2 Unix SMB/CIFS implementation.
4 DNS server handler for update requests
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
28 #include "param/param.h"
29 #include "param/loadparm.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "smbd/service_task.h"
33 #include "dns_server/dns_server.h"
34 #include "auth/auth.h"
36 static WERROR
dns_rr_to_dnsp(TALLOC_CTX
*mem_ctx
,
37 const struct dns_res_rec
*rrec
,
38 struct dnsp_DnssrvRpcRecord
*r
);
40 static WERROR
check_one_prerequisite(struct dns_server
*dns
,
42 const struct dns_name_question
*zone
,
43 const struct dns_res_rec
*pr
,
51 struct dnsp_DnssrvRpcRecord
*rec
= NULL
;
52 struct dnsp_DnssrvRpcRecord
*ans
;
55 size_t host_part_len
= 0;
60 return DNS_ERR(FORMAT_ERROR
);
63 match
= dns_name_match(zone
->name
, pr
->name
, &host_part_len
);
65 return DNS_ERR(NOTZONE
);
68 werror
= dns_name2dn(dns
, mem_ctx
, pr
->name
, &dn
);
69 W_ERROR_NOT_OK_RETURN(werror
);
71 if (pr
->rr_class
== DNS_QCLASS_ANY
) {
73 if (pr
->length
!= 0) {
74 return DNS_ERR(FORMAT_ERROR
);
78 if (pr
->rr_type
== DNS_QTYPE_ALL
) {
81 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &ans
, &acount
);
82 W_ERROR_NOT_OK_RETURN(werror
);
85 return DNS_ERR(NAME_ERROR
);
90 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &ans
, &acount
);
91 if (W_ERROR_EQUAL(werror
, DNS_ERR(NAME_ERROR
))) {
92 return DNS_ERR(NXRRSET
);
94 W_ERROR_NOT_OK_RETURN(werror
);
96 for (i
= 0; i
< acount
; i
++) {
97 if (ans
[i
].wType
== pr
->rr_type
) {
103 return DNS_ERR(NXRRSET
);
108 * RFC2136 3.2.5 doesn't actually mention the need to return
109 * OK here, but otherwise we'd always return a FORMAT_ERROR
110 * later on. This also matches Microsoft DNS behavior.
115 if (pr
->rr_class
== DNS_QCLASS_NONE
) {
116 if (pr
->length
!= 0) {
117 return DNS_ERR(FORMAT_ERROR
);
120 if (pr
->rr_type
== DNS_QTYPE_ALL
) {
123 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &ans
, &acount
);
124 if (W_ERROR_EQUAL(werror
, WERR_OK
)) {
125 return DNS_ERR(YXDOMAIN
);
130 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &ans
, &acount
);
131 if (W_ERROR_EQUAL(werror
, DNS_ERR(NAME_ERROR
))) {
137 for (i
= 0; i
< acount
; i
++) {
138 if (ans
[i
].wType
== pr
->rr_type
) {
144 return DNS_ERR(YXRRSET
);
149 * RFC2136 3.2.5 doesn't actually mention the need to return
150 * OK here, but otherwise we'd always return a FORMAT_ERROR
151 * later on. This also matches Microsoft DNS behavior.
156 if (pr
->rr_class
!= zone
->question_class
) {
157 return DNS_ERR(FORMAT_ERROR
);
160 *final_result
= false;
162 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &ans
, &acount
);
163 if (W_ERROR_EQUAL(werror
, DNS_ERR(NAME_ERROR
))) {
164 return DNS_ERR(NXRRSET
);
166 W_ERROR_NOT_OK_RETURN(werror
);
168 rec
= talloc_zero(mem_ctx
, struct dnsp_DnssrvRpcRecord
);
169 W_ERROR_HAVE_NO_MEMORY(rec
);
171 werror
= dns_rr_to_dnsp(rec
, pr
, rec
);
172 W_ERROR_NOT_OK_RETURN(werror
);
174 for (i
= 0; i
< acount
; i
++) {
175 if (dns_records_match(rec
, &ans
[i
])) {
182 return DNS_ERR(NXRRSET
);
188 static WERROR
check_prerequisites(struct dns_server
*dns
,
190 const struct dns_name_question
*zone
,
191 const struct dns_res_rec
*prereqs
, uint16_t count
)
194 WERROR final_error
= WERR_OK
;
196 for (i
= 0; i
< count
; i
++) {
200 werror
= check_one_prerequisite(dns
, mem_ctx
, zone
,
201 &prereqs
[i
], &final
);
202 if (!W_ERROR_IS_OK(werror
)) {
206 if (W_ERROR_IS_OK(final_error
)) {
207 final_error
= werror
;
212 if (!W_ERROR_IS_OK(final_error
)) {
219 static WERROR
update_prescan(const struct dns_name_question
*zone
,
220 const struct dns_res_rec
*updates
, uint16_t count
)
222 const struct dns_res_rec
*r
;
224 size_t host_part_len
;
227 for (i
= 0; i
< count
; i
++) {
229 match
= dns_name_match(zone
->name
, r
->name
, &host_part_len
);
231 return DNS_ERR(NOTZONE
);
233 if (zone
->question_class
== r
->rr_class
) {
234 if (r
->rr_type
== DNS_QTYPE_ALL
) {
235 return DNS_ERR(FORMAT_ERROR
);
237 if (r
->rr_type
== DNS_QTYPE_AXFR
) {
238 return DNS_ERR(FORMAT_ERROR
);
240 if (r
->rr_type
== DNS_QTYPE_MAILB
) {
241 return DNS_ERR(FORMAT_ERROR
);
243 if (r
->rr_type
== DNS_QTYPE_MAILA
) {
244 return DNS_ERR(FORMAT_ERROR
);
246 } else if (r
->rr_class
== DNS_QCLASS_ANY
) {
248 return DNS_ERR(FORMAT_ERROR
);
250 if (r
->length
!= 0) {
251 return DNS_ERR(FORMAT_ERROR
);
253 if (r
->rr_type
== DNS_QTYPE_AXFR
) {
254 return DNS_ERR(FORMAT_ERROR
);
256 if (r
->rr_type
== DNS_QTYPE_MAILB
) {
257 return DNS_ERR(FORMAT_ERROR
);
259 if (r
->rr_type
== DNS_QTYPE_MAILA
) {
260 return DNS_ERR(FORMAT_ERROR
);
262 } else if (r
->rr_class
== DNS_QCLASS_NONE
) {
264 return DNS_ERR(FORMAT_ERROR
);
266 if (r
->rr_type
== DNS_QTYPE_ALL
) {
267 return DNS_ERR(FORMAT_ERROR
);
269 if (r
->rr_type
== DNS_QTYPE_AXFR
) {
270 return DNS_ERR(FORMAT_ERROR
);
272 if (r
->rr_type
== DNS_QTYPE_MAILB
) {
273 return DNS_ERR(FORMAT_ERROR
);
275 if (r
->rr_type
== DNS_QTYPE_MAILA
) {
276 return DNS_ERR(FORMAT_ERROR
);
279 return DNS_ERR(FORMAT_ERROR
);
285 static WERROR
dns_rr_to_dnsp(TALLOC_CTX
*mem_ctx
,
286 const struct dns_res_rec
*rrec
,
287 struct dnsp_DnssrvRpcRecord
*r
)
290 char *txt_record_txt
;
291 char *saveptr
= NULL
;
293 if (rrec
->rr_type
== DNS_QTYPE_ALL
) {
294 return DNS_ERR(FORMAT_ERROR
);
299 r
->wType
= rrec
->rr_type
;
300 r
->dwTtlSeconds
= rrec
->ttl
;
301 r
->rank
= DNS_RANK_ZONE
;
302 /* TODO: Autogenerate this somehow */
305 /* If we get QCLASS_ANY, we're done here */
306 if (rrec
->rr_class
== DNS_QCLASS_ANY
) {
310 switch(rrec
->rr_type
) {
312 r
->data
.ipv4
= talloc_strdup(mem_ctx
, rrec
->rdata
.ipv4_record
);
313 W_ERROR_HAVE_NO_MEMORY(r
->data
.ipv4
);
316 r
->data
.ipv6
= talloc_strdup(mem_ctx
, rrec
->rdata
.ipv6_record
);
317 W_ERROR_HAVE_NO_MEMORY(r
->data
.ipv6
);
320 r
->data
.ns
= talloc_strdup(mem_ctx
, rrec
->rdata
.ns_record
);
321 W_ERROR_HAVE_NO_MEMORY(r
->data
.ns
);
323 case DNS_QTYPE_CNAME
:
324 r
->data
.cname
= talloc_strdup(mem_ctx
, rrec
->rdata
.cname_record
);
325 W_ERROR_HAVE_NO_MEMORY(r
->data
.cname
);
328 r
->data
.srv
.wPriority
= rrec
->rdata
.srv_record
.priority
;
329 r
->data
.srv
.wWeight
= rrec
->rdata
.srv_record
.weight
;
330 r
->data
.srv
.wPort
= rrec
->rdata
.srv_record
.port
;
331 r
->data
.srv
.nameTarget
= talloc_strdup(mem_ctx
,
332 rrec
->rdata
.srv_record
.target
);
333 W_ERROR_HAVE_NO_MEMORY(r
->data
.srv
.nameTarget
);
336 r
->data
.ptr
= talloc_strdup(mem_ctx
, rrec
->rdata
.ptr_record
);
337 W_ERROR_HAVE_NO_MEMORY(r
->data
.ptr
);
340 r
->data
.mx
.wPriority
= rrec
->rdata
.mx_record
.preference
;
341 r
->data
.mx
.nameTarget
= talloc_strdup(mem_ctx
,
342 rrec
->rdata
.mx_record
.exchange
);
343 W_ERROR_HAVE_NO_MEMORY(r
->data
.mx
.nameTarget
);
346 r
->data
.txt
.count
= 0;
347 r
->data
.txt
.str
= talloc_array(mem_ctx
, const char *,
349 W_ERROR_HAVE_NO_MEMORY(r
->data
.txt
.str
);
351 txt_record_txt
= talloc_strdup(r
->data
.txt
.str
,
352 rrec
->rdata
.txt_record
.txt
);
353 W_ERROR_HAVE_NO_MEMORY(txt_record_txt
);
355 tmp
= strtok_r(txt_record_txt
, "\"", &saveptr
);
357 if (strcmp(tmp
, " ") == 0) {
358 tmp
= strtok_r(NULL
, "\"", &saveptr
);
361 r
->data
.txt
.str
= talloc_realloc(mem_ctx
, r
->data
.txt
.str
, const char *,
362 r
->data
.txt
.count
+1);
363 r
->data
.txt
.str
[r
->data
.txt
.count
] = talloc_strdup(r
->data
.txt
.str
, tmp
);
364 W_ERROR_HAVE_NO_MEMORY(r
->data
.txt
.str
[r
->data
.txt
.count
]);
367 tmp
= strtok_r(NULL
, "\"", &saveptr
);
372 DEBUG(0, ("Got a qytpe of %d\n", rrec
->rr_type
));
373 return DNS_ERR(NOT_IMPLEMENTED
);
382 static WERROR
handle_one_update(struct dns_server
*dns
,
384 const struct dns_name_question
*zone
,
385 const struct dns_res_rec
*update
,
386 const struct dns_server_tkey
*tkey
)
388 struct dnsp_DnssrvRpcRecord
*recs
= NULL
;
393 bool needs_add
= false;
394 uint32_t access_mask
= 0;
396 DEBUG(2, ("Looking at record: \n"));
398 NDR_PRINT_DEBUG(dns_res_rec
, discard_const(update
));
401 switch (update
->rr_type
) {
404 case DNS_QTYPE_CNAME
:
413 DEBUG(0, ("Can't handle updates of type %u yet\n",
415 return DNS_ERR(NOT_IMPLEMENTED
);
418 werror
= dns_name2dn(dns
, mem_ctx
, update
->name
, &dn
);
419 W_ERROR_NOT_OK_RETURN(werror
);
421 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &recs
, &rcount
);
422 if (W_ERROR_EQUAL(werror
, DNS_ERR(NAME_ERROR
))) {
427 access_mask
= SEC_ADS_CREATE_CHILD
;
429 W_ERROR_NOT_OK_RETURN(werror
);
431 access_mask
= SEC_STD_REQUIRED
| SEC_ADS_SELF_WRITE
;
435 ldb_ret
= dsdb_check_access_on_dn(dns
->samdb
, mem_ctx
, dn
,
436 tkey
->session_info
->security_token
,
438 if (ldb_ret
!= LDB_SUCCESS
) {
439 DEBUG(5, ("Disallowing update: %s\n", ldb_strerror(ldb_ret
)));
440 return DNS_ERR(REFUSED
);
442 DEBUG(5, ("Allowing signed update\n"));
445 if (update
->rr_class
== zone
->question_class
) {
446 if (update
->rr_type
== DNS_QTYPE_CNAME
) {
448 * If there is a record in the directory
449 * that's not a CNAME, ignore update
451 for (i
= 0; i
< rcount
; i
++) {
452 if (recs
[i
].wType
!= DNS_TYPE_CNAME
) {
453 DEBUG(5, ("Skipping update\n"));
460 * There should be no entries besides one CNAME record
461 * per name, so replace everything with the new CNAME
465 recs
= talloc_realloc(mem_ctx
, recs
,
466 struct dnsp_DnssrvRpcRecord
, rcount
);
467 W_ERROR_HAVE_NO_MEMORY(recs
);
469 werror
= dns_rr_to_dnsp(recs
, update
, &recs
[0]);
470 W_ERROR_NOT_OK_RETURN(werror
);
472 werror
= dns_replace_records(dns
, mem_ctx
, dn
,
473 needs_add
, recs
, rcount
);
474 W_ERROR_NOT_OK_RETURN(werror
);
479 * If there is a CNAME record for this name,
482 for (i
= 0; i
< rcount
; i
++) {
483 if (recs
[i
].wType
== DNS_TYPE_CNAME
) {
484 DEBUG(5, ("Skipping update\n"));
489 if (update
->rr_type
== DNS_QTYPE_SOA
) {
493 * If the zone has no SOA record?? or update's
494 * serial number is smaller than existing SOA's,
497 for (i
= 0; i
< rcount
; i
++) {
498 if (recs
[i
].wType
== DNS_TYPE_SOA
) {
501 n
= update
->rdata
.soa_record
.serial
;
502 o
= recs
[i
].data
.soa
.serial
;
504 * TODO: Implement RFC 1982 comparison
508 DEBUG(5, ("Skipping update\n"));
516 DEBUG(5, ("Skipping update\n"));
520 werror
= dns_rr_to_dnsp(mem_ctx
, update
, &recs
[i
]);
521 W_ERROR_NOT_OK_RETURN(werror
);
523 for (i
++; i
< rcount
; i
++) {
524 if (recs
[i
].wType
!= DNS_TYPE_SOA
) {
528 ZERO_STRUCT(recs
[i
]);
531 werror
= dns_replace_records(dns
, mem_ctx
, dn
,
532 needs_add
, recs
, rcount
);
533 W_ERROR_NOT_OK_RETURN(werror
);
538 recs
= talloc_realloc(mem_ctx
, recs
,
539 struct dnsp_DnssrvRpcRecord
, rcount
+1);
540 W_ERROR_HAVE_NO_MEMORY(recs
);
542 werror
= dns_rr_to_dnsp(recs
, update
, &recs
[rcount
]);
543 W_ERROR_NOT_OK_RETURN(werror
);
545 for (i
= 0; i
< rcount
; i
++) {
546 if (!dns_records_match(&recs
[i
], &recs
[rcount
])) {
550 recs
[i
] = recs
[rcount
];
552 werror
= dns_replace_records(dns
, mem_ctx
, dn
,
553 needs_add
, recs
, rcount
);
554 W_ERROR_NOT_OK_RETURN(werror
);
559 werror
= dns_replace_records(dns
, mem_ctx
, dn
,
560 needs_add
, recs
, rcount
+1);
561 W_ERROR_NOT_OK_RETURN(werror
);
564 } else if (update
->rr_class
== DNS_QCLASS_ANY
) {
565 if (update
->rr_type
== DNS_QTYPE_ALL
) {
566 if (dns_name_equal(update
->name
, zone
->name
)) {
567 for (i
= 0; i
< rcount
; i
++) {
569 if (recs
[i
].wType
== DNS_TYPE_SOA
) {
573 if (recs
[i
].wType
== DNS_TYPE_NS
) {
577 ZERO_STRUCT(recs
[i
]);
581 for (i
= 0; i
< rcount
; i
++) {
582 ZERO_STRUCT(recs
[i
]);
586 } else if (dns_name_equal(update
->name
, zone
->name
)) {
588 if (update
->rr_type
== DNS_QTYPE_SOA
) {
592 if (update
->rr_type
== DNS_QTYPE_NS
) {
596 for (i
= 0; i
< rcount
; i
++) {
597 if (recs
[i
].wType
== update
->rr_type
) {
598 ZERO_STRUCT(recs
[i
]);
602 werror
= dns_replace_records(dns
, mem_ctx
, dn
,
603 needs_add
, recs
, rcount
);
604 W_ERROR_NOT_OK_RETURN(werror
);
607 } else if (update
->rr_class
== DNS_QCLASS_NONE
) {
608 struct dnsp_DnssrvRpcRecord
*del_rec
;
610 if (update
->rr_type
== DNS_QTYPE_SOA
) {
613 if (update
->rr_type
== DNS_QTYPE_NS
) {
615 struct dnsp_DnssrvRpcRecord
*ns_rec
= talloc(mem_ctx
,
616 struct dnsp_DnssrvRpcRecord
);
617 W_ERROR_HAVE_NO_MEMORY(ns_rec
);
620 werror
= dns_rr_to_dnsp(ns_rec
, update
, ns_rec
);
621 W_ERROR_NOT_OK_RETURN(werror
);
623 for (i
= 0; i
< rcount
; i
++) {
624 if (dns_records_match(ns_rec
, &recs
[i
])) {
634 del_rec
= talloc(mem_ctx
, struct dnsp_DnssrvRpcRecord
);
635 W_ERROR_HAVE_NO_MEMORY(del_rec
);
637 werror
= dns_rr_to_dnsp(del_rec
, update
, del_rec
);
638 W_ERROR_NOT_OK_RETURN(werror
);
640 for (i
= 0; i
< rcount
; i
++) {
641 if (dns_records_match(del_rec
, &recs
[i
])) {
642 ZERO_STRUCT(recs
[i
]);
646 werror
= dns_replace_records(dns
, mem_ctx
, dn
,
647 needs_add
, recs
, rcount
);
648 W_ERROR_NOT_OK_RETURN(werror
);
654 static WERROR
handle_updates(struct dns_server
*dns
,
656 const struct dns_name_question
*zone
,
657 const struct dns_res_rec
*prereqs
, uint16_t pcount
,
658 struct dns_res_rec
*updates
, uint16_t upd_count
,
659 struct dns_server_tkey
*tkey
)
661 struct ldb_dn
*zone_dn
= NULL
;
662 WERROR werror
= WERR_OK
;
665 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
667 werror
= dns_name2dn(dns
, tmp_ctx
, zone
->name
, &zone_dn
);
668 W_ERROR_NOT_OK_RETURN(werror
);
670 ret
= ldb_transaction_start(dns
->samdb
);
671 if (ret
!= LDB_SUCCESS
) {
672 return DNS_ERR(SERVER_FAILURE
);
675 werror
= check_prerequisites(dns
, tmp_ctx
, zone
, prereqs
, pcount
);
676 W_ERROR_NOT_OK_GOTO(werror
, failed
);
678 DEBUG(1, ("update count is %u\n", upd_count
));
680 for (ri
= 0; ri
< upd_count
; ri
++) {
681 werror
= handle_one_update(dns
, tmp_ctx
, zone
,
683 W_ERROR_NOT_OK_GOTO(werror
, failed
);
686 ldb_transaction_commit(dns
->samdb
);
687 TALLOC_FREE(tmp_ctx
);
691 ldb_transaction_cancel(dns
->samdb
);
692 TALLOC_FREE(tmp_ctx
);
697 static WERROR
dns_update_allowed(struct dns_server
*dns
,
698 struct dns_request_state
*state
,
699 struct dns_server_tkey
**tkey
)
701 if (lpcfg_allow_dns_updates(dns
->task
->lp_ctx
) == DNS_UPDATE_ON
) {
702 DEBUG(2, ("All updates allowed.\n"));
706 if (lpcfg_allow_dns_updates(dns
->task
->lp_ctx
) == DNS_UPDATE_OFF
) {
707 DEBUG(2, ("Updates disabled.\n"));
708 return DNS_ERR(REFUSED
);
711 if (state
->authenticated
== false ) {
712 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
713 return DNS_ERR(REFUSED
);
716 *tkey
= dns_find_tkey(dns
->tkeys
, state
->key_name
);
718 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
719 return DNS_ERR(REFUSED
);
726 WERROR
dns_server_process_update(struct dns_server
*dns
,
727 struct dns_request_state
*state
,
729 struct dns_name_packet
*in
,
730 struct dns_res_rec
**prereqs
, uint16_t *prereq_count
,
731 struct dns_res_rec
**updates
, uint16_t *update_count
,
732 struct dns_res_rec
**additional
, uint16_t *arcount
)
734 struct dns_name_question
*zone
;
735 const struct dns_server_zone
*z
;
736 size_t host_part_len
= 0;
737 WERROR werror
= DNS_ERR(NOT_IMPLEMENTED
);
738 struct dns_server_tkey
*tkey
= NULL
;
740 if (in
->qdcount
!= 1) {
741 return DNS_ERR(FORMAT_ERROR
);
744 zone
= &in
->questions
[0];
746 if (zone
->question_class
!= DNS_QCLASS_IN
&&
747 zone
->question_class
!= DNS_QCLASS_ANY
) {
748 return DNS_ERR(NOT_IMPLEMENTED
);
751 if (zone
->question_type
!= DNS_QTYPE_SOA
) {
752 return DNS_ERR(FORMAT_ERROR
);
755 DEBUG(2, ("Got a dns update request.\n"));
757 for (z
= dns
->zones
; z
!= NULL
; z
= z
->next
) {
760 match
= dns_name_match(z
->name
, zone
->name
, &host_part_len
);
767 DEBUG(1, ("We're not authoritative for this zone\n"));
768 return DNS_ERR(NOTAUTH
);
771 if (host_part_len
!= 0) {
772 /* TODO: We need to delegate this one */
773 DEBUG(1, ("Would have to delegate zones.\n"));
774 return DNS_ERR(NOT_IMPLEMENTED
);
777 *prereq_count
= in
->ancount
;
778 *prereqs
= in
->answers
;
779 werror
= check_prerequisites(dns
, mem_ctx
, in
->questions
, *prereqs
,
781 W_ERROR_NOT_OK_RETURN(werror
);
783 werror
= dns_update_allowed(dns
, state
, &tkey
);
784 if (!W_ERROR_IS_OK(werror
)) {
788 *update_count
= in
->nscount
;
789 *updates
= in
->nsrecs
;
790 werror
= update_prescan(in
->questions
, *updates
, *update_count
);
791 W_ERROR_NOT_OK_RETURN(werror
);
793 werror
= handle_updates(dns
, mem_ctx
, in
->questions
, *prereqs
,
794 *prereq_count
, *updates
, *update_count
, tkey
);
795 W_ERROR_NOT_OK_RETURN(werror
);