?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ctdb-scripts: Don't set arp_filter=1 by default in 10.interface
[samba4-gss.git] / source4 / dns_server / dns_update.c
blob1285111c6249ceae483bca00da44e3ab08e3b268
1 /*
2 Unix SMB/CIFS implementation.
3
4 DNS server handler for update requests
5
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
27 #include <ldb.h>
28 #include "param/param.h"
29 #include "param/loadparm.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "samba/service_task.h"
33 #include "dns_server/dns_server.h"
34 #include "auth/auth.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_DNS
38
39 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
40 const struct dns_res_rec *rrec,
41 struct dnsp_DnssrvRpcRecord *r,
42 bool name_is_static);
43
44 static WERROR check_one_prerequisite(struct dns_server *dns,
45 TALLOC_CTX *mem_ctx,
46 const struct dns_name_question *zone,
47 const struct dns_res_rec *pr,
48 bool *final_result)
49 {
50 bool match;
51 WERROR werror;
52 struct ldb_dn *dn;
53 uint16_t i;
54 bool found = false;
55 struct dnsp_DnssrvRpcRecord *rec = NULL;
56 struct dnsp_DnssrvRpcRecord *ans;
57 uint16_t a_count;
58
59 size_t host_part_len = 0;
60
61 *final_result = true;
62
63 if (pr->ttl != 0) {
64 return DNS_ERR(FORMAT_ERROR);
65 }
66
67 match = dns_name_match(zone->name, pr->name, &host_part_len);
68 if (!match) {
69 return DNS_ERR(NOTZONE);
70 }
71
72 werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
73 W_ERROR_NOT_OK_RETURN(werror);
74
75 if (pr->rr_class == DNS_QCLASS_ANY) {
76
77 if (pr->length != 0) {
78 return DNS_ERR(FORMAT_ERROR);
79 }
80
81
82 if (pr->rr_type == DNS_QTYPE_ALL) {
83 /*
84 */
85 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &a_count);
86 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
87 return DNS_ERR(NAME_ERROR);
88 }
89 W_ERROR_NOT_OK_RETURN(werror);
90
91 if (a_count == 0) {
92 return DNS_ERR(NAME_ERROR);
93 }
94 } else {
95 /*
96 */
97 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &a_count);
98 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
99 return DNS_ERR(NXRRSET);
100 }
101 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
102 return DNS_ERR(NXRRSET);
103 }
104 W_ERROR_NOT_OK_RETURN(werror);
105
106 for (i = 0; i < a_count; i++) {
107 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
108 found = true;
109 break;
110 }
111 }
112 if (!found) {
113 return DNS_ERR(NXRRSET);
114 }
115 }
116
117 /*
118 * RFC2136 3.2.5 doesn't actually mention the need to return
119 * OK here, but otherwise we'd always return a FORMAT_ERROR
120 * later on. This also matches Microsoft DNS behavior.
121 */
122 return WERR_OK;
123 }
124
125 if (pr->rr_class == DNS_QCLASS_NONE) {
126 if (pr->length != 0) {
127 return DNS_ERR(FORMAT_ERROR);
128 }
129
130 if (pr->rr_type == DNS_QTYPE_ALL) {
131 /*
132 */
133 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &a_count);
134 if (W_ERROR_EQUAL(werror, WERR_OK)) {
135 return DNS_ERR(YXDOMAIN);
136 }
137 } else {
138 /*
139 */
140 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &a_count);
141 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
142 werror = WERR_OK;
143 }
144 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
145 werror = WERR_OK;
146 }
147
148 for (i = 0; i < a_count; i++) {
149 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
150 found = true;
151 break;
152 }
153 }
154 if (found) {
155 return DNS_ERR(YXRRSET);
156 }
157 }
158
159 /*
160 * RFC2136 3.2.5 doesn't actually mention the need to return
161 * OK here, but otherwise we'd always return a FORMAT_ERROR
162 * later on. This also matches Microsoft DNS behavior.
163 */
164 return WERR_OK;
165 }
166
167 if (pr->rr_class != zone->question_class) {
168 return DNS_ERR(FORMAT_ERROR);
169 }
170
171 *final_result = false;
172
173 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &a_count);
174 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
175 return DNS_ERR(NXRRSET);
176 }
177 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
178 return DNS_ERR(NXRRSET);
179 }
180 W_ERROR_NOT_OK_RETURN(werror);
181
182 rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
183 W_ERROR_HAVE_NO_MEMORY(rec);
184
185 werror = dns_rr_to_dnsp(rec, pr, rec, dns_name_is_static(ans, a_count));
186 W_ERROR_NOT_OK_RETURN(werror);
187
188 for (i = 0; i < a_count; i++) {
189 if (dns_record_match(rec, &ans[i])) {
190 found = true;
191 break;
192 }
193 }
194
195 if (!found) {
196 return DNS_ERR(NXRRSET);
197 }
198
199 return WERR_OK;
200 }
201
202 static WERROR check_prerequisites(struct dns_server *dns,
203 TALLOC_CTX *mem_ctx,
204 const struct dns_name_question *zone,
205 const struct dns_res_rec *prereqs, uint16_t count)
206 {
207 uint16_t i;
208 WERROR final_error = WERR_OK;
209
210 for (i = 0; i < count; i++) {
211 bool final;
212 WERROR werror;
213
214 werror = check_one_prerequisite(dns, mem_ctx, zone,
215 &prereqs[i], &final);
216 if (!W_ERROR_IS_OK(werror)) {
217 if (final) {
218 return werror;
219 }
220 if (W_ERROR_IS_OK(final_error)) {
221 final_error = werror;
222 }
223 }
224 }
225
226 if (!W_ERROR_IS_OK(final_error)) {
227 return final_error;
228 }
229
230 return WERR_OK;
231 }
232
233 static WERROR update_prescan(const struct dns_name_question *zone,
234 const struct dns_res_rec *updates, uint16_t count)
235 {
236 const struct dns_res_rec *r;
237 uint16_t i;
238 size_t host_part_len;
239 bool match;
240
241 for (i = 0; i < count; i++) {
242 r = &updates[i];
243 match = dns_name_match(zone->name, r->name, &host_part_len);
244 if (!match) {
245 return DNS_ERR(NOTZONE);
246 }
247 if (zone->question_class == r->rr_class) {
248 if (r->rr_type == DNS_QTYPE_ALL) {
249 return DNS_ERR(FORMAT_ERROR);
250 }
251 if (r->rr_type == DNS_QTYPE_AXFR) {
252 return DNS_ERR(FORMAT_ERROR);
253 }
254 if (r->rr_type == DNS_QTYPE_MAILB) {
255 return DNS_ERR(FORMAT_ERROR);
256 }
257 if (r->rr_type == DNS_QTYPE_MAILA) {
258 return DNS_ERR(FORMAT_ERROR);
259 }
260 } else if (r->rr_class == DNS_QCLASS_ANY) {
261 if (r->ttl != 0) {
262 return DNS_ERR(FORMAT_ERROR);
263 }
264 if (r->length != 0) {
265 return DNS_ERR(FORMAT_ERROR);
266 }
267 if (r->rr_type == DNS_QTYPE_AXFR) {
268 return DNS_ERR(FORMAT_ERROR);
269 }
270 if (r->rr_type == DNS_QTYPE_MAILB) {
271 return DNS_ERR(FORMAT_ERROR);
272 }
273 if (r->rr_type == DNS_QTYPE_MAILA) {
274 return DNS_ERR(FORMAT_ERROR);
275 }
276 } else if (r->rr_class == DNS_QCLASS_NONE) {
277 if (r->ttl != 0) {
278 return DNS_ERR(FORMAT_ERROR);
279 }
280 if (r->rr_type == DNS_QTYPE_ALL) {
281 return DNS_ERR(FORMAT_ERROR);
282 }
283 if (r->rr_type == DNS_QTYPE_AXFR) {
284 return DNS_ERR(FORMAT_ERROR);
285 }
286 if (r->rr_type == DNS_QTYPE_MAILB) {
287 return DNS_ERR(FORMAT_ERROR);
288 }
289 if (r->rr_type == DNS_QTYPE_MAILA) {
290 return DNS_ERR(FORMAT_ERROR);
291 }
292 } else {
293 return DNS_ERR(FORMAT_ERROR);
294 }
295 }
296 return WERR_OK;
297 }
298
299 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
300 const struct dns_res_rec *rrec,
301 struct dnsp_DnssrvRpcRecord *r,
302 bool name_is_static)
303 {
304 enum ndr_err_code ndr_err;
305
306 if (rrec->rr_type == DNS_QTYPE_ALL) {
307 return DNS_ERR(FORMAT_ERROR);
308 }
309
310 ZERO_STRUCTP(r);
311
312 r->wType = (enum dns_record_type) rrec->rr_type;
313 r->dwTtlSeconds = rrec->ttl;
314 r->rank = DNS_RANK_ZONE;
315 if (name_is_static) {
316 r->dwTimeStamp = 0;
317 } else {
318 r->dwTimeStamp = unix_to_dns_timestamp(time(NULL));
319 }
320
321 /* If we get QCLASS_ANY, we're done here */
322 if (rrec->rr_class == DNS_QCLASS_ANY) {
323 goto done;
324 }
325
326 switch(rrec->rr_type) {
327 case DNS_QTYPE_A:
328 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
329 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
330 break;
331 case DNS_QTYPE_AAAA:
332 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
333 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
334 break;
335 case DNS_QTYPE_NS:
336 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
337 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
338 break;
339 case DNS_QTYPE_CNAME:
340 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
341 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
342 break;
343 case DNS_QTYPE_SRV:
344 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
345 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
346 r->data.srv.wPort = rrec->rdata.srv_record.port;
347 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
348 rrec->rdata.srv_record.target);
349 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
350 break;
351 case DNS_QTYPE_PTR:
352 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
353 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
354 break;
355 case DNS_QTYPE_MX:
356 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
357 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
358 rrec->rdata.mx_record.exchange);
359 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
360 break;
361 case DNS_QTYPE_TXT:
362 ndr_err = ndr_dnsp_string_list_copy(mem_ctx,
363 &rrec->rdata.txt_record.txt,
364 &r->data.txt);
365 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
366 return WERR_NOT_ENOUGH_MEMORY;
367 }
368
369 break;
370 default:
371 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
372 return DNS_ERR(NOT_IMPLEMENTED);
373 }
374
375 done:
376
377 return WERR_OK;
378 }
379
380
381 static WERROR handle_one_update(struct dns_server *dns,
382 TALLOC_CTX *mem_ctx,
383 const struct dns_name_question *zone,
384 const struct dns_res_rec *update,
385 const struct dns_server_tkey *tkey)
386 {
387 struct dnsp_DnssrvRpcRecord *recs = NULL;
388 uint16_t rcount = 0;
389 struct ldb_dn *dn;
390 uint16_t i;
391 uint16_t first = 0;
392 WERROR werror;
393 bool tombstoned = false;
394 bool needs_add = false;
395 bool name_is_static;
396
397 DBG_NOTICE("Looking at record: \n");
398 if (DEBUGLVL(DBGLVL_NOTICE)) {
399 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
400 }
401
402 switch (update->rr_type) {
403 case DNS_QTYPE_A:
404 case DNS_QTYPE_NS:
405 case DNS_QTYPE_CNAME:
406 case DNS_QTYPE_SOA:
407 case DNS_QTYPE_PTR:
408 case DNS_QTYPE_MX:
409 case DNS_QTYPE_AAAA:
410 case DNS_QTYPE_SRV:
411 case DNS_QTYPE_TXT:
412 case DNS_QTYPE_ALL:
413 break;
414 default:
415 DEBUG(0, ("Can't handle updates of type %u yet\n",
416 update->rr_type));
417 return DNS_ERR(NOT_IMPLEMENTED);
418 }
419
420 werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
421 DBG_DEBUG("dns_name2dn(): %s\n", win_errstr(werror));
422 W_ERROR_NOT_OK_RETURN(werror);
423
424 werror = dns_common_lookup(dns->samdb, mem_ctx, dn,
425 &recs, &rcount, &tombstoned);
426 DBG_DEBUG("dns_common_lookup(): %s\n", win_errstr(werror));
427 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
428 needs_add = true;
429 werror = WERR_OK;
430 }
431 W_ERROR_NOT_OK_RETURN(werror);
432
433 if (tombstoned) {
434 /*
435 * we need to keep the existing tombstone record
436 * and ignore it.
437 *
438 * There *should* only be a single record of type TOMBSTONE,
439 * but we don't insist.
440 */
441 if (rcount != 1) {
442 DBG_WARNING("Tombstoned dnsNode has %u records, "
443 "expected 1\n", rcount);
444 if (DEBUGLVL(DBGLVL_WARNING)) {
445 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
446 }
447 }
448 first = rcount;
449 }
450
451 name_is_static = dns_name_is_static(recs, rcount);
452
453 if (update->rr_class == zone->question_class) {
454 if (update->rr_type == DNS_QTYPE_CNAME) {
455 /*
456 * If there is a record in the directory
457 * that's not a CNAME, ignore update
458 */
459 for (i = first; i < rcount; i++) {
460 if (recs[i].wType != DNS_TYPE_CNAME) {
461 DEBUG(5, ("Skipping update\n"));
462 return WERR_OK;
463 }
464 }
465
466 /*
467 * There should be no entries besides one CNAME record
468 * per name, so replace everything with the new CNAME
469 */
470
471 rcount = first;
472 recs = talloc_realloc(mem_ctx, recs,
473 struct dnsp_DnssrvRpcRecord, rcount + 1);
474 W_ERROR_HAVE_NO_MEMORY(recs);
475
476 werror = dns_rr_to_dnsp(
477 recs, update, &recs[rcount], name_is_static);
478 DBG_DEBUG("dns_rr_to_dnsp(CNAME): %s\n", win_errstr(werror));
479 W_ERROR_NOT_OK_RETURN(werror);
480 rcount += 1;
481
482 werror = dns_replace_records(dns, mem_ctx, dn,
483 needs_add, recs, rcount);
484 DBG_DEBUG("dns_replace_records(CNAME): %s\n", win_errstr(werror));
485 W_ERROR_NOT_OK_RETURN(werror);
486
487 return WERR_OK;
488 } else {
489 /*
490 * If there is a CNAME record for this name,
491 * ignore update
492 */
493 for (i = first; i < rcount; i++) {
494 if (recs[i].wType == DNS_TYPE_CNAME) {
495 DEBUG(5, ("Skipping update\n"));
496 return WERR_OK;
497 }
498 }
499 }
500 if (update->rr_type == DNS_QTYPE_SOA) {
501 bool found = false;
502
503 /*
504 * If the zone has no SOA record?? or update's
505 * serial number is smaller than existing SOA's,
506 * ignore update
507 */
508 for (i = first; i < rcount; i++) {
509 if (recs[i].wType == DNS_TYPE_SOA) {
510 uint16_t n, o;
511
512 n = update->rdata.soa_record.serial;
513 o = recs[i].data.soa.serial;
514 /*
515 * TODO: Implement RFC 1982 comparison
516 * logic for RFC2136
517 */
518 if (n <= o) {
519 DEBUG(5, ("Skipping update\n"));
520 return WERR_OK;
521 }
522 found = true;
523 break;
524 }
525 }
526 if (!found) {
527 DEBUG(5, ("Skipping update\n"));
528 return WERR_OK;
529 }
530
531 werror = dns_rr_to_dnsp(
532 mem_ctx, update, &recs[i], name_is_static);
533 DBG_DEBUG("dns_rr_to_dnsp(SOA): %s\n", win_errstr(werror));
534 W_ERROR_NOT_OK_RETURN(werror);
535
536 /*
537 * There should only be one SOA, which we have already
538 * found and replaced. We now check for and tombstone
539 * any others.
540 */
541 for (i++; i < rcount; i++) {
542 if (recs[i].wType != DNS_TYPE_SOA) {
543 continue;
544 }
545 DBG_ERR("Duplicate SOA records found.\n");
546 if (DEBUGLVL(DBGLVL_ERR)) {
547 NDR_PRINT_DEBUG(dns_res_rec,
548 discard_const(update));
549 }
550 recs[i] = (struct dnsp_DnssrvRpcRecord) {
551 .wType = DNS_TYPE_TOMBSTONE,
552 };
553 }
554
555 werror = dns_replace_records(dns, mem_ctx, dn,
556 needs_add, recs, rcount);
557 DBG_DEBUG("dns_replace_records(SOA): %s\n", win_errstr(werror));
558 W_ERROR_NOT_OK_RETURN(werror);
559
560 return WERR_OK;
561 }
562 /* All but CNAME, SOA */
563 recs = talloc_realloc(mem_ctx, recs,
564 struct dnsp_DnssrvRpcRecord, rcount+1);
565 W_ERROR_HAVE_NO_MEMORY(recs);
566
567 werror =
568 dns_rr_to_dnsp(recs, update, &recs[rcount], name_is_static);
569 DBG_DEBUG("dns_rr_to_dnsp(GENERIC): %s\n", win_errstr(werror));
570 W_ERROR_NOT_OK_RETURN(werror);
571
572 for (i = first; i < rcount; i++) {
573 struct dnsp_DnssrvRpcRecord orig_rec = recs[i];
574
575 if (!dns_record_match(&recs[i], &recs[rcount])) {
576 continue;
577 }
578
579 recs[i].data = recs[rcount].data;
580 recs[i].wType = recs[rcount].wType;
581 recs[i].dwTtlSeconds = recs[rcount].dwTtlSeconds;
582 recs[i].rank = recs[rcount].rank;
583 recs[i].dwReserved = 0;
584 recs[i].flags = 0;
585 werror = dns_replace_records(dns, mem_ctx, dn,
586 needs_add, recs, rcount);
587 DBG_DEBUG("dns_replace_records(REPLACE): %s\n", win_errstr(werror));
588 if (W_ERROR_EQUAL(werror, WERR_ACCESS_DENIED) &&
589 !needs_add &&
590 orig_rec.dwTtlSeconds == recs[i].dwTtlSeconds)
591 {
592 DBG_NOTICE("dns_replace_records(REPLACE): %s "
593 "=> skip no-op\n",
594 win_errstr(werror));
595 werror = WERR_OK;
596 }
597 W_ERROR_NOT_OK_RETURN(werror);
598
599 return WERR_OK;
600 }
601 /* we did not find a matching record. This is new. */
602 werror = dns_replace_records(dns, mem_ctx, dn,
603 needs_add, recs, rcount+1);
604 DBG_DEBUG("dns_replace_records(ADD): %s\n", win_errstr(werror));
605 W_ERROR_NOT_OK_RETURN(werror);
606
607 return WERR_OK;
608 } else if (update->rr_class == DNS_QCLASS_ANY) {
609 /*
610 * Mass-deleting records by type, which we do by adding a
611 * tombstone with zero timestamp. dns_replace_records() will
612 * work out if the node as a whole needs tombstoning.
613 */
614 if (update->rr_type == DNS_QTYPE_ALL) {
615 if (samba_dns_name_equal(update->name, zone->name)) {
616 for (i = first; i < rcount; i++) {
617
618 if (recs[i].wType == DNS_TYPE_SOA) {
619 continue;
620 }
621
622 if (recs[i].wType == DNS_TYPE_NS) {
623 continue;
624 }
625
626 recs[i] = (struct dnsp_DnssrvRpcRecord) {
627 .wType = DNS_TYPE_TOMBSTONE,
628 };
629 }
630
631 } else {
632 for (i = first; i < rcount; i++) {
633 recs[i] = (struct dnsp_DnssrvRpcRecord) {
634 .wType = DNS_TYPE_TOMBSTONE,
635 };
636 }
637 }
638
639 } else if (samba_dns_name_equal(update->name, zone->name)) {
640
641 if (update->rr_type == DNS_QTYPE_SOA) {
642 return WERR_OK;
643 }
644
645 if (update->rr_type == DNS_QTYPE_NS) {
646 return WERR_OK;
647 }
648 }
649 for (i = first; i < rcount; i++) {
650 if (recs[i].wType == (enum dns_record_type) update->rr_type) {
651 recs[i] = (struct dnsp_DnssrvRpcRecord) {
652 .wType = DNS_TYPE_TOMBSTONE,
653 };
654 }
655 }
656
657 werror = dns_replace_records(dns, mem_ctx, dn,
658 needs_add, recs, rcount);
659 DBG_DEBUG("dns_replace_records(DELETE-ANY): %s\n", win_errstr(werror));
660 W_ERROR_NOT_OK_RETURN(werror);
661
662 return WERR_OK;
663 } else if (update->rr_class == DNS_QCLASS_NONE) {
664 /* deleting individual records */
665 struct dnsp_DnssrvRpcRecord *del_rec;
666
667 if (update->rr_type == DNS_QTYPE_SOA) {
668 return WERR_OK;
669 }
670 if (update->rr_type == DNS_QTYPE_NS) {
671 bool found = false;
672 struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
673 struct dnsp_DnssrvRpcRecord);
674 W_ERROR_HAVE_NO_MEMORY(ns_rec);
675
676 werror = dns_rr_to_dnsp(
677 ns_rec, update, ns_rec, name_is_static);
678 DBG_DEBUG("dns_rr_to_dnsp(NS): %s\n", win_errstr(werror));
679 W_ERROR_NOT_OK_RETURN(werror);
680
681 for (i = first; i < rcount; i++) {
682 if (dns_record_match(ns_rec, &recs[i])) {
683 found = true;
684 break;
685 }
686 }
687 if (found) {
688 return WERR_OK;
689 }
690 }
691
692 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
693 W_ERROR_HAVE_NO_MEMORY(del_rec);
694
695 werror =
696 dns_rr_to_dnsp(del_rec, update, del_rec, name_is_static);
697 DBG_DEBUG("dns_rr_to_dnsp(DELETE-NONE): %s\n", win_errstr(werror));
698 W_ERROR_NOT_OK_RETURN(werror);
699
700 for (i = first; i < rcount; i++) {
701 if (dns_record_match(del_rec, &recs[i])) {
702 recs[i] = (struct dnsp_DnssrvRpcRecord) {
703 .wType = DNS_TYPE_TOMBSTONE,
704 };
705 }
706 }
707
708 werror = dns_replace_records(dns, mem_ctx, dn,
709 needs_add, recs, rcount);
710 DBG_DEBUG("dns_replace_records(DELETE-NONE): %s\n", win_errstr(werror));
711 W_ERROR_NOT_OK_RETURN(werror);
712 }
713
714 return WERR_OK;
715 }
716
717 static WERROR handle_updates(struct dns_server *dns,
718 TALLOC_CTX *mem_ctx,
719 const struct dns_name_question *zone,
720 const struct dns_res_rec *prereqs, uint16_t pcount,
721 struct dns_res_rec *updates, uint16_t upd_count,
722 struct dns_server_tkey *tkey)
723 {
724 struct ldb_dn *zone_dn = NULL;
725 WERROR werror = WERR_OK;
726 int ret;
727 uint16_t ri;
728 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
729
730 if (tkey != NULL) {
731 ret = ldb_set_opaque(
732 dns->samdb,
733 DSDB_SESSION_INFO,
734 tkey->session_info);
735 if (ret != LDB_SUCCESS) {
736 DEBUG(1, ("unable to set session info\n"));
737 werror = DNS_ERR(SERVER_FAILURE);
738 goto failed;
739 }
740 }
741
742 werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
743 DBG_DEBUG("dns_name2dn(): %s\n", win_errstr(werror));
744 W_ERROR_NOT_OK_GOTO(werror, failed);
745
746 ret = ldb_transaction_start(dns->samdb);
747 if (ret != LDB_SUCCESS) {
748 werror = DNS_ERR(SERVER_FAILURE);
749 goto failed;
750 }
751
752 werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
753 W_ERROR_NOT_OK_GOTO(werror, failed);
754
755 DBG_DEBUG("dns update count is %u\n", upd_count);
756
757 for (ri = 0; ri < upd_count; ri++) {
758 werror = handle_one_update(dns, tmp_ctx, zone,
759 &updates[ri], tkey);
760 DBG_DEBUG("handle_one_update(%u): %s\n",
761 ri, win_errstr(werror));
762 W_ERROR_NOT_OK_GOTO(werror, failed);
763 }
764
765 failed:
766 if (W_ERROR_IS_OK(werror)) {
767 ret = ldb_transaction_commit(dns->samdb);
768 if (ret != LDB_SUCCESS) {
769 werror = DNS_ERR(SERVER_FAILURE);
770 }
771 } else {
772 ldb_transaction_cancel(dns->samdb);
773 }
774
775 if (tkey != NULL) {
776 ldb_set_opaque(
777 dns->samdb,
778 DSDB_SESSION_INFO,
779 system_session(dns->task->lp_ctx));
780 }
781
782 TALLOC_FREE(tmp_ctx);
783 return werror;
784
785 }
786
787 static WERROR dns_update_allowed(struct dns_server *dns,
788 const struct dns_request_state *state,
789 struct dns_server_tkey **tkey)
790 {
791 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
792 DEBUG(2, ("All updates allowed.\n"));
793 return WERR_OK;
794 }
795
796 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
797 DEBUG(2, ("Updates disabled.\n"));
798 return DNS_ERR(REFUSED);
799 }
800
801 if (state->authenticated == false ) {
802 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
803 return DNS_ERR(REFUSED);
804 }
805
806 *tkey = dns_find_tkey(dns->tkeys, state->key_name);
807 if (*tkey == NULL) {
808 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
809 return DNS_ERR(REFUSED);
810 }
811
812 return WERR_OK;
813 }
814
815
816 WERROR dns_server_process_update(struct dns_server *dns,
817 const struct dns_request_state *state,
818 TALLOC_CTX *mem_ctx,
819 const struct dns_name_packet *in,
820 struct dns_res_rec **prereqs, uint16_t *prereq_count,
821 struct dns_res_rec **updates, uint16_t *update_count,
822 struct dns_res_rec **additional, uint16_t *arcount)
823 {
824 struct dns_name_question *zone;
825 const struct dns_server_zone *z;
826 size_t host_part_len = 0;
827 WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
828 struct dns_server_tkey *tkey = NULL;
829
830 if (in->qdcount != 1) {
831 return DNS_ERR(FORMAT_ERROR);
832 }
833
834 zone = &in->questions[0];
835
836 if (zone->question_class != DNS_QCLASS_IN &&
837 zone->question_class != DNS_QCLASS_ANY) {
838 return DNS_ERR(NOT_IMPLEMENTED);
839 }
840
841 if (zone->question_type != DNS_QTYPE_SOA) {
842 return DNS_ERR(FORMAT_ERROR);
843 }
844
845 DEBUG(2, ("Got a dns update request.\n"));
846
847 for (z = dns->zones; z != NULL; z = z->next) {
848 bool match;
849
850 match = dns_name_match(z->name, zone->name, &host_part_len);
851 if (match) {
852 break;
853 }
854 }
855
856 if (z == NULL) {
857 DEBUG(1, ("We're not authoritative for this zone\n"));
858 return DNS_ERR(NOTAUTH);
859 }
860
861 if (host_part_len != 0) {
862 /* TODO: We need to delegate this one */
863 DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
864 return DNS_ERR(NOT_IMPLEMENTED);
865 }
866
867 *prereq_count = in->ancount;
868 *prereqs = in->answers;
869 werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
870 *prereq_count);
871 W_ERROR_NOT_OK_RETURN(werror);
872
873 werror = dns_update_allowed(dns, state, &tkey);
874 if (!W_ERROR_IS_OK(werror)) {
875 return werror;
876 }
877
878 *update_count = in->nscount;
879 *updates = in->nsrecs;
880 werror = update_prescan(in->questions, *updates, *update_count);
881 DBG_DEBUG("update_prescan(): %s\n", win_errstr(werror));
882 W_ERROR_NOT_OK_RETURN(werror);
883
884 werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
885 *prereq_count, *updates, *update_count, tkey);
886 DBG_DEBUG("handle_updates(): %s\n", win_errstr(werror));
887 W_ERROR_NOT_OK_RETURN(werror);
888
889 return werror;
890 }
GSS-enabled samba4