source4/dns_server/dns_update.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DNS server handler for update requests
   5
   6    Copyright (C) 2010 Kai Blin  <kai@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/util/ntstatus.h"
  24 #include "librpc/ndr/libndr.h"
  25 #include "librpc/gen_ndr/ndr_dns.h"
  26 #include "librpc/gen_ndr/ndr_dnsp.h"
  27 #include <ldb.h>
  28 #include "param/param.h"
  29 #include "param/loadparm.h"
  30 #include "dsdb/samdb/samdb.h"
  31 #include "dsdb/common/util.h"
  32 #include "samba/service_task.h"
  33 #include "dns_server/dns_server.h"
  34 #include "auth/auth.h"
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_DNS
  38
  39 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
  40                              const struct dns_res_rec *rrec,
  41                              struct dnsp_DnssrvRpcRecord *r,
  42                              bool name_is_static);
  43
  44 static WERROR check_one_prerequisite(struct dns_server *dns,
  45                                      TALLOC_CTX *mem_ctx,
  46                                      const struct dns_name_question *zone,
  47                                      const struct dns_res_rec *pr,
  48                                      bool *final_result)
  49 {
  50         bool match;
  51         WERROR werror;
  52         struct ldb_dn *dn;
  53         uint16_t i;
  54         bool found = false;
  55         struct dnsp_DnssrvRpcRecord *rec = NULL;
  56         struct dnsp_DnssrvRpcRecord *ans;
  57         uint16_t a_count;
  58
  59         size_t host_part_len = 0;
  60
  61         *final_result = true;
  62
  63         if (pr->ttl != 0) {
  64                 return DNS_ERR(FORMAT_ERROR);
  65         }
  66
  67         match = dns_name_match(zone->name, pr->name, &host_part_len);
  68         if (!match) {
  69                 return DNS_ERR(NOTZONE);
  70         }
  71
  72         werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
  73         W_ERROR_NOT_OK_RETURN(werror);
  74
  75         if (pr->rr_class == DNS_QCLASS_ANY) {
  76
  77                 if (pr->length != 0) {
  78                         return DNS_ERR(FORMAT_ERROR);
  79                 }
  80
  81
  82                 if (pr->rr_type == DNS_QTYPE_ALL) {
  83                         /*
  84                          */
  85                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &a_count);
  86                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
  87                                 return DNS_ERR(NAME_ERROR);
  88                         }
  89                         W_ERROR_NOT_OK_RETURN(werror);
  90
  91                         if (a_count == 0) {
  92                                 return DNS_ERR(NAME_ERROR);
  93                         }
  94                 } else {
  95                         /*
  96                          */
  97                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &a_count);
  98                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
  99                                 return DNS_ERR(NXRRSET);
 100                         }
 101                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 102                                 return DNS_ERR(NXRRSET);
 103                         }
 104                         W_ERROR_NOT_OK_RETURN(werror);
 105
 106                         for (i = 0; i < a_count; i++) {
 107                                 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
 108                                         found = true;
 109                                         break;
 110                                 }
 111                         }
 112                         if (!found) {
 113                                 return DNS_ERR(NXRRSET);
 114                         }
 115                 }
 116
 117                 /*
 118                  * RFC2136 3.2.5 doesn't actually mention the need to return
 119                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 120                  * later on. This also matches Microsoft DNS behavior.
 121                  */
 122                 return WERR_OK;
 123         }
 124
 125         if (pr->rr_class == DNS_QCLASS_NONE) {
 126                 if (pr->length != 0) {
 127                         return DNS_ERR(FORMAT_ERROR);
 128                 }
 129
 130                 if (pr->rr_type == DNS_QTYPE_ALL) {
 131                         /*
 132                          */
 133                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &a_count);
 134                         if (W_ERROR_EQUAL(werror, WERR_OK)) {
 135                                 return DNS_ERR(YXDOMAIN);
 136                         }
 137                 } else {
 138                         /*
 139                          */
 140                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &a_count);
 141                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
 142                                 werror = WERR_OK;
 143                         }
 144                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 145                                 werror = WERR_OK;
 146                         }
 147
 148                         for (i = 0; i < a_count; i++) {
 149                                 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
 150                                         found = true;
 151                                         break;
 152                                 }
 153                         }
 154                         if (found) {
 155                                 return DNS_ERR(YXRRSET);
 156                         }
 157                 }
 158
 159                 /*
 160                  * RFC2136 3.2.5 doesn't actually mention the need to return
 161                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 162                  * later on. This also matches Microsoft DNS behavior.
 163                  */
 164                 return WERR_OK;
 165         }
 166
 167         if (pr->rr_class != zone->question_class) {
 168                 return DNS_ERR(FORMAT_ERROR);
 169         }
 170
 171         *final_result = false;
 172
 173         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &a_count);
 174         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
 175                 return DNS_ERR(NXRRSET);
 176         }
 177         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 178                 return DNS_ERR(NXRRSET);
 179         }
 180         W_ERROR_NOT_OK_RETURN(werror);
 181
 182         rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
 183         W_ERROR_HAVE_NO_MEMORY(rec);
 184
 185         werror = dns_rr_to_dnsp(rec, pr, rec, dns_name_is_static(ans, a_count));
 186         W_ERROR_NOT_OK_RETURN(werror);
 187
 188         for (i = 0; i < a_count; i++) {
 189                 if (dns_record_match(rec, &ans[i])) {
 190                         found = true;
 191                         break;
 192                 }
 193         }
 194
 195         if (!found) {
 196                 return DNS_ERR(NXRRSET);
 197         }
 198
 199         return WERR_OK;
 200 }
 201
 202 static WERROR check_prerequisites(struct dns_server *dns,
 203                                   TALLOC_CTX *mem_ctx,
 204                                   const struct dns_name_question *zone,
 205                                   const struct dns_res_rec *prereqs, uint16_t count)
 206 {
 207         uint16_t i;
 208         WERROR final_error = WERR_OK;
 209
 210         for (i = 0; i < count; i++) {
 211                 bool final;
 212                 WERROR werror;
 213
 214                 werror = check_one_prerequisite(dns, mem_ctx, zone,
 215                                                 &prereqs[i], &final);
 216                 if (!W_ERROR_IS_OK(werror)) {
 217                         if (final) {
 218                                 return werror;
 219                         }
 220                         if (W_ERROR_IS_OK(final_error)) {
 221                                 final_error = werror;
 222                         }
 223                 }
 224         }
 225
 226         if (!W_ERROR_IS_OK(final_error)) {
 227                 return final_error;
 228         }
 229
 230         return WERR_OK;
 231 }
 232
 233 static WERROR update_prescan(const struct dns_name_question *zone,
 234                              const struct dns_res_rec *updates, uint16_t count)
 235 {
 236         const struct dns_res_rec *r;
 237         uint16_t i;
 238         size_t host_part_len;
 239         bool match;
 240
 241         for (i = 0; i < count; i++) {
 242                 r = &updates[i];
 243                 match = dns_name_match(zone->name, r->name, &host_part_len);
 244                 if (!match) {
 245                         return DNS_ERR(NOTZONE);
 246                 }
 247                 if (zone->question_class == r->rr_class) {
 248                         if (r->rr_type == DNS_QTYPE_ALL) {
 249                                 return DNS_ERR(FORMAT_ERROR);
 250                         }
 251                         if (r->rr_type == DNS_QTYPE_AXFR) {
 252                                 return DNS_ERR(FORMAT_ERROR);
 253                         }
 254                         if (r->rr_type == DNS_QTYPE_MAILB) {
 255                                 return DNS_ERR(FORMAT_ERROR);
 256                         }
 257                         if (r->rr_type == DNS_QTYPE_MAILA) {
 258                                 return DNS_ERR(FORMAT_ERROR);
 259                         }
 260                 } else if (r->rr_class == DNS_QCLASS_ANY) {
 261                         if (r->ttl != 0) {
 262                                 return DNS_ERR(FORMAT_ERROR);
 263                         }
 264                         if (r->length != 0) {
 265                                 return DNS_ERR(FORMAT_ERROR);
 266                         }
 267                         if (r->rr_type == DNS_QTYPE_AXFR) {
 268                                 return DNS_ERR(FORMAT_ERROR);
 269                         }
 270                         if (r->rr_type == DNS_QTYPE_MAILB) {
 271                                 return DNS_ERR(FORMAT_ERROR);
 272                         }
 273                         if (r->rr_type == DNS_QTYPE_MAILA) {
 274                                 return DNS_ERR(FORMAT_ERROR);
 275                         }
 276                 } else if (r->rr_class == DNS_QCLASS_NONE) {
 277                         if (r->ttl != 0) {
 278                                 return DNS_ERR(FORMAT_ERROR);
 279                         }
 280                         if (r->rr_type == DNS_QTYPE_ALL) {
 281                                 return DNS_ERR(FORMAT_ERROR);
 282                         }
 283                         if (r->rr_type == DNS_QTYPE_AXFR) {
 284                                 return DNS_ERR(FORMAT_ERROR);
 285                         }
 286                         if (r->rr_type == DNS_QTYPE_MAILB) {
 287                                 return DNS_ERR(FORMAT_ERROR);
 288                         }
 289                         if (r->rr_type == DNS_QTYPE_MAILA) {
 290                                 return DNS_ERR(FORMAT_ERROR);
 291                         }
 292                 } else {
 293                         return DNS_ERR(FORMAT_ERROR);
 294                 }
 295         }
 296         return WERR_OK;
 297 }
 298
 299 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
 300                              const struct dns_res_rec *rrec,
 301                              struct dnsp_DnssrvRpcRecord *r,
 302                              bool name_is_static)
 303 {
 304         enum ndr_err_code ndr_err;
 305
 306         if (rrec->rr_type == DNS_QTYPE_ALL) {
 307                 return DNS_ERR(FORMAT_ERROR);
 308         }
 309
 310         ZERO_STRUCTP(r);
 311
 312         r->wType = (enum dns_record_type) rrec->rr_type;
 313         r->dwTtlSeconds = rrec->ttl;
 314         r->rank = DNS_RANK_ZONE;
 315         if (name_is_static) {
 316                 r->dwTimeStamp = 0;
 317         } else {
 318                 r->dwTimeStamp = unix_to_dns_timestamp(time(NULL));
 319         }
 320
 321         /* If we get QCLASS_ANY, we're done here */
 322         if (rrec->rr_class == DNS_QCLASS_ANY) {
 323                 goto done;
 324         }
 325
 326         switch(rrec->rr_type) {
 327         case DNS_QTYPE_A:
 328                 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
 329                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
 330                 break;
 331         case DNS_QTYPE_AAAA:
 332                 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
 333                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
 334                 break;
 335         case DNS_QTYPE_NS:
 336                 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
 337                 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
 338                 break;
 339         case DNS_QTYPE_CNAME:
 340                 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
 341                 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
 342                 break;
 343         case DNS_QTYPE_SRV:
 344                 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
 345                 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
 346                 r->data.srv.wPort = rrec->rdata.srv_record.port;
 347                 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
 348                                 rrec->rdata.srv_record.target);
 349                 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
 350                 break;
 351         case DNS_QTYPE_PTR:
 352                 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
 353                 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
 354                 break;
 355         case DNS_QTYPE_MX:
 356                 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
 357                 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
 358                                 rrec->rdata.mx_record.exchange);
 359                 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
 360                 break;
 361         case DNS_QTYPE_TXT:
 362                 ndr_err = ndr_dnsp_string_list_copy(mem_ctx,
 363                                                     &rrec->rdata.txt_record.txt,
 364                                                     &r->data.txt);
 365                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 366                         return WERR_NOT_ENOUGH_MEMORY;
 367                 }
 368
 369                 break;
 370         default:
 371                 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
 372                 return DNS_ERR(NOT_IMPLEMENTED);
 373         }
 374
 375 done:
 376
 377         return WERR_OK;
 378 }
 379
 380
 381 static WERROR handle_one_update(struct dns_server *dns,
 382                                 TALLOC_CTX *mem_ctx,
 383                                 const struct dns_name_question *zone,
 384                                 const struct dns_res_rec *update,
 385                                 const struct dns_server_tkey *tkey)
 386 {
 387         struct dnsp_DnssrvRpcRecord *recs = NULL;
 388         uint16_t rcount = 0;
 389         struct ldb_dn *dn;
 390         uint16_t i;
 391         uint16_t first = 0;
 392         WERROR werror;
 393         bool tombstoned = false;
 394         bool needs_add = false;
 395         bool name_is_static;
 396
 397         DBG_NOTICE("Looking at record: \n");
 398         if (DEBUGLVL(DBGLVL_NOTICE)) {
 399                 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
 400         }
 401
 402         switch (update->rr_type) {
 403         case DNS_QTYPE_A:
 404         case DNS_QTYPE_NS:
 405         case DNS_QTYPE_CNAME:
 406         case DNS_QTYPE_SOA:
 407         case DNS_QTYPE_PTR:
 408         case DNS_QTYPE_MX:
 409         case DNS_QTYPE_AAAA:
 410         case DNS_QTYPE_SRV:
 411         case DNS_QTYPE_TXT:
 412         case DNS_QTYPE_ALL:
 413                 break;
 414         default:
 415                 DEBUG(0, ("Can't handle updates of type %u yet\n",
 416                           update->rr_type));
 417                 return DNS_ERR(NOT_IMPLEMENTED);
 418         }
 419
 420         werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
 421         DBG_DEBUG("dns_name2dn(): %s\n", win_errstr(werror));
 422         W_ERROR_NOT_OK_RETURN(werror);
 423
 424         werror = dns_common_lookup(dns->samdb, mem_ctx, dn,
 425                                    &recs, &rcount, &tombstoned);
 426         DBG_DEBUG("dns_common_lookup(): %s\n", win_errstr(werror));
 427         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
 428                 needs_add = true;
 429                 werror = WERR_OK;
 430         }
 431         W_ERROR_NOT_OK_RETURN(werror);
 432
 433         if (tombstoned) {
 434                 /*
 435                  * we need to keep the existing tombstone record
 436                  * and ignore it.
 437                  *
 438                  * There *should* only be a single record of type TOMBSTONE,
 439                  * but we don't insist.
 440                  */
 441                 if (rcount != 1) {
 442                         DBG_WARNING("Tombstoned dnsNode has %u records, "
 443                                     "expected 1\n", rcount);
 444                         if (DEBUGLVL(DBGLVL_WARNING)) {
 445                                 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
 446                         }
 447                 }
 448                 first = rcount;
 449         }
 450
 451         name_is_static = dns_name_is_static(recs, rcount);
 452
 453         if (update->rr_class == zone->question_class) {
 454                 if (update->rr_type == DNS_QTYPE_CNAME) {
 455                         /*
 456                          * If there is a record in the directory
 457                          * that's not a CNAME, ignore update
 458                          */
 459                         for (i = first; i < rcount; i++) {
 460                                 if (recs[i].wType != DNS_TYPE_CNAME) {
 461                                         DEBUG(5, ("Skipping update\n"));
 462                                         return WERR_OK;
 463                                 }
 464                         }
 465
 466                         /*
 467                          * There should be no entries besides one CNAME record
 468                          * per name, so replace everything with the new CNAME
 469                          */
 470
 471                         rcount = first;
 472                         recs = talloc_realloc(mem_ctx, recs,
 473                                         struct dnsp_DnssrvRpcRecord, rcount + 1);
 474                         W_ERROR_HAVE_NO_MEMORY(recs);
 475
 476                         werror = dns_rr_to_dnsp(
 477                             recs, update, &recs[rcount], name_is_static);
 478                         DBG_DEBUG("dns_rr_to_dnsp(CNAME): %s\n", win_errstr(werror));
 479                         W_ERROR_NOT_OK_RETURN(werror);
 480                         rcount += 1;
 481
 482                         werror = dns_replace_records(dns, mem_ctx, dn,
 483                                                      needs_add, recs, rcount);
 484                         DBG_DEBUG("dns_replace_records(CNAME): %s\n", win_errstr(werror));
 485                         W_ERROR_NOT_OK_RETURN(werror);
 486
 487                         return WERR_OK;
 488                 } else {
 489                         /*
 490                          * If there is a CNAME record for this name,
 491                          * ignore update
 492                          */
 493                         for (i = first; i < rcount; i++) {
 494                                 if (recs[i].wType == DNS_TYPE_CNAME) {
 495                                         DEBUG(5, ("Skipping update\n"));
 496                                         return WERR_OK;
 497                                 }
 498                         }
 499                 }
 500                 if (update->rr_type == DNS_QTYPE_SOA) {
 501                         bool found = false;
 502
 503                         /*
 504                          * If the zone has no SOA record?? or update's
 505                          * serial number is smaller than existing SOA's,
 506                          * ignore update
 507                          */
 508                         for (i = first; i < rcount; i++) {
 509                                 if (recs[i].wType == DNS_TYPE_SOA) {
 510                                         uint16_t n, o;
 511
 512                                         n = update->rdata.soa_record.serial;
 513                                         o = recs[i].data.soa.serial;
 514                                         /*
 515                                          * TODO: Implement RFC 1982 comparison
 516                                          * logic for RFC2136
 517                                          */
 518                                         if (n <= o) {
 519                                                 DEBUG(5, ("Skipping update\n"));
 520                                                 return WERR_OK;
 521                                         }
 522                                         found = true;
 523                                         break;
 524                                 }
 525                         }
 526                         if (!found) {
 527                                 DEBUG(5, ("Skipping update\n"));
 528                                 return WERR_OK;
 529                         }
 530
 531                         werror = dns_rr_to_dnsp(
 532                             mem_ctx, update, &recs[i], name_is_static);
 533                         DBG_DEBUG("dns_rr_to_dnsp(SOA): %s\n", win_errstr(werror));
 534                         W_ERROR_NOT_OK_RETURN(werror);
 535
 536                         /*
 537                          * There should only be one SOA, which we have already
 538                          * found and replaced. We now check for and tombstone
 539                          * any others.
 540                          */
 541                         for (i++; i < rcount; i++) {
 542                                 if (recs[i].wType != DNS_TYPE_SOA) {
 543                                         continue;
 544                                 }
 545                                 DBG_ERR("Duplicate SOA records found.\n");
 546                                 if (DEBUGLVL(DBGLVL_ERR)) {
 547                                         NDR_PRINT_DEBUG(dns_res_rec,
 548                                                         discard_const(update));
 549                                 }
 550                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
 551                                         .wType = DNS_TYPE_TOMBSTONE,
 552                                 };
 553                         }
 554
 555                         werror = dns_replace_records(dns, mem_ctx, dn,
 556                                                      needs_add, recs, rcount);
 557                         DBG_DEBUG("dns_replace_records(SOA): %s\n", win_errstr(werror));
 558                         W_ERROR_NOT_OK_RETURN(werror);
 559
 560                         return WERR_OK;
 561                 }
 562                 /* All but CNAME, SOA */
 563                 recs = talloc_realloc(mem_ctx, recs,
 564                                 struct dnsp_DnssrvRpcRecord, rcount+1);
 565                 W_ERROR_HAVE_NO_MEMORY(recs);
 566
 567                 werror =
 568                     dns_rr_to_dnsp(recs, update, &recs[rcount], name_is_static);
 569                 DBG_DEBUG("dns_rr_to_dnsp(GENERIC): %s\n", win_errstr(werror));
 570                 W_ERROR_NOT_OK_RETURN(werror);
 571
 572                 for (i = first; i < rcount; i++) {
 573                         if (!dns_record_match(&recs[i], &recs[rcount])) {
 574                                 continue;
 575                         }
 576
 577                         recs[i].data = recs[rcount].data;
 578                         recs[i].wType = recs[rcount].wType;
 579                         recs[i].dwTtlSeconds = recs[rcount].dwTtlSeconds;
 580                         recs[i].rank = recs[rcount].rank;
 581                         recs[i].dwReserved = 0;
 582                         recs[i].flags = 0;
 583                         werror = dns_replace_records(dns, mem_ctx, dn,
 584                                                      needs_add, recs, rcount);
 585                         DBG_DEBUG("dns_replace_records(REPLACE): %s\n", win_errstr(werror));
 586                         W_ERROR_NOT_OK_RETURN(werror);
 587
 588                         return WERR_OK;
 589                 }
 590                 /* we did not find a matching record. This is new. */
 591                 werror = dns_replace_records(dns, mem_ctx, dn,
 592                                              needs_add, recs, rcount+1);
 593                 DBG_DEBUG("dns_replace_records(ADD): %s\n", win_errstr(werror));
 594                 W_ERROR_NOT_OK_RETURN(werror);
 595
 596                 return WERR_OK;
 597         } else if (update->rr_class == DNS_QCLASS_ANY) {
 598                 /*
 599                  * Mass-deleting records by type, which we do by adding a
 600                  * tombstone with zero timestamp. dns_replace_records() will
 601                  * work out if the node as a whole needs tombstoning.
 602                  */
 603                 if (update->rr_type == DNS_QTYPE_ALL) {
 604                         if (samba_dns_name_equal(update->name, zone->name)) {
 605                                 for (i = first; i < rcount; i++) {
 606
 607                                         if (recs[i].wType == DNS_TYPE_SOA) {
 608                                                 continue;
 609                                         }
 610
 611                                         if (recs[i].wType == DNS_TYPE_NS) {
 612                                                 continue;
 613                                         }
 614
 615                                         recs[i] = (struct dnsp_DnssrvRpcRecord) {
 616                                                 .wType = DNS_TYPE_TOMBSTONE,
 617                                         };
 618                                 }
 619
 620                         } else {
 621                                 for (i = first; i < rcount; i++) {
 622                                         recs[i] = (struct dnsp_DnssrvRpcRecord) {
 623                                                 .wType = DNS_TYPE_TOMBSTONE,
 624                                         };
 625                                 }
 626                         }
 627
 628                 } else if (samba_dns_name_equal(update->name, zone->name)) {
 629
 630                         if (update->rr_type == DNS_QTYPE_SOA) {
 631                                 return WERR_OK;
 632                         }
 633
 634                         if (update->rr_type == DNS_QTYPE_NS) {
 635                                 return WERR_OK;
 636                         }
 637                 }
 638                 for (i = first; i < rcount; i++) {
 639                         if (recs[i].wType == (enum dns_record_type) update->rr_type) {
 640                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
 641                                         .wType = DNS_TYPE_TOMBSTONE,
 642                                 };
 643                         }
 644                 }
 645
 646                 werror = dns_replace_records(dns, mem_ctx, dn,
 647                                              needs_add, recs, rcount);
 648                 DBG_DEBUG("dns_replace_records(DELETE-ANY): %s\n", win_errstr(werror));
 649                 W_ERROR_NOT_OK_RETURN(werror);
 650
 651                 return WERR_OK;
 652         } else if (update->rr_class == DNS_QCLASS_NONE) {
 653                 /* deleting individual records */
 654                 struct dnsp_DnssrvRpcRecord *del_rec;
 655
 656                 if (update->rr_type == DNS_QTYPE_SOA) {
 657                         return WERR_OK;
 658                 }
 659                 if (update->rr_type == DNS_QTYPE_NS) {
 660                         bool found = false;
 661                         struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
 662                                                 struct dnsp_DnssrvRpcRecord);
 663                         W_ERROR_HAVE_NO_MEMORY(ns_rec);
 664
 665                         werror = dns_rr_to_dnsp(
 666                             ns_rec, update, ns_rec, name_is_static);
 667                         DBG_DEBUG("dns_rr_to_dnsp(NS): %s\n", win_errstr(werror));
 668                         W_ERROR_NOT_OK_RETURN(werror);
 669
 670                         for (i = first; i < rcount; i++) {
 671                                 if (dns_record_match(ns_rec, &recs[i])) {
 672                                         found = true;
 673                                         break;
 674                                 }
 675                         }
 676                         if (found) {
 677                                 return WERR_OK;
 678                         }
 679                 }
 680
 681                 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
 682                 W_ERROR_HAVE_NO_MEMORY(del_rec);
 683
 684                 werror =
 685                     dns_rr_to_dnsp(del_rec, update, del_rec, name_is_static);
 686                 DBG_DEBUG("dns_rr_to_dnsp(DELETE-NONE): %s\n", win_errstr(werror));
 687                 W_ERROR_NOT_OK_RETURN(werror);
 688
 689                 for (i = first; i < rcount; i++) {
 690                         if (dns_record_match(del_rec, &recs[i])) {
 691                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
 692                                         .wType = DNS_TYPE_TOMBSTONE,
 693                                 };
 694                         }
 695                 }
 696
 697                 werror = dns_replace_records(dns, mem_ctx, dn,
 698                                              needs_add, recs, rcount);
 699                 DBG_DEBUG("dns_replace_records(DELETE-NONE): %s\n", win_errstr(werror));
 700                 W_ERROR_NOT_OK_RETURN(werror);
 701         }
 702
 703         return WERR_OK;
 704 }
 705
 706 static WERROR handle_updates(struct dns_server *dns,
 707                              TALLOC_CTX *mem_ctx,
 708                              const struct dns_name_question *zone,
 709                              const struct dns_res_rec *prereqs, uint16_t pcount,
 710                              struct dns_res_rec *updates, uint16_t upd_count,
 711                              struct dns_server_tkey *tkey)
 712 {
 713         struct ldb_dn *zone_dn = NULL;
 714         WERROR werror = WERR_OK;
 715         int ret;
 716         uint16_t ri;
 717         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 718
 719         if (tkey != NULL) {
 720                 ret = ldb_set_opaque(
 721                         dns->samdb,
 722                         DSDB_SESSION_INFO,
 723                         tkey->session_info);
 724                 if (ret != LDB_SUCCESS) {
 725                         DEBUG(1, ("unable to set session info\n"));
 726                         werror = DNS_ERR(SERVER_FAILURE);
 727                         goto failed;
 728                 }
 729         }
 730
 731         werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
 732         DBG_DEBUG("dns_name2dn(): %s\n", win_errstr(werror));
 733         W_ERROR_NOT_OK_GOTO(werror, failed);
 734
 735         ret = ldb_transaction_start(dns->samdb);
 736         if (ret != LDB_SUCCESS) {
 737                 werror = DNS_ERR(SERVER_FAILURE);
 738                 goto failed;
 739         }
 740
 741         werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
 742         W_ERROR_NOT_OK_GOTO(werror, failed);
 743
 744         DBG_DEBUG("dns update count is %u\n", upd_count);
 745
 746         for (ri = 0; ri < upd_count; ri++) {
 747                 werror = handle_one_update(dns, tmp_ctx, zone,
 748                                            &updates[ri], tkey);
 749                 DBG_DEBUG("handle_one_update(%u): %s\n",
 750                           ri, win_errstr(werror));
 751                 W_ERROR_NOT_OK_GOTO(werror, failed);
 752         }
 753
 754 failed:
 755         if (W_ERROR_IS_OK(werror)) {
 756                 ret = ldb_transaction_commit(dns->samdb);
 757                 if (ret != LDB_SUCCESS) {
 758                         werror = DNS_ERR(SERVER_FAILURE);
 759                 }
 760         } else {
 761                 ldb_transaction_cancel(dns->samdb);
 762         }
 763
 764         if (tkey != NULL) {
 765                 ldb_set_opaque(
 766                         dns->samdb,
 767                         DSDB_SESSION_INFO,
 768                         system_session(dns->task->lp_ctx));
 769         }
 770
 771         TALLOC_FREE(tmp_ctx);
 772         return werror;
 773
 774 }
 775
 776 static WERROR dns_update_allowed(struct dns_server *dns,
 777                                  const struct dns_request_state *state,
 778                                  struct dns_server_tkey **tkey)
 779 {
 780         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
 781                 DEBUG(2, ("All updates allowed.\n"));
 782                 return WERR_OK;
 783         }
 784
 785         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
 786                 DEBUG(2, ("Updates disabled.\n"));
 787                 return DNS_ERR(REFUSED);
 788         }
 789
 790         if (state->authenticated == false ) {
 791                 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
 792                 return DNS_ERR(REFUSED);
 793         }
 794
 795         *tkey = dns_find_tkey(dns->tkeys, state->key_name);
 796         if (*tkey == NULL) {
 797                 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
 798                 return DNS_ERR(REFUSED);
 799         }
 800
 801         return WERR_OK;
 802 }
 803
 804
 805 WERROR dns_server_process_update(struct dns_server *dns,
 806                                  const struct dns_request_state *state,
 807                                  TALLOC_CTX *mem_ctx,
 808                                  const struct dns_name_packet *in,
 809                                  struct dns_res_rec **prereqs,    uint16_t *prereq_count,
 810                                  struct dns_res_rec **updates,    uint16_t *update_count,
 811                                  struct dns_res_rec **additional, uint16_t *arcount)
 812 {
 813         struct dns_name_question *zone;
 814         const struct dns_server_zone *z;
 815         size_t host_part_len = 0;
 816         WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
 817         struct dns_server_tkey *tkey = NULL;
 818
 819         if (in->qdcount != 1) {
 820                 return DNS_ERR(FORMAT_ERROR);
 821         }
 822
 823         zone = &in->questions[0];
 824
 825         if (zone->question_class != DNS_QCLASS_IN &&
 826             zone->question_class != DNS_QCLASS_ANY) {
 827                 return DNS_ERR(NOT_IMPLEMENTED);
 828         }
 829
 830         if (zone->question_type != DNS_QTYPE_SOA) {
 831                 return DNS_ERR(FORMAT_ERROR);
 832         }
 833
 834         DEBUG(2, ("Got a dns update request.\n"));
 835
 836         for (z = dns->zones; z != NULL; z = z->next) {
 837                 bool match;
 838
 839                 match = dns_name_match(z->name, zone->name, &host_part_len);
 840                 if (match) {
 841                         break;
 842                 }
 843         }
 844
 845         if (z == NULL) {
 846                 DEBUG(1, ("We're not authoritative for this zone\n"));
 847                 return DNS_ERR(NOTAUTH);
 848         }
 849
 850         if (host_part_len != 0) {
 851                 /* TODO: We need to delegate this one */
 852                 DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
 853                 return DNS_ERR(NOT_IMPLEMENTED);
 854         }
 855
 856         *prereq_count = in->ancount;
 857         *prereqs = in->answers;
 858         werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
 859                                      *prereq_count);
 860         W_ERROR_NOT_OK_RETURN(werror);
 861
 862         werror = dns_update_allowed(dns, state, &tkey);
 863         if (!W_ERROR_IS_OK(werror)) {
 864                 return werror;
 865         }
 866
 867         *update_count = in->nscount;
 868         *updates = in->nsrecs;
 869         werror = update_prescan(in->questions, *updates, *update_count);
 870         DBG_DEBUG("update_prescan(): %s\n", win_errstr(werror));
 871         W_ERROR_NOT_OK_RETURN(werror);
 872
 873         werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
 874                                 *prereq_count, *updates, *update_count, tkey);
 875         DBG_DEBUG("handle_updates(): %s\n", win_errstr(werror));
 876         W_ERROR_NOT_OK_RETURN(werror);
 877
 878         return werror;
 879 }