source4/dns_server/dnsserver_common.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DNS server utils
   5
   6    Copyright (C) 2010 Kai Blin
   7    Copyright (C) 2014 Stefan Metzmacher
   8    Copyright (C) 2015 Andrew Bartlett
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "libcli/util/ntstatus.h"
  26 #include "libcli/util/werror.h"
  27 #include "librpc/ndr/libndr.h"
  28 #include "librpc/gen_ndr/ndr_dns.h"
  29 #include "librpc/gen_ndr/ndr_dnsp.h"
  30 #include <ldb.h>
  31 #include "dsdb/samdb/samdb.h"
  32 #include "dsdb/common/util.h"
  33 #include "dns_server/dnsserver_common.h"
  34 #include "rpc_server/dnsserver/dnsserver.h"
  35 #include "lib/util/dlinklist.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_DNS
  39
  40 uint8_t werr_to_dns_err(WERROR werr)
  41 {
  42         if (W_ERROR_EQUAL(WERR_OK, werr)) {
  43                 return DNS_RCODE_OK;
  44         } else if (W_ERROR_EQUAL(DNS_ERR(FORMAT_ERROR), werr)) {
  45                 return DNS_RCODE_FORMERR;
  46         } else if (W_ERROR_EQUAL(DNS_ERR(SERVER_FAILURE), werr)) {
  47                 return DNS_RCODE_SERVFAIL;
  48         } else if (W_ERROR_EQUAL(DNS_ERR(NAME_ERROR), werr)) {
  49                 return DNS_RCODE_NXDOMAIN;
  50         } else if (W_ERROR_EQUAL(WERR_DNS_ERROR_NAME_DOES_NOT_EXIST, werr)) {
  51                 return DNS_RCODE_NXDOMAIN;
  52         } else if (W_ERROR_EQUAL(DNS_ERR(NOT_IMPLEMENTED), werr)) {
  53                 return DNS_RCODE_NOTIMP;
  54         } else if (W_ERROR_EQUAL(DNS_ERR(REFUSED), werr)) {
  55                 return DNS_RCODE_REFUSED;
  56         } else if (W_ERROR_EQUAL(DNS_ERR(YXDOMAIN), werr)) {
  57                 return DNS_RCODE_YXDOMAIN;
  58         } else if (W_ERROR_EQUAL(DNS_ERR(YXRRSET), werr)) {
  59                 return DNS_RCODE_YXRRSET;
  60         } else if (W_ERROR_EQUAL(DNS_ERR(NXRRSET), werr)) {
  61                 return DNS_RCODE_NXRRSET;
  62         } else if (W_ERROR_EQUAL(DNS_ERR(NOTAUTH), werr)) {
  63                 return DNS_RCODE_NOTAUTH;
  64         } else if (W_ERROR_EQUAL(DNS_ERR(NOTZONE), werr)) {
  65                 return DNS_RCODE_NOTZONE;
  66         } else if (W_ERROR_EQUAL(DNS_ERR(BADKEY), werr)) {
  67                 return DNS_RCODE_BADKEY;
  68         }
  69         DEBUG(5, ("No mapping exists for %s\n", win_errstr(werr)));
  70         return DNS_RCODE_SERVFAIL;
  71 }
  72
  73 WERROR dns_common_extract(struct ldb_context *samdb,
  74                           const struct ldb_message_element *el,
  75                           TALLOC_CTX *mem_ctx,
  76                           struct dnsp_DnssrvRpcRecord **records,
  77                           uint16_t *num_records)
  78 {
  79         uint16_t ri;
  80         struct dnsp_DnssrvRpcRecord *recs;
  81
  82         *records = NULL;
  83         *num_records = 0;
  84
  85         recs = talloc_zero_array(mem_ctx, struct dnsp_DnssrvRpcRecord,
  86                                  el->num_values);
  87         if (recs == NULL) {
  88                 return WERR_NOT_ENOUGH_MEMORY;
  89         }
  90         for (ri = 0; ri < el->num_values; ri++) {
  91                 bool am_rodc;
  92                 int ret;
  93                 const char *dnsHostName = NULL;
  94                 struct ldb_val *v = &el->values[ri];
  95                 enum ndr_err_code ndr_err;
  96                 ndr_err = ndr_pull_struct_blob(v, recs, &recs[ri],
  97                                 (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
  98                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
  99                         TALLOC_FREE(recs);
 100                         DEBUG(0, ("Failed to grab dnsp_DnssrvRpcRecord\n"));
 101                         return DNS_ERR(SERVER_FAILURE);
 102                 }
 103
 104                 /*
 105                  * In AD, except on an RODC (where we should list a random RWDC,
 106                  * we should over-stamp the MNAME with our own hostname
 107                  */
 108                 if (recs[ri].wType != DNS_TYPE_SOA) {
 109                         continue;
 110                 }
 111
 112                 ret = samdb_rodc(samdb, &am_rodc);
 113                 if (ret != LDB_SUCCESS) {
 114                         DEBUG(0, ("Failed to confirm we are not an RODC: %s\n",
 115                                   ldb_errstring(samdb)));
 116                         return DNS_ERR(SERVER_FAILURE);
 117                 }
 118
 119                 if (am_rodc) {
 120                         continue;
 121                 }
 122
 123                 ret = samdb_dns_host_name(samdb, &dnsHostName);
 124                 if (ret != LDB_SUCCESS || dnsHostName == NULL) {
 125                         DEBUG(0, ("Failed to get dnsHostName from rootDSE"));
 126                         return DNS_ERR(SERVER_FAILURE);
 127                 }
 128
 129                 recs[ri].data.soa.mname = talloc_strdup(recs, dnsHostName);
 130         }
 131
 132         *records = recs;
 133         *num_records = el->num_values;
 134         return WERR_OK;
 135 }
 136
 137 /*
 138  * Lookup a DNS record, performing an exact match.
 139  * i.e. DNS wild card records are not considered.
 140  */
 141 WERROR dns_common_lookup(struct ldb_context *samdb,
 142                          TALLOC_CTX *mem_ctx,
 143                          struct ldb_dn *dn,
 144                          struct dnsp_DnssrvRpcRecord **records,
 145                          uint16_t *num_records,
 146                          bool *tombstoned)
 147 {
 148         const struct timeval start = timeval_current();
 149         static const char * const attrs[] = {
 150                 "dnsRecord",
 151                 "dNSTombstoned",
 152                 NULL
 153         };
 154         int ret;
 155         WERROR werr = WERR_OK;
 156         struct ldb_message *msg = NULL;
 157         struct ldb_message_element *el;
 158
 159         *records = NULL;
 160         *num_records = 0;
 161
 162         if (tombstoned != NULL) {
 163                 *tombstoned = false;
 164                 ret = dsdb_search_one(samdb, mem_ctx, &msg, dn,
 165                         LDB_SCOPE_BASE, attrs, 0,
 166                         "(objectClass=dnsNode)");
 167         } else {
 168                 ret = dsdb_search_one(samdb, mem_ctx, &msg, dn,
 169                         LDB_SCOPE_BASE, attrs, 0,
 170                         "(&(objectClass=dnsNode)(!(dNSTombstoned=TRUE)))");
 171         }
 172         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 173                 werr = WERR_DNS_ERROR_NAME_DOES_NOT_EXIST;
 174                 goto exit;
 175         }
 176         if (ret != LDB_SUCCESS) {
 177                 /* TODO: we need to check if there's a glue record we need to
 178                  * create a referral to */
 179                 werr = DNS_ERR(NAME_ERROR);
 180                 goto exit;
 181         }
 182
 183         if (tombstoned != NULL) {
 184                 *tombstoned = ldb_msg_find_attr_as_bool(msg,
 185                                         "dNSTombstoned", false);
 186         }
 187
 188         el = ldb_msg_find_element(msg, "dnsRecord");
 189         if (el == NULL) {
 190                 TALLOC_FREE(msg);
 191                 /*
 192                  * records produced by older Samba releases
 193                  * keep dnsNode objects without dnsRecord and
 194                  * without setting dNSTombstoned=TRUE.
 195                  *
 196                  * We just pretend they're tombstones.
 197                  */
 198                 if (tombstoned != NULL) {
 199                         struct dnsp_DnssrvRpcRecord *recs;
 200                         recs = talloc_array(mem_ctx,
 201                                             struct dnsp_DnssrvRpcRecord,
 202                                             1);
 203                         if (recs == NULL) {
 204                                 werr = WERR_NOT_ENOUGH_MEMORY;
 205                                 goto exit;
 206                         }
 207                         recs[0] = (struct dnsp_DnssrvRpcRecord) {
 208                                 .wType = DNS_TYPE_TOMBSTONE,
 209                                 /*
 210                                  * A value of timestamp != 0
 211                                  * indicated that the object was already
 212                                  * a tombstone, this will be used
 213                                  * in dns_common_replace()
 214                                  */
 215                                 .data.timestamp = 1,
 216                         };
 217
 218                         *tombstoned = true;
 219                         *records = recs;
 220                         *num_records = 1;
 221                         werr = WERR_OK;
 222                         goto exit;
 223                 } else {
 224                         /*
 225                          * Because we are not looking for a tombstone
 226                          * in this codepath, we just pretend it does
 227                          * not exist at all.
 228                          */
 229                         werr = WERR_DNS_ERROR_NAME_DOES_NOT_EXIST;
 230                         goto exit;
 231                 }
 232         }
 233
 234         werr = dns_common_extract(samdb, el, mem_ctx, records, num_records);
 235         TALLOC_FREE(msg);
 236         if (!W_ERROR_IS_OK(werr)) {
 237                 goto exit;
 238         }
 239
 240         werr = WERR_OK;
 241 exit:
 242         DNS_COMMON_LOG_OPERATION(
 243                 win_errstr(werr),
 244                 &start,
 245                 NULL,
 246                 dn == NULL ? NULL : ldb_dn_get_linearized(dn),
 247                 NULL);
 248         return werr;
 249 }
 250
 251 /*
 252  * Build an ldb_parse_tree node for an equality check
 253  *
 254  * Note: name is assumed to have been validated by dns_name_check
 255  *       so will be zero terminated and of a reasonable size.
 256  */
 257 static struct ldb_parse_tree *build_equality_operation(
 258         TALLOC_CTX *mem_ctx,
 259         bool add_asterix,     /* prepend an '*' to the name          */
 260         const uint8_t *name,  /* the value being matched             */
 261         const char *attr,     /* the attribute to check name against */
 262         size_t size)          /* length of name                      */
 263 {
 264
 265         struct ldb_parse_tree *el = NULL;  /* Equality node being built */
 266         struct ldb_val *value = NULL;      /* Value the attr will be compared
 267                                               with */
 268         size_t length = 0;                 /* calculated length of the value
 269                                               including option '*' prefix and
 270                                               '\0' string terminator */
 271
 272         el = talloc(mem_ctx, struct ldb_parse_tree);
 273         if (el == NULL) {
 274                 DBG_ERR("Unable to allocate ldb_parse_tree\n");
 275                 return NULL;
 276         }
 277
 278         el->operation = LDB_OP_EQUALITY;
 279         el->u.equality.attr = talloc_strdup(mem_ctx, attr);
 280         value = &el->u.equality.value;
 281         length = (add_asterix) ? size + 2 : size + 1;
 282         value->data = talloc_zero_array(el, uint8_t, length);
 283         if (el == NULL) {
 284                 DBG_ERR("Unable to allocate value->data\n");
 285                 TALLOC_FREE(el);
 286                 return NULL;
 287         }
 288
 289         value->length = length;
 290         if (add_asterix) {
 291                 value->data[0] = '*';
 292                 memcpy(&value->data[1], name, size);
 293         } else {
 294                 memcpy(value->data, name, size);
 295         }
 296         return el;
 297 }
 298
 299 /*
 300  * Determine the number of levels in name
 301  * essentially the number of '.'s in the name + 1
 302  *
 303  * name is assumed to have been validated by dns_name_check
 304  */
 305 static unsigned int number_of_labels(const struct ldb_val *name) {
 306         int x  = 0;
 307         unsigned int labels = 1;
 308         for (x = 0; x < name->length; x++) {
 309                 if (name->data[x] == '.') {
 310                         labels++;
 311                 }
 312         }
 313         return labels;
 314 }
 315 /*
 316  * Build a query that matches the target name, and any possible
 317  * DNS wild card entries
 318  *
 319  * Builds a parse tree equivalent to the example query.
 320  *
 321  * x.y.z -> (|(name=x.y.z)(name=\2a.y.z)(name=\2a.z)(name=\2a))
 322  *
 323  * The attribute 'name' is used as this is what the LDB index is on
 324  * (the RDN, being 'dc' in this use case, does not have an index in
 325  * the AD schema).
 326  *
 327  * Returns NULL if unable to build the query.
 328  *
 329  * The first component of the DN is assumed to be the name being looked up
 330  * and also that it has been validated by dns_name_check
 331  *
 332  */
 333 #define BASE "(&(objectClass=dnsNode)(!(dNSTombstoned=TRUE))(|(a=b)(c=d)))"
 334 static struct ldb_parse_tree *build_wildcard_query(
 335         TALLOC_CTX *mem_ctx,
 336         struct ldb_dn *dn)
 337 {
 338         const struct ldb_val *name = NULL;            /* The DNS name being
 339                                                          queried */
 340         const char *attr = "name";                    /* The attribute name */
 341         struct ldb_parse_tree *query = NULL;          /* The constructed query
 342                                                          parse tree*/
 343         struct ldb_parse_tree *wildcard_query = NULL; /* The parse tree for the
 344                                                          name and wild card
 345                                                          entries */
 346         int labels = 0;         /* The number of labels in the name */
 347
 348         name = ldb_dn_get_rdn_val(dn);
 349         if (name == NULL) {
 350                 DBG_ERR("Unable to get domain name value\n");
 351                 return NULL;
 352         }
 353         labels = number_of_labels(name);
 354
 355         query = ldb_parse_tree(mem_ctx, BASE);
 356         if (query == NULL) {
 357                 DBG_ERR("Unable to parse query %s\n", BASE);
 358                 return NULL;
 359         }
 360
 361         /*
 362          * The 3rd element of BASE is a place holder which is replaced with
 363          * the actual wild card query
 364          */
 365         wildcard_query = query->u.list.elements[2];
 366         TALLOC_FREE(wildcard_query->u.list.elements);
 367
 368         wildcard_query->u.list.num_elements = labels + 1;
 369         wildcard_query->u.list.elements = talloc_array(
 370                 wildcard_query,
 371                 struct ldb_parse_tree *,
 372                 labels + 1);
 373         /*
 374          * Build the wild card query
 375          */
 376         {
 377                 int x = 0;   /* current character in the name               */
 378                 int l = 0;   /* current equality operator index in elements */
 379                 struct ldb_parse_tree *el = NULL; /* Equality operator being
 380                                                      built */
 381                 bool add_asterix = true;  /* prepend an '*' to the value    */
 382                 for (l = 0, x = 0; l < labels && x < name->length; l++) {
 383                         unsigned int size = name->length - x;
 384                         add_asterix = (name->data[x] == '.');
 385                         el = build_equality_operation(
 386                                 mem_ctx,
 387                                 add_asterix,
 388                                 &name->data[x],
 389                                 attr,
 390                                 size);
 391                         if (el == NULL) {
 392                                 return NULL;  /* Reason will have been logged */
 393                         }
 394                         wildcard_query->u.list.elements[l] = el;
 395
 396                         /* skip to the start of the next label */
 397                         x++;
 398                         for (;x < name->length && name->data[x] != '.'; x++);
 399                 }
 400
 401                 /* Add the base level "*" only query */
 402                 el = build_equality_operation(mem_ctx, true, NULL, attr, 0);
 403                 if (el == NULL) {
 404                         TALLOC_FREE(query);
 405                         return NULL;  /* Reason will have been logged */
 406                 }
 407                 wildcard_query->u.list.elements[l] = el;
 408         }
 409         return query;
 410 }
 411
 412 /*
 413  * Scan the list of records matching a dns wildcard query and return the
 414  * best match.
 415  *
 416  * The best match is either an exact name match, or the longest wild card
 417  * entry returned
 418  *
 419  * i.e. name = a.b.c candidates *.b.c, *.c,        - *.b.c would be selected
 420  *      name = a.b.c candidates a.b.c, *.b.c, *.c  - a.b.c would be selected
 421  */
 422 static struct ldb_message *get_best_match(struct ldb_dn *dn,
 423                                           struct ldb_result *result)
 424 {
 425         int matched = 0;    /* Index of the current best match in result */
 426         size_t length = 0;  /* The length of the current candidate       */
 427         const struct ldb_val *target = NULL;    /* value we're looking for */
 428         const struct ldb_val *candidate = NULL; /* current candidate value */
 429         int x = 0;
 430
 431         target = ldb_dn_get_rdn_val(dn);
 432         for(x = 0; x < result->count; x++) {
 433                 candidate = ldb_dn_get_rdn_val(result->msgs[x]->dn);
 434                 if (strncasecmp((char *) target->data,
 435                                 (char *) candidate->data,
 436                                 target->length) == 0) {
 437                         /* Exact match stop searching and return */
 438                         return result->msgs[x];
 439                 }
 440                 if (candidate->length > length) {
 441                         matched = x;
 442                         length  = candidate->length;
 443                 }
 444         }
 445         return result->msgs[matched];
 446 }
 447
 448 /*
 449  * Look up a DNS entry, if an exact match does not exist, return the
 450  * closest matching DNS wildcard entry if available
 451  *
 452  * Returns: LDB_ERR_NO_SUCH_OBJECT     If no matching record exists
 453  *          LDB_ERR_OPERATIONS_ERROR   If the query fails
 454  *          LDB_SUCCESS                If a matching record was retrieved
 455  *
 456  */
 457 static int dns_wildcard_lookup(struct ldb_context *samdb,
 458                                TALLOC_CTX *mem_ctx,
 459                                struct ldb_dn *dn,
 460                                struct ldb_message **msg)
 461 {
 462         static const char * const attrs[] = {
 463                 "dnsRecord",
 464                 "dNSTombstoned",
 465                 NULL
 466         };
 467         struct ldb_dn *parent = NULL;     /* The parent dn                    */
 468         struct ldb_result *result = NULL; /* Results of the search            */
 469         int ret;                          /* Return code                      */
 470         struct ldb_parse_tree *query = NULL; /* The query to run              */
 471         struct ldb_request *request = NULL;  /* LDB request for the query op  */
 472         struct ldb_message *match = NULL;    /* the best matching DNS record  */
 473         TALLOC_CTX *frame = talloc_stackframe();
 474
 475         parent = ldb_dn_get_parent(frame, dn);
 476         if (parent == NULL) {
 477                 DBG_ERR("Unable to extract parent from dn\n");
 478                 TALLOC_FREE(frame);
 479                 return LDB_ERR_OPERATIONS_ERROR;
 480         }
 481
 482         query = build_wildcard_query(frame, dn);
 483         if (query == NULL) {
 484                 TALLOC_FREE(frame);
 485                 return LDB_ERR_OPERATIONS_ERROR;
 486         }
 487
 488         result = talloc_zero(mem_ctx, struct ldb_result);
 489         if (result == NULL) {
 490                 TALLOC_FREE(frame);
 491                 DBG_ERR("Unable to allocate ldb_result\n");
 492                 return LDB_ERR_OPERATIONS_ERROR;
 493         }
 494
 495         ret = ldb_build_search_req_ex(&request,
 496                                       samdb,
 497                                       frame,
 498                                       parent,
 499                                       LDB_SCOPE_SUBTREE,
 500                                       query,
 501                                       attrs,
 502                                       NULL,
 503                                       result,
 504                                       ldb_search_default_callback,
 505                                       NULL);
 506         if (ret != LDB_SUCCESS) {
 507                 TALLOC_FREE(frame);
 508                 DBG_ERR("ldb_build_search_req_ex returned %d\n", ret);
 509                 return ret;
 510         }
 511
 512         ret = ldb_request(samdb, request);
 513         if (ret != LDB_SUCCESS) {
 514                 TALLOC_FREE(frame);
 515                 return ret;
 516         }
 517
 518         ret = ldb_wait(request->handle, LDB_WAIT_ALL);
 519         if (ret != LDB_SUCCESS) {
 520                 TALLOC_FREE(frame);
 521                 return ret;
 522         }
 523
 524         if (result->count == 0) {
 525                 TALLOC_FREE(frame);
 526                 return LDB_ERR_NO_SUCH_OBJECT;
 527         }
 528
 529         match = get_best_match(dn, result);
 530         if (match == NULL) {
 531                 TALLOC_FREE(frame);
 532                 return LDB_ERR_OPERATIONS_ERROR;
 533         }
 534
 535         *msg = talloc_move(mem_ctx, &match);
 536         TALLOC_FREE(frame);
 537         return LDB_SUCCESS;
 538 }
 539
 540 /*
 541  * Lookup a DNS record, will match DNS wild card records if an exact match
 542  * is not found.
 543  */
 544 WERROR dns_common_wildcard_lookup(struct ldb_context *samdb,
 545                                   TALLOC_CTX *mem_ctx,
 546                                   struct ldb_dn *dn,
 547                                   struct dnsp_DnssrvRpcRecord **records,
 548                                   uint16_t *num_records)
 549 {
 550         const struct timeval start = timeval_current();
 551         int ret;
 552         WERROR werr = WERR_OK;
 553         struct ldb_message *msg = NULL;
 554         struct ldb_message_element *el = NULL;
 555         const struct ldb_val *name = NULL;
 556
 557         *records = NULL;
 558         *num_records = 0;
 559
 560         name = ldb_dn_get_rdn_val(dn);
 561         if (name == NULL) {
 562                 return DNS_ERR(NAME_ERROR);
 563                 goto exit;
 564         }
 565
 566         /* Don't look for a wildcard for @ */
 567         if (name->length == 1 && name->data[0] == '@') {
 568                 werr = dns_common_lookup(samdb,
 569                                          mem_ctx,
 570                                          dn,
 571                                          records,
 572                                          num_records,
 573                                          NULL);
 574                 goto exit;
 575         }
 576
 577         werr =  dns_name_check(
 578                         mem_ctx,
 579                         strlen((const char*)name->data),
 580                         (const char*) name->data);
 581         if (!W_ERROR_IS_OK(werr)) {
 582                 goto exit;
 583         }
 584
 585         /*
 586          * Do a point search first, then fall back to a wildcard
 587          * lookup if it does not exist
 588          */
 589         werr = dns_common_lookup(samdb,
 590                                  mem_ctx,
 591                                  dn,
 592                                  records,
 593                                  num_records,
 594                                  NULL);
 595         if (!W_ERROR_EQUAL(werr, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
 596                 goto exit;
 597         }
 598
 599         ret = dns_wildcard_lookup(samdb, mem_ctx, dn, &msg);
 600         if (ret == LDB_ERR_OPERATIONS_ERROR) {
 601                 werr = DNS_ERR(SERVER_FAILURE);
 602                 goto exit;
 603         }
 604         if (ret != LDB_SUCCESS) {
 605                 werr = DNS_ERR(NAME_ERROR);
 606                 goto exit;
 607         }
 608
 609         el = ldb_msg_find_element(msg, "dnsRecord");
 610         if (el == NULL) {
 611                 werr = WERR_DNS_ERROR_NAME_DOES_NOT_EXIST;
 612                 goto exit;
 613         }
 614
 615         werr = dns_common_extract(samdb, el, mem_ctx, records, num_records);
 616         TALLOC_FREE(msg);
 617         if (!W_ERROR_IS_OK(werr)) {
 618                 return werr;
 619                 goto exit;
 620         }
 621
 622         werr = WERR_OK;
 623 exit:
 624         DNS_COMMON_LOG_OPERATION(
 625                 win_errstr(werr),
 626                 &start,
 627                 NULL,
 628                 dn == NULL ? NULL : ldb_dn_get_linearized(dn),
 629                 NULL);
 630         return werr;
 631 }
 632
 633 static int rec_cmp(const struct dnsp_DnssrvRpcRecord *r1,
 634                    const struct dnsp_DnssrvRpcRecord *r2)
 635 {
 636         if (r1->wType != r2->wType) {
 637                 /*
 638                  * The records are sorted with higher types first
 639                  */
 640                 return r2->wType - r1->wType;
 641         }
 642
 643         /*
 644          * Then we need to sort from the oldest to newest timestamp
 645          */
 646         return r1->dwTimeStamp - r2->dwTimeStamp;
 647 }
 648
 649 /*
 650  * Check for valid DNS names. These are names which:
 651  *   - are non-empty
 652  *   - do not start with a dot
 653  *   - do not have any empty labels
 654  *   - have no more than 127 labels
 655  *   - are no longer than 253 characters
 656  *   - none of the labels exceed 63 characters
 657  */
 658 WERROR dns_name_check(TALLOC_CTX *mem_ctx, size_t len, const char *name)
 659 {
 660         size_t i;
 661         unsigned int labels    = 0;
 662         unsigned int label_len = 0;
 663
 664         if (len == 0) {
 665                 return WERR_DS_INVALID_DN_SYNTAX;
 666         }
 667
 668         if (len > 1 && name[0] == '.') {
 669                 return WERR_DS_INVALID_DN_SYNTAX;
 670         }
 671
 672         if ((len - 1) > DNS_MAX_DOMAIN_LENGTH) {
 673                 return WERR_DS_INVALID_DN_SYNTAX;
 674         }
 675
 676         for (i = 0; i < len - 1; i++) {
 677                 if (name[i] == '.' && name[i+1] == '.') {
 678                         return WERR_DS_INVALID_DN_SYNTAX;
 679                 }
 680                 if (name[i] == '.') {
 681                         labels++;
 682                         if (labels > DNS_MAX_LABELS) {
 683                                 return WERR_DS_INVALID_DN_SYNTAX;
 684                         }
 685                         label_len = 0;
 686                 } else {
 687                         label_len++;
 688                         if (label_len > DNS_MAX_LABEL_LENGTH) {
 689                                 return WERR_DS_INVALID_DN_SYNTAX;
 690                         }
 691                 }
 692         }
 693
 694         return WERR_OK;
 695 }
 696
 697 static WERROR check_name_list(TALLOC_CTX *mem_ctx, uint16_t rec_count,
 698                               struct dnsp_DnssrvRpcRecord *records)
 699 {
 700         WERROR werr;
 701         uint16_t i;
 702         size_t len;
 703         struct dnsp_DnssrvRpcRecord record;
 704
 705         werr = WERR_OK;
 706         for (i = 0; i < rec_count; i++) {
 707                 record = records[i];
 708
 709                 switch (record.wType) {
 710
 711                 case DNS_TYPE_NS:
 712                         len = strlen(record.data.ns);
 713                         werr = dns_name_check(mem_ctx, len, record.data.ns);
 714                         break;
 715                 case DNS_TYPE_CNAME:
 716                         len = strlen(record.data.cname);
 717                         werr = dns_name_check(mem_ctx, len, record.data.cname);
 718                         break;
 719                 case DNS_TYPE_SOA:
 720                         len = strlen(record.data.soa.mname);
 721                         werr = dns_name_check(mem_ctx, len, record.data.soa.mname);
 722                         if (!W_ERROR_IS_OK(werr)) {
 723                                 break;
 724                         }
 725                         len = strlen(record.data.soa.rname);
 726                         werr = dns_name_check(mem_ctx, len, record.data.soa.rname);
 727                         break;
 728                 case DNS_TYPE_PTR:
 729                         len = strlen(record.data.ptr);
 730                         werr = dns_name_check(mem_ctx, len, record.data.ptr);
 731                         break;
 732                 case DNS_TYPE_MX:
 733                         len = strlen(record.data.mx.nameTarget);
 734                         werr = dns_name_check(mem_ctx, len, record.data.mx.nameTarget);
 735                         break;
 736                 case DNS_TYPE_SRV:
 737                         len = strlen(record.data.srv.nameTarget);
 738                         werr = dns_name_check(mem_ctx, len,
 739                                               record.data.srv.nameTarget);
 740                         break;
 741                 /*
 742                  * In the default case, the record doesn't have a DN, so it
 743                  * must be ok.
 744                  */
 745                 default:
 746                         break;
 747                 }
 748
 749                 if (!W_ERROR_IS_OK(werr)) {
 750                         return werr;
 751                 }
 752         }
 753
 754         return WERR_OK;
 755 }
 756
 757 bool dns_name_is_static(struct dnsp_DnssrvRpcRecord *records,
 758                         uint16_t rec_count)
 759 {
 760         int i = 0;
 761         for (i = 0; i < rec_count; i++) {
 762                 if (records[i].wType == DNS_TYPE_TOMBSTONE) {
 763                         continue;
 764                 }
 765
 766                 if (records[i].wType == DNS_TYPE_SOA ||
 767                     records[i].dwTimeStamp == 0) {
 768                         return true;
 769                 }
 770         }
 771         return false;
 772 }
 773
 774 /*
 775  * Helper function to copy a dnsp_ip4_array struct to an IP4_ARRAY struct.
 776  * The new structure and it's data are allocated on the supplied talloc context
 777  */
 778 static struct IP4_ARRAY *copy_ip4_array(TALLOC_CTX *ctx,
 779                                         const char *name,
 780                                         struct dnsp_ip4_array array)
 781 {
 782
 783         struct IP4_ARRAY *ip4_array = NULL;
 784         unsigned int i;
 785
 786         ip4_array = talloc_zero(ctx, struct IP4_ARRAY);
 787         if (ip4_array == NULL) {
 788                 DBG_ERR("Out of memory copying property [%s]\n", name);
 789                 return NULL;
 790         }
 791
 792         ip4_array->AddrCount = array.addrCount;
 793         if (ip4_array->AddrCount == 0) {
 794                 return ip4_array;
 795         }
 796
 797         ip4_array->AddrArray =
 798             talloc_array(ip4_array, uint32_t, ip4_array->AddrCount);
 799         if (ip4_array->AddrArray == NULL) {
 800                 TALLOC_FREE(ip4_array);
 801                 DBG_ERR("Out of memory copying property [%s] values\n", name);
 802                 return NULL;
 803         }
 804
 805         for (i = 0; i < ip4_array->AddrCount; i++) {
 806                 ip4_array->AddrArray[i] = array.addr[i];
 807         }
 808
 809         return ip4_array;
 810 }
 811
 812 bool dns_zoneinfo_load_zone_property(struct dnsserver_zoneinfo *zoneinfo,
 813                                      struct dnsp_DnsProperty *prop)
 814 {
 815         switch (prop->id) {
 816         case DSPROPERTY_ZONE_TYPE:
 817                 zoneinfo->dwZoneType = prop->data.zone_type;
 818                 break;
 819         case DSPROPERTY_ZONE_ALLOW_UPDATE:
 820                 zoneinfo->fAllowUpdate = prop->data.allow_update_flag;
 821                 break;
 822         case DSPROPERTY_ZONE_NOREFRESH_INTERVAL:
 823                 zoneinfo->dwNoRefreshInterval = prop->data.norefresh_hours;
 824                 break;
 825         case DSPROPERTY_ZONE_REFRESH_INTERVAL:
 826                 zoneinfo->dwRefreshInterval = prop->data.refresh_hours;
 827                 break;
 828         case DSPROPERTY_ZONE_AGING_STATE:
 829                 zoneinfo->fAging = prop->data.aging_enabled;
 830                 break;
 831         case DSPROPERTY_ZONE_SCAVENGING_SERVERS:
 832                 zoneinfo->aipScavengeServers = copy_ip4_array(
 833                     zoneinfo, "ZONE_SCAVENGING_SERVERS", prop->data.servers);
 834                 if (zoneinfo->aipScavengeServers == NULL) {
 835                         return false;
 836                 }
 837                 break;
 838         case DSPROPERTY_ZONE_AGING_ENABLED_TIME:
 839                 zoneinfo->dwAvailForScavengeTime =
 840                     prop->data.next_scavenging_cycle_hours;
 841                 break;
 842         case DSPROPERTY_ZONE_MASTER_SERVERS:
 843                 zoneinfo->aipLocalMasters = copy_ip4_array(
 844                     zoneinfo, "ZONE_MASTER_SERVERS", prop->data.master_servers);
 845                 if (zoneinfo->aipLocalMasters == NULL) {
 846                         return false;
 847                 }
 848                 break;
 849         case DSPROPERTY_ZONE_EMPTY:
 850         case DSPROPERTY_ZONE_SECURE_TIME:
 851         case DSPROPERTY_ZONE_DELETED_FROM_HOSTNAME:
 852         case DSPROPERTY_ZONE_AUTO_NS_SERVERS:
 853         case DSPROPERTY_ZONE_DCPROMO_CONVERT:
 854         case DSPROPERTY_ZONE_SCAVENGING_SERVERS_DA:
 855         case DSPROPERTY_ZONE_MASTER_SERVERS_DA:
 856         case DSPROPERTY_ZONE_NS_SERVERS_DA:
 857         case DSPROPERTY_ZONE_NODE_DBFLAGS:
 858                 break;
 859         }
 860         return true;
 861 }
 862 WERROR dns_get_zone_properties(struct ldb_context *samdb,
 863                                TALLOC_CTX *mem_ctx,
 864                                struct ldb_dn *zone_dn,
 865                                struct dnsserver_zoneinfo *zoneinfo)
 866 {
 867
 868         int ret, i;
 869         struct dnsp_DnsProperty *prop = NULL;
 870         struct ldb_message_element *element = NULL;
 871         const char *const attrs[] = {"dNSProperty", NULL};
 872         struct ldb_result *res = NULL;
 873         enum ndr_err_code err;
 874
 875         ret = ldb_search(samdb,
 876                          mem_ctx,
 877                          &res,
 878                          zone_dn,
 879                          LDB_SCOPE_BASE,
 880                          attrs,
 881                          "(objectClass=dnsZone)");
 882         if (ret != LDB_SUCCESS) {
 883                 DBG_ERR("dnsserver: Failed to find DNS zone: %s\n",
 884                         ldb_dn_get_linearized(zone_dn));
 885                 return DNS_ERR(SERVER_FAILURE);
 886         }
 887
 888         element = ldb_msg_find_element(res->msgs[0], "dNSProperty");
 889         if (element == NULL) {
 890                 return DNS_ERR(NOTZONE);
 891         }
 892
 893         for (i = 0; i < element->num_values; i++) {
 894                 bool valid_property;
 895                 prop = talloc_zero(mem_ctx, struct dnsp_DnsProperty);
 896                 if (prop == NULL) {
 897                         return WERR_NOT_ENOUGH_MEMORY;
 898                 }
 899                 err = ndr_pull_struct_blob(
 900                     &(element->values[i]),
 901                     mem_ctx,
 902                     prop,
 903                     (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnsProperty);
 904                 if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
 905                         return DNS_ERR(SERVER_FAILURE);
 906                 }
 907
 908                 valid_property =
 909                     dns_zoneinfo_load_zone_property(zoneinfo, prop);
 910                 if (!valid_property) {
 911                         return DNS_ERR(SERVER_FAILURE);
 912                 }
 913         }
 914
 915         return WERR_OK;
 916 }
 917
 918 WERROR dns_common_replace(struct ldb_context *samdb,
 919                           TALLOC_CTX *mem_ctx,
 920                           struct ldb_dn *dn,
 921                           bool needs_add,
 922                           uint32_t serial,
 923                           struct dnsp_DnssrvRpcRecord *records,
 924                           uint16_t rec_count)
 925 {
 926         const struct timeval start = timeval_current();
 927         struct ldb_message_element *el;
 928         uint16_t i;
 929         int ret;
 930         WERROR werr;
 931         struct ldb_message *msg = NULL;
 932         bool was_tombstoned = false;
 933         bool become_tombstoned = false;
 934         struct ldb_dn *zone_dn = NULL;
 935         struct dnsserver_zoneinfo *zoneinfo = NULL;
 936         NTTIME t;
 937
 938         msg = ldb_msg_new(mem_ctx);
 939         W_ERROR_HAVE_NO_MEMORY(msg);
 940
 941         msg->dn = dn;
 942
 943         zone_dn = ldb_dn_copy(mem_ctx, dn);
 944         if (zone_dn == NULL) {
 945                 werr = WERR_NOT_ENOUGH_MEMORY;
 946                 goto exit;
 947         }
 948         if (!ldb_dn_remove_child_components(zone_dn, 1)) {
 949                 werr = DNS_ERR(SERVER_FAILURE);
 950                 goto exit;
 951         }
 952         zoneinfo = talloc(mem_ctx, struct dnsserver_zoneinfo);
 953         if (zoneinfo == NULL) {
 954                 werr = WERR_NOT_ENOUGH_MEMORY;
 955                 goto exit;
 956         }
 957         werr = dns_get_zone_properties(samdb, mem_ctx, zone_dn, zoneinfo);
 958         if (W_ERROR_EQUAL(DNS_ERR(NOTZONE), werr)) {
 959                 /*
 960                  * We only got zoneinfo for aging so if we didn't find any
 961                  * properties then just disable aging and keep going.
 962                  */
 963                 zoneinfo->fAging = 0;
 964         } else if (!W_ERROR_IS_OK(werr)) {
 965                 goto exit;
 966         }
 967
 968         werr = check_name_list(mem_ctx, rec_count, records);
 969         if (!W_ERROR_IS_OK(werr)) {
 970                 goto exit;
 971         }
 972
 973         ret = ldb_msg_add_empty(msg, "dnsRecord", LDB_FLAG_MOD_REPLACE, &el);
 974         if (ret != LDB_SUCCESS) {
 975                 werr = DNS_ERR(SERVER_FAILURE);
 976                 goto exit;
 977         }
 978
 979         /*
 980          * we have at least one value,
 981          * which might be used for the tombstone marker
 982          */
 983         el->values = talloc_zero_array(el, struct ldb_val, MAX(1, rec_count));
 984         if (rec_count > 0) {
 985                 if (el->values == NULL) {
 986                         werr = WERR_NOT_ENOUGH_MEMORY;
 987                         goto exit;
 988                 }
 989
 990                 /*
 991                  * We store a sorted list with the high wType values first
 992                  * that's what windows does. It also simplifies the
 993                  * filtering of DNS_TYPE_TOMBSTONE records
 994                  */
 995                 TYPESAFE_QSORT(records, rec_count, rec_cmp);
 996         }
 997
 998         for (i = 0; i < rec_count; i++) {
 999                 struct ldb_val *v = &el->values[el->num_values];
1000                 enum ndr_err_code ndr_err;
1001
1002                 if (records[i].wType == DNS_TYPE_TOMBSTONE) {
1003                         if (records[i].data.timestamp != 0) {
1004                                 was_tombstoned = true;
1005                         }
1006                         continue;
1007                 }
1008
1009                 if (zoneinfo->fAging == 1 && records[i].dwTimeStamp != 0) {
1010                         unix_to_nt_time(&t, time(NULL));
1011                         t /= 10 * 1000 * 1000;
1012                         t /= 3600;
1013                         if (t - records[i].dwTimeStamp >
1014                             zoneinfo->dwNoRefreshInterval) {
1015                                 records[i].dwTimeStamp = t;
1016                         }
1017                 }
1018
1019                 records[i].dwSerial = serial;
1020                 ndr_err = ndr_push_struct_blob(v, el->values, &records[i],
1021                                 (ndr_push_flags_fn_t)ndr_push_dnsp_DnssrvRpcRecord);
1022                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1023                         DEBUG(0, ("Failed to push dnsp_DnssrvRpcRecord\n"));
1024                         werr = DNS_ERR(SERVER_FAILURE);
1025                         goto exit;
1026                 }
1027                 el->num_values++;
1028         }
1029
1030         if (needs_add) {
1031                 if (el->num_values == 0) {
1032                         werr = WERR_OK;
1033                         goto exit;
1034                 }
1035
1036                 ret = ldb_msg_add_string(msg, "objectClass", "dnsNode");
1037                 if (ret != LDB_SUCCESS) {
1038                         werr = DNS_ERR(SERVER_FAILURE);
1039                         goto exit;
1040                 }
1041
1042                 ret = ldb_add(samdb, msg);
1043                 if (ret != LDB_SUCCESS) {
1044                         werr = DNS_ERR(SERVER_FAILURE);
1045                         goto exit;
1046                 }
1047
1048                 return WERR_OK;
1049                 goto exit;
1050         }
1051
1052         if (el->num_values == 0) {
1053                 struct dnsp_DnssrvRpcRecord tbs;
1054                 struct ldb_val *v = &el->values[el->num_values];
1055                 enum ndr_err_code ndr_err;
1056                 struct timeval tv;
1057
1058                 if (was_tombstoned) {
1059                         /*
1060                          * This is already a tombstoned object.
1061                          * Just leave it instead of updating the time stamp.
1062                          */
1063                         werr = WERR_OK;
1064                         goto exit;
1065                 }
1066
1067                 tv = timeval_current();
1068                 tbs = (struct dnsp_DnssrvRpcRecord) {
1069                         .wType = DNS_TYPE_TOMBSTONE,
1070                         .dwSerial = serial,
1071                         .data.timestamp = timeval_to_nttime(&tv),
1072                 };
1073
1074                 ndr_err = ndr_push_struct_blob(v, el->values, &tbs,
1075                                 (ndr_push_flags_fn_t)ndr_push_dnsp_DnssrvRpcRecord);
1076                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1077                         DEBUG(0, ("Failed to push dnsp_DnssrvRpcRecord\n"));
1078                         werr = DNS_ERR(SERVER_FAILURE);
1079                         goto exit;
1080                 }
1081                 el->num_values++;
1082
1083                 become_tombstoned = true;
1084         }
1085
1086         if (was_tombstoned || become_tombstoned) {
1087                 ret = ldb_msg_add_empty(msg, "dNSTombstoned",
1088                                         LDB_FLAG_MOD_REPLACE, NULL);
1089                 if (ret != LDB_SUCCESS) {
1090                         werr = DNS_ERR(SERVER_FAILURE);
1091                         goto exit;
1092                 }
1093
1094                 ret = ldb_msg_add_fmt(msg, "dNSTombstoned", "%s",
1095                                       become_tombstoned ? "TRUE" : "FALSE");
1096                 if (ret != LDB_SUCCESS) {
1097                         werr = DNS_ERR(SERVER_FAILURE);
1098                         goto exit;
1099                 }
1100         }
1101
1102         ret = ldb_modify(samdb, msg);
1103         if (ret != LDB_SUCCESS) {
1104                 NTSTATUS nt = dsdb_ldb_err_to_ntstatus(ret);
1105                 werr = ntstatus_to_werror(nt);
1106                 goto exit;
1107         }
1108
1109         werr = WERR_OK;
1110 exit:
1111         DNS_COMMON_LOG_OPERATION(
1112                 win_errstr(werr),
1113                 &start,
1114                 NULL,
1115                 dn == NULL ? NULL : ldb_dn_get_linearized(dn),
1116                 NULL);
1117         return werr;
1118 }
1119
1120 bool dns_name_match(const char *zone, const char *name, size_t *host_part_len)
1121 {
1122         size_t zl = strlen(zone);
1123         size_t nl = strlen(name);
1124         ssize_t zi, ni;
1125         static const size_t fixup = 'a' - 'A';
1126
1127         if (zl > nl) {
1128                 return false;
1129         }
1130
1131         for (zi = zl, ni = nl; zi >= 0; zi--, ni--) {
1132                 char zc = zone[zi];
1133                 char nc = name[ni];
1134
1135                 /* convert to lower case */
1136                 if (zc >= 'A' && zc <= 'Z') {
1137                         zc += fixup;
1138                 }
1139                 if (nc >= 'A' && nc <= 'Z') {
1140                         nc += fixup;
1141                 }
1142
1143                 if (zc != nc) {
1144                         return false;
1145                 }
1146         }
1147
1148         if (ni >= 0) {
1149                 if (name[ni] != '.') {
1150                         return false;
1151                 }
1152
1153                 ni--;
1154         }
1155
1156         *host_part_len = ni+1;
1157
1158         return true;
1159 }
1160
1161 WERROR dns_common_name2dn(struct ldb_context *samdb,
1162                           struct dns_server_zone *zones,
1163                           TALLOC_CTX *mem_ctx,
1164                           const char *name,
1165                           struct ldb_dn **_dn)
1166 {
1167         struct ldb_dn *base;
1168         struct ldb_dn *dn;
1169         const struct dns_server_zone *z;
1170         size_t host_part_len = 0;
1171         struct ldb_val host_part;
1172         WERROR werr;
1173         bool ok;
1174         const char *casefold = NULL;
1175
1176         if (name == NULL) {
1177                 return DNS_ERR(FORMAT_ERROR);
1178         }
1179
1180         if (strcmp(name, "") == 0) {
1181                 base = ldb_get_default_basedn(samdb);
1182                 dn = ldb_dn_copy(mem_ctx, base);
1183                 ok = ldb_dn_add_child_fmt(dn,
1184                                           "DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=System");
1185                 if (ok == false) {
1186                         TALLOC_FREE(dn);
1187                         return WERR_NOT_ENOUGH_MEMORY;
1188                 }
1189
1190                 *_dn = dn;
1191                 return WERR_OK;
1192         }
1193
1194         /* Check non-empty names */
1195         werr = dns_name_check(mem_ctx, strlen(name), name);
1196         if (!W_ERROR_IS_OK(werr)) {
1197                 return werr;
1198         }
1199
1200         for (z = zones; z != NULL; z = z->next) {
1201                 bool match;
1202
1203                 match = dns_name_match(z->name, name, &host_part_len);
1204                 if (match) {
1205                         break;
1206                 }
1207         }
1208
1209         if (z == NULL) {
1210                 return DNS_ERR(NAME_ERROR);
1211         }
1212
1213         if (host_part_len == 0) {
1214                 dn = ldb_dn_copy(mem_ctx, z->dn);
1215                 ok = ldb_dn_add_child_fmt(dn, "DC=@");
1216                 if (! ok) {
1217                         TALLOC_FREE(dn);
1218                         return WERR_NOT_ENOUGH_MEMORY;
1219                 }
1220                 *_dn = dn;
1221                 return WERR_OK;
1222         }
1223
1224         dn = ldb_dn_copy(mem_ctx, z->dn);
1225         if (dn == NULL) {
1226                 TALLOC_FREE(dn);
1227                 return WERR_NOT_ENOUGH_MEMORY;
1228         }
1229
1230         host_part = data_blob_const(name, host_part_len);
1231
1232         ok = ldb_dn_add_child_val(dn, "DC", host_part);
1233
1234         if (ok == false) {
1235                 TALLOC_FREE(dn);
1236                 return WERR_NOT_ENOUGH_MEMORY;
1237         }
1238
1239         /*
1240          * Check the new DN here for validity, so as to catch errors
1241          * early
1242          */
1243         ok = ldb_dn_validate(dn);
1244         if (ok == false) {
1245                 TALLOC_FREE(dn);
1246                 return DNS_ERR(NAME_ERROR);
1247         }
1248
1249         /*
1250          * The value from this check is saved in the DN, and doing
1251          * this here allows an easy return here.
1252          */
1253         casefold = ldb_dn_get_casefold(dn);
1254         if (casefold == NULL) {
1255                 TALLOC_FREE(dn);
1256                 return DNS_ERR(NAME_ERROR);
1257         }
1258
1259         *_dn = dn;
1260         return WERR_OK;
1261 }
1262
1263 static int dns_common_sort_zones(struct ldb_message **m1, struct ldb_message **m2)
1264 {
1265         const char *n1, *n2;
1266         size_t l1, l2;
1267
1268         n1 = ldb_msg_find_attr_as_string(*m1, "name", NULL);
1269         n2 = ldb_msg_find_attr_as_string(*m2, "name", NULL);
1270
1271         l1 = strlen(n1);
1272         l2 = strlen(n2);
1273
1274         /* If the string lengths are not equal just sort by length */
1275         if (l1 != l2) {
1276                 /* If m1 is the larger zone name, return it first */
1277                 return l2 - l1;
1278         }
1279
1280         /*TODO: We need to compare DNs here, we want the DomainDNSZones first */
1281         return 0;
1282 }
1283
1284 NTSTATUS dns_common_zones(struct ldb_context *samdb,
1285                           TALLOC_CTX *mem_ctx,
1286                           struct ldb_dn *base_dn,
1287                           struct dns_server_zone **zones_ret)
1288 {
1289         const struct timeval start = timeval_current();
1290         int ret;
1291         static const char * const attrs[] = { "name", NULL};
1292         struct ldb_result *res;
1293         int i;
1294         struct dns_server_zone *new_list = NULL;
1295         TALLOC_CTX *frame = talloc_stackframe();
1296         NTSTATUS result = NT_STATUS_OK;
1297
1298         if (base_dn) {
1299                 /* This search will work against windows */
1300                 ret = dsdb_search(samdb, frame, &res,
1301                                   base_dn, LDB_SCOPE_SUBTREE,
1302                                   attrs, 0, "(objectClass=dnsZone)");
1303         } else {
1304                 /* TODO: this search does not work against windows */
1305                 ret = dsdb_search(samdb, frame, &res, NULL,
1306                                   LDB_SCOPE_SUBTREE,
1307                                   attrs,
1308                                   DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
1309                                   "(objectClass=dnsZone)");
1310         }
1311         if (ret != LDB_SUCCESS) {
1312                 TALLOC_FREE(frame);
1313                 result = NT_STATUS_INTERNAL_DB_CORRUPTION;
1314                 goto exit;
1315         }
1316
1317         TYPESAFE_QSORT(res->msgs, res->count, dns_common_sort_zones);
1318
1319         for (i=0; i < res->count; i++) {
1320                 struct dns_server_zone *z;
1321
1322                 z = talloc_zero(mem_ctx, struct dns_server_zone);
1323                 if (z == NULL) {
1324                         TALLOC_FREE(frame);
1325                         result = NT_STATUS_NO_MEMORY;
1326                         goto exit;
1327                 }
1328
1329                 z->name = ldb_msg_find_attr_as_string(res->msgs[i], "name", NULL);
1330                 talloc_steal(z, z->name);
1331                 z->dn = talloc_move(z, &res->msgs[i]->dn);
1332                 /*
1333                  * Ignore the RootDNSServers zone and zones that we don't support yet
1334                  * RootDNSServers should never be returned (Windows DNS server don't)
1335                  * ..TrustAnchors should never be returned as is, (Windows returns
1336                  * TrustAnchors) and for the moment we don't support DNSSEC so we'd better
1337                  * not return this zone.
1338                  */
1339                 if ((strcmp(z->name, "RootDNSServers") == 0) ||
1340                     (strcmp(z->name, "..TrustAnchors") == 0))
1341                 {
1342                         DEBUG(10, ("Ignoring zone %s\n", z->name));
1343                         talloc_free(z);
1344                         continue;
1345                 }
1346                 DLIST_ADD_END(new_list, z);
1347         }
1348
1349         *zones_ret = new_list;
1350         TALLOC_FREE(frame);
1351         result = NT_STATUS_OK;
1352 exit:
1353         DNS_COMMON_LOG_OPERATION(
1354                 nt_errstr(result),
1355                 &start,
1356                 NULL,
1357                 base_dn == NULL ? NULL : ldb_dn_get_linearized(base_dn),
1358                 NULL);
1359         return result;
1360 }
1361
1362 /*
1363   see if two DNS names are the same
1364  */
1365 bool dns_name_equal(const char *name1, const char *name2)
1366 {
1367         size_t len1 = strlen(name1);
1368         size_t len2 = strlen(name2);
1369
1370         if (len1 > 0 && name1[len1 - 1] == '.') {
1371                 len1--;
1372         }
1373         if (len2 > 0 && name2[len2 - 1] == '.') {
1374                 len2--;
1375         }
1376         if (len1 != len2) {
1377                 return false;
1378         }
1379         return strncasecmp(name1, name2, len1) == 0;
1380 }