2 Unix SMB/CIFS implementation.
4 DNS server handler for queries
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/service_task.h"
24 #include "libcli/util/werror.h"
25 #include "librpc/ndr/libndr.h"
26 #include "librpc/gen_ndr/ndr_dns.h"
27 #include "librpc/gen_ndr/ndr_dnsp.h"
29 #include "param/param.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "dns_server/dns_server.h"
33 #include "libcli/dns/libdns.h"
34 #include "lib/util/util_net.h"
35 #include "lib/util/tevent_werror.h"
36 #include "auth/auth.h"
37 #include "auth/credentials/credentials.h"
38 #include "auth/gensec/gensec.h"
40 static WERROR
create_response_rr(const struct dns_name_question
*question
,
41 const struct dnsp_DnssrvRpcRecord
*rec
,
42 struct dns_res_rec
**answers
, uint16_t *ancount
)
44 struct dns_res_rec
*ans
= *answers
;
45 uint16_t ai
= *ancount
;
53 ans
[ai
].rdata
.cname_record
= talloc_strdup(ans
, rec
->data
.cname
);
54 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.cname_record
);
57 ans
[ai
].rdata
.ipv4_record
= talloc_strdup(ans
, rec
->data
.ipv4
);
58 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ipv4_record
);
61 ans
[ai
].rdata
.ipv6_record
= talloc_strdup(ans
, rec
->data
.ipv6
);
62 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ipv6_record
);
65 ans
[ai
].rdata
.ns_record
= talloc_strdup(ans
, rec
->data
.ns
);
66 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.ns_record
);
69 ans
[ai
].rdata
.srv_record
.priority
= rec
->data
.srv
.wPriority
;
70 ans
[ai
].rdata
.srv_record
.weight
= rec
->data
.srv
.wWeight
;
71 ans
[ai
].rdata
.srv_record
.port
= rec
->data
.srv
.wPort
;
72 ans
[ai
].rdata
.srv_record
.target
= talloc_strdup(
73 ans
, rec
->data
.srv
.nameTarget
);
74 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.srv_record
.target
);
77 ans
[ai
].rdata
.soa_record
.mname
= talloc_strdup(
78 ans
, rec
->data
.soa
.mname
);
79 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.soa_record
.mname
);
80 ans
[ai
].rdata
.soa_record
.rname
= talloc_strdup(
81 ans
, rec
->data
.soa
.rname
);
82 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].rdata
.soa_record
.rname
);
83 ans
[ai
].rdata
.soa_record
.serial
= rec
->data
.soa
.serial
;
84 ans
[ai
].rdata
.soa_record
.refresh
= rec
->data
.soa
.refresh
;
85 ans
[ai
].rdata
.soa_record
.retry
= rec
->data
.soa
.retry
;
86 ans
[ai
].rdata
.soa_record
.expire
= rec
->data
.soa
.expire
;
87 ans
[ai
].rdata
.soa_record
.minimum
= rec
->data
.soa
.minimum
;
90 ans
[ai
].rdata
.ptr_record
= talloc_strdup(ans
, rec
->data
.ptr
);
93 tmp
= talloc_asprintf(ans
, "\"%s\"", rec
->data
.txt
.str
[0]);
94 W_ERROR_HAVE_NO_MEMORY(tmp
);
95 for (i
=1; i
<rec
->data
.txt
.count
; i
++) {
96 tmp
= talloc_asprintf_append_buffer(
97 tmp
, " \"%s\"", rec
->data
.txt
.str
[i
]);
98 W_ERROR_HAVE_NO_MEMORY(tmp
);
100 ans
[ai
].rdata
.txt_record
.txt
= tmp
;
103 DEBUG(0, ("Got unhandled type %u query.\n", rec
->wType
));
104 return DNS_ERR(NOT_IMPLEMENTED
);
107 ans
[ai
].name
= talloc_strdup(ans
, question
->name
);
108 W_ERROR_HAVE_NO_MEMORY(ans
[ai
].name
);
109 ans
[ai
].rr_type
= rec
->wType
;
110 ans
[ai
].rr_class
= DNS_QCLASS_IN
;
111 ans
[ai
].ttl
= rec
->dwTtlSeconds
;
112 ans
[ai
].length
= UINT16_MAX
;
121 struct ask_forwarder_state
{
122 struct tevent_context
*ev
;
124 struct dns_name_packet in_packet
;
127 static void ask_forwarder_done(struct tevent_req
*subreq
);
129 static struct tevent_req
*ask_forwarder_send(
130 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
131 const char *forwarder
, struct dns_name_question
*question
)
133 struct tevent_req
*req
, *subreq
;
134 struct ask_forwarder_state
*state
;
135 struct dns_name_packet out_packet
= { 0, };
137 enum ndr_err_code ndr_err
;
139 req
= tevent_req_create(mem_ctx
, &state
, struct ask_forwarder_state
);
144 generate_random_buffer((uint8_t *)&state
->id
, sizeof(state
->id
));
146 if (!is_ipaddress(forwarder
)) {
147 DEBUG(0, ("Invalid 'dns forwarder' setting '%s', needs to be "
148 "an IP address\n", forwarder
));
149 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
150 return tevent_req_post(req
, ev
);
153 out_packet
.id
= state
->id
;
154 out_packet
.operation
|= DNS_OPCODE_QUERY
| DNS_FLAG_RECURSION_DESIRED
;
155 out_packet
.qdcount
= 1;
156 out_packet
.questions
= question
;
158 ndr_err
= ndr_push_struct_blob(
159 &out_blob
, state
, &out_packet
,
160 (ndr_push_flags_fn_t
)ndr_push_dns_name_packet
);
161 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
162 tevent_req_werror(req
, DNS_ERR(SERVER_FAILURE
));
163 return tevent_req_post(req
, ev
);
165 subreq
= dns_udp_request_send(state
, ev
, forwarder
, out_blob
.data
,
167 if (tevent_req_nomem(subreq
, req
)) {
168 return tevent_req_post(req
, ev
);
170 tevent_req_set_callback(subreq
, ask_forwarder_done
, req
);
174 static void ask_forwarder_done(struct tevent_req
*subreq
)
176 struct tevent_req
*req
= tevent_req_callback_data(
177 subreq
, struct tevent_req
);
178 struct ask_forwarder_state
*state
= tevent_req_data(
179 req
, struct ask_forwarder_state
);
181 enum ndr_err_code ndr_err
;
184 ret
= dns_udp_request_recv(subreq
, state
,
185 &in_blob
.data
, &in_blob
.length
);
187 if (tevent_req_werror(req
, ret
)) {
191 ndr_err
= ndr_pull_struct_blob(
192 &in_blob
, state
, &state
->in_packet
,
193 (ndr_pull_flags_fn_t
)ndr_pull_dns_name_packet
);
194 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
195 tevent_req_werror(req
, DNS_ERR(SERVER_FAILURE
));
198 if (state
->in_packet
.id
!= state
->id
) {
199 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
202 tevent_req_done(req
);
205 static WERROR
ask_forwarder_recv(
206 struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
207 struct dns_res_rec
**answers
, uint16_t *ancount
,
208 struct dns_res_rec
**nsrecs
, uint16_t *nscount
,
209 struct dns_res_rec
**additional
, uint16_t *arcount
)
211 struct ask_forwarder_state
*state
= tevent_req_data(
212 req
, struct ask_forwarder_state
);
213 struct dns_name_packet
*in_packet
= &state
->in_packet
;
216 if (tevent_req_is_werror(req
, &err
)) {
220 *ancount
= in_packet
->ancount
;
221 *answers
= talloc_move(mem_ctx
, &in_packet
->answers
);
223 *nscount
= in_packet
->nscount
;
224 *nsrecs
= talloc_move(mem_ctx
, &in_packet
->nsrecs
);
226 *arcount
= in_packet
->arcount
;
227 *additional
= talloc_move(mem_ctx
, &in_packet
->additional
);
232 static WERROR
handle_question(struct dns_server
*dns
,
234 const struct dns_name_question
*question
,
235 struct dns_res_rec
**answers
, uint16_t *ancount
)
237 struct dns_res_rec
*ans
= *answers
;
240 struct dnsp_DnssrvRpcRecord
*recs
;
241 uint16_t rec_count
, ai
= *ancount
;
242 struct ldb_dn
*dn
= NULL
;
244 werror
= dns_name2dn(dns
, mem_ctx
, question
->name
, &dn
);
245 W_ERROR_NOT_OK_RETURN(werror
);
247 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &recs
, &rec_count
);
248 W_ERROR_NOT_OK_RETURN(werror
);
250 ans
= talloc_realloc(mem_ctx
, ans
, struct dns_res_rec
, rec_count
+ ai
);
255 for (ri
= 0; ri
< rec_count
; ri
++) {
256 if ((recs
[ri
].wType
== DNS_TYPE_CNAME
) &&
257 ((question
->question_type
== DNS_QTYPE_A
) ||
258 (question
->question_type
== DNS_QTYPE_AAAA
))) {
259 struct dns_name_question
*new_q
=
260 talloc(mem_ctx
, struct dns_name_question
);
266 /* We reply with one more record, so grow the array */
267 ans
= talloc_realloc(mem_ctx
, ans
, struct dns_res_rec
,
274 /* First put in the CNAME record */
275 werror
= create_response_rr(question
, &recs
[ri
], &ans
, &ai
);
276 if (!W_ERROR_IS_OK(werror
)) {
280 /* And then look up the name it points at.. */
282 /* First build up the new question */
283 new_q
->question_type
= question
->question_type
;
284 new_q
->question_class
= question
->question_class
;
285 if (new_q
->question_type
== DNS_QTYPE_A
) {
286 new_q
->name
= talloc_strdup(new_q
, recs
[ri
].data
.ipv4
);
287 } else if (new_q
->question_type
== DNS_QTYPE_AAAA
) {
288 new_q
->name
= talloc_strdup(new_q
, recs
[ri
].data
.ipv6
);
290 if (new_q
->name
== NULL
) {
294 /* and then call the lookup again */
295 werror
= handle_question(dns
, mem_ctx
, new_q
, &ans
, &ai
);
296 if (!W_ERROR_IS_OK(werror
)) {
303 if ((question
->question_type
!= DNS_QTYPE_ALL
) &&
304 (recs
[ri
].wType
!= question
->question_type
)) {
307 werror
= create_response_rr(question
, &recs
[ri
], &ans
, &ai
);
308 if (!W_ERROR_IS_OK(werror
)) {
314 return DNS_ERR(NAME_ERROR
);
323 static NTSTATUS
accept_gss_ticket(TALLOC_CTX
*mem_ctx
,
324 struct dns_server
*dns
,
325 struct dns_server_tkey
*tkey
,
326 const DATA_BLOB
*key
,
328 uint16_t *dns_auth_error
)
332 status
= gensec_update(tkey
->gensec
, mem_ctx
, dns
->task
->event_ctx
,
335 if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED
, status
)) {
336 *dns_auth_error
= DNS_RCODE_OK
;
340 if (NT_STATUS_IS_OK(status
)) {
342 status
= gensec_session_info(tkey
->gensec
, tkey
, &tkey
->session_info
);
343 if (!NT_STATUS_IS_OK(status
)) {
344 *dns_auth_error
= DNS_RCODE_BADKEY
;
347 *dns_auth_error
= DNS_RCODE_OK
;
353 static struct dns_server_tkey
*find_tkey(struct dns_server_tkey_store
*store
,
356 struct dns_server_tkey
*tkey
= NULL
;
360 struct dns_server_tkey
*tmp_key
= store
->tkeys
[i
];
363 i
%= TKEY_BUFFER_SIZE
;
365 if (tmp_key
== NULL
) {
368 if (dns_name_equal(name
, tmp_key
->name
)) {
377 static NTSTATUS
create_tkey(struct dns_server
*dns
,
379 struct dns_server_tkey
**tkey
)
382 struct dns_server_tkey_store
*store
= dns
->tkeys
;
383 struct dns_server_tkey
*k
= talloc_zero(store
, struct dns_server_tkey
);
386 return NT_STATUS_NO_MEMORY
;
389 k
->name
= talloc_strdup(k
, name
);
391 if (k
->name
== NULL
) {
392 return NT_STATUS_NO_MEMORY
;
395 status
= samba_server_gensec_start(k
,
396 dns
->task
->event_ctx
,
399 dns
->server_credentials
,
402 if (!NT_STATUS_IS_OK(status
)) {
403 DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status
)));
408 gensec_want_feature(k
->gensec
, GENSEC_FEATURE_SIGN
);
410 status
= gensec_start_mech_by_oid(k
->gensec
, GENSEC_OID_SPNEGO
);
412 if (!NT_STATUS_IS_OK(status
)) {
413 DEBUG(1, ("Failed to start GENSEC server code: %s\n",
419 if (store
->tkeys
[store
->next_idx
] != NULL
) {
420 TALLOC_FREE(store
->tkeys
[store
->next_idx
]);
423 store
->tkeys
[store
->next_idx
] = k
;
425 store
->next_idx
%= store
->size
;
431 static WERROR
handle_tkey(struct dns_server
*dns
,
433 const struct dns_name_packet
*in
,
434 struct dns_res_rec
**answers
,
437 struct dns_res_rec
*in_tkey
= NULL
;
438 struct dns_res_rec
*ret_tkey
;
441 for (i
= 0; i
< in
->arcount
; i
++) {
442 if (in
->additional
[i
].rr_type
== DNS_QTYPE_TKEY
) {
443 in_tkey
= &in
->additional
[i
];
448 /* If this is a TKEY query, it should have a TKEY RR.
449 * Behaviour is not really specified in RFC 2930 or RFC 3645, but
450 * FORMAT_ERROR seems to be what BIND uses .*/
451 if (in_tkey
== NULL
) {
452 return DNS_ERR(FORMAT_ERROR
);
455 ret_tkey
= talloc_zero(mem_ctx
, struct dns_res_rec
);
456 if (ret_tkey
== NULL
) {
460 ret_tkey
->name
= talloc_strdup(ret_tkey
, in_tkey
->name
);
461 if (ret_tkey
->name
== NULL
) {
465 ret_tkey
->rr_type
= DNS_QTYPE_TKEY
;
466 ret_tkey
->rr_class
= DNS_QCLASS_ANY
;
467 ret_tkey
->length
= UINT16_MAX
;
469 ret_tkey
->rdata
.tkey_record
.algorithm
= talloc_strdup(ret_tkey
, ret_tkey
->name
);
470 if (ret_tkey
->rdata
.tkey_record
.algorithm
== NULL
) {
474 ret_tkey
->rdata
.tkey_record
.inception
= in_tkey
->rdata
.tkey_record
.inception
;
475 ret_tkey
->rdata
.tkey_record
.expiration
= in_tkey
->rdata
.tkey_record
.expiration
;
476 ret_tkey
->rdata
.tkey_record
.mode
= in_tkey
->rdata
.tkey_record
.mode
;
478 switch (in_tkey
->rdata
.tkey_record
.mode
) {
479 case DNS_TKEY_MODE_DH
:
480 /* FIXME: According to RFC 2930, we MUST support this, but we don't.
481 * Still, claim it's a bad key instead of a bad mode */
482 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
484 case DNS_TKEY_MODE_GSSAPI
: {
486 struct dns_server_tkey
*tkey
;
490 tkey
= find_tkey(dns
->tkeys
, in
->questions
[0].name
);
491 if (tkey
!= NULL
&& tkey
->complete
) {
492 /* TODO: check if the key is still valid */
493 DEBUG(1, ("Rejecting tkey negotiation for already established key\n"));
494 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADNAME
;
499 status
= create_tkey(dns
, in
->questions
[0].name
,
501 if (!NT_STATUS_IS_OK(status
)) {
502 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
503 return ntstatus_to_werror(status
);
507 key
.data
= in_tkey
->rdata
.tkey_record
.key_data
;
508 key
.length
= in_tkey
->rdata
.tkey_record
.key_size
;
510 status
= accept_gss_ticket(ret_tkey
, dns
, tkey
, &key
, &reply
,
511 &ret_tkey
->rdata
.tkey_record
.error
);
512 if (NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
513 DEBUG(1, ("More processing required\n"));
514 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
515 } else if (NT_STATUS_IS_OK(status
)) {
516 DEBUG(1, ("Tkey handshake completed\n"));
518 DEBUG(0, ("GSS key negotiation returned %s\n", nt_errstr(status
)));
519 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADKEY
;
524 case DNS_TKEY_MODE_DELETE
:
525 /* TODO: implement me */
526 DEBUG(1, ("Should delete tkey here\n"));
527 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_OK
;
529 case DNS_TKEY_MODE_NULL
:
530 case DNS_TKEY_MODE_SERVER
:
531 case DNS_TKEY_MODE_CLIENT
:
532 case DNS_TKEY_MODE_LAST
:
533 /* We don't have to implement these, return a mode error */
534 ret_tkey
->rdata
.tkey_record
.error
= DNS_RCODE_BADMODE
;
537 DEBUG(1, ("Unsupported TKEY mode %d\n",
538 in_tkey
->rdata
.tkey_record
.mode
));
547 struct dns_server_process_query_state
{
548 struct dns_res_rec
*answers
;
550 struct dns_res_rec
*nsrecs
;
552 struct dns_res_rec
*additional
;
556 static void dns_server_process_query_got_response(struct tevent_req
*subreq
);
558 struct tevent_req
*dns_server_process_query_send(
559 TALLOC_CTX
*mem_ctx
, struct tevent_context
*ev
,
560 struct dns_server
*dns
, struct dns_request_state
*req_state
,
561 const struct dns_name_packet
*in
)
563 struct tevent_req
*req
, *subreq
;
564 struct dns_server_process_query_state
*state
;
566 req
= tevent_req_create(mem_ctx
, &state
,
567 struct dns_server_process_query_state
);
571 if (in
->qdcount
!= 1) {
572 tevent_req_werror(req
, DNS_ERR(FORMAT_ERROR
));
573 return tevent_req_post(req
, ev
);
576 /* Windows returns NOT_IMPLEMENTED on this as well */
577 if (in
->questions
[0].question_class
== DNS_QCLASS_NONE
) {
578 tevent_req_werror(req
, DNS_ERR(NOT_IMPLEMENTED
));
579 return tevent_req_post(req
, ev
);
582 if (in
->questions
[0].question_type
== DNS_QTYPE_TKEY
) {
585 err
= handle_tkey(dns
, state
, in
, &state
->answers
,
587 if (tevent_req_werror(req
, err
)) {
588 return tevent_req_post(req
, ev
);
590 tevent_req_done(req
);
591 return tevent_req_post(req
, ev
);
594 if (dns_authorative_for_zone(dns
, in
->questions
[0].name
)) {
597 req_state
->flags
|= DNS_FLAG_AUTHORITATIVE
;
598 err
= handle_question(dns
, state
, &in
->questions
[0],
599 &state
->answers
, &state
->ancount
);
600 if (tevent_req_werror(req
, err
)) {
601 return tevent_req_post(req
, ev
);
603 tevent_req_done(req
);
604 return tevent_req_post(req
, ev
);
607 if ((req_state
->flags
& DNS_FLAG_RECURSION_DESIRED
) &&
608 (req_state
->flags
& DNS_FLAG_RECURSION_AVAIL
)) {
609 DEBUG(2, ("Not authoritative for '%s', forwarding\n",
610 in
->questions
[0].name
));
612 subreq
= ask_forwarder_send(
613 state
, ev
, lpcfg_dns_forwarder(dns
->task
->lp_ctx
),
615 if (tevent_req_nomem(subreq
, req
)) {
616 return tevent_req_post(req
, ev
);
618 tevent_req_set_callback(
619 subreq
, dns_server_process_query_got_response
, req
);
623 tevent_req_werror(req
, DNS_ERR(NAME_ERROR
));
624 return tevent_req_post(req
, ev
);
627 static void dns_server_process_query_got_response(struct tevent_req
*subreq
)
629 struct tevent_req
*req
= tevent_req_callback_data(
630 subreq
, struct tevent_req
);
631 struct dns_server_process_query_state
*state
= tevent_req_data(
632 req
, struct dns_server_process_query_state
);
635 err
= ask_forwarder_recv(subreq
, state
,
636 &state
->answers
, &state
->ancount
,
637 &state
->nsrecs
, &state
->nscount
,
638 &state
->additional
, &state
->arcount
);
640 if (tevent_req_werror(req
, err
)) {
643 tevent_req_done(req
);
646 WERROR
dns_server_process_query_recv(
647 struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
648 struct dns_res_rec
**answers
, uint16_t *ancount
,
649 struct dns_res_rec
**nsrecs
, uint16_t *nscount
,
650 struct dns_res_rec
**additional
, uint16_t *arcount
)
652 struct dns_server_process_query_state
*state
= tevent_req_data(
653 req
, struct dns_server_process_query_state
);
656 if (tevent_req_is_werror(req
, &err
)) {
659 *answers
= talloc_move(mem_ctx
, &state
->answers
);
660 *ancount
= state
->ancount
;
661 *nsrecs
= talloc_move(mem_ctx
, &state
->nsrecs
);
662 *nscount
= state
->nscount
;
663 *additional
= talloc_move(mem_ctx
, &state
->additional
);
664 *arcount
= state
->arcount
;