source4/dns_server/dns_update.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DNS server handler for update requests
   5
   6    Copyright (C) 2010 Kai Blin  <kai@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/util/ntstatus.h"
  24 #include "librpc/ndr/libndr.h"
  25 #include "librpc/gen_ndr/ndr_dns.h"
  26 #include "librpc/gen_ndr/ndr_dnsp.h"
  27 #include <ldb.h>
  28 #include "param/param.h"
  29 #include "param/loadparm.h"
  30 #include "dsdb/samdb/samdb.h"
  31 #include "dsdb/common/util.h"
  32 #include "smbd/service_task.h"
  33 #include "dns_server/dns_server.h"
  34 #include "auth/auth.h"
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_DNS
  38
  39 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
  40                              const struct dns_res_rec *rrec,
  41                              struct dnsp_DnssrvRpcRecord *r);
  42
  43 static WERROR check_one_prerequisite(struct dns_server *dns,
  44                                      TALLOC_CTX *mem_ctx,
  45                                      const struct dns_name_question *zone,
  46                                      const struct dns_res_rec *pr,
  47                                      bool *final_result)
  48 {
  49         bool match;
  50         WERROR werror;
  51         struct ldb_dn *dn;
  52         uint16_t i;
  53         bool found = false;
  54         struct dnsp_DnssrvRpcRecord *rec = NULL;
  55         struct dnsp_DnssrvRpcRecord *ans;
  56         uint16_t acount;
  57
  58         size_t host_part_len = 0;
  59
  60         *final_result = true;
  61
  62         if (pr->ttl != 0) {
  63                 return DNS_ERR(FORMAT_ERROR);
  64         }
  65
  66         match = dns_name_match(zone->name, pr->name, &host_part_len);
  67         if (!match) {
  68                 return DNS_ERR(NOTZONE);
  69         }
  70
  71         werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
  72         W_ERROR_NOT_OK_RETURN(werror);
  73
  74         if (pr->rr_class == DNS_QCLASS_ANY) {
  75
  76                 if (pr->length != 0) {
  77                         return DNS_ERR(FORMAT_ERROR);
  78                 }
  79
  80
  81                 if (pr->rr_type == DNS_QTYPE_ALL) {
  82                         /*
  83                          */
  84                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
  85                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
  86                                 return DNS_ERR(NAME_ERROR);
  87                         }
  88                         W_ERROR_NOT_OK_RETURN(werror);
  89
  90                         if (acount == 0) {
  91                                 return DNS_ERR(NAME_ERROR);
  92                         }
  93                 } else {
  94                         /*
  95                          */
  96                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
  97                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
  98                                 return DNS_ERR(NXRRSET);
  99                         }
 100                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 101                                 return DNS_ERR(NXRRSET);
 102                         }
 103                         W_ERROR_NOT_OK_RETURN(werror);
 104
 105                         for (i = 0; i < acount; i++) {
 106                                 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
 107                                         found = true;
 108                                         break;
 109                                 }
 110                         }
 111                         if (!found) {
 112                                 return DNS_ERR(NXRRSET);
 113                         }
 114                 }
 115
 116                 /*
 117                  * RFC2136 3.2.5 doesn't actually mention the need to return
 118                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 119                  * later on. This also matches Microsoft DNS behavior.
 120                  */
 121                 return WERR_OK;
 122         }
 123
 124         if (pr->rr_class == DNS_QCLASS_NONE) {
 125                 if (pr->length != 0) {
 126                         return DNS_ERR(FORMAT_ERROR);
 127                 }
 128
 129                 if (pr->rr_type == DNS_QTYPE_ALL) {
 130                         /*
 131                          */
 132                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 133                         if (W_ERROR_EQUAL(werror, WERR_OK)) {
 134                                 return DNS_ERR(YXDOMAIN);
 135                         }
 136                 } else {
 137                         /*
 138                          */
 139                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 140                         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
 141                                 werror = WERR_OK;
 142                         }
 143                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 144                                 werror = WERR_OK;
 145                         }
 146
 147                         for (i = 0; i < acount; i++) {
 148                                 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
 149                                         found = true;
 150                                         break;
 151                                 }
 152                         }
 153                         if (found) {
 154                                 return DNS_ERR(YXRRSET);
 155                         }
 156                 }
 157
 158                 /*
 159                  * RFC2136 3.2.5 doesn't actually mention the need to return
 160                  * OK here, but otherwise we'd always return a FORMAT_ERROR
 161                  * later on. This also matches Microsoft DNS behavior.
 162                  */
 163                 return WERR_OK;
 164         }
 165
 166         if (pr->rr_class != zone->question_class) {
 167                 return DNS_ERR(FORMAT_ERROR);
 168         }
 169
 170         *final_result = false;
 171
 172         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
 173         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
 174                 return DNS_ERR(NXRRSET);
 175         }
 176         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
 177                 return DNS_ERR(NXRRSET);
 178         }
 179         W_ERROR_NOT_OK_RETURN(werror);
 180
 181         rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
 182         W_ERROR_HAVE_NO_MEMORY(rec);
 183
 184         werror = dns_rr_to_dnsp(rec, pr, rec);
 185         W_ERROR_NOT_OK_RETURN(werror);
 186
 187         for (i = 0; i < acount; i++) {
 188                 if (dns_records_match(rec, &ans[i])) {
 189                         found = true;
 190                         break;
 191                 }
 192         }
 193
 194         if (!found) {
 195                 return DNS_ERR(NXRRSET);
 196         }
 197
 198         return WERR_OK;
 199 }
 200
 201 static WERROR check_prerequisites(struct dns_server *dns,
 202                                   TALLOC_CTX *mem_ctx,
 203                                   const struct dns_name_question *zone,
 204                                   const struct dns_res_rec *prereqs, uint16_t count)
 205 {
 206         uint16_t i;
 207         WERROR final_error = WERR_OK;
 208
 209         for (i = 0; i < count; i++) {
 210                 bool final;
 211                 WERROR werror;
 212
 213                 werror = check_one_prerequisite(dns, mem_ctx, zone,
 214                                                 &prereqs[i], &final);
 215                 if (!W_ERROR_IS_OK(werror)) {
 216                         if (final) {
 217                                 return werror;
 218                         }
 219                         if (W_ERROR_IS_OK(final_error)) {
 220                                 final_error = werror;
 221                         }
 222                 }
 223         }
 224
 225         if (!W_ERROR_IS_OK(final_error)) {
 226                 return final_error;
 227         }
 228
 229         return WERR_OK;
 230 }
 231
 232 static WERROR update_prescan(const struct dns_name_question *zone,
 233                              const struct dns_res_rec *updates, uint16_t count)
 234 {
 235         const struct dns_res_rec *r;
 236         uint16_t i;
 237         size_t host_part_len;
 238         bool match;
 239
 240         for (i = 0; i < count; i++) {
 241                 r = &updates[i];
 242                 match = dns_name_match(zone->name, r->name, &host_part_len);
 243                 if (!match) {
 244                         return DNS_ERR(NOTZONE);
 245                 }
 246                 if (zone->question_class == r->rr_class) {
 247                         if (r->rr_type == DNS_QTYPE_ALL) {
 248                                 return DNS_ERR(FORMAT_ERROR);
 249                         }
 250                         if (r->rr_type == DNS_QTYPE_AXFR) {
 251                                 return DNS_ERR(FORMAT_ERROR);
 252                         }
 253                         if (r->rr_type == DNS_QTYPE_MAILB) {
 254                                 return DNS_ERR(FORMAT_ERROR);
 255                         }
 256                         if (r->rr_type == DNS_QTYPE_MAILA) {
 257                                 return DNS_ERR(FORMAT_ERROR);
 258                         }
 259                 } else if (r->rr_class == DNS_QCLASS_ANY) {
 260                         if (r->ttl != 0) {
 261                                 return DNS_ERR(FORMAT_ERROR);
 262                         }
 263                         if (r->length != 0) {
 264                                 return DNS_ERR(FORMAT_ERROR);
 265                         }
 266                         if (r->rr_type == DNS_QTYPE_AXFR) {
 267                                 return DNS_ERR(FORMAT_ERROR);
 268                         }
 269                         if (r->rr_type == DNS_QTYPE_MAILB) {
 270                                 return DNS_ERR(FORMAT_ERROR);
 271                         }
 272                         if (r->rr_type == DNS_QTYPE_MAILA) {
 273                                 return DNS_ERR(FORMAT_ERROR);
 274                         }
 275                 } else if (r->rr_class == DNS_QCLASS_NONE) {
 276                         if (r->ttl != 0) {
 277                                 return DNS_ERR(FORMAT_ERROR);
 278                         }
 279                         if (r->rr_type == DNS_QTYPE_ALL) {
 280                                 return DNS_ERR(FORMAT_ERROR);
 281                         }
 282                         if (r->rr_type == DNS_QTYPE_AXFR) {
 283                                 return DNS_ERR(FORMAT_ERROR);
 284                         }
 285                         if (r->rr_type == DNS_QTYPE_MAILB) {
 286                                 return DNS_ERR(FORMAT_ERROR);
 287                         }
 288                         if (r->rr_type == DNS_QTYPE_MAILA) {
 289                                 return DNS_ERR(FORMAT_ERROR);
 290                         }
 291                 } else {
 292                         return DNS_ERR(FORMAT_ERROR);
 293                 }
 294         }
 295         return WERR_OK;
 296 }
 297
 298 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
 299                              const struct dns_res_rec *rrec,
 300                              struct dnsp_DnssrvRpcRecord *r)
 301 {
 302         char *tmp;
 303         char *txt_record_txt;
 304         char *saveptr = NULL;
 305
 306         if (rrec->rr_type == DNS_QTYPE_ALL) {
 307                 return DNS_ERR(FORMAT_ERROR);
 308         }
 309
 310         ZERO_STRUCTP(r);
 311
 312         r->wType = (enum dns_record_type) rrec->rr_type;
 313         r->dwTtlSeconds = rrec->ttl;
 314         r->rank = DNS_RANK_ZONE;
 315
 316         /* If we get QCLASS_ANY, we're done here */
 317         if (rrec->rr_class == DNS_QCLASS_ANY) {
 318                 goto done;
 319         }
 320
 321         switch(rrec->rr_type) {
 322         case DNS_QTYPE_A:
 323                 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
 324                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
 325                 break;
 326         case DNS_QTYPE_AAAA:
 327                 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
 328                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
 329                 break;
 330         case DNS_QTYPE_NS:
 331                 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
 332                 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
 333                 break;
 334         case DNS_QTYPE_CNAME:
 335                 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
 336                 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
 337                 break;
 338         case DNS_QTYPE_SRV:
 339                 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
 340                 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
 341                 r->data.srv.wPort = rrec->rdata.srv_record.port;
 342                 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
 343                                 rrec->rdata.srv_record.target);
 344                 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
 345                 break;
 346         case DNS_QTYPE_PTR:
 347                 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
 348                 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
 349                 break;
 350         case DNS_QTYPE_MX:
 351                 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
 352                 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
 353                                 rrec->rdata.mx_record.exchange);
 354                 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
 355                 break;
 356         case DNS_QTYPE_TXT:
 357                 r->data.txt.count = 0;
 358                 r->data.txt.str = talloc_array(mem_ctx, const char *,
 359                                                r->data.txt.count);
 360                 W_ERROR_HAVE_NO_MEMORY(r->data.txt.str);
 361
 362                 txt_record_txt = talloc_strdup(r->data.txt.str,
 363                                                rrec->rdata.txt_record.txt);
 364                 W_ERROR_HAVE_NO_MEMORY(txt_record_txt);
 365
 366                 tmp = strtok_r(txt_record_txt, "\"", &saveptr);
 367                 while (tmp) {
 368                         if (strcmp(tmp, " ") == 0) {
 369                                 tmp = strtok_r(NULL, "\"", &saveptr);
 370                                 continue;
 371                         }
 372                         r->data.txt.str = talloc_realloc(mem_ctx, r->data.txt.str, const char *,
 373                                                         r->data.txt.count+1);
 374                         r->data.txt.str[r->data.txt.count] = talloc_strdup(r->data.txt.str, tmp);
 375                         W_ERROR_HAVE_NO_MEMORY(r->data.txt.str[r->data.txt.count]);
 376
 377                         r->data.txt.count++;
 378                         tmp = strtok_r(NULL, "\"", &saveptr);
 379                 }
 380
 381                 break;
 382         default:
 383                 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
 384                 return DNS_ERR(NOT_IMPLEMENTED);
 385         }
 386
 387 done:
 388
 389         return WERR_OK;
 390 }
 391
 392
 393 static WERROR handle_one_update(struct dns_server *dns,
 394                                 TALLOC_CTX *mem_ctx,
 395                                 const struct dns_name_question *zone,
 396                                 const struct dns_res_rec *update,
 397                                 const struct dns_server_tkey *tkey)
 398 {
 399         struct dnsp_DnssrvRpcRecord *recs = NULL;
 400         uint16_t rcount = 0;
 401         struct ldb_dn *dn;
 402         uint16_t i;
 403         uint16_t first = 0;
 404         WERROR werror;
 405         bool tombstoned = false;
 406         bool needs_add = false;
 407
 408         DEBUG(2, ("Looking at record: \n"));
 409         if (DEBUGLVL(2)) {
 410                 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
 411         }
 412
 413         switch (update->rr_type) {
 414         case DNS_QTYPE_A:
 415         case DNS_QTYPE_NS:
 416         case DNS_QTYPE_CNAME:
 417         case DNS_QTYPE_SOA:
 418         case DNS_QTYPE_PTR:
 419         case DNS_QTYPE_MX:
 420         case DNS_QTYPE_AAAA:
 421         case DNS_QTYPE_SRV:
 422         case DNS_QTYPE_TXT:
 423                 break;
 424         default:
 425                 DEBUG(0, ("Can't handle updates of type %u yet\n",
 426                           update->rr_type));
 427                 return DNS_ERR(NOT_IMPLEMENTED);
 428         }
 429
 430         werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
 431         W_ERROR_NOT_OK_RETURN(werror);
 432
 433         werror = dns_common_lookup(dns->samdb, mem_ctx, dn,
 434                                    &recs, &rcount, &tombstoned);
 435         if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
 436                 needs_add = true;
 437                 werror = WERR_OK;
 438         }
 439         W_ERROR_NOT_OK_RETURN(werror);
 440
 441         if (tombstoned) {
 442                 /*
 443                  * we need to keep the existing tombstone record
 444                  * and ignore it
 445                  */
 446                 first = rcount;
 447         }
 448
 449         if (update->rr_class == zone->question_class) {
 450                 if (update->rr_type == DNS_QTYPE_CNAME) {
 451                         /*
 452                          * If there is a record in the directory
 453                          * that's not a CNAME, ignore update
 454                          */
 455                         for (i = first; i < rcount; i++) {
 456                                 if (recs[i].wType != DNS_TYPE_CNAME) {
 457                                         DEBUG(5, ("Skipping update\n"));
 458                                         return WERR_OK;
 459                                 }
 460                                 break;
 461                         }
 462
 463                         /*
 464                          * There should be no entries besides one CNAME record
 465                          * per name, so replace everything with the new CNAME
 466                          */
 467
 468                         rcount = first;
 469                         recs = talloc_realloc(mem_ctx, recs,
 470                                         struct dnsp_DnssrvRpcRecord, rcount + 1);
 471                         W_ERROR_HAVE_NO_MEMORY(recs);
 472
 473                         werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
 474                         W_ERROR_NOT_OK_RETURN(werror);
 475                         rcount += 1;
 476
 477                         werror = dns_replace_records(dns, mem_ctx, dn,
 478                                                      needs_add, recs, rcount);
 479                         W_ERROR_NOT_OK_RETURN(werror);
 480
 481                         return WERR_OK;
 482                 } else {
 483                         /*
 484                          * If there is a CNAME record for this name,
 485                          * ignore update
 486                          */
 487                         for (i = first; i < rcount; i++) {
 488                                 if (recs[i].wType == DNS_TYPE_CNAME) {
 489                                         DEBUG(5, ("Skipping update\n"));
 490                                         return WERR_OK;
 491                                 }
 492                         }
 493                 }
 494                 if (update->rr_type == DNS_QTYPE_SOA) {
 495                         bool found = false;
 496
 497                         /*
 498                          * If the zone has no SOA record?? or update's
 499                          * serial number is smaller than existing SOA's,
 500                          * ignore update
 501                          */
 502                         for (i = first; i < rcount; i++) {
 503                                 if (recs[i].wType == DNS_TYPE_SOA) {
 504                                         uint16_t n, o;
 505
 506                                         n = update->rdata.soa_record.serial;
 507                                         o = recs[i].data.soa.serial;
 508                                         /*
 509                                          * TODO: Implement RFC 1982 comparison
 510                                          * logic for RFC2136
 511                                          */
 512                                         if (n <= o) {
 513                                                 DEBUG(5, ("Skipping update\n"));
 514                                                 return WERR_OK;
 515                                         }
 516                                         found = true;
 517                                         break;
 518                                 }
 519                         }
 520                         if (!found) {
 521                                 DEBUG(5, ("Skipping update\n"));
 522                                 return WERR_OK;
 523                         }
 524
 525                         werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
 526                         W_ERROR_NOT_OK_RETURN(werror);
 527
 528                         for (i++; i < rcount; i++) {
 529                                 if (recs[i].wType != DNS_TYPE_SOA) {
 530                                         continue;
 531                                 }
 532
 533                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
 534                                         .wType = DNS_TYPE_TOMBSTONE,
 535                                 };
 536                         }
 537
 538                         werror = dns_replace_records(dns, mem_ctx, dn,
 539                                                      needs_add, recs, rcount);
 540                         W_ERROR_NOT_OK_RETURN(werror);
 541
 542                         return WERR_OK;
 543                 }
 544
 545                 recs = talloc_realloc(mem_ctx, recs,
 546                                 struct dnsp_DnssrvRpcRecord, rcount+1);
 547                 W_ERROR_HAVE_NO_MEMORY(recs);
 548
 549                 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
 550                 W_ERROR_NOT_OK_RETURN(werror);
 551
 552                 for (i = first; i < rcount; i++) {
 553                         if (!dns_records_match(&recs[i], &recs[rcount])) {
 554                                 continue;
 555                         }
 556
 557                         recs[i] = recs[rcount];
 558
 559                         werror = dns_replace_records(dns, mem_ctx, dn,
 560                                                      needs_add, recs, rcount);
 561                         W_ERROR_NOT_OK_RETURN(werror);
 562
 563                         return WERR_OK;
 564                 }
 565
 566                 werror = dns_replace_records(dns, mem_ctx, dn,
 567                                              needs_add, recs, rcount+1);
 568                 W_ERROR_NOT_OK_RETURN(werror);
 569
 570                 return WERR_OK;
 571         } else if (update->rr_class == DNS_QCLASS_ANY) {
 572                 if (update->rr_type == DNS_QTYPE_ALL) {
 573                         if (dns_name_equal(update->name, zone->name)) {
 574                                 for (i = first; i < rcount; i++) {
 575
 576                                         if (recs[i].wType == DNS_TYPE_SOA) {
 577                                                 continue;
 578                                         }
 579
 580                                         if (recs[i].wType == DNS_TYPE_NS) {
 581                                                 continue;
 582                                         }
 583
 584                                         recs[i] = (struct dnsp_DnssrvRpcRecord) {
 585                                                 .wType = DNS_TYPE_TOMBSTONE,
 586                                         };
 587                                 }
 588
 589                         } else {
 590                                 for (i = first; i < rcount; i++) {
 591                                         recs[i] = (struct dnsp_DnssrvRpcRecord) {
 592                                                 .wType = DNS_TYPE_TOMBSTONE,
 593                                         };
 594                                 }
 595                         }
 596
 597                 } else if (dns_name_equal(update->name, zone->name)) {
 598
 599                         if (update->rr_type == DNS_QTYPE_SOA) {
 600                                 return WERR_OK;
 601                         }
 602
 603                         if (update->rr_type == DNS_QTYPE_NS) {
 604                                 return WERR_OK;
 605                         }
 606                 }
 607                 for (i = first; i < rcount; i++) {
 608                         if (recs[i].wType == (enum dns_record_type) update->rr_type) {
 609                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
 610                                         .wType = DNS_TYPE_TOMBSTONE,
 611                                 };
 612                         }
 613                 }
 614
 615                 werror = dns_replace_records(dns, mem_ctx, dn,
 616                                              needs_add, recs, rcount);
 617                 W_ERROR_NOT_OK_RETURN(werror);
 618
 619                 return WERR_OK;
 620         } else if (update->rr_class == DNS_QCLASS_NONE) {
 621                 struct dnsp_DnssrvRpcRecord *del_rec;
 622
 623                 if (update->rr_type == DNS_QTYPE_SOA) {
 624                         return WERR_OK;
 625                 }
 626                 if (update->rr_type == DNS_QTYPE_NS) {
 627                         bool found = false;
 628                         struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
 629                                                 struct dnsp_DnssrvRpcRecord);
 630                         W_ERROR_HAVE_NO_MEMORY(ns_rec);
 631
 632
 633                         werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
 634                         W_ERROR_NOT_OK_RETURN(werror);
 635
 636                         for (i = first; i < rcount; i++) {
 637                                 if (dns_records_match(ns_rec, &recs[i])) {
 638                                         found = true;
 639                                         break;
 640                                 }
 641                         }
 642                         if (found) {
 643                                 return WERR_OK;
 644                         }
 645                 }
 646
 647                 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
 648                 W_ERROR_HAVE_NO_MEMORY(del_rec);
 649
 650                 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
 651                 W_ERROR_NOT_OK_RETURN(werror);
 652
 653                 for (i = first; i < rcount; i++) {
 654                         if (dns_records_match(del_rec, &recs[i])) {
 655                                 recs[i] = (struct dnsp_DnssrvRpcRecord) {
 656                                         .wType = DNS_TYPE_TOMBSTONE,
 657                                 };
 658                         }
 659                 }
 660
 661                 werror = dns_replace_records(dns, mem_ctx, dn,
 662                                              needs_add, recs, rcount);
 663                 W_ERROR_NOT_OK_RETURN(werror);
 664         }
 665
 666         return WERR_OK;
 667 }
 668
 669 static WERROR handle_updates(struct dns_server *dns,
 670                              TALLOC_CTX *mem_ctx,
 671                              const struct dns_name_question *zone,
 672                              const struct dns_res_rec *prereqs, uint16_t pcount,
 673                              struct dns_res_rec *updates, uint16_t upd_count,
 674                              struct dns_server_tkey *tkey)
 675 {
 676         struct ldb_dn *zone_dn = NULL;
 677         WERROR werror = WERR_OK;
 678         int ret;
 679         uint16_t ri;
 680         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 681
 682         if (tkey != NULL) {
 683                 ret = ldb_set_opaque(dns->samdb, "sessionInfo", tkey->session_info);
 684                 if (ret != LDB_SUCCESS) {
 685                         DEBUG(1, ("unable to set session info\n"));
 686                         werror = DNS_ERR(SERVER_FAILURE);
 687                         goto failed;
 688                 }
 689         }
 690
 691         werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
 692         W_ERROR_NOT_OK_GOTO(werror, failed);
 693
 694         ret = ldb_transaction_start(dns->samdb);
 695         if (ret != LDB_SUCCESS) {
 696                 werror = DNS_ERR(SERVER_FAILURE);
 697                 goto failed;
 698         }
 699
 700         werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
 701         W_ERROR_NOT_OK_GOTO(werror, failed);
 702
 703         DEBUG(1, ("update count is %u\n", upd_count));
 704
 705         for (ri = 0; ri < upd_count; ri++) {
 706                 werror = handle_one_update(dns, tmp_ctx, zone,
 707                                            &updates[ri], tkey);
 708                 W_ERROR_NOT_OK_GOTO(werror, failed);
 709         }
 710
 711         ldb_transaction_commit(dns->samdb);
 712         TALLOC_FREE(tmp_ctx);
 713
 714         if (tkey != NULL) {
 715                 ldb_set_opaque(dns->samdb, "sessionInfo",
 716                                system_session(dns->task->lp_ctx));
 717         }
 718
 719         return WERR_OK;
 720
 721 failed:
 722         ldb_transaction_cancel(dns->samdb);
 723
 724         if (tkey != NULL) {
 725                 ldb_set_opaque(dns->samdb, "sessionInfo",
 726                                system_session(dns->task->lp_ctx));
 727         }
 728
 729         TALLOC_FREE(tmp_ctx);
 730         return werror;
 731
 732 }
 733
 734 static WERROR dns_update_allowed(struct dns_server *dns,
 735                                  const struct dns_request_state *state,
 736                                  struct dns_server_tkey **tkey)
 737 {
 738         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
 739                 DEBUG(2, ("All updates allowed.\n"));
 740                 return WERR_OK;
 741         }
 742
 743         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
 744                 DEBUG(2, ("Updates disabled.\n"));
 745                 return DNS_ERR(REFUSED);
 746         }
 747
 748         if (state->authenticated == false ) {
 749                 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
 750                 return DNS_ERR(REFUSED);
 751         }
 752
 753         *tkey = dns_find_tkey(dns->tkeys, state->key_name);
 754         if (*tkey == NULL) {
 755                 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
 756                 return DNS_ERR(REFUSED);
 757         }
 758
 759         return WERR_OK;
 760 }
 761
 762
 763 WERROR dns_server_process_update(struct dns_server *dns,
 764                                  const struct dns_request_state *state,
 765                                  TALLOC_CTX *mem_ctx,
 766                                  const struct dns_name_packet *in,
 767                                  struct dns_res_rec **prereqs,    uint16_t *prereq_count,
 768                                  struct dns_res_rec **updates,    uint16_t *update_count,
 769                                  struct dns_res_rec **additional, uint16_t *arcount)
 770 {
 771         struct dns_name_question *zone;
 772         const struct dns_server_zone *z;
 773         size_t host_part_len = 0;
 774         WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
 775         struct dns_server_tkey *tkey = NULL;
 776
 777         if (in->qdcount != 1) {
 778                 return DNS_ERR(FORMAT_ERROR);
 779         }
 780
 781         zone = &in->questions[0];
 782
 783         if (zone->question_class != DNS_QCLASS_IN &&
 784             zone->question_class != DNS_QCLASS_ANY) {
 785                 return DNS_ERR(NOT_IMPLEMENTED);
 786         }
 787
 788         if (zone->question_type != DNS_QTYPE_SOA) {
 789                 return DNS_ERR(FORMAT_ERROR);
 790         }
 791
 792         DEBUG(2, ("Got a dns update request.\n"));
 793
 794         for (z = dns->zones; z != NULL; z = z->next) {
 795                 bool match;
 796
 797                 match = dns_name_match(z->name, zone->name, &host_part_len);
 798                 if (match) {
 799                         break;
 800                 }
 801         }
 802
 803         if (z == NULL) {
 804                 DEBUG(1, ("We're not authoritative for this zone\n"));
 805                 return DNS_ERR(NOTAUTH);
 806         }
 807
 808         if (host_part_len != 0) {
 809                 /* TODO: We need to delegate this one */
 810                 DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
 811                 return DNS_ERR(NOT_IMPLEMENTED);
 812         }
 813
 814         *prereq_count = in->ancount;
 815         *prereqs = in->answers;
 816         werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
 817                                      *prereq_count);
 818         W_ERROR_NOT_OK_RETURN(werror);
 819
 820         werror = dns_update_allowed(dns, state, &tkey);
 821         if (!W_ERROR_IS_OK(werror)) {
 822                 return werror;
 823         }
 824
 825         *update_count = in->nscount;
 826         *updates = in->nsrecs;
 827         werror = update_prescan(in->questions, *updates, *update_count);
 828         W_ERROR_NOT_OK_RETURN(werror);
 829
 830         werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
 831                                 *prereq_count, *updates, *update_count, tkey);
 832         W_ERROR_NOT_OK_RETURN(werror);
 833
 834         return werror;
 835 }