2 Unix SMB/CIFS implementation.
4 DNS server handler for update requests
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
28 #include "dsdb/samdb/samdb.h"
29 #include "dsdb/common/util.h"
30 #include "dns_server/dns_server.h"
32 static WERROR
dns_rr_to_dnsp(TALLOC_CTX
*mem_ctx
,
33 const struct dns_res_rec
*rrec
,
34 struct dnsp_DnssrvRpcRecord
*r
);
36 static WERROR
check_one_prerequisite(struct dns_server
*dns
,
38 const struct dns_name_question
*zone
,
39 const struct dns_res_rec
*pr
,
47 struct dnsp_DnssrvRpcRecord
*rec
= NULL
;
48 struct dnsp_DnssrvRpcRecord
*ans
;
51 size_t host_part_len
= 0;
56 return DNS_ERR(FORMAT_ERROR
);
59 match
= dns_name_match(zone
->name
, pr
->name
, &host_part_len
);
61 return DNS_ERR(NOTZONE
);
64 werror
= dns_name2dn(dns
, mem_ctx
, pr
->name
, &dn
);
65 W_ERROR_NOT_OK_RETURN(werror
);
67 if (pr
->rr_class
== DNS_QCLASS_ANY
) {
69 if (pr
->length
!= 0) {
70 return DNS_ERR(FORMAT_ERROR
);
74 if (pr
->rr_type
== DNS_QTYPE_ALL
) {
77 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &ans
, &acount
);
78 W_ERROR_NOT_OK_RETURN(werror
);
81 return DNS_ERR(NAME_ERROR
);
86 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &ans
, &acount
);
87 if (W_ERROR_EQUAL(werror
, DNS_ERR(NAME_ERROR
))) {
88 return DNS_ERR(NXRRSET
);
90 W_ERROR_NOT_OK_RETURN(werror
);
92 for (i
= 0; i
< acount
; i
++) {
93 if (ans
[i
].wType
== pr
->rr_type
) {
99 return DNS_ERR(NXRRSET
);
104 * RFC2136 3.2.5 doesn't actually mention the need to return
105 * OK here, but otherwise we'd always return a FORMAT_ERROR
106 * later on. This also matches Microsoft DNS behavior.
111 if (pr
->rr_class
== DNS_QCLASS_NONE
) {
112 if (pr
->length
!= 0) {
113 return DNS_ERR(FORMAT_ERROR
);
116 if (pr
->rr_type
== DNS_QTYPE_ALL
) {
119 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &ans
, &acount
);
120 if (W_ERROR_EQUAL(werror
, WERR_OK
)) {
121 return DNS_ERR(YXDOMAIN
);
126 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &ans
, &acount
);
127 if (W_ERROR_EQUAL(werror
, DNS_ERR(NAME_ERROR
))) {
133 for (i
= 0; i
< acount
; i
++) {
134 if (ans
[i
].wType
== pr
->rr_type
) {
140 return DNS_ERR(YXRRSET
);
145 * RFC2136 3.2.5 doesn't actually mention the need to return
146 * OK here, but otherwise we'd always return a FORMAT_ERROR
147 * later on. This also matches Microsoft DNS behavior.
152 if (pr
->rr_class
!= zone
->question_class
) {
153 return DNS_ERR(FORMAT_ERROR
);
156 *final_result
= false;
158 werror
= dns_lookup_records(dns
, mem_ctx
, dn
, &ans
, &acount
);
159 if (W_ERROR_EQUAL(werror
, DNS_ERR(NAME_ERROR
))) {
160 return DNS_ERR(NXRRSET
);
162 W_ERROR_NOT_OK_RETURN(werror
);
164 rec
= talloc_zero(mem_ctx
, struct dnsp_DnssrvRpcRecord
);
165 W_ERROR_HAVE_NO_MEMORY(rec
);
167 werror
= dns_rr_to_dnsp(rec
, pr
, rec
);
168 W_ERROR_NOT_OK_RETURN(werror
);
170 for (i
= 0; i
< acount
; i
++) {
171 if (dns_records_match(rec
, &ans
[i
])) {
178 return DNS_ERR(NXRRSET
);
184 static WERROR
check_prerequisites(struct dns_server
*dns
,
186 const struct dns_name_question
*zone
,
187 const struct dns_res_rec
*prereqs
, uint16_t count
)
190 WERROR final_error
= WERR_OK
;
192 for (i
= 0; i
< count
; i
++) {
196 werror
= check_one_prerequisite(dns
, mem_ctx
, zone
,
197 &prereqs
[i
], &final
);
198 if (!W_ERROR_IS_OK(werror
)) {
202 if (W_ERROR_IS_OK(final_error
)) {
203 final_error
= werror
;
208 if (!W_ERROR_IS_OK(final_error
)) {
215 static WERROR
update_prescan(const struct dns_name_question
*zone
,
216 const struct dns_res_rec
*updates
, uint16_t count
)
218 const struct dns_res_rec
*r
;
220 size_t host_part_len
;
223 for (i
= 0; i
< count
; i
++) {
225 match
= dns_name_match(zone
->name
, r
->name
, &host_part_len
);
227 return DNS_ERR(NOTZONE
);
229 if (zone
->question_class
== r
->rr_class
) {
230 /*TODO: also check for AXFR,MAILA,MAILB */
231 if (r
->rr_type
== DNS_QTYPE_ALL
) {
232 return DNS_ERR(FORMAT_ERROR
);
234 } else if (r
->rr_class
== DNS_QCLASS_ANY
) {
235 if (r
->ttl
!= 0 || r
->length
!= 0) {
236 return DNS_ERR(FORMAT_ERROR
);
238 } else if (r
->rr_class
== DNS_QCLASS_NONE
) {
239 if (r
->ttl
!= 0 || r
->rr_type
== DNS_QTYPE_ALL
) {
240 return DNS_ERR(FORMAT_ERROR
);
243 return DNS_ERR(FORMAT_ERROR
);
249 static WERROR
dns_rr_to_dnsp(TALLOC_CTX
*mem_ctx
,
250 const struct dns_res_rec
*rrec
,
251 struct dnsp_DnssrvRpcRecord
*r
)
253 if (rrec
->rr_type
== DNS_QTYPE_ALL
) {
254 return DNS_ERR(FORMAT_ERROR
);
259 r
->wType
= rrec
->rr_type
;
260 r
->dwTtlSeconds
= rrec
->ttl
;
261 r
->rank
= DNS_RANK_ZONE
;
262 /* TODO: Autogenerate this somehow */
265 /* If we get QCLASS_ANY, we're done here */
266 if (rrec
->rr_class
== DNS_QCLASS_ANY
) {
270 switch(rrec
->rr_type
) {
272 r
->data
.ipv4
= talloc_strdup(mem_ctx
, rrec
->rdata
.ipv4_record
);
273 W_ERROR_HAVE_NO_MEMORY(r
->data
.ipv4
);
276 r
->data
.ipv6
= talloc_strdup(mem_ctx
, rrec
->rdata
.ipv6_record
);
277 W_ERROR_HAVE_NO_MEMORY(r
->data
.ipv6
);
280 r
->data
.ns
= talloc_strdup(mem_ctx
, rrec
->rdata
.ns_record
);
281 W_ERROR_HAVE_NO_MEMORY(r
->data
.ns
);
283 case DNS_QTYPE_CNAME
:
284 r
->data
.cname
= talloc_strdup(mem_ctx
, rrec
->rdata
.cname_record
);
285 W_ERROR_HAVE_NO_MEMORY(r
->data
.cname
);
288 r
->data
.srv
.wPriority
= rrec
->rdata
.srv_record
.priority
;
289 r
->data
.srv
.wWeight
= rrec
->rdata
.srv_record
.weight
;
290 r
->data
.srv
.wPort
= rrec
->rdata
.srv_record
.port
;
291 r
->data
.srv
.nameTarget
= talloc_strdup(mem_ctx
,
292 rrec
->rdata
.srv_record
.target
);
293 W_ERROR_HAVE_NO_MEMORY(r
->data
.srv
.nameTarget
);
296 r
->data
.mx
.wPriority
= rrec
->rdata
.mx_record
.preference
;
297 r
->data
.mx
.nameTarget
= talloc_strdup(mem_ctx
,
298 rrec
->rdata
.mx_record
.exchange
);
299 W_ERROR_HAVE_NO_MEMORY(r
->data
.mx
.nameTarget
);
302 r
->data
.txt
= talloc_strdup(mem_ctx
, rrec
->rdata
.txt_record
.txt
);
303 W_ERROR_HAVE_NO_MEMORY(r
->data
.txt
);
306 DEBUG(0, ("Got a qytpe of %d\n", rrec
->rr_type
));
307 return DNS_ERR(NOT_IMPLEMENTED
);
315 WERROR
dns_server_process_update(struct dns_server
*dns
,
317 struct dns_name_packet
*in
,
318 struct dns_res_rec
**prereqs
, uint16_t *prereq_count
,
319 struct dns_res_rec
**updates
, uint16_t *update_count
,
320 struct dns_res_rec
**additional
, uint16_t *arcount
)
322 struct dns_name_question
*zone
;
323 const struct dns_server_zone
*z
;
324 size_t host_part_len
= 0;
325 WERROR werror
= DNS_ERR(NOT_IMPLEMENTED
);
326 bool update_allowed
= false;
328 if (in
->qdcount
!= 1) {
329 return DNS_ERR(FORMAT_ERROR
);
332 zone
= &in
->questions
[0];
334 if (zone
->question_class
!= DNS_QCLASS_IN
&&
335 zone
->question_class
!= DNS_QCLASS_ANY
) {
336 return DNS_ERR(NOT_IMPLEMENTED
);
339 if (zone
->question_type
!= DNS_QTYPE_SOA
) {
340 return DNS_ERR(FORMAT_ERROR
);
343 DEBUG(0, ("Got a dns update request.\n"));
345 for (z
= dns
->zones
; z
!= NULL
; z
= z
->next
) {
348 match
= dns_name_match(z
->name
, zone
->name
, &host_part_len
);
355 return DNS_ERR(NOTAUTH
);
358 if (host_part_len
!= 0) {
359 /* TODO: We need to delegate this one */
360 return DNS_ERR(NOT_IMPLEMENTED
);
363 *prereq_count
= in
->ancount
;
364 *prereqs
= in
->answers
;
365 werror
= check_prerequisites(dns
, mem_ctx
, in
->questions
, *prereqs
,
367 W_ERROR_NOT_OK_RETURN(werror
);
369 /* TODO: Check if update is allowed, we probably want "always",
370 * key-based GSSAPI, key-based bind-style TSIG and "never" as
371 * smb.conf options. */
372 if (!update_allowed
) {
373 return DNS_ERR(REFUSED
);
376 werror
= update_prescan(in
->questions
, *updates
, *update_count
);
377 W_ERROR_NOT_OK_RETURN(werror
);