dnsserver: Tighten DNS name checking
[nivanova/samba-autobuild/.git] / source4 / dns_server / dnsserver_common.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    DNS server utils
5
6    Copyright (C) 2010 Kai Blin
7    Copyright (C) 2014 Stefan Metzmacher
8    Copyright (C) 2015 Andrew Bartlett
9
10    This program is free software; you can redistribute it and/or modify
11    it under the terms of the GNU General Public License as published by
12    the Free Software Foundation; either version 3 of the License, or
13    (at your option) any later version.
14
15    This program is distributed in the hope that it will be useful,
16    but WITHOUT ANY WARRANTY; without even the implied warranty of
17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18    GNU General Public License for more details.
19
20    You should have received a copy of the GNU General Public License
21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "libcli/util/ntstatus.h"
26 #include "libcli/util/werror.h"
27 #include "librpc/ndr/libndr.h"
28 #include "librpc/gen_ndr/ndr_dns.h"
29 #include "librpc/gen_ndr/ndr_dnsp.h"
30 #include <ldb.h>
31 #include "dsdb/samdb/samdb.h"
32 #include "dsdb/common/util.h"
33 #include "dns_server/dnsserver_common.h"
34 #include "lib/util/dlinklist.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_DNS
38
39 uint8_t werr_to_dns_err(WERROR werr)
40 {
41         if (W_ERROR_EQUAL(WERR_OK, werr)) {
42                 return DNS_RCODE_OK;
43         } else if (W_ERROR_EQUAL(DNS_ERR(FORMAT_ERROR), werr)) {
44                 return DNS_RCODE_FORMERR;
45         } else if (W_ERROR_EQUAL(DNS_ERR(SERVER_FAILURE), werr)) {
46                 return DNS_RCODE_SERVFAIL;
47         } else if (W_ERROR_EQUAL(DNS_ERR(NAME_ERROR), werr)) {
48                 return DNS_RCODE_NXDOMAIN;
49         } else if (W_ERROR_EQUAL(WERR_DNS_ERROR_NAME_DOES_NOT_EXIST, werr)) {
50                 return DNS_RCODE_NXDOMAIN;
51         } else if (W_ERROR_EQUAL(DNS_ERR(NOT_IMPLEMENTED), werr)) {
52                 return DNS_RCODE_NOTIMP;
53         } else if (W_ERROR_EQUAL(DNS_ERR(REFUSED), werr)) {
54                 return DNS_RCODE_REFUSED;
55         } else if (W_ERROR_EQUAL(DNS_ERR(YXDOMAIN), werr)) {
56                 return DNS_RCODE_YXDOMAIN;
57         } else if (W_ERROR_EQUAL(DNS_ERR(YXRRSET), werr)) {
58                 return DNS_RCODE_YXRRSET;
59         } else if (W_ERROR_EQUAL(DNS_ERR(NXRRSET), werr)) {
60                 return DNS_RCODE_NXRRSET;
61         } else if (W_ERROR_EQUAL(DNS_ERR(NOTAUTH), werr)) {
62                 return DNS_RCODE_NOTAUTH;
63         } else if (W_ERROR_EQUAL(DNS_ERR(NOTZONE), werr)) {
64                 return DNS_RCODE_NOTZONE;
65         } else if (W_ERROR_EQUAL(DNS_ERR(BADKEY), werr)) {
66                 return DNS_RCODE_BADKEY;
67         }
68         DEBUG(5, ("No mapping exists for %s\n", win_errstr(werr)));
69         return DNS_RCODE_SERVFAIL;
70 }
71
72 WERROR dns_common_extract(struct ldb_context *samdb,
73                           const struct ldb_message_element *el,
74                           TALLOC_CTX *mem_ctx,
75                           struct dnsp_DnssrvRpcRecord **records,
76                           uint16_t *num_records)
77 {
78         uint16_t ri;
79         struct dnsp_DnssrvRpcRecord *recs;
80
81         *records = NULL;
82         *num_records = 0;
83
84         recs = talloc_zero_array(mem_ctx, struct dnsp_DnssrvRpcRecord,
85                                  el->num_values);
86         if (recs == NULL) {
87                 return WERR_NOT_ENOUGH_MEMORY;
88         }
89         for (ri = 0; ri < el->num_values; ri++) {
90                 bool am_rodc;
91                 int ret;
92                 const char *dnsHostName = NULL;
93                 struct ldb_val *v = &el->values[ri];
94                 enum ndr_err_code ndr_err;
95                 ndr_err = ndr_pull_struct_blob(v, recs, &recs[ri],
96                                 (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
97                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
98                         TALLOC_FREE(recs);
99                         DEBUG(0, ("Failed to grab dnsp_DnssrvRpcRecord\n"));
100                         return DNS_ERR(SERVER_FAILURE);
101                 }
102
103                 /*
104                  * In AD, except on an RODC (where we should list a random RWDC,
105                  * we should over-stamp the MNAME with our own hostname
106                  */
107                 if (recs[ri].wType != DNS_TYPE_SOA) {
108                         continue;
109                 }
110
111                 ret = samdb_rodc(samdb, &am_rodc);
112                 if (ret != LDB_SUCCESS) {
113                         DEBUG(0, ("Failed to confirm we are not an RODC: %s\n",
114                                   ldb_errstring(samdb)));
115                         return DNS_ERR(SERVER_FAILURE);
116                 }
117
118                 if (am_rodc) {
119                         continue;
120                 }
121
122                 ret = samdb_dns_host_name(samdb, &dnsHostName);
123                 if (ret != LDB_SUCCESS || dnsHostName == NULL) {
124                         DEBUG(0, ("Failed to get dnsHostName from rootDSE"));
125                         return DNS_ERR(SERVER_FAILURE);
126                 }
127
128                 recs[ri].data.soa.mname = talloc_strdup(recs, dnsHostName);
129         }
130
131         *records = recs;
132         *num_records = el->num_values;
133         return WERR_OK;
134 }
135
136 WERROR dns_common_lookup(struct ldb_context *samdb,
137                          TALLOC_CTX *mem_ctx,
138                          struct ldb_dn *dn,
139                          struct dnsp_DnssrvRpcRecord **records,
140                          uint16_t *num_records,
141                          bool *tombstoned)
142 {
143         static const char * const attrs[] = {
144                 "dnsRecord",
145                 "dNSTombstoned",
146                 NULL
147         };
148         int ret;
149         WERROR werr;
150         struct ldb_message *msg = NULL;
151         struct ldb_message_element *el;
152
153         *records = NULL;
154         *num_records = 0;
155
156         if (tombstoned != NULL) {
157                 *tombstoned = false;
158                 ret = dsdb_search_one(samdb, mem_ctx, &msg, dn,
159                         LDB_SCOPE_BASE, attrs, 0,
160                         "(objectClass=dnsNode)");
161         } else {
162                 ret = dsdb_search_one(samdb, mem_ctx, &msg, dn,
163                         LDB_SCOPE_BASE, attrs, 0,
164                         "(&(objectClass=dnsNode)(!(dNSTombstoned=TRUE)))");
165         }
166         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
167                 return WERR_DNS_ERROR_NAME_DOES_NOT_EXIST;
168         }
169         if (ret != LDB_SUCCESS) {
170                 /* TODO: we need to check if there's a glue record we need to
171                  * create a referral to */
172                 return DNS_ERR(NAME_ERROR);
173         }
174
175         if (tombstoned != NULL) {
176                 *tombstoned = ldb_msg_find_attr_as_bool(msg,
177                                         "dNSTombstoned", false);
178         }
179
180         el = ldb_msg_find_element(msg, "dnsRecord");
181         if (el == NULL) {
182                 TALLOC_FREE(msg);
183                 /*
184                  * records produced by older Samba releases
185                  * keep dnsNode objects without dnsRecord and
186                  * without setting dNSTombstoned=TRUE.
187                  *
188                  * We just pretend they're tombstones.
189                  */
190                 if (tombstoned != NULL) {
191                         struct dnsp_DnssrvRpcRecord *recs;
192                         recs = talloc_array(mem_ctx,
193                                             struct dnsp_DnssrvRpcRecord,
194                                             1);
195                         if (recs == NULL) {
196                                 return WERR_NOT_ENOUGH_MEMORY;
197                         }
198                         recs[0] = (struct dnsp_DnssrvRpcRecord) {
199                                 .wType = DNS_TYPE_TOMBSTONE,
200                                 /*
201                                  * A value of timestamp != 0
202                                  * indicated that the object was already
203                                  * a tombstone, this will be used
204                                  * in dns_common_replace()
205                                  */
206                                 .data.timestamp = 1,
207                         };
208
209                         *tombstoned = true;
210                         *records = recs;
211                         *num_records = 1;
212                         return WERR_OK;
213                 } else {
214                         /*
215                          * Because we are not looking for a tombstone
216                          * in this codepath, we just pretend it does
217                          * not exist at all.
218                          */
219                         return WERR_DNS_ERROR_NAME_DOES_NOT_EXIST;
220                 }
221         }
222
223         werr = dns_common_extract(samdb, el, mem_ctx, records, num_records);
224         TALLOC_FREE(msg);
225         if (!W_ERROR_IS_OK(werr)) {
226                 return werr;
227         }
228
229         return WERR_OK;
230 }
231
232 static int rec_cmp(const struct dnsp_DnssrvRpcRecord *r1,
233                    const struct dnsp_DnssrvRpcRecord *r2)
234 {
235         if (r1->wType != r2->wType) {
236                 /*
237                  * The records are sorted with higher types first
238                  */
239                 return r2->wType - r1->wType;
240         }
241
242         /*
243          * Then we need to sort from the oldest to newest timestamp
244          */
245         return r1->dwTimeStamp - r2->dwTimeStamp;
246 }
247
248 /*
249  * Check for valid DNS names. These are names which:
250  *   - are non-empty
251  *   - do not start with a dot
252  *   - do not have any empty labels
253  *   - have no more than 127 labels
254  *   - are no longer than 253 characters
255  *   - none of the labels exceed 63 characters
256  */
257 WERROR dns_name_check(TALLOC_CTX *mem_ctx, size_t len, const char *name)
258 {
259         size_t i;
260         unsigned int labels    = 0;
261         unsigned int label_len = 0;
262
263         if (len == 0) {
264                 return WERR_DS_INVALID_DN_SYNTAX;
265         }
266
267         if (len > 1 && name[0] == '.') {
268                 return WERR_DS_INVALID_DN_SYNTAX;
269         }
270
271         if ((len - 1) > DNS_MAX_DOMAIN_LENGTH) {
272                 return WERR_DS_INVALID_DN_SYNTAX;
273         }
274
275         for (i = 0; i < len - 1; i++) {
276                 if (name[i] == '.' && name[i+1] == '.') {
277                         return WERR_DS_INVALID_DN_SYNTAX;
278                 }
279                 if (name[i] == '.') {
280                         labels++;
281                         if (labels > DNS_MAX_LABELS) {
282                                 return WERR_DS_INVALID_DN_SYNTAX;
283                         }
284                         label_len = 0;
285                 } else {
286                         label_len++;
287                         if (label_len > DNS_MAX_LABEL_LENGTH) {
288                                 return WERR_DS_INVALID_DN_SYNTAX;
289                         }
290                 }
291         }
292
293         return WERR_OK;
294 }
295
296 static WERROR check_name_list(TALLOC_CTX *mem_ctx, uint16_t rec_count,
297                               struct dnsp_DnssrvRpcRecord *records)
298 {
299         WERROR werr;
300         uint16_t i;
301         size_t len;
302         struct dnsp_DnssrvRpcRecord record;
303
304         werr = WERR_OK;
305         for (i = 0; i < rec_count; i++) {
306                 record = records[i];
307
308                 switch (record.wType) {
309
310                 case DNS_TYPE_NS:
311                         len = strlen(record.data.ns);
312                         werr = dns_name_check(mem_ctx, len, record.data.ns);
313                         break;
314                 case DNS_TYPE_CNAME:
315                         len = strlen(record.data.cname);
316                         werr = dns_name_check(mem_ctx, len, record.data.cname);
317                         break;
318                 case DNS_TYPE_SOA:
319                         len = strlen(record.data.soa.mname);
320                         werr = dns_name_check(mem_ctx, len, record.data.soa.mname);
321                         if (!W_ERROR_IS_OK(werr)) {
322                                 break;
323                         }
324                         len = strlen(record.data.soa.rname);
325                         werr = dns_name_check(mem_ctx, len, record.data.soa.rname);
326                         break;
327                 case DNS_TYPE_PTR:
328                         len = strlen(record.data.ptr);
329                         werr = dns_name_check(mem_ctx, len, record.data.ptr);
330                         break;
331                 case DNS_TYPE_MX:
332                         len = strlen(record.data.mx.nameTarget);
333                         werr = dns_name_check(mem_ctx, len, record.data.mx.nameTarget);
334                         break;
335                 case DNS_TYPE_SRV:
336                         len = strlen(record.data.srv.nameTarget);
337                         werr = dns_name_check(mem_ctx, len,
338                                               record.data.srv.nameTarget);
339                         break;
340                 /*
341                  * In the default case, the record doesn't have a DN, so it
342                  * must be ok.
343                  */
344                 default:
345                         break;
346                 }
347
348                 if (!W_ERROR_IS_OK(werr)) {
349                         return werr;
350                 }
351         }
352
353         return WERR_OK;
354 }
355
356 WERROR dns_common_replace(struct ldb_context *samdb,
357                           TALLOC_CTX *mem_ctx,
358                           struct ldb_dn *dn,
359                           bool needs_add,
360                           uint32_t serial,
361                           struct dnsp_DnssrvRpcRecord *records,
362                           uint16_t rec_count)
363 {
364         struct ldb_message_element *el;
365         uint16_t i;
366         int ret;
367         WERROR werr;
368         struct ldb_message *msg = NULL;
369         bool was_tombstoned = false;
370         bool become_tombstoned = false;
371
372         msg = ldb_msg_new(mem_ctx);
373         W_ERROR_HAVE_NO_MEMORY(msg);
374
375         msg->dn = dn;
376
377         werr = check_name_list(mem_ctx, rec_count, records);
378         if (!W_ERROR_IS_OK(werr)) {
379                 return werr;
380         }
381
382         ret = ldb_msg_add_empty(msg, "dnsRecord", LDB_FLAG_MOD_REPLACE, &el);
383         if (ret != LDB_SUCCESS) {
384                 return DNS_ERR(SERVER_FAILURE);
385         }
386
387         /*
388          * we have at least one value,
389          * which might be used for the tombstone marker
390          */
391         el->values = talloc_zero_array(el, struct ldb_val, MAX(1, rec_count));
392         if (rec_count > 0) {
393                 W_ERROR_HAVE_NO_MEMORY(el->values);
394
395                 /*
396                  * We store a sorted list with the high wType values first
397                  * that's what windows does. It also simplifies the
398                  * filtering of DNS_TYPE_TOMBSTONE records
399                  */
400                 TYPESAFE_QSORT(records, rec_count, rec_cmp);
401         }
402
403         for (i = 0; i < rec_count; i++) {
404                 struct ldb_val *v = &el->values[el->num_values];
405                 enum ndr_err_code ndr_err;
406
407                 if (records[i].wType == DNS_TYPE_TOMBSTONE) {
408                         if (records[i].data.timestamp != 0) {
409                                 was_tombstoned = true;
410                         }
411                         continue;
412                 }
413
414                 records[i].dwSerial = serial;
415                 ndr_err = ndr_push_struct_blob(v, el->values, &records[i],
416                                 (ndr_push_flags_fn_t)ndr_push_dnsp_DnssrvRpcRecord);
417                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
418                         DEBUG(0, ("Failed to push dnsp_DnssrvRpcRecord\n"));
419                         return DNS_ERR(SERVER_FAILURE);
420                 }
421                 el->num_values++;
422         }
423
424         if (needs_add) {
425                 if (el->num_values == 0) {
426                         return WERR_OK;
427                 }
428
429                 ret = ldb_msg_add_string(msg, "objectClass", "dnsNode");
430                 if (ret != LDB_SUCCESS) {
431                         return DNS_ERR(SERVER_FAILURE);
432                 }
433
434                 ret = ldb_add(samdb, msg);
435                 if (ret != LDB_SUCCESS) {
436                         return DNS_ERR(SERVER_FAILURE);
437                 }
438
439                 return WERR_OK;
440         }
441
442         if (el->num_values == 0) {
443                 struct dnsp_DnssrvRpcRecord tbs;
444                 struct ldb_val *v = &el->values[el->num_values];
445                 enum ndr_err_code ndr_err;
446                 struct timeval tv;
447
448                 if (was_tombstoned) {
449                         /*
450                          * This is already a tombstoned object.
451                          * Just leave it instead of updating the time stamp.
452                          */
453                         return WERR_OK;
454                 }
455
456                 tv = timeval_current();
457                 tbs = (struct dnsp_DnssrvRpcRecord) {
458                         .wType = DNS_TYPE_TOMBSTONE,
459                         .dwSerial = serial,
460                         .data.timestamp = timeval_to_nttime(&tv),
461                 };
462
463                 ndr_err = ndr_push_struct_blob(v, el->values, &tbs,
464                                 (ndr_push_flags_fn_t)ndr_push_dnsp_DnssrvRpcRecord);
465                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
466                         DEBUG(0, ("Failed to push dnsp_DnssrvRpcRecord\n"));
467                         return DNS_ERR(SERVER_FAILURE);
468                 }
469                 el->num_values++;
470
471                 become_tombstoned = true;
472         }
473
474         if (was_tombstoned || become_tombstoned) {
475                 ret = ldb_msg_add_empty(msg, "dNSTombstoned",
476                                         LDB_FLAG_MOD_REPLACE, NULL);
477                 if (ret != LDB_SUCCESS) {
478                         return DNS_ERR(SERVER_FAILURE);
479                 }
480
481                 ret = ldb_msg_add_fmt(msg, "dNSTombstoned", "%s",
482                                       become_tombstoned ? "TRUE" : "FALSE");
483                 if (ret != LDB_SUCCESS) {
484                         return DNS_ERR(SERVER_FAILURE);
485                 }
486         }
487
488         ret = ldb_modify(samdb, msg);
489         if (ret != LDB_SUCCESS) {
490                 NTSTATUS nt = dsdb_ldb_err_to_ntstatus(ret);
491                 return ntstatus_to_werror(nt);
492         }
493
494         return WERR_OK;
495 }
496
497 bool dns_name_match(const char *zone, const char *name, size_t *host_part_len)
498 {
499         size_t zl = strlen(zone);
500         size_t nl = strlen(name);
501         ssize_t zi, ni;
502         static const size_t fixup = 'a' - 'A';
503
504         if (zl > nl) {
505                 return false;
506         }
507
508         for (zi = zl, ni = nl; zi >= 0; zi--, ni--) {
509                 char zc = zone[zi];
510                 char nc = name[ni];
511
512                 /* convert to lower case */
513                 if (zc >= 'A' && zc <= 'Z') {
514                         zc += fixup;
515                 }
516                 if (nc >= 'A' && nc <= 'Z') {
517                         nc += fixup;
518                 }
519
520                 if (zc != nc) {
521                         return false;
522                 }
523         }
524
525         if (ni >= 0) {
526                 if (name[ni] != '.') {
527                         return false;
528                 }
529
530                 ni--;
531         }
532
533         *host_part_len = ni+1;
534
535         return true;
536 }
537
538 WERROR dns_common_name2dn(struct ldb_context *samdb,
539                           struct dns_server_zone *zones,
540                           TALLOC_CTX *mem_ctx,
541                           const char *name,
542                           struct ldb_dn **_dn)
543 {
544         struct ldb_dn *base;
545         struct ldb_dn *dn;
546         const struct dns_server_zone *z;
547         size_t host_part_len = 0;
548         WERROR werr;
549
550         if (name == NULL) {
551                 return DNS_ERR(FORMAT_ERROR);
552         }
553
554         if (strcmp(name, "") == 0) {
555                 base = ldb_get_default_basedn(samdb);
556                 dn = ldb_dn_copy(mem_ctx, base);
557                 ldb_dn_add_child_fmt(dn, "DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=System");
558                 *_dn = dn;
559                 return WERR_OK;
560         }
561
562         /* Check non-empty names */
563         werr = dns_name_check(mem_ctx, strlen(name), name);
564         if (!W_ERROR_IS_OK(werr)) {
565                 return werr;
566         }
567
568         for (z = zones; z != NULL; z = z->next) {
569                 bool match;
570
571                 match = dns_name_match(z->name, name, &host_part_len);
572                 if (match) {
573                         break;
574                 }
575         }
576
577         if (z == NULL) {
578                 return DNS_ERR(NAME_ERROR);
579         }
580
581         if (host_part_len == 0) {
582                 dn = ldb_dn_copy(mem_ctx, z->dn);
583                 ldb_dn_add_child_fmt(dn, "DC=@");
584                 *_dn = dn;
585                 return WERR_OK;
586         }
587
588         dn = ldb_dn_copy(mem_ctx, z->dn);
589         ldb_dn_add_child_fmt(dn, "DC=%*.*s", (int)host_part_len, (int)host_part_len, name);
590         *_dn = dn;
591         return WERR_OK;
592 }
593
594 static int dns_common_sort_zones(struct ldb_message **m1, struct ldb_message **m2)
595 {
596         const char *n1, *n2;
597         size_t l1, l2;
598
599         n1 = ldb_msg_find_attr_as_string(*m1, "name", NULL);
600         n2 = ldb_msg_find_attr_as_string(*m2, "name", NULL);
601
602         l1 = strlen(n1);
603         l2 = strlen(n2);
604
605         /* If the string lengths are not equal just sort by length */
606         if (l1 != l2) {
607                 /* If m1 is the larger zone name, return it first */
608                 return l2 - l1;
609         }
610
611         /*TODO: We need to compare DNs here, we want the DomainDNSZones first */
612         return 0;
613 }
614
615 NTSTATUS dns_common_zones(struct ldb_context *samdb,
616                           TALLOC_CTX *mem_ctx,
617                           struct ldb_dn *base_dn,
618                           struct dns_server_zone **zones_ret)
619 {
620         int ret;
621         static const char * const attrs[] = { "name", NULL};
622         struct ldb_result *res;
623         int i;
624         struct dns_server_zone *new_list = NULL;
625         TALLOC_CTX *frame = talloc_stackframe();
626
627         if (base_dn) {
628                 /* This search will work against windows */
629                 ret = dsdb_search(samdb, frame, &res,
630                                   base_dn, LDB_SCOPE_SUBTREE,
631                                   attrs, 0, "(objectClass=dnsZone)");
632         } else {
633                 /* TODO: this search does not work against windows */
634                 ret = dsdb_search(samdb, frame, &res, NULL,
635                                   LDB_SCOPE_SUBTREE,
636                                   attrs,
637                                   DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
638                                   "(objectClass=dnsZone)");
639         }
640         if (ret != LDB_SUCCESS) {
641                 TALLOC_FREE(frame);
642                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
643         }
644
645         TYPESAFE_QSORT(res->msgs, res->count, dns_common_sort_zones);
646
647         for (i=0; i < res->count; i++) {
648                 struct dns_server_zone *z;
649
650                 z = talloc_zero(mem_ctx, struct dns_server_zone);
651                 if (z == NULL) {
652                         TALLOC_FREE(frame);
653                         return NT_STATUS_NO_MEMORY;
654                 }
655
656                 z->name = ldb_msg_find_attr_as_string(res->msgs[i], "name", NULL);
657                 talloc_steal(z, z->name);
658                 z->dn = talloc_move(z, &res->msgs[i]->dn);
659                 /*
660                  * Ignore the RootDNSServers zone and zones that we don't support yet
661                  * RootDNSServers should never be returned (Windows DNS server don't)
662                  * ..TrustAnchors should never be returned as is, (Windows returns
663                  * TrustAnchors) and for the moment we don't support DNSSEC so we'd better
664                  * not return this zone.
665                  */
666                 if ((strcmp(z->name, "RootDNSServers") == 0) ||
667                     (strcmp(z->name, "..TrustAnchors") == 0))
668                 {
669                         DEBUG(10, ("Ignoring zone %s\n", z->name));
670                         talloc_free(z);
671                         continue;
672                 }
673                 DLIST_ADD_END(new_list, z);
674         }
675
676         *zones_ret = new_list;
677         TALLOC_FREE(frame);
678         return NT_STATUS_OK;
679 }