CVE-2016-2115: s3:winbindd: use lp_client_ipc_{min,max}_protocol()
[samba.git] / source4 / dns_server / dns_update.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    DNS server handler for update requests
5
6    Copyright (C) 2010 Kai Blin  <kai@samba.org>
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
27 #include <ldb.h>
28 #include "param/param.h"
29 #include "param/loadparm.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "smbd/service_task.h"
33 #include "dns_server/dns_server.h"
34 #include "auth/auth.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_DNS
38
39 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
40                              const struct dns_res_rec *rrec,
41                              struct dnsp_DnssrvRpcRecord *r);
42
43 static WERROR check_one_prerequisite(struct dns_server *dns,
44                                      TALLOC_CTX *mem_ctx,
45                                      const struct dns_name_question *zone,
46                                      const struct dns_res_rec *pr,
47                                      bool *final_result)
48 {
49         bool match;
50         WERROR werror;
51         struct ldb_dn *dn;
52         uint16_t i;
53         bool found = false;
54         struct dnsp_DnssrvRpcRecord *rec = NULL;
55         struct dnsp_DnssrvRpcRecord *ans;
56         uint16_t acount;
57
58         size_t host_part_len = 0;
59
60         *final_result = true;
61
62         if (pr->ttl != 0) {
63                 return DNS_ERR(FORMAT_ERROR);
64         }
65
66         match = dns_name_match(zone->name, pr->name, &host_part_len);
67         if (!match) {
68                 return DNS_ERR(NOTZONE);
69         }
70
71         werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
72         W_ERROR_NOT_OK_RETURN(werror);
73
74         if (pr->rr_class == DNS_QCLASS_ANY) {
75
76                 if (pr->length != 0) {
77                         return DNS_ERR(FORMAT_ERROR);
78                 }
79
80
81                 if (pr->rr_type == DNS_QTYPE_ALL) {
82                         /*
83                          */
84                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
85                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
86                                 return DNS_ERR(NAME_ERROR);
87                         }
88                         W_ERROR_NOT_OK_RETURN(werror);
89
90                         if (acount == 0) {
91                                 return DNS_ERR(NAME_ERROR);
92                         }
93                 } else {
94                         /*
95                          */
96                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
97                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
98                                 return DNS_ERR(NXRRSET);
99                         }
100                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
101                                 return DNS_ERR(NXRRSET);
102                         }
103                         W_ERROR_NOT_OK_RETURN(werror);
104
105                         for (i = 0; i < acount; i++) {
106                                 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
107                                         found = true;
108                                         break;
109                                 }
110                         }
111                         if (!found) {
112                                 return DNS_ERR(NXRRSET);
113                         }
114                 }
115
116                 /*
117                  * RFC2136 3.2.5 doesn't actually mention the need to return
118                  * OK here, but otherwise we'd always return a FORMAT_ERROR
119                  * later on. This also matches Microsoft DNS behavior.
120                  */
121                 return WERR_OK;
122         }
123
124         if (pr->rr_class == DNS_QCLASS_NONE) {
125                 if (pr->length != 0) {
126                         return DNS_ERR(FORMAT_ERROR);
127                 }
128
129                 if (pr->rr_type == DNS_QTYPE_ALL) {
130                         /*
131                          */
132                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
133                         if (W_ERROR_EQUAL(werror, WERR_OK)) {
134                                 return DNS_ERR(YXDOMAIN);
135                         }
136                 } else {
137                         /*
138                          */
139                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
140                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
141                                 werror = WERR_OK;
142                         }
143                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
144                                 werror = WERR_OK;
145                         }
146
147                         for (i = 0; i < acount; i++) {
148                                 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
149                                         found = true;
150                                         break;
151                                 }
152                         }
153                         if (found) {
154                                 return DNS_ERR(YXRRSET);
155                         }
156                 }
157
158                 /*
159                  * RFC2136 3.2.5 doesn't actually mention the need to return
160                  * OK here, but otherwise we'd always return a FORMAT_ERROR
161                  * later on. This also matches Microsoft DNS behavior.
162                  */
163                 return WERR_OK;
164         }
165
166         if (pr->rr_class != zone->question_class) {
167                 return DNS_ERR(FORMAT_ERROR);
168         }
169
170         *final_result = false;
171
172         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
173         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
174                 return DNS_ERR(NXRRSET);
175         }
176         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
177                 return DNS_ERR(NXRRSET);
178         }
179         W_ERROR_NOT_OK_RETURN(werror);
180
181         rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
182         W_ERROR_HAVE_NO_MEMORY(rec);
183
184         werror = dns_rr_to_dnsp(rec, pr, rec);
185         W_ERROR_NOT_OK_RETURN(werror);
186
187         for (i = 0; i < acount; i++) {
188                 if (dns_records_match(rec, &ans[i])) {
189                         found = true;
190                         break;
191                 }
192         }
193
194         if (!found) {
195                 return DNS_ERR(NXRRSET);
196         }
197
198         return WERR_OK;
199 }
200
201 static WERROR check_prerequisites(struct dns_server *dns,
202                                   TALLOC_CTX *mem_ctx,
203                                   const struct dns_name_question *zone,
204                                   const struct dns_res_rec *prereqs, uint16_t count)
205 {
206         uint16_t i;
207         WERROR final_error = WERR_OK;
208
209         for (i = 0; i < count; i++) {
210                 bool final;
211                 WERROR werror;
212
213                 werror = check_one_prerequisite(dns, mem_ctx, zone,
214                                                 &prereqs[i], &final);
215                 if (!W_ERROR_IS_OK(werror)) {
216                         if (final) {
217                                 return werror;
218                         }
219                         if (W_ERROR_IS_OK(final_error)) {
220                                 final_error = werror;
221                         }
222                 }
223         }
224
225         if (!W_ERROR_IS_OK(final_error)) {
226                 return final_error;
227         }
228
229         return WERR_OK;
230 }
231
232 static WERROR update_prescan(const struct dns_name_question *zone,
233                              const struct dns_res_rec *updates, uint16_t count)
234 {
235         const struct dns_res_rec *r;
236         uint16_t i;
237         size_t host_part_len;
238         bool match;
239
240         for (i = 0; i < count; i++) {
241                 r = &updates[i];
242                 match = dns_name_match(zone->name, r->name, &host_part_len);
243                 if (!match) {
244                         return DNS_ERR(NOTZONE);
245                 }
246                 if (zone->question_class == r->rr_class) {
247                         if (r->rr_type == DNS_QTYPE_ALL) {
248                                 return DNS_ERR(FORMAT_ERROR);
249                         }
250                         if (r->rr_type == DNS_QTYPE_AXFR) {
251                                 return DNS_ERR(FORMAT_ERROR);
252                         }
253                         if (r->rr_type == DNS_QTYPE_MAILB) {
254                                 return DNS_ERR(FORMAT_ERROR);
255                         }
256                         if (r->rr_type == DNS_QTYPE_MAILA) {
257                                 return DNS_ERR(FORMAT_ERROR);
258                         }
259                 } else if (r->rr_class == DNS_QCLASS_ANY) {
260                         if (r->ttl != 0) {
261                                 return DNS_ERR(FORMAT_ERROR);
262                         }
263                         if (r->length != 0) {
264                                 return DNS_ERR(FORMAT_ERROR);
265                         }
266                         if (r->rr_type == DNS_QTYPE_AXFR) {
267                                 return DNS_ERR(FORMAT_ERROR);
268                         }
269                         if (r->rr_type == DNS_QTYPE_MAILB) {
270                                 return DNS_ERR(FORMAT_ERROR);
271                         }
272                         if (r->rr_type == DNS_QTYPE_MAILA) {
273                                 return DNS_ERR(FORMAT_ERROR);
274                         }
275                 } else if (r->rr_class == DNS_QCLASS_NONE) {
276                         if (r->ttl != 0) {
277                                 return DNS_ERR(FORMAT_ERROR);
278                         }
279                         if (r->rr_type == DNS_QTYPE_ALL) {
280                                 return DNS_ERR(FORMAT_ERROR);
281                         }
282                         if (r->rr_type == DNS_QTYPE_AXFR) {
283                                 return DNS_ERR(FORMAT_ERROR);
284                         }
285                         if (r->rr_type == DNS_QTYPE_MAILB) {
286                                 return DNS_ERR(FORMAT_ERROR);
287                         }
288                         if (r->rr_type == DNS_QTYPE_MAILA) {
289                                 return DNS_ERR(FORMAT_ERROR);
290                         }
291                 } else {
292                         return DNS_ERR(FORMAT_ERROR);
293                 }
294         }
295         return WERR_OK;
296 }
297
298 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
299                              const struct dns_res_rec *rrec,
300                              struct dnsp_DnssrvRpcRecord *r)
301 {
302         enum ndr_err_code ndr_err;
303
304         if (rrec->rr_type == DNS_QTYPE_ALL) {
305                 return DNS_ERR(FORMAT_ERROR);
306         }
307
308         ZERO_STRUCTP(r);
309
310         r->wType = (enum dns_record_type) rrec->rr_type;
311         r->dwTtlSeconds = rrec->ttl;
312         r->rank = DNS_RANK_ZONE;
313
314         /* If we get QCLASS_ANY, we're done here */
315         if (rrec->rr_class == DNS_QCLASS_ANY) {
316                 goto done;
317         }
318
319         switch(rrec->rr_type) {
320         case DNS_QTYPE_A:
321                 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
322                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
323                 break;
324         case DNS_QTYPE_AAAA:
325                 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
326                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
327                 break;
328         case DNS_QTYPE_NS:
329                 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
330                 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
331                 break;
332         case DNS_QTYPE_CNAME:
333                 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
334                 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
335                 break;
336         case DNS_QTYPE_SRV:
337                 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
338                 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
339                 r->data.srv.wPort = rrec->rdata.srv_record.port;
340                 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
341                                 rrec->rdata.srv_record.target);
342                 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
343                 break;
344         case DNS_QTYPE_PTR:
345                 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
346                 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
347                 break;
348         case DNS_QTYPE_MX:
349                 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
350                 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
351                                 rrec->rdata.mx_record.exchange);
352                 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
353                 break;
354         case DNS_QTYPE_TXT:
355                 ndr_err = ndr_dnsp_string_list_copy(mem_ctx,
356                                                     &rrec->rdata.txt_record.txt,
357                                                     &r->data.txt);
358                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
359                         return WERR_NOMEM;
360                 }
361
362                 break;
363         default:
364                 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
365                 return DNS_ERR(NOT_IMPLEMENTED);
366         }
367
368 done:
369
370         return WERR_OK;
371 }
372
373
374 static WERROR handle_one_update(struct dns_server *dns,
375                                 TALLOC_CTX *mem_ctx,
376                                 const struct dns_name_question *zone,
377                                 const struct dns_res_rec *update,
378                                 const struct dns_server_tkey *tkey)
379 {
380         struct dnsp_DnssrvRpcRecord *recs = NULL;
381         uint16_t rcount = 0;
382         struct ldb_dn *dn;
383         uint16_t i;
384         uint16_t first = 0;
385         WERROR werror;
386         bool tombstoned = false;
387         bool needs_add = false;
388
389         DEBUG(2, ("Looking at record: \n"));
390         if (DEBUGLVL(2)) {
391                 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
392         }
393
394         switch (update->rr_type) {
395         case DNS_QTYPE_A:
396         case DNS_QTYPE_NS:
397         case DNS_QTYPE_CNAME:
398         case DNS_QTYPE_SOA:
399         case DNS_QTYPE_PTR:
400         case DNS_QTYPE_MX:
401         case DNS_QTYPE_AAAA:
402         case DNS_QTYPE_SRV:
403         case DNS_QTYPE_TXT:
404                 break;
405         default:
406                 DEBUG(0, ("Can't handle updates of type %u yet\n",
407                           update->rr_type));
408                 return DNS_ERR(NOT_IMPLEMENTED);
409         }
410
411         werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
412         W_ERROR_NOT_OK_RETURN(werror);
413
414         werror = dns_common_lookup(dns->samdb, mem_ctx, dn,
415                                    &recs, &rcount, &tombstoned);
416         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
417                 needs_add = true;
418                 werror = WERR_OK;
419         }
420         W_ERROR_NOT_OK_RETURN(werror);
421
422         if (tombstoned) {
423                 /*
424                  * we need to keep the existing tombstone record
425                  * and ignore it
426                  */
427                 first = rcount;
428         }
429
430         if (update->rr_class == zone->question_class) {
431                 if (update->rr_type == DNS_QTYPE_CNAME) {
432                         /*
433                          * If there is a record in the directory
434                          * that's not a CNAME, ignore update
435                          */
436                         for (i = first; i < rcount; i++) {
437                                 if (recs[i].wType != DNS_TYPE_CNAME) {
438                                         DEBUG(5, ("Skipping update\n"));
439                                         return WERR_OK;
440                                 }
441                                 break;
442                         }
443
444                         /*
445                          * There should be no entries besides one CNAME record
446                          * per name, so replace everything with the new CNAME
447                          */
448
449                         rcount = first;
450                         recs = talloc_realloc(mem_ctx, recs,
451                                         struct dnsp_DnssrvRpcRecord, rcount + 1);
452                         W_ERROR_HAVE_NO_MEMORY(recs);
453
454                         werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
455                         W_ERROR_NOT_OK_RETURN(werror);
456                         rcount += 1;
457
458                         werror = dns_replace_records(dns, mem_ctx, dn,
459                                                      needs_add, recs, rcount);
460                         W_ERROR_NOT_OK_RETURN(werror);
461
462                         return WERR_OK;
463                 } else {
464                         /*
465                          * If there is a CNAME record for this name,
466                          * ignore update
467                          */
468                         for (i = first; i < rcount; i++) {
469                                 if (recs[i].wType == DNS_TYPE_CNAME) {
470                                         DEBUG(5, ("Skipping update\n"));
471                                         return WERR_OK;
472                                 }
473                         }
474                 }
475                 if (update->rr_type == DNS_QTYPE_SOA) {
476                         bool found = false;
477
478                         /*
479                          * If the zone has no SOA record?? or update's
480                          * serial number is smaller than existing SOA's,
481                          * ignore update
482                          */
483                         for (i = first; i < rcount; i++) {
484                                 if (recs[i].wType == DNS_TYPE_SOA) {
485                                         uint16_t n, o;
486
487                                         n = update->rdata.soa_record.serial;
488                                         o = recs[i].data.soa.serial;
489                                         /*
490                                          * TODO: Implement RFC 1982 comparison
491                                          * logic for RFC2136
492                                          */
493                                         if (n <= o) {
494                                                 DEBUG(5, ("Skipping update\n"));
495                                                 return WERR_OK;
496                                         }
497                                         found = true;
498                                         break;
499                                 }
500                         }
501                         if (!found) {
502                                 DEBUG(5, ("Skipping update\n"));
503                                 return WERR_OK;
504                         }
505
506                         werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
507                         W_ERROR_NOT_OK_RETURN(werror);
508
509                         for (i++; i < rcount; i++) {
510                                 if (recs[i].wType != DNS_TYPE_SOA) {
511                                         continue;
512                                 }
513
514                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
515                                         .wType = DNS_TYPE_TOMBSTONE,
516                                 };
517                         }
518
519                         werror = dns_replace_records(dns, mem_ctx, dn,
520                                                      needs_add, recs, rcount);
521                         W_ERROR_NOT_OK_RETURN(werror);
522
523                         return WERR_OK;
524                 }
525
526                 recs = talloc_realloc(mem_ctx, recs,
527                                 struct dnsp_DnssrvRpcRecord, rcount+1);
528                 W_ERROR_HAVE_NO_MEMORY(recs);
529
530                 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
531                 W_ERROR_NOT_OK_RETURN(werror);
532
533                 for (i = first; i < rcount; i++) {
534                         if (!dns_records_match(&recs[i], &recs[rcount])) {
535                                 continue;
536                         }
537
538                         recs[i] = recs[rcount];
539
540                         werror = dns_replace_records(dns, mem_ctx, dn,
541                                                      needs_add, recs, rcount);
542                         W_ERROR_NOT_OK_RETURN(werror);
543
544                         return WERR_OK;
545                 }
546
547                 werror = dns_replace_records(dns, mem_ctx, dn,
548                                              needs_add, recs, rcount+1);
549                 W_ERROR_NOT_OK_RETURN(werror);
550
551                 return WERR_OK;
552         } else if (update->rr_class == DNS_QCLASS_ANY) {
553                 if (update->rr_type == DNS_QTYPE_ALL) {
554                         if (dns_name_equal(update->name, zone->name)) {
555                                 for (i = first; i < rcount; i++) {
556
557                                         if (recs[i].wType == DNS_TYPE_SOA) {
558                                                 continue;
559                                         }
560
561                                         if (recs[i].wType == DNS_TYPE_NS) {
562                                                 continue;
563                                         }
564
565                                         recs[i] = (struct dnsp_DnssrvRpcRecord) {
566                                                 .wType = DNS_TYPE_TOMBSTONE,
567                                         };
568                                 }
569
570                         } else {
571                                 for (i = first; i < rcount; i++) {
572                                         recs[i] = (struct dnsp_DnssrvRpcRecord) {
573                                                 .wType = DNS_TYPE_TOMBSTONE,
574                                         };
575                                 }
576                         }
577
578                 } else if (dns_name_equal(update->name, zone->name)) {
579
580                         if (update->rr_type == DNS_QTYPE_SOA) {
581                                 return WERR_OK;
582                         }
583
584                         if (update->rr_type == DNS_QTYPE_NS) {
585                                 return WERR_OK;
586                         }
587                 }
588                 for (i = first; i < rcount; i++) {
589                         if (recs[i].wType == (enum dns_record_type) update->rr_type) {
590                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
591                                         .wType = DNS_TYPE_TOMBSTONE,
592                                 };
593                         }
594                 }
595
596                 werror = dns_replace_records(dns, mem_ctx, dn,
597                                              needs_add, recs, rcount);
598                 W_ERROR_NOT_OK_RETURN(werror);
599
600                 return WERR_OK;
601         } else if (update->rr_class == DNS_QCLASS_NONE) {
602                 struct dnsp_DnssrvRpcRecord *del_rec;
603
604                 if (update->rr_type == DNS_QTYPE_SOA) {
605                         return WERR_OK;
606                 }
607                 if (update->rr_type == DNS_QTYPE_NS) {
608                         bool found = false;
609                         struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
610                                                 struct dnsp_DnssrvRpcRecord);
611                         W_ERROR_HAVE_NO_MEMORY(ns_rec);
612
613
614                         werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
615                         W_ERROR_NOT_OK_RETURN(werror);
616
617                         for (i = first; i < rcount; i++) {
618                                 if (dns_records_match(ns_rec, &recs[i])) {
619                                         found = true;
620                                         break;
621                                 }
622                         }
623                         if (found) {
624                                 return WERR_OK;
625                         }
626                 }
627
628                 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
629                 W_ERROR_HAVE_NO_MEMORY(del_rec);
630
631                 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
632                 W_ERROR_NOT_OK_RETURN(werror);
633
634                 for (i = first; i < rcount; i++) {
635                         if (dns_records_match(del_rec, &recs[i])) {
636                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
637                                         .wType = DNS_TYPE_TOMBSTONE,
638                                 };
639                         }
640                 }
641
642                 werror = dns_replace_records(dns, mem_ctx, dn,
643                                              needs_add, recs, rcount);
644                 W_ERROR_NOT_OK_RETURN(werror);
645         }
646
647         return WERR_OK;
648 }
649
650 static WERROR handle_updates(struct dns_server *dns,
651                              TALLOC_CTX *mem_ctx,
652                              const struct dns_name_question *zone,
653                              const struct dns_res_rec *prereqs, uint16_t pcount,
654                              struct dns_res_rec *updates, uint16_t upd_count,
655                              struct dns_server_tkey *tkey)
656 {
657         struct ldb_dn *zone_dn = NULL;
658         WERROR werror = WERR_OK;
659         int ret;
660         uint16_t ri;
661         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
662
663         if (tkey != NULL) {
664                 ret = ldb_set_opaque(dns->samdb, "sessionInfo", tkey->session_info);
665                 if (ret != LDB_SUCCESS) {
666                         DEBUG(1, ("unable to set session info\n"));
667                         werror = DNS_ERR(SERVER_FAILURE);
668                         goto failed;
669                 }
670         }
671
672         werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
673         W_ERROR_NOT_OK_GOTO(werror, failed);
674
675         ret = ldb_transaction_start(dns->samdb);
676         if (ret != LDB_SUCCESS) {
677                 werror = DNS_ERR(SERVER_FAILURE);
678                 goto failed;
679         }
680
681         werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
682         W_ERROR_NOT_OK_GOTO(werror, failed);
683
684         DEBUG(1, ("update count is %u\n", upd_count));
685
686         for (ri = 0; ri < upd_count; ri++) {
687                 werror = handle_one_update(dns, tmp_ctx, zone,
688                                            &updates[ri], tkey);
689                 W_ERROR_NOT_OK_GOTO(werror, failed);
690         }
691
692         ldb_transaction_commit(dns->samdb);
693         TALLOC_FREE(tmp_ctx);
694
695         if (tkey != NULL) {
696                 ldb_set_opaque(dns->samdb, "sessionInfo",
697                                system_session(dns->task->lp_ctx));
698         }
699
700         return WERR_OK;
701
702 failed:
703         ldb_transaction_cancel(dns->samdb);
704
705         if (tkey != NULL) {
706                 ldb_set_opaque(dns->samdb, "sessionInfo",
707                                system_session(dns->task->lp_ctx));
708         }
709
710         TALLOC_FREE(tmp_ctx);
711         return werror;
712
713 }
714
715 static WERROR dns_update_allowed(struct dns_server *dns,
716                                  const struct dns_request_state *state,
717                                  struct dns_server_tkey **tkey)
718 {
719         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
720                 DEBUG(2, ("All updates allowed.\n"));
721                 return WERR_OK;
722         }
723
724         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
725                 DEBUG(2, ("Updates disabled.\n"));
726                 return DNS_ERR(REFUSED);
727         }
728
729         if (state->authenticated == false ) {
730                 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
731                 return DNS_ERR(REFUSED);
732         }
733
734         *tkey = dns_find_tkey(dns->tkeys, state->key_name);
735         if (*tkey == NULL) {
736                 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
737                 return DNS_ERR(REFUSED);
738         }
739
740         return WERR_OK;
741 }
742
743
744 WERROR dns_server_process_update(struct dns_server *dns,
745                                  const struct dns_request_state *state,
746                                  TALLOC_CTX *mem_ctx,
747                                  const struct dns_name_packet *in,
748                                  struct dns_res_rec **prereqs,    uint16_t *prereq_count,
749                                  struct dns_res_rec **updates,    uint16_t *update_count,
750                                  struct dns_res_rec **additional, uint16_t *arcount)
751 {
752         struct dns_name_question *zone;
753         const struct dns_server_zone *z;
754         size_t host_part_len = 0;
755         WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
756         struct dns_server_tkey *tkey = NULL;
757
758         if (in->qdcount != 1) {
759                 return DNS_ERR(FORMAT_ERROR);
760         }
761
762         zone = &in->questions[0];
763
764         if (zone->question_class != DNS_QCLASS_IN &&
765             zone->question_class != DNS_QCLASS_ANY) {
766                 return DNS_ERR(NOT_IMPLEMENTED);
767         }
768
769         if (zone->question_type != DNS_QTYPE_SOA) {
770                 return DNS_ERR(FORMAT_ERROR);
771         }
772
773         DEBUG(2, ("Got a dns update request.\n"));
774
775         for (z = dns->zones; z != NULL; z = z->next) {
776                 bool match;
777
778                 match = dns_name_match(z->name, zone->name, &host_part_len);
779                 if (match) {
780                         break;
781                 }
782         }
783
784         if (z == NULL) {
785                 DEBUG(1, ("We're not authoritative for this zone\n"));
786                 return DNS_ERR(NOTAUTH);
787         }
788
789         if (host_part_len != 0) {
790                 /* TODO: We need to delegate this one */
791                 DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
792                 return DNS_ERR(NOT_IMPLEMENTED);
793         }
794
795         *prereq_count = in->ancount;
796         *prereqs = in->answers;
797         werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
798                                      *prereq_count);
799         W_ERROR_NOT_OK_RETURN(werror);
800
801         werror = dns_update_allowed(dns, state, &tkey);
802         if (!W_ERROR_IS_OK(werror)) {
803                 return werror;
804         }
805
806         *update_count = in->nscount;
807         *updates = in->nsrecs;
808         werror = update_prescan(in->questions, *updates, *update_count);
809         W_ERROR_NOT_OK_RETURN(werror);
810
811         werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
812                                 *prereq_count, *updates, *update_count, tkey);
813         W_ERROR_NOT_OK_RETURN(werror);
814
815         return werror;
816 }