source4/dns_server/dns_update.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DNS server handler for update requests
   5
   6    Copyright (C) 2010 Kai Blin  <kai@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/util/ntstatus.h"
  24 #include "librpc/ndr/libndr.h"
  25 #include "librpc/gen_ndr/ndr_dns.h"
  26 #include "librpc/gen_ndr/ndr_dnsp.h"
  27 #include <ldb.h>
  28 #include "param/param.h"
  29 #include "param/loadparm.h"
  30 #include "dsdb/samdb/samdb.h"
  31 #include "dsdb/common/util.h"
  32 #include "smbd/service_task.h"
  33 #include "dns_server/dns_server.h"
  34 #include "auth/auth.h"
  35
  36 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
  37                              const struct dns_res_rec *rrec,
  38                              struct dnsp_DnssrvRpcRecord *r);
  39
  40 static WERROR check_one_prerequisite(struct dns_server *dns,
  41                                      TALLOC_CTX *mem_ctx,
  42                                      const struct dns_name_question *zone,
  43                                      const struct dns_res_rec *pr,
  44                                      bool *final_result)
  45 {
  46         bool match;
  47         WERROR werror;
  48         struct ldb_dn *dn;
  49         uint16_t i;
  50         bool found = false;
  51         struct dnsp_DnssrvRpcRecord *rec = NULL;
  52         struct dnsp_DnssrvRpcRecord *ans;
  53         uint16_t acount;
  54
  55         size_t host_part_len = 0;
  56
  57         *final_result = true;
  58
  59         if (pr->ttl != 0) {
  60                 return DNS_ERR(FORMAT_ERROR);
  61         }
  62
  63         match = dns_name_match(zone->name, pr->name, &host_part_len);
  64         if (!match) {
  65                 return DNS_ERR(NOTZONE);
  66         }
  67
  68         werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
  69         W_ERROR_NOT_OK_RETURN(werror);
  70
  71         if (pr->rr_class == DNS_QCLASS_ANY) {
  72
  73                 if (pr->length != 0) {
  74                         return DNS_ERR(FORMAT_ERROR);
  75                 }
  76
  77
  78                 if (pr->rr_type == DNS_QTYPE_ALL) {
  79                         /*
  80                          */
  81                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
  82                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
  83                                 return DNS_ERR(NAME_ERROR);
  84                         }
  85                         W_ERROR_NOT_OK_RETURN(werror);
  86
  87                         if (acount == 0) {
  88                                 return DNS_ERR(NAME_ERROR);
  89                         }
  90                 } else {
  91                         /*
  92                          */
  93                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
  94                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
  95                                 return DNS_ERR(NXRRSET);
  96                         }
  97                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
  98                                 return DNS_ERR(NXRRSET);
  99                         }
 100                         W_ERROR_NOT_OK_RETURN(werror);
 101
 102                         for (i = 0; i < acount; i++) {
 103                                 if (ans[i].wType == pr->rr_type) {
 104                                         found = true;
 105                                         break;
 106                                 }
 107                         }
 108                         if (!found) {
 109                                 return DNS_ERR(NXRRSET);
 110                         }
 111                 }
 112
 113                 /*
 114                  * RFC2136 3.2.5 doesn't actually mention the need to return
 115                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 116                  * later on. This also matches Microsoft DNS behavior.
 117                  */
 118                 return WERR_OK;
 119         }
 120
 121         if (pr->rr_class == DNS_QCLASS_NONE) {
 122                 if (pr->length != 0) {
 123                         return DNS_ERR(FORMAT_ERROR);
 124                 }
 125
 126                 if (pr->rr_type == DNS_QTYPE_ALL) {
 127                         /*
 128                          */
 129                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 130                         if (W_ERROR_EQUAL(werror, WERR_OK)) {
 131                                 return DNS_ERR(YXDOMAIN);
 132                         }
 133                 } else {
 134                         /*
 135                          */
 136                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 137                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
 138                                 werror = WERR_OK;
 139                         }
 140                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 141                                 werror = WERR_OK;
 142                         }
 143
 144                         for (i = 0; i < acount; i++) {
 145                                 if (ans[i].wType == pr->rr_type) {
 146                                         found = true;
 147                                         break;
 148                                 }
 149                         }
 150                         if (found) {
 151                                 return DNS_ERR(YXRRSET);
 152                         }
 153                 }
 154
 155                 /*
 156                  * RFC2136 3.2.5 doesn't actually mention the need to return
 157                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 158                  * later on. This also matches Microsoft DNS behavior.
 159                  */
 160                 return WERR_OK;
 161         }
 162
 163         if (pr->rr_class != zone->question_class) {
 164                 return DNS_ERR(FORMAT_ERROR);
 165         }
 166
 167         *final_result = false;
 168
 169         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 170         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
 171                 return DNS_ERR(NXRRSET);
 172         }
 173         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 174                 return DNS_ERR(NXRRSET);
 175         }
 176         W_ERROR_NOT_OK_RETURN(werror);
 177
 178         rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
 179         W_ERROR_HAVE_NO_MEMORY(rec);
 180
 181         werror = dns_rr_to_dnsp(rec, pr, rec);
 182         W_ERROR_NOT_OK_RETURN(werror);
 183
 184         for (i = 0; i < acount; i++) {
 185                 if (dns_records_match(rec, &ans[i])) {
 186                         found = true;
 187                         break;
 188                 }
 189         }
 190
 191         if (!found) {
 192                 return DNS_ERR(NXRRSET);
 193         }
 194
 195         return WERR_OK;
 196 }
 197
 198 static WERROR check_prerequisites(struct dns_server *dns,
 199                                   TALLOC_CTX *mem_ctx,
 200                                   const struct dns_name_question *zone,
 201                                   const struct dns_res_rec *prereqs, uint16_t count)
 202 {
 203         uint16_t i;
 204         WERROR final_error = WERR_OK;
 205
 206         for (i = 0; i < count; i++) {
 207                 bool final;
 208                 WERROR werror;
 209
 210                 werror = check_one_prerequisite(dns, mem_ctx, zone,
 211                                                 &prereqs[i], &final);
 212                 if (!W_ERROR_IS_OK(werror)) {
 213                         if (final) {
 214                                 return werror;
 215                         }
 216                         if (W_ERROR_IS_OK(final_error)) {
 217                                 final_error = werror;
 218                         }
 219                 }
 220         }
 221
 222         if (!W_ERROR_IS_OK(final_error)) {
 223                 return final_error;
 224         }
 225
 226         return WERR_OK;
 227 }
 228
 229 static WERROR update_prescan(const struct dns_name_question *zone,
 230                              const struct dns_res_rec *updates, uint16_t count)
 231 {
 232         const struct dns_res_rec *r;
 233         uint16_t i;
 234         size_t host_part_len;
 235         bool match;
 236
 237         for (i = 0; i < count; i++) {
 238                 r = &updates[i];
 239                 match = dns_name_match(zone->name, r->name, &host_part_len);
 240                 if (!match) {
 241                         return DNS_ERR(NOTZONE);
 242                 }
 243                 if (zone->question_class == r->rr_class) {
 244                         if (r->rr_type == DNS_QTYPE_ALL) {
 245                                 return DNS_ERR(FORMAT_ERROR);
 246                         }
 247                         if (r->rr_type == DNS_QTYPE_AXFR) {
 248                                 return DNS_ERR(FORMAT_ERROR);
 249                         }
 250                         if (r->rr_type == DNS_QTYPE_MAILB) {
 251                                 return DNS_ERR(FORMAT_ERROR);
 252                         }
 253                         if (r->rr_type == DNS_QTYPE_MAILA) {
 254                                 return DNS_ERR(FORMAT_ERROR);
 255                         }
 256                 } else if (r->rr_class == DNS_QCLASS_ANY) {
 257                         if (r->ttl != 0) {
 258                                 return DNS_ERR(FORMAT_ERROR);
 259                         }
 260                         if (r->length != 0) {
 261                                 return DNS_ERR(FORMAT_ERROR);
 262                         }
 263                         if (r->rr_type == DNS_QTYPE_AXFR) {
 264                                 return DNS_ERR(FORMAT_ERROR);
 265                         }
 266                         if (r->rr_type == DNS_QTYPE_MAILB) {
 267                                 return DNS_ERR(FORMAT_ERROR);
 268                         }
 269                         if (r->rr_type == DNS_QTYPE_MAILA) {
 270                                 return DNS_ERR(FORMAT_ERROR);
 271                         }
 272                 } else if (r->rr_class == DNS_QCLASS_NONE) {
 273                         if (r->ttl != 0) {
 274                                 return DNS_ERR(FORMAT_ERROR);
 275                         }
 276                         if (r->rr_type == DNS_QTYPE_ALL) {
 277                                 return DNS_ERR(FORMAT_ERROR);
 278                         }
 279                         if (r->rr_type == DNS_QTYPE_AXFR) {
 280                                 return DNS_ERR(FORMAT_ERROR);
 281                         }
 282                         if (r->rr_type == DNS_QTYPE_MAILB) {
 283                                 return DNS_ERR(FORMAT_ERROR);
 284                         }
 285                         if (r->rr_type == DNS_QTYPE_MAILA) {
 286                                 return DNS_ERR(FORMAT_ERROR);
 287                         }
 288                 } else {
 289                         return DNS_ERR(FORMAT_ERROR);
 290                 }
 291         }
 292         return WERR_OK;
 293 }
 294
 295 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
 296                              const struct dns_res_rec *rrec,
 297                              struct dnsp_DnssrvRpcRecord *r)
 298 {
 299         char *tmp;
 300         char *txt_record_txt;
 301         char *saveptr = NULL;
 302
 303         if (rrec->rr_type == DNS_QTYPE_ALL) {
 304                 return DNS_ERR(FORMAT_ERROR);
 305         }
 306
 307         ZERO_STRUCTP(r);
 308
 309         r->wType = rrec->rr_type;
 310         r->dwTtlSeconds = rrec->ttl;
 311         r->rank = DNS_RANK_ZONE;
 312
 313         /* If we get QCLASS_ANY, we're done here */
 314         if (rrec->rr_class == DNS_QCLASS_ANY) {
 315                 goto done;
 316         }
 317
 318         switch(rrec->rr_type) {
 319         case DNS_QTYPE_A:
 320                 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
 321                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
 322                 break;
 323         case DNS_QTYPE_AAAA:
 324                 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
 325                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
 326                 break;
 327         case DNS_QTYPE_NS:
 328                 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
 329                 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
 330                 break;
 331         case DNS_QTYPE_CNAME:
 332                 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
 333                 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
 334                 break;
 335         case DNS_QTYPE_SRV:
 336                 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
 337                 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
 338                 r->data.srv.wPort = rrec->rdata.srv_record.port;
 339                 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
 340                                 rrec->rdata.srv_record.target);
 341                 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
 342                 break;
 343         case DNS_QTYPE_PTR:
 344                 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
 345                 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
 346                 break;
 347         case DNS_QTYPE_MX:
 348                 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
 349                 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
 350                                 rrec->rdata.mx_record.exchange);
 351                 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
 352                 break;
 353         case DNS_QTYPE_TXT:
 354                 r->data.txt.count = 0;
 355                 r->data.txt.str = talloc_array(mem_ctx, const char *,
 356                                                r->data.txt.count);
 357                 W_ERROR_HAVE_NO_MEMORY(r->data.txt.str);
 358
 359                 txt_record_txt = talloc_strdup(r->data.txt.str,
 360                                                rrec->rdata.txt_record.txt);
 361                 W_ERROR_HAVE_NO_MEMORY(txt_record_txt);
 362
 363                 tmp = strtok_r(txt_record_txt, "\"", &saveptr);
 364                 while (tmp) {
 365                         if (strcmp(tmp, " ") == 0) {
 366                                 tmp = strtok_r(NULL, "\"", &saveptr);
 367                                 continue;
 368                         }
 369                         r->data.txt.str = talloc_realloc(mem_ctx, r->data.txt.str, const char *,
 370                                                         r->data.txt.count+1);
 371                         r->data.txt.str[r->data.txt.count] = talloc_strdup(r->data.txt.str, tmp);
 372                         W_ERROR_HAVE_NO_MEMORY(r->data.txt.str[r->data.txt.count]);
 373
 374                         r->data.txt.count++;
 375                         tmp = strtok_r(NULL, "\"", &saveptr);
 376                 }
 377
 378                 break;
 379         default:
 380                 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
 381                 return DNS_ERR(NOT_IMPLEMENTED);
 382         }
 383
 384 done:
 385
 386         return WERR_OK;
 387 }
 388
 389
 390 static WERROR handle_one_update(struct dns_server *dns,
 391                                 TALLOC_CTX *mem_ctx,
 392                                 const struct dns_name_question *zone,
 393                                 const struct dns_res_rec *update,
 394                                 const struct dns_server_tkey *tkey)
 395 {
 396         struct dnsp_DnssrvRpcRecord *recs = NULL;
 397         uint16_t rcount = 0;
 398         struct ldb_dn *dn;
 399         uint16_t i;
 400         uint16_t first = 0;
 401         WERROR werror;
 402         bool tombstoned = false;
 403         bool needs_add = false;
 404
 405         DEBUG(2, ("Looking at record: \n"));
 406         if (DEBUGLVL(2)) {
 407                 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
 408         }
 409
 410         switch (update->rr_type) {
 411         case DNS_QTYPE_A:
 412         case DNS_QTYPE_NS:
 413         case DNS_QTYPE_CNAME:
 414         case DNS_QTYPE_SOA:
 415         case DNS_QTYPE_PTR:
 416         case DNS_QTYPE_MX:
 417         case DNS_QTYPE_AAAA:
 418         case DNS_QTYPE_SRV:
 419         case DNS_QTYPE_TXT:
 420                 break;
 421         default:
 422                 DEBUG(0, ("Can't handle updates of type %u yet\n",
 423                           update->rr_type));
 424                 return DNS_ERR(NOT_IMPLEMENTED);
 425         }
 426
 427         werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
 428         W_ERROR_NOT_OK_RETURN(werror);
 429
 430         werror = dns_common_lookup(dns->samdb, mem_ctx, dn,
 431                                    &recs, &rcount, &tombstoned);
 432         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
 433                 needs_add = true;
 434                 werror = WERR_OK;
 435         }
 436         W_ERROR_NOT_OK_RETURN(werror);
 437
 438         if (tombstoned) {
 439                 /*
 440                  * we need to keep the existing tombstone record
 441                  * and ignore it
 442                  */
 443                 first = rcount;
 444         }
 445
 446         if (update->rr_class == zone->question_class) {
 447                 if (update->rr_type == DNS_QTYPE_CNAME) {
 448                         /*
 449                          * If there is a record in the directory
 450                          * that's not a CNAME, ignore update
 451                          */
 452                         for (i = first; i < rcount; i++) {
 453                                 if (recs[i].wType != DNS_TYPE_CNAME) {
 454                                         DEBUG(5, ("Skipping update\n"));
 455                                         return WERR_OK;
 456                                 }
 457                                 break;
 458                         }
 459
 460                         /*
 461                          * There should be no entries besides one CNAME record
 462                          * per name, so replace everything with the new CNAME
 463                          */
 464
 465                         rcount = first;
 466                         recs = talloc_realloc(mem_ctx, recs,
 467                                         struct dnsp_DnssrvRpcRecord, rcount + 1);
 468                         W_ERROR_HAVE_NO_MEMORY(recs);
 469
 470                         werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
 471                         W_ERROR_NOT_OK_RETURN(werror);
 472                         rcount += 1;
 473
 474                         werror = dns_replace_records(dns, mem_ctx, dn,
 475                                                      needs_add, recs, rcount);
 476                         W_ERROR_NOT_OK_RETURN(werror);
 477
 478                         return WERR_OK;
 479                 } else {
 480                         /*
 481                          * If there is a CNAME record for this name,
 482                          * ignore update
 483                          */
 484                         for (i = first; i < rcount; i++) {
 485                                 if (recs[i].wType == DNS_TYPE_CNAME) {
 486                                         DEBUG(5, ("Skipping update\n"));
 487                                         return WERR_OK;
 488                                 }
 489                         }
 490                 }
 491                 if (update->rr_type == DNS_QTYPE_SOA) {
 492                         bool found = false;
 493
 494                         /*
 495                          * If the zone has no SOA record?? or update's
 496                          * serial number is smaller than existing SOA's,
 497                          * ignore update
 498                          */
 499                         for (i = first; i < rcount; i++) {
 500                                 if (recs[i].wType == DNS_TYPE_SOA) {
 501                                         uint16_t n, o;
 502
 503                                         n = update->rdata.soa_record.serial;
 504                                         o = recs[i].data.soa.serial;
 505                                         /*
 506                                          * TODO: Implement RFC 1982 comparison
 507                                          * logic for RFC2136
 508                                          */
 509                                         if (n <= o) {
 510                                                 DEBUG(5, ("Skipping update\n"));
 511                                                 return WERR_OK;
 512                                         }
 513                                         found = true;
 514                                         break;
 515                                 }
 516                         }
 517                         if (!found) {
 518                                 DEBUG(5, ("Skipping update\n"));
 519                                 return WERR_OK;
 520                         }
 521
 522                         werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
 523                         W_ERROR_NOT_OK_RETURN(werror);
 524
 525                         for (i++; i < rcount; i++) {
 526                                 if (recs[i].wType != DNS_TYPE_SOA) {
 527                                         continue;
 528                                 }
 529
 530                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
 531                                         .wType = DNS_TYPE_TOMBSTONE,
 532                                 };
 533                         }
 534
 535                         werror = dns_replace_records(dns, mem_ctx, dn,
 536                                                      needs_add, recs, rcount);
 537                         W_ERROR_NOT_OK_RETURN(werror);
 538
 539                         return WERR_OK;
 540                 }
 541
 542                 recs = talloc_realloc(mem_ctx, recs,
 543                                 struct dnsp_DnssrvRpcRecord, rcount+1);
 544                 W_ERROR_HAVE_NO_MEMORY(recs);
 545
 546                 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
 547                 W_ERROR_NOT_OK_RETURN(werror);
 548
 549                 for (i = first; i < rcount; i++) {
 550                         if (!dns_records_match(&recs[i], &recs[rcount])) {
 551                                 continue;
 552                         }
 553
 554                         recs[i] = recs[rcount];
 555
 556                         werror = dns_replace_records(dns, mem_ctx, dn,
 557                                                      needs_add, recs, rcount);
 558                         W_ERROR_NOT_OK_RETURN(werror);
 559
 560                         return WERR_OK;
 561                 }
 562
 563                 werror = dns_replace_records(dns, mem_ctx, dn,
 564                                              needs_add, recs, rcount+1);
 565                 W_ERROR_NOT_OK_RETURN(werror);
 566
 567                 return WERR_OK;
 568         } else if (update->rr_class == DNS_QCLASS_ANY) {
 569                 if (update->rr_type == DNS_QTYPE_ALL) {
 570                         if (dns_name_equal(update->name, zone->name)) {
 571                                 for (i = first; i < rcount; i++) {
 572
 573                                         if (recs[i].wType == DNS_TYPE_SOA) {
 574                                                 continue;
 575                                         }
 576
 577                                         if (recs[i].wType == DNS_TYPE_NS) {
 578                                                 continue;
 579                                         }
 580
 581                                         recs[i] = (struct dnsp_DnssrvRpcRecord) {
 582                                                 .wType = DNS_TYPE_TOMBSTONE,
 583                                         };
 584                                 }
 585
 586                         } else {
 587                                 for (i = first; i < rcount; i++) {
 588                                         recs[i] = (struct dnsp_DnssrvRpcRecord) {
 589                                                 .wType = DNS_TYPE_TOMBSTONE,
 590                                         };
 591                                 }
 592                         }
 593
 594                 } else if (dns_name_equal(update->name, zone->name)) {
 595
 596                         if (update->rr_type == DNS_QTYPE_SOA) {
 597                                 return WERR_OK;
 598                         }
 599
 600                         if (update->rr_type == DNS_QTYPE_NS) {
 601                                 return WERR_OK;
 602                         }
 603                 }
 604                 for (i = first; i < rcount; i++) {
 605                         if (recs[i].wType == update->rr_type) {
 606                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
 607                                         .wType = DNS_TYPE_TOMBSTONE,
 608                                 };
 609                         }
 610                 }
 611
 612                 werror = dns_replace_records(dns, mem_ctx, dn,
 613                                              needs_add, recs, rcount);
 614                 W_ERROR_NOT_OK_RETURN(werror);
 615
 616                 return WERR_OK;
 617         } else if (update->rr_class == DNS_QCLASS_NONE) {
 618                 struct dnsp_DnssrvRpcRecord *del_rec;
 619
 620                 if (update->rr_type == DNS_QTYPE_SOA) {
 621                         return WERR_OK;
 622                 }
 623                 if (update->rr_type == DNS_QTYPE_NS) {
 624                         bool found = false;
 625                         struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
 626                                                 struct dnsp_DnssrvRpcRecord);
 627                         W_ERROR_HAVE_NO_MEMORY(ns_rec);
 628
 629
 630                         werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
 631                         W_ERROR_NOT_OK_RETURN(werror);
 632
 633                         for (i = first; i < rcount; i++) {
 634                                 if (dns_records_match(ns_rec, &recs[i])) {
 635                                         found = true;
 636                                         break;
 637                                 }
 638                         }
 639                         if (found) {
 640                                 return WERR_OK;
 641                         }
 642                 }
 643
 644                 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
 645                 W_ERROR_HAVE_NO_MEMORY(del_rec);
 646
 647                 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
 648                 W_ERROR_NOT_OK_RETURN(werror);
 649
 650                 for (i = first; i < rcount; i++) {
 651                         if (dns_records_match(del_rec, &recs[i])) {
 652                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
 653                                         .wType = DNS_TYPE_TOMBSTONE,
 654                                 };
 655                         }
 656                 }
 657
 658                 werror = dns_replace_records(dns, mem_ctx, dn,
 659                                              needs_add, recs, rcount);
 660                 W_ERROR_NOT_OK_RETURN(werror);
 661         }
 662
 663         return WERR_OK;
 664 }
 665
 666 static WERROR handle_updates(struct dns_server *dns,
 667                              TALLOC_CTX *mem_ctx,
 668                              const struct dns_name_question *zone,
 669                              const struct dns_res_rec *prereqs, uint16_t pcount,
 670                              struct dns_res_rec *updates, uint16_t upd_count,
 671                              struct dns_server_tkey *tkey)
 672 {
 673         struct ldb_dn *zone_dn = NULL;
 674         WERROR werror = WERR_OK;
 675         int ret;
 676         uint16_t ri;
 677         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 678
 679         if (tkey != NULL) {
 680                 ret = ldb_set_opaque(dns->samdb, "sessionInfo", tkey->session_info);
 681                 if (ret != LDB_SUCCESS) {
 682                         DEBUG(1, ("unable to set session info\n"));
 683                         werror = DNS_ERR(SERVER_FAILURE);
 684                         goto failed;
 685                 }
 686         }
 687
 688         werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
 689         W_ERROR_NOT_OK_GOTO(werror, failed);
 690
 691         ret = ldb_transaction_start(dns->samdb);
 692         if (ret != LDB_SUCCESS) {
 693                 werror = DNS_ERR(SERVER_FAILURE);
 694                 goto failed;
 695         }
 696
 697         werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
 698         W_ERROR_NOT_OK_GOTO(werror, failed);
 699
 700         DEBUG(1, ("update count is %u\n", upd_count));
 701
 702         for (ri = 0; ri < upd_count; ri++) {
 703                 werror = handle_one_update(dns, tmp_ctx, zone,
 704                                            &updates[ri], tkey);
 705                 W_ERROR_NOT_OK_GOTO(werror, failed);
 706         }
 707
 708         ldb_transaction_commit(dns->samdb);
 709         TALLOC_FREE(tmp_ctx);
 710
 711         if (tkey != NULL) {
 712                 ldb_set_opaque(dns->samdb, "sessionInfo",
 713                                system_session(dns->task->lp_ctx));
 714         }
 715
 716         return WERR_OK;
 717
 718 failed:
 719         ldb_transaction_cancel(dns->samdb);
 720
 721         if (tkey != NULL) {
 722                 ldb_set_opaque(dns->samdb, "sessionInfo",
 723                                system_session(dns->task->lp_ctx));
 724         }
 725
 726         TALLOC_FREE(tmp_ctx);
 727         return werror;
 728
 729 }
 730
 731 static WERROR dns_update_allowed(struct dns_server *dns,
 732                                  struct dns_request_state *state,
 733                                  struct dns_server_tkey **tkey)
 734 {
 735         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
 736                 DEBUG(2, ("All updates allowed.\n"));
 737                 return WERR_OK;
 738         }
 739
 740         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
 741                 DEBUG(2, ("Updates disabled.\n"));
 742                 return DNS_ERR(REFUSED);
 743         }
 744
 745         if (state->authenticated == false ) {
 746                 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
 747                 return DNS_ERR(REFUSED);
 748         }
 749
 750         *tkey = dns_find_tkey(dns->tkeys, state->key_name);
 751         if (*tkey == NULL) {
 752                 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
 753                 return DNS_ERR(REFUSED);
 754         }
 755
 756         return WERR_OK;
 757 }
 758
 759
 760 WERROR dns_server_process_update(struct dns_server *dns,
 761                                  struct dns_request_state *state,
 762                                  TALLOC_CTX *mem_ctx,
 763                                  struct dns_name_packet *in,
 764                                  struct dns_res_rec **prereqs,    uint16_t *prereq_count,
 765                                  struct dns_res_rec **updates,    uint16_t *update_count,
 766                                  struct dns_res_rec **additional, uint16_t *arcount)
 767 {
 768         struct dns_name_question *zone;
 769         const struct dns_server_zone *z;
 770         size_t host_part_len = 0;
 771         WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
 772         struct dns_server_tkey *tkey = NULL;
 773
 774         if (in->qdcount != 1) {
 775                 return DNS_ERR(FORMAT_ERROR);
 776         }
 777
 778         zone = &in->questions[0];
 779
 780         if (zone->question_class != DNS_QCLASS_IN &&
 781             zone->question_class != DNS_QCLASS_ANY) {
 782                 return DNS_ERR(NOT_IMPLEMENTED);
 783         }
 784
 785         if (zone->question_type != DNS_QTYPE_SOA) {
 786                 return DNS_ERR(FORMAT_ERROR);
 787         }
 788
 789         DEBUG(2, ("Got a dns update request.\n"));
 790
 791         for (z = dns->zones; z != NULL; z = z->next) {
 792                 bool match;
 793
 794                 match = dns_name_match(z->name, zone->name, &host_part_len);
 795                 if (match) {
 796                         break;
 797                 }
 798         }
 799
 800         if (z == NULL) {
 801                 DEBUG(1, ("We're not authoritative for this zone\n"));
 802                 return DNS_ERR(NOTAUTH);
 803         }
 804
 805         if (host_part_len != 0) {
 806                 /* TODO: We need to delegate this one */
 807                 DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
 808                 return DNS_ERR(NOT_IMPLEMENTED);
 809         }
 810
 811         *prereq_count = in->ancount;
 812         *prereqs = in->answers;
 813         werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
 814                                      *prereq_count);
 815         W_ERROR_NOT_OK_RETURN(werror);
 816
 817         werror = dns_update_allowed(dns, state, &tkey);
 818         if (!W_ERROR_IS_OK(werror)) {
 819                 return werror;
 820         }
 821
 822         *update_count = in->nscount;
 823         *updates = in->nsrecs;
 824         werror = update_prescan(in->questions, *updates, *update_count);
 825         W_ERROR_NOT_OK_RETURN(werror);
 826
 827         werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
 828                                 *prereq_count, *updates, *update_count, tkey);
 829         W_ERROR_NOT_OK_RETURN(werror);
 830
 831         return werror;
 832 }