s4 dns: Allow configuring signed updates
[gd/samba-autobuild/.git] / source4 / dns_server / dns_update.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    DNS server handler for update requests
5
6    Copyright (C) 2010 Kai Blin  <kai@samba.org>
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
27 #include <ldb.h>
28 #include "param/param.h"
29 #include "param/loadparm.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "smbd/service_task.h"
33 #include "dns_server/dns_server.h"
34
35 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
36                              const struct dns_res_rec *rrec,
37                              struct dnsp_DnssrvRpcRecord *r);
38
39 static WERROR check_one_prerequisite(struct dns_server *dns,
40                                      TALLOC_CTX *mem_ctx,
41                                      const struct dns_name_question *zone,
42                                      const struct dns_res_rec *pr,
43                                      bool *final_result)
44 {
45         bool match;
46         WERROR werror;
47         struct ldb_dn *dn;
48         uint16_t i;
49         bool found = false;
50         struct dnsp_DnssrvRpcRecord *rec = NULL;
51         struct dnsp_DnssrvRpcRecord *ans;
52         uint16_t acount;
53
54         size_t host_part_len = 0;
55
56         *final_result = true;
57
58         if (pr->ttl != 0) {
59                 return DNS_ERR(FORMAT_ERROR);
60         }
61
62         match = dns_name_match(zone->name, pr->name, &host_part_len);
63         if (!match) {
64                 return DNS_ERR(NOTZONE);
65         }
66
67         werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
68         W_ERROR_NOT_OK_RETURN(werror);
69
70         if (pr->rr_class == DNS_QCLASS_ANY) {
71
72                 if (pr->length != 0) {
73                         return DNS_ERR(FORMAT_ERROR);
74                 }
75
76
77                 if (pr->rr_type == DNS_QTYPE_ALL) {
78                         /*
79                          */
80                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
81                         W_ERROR_NOT_OK_RETURN(werror);
82
83                         if (acount == 0) {
84                                 return DNS_ERR(NAME_ERROR);
85                         }
86                 } else {
87                         /*
88                          */
89                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
90                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
91                                 return DNS_ERR(NXRRSET);
92                         }
93                         W_ERROR_NOT_OK_RETURN(werror);
94
95                         for (i = 0; i < acount; i++) {
96                                 if (ans[i].wType == pr->rr_type) {
97                                         found = true;
98                                         break;
99                                 }
100                         }
101                         if (!found) {
102                                 return DNS_ERR(NXRRSET);
103                         }
104                 }
105
106                 /*
107                  * RFC2136 3.2.5 doesn't actually mention the need to return
108                  * OK here, but otherwise we'd always return a FORMAT_ERROR
109                  * later on. This also matches Microsoft DNS behavior.
110                  */
111                 return WERR_OK;
112         }
113
114         if (pr->rr_class == DNS_QCLASS_NONE) {
115                 if (pr->length != 0) {
116                         return DNS_ERR(FORMAT_ERROR);
117                 }
118
119                 if (pr->rr_type == DNS_QTYPE_ALL) {
120                         /*
121                          */
122                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
123                         if (W_ERROR_EQUAL(werror, WERR_OK)) {
124                                 return DNS_ERR(YXDOMAIN);
125                         }
126                 } else {
127                         /*
128                          */
129                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
130                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
131                                 werror = WERR_OK;
132                                 ans = NULL;
133                                 acount = 0;
134                         }
135
136                         for (i = 0; i < acount; i++) {
137                                 if (ans[i].wType == pr->rr_type) {
138                                         found = true;
139                                         break;
140                                 }
141                         }
142                         if (found) {
143                                 return DNS_ERR(YXRRSET);
144                         }
145                 }
146
147                 /*
148                  * RFC2136 3.2.5 doesn't actually mention the need to return
149                  * OK here, but otherwise we'd always return a FORMAT_ERROR
150                  * later on. This also matches Microsoft DNS behavior.
151                  */
152                 return WERR_OK;
153         }
154
155         if (pr->rr_class != zone->question_class) {
156                 return DNS_ERR(FORMAT_ERROR);
157         }
158
159         *final_result = false;
160
161         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
162         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
163                 return DNS_ERR(NXRRSET);
164         }
165         W_ERROR_NOT_OK_RETURN(werror);
166
167         rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
168         W_ERROR_HAVE_NO_MEMORY(rec);
169
170         werror = dns_rr_to_dnsp(rec, pr, rec);
171         W_ERROR_NOT_OK_RETURN(werror);
172
173         for (i = 0; i < acount; i++) {
174                 if (dns_records_match(rec, &ans[i])) {
175                         found = true;
176                         break;
177                 }
178         }
179
180         if (!found) {
181                 return DNS_ERR(NXRRSET);
182         }
183
184         return WERR_OK;
185 }
186
187 static WERROR check_prerequisites(struct dns_server *dns,
188                                   TALLOC_CTX *mem_ctx,
189                                   const struct dns_name_question *zone,
190                                   const struct dns_res_rec *prereqs, uint16_t count)
191 {
192         uint16_t i;
193         WERROR final_error = WERR_OK;
194
195         for (i = 0; i < count; i++) {
196                 bool final;
197                 WERROR werror;
198
199                 werror = check_one_prerequisite(dns, mem_ctx, zone,
200                                                 &prereqs[i], &final);
201                 if (!W_ERROR_IS_OK(werror)) {
202                         if (final) {
203                                 return werror;
204                         }
205                         if (W_ERROR_IS_OK(final_error)) {
206                                 final_error = werror;
207                         }
208                 }
209         }
210
211         if (!W_ERROR_IS_OK(final_error)) {
212                 return final_error;
213         }
214
215         return WERR_OK;
216 }
217
218 static WERROR update_prescan(const struct dns_name_question *zone,
219                              const struct dns_res_rec *updates, uint16_t count)
220 {
221         const struct dns_res_rec *r;
222         uint16_t i;
223         size_t host_part_len;
224         bool match;
225
226         for (i = 0; i < count; i++) {
227                 r = &updates[i];
228                 match = dns_name_match(zone->name, r->name, &host_part_len);
229                 if (!match) {
230                         return DNS_ERR(NOTZONE);
231                 }
232                 if (zone->question_class == r->rr_class) {
233                         if (r->rr_type == DNS_QTYPE_ALL) {
234                                 return DNS_ERR(FORMAT_ERROR);
235                         }
236                         if (r->rr_type == DNS_QTYPE_AXFR) {
237                                 return DNS_ERR(FORMAT_ERROR);
238                         }
239                         if (r->rr_type == DNS_QTYPE_MAILB) {
240                                 return DNS_ERR(FORMAT_ERROR);
241                         }
242                         if (r->rr_type == DNS_QTYPE_MAILA) {
243                                 return DNS_ERR(FORMAT_ERROR);
244                         }
245                 } else if (r->rr_class == DNS_QCLASS_ANY) {
246                         if (r->ttl != 0) {
247                                 return DNS_ERR(FORMAT_ERROR);
248                         }
249                         if (r->length != 0) {
250                                 return DNS_ERR(FORMAT_ERROR);
251                         }
252                         if (r->rr_type == DNS_QTYPE_AXFR) {
253                                 return DNS_ERR(FORMAT_ERROR);
254                         }
255                         if (r->rr_type == DNS_QTYPE_MAILB) {
256                                 return DNS_ERR(FORMAT_ERROR);
257                         }
258                         if (r->rr_type == DNS_QTYPE_MAILA) {
259                                 return DNS_ERR(FORMAT_ERROR);
260                         }
261                 } else if (r->rr_class == DNS_QCLASS_NONE) {
262                         if (r->ttl != 0) {
263                                 return DNS_ERR(FORMAT_ERROR);
264                         }
265                         if (r->rr_type == DNS_QTYPE_ALL) {
266                                 return DNS_ERR(FORMAT_ERROR);
267                         }
268                         if (r->rr_type == DNS_QTYPE_AXFR) {
269                                 return DNS_ERR(FORMAT_ERROR);
270                         }
271                         if (r->rr_type == DNS_QTYPE_MAILB) {
272                                 return DNS_ERR(FORMAT_ERROR);
273                         }
274                         if (r->rr_type == DNS_QTYPE_MAILA) {
275                                 return DNS_ERR(FORMAT_ERROR);
276                         }
277                 } else {
278                         return DNS_ERR(FORMAT_ERROR);
279                 }
280         }
281         return WERR_OK;
282 }
283
284 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
285                              const struct dns_res_rec *rrec,
286                              struct dnsp_DnssrvRpcRecord *r)
287 {
288         char *tmp;
289         char *txt_record_txt;
290         char *saveptr = NULL;
291
292         if (rrec->rr_type == DNS_QTYPE_ALL) {
293                 return DNS_ERR(FORMAT_ERROR);
294         }
295
296         ZERO_STRUCTP(r);
297
298         r->wType = rrec->rr_type;
299         r->dwTtlSeconds = rrec->ttl;
300         r->rank = DNS_RANK_ZONE;
301         /* TODO: Autogenerate this somehow */
302         r->dwSerial = 110;
303
304         /* If we get QCLASS_ANY, we're done here */
305         if (rrec->rr_class == DNS_QCLASS_ANY) {
306                 goto done;
307         }
308
309         switch(rrec->rr_type) {
310         case DNS_QTYPE_A:
311                 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
312                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
313                 break;
314         case DNS_QTYPE_AAAA:
315                 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
316                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
317                 break;
318         case DNS_QTYPE_NS:
319                 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
320                 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
321                 break;
322         case DNS_QTYPE_CNAME:
323                 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
324                 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
325                 break;
326         case DNS_QTYPE_SRV:
327                 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
328                 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
329                 r->data.srv.wPort = rrec->rdata.srv_record.port;
330                 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
331                                 rrec->rdata.srv_record.target);
332                 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
333                 break;
334         case DNS_QTYPE_PTR:
335                 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
336                 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
337                 break;
338         case DNS_QTYPE_MX:
339                 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
340                 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
341                                 rrec->rdata.mx_record.exchange);
342                 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
343                 break;
344         case DNS_QTYPE_TXT:
345                 r->data.txt.count = 0;
346                 r->data.txt.str = talloc_array(mem_ctx, const char *,
347                                                r->data.txt.count);
348                 W_ERROR_HAVE_NO_MEMORY(r->data.txt.str);
349
350                 txt_record_txt = talloc_strdup(r->data.txt.str,
351                                                rrec->rdata.txt_record.txt);
352                 W_ERROR_HAVE_NO_MEMORY(txt_record_txt);
353
354                 tmp = strtok_r(txt_record_txt, "\"", &saveptr);
355                 while (tmp) {
356                         if (strcmp(tmp, " ") == 0) {
357                                 tmp = strtok_r(NULL, "\"", &saveptr);
358                                 continue;
359                         }
360                         r->data.txt.str = talloc_realloc(mem_ctx, r->data.txt.str, const char *,
361                                                         r->data.txt.count+1);
362                         r->data.txt.str[r->data.txt.count] = talloc_strdup(r->data.txt.str, tmp);
363                         W_ERROR_HAVE_NO_MEMORY(r->data.txt.str[r->data.txt.count]);
364
365                         r->data.txt.count++;
366                         tmp = strtok_r(NULL, "\"", &saveptr);
367                 }
368
369                 break;
370         default:
371                 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
372                 return DNS_ERR(NOT_IMPLEMENTED);
373         }
374
375 done:
376
377         return WERR_OK;
378 }
379
380
381 static WERROR handle_one_update(struct dns_server *dns,
382                                 TALLOC_CTX *mem_ctx,
383                                 const struct dns_name_question *zone,
384                                 const struct dns_res_rec *update)
385 {
386         struct dnsp_DnssrvRpcRecord *recs = NULL;
387         uint16_t rcount = 0;
388         struct ldb_dn *dn;
389         uint16_t i;
390         WERROR werror;
391         bool needs_add = false;
392
393         DEBUG(2, ("Looking at record: \n"));
394         if (DEBUGLVL(2)) {
395                 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
396         }
397
398         switch (update->rr_type) {
399         case DNS_QTYPE_A:
400         case DNS_QTYPE_NS:
401         case DNS_QTYPE_CNAME:
402         case DNS_QTYPE_SOA:
403         case DNS_QTYPE_PTR:
404         case DNS_QTYPE_MX:
405         case DNS_QTYPE_AAAA:
406         case DNS_QTYPE_SRV:
407         case DNS_QTYPE_TXT:
408                 break;
409         default:
410                 DEBUG(0, ("Can't handle updates of type %u yet\n",
411                           update->rr_type));
412                 return DNS_ERR(NOT_IMPLEMENTED);
413         }
414
415         werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
416         W_ERROR_NOT_OK_RETURN(werror);
417
418         werror = dns_lookup_records(dns, mem_ctx, dn, &recs, &rcount);
419         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
420                 recs = NULL;
421                 rcount = 0;
422                 needs_add = true;
423                 werror = WERR_OK;
424         }
425         W_ERROR_NOT_OK_RETURN(werror);
426
427         if (update->rr_class == zone->question_class) {
428                 if (update->rr_type == DNS_QTYPE_CNAME) {
429                         /*
430                          * If there is a record in the directory
431                          * that's not a CNAME, ignore update
432                          */
433                         for (i = 0; i < rcount; i++) {
434                                 if (recs[i].wType != DNS_TYPE_CNAME) {
435                                         DEBUG(0, ("Skipping update\n"));
436                                         return WERR_OK;
437                                 }
438                                 break;
439                         }
440
441                         /*
442                          * There should be no entries besides one CNAME record
443                          * per name, so replace everything with the new CNAME
444                          */
445
446                         rcount = 1;
447                         recs = talloc_realloc(mem_ctx, recs,
448                                         struct dnsp_DnssrvRpcRecord, rcount);
449                         W_ERROR_HAVE_NO_MEMORY(recs);
450
451                         werror = dns_rr_to_dnsp(recs, update, &recs[0]);
452                         W_ERROR_NOT_OK_RETURN(werror);
453
454                         werror = dns_replace_records(dns, mem_ctx, dn,
455                                                      needs_add, recs, rcount);
456                         W_ERROR_NOT_OK_RETURN(werror);
457
458                         return WERR_OK;
459                 } else {
460                         /*
461                          * If there is a CNAME record for this name,
462                          * ignore update
463                          */
464                         for (i = 0; i < rcount; i++) {
465                                 if (recs[i].wType == DNS_TYPE_CNAME) {
466                                         DEBUG(0, ("Skipping update\n"));
467                                         return WERR_OK;
468                                 }
469                         }
470                 }
471                 if (update->rr_type == DNS_QTYPE_SOA) {
472                         bool found = false;
473
474                         /*
475                          * If the zone has no SOA record?? or update's
476                          * serial number is smaller than existing SOA's,
477                          * ignore update
478                          */
479                         for (i = 0; i < rcount; i++) {
480                                 if (recs[i].wType == DNS_TYPE_SOA) {
481                                         uint16_t n, o;
482
483                                         n = update->rdata.soa_record.serial;
484                                         o = recs[i].data.soa.serial;
485                                         /*
486                                          * TODO: Implement RFC 1982 comparison
487                                          * logic for RFC2136
488                                          */
489                                         if (n <= o) {
490                                                 DEBUG(0, ("Skipping update\n"));
491                                                 return WERR_OK;
492                                         }
493                                         found = true;
494                                         break;
495                                 }
496                         }
497                         if (!found) {
498                                 DEBUG(0, ("Skipping update\n"));
499                                 return WERR_OK;
500                         }
501
502                         werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
503                         W_ERROR_NOT_OK_RETURN(werror);
504
505                         for (i++; i < rcount; i++) {
506                                 if (recs[i].wType != DNS_TYPE_SOA) {
507                                         continue;
508                                 }
509
510                                 ZERO_STRUCT(recs[i]);
511                         }
512
513                         werror = dns_replace_records(dns, mem_ctx, dn,
514                                                      needs_add, recs, rcount);
515                         W_ERROR_NOT_OK_RETURN(werror);
516
517                         return WERR_OK;
518                 }
519
520                 recs = talloc_realloc(mem_ctx, recs,
521                                 struct dnsp_DnssrvRpcRecord, rcount+1);
522                 W_ERROR_HAVE_NO_MEMORY(recs);
523
524                 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
525                 W_ERROR_NOT_OK_RETURN(werror);
526
527                 for (i = 0; i < rcount; i++) {
528                         if (!dns_records_match(&recs[i], &recs[rcount])) {
529                                 continue;
530                         }
531
532                         recs[i] = recs[rcount];
533
534                         werror = dns_replace_records(dns, mem_ctx, dn,
535                                                      needs_add, recs, rcount);
536                         W_ERROR_NOT_OK_RETURN(werror);
537
538                         return WERR_OK;
539                 }
540
541                 werror = dns_replace_records(dns, mem_ctx, dn,
542                                              needs_add, recs, rcount+1);
543                 W_ERROR_NOT_OK_RETURN(werror);
544
545                 return WERR_OK;
546         } else if (update->rr_class == DNS_QCLASS_ANY) {
547                 if (update->rr_type == DNS_QTYPE_ALL) {
548                         if (dns_name_equal(update->name, zone->name)) {
549                                 for (i = 0; i < rcount; i++) {
550
551                                         if (recs[i].wType == DNS_TYPE_SOA) {
552                                                 continue;
553                                         }
554
555                                         if (recs[i].wType == DNS_TYPE_NS) {
556                                                 continue;
557                                         }
558
559                                         ZERO_STRUCT(recs[i]);
560                                 }
561
562                         } else {
563                                 for (i = 0; i < rcount; i++) {
564                                         ZERO_STRUCT(recs[i]);
565                                 }
566                         }
567
568                 } else if (dns_name_equal(update->name, zone->name)) {
569
570                         if (update->rr_type == DNS_QTYPE_SOA) {
571                                 return WERR_OK;
572                         }
573
574                         if (update->rr_type == DNS_QTYPE_NS) {
575                                 return WERR_OK;
576                         }
577                 }
578                 for (i = 0; i < rcount; i++) {
579                         if (recs[i].wType == update->rr_type) {
580                                 ZERO_STRUCT(recs[i]);
581                         }
582                 }
583
584                 werror = dns_replace_records(dns, mem_ctx, dn,
585                                              needs_add, recs, rcount);
586                 W_ERROR_NOT_OK_RETURN(werror);
587
588                 return WERR_OK;
589         } else if (update->rr_class == DNS_QCLASS_NONE) {
590                 struct dnsp_DnssrvRpcRecord *del_rec;
591
592                 if (update->rr_type == DNS_QTYPE_SOA) {
593                         return WERR_OK;
594                 }
595                 if (update->rr_type == DNS_QTYPE_NS) {
596                         bool found = false;
597                         struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
598                                                 struct dnsp_DnssrvRpcRecord);
599                         W_ERROR_HAVE_NO_MEMORY(ns_rec);
600
601
602                         werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
603                         W_ERROR_NOT_OK_RETURN(werror);
604
605                         for (i = 0; i < rcount; i++) {
606                                 if (dns_records_match(ns_rec, &recs[i])) {
607                                         found = true;
608                                         break;
609                                 }
610                         }
611                         if (found) {
612                                 return WERR_OK;
613                         }
614                 }
615
616                 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
617                 W_ERROR_HAVE_NO_MEMORY(del_rec);
618
619                 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
620                 W_ERROR_NOT_OK_RETURN(werror);
621
622                 for (i = 0; i < rcount; i++) {
623                         if (dns_records_match(del_rec, &recs[i])) {
624                                 ZERO_STRUCT(recs[i]);
625                         }
626                 }
627
628                 werror = dns_replace_records(dns, mem_ctx, dn,
629                                              needs_add, recs, rcount);
630                 W_ERROR_NOT_OK_RETURN(werror);
631         }
632
633         return WERR_OK;
634 }
635
636 static WERROR handle_updates(struct dns_server *dns,
637                              TALLOC_CTX *mem_ctx,
638                              const struct dns_name_question *zone,
639                              const struct dns_res_rec *prereqs, uint16_t pcount,
640                              struct dns_res_rec *updates, uint16_t upd_count)
641 {
642         struct ldb_dn *zone_dn = NULL;
643         WERROR werror = WERR_OK;
644         int ret;
645         uint16_t ri;
646         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
647
648         werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
649         W_ERROR_NOT_OK_RETURN(werror);
650
651         ret = ldb_transaction_start(dns->samdb);
652         if (ret != LDB_SUCCESS) {
653                 return DNS_ERR(SERVER_FAILURE);
654         }
655
656         werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
657         W_ERROR_NOT_OK_GOTO(werror, failed);
658
659         DEBUG(0, ("update count is %u\n", upd_count));
660
661         for (ri = 0; ri < upd_count; ri++) {
662                 werror = handle_one_update(dns, tmp_ctx, zone,
663                                            &updates[ri]);
664                 W_ERROR_NOT_OK_GOTO(werror, failed);
665         }
666
667         ldb_transaction_commit(dns->samdb);
668         TALLOC_FREE(tmp_ctx);
669         return WERR_OK;
670
671 failed:
672         ldb_transaction_cancel(dns->samdb);
673         TALLOC_FREE(tmp_ctx);
674         return werror;
675
676 }
677
678 WERROR dns_server_process_update(struct dns_server *dns,
679                                  struct dns_request_state *state,
680                                  TALLOC_CTX *mem_ctx,
681                                  struct dns_name_packet *in,
682                                  struct dns_res_rec **prereqs,    uint16_t *prereq_count,
683                                  struct dns_res_rec **updates,    uint16_t *update_count,
684                                  struct dns_res_rec **additional, uint16_t *arcount)
685 {
686         struct dns_name_question *zone;
687         const struct dns_server_zone *z;
688         size_t host_part_len = 0;
689         WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
690
691         if (in->qdcount != 1) {
692                 return DNS_ERR(FORMAT_ERROR);
693         }
694
695         zone = &in->questions[0];
696
697         if (zone->question_class != DNS_QCLASS_IN &&
698             zone->question_class != DNS_QCLASS_ANY) {
699                 return DNS_ERR(NOT_IMPLEMENTED);
700         }
701
702         if (zone->question_type != DNS_QTYPE_SOA) {
703                 return DNS_ERR(FORMAT_ERROR);
704         }
705
706         DEBUG(2, ("Got a dns update request.\n"));
707
708         for (z = dns->zones; z != NULL; z = z->next) {
709                 bool match;
710
711                 match = dns_name_match(z->name, zone->name, &host_part_len);
712                 if (match) {
713                         break;
714                 }
715         }
716
717         if (z == NULL) {
718                 DEBUG(0, ("We're not authoritative for this zone\n"));
719                 return DNS_ERR(NOTAUTH);
720         }
721
722         if (host_part_len != 0) {
723                 /* TODO: We need to delegate this one */
724                 DEBUG(0, ("Would have to delegate zones.\n"));
725                 return DNS_ERR(NOT_IMPLEMENTED);
726         }
727
728         *prereq_count = in->ancount;
729         *prereqs = in->answers;
730         werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
731                                      *prereq_count);
732         W_ERROR_NOT_OK_RETURN(werror);
733
734         /* TODO: Check if update is allowed, we probably want "always",
735          * key-based GSSAPI, key-based bind-style TSIG and "never" as
736          * smb.conf options. */
737         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
738                 DEBUG(0, ("Update not allowed.\n"));
739                 return DNS_ERR(REFUSED);
740         }
741         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_SIGNED &&
742             state->authenticated == false ) {
743                 DEBUG(0, ("Update not allowed for unsigned packet.\n"));
744                 return DNS_ERR(REFUSED);
745         }
746
747         *update_count = in->nscount;
748         *updates = in->nsrecs;
749         werror = update_prescan(in->questions, *updates, *update_count);
750         W_ERROR_NOT_OK_RETURN(werror);
751
752
753         werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
754                                 *prereq_count, *updates, *update_count);
755         W_ERROR_NOT_OK_RETURN(werror);
756
757         return werror;
758 }