source4/dns_server/dns_update.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DNS server handler for update requests
   5
   6    Copyright (C) 2010 Kai Blin  <kai@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/util/ntstatus.h"
  24 #include "librpc/ndr/libndr.h"
  25 #include "librpc/gen_ndr/ndr_dns.h"
  26 #include "librpc/gen_ndr/ndr_dnsp.h"
  27 #include <ldb.h>
  28 #include "dsdb/samdb/samdb.h"
  29 #include "dsdb/common/util.h"
  30 #include "dns_server/dns_server.h"
  31
  32 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
  33                              const struct dns_res_rec *rrec,
  34                              struct dnsp_DnssrvRpcRecord *r);
  35
  36 static WERROR check_one_prerequisite(struct dns_server *dns,
  37                                      TALLOC_CTX *mem_ctx,
  38                                      const struct dns_name_question *zone,
  39                                      const struct dns_res_rec *pr,
  40                                      bool *final_result)
  41 {
  42         bool match;
  43         WERROR werror;
  44         struct ldb_dn *dn;
  45         uint16_t i;
  46         bool found = false;
  47         struct dnsp_DnssrvRpcRecord *rec = NULL;
  48         struct dnsp_DnssrvRpcRecord *ans;
  49         uint16_t acount;
  50
  51         size_t host_part_len = 0;
  52
  53         *final_result = true;
  54
  55         if (pr->ttl != 0) {
  56                 return DNS_ERR(FORMAT_ERROR);
  57         }
  58
  59         match = dns_name_match(zone->name, pr->name, &host_part_len);
  60         if (!match) {
  61                 return DNS_ERR(NOTZONE);
  62         }
  63
  64         werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
  65         W_ERROR_NOT_OK_RETURN(werror);
  66
  67         if (pr->rr_class == DNS_QCLASS_ANY) {
  68
  69                 if (pr->length != 0) {
  70                         return DNS_ERR(FORMAT_ERROR);
  71                 }
  72
  73
  74                 if (pr->rr_type == DNS_QTYPE_ALL) {
  75                         /*
  76                          */
  77                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
  78                         W_ERROR_NOT_OK_RETURN(werror);
  79
  80                         if (acount == 0) {
  81                                 return DNS_ERR(NAME_ERROR);
  82                         }
  83                 } else {
  84                         /*
  85                          */
  86                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
  87                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
  88                                 return DNS_ERR(NXRRSET);
  89                         }
  90                         W_ERROR_NOT_OK_RETURN(werror);
  91
  92                         for (i = 0; i < acount; i++) {
  93                                 if (ans[i].wType == pr->rr_type) {
  94                                         found = true;
  95                                         break;
  96                                 }
  97                         }
  98                         if (!found) {
  99                                 return DNS_ERR(NXRRSET);
 100                         }
 101                 }
 102
 103                 /*
 104                  * RFC2136 3.2.5 doesn't actually mention the need to return
 105                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 106                  * later on. This also matches Microsoft DNS behavior.
 107                  */
 108                 return WERR_OK;
 109         }
 110
 111         if (pr->rr_class == DNS_QCLASS_NONE) {
 112                 if (pr->length != 0) {
 113                         return DNS_ERR(FORMAT_ERROR);
 114                 }
 115
 116                 if (pr->rr_type == DNS_QTYPE_ALL) {
 117                         /*
 118                          */
 119                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 120                         if (W_ERROR_EQUAL(werror, WERR_OK)) {
 121                                 return DNS_ERR(YXDOMAIN);
 122                         }
 123                 } else {
 124                         /*
 125                          */
 126                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 127                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 128                                 werror = WERR_OK;
 129                                 ans = NULL;
 130                                 acount = 0;
 131                         }
 132
 133                         for (i = 0; i < acount; i++) {
 134                                 if (ans[i].wType == pr->rr_type) {
 135                                         found = true;
 136                                         break;
 137                                 }
 138                         }
 139                         if (found) {
 140                                 return DNS_ERR(YXRRSET);
 141                         }
 142                 }
 143
 144                 /*
 145                  * RFC2136 3.2.5 doesn't actually mention the need to return
 146                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 147                  * later on. This also matches Microsoft DNS behavior.
 148                  */
 149                 return WERR_OK;
 150         }
 151
 152         if (pr->rr_class != zone->question_class) {
 153                 return DNS_ERR(FORMAT_ERROR);
 154         }
 155
 156         *final_result = false;
 157
 158         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 159         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 160                 return DNS_ERR(NXRRSET);
 161         }
 162         W_ERROR_NOT_OK_RETURN(werror);
 163
 164         rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
 165         W_ERROR_HAVE_NO_MEMORY(rec);
 166
 167         werror = dns_rr_to_dnsp(rec, pr, rec);
 168         W_ERROR_NOT_OK_RETURN(werror);
 169
 170         for (i = 0; i < acount; i++) {
 171                 if (dns_records_match(rec, &ans[i])) {
 172                         found = true;
 173                         break;
 174                 }
 175         }
 176
 177         if (!found) {
 178                 return DNS_ERR(NXRRSET);
 179         }
 180
 181         return WERR_OK;
 182 }
 183
 184 static WERROR check_prerequisites(struct dns_server *dns,
 185                                   TALLOC_CTX *mem_ctx,
 186                                   const struct dns_name_question *zone,
 187                                   const struct dns_res_rec *prereqs, uint16_t count)
 188 {
 189         uint16_t i;
 190         WERROR final_error = WERR_OK;
 191
 192         for (i = 0; i < count; i++) {
 193                 bool final;
 194                 WERROR werror;
 195
 196                 werror = check_one_prerequisite(dns, mem_ctx, zone,
 197                                                 &prereqs[i], &final);
 198                 if (!W_ERROR_IS_OK(werror)) {
 199                         if (final) {
 200                                 return werror;
 201                         }
 202                         if (W_ERROR_IS_OK(final_error)) {
 203                                 final_error = werror;
 204                         }
 205                 }
 206         }
 207
 208         if (!W_ERROR_IS_OK(final_error)) {
 209                 return final_error;
 210         }
 211
 212         return WERR_OK;
 213 }
 214
 215 static WERROR update_prescan(const struct dns_name_question *zone,
 216                              const struct dns_res_rec *updates, uint16_t count)
 217 {
 218         const struct dns_res_rec *r;
 219         uint16_t i;
 220         size_t host_part_len;
 221         bool match;
 222
 223         for (i = 0; i < count; i++) {
 224                 r = &updates[i];
 225                 match = dns_name_match(zone->name, r->name, &host_part_len);
 226                 if (!match) {
 227                         return DNS_ERR(NOTZONE);
 228                 }
 229                 if (zone->question_class == r->rr_class) {
 230                         if (r->rr_type == DNS_QTYPE_ALL) {
 231                                 return DNS_ERR(FORMAT_ERROR);
 232                         }
 233                         if (r->rr_type == DNS_QTYPE_AXFR) {
 234                                 return DNS_ERR(FORMAT_ERROR);
 235                         }
 236                         if (r->rr_type == DNS_QTYPE_MAILB) {
 237                                 return DNS_ERR(FORMAT_ERROR);
 238                         }
 239                         if (r->rr_type == DNS_QTYPE_MAILA) {
 240                                 return DNS_ERR(FORMAT_ERROR);
 241                         }
 242                 } else if (r->rr_class == DNS_QCLASS_ANY) {
 243                         if (r->ttl != 0) {
 244                                 return DNS_ERR(FORMAT_ERROR);
 245                         }
 246                         if (r->length != 0) {
 247                                 return DNS_ERR(FORMAT_ERROR);
 248                         }
 249                         if (r->rr_type == DNS_QTYPE_AXFR) {
 250                                 return DNS_ERR(FORMAT_ERROR);
 251                         }
 252                         if (r->rr_type == DNS_QTYPE_MAILB) {
 253                                 return DNS_ERR(FORMAT_ERROR);
 254                         }
 255                         if (r->rr_type == DNS_QTYPE_MAILA) {
 256                                 return DNS_ERR(FORMAT_ERROR);
 257                         }
 258                 } else if (r->rr_class == DNS_QCLASS_NONE) {
 259                         if (r->ttl != 0) {
 260                                 return DNS_ERR(FORMAT_ERROR);
 261                         }
 262                         if (r->rr_type == DNS_QTYPE_ALL) {
 263                                 return DNS_ERR(FORMAT_ERROR);
 264                         }
 265                         if (r->rr_type == DNS_QTYPE_AXFR) {
 266                                 return DNS_ERR(FORMAT_ERROR);
 267                         }
 268                         if (r->rr_type == DNS_QTYPE_MAILB) {
 269                                 return DNS_ERR(FORMAT_ERROR);
 270                         }
 271                         if (r->rr_type == DNS_QTYPE_MAILA) {
 272                                 return DNS_ERR(FORMAT_ERROR);
 273                         }
 274                 } else {
 275                         return DNS_ERR(FORMAT_ERROR);
 276                 }
 277         }
 278         return WERR_OK;
 279 }
 280
 281 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
 282                              const struct dns_res_rec *rrec,
 283                              struct dnsp_DnssrvRpcRecord *r)
 284 {
 285         if (rrec->rr_type == DNS_QTYPE_ALL) {
 286                 return DNS_ERR(FORMAT_ERROR);
 287         }
 288
 289         ZERO_STRUCTP(r);
 290
 291         r->wType = rrec->rr_type;
 292         r->dwTtlSeconds = rrec->ttl;
 293         r->rank = DNS_RANK_ZONE;
 294         /* TODO: Autogenerate this somehow */
 295         r->dwSerial = 110;
 296
 297         /* If we get QCLASS_ANY, we're done here */
 298         if (rrec->rr_class == DNS_QCLASS_ANY) {
 299                 goto done;
 300         }
 301
 302         switch(rrec->rr_type) {
 303         case DNS_QTYPE_A:
 304                 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
 305                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
 306                 break;
 307         case DNS_QTYPE_AAAA:
 308                 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
 309                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
 310                 break;
 311         case DNS_QTYPE_NS:
 312                 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
 313                 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
 314                 break;
 315         case DNS_QTYPE_CNAME:
 316                 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
 317                 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
 318                 break;
 319         case DNS_QTYPE_SRV:
 320                 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
 321                 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
 322                 r->data.srv.wPort = rrec->rdata.srv_record.port;
 323                 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
 324                                 rrec->rdata.srv_record.target);
 325                 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
 326                 break;
 327         case DNS_QTYPE_MX:
 328                 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
 329                 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
 330                                 rrec->rdata.mx_record.exchange);
 331                 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
 332                 break;
 333         case DNS_QTYPE_TXT:
 334                 r->data.txt = talloc_strdup(mem_ctx, rrec->rdata.txt_record.txt);
 335                 W_ERROR_HAVE_NO_MEMORY(r->data.txt);
 336                 break;
 337         default:
 338                 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
 339                 return DNS_ERR(NOT_IMPLEMENTED);
 340         }
 341
 342 done:
 343
 344         return WERR_OK;
 345 }
 346
 347
 348 static WERROR handle_one_update(struct dns_server *dns,
 349                                 TALLOC_CTX *mem_ctx,
 350                                 const struct dns_name_question *zone,
 351                                 const struct dns_res_rec *update)
 352 {
 353         struct dnsp_DnssrvRpcRecord *recs = NULL;
 354         uint16_t rcount = 0;
 355         struct ldb_dn *dn;
 356         uint16_t i;
 357         WERROR werror;
 358         bool needs_add = false;
 359
 360         DEBUG(1, ("Looking at record: \n"));
 361         NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
 362
 363         switch (update->rr_type) {
 364         case DNS_QTYPE_A:
 365                 break;
 366         case DNS_QTYPE_NS:
 367                 break;
 368         case DNS_QTYPE_CNAME:
 369                 break;
 370         case DNS_QTYPE_SOA:
 371                 break;
 372         case DNS_QTYPE_PTR:
 373                 break;
 374         case DNS_QTYPE_MX:
 375                 break;
 376         case DNS_QTYPE_AAAA:
 377                 break;
 378         case DNS_QTYPE_SRV:
 379                 break;
 380         case DNS_QTYPE_TXT:
 381                 break;
 382         default:
 383                 return DNS_ERR(NOT_IMPLEMENTED);
 384         }
 385
 386         werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
 387         W_ERROR_NOT_OK_RETURN(werror);
 388
 389         werror = dns_lookup_records(dns, mem_ctx, dn, &recs, &rcount);
 390         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 391                 recs = NULL;
 392                 rcount = 0;
 393                 needs_add = true;
 394                 werror = WERR_OK;
 395         }
 396         W_ERROR_NOT_OK_RETURN(werror);
 397
 398         if (update->rr_class == zone->question_class) {
 399                 if (update->rr_type == DNS_QTYPE_CNAME) {
 400                         /*
 401                          * If there is a record in the directory
 402                          * that's not a CNAME, ignore update
 403                          */
 404                         for (i = 0; i < rcount; i++) {
 405                                 if (recs[i].wType != DNS_TYPE_CNAME) {
 406                                         DEBUG(0, ("Skipping update\n"));
 407                                         return WERR_OK;
 408                                 }
 409                                 break;
 410                         }
 411
 412                         /*
 413                          * There should be no entries besides one CNAME record
 414                          * per name, so replace everything with the new CNAME
 415                          */
 416
 417                         rcount = 1;
 418                         recs = talloc_realloc(mem_ctx, recs,
 419                                         struct dnsp_DnssrvRpcRecord, rcount);
 420                         W_ERROR_HAVE_NO_MEMORY(recs);
 421
 422                         werror = dns_rr_to_dnsp(recs, update, &recs[0]);
 423                         W_ERROR_NOT_OK_RETURN(werror);
 424
 425                         werror = dns_replace_records(dns, mem_ctx, dn,
 426                                                      needs_add, recs, rcount);
 427                         W_ERROR_NOT_OK_RETURN(werror);
 428
 429                         return WERR_OK;
 430                 } else {
 431                         /*
 432                          * If there is a CNAME record for this name,
 433                          * ignore update
 434                          */
 435                         for (i = 0; i < rcount; i++) {
 436                                 if (recs[i].wType == DNS_TYPE_CNAME) {
 437                                         DEBUG(0, ("Skipping update\n"));
 438                                         return WERR_OK;
 439                                 }
 440                         }
 441                 }
 442                 if (update->rr_type == DNS_QTYPE_SOA) {
 443                         bool found = false;
 444
 445                         /*
 446                          * If the zone has no SOA record?? or update's
 447                          * serial number is smaller than existing SOA's,
 448                          * ignore update
 449                          */
 450                         for (i = 0; i < rcount; i++) {
 451                                 if (recs[i].wType == DNS_TYPE_SOA) {
 452                                         uint16_t n, o;
 453
 454                                         n = update->rdata.soa_record.serial;
 455                                         o = recs[i].data.soa.serial;
 456                                         /*
 457                                          * TODO: Implement RFC 1982 comparison
 458                                          * logic for RFC2136
 459                                          */
 460                                         if (n <= o) {
 461                                                 DEBUG(0, ("Skipping update\n"));
 462                                                 return WERR_OK;
 463                                         }
 464                                         found = true;
 465                                         break;
 466                                 }
 467                         }
 468                         if (!found) {
 469                                 DEBUG(0, ("Skipping update\n"));
 470                                 return WERR_OK;
 471                         }
 472
 473                         werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
 474                         W_ERROR_NOT_OK_RETURN(werror);
 475
 476                         for (i++; i < rcount; i++) {
 477                                 if (recs[i].wType != DNS_TYPE_SOA) {
 478                                         continue;
 479                                 }
 480
 481                                 ZERO_STRUCT(recs[i]);
 482                         }
 483
 484                         werror = dns_replace_records(dns, mem_ctx, dn,
 485                                                      needs_add, recs, rcount);
 486                         W_ERROR_NOT_OK_RETURN(werror);
 487
 488                         return WERR_OK;
 489                 }
 490
 491                 recs = talloc_realloc(mem_ctx, recs,
 492                                 struct dnsp_DnssrvRpcRecord, rcount+1);
 493                 W_ERROR_HAVE_NO_MEMORY(recs);
 494
 495                 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
 496                 W_ERROR_NOT_OK_RETURN(werror);
 497
 498                 for (i = 0; i < rcount; i++) {
 499                         if (!dns_records_match(&recs[i], &recs[rcount])) {
 500                                 continue;
 501                         }
 502
 503                         recs[i] = recs[rcount];
 504
 505                         werror = dns_replace_records(dns, mem_ctx, dn,
 506                                                      needs_add, recs, rcount);
 507                         W_ERROR_NOT_OK_RETURN(werror);
 508
 509                         return WERR_OK;
 510                 }
 511
 512                 werror = dns_replace_records(dns, mem_ctx, dn,
 513                                              needs_add, recs, rcount+1);
 514                 W_ERROR_NOT_OK_RETURN(werror);
 515
 516                 return WERR_OK;
 517         } else if (update->rr_class == DNS_QCLASS_ANY) {
 518                 if (update->rr_type == DNS_QTYPE_ALL) {
 519                         if (dns_name_equal(update->name, zone->name)) {
 520                                 for (i = 0; i < rcount; i++) {
 521
 522                                         if (recs[i].wType == DNS_TYPE_SOA) {
 523                                                 continue;
 524                                         }
 525
 526                                         if (recs[i].wType == DNS_TYPE_NS) {
 527                                                 continue;
 528                                         }
 529
 530                                         ZERO_STRUCT(recs[i]);
 531                                 }
 532
 533                         } else {
 534                                 for (i = 0; i < rcount; i++) {
 535                                         ZERO_STRUCT(recs[i]);
 536                                 }
 537                         }
 538
 539                 } else if (dns_name_equal(update->name, zone->name)) {
 540
 541                         if (update->rr_type == DNS_QTYPE_SOA) {
 542                                 return WERR_OK;
 543                         }
 544
 545                         if (update->rr_type == DNS_QTYPE_NS) {
 546                                 return WERR_OK;
 547                         }
 548                 }
 549                 for (i = 0; i < rcount; i++) {
 550                         if (recs[i].wType == update->rr_type) {
 551                                 ZERO_STRUCT(recs[i]);
 552                         }
 553                 }
 554
 555                 werror = dns_replace_records(dns, mem_ctx, dn,
 556                                              needs_add, recs, rcount);
 557                 W_ERROR_NOT_OK_RETURN(werror);
 558
 559                 return WERR_OK;
 560         } else if (update->rr_class == DNS_QCLASS_NONE) {
 561                 struct dnsp_DnssrvRpcRecord *del_rec;
 562
 563                 if (update->rr_type == DNS_QTYPE_SOA) {
 564                         return WERR_OK;
 565                 }
 566                 if (update->rr_type == DNS_QTYPE_NS) {
 567                         bool found = false;
 568                         struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
 569                                                 struct dnsp_DnssrvRpcRecord);
 570                         W_ERROR_HAVE_NO_MEMORY(ns_rec);
 571
 572
 573                         werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
 574                         W_ERROR_NOT_OK_RETURN(werror);
 575
 576                         for (i = 0; i < rcount; i++) {
 577                                 if (dns_records_match(ns_rec, &recs[i])) {
 578                                         found = true;
 579                                         break;
 580                                 }
 581                         }
 582                         if (found) {
 583                                 return WERR_OK;
 584                         }
 585                 }
 586
 587                 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
 588                 W_ERROR_HAVE_NO_MEMORY(del_rec);
 589
 590                 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
 591                 W_ERROR_NOT_OK_RETURN(werror);
 592
 593                 for (i = 0; i < rcount; i++) {
 594                         if (dns_records_match(del_rec, &recs[i])) {
 595                                 ZERO_STRUCT(recs[i]);
 596                         }
 597                 }
 598         }
 599
 600         return WERR_OK;
 601 }
 602
 603 static WERROR handle_updates(struct dns_server *dns,
 604                              TALLOC_CTX *mem_ctx,
 605                              const struct dns_name_question *zone,
 606                              const struct dns_res_rec *prereqs, uint16_t pcount,
 607                              struct dns_res_rec *updates, uint16_t upd_count)
 608 {
 609         struct ldb_dn *zone_dn = NULL;
 610         WERROR werror = WERR_OK;
 611         int ret;
 612         uint16_t ri;
 613         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 614
 615         werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
 616         W_ERROR_NOT_OK_RETURN(werror);
 617
 618         ret = ldb_transaction_start(dns->samdb);
 619         if (ret != LDB_SUCCESS) {
 620                 return DNS_ERR(SERVER_FAILURE);
 621         }
 622
 623         werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
 624         W_ERROR_NOT_OK_GOTO(werror, failed);
 625
 626         DEBUG(0, ("update count is %u\n", upd_count));
 627
 628         for (ri = 0; ri < upd_count; ri++) {
 629                 werror = handle_one_update(dns, tmp_ctx, zone,
 630                                            &updates[ri]);
 631                 W_ERROR_NOT_OK_GOTO(werror, failed);
 632         }
 633
 634         ldb_transaction_commit(dns->samdb);
 635         TALLOC_FREE(tmp_ctx);
 636         return WERR_OK;
 637
 638 failed:
 639         ldb_transaction_cancel(dns->samdb);
 640         TALLOC_FREE(tmp_ctx);
 641         return werror;
 642
 643 }
 644
 645 WERROR dns_server_process_update(struct dns_server *dns,
 646                                  TALLOC_CTX *mem_ctx,
 647                                  struct dns_name_packet *in,
 648                                  struct dns_res_rec **prereqs,    uint16_t *prereq_count,
 649                                  struct dns_res_rec **updates,    uint16_t *update_count,
 650                                  struct dns_res_rec **additional, uint16_t *arcount)
 651 {
 652         struct dns_name_question *zone;
 653         const struct dns_server_zone *z;
 654         size_t host_part_len = 0;
 655         WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
 656         bool update_allowed = false;
 657
 658         if (in->qdcount != 1) {
 659                 return DNS_ERR(FORMAT_ERROR);
 660         }
 661
 662         zone = &in->questions[0];
 663
 664         if (zone->question_class != DNS_QCLASS_IN &&
 665             zone->question_class != DNS_QCLASS_ANY) {
 666                 return DNS_ERR(NOT_IMPLEMENTED);
 667         }
 668
 669         if (zone->question_type != DNS_QTYPE_SOA) {
 670                 return DNS_ERR(FORMAT_ERROR);
 671         }
 672
 673         DEBUG(0, ("Got a dns update request.\n"));
 674
 675         for (z = dns->zones; z != NULL; z = z->next) {
 676                 bool match;
 677
 678                 match = dns_name_match(z->name, zone->name, &host_part_len);
 679                 if (match) {
 680                         break;
 681                 }
 682         }
 683
 684         if (z == NULL) {
 685                 return DNS_ERR(NOTAUTH);
 686         }
 687
 688         if (host_part_len != 0) {
 689                 /* TODO: We need to delegate this one */
 690                 return DNS_ERR(NOT_IMPLEMENTED);
 691         }
 692
 693         *prereq_count = in->ancount;
 694         *prereqs = in->answers;
 695         werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
 696                                      *prereq_count);
 697         W_ERROR_NOT_OK_RETURN(werror);
 698
 699         /* TODO: Check if update is allowed, we probably want "always",
 700          * key-based GSSAPI, key-based bind-style TSIG and "never" as
 701          * smb.conf options. */
 702         if (!update_allowed) {
 703                 return DNS_ERR(REFUSED);
 704         }
 705
 706         *update_count = in->nscount;
 707         *updates = in->nsrecs;
 708         werror = update_prescan(in->questions, *updates, *update_count);
 709         W_ERROR_NOT_OK_RETURN(werror);
 710
 711
 712         werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
 713                                 *prereq_count, *updates, *update_count);
 714         W_ERROR_NOT_OK_RETURN(werror);
 715
 716         return werror;
 717 }