8be3564ee982818c49d4dd5376538f303101d530
[kai/samba.git] / source4 / dns_server / dns_update.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    DNS server handler for update requests
5
6    Copyright (C) 2010 Kai Blin  <kai@samba.org>
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libcli/util/ntstatus.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/ndr_dns.h"
26 #include "librpc/gen_ndr/ndr_dnsp.h"
27 #include <ldb.h>
28 #include "param/param.h"
29 #include "param/loadparm.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "smbd/service_task.h"
33 #include "dns_server/dns_server.h"
34 #include "auth/auth.h"
35
36 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
37                              const struct dns_res_rec *rrec,
38                              struct dnsp_DnssrvRpcRecord *r);
39
40 static WERROR check_one_prerequisite(struct dns_server *dns,
41                                      TALLOC_CTX *mem_ctx,
42                                      const struct dns_name_question *zone,
43                                      const struct dns_res_rec *pr,
44                                      bool *final_result)
45 {
46         bool match;
47         WERROR werror;
48         struct ldb_dn *dn;
49         uint16_t i;
50         bool found = false;
51         struct dnsp_DnssrvRpcRecord *rec = NULL;
52         struct dnsp_DnssrvRpcRecord *ans;
53         uint16_t acount;
54
55         size_t host_part_len = 0;
56
57         *final_result = true;
58
59         if (pr->ttl != 0) {
60                 return DNS_ERR(FORMAT_ERROR);
61         }
62
63         match = dns_name_match(zone->name, pr->name, &host_part_len);
64         if (!match) {
65                 return DNS_ERR(NOTZONE);
66         }
67
68         werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
69         W_ERROR_NOT_OK_RETURN(werror);
70
71         if (pr->rr_class == DNS_QCLASS_ANY) {
72
73                 if (pr->length != 0) {
74                         return DNS_ERR(FORMAT_ERROR);
75                 }
76
77
78                 if (pr->rr_type == DNS_QTYPE_ALL) {
79                         /*
80                          */
81                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
82                         W_ERROR_NOT_OK_RETURN(werror);
83
84                         if (acount == 0) {
85                                 return DNS_ERR(NAME_ERROR);
86                         }
87                 } else {
88                         /*
89                          */
90                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
91                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
92                                 return DNS_ERR(NXRRSET);
93                         }
94                         W_ERROR_NOT_OK_RETURN(werror);
95
96                         for (i = 0; i < acount; i++) {
97                                 if (ans[i].wType == pr->rr_type) {
98                                         found = true;
99                                         break;
100                                 }
101                         }
102                         if (!found) {
103                                 return DNS_ERR(NXRRSET);
104                         }
105                 }
106
107                 /*
108                  * RFC2136 3.2.5 doesn't actually mention the need to return
109                  * OK here, but otherwise we'd always return a FORMAT_ERROR
110                  * later on. This also matches Microsoft DNS behavior.
111                  */
112                 return WERR_OK;
113         }
114
115         if (pr->rr_class == DNS_QCLASS_NONE) {
116                 if (pr->length != 0) {
117                         return DNS_ERR(FORMAT_ERROR);
118                 }
119
120                 if (pr->rr_type == DNS_QTYPE_ALL) {
121                         /*
122                          */
123                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
124                         if (W_ERROR_EQUAL(werror, WERR_OK)) {
125                                 return DNS_ERR(YXDOMAIN);
126                         }
127                 } else {
128                         /*
129                          */
130                         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
131                         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
132                                 werror = WERR_OK;
133                                 ans = NULL;
134                                 acount = 0;
135                         }
136
137                         for (i = 0; i < acount; i++) {
138                                 if (ans[i].wType == pr->rr_type) {
139                                         found = true;
140                                         break;
141                                 }
142                         }
143                         if (found) {
144                                 return DNS_ERR(YXRRSET);
145                         }
146                 }
147
148                 /*
149                  * RFC2136 3.2.5 doesn't actually mention the need to return
150                  * OK here, but otherwise we'd always return a FORMAT_ERROR
151                  * later on. This also matches Microsoft DNS behavior.
152                  */
153                 return WERR_OK;
154         }
155
156         if (pr->rr_class != zone->question_class) {
157                 return DNS_ERR(FORMAT_ERROR);
158         }
159
160         *final_result = false;
161
162         werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
163         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
164                 return DNS_ERR(NXRRSET);
165         }
166         W_ERROR_NOT_OK_RETURN(werror);
167
168         rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
169         W_ERROR_HAVE_NO_MEMORY(rec);
170
171         werror = dns_rr_to_dnsp(rec, pr, rec);
172         W_ERROR_NOT_OK_RETURN(werror);
173
174         for (i = 0; i < acount; i++) {
175                 if (dns_records_match(rec, &ans[i])) {
176                         found = true;
177                         break;
178                 }
179         }
180
181         if (!found) {
182                 return DNS_ERR(NXRRSET);
183         }
184
185         return WERR_OK;
186 }
187
188 static WERROR check_prerequisites(struct dns_server *dns,
189                                   TALLOC_CTX *mem_ctx,
190                                   const struct dns_name_question *zone,
191                                   const struct dns_res_rec *prereqs, uint16_t count)
192 {
193         uint16_t i;
194         WERROR final_error = WERR_OK;
195
196         for (i = 0; i < count; i++) {
197                 bool final;
198                 WERROR werror;
199
200                 werror = check_one_prerequisite(dns, mem_ctx, zone,
201                                                 &prereqs[i], &final);
202                 if (!W_ERROR_IS_OK(werror)) {
203                         if (final) {
204                                 return werror;
205                         }
206                         if (W_ERROR_IS_OK(final_error)) {
207                                 final_error = werror;
208                         }
209                 }
210         }
211
212         if (!W_ERROR_IS_OK(final_error)) {
213                 return final_error;
214         }
215
216         return WERR_OK;
217 }
218
219 static WERROR update_prescan(const struct dns_name_question *zone,
220                              const struct dns_res_rec *updates, uint16_t count)
221 {
222         const struct dns_res_rec *r;
223         uint16_t i;
224         size_t host_part_len;
225         bool match;
226
227         for (i = 0; i < count; i++) {
228                 r = &updates[i];
229                 match = dns_name_match(zone->name, r->name, &host_part_len);
230                 if (!match) {
231                         return DNS_ERR(NOTZONE);
232                 }
233                 if (zone->question_class == r->rr_class) {
234                         if (r->rr_type == DNS_QTYPE_ALL) {
235                                 return DNS_ERR(FORMAT_ERROR);
236                         }
237                         if (r->rr_type == DNS_QTYPE_AXFR) {
238                                 return DNS_ERR(FORMAT_ERROR);
239                         }
240                         if (r->rr_type == DNS_QTYPE_MAILB) {
241                                 return DNS_ERR(FORMAT_ERROR);
242                         }
243                         if (r->rr_type == DNS_QTYPE_MAILA) {
244                                 return DNS_ERR(FORMAT_ERROR);
245                         }
246                 } else if (r->rr_class == DNS_QCLASS_ANY) {
247                         if (r->ttl != 0) {
248                                 return DNS_ERR(FORMAT_ERROR);
249                         }
250                         if (r->length != 0) {
251                                 return DNS_ERR(FORMAT_ERROR);
252                         }
253                         if (r->rr_type == DNS_QTYPE_AXFR) {
254                                 return DNS_ERR(FORMAT_ERROR);
255                         }
256                         if (r->rr_type == DNS_QTYPE_MAILB) {
257                                 return DNS_ERR(FORMAT_ERROR);
258                         }
259                         if (r->rr_type == DNS_QTYPE_MAILA) {
260                                 return DNS_ERR(FORMAT_ERROR);
261                         }
262                 } else if (r->rr_class == DNS_QCLASS_NONE) {
263                         if (r->ttl != 0) {
264                                 return DNS_ERR(FORMAT_ERROR);
265                         }
266                         if (r->rr_type == DNS_QTYPE_ALL) {
267                                 return DNS_ERR(FORMAT_ERROR);
268                         }
269                         if (r->rr_type == DNS_QTYPE_AXFR) {
270                                 return DNS_ERR(FORMAT_ERROR);
271                         }
272                         if (r->rr_type == DNS_QTYPE_MAILB) {
273                                 return DNS_ERR(FORMAT_ERROR);
274                         }
275                         if (r->rr_type == DNS_QTYPE_MAILA) {
276                                 return DNS_ERR(FORMAT_ERROR);
277                         }
278                 } else {
279                         return DNS_ERR(FORMAT_ERROR);
280                 }
281         }
282         return WERR_OK;
283 }
284
285 static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
286                              const struct dns_res_rec *rrec,
287                              struct dnsp_DnssrvRpcRecord *r)
288 {
289         char *tmp;
290         char *txt_record_txt;
291         char *saveptr = NULL;
292
293         if (rrec->rr_type == DNS_QTYPE_ALL) {
294                 return DNS_ERR(FORMAT_ERROR);
295         }
296
297         ZERO_STRUCTP(r);
298
299         r->wType = rrec->rr_type;
300         r->dwTtlSeconds = rrec->ttl;
301         r->rank = DNS_RANK_ZONE;
302         /* TODO: Autogenerate this somehow */
303         r->dwSerial = 110;
304
305         /* If we get QCLASS_ANY, we're done here */
306         if (rrec->rr_class == DNS_QCLASS_ANY) {
307                 goto done;
308         }
309
310         switch(rrec->rr_type) {
311         case DNS_QTYPE_A:
312                 r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
313                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
314                 break;
315         case DNS_QTYPE_AAAA:
316                 r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
317                 W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
318                 break;
319         case DNS_QTYPE_NS:
320                 r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
321                 W_ERROR_HAVE_NO_MEMORY(r->data.ns);
322                 break;
323         case DNS_QTYPE_CNAME:
324                 r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
325                 W_ERROR_HAVE_NO_MEMORY(r->data.cname);
326                 break;
327         case DNS_QTYPE_SRV:
328                 r->data.srv.wPriority = rrec->rdata.srv_record.priority;
329                 r->data.srv.wWeight = rrec->rdata.srv_record.weight;
330                 r->data.srv.wPort = rrec->rdata.srv_record.port;
331                 r->data.srv.nameTarget = talloc_strdup(mem_ctx,
332                                 rrec->rdata.srv_record.target);
333                 W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
334                 break;
335         case DNS_QTYPE_PTR:
336                 r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
337                 W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
338                 break;
339         case DNS_QTYPE_MX:
340                 r->data.mx.wPriority = rrec->rdata.mx_record.preference;
341                 r->data.mx.nameTarget = talloc_strdup(mem_ctx,
342                                 rrec->rdata.mx_record.exchange);
343                 W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
344                 break;
345         case DNS_QTYPE_TXT:
346                 r->data.txt.count = 0;
347                 r->data.txt.str = talloc_array(mem_ctx, const char *,
348                                                r->data.txt.count);
349                 W_ERROR_HAVE_NO_MEMORY(r->data.txt.str);
350
351                 txt_record_txt = talloc_strdup(r->data.txt.str,
352                                                rrec->rdata.txt_record.txt);
353                 W_ERROR_HAVE_NO_MEMORY(txt_record_txt);
354
355                 tmp = strtok_r(txt_record_txt, "\"", &saveptr);
356                 while (tmp) {
357                         if (strcmp(tmp, " ") == 0) {
358                                 tmp = strtok_r(NULL, "\"", &saveptr);
359                                 continue;
360                         }
361                         r->data.txt.str = talloc_realloc(mem_ctx, r->data.txt.str, const char *,
362                                                         r->data.txt.count+1);
363                         r->data.txt.str[r->data.txt.count] = talloc_strdup(r->data.txt.str, tmp);
364                         W_ERROR_HAVE_NO_MEMORY(r->data.txt.str[r->data.txt.count]);
365
366                         r->data.txt.count++;
367                         tmp = strtok_r(NULL, "\"", &saveptr);
368                 }
369
370                 break;
371         default:
372                 DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
373                 return DNS_ERR(NOT_IMPLEMENTED);
374         }
375
376 done:
377
378         return WERR_OK;
379 }
380
381
382 static WERROR handle_one_update(struct dns_server *dns,
383                                 TALLOC_CTX *mem_ctx,
384                                 const struct dns_name_question *zone,
385                                 const struct dns_res_rec *update,
386                                 const struct dns_server_tkey *tkey)
387 {
388         struct dnsp_DnssrvRpcRecord *recs = NULL;
389         uint16_t rcount = 0;
390         struct ldb_dn *dn;
391         uint16_t i;
392         WERROR werror;
393         bool needs_add = false;
394
395         DEBUG(2, ("Looking at record: \n"));
396         if (DEBUGLVL(2)) {
397                 NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
398         }
399
400         switch (update->rr_type) {
401         case DNS_QTYPE_A:
402         case DNS_QTYPE_NS:
403         case DNS_QTYPE_CNAME:
404         case DNS_QTYPE_SOA:
405         case DNS_QTYPE_PTR:
406         case DNS_QTYPE_MX:
407         case DNS_QTYPE_AAAA:
408         case DNS_QTYPE_SRV:
409         case DNS_QTYPE_TXT:
410                 break;
411         default:
412                 DEBUG(0, ("Can't handle updates of type %u yet\n",
413                           update->rr_type));
414                 return DNS_ERR(NOT_IMPLEMENTED);
415         }
416
417         werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
418         W_ERROR_NOT_OK_RETURN(werror);
419
420         werror = dns_lookup_records(dns, mem_ctx, dn, &recs, &rcount);
421         if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
422                 recs = NULL;
423                 rcount = 0;
424                 needs_add = true;
425                 werror = WERR_OK;
426         }
427         W_ERROR_NOT_OK_RETURN(werror);
428
429         if (update->rr_class == zone->question_class) {
430                 if (update->rr_type == DNS_QTYPE_CNAME) {
431                         /*
432                          * If there is a record in the directory
433                          * that's not a CNAME, ignore update
434                          */
435                         for (i = 0; i < rcount; i++) {
436                                 if (recs[i].wType != DNS_TYPE_CNAME) {
437                                         DEBUG(5, ("Skipping update\n"));
438                                         return WERR_OK;
439                                 }
440                                 break;
441                         }
442
443                         /*
444                          * There should be no entries besides one CNAME record
445                          * per name, so replace everything with the new CNAME
446                          */
447
448                         rcount = 1;
449                         recs = talloc_realloc(mem_ctx, recs,
450                                         struct dnsp_DnssrvRpcRecord, rcount);
451                         W_ERROR_HAVE_NO_MEMORY(recs);
452
453                         werror = dns_rr_to_dnsp(recs, update, &recs[0]);
454                         W_ERROR_NOT_OK_RETURN(werror);
455
456                         werror = dns_replace_records(dns, mem_ctx, dn,
457                                                      needs_add, recs, rcount);
458                         W_ERROR_NOT_OK_RETURN(werror);
459
460                         return WERR_OK;
461                 } else {
462                         /*
463                          * If there is a CNAME record for this name,
464                          * ignore update
465                          */
466                         for (i = 0; i < rcount; i++) {
467                                 if (recs[i].wType == DNS_TYPE_CNAME) {
468                                         DEBUG(5, ("Skipping update\n"));
469                                         return WERR_OK;
470                                 }
471                         }
472                 }
473                 if (update->rr_type == DNS_QTYPE_SOA) {
474                         bool found = false;
475
476                         /*
477                          * If the zone has no SOA record?? or update's
478                          * serial number is smaller than existing SOA's,
479                          * ignore update
480                          */
481                         for (i = 0; i < rcount; i++) {
482                                 if (recs[i].wType == DNS_TYPE_SOA) {
483                                         uint16_t n, o;
484
485                                         n = update->rdata.soa_record.serial;
486                                         o = recs[i].data.soa.serial;
487                                         /*
488                                          * TODO: Implement RFC 1982 comparison
489                                          * logic for RFC2136
490                                          */
491                                         if (n <= o) {
492                                                 DEBUG(5, ("Skipping update\n"));
493                                                 return WERR_OK;
494                                         }
495                                         found = true;
496                                         break;
497                                 }
498                         }
499                         if (!found) {
500                                 DEBUG(5, ("Skipping update\n"));
501                                 return WERR_OK;
502                         }
503
504                         werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
505                         W_ERROR_NOT_OK_RETURN(werror);
506
507                         for (i++; i < rcount; i++) {
508                                 if (recs[i].wType != DNS_TYPE_SOA) {
509                                         continue;
510                                 }
511
512                                 ZERO_STRUCT(recs[i]);
513                         }
514
515                         werror = dns_replace_records(dns, mem_ctx, dn,
516                                                      needs_add, recs, rcount);
517                         W_ERROR_NOT_OK_RETURN(werror);
518
519                         return WERR_OK;
520                 }
521
522                 recs = talloc_realloc(mem_ctx, recs,
523                                 struct dnsp_DnssrvRpcRecord, rcount+1);
524                 W_ERROR_HAVE_NO_MEMORY(recs);
525
526                 werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
527                 W_ERROR_NOT_OK_RETURN(werror);
528
529                 for (i = 0; i < rcount; i++) {
530                         if (!dns_records_match(&recs[i], &recs[rcount])) {
531                                 continue;
532                         }
533
534                         recs[i] = recs[rcount];
535
536                         werror = dns_replace_records(dns, mem_ctx, dn,
537                                                      needs_add, recs, rcount);
538                         W_ERROR_NOT_OK_RETURN(werror);
539
540                         return WERR_OK;
541                 }
542
543                 werror = dns_replace_records(dns, mem_ctx, dn,
544                                              needs_add, recs, rcount+1);
545                 W_ERROR_NOT_OK_RETURN(werror);
546
547                 return WERR_OK;
548         } else if (update->rr_class == DNS_QCLASS_ANY) {
549                 if (update->rr_type == DNS_QTYPE_ALL) {
550                         if (dns_name_equal(update->name, zone->name)) {
551                                 for (i = 0; i < rcount; i++) {
552
553                                         if (recs[i].wType == DNS_TYPE_SOA) {
554                                                 continue;
555                                         }
556
557                                         if (recs[i].wType == DNS_TYPE_NS) {
558                                                 continue;
559                                         }
560
561                                         ZERO_STRUCT(recs[i]);
562                                 }
563
564                         } else {
565                                 for (i = 0; i < rcount; i++) {
566                                         ZERO_STRUCT(recs[i]);
567                                 }
568                         }
569
570                 } else if (dns_name_equal(update->name, zone->name)) {
571
572                         if (update->rr_type == DNS_QTYPE_SOA) {
573                                 return WERR_OK;
574                         }
575
576                         if (update->rr_type == DNS_QTYPE_NS) {
577                                 return WERR_OK;
578                         }
579                 }
580                 for (i = 0; i < rcount; i++) {
581                         if (recs[i].wType == update->rr_type) {
582                                 ZERO_STRUCT(recs[i]);
583                         }
584                 }
585
586                 werror = dns_replace_records(dns, mem_ctx, dn,
587                                              needs_add, recs, rcount);
588                 W_ERROR_NOT_OK_RETURN(werror);
589
590                 return WERR_OK;
591         } else if (update->rr_class == DNS_QCLASS_NONE) {
592                 struct dnsp_DnssrvRpcRecord *del_rec;
593
594                 if (update->rr_type == DNS_QTYPE_SOA) {
595                         return WERR_OK;
596                 }
597                 if (update->rr_type == DNS_QTYPE_NS) {
598                         bool found = false;
599                         struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
600                                                 struct dnsp_DnssrvRpcRecord);
601                         W_ERROR_HAVE_NO_MEMORY(ns_rec);
602
603
604                         werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
605                         W_ERROR_NOT_OK_RETURN(werror);
606
607                         for (i = 0; i < rcount; i++) {
608                                 if (dns_records_match(ns_rec, &recs[i])) {
609                                         found = true;
610                                         break;
611                                 }
612                         }
613                         if (found) {
614                                 return WERR_OK;
615                         }
616                 }
617
618                 del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
619                 W_ERROR_HAVE_NO_MEMORY(del_rec);
620
621                 werror = dns_rr_to_dnsp(del_rec, update, del_rec);
622                 W_ERROR_NOT_OK_RETURN(werror);
623
624                 for (i = 0; i < rcount; i++) {
625                         if (dns_records_match(del_rec, &recs[i])) {
626                                 ZERO_STRUCT(recs[i]);
627                         }
628                 }
629
630                 werror = dns_replace_records(dns, mem_ctx, dn,
631                                              needs_add, recs, rcount);
632                 W_ERROR_NOT_OK_RETURN(werror);
633         }
634
635         return WERR_OK;
636 }
637
638 static WERROR handle_updates(struct dns_server *dns,
639                              TALLOC_CTX *mem_ctx,
640                              const struct dns_name_question *zone,
641                              const struct dns_res_rec *prereqs, uint16_t pcount,
642                              struct dns_res_rec *updates, uint16_t upd_count,
643                              struct dns_server_tkey *tkey)
644 {
645         struct ldb_dn *zone_dn = NULL;
646         WERROR werror = WERR_OK;
647         int ret;
648         uint16_t ri;
649         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
650
651         if (tkey != NULL) {
652                 ret = ldb_set_opaque(dns->samdb, "sessionInfo", tkey->session_info);
653                 if (ret != LDB_SUCCESS) {
654                         DEBUG(1, ("unable to set session info\n"));
655                         werror = DNS_ERR(SERVER_FAILURE);
656                         goto failed;
657                 }
658         }
659
660         werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
661         W_ERROR_NOT_OK_GOTO(werror, failed);
662
663         ret = ldb_transaction_start(dns->samdb);
664         if (ret != LDB_SUCCESS) {
665                 werror = DNS_ERR(SERVER_FAILURE);
666                 goto failed;
667         }
668
669         werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
670         W_ERROR_NOT_OK_GOTO(werror, failed);
671
672         DEBUG(1, ("update count is %u\n", upd_count));
673
674         for (ri = 0; ri < upd_count; ri++) {
675                 werror = handle_one_update(dns, tmp_ctx, zone,
676                                            &updates[ri], tkey);
677                 W_ERROR_NOT_OK_GOTO(werror, failed);
678         }
679
680         ldb_transaction_commit(dns->samdb);
681         TALLOC_FREE(tmp_ctx);
682
683         if (tkey != NULL) {
684                 ldb_set_opaque(dns->samdb, "sessionInfo",
685                                system_session(dns->task->lp_ctx));
686         }
687
688         return WERR_OK;
689
690 failed:
691         ldb_transaction_cancel(dns->samdb);
692
693         if (tkey != NULL) {
694                 ldb_set_opaque(dns->samdb, "sessionInfo",
695                                system_session(dns->task->lp_ctx));
696         }
697
698         TALLOC_FREE(tmp_ctx);
699         return werror;
700
701 }
702
703 static WERROR dns_update_allowed(struct dns_server *dns,
704                                  struct dns_request_state *state,
705                                  struct dns_server_tkey **tkey)
706 {
707         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
708                 DEBUG(2, ("All updates allowed.\n"));
709                 return WERR_OK;
710         }
711
712         if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
713                 DEBUG(2, ("Updates disabled.\n"));
714                 return DNS_ERR(REFUSED);
715         }
716
717         if (state->authenticated == false ) {
718                 DEBUG(2, ("Update not allowed for unsigned packet.\n"));
719                 return DNS_ERR(REFUSED);
720         }
721
722         *tkey = dns_find_tkey(dns->tkeys, state->key_name);
723         if (*tkey == NULL) {
724                 DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
725                 return DNS_ERR(REFUSED);
726         }
727
728         return WERR_OK;
729 }
730
731
732 WERROR dns_server_process_update(struct dns_server *dns,
733                                  struct dns_request_state *state,
734                                  TALLOC_CTX *mem_ctx,
735                                  struct dns_name_packet *in,
736                                  struct dns_res_rec **prereqs,    uint16_t *prereq_count,
737                                  struct dns_res_rec **updates,    uint16_t *update_count,
738                                  struct dns_res_rec **additional, uint16_t *arcount)
739 {
740         struct dns_name_question *zone;
741         const struct dns_server_zone *z;
742         size_t host_part_len = 0;
743         WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
744         struct dns_server_tkey *tkey = NULL;
745
746         if (in->qdcount != 1) {
747                 return DNS_ERR(FORMAT_ERROR);
748         }
749
750         zone = &in->questions[0];
751
752         if (zone->question_class != DNS_QCLASS_IN &&
753             zone->question_class != DNS_QCLASS_ANY) {
754                 return DNS_ERR(NOT_IMPLEMENTED);
755         }
756
757         if (zone->question_type != DNS_QTYPE_SOA) {
758                 return DNS_ERR(FORMAT_ERROR);
759         }
760
761         DEBUG(2, ("Got a dns update request.\n"));
762
763         for (z = dns->zones; z != NULL; z = z->next) {
764                 bool match;
765
766                 match = dns_name_match(z->name, zone->name, &host_part_len);
767                 if (match) {
768                         break;
769                 }
770         }
771
772         if (z == NULL) {
773                 DEBUG(1, ("We're not authoritative for this zone\n"));
774                 return DNS_ERR(NOTAUTH);
775         }
776
777         if (host_part_len != 0) {
778                 /* TODO: We need to delegate this one */
779                 DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
780                 return DNS_ERR(NOT_IMPLEMENTED);
781         }
782
783         *prereq_count = in->ancount;
784         *prereqs = in->answers;
785         werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
786                                      *prereq_count);
787         W_ERROR_NOT_OK_RETURN(werror);
788
789         werror = dns_update_allowed(dns, state, &tkey);
790         if (!W_ERROR_IS_OK(werror)) {
791                 return werror;
792         }
793
794         *update_count = in->nscount;
795         *updates = in->nsrecs;
796         werror = update_prescan(in->questions, *updates, *update_count);
797         W_ERROR_NOT_OK_RETURN(werror);
798
799         werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
800                                 *prereq_count, *updates, *update_count, tkey);
801         W_ERROR_NOT_OK_RETURN(werror);
802
803         return werror;
804 }