2 Unix SMB/CIFS implementation.
4 DNS server handler for update requests
6 Copyright (C) 2010 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
28 #include "param/param.h"
29 #include "param/loadparm.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "smbd/service_task.h"
33 #include "dns_server/dns_server.h"
34 #include "auth/auth.h"
37 #define DBGC_CLASS DBGC_DNS
39 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
40 const struct dns_res_rec *rrec,
41 struct dnsp_DnssrvRpcRecord *r);
43 static WERROR check_one_prerequisite(struct dns_server *dns,
45 const struct dns_name_question *zone,
46 const struct dns_res_rec *pr,
54 struct dnsp_DnssrvRpcRecord *rec = NULL;
55 struct dnsp_DnssrvRpcRecord *ans;
58 size_t host_part_len = 0;
63 return DNS_ERR(FORMAT_ERROR);
66 match = dns_name_match(zone->name, pr->name, &host_part_len);
68 return DNS_ERR(NOTZONE);
71 werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
72 W_ERROR_NOT_OK_RETURN(werror);
74 if (pr->rr_class == DNS_QCLASS_ANY) {
76 if (pr->length != 0) {
77 return DNS_ERR(FORMAT_ERROR);
81 if (pr->rr_type == DNS_QTYPE_ALL) {
84 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
85 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
86 return DNS_ERR(NAME_ERROR);
88 W_ERROR_NOT_OK_RETURN(werror);
91 return DNS_ERR(NAME_ERROR);
96 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
97 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
98 return DNS_ERR(NXRRSET);
100 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
101 return DNS_ERR(NXRRSET);
103 W_ERROR_NOT_OK_RETURN(werror);
105 for (i = 0; i < acount; i++) {
106 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
112 return DNS_ERR(NXRRSET);
117 * RFC2136 3.2.5 doesn't actually mention the need to return
118 * OK here, but otherwise we'd always return a FORMAT_ERROR
119 * later on. This also matches Microsoft DNS behavior.
124 if (pr->rr_class == DNS_QCLASS_NONE) {
125 if (pr->length != 0) {
126 return DNS_ERR(FORMAT_ERROR);
129 if (pr->rr_type == DNS_QTYPE_ALL) {
132 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
133 if (W_ERROR_EQUAL(werror, WERR_OK)) {
134 return DNS_ERR(YXDOMAIN);
139 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
140 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
143 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
147 for (i = 0; i < acount; i++) {
148 if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
154 return DNS_ERR(YXRRSET);
159 * RFC2136 3.2.5 doesn't actually mention the need to return
160 * OK here, but otherwise we'd always return a FORMAT_ERROR
161 * later on. This also matches Microsoft DNS behavior.
166 if (pr->rr_class != zone->question_class) {
167 return DNS_ERR(FORMAT_ERROR);
170 *final_result = false;
172 werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
173 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
174 return DNS_ERR(NXRRSET);
176 if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
177 return DNS_ERR(NXRRSET);
179 W_ERROR_NOT_OK_RETURN(werror);
181 rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
182 W_ERROR_HAVE_NO_MEMORY(rec);
184 werror = dns_rr_to_dnsp(rec, pr, rec);
185 W_ERROR_NOT_OK_RETURN(werror);
187 for (i = 0; i < acount; i++) {
188 if (dns_records_match(rec, &ans[i])) {
195 return DNS_ERR(NXRRSET);
201 static WERROR check_prerequisites(struct dns_server *dns,
203 const struct dns_name_question *zone,
204 const struct dns_res_rec *prereqs, uint16_t count)
207 WERROR final_error = WERR_OK;
209 for (i = 0; i < count; i++) {
213 werror = check_one_prerequisite(dns, mem_ctx, zone,
214 &prereqs[i], &final);
215 if (!W_ERROR_IS_OK(werror)) {
219 if (W_ERROR_IS_OK(final_error)) {
220 final_error = werror;
225 if (!W_ERROR_IS_OK(final_error)) {
232 static WERROR update_prescan(const struct dns_name_question *zone,
233 const struct dns_res_rec *updates, uint16_t count)
235 const struct dns_res_rec *r;
237 size_t host_part_len;
240 for (i = 0; i < count; i++) {
242 match = dns_name_match(zone->name, r->name, &host_part_len);
244 return DNS_ERR(NOTZONE);
246 if (zone->question_class == r->rr_class) {
247 if (r->rr_type == DNS_QTYPE_ALL) {
248 return DNS_ERR(FORMAT_ERROR);
250 if (r->rr_type == DNS_QTYPE_AXFR) {
251 return DNS_ERR(FORMAT_ERROR);
253 if (r->rr_type == DNS_QTYPE_MAILB) {
254 return DNS_ERR(FORMAT_ERROR);
256 if (r->rr_type == DNS_QTYPE_MAILA) {
257 return DNS_ERR(FORMAT_ERROR);
259 } else if (r->rr_class == DNS_QCLASS_ANY) {
261 return DNS_ERR(FORMAT_ERROR);
263 if (r->length != 0) {
264 return DNS_ERR(FORMAT_ERROR);
266 if (r->rr_type == DNS_QTYPE_AXFR) {
267 return DNS_ERR(FORMAT_ERROR);
269 if (r->rr_type == DNS_QTYPE_MAILB) {
270 return DNS_ERR(FORMAT_ERROR);
272 if (r->rr_type == DNS_QTYPE_MAILA) {
273 return DNS_ERR(FORMAT_ERROR);
275 } else if (r->rr_class == DNS_QCLASS_NONE) {
277 return DNS_ERR(FORMAT_ERROR);
279 if (r->rr_type == DNS_QTYPE_ALL) {
280 return DNS_ERR(FORMAT_ERROR);
282 if (r->rr_type == DNS_QTYPE_AXFR) {
283 return DNS_ERR(FORMAT_ERROR);
285 if (r->rr_type == DNS_QTYPE_MAILB) {
286 return DNS_ERR(FORMAT_ERROR);
288 if (r->rr_type == DNS_QTYPE_MAILA) {
289 return DNS_ERR(FORMAT_ERROR);
292 return DNS_ERR(FORMAT_ERROR);
298 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
299 const struct dns_res_rec *rrec,
300 struct dnsp_DnssrvRpcRecord *r)
302 enum ndr_err_code ndr_err;
304 if (rrec->rr_type == DNS_QTYPE_ALL) {
305 return DNS_ERR(FORMAT_ERROR);
310 r->wType = (enum dns_record_type) rrec->rr_type;
311 r->dwTtlSeconds = rrec->ttl;
312 r->rank = DNS_RANK_ZONE;
314 /* If we get QCLASS_ANY, we're done here */
315 if (rrec->rr_class == DNS_QCLASS_ANY) {
319 switch(rrec->rr_type) {
321 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
322 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
325 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
326 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
329 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
330 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
332 case DNS_QTYPE_CNAME:
333 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
334 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
337 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
338 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
339 r->data.srv.wPort = rrec->rdata.srv_record.port;
340 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
341 rrec->rdata.srv_record.target);
342 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
345 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
346 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
349 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
350 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
351 rrec->rdata.mx_record.exchange);
352 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
355 ndr_err = ndr_dnsp_string_list_copy(mem_ctx,
356 &rrec->rdata.txt_record.txt,
358 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
359 return WERR_NOT_ENOUGH_MEMORY;
364 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
365 return DNS_ERR(NOT_IMPLEMENTED);
374 static WERROR handle_one_update(struct dns_server *dns,
376 const struct dns_name_question *zone,
377 const struct dns_res_rec *update,
378 const struct dns_server_tkey *tkey)
380 struct dnsp_DnssrvRpcRecord *recs = NULL;
386 bool tombstoned = false;
387 bool needs_add = false;
389 DEBUG(2, ("Looking at record: \n"));
391 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
394 switch (update->rr_type) {
397 case DNS_QTYPE_CNAME:
406 DEBUG(0, ("Can't handle updates of type %u yet\n",
408 return DNS_ERR(NOT_IMPLEMENTED);
411 werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
412 W_ERROR_NOT_OK_RETURN(werror);
414 werror = dns_common_lookup(dns->samdb, mem_ctx, dn,
415 &recs, &rcount, &tombstoned);
416 if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
420 W_ERROR_NOT_OK_RETURN(werror);
424 * we need to keep the existing tombstone record
430 if (update->rr_class == zone->question_class) {
431 if (update->rr_type == DNS_QTYPE_CNAME) {
433 * If there is a record in the directory
434 * that's not a CNAME, ignore update
436 for (i = first; i < rcount; i++) {
437 if (recs[i].wType != DNS_TYPE_CNAME) {
438 DEBUG(5, ("Skipping update\n"));
445 * There should be no entries besides one CNAME record
446 * per name, so replace everything with the new CNAME
450 recs = talloc_realloc(mem_ctx, recs,
451 struct dnsp_DnssrvRpcRecord, rcount + 1);
452 W_ERROR_HAVE_NO_MEMORY(recs);
454 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
455 W_ERROR_NOT_OK_RETURN(werror);
458 werror = dns_replace_records(dns, mem_ctx, dn,
459 needs_add, recs, rcount);
460 W_ERROR_NOT_OK_RETURN(werror);
465 * If there is a CNAME record for this name,
468 for (i = first; i < rcount; i++) {
469 if (recs[i].wType == DNS_TYPE_CNAME) {
470 DEBUG(5, ("Skipping update\n"));
475 if (update->rr_type == DNS_QTYPE_SOA) {
479 * If the zone has no SOA record?? or update's
480 * serial number is smaller than existing SOA's,
483 for (i = first; i < rcount; i++) {
484 if (recs[i].wType == DNS_TYPE_SOA) {
487 n = update->rdata.soa_record.serial;
488 o = recs[i].data.soa.serial;
490 * TODO: Implement RFC 1982 comparison
494 DEBUG(5, ("Skipping update\n"));
502 DEBUG(5, ("Skipping update\n"));
506 werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
507 W_ERROR_NOT_OK_RETURN(werror);
509 for (i++; i < rcount; i++) {
510 if (recs[i].wType != DNS_TYPE_SOA) {
514 recs[i] = (struct dnsp_DnssrvRpcRecord) {
515 .wType = DNS_TYPE_TOMBSTONE,
519 werror = dns_replace_records(dns, mem_ctx, dn,
520 needs_add, recs, rcount);
521 W_ERROR_NOT_OK_RETURN(werror);
526 recs = talloc_realloc(mem_ctx, recs,
527 struct dnsp_DnssrvRpcRecord, rcount+1);
528 W_ERROR_HAVE_NO_MEMORY(recs);
530 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
531 W_ERROR_NOT_OK_RETURN(werror);
533 for (i = first; i < rcount; i++) {
534 if (!dns_records_match(&recs[i], &recs[rcount])) {
538 recs[i] = recs[rcount];
540 werror = dns_replace_records(dns, mem_ctx, dn,
541 needs_add, recs, rcount);
542 W_ERROR_NOT_OK_RETURN(werror);
547 werror = dns_replace_records(dns, mem_ctx, dn,
548 needs_add, recs, rcount+1);
549 W_ERROR_NOT_OK_RETURN(werror);
552 } else if (update->rr_class == DNS_QCLASS_ANY) {
553 if (update->rr_type == DNS_QTYPE_ALL) {
554 if (dns_name_equal(update->name, zone->name)) {
555 for (i = first; i < rcount; i++) {
557 if (recs[i].wType == DNS_TYPE_SOA) {
561 if (recs[i].wType == DNS_TYPE_NS) {
565 recs[i] = (struct dnsp_DnssrvRpcRecord) {
566 .wType = DNS_TYPE_TOMBSTONE,
571 for (i = first; i < rcount; i++) {
572 recs[i] = (struct dnsp_DnssrvRpcRecord) {
573 .wType = DNS_TYPE_TOMBSTONE,
578 } else if (dns_name_equal(update->name, zone->name)) {
580 if (update->rr_type == DNS_QTYPE_SOA) {
584 if (update->rr_type == DNS_QTYPE_NS) {
588 for (i = first; i < rcount; i++) {
589 if (recs[i].wType == (enum dns_record_type) update->rr_type) {
590 recs[i] = (struct dnsp_DnssrvRpcRecord) {
591 .wType = DNS_TYPE_TOMBSTONE,
596 werror = dns_replace_records(dns, mem_ctx, dn,
597 needs_add, recs, rcount);
598 W_ERROR_NOT_OK_RETURN(werror);
601 } else if (update->rr_class == DNS_QCLASS_NONE) {
602 struct dnsp_DnssrvRpcRecord *del_rec;
604 if (update->rr_type == DNS_QTYPE_SOA) {
607 if (update->rr_type == DNS_QTYPE_NS) {
609 struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
610 struct dnsp_DnssrvRpcRecord);
611 W_ERROR_HAVE_NO_MEMORY(ns_rec);
614 werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
615 W_ERROR_NOT_OK_RETURN(werror);
617 for (i = first; i < rcount; i++) {
618 if (dns_records_match(ns_rec, &recs[i])) {
628 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
629 W_ERROR_HAVE_NO_MEMORY(del_rec);
631 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
632 W_ERROR_NOT_OK_RETURN(werror);
634 for (i = first; i < rcount; i++) {
635 if (dns_records_match(del_rec, &recs[i])) {
636 recs[i] = (struct dnsp_DnssrvRpcRecord) {
637 .wType = DNS_TYPE_TOMBSTONE,
642 werror = dns_replace_records(dns, mem_ctx, dn,
643 needs_add, recs, rcount);
644 W_ERROR_NOT_OK_RETURN(werror);
650 static WERROR handle_updates(struct dns_server *dns,
652 const struct dns_name_question *zone,
653 const struct dns_res_rec *prereqs, uint16_t pcount,
654 struct dns_res_rec *updates, uint16_t upd_count,
655 struct dns_server_tkey *tkey)
657 struct ldb_dn *zone_dn = NULL;
658 WERROR werror = WERR_OK;
661 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
664 ret = ldb_set_opaque(dns->samdb, "sessionInfo", tkey->session_info);
665 if (ret != LDB_SUCCESS) {
666 DEBUG(1, ("unable to set session info\n"));
667 werror = DNS_ERR(SERVER_FAILURE);
672 werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
673 W_ERROR_NOT_OK_GOTO(werror, failed);
675 ret = ldb_transaction_start(dns->samdb);
676 if (ret != LDB_SUCCESS) {
677 werror = DNS_ERR(SERVER_FAILURE);
681 werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
682 W_ERROR_NOT_OK_GOTO(werror, failed);
684 DEBUG(1, ("update count is %u\n", upd_count));
686 for (ri = 0; ri < upd_count; ri++) {
687 werror = handle_one_update(dns, tmp_ctx, zone,
689 W_ERROR_NOT_OK_GOTO(werror, failed);
692 ldb_transaction_commit(dns->samdb);
693 TALLOC_FREE(tmp_ctx);
696 ldb_set_opaque(dns->samdb, "sessionInfo",
697 system_session(dns->task->lp_ctx));
703 ldb_transaction_cancel(dns->samdb);
706 ldb_set_opaque(dns->samdb, "sessionInfo",
707 system_session(dns->task->lp_ctx));
710 TALLOC_FREE(tmp_ctx);
715 static WERROR dns_update_allowed(struct dns_server *dns,
716 const struct dns_request_state *state,
717 struct dns_server_tkey **tkey)
719 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
720 DEBUG(2, ("All updates allowed.\n"));
724 if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
725 DEBUG(2, ("Updates disabled.\n"));
726 return DNS_ERR(REFUSED);
729 if (state->authenticated == false ) {
730 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
731 return DNS_ERR(REFUSED);
734 *tkey = dns_find_tkey(dns->tkeys, state->key_name);
736 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
737 return DNS_ERR(REFUSED);
744 WERROR dns_server_process_update(struct dns_server *dns,
745 const struct dns_request_state *state,
747 const struct dns_name_packet *in,
748 struct dns_res_rec **prereqs, uint16_t *prereq_count,
749 struct dns_res_rec **updates, uint16_t *update_count,
750 struct dns_res_rec **additional, uint16_t *arcount)
752 struct dns_name_question *zone;
753 const struct dns_server_zone *z;
754 size_t host_part_len = 0;
755 WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
756 struct dns_server_tkey *tkey = NULL;
758 if (in->qdcount != 1) {
759 return DNS_ERR(FORMAT_ERROR);
762 zone = &in->questions[0];
764 if (zone->question_class != DNS_QCLASS_IN &&
765 zone->question_class != DNS_QCLASS_ANY) {
766 return DNS_ERR(NOT_IMPLEMENTED);
769 if (zone->question_type != DNS_QTYPE_SOA) {
770 return DNS_ERR(FORMAT_ERROR);
773 DEBUG(2, ("Got a dns update request.\n"));
775 for (z = dns->zones; z != NULL; z = z->next) {
778 match = dns_name_match(z->name, zone->name, &host_part_len);
785 DEBUG(1, ("We're not authoritative for this zone\n"));
786 return DNS_ERR(NOTAUTH);
789 if (host_part_len != 0) {
790 /* TODO: We need to delegate this one */
791 DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
792 return DNS_ERR(NOT_IMPLEMENTED);
795 *prereq_count = in->ancount;
796 *prereqs = in->answers;
797 werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
799 W_ERROR_NOT_OK_RETURN(werror);
801 werror = dns_update_allowed(dns, state, &tkey);
802 if (!W_ERROR_IS_OK(werror)) {
806 *update_count = in->nscount;
807 *updates = in->nsrecs;
808 werror = update_prescan(in->questions, *updates, *update_count);
809 W_ERROR_NOT_OK_RETURN(werror);
811 werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
812 *prereq_count, *updates, *update_count, tkey);
813 W_ERROR_NOT_OK_RETURN(werror);