2 Unix SMB/CIFS implementation.
4 DNS server handler for update requests
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
28 #include "param/param.h"
29 #include "dsdb/samdb/samdb.h"
30 #include "dsdb/common/util.h"
31 #include "smbd/service_task.h"
32 #include "dns_server/dns_server.h"
33 #include "dns_server/dns_update.h"
35 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
36 const struct dns_res_rec *rrec,
37 struct dnsp_DnssrvRpcRecord *r);
39 static WERROR check_one_prerequisite(struct dns_server *dns,
41 const struct dns_name_question *zone,
42 const struct dns_res_rec *pr,
50 struct dnsp_DnssrvRpcRecord *rec = NULL;
51 struct dnsp_DnssrvRpcRecord *ans;
54 size_t host_part_len = 0;
59 return DNS_ERR(FORMAT_ERROR);
62 match = dns_name_match(zone->name, pr->name, &host_part_len);
64 return DNS_ERR(NOTZONE);
67 werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
68 W_ERROR_NOT_OK_RETURN(werror);
70 if (pr->rr_class == DNS_QCLASS_ANY) {
72 if (pr->length != 0) {
73 return DNS_ERR(FORMAT_ERROR);
77 if (pr->rr_type == DNS_QTYPE_ALL) {
80 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
81 W_ERROR_NOT_OK_RETURN(werror);
84 return DNS_ERR(NAME_ERROR);
89 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
90 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
91 return DNS_ERR(NXRRSET);
93 W_ERROR_NOT_OK_RETURN(werror);
95 for (i = 0; i < acount; i++) {
96 if (ans[i].wType == pr->rr_type) {
102 return DNS_ERR(NXRRSET);
107 * RFC2136 3.2.5 doesn't actually mention the need to return
108 * OK here, but otherwise we'd always return a FORMAT_ERROR
109 * later on. This also matches Microsoft DNS behavior.
114 if (pr->rr_class == DNS_QCLASS_NONE) {
115 if (pr->length != 0) {
116 return DNS_ERR(FORMAT_ERROR);
119 if (pr->rr_type == DNS_QTYPE_ALL) {
122 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
123 if (W_ERROR_EQUAL(werror, WERR_OK)) {
124 return DNS_ERR(YXDOMAIN);
129 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
130 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
136 for (i = 0; i < acount; i++) {
137 if (ans[i].wType == pr->rr_type) {
143 return DNS_ERR(YXRRSET);
148 * RFC2136 3.2.5 doesn't actually mention the need to return
149 * OK here, but otherwise we'd always return a FORMAT_ERROR
150 * later on. This also matches Microsoft DNS behavior.
155 if (pr->rr_class != zone->question_class) {
156 return DNS_ERR(FORMAT_ERROR);
159 *final_result = false;
161 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
162 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
163 return DNS_ERR(NXRRSET);
165 W_ERROR_NOT_OK_RETURN(werror);
167 rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
168 W_ERROR_HAVE_NO_MEMORY(rec);
170 werror = dns_rr_to_dnsp(rec, pr, rec);
171 W_ERROR_NOT_OK_RETURN(werror);
173 for (i = 0; i < acount; i++) {
174 if (dns_records_match(rec, &ans[i])) {
181 return DNS_ERR(NXRRSET);
187 static WERROR check_prerequisites(struct dns_server *dns,
189 const struct dns_name_question *zone,
190 const struct dns_res_rec *prereqs, uint16_t count)
193 WERROR final_error = WERR_OK;
195 for (i = 0; i < count; i++) {
199 werror = check_one_prerequisite(dns, mem_ctx, zone,
200 &prereqs[i], &final);
201 if (!W_ERROR_IS_OK(werror)) {
205 if (W_ERROR_IS_OK(final_error)) {
206 final_error = werror;
211 if (!W_ERROR_IS_OK(final_error)) {
218 static WERROR update_prescan(const struct dns_name_question *zone,
219 const struct dns_res_rec *updates, uint16_t count)
221 const struct dns_res_rec *r;
223 size_t host_part_len;
226 for (i = 0; i < count; i++) {
228 match = dns_name_match(zone->name, r->name, &host_part_len);
230 return DNS_ERR(NOTZONE);
232 if (zone->question_class == r->rr_class) {
233 if (r->rr_type == DNS_QTYPE_ALL) {
234 return DNS_ERR(FORMAT_ERROR);
236 if (r->rr_type == DNS_QTYPE_AXFR) {
237 return DNS_ERR(FORMAT_ERROR);
239 if (r->rr_type == DNS_QTYPE_MAILB) {
240 return DNS_ERR(FORMAT_ERROR);
242 if (r->rr_type == DNS_QTYPE_MAILA) {
243 return DNS_ERR(FORMAT_ERROR);
245 } else if (r->rr_class == DNS_QCLASS_ANY) {
247 return DNS_ERR(FORMAT_ERROR);
249 if (r->length != 0) {
250 return DNS_ERR(FORMAT_ERROR);
252 if (r->rr_type == DNS_QTYPE_AXFR) {
253 return DNS_ERR(FORMAT_ERROR);
255 if (r->rr_type == DNS_QTYPE_MAILB) {
256 return DNS_ERR(FORMAT_ERROR);
258 if (r->rr_type == DNS_QTYPE_MAILA) {
259 return DNS_ERR(FORMAT_ERROR);
261 } else if (r->rr_class == DNS_QCLASS_NONE) {
263 return DNS_ERR(FORMAT_ERROR);
265 if (r->rr_type == DNS_QTYPE_ALL) {
266 return DNS_ERR(FORMAT_ERROR);
268 if (r->rr_type == DNS_QTYPE_AXFR) {
269 return DNS_ERR(FORMAT_ERROR);
271 if (r->rr_type == DNS_QTYPE_MAILB) {
272 return DNS_ERR(FORMAT_ERROR);
274 if (r->rr_type == DNS_QTYPE_MAILA) {
275 return DNS_ERR(FORMAT_ERROR);
278 return DNS_ERR(FORMAT_ERROR);
284 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
285 const struct dns_res_rec *rrec,
286 struct dnsp_DnssrvRpcRecord *r)
289 char *txt_record_txt;
290 char *saveptr = NULL;
292 if (rrec->rr_type == DNS_QTYPE_ALL) {
293 return DNS_ERR(FORMAT_ERROR);
298 r->wType = rrec->rr_type;
299 r->dwTtlSeconds = rrec->ttl;
300 r->rank = DNS_RANK_ZONE;
301 /* TODO: Autogenerate this somehow */
304 /* If we get QCLASS_ANY, we're done here */
305 if (rrec->rr_class == DNS_QCLASS_ANY) {
309 switch(rrec->rr_type) {
311 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
312 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
315 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
316 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
319 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
320 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
322 case DNS_QTYPE_CNAME:
323 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
324 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
327 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
328 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
329 r->data.srv.wPort = rrec->rdata.srv_record.port;
330 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
331 rrec->rdata.srv_record.target);
332 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
335 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
336 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
337 rrec->rdata.mx_record.exchange);
338 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
341 r->data.txt.count = 0;
342 r->data.txt.str = talloc_array(mem_ctx, const char *,
344 W_ERROR_HAVE_NO_MEMORY(r->data.txt.str);
346 txt_record_txt = talloc_strdup(r->data.txt.str,
347 rrec->rdata.txt_record.txt);
348 W_ERROR_HAVE_NO_MEMORY(txt_record_txt);
350 tmp = strtok_r(txt_record_txt, "\"", &saveptr);
352 if (strcmp(tmp, " ") == 0) {
353 tmp = strtok_r(NULL, "\"", &saveptr);
356 r->data.txt.str = talloc_realloc(mem_ctx, r->data.txt.str, const char *,
357 r->data.txt.count+1);
358 r->data.txt.str[r->data.txt.count] = talloc_strdup(r->data.txt.str, tmp);
359 W_ERROR_HAVE_NO_MEMORY(r->data.txt.str[r->data.txt.count]);
362 tmp = strtok_r(NULL, "\"", &saveptr);
367 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
368 return DNS_ERR(NOT_IMPLEMENTED);
377 static WERROR handle_one_update(struct dns_server *dns,
379 const struct dns_name_question *zone,
380 const struct dns_res_rec *update)
382 struct dnsp_DnssrvRpcRecord *recs = NULL;
387 bool needs_add = false;
389 DEBUG(2, ("Looking at record: \n"));
391 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
394 switch (update->rr_type) {
399 case DNS_QTYPE_CNAME:
414 DEBUG(0, ("Can't handle updates of type %u yet\n",
416 return DNS_ERR(NOT_IMPLEMENTED);
419 werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
420 W_ERROR_NOT_OK_RETURN(werror);
422 werror = dns_lookup_records(dns, mem_ctx, dn, &recs, &rcount);
423 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
429 W_ERROR_NOT_OK_RETURN(werror);
431 if (update->rr_class == zone->question_class) {
432 if (update->rr_type == DNS_QTYPE_CNAME) {
434 * If there is a record in the directory
435 * that's not a CNAME, ignore update
437 for (i = 0; i < rcount; i++) {
438 if (recs[i].wType != DNS_TYPE_CNAME) {
439 DEBUG(0, ("Skipping update\n"));
446 * There should be no entries besides one CNAME record
447 * per name, so replace everything with the new CNAME
451 recs = talloc_realloc(mem_ctx, recs,
452 struct dnsp_DnssrvRpcRecord, rcount);
453 W_ERROR_HAVE_NO_MEMORY(recs);
455 werror = dns_rr_to_dnsp(recs, update, &recs[0]);
456 W_ERROR_NOT_OK_RETURN(werror);
458 werror = dns_replace_records(dns, mem_ctx, dn,
459 needs_add, recs, rcount);
460 W_ERROR_NOT_OK_RETURN(werror);
465 * If there is a CNAME record for this name,
468 for (i = 0; i < rcount; i++) {
469 if (recs[i].wType == DNS_TYPE_CNAME) {
470 DEBUG(0, ("Skipping update\n"));
475 if (update->rr_type == DNS_QTYPE_SOA) {
479 * If the zone has no SOA record?? or update's
480 * serial number is smaller than existing SOA's,
483 for (i = 0; i < rcount; i++) {
484 if (recs[i].wType == DNS_TYPE_SOA) {
487 n = update->rdata.soa_record.serial;
488 o = recs[i].data.soa.serial;
490 * TODO: Implement RFC 1982 comparison
494 DEBUG(0, ("Skipping update\n"));
502 DEBUG(0, ("Skipping update\n"));
506 werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
507 W_ERROR_NOT_OK_RETURN(werror);
509 for (i++; i < rcount; i++) {
510 if (recs[i].wType != DNS_TYPE_SOA) {
514 ZERO_STRUCT(recs[i]);
517 werror = dns_replace_records(dns, mem_ctx, dn,
518 needs_add, recs, rcount);
519 W_ERROR_NOT_OK_RETURN(werror);
524 recs = talloc_realloc(mem_ctx, recs,
525 struct dnsp_DnssrvRpcRecord, rcount+1);
526 W_ERROR_HAVE_NO_MEMORY(recs);
528 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
529 W_ERROR_NOT_OK_RETURN(werror);
531 for (i = 0; i < rcount; i++) {
532 if (!dns_records_match(&recs[i], &recs[rcount])) {
536 recs[i] = recs[rcount];
538 werror = dns_replace_records(dns, mem_ctx, dn,
539 needs_add, recs, rcount);
540 W_ERROR_NOT_OK_RETURN(werror);
545 werror = dns_replace_records(dns, mem_ctx, dn,
546 needs_add, recs, rcount+1);
547 W_ERROR_NOT_OK_RETURN(werror);
550 } else if (update->rr_class == DNS_QCLASS_ANY) {
551 if (update->rr_type == DNS_QTYPE_ALL) {
552 if (dns_name_equal(update->name, zone->name)) {
553 for (i = 0; i < rcount; i++) {
555 if (recs[i].wType == DNS_TYPE_SOA) {
559 if (recs[i].wType == DNS_TYPE_NS) {
563 ZERO_STRUCT(recs[i]);
567 for (i = 0; i < rcount; i++) {
568 ZERO_STRUCT(recs[i]);
572 } else if (dns_name_equal(update->name, zone->name)) {
574 if (update->rr_type == DNS_QTYPE_SOA) {
578 if (update->rr_type == DNS_QTYPE_NS) {
582 for (i = 0; i < rcount; i++) {
583 if (recs[i].wType == update->rr_type) {
584 ZERO_STRUCT(recs[i]);
588 werror = dns_replace_records(dns, mem_ctx, dn,
589 needs_add, recs, rcount);
590 W_ERROR_NOT_OK_RETURN(werror);
593 } else if (update->rr_class == DNS_QCLASS_NONE) {
594 struct dnsp_DnssrvRpcRecord *del_rec;
596 if (update->rr_type == DNS_QTYPE_SOA) {
599 if (update->rr_type == DNS_QTYPE_NS) {
601 struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
602 struct dnsp_DnssrvRpcRecord);
603 W_ERROR_HAVE_NO_MEMORY(ns_rec);
606 werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
607 W_ERROR_NOT_OK_RETURN(werror);
609 for (i = 0; i < rcount; i++) {
610 if (dns_records_match(ns_rec, &recs[i])) {
620 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
621 W_ERROR_HAVE_NO_MEMORY(del_rec);
623 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
624 W_ERROR_NOT_OK_RETURN(werror);
626 for (i = 0; i < rcount; i++) {
627 if (dns_records_match(del_rec, &recs[i])) {
628 ZERO_STRUCT(recs[i]);
636 static WERROR handle_updates(struct dns_server *dns,
638 const struct dns_name_question *zone,
639 const struct dns_res_rec *prereqs, uint16_t pcount,
640 struct dns_res_rec *updates, uint16_t upd_count)
642 struct ldb_dn *zone_dn = NULL;
643 WERROR werror = WERR_OK;
646 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
648 werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
649 W_ERROR_NOT_OK_RETURN(werror);
651 ret = ldb_transaction_start(dns->samdb);
652 if (ret != LDB_SUCCESS) {
653 return DNS_ERR(SERVER_FAILURE);
656 werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
657 W_ERROR_NOT_OK_GOTO(werror, failed);
659 DEBUG(0, ("update count is %u\n", upd_count));
661 for (ri = 0; ri < upd_count; ri++) {
662 werror = handle_one_update(dns, tmp_ctx, zone,
664 W_ERROR_NOT_OK_GOTO(werror, failed);
667 ldb_transaction_commit(dns->samdb);
668 TALLOC_FREE(tmp_ctx);
672 ldb_transaction_cancel(dns->samdb);
673 TALLOC_FREE(tmp_ctx);
678 WERROR dns_server_process_update(struct dns_server *dns,
680 struct dns_name_packet *in,
681 struct dns_res_rec **prereqs, uint16_t *prereq_count,
682 struct dns_res_rec **updates, uint16_t *update_count,
683 struct dns_res_rec **additional, uint16_t *arcount)
685 struct dns_name_question *zone;
686 const struct dns_server_zone *z;
687 size_t host_part_len = 0;
688 WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
690 if (in->qdcount != 1) {
691 return DNS_ERR(FORMAT_ERROR);
694 zone = &in->questions[0];
696 if (zone->question_class != DNS_QCLASS_IN &&
697 zone->question_class != DNS_QCLASS_ANY) {
698 return DNS_ERR(NOT_IMPLEMENTED);
701 if (zone->question_type != DNS_QTYPE_SOA) {
702 return DNS_ERR(FORMAT_ERROR);
705 DEBUG(2, ("Got a dns update request.\n"));
707 for (z = dns->zones; z != NULL; z = z->next) {
710 match = dns_name_match(z->name, zone->name, &host_part_len);
717 DEBUG(0, ("We're not authorative for this zone\n"));
718 return DNS_ERR(NOTAUTH);
721 if (host_part_len != 0) {
722 /* TODO: We need to delegate this one */
723 DEBUG(0, ("Would have to delegate zones.\n"));
724 return DNS_ERR(NOT_IMPLEMENTED);
727 *prereq_count = in->ancount;
728 *prereqs = in->answers;
729 werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
731 W_ERROR_NOT_OK_RETURN(werror);
733 /* TODO: Check if update is allowed, we probably want "always",
734 * key-based GSSAPI, key-based bind-style TSIG and "never" as
735 * smb.conf options. */
736 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) != DNS_UPDATE_ON) {
737 DEBUG(0, ("Update not allowed.\n"));
738 return DNS_ERR(REFUSED);
741 *update_count = in->nscount;
742 *updates = in->nsrecs;
743 werror = update_prescan(in->questions, *updates, *update_count);
744 W_ERROR_NOT_OK_RETURN(werror);
747 werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
748 *prereq_count, *updates, *update_count);
749 W_ERROR_NOT_OK_RETURN(werror);