s4 dns: Improve logging of delegated dns updates
[Samba/gebeck_regimport.git] / source4 / dns_server / dns_update.c
blobaa80b52bdd70847ece89839e00dd4b5f9994daf2
1 /*
2 Unix SMB/CIFS implementation.
4 DNS server handler for update requests
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "includes.h"
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
27 #include <ldb.h>
28 #include "param/param.h"
29 #include "param/loadparm.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "smbd/service_task.h"
33 #include "dns_server/dns_server.h"
34 #include "auth/auth.h"
36 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
37 const struct dns_res_rec *rrec,
38 struct dnsp_DnssrvRpcRecord *r);
40 static WERROR check_one_prerequisite(struct dns_server *dns,
41 TALLOC_CTX *mem_ctx,
42 const struct dns_name_question *zone,
43 const struct dns_res_rec *pr,
44 bool *final_result)
46 bool match;
47 WERROR werror;
48 struct ldb_dn *dn;
49 uint16_t i;
50 bool found = false;
51 struct dnsp_DnssrvRpcRecord *rec = NULL;
52 struct dnsp_DnssrvRpcRecord *ans;
53 uint16_t acount;
55 size_t host_part_len = 0;
57 *final_result = true;
59 if (pr->ttl != 0) {
60 return DNS_ERR(FORMAT_ERROR);
63 match = dns_name_match(zone->name, pr->name, &host_part_len);
64 if (!match) {
65 return DNS_ERR(NOTZONE);
68 werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
69 W_ERROR_NOT_OK_RETURN(werror);
71 if (pr->rr_class == DNS_QCLASS_ANY) {
73 if (pr->length != 0) {
74 return DNS_ERR(FORMAT_ERROR);
78 if (pr->rr_type == DNS_QTYPE_ALL) {
81 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
82 W_ERROR_NOT_OK_RETURN(werror);
84 if (acount == 0) {
85 return DNS_ERR(NAME_ERROR);
87 } else {
90 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
91 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
92 return DNS_ERR(NXRRSET);
94 W_ERROR_NOT_OK_RETURN(werror);
96 for (i = 0; i < acount; i++) {
97 if (ans[i].wType == pr->rr_type) {
98 found = true;
99 break;
102 if (!found) {
103 return DNS_ERR(NXRRSET);
108 * RFC2136 3.2.5 doesn't actually mention the need to return
109 * OK here, but otherwise we'd always return a FORMAT_ERROR
110 * later on. This also matches Microsoft DNS behavior.
112 return WERR_OK;
115 if (pr->rr_class == DNS_QCLASS_NONE) {
116 if (pr->length != 0) {
117 return DNS_ERR(FORMAT_ERROR);
120 if (pr->rr_type == DNS_QTYPE_ALL) {
123 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
124 if (W_ERROR_EQUAL(werror, WERR_OK)) {
125 return DNS_ERR(YXDOMAIN);
127 } else {
130 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
131 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
132 werror = WERR_OK;
133 ans = NULL;
134 acount = 0;
137 for (i = 0; i < acount; i++) {
138 if (ans[i].wType == pr->rr_type) {
139 found = true;
140 break;
143 if (found) {
144 return DNS_ERR(YXRRSET);
149 * RFC2136 3.2.5 doesn't actually mention the need to return
150 * OK here, but otherwise we'd always return a FORMAT_ERROR
151 * later on. This also matches Microsoft DNS behavior.
153 return WERR_OK;
156 if (pr->rr_class != zone->question_class) {
157 return DNS_ERR(FORMAT_ERROR);
160 *final_result = false;
162 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
163 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
164 return DNS_ERR(NXRRSET);
166 W_ERROR_NOT_OK_RETURN(werror);
168 rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
169 W_ERROR_HAVE_NO_MEMORY(rec);
171 werror = dns_rr_to_dnsp(rec, pr, rec);
172 W_ERROR_NOT_OK_RETURN(werror);
174 for (i = 0; i < acount; i++) {
175 if (dns_records_match(rec, &ans[i])) {
176 found = true;
177 break;
181 if (!found) {
182 return DNS_ERR(NXRRSET);
185 return WERR_OK;
188 static WERROR check_prerequisites(struct dns_server *dns,
189 TALLOC_CTX *mem_ctx,
190 const struct dns_name_question *zone,
191 const struct dns_res_rec *prereqs, uint16_t count)
193 uint16_t i;
194 WERROR final_error = WERR_OK;
196 for (i = 0; i < count; i++) {
197 bool final;
198 WERROR werror;
200 werror = check_one_prerequisite(dns, mem_ctx, zone,
201 &prereqs[i], &final);
202 if (!W_ERROR_IS_OK(werror)) {
203 if (final) {
204 return werror;
206 if (W_ERROR_IS_OK(final_error)) {
207 final_error = werror;
212 if (!W_ERROR_IS_OK(final_error)) {
213 return final_error;
216 return WERR_OK;
219 static WERROR update_prescan(const struct dns_name_question *zone,
220 const struct dns_res_rec *updates, uint16_t count)
222 const struct dns_res_rec *r;
223 uint16_t i;
224 size_t host_part_len;
225 bool match;
227 for (i = 0; i < count; i++) {
228 r = &updates[i];
229 match = dns_name_match(zone->name, r->name, &host_part_len);
230 if (!match) {
231 return DNS_ERR(NOTZONE);
233 if (zone->question_class == r->rr_class) {
234 if (r->rr_type == DNS_QTYPE_ALL) {
235 return DNS_ERR(FORMAT_ERROR);
237 if (r->rr_type == DNS_QTYPE_AXFR) {
238 return DNS_ERR(FORMAT_ERROR);
240 if (r->rr_type == DNS_QTYPE_MAILB) {
241 return DNS_ERR(FORMAT_ERROR);
243 if (r->rr_type == DNS_QTYPE_MAILA) {
244 return DNS_ERR(FORMAT_ERROR);
246 } else if (r->rr_class == DNS_QCLASS_ANY) {
247 if (r->ttl != 0) {
248 return DNS_ERR(FORMAT_ERROR);
250 if (r->length != 0) {
251 return DNS_ERR(FORMAT_ERROR);
253 if (r->rr_type == DNS_QTYPE_AXFR) {
254 return DNS_ERR(FORMAT_ERROR);
256 if (r->rr_type == DNS_QTYPE_MAILB) {
257 return DNS_ERR(FORMAT_ERROR);
259 if (r->rr_type == DNS_QTYPE_MAILA) {
260 return DNS_ERR(FORMAT_ERROR);
262 } else if (r->rr_class == DNS_QCLASS_NONE) {
263 if (r->ttl != 0) {
264 return DNS_ERR(FORMAT_ERROR);
266 if (r->rr_type == DNS_QTYPE_ALL) {
267 return DNS_ERR(FORMAT_ERROR);
269 if (r->rr_type == DNS_QTYPE_AXFR) {
270 return DNS_ERR(FORMAT_ERROR);
272 if (r->rr_type == DNS_QTYPE_MAILB) {
273 return DNS_ERR(FORMAT_ERROR);
275 if (r->rr_type == DNS_QTYPE_MAILA) {
276 return DNS_ERR(FORMAT_ERROR);
278 } else {
279 return DNS_ERR(FORMAT_ERROR);
282 return WERR_OK;
285 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
286 const struct dns_res_rec *rrec,
287 struct dnsp_DnssrvRpcRecord *r)
289 char *tmp;
290 char *txt_record_txt;
291 char *saveptr = NULL;
293 if (rrec->rr_type == DNS_QTYPE_ALL) {
294 return DNS_ERR(FORMAT_ERROR);
297 ZERO_STRUCTP(r);
299 r->wType = rrec->rr_type;
300 r->dwTtlSeconds = rrec->ttl;
301 r->rank = DNS_RANK_ZONE;
302 /* TODO: Autogenerate this somehow */
303 r->dwSerial = 110;
305 /* If we get QCLASS_ANY, we're done here */
306 if (rrec->rr_class == DNS_QCLASS_ANY) {
307 goto done;
310 switch(rrec->rr_type) {
311 case DNS_QTYPE_A:
312 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
313 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
314 break;
315 case DNS_QTYPE_AAAA:
316 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
317 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
318 break;
319 case DNS_QTYPE_NS:
320 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
321 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
322 break;
323 case DNS_QTYPE_CNAME:
324 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
325 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
326 break;
327 case DNS_QTYPE_SRV:
328 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
329 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
330 r->data.srv.wPort = rrec->rdata.srv_record.port;
331 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
332 rrec->rdata.srv_record.target);
333 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
334 break;
335 case DNS_QTYPE_PTR:
336 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
337 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
338 break;
339 case DNS_QTYPE_MX:
340 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
341 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
342 rrec->rdata.mx_record.exchange);
343 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
344 break;
345 case DNS_QTYPE_TXT:
346 r->data.txt.count = 0;
347 r->data.txt.str = talloc_array(mem_ctx, const char *,
348 r->data.txt.count);
349 W_ERROR_HAVE_NO_MEMORY(r->data.txt.str);
351 txt_record_txt = talloc_strdup(r->data.txt.str,
352 rrec->rdata.txt_record.txt);
353 W_ERROR_HAVE_NO_MEMORY(txt_record_txt);
355 tmp = strtok_r(txt_record_txt, "\"", &saveptr);
356 while (tmp) {
357 if (strcmp(tmp, " ") == 0) {
358 tmp = strtok_r(NULL, "\"", &saveptr);
359 continue;
361 r->data.txt.str = talloc_realloc(mem_ctx, r->data.txt.str, const char *,
362 r->data.txt.count+1);
363 r->data.txt.str[r->data.txt.count] = talloc_strdup(r->data.txt.str, tmp);
364 W_ERROR_HAVE_NO_MEMORY(r->data.txt.str[r->data.txt.count]);
366 r->data.txt.count++;
367 tmp = strtok_r(NULL, "\"", &saveptr);
370 break;
371 default:
372 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
373 return DNS_ERR(NOT_IMPLEMENTED);
376 done:
378 return WERR_OK;
382 static WERROR handle_one_update(struct dns_server *dns,
383 TALLOC_CTX *mem_ctx,
384 const struct dns_name_question *zone,
385 const struct dns_res_rec *update,
386 const struct dns_server_tkey *tkey)
388 struct dnsp_DnssrvRpcRecord *recs = NULL;
389 uint16_t rcount = 0;
390 struct ldb_dn *dn;
391 uint16_t i;
392 WERROR werror;
393 bool needs_add = false;
394 uint32_t access_mask = 0;
396 DEBUG(2, ("Looking at record: \n"));
397 if (DEBUGLVL(2)) {
398 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
401 switch (update->rr_type) {
402 case DNS_QTYPE_A:
403 case DNS_QTYPE_NS:
404 case DNS_QTYPE_CNAME:
405 case DNS_QTYPE_SOA:
406 case DNS_QTYPE_PTR:
407 case DNS_QTYPE_MX:
408 case DNS_QTYPE_AAAA:
409 case DNS_QTYPE_SRV:
410 case DNS_QTYPE_TXT:
411 break;
412 default:
413 DEBUG(0, ("Can't handle updates of type %u yet\n",
414 update->rr_type));
415 return DNS_ERR(NOT_IMPLEMENTED);
418 werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
419 W_ERROR_NOT_OK_RETURN(werror);
421 werror = dns_lookup_records(dns, mem_ctx, dn, &recs, &rcount);
422 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
423 recs = NULL;
424 rcount = 0;
425 needs_add = true;
426 werror = WERR_OK;
427 access_mask = SEC_ADS_CREATE_CHILD;
429 W_ERROR_NOT_OK_RETURN(werror);
431 access_mask = SEC_STD_REQUIRED | SEC_ADS_SELF_WRITE;
433 if (tkey != NULL) {
434 int ldb_ret;
435 ldb_ret = dsdb_check_access_on_dn(dns->samdb, mem_ctx, dn,
436 tkey->session_info->security_token,
437 access_mask, NULL);
438 if (ldb_ret != LDB_SUCCESS) {
439 DEBUG(5, ("Disallowing update: %s\n", ldb_strerror(ldb_ret)));
440 return DNS_ERR(REFUSED);
442 DEBUG(5, ("Allowing signed update\n"));
445 if (update->rr_class == zone->question_class) {
446 if (update->rr_type == DNS_QTYPE_CNAME) {
448 * If there is a record in the directory
449 * that's not a CNAME, ignore update
451 for (i = 0; i < rcount; i++) {
452 if (recs[i].wType != DNS_TYPE_CNAME) {
453 DEBUG(5, ("Skipping update\n"));
454 return WERR_OK;
456 break;
460 * There should be no entries besides one CNAME record
461 * per name, so replace everything with the new CNAME
464 rcount = 1;
465 recs = talloc_realloc(mem_ctx, recs,
466 struct dnsp_DnssrvRpcRecord, rcount);
467 W_ERROR_HAVE_NO_MEMORY(recs);
469 werror = dns_rr_to_dnsp(recs, update, &recs[0]);
470 W_ERROR_NOT_OK_RETURN(werror);
472 werror = dns_replace_records(dns, mem_ctx, dn,
473 needs_add, recs, rcount);
474 W_ERROR_NOT_OK_RETURN(werror);
476 return WERR_OK;
477 } else {
479 * If there is a CNAME record for this name,
480 * ignore update
482 for (i = 0; i < rcount; i++) {
483 if (recs[i].wType == DNS_TYPE_CNAME) {
484 DEBUG(5, ("Skipping update\n"));
485 return WERR_OK;
489 if (update->rr_type == DNS_QTYPE_SOA) {
490 bool found = false;
493 * If the zone has no SOA record?? or update's
494 * serial number is smaller than existing SOA's,
495 * ignore update
497 for (i = 0; i < rcount; i++) {
498 if (recs[i].wType == DNS_TYPE_SOA) {
499 uint16_t n, o;
501 n = update->rdata.soa_record.serial;
502 o = recs[i].data.soa.serial;
504 * TODO: Implement RFC 1982 comparison
505 * logic for RFC2136
507 if (n <= o) {
508 DEBUG(5, ("Skipping update\n"));
509 return WERR_OK;
511 found = true;
512 break;
515 if (!found) {
516 DEBUG(5, ("Skipping update\n"));
517 return WERR_OK;
520 werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
521 W_ERROR_NOT_OK_RETURN(werror);
523 for (i++; i < rcount; i++) {
524 if (recs[i].wType != DNS_TYPE_SOA) {
525 continue;
528 ZERO_STRUCT(recs[i]);
531 werror = dns_replace_records(dns, mem_ctx, dn,
532 needs_add, recs, rcount);
533 W_ERROR_NOT_OK_RETURN(werror);
535 return WERR_OK;
538 recs = talloc_realloc(mem_ctx, recs,
539 struct dnsp_DnssrvRpcRecord, rcount+1);
540 W_ERROR_HAVE_NO_MEMORY(recs);
542 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
543 W_ERROR_NOT_OK_RETURN(werror);
545 for (i = 0; i < rcount; i++) {
546 if (!dns_records_match(&recs[i], &recs[rcount])) {
547 continue;
550 recs[i] = recs[rcount];
552 werror = dns_replace_records(dns, mem_ctx, dn,
553 needs_add, recs, rcount);
554 W_ERROR_NOT_OK_RETURN(werror);
556 return WERR_OK;
559 werror = dns_replace_records(dns, mem_ctx, dn,
560 needs_add, recs, rcount+1);
561 W_ERROR_NOT_OK_RETURN(werror);
563 return WERR_OK;
564 } else if (update->rr_class == DNS_QCLASS_ANY) {
565 if (update->rr_type == DNS_QTYPE_ALL) {
566 if (dns_name_equal(update->name, zone->name)) {
567 for (i = 0; i < rcount; i++) {
569 if (recs[i].wType == DNS_TYPE_SOA) {
570 continue;
573 if (recs[i].wType == DNS_TYPE_NS) {
574 continue;
577 ZERO_STRUCT(recs[i]);
580 } else {
581 for (i = 0; i < rcount; i++) {
582 ZERO_STRUCT(recs[i]);
586 } else if (dns_name_equal(update->name, zone->name)) {
588 if (update->rr_type == DNS_QTYPE_SOA) {
589 return WERR_OK;
592 if (update->rr_type == DNS_QTYPE_NS) {
593 return WERR_OK;
596 for (i = 0; i < rcount; i++) {
597 if (recs[i].wType == update->rr_type) {
598 ZERO_STRUCT(recs[i]);
602 werror = dns_replace_records(dns, mem_ctx, dn,
603 needs_add, recs, rcount);
604 W_ERROR_NOT_OK_RETURN(werror);
606 return WERR_OK;
607 } else if (update->rr_class == DNS_QCLASS_NONE) {
608 struct dnsp_DnssrvRpcRecord *del_rec;
610 if (update->rr_type == DNS_QTYPE_SOA) {
611 return WERR_OK;
613 if (update->rr_type == DNS_QTYPE_NS) {
614 bool found = false;
615 struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
616 struct dnsp_DnssrvRpcRecord);
617 W_ERROR_HAVE_NO_MEMORY(ns_rec);
620 werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
621 W_ERROR_NOT_OK_RETURN(werror);
623 for (i = 0; i < rcount; i++) {
624 if (dns_records_match(ns_rec, &recs[i])) {
625 found = true;
626 break;
629 if (found) {
630 return WERR_OK;
634 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
635 W_ERROR_HAVE_NO_MEMORY(del_rec);
637 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
638 W_ERROR_NOT_OK_RETURN(werror);
640 for (i = 0; i < rcount; i++) {
641 if (dns_records_match(del_rec, &recs[i])) {
642 ZERO_STRUCT(recs[i]);
646 werror = dns_replace_records(dns, mem_ctx, dn,
647 needs_add, recs, rcount);
648 W_ERROR_NOT_OK_RETURN(werror);
651 return WERR_OK;
654 static WERROR handle_updates(struct dns_server *dns,
655 TALLOC_CTX *mem_ctx,
656 const struct dns_name_question *zone,
657 const struct dns_res_rec *prereqs, uint16_t pcount,
658 struct dns_res_rec *updates, uint16_t upd_count,
659 struct dns_server_tkey *tkey)
661 struct ldb_dn *zone_dn = NULL;
662 WERROR werror = WERR_OK;
663 int ret;
664 uint16_t ri;
665 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
667 werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
668 W_ERROR_NOT_OK_RETURN(werror);
670 ret = ldb_transaction_start(dns->samdb);
671 if (ret != LDB_SUCCESS) {
672 return DNS_ERR(SERVER_FAILURE);
675 werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
676 W_ERROR_NOT_OK_GOTO(werror, failed);
678 DEBUG(1, ("update count is %u\n", upd_count));
680 for (ri = 0; ri < upd_count; ri++) {
681 werror = handle_one_update(dns, tmp_ctx, zone,
682 &updates[ri], tkey);
683 W_ERROR_NOT_OK_GOTO(werror, failed);
686 ldb_transaction_commit(dns->samdb);
687 TALLOC_FREE(tmp_ctx);
688 return WERR_OK;
690 failed:
691 ldb_transaction_cancel(dns->samdb);
692 TALLOC_FREE(tmp_ctx);
693 return werror;
697 static WERROR dns_update_allowed(struct dns_server *dns,
698 struct dns_request_state *state,
699 struct dns_server_tkey **tkey)
701 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
702 DEBUG(2, ("All updates allowed.\n"));
703 return WERR_OK;
706 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
707 DEBUG(2, ("Updates disabled.\n"));
708 return DNS_ERR(REFUSED);
711 if (state->authenticated == false ) {
712 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
713 return DNS_ERR(REFUSED);
716 *tkey = dns_find_tkey(dns->tkeys, state->key_name);
717 if (*tkey == NULL) {
718 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
719 return DNS_ERR(REFUSED);
722 return WERR_OK;
726 WERROR dns_server_process_update(struct dns_server *dns,
727 struct dns_request_state *state,
728 TALLOC_CTX *mem_ctx,
729 struct dns_name_packet *in,
730 struct dns_res_rec **prereqs, uint16_t *prereq_count,
731 struct dns_res_rec **updates, uint16_t *update_count,
732 struct dns_res_rec **additional, uint16_t *arcount)
734 struct dns_name_question *zone;
735 const struct dns_server_zone *z;
736 size_t host_part_len = 0;
737 WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
738 struct dns_server_tkey *tkey = NULL;
740 if (in->qdcount != 1) {
741 return DNS_ERR(FORMAT_ERROR);
744 zone = &in->questions[0];
746 if (zone->question_class != DNS_QCLASS_IN &&
747 zone->question_class != DNS_QCLASS_ANY) {
748 return DNS_ERR(NOT_IMPLEMENTED);
751 if (zone->question_type != DNS_QTYPE_SOA) {
752 return DNS_ERR(FORMAT_ERROR);
755 DEBUG(2, ("Got a dns update request.\n"));
757 for (z = dns->zones; z != NULL; z = z->next) {
758 bool match;
760 match = dns_name_match(z->name, zone->name, &host_part_len);
761 if (match) {
762 break;
766 if (z == NULL) {
767 DEBUG(1, ("We're not authoritative for this zone\n"));
768 return DNS_ERR(NOTAUTH);
771 if (host_part_len != 0) {
772 /* TODO: We need to delegate this one */
773 DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
774 return DNS_ERR(NOT_IMPLEMENTED);
777 *prereq_count = in->ancount;
778 *prereqs = in->answers;
779 werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
780 *prereq_count);
781 W_ERROR_NOT_OK_RETURN(werror);
783 werror = dns_update_allowed(dns, state, &tkey);
784 if (!W_ERROR_IS_OK(werror)) {
785 return werror;
788 *update_count = in->nscount;
789 *updates = in->nsrecs;
790 werror = update_prescan(in->questions, *updates, *update_count);
791 W_ERROR_NOT_OK_RETURN(werror);
793 werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
794 *prereq_count, *updates, *update_count, tkey);
795 W_ERROR_NOT_OK_RETURN(werror);
797 return werror;