source4/dns_server/dlz_bind9.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    bind9 dlz driver for Samba
   5
   6    Copyright (C) 2010 Andrew Tridgell
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "talloc.h"
  24 #include "param/param.h"
  25 #include "lib/events/events.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "dsdb/common/util.h"
  28 #include "auth/auth.h"
  29 #include "auth/session.h"
  30 #include "auth/gensec/gensec.h"
  31 #include "librpc/gen_ndr/security.h"
  32 #include "auth/credentials/credentials.h"
  33 #include "system/kerberos.h"
  34 #include "auth/kerberos/kerberos.h"
  35 #include "gen_ndr/ndr_dnsp.h"
  36 #include "gen_ndr/server_id.h"
  37 #include "messaging/messaging.h"
  38 #include <popt.h>
  39 #include "lib/util/dlinklist.h"
  40 #include "dlz_minimal.h"
  41 #include "dns_server/dnsserver_common.h"
  42
  43 struct b9_options {
  44         const char *url;
  45         const char *debug;
  46 };
  47
  48 struct b9_zone {
  49         char *name;
  50         struct b9_zone *prev, *next;
  51 };
  52
  53 struct dlz_bind9_data {
  54         struct b9_options options;
  55         struct ldb_context *samdb;
  56         struct tevent_context *ev_ctx;
  57         struct loadparm_context *lp;
  58         int *transaction_token;
  59         uint32_t soa_serial;
  60         struct b9_zone *zonelist;
  61
  62         /* Used for dynamic update */
  63         struct smb_krb5_context *smb_krb5_ctx;
  64         struct auth4_context *auth_context;
  65         struct auth_session_info *session_info;
  66         char *update_name;
  67
  68         /* helper functions from the dlz_dlopen driver */
  69         log_t *log;
  70         dns_sdlz_putrr_t *putrr;
  71         dns_sdlz_putnamedrr_t *putnamedrr;
  72         dns_dlz_writeablezone_t *writeable_zone;
  73 };
  74
  75 static struct dlz_bind9_data *dlz_bind9_state = NULL;
  76 static int dlz_bind9_state_ref_count = 0;
  77
  78 static const char *zone_prefixes[] = {
  79         "CN=MicrosoftDNS,DC=DomainDnsZones",
  80         "CN=MicrosoftDNS,DC=ForestDnsZones",
  81         "CN=MicrosoftDNS,CN=System",
  82         NULL
  83 };
  84
  85 /*
  86   return the version of the API
  87  */
  88 _PUBLIC_ int dlz_version(unsigned int *flags)
  89 {
  90         return DLZ_DLOPEN_VERSION;
  91 }
  92
  93 /*
  94    remember a helper function from the bind9 dlz_dlopen driver
  95  */
  96 static void b9_add_helper(struct dlz_bind9_data *state, const char *helper_name, void *ptr)
  97 {
  98         if (strcmp(helper_name, "log") == 0) {
  99                 state->log = ptr;
 100         }
 101         if (strcmp(helper_name, "putrr") == 0) {
 102                 state->putrr = ptr;
 103         }
 104         if (strcmp(helper_name, "putnamedrr") == 0) {
 105                 state->putnamedrr = ptr;
 106         }
 107         if (strcmp(helper_name, "writeable_zone") == 0) {
 108                 state->writeable_zone = ptr;
 109         }
 110 }
 111
 112 /*
 113  * Add a trailing '.' if it's missing
 114  */
 115 static const char *b9_format_fqdn(TALLOC_CTX *mem_ctx, const char *str)
 116 {
 117         size_t len;
 118         const char *tmp;
 119
 120         if (str == NULL || str[0] == '\0') {
 121                 return str;
 122         }
 123
 124         len = strlen(str);
 125         if (str[len-1] != '.') {
 126                 tmp = talloc_asprintf(mem_ctx, "%s.", str);
 127         } else {
 128                 tmp = str;
 129         }
 130         return tmp;
 131 }
 132
 133 /*
 134   format a record for bind9
 135  */
 136 static bool b9_format(struct dlz_bind9_data *state,
 137                       TALLOC_CTX *mem_ctx,
 138                       struct dnsp_DnssrvRpcRecord *rec,
 139                       const char **type, const char **data)
 140 {
 141         uint32_t i;
 142         char *tmp;
 143         const char *fqdn;
 144
 145         switch (rec->wType) {
 146         case DNS_TYPE_A:
 147                 *type = "a";
 148                 *data = rec->data.ipv4;
 149                 break;
 150
 151         case DNS_TYPE_AAAA:
 152                 *type = "aaaa";
 153                 *data = rec->data.ipv6;
 154                 break;
 155
 156         case DNS_TYPE_CNAME:
 157                 *type = "cname";
 158                 *data = b9_format_fqdn(mem_ctx, rec->data.cname);
 159                 break;
 160
 161         case DNS_TYPE_TXT:
 162                 *type = "txt";
 163                 tmp = talloc_asprintf(mem_ctx, "\"%s\"", rec->data.txt.str[0]);
 164                 for (i=1; i<rec->data.txt.count; i++) {
 165                         tmp = talloc_asprintf_append(tmp, " \"%s\"", rec->data.txt.str[i]);
 166                 }
 167                 *data = tmp;
 168                 break;
 169
 170         case DNS_TYPE_PTR:
 171                 *type = "ptr";
 172                 *data = b9_format_fqdn(mem_ctx, rec->data.ptr);
 173                 break;
 174
 175         case DNS_TYPE_SRV:
 176                 *type = "srv";
 177                 fqdn = b9_format_fqdn(mem_ctx, rec->data.srv.nameTarget);
 178                 if (fqdn == NULL) {
 179                         return false;
 180                 }
 181                 *data = talloc_asprintf(mem_ctx, "%u %u %u %s",
 182                                         rec->data.srv.wPriority,
 183                                         rec->data.srv.wWeight,
 184                                         rec->data.srv.wPort,
 185                                         fqdn);
 186                 break;
 187
 188         case DNS_TYPE_MX:
 189                 *type = "mx";
 190                 fqdn = b9_format_fqdn(mem_ctx, rec->data.mx.nameTarget);
 191                 if (fqdn == NULL) {
 192                         return false;
 193                 }
 194                 *data = talloc_asprintf(mem_ctx, "%u %s",
 195                                         rec->data.mx.wPriority, fqdn);
 196                 break;
 197
 198         case DNS_TYPE_HINFO:
 199                 *type = "hinfo";
 200                 *data = talloc_asprintf(mem_ctx, "%s %s",
 201                                         rec->data.hinfo.cpu,
 202                                         rec->data.hinfo.os);
 203                 break;
 204
 205         case DNS_TYPE_NS:
 206                 *type = "ns";
 207                 *data = b9_format_fqdn(mem_ctx, rec->data.ns);
 208                 break;
 209
 210         case DNS_TYPE_SOA: {
 211                 const char *mname;
 212                 *type = "soa";
 213
 214                 /* we need to fake the authoritative nameserver to
 215                  * point at ourselves. This is how AD DNS servers
 216                  * force clients to send updates to the right local DC
 217                  */
 218                 mname = talloc_asprintf(mem_ctx, "%s.%s.",
 219                                         lpcfg_netbios_name(state->lp),
 220                                         lpcfg_dnsdomain(state->lp));
 221                 if (mname == NULL) {
 222                         return false;
 223                 }
 224                 mname = strlower_talloc(mem_ctx, mname);
 225                 if (mname == NULL) {
 226                         return false;
 227                 }
 228
 229                 fqdn = b9_format_fqdn(mem_ctx, rec->data.soa.rname);
 230                 if (fqdn == NULL) {
 231                         return false;
 232                 }
 233
 234                 state->soa_serial = rec->data.soa.serial;
 235
 236                 *data = talloc_asprintf(mem_ctx, "%s %s %u %u %u %u %u",
 237                                         mname, fqdn,
 238                                         rec->data.soa.serial,
 239                                         rec->data.soa.refresh,
 240                                         rec->data.soa.retry,
 241                                         rec->data.soa.expire,
 242                                         rec->data.soa.minimum);
 243                 break;
 244         }
 245
 246         default:
 247                 state->log(ISC_LOG_ERROR, "samba_dlz b9_format: unhandled record type %u",
 248                            rec->wType);
 249                 return false;
 250         }
 251
 252         return true;
 253 }
 254
 255 static const struct {
 256         enum dns_record_type dns_type;
 257         const char *typestr;
 258         bool single_valued;
 259 } dns_typemap[] = {
 260         { DNS_TYPE_A,     "A"     , false},
 261         { DNS_TYPE_AAAA,  "AAAA"  , false},
 262         { DNS_TYPE_CNAME, "CNAME" , true},
 263         { DNS_TYPE_TXT,   "TXT"   , false},
 264         { DNS_TYPE_PTR,   "PTR"   , false},
 265         { DNS_TYPE_SRV,   "SRV"   , false},
 266         { DNS_TYPE_MX,    "MX"    , false},
 267         { DNS_TYPE_HINFO, "HINFO" , false},
 268         { DNS_TYPE_NS,    "NS"    , false},
 269         { DNS_TYPE_SOA,   "SOA"   , true},
 270 };
 271
 272
 273 /*
 274   see if a DNS type is single valued
 275  */
 276 static bool b9_single_valued(enum dns_record_type dns_type)
 277 {
 278         int i;
 279         for (i=0; i<ARRAY_SIZE(dns_typemap); i++) {
 280                 if (dns_typemap[i].dns_type == dns_type) {
 281                         return dns_typemap[i].single_valued;
 282                 }
 283         }
 284         return false;
 285 }
 286
 287 /*
 288   see if a DNS type is single valued
 289  */
 290 static bool b9_dns_type(const char *type, enum dns_record_type *dtype)
 291 {
 292         int i;
 293         for (i=0; i<ARRAY_SIZE(dns_typemap); i++) {
 294                 if (strcasecmp(dns_typemap[i].typestr, type) == 0) {
 295                         *dtype = dns_typemap[i].dns_type;
 296                         return true;
 297                 }
 298         }
 299         return false;
 300 }
 301
 302
 303 #define DNS_PARSE_STR(ret, str, sep, saveptr) do {      \
 304         (ret) = strtok_r(str, sep, &saveptr); \
 305         if ((ret) == NULL) return false; \
 306         } while (0)
 307
 308 #define DNS_PARSE_UINT(ret, str, sep, saveptr) do {  \
 309         char *istr = strtok_r(str, sep, &saveptr); \
 310         if ((istr) == NULL) return false; \
 311         (ret) = strtoul(istr, NULL, 10); \
 312         } while (0)
 313
 314 /*
 315   parse a record from bind9
 316  */
 317 static bool b9_parse(struct dlz_bind9_data *state,
 318                      const char *rdatastr,
 319                      struct dnsp_DnssrvRpcRecord *rec)
 320 {
 321         char *full_name, *dclass, *type;
 322         char *str, *tmp, *saveptr=NULL;
 323         int i;
 324
 325         str = talloc_strdup(rec, rdatastr);
 326         if (str == NULL) {
 327                 return false;
 328         }
 329
 330         /* parse the SDLZ string form */
 331         DNS_PARSE_STR(full_name, str, "\t", saveptr);
 332         DNS_PARSE_UINT(rec->dwTtlSeconds, NULL, "\t", saveptr);
 333         DNS_PARSE_STR(dclass, NULL, "\t", saveptr);
 334         DNS_PARSE_STR(type, NULL, "\t", saveptr);
 335
 336         /* construct the record */
 337         for (i=0; i<ARRAY_SIZE(dns_typemap); i++) {
 338                 if (strcasecmp(type, dns_typemap[i].typestr) == 0) {
 339                         rec->wType = dns_typemap[i].dns_type;
 340                         break;
 341                 }
 342         }
 343         if (i == ARRAY_SIZE(dns_typemap)) {
 344                 state->log(ISC_LOG_ERROR, "samba_dlz: unsupported record type '%s' for '%s'",
 345                            type, full_name);
 346                 return false;
 347         }
 348
 349         switch (rec->wType) {
 350         case DNS_TYPE_A:
 351                 DNS_PARSE_STR(rec->data.ipv4, NULL, " ", saveptr);
 352                 break;
 353
 354         case DNS_TYPE_AAAA:
 355                 DNS_PARSE_STR(rec->data.ipv6, NULL, " ", saveptr);
 356                 break;
 357
 358         case DNS_TYPE_CNAME:
 359                 DNS_PARSE_STR(rec->data.cname, NULL, " ", saveptr);
 360                 break;
 361
 362         case DNS_TYPE_TXT:
 363                 rec->data.txt.count = 0;
 364                 rec->data.txt.str = talloc_array(rec, const char *, rec->data.txt.count);
 365                 tmp = strtok_r(NULL, "\t", &saveptr);
 366                 while (tmp) {
 367                         rec->data.txt.str = talloc_realloc(rec, rec->data.txt.str, const char *,
 368                                                         rec->data.txt.count+1);
 369                         if (tmp[0] == '"') {
 370                                 /* Strip quotes */
 371                                 rec->data.txt.str[rec->data.txt.count] = talloc_strndup(rec, &tmp[1], strlen(tmp)-2);
 372                         } else {
 373                                 rec->data.txt.str[rec->data.txt.count] = talloc_strdup(rec, tmp);
 374                         }
 375                         rec->data.txt.count++;
 376                         tmp = strtok_r(NULL, " ", &saveptr);
 377                 }
 378                 break;
 379
 380         case DNS_TYPE_PTR:
 381                 DNS_PARSE_STR(rec->data.ptr, NULL, " ", saveptr);
 382                 break;
 383
 384         case DNS_TYPE_SRV:
 385                 DNS_PARSE_UINT(rec->data.srv.wPriority, NULL, " ", saveptr);
 386                 DNS_PARSE_UINT(rec->data.srv.wWeight, NULL, " ", saveptr);
 387                 DNS_PARSE_UINT(rec->data.srv.wPort, NULL, " ", saveptr);
 388                 DNS_PARSE_STR(rec->data.srv.nameTarget, NULL, " ", saveptr);
 389                 break;
 390
 391         case DNS_TYPE_MX:
 392                 DNS_PARSE_UINT(rec->data.mx.wPriority, NULL, " ", saveptr);
 393                 DNS_PARSE_STR(rec->data.mx.nameTarget, NULL, " ", saveptr);
 394                 break;
 395
 396         case DNS_TYPE_HINFO:
 397                 DNS_PARSE_STR(rec->data.hinfo.cpu, NULL, " ", saveptr);
 398                 DNS_PARSE_STR(rec->data.hinfo.os, NULL, " ", saveptr);
 399                 break;
 400
 401         case DNS_TYPE_NS:
 402                 DNS_PARSE_STR(rec->data.ns, NULL, " ", saveptr);
 403                 break;
 404
 405         case DNS_TYPE_SOA:
 406                 DNS_PARSE_STR(rec->data.soa.mname, NULL, " ", saveptr);
 407                 DNS_PARSE_STR(rec->data.soa.rname, NULL, " ", saveptr);
 408                 DNS_PARSE_UINT(rec->data.soa.serial, NULL, " ", saveptr);
 409                 DNS_PARSE_UINT(rec->data.soa.refresh, NULL, " ", saveptr);
 410                 DNS_PARSE_UINT(rec->data.soa.retry, NULL, " ", saveptr);
 411                 DNS_PARSE_UINT(rec->data.soa.expire, NULL, " ", saveptr);
 412                 DNS_PARSE_UINT(rec->data.soa.minimum, NULL, " ", saveptr);
 413                 break;
 414
 415         default:
 416                 state->log(ISC_LOG_ERROR, "samba_dlz b9_parse: unhandled record type %u",
 417                            rec->wType);
 418                 return false;
 419         }
 420
 421         /* we should be at the end of the buffer now */
 422         if (strtok_r(NULL, "\t ", &saveptr) != NULL) {
 423                 state->log(ISC_LOG_ERROR, "samba_dlz b9_parse: unexpected data at end of string for '%s'",
 424                            rdatastr);
 425                 return false;
 426         }
 427
 428         return true;
 429 }
 430
 431 /*
 432   send a resource record to bind9
 433  */
 434 static isc_result_t b9_putrr(struct dlz_bind9_data *state,
 435                              void *handle, struct dnsp_DnssrvRpcRecord *rec,
 436                              const char **types)
 437 {
 438         isc_result_t result;
 439         const char *type, *data;
 440         TALLOC_CTX *tmp_ctx = talloc_new(state);
 441
 442         if (!b9_format(state, tmp_ctx, rec, &type, &data)) {
 443                 return ISC_R_FAILURE;
 444         }
 445
 446         if (data == NULL) {
 447                 talloc_free(tmp_ctx);
 448                 return ISC_R_NOMEMORY;
 449         }
 450
 451         if (types) {
 452                 int i;
 453                 for (i=0; types[i]; i++) {
 454                         if (strcmp(types[i], type) == 0) break;
 455                 }
 456                 if (types[i] == NULL) {
 457                         /* skip it */
 458                         return ISC_R_SUCCESS;
 459                 }
 460         }
 461
 462         result = state->putrr(handle, type, rec->dwTtlSeconds, data);
 463         if (result != ISC_R_SUCCESS) {
 464                 state->log(ISC_LOG_ERROR, "Failed to put rr");
 465         }
 466         talloc_free(tmp_ctx);
 467         return result;
 468 }
 469
 470
 471 /*
 472   send a named resource record to bind9
 473  */
 474 static isc_result_t b9_putnamedrr(struct dlz_bind9_data *state,
 475                                   void *handle, const char *name,
 476                                   struct dnsp_DnssrvRpcRecord *rec)
 477 {
 478         isc_result_t result;
 479         const char *type, *data;
 480         TALLOC_CTX *tmp_ctx = talloc_new(state);
 481
 482         if (!b9_format(state, tmp_ctx, rec, &type, &data)) {
 483                 return ISC_R_FAILURE;
 484         }
 485
 486         if (data == NULL) {
 487                 talloc_free(tmp_ctx);
 488                 return ISC_R_NOMEMORY;
 489         }
 490
 491         result = state->putnamedrr(handle, name, type, rec->dwTtlSeconds, data);
 492         if (result != ISC_R_SUCCESS) {
 493                 state->log(ISC_LOG_ERROR, "Failed to put named rr '%s'", name);
 494         }
 495         talloc_free(tmp_ctx);
 496         return result;
 497 }
 498
 499 /*
 500    parse options
 501  */
 502 static isc_result_t parse_options(struct dlz_bind9_data *state,
 503                                   unsigned int argc, const char **argv,
 504                                   struct b9_options *options)
 505 {
 506         int opt;
 507         poptContext pc;
 508         struct poptOption long_options[] = {
 509                 { "url", 'H', POPT_ARG_STRING, &options->url, 0, "database URL", "URL" },
 510                 { "debug", 'd', POPT_ARG_STRING, &options->debug, 0, "debug level", "DEBUG" },
 511                 { NULL }
 512         };
 513
 514         pc = poptGetContext("dlz_bind9", argc, argv, long_options,
 515                         POPT_CONTEXT_KEEP_FIRST);
 516         while ((opt = poptGetNextOpt(pc)) != -1) {
 517                 switch (opt) {
 518                 default:
 519                         state->log(ISC_LOG_ERROR, "dlz_bind9: Invalid option %s: %s",
 520                                    poptBadOption(pc, 0), poptStrerror(opt));
 521                         return ISC_R_FAILURE;
 522                 }
 523         }
 524
 525         return ISC_R_SUCCESS;
 526 }
 527
 528
 529 /*
 530  * Create session info from PAC
 531  * This is called as auth_context->generate_session_info_pac()
 532  */
 533 static NTSTATUS b9_generate_session_info_pac(struct auth4_context *auth_context,
 534                                              TALLOC_CTX *mem_ctx,
 535                                              struct smb_krb5_context *smb_krb5_context,
 536                                              DATA_BLOB *pac_blob,
 537                                              const char *principal_name,
 538                                              const struct tsocket_address *remote_addr,
 539                                              uint32_t session_info_flags,
 540                                              struct auth_session_info **session_info)
 541 {
 542         NTSTATUS status;
 543         struct auth_user_info_dc *user_info_dc;
 544         TALLOC_CTX *tmp_ctx;
 545
 546         tmp_ctx = talloc_new(mem_ctx);
 547         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 548
 549         status = kerberos_pac_blob_to_user_info_dc(tmp_ctx,
 550                                                    *pac_blob,
 551                                                    smb_krb5_context->krb5_context,
 552                                                    &user_info_dc,
 553                                                    NULL,
 554                                                    NULL);
 555         if (!NT_STATUS_IS_OK(status)) {
 556                 talloc_free(tmp_ctx);
 557                 return status;
 558         }
 559
 560         if (user_info_dc->info->authenticated) {
 561                 session_info_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
 562         }
 563
 564         session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
 565
 566         status = auth_generate_session_info(mem_ctx, NULL, NULL, user_info_dc,
 567                                             session_info_flags, session_info);
 568         if (!NT_STATUS_IS_OK(status)) {
 569                 talloc_free(tmp_ctx);
 570                 return status;
 571         }
 572
 573         talloc_free(tmp_ctx);
 574         return status;
 575 }
 576
 577 /* Callback for the DEBUG() system, to catch the remaining messages */
 578 static void b9_debug(void *private_ptr, int msg_level, const char *msg)
 579 {
 580         static const int isc_log_map[] = {
 581                 ISC_LOG_CRITICAL, /* 0 */
 582                 ISC_LOG_ERROR,    /* 1 */
 583                 ISC_LOG_WARNING,   /* 2 */
 584                 ISC_LOG_NOTICE    /* 3 */
 585         };
 586         struct dlz_bind9_data *state = private_ptr;
 587         int     isc_log_level;
 588
 589         if (msg_level >= ARRAY_SIZE(isc_log_map) || msg_level < 0) {
 590                 isc_log_level = ISC_LOG_INFO;
 591         } else {
 592                 isc_log_level = isc_log_map[msg_level];
 593         }
 594         state->log(isc_log_level, "samba_dlz: %s", msg);
 595 }
 596
 597 static int dlz_state_debug_unregister(struct dlz_bind9_data *state)
 598 {
 599         /* Stop logging (to the bind9 logs) */
 600         debug_set_callback(NULL, NULL);
 601         return 0;
 602 }
 603
 604 /*
 605   called to initialise the driver
 606  */
 607 _PUBLIC_ isc_result_t dlz_create(const char *dlzname,
 608                                  unsigned int argc, const char **argv,
 609                                  void **dbdata, ...)
 610 {
 611         struct dlz_bind9_data *state;
 612         const char *helper_name;
 613         va_list ap;
 614         isc_result_t result;
 615         struct ldb_dn *dn;
 616         NTSTATUS nt_status;
 617         int ret;
 618         char *errstring = NULL;
 619
 620         if (dlz_bind9_state != NULL) {
 621                 *dbdata = dlz_bind9_state;
 622                 dlz_bind9_state_ref_count++;
 623                 return ISC_R_SUCCESS;
 624         }
 625
 626         state = talloc_zero(NULL, struct dlz_bind9_data);
 627         if (state == NULL) {
 628                 return ISC_R_NOMEMORY;
 629         }
 630
 631         talloc_set_destructor(state, dlz_state_debug_unregister);
 632
 633         /* fill in the helper functions */
 634         va_start(ap, dbdata);
 635         while ((helper_name = va_arg(ap, const char *)) != NULL) {
 636                 b9_add_helper(state, helper_name, va_arg(ap, void*));
 637         }
 638         va_end(ap);
 639
 640         /* Do not install samba signal handlers */
 641         fault_setup_disable();
 642
 643         /* Start logging (to the bind9 logs) */
 644         debug_set_callback(state, b9_debug);
 645
 646         state->ev_ctx = s4_event_context_init(state);
 647         if (state->ev_ctx == NULL) {
 648                 result = ISC_R_NOMEMORY;
 649                 goto failed;
 650         }
 651
 652         result = parse_options(state, argc, argv, &state->options);
 653         if (result != ISC_R_SUCCESS) {
 654                 goto failed;
 655         }
 656
 657         state->lp = loadparm_init_global(true);
 658         if (state->lp == NULL) {
 659                 result = ISC_R_NOMEMORY;
 660                 goto failed;
 661         }
 662
 663         if (state->options.debug) {
 664                 lpcfg_do_global_parameter(state->lp, "log level", state->options.debug);
 665         } else {
 666                 lpcfg_do_global_parameter(state->lp, "log level", "0");
 667         }
 668
 669         if (smb_krb5_init_context(state, state->lp, &state->smb_krb5_ctx) != 0) {
 670                 result = ISC_R_NOMEMORY;
 671                 goto failed;
 672         }
 673
 674         nt_status = gensec_init();
 675         if (!NT_STATUS_IS_OK(nt_status)) {
 676                 result = ISC_R_NOMEMORY;
 677                 goto failed;
 678         }
 679
 680         state->auth_context = talloc_zero(state, struct auth4_context);
 681         if (state->auth_context == NULL) {
 682                 result = ISC_R_NOMEMORY;
 683                 goto failed;
 684         }
 685
 686         if (state->options.url == NULL) {
 687                 state->options.url = talloc_asprintf(state,
 688                                                      "%s/dns/sam.ldb",
 689                                                      lpcfg_binddns_dir(state->lp));
 690                 if (state->options.url == NULL) {
 691                         result = ISC_R_NOMEMORY;
 692                         goto failed;
 693                 }
 694
 695                 if (!file_exist(state->options.url)) {
 696                         state->options.url = talloc_asprintf(state,
 697                                                              "%s/dns/sam.ldb",
 698                                                              lpcfg_private_dir(state->lp));
 699                         if (state->options.url == NULL) {
 700                                 result = ISC_R_NOMEMORY;
 701                                 goto failed;
 702                         }
 703                 }
 704         }
 705
 706         ret = samdb_connect_url(state, state->ev_ctx, state->lp,
 707                                 system_session(state->lp), 0,
 708                                 state->options.url,
 709                                 &state->samdb, &errstring);
 710         if (ret != LDB_SUCCESS) {
 711                 state->log(ISC_LOG_ERROR,
 712                            "samba_dlz: Failed to connect to %s: %s",
 713                            errstring, ldb_strerror(ret));
 714                 result = ISC_R_FAILURE;
 715                 goto failed;
 716         }
 717
 718         dn = ldb_get_default_basedn(state->samdb);
 719         if (dn == NULL) {
 720                 state->log(ISC_LOG_ERROR, "samba_dlz: Unable to get basedn for %s - %s",
 721                            state->options.url, ldb_errstring(state->samdb));
 722                 result = ISC_R_FAILURE;
 723                 goto failed;
 724         }
 725
 726         state->log(ISC_LOG_INFO, "samba_dlz: started for DN %s",
 727                    ldb_dn_get_linearized(dn));
 728
 729         state->auth_context->event_ctx = state->ev_ctx;
 730         state->auth_context->lp_ctx = state->lp;
 731         state->auth_context->sam_ctx = state->samdb;
 732         state->auth_context->generate_session_info_pac = b9_generate_session_info_pac;
 733
 734         *dbdata = state;
 735         dlz_bind9_state = state;
 736         dlz_bind9_state_ref_count++;
 737
 738         return ISC_R_SUCCESS;
 739
 740 failed:
 741         talloc_free(state);
 742         return result;
 743 }
 744
 745 /*
 746   shutdown the backend
 747  */
 748 _PUBLIC_ void dlz_destroy(void *dbdata)
 749 {
 750         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
 751         state->log(ISC_LOG_INFO, "samba_dlz: shutting down");
 752
 753         dlz_bind9_state_ref_count--;
 754         if (dlz_bind9_state_ref_count == 0) {
 755                 talloc_unlink(state, state->samdb);
 756                 talloc_free(state);
 757                 dlz_bind9_state = NULL;
 758         }
 759 }
 760
 761
 762 /*
 763   return the base DN for a zone
 764  */
 765 static isc_result_t b9_find_zone_dn(struct dlz_bind9_data *state, const char *zone_name,
 766                                     TALLOC_CTX *mem_ctx, struct ldb_dn **zone_dn)
 767 {
 768         int ret;
 769         TALLOC_CTX *tmp_ctx = talloc_new(state);
 770         const char *attrs[] = { NULL };
 771         int i;
 772
 773         for (i=0; zone_prefixes[i]; i++) {
 774                 struct ldb_dn *dn;
 775                 struct ldb_result *res;
 776
 777                 dn = ldb_dn_copy(tmp_ctx, ldb_get_default_basedn(state->samdb));
 778                 if (dn == NULL) {
 779                         talloc_free(tmp_ctx);
 780                         return ISC_R_NOMEMORY;
 781                 }
 782
 783                 if (!ldb_dn_add_child_fmt(dn, "DC=%s,%s", zone_name, zone_prefixes[i])) {
 784                         talloc_free(tmp_ctx);
 785                         return ISC_R_NOMEMORY;
 786                 }
 787
 788                 ret = ldb_search(state->samdb, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, "objectClass=dnsZone");
 789                 if (ret == LDB_SUCCESS) {
 790                         if (zone_dn != NULL) {
 791                                 *zone_dn = talloc_steal(mem_ctx, dn);
 792                         }
 793                         talloc_free(tmp_ctx);
 794                         return ISC_R_SUCCESS;
 795                 }
 796                 talloc_free(dn);
 797         }
 798
 799         talloc_free(tmp_ctx);
 800         return ISC_R_NOTFOUND;
 801 }
 802
 803
 804 /*
 805   return the DN for a name. The record does not need to exist, but the
 806   zone must exist
 807  */
 808 static isc_result_t b9_find_name_dn(struct dlz_bind9_data *state, const char *name,
 809                                     TALLOC_CTX *mem_ctx, struct ldb_dn **dn)
 810 {
 811         const char *p;
 812
 813         /* work through the name piece by piece, until we find a zone */
 814         for (p=name; p; ) {
 815                 isc_result_t result;
 816                 result = b9_find_zone_dn(state, p, mem_ctx, dn);
 817                 if (result == ISC_R_SUCCESS) {
 818                         /* we found a zone, now extend the DN to get
 819                          * the full DN
 820                          */
 821                         bool ret;
 822                         if (p == name) {
 823                                 ret = ldb_dn_add_child_fmt(*dn, "DC=@");
 824                         } else {
 825                                 ret = ldb_dn_add_child_fmt(*dn, "DC=%.*s", (int)(p-name)-1, name);
 826                         }
 827                         if (!ret) {
 828                                 talloc_free(*dn);
 829                                 return ISC_R_NOMEMORY;
 830                         }
 831                         return ISC_R_SUCCESS;
 832                 }
 833                 p = strchr(p, '.');
 834                 if (p == NULL) {
 835                         break;
 836                 }
 837                 p++;
 838         }
 839         return ISC_R_NOTFOUND;
 840 }
 841
 842
 843 /*
 844   see if we handle a given zone
 845  */
 846 #if DLZ_DLOPEN_VERSION < 3
 847 _PUBLIC_ isc_result_t dlz_findzonedb(void *dbdata, const char *name)
 848 #else
 849 _PUBLIC_ isc_result_t dlz_findzonedb(void *dbdata, const char *name,
 850                                      dns_clientinfomethods_t *methods,
 851                                      dns_clientinfo_t *clientinfo)
 852 #endif
 853 {
 854         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
 855         return b9_find_zone_dn(state, name, NULL, NULL);
 856 }
 857
 858
 859 /*
 860   lookup one record
 861  */
 862 static isc_result_t dlz_lookup_types(struct dlz_bind9_data *state,
 863                                      const char *zone, const char *name,
 864                                      dns_sdlzlookup_t *lookup,
 865                                      const char **types)
 866 {
 867         TALLOC_CTX *tmp_ctx = talloc_new(state);
 868         struct ldb_dn *dn;
 869         WERROR werr = WERR_DNS_ERROR_NAME_DOES_NOT_EXIST;
 870         struct dnsp_DnssrvRpcRecord *records = NULL;
 871         uint16_t num_records = 0, i;
 872
 873         for (i=0; zone_prefixes[i]; i++) {
 874                 dn = ldb_dn_copy(tmp_ctx, ldb_get_default_basedn(state->samdb));
 875                 if (dn == NULL) {
 876                         talloc_free(tmp_ctx);
 877                         return ISC_R_NOMEMORY;
 878                 }
 879
 880                 if (!ldb_dn_add_child_fmt(dn, "DC=%s,DC=%s,%s", name, zone, zone_prefixes[i])) {
 881                         talloc_free(tmp_ctx);
 882                         return ISC_R_NOMEMORY;
 883                 }
 884
 885                 werr = dns_common_wildcard_lookup(state->samdb, tmp_ctx, dn,
 886                                          &records, &num_records);
 887                 if (W_ERROR_IS_OK(werr)) {
 888                         break;
 889                 }
 890         }
 891         if (!W_ERROR_IS_OK(werr)) {
 892                 talloc_free(tmp_ctx);
 893                 return ISC_R_NOTFOUND;
 894         }
 895
 896         for (i=0; i < num_records; i++) {
 897                 isc_result_t result;
 898
 899                 result = b9_putrr(state, lookup, &records[i], types);
 900                 if (result != ISC_R_SUCCESS) {
 901                         talloc_free(tmp_ctx);
 902                         return result;
 903                 }
 904         }
 905
 906         talloc_free(tmp_ctx);
 907         return ISC_R_SUCCESS;
 908 }
 909
 910 /*
 911   lookup one record
 912  */
 913 #if DLZ_DLOPEN_VERSION == 1
 914 _PUBLIC_ isc_result_t dlz_lookup(const char *zone, const char *name,
 915                                  void *dbdata, dns_sdlzlookup_t *lookup)
 916 #else
 917 _PUBLIC_ isc_result_t dlz_lookup(const char *zone, const char *name,
 918                                  void *dbdata, dns_sdlzlookup_t *lookup,
 919                                  dns_clientinfomethods_t *methods,
 920                                  dns_clientinfo_t *clientinfo)
 921 #endif
 922 {
 923         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
 924         return dlz_lookup_types(state, zone, name, lookup, NULL);
 925 }
 926
 927
 928 /*
 929   see if a zone transfer is allowed
 930  */
 931 _PUBLIC_ isc_result_t dlz_allowzonexfr(void *dbdata, const char *name, const char *client)
 932 {
 933         /* just say yes for all our zones for now */
 934         struct dlz_bind9_data *state = talloc_get_type(
 935                 dbdata, struct dlz_bind9_data);
 936         return b9_find_zone_dn(state, name, NULL, NULL);
 937 }
 938
 939 /*
 940   perform a zone transfer
 941  */
 942 _PUBLIC_ isc_result_t dlz_allnodes(const char *zone, void *dbdata,
 943                                    dns_sdlzallnodes_t *allnodes)
 944 {
 945         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
 946         const char *attrs[] = { "dnsRecord", NULL };
 947         int ret = LDB_SUCCESS, i, j;
 948         struct ldb_dn *dn;
 949         struct ldb_result *res;
 950         TALLOC_CTX *tmp_ctx = talloc_new(state);
 951
 952         for (i=0; zone_prefixes[i]; i++) {
 953                 dn = ldb_dn_copy(tmp_ctx, ldb_get_default_basedn(state->samdb));
 954                 if (dn == NULL) {
 955                         talloc_free(tmp_ctx);
 956                         return ISC_R_NOMEMORY;
 957                 }
 958
 959                 if (!ldb_dn_add_child_fmt(dn, "DC=%s,%s", zone, zone_prefixes[i])) {
 960                         talloc_free(tmp_ctx);
 961                         return ISC_R_NOMEMORY;
 962                 }
 963
 964                 ret = ldb_search(state->samdb, tmp_ctx, &res, dn, LDB_SCOPE_SUBTREE,
 965                                  attrs, "objectClass=dnsNode");
 966                 if (ret == LDB_SUCCESS) {
 967                         break;
 968                 }
 969         }
 970         if (ret != LDB_SUCCESS) {
 971                 talloc_free(tmp_ctx);
 972                 return ISC_R_NOTFOUND;
 973         }
 974
 975         for (i=0; i<res->count; i++) {
 976                 struct ldb_message_element *el;
 977                 TALLOC_CTX *el_ctx = talloc_new(tmp_ctx);
 978                 const char *rdn, *name;
 979                 const struct ldb_val *v;
 980                 WERROR werr;
 981                 struct dnsp_DnssrvRpcRecord *recs = NULL;
 982                 uint16_t num_recs = 0;
 983
 984                 el = ldb_msg_find_element(res->msgs[i], "dnsRecord");
 985                 if (el == NULL || el->num_values == 0) {
 986                         state->log(ISC_LOG_INFO, "failed to find dnsRecord for %s",
 987                                    ldb_dn_get_linearized(dn));
 988                         talloc_free(el_ctx);
 989                         continue;
 990                 }
 991
 992                 v = ldb_dn_get_rdn_val(res->msgs[i]->dn);
 993                 if (v == NULL) {
 994                         state->log(ISC_LOG_INFO, "failed to find RDN for %s",
 995                                    ldb_dn_get_linearized(dn));
 996                         talloc_free(el_ctx);
 997                         continue;
 998                 }
 999
1000                 rdn = talloc_strndup(el_ctx, (char *)v->data, v->length);
1001                 if (rdn == NULL) {
1002                         talloc_free(tmp_ctx);
1003                         return ISC_R_NOMEMORY;
1004                 }
1005
1006                 if (strcmp(rdn, "@") == 0) {
1007                         name = zone;
1008                 } else {
1009                         name = talloc_asprintf(el_ctx, "%s.%s", rdn, zone);
1010                 }
1011                 name = b9_format_fqdn(el_ctx, name);
1012                 if (name == NULL) {
1013                         talloc_free(tmp_ctx);
1014                         return ISC_R_NOMEMORY;
1015                 }
1016
1017                 werr = dns_common_extract(state->samdb, el, el_ctx, &recs, &num_recs);
1018                 if (!W_ERROR_IS_OK(werr)) {
1019                         state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse dnsRecord for %s, %s",
1020                                    ldb_dn_get_linearized(dn), win_errstr(werr));
1021                         talloc_free(el_ctx);
1022                         continue;
1023                 }
1024
1025                 for (j=0; j < num_recs; j++) {
1026                         isc_result_t result;
1027
1028                         result = b9_putnamedrr(state, allnodes, name, &recs[j]);
1029                         if (result != ISC_R_SUCCESS) {
1030                                 continue;
1031                         }
1032                 }
1033
1034                 talloc_free(el_ctx);
1035         }
1036
1037         talloc_free(tmp_ctx);
1038
1039         return ISC_R_SUCCESS;
1040 }
1041
1042
1043 /*
1044   start a transaction
1045  */
1046 _PUBLIC_ isc_result_t dlz_newversion(const char *zone, void *dbdata, void **versionp)
1047 {
1048         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
1049
1050         state->log(ISC_LOG_INFO, "samba_dlz: starting transaction on zone %s", zone);
1051
1052         if (state->transaction_token != NULL) {
1053                 state->log(ISC_LOG_INFO, "samba_dlz: transaction already started for zone %s", zone);
1054                 return ISC_R_FAILURE;
1055         }
1056
1057         state->transaction_token = talloc_zero(state, int);
1058         if (state->transaction_token == NULL) {
1059                 return ISC_R_NOMEMORY;
1060         }
1061
1062         if (ldb_transaction_start(state->samdb) != LDB_SUCCESS) {
1063                 state->log(ISC_LOG_INFO, "samba_dlz: failed to start a transaction for zone %s", zone);
1064                 talloc_free(state->transaction_token);
1065                 state->transaction_token = NULL;
1066                 return ISC_R_FAILURE;
1067         }
1068
1069         *versionp = (void *)state->transaction_token;
1070
1071         return ISC_R_SUCCESS;
1072 }
1073
1074 /*
1075   end a transaction
1076  */
1077 _PUBLIC_ void dlz_closeversion(const char *zone, isc_boolean_t commit,
1078                                void *dbdata, void **versionp)
1079 {
1080         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
1081
1082         if (state->transaction_token != (int *)*versionp) {
1083                 state->log(ISC_LOG_INFO, "samba_dlz: transaction not started for zone %s", zone);
1084                 return;
1085         }
1086
1087         if (commit) {
1088                 if (ldb_transaction_commit(state->samdb) != LDB_SUCCESS) {
1089                         state->log(ISC_LOG_INFO, "samba_dlz: failed to commit a transaction for zone %s", zone);
1090                         return;
1091                 }
1092                 state->log(ISC_LOG_INFO, "samba_dlz: committed transaction on zone %s", zone);
1093         } else {
1094                 if (ldb_transaction_cancel(state->samdb) != LDB_SUCCESS) {
1095                         state->log(ISC_LOG_INFO, "samba_dlz: failed to cancel a transaction for zone %s", zone);
1096                         return;
1097                 }
1098                 state->log(ISC_LOG_INFO, "samba_dlz: cancelling transaction on zone %s", zone);
1099         }
1100
1101         talloc_free(state->transaction_token);
1102         state->transaction_token = NULL;
1103         *versionp = NULL;
1104 }
1105
1106
1107 /*
1108   see if there is a SOA record for a zone
1109  */
1110 static bool b9_has_soa(struct dlz_bind9_data *state, struct ldb_dn *dn, const char *zone)
1111 {
1112         TALLOC_CTX *tmp_ctx = talloc_new(state);
1113         WERROR werr;
1114         struct dnsp_DnssrvRpcRecord *records = NULL;
1115         uint16_t num_records = 0, i;
1116
1117         if (!ldb_dn_add_child_fmt(dn, "DC=@,DC=%s", zone)) {
1118                 talloc_free(tmp_ctx);
1119                 return false;
1120         }
1121
1122         werr = dns_common_lookup(state->samdb, tmp_ctx, dn,
1123                                  &records, &num_records, NULL);
1124         if (!W_ERROR_IS_OK(werr)) {
1125                 talloc_free(tmp_ctx);
1126                 return false;
1127         }
1128
1129         for (i=0; i < num_records; i++) {
1130                 if (records[i].wType == DNS_TYPE_SOA) {
1131                         talloc_free(tmp_ctx);
1132                         return true;
1133                 }
1134         }
1135
1136         talloc_free(tmp_ctx);
1137         return false;
1138 }
1139
1140 static bool b9_zone_add(struct dlz_bind9_data *state, const char *name)
1141 {
1142         struct b9_zone *zone;
1143
1144         zone = talloc_zero(state, struct b9_zone);
1145         if (zone == NULL) {
1146                 return false;
1147         }
1148
1149         zone->name = talloc_strdup(zone, name);
1150         if (zone->name == NULL) {
1151                 talloc_free(zone);
1152                 return false;
1153         }
1154
1155         DLIST_ADD(state->zonelist, zone);
1156         return true;
1157 }
1158
1159 static bool b9_zone_exists(struct dlz_bind9_data *state, const char *name)
1160 {
1161         struct b9_zone *zone = state->zonelist;
1162         bool found = false;
1163
1164         while (zone != NULL) {
1165                 if (strcasecmp(name, zone->name) == 0) {
1166                         found = true;
1167                         break;
1168                 }
1169                 zone = zone->next;
1170         }
1171
1172         return found;
1173 }
1174
1175
1176 /*
1177   configure a writeable zone
1178  */
1179 #if DLZ_DLOPEN_VERSION < 3
1180 _PUBLIC_ isc_result_t dlz_configure(dns_view_t *view, void *dbdata)
1181 #else
1182 _PUBLIC_ isc_result_t dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb,
1183                                     void *dbdata)
1184 #endif
1185 {
1186         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
1187         TALLOC_CTX *tmp_ctx;
1188         struct ldb_dn *dn;
1189         int i;
1190
1191         state->log(ISC_LOG_INFO, "samba_dlz: starting configure");
1192         if (state->writeable_zone == NULL) {
1193                 state->log(ISC_LOG_INFO, "samba_dlz: no writeable_zone method available");
1194                 return ISC_R_FAILURE;
1195         }
1196
1197         tmp_ctx = talloc_new(state);
1198
1199         for (i=0; zone_prefixes[i]; i++) {
1200                 const char *attrs[] = { "name", NULL };
1201                 int j, ret;
1202                 struct ldb_result *res;
1203
1204                 dn = ldb_dn_copy(tmp_ctx, ldb_get_default_basedn(state->samdb));
1205                 if (dn == NULL) {
1206                         talloc_free(tmp_ctx);
1207                         return ISC_R_NOMEMORY;
1208                 }
1209
1210                 if (!ldb_dn_add_child_fmt(dn, "%s", zone_prefixes[i])) {
1211                         talloc_free(tmp_ctx);
1212                         return ISC_R_NOMEMORY;
1213                 }
1214
1215                 ret = ldb_search(state->samdb, tmp_ctx, &res, dn, LDB_SCOPE_SUBTREE,
1216                                  attrs, "objectClass=dnsZone");
1217                 if (ret != LDB_SUCCESS) {
1218                         continue;
1219                 }
1220
1221                 for (j=0; j<res->count; j++) {
1222                         isc_result_t result;
1223                         const char *zone = ldb_msg_find_attr_as_string(res->msgs[j], "name", NULL);
1224                         struct ldb_dn *zone_dn;
1225
1226                         if (zone == NULL) {
1227                                 continue;
1228                         }
1229                         /* Ignore zones that are not handled in BIND */
1230                         if ((strcmp(zone, "RootDNSServers") == 0) ||
1231                             (strcmp(zone, "..TrustAnchors") == 0)) {
1232                                 continue;
1233                         }
1234                         zone_dn = ldb_dn_copy(tmp_ctx, dn);
1235                         if (zone_dn == NULL) {
1236                                 talloc_free(tmp_ctx);
1237                                 return ISC_R_NOMEMORY;
1238                         }
1239
1240                         if (!b9_has_soa(state, zone_dn, zone)) {
1241                                 continue;
1242                         }
1243
1244                         if (b9_zone_exists(state, zone)) {
1245                                 state->log(ISC_LOG_WARNING, "samba_dlz: Ignoring duplicate zone '%s' from '%s'",
1246                                            zone, ldb_dn_get_linearized(zone_dn));
1247                                 continue;
1248                         }
1249
1250                         if (!b9_zone_add(state, zone)) {
1251                                 talloc_free(tmp_ctx);
1252                                 return ISC_R_NOMEMORY;
1253                         }
1254
1255 #if DLZ_DLOPEN_VERSION < 3
1256                         result = state->writeable_zone(view, zone);
1257 #else
1258                         result = state->writeable_zone(view, dlzdb, zone);
1259 #endif
1260                         if (result != ISC_R_SUCCESS) {
1261                                 state->log(ISC_LOG_ERROR, "samba_dlz: Failed to configure zone '%s'",
1262                                            zone);
1263                                 talloc_free(tmp_ctx);
1264                                 return result;
1265                         }
1266                         state->log(ISC_LOG_INFO, "samba_dlz: configured writeable zone '%s'", zone);
1267                 }
1268         }
1269
1270         talloc_free(tmp_ctx);
1271         return ISC_R_SUCCESS;
1272 }
1273
1274 /*
1275   authorize a zone update
1276  */
1277 _PUBLIC_ isc_boolean_t dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
1278                                     const char *type, const char *key, uint32_t keydatalen, uint8_t *keydata,
1279                                     void *dbdata)
1280 {
1281         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
1282         TALLOC_CTX *tmp_ctx;
1283         DATA_BLOB ap_req;
1284         struct cli_credentials *server_credentials;
1285         char *keytab_name;
1286         char *keytab_file = NULL;
1287         int ret;
1288         int ldb_ret;
1289         NTSTATUS nt_status;
1290         struct gensec_security *gensec_ctx;
1291         struct auth_session_info *session_info;
1292         struct ldb_dn *dn;
1293         isc_result_t result;
1294         struct ldb_result *res;
1295         const char * attrs[] = { NULL };
1296         uint32_t access_mask;
1297         struct gensec_settings *settings = NULL;
1298         const struct gensec_security_ops **backends = NULL;
1299         size_t idx = 0;
1300
1301         /* Remove cached credentials, if any */
1302         if (state->session_info) {
1303                 talloc_free(state->session_info);
1304                 state->session_info = NULL;
1305         }
1306         if (state->update_name) {
1307                 talloc_free(state->update_name);
1308                 state->update_name = NULL;
1309         }
1310
1311         tmp_ctx = talloc_new(NULL);
1312         if (tmp_ctx == NULL) {
1313                 state->log(ISC_LOG_ERROR, "samba_dlz: no memory");
1314                 return ISC_FALSE;
1315         }
1316
1317         ap_req = data_blob_const(keydata, keydatalen);
1318         server_credentials = cli_credentials_init(tmp_ctx);
1319         if (!server_credentials) {
1320                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to init server credentials");
1321                 talloc_free(tmp_ctx);
1322                 return ISC_FALSE;
1323         }
1324
1325         cli_credentials_set_krb5_context(server_credentials, state->smb_krb5_ctx);
1326         cli_credentials_set_conf(server_credentials, state->lp);
1327
1328         keytab_file = talloc_asprintf(tmp_ctx,
1329                                       "%s/dns.keytab",
1330                                       lpcfg_binddns_dir(state->lp));
1331         if (keytab_file == NULL) {
1332                 state->log(ISC_LOG_ERROR, "samba_dlz: Out of memory!");
1333                 talloc_free(tmp_ctx);
1334                 return ISC_FALSE;
1335         }
1336
1337         if (!file_exist(keytab_file)) {
1338                 keytab_file = talloc_asprintf(tmp_ctx,
1339                                               "%s/dns.keytab",
1340                                               lpcfg_private_dir(state->lp));
1341                 if (keytab_file == NULL) {
1342                         state->log(ISC_LOG_ERROR, "samba_dlz: Out of memory!");
1343                         talloc_free(tmp_ctx);
1344                         return ISC_FALSE;
1345                 }
1346         }
1347
1348         keytab_name = talloc_asprintf(tmp_ctx, "FILE:%s", keytab_file);
1349         if (keytab_name == NULL) {
1350                 state->log(ISC_LOG_ERROR, "samba_dlz: Out of memory!");
1351                 talloc_free(tmp_ctx);
1352                 return ISC_FALSE;
1353         }
1354
1355         ret = cli_credentials_set_keytab_name(server_credentials, state->lp, keytab_name,
1356                                                 CRED_SPECIFIED);
1357         if (ret != 0) {
1358                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to obtain server credentials from %s",
1359                            keytab_name);
1360                 talloc_free(tmp_ctx);
1361                 return ISC_FALSE;
1362         }
1363         talloc_free(keytab_name);
1364
1365         settings = lpcfg_gensec_settings(tmp_ctx, state->lp);
1366         if (settings == NULL) {
1367                 state->log(ISC_LOG_ERROR, "samba_dlz: lpcfg_gensec_settings failed");
1368                 talloc_free(tmp_ctx);
1369                 return ISC_FALSE;
1370         }
1371         backends = talloc_zero_array(settings,
1372                                      const struct gensec_security_ops *, 3);
1373         if (backends == NULL) {
1374                 state->log(ISC_LOG_ERROR, "samba_dlz: talloc_zero_array gensec_security_ops failed");
1375                 talloc_free(tmp_ctx);
1376                 return ISC_FALSE;
1377         }
1378         settings->backends = backends;
1379
1380         gensec_init();
1381
1382         backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_KERBEROS5);
1383         backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_SPNEGO);
1384
1385         nt_status = gensec_server_start(tmp_ctx, settings,
1386                                         state->auth_context, &gensec_ctx);
1387         if (!NT_STATUS_IS_OK(nt_status)) {
1388                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to start gensec server");
1389                 talloc_free(tmp_ctx);
1390                 return ISC_FALSE;
1391         }
1392
1393         gensec_set_credentials(gensec_ctx, server_credentials);
1394
1395         nt_status = gensec_start_mech_by_oid(gensec_ctx, GENSEC_OID_SPNEGO);
1396         if (!NT_STATUS_IS_OK(nt_status)) {
1397                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to start spnego");
1398                 talloc_free(tmp_ctx);
1399                 return ISC_FALSE;
1400         }
1401
1402         /*
1403          * We only allow SPNEGO/KRB5 and make sure the backend
1404          * to is RPC/IPC free.
1405          *
1406          * See gensec_gssapi_update_internal() as
1407          * GENSEC_SERVER.
1408          *
1409          * It allows gensec_update() not to block.
1410          *
1411          * If that changes in future we need to use
1412          * gensec_update_send/recv here!
1413          */
1414         nt_status = gensec_update(gensec_ctx, tmp_ctx, ap_req, &ap_req);
1415         if (!NT_STATUS_IS_OK(nt_status)) {
1416                 state->log(ISC_LOG_ERROR, "samba_dlz: spnego update failed");
1417                 talloc_free(tmp_ctx);
1418                 return ISC_FALSE;
1419         }
1420
1421         nt_status = gensec_session_info(gensec_ctx, tmp_ctx, &session_info);
1422         if (!NT_STATUS_IS_OK(nt_status)) {
1423                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to create session info");
1424                 talloc_free(tmp_ctx);
1425                 return ISC_FALSE;
1426         }
1427
1428         /* Get the DN from name */
1429         result = b9_find_name_dn(state, name, tmp_ctx, &dn);
1430         if (result != ISC_R_SUCCESS) {
1431                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to find name %s", name);
1432                 talloc_free(tmp_ctx);
1433                 return ISC_FALSE;
1434         }
1435
1436         /* make sure the dn exists, or find parent dn in case new object is being added */
1437         ldb_ret = ldb_search(state->samdb, tmp_ctx, &res, dn, LDB_SCOPE_BASE,
1438                                 attrs, "objectClass=dnsNode");
1439         if (ldb_ret == LDB_ERR_NO_SUCH_OBJECT) {
1440                 ldb_dn_remove_child_components(dn, 1);
1441                 access_mask = SEC_ADS_CREATE_CHILD;
1442                 talloc_free(res);
1443         } else if (ldb_ret == LDB_SUCCESS) {
1444                 access_mask = SEC_STD_REQUIRED | SEC_ADS_SELF_WRITE;
1445                 talloc_free(res);
1446         } else {
1447                 talloc_free(tmp_ctx);
1448                 return ISC_FALSE;
1449         }
1450
1451         /* Do ACL check */
1452         ldb_ret = dsdb_check_access_on_dn(state->samdb, tmp_ctx, dn,
1453                                                 session_info->security_token,
1454                                                 access_mask, NULL);
1455         if (ldb_ret != LDB_SUCCESS) {
1456                 state->log(ISC_LOG_INFO,
1457                         "samba_dlz: disallowing update of signer=%s name=%s type=%s error=%s",
1458                         signer, name, type, ldb_strerror(ldb_ret));
1459                 talloc_free(tmp_ctx);
1460                 return ISC_FALSE;
1461         }
1462
1463         /* Cache session_info, so it can be used in the actual add/delete operation */
1464         state->update_name = talloc_strdup(state, name);
1465         if (state->update_name == NULL) {
1466                 state->log(ISC_LOG_ERROR, "samba_dlz: memory allocation error");
1467                 talloc_free(tmp_ctx);
1468                 return ISC_FALSE;
1469         }
1470         state->session_info = talloc_steal(state, session_info);
1471
1472         state->log(ISC_LOG_INFO, "samba_dlz: allowing update of signer=%s name=%s tcpaddr=%s type=%s key=%s",
1473                    signer, name, tcpaddr, type, key);
1474
1475         talloc_free(tmp_ctx);
1476         return ISC_TRUE;
1477 }
1478
1479 /*
1480   see if two DNS names are the same
1481  */
1482 static bool dns_name_equal(const char *name1, const char *name2)
1483 {
1484         size_t len1 = strlen(name1);
1485         size_t len2 = strlen(name2);
1486         if (name1[len1-1] == '.') len1--;
1487         if (name2[len2-1] == '.') len2--;
1488         if (len1 != len2) {
1489                 return false;
1490         }
1491         return strncasecmp_m(name1, name2, len1) == 0;
1492 }
1493
1494
1495 /*
1496   see if two dns records match
1497  */
1498 static bool b9_record_match(struct dlz_bind9_data *state,
1499                             struct dnsp_DnssrvRpcRecord *rec1, struct dnsp_DnssrvRpcRecord *rec2)
1500 {
1501         bool status;
1502         int i;
1503         struct in6_addr rec1_in_addr6;
1504         struct in6_addr rec2_in_addr6;
1505
1506         if (rec1->wType != rec2->wType) {
1507                 return false;
1508         }
1509         /* see if this type is single valued */
1510         if (b9_single_valued(rec1->wType)) {
1511                 return true;
1512         }
1513
1514         /* see if the data matches */
1515         switch (rec1->wType) {
1516         case DNS_TYPE_A:
1517                 return strcmp(rec1->data.ipv4, rec2->data.ipv4) == 0;
1518         case DNS_TYPE_AAAA: {
1519                 int ret;
1520
1521                 ret = inet_pton(AF_INET6, rec1->data.ipv6, &rec1_in_addr6);
1522                 if (ret != 1) {
1523                         return false;
1524                 }
1525                 ret = inet_pton(AF_INET6, rec2->data.ipv6, &rec2_in_addr6);
1526                 if (ret != 1) {
1527                         return false;
1528                 }
1529
1530                 return memcmp(&rec1_in_addr6, &rec2_in_addr6, sizeof(rec1_in_addr6)) == 0;
1531         }
1532         case DNS_TYPE_CNAME:
1533                 return dns_name_equal(rec1->data.cname, rec2->data.cname);
1534         case DNS_TYPE_TXT:
1535                 status = (rec1->data.txt.count == rec2->data.txt.count);
1536                 if (!status) return status;
1537                 for (i=0; i<rec1->data.txt.count; i++) {
1538                         status &= (strcmp(rec1->data.txt.str[i], rec2->data.txt.str[i]) == 0);
1539                 }
1540                 return status;
1541         case DNS_TYPE_PTR:
1542                 return dns_name_equal(rec1->data.ptr, rec2->data.ptr);
1543         case DNS_TYPE_NS:
1544                 return dns_name_equal(rec1->data.ns, rec2->data.ns);
1545
1546         case DNS_TYPE_SRV:
1547                 return rec1->data.srv.wPriority == rec2->data.srv.wPriority &&
1548                         rec1->data.srv.wWeight  == rec2->data.srv.wWeight &&
1549                         rec1->data.srv.wPort    == rec2->data.srv.wPort &&
1550                         dns_name_equal(rec1->data.srv.nameTarget, rec2->data.srv.nameTarget);
1551
1552         case DNS_TYPE_MX:
1553                 return rec1->data.mx.wPriority == rec2->data.mx.wPriority &&
1554                         dns_name_equal(rec1->data.mx.nameTarget, rec2->data.mx.nameTarget);
1555
1556         case DNS_TYPE_HINFO:
1557                 return strcmp(rec1->data.hinfo.cpu, rec2->data.hinfo.cpu) == 0 &&
1558                         strcmp(rec1->data.hinfo.os, rec2->data.hinfo.os) == 0;
1559
1560         case DNS_TYPE_SOA:
1561                 return dns_name_equal(rec1->data.soa.mname, rec2->data.soa.mname) &&
1562                         dns_name_equal(rec1->data.soa.rname, rec2->data.soa.rname) &&
1563                         rec1->data.soa.serial == rec2->data.soa.serial &&
1564                         rec1->data.soa.refresh == rec2->data.soa.refresh &&
1565                         rec1->data.soa.retry == rec2->data.soa.retry &&
1566                         rec1->data.soa.expire == rec2->data.soa.expire &&
1567                         rec1->data.soa.minimum == rec2->data.soa.minimum;
1568         default:
1569                 state->log(ISC_LOG_ERROR, "samba_dlz b9_record_match: unhandled record type %u",
1570                            rec1->wType);
1571                 break;
1572         }
1573
1574         return false;
1575 }
1576
1577 /*
1578  * Update session_info on samdb using the cached credentials
1579  */
1580 static bool b9_set_session_info(struct dlz_bind9_data *state, const char *name)
1581 {
1582         int ret;
1583
1584         if (state->update_name == NULL || state->session_info == NULL) {
1585                 state->log(ISC_LOG_ERROR, "samba_dlz: invalid credentials");
1586                 return false;
1587         }
1588
1589         /* Do not use client credentials, if we're not updating the client specified name */
1590         if (strcmp(state->update_name, name) != 0) {
1591                 return true;
1592         }
1593
1594         ret = ldb_set_opaque(state->samdb, "sessionInfo", state->session_info);
1595         if (ret != LDB_SUCCESS) {
1596                 state->log(ISC_LOG_ERROR, "samba_dlz: unable to set session info");
1597                 return false;
1598         }
1599
1600         return true;
1601 }
1602
1603 /*
1604  * Reset session_info on samdb as system session
1605  */
1606 static void b9_reset_session_info(struct dlz_bind9_data *state)
1607 {
1608         ldb_set_opaque(state->samdb, "sessionInfo", system_session(state->lp));
1609 }
1610
1611 /*
1612   add or modify a rdataset
1613  */
1614 _PUBLIC_ isc_result_t dlz_addrdataset(const char *name, const char *rdatastr, void *dbdata, void *version)
1615 {
1616         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
1617         struct dnsp_DnssrvRpcRecord *rec;
1618         struct ldb_dn *dn;
1619         isc_result_t result;
1620         bool tombstoned = false;
1621         bool needs_add = false;
1622         struct dnsp_DnssrvRpcRecord *recs = NULL;
1623         uint16_t num_recs = 0;
1624         uint16_t first = 0;
1625         uint16_t i;
1626         NTTIME t;
1627         WERROR werr;
1628
1629         if (state->transaction_token != (void*)version) {
1630                 state->log(ISC_LOG_INFO, "samba_dlz: bad transaction version");
1631                 return ISC_R_FAILURE;
1632         }
1633
1634         rec = talloc_zero(state, struct dnsp_DnssrvRpcRecord);
1635         if (rec == NULL) {
1636                 return ISC_R_NOMEMORY;
1637         }
1638
1639         unix_to_nt_time(&t, time(NULL));
1640         t /= 10*1000*1000; /* convert to seconds (NT time is in 100ns units) */
1641         t /= 3600;         /* convert to hours */
1642
1643         rec->rank        = DNS_RANK_ZONE;
1644         rec->dwTimeStamp = (uint32_t)t;
1645
1646         if (!b9_parse(state, rdatastr, rec)) {
1647                 state->log(ISC_LOG_INFO, "samba_dlz: failed to parse rdataset '%s'", rdatastr);
1648                 talloc_free(rec);
1649                 return ISC_R_FAILURE;
1650         }
1651
1652         /* find the DN of the record */
1653         result = b9_find_name_dn(state, name, rec, &dn);
1654         if (result != ISC_R_SUCCESS) {
1655                 talloc_free(rec);
1656                 return result;
1657         }
1658
1659         /* get any existing records */
1660         werr = dns_common_lookup(state->samdb, rec, dn,
1661                                  &recs, &num_recs, &tombstoned);
1662         if (W_ERROR_EQUAL(werr, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
1663                 needs_add = true;
1664                 werr = WERR_OK;
1665         }
1666         if (!W_ERROR_IS_OK(werr)) {
1667                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse dnsRecord for %s, %s",
1668                            ldb_dn_get_linearized(dn), win_errstr(werr));
1669                 talloc_free(rec);
1670                 return ISC_R_FAILURE;
1671         }
1672
1673         if (tombstoned) {
1674                 /*
1675                  * we need to keep the existing tombstone record
1676                  * and ignore it
1677                  */
1678                 first = num_recs;
1679         }
1680
1681         /* there are existing records. We need to see if this will
1682          * replace a record or add to it
1683          */
1684         for (i=first; i < num_recs; i++) {
1685                 if (b9_record_match(state, rec, &recs[i])) {
1686                         break;
1687                 }
1688         }
1689         if (i == UINT16_MAX) {
1690                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to already %u dnsRecord values for %s",
1691                            i, ldb_dn_get_linearized(dn));
1692                 talloc_free(rec);
1693                 return ISC_R_FAILURE;
1694         }
1695
1696         if (i == num_recs) {
1697                 /* adding a new value */
1698                 recs = talloc_realloc(rec, recs,
1699                                       struct dnsp_DnssrvRpcRecord,
1700                                       num_recs + 1);
1701                 if (recs == NULL) {
1702                         talloc_free(rec);
1703                         return ISC_R_NOMEMORY;
1704                 }
1705                 num_recs++;
1706         }
1707
1708         recs[i] = *rec;
1709
1710         if (!b9_set_session_info(state, name)) {
1711                 talloc_free(rec);
1712                 return ISC_R_FAILURE;
1713         }
1714
1715         /* modify the record */
1716         werr = dns_common_replace(state->samdb, rec, dn,
1717                                   needs_add,
1718                                   state->soa_serial,
1719                                   recs, num_recs);
1720         b9_reset_session_info(state);
1721         if (!W_ERROR_IS_OK(werr)) {
1722                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to %s %s - %s",
1723                            needs_add ? "add" : "modify",
1724                            ldb_dn_get_linearized(dn), win_errstr(werr));
1725                 talloc_free(rec);
1726                 return ISC_R_FAILURE;
1727         }
1728
1729         state->log(ISC_LOG_INFO, "samba_dlz: added rdataset %s '%s'", name, rdatastr);
1730
1731         talloc_free(rec);
1732         return ISC_R_SUCCESS;
1733 }
1734
1735 /*
1736   remove a rdataset
1737  */
1738 _PUBLIC_ isc_result_t dlz_subrdataset(const char *name, const char *rdatastr, void *dbdata, void *version)
1739 {
1740         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
1741         struct dnsp_DnssrvRpcRecord *rec;
1742         struct ldb_dn *dn;
1743         isc_result_t result;
1744         struct dnsp_DnssrvRpcRecord *recs = NULL;
1745         uint16_t num_recs = 0;
1746         uint16_t i;
1747         WERROR werr;
1748
1749         if (state->transaction_token != (void*)version) {
1750                 state->log(ISC_LOG_ERROR, "samba_dlz: bad transaction version");
1751                 return ISC_R_FAILURE;
1752         }
1753
1754         rec = talloc_zero(state, struct dnsp_DnssrvRpcRecord);
1755         if (rec == NULL) {
1756                 return ISC_R_NOMEMORY;
1757         }
1758
1759         if (!b9_parse(state, rdatastr, rec)) {
1760                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse rdataset '%s'", rdatastr);
1761                 talloc_free(rec);
1762                 return ISC_R_FAILURE;
1763         }
1764
1765         /* find the DN of the record */
1766         result = b9_find_name_dn(state, name, rec, &dn);
1767         if (result != ISC_R_SUCCESS) {
1768                 talloc_free(rec);
1769                 return result;
1770         }
1771
1772         /* get the existing records */
1773         werr = dns_common_lookup(state->samdb, rec, dn,
1774                                  &recs, &num_recs, NULL);
1775         if (!W_ERROR_IS_OK(werr)) {
1776                 talloc_free(rec);
1777                 return ISC_R_NOTFOUND;
1778         }
1779
1780         for (i=0; i < num_recs; i++) {
1781                 if (b9_record_match(state, rec, &recs[i])) {
1782                         recs[i] = (struct dnsp_DnssrvRpcRecord) {
1783                                 .wType = DNS_TYPE_TOMBSTONE,
1784                         };
1785                         break;
1786                 }
1787         }
1788         if (i == num_recs) {
1789                 talloc_free(rec);
1790                 return ISC_R_NOTFOUND;
1791         }
1792
1793         if (!b9_set_session_info(state, name)) {
1794                 talloc_free(rec);
1795                 return ISC_R_FAILURE;
1796         }
1797
1798         /* modify the record */
1799         werr = dns_common_replace(state->samdb, rec, dn,
1800                                   false,/* needs_add */
1801                                   state->soa_serial,
1802                                   recs, num_recs);
1803         b9_reset_session_info(state);
1804         if (!W_ERROR_IS_OK(werr)) {
1805                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to modify %s - %s",
1806                            ldb_dn_get_linearized(dn), win_errstr(werr));
1807                 talloc_free(rec);
1808                 return ISC_R_FAILURE;
1809         }
1810
1811         state->log(ISC_LOG_INFO, "samba_dlz: subtracted rdataset %s '%s'", name, rdatastr);
1812
1813         talloc_free(rec);
1814         return ISC_R_SUCCESS;
1815 }
1816
1817
1818 /*
1819   delete all records of the given type
1820  */
1821 _PUBLIC_ isc_result_t dlz_delrdataset(const char *name, const char *type, void *dbdata, void *version)
1822 {
1823         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
1824         TALLOC_CTX *tmp_ctx;
1825         struct ldb_dn *dn;
1826         isc_result_t result;
1827         enum dns_record_type dns_type;
1828         bool found = false;
1829         struct dnsp_DnssrvRpcRecord *recs = NULL;
1830         uint16_t num_recs = 0;
1831         uint16_t ri = 0;
1832         WERROR werr;
1833
1834         if (state->transaction_token != (void*)version) {
1835                 state->log(ISC_LOG_ERROR, "samba_dlz: bad transaction version");
1836                 return ISC_R_FAILURE;
1837         }
1838
1839         if (!b9_dns_type(type, &dns_type)) {
1840                 state->log(ISC_LOG_ERROR, "samba_dlz: bad dns type %s in delete", type);
1841                 return ISC_R_FAILURE;
1842         }
1843
1844         tmp_ctx = talloc_new(state);
1845
1846         /* find the DN of the record */
1847         result = b9_find_name_dn(state, name, tmp_ctx, &dn);
1848         if (result != ISC_R_SUCCESS) {
1849                 talloc_free(tmp_ctx);
1850                 return result;
1851         }
1852
1853         /* get the existing records */
1854         werr = dns_common_lookup(state->samdb, tmp_ctx, dn,
1855                                  &recs, &num_recs, NULL);
1856         if (!W_ERROR_IS_OK(werr)) {
1857                 talloc_free(tmp_ctx);
1858                 return ISC_R_NOTFOUND;
1859         }
1860
1861         for (ri=0; ri < num_recs; ri++) {
1862                 if (dns_type != recs[ri].wType) {
1863                         continue;
1864                 }
1865
1866                 found = true;
1867                 recs[ri] = (struct dnsp_DnssrvRpcRecord) {
1868                         .wType = DNS_TYPE_TOMBSTONE,
1869                 };
1870         }
1871
1872         if (!found) {
1873                 talloc_free(tmp_ctx);
1874                 return ISC_R_FAILURE;
1875         }
1876
1877         if (!b9_set_session_info(state, name)) {
1878                 talloc_free(tmp_ctx);
1879                 return ISC_R_FAILURE;
1880         }
1881
1882         /* modify the record */
1883         werr = dns_common_replace(state->samdb, tmp_ctx, dn,
1884                                   false,/* needs_add */
1885                                   state->soa_serial,
1886                                   recs, num_recs);
1887         b9_reset_session_info(state);
1888         if (!W_ERROR_IS_OK(werr)) {
1889                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to modify %s - %s",
1890                            ldb_dn_get_linearized(dn), win_errstr(werr));
1891                 talloc_free(tmp_ctx);
1892                 return ISC_R_FAILURE;
1893         }
1894
1895         state->log(ISC_LOG_INFO, "samba_dlz: deleted rdataset %s of type %s", name, type);
1896
1897         talloc_free(tmp_ctx);
1898         return ISC_R_SUCCESS;
1899 }