s4 dns: Actually handle the update request
[Samba/gebeck_regimport.git] / source4 / dns_server / dns_update.c
blob64b6181d7e349d881cbf65de626dd88283209ded
1 /*
2 Unix SMB/CIFS implementation.
4 DNS server handler for update requests
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "includes.h"
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
27 #include <ldb.h>
28 #include "dsdb/samdb/samdb.h"
29 #include "dsdb/common/util.h"
30 #include "dns_server/dns_server.h"
32 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
33 const struct dns_res_rec *rrec,
34 struct dnsp_DnssrvRpcRecord *r);
36 static WERROR check_one_prerequisite(struct dns_server *dns,
37 TALLOC_CTX *mem_ctx,
38 const struct dns_name_question *zone,
39 const struct dns_res_rec *pr,
40 bool *final_result)
42 bool match;
43 WERROR werror;
44 struct ldb_dn *dn;
45 uint16_t i;
46 bool found = false;
47 struct dnsp_DnssrvRpcRecord *rec = NULL;
48 struct dnsp_DnssrvRpcRecord *ans;
49 uint16_t acount;
51 size_t host_part_len = 0;
53 *final_result = true;
55 if (pr->ttl != 0) {
56 return DNS_ERR(FORMAT_ERROR);
59 match = dns_name_match(zone->name, pr->name, &host_part_len);
60 if (!match) {
61 return DNS_ERR(NOTZONE);
64 werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
65 W_ERROR_NOT_OK_RETURN(werror);
67 if (pr->rr_class == DNS_QCLASS_ANY) {
69 if (pr->length != 0) {
70 return DNS_ERR(FORMAT_ERROR);
74 if (pr->rr_type == DNS_QTYPE_ALL) {
77 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
78 W_ERROR_NOT_OK_RETURN(werror);
80 if (acount == 0) {
81 return DNS_ERR(NAME_ERROR);
83 } else {
86 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
87 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
88 return DNS_ERR(NXRRSET);
90 W_ERROR_NOT_OK_RETURN(werror);
92 for (i = 0; i < acount; i++) {
93 if (ans[i].wType == pr->rr_type) {
94 found = true;
95 break;
98 if (!found) {
99 return DNS_ERR(NXRRSET);
104 * RFC2136 3.2.5 doesn't actually mention the need to return
105 * OK here, but otherwise we'd always return a FORMAT_ERROR
106 * later on. This also matches Microsoft DNS behavior.
108 return WERR_OK;
111 if (pr->rr_class == DNS_QCLASS_NONE) {
112 if (pr->length != 0) {
113 return DNS_ERR(FORMAT_ERROR);
116 if (pr->rr_type == DNS_QTYPE_ALL) {
119 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
120 if (W_ERROR_EQUAL(werror, WERR_OK)) {
121 return DNS_ERR(YXDOMAIN);
123 } else {
126 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
127 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
128 werror = WERR_OK;
129 ans = NULL;
130 acount = 0;
133 for (i = 0; i < acount; i++) {
134 if (ans[i].wType == pr->rr_type) {
135 found = true;
136 break;
139 if (found) {
140 return DNS_ERR(YXRRSET);
145 * RFC2136 3.2.5 doesn't actually mention the need to return
146 * OK here, but otherwise we'd always return a FORMAT_ERROR
147 * later on. This also matches Microsoft DNS behavior.
149 return WERR_OK;
152 if (pr->rr_class != zone->question_class) {
153 return DNS_ERR(FORMAT_ERROR);
156 *final_result = false;
158 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
159 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
160 return DNS_ERR(NXRRSET);
162 W_ERROR_NOT_OK_RETURN(werror);
164 rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
165 W_ERROR_HAVE_NO_MEMORY(rec);
167 werror = dns_rr_to_dnsp(rec, pr, rec);
168 W_ERROR_NOT_OK_RETURN(werror);
170 for (i = 0; i < acount; i++) {
171 if (dns_records_match(rec, &ans[i])) {
172 found = true;
173 break;
177 if (!found) {
178 return DNS_ERR(NXRRSET);
181 return WERR_OK;
184 static WERROR check_prerequisites(struct dns_server *dns,
185 TALLOC_CTX *mem_ctx,
186 const struct dns_name_question *zone,
187 const struct dns_res_rec *prereqs, uint16_t count)
189 uint16_t i;
190 WERROR final_error = WERR_OK;
192 for (i = 0; i < count; i++) {
193 bool final;
194 WERROR werror;
196 werror = check_one_prerequisite(dns, mem_ctx, zone,
197 &prereqs[i], &final);
198 if (!W_ERROR_IS_OK(werror)) {
199 if (final) {
200 return werror;
202 if (W_ERROR_IS_OK(final_error)) {
203 final_error = werror;
208 if (!W_ERROR_IS_OK(final_error)) {
209 return final_error;
212 return WERR_OK;
215 static WERROR update_prescan(const struct dns_name_question *zone,
216 const struct dns_res_rec *updates, uint16_t count)
218 const struct dns_res_rec *r;
219 uint16_t i;
220 size_t host_part_len;
221 bool match;
223 for (i = 0; i < count; i++) {
224 r = &updates[i];
225 match = dns_name_match(zone->name, r->name, &host_part_len);
226 if (!match) {
227 return DNS_ERR(NOTZONE);
229 if (zone->question_class == r->rr_class) {
230 if (r->rr_type == DNS_QTYPE_ALL) {
231 return DNS_ERR(FORMAT_ERROR);
233 if (r->rr_type == DNS_QTYPE_AXFR) {
234 return DNS_ERR(FORMAT_ERROR);
236 if (r->rr_type == DNS_QTYPE_MAILB) {
237 return DNS_ERR(FORMAT_ERROR);
239 if (r->rr_type == DNS_QTYPE_MAILA) {
240 return DNS_ERR(FORMAT_ERROR);
242 } else if (r->rr_class == DNS_QCLASS_ANY) {
243 if (r->ttl != 0) {
244 return DNS_ERR(FORMAT_ERROR);
246 if (r->length != 0) {
247 return DNS_ERR(FORMAT_ERROR);
249 if (r->rr_type == DNS_QTYPE_AXFR) {
250 return DNS_ERR(FORMAT_ERROR);
252 if (r->rr_type == DNS_QTYPE_MAILB) {
253 return DNS_ERR(FORMAT_ERROR);
255 if (r->rr_type == DNS_QTYPE_MAILA) {
256 return DNS_ERR(FORMAT_ERROR);
258 } else if (r->rr_class == DNS_QCLASS_NONE) {
259 if (r->ttl != 0) {
260 return DNS_ERR(FORMAT_ERROR);
262 if (r->rr_type == DNS_QTYPE_ALL) {
263 return DNS_ERR(FORMAT_ERROR);
265 if (r->rr_type == DNS_QTYPE_AXFR) {
266 return DNS_ERR(FORMAT_ERROR);
268 if (r->rr_type == DNS_QTYPE_MAILB) {
269 return DNS_ERR(FORMAT_ERROR);
271 if (r->rr_type == DNS_QTYPE_MAILA) {
272 return DNS_ERR(FORMAT_ERROR);
274 } else {
275 return DNS_ERR(FORMAT_ERROR);
278 return WERR_OK;
281 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
282 const struct dns_res_rec *rrec,
283 struct dnsp_DnssrvRpcRecord *r)
285 if (rrec->rr_type == DNS_QTYPE_ALL) {
286 return DNS_ERR(FORMAT_ERROR);
289 ZERO_STRUCTP(r);
291 r->wType = rrec->rr_type;
292 r->dwTtlSeconds = rrec->ttl;
293 r->rank = DNS_RANK_ZONE;
294 /* TODO: Autogenerate this somehow */
295 r->dwSerial = 110;
297 /* If we get QCLASS_ANY, we're done here */
298 if (rrec->rr_class == DNS_QCLASS_ANY) {
299 goto done;
302 switch(rrec->rr_type) {
303 case DNS_QTYPE_A:
304 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
305 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
306 break;
307 case DNS_QTYPE_AAAA:
308 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
309 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
310 break;
311 case DNS_QTYPE_NS:
312 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
313 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
314 break;
315 case DNS_QTYPE_CNAME:
316 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
317 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
318 break;
319 case DNS_QTYPE_SRV:
320 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
321 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
322 r->data.srv.wPort = rrec->rdata.srv_record.port;
323 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
324 rrec->rdata.srv_record.target);
325 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
326 break;
327 case DNS_QTYPE_MX:
328 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
329 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
330 rrec->rdata.mx_record.exchange);
331 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
332 break;
333 case DNS_QTYPE_TXT:
334 r->data.txt = talloc_strdup(mem_ctx, rrec->rdata.txt_record.txt);
335 W_ERROR_HAVE_NO_MEMORY(r->data.txt);
336 break;
337 default:
338 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
339 return DNS_ERR(NOT_IMPLEMENTED);
342 done:
344 return WERR_OK;
348 static WERROR handle_one_update(struct dns_server *dns,
349 TALLOC_CTX *mem_ctx,
350 const struct dns_name_question *zone,
351 const struct dns_res_rec *update)
353 struct dnsp_DnssrvRpcRecord *recs = NULL;
354 uint16_t rcount = 0;
355 struct ldb_dn *dn;
356 uint16_t i;
357 WERROR werror;
358 bool needs_add = false;
360 DEBUG(1, ("Looking at record: \n"));
361 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
363 switch (update->rr_type) {
364 case DNS_QTYPE_A:
365 break;
366 case DNS_QTYPE_NS:
367 break;
368 case DNS_QTYPE_CNAME:
369 break;
370 case DNS_QTYPE_SOA:
371 break;
372 case DNS_QTYPE_PTR:
373 break;
374 case DNS_QTYPE_MX:
375 break;
376 case DNS_QTYPE_AAAA:
377 break;
378 case DNS_QTYPE_SRV:
379 break;
380 case DNS_QTYPE_TXT:
381 break;
382 default:
383 return DNS_ERR(NOT_IMPLEMENTED);
386 werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
387 W_ERROR_NOT_OK_RETURN(werror);
389 werror = dns_lookup_records(dns, mem_ctx, dn, &recs, &rcount);
390 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
391 recs = NULL;
392 rcount = 0;
393 needs_add = true;
394 werror = WERR_OK;
396 W_ERROR_NOT_OK_RETURN(werror);
398 if (update->rr_class == zone->question_class) {
399 if (update->rr_type == DNS_QTYPE_CNAME) {
401 * If there is a record in the directory
402 * that's not a CNAME, ignore update
404 for (i = 0; i < rcount; i++) {
405 if (recs[i].wType != DNS_TYPE_CNAME) {
406 DEBUG(0, ("Skipping update\n"));
407 return WERR_OK;
409 break;
413 * There should be no entries besides one CNAME record
414 * per name, so replace everything with the new CNAME
417 rcount = 1;
418 recs = talloc_realloc(mem_ctx, recs,
419 struct dnsp_DnssrvRpcRecord, rcount);
420 W_ERROR_HAVE_NO_MEMORY(recs);
422 werror = dns_rr_to_dnsp(recs, update, &recs[0]);
423 W_ERROR_NOT_OK_RETURN(werror);
425 werror = dns_replace_records(dns, mem_ctx, dn,
426 needs_add, recs, rcount);
427 W_ERROR_NOT_OK_RETURN(werror);
429 return WERR_OK;
430 } else {
432 * If there is a CNAME record for this name,
433 * ignore update
435 for (i = 0; i < rcount; i++) {
436 if (recs[i].wType == DNS_TYPE_CNAME) {
437 DEBUG(0, ("Skipping update\n"));
438 return WERR_OK;
442 if (update->rr_type == DNS_QTYPE_SOA) {
443 bool found = false;
446 * If the zone has no SOA record?? or update's
447 * serial number is smaller than existing SOA's,
448 * ignore update
450 for (i = 0; i < rcount; i++) {
451 if (recs[i].wType == DNS_TYPE_SOA) {
452 uint16_t n, o;
454 n = update->rdata.soa_record.serial;
455 o = recs[i].data.soa.serial;
457 * TODO: Implement RFC 1982 comparison
458 * logic for RFC2136
460 if (n <= o) {
461 DEBUG(0, ("Skipping update\n"));
462 return WERR_OK;
464 found = true;
465 break;
468 if (!found) {
469 DEBUG(0, ("Skipping update\n"));
470 return WERR_OK;
473 werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
474 W_ERROR_NOT_OK_RETURN(werror);
476 for (i++; i < rcount; i++) {
477 if (recs[i].wType != DNS_TYPE_SOA) {
478 continue;
481 ZERO_STRUCT(recs[i]);
484 werror = dns_replace_records(dns, mem_ctx, dn,
485 needs_add, recs, rcount);
486 W_ERROR_NOT_OK_RETURN(werror);
488 return WERR_OK;
491 recs = talloc_realloc(mem_ctx, recs,
492 struct dnsp_DnssrvRpcRecord, rcount+1);
493 W_ERROR_HAVE_NO_MEMORY(recs);
495 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
496 W_ERROR_NOT_OK_RETURN(werror);
498 for (i = 0; i < rcount; i++) {
499 if (!dns_records_match(&recs[i], &recs[rcount])) {
500 continue;
503 recs[i] = recs[rcount];
505 werror = dns_replace_records(dns, mem_ctx, dn,
506 needs_add, recs, rcount);
507 W_ERROR_NOT_OK_RETURN(werror);
509 return WERR_OK;
512 werror = dns_replace_records(dns, mem_ctx, dn,
513 needs_add, recs, rcount+1);
514 W_ERROR_NOT_OK_RETURN(werror);
516 return WERR_OK;
517 } else if (update->rr_class == DNS_QCLASS_ANY) {
518 if (update->rr_type == DNS_QTYPE_ALL) {
519 if (dns_name_equal(update->name, zone->name)) {
520 for (i = 0; i < rcount; i++) {
522 if (recs[i].wType == DNS_TYPE_SOA) {
523 continue;
526 if (recs[i].wType == DNS_TYPE_NS) {
527 continue;
530 ZERO_STRUCT(recs[i]);
533 } else {
534 for (i = 0; i < rcount; i++) {
535 ZERO_STRUCT(recs[i]);
539 } else if (dns_name_equal(update->name, zone->name)) {
541 if (update->rr_type == DNS_QTYPE_SOA) {
542 return WERR_OK;
545 if (update->rr_type == DNS_QTYPE_NS) {
546 return WERR_OK;
549 for (i = 0; i < rcount; i++) {
550 if (recs[i].wType == update->rr_type) {
551 ZERO_STRUCT(recs[i]);
555 werror = dns_replace_records(dns, mem_ctx, dn,
556 needs_add, recs, rcount);
557 W_ERROR_NOT_OK_RETURN(werror);
559 return WERR_OK;
560 } else if (update->rr_class == DNS_QCLASS_NONE) {
561 struct dnsp_DnssrvRpcRecord *del_rec;
563 if (update->rr_type == DNS_QTYPE_SOA) {
564 return WERR_OK;
566 if (update->rr_type == DNS_QTYPE_NS) {
567 bool found = false;
568 struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
569 struct dnsp_DnssrvRpcRecord);
570 W_ERROR_HAVE_NO_MEMORY(ns_rec);
573 werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
574 W_ERROR_NOT_OK_RETURN(werror);
576 for (i = 0; i < rcount; i++) {
577 if (dns_records_match(ns_rec, &recs[i])) {
578 found = true;
579 break;
582 if (found) {
583 return WERR_OK;
587 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
588 W_ERROR_HAVE_NO_MEMORY(del_rec);
590 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
591 W_ERROR_NOT_OK_RETURN(werror);
593 for (i = 0; i < rcount; i++) {
594 if (dns_records_match(del_rec, &recs[i])) {
595 ZERO_STRUCT(recs[i]);
600 return WERR_OK;
603 static WERROR handle_updates(struct dns_server *dns,
604 TALLOC_CTX *mem_ctx,
605 const struct dns_name_question *zone,
606 const struct dns_res_rec *prereqs, uint16_t pcount,
607 struct dns_res_rec *updates, uint16_t upd_count)
609 struct ldb_dn *zone_dn = NULL;
610 WERROR werror = WERR_OK;
611 int ret;
612 uint16_t ri;
613 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
615 werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
616 W_ERROR_NOT_OK_RETURN(werror);
618 ret = ldb_transaction_start(dns->samdb);
619 if (ret != LDB_SUCCESS) {
620 return DNS_ERR(SERVER_FAILURE);
623 werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
624 W_ERROR_NOT_OK_GOTO(werror, failed);
626 DEBUG(0, ("update count is %u\n", upd_count));
628 for (ri = 0; ri < upd_count; ri++) {
629 werror = handle_one_update(dns, tmp_ctx, zone,
630 &updates[ri]);
631 W_ERROR_NOT_OK_GOTO(werror, failed);
634 ldb_transaction_commit(dns->samdb);
635 TALLOC_FREE(tmp_ctx);
636 return WERR_OK;
638 failed:
639 ldb_transaction_cancel(dns->samdb);
640 TALLOC_FREE(tmp_ctx);
641 return werror;
645 WERROR dns_server_process_update(struct dns_server *dns,
646 TALLOC_CTX *mem_ctx,
647 struct dns_name_packet *in,
648 struct dns_res_rec **prereqs, uint16_t *prereq_count,
649 struct dns_res_rec **updates, uint16_t *update_count,
650 struct dns_res_rec **additional, uint16_t *arcount)
652 struct dns_name_question *zone;
653 const struct dns_server_zone *z;
654 size_t host_part_len = 0;
655 WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
656 bool update_allowed = false;
658 if (in->qdcount != 1) {
659 return DNS_ERR(FORMAT_ERROR);
662 zone = &in->questions[0];
664 if (zone->question_class != DNS_QCLASS_IN &&
665 zone->question_class != DNS_QCLASS_ANY) {
666 return DNS_ERR(NOT_IMPLEMENTED);
669 if (zone->question_type != DNS_QTYPE_SOA) {
670 return DNS_ERR(FORMAT_ERROR);
673 DEBUG(0, ("Got a dns update request.\n"));
675 for (z = dns->zones; z != NULL; z = z->next) {
676 bool match;
678 match = dns_name_match(z->name, zone->name, &host_part_len);
679 if (match) {
680 break;
684 if (z == NULL) {
685 return DNS_ERR(NOTAUTH);
688 if (host_part_len != 0) {
689 /* TODO: We need to delegate this one */
690 return DNS_ERR(NOT_IMPLEMENTED);
693 *prereq_count = in->ancount;
694 *prereqs = in->answers;
695 werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
696 *prereq_count);
697 W_ERROR_NOT_OK_RETURN(werror);
699 /* TODO: Check if update is allowed, we probably want "always",
700 * key-based GSSAPI, key-based bind-style TSIG and "never" as
701 * smb.conf options. */
702 if (!update_allowed) {
703 return DNS_ERR(REFUSED);
706 *update_count = in->nscount;
707 *updates = in->nsrecs;
708 werror = update_prescan(in->questions, *updates, *update_count);
709 W_ERROR_NOT_OK_RETURN(werror);
712 werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
713 *prereq_count, *updates, *update_count);
714 W_ERROR_NOT_OK_RETURN(werror);
716 return werror;