(rec, pr, rec);
 172         W_ERROR_NOT_OK_RETURN(werror);
 173
 174         for (i = 0; i < acount; i++) {
 175                 if (dns_records_match(rec, &ans[i])) {
 176                         found = true;
 177                         break;
 178                 }
 179         }
 180
 181         if (!found) {
 182                 return DNS_ERR(NXRRSET);
 183         }
 184
 185         return WERR_OK;
 186 }
 187
 188 static WERROR check_prerequisites(struct dns_server *dns,
 189                                   TALLOC_CTX *mem_ctx,
 190                                   const struct dns_name_question *zone,
 191                                   const struct dns_res_rec *prereqs, uint16_t count)
 192 {
 193         uint16_t i;
 194         WERROR final_error = WERR_OK;
 195
 196         for (i = 0; i < count; i++) {
 197                 bool final;
 198                 WERROR werror;
 199
 200                 werror = check_one_prerequisite(dns, mem_ctx, zone,
 201                                                 &prereqs[i], &final);
 202                 if (!W_ERROR_IS_OK(werror)) {
 203                         if (final) {
 204                                 return werror;
 205                         }
 206                         if (W_ERROR_IS_OK(final_error)) {
 207                                 final_error = werror;
 208                         }
 209                 }
 210         }
 211
 212         if (!W_ERROR_IS_OK(final_error)) {
 213                 return final_error;
 214         }
 215
 216         return WERR_OK;
 217 }
 218
 219 static WERROR update_prescan(const struct dns_name_question *zone,
 220                              const struct dns_res_rec *updates, uint16_t count)
 221 {
 222         const struct dns_res_rec *r;
 223         uint16_t i;
 224         size_t host_part_len;
 225         bool match;
 226
 227         for (i = 0; i < count; i++) {
 228                 r = &updates[i];
 229                 match = dns_name_match(zone->name, r->name, &host_part_len);
 230                 if (!match) {
 231                         return DNS_ERR(NOTZONE);
 232                 }
 233                 if (zone->question_class == r->rr_class) {
 234                         if (r->rr_type == DNS_QTYPE_ALL) {
 235                                 return DNS_ERR(FORMAT_ERROR);
 236                         }
 237                         if (r->rr_type == DNS_QTYPE_AXFR) {
 238                                 return DNS_ERR(FORMAT_ERROR);
 239                         }
 240                         if (r->rr_type == DNS_QTYPE_MAILB) {
 241                                 return DNS_ERR(FORMAT_ERROR);
 242                         }
 243                         if (r->rr_type == DNS_QTYPE_MAILA) {
 244                                 return DNS_ERR(FORMAT_ERROR);
 245                         }
 246                 } else if (r->rr_class == DNS_QCLASS_ANY) {
 247                         if (r->ttl != 0) {
 248                                 return DNS_ERR(FORMAT_ERROR);
 249                         }
 250                         if (r->length != 0) {
 251                                 return DNS_ERR(FORMAT_ERROR);
 252                         }
 253                         if (r->rr_type == DNS_QTYPE_AXFR) {
 254                                 return DNS_ERR(FORMAT_ERROR);
 255                         }
 256                         if (r->rr_type == DNS_QTYPE_MAILB) {
 257                                 return DNS_ERR(FORMAT_ERROR);
 258                         }
 259                         if (r->rr_type == DNS_QTYPE_MAILA) {
 260                                 return DNS_ERR(FORMAT_ERROR);
 261                         }
 262                 } else if (r->rr_class == DNS_QCLASS_NONE) {
 263                         if (r->ttl != 0) {
 264                                 return DNS_ERR(FORMAT_ERROR);
 265                         }
 266                         if (r->rr_type == DNS_QTYPE_ALL) {
 267                                 return DNS_ERR(FORMAT_ERROR);
 268                         }
 269                         if (r->rr_type == DNS_QTYPE_AXFR) {
 270                                 return DNS_ERR(FORMAT_ERROR);
 271                         }
 272                         if (r->rr_type == DNS_QTYPE_MAILB) {
 273                                 return DNS_ERR(FORMAT_ERROR);
 274                         }
 275                         if (r->rr_type == DNS_QTYPE_MAILA) {
 276                                 return DNS_ERR(FORMAT_ERROR);
 277                         }
 278                 } else {
 279                         return DNS_ERR(FORMAT_ERROR);
 280                 }
 281         }
 282         return WERR_OK;
 283 }
 284
 285 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
 286                              const struct dns_res_rec *rrec,
 287                              struct dnsp_DnssrvRpcRecord *r)
 288 {
 289         char *tmp;
 290         char *txt_record_txt;
 291         char *saveptr = NULL;
 292
 293         if (rrec->rr_type == DNS_QTYPE_ALL) {
 294                 return DNS_ERR(FORMAT_ERROR);
 295         }
 296
 297         ZERO_STRUCTP(r);
 298
 299         r->wType = rrec->rr_type;
 300         r->dwTtlSeconds = rrec->ttl;
 301         r->rank = DNS_RANK_ZONE;
 302         /* TODO: Autogenerate this somehow */
 303         r->dwSerial = 110;
 304
 305         /* If we get QCLASS_ANY, we're done here */
 306         if (rrec->rr_class == DNS_QCLASS_ANY) {
 307                 goto done;
 308         }
 309
 310         switch(rrec->rr_type) {
 311         case DNS_QTYPE_A:
 312                 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
 313                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
 314                 break;
 315         case DNS_QTYPE_AAAA:
 316                 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
 317                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
 318                 break;
 319         case DNS_QTYPE_NS:
 320                 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
 321                 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
 322                 break;
 323         case DNS_QTYPE_CNAME:
 324                 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
 325                 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
 326                 break;
 327         case DNS_QTYPE_SRV:
 328                 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
 329                 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
 330                 r->data.srv.wPort = rrec->rdata.srv_record.port;
 331                 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
 332                                 rrec->rdata.srv_record.target);
 333                 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
 334                 break;
 335         case DNS_QTYPE_PTR:
 336                 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
 337                 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
 338                 break;
 339         case DNS_QTYPE_MX:
 340                 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
 341                 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
 342                                 rrec->rdata.mx_record.exchange);
 343                 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
 344                 break;
 345         case DNS_QTYPE_TXT:
 346                 r->data.txt.count = 0;
 347                 r->data.txt.str = talloc_array(mem_ctx, const char *,
 348                                                r->data.txt.count);
 349                 W_ERROR_HAVE_NO_MEMORY(r->data.txt.str);
 350
 351                 txt_record_txt = talloc_strdup(r->data.txt.str,
 352                                                rrec->rdata.txt_record.txt);
 353                 W_ERROR_HAVE_NO_MEMORY(txt_record_txt);
 354
 355                 tmp = strtok_r(txt_record_txt, "\"", &saveptr);
 356                 while (tmp) {
 357                         if (strcmp(tmp, " ") == 0) {
 358                                 tmp = strtok_r(NULL, "\"", &saveptr);
 359                                 continue;
 360                         }
 361                         r->data.txt.str = talloc_realloc(mem_ctx, r->data.txt.str, const char *,
 362                                                         r->data.txt.count+1);
 363                         r->data.txt.str[r->data.txt.count] = talloc_strdup(r->data.txt.str, tmp);
 364                         W_ERROR_HAVE_NO_MEMORY(r->data.txt.str[r->data.txt.count]);
 365
 366                         r->data.txt.count++;
 367                         tmp = strtok_r(NULL, "\"", &saveptr);
 368                 }
 369
 370                 break;
 371         default:
 372                 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
 373                 return DNS_ERR(NOT_IMPLEMENTED);
 374         }
 375
 376 done:
 377
 378         return WERR_OK;
 379 }
 380
 381
 382 static WERROR handle_one_update(struct dns_server *dns,
 383                                 TALLOC_CTX *mem_ctx,
 384                                 const struct dns_name_question *zone,
 385                                 const struct dns_res_rec *update,
 386                                 const struct dns_server_tkey *tkey)
 387 {
 388         struct dnsp_DnssrvRpcRecord *recs = NULL;
 389         uint16_t rcount = 0;
 390         struct ldb_dn *dn;
 391         uint16_t i;
 392         WERROR werror;
 393         bool needs_add = false;
 394         uint32_t access_mask = 0;
 395
 396         DEBUG(2, ("Looking at record: \n"));
 397         if (DEBUGLVL(2)) {
 398                 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
 399         }
 400
 401         switch (update->rr_type) {
 402         case DNS_QTYPE_A:
 403         case DNS_QTYPE_NS:
 404         case DNS_QTYPE_CNAME:
 405         case DNS_QTYPE_SOA:
 406         case DNS_QTYPE_PTR:
 407         case DNS_QTYPE_MX:
 408         case DNS_QTYPE_AAAA:
 409         case DNS_QTYPE_SRV:
 410         case DNS_QTYPE_TXT:
 411                 break;
 412         default:
 413                 DEBUG(0, ("Can't handle updates of type %u yet\n",
 414                           update->rr_type));
 415                 return DNS_ERR(NOT_IMPLEMENTED);
 416         }
 417
 418         werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
 419         W_ERROR_NOT_OK_RETURN(werror);
 420
 421         werror = dns_lookup_records(dns, mem_ctx, dn, &recs, &rcount);
 422         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 423                 recs = NULL;
 424                 rcount = 0;
 425                 needs_add = true;
 426                 werror = WERR_OK;
 427                 access_mask = SEC_ADS_CREATE_CHILD;
 428         }
 429         W_ERROR_NOT_OK_RETURN(werror);
 430
 431         access_mask = SEC_STD_REQUIRED | SEC_ADS_SELF_WRITE;
 432
 433         if (tkey != NULL) {
 434                 int ldb_ret;
 435                 ldb_ret = dsdb_check_access_on_dn(dns->samdb, mem_ctx, dn,
 436                                                   tkey->session_info->security_token,
 437                                                   access_mask, NULL);
 438                 if (ldb_ret != LDB_SUCCESS) {
 439                         DEBUG(0, ("Disallowing update: %s\n", ldb_strerror(ldb_ret)));
 440                         return DNS_ERR(REFUSED);
 441                 }
 442                 DEBUG(0, ("Allowing signed update\n"));
 443         }
 444
 445         if (update->rr_class == zone->question_class) {
 446                 if (update->rr_type == DNS_QTYPE_CNAME) {
 447                         /*
 448                          * If there is a record in the directory
 449                          * that's not a CNAME, ignore update
 450                          */
 451                         for (i = 0; i < rcount; i++) {
 452                                 if (recs[i].wType != DNS_TYPE_CNAME) {
 453                                         DEBUG(0, ("Skipping update\n"));
 454                                         return WERR_OK;
 455                                 }
 456                                 break;
 457                         }
 458
 459                         /*
 460                          * There should be no entries besides one CNAME record
 461                          * per name, so replace everything with the new CNAME
 462                          */
 463
 464                         rcount = 1;
 465                         recs = talloc_realloc(mem_ctx, recs,
 466                                         struct dnsp_DnssrvRpcRecord, rcount);
 467                         W_ERROR_HAVE_NO_MEMORY(recs);
 468
 469                         werror = dns_rr_to_dnsp(recs, update, &recs[0]);
 470                         W_ERROR_NOT_OK_RETURN(werror);
 471
 472                         werror = dns_replace_records(dns, mem_ctx, dn,
 473                                                      needs_add, recs, rcount);
 474                         W_ERROR_NOT_OK_RETURN(werror);
 475
 476                         return WERR_OK;
 477                 } else {
 478                         /*
 479                          * If there is a CNAME record for this name,
 480                          * ignore update
 481                          */
 482                         for (i = 0; i < rcount; i++) {
 483                                 if (recs[i].wType == DNS_TYPE_CNAME) {
 484                                         DEBUG(0, ("Skipping update\n"));
 485                                         return WERR_OK;
 486                                 }
 487                         }
 488                 }
 489                 if (update->rr_type == DNS_QTYPE_SOA) {
 490                         bool found = false;
 491
 492                         /*
 493                          * If the zone has no SOA record?? or update's
 494                          * serial number is smaller than existing SOA's,
 495                          * ignore update
 496                          */
 497                         for (i = 0; i < rcount; i++) {
 498                                 if (recs[i].wType == DNS_TYPE_SOA) {
 499                                         uint16_t n, o;
 500
 501                                         n = update->rdata.soa_record.serial;
 502                                         o = recs[i].data.soa.serial;
 503                                         /*
 504                                          * TODO: Implement RFC 1982 comparison
 505                                          * logic for RFC2136
 506                                          */
 507                                         if (n <= o) {
 508                                                 DEBUG(0, ("Skipping update\n"));
 509                                                 return WERR_OK;
 510                                         }
 511                                         found = true;
 512                                         break;
 513                                 }
 514                         }
 515                         if (!found) {
 516                                 DEBUG(0, ("Skipping update\n"));
 517                                 return WERR_OK;
 518                         }
 519
 520                         werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
 521                         W_ERROR_NOT_OK_RETURN(werror);
 522
 523                         for (i++; i < rcount; i++) {
 524                                 if (recs[i].wType != DNS_TYPE_SOA) {
 525                                         continue;
 526                                 }
 527
 528                                 ZERO_STRUCT(recs[i]);
 529                         }
 530
 531                         werror = dns_replace_records(dns, mem_ctx, dn,
 532                                                      needs_add, recs, rcount);
 533                         W_ERROR_NOT_OK_RETURN(werror);
 534
 535                         return WERR_OK;
 536                 }
 537
 538                 recs = talloc_realloc(mem_ctx, recs,
 539                                 struct dnsp_DnssrvRpcRecord, rcount+1);
 540                 W_ERROR_HAVE_NO_MEMORY(recs);
 541
 542                 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
 543                 W_ERROR_NOT_OK_RETURN(werror);
 544
 545                 for (i = 0; i < rcount; i++) {
 546                         if (!dns_records_match(&recs[i], &recs[rcount])) {
 547                                 continue;
 548                         }
 549
 550                         recs[i] = recs[rcount];
 551
 552                         werror = dns_replace_records(dns, mem_ctx, dn,
 553                                                      needs_add, recs, rcount);
 554                         W_ERROR_NOT_OK_RETURN(werror);
 555
 556                         return WERR_OK;
 557                 }
 558
 559                 werror = dns_replace_records(dns, mem_ctx, dn,
 560                                              needs_add, recs, rcount+1);
 561                 W_ERROR_NOT_OK_RETURN(werror);
 562
 563                 return WERR_OK;
 564         } else if (update->rr_class == DNS_QCLASS_ANY) {
 565                 if (update->rr_type == DNS_QTYPE_ALL) {
 566                         if (dns_name_equal(update->name, zone->name)) {
 567                                 for (i = 0; i < rcount; i++) {
 568
 569                                         if (recs[i].wType == DNS_TYPE_SOA) {
 570                                                 continue;
 571                                         }
 572
 573                                         if (recs[i].wType == DNS_TYPE_NS) {
 574                                                 continue;
 575                                         }
 576
 577                                         ZERO_STRUCT(recs[i]);
 578                                 }
 579
 580                         } else {
 581                                 for (i = 0; i < rcount; i++) {
 582                                         ZERO_STRUCT(recs[i]);
 583                                 }
 584                         }
 585
 586                 } else if (dns_name_equal(update->name, zone->name)) {
 587
 588                         if (update->rr_type == DNS_QTYPE_SOA) {
 589                                 return WERR_OK;
 590                         }
 591
 592                         if (update->rr_type == DNS_QTYPE_NS) {
 593                                 return WERR_OK;
 594                         }
 595                 }
 596                 for (i = 0; i < rcount; i++) {
 597                         if (recs[i].wType == update->rr_type) {
 598                                 ZERO_STRUCT(recs[i]);
 599                         }
 600                 }
 601
 602                 werror = dns_replace_records(dns, mem_ctx, dn,
 603                                              needs_add, recs, rcount);
 604                 W_ERROR_NOT_OK_RETURN(werror);
 605
 606                 return WERR_OK;
 607         } else if (update->rr_class == DNS_QCLASS_NONE) {
 608                 struct dnsp_DnssrvRpcRecord *del_rec;
 609
 610                 if (update->rr_type == DNS_QTYPE_SOA) {
 611                         return WERR_OK;
 612                 }
 613                 if (update->rr_type == DNS_QTYPE_NS) {
 614                         bool found = false;
 615                         struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
 616                                                 struct dnsp_DnssrvRpcRecord);
 617                         W_ERROR_HAVE_NO_MEMORY(ns_rec);
 618
 619
 620                         werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
 621                         W_ERROR_NOT_OK_RETURN(werror);
 622
 623                         for (i = 0; i < rcount; i++) {
 624                                 if (dns_records_match(ns_rec, &recs[i])) {
 625                                         found = true;
 626                                         break;
 627                                 }
 628                         }
 629                         if (found) {
 630                                 return WERR_OK;
 631                         }
 632                 }
 633
 634                 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
 635                 W_ERROR_HAVE_NO_MEMORY(del_rec);
 636
 637                 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
 638                 W_ERROR_NOT_OK_RETURN(werror);
 639
 640                 for (i = 0; i < rcount; i++) {
 641                         if (dns_records_match(del_rec, &recs[i])) {
 642                                 ZERO_STRUCT(recs[i]);
 643                         }
 644                 }
 645
 646                 werror = dns_replace_records(dns, mem_ctx, dn,
 647                                              needs_add, recs, rcount);
 648                 W_ERROR_NOT_OK_RETURN(werror);
 649         }
 650
 651         return WERR_OK;
 652 }
 653
 654 static WERROR handle_updates(struct dns_server *dns,
 655                              TALLOC_CTX *mem_ctx,
 656                              const struct dns_name_question *zone,
 657                              const struct dns_res_rec *prereqs, uint16_t pcount,
 658                              struct dns_res_rec *updates, uint16_t upd_count,
 659                              struct dns_server_tkey *tkey)
 660 {
 661         struct ldb_dn *zone_dn = NULL;
 662         WERROR werror = WERR_OK;
 663         int ret;
 664         uint16_t ri;
 665         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 666
 667         werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
 668         W_ERROR_NOT_OK_RETURN(werror);
 669
 670         ret = ldb_transaction_start(dns->samdb);
 671         if (ret != LDB_SUCCESS) {
 672                 return DNS_ERR(SERVER_FAILURE);
 673         }
 674
 675         werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
 676         W_ERROR_NOT_OK_GOTO(werror, failed);
 677
 678         DEBUG(0, ("update count is %u\n", upd_count));
 679
 680         for (ri = 0; ri < upd_count; ri++) {
 681                 werror = handle_one_update(dns, tmp_ctx, zone,
 682                                            &updates[ri], tkey);
 683                 W_ERROR_NOT_OK_GOTO(werror, failed);
 684         }
 685
 686         ldb_transaction_commit(dns->samdb);
 687         TALLOC_FREE(tmp_ctx);
 688         return WERR_OK;
 689
 690 failed:
 691         ldb_transaction_cancel(dns->samdb);
 692         TALLOC_FREE(tmp_ctx);
 693         return werror;
 694
 695 }
 696
 697 static WERROR dns_update_allowed(struct dns_server *dns,
 698                                  struct dns_request_state *state,
 699                                  struct dns_server_tkey **tkey)
 700 {
 701         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
 702                 DEBUG(0, ("All updates allowed.\n"));
 703                 return WERR_OK;
 704         }
 705
 706         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
 707                 DEBUG(0, ("Updates disabled.\n"));
 708                 return DNS_ERR(REFUSED);
 709         }
 710
 711         if (state->authenticated == false ) {
 712                 DEBUG(0, ("Update not allowed for unsigned packet.\n"));
 713                 return DNS_ERR(REFUSED);
 714         }
 715
 716         *tkey = dns_find_tkey(dns->tkeys, state->key_name);
 717         if (*tkey == NULL) {
 718                 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
 719                 return DNS_ERR(REFUSED);
 720         }
 721
 722         return WERR_OK;
 723 }
 724
 725
 726 WERROR dns_server_process_update(struct dns_server *dns,
 727                                  struct dns_request_state *state,
 728                                  TALLOC_CTX *mem_ctx,
 729                                  struct dns_name_packet *in,
 730                                  struct dns_res_rec **prereqs,    uint16_t *prereq_count,
 731                                  struct dns_res_rec **updates,    uint16_t *update_count,
 732                                  struct dns_res_rec **additional, uint16_t *arcount)
 733 {
 734         struct dns_name_question *zone;
 735         const struct dns_server_zone *z;
 736         size_t host_part_len = 0;
 737         WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
 738         struct dns_server_tkey *tkey = NULL;
 739
 740         if (in->qdcount != 1) {
 741                 return DNS_ERR(FORMAT_ERROR);
 742         }
 743
 744         zone = &in->questions[0];
 745
 746         if (zone->question_class != DNS_QCLASS_IN &&
 747             zone->question_class != DNS_QCLASS_ANY) {
 748                 return DNS_ERR(NOT_IMPLEMENTED);
 749         }
 750
 751         if (zone->question_type != DNS_QTYPE_SOA) {
 752                 return DNS_ERR(FORMAT_ERROR);
 753         }
 754
 755         DEBUG(2, ("Got a dns update request.\n"));
 756
 757         for (z = dns->zones; z != NULL; z = z->next) {
 758                 bool match;
 759
 760                 match = dns_name_match(z->name, zone->name, &host_part_len);
 761                 if (match) {
 762                         break;
 763                 }
 764         }
 765
 766         if (z == NULL) {
 767                 DEBUG(0, ("We're not authoritative for this zone\n"));
 768                 return DNS_ERR(NOTAUTH);
 769         }
 770
 771         if (host_part_len != 0) {
 772                 /* TODO: We need to delegate this one */
 773                 DEBUG(0, ("Would have to delegate zones.\n"));
 774                 return DNS_ERR(NOT_IMPLEMENTED);
 775         }
 776
 777         *prereq_count = in->ancount;
 778         *prereqs = in->answers;
 779         werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
 780                                      *prereq_count);
 781         W_ERROR_NOT_OK_RETURN(werror);
 782
 783         werror = dns_update_allowed(dns, state, &tkey);
 784         if (!W_ERROR_IS_OK(werror)) {
 785                 return werror;
 786         }
 787
 788         *update_count = in->nscount;
 789         *updates = in->nsrecs;
 790         werror = update_prescan(in->questions, *updates, *update_count);
 791         W_ERROR_NOT_OK_RETURN(werror);
 792
 793         werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
 794                                 *prereq_count, *updates, *update_count, tkey);
 795         W_ERROR_NOT_OK_RETURN(werror);
 796
 797         return werror;
 798 }