lib/addns/dnsquery.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    DNS utility library
   4    Copyright (C) Gerald (Jerry) Carter           2006.
   5    Copyright (C) Jeremy Allison                  2007.
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "lib/util/util_net.h"
  23 #include "lib/util/tsort.h"
  24 #include "dnsquery.h"
  25
  26 /* AIX resolv.h uses 'class' in struct ns_rr */
  27
  28 #if defined(AIX)
  29 #  if defined(class)
  30 #    undef class
  31 #  endif
  32 #endif  /* AIX */
  33
  34 /* resolver headers */
  35
  36 #include <sys/types.h>
  37 #include <netinet/in.h>
  38 #include <arpa/nameser.h>
  39 #include <resolv.h>
  40 #include <netdb.h>
  41
  42 #define MAX_DNS_PACKET_SIZE 0xffff
  43
  44 #ifdef NS_HFIXEDSZ      /* Bind 8/9 interface */
  45 #if !defined(C_IN)      /* AIX 5.3 already defines C_IN */
  46 #  define C_IN          ns_c_in
  47 #endif
  48 #if !defined(T_A)       /* AIX 5.3 already defines T_A */
  49 #  define T_A           ns_t_a
  50 #endif
  51
  52 #if defined(HAVE_IPV6)
  53 #if !defined(T_AAAA)
  54 #  define T_AAAA        ns_t_aaaa
  55 #endif
  56 #endif
  57
  58 #  define T_SRV         ns_t_srv
  59 #if !defined(T_NS)      /* AIX 5.3 already defines T_NS */
  60 #  define T_NS          ns_t_ns
  61 #endif
  62 #else
  63 #  ifdef HFIXEDSZ
  64 #    define NS_HFIXEDSZ HFIXEDSZ
  65 #  else
  66 #    define NS_HFIXEDSZ sizeof(HEADER)
  67 #  endif        /* HFIXEDSZ */
  68 #  ifdef PACKETSZ
  69 #    define NS_PACKETSZ PACKETSZ
  70 #  else /* 512 is usually the default */
  71 #    define NS_PACKETSZ 512
  72 #  endif        /* PACKETSZ */
  73 #  define T_SRV         33
  74 #endif
  75
  76 /*********************************************************************
  77 *********************************************************************/
  78
  79 static bool ads_dns_parse_query( TALLOC_CTX *ctx, uint8_t *start, uint8_t *end,
  80                           uint8_t **ptr, struct dns_query *q )
  81 {
  82         uint8_t *p = *ptr;
  83         char hostname[MAX_DNS_NAME_LENGTH];
  84         int namelen;
  85
  86         ZERO_STRUCTP( q );
  87
  88         if ( !start || !end || !q || !*ptr)
  89                 return false;
  90
  91         /* See RFC 1035 for details. If this fails, then return. */
  92
  93         namelen = dn_expand( start, end, p, hostname, sizeof(hostname) );
  94         if ( namelen < 0 ) {
  95                 return false;
  96         }
  97         p += namelen;
  98         q->hostname = talloc_strdup( ctx, hostname );
  99
 100         /* check that we have space remaining */
 101
 102         if ( PTR_DIFF(p+4, end) > 0 )
 103                 return false;
 104
 105         q->type     = RSVAL( p, 0 );
 106         q->in_class = RSVAL( p, 2 );
 107         p += 4;
 108
 109         *ptr = p;
 110
 111         return true;
 112 }
 113
 114 /*********************************************************************
 115 *********************************************************************/
 116
 117 static bool ads_dns_parse_rr( TALLOC_CTX *ctx, uint8_t *start, uint8_t *end,
 118                        uint8_t **ptr, struct dns_rr *rr )
 119 {
 120         uint8_t *p = *ptr;
 121         char hostname[MAX_DNS_NAME_LENGTH];
 122         int namelen;
 123
 124         if ( !start || !end || !rr || !*ptr)
 125                 return -1;
 126
 127         ZERO_STRUCTP( rr );
 128         /* pull the name from the answer */
 129
 130         namelen = dn_expand( start, end, p, hostname, sizeof(hostname) );
 131         if ( namelen < 0 ) {
 132                 return -1;
 133         }
 134         p += namelen;
 135         rr->hostname = talloc_strdup( ctx, hostname );
 136
 137         /* check that we have space remaining */
 138
 139         if ( PTR_DIFF(p+10, end) > 0 )
 140                 return false;
 141
 142         /* pull some values and then skip onto the string */
 143
 144         rr->type     = RSVAL(p, 0);
 145         rr->in_class = RSVAL(p, 2);
 146         rr->ttl      = RIVAL(p, 4);
 147         rr->rdatalen = RSVAL(p, 8);
 148
 149         p += 10;
 150
 151         /* sanity check the available space */
 152
 153         if ( PTR_DIFF(p+rr->rdatalen, end ) > 0 ) {
 154                 return false;
 155
 156         }
 157
 158         /* save a point to the rdata for this section */
 159
 160         rr->rdata = p;
 161         p += rr->rdatalen;
 162
 163         *ptr = p;
 164
 165         return true;
 166 }
 167
 168 /*********************************************************************
 169 *********************************************************************/
 170
 171 static bool ads_dns_parse_rr_srv( TALLOC_CTX *ctx, uint8_t *start, uint8_t *end,
 172                        uint8_t **ptr, struct dns_rr_srv *srv )
 173 {
 174         struct dns_rr rr;
 175         uint8_t *p;
 176         char dcname[MAX_DNS_NAME_LENGTH];
 177         int namelen;
 178
 179         if ( !start || !end || !srv || !*ptr)
 180                 return -1;
 181
 182         /* Parse the RR entry.  Coming out of the this, ptr is at the beginning
 183            of the next record */
 184
 185         if ( !ads_dns_parse_rr( ctx, start, end, ptr, &rr ) ) {
 186                 DEBUG(1,("ads_dns_parse_rr_srv: Failed to parse RR record\n"));
 187                 return false;
 188         }
 189
 190         if ( rr.type != T_SRV ) {
 191                 DEBUG(1,("ads_dns_parse_rr_srv: Bad answer type (%d)\n",
 192                                         rr.type));
 193                 return false;
 194         }
 195
 196         p = rr.rdata;
 197
 198         srv->priority = RSVAL(p, 0);
 199         srv->weight   = RSVAL(p, 2);
 200         srv->port     = RSVAL(p, 4);
 201
 202         p += 6;
 203
 204         namelen = dn_expand( start, end, p, dcname, sizeof(dcname) );
 205         if ( namelen < 0 ) {
 206                 DEBUG(1,("ads_dns_parse_rr_srv: Failed to uncompress name!\n"));
 207                 return false;
 208         }
 209
 210         srv->hostname = talloc_strdup( ctx, dcname );
 211
 212         DEBUG(10,("ads_dns_parse_rr_srv: Parsed %s [%u, %u, %u]\n",
 213                   srv->hostname,
 214                   srv->priority,
 215                   srv->weight,
 216                   srv->port));
 217
 218         return true;
 219 }
 220
 221 /*********************************************************************
 222 *********************************************************************/
 223
 224 static bool ads_dns_parse_rr_ns( TALLOC_CTX *ctx, uint8_t *start, uint8_t *end,
 225                        uint8_t **ptr, struct dns_rr_ns *nsrec )
 226 {
 227         struct dns_rr rr;
 228         uint8_t *p;
 229         char nsname[MAX_DNS_NAME_LENGTH];
 230         int namelen;
 231
 232         if ( !start || !end || !nsrec || !*ptr)
 233                 return -1;
 234
 235         /* Parse the RR entry.  Coming out of the this, ptr is at the beginning
 236            of the next record */
 237
 238         if ( !ads_dns_parse_rr( ctx, start, end, ptr, &rr ) ) {
 239                 DEBUG(1,("ads_dns_parse_rr_ns: Failed to parse RR record\n"));
 240                 return false;
 241         }
 242
 243         if ( rr.type != T_NS ) {
 244                 DEBUG(1,("ads_dns_parse_rr_ns: Bad answer type (%d)\n",
 245                                         rr.type));
 246                 return false;
 247         }
 248
 249         p = rr.rdata;
 250
 251         /* ame server hostname */
 252
 253         namelen = dn_expand( start, end, p, nsname, sizeof(nsname) );
 254         if ( namelen < 0 ) {
 255                 DEBUG(1,("ads_dns_parse_rr_ns: Failed to uncompress name!\n"));
 256                 return false;
 257         }
 258         nsrec->hostname = talloc_strdup( ctx, nsname );
 259
 260         return true;
 261 }
 262
 263 /*********************************************************************
 264  Sort SRV record list based on weight and priority.  See RFC 2782.
 265 *********************************************************************/
 266
 267 static int dnssrvcmp( struct dns_rr_srv *a, struct dns_rr_srv *b )
 268 {
 269         if ( a->priority == b->priority ) {
 270
 271                 /* randomize entries with an equal weight and priority */
 272                 if ( a->weight == b->weight )
 273                         return 0;
 274
 275                 /* higher weights should be sorted lower */
 276                 if ( a->weight > b->weight )
 277                         return -1;
 278                 else
 279                         return 1;
 280         }
 281
 282         if ( a->priority < b->priority )
 283                 return -1;
 284
 285         return 1;
 286 }
 287
 288 /*********************************************************************
 289  Simple wrapper for a DNS query
 290 *********************************************************************/
 291
 292 #define DNS_FAILED_WAITTIME          30
 293
 294 static NTSTATUS dns_send_req( TALLOC_CTX *ctx, const char *name, int q_type,
 295                               uint8_t **buf, int *resp_length )
 296 {
 297         uint8_t *buffer = NULL;
 298         size_t buf_len = 0;
 299         int resp_len = NS_PACKETSZ;
 300         static time_t last_dns_check = 0;
 301         static NTSTATUS last_dns_status = NT_STATUS_OK;
 302         time_t now = time_mono(NULL);
 303
 304         /* Try to prevent bursts of DNS lookups if the server is down */
 305
 306         /* Protect against large clock changes */
 307
 308         if ( last_dns_check > now )
 309                 last_dns_check = 0;
 310
 311         /* IF we had a DNS timeout or a bad server and we are still
 312            in the 30 second cache window, just return the previous
 313            status and save the network timeout. */
 314
 315         if ( (NT_STATUS_EQUAL(last_dns_status,NT_STATUS_IO_TIMEOUT) ||
 316               NT_STATUS_EQUAL(last_dns_status,NT_STATUS_CONNECTION_REFUSED)) &&
 317              (last_dns_check+DNS_FAILED_WAITTIME) > now )
 318         {
 319                 DEBUG(10,("dns_send_req: last dns check returning cached status (%s)\n",
 320                           nt_errstr(last_dns_status) ));
 321                 return last_dns_status;
 322         }
 323
 324         /* Send the Query */
 325         do {
 326                 if ( buffer )
 327                         TALLOC_FREE( buffer );
 328
 329                 buf_len = resp_len * sizeof(uint8_t);
 330
 331                 if (buf_len) {
 332                         if ((buffer = talloc_array(ctx, uint8_t, buf_len))
 333                                         == NULL ) {
 334                                 DEBUG(0,("dns_send_req: "
 335                                         "talloc() failed!\n"));
 336                                 last_dns_status = NT_STATUS_NO_MEMORY;
 337                                 last_dns_check = time_mono(NULL);
 338                                 return last_dns_status;
 339                         }
 340                 }
 341
 342                 if ((resp_len = res_query(name, C_IN, q_type, buffer, buf_len))
 343                                 < 0 ) {
 344                         DEBUG(3,("dns_send_req: "
 345                                 "Failed to resolve %s (%s)\n",
 346                                 name, strerror(errno)));
 347                         TALLOC_FREE( buffer );
 348                         last_dns_status = NT_STATUS_UNSUCCESSFUL;
 349
 350                         if (errno == ETIMEDOUT) {
 351                                 last_dns_status = NT_STATUS_IO_TIMEOUT;
 352                         }
 353                         if (errno == ECONNREFUSED) {
 354                                 last_dns_status = NT_STATUS_CONNECTION_REFUSED;
 355                         }
 356                         last_dns_check = time_mono(NULL);
 357                         return last_dns_status;
 358                 }
 359
 360                 /* On AIX, Solaris, and possibly some older glibc systems (e.g. SLES8)
 361                    truncated replies never give back a resp_len > buflen
 362                    which ends up causing DNS resolve failures on large tcp DNS replies */
 363
 364                 if (buf_len == resp_len) {
 365                         if (resp_len == MAX_DNS_PACKET_SIZE) {
 366                                 DEBUG(1,("dns_send_req: DNS reply too large when resolving %s\n",
 367                                         name));
 368                                 TALLOC_FREE( buffer );
 369                                 last_dns_status = NT_STATUS_BUFFER_TOO_SMALL;
 370                                 last_dns_check = time_mono(NULL);
 371                                 return last_dns_status;
 372                         }
 373
 374                         resp_len = MIN(resp_len*2, MAX_DNS_PACKET_SIZE);
 375                 }
 376
 377
 378         } while ( buf_len < resp_len && resp_len <= MAX_DNS_PACKET_SIZE );
 379
 380         *buf = buffer;
 381         *resp_length = resp_len;
 382
 383         last_dns_check = time_mono(NULL);
 384         last_dns_status = NT_STATUS_OK;
 385         return last_dns_status;
 386 }
 387
 388 /*********************************************************************
 389  Simple wrapper for a DNS SRV query
 390 *********************************************************************/
 391
 392 NTSTATUS ads_dns_lookup_srv(TALLOC_CTX *ctx,
 393                                 const char *name,
 394                                 struct dns_rr_srv **dclist,
 395                                 int *numdcs)
 396 {
 397         uint8_t *buffer = NULL;
 398         int resp_len = 0;
 399         struct dns_rr_srv *dcs = NULL;
 400         int query_count, answer_count, auth_count, additional_count;
 401         uint8_t *p = buffer;
 402         int rrnum;
 403         int idx = 0;
 404         NTSTATUS status;
 405
 406         if ( !ctx || !name || !dclist ) {
 407                 return NT_STATUS_INVALID_PARAMETER;
 408         }
 409
 410         /* Send the request.  May have to loop several times in case
 411            of large replies */
 412
 413         status = dns_send_req( ctx, name, T_SRV, &buffer, &resp_len );
 414         if ( !NT_STATUS_IS_OK(status) ) {
 415                 DEBUG(3,("ads_dns_lookup_srv: Failed to send DNS query (%s)\n",
 416                         nt_errstr(status)));
 417                 return status;
 418         }
 419         p = buffer;
 420
 421         /* For some insane reason, the ns_initparse() et. al. routines are only
 422            available in libresolv.a, and not the shared lib.  Who knows why....
 423            So we have to parse the DNS reply ourselves */
 424
 425         /* Pull the answer RR's count from the header.
 426          * Use the NMB ordering macros */
 427
 428         query_count      = RSVAL( p, 4 );
 429         answer_count     = RSVAL( p, 6 );
 430         auth_count       = RSVAL( p, 8 );
 431         additional_count = RSVAL( p, 10 );
 432
 433         DEBUG(4,("ads_dns_lookup_srv: "
 434                 "%d records returned in the answer section.\n",
 435                 answer_count));
 436
 437         if (answer_count) {
 438                 if ((dcs = talloc_zero_array(ctx, struct dns_rr_srv,
 439                                                 answer_count)) == NULL ) {
 440                         DEBUG(0,("ads_dns_lookup_srv: "
 441                                 "talloc() failure for %d char*'s\n",
 442                                 answer_count));
 443                         return NT_STATUS_NO_MEMORY;
 444                 }
 445         } else {
 446                 dcs = NULL;
 447         }
 448
 449         /* now skip the header */
 450
 451         p += NS_HFIXEDSZ;
 452
 453         /* parse the query section */
 454
 455         for ( rrnum=0; rrnum<query_count; rrnum++ ) {
 456                 struct dns_query q;
 457
 458                 if (!ads_dns_parse_query(ctx, buffer,
 459                                         buffer+resp_len, &p, &q)) {
 460                         DEBUG(1,("ads_dns_lookup_srv: "
 461                                  "Failed to parse query record [%d]!\n", rrnum));
 462                         return NT_STATUS_UNSUCCESSFUL;
 463                 }
 464         }
 465
 466         /* now we are at the answer section */
 467
 468         for ( rrnum=0; rrnum<answer_count; rrnum++ ) {
 469                 if (!ads_dns_parse_rr_srv(ctx, buffer, buffer+resp_len,
 470                                         &p, &dcs[rrnum])) {
 471                         DEBUG(1,("ads_dns_lookup_srv: "
 472                                  "Failed to parse answer recordi [%d]!\n", rrnum));
 473                         return NT_STATUS_UNSUCCESSFUL;
 474                 }
 475         }
 476         idx = rrnum;
 477
 478         /* Parse the authority section */
 479         /* just skip these for now */
 480
 481         for ( rrnum=0; rrnum<auth_count; rrnum++ ) {
 482                 struct dns_rr rr;
 483
 484                 if (!ads_dns_parse_rr( ctx, buffer,
 485                                         buffer+resp_len, &p, &rr)) {
 486                         DEBUG(1,("ads_dns_lookup_srv: "
 487                                  "Failed to parse authority record! [%d]\n", rrnum));
 488                         return NT_STATUS_UNSUCCESSFUL;
 489                 }
 490         }
 491
 492         /* Parse the additional records section */
 493
 494         for ( rrnum=0; rrnum<additional_count; rrnum++ ) {
 495                 struct dns_rr rr;
 496                 int i;
 497
 498                 if (!ads_dns_parse_rr(ctx, buffer, buffer+resp_len,
 499                                         &p, &rr)) {
 500                         DEBUG(1,("ads_dns_lookup_srv: Failed "
 501                                  "to parse additional records section! [%d]\n", rrnum));
 502                         return NT_STATUS_UNSUCCESSFUL;
 503                 }
 504
 505                 /* Only interested in A or AAAA records as a shortcut for having
 506                  * to come back later and lookup the name. For multi-homed
 507                  * hosts, the number of additional records and exceed the
 508                  * number of answer records. */
 509
 510                 if (rr.type != T_A || rr.rdatalen != 4) {
 511 #if defined(HAVE_IPV6)
 512                         /* RFC2874 defines A6 records. This
 513                          * requires recusive and horribly complex lookups.
 514                          * Bastards. Ignore this for now.... JRA.
 515                          * Luckily RFC3363 reprecates A6 records.
 516                          */
 517                         if (rr.type != T_AAAA || rr.rdatalen != 16)
 518 #endif
 519                                 continue;
 520                 }
 521
 522                 for ( i=0; i<idx; i++ ) {
 523                         if ( strcmp( rr.hostname, dcs[i].hostname ) == 0 ) {
 524                                 int num_ips = dcs[i].num_ips;
 525                                 struct sockaddr_storage *tmp_ss_s;
 526
 527                                 /* allocate new memory */
 528
 529                                 if (dcs[i].num_ips == 0) {
 530                                         if ((dcs[i].ss_s = talloc_array(dcs,
 531                                                 struct sockaddr_storage, 1 ))
 532                                                         == NULL ) {
 533                                                 return NT_STATUS_NO_MEMORY;
 534                                         }
 535                                 } else {
 536                                         if ((tmp_ss_s = talloc_realloc(dcs,
 537                                                         dcs[i].ss_s,
 538                                                         struct sockaddr_storage,
 539                                                         dcs[i].num_ips+1))
 540                                                                 == NULL ) {
 541                                                 return NT_STATUS_NO_MEMORY;
 542                                         }
 543
 544                                         dcs[i].ss_s = tmp_ss_s;
 545                                 }
 546                                 dcs[i].num_ips++;
 547
 548                                 /* copy the new IP address */
 549                                 if (rr.type == T_A) {
 550                                         struct in_addr ip;
 551                                         memcpy(&ip, rr.rdata, 4);
 552                                         in_addr_to_sockaddr_storage(
 553                                                         &dcs[i].ss_s[num_ips],
 554                                                         ip);
 555                                 }
 556 #if defined(HAVE_IPV6)
 557                                 if (rr.type == T_AAAA) {
 558                                         struct in6_addr ip6;
 559                                         memcpy(&ip6, rr.rdata, rr.rdatalen);
 560                                         in6_addr_to_sockaddr_storage(
 561                                                         &dcs[i].ss_s[num_ips],
 562                                                         ip6);
 563                                 }
 564 #endif
 565                         }
 566                 }
 567         }
 568
 569         TYPESAFE_QSORT(dcs, idx, dnssrvcmp );
 570
 571         *dclist = dcs;
 572         *numdcs = idx;
 573
 574         return NT_STATUS_OK;
 575 }
 576
 577 /*********************************************************************
 578  Simple wrapper for a DNS NS query
 579 *********************************************************************/
 580
 581 NTSTATUS ads_dns_lookup_ns(TALLOC_CTX *ctx,
 582                                 const char *dnsdomain,
 583                                 struct dns_rr_ns **nslist,
 584                                 int *numns)
 585 {
 586         uint8_t *buffer = NULL;
 587         int resp_len = 0;
 588         struct dns_rr_ns *nsarray = NULL;
 589         int query_count, answer_count, auth_count, additional_count;
 590         uint8_t *p;
 591         int rrnum;
 592         int idx = 0;
 593         NTSTATUS status;
 594
 595         if ( !ctx || !dnsdomain || !nslist ) {
 596                 return NT_STATUS_INVALID_PARAMETER;
 597         }
 598
 599         /* Send the request.  May have to loop several times in case
 600            of large replies */
 601
 602         status = dns_send_req( ctx, dnsdomain, T_NS, &buffer, &resp_len );
 603         if ( !NT_STATUS_IS_OK(status) ) {
 604                 DEBUG(3,("ads_dns_lookup_ns: Failed to send DNS query (%s)\n",
 605                         nt_errstr(status)));
 606                 return status;
 607         }
 608         p = buffer;
 609
 610         /* For some insane reason, the ns_initparse() et. al. routines are only
 611            available in libresolv.a, and not the shared lib.  Who knows why....
 612            So we have to parse the DNS reply ourselves */
 613
 614         /* Pull the answer RR's count from the header.
 615          * Use the NMB ordering macros */
 616
 617         query_count      = RSVAL( p, 4 );
 618         answer_count     = RSVAL( p, 6 );
 619         auth_count       = RSVAL( p, 8 );
 620         additional_count = RSVAL( p, 10 );
 621
 622         DEBUG(4,("ads_dns_lookup_ns: "
 623                 "%d records returned in the answer section.\n",
 624                 answer_count));
 625
 626         if (answer_count) {
 627                 if ((nsarray = talloc_array(ctx, struct dns_rr_ns,
 628                                                 answer_count)) == NULL ) {
 629                         DEBUG(0,("ads_dns_lookup_ns: "
 630                                 "talloc() failure for %d char*'s\n",
 631                                 answer_count));
 632                         return NT_STATUS_NO_MEMORY;
 633                 }
 634         } else {
 635                 nsarray = NULL;
 636         }
 637
 638         /* now skip the header */
 639
 640         p += NS_HFIXEDSZ;
 641
 642         /* parse the query section */
 643
 644         for ( rrnum=0; rrnum<query_count; rrnum++ ) {
 645                 struct dns_query q;
 646
 647                 if (!ads_dns_parse_query(ctx, buffer, buffer+resp_len,
 648                                         &p, &q)) {
 649                         DEBUG(1,("ads_dns_lookup_ns: "
 650                                 " Failed to parse query record!\n"));
 651                         return NT_STATUS_UNSUCCESSFUL;
 652                 }
 653         }
 654
 655         /* now we are at the answer section */
 656
 657         for ( rrnum=0; rrnum<answer_count; rrnum++ ) {
 658                 if (!ads_dns_parse_rr_ns(ctx, buffer, buffer+resp_len,
 659                                         &p, &nsarray[rrnum])) {
 660                         DEBUG(1,("ads_dns_lookup_ns: "
 661                                 "Failed to parse answer record!\n"));
 662                         return NT_STATUS_UNSUCCESSFUL;
 663                 }
 664         }
 665         idx = rrnum;
 666
 667         /* Parse the authority section */
 668         /* just skip these for now */
 669
 670         for ( rrnum=0; rrnum<auth_count; rrnum++ ) {
 671                 struct dns_rr rr;
 672
 673                 if ( !ads_dns_parse_rr(ctx, buffer, buffer+resp_len,
 674                                         &p, &rr)) {
 675                         DEBUG(1,("ads_dns_lookup_ns: "
 676                                 "Failed to parse authority record!\n"));
 677                         return NT_STATUS_UNSUCCESSFUL;
 678                 }
 679         }
 680
 681         /* Parse the additional records section */
 682
 683         for ( rrnum=0; rrnum<additional_count; rrnum++ ) {
 684                 struct dns_rr rr;
 685                 int i;
 686
 687                 if (!ads_dns_parse_rr(ctx, buffer, buffer+resp_len,
 688                                         &p, &rr)) {
 689                         DEBUG(1,("ads_dns_lookup_ns: Failed "
 690                                 "to parse additional records section!\n"));
 691                         return NT_STATUS_UNSUCCESSFUL;
 692                 }
 693
 694                 /* only interested in A records as a shortcut for having to come
 695                    back later and lookup the name */
 696
 697                 if (rr.type != T_A || rr.rdatalen != 4) {
 698 #if defined(HAVE_IPV6)
 699                         if (rr.type != T_AAAA || rr.rdatalen != 16)
 700 #endif
 701                                 continue;
 702                 }
 703
 704                 for ( i=0; i<idx; i++ ) {
 705                         if (strcmp(rr.hostname, nsarray[i].hostname) == 0) {
 706                                 if (rr.type == T_A) {
 707                                         struct in_addr ip;
 708                                         memcpy(&ip, rr.rdata, 4);
 709                                         in_addr_to_sockaddr_storage(
 710                                                         &nsarray[i].ss,
 711                                                         ip);
 712                                 }
 713 #if defined(HAVE_IPV6)
 714                                 if (rr.type == T_AAAA) {
 715                                         struct in6_addr ip6;
 716                                         memcpy(&ip6, rr.rdata, rr.rdatalen);
 717                                         in6_addr_to_sockaddr_storage(
 718                                                         &nsarray[i].ss,
 719                                                         ip6);
 720                                 }
 721 #endif
 722                         }
 723                 }
 724         }
 725
 726         *nslist = nsarray;
 727         *numns = idx;
 728
 729         return NT_STATUS_OK;
 730 }
 731
 732 /********************************************************************
 733  Query with optional sitename.
 734 ********************************************************************/
 735
 736 static NTSTATUS ads_dns_query_internal(TALLOC_CTX *ctx,
 737                                        const char *servicename,
 738                                        const char *dc_pdc_gc_domains,
 739                                        const char *realm,
 740                                        const char *sitename,
 741                                        struct dns_rr_srv **dclist,
 742                                        int *numdcs )
 743 {
 744         char *name;
 745         if (sitename && strlen(sitename)) {
 746                 name = talloc_asprintf(ctx, "%s._tcp.%s._sites.%s._msdcs.%s",
 747                                        servicename, sitename,
 748                                        dc_pdc_gc_domains, realm);
 749         } else {
 750                 name = talloc_asprintf(ctx, "%s._tcp.%s._msdcs.%s",
 751                                 servicename, dc_pdc_gc_domains, realm);
 752         }
 753         if (!name) {
 754                 return NT_STATUS_NO_MEMORY;
 755         }
 756         return ads_dns_lookup_srv(ctx, name, dclist, numdcs);
 757 }
 758
 759 /********************************************************************
 760  Query for AD DC's.
 761 ********************************************************************/
 762
 763 NTSTATUS ads_dns_query_dcs(TALLOC_CTX *ctx,
 764                            const char *realm,
 765                            const char *sitename,
 766                            struct dns_rr_srv **dclist,
 767                            int *numdcs )
 768 {
 769         NTSTATUS status;
 770
 771         status = ads_dns_query_internal(ctx,
 772                                         "_ldap",
 773                                         "dc",
 774                                         realm,
 775                                         sitename,
 776                                         dclist,
 777                                         numdcs);
 778
 779         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
 780             NT_STATUS_EQUAL(status, NT_STATUS_CONNECTION_REFUSED)) {
 781                 return status;
 782         }
 783
 784         if (sitename &&
 785             ((!NT_STATUS_IS_OK(status)) ||
 786              (NT_STATUS_IS_OK(status) && (numdcs == 0)))) {
 787                 /* Sitename DNS query may have failed. Try without. */
 788                 status = ads_dns_query_internal(ctx,
 789                                                 "_ldap",
 790                                                 "dc",
 791                                                 realm,
 792                                                 NULL,
 793                                                 dclist,
 794                                                 numdcs);
 795         }
 796         return status;
 797 }
 798
 799 /********************************************************************
 800  Query for AD GC's.
 801 ********************************************************************/
 802
 803 NTSTATUS ads_dns_query_gcs(TALLOC_CTX *ctx,
 804                            const char *realm,
 805                            const char *sitename,
 806                            struct dns_rr_srv **dclist,
 807                            int *numdcs )
 808 {
 809         NTSTATUS status;
 810
 811         status = ads_dns_query_internal(ctx,
 812                                         "_ldap",
 813                                         "gc",
 814                                         realm,
 815                                         sitename,
 816                                         dclist,
 817                                         numdcs);
 818
 819         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
 820             NT_STATUS_EQUAL(status, NT_STATUS_CONNECTION_REFUSED)) {
 821                 return status;
 822         }
 823
 824         if (sitename &&
 825             ((!NT_STATUS_IS_OK(status)) ||
 826              (NT_STATUS_IS_OK(status) && (numdcs == 0)))) {
 827                 /* Sitename DNS query may have failed. Try without. */
 828                 status = ads_dns_query_internal(ctx,
 829                                                 "_ldap",
 830                                                 "gc",
 831                                                 realm,
 832                                                 NULL,
 833                                                 dclist,
 834                                                 numdcs);
 835         }
 836         return status;
 837 }
 838
 839 /********************************************************************
 840  Query for AD KDC's.
 841  Even if our underlying kerberos libraries are UDP only, this
 842  is pretty safe as it's unlikely that a KDC supports TCP and not UDP.
 843 ********************************************************************/
 844
 845 NTSTATUS ads_dns_query_kdcs(TALLOC_CTX *ctx,
 846                             const char *dns_forest_name,
 847                             const char *sitename,
 848                             struct dns_rr_srv **dclist,
 849                             int *numdcs )
 850 {
 851         NTSTATUS status;
 852
 853         status = ads_dns_query_internal(ctx,
 854                                         "_kerberos",
 855                                         "dc",
 856                                         dns_forest_name,
 857                                         sitename,
 858                                         dclist,
 859                                         numdcs);
 860
 861         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
 862             NT_STATUS_EQUAL(status, NT_STATUS_CONNECTION_REFUSED)) {
 863                 return status;
 864         }
 865
 866         if (sitename &&
 867             ((!NT_STATUS_IS_OK(status)) ||
 868              (NT_STATUS_IS_OK(status) && (numdcs == 0)))) {
 869                 /* Sitename DNS query may have failed. Try without. */
 870                 status = ads_dns_query_internal(ctx,
 871                                                 "_kerberos",
 872                                                 "dc",
 873                                                 dns_forest_name,
 874                                                 NULL,
 875                                                 dclist,
 876                                                 numdcs);
 877         }
 878         return status;
 879 }
 880
 881 /********************************************************************
 882  Query for AD PDC. Sitename is obsolete here.
 883 ********************************************************************/
 884
 885 NTSTATUS ads_dns_query_pdc(TALLOC_CTX *ctx,
 886                            const char *dns_domain_name,
 887                            struct dns_rr_srv **dclist,
 888                            int *numdcs )
 889 {
 890         return ads_dns_query_internal(ctx,
 891                                       "_ldap",
 892                                       "pdc",
 893                                       dns_domain_name,
 894                                       NULL,
 895                                       dclist,
 896                                       numdcs);
 897 }
 898
 899 /********************************************************************
 900  Query for AD DC by guid. Sitename is obsolete here.
 901 ********************************************************************/
 902
 903 NTSTATUS ads_dns_query_dcs_guid(TALLOC_CTX *ctx,
 904                                 const char *dns_forest_name,
 905                                 const char *domain_guid,
 906                                 struct dns_rr_srv **dclist,
 907                                 int *numdcs )
 908 {
 909         /*_ldap._tcp.DomainGuid.domains._msdcs.DnsForestName */
 910
 911         const char *domains;
 912
 913         /* little hack */
 914         domains = talloc_asprintf(ctx, "%s.domains", domain_guid);
 915         if (!domains) {
 916                 return NT_STATUS_NO_MEMORY;
 917         }
 918
 919         return ads_dns_query_internal(ctx,
 920                                       "_ldap",
 921                                       domains,
 922                                       dns_forest_name,
 923                                       NULL,
 924                                       dclist,
 925                                       numdcs);
 926 }