Changeset 988 for vendor/current/source4/dns_server

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source4/dns_server

Files:

• TODO (modified) (1 diff)
• dlz_bind9.c (modified) (56 diffs)
• dlz_minimal.h (modified) (3 diffs)
• dns_crypto.c (added)
• dns_query.c (modified) (2 diffs)
• dns_server.c (modified) (23 diffs)
• dns_server.h (modified) (2 diffs)
• dns_update.c (modified) (8 diffs)
• dns_utils.c (modified) (2 diffs)
• dnsserver_common.c (added)
• dnsserver_common.h (added)
• pydns.c (added)
• wscript_build (modified) (2 diffs)

vendor/current/source4/dns_server/TODO

@@ -4 +4 @@
 Just so we don't forget the required features for an AD-compatible DNS server:
 
-- Forwarding to other nameservers if we don't know the domain
-- Additional record handling (especially in SOA records, but we'll want off of
-  this stuff)
-- TSIG-GSSAPI handling
-- Symmetric Bind-style key handling (not strictly needed for AD, but needed for
+- Symmetric Bind-style TKEY handling (not strictly needed for AD, but needed for
   integration to other name servers / tools)
-- Command line tools that unix admins are used to
-- Zone transfer support (XFER, IFER)
+(- Command line tools that unix admins are used to)
+- Zone transfer support (XFER, IFER) (look at AD for permission settings)
 - Caching
-- Tests, tests, tests (probably based on python's dns implementation)
+- dynamic zone reloading
+- Tests, tests, tests

vendor/current/source4/dns_server/dlz_bind9.c

@@ -26 +26 @@
 #include "dsdb/samdb/samdb.h"
 #include "dsdb/common/util.h"
+#include "auth/auth.h"
 #include "auth/session.h"
 #include "auth/gensec/gensec.h"
+#include "librpc/gen_ndr/security.h"
+#include "auth/credentials/credentials.h"
+#include "system/kerberos.h"
+#include "auth/kerberos/kerberos.h"
 #include "gen_ndr/ndr_dnsp.h"
-#include "lib/cmdline/popt_common.h"
-#include "lib/cmdline/popt_credentials.h"
-#include "ldb_module.h"
+#include "gen_ndr/server_id.h"
+#include "messaging/messaging.h"
+#include <popt.h>
+#include "lib/util/dlinklist.h"
 #include "dlz_minimal.h"
+#include "dns_server/dnsserver_common.h"
+
+struct b9_options {
+        const char *url;
+        const char *debug;
+};
+
+struct b9_zone {
+        char *name;
+        struct b9_zone *prev, *next;
+};
 
 struct dlz_bind9_data {
+        struct b9_options options;
         struct ldb_context *samdb;
         struct tevent_context *ev_ctx;
@@ -40 +58 @@
         int *transaction_token;
         uint32_t soa_serial;
+        struct b9_zone *zonelist;
+
+        /* Used for dynamic update */
+        struct smb_krb5_context *smb_krb5_ctx;
+        struct auth4_context *auth_context;
+        struct auth_session_info *session_info;
+        char *update_name;
 
         /* helper functions from the dlz_dlopen driver */
-        void (*log)(int level, const char *fmt, ...);
-        isc_result_t (*putrr)(dns_sdlzlookup_t *handle, const char *type,
-                              dns_ttl_t ttl, const char *data);
-        isc_result_t (*putnamedrr)(dns_sdlzlookup_t *handle, const char *name,
-                                   const char *type, dns_ttl_t ttl, const char *data);
-        isc_result_t (*writeable_zone)(dns_view_t *view, const char *zone_name);
+        log_t *log;
+        dns_sdlz_putrr_t *putrr;
+        dns_sdlz_putnamedrr_t *putnamedrr;
+        dns_dlz_writeablezone_t *writeable_zone;
 };
 
+static struct dlz_bind9_data *dlz_bind9_state = NULL;
+static int dlz_bind9_state_ref_count = 0;
 
 static const char *zone_prefixes[] = {
         "CN=MicrosoftDNS,DC=DomainDnsZones",
         "CN=MicrosoftDNS,DC=ForestDnsZones",
+        "CN=MicrosoftDNS,CN=System",
         NULL
 };
@@ -82 +108 @@
                 state->writeable_zone = ptr;
         }
+}
+
+/*
+ * Add a trailing '.' if it's missing
+ */
+static const char *b9_format_fqdn(TALLOC_CTX *mem_ctx, const char *str)
+{
+        size_t len;
+        const char *tmp;
+
+        if (str == NULL || str[0] == '\0') {
+                return str;
+        }
+
+        len = strlen(str);
+        if (str[len-1] != '.') {
+                tmp = talloc_asprintf(mem_ctx, "%s.", str);
+        } else {
+                tmp = str;
+        }
+        return tmp;
 }
 
@@ -92 +139 @@
                       const char **type, const char **data)
 {
+        uint32_t i;
+        char *tmp;
+        const char *fqdn;
+
         switch (rec->wType) {
         case DNS_TYPE_A:
@@ -105 +156 @@
         case DNS_TYPE_CNAME:
                 *type = "cname";
-                *data = rec->data.cname;
+                *data = b9_format_fqdn(mem_ctx, rec->data.cname);
                 break;
 
         case DNS_TYPE_TXT:
                 *type = "txt";
-                *data = rec->data.txt;
+                tmp = talloc_asprintf(mem_ctx, "\"%s\"", rec->data.txt.str[0]);
+                for (i=1; i<rec->data.txt.count; i++) {
+                        tmp = talloc_asprintf_append(tmp, " \"%s\"", rec->data.txt.str[i]);
+                }
+                *data = tmp;
                 break;
 
         case DNS_TYPE_PTR:
                 *type = "ptr";
-                *data = rec->data.ptr;
+                *data = b9_format_fqdn(mem_ctx, rec->data.ptr);
                 break;
 
         case DNS_TYPE_SRV:
                 *type = "srv";
+                fqdn = b9_format_fqdn(mem_ctx, rec->data.srv.nameTarget);
+                if (fqdn == NULL) {
+                        return false;
+                }
                 *data = talloc_asprintf(mem_ctx, "%u %u %u %s",
                                         rec->data.srv.wPriority,
                                         rec->data.srv.wWeight,
                                         rec->data.srv.wPort,
-                                        rec->data.srv.nameTarget);
+                                        fqdn);
                 break;
 
         case DNS_TYPE_MX:
                 *type = "mx";
+                fqdn = b9_format_fqdn(mem_ctx, rec->data.mx.nameTarget);
+                if (fqdn == NULL) {
+                        return false;
+                }
                 *data = talloc_asprintf(mem_ctx, "%u %s",
-                                        rec->data.mx.wPriority,
-                                        rec->data.mx.nameTarget);
+                                        rec->data.mx.wPriority, fqdn);
                 break;
 
@@ -143 +205 @@
         case DNS_TYPE_NS:
                 *type = "ns";
-                *data = rec->data.ns;
+                *data = b9_format_fqdn(mem_ctx, rec->data.ns);
                 break;
 
@@ -154 +216 @@
                  * force clients to send updates to the right local DC
                  */
-                mname = talloc_asprintf(mem_ctx, "%s.%s",
-                                        lpcfg_netbios_name(state->lp), lpcfg_dnsdomain(state->lp));
+                mname = talloc_asprintf(mem_ctx, "%s.%s.",
+                                        lpcfg_netbios_name(state->lp),
+                                        lpcfg_dnsdomain(state->lp));
                 if (mname == NULL) {
                         return false;
@@ -164 +227 @@
                 }
 
+                fqdn = b9_format_fqdn(mem_ctx, rec->data.soa.rname);
+                if (fqdn == NULL) {
+                        return false;
+                }
+
                 state->soa_serial = rec->data.soa.serial;
 
                 *data = talloc_asprintf(mem_ctx, "%s %s %u %u %u %u %u",
-                                        mname,
-                                        rec->data.soa.rname,
+                                        mname, fqdn,
                                         rec->data.soa.serial,
                                         rec->data.soa.refresh,
@@ -178 +245 @@
 
         default:
-                state->log(ISC_LOG_ERROR, "samba b9_putrr: unhandled record type %u",
+                state->log(ISC_LOG_ERROR, "samba_dlz b9_format: unhandled record type %u",
                            rec->wType);
                 return false;
@@ -253 +320 @@
 {
         char *full_name, *dclass, *type;
-        char *str, *saveptr=NULL;
+        char *str, *tmp, *saveptr=NULL;
         int i;
 
@@ -294 +361 @@
 
         case DNS_TYPE_TXT:
-                DNS_PARSE_STR(rec->data.txt, NULL, "\t", saveptr);
+                rec->data.txt.count = 0;
+                rec->data.txt.str = talloc_array(rec, const char *, rec->data.txt.count);
+                tmp = strtok_r(NULL, "\t", &saveptr);
+                while (tmp) {
+                        rec->data.txt.str = talloc_realloc(rec, rec->data.txt.str, const char *,
+                                                        rec->data.txt.count+1);
+                        if (tmp[0] == '"') {
+                                /* Strip quotes */
+                                rec->data.txt.str[rec->data.txt.count] = talloc_strndup(rec, &tmp[1], strlen(tmp)-2);
+                        } else {
+                                rec->data.txt.str[rec->data.txt.count] = talloc_strdup(rec, tmp);
+                        }
+                        rec->data.txt.count++;
+                        tmp = strtok_r(NULL, " ", &saveptr);
+                }
                 break;
 
@@ -333 +414 @@
 
         default:
-                state->log(ISC_LOG_ERROR, "samba b9_parse: unhandled record type %u",
+                state->log(ISC_LOG_ERROR, "samba_dlz b9_parse: unhandled record type %u",
                            rec->wType);
                 return false;
@@ -340 +421 @@
         /* we should be at the end of the buffer now */
         if (strtok_r(NULL, "\t ", &saveptr) != NULL) {
-                state->log(ISC_LOG_ERROR, "samba b9_parse: expected data at end of string for '%s'");
+                state->log(ISC_LOG_ERROR, "samba_dlz b9_parse: unexpected data at end of string for '%s'",
+                           rdatastr);
                 return false;
         }
@@ -348 +430 @@
 
 /*
-  send a resource recond to bind9
+  send a resource record to bind9
  */
 static isc_result_t b9_putrr(struct dlz_bind9_data *state,
@@ -388 +470 @@
 
 /*
-  send a named resource recond to bind9
+  send a named resource record to bind9
  */
 static isc_result_t b9_putnamedrr(struct dlz_bind9_data *state,
@@ -415 +497 @@
 }
 
-struct b9_options {
-        const char *url;
-};
-
 /*
    parse options
  */
 static isc_result_t parse_options(struct dlz_bind9_data *state,
-                                  unsigned int argc, char *argv[],
+                                  unsigned int argc, const char **argv,
                                   struct b9_options *options)
 {
@@ -429 +507 @@
         poptContext pc;
         struct poptOption long_options[] = {
-                { "url",       'H', POPT_ARG_STRING, &options->url, 0, "database URL", "URL" },
+                { "url", 'H', POPT_ARG_STRING, &options->url, 0, "database URL", "URL" },
+                { "debug", 'd', POPT_ARG_STRING, &options->debug, 0, "debug level", "DEBUG" },
                 { NULL }
         };
-        struct poptOption **popt_options;
-        int ret;
-
-        fault_setup_disable();
-
-        popt_options = ldb_module_popt_options(state->samdb);
-        (*popt_options) = long_options;
-
-        ret = ldb_modules_hook(state->samdb, LDB_MODULE_HOOK_CMDLINE_OPTIONS);
-        if (ret != LDB_SUCCESS) {
-                state->log(ISC_LOG_ERROR, "dlz samba: failed cmdline hook");
-                return ISC_R_FAILURE;
-        }
-
-        pc = poptGetContext("dlz_bind9", argc, (const char **)argv, *popt_options,
-                            POPT_CONTEXT_KEEP_FIRST);
-
+
+        pc = poptGetContext("dlz_bind9", argc, argv, long_options,
+                        POPT_CONTEXT_KEEP_FIRST);
         while ((opt = poptGetNextOpt(pc)) != -1) {
                 switch (opt) {
                 default:
-                        state->log(ISC_LOG_ERROR, "dlz samba: Invalid option %s: %s",
+                        state->log(ISC_LOG_ERROR, "dlz_bind9: Invalid option %s: %s",
                                    poptBadOption(pc, 0), poptStrerror(opt));
                         return ISC_R_FAILURE;
@@ -458 +523 @@
         }
 
-        ret = ldb_modules_hook(state->samdb, LDB_MODULE_HOOK_CMDLINE_PRECONNECT);
-        if (ret != LDB_SUCCESS) {
-                state->log(ISC_LOG_ERROR, "dlz samba: failed cmdline preconnect");
-                return ISC_R_FAILURE;
-        }
-
         return ISC_R_SUCCESS;
 }
@@ -469 +528 @@
 
 /*
+ * Create session info from PAC
+ * This is called as auth_context->generate_session_info_pac()
+ */
+static NTSTATUS b9_generate_session_info_pac(struct auth4_context *auth_context,
+                                             TALLOC_CTX *mem_ctx,
+                                             struct smb_krb5_context *smb_krb5_context,
+                                             DATA_BLOB *pac_blob,
+                                             const char *principal_name,
+                                             const struct tsocket_address *remote_addr,
+                                             uint32_t session_info_flags,
+                                             struct auth_session_info **session_info)
+{
+        NTSTATUS status;
+        struct auth_user_info_dc *user_info_dc;
+        TALLOC_CTX *tmp_ctx;
+
+        tmp_ctx = talloc_new(mem_ctx);
+        NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
+
+        status = kerberos_pac_blob_to_user_info_dc(tmp_ctx,
+                                                   *pac_blob,
+                                                   smb_krb5_context->krb5_context,
+                                                   &user_info_dc,
+                                                   NULL,
+                                                   NULL);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(tmp_ctx);
+                return status;
+        }
+
+        if (user_info_dc->info->authenticated) {
+                session_info_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
+        }
+
+        session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
+
+        status = auth_generate_session_info(mem_ctx, NULL, NULL, user_info_dc,
+                                            session_info_flags, session_info);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(tmp_ctx);
+                return status;
+        }
+
+        talloc_free(tmp_ctx);
+        return status;
+}
+
+/* Callback for the DEBUG() system, to catch the remaining messages */
+static void b9_debug(void *private_ptr, int msg_level, const char *msg)
+{
+        static const int isc_log_map[] = {
+                ISC_LOG_CRITICAL, /* 0 */
+                ISC_LOG_ERROR,    /* 1 */
+                ISC_LOG_WARNING,   /* 2 */
+                ISC_LOG_NOTICE    /* 3 */
+        };
+        struct dlz_bind9_data *state = private_ptr;
+        int     isc_log_level;
+        
+        if (msg_level >= ARRAY_SIZE(isc_log_map) || msg_level < 0) {
+                isc_log_level = ISC_LOG_INFO;
+        } else {
+                isc_log_level = isc_log_map[msg_level];
+        }
+        state->log(isc_log_level, "samba_dlz: %s", msg);
+}
+
+static int dlz_state_debug_unregister(struct dlz_bind9_data *state)
+{
+        /* Stop logging (to the bind9 logs) */
+        debug_set_callback(NULL, NULL);
+        return 0;
+}
+
+/*
   called to initialise the driver
  */
 _PUBLIC_ isc_result_t dlz_create(const char *dlzname,
-                                 unsigned int argc, char *argv[],
+                                 unsigned int argc, const char **argv,
                                  void **dbdata, ...)
 {
@@ -479 +613 @@
         va_list ap;
         isc_result_t result;
-        TALLOC_CTX *tmp_ctx;
-        int ret;
         struct ldb_dn *dn;
-        struct b9_options options;
-
-        ZERO_STRUCT(options);
+        NTSTATUS nt_status;
+
+        if (dlz_bind9_state != NULL) {
+                *dbdata = dlz_bind9_state;
+                dlz_bind9_state_ref_count++;
+                return ISC_R_SUCCESS;
+        }
 
         state = talloc_zero(NULL, struct dlz_bind9_data);
@@ -491 +627 @@
         }
 
-        tmp_ctx = talloc_new(state);
+        talloc_set_destructor(state, dlz_state_debug_unregister);
 
         /* fill in the helper functions */
@@ -500 +636 @@
         va_end(ap);
 
+        /* Do not install samba signal handlers */
+        fault_setup_disable();
+
+        /* Start logging (to the bind9 logs) */
+        debug_set_callback(state, b9_debug);
+
         state->ev_ctx = s4_event_context_init(state);
         if (state->ev_ctx == NULL) {
@@ -506 +648 @@
         }
 
-        state->samdb = ldb_init(state, state->ev_ctx);
-        if (state->samdb == NULL) {
-                state->log(ISC_LOG_ERROR, "samba_dlz: Failed to create ldb");
-                result = ISC_R_FAILURE;
-                goto failed;
-        }
-
-        result = parse_options(state, argc, argv, &options);
+        result = parse_options(state, argc, argv, &state->options);
         if (result != ISC_R_SUCCESS) {
                 goto failed;
@@ -524 +659 @@
         }
 
-        if (options.url == NULL) {
-                options.url = talloc_asprintf(tmp_ctx, "ldapi://%s",
-                                              private_path(tmp_ctx, state->lp, "ldap_priv/ldapi"));
-                if (options.url == NULL) {
+        if (state->options.debug) {
+                lpcfg_do_global_parameter(state->lp, "log level", state->options.debug);
+        } else {
+                lpcfg_do_global_parameter(state->lp, "log level", "0");
+        }
+
+        if (smb_krb5_init_context(state, state->lp, &state->smb_krb5_ctx) != 0) {
+                result = ISC_R_NOMEMORY;
+                goto failed;
+        }
+
+        nt_status = gensec_init();
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                result = ISC_R_NOMEMORY;
+                goto failed;
+        }
+
+        state->auth_context = talloc_zero(state, struct auth4_context);
+        if (state->auth_context == NULL) {
+                result = ISC_R_NOMEMORY;
+                goto failed;
+        }
+
+        if (state->options.url == NULL) {
+                state->options.url = lpcfg_private_path(state, state->lp, "dns/sam.ldb");
+                if (state->options.url == NULL) {
                         result = ISC_R_NOMEMORY;
                         goto failed;
@@ -533 +690 @@
         }
 
-        ret = ldb_connect(state->samdb, options.url, 0, NULL);
-        if (ret == -1) {
-                state->log(ISC_LOG_ERROR, "samba_dlz: Failed to connect to %s - %s",
-                           options.url, ldb_errstring(state->samdb));
-                result = ISC_R_FAILURE;
-                goto failed;
-        }
-
-        ret = ldb_modules_hook(state->samdb, LDB_MODULE_HOOK_CMDLINE_POSTCONNECT);
-        if (ret != LDB_SUCCESS) {
-                state->log(ISC_LOG_ERROR, "samba_dlz: Failed postconnect for %s - %s",
-                           options.url, ldb_errstring(state->samdb));
+        state->samdb = samdb_connect_url(state, state->ev_ctx, state->lp,
+                                        system_session(state->lp), 0, state->options.url);
+        if (state->samdb == NULL) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: Failed to connect to %s",
+                        state->options.url);
                 result = ISC_R_FAILURE;
                 goto failed;
@@ -552 +702 @@
         if (dn == NULL) {
                 state->log(ISC_LOG_ERROR, "samba_dlz: Unable to get basedn for %s - %s",
-                           options.url, ldb_errstring(state->samdb));
+                           state->options.url, ldb_errstring(state->samdb));
                 result = ISC_R_FAILURE;
                 goto failed;
@@ -560 +710 @@
                    ldb_dn_get_linearized(dn));
 
+        state->auth_context->event_ctx = state->ev_ctx;
+        state->auth_context->lp_ctx = state->lp;
+        state->auth_context->sam_ctx = state->samdb;
+        state->auth_context->generate_session_info_pac = b9_generate_session_info_pac;
+
         *dbdata = state;
-
-        talloc_free(tmp_ctx);
+        dlz_bind9_state = state;
+        dlz_bind9_state_ref_count++;
+
         return ISC_R_SUCCESS;
 
@@ -577 +733 @@
         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
         state->log(ISC_LOG_INFO, "samba_dlz: shutting down");
-        talloc_free(state);
+
+        dlz_bind9_state_ref_count--;
+        if (dlz_bind9_state_ref_count == 0) {
+                talloc_unlink(state, state->samdb);
+                talloc_free(state);
+                dlz_bind9_state = NULL;
+        }
 }
 
@@ -665 +827 @@
   see if we handle a given zone
  */
+#if DLZ_DLOPEN_VERSION < 3
 _PUBLIC_ isc_result_t dlz_findzonedb(void *dbdata, const char *name)
+#else
+_PUBLIC_ isc_result_t dlz_findzonedb(void *dbdata, const char *name,
+                                     dns_clientinfomethods_t *methods,
+                                     dns_clientinfo_t *clientinfo)
+#endif
 {
         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
@@ -681 +849 @@
 {
         TALLOC_CTX *tmp_ctx = talloc_new(state);
-        const char *attrs[] = { "dnsRecord", NULL };
-        int ret = LDB_SUCCESS, i;
-        struct ldb_result *res;
-        struct ldb_message_element *el;
         struct ldb_dn *dn;
+        WERROR werr = WERR_DNS_ERROR_NAME_DOES_NOT_EXIST;
+        struct dnsp_DnssrvRpcRecord *records = NULL;
+        uint16_t num_records = 0, i;
 
         for (i=0; zone_prefixes[i]; i++) {
@@ -699 +866 @@
                 }
 
-                ret = ldb_search(state->samdb, tmp_ctx, &res, dn, LDB_SCOPE_BASE,
-                                 attrs, "objectClass=dnsNode");
-                if (ret == LDB_SUCCESS) {
+                werr = dns_common_lookup(state->samdb, tmp_ctx, dn,
+                                         &records, &num_records, NULL);
+                if (W_ERROR_IS_OK(werr)) {
                         break;
                 }
         }
-        if (ret != LDB_SUCCESS) {
+        if (!W_ERROR_IS_OK(werr)) {
                 talloc_free(tmp_ctx);
                 return ISC_R_NOTFOUND;
         }
 
-        el = ldb_msg_find_element(res->msgs[0], "dnsRecord");
-        if (el == NULL || el->num_values == 0) {
-                talloc_free(tmp_ctx);
-                return ISC_R_NOTFOUND;
-        }
-
-        for (i=0; i<el->num_values; i++) {
-                struct dnsp_DnssrvRpcRecord rec;
-                enum ndr_err_code ndr_err;
+        for (i=0; i < num_records; i++) {
                 isc_result_t result;
 
-                ndr_err = ndr_pull_struct_blob(&el->values[i], tmp_ctx, &rec,
-                                               (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse dnsRecord for %s",
-                                   ldb_dn_get_linearized(dn));
-                        talloc_free(tmp_ctx);
-                        return ISC_R_FAILURE;
-                }
-
-                result = b9_putrr(state, lookup, &rec, types);
+                result = b9_putrr(state, lookup, &records[i], types);
                 if (result != ISC_R_SUCCESS) {
                         talloc_free(tmp_ctx);
@@ -744 +894 @@
   lookup one record
  */
+#if DLZ_DLOPEN_VERSION == 1
 _PUBLIC_ isc_result_t dlz_lookup(const char *zone, const char *name,
                                  void *dbdata, dns_sdlzlookup_t *lookup)
+#else
+_PUBLIC_ isc_result_t dlz_lookup(const char *zone, const char *name,
+                                 void *dbdata, dns_sdlzlookup_t *lookup,
+                                 dns_clientinfomethods_t *methods,
+                                 dns_clientinfo_t *clientinfo)
+#endif
 {
         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
@@ -758 +915 @@
 {
         /* just say yes for all our zones for now */
-        return dlz_findzonedb(dbdata, name);
+        struct dlz_bind9_data *state = talloc_get_type(
+                dbdata, struct dlz_bind9_data);
+        return b9_find_zone_dn(state, name, NULL, NULL);
 }
 
@@ -802 +961 @@
                 const char *rdn, *name;
                 const struct ldb_val *v;
+                WERROR werr;
+                struct dnsp_DnssrvRpcRecord *recs = NULL;
+                uint16_t num_recs = 0;
 
                 el = ldb_msg_find_element(res->msgs[i], "dnsRecord");
@@ -830 +992 @@
                         name = talloc_asprintf(el_ctx, "%s.%s", rdn, zone);
                 }
+                name = b9_format_fqdn(el_ctx, name);
                 if (name == NULL) {
                         talloc_free(tmp_ctx);
@@ -835 +998 @@
                 }
 
-                for (j=0; j<el->num_values; j++) {
-                        struct dnsp_DnssrvRpcRecord rec;
-                        enum ndr_err_code ndr_err;
+                werr = dns_common_extract(el, el_ctx, &recs, &num_recs);
+                if (!W_ERROR_IS_OK(werr)) {
+                        state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse dnsRecord for %s, %s",
+                                   ldb_dn_get_linearized(dn), win_errstr(werr));
+                        talloc_free(el_ctx);
+                        continue;
+                }
+
+                for (j=0; j < num_recs; j++) {
                         isc_result_t result;
 
-                        ndr_err = ndr_pull_struct_blob(&el->values[j], el_ctx, &rec,
-                                                       (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
-                        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                                state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse dnsRecord for %s",
-                                           ldb_dn_get_linearized(dn));
-                                continue;
-                        }
-
-                        result = b9_putnamedrr(state, allnodes, name, &rec);
+                        result = b9_putnamedrr(state, allnodes, name, &recs[j]);
                         if (result != ISC_R_SUCCESS) {
                                 continue;
                         }
                 }
+
+                talloc_free(el_ctx);
         }
 
@@ -930 +1093 @@
 static bool b9_has_soa(struct dlz_bind9_data *state, struct ldb_dn *dn, const char *zone)
 {
-        const char *attrs[] = { "dnsRecord", NULL };
-        struct ldb_result *res;
-        struct ldb_message_element *el;
         TALLOC_CTX *tmp_ctx = talloc_new(state);
-        int ret, i;
+        WERROR werr;
+        struct dnsp_DnssrvRpcRecord *records = NULL;
+        uint16_t num_records = 0, i;
 
         if (!ldb_dn_add_child_fmt(dn, "DC=@,DC=%s", zone)) {
@@ -941 +1103 @@
         }
 
-        ret = ldb_search(state->samdb, tmp_ctx, &res, dn, LDB_SCOPE_BASE,
-                         attrs, "objectClass=dnsNode");
-        if (ret != LDB_SUCCESS) {
+        werr = dns_common_lookup(state->samdb, tmp_ctx, dn,
+                                 &records, &num_records, NULL);
+        if (!W_ERROR_IS_OK(werr)) {
                 talloc_free(tmp_ctx);
                 return false;
         }
 
-        el = ldb_msg_find_element(res->msgs[0], "dnsRecord");
-        if (el == NULL) {
-                talloc_free(tmp_ctx);
-                return false;
-        }
-        for (i=0; i<el->num_values; i++) {
-                struct dnsp_DnssrvRpcRecord rec;
-                enum ndr_err_code ndr_err;
-
-                ndr_err = ndr_pull_struct_blob(&el->values[i], tmp_ctx, &rec,
-                                               (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        continue;
-                }
-                if (rec.wType == DNS_TYPE_SOA) {
+        for (i=0; i < num_records; i++) {
+                if (records[i].wType == DNS_TYPE_SOA) {
                         talloc_free(tmp_ctx);
                         return true;
@@ -972 +1121 @@
 }
 
+static bool b9_zone_add(struct dlz_bind9_data *state, const char *name)
+{
+        struct b9_zone *zone;
+
+        zone = talloc_zero(state, struct b9_zone);
+        if (zone == NULL) {
+                return false;
+        }
+
+        zone->name = talloc_strdup(zone, name);
+        if (zone->name == NULL) {
+                talloc_free(zone);
+                return false;
+        }
+
+        DLIST_ADD(state->zonelist, zone);
+        return true;
+}
+
+static bool b9_zone_exists(struct dlz_bind9_data *state, const char *name)
+{
+        struct b9_zone *zone = state->zonelist;
+        bool found = false;
+
+        while (zone != NULL) {
+                if (strcasecmp(name, zone->name) == 0) {
+                        found = true;
+                        break;
+                }
+                zone = zone->next;
+        }
+
+        return found;
+}
+
+
 /*
   configure a writeable zone
  */
+#if DLZ_DLOPEN_VERSION < 3
 _PUBLIC_ isc_result_t dlz_configure(dns_view_t *view, void *dbdata)
+#else
+_PUBLIC_ isc_result_t dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb,
+                                    void *dbdata)
+#endif
 {
         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
@@ -1015 +1205 @@
                         isc_result_t result;
                         const char *zone = ldb_msg_find_attr_as_string(res->msgs[j], "name", NULL);
+                        struct ldb_dn *zone_dn;
+
                         if (zone == NULL) {
                                 continue;
                         }
-                        if (!b9_has_soa(state, dn, zone)) {
+                        /* Ignore zones that are not handled in BIND */
+                        if ((strcmp(zone, "RootDNSServers") == 0) ||
+                            (strcmp(zone, "..TrustAnchors") == 0)) {
                                 continue;
                         }
+                        zone_dn = ldb_dn_copy(tmp_ctx, dn);
+                        if (zone_dn == NULL) {
+                                talloc_free(tmp_ctx);
+                                return ISC_R_NOMEMORY;
+                        }
+
+                        if (!b9_has_soa(state, zone_dn, zone)) {
+                                continue;
+                        }
+
+                        if (b9_zone_exists(state, zone)) {
+                                state->log(ISC_LOG_WARNING, "samba_dlz: Ignoring duplicate zone '%s' from '%s'",
+                                           zone, ldb_dn_get_linearized(zone_dn));
+                                continue;
+                        }
+
+                        if (!b9_zone_add(state, zone)) {
+                                talloc_free(tmp_ctx);
+                                return ISC_R_NOMEMORY;
+                        }
+
+#if DLZ_DLOPEN_VERSION < 3
                         result = state->writeable_zone(view, zone);
+#else
+                        result = state->writeable_zone(view, dlzdb, zone);
+#endif
                         if (result != ISC_R_SUCCESS) {
                                 state->log(ISC_LOG_ERROR, "samba_dlz: Failed to configure zone '%s'",
@@ -1044 +1263 @@
 {
         struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
-
-        state->log(ISC_LOG_INFO, "samba_dlz: allowing update of signer=%s name=%s tcpaddr=%s type=%s key=%s keydatalen=%u",
-                   signer, name, tcpaddr, type, key, keydatalen);
-        return true;
-}
-
-
-/*
-  add a new record
- */
-static isc_result_t b9_add_record(struct dlz_bind9_data *state, const char *name,
-                                  struct ldb_dn *dn,
-                                  struct dnsp_DnssrvRpcRecord *rec)
-{
-        struct ldb_message *msg;
-        enum ndr_err_code ndr_err;
-        struct ldb_val v;
+        TALLOC_CTX *tmp_ctx;
+        DATA_BLOB ap_req;
+        struct cli_credentials *server_credentials;
+        char *keytab_name;
         int ret;
-
-        msg = ldb_msg_new(rec);
-        if (msg == NULL) {
-                return ISC_R_NOMEMORY;
-        }
-        msg->dn = dn;
-        ret = ldb_msg_add_string(msg, "objectClass", "dnsNode");
-        if (ret != LDB_SUCCESS) {
-                return ISC_R_FAILURE;
-        }
-
-        ndr_err = ndr_push_struct_blob(&v, rec, rec, (ndr_push_flags_fn_t)ndr_push_dnsp_DnssrvRpcRecord);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                return ISC_R_FAILURE;
-        }
-        ret = ldb_msg_add_value(msg, "dnsRecord", &v, NULL);
-        if (ret != LDB_SUCCESS) {
-                return ISC_R_FAILURE;
-        }
-
-        ret = ldb_add(state->samdb, msg);
-        if (ret != LDB_SUCCESS) {
-                return ISC_R_FAILURE;
-        }
-
-        return ISC_R_SUCCESS;
+        int ldb_ret;
+        NTSTATUS nt_status;
+        struct gensec_security *gensec_ctx;
+        struct auth_session_info *session_info;
+        struct ldb_dn *dn;
+        isc_result_t result;
+        struct ldb_result *res;
+        const char * attrs[] = { NULL };
+        uint32_t access_mask;
+
+        /* Remove cached credentials, if any */
+        if (state->session_info) {
+                talloc_free(state->session_info);
+                state->session_info = NULL;
+        }
+        if (state->update_name) {
+                talloc_free(state->update_name);
+                state->update_name = NULL;
+        }
+
+        tmp_ctx = talloc_new(NULL);
+        if (tmp_ctx == NULL) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: no memory");
+                return ISC_FALSE;
+        }
+
+        ap_req = data_blob_const(keydata, keydatalen);
+        server_credentials = cli_credentials_init(tmp_ctx);
+        if (!server_credentials) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to init server credentials");
+                talloc_free(tmp_ctx);
+                return ISC_FALSE;
+        }
+
+        cli_credentials_set_krb5_context(server_credentials, state->smb_krb5_ctx);
+        cli_credentials_set_conf(server_credentials, state->lp);
+
+        keytab_name = talloc_asprintf(tmp_ctx, "FILE:%s/dns.keytab",
+                                        lpcfg_private_dir(state->lp));
+        ret = cli_credentials_set_keytab_name(server_credentials, state->lp, keytab_name,
+                                                CRED_SPECIFIED);
+        if (ret != 0) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to obtain server credentials from %s",
+                           keytab_name);
+                talloc_free(tmp_ctx);
+                return ISC_FALSE;
+        }
+        talloc_free(keytab_name);
+
+        nt_status = gensec_server_start(tmp_ctx,
+                                        lpcfg_gensec_settings(tmp_ctx, state->lp),
+                                        state->auth_context, &gensec_ctx);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to start gensec server");
+                talloc_free(tmp_ctx);
+                return ISC_FALSE;
+        }
+
+        gensec_set_credentials(gensec_ctx, server_credentials);
+
+        nt_status = gensec_start_mech_by_name(gensec_ctx, "spnego");
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to start spnego");
+                talloc_free(tmp_ctx);
+                return ISC_FALSE;
+        }
+
+        nt_status = gensec_update_ev(gensec_ctx, tmp_ctx, state->ev_ctx, ap_req, &ap_req);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: spnego update failed");
+                talloc_free(tmp_ctx);
+                return ISC_FALSE;
+        }
+
+        nt_status = gensec_session_info(gensec_ctx, tmp_ctx, &session_info);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to create session info");
+                talloc_free(tmp_ctx);
+                return ISC_FALSE;
+        }
+
+        /* Get the DN from name */
+        result = b9_find_name_dn(state, name, tmp_ctx, &dn);
+        if (result != ISC_R_SUCCESS) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to find name %s", name);
+                talloc_free(tmp_ctx);
+                return ISC_FALSE;
+        }
+
+        /* make sure the dn exists, or find parent dn in case new object is being added */
+        ldb_ret = ldb_search(state->samdb, tmp_ctx, &res, dn, LDB_SCOPE_BASE,
+                                attrs, "objectClass=dnsNode");
+        if (ldb_ret == LDB_ERR_NO_SUCH_OBJECT) {
+                ldb_dn_remove_child_components(dn, 1);
+                access_mask = SEC_ADS_CREATE_CHILD;
+                talloc_free(res);
+        } else if (ldb_ret == LDB_SUCCESS) {
+                access_mask = SEC_STD_REQUIRED | SEC_ADS_SELF_WRITE;
+                talloc_free(res);
+        } else {
+                talloc_free(tmp_ctx);
+                return ISC_FALSE;
+        }
+
+        /* Do ACL check */
+        ldb_ret = dsdb_check_access_on_dn(state->samdb, tmp_ctx, dn,
+                                                session_info->security_token,
+                                                access_mask, NULL);
+        if (ldb_ret != LDB_SUCCESS) {
+                state->log(ISC_LOG_INFO,
+                        "samba_dlz: disallowing update of signer=%s name=%s type=%s error=%s",
+                        signer, name, type, ldb_strerror(ldb_ret));
+                talloc_free(tmp_ctx);
+                return ISC_FALSE;
+        }
+
+        /* Cache session_info, so it can be used in the actual add/delete operation */
+        state->update_name = talloc_strdup(state, name);
+        if (state->update_name == NULL) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: memory allocation error");
+                talloc_free(tmp_ctx);
+                return ISC_FALSE;
+        }
+        state->session_info = talloc_steal(state, session_info);
+
+        state->log(ISC_LOG_INFO, "samba_dlz: allowing update of signer=%s name=%s tcpaddr=%s type=%s key=%s",
+                   signer, name, tcpaddr, type, key);
+
+        talloc_free(tmp_ctx);
+        return ISC_TRUE;
 }
 
@@ -1112 +1422 @@
                             struct dnsp_DnssrvRpcRecord *rec1, struct dnsp_DnssrvRpcRecord *rec2)
 {
+        bool status;
+        int i;
+        struct in6_addr rec1_in_addr6;
+        struct in6_addr rec2_in_addr6;
+
         if (rec1->wType != rec2->wType) {
                 return false;
@@ -1124 +1439 @@
         case DNS_TYPE_A:
                 return strcmp(rec1->data.ipv4, rec2->data.ipv4) == 0;
-        case DNS_TYPE_AAAA:
-                return strcmp(rec1->data.ipv6, rec2->data.ipv6) == 0;
+        case DNS_TYPE_AAAA: {
+                int ret;
+
+                ret = inet_pton(AF_INET6, rec1->data.ipv6, &rec1_in_addr6);
+                if (ret != 1) {
+                        return false;
+                }
+                ret = inet_pton(AF_INET6, rec2->data.ipv6, &rec2_in_addr6);
+                if (ret != 1) {
+                        return false;
+                }
+
+                return memcmp(&rec1_in_addr6, &rec2_in_addr6, sizeof(rec1_in_addr6)) == 0;
+        }
         case DNS_TYPE_CNAME:
                 return dns_name_equal(rec1->data.cname, rec2->data.cname);
         case DNS_TYPE_TXT:
-                return strcmp(rec1->data.txt, rec2->data.txt) == 0;
+                status = (rec1->data.txt.count == rec2->data.txt.count);
+                if (!status) return status;
+                for (i=0; i<rec1->data.txt.count; i++) {
+                        status &= (strcmp(rec1->data.txt.str[i], rec2->data.txt.str[i]) == 0);
+                }
+                return status;
         case DNS_TYPE_PTR:
-                return strcmp(rec1->data.ptr, rec2->data.ptr) == 0;
+                return dns_name_equal(rec1->data.ptr, rec2->data.ptr);
         case DNS_TYPE_NS:
                 return dns_name_equal(rec1->data.ns, rec2->data.ns);
@@ -1158 +1490 @@
                         rec1->data.soa.minimum == rec2->data.soa.minimum;
         default:
-                state->log(ISC_LOG_ERROR, "samba b9_putrr: unhandled record type %u",
+                state->log(ISC_LOG_ERROR, "samba_dlz b9_record_match: unhandled record type %u",
                            rec1->wType);
                 break;
@@ -1166 +1498 @@
 }
 
+/*
+ * Update session_info on samdb using the cached credentials
+ */
+static bool b9_set_session_info(struct dlz_bind9_data *state, const char *name)
+{
+        int ret;
+
+        if (state->update_name == NULL || state->session_info == NULL) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: invalid credentials");
+                return false;
+        }
+
+        /* Do not use client credentials, if we're not updating the client specified name */
+        if (strcmp(state->update_name, name) != 0) {
+                return true;
+        }
+
+        ret = ldb_set_opaque(state->samdb, "sessionInfo", state->session_info);
+        if (ret != LDB_SUCCESS) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: unable to set session info");
+                return false;
+        }
+
+        return true;
+}
+
+/*
+ * Reset session_info on samdb as system session
+ */
+static void b9_reset_session_info(struct dlz_bind9_data *state)
+{
+        ldb_set_opaque(state->samdb, "sessionInfo", system_session(state->lp));
+}
 
 /*
@@ -1176 +1541 @@
         struct ldb_dn *dn;
         isc_result_t result;
-        struct ldb_result *res;
-        const char *attrs[] = { "dnsRecord", NULL };
-        int ret, i;
-        struct ldb_message_element *el;
-        enum ndr_err_code ndr_err;
+        bool tombstoned = false;
+        bool needs_add = false;
+        struct dnsp_DnssrvRpcRecord *recs = NULL;
+        uint16_t num_recs = 0;
+        uint16_t first = 0;
+        uint16_t i;
         NTTIME t;
+        WERROR werr;
 
         if (state->transaction_token != (void*)version) {
@@ -1198 +1565 @@
 
         rec->rank        = DNS_RANK_ZONE;
-        rec->dwSerial    = state->soa_serial;
         rec->dwTimeStamp = (uint32_t)t;
 
@@ -1215 +1581 @@
 
         /* get any existing records */
-        ret = ldb_search(state->samdb, rec, &res, dn, LDB_SCOPE_BASE, attrs, "objectClass=dnsNode");
-        if (ret == LDB_ERR_NO_SUCH_OBJECT) {
-                result = b9_add_record(state, name, dn, rec);
+        werr = dns_common_lookup(state->samdb, rec, dn,
+                                 &recs, &num_recs, &tombstoned);
+        if (W_ERROR_EQUAL(werr, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
+                needs_add = true;
+                werr = WERR_OK;
+        }
+        if (!W_ERROR_IS_OK(werr)) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse dnsRecord for %s, %s",
+                           ldb_dn_get_linearized(dn), win_errstr(werr));
                 talloc_free(rec);
-                if (result == ISC_R_SUCCESS) {
-                        state->log(ISC_LOG_ERROR, "samba_dlz: added %s %s", name, rdatastr);
-                }
-                return result;
+                return ISC_R_FAILURE;
+        }
+
+        if (tombstoned) {
+                /*
+                 * we need to keep the existing tombstone record
+                 * and ignore it
+                 */
+                first = num_recs;
         }
 
@@ -1228 +1605 @@
          * replace a record or add to it
          */
-        el = ldb_msg_find_element(res->msgs[0], "dnsRecord");
-        if (el == NULL) {
-                state->log(ISC_LOG_ERROR, "samba_dlz: no dnsRecord attribute for %s",
-                           ldb_dn_get_linearized(dn));
+        for (i=first; i < num_recs; i++) {
+                if (b9_record_match(state, rec, &recs[i])) {
+                        break;
+                }
+        }
+        if (i == UINT16_MAX) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to already %u dnsRecord values for %s",
+                           i, ldb_dn_get_linearized(dn));
                 talloc_free(rec);
                 return ISC_R_FAILURE;
         }
 
-        for (i=0; i<el->num_values; i++) {
-                struct dnsp_DnssrvRpcRecord rec2;
-
-                ndr_err = ndr_pull_struct_blob(&el->values[i], rec, &rec2,
-                                               (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse dnsRecord for %s",
-                                   ldb_dn_get_linearized(dn));
-                        talloc_free(rec);
-                        return ISC_R_FAILURE;
-                }
-
-                if (b9_record_match(state, rec, &rec2)) {
-                        break;
-                }
-        }
-        if (i == el->num_values) {
+        if (i == num_recs) {
                 /* adding a new value */
-                el->values = talloc_realloc(el, el->values, struct ldb_val, el->num_values+1);
-                if (el->values == NULL) {
+                recs = talloc_realloc(rec, recs,
+                                      struct dnsp_DnssrvRpcRecord,
+                                      num_recs + 1);
+                if (recs == NULL) {
                         talloc_free(rec);
                         return ISC_R_NOMEMORY;
                 }
-                el->num_values++;
-        }
-
-        ndr_err = ndr_push_struct_blob(&el->values[i], rec, rec,
-                                       (ndr_push_flags_fn_t)ndr_push_dnsp_DnssrvRpcRecord);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                state->log(ISC_LOG_ERROR, "samba_dlz: failed to push dnsRecord for %s",
-                           ldb_dn_get_linearized(dn));
+                num_recs++;
+        }
+
+        recs[i] = *rec;
+
+        if (!b9_set_session_info(state, name)) {
                 talloc_free(rec);
                 return ISC_R_FAILURE;
@@ -1272 +1637 @@
 
         /* modify the record */
-        el->flags = LDB_FLAG_MOD_REPLACE;
-        ret = ldb_modify(state->samdb, res->msgs[0]);
-        if (ret != LDB_SUCCESS) {
-                state->log(ISC_LOG_ERROR, "samba_dlz: failed to modify %s - %s",
-                           ldb_dn_get_linearized(dn), ldb_errstring(state->samdb));
+        werr = dns_common_replace(state->samdb, rec, dn,
+                                  needs_add,
+                                  state->soa_serial,
+                                  recs, num_recs);
+        b9_reset_session_info(state);
+        if (!W_ERROR_IS_OK(werr)) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to %s %s - %s",
+                           needs_add ? "add" : "modify",
+                           ldb_dn_get_linearized(dn), win_errstr(werr));
                 talloc_free(rec);
                 return ISC_R_FAILURE;
@@ -1296 +1665 @@
         struct ldb_dn *dn;
         isc_result_t result;
-        struct ldb_result *res;
-        const char *attrs[] = { "dnsRecord", NULL };
-        int ret, i;
-        struct ldb_message_element *el;
-        enum ndr_err_code ndr_err;
+        struct dnsp_DnssrvRpcRecord *recs = NULL;
+        uint16_t num_recs = 0;
+        uint16_t i;
+        WERROR werr;
 
         if (state->transaction_token != (void*)version) {
-                state->log(ISC_LOG_INFO, "samba_dlz: bad transaction version");
+                state->log(ISC_LOG_ERROR, "samba_dlz: bad transaction version");
                 return ISC_R_FAILURE;
         }
@@ -1313 +1681 @@
 
         if (!b9_parse(state, rdatastr, rec)) {
-                state->log(ISC_LOG_INFO, "samba_dlz: failed to parse rdataset '%s'", rdatastr);
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse rdataset '%s'", rdatastr);
                 talloc_free(rec);
                 return ISC_R_FAILURE;
@@ -1326 +1694 @@
 
         /* get the existing records */
-        ret = ldb_search(state->samdb, rec, &res, dn, LDB_SCOPE_BASE, attrs, "objectClass=dnsNode");
-        if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+        werr = dns_common_lookup(state->samdb, rec, dn,
+                                 &recs, &num_recs, NULL);
+        if (!W_ERROR_IS_OK(werr)) {
                 talloc_free(rec);
                 return ISC_R_NOTFOUND;
         }
 
-        /* there are existing records. We need to see if any match
-         */
-        el = ldb_msg_find_element(res->msgs[0], "dnsRecord");
-        if (el == NULL || el->num_values == 0) {
-                state->log(ISC_LOG_ERROR, "samba_dlz: no dnsRecord attribute for %s",
-                           ldb_dn_get_linearized(dn));
-                talloc_free(rec);
-                return ISC_R_FAILURE;
-        }
-
-        for (i=0; i<el->num_values; i++) {
-                struct dnsp_DnssrvRpcRecord rec2;
-
-                ndr_err = ndr_pull_struct_blob(&el->values[i], rec, &rec2,
-                                               (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse dnsRecord for %s",
-                                   ldb_dn_get_linearized(dn));
-                        talloc_free(rec);
-                        return ISC_R_FAILURE;
-                }
-
-                if (b9_record_match(state, rec, &rec2)) {
+        for (i=0; i < num_recs; i++) {
+                if (b9_record_match(state, rec, &recs[i])) {
+                        recs[i] = (struct dnsp_DnssrvRpcRecord) {
+                                .wType = DNS_TYPE_TOMBSTONE,
+                        };
                         break;
                 }
         }
-        if (i == el->num_values) {
+        if (i == num_recs) {
                 talloc_free(rec);
                 return ISC_R_NOTFOUND;
         }
 
-        if (i < el->num_values-1) {
-                memmove(&el->values[i], &el->values[i+1], sizeof(el->values[0])*((el->num_values-1)-i));
-        }
-        el->num_values--;
-
-        if (el->num_values == 0) {
-                /* delete the record */
-                ret = ldb_delete(state->samdb, dn);
-        } else {
-                /* modify the record */
-                el->flags = LDB_FLAG_MOD_REPLACE;
-                ret = ldb_modify(state->samdb, res->msgs[0]);
-        }
-        if (ret != LDB_SUCCESS) {
+        if (!b9_set_session_info(state, name)) {
+                talloc_free(rec);
+                return ISC_R_FAILURE;
+        }
+
+        /* modify the record */
+        werr = dns_common_replace(state->samdb, rec, dn,
+                                  false,/* needs_add */
+                                  state->soa_serial,
+                                  recs, num_recs);
+        b9_reset_session_info(state);
+        if (!W_ERROR_IS_OK(werr)) {
                 state->log(ISC_LOG_ERROR, "samba_dlz: failed to modify %s - %s",
-                           ldb_dn_get_linearized(dn), ldb_errstring(state->samdb));
+                           ldb_dn_get_linearized(dn), win_errstr(werr));
                 talloc_free(rec);
                 return ISC_R_FAILURE;
@@ -1399 +1748 @@
         struct ldb_dn *dn;
         isc_result_t result;
-        struct ldb_result *res;
-        const char *attrs[] = { "dnsRecord", NULL };
-        int ret, i;
-        struct ldb_message_element *el;
-        enum ndr_err_code ndr_err;
         enum dns_record_type dns_type;
         bool found = false;
+        struct dnsp_DnssrvRpcRecord *recs = NULL;
+        uint16_t num_recs = 0;
+        uint16_t ri = 0;
+        WERROR werr;
 
         if (state->transaction_token != (void*)version) {
-                state->log(ISC_LOG_INFO, "samba_dlz: bad transaction version");
+                state->log(ISC_LOG_ERROR, "samba_dlz: bad transaction version");
                 return ISC_R_FAILURE;
         }
 
         if (!b9_dns_type(type, &dns_type)) {
-                state->log(ISC_LOG_INFO, "samba_dlz: bad dns type %s in delete", type);
+                state->log(ISC_LOG_ERROR, "samba_dlz: bad dns type %s in delete", type);
                 return ISC_R_FAILURE;
         }
@@ -1427 +1775 @@
 
         /* get the existing records */
-        ret = ldb_search(state->samdb, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, "objectClass=dnsNode");
-        if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+        werr = dns_common_lookup(state->samdb, tmp_ctx, dn,
+                                 &recs, &num_recs, NULL);
+        if (!W_ERROR_IS_OK(werr)) {
                 talloc_free(tmp_ctx);
                 return ISC_R_NOTFOUND;
         }
 
-        /* there are existing records. We need to see if any match the type
-         */
-        el = ldb_msg_find_element(res->msgs[0], "dnsRecord");
-        if (el == NULL || el->num_values == 0) {
-                talloc_free(tmp_ctx);
-                return ISC_R_NOTFOUND;
-        }
-
-        for (i=0; i<el->num_values; i++) {
-                struct dnsp_DnssrvRpcRecord rec2;
-
-                ndr_err = ndr_pull_struct_blob(&el->values[i], tmp_ctx, &rec2,
-                                               (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse dnsRecord for %s",
-                                   ldb_dn_get_linearized(dn));
-                        talloc_free(tmp_ctx);
-                        return ISC_R_FAILURE;
-                }
-
-                if (dns_type == rec2.wType) {
-                        if (i < el->num_values-1) {
-                                memmove(&el->values[i], &el->values[i+1],
-                                        sizeof(el->values[0])*((el->num_values-1)-i));
-                        }
-                        el->num_values--;
-                        i--;
-                        found = true;
-                }
+        for (ri=0; ri < num_recs; ri++) {
+                if (dns_type != recs[ri].wType) {
+                        continue;
+                }
+
+                found = true;
+                recs[ri] = (struct dnsp_DnssrvRpcRecord) {
+                        .wType = DNS_TYPE_TOMBSTONE,
+                };
         }
 
@@ -1469 +1798 @@
         }
 
-        if (el->num_values == 0) {
-                /* delete the record */
-                ret = ldb_delete(state->samdb, dn);
-        } else {
-                /* modify the record */
-                el->flags = LDB_FLAG_MOD_REPLACE;
-                ret = ldb_modify(state->samdb, res->msgs[0]);
-        }
-        if (ret != LDB_SUCCESS) {
-                state->log(ISC_LOG_ERROR, "samba_dlz: failed to delete type %s in %s - %s",
-                           type, ldb_dn_get_linearized(dn), ldb_errstring(state->samdb));
+        if (!b9_set_session_info(state, name)) {
+                talloc_free(tmp_ctx);
+                return ISC_R_FAILURE;
+        }
+
+        /* modify the record */
+        werr = dns_common_replace(state->samdb, tmp_ctx, dn,
+                                  false,/* needs_add */
+                                  state->soa_serial,
+                                  recs, num_recs);
+        b9_reset_session_info(state);
+        if (!W_ERROR_IS_OK(werr)) {
+                state->log(ISC_LOG_ERROR, "samba_dlz: failed to modify %s - %s",
+                           ldb_dn_get_linearized(dn), win_errstr(werr));
                 talloc_free(tmp_ctx);
                 return ISC_R_FAILURE;

vendor/current/source4/dns_server/dlz_minimal.h

@@ -17 +17 @@
  */
 
-/*
-  This header provides a minimal set of defines and typedefs needed
-  for building an external DLZ module for bind9. When creating a new
-  external DLZ driver, please copy this header into your own source
-  tree.
- */
+/* This header is updated based on BIND 9.10.1 source.
+ *    contrib/dlz/modules/include/dlz_minimal.h
+ */
+
+#ifndef DLZ_MINIMAL_H
+#define DLZ_MINIMAL_H 1
+
+#ifdef BIND_VERSION_9_8
+#define DLZ_DLOPEN_VERSION 1
+#elif BIND_VERSION_9_9
+#define DLZ_DLOPEN_VERSION 2
+#elif BIND_VERSION_9_10
+#define DLZ_DLOPEN_VERSION 3
+#define DLZ_DLOPEN_AGE 0
+#else
+#error Unsupported BIND version
+#endif
+
 typedef unsigned int isc_result_t;
+#if DLZ_DLOPEN_VERSION == 1
 typedef bool isc_boolean_t;
+#else
+typedef int isc_boolean_t;
+#endif
 typedef uint32_t dns_ttl_t;
 
-#define DLZ_DLOPEN_VERSION 1
-
-/* return this in flags to dlz_version() if thread safe */
+/* return these in flags from dlz_version() */
 #define DNS_SDLZFLAG_THREADSAFE         0x00000001U
+#define DNS_SDLZFLAG_RELATIVEOWNER      0x00000002U
+#define DNS_SDLZFLAG_RELATIVERDATA      0x00000004U
 
 /* result codes */
 #define ISC_R_SUCCESS                   0
 #define ISC_R_NOMEMORY                  1
+#define ISC_R_NOPERM                    6
+#define ISC_R_NOSPACE                   19
 #define ISC_R_NOTFOUND                  23
 #define ISC_R_FAILURE                   25
+#define ISC_R_NOTIMPLEMENTED            27
+#define ISC_R_NOMORE                    29
+#define ISC_R_INVALIDFILE               30
+#define ISC_R_UNEXPECTED                34
+#define ISC_R_FILENOTFOUND              38
+
+/* boolean values */
+#define ISC_TRUE        1
+#define ISC_FALSE       0
 
 /* log levels */
@@ -44 +71 @@
 #define ISC_LOG_ERROR           (-4)
 #define ISC_LOG_CRITICAL        (-5)
-
-/* some opaque structures */
+#define ISC_LOG_DEBUG(level)    (level)
+
+/* opaque structures */
 typedef void *dns_sdlzlookup_t;
 typedef void *dns_sdlzallnodes_t;
 typedef void *dns_view_t;
-
-/*
- * prototypes for the functions you can include in your driver
- */
-
+typedef void *dns_dlzdb_t;
+
+#if DLZ_DLOPEN_VERSION > 1
+/*
+ * Method and type definitions needed for retrieval of client info
+ * from the caller.
+ */
+typedef struct isc_sockaddr {
+        union {
+                struct sockaddr         sa;
+                struct sockaddr_in      sin;
+                struct sockaddr_in6     sin6;
+                struct sockaddr_un      sunix;
+        }                               type;
+        unsigned int                    length;
+        void *                          link;
+} isc_sockaddr_t;
+
+#define DNS_CLIENTINFO_VERSION 1
+typedef struct dns_clientinfo {
+        uint16_t version;
+        void *data;
+} dns_clientinfo_t;
+
+typedef isc_result_t (*dns_clientinfo_sourceip_t)(dns_clientinfo_t *client,
+                                                  isc_sockaddr_t **addrp);
+
+#define DNS_CLIENTINFOMETHODS_VERSION 1
+#define DNS_CLIENTINFOMETHODS_AGE 0
+
+typedef struct dns_clientinfomethods {
+        uint16_t version;
+        uint16_t age;
+        dns_clientinfo_sourceip_t sourceip;
+} dns_clientinfomethods_t;
+#endif /* DLZ_DLOPEN_VERSION > 1 */
+
+/*
+ * Method definitions for callbacks provided by the dlopen driver
+ */
+
+typedef void log_t(int level, const char *fmt, ...);
+
+typedef isc_result_t dns_sdlz_putrr_t(dns_sdlzlookup_t *lookup,
+                                      const char *type,
+                                      dns_ttl_t ttl,
+                                      const char *data);
+
+typedef isc_result_t dns_sdlz_putnamedrr_t(dns_sdlzallnodes_t *allnodes,
+                                           const char *name,
+                                           const char *type,
+                                           dns_ttl_t ttl,
+                                           const char *data);
+
+#if DLZ_DLOPEN_VERSION < 3
+typedef isc_result_t dns_dlz_writeablezone_t(dns_view_t *view,
+                                             const char *zone_name);
+#else /* DLZ_DLOPEN_VERSION >= 3 */
+typedef isc_result_t dns_dlz_writeablezone_t(dns_view_t *view,
+                                             dns_dlzdb_t *dlzdb,
+                                             const char *zone_name);
+#endif /* DLZ_DLOPEN_VERSION */
+
+/*
+ * prototypes for the functions you can include in your module
+ */
 
 /*
  * dlz_version() is required for all DLZ external drivers. It should
- * return DLZ_DLOPEN_VERSION
- */
-int dlz_version(unsigned int *flags);
+ * return DLZ_DLOPEN_VERSION.  'flags' is updated to indicate capabilities
+ * of the module.  In particular, if the module is thread-safe then it
+ * sets 'flags' to include DNS_SDLZFLAG_THREADSAFE.  Other capability
+ * flags may be added in the future.
+ */
+int
+dlz_version(unsigned int *flags);
 
 /*
  * dlz_create() is required for all DLZ external drivers.
  */
-isc_result_t dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata, ...);
+isc_result_t
+dlz_create(const char *dlzname, unsigned int argc, const char *argv[],
+           void **dbdata, ...);
 
 /*
@@ -70 +165 @@
  * unloaded if supplied
  */
-void dlz_destroy(void *dbdata);
-
-/*
-  dlz_findzonedb is required for all DLZ external drivers
- */
-isc_result_t dlz_findzonedb(void *dbdata, const char *name);
-
-/*
-  dlz_lookup is required for all DLZ external drivers
- */
-isc_result_t dlz_lookup(const char *zone, const char *name,
-                        void *dbdata, dns_sdlzlookup_t *lookup);
-
-/*
-  dlz_allowzonexfr() is optional, and should be supplied if you want
-  to support zone transfers
- */
-isc_result_t dlz_allowzonexfr(void *dbdata, const char *name, const char *client);
-
-
-/*
-  dlz_allnodes() is optional, but must be supplied if supply a
-  dlz_allowzonexfr() function
- */
-isc_result_t dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes);
-
-/*
-  dlz_newversion() is optional. It should be supplied if you want to
-  support dynamic updates.
- */
-isc_result_t dlz_newversion(const char *zone, void *dbdata, void **versionp);
-
-/*
-   dlz_closeversion() is optional, but must be supplied if you supply
-   a dlz_newversion() function
- */
-void dlz_closeversion(const char *zone, isc_boolean_t commit, void *dbdata, void **versionp);
-
-/*
-  dlz_configure() is optional, but must be supplied if you want to
-  support dynamic updates
- */
-isc_result_t dlz_configure(dns_view_t *view, void *dbdata);
-
-/*
-  dlz_ssumatch() is optional, but must be supplied if you want to
-  support dynamic updates
- */
-isc_boolean_t dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
-                           const char *type, const char *key, uint32_t keydatalen, uint8_t *keydata,
-                           void *dbdata);
-
-/*
-  dlz_addrdataset() is optional, but must be supplied if you want to
-  support dynamic updates
- */
-isc_result_t dlz_addrdataset(const char *name, const char *rdatastr, void *dbdata, void *version);
-
-/*
-  dlz_subrdataset() is optional, but must be supplied if you want to
-  support dynamic updates
- */
-isc_result_t dlz_subrdataset(const char *name, const char *rdatastr, void *dbdata, void *version);
-
-/*
-  dlz_delrdataset() is optional, but must be supplied if you want to
-  support dynamic updates
- */
-isc_result_t dlz_delrdataset(const char *name, const char *type, void *dbdata, void *version);
+void
+dlz_destroy(void *dbdata);
+
+/*
+ * dlz_findzonedb is required for all DLZ external drivers
+ */
+#if DLZ_DLOPEN_VERSION < 3
+isc_result_t
+dlz_findzonedb(void *dbdata, const char *name);
+#else /* DLZ_DLOPEN_VERSION >= 3 */
+isc_result_t
+dlz_findzonedb(void *dbdata, const char *name,
+               dns_clientinfomethods_t *methods,
+               dns_clientinfo_t *clientinfo);
+#endif /* DLZ_DLOPEN_VERSION */
+
+/*
+ * dlz_lookup is required for all DLZ external drivers
+ */
+#if DLZ_DLOPEN_VERSION == 1
+isc_result_t
+dlz_lookup(const char *zone, const char *name, void *dbdata,
+           dns_sdlzlookup_t *lookup);
+#else /* DLZ_DLOPEN_VERSION > 1 */
+isc_result_t
+dlz_lookup(const char *zone, const char *name, void *dbdata,
+           dns_sdlzlookup_t *lookup,
+           dns_clientinfomethods_t *methods,
+           dns_clientinfo_t *clientinfo);
+#endif /* DLZ_DLOPEN_VERSION */
+
+/*
+ * dlz_authority() is optional if dlz_lookup() supplies
+ * authority information (i.e., SOA, NS) for the dns record
+ */
+isc_result_t
+dlz_authority(const char *zone, void *dbdata, dns_sdlzlookup_t *lookup);
+
+/*
+ * dlz_allowzonexfr() is optional, and should be supplied if you want to
+ * support zone transfers
+ */
+isc_result_t
+dlz_allowzonexfr(void *dbdata, const char *name, const char *client);
+
+/*
+ * dlz_allnodes() is optional, but must be supplied if supply a
+ * dlz_allowzonexfr() function
+ */
+isc_result_t
+dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes);
+
+/*
+ * dlz_newversion() is optional. It should be supplied if you want to
+ * support dynamic updates.
+ */
+isc_result_t
+dlz_newversion(const char *zone, void *dbdata, void **versionp);
+
+/* 
+ * dlz_closeversion() is optional, but must be supplied if you supply a
+ * dlz_newversion() function
+ */
+void
+dlz_closeversion(const char *zone, isc_boolean_t commit, void *dbdata,
+                 void **versionp);
+
+/*
+ * dlz_configure() is optional, but must be supplied if you want to support
+ * dynamic updates
+ */
+#if DLZ_DLOPEN_VERSION < 3
+isc_result_t
+dlz_configure(dns_view_t *view, void *dbdata);
+#else /* DLZ_DLOPEN_VERSION >= 3 */
+isc_result_t
+dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *dbdata);
+#endif /* DLZ_DLOPEN_VERSION */
+
+/*
+ * dlz_ssumatch() is optional, but must be supplied if you want to support
+ * dynamic updates
+ */
+isc_boolean_t
+dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
+             const char *type, const char *key, uint32_t keydatalen,
+             uint8_t *keydata, void *dbdata);
+
+/*
+ * dlz_addrdataset() is optional, but must be supplied if you want to
+ * support dynamic updates
+ */
+isc_result_t
+dlz_addrdataset(const char *name, const char *rdatastr, void *dbdata,
+                void *version);
+
+/*
+ * dlz_subrdataset() is optional, but must be supplied if you want to
+ * support dynamic updates
+ */
+isc_result_t
+dlz_subrdataset(const char *name, const char *rdatastr, void *dbdata,
+                void *version);
+
+/*
+ * dlz_delrdataset() is optional, but must be supplied if you want to
+ * support dynamic updates
+ */
+isc_result_t
+dlz_delrdataset(const char *name, const char *type, void *dbdata,
+                void *version);
+
+#endif /* DLZ_MINIMAL_H */

vendor/current/source4/dns_server/dns_query.c

@@ -21 +21 @@
 
 #include "includes.h"
+#include "smbd/service_task.h"
 #include "libcli/util/werror.h"
 #include "librpc/ndr/libndr.h"
@@ -26 +27 @@
 #include "librpc/gen_ndr/ndr_dnsp.h"
 #include <ldb.h>
+#include "param/param.h"
 #include "dsdb/samdb/samdb.h"
 #include "dsdb/common/util.h"
 #include "dns_server/dns_server.h"
-
-static WERROR handle_question(struct dns_server *dns,
-                              TALLOC_CTX *mem_ctx,
-                              const struct dns_name_question *question,
-                              struct dns_res_rec **answers, uint16_t *ancount)
-{
-        struct dns_res_rec *ans;
+#include "libcli/dns/libdns.h"
+#include "lib/util/util_net.h"
+#include "lib/util/tevent_werror.h"
+#include "auth/auth.h"
+#include "auth/credentials/credentials.h"
+#include "auth/gensec/gensec.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_DNS
+
+static WERROR add_response_rr(const char *name,
+                              const struct dnsp_DnssrvRpcRecord *rec,
+                              struct dns_res_rec **answers)
+{
+        struct dns_res_rec *ans = *answers;
+        uint16_t ai = talloc_array_length(ans);
+        enum ndr_err_code ndr_err;
+
+        if (ai == UINT16_MAX) {
+                return WERR_BUFFER_OVERFLOW;
+        }
+
+        /*
+         * "ans" is always non-NULL and thus its own talloc context
+         */
+        ans = talloc_realloc(ans, ans, struct dns_res_rec, ai+1);
+        if (ans == NULL) {
+                return WERR_NOMEM;
+        }
+
+        ZERO_STRUCT(ans[ai]);
+
+        switch (rec->wType) {
+        case DNS_QTYPE_CNAME:
+                ans[ai].rdata.cname_record = talloc_strdup(ans, rec->data.cname);
+                W_ERROR_HAVE_NO_MEMORY(ans[ai].rdata.cname_record);
+                break;
+        case DNS_QTYPE_A:
+                ans[ai].rdata.ipv4_record = talloc_strdup(ans, rec->data.ipv4);
+                W_ERROR_HAVE_NO_MEMORY(ans[ai].rdata.ipv4_record);
+                break;
+        case DNS_QTYPE_AAAA:
+                ans[ai].rdata.ipv6_record = talloc_strdup(ans, rec->data.ipv6);
+                W_ERROR_HAVE_NO_MEMORY(ans[ai].rdata.ipv6_record);
+                break;
+        case DNS_TYPE_NS:
+                ans[ai].rdata.ns_record = talloc_strdup(ans, rec->data.ns);
+                W_ERROR_HAVE_NO_MEMORY(ans[ai].rdata.ns_record);
+                break;
+        case DNS_QTYPE_SRV:
+                ans[ai].rdata.srv_record.priority = rec->data.srv.wPriority;
+                ans[ai].rdata.srv_record.weight   = rec->data.srv.wWeight;
+                ans[ai].rdata.srv_record.port     = rec->data.srv.wPort;
+                ans[ai].rdata.srv_record.target   = talloc_strdup(
+                        ans, rec->data.srv.nameTarget);
+                W_ERROR_HAVE_NO_MEMORY(ans[ai].rdata.srv_record.target);
+                break;
+        case DNS_QTYPE_SOA:
+                ans[ai].rdata.soa_record.mname   = talloc_strdup(
+                        ans, rec->data.soa.mname);
+                W_ERROR_HAVE_NO_MEMORY(ans[ai].rdata.soa_record.mname);
+                ans[ai].rdata.soa_record.rname   = talloc_strdup(
+                        ans, rec->data.soa.rname);
+                W_ERROR_HAVE_NO_MEMORY(ans[ai].rdata.soa_record.rname);
+                ans[ai].rdata.soa_record.serial  = rec->data.soa.serial;
+                ans[ai].rdata.soa_record.refresh = rec->data.soa.refresh;
+                ans[ai].rdata.soa_record.retry   = rec->data.soa.retry;
+                ans[ai].rdata.soa_record.expire  = rec->data.soa.expire;
+                ans[ai].rdata.soa_record.minimum = rec->data.soa.minimum;
+                break;
+        case DNS_QTYPE_PTR:
+                ans[ai].rdata.ptr_record = talloc_strdup(ans, rec->data.ptr);
+                W_ERROR_HAVE_NO_MEMORY(ans[ai].rdata.ptr_record);
+                break;
+        case DNS_QTYPE_MX:
+                ans[ai].rdata.mx_record.preference = rec->data.mx.wPriority;
+                ans[ai].rdata.mx_record.exchange = talloc_strdup(
+                        ans, rec->data.mx.nameTarget);
+                if (ans[ai].rdata.mx_record.exchange == NULL) {
+                        return WERR_NOMEM;
+                }
+                break;
+        case DNS_QTYPE_TXT:
+                ndr_err = ndr_dnsp_string_list_copy(ans,
+                                                    &rec->data.txt,
+                                                    &ans[ai].rdata.txt_record.txt);
+                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                        return WERR_NOMEM;
+                }
+                break;
+        default:
+                DEBUG(0, ("Got unhandled type %u query.\n", rec->wType));
+                return DNS_ERR(NOT_IMPLEMENTED);
+        }
+
+        ans[ai].name = talloc_strdup(ans, name);
+        W_ERROR_HAVE_NO_MEMORY(ans[ai].name);
+        ans[ai].rr_type = rec->wType;
+        ans[ai].rr_class = DNS_QCLASS_IN;
+        ans[ai].ttl = rec->dwTtlSeconds;
+        ans[ai].length = UINT16_MAX;
+
+        *answers = ans;
+
+        return WERR_OK;
+}
+
+static WERROR add_dns_res_rec(struct dns_res_rec **pdst,
+                              const struct dns_res_rec *src)
+{
+        struct dns_res_rec *dst = *pdst;
+        uint16_t di = talloc_array_length(dst);
+        enum ndr_err_code ndr_err;
+
+        if (di == UINT16_MAX) {
+                return WERR_BUFFER_OVERFLOW;
+        }
+
+        dst = talloc_realloc(dst, dst, struct dns_res_rec, di+1);
+        if (dst == NULL) {
+                return WERR_NOMEM;
+        }
+
+        ZERO_STRUCT(dst[di]);
+
+        dst[di] = (struct dns_res_rec) {
+                .name = talloc_strdup(dst, src->name),
+                .rr_type = src->rr_type,
+                .rr_class = src->rr_class,
+                .ttl = src->ttl,
+                .length = src->length
+        };
+
+        if (dst[di].name == NULL) {
+                return WERR_NOMEM;
+        }
+
+        switch (src->rr_type) {
+        case DNS_QTYPE_CNAME:
+                dst[di].rdata.cname_record = talloc_strdup(
+                        dst, src->rdata.cname_record);
+                if (dst[di].rdata.cname_record == NULL) {
+                        return WERR_NOMEM;
+                }
+                break;
+        case DNS_QTYPE_A:
+                dst[di].rdata.ipv4_record = talloc_strdup(
+                        dst, src->rdata.ipv4_record);
+                if (dst[di].rdata.ipv4_record == NULL) {
+                        return WERR_NOMEM;
+                }
+                break;
+        case DNS_QTYPE_AAAA:
+                dst[di].rdata.ipv6_record = talloc_strdup(
+                        dst, src->rdata.ipv6_record);
+                if (dst[di].rdata.ipv6_record == NULL) {
+                        return WERR_NOMEM;
+                }
+                break;
+        case DNS_TYPE_NS:
+                dst[di].rdata.ns_record = talloc_strdup(
+                        dst, src->rdata.ns_record);
+                if (dst[di].rdata.ns_record == NULL) {
+                        return WERR_NOMEM;
+                }
+                break;
+        case DNS_QTYPE_SRV:
+                dst[di].rdata.srv_record = (struct dns_srv_record) {
+                        .priority = src->rdata.srv_record.priority,
+                        .weight   = src->rdata.srv_record.weight,
+                        .port     = src->rdata.srv_record.port,
+                        .target   = talloc_strdup(
+                                dst, src->rdata.srv_record.target)
+                };
+                if (dst[di].rdata.srv_record.target == NULL) {
+                        return WERR_NOMEM;
+                }
+                break;
+        case DNS_QTYPE_SOA:
+                dst[di].rdata.soa_record = (struct dns_soa_record) {
+                        .mname   = talloc_strdup(
+                                dst, src->rdata.soa_record.mname),
+                        .rname   = talloc_strdup(
+                                dst, src->rdata.soa_record.rname),
+                        .serial  = src->rdata.soa_record.serial,
+                        .refresh = src->rdata.soa_record.refresh,
+                        .retry   = src->rdata.soa_record.retry,
+                        .expire  = src->rdata.soa_record.expire,
+                        .minimum = src->rdata.soa_record.minimum
+                };
+
+                if ((dst[di].rdata.soa_record.mname == NULL) ||
+                    (dst[di].rdata.soa_record.rname == NULL)) {
+                        return WERR_NOMEM;
+                }
+
+                break;
+        case DNS_QTYPE_PTR:
+                dst[di].rdata.ptr_record = talloc_strdup(
+                        dst, src->rdata.ptr_record);
+                if (dst[di].rdata.ptr_record == NULL) {
+                        return WERR_NOMEM;
+                }
+                break;
+        case DNS_QTYPE_MX:
+                dst[di].rdata.mx_record = (struct dns_mx_record) {
+                        .preference = src->rdata.mx_record.preference,
+                        .exchange   = talloc_strdup(
+                                src, src->rdata.mx_record.exchange)
+                };
+
+                if (dst[di].rdata.mx_record.exchange == NULL) {
+                        return WERR_NOMEM;
+                }
+                break;
+        case DNS_QTYPE_TXT:
+                ndr_err = ndr_dnsp_string_list_copy(dst,
+                                                    &src->rdata.txt_record.txt,
+                                                    &dst[di].rdata.txt_record.txt);
+                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                        return WERR_NOMEM;
+                }
+                break;
+        default:
+                DBG_WARNING("Got unhandled type %u query.\n", src->rr_type);
+                return DNS_ERR(NOT_IMPLEMENTED);
+        }
+
+        *pdst = dst;
+
+        return WERR_OK;
+}
+
+struct ask_forwarder_state {
+        struct tevent_context *ev;
+        uint16_t id;
+        struct dns_name_packet in_packet;
+};
+
+static void ask_forwarder_done(struct tevent_req *subreq);
+
+static struct tevent_req *ask_forwarder_send(
+        TALLOC_CTX *mem_ctx, struct tevent_context *ev,
+        struct dns_server *dns,
+        const char *forwarder, struct dns_name_question *question)
+{
+        struct tevent_req *req, *subreq;
+        struct ask_forwarder_state *state;
+        struct dns_res_rec *options;
+        struct dns_name_packet out_packet = { 0, };
+        DATA_BLOB out_blob;
+        enum ndr_err_code ndr_err;
+        WERROR werr;
+
+        req = tevent_req_create(mem_ctx, &state, struct ask_forwarder_state);
+        if (req == NULL) {
+                return NULL;
+        }
+        state->ev = ev;
+        generate_random_buffer((uint8_t *)&state->id, sizeof(state->id));
+
+        if (!is_ipaddress(forwarder)) {
+                DEBUG(0, ("Invalid 'dns forwarder' setting '%s', needs to be "
+                          "an IP address\n", forwarder));
+                tevent_req_werror(req, DNS_ERR(NAME_ERROR));
+                return tevent_req_post(req, ev);
+        }
+
+        out_packet.id = state->id;
+        out_packet.operation |= DNS_OPCODE_QUERY | DNS_FLAG_RECURSION_DESIRED;
+        out_packet.qdcount = 1;
+        out_packet.questions = question;
+
+        werr = dns_generate_options(dns, state, &options);
+        if (!W_ERROR_IS_OK(werr)) {
+                tevent_req_werror(req, werr);
+                return tevent_req_post(req, ev);
+        }
+
+        out_packet.arcount = 1;
+        out_packet.additional = options;
+
+        ndr_err = ndr_push_struct_blob(
+                &out_blob, state, &out_packet,
+                (ndr_push_flags_fn_t)ndr_push_dns_name_packet);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                tevent_req_werror(req, DNS_ERR(SERVER_FAILURE));
+                return tevent_req_post(req, ev);
+        }
+        subreq = dns_udp_request_send(state, ev, forwarder, out_blob.data,
+                                      out_blob.length);
+        if (tevent_req_nomem(subreq, req)) {
+                return tevent_req_post(req, ev);
+        }
+        tevent_req_set_callback(subreq, ask_forwarder_done, req);
+        return req;
+}
+
+static void ask_forwarder_done(struct tevent_req *subreq)
+{
+        struct tevent_req *req = tevent_req_callback_data(
+                subreq, struct tevent_req);
+        struct ask_forwarder_state *state = tevent_req_data(
+                req, struct ask_forwarder_state);
+        DATA_BLOB in_blob;
+        enum ndr_err_code ndr_err;
+        int ret;
+
+        ret = dns_udp_request_recv(subreq, state,
+                                   &in_blob.data, &in_blob.length);
+        TALLOC_FREE(subreq);
+
+        if (ret != 0) {
+                tevent_req_werror(req, unix_to_werror(ret));
+                return;
+        }
+
+        ndr_err = ndr_pull_struct_blob(
+                &in_blob, state, &state->in_packet,
+                (ndr_pull_flags_fn_t)ndr_pull_dns_name_packet);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                tevent_req_werror(req, DNS_ERR(SERVER_FAILURE));
+                return;
+        }
+        if (state->in_packet.id != state->id) {
+                tevent_req_werror(req, DNS_ERR(NAME_ERROR));
+                return;
+        }
+        tevent_req_done(req);
+}
+
+static WERROR ask_forwarder_recv(
+        struct tevent_req *req, TALLOC_CTX *mem_ctx,
+        struct dns_res_rec **answers, uint16_t *ancount,
+        struct dns_res_rec **nsrecs, uint16_t *nscount,
+        struct dns_res_rec **additional, uint16_t *arcount)
+{
+        struct ask_forwarder_state *state = tevent_req_data(
+                req, struct ask_forwarder_state);
+        struct dns_name_packet *in_packet = &state->in_packet;
+        WERROR err;
+
+        if (tevent_req_is_werror(req, &err)) {
+                return err;
+        }
+
+        *ancount = in_packet->ancount;
+        *answers = talloc_move(mem_ctx, &in_packet->answers);
+
+        *nscount = in_packet->nscount;
+        *nsrecs = talloc_move(mem_ctx, &in_packet->nsrecs);
+
+        *arcount = in_packet->arcount;
+        *additional = talloc_move(mem_ctx, &in_packet->additional);
+
+        return WERR_OK;
+}
+
+static WERROR add_zone_authority_record(struct dns_server *dns,
+                                        TALLOC_CTX *mem_ctx,
+                                        const struct dns_name_question *question,
+                                        struct dns_res_rec **nsrecs)
+{
+        const char *zone = NULL;
+        struct dnsp_DnssrvRpcRecord *recs;
+        struct dns_res_rec *ns = *nsrecs;
+        uint16_t rec_count;
         struct ldb_dn *dn = NULL;
+        unsigned int ri;
         WERROR werror;
-        static const char * const attrs[] = { "dnsRecord", NULL};
-        int ret;
-        uint16_t ai = *ancount;
-        unsigned int ri;
-        struct ldb_message *msg = NULL;
+
+        zone = dns_get_authoritative_zone(dns, question->name);
+        DEBUG(10, ("Creating zone authority record for '%s'\n", zone));
+
+        werror = dns_name2dn(dns, mem_ctx, zone, &dn);
+        if (!W_ERROR_IS_OK(werror)) {
+                return werror;
+        }
+
+        werror = dns_lookup_records(dns, mem_ctx, dn, &recs, &rec_count);
+        if (!W_ERROR_IS_OK(werror)) {
+                return werror;
+        }
+
+        for (ri = 0; ri < rec_count; ri++) {
+                if (recs[ri].wType == DNS_TYPE_SOA) {
+                        werror = add_response_rr(zone, &recs[ri], &ns);
+                        if (!W_ERROR_IS_OK(werror)) {
+                                return werror;
+                        }
+                }
+        }
+
+        *nsrecs = ns;
+
+        return WERR_OK;
+}
+
+static struct tevent_req *handle_authoritative_send(
+        TALLOC_CTX *mem_ctx, struct tevent_context *ev,
+        struct dns_server *dns, const char *forwarder,
+        struct dns_name_question *question,
+        struct dns_res_rec **answers, struct dns_res_rec **nsrecs);
+static WERROR handle_authoritative_recv(struct tevent_req *req);
+
+struct handle_dnsrpcrec_state {
+        struct dns_res_rec **answers;
+        struct dns_res_rec **nsrecs;
+};
+
+static void handle_dnsrpcrec_gotauth(struct tevent_req *subreq);
+static void handle_dnsrpcrec_gotforwarded(struct tevent_req *subreq);
+
+static struct tevent_req *handle_dnsrpcrec_send(
+        TALLOC_CTX *mem_ctx, struct tevent_context *ev,
+        struct dns_server *dns, const char *forwarder,
+        const struct dns_name_question *question,
+        struct dnsp_DnssrvRpcRecord *rec,
+        struct dns_res_rec **answers, struct dns_res_rec **nsrecs)
+{
+        struct tevent_req *req, *subreq;
+        struct handle_dnsrpcrec_state *state;
+        struct dns_name_question *new_q;
+        bool resolve_cname;
+        WERROR werr;
+
+        req = tevent_req_create(mem_ctx, &state,
+                                struct handle_dnsrpcrec_state);
+        if (req == NULL) {
+                return NULL;
+        }
+        state->answers = answers;
+        state->nsrecs = nsrecs;
+
+        resolve_cname = ((rec->wType == DNS_TYPE_CNAME) &&
+                         ((question->question_type == DNS_QTYPE_A) ||
+                          (question->question_type == DNS_QTYPE_AAAA)));
+
+        if (!resolve_cname) {
+                if ((question->question_type != DNS_QTYPE_ALL) &&
+                    (rec->wType !=
+                     (enum dns_record_type) question->question_type)) {
+                        tevent_req_done(req);
+                        return tevent_req_post(req, ev);
+                }
+
+                werr = add_response_rr(question->name, rec, state->answers);
+                if (tevent_req_werror(req, werr)) {
+                        return tevent_req_post(req, ev);
+                }
+
+                tevent_req_done(req);
+                return tevent_req_post(req, ev);
+        }
+
+        werr = add_response_rr(question->name, rec, state->answers);
+        if (tevent_req_werror(req, werr)) {
+                return tevent_req_post(req, ev);
+        }
+
+        new_q = talloc(state, struct dns_name_question);
+        if (tevent_req_nomem(new_q, req)) {
+                return tevent_req_post(req, ev);
+        }
+
+        *new_q = (struct dns_name_question) {
+                .question_type = question->question_type,
+                .question_class = question->question_class,
+                .name = rec->data.cname
+        };
+
+        if (dns_authorative_for_zone(dns, new_q->name)) {
+                subreq = handle_authoritative_send(
+                        state, ev, dns, forwarder, new_q,
+                        state->answers, state->nsrecs);
+                if (tevent_req_nomem(subreq, req)) {
+                        return tevent_req_post(req, ev);
+                }
+                tevent_req_set_callback(subreq, handle_dnsrpcrec_gotauth, req);
+                return req;
+        }
+
+        subreq = ask_forwarder_send(state, ev, dns, forwarder, new_q);
+        if (tevent_req_nomem(subreq, req)) {
+                return tevent_req_post(req, ev);
+        }
+        tevent_req_set_callback(subreq, handle_dnsrpcrec_gotforwarded, req);
+
+        return req;
+}
+
+static void handle_dnsrpcrec_gotauth(struct tevent_req *subreq)
+{
+        struct tevent_req *req = tevent_req_callback_data(
+                subreq, struct tevent_req);
+        WERROR werr;
+
+        werr = handle_authoritative_recv(subreq);
+        TALLOC_FREE(subreq);
+        if (tevent_req_werror(req, werr)) {
+                return;
+        }
+        tevent_req_done(req);
+}
+
+static void handle_dnsrpcrec_gotforwarded(struct tevent_req *subreq)
+{
+        struct tevent_req *req = tevent_req_callback_data(
+                subreq, struct tevent_req);
+        struct handle_dnsrpcrec_state *state = tevent_req_data(
+                req, struct handle_dnsrpcrec_state);
+        struct dns_res_rec *answers, *nsrecs, *additional;
+        uint16_t ancount = 0;
+        uint16_t nscount = 0;
+        uint16_t arcount = 0;
+        uint16_t i;
+        WERROR werr;
+
+        werr = ask_forwarder_recv(subreq, state, &answers, &ancount,
+                                  &nsrecs, &nscount, &additional, &arcount);
+        if (tevent_req_werror(req, werr)) {
+                return;
+        }
+
+        for (i=0; i<ancount; i++) {
+                werr = add_dns_res_rec(state->answers, &answers[i]);
+                if (tevent_req_werror(req, werr)) {
+                        return;
+                }
+        }
+
+        for (i=0; i<nscount; i++) {
+                werr = add_dns_res_rec(state->nsrecs, &nsrecs[i]);
+                if (tevent_req_werror(req, werr)) {
+                        return;
+                }
+        }
+
+        tevent_req_done(req);
+}
+
+static WERROR handle_dnsrpcrec_recv(struct tevent_req *req)
+{
+        return tevent_req_simple_recv_werror(req);
+}
+
+struct handle_authoritative_state {
+        struct tevent_context *ev;
+        struct dns_server *dns;
+        struct dns_name_question *question;
+        const char *forwarder;
+
         struct dnsp_DnssrvRpcRecord *recs;
-        struct ldb_message_element *el;
-
-        werror = dns_name2dn(dns, mem_ctx, question->name, &dn);
-        W_ERROR_NOT_OK_RETURN(werror);
-
-        ret = dsdb_search_one(dns->samdb, mem_ctx, &msg, dn,
-                              LDB_SCOPE_BASE, attrs, 0, "%s", "(objectClass=dnsNode)");
-        if (ret != LDB_SUCCESS) {
-                return DNS_ERR(NAME_ERROR);
-        }
-
-        el = ldb_msg_find_element(msg, attrs[0]);
-        if (el == NULL) {
-                return DNS_ERR(NAME_ERROR);
-        }
-
-        recs = talloc_array(mem_ctx, struct dnsp_DnssrvRpcRecord, el->num_values);
-        for (ri = 0; ri < el->num_values; ri++) {
-                struct ldb_val *v = &el->values[ri];
-                enum ndr_err_code ndr_err;
-
-                ndr_err = ndr_pull_struct_blob(v, recs, &recs[ri],
-                                (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        DEBUG(0, ("Failed to grab dnsp_DnssrvRpcRecord\n"));
-                        return DNS_ERR(SERVER_FAILURE);
-                }
-        }
-
-        ans = talloc_realloc(mem_ctx, *answers, struct dns_res_rec,
-                             ai + el->num_values);
-        W_ERROR_HAVE_NO_MEMORY(ans);
-
-        switch (question->question_type) {
-        case DNS_QTYPE_CNAME:
-                for (ri = 0; ri < el->num_values; ri++) {
-                        if (recs[ri].wType != question->question_type) {
-                                continue;
+        uint16_t rec_count;
+        uint16_t recs_done;
+
+        struct dns_res_rec **answers;
+        struct dns_res_rec **nsrecs;
+};
+
+static void handle_authoritative_done(struct tevent_req *subreq);
+
+static struct tevent_req *handle_authoritative_send(
+        TALLOC_CTX *mem_ctx, struct tevent_context *ev,
+        struct dns_server *dns, const char *forwarder,
+        struct dns_name_question *question,
+        struct dns_res_rec **answers, struct dns_res_rec **nsrecs)
+{
+        struct tevent_req *req, *subreq;
+        struct handle_authoritative_state *state;
+        struct ldb_dn *dn = NULL;
+        WERROR werr;
+
+        req = tevent_req_create(mem_ctx, &state,
+                                struct handle_authoritative_state);
+        if (req == NULL) {
+                return NULL;
+        }
+        state->ev = ev;
+        state->dns = dns;
+        state->question = question;
+        state->forwarder = forwarder;
+        state->answers = answers;
+        state->nsrecs = nsrecs;
+
+        werr = dns_name2dn(dns, state, question->name, &dn);
+        if (tevent_req_werror(req, werr)) {
+                return tevent_req_post(req, ev);
+        }
+
+        werr = dns_lookup_records(dns, state, dn, &state->recs,
+                                  &state->rec_count);
+        TALLOC_FREE(dn);
+        if (tevent_req_werror(req, werr)) {
+                return tevent_req_post(req, ev);
+        }
+
+        if (state->rec_count == 0) {
+                tevent_req_werror(req, DNS_ERR(NAME_ERROR));
+                return tevent_req_post(req, ev);
+        }
+
+        subreq = handle_dnsrpcrec_send(
+                state, state->ev, state->dns, state->forwarder,
+                state->question, &state->recs[state->recs_done],
+                state->answers, state->nsrecs);
+        if (tevent_req_nomem(subreq, req)) {
+                return tevent_req_post(req, ev);
+        }
+        tevent_req_set_callback(subreq, handle_authoritative_done, req);
+        return req;
+}
+
+static void handle_authoritative_done(struct tevent_req *subreq)
+{
+        struct tevent_req *req = tevent_req_callback_data(
+                subreq, struct tevent_req);
+        struct handle_authoritative_state *state = tevent_req_data(
+                req, struct handle_authoritative_state);
+        WERROR werr;
+
+        werr = handle_dnsrpcrec_recv(subreq);
+        TALLOC_FREE(subreq);
+        if (tevent_req_werror(req, werr)) {
+                return;
+        }
+
+        state->recs_done += 1;
+
+        if (state->recs_done == state->rec_count) {
+                tevent_req_done(req);
+                return;
+        }
+
+        subreq = handle_dnsrpcrec_send(
+                state, state->ev, state->dns, state->forwarder,
+                state->question, &state->recs[state->recs_done],
+                state->answers, state->nsrecs);
+        if (tevent_req_nomem(subreq, req)) {
+                return;
+        }
+        tevent_req_set_callback(subreq, handle_authoritative_done, req);
+}
+
+static WERROR handle_authoritative_recv(struct tevent_req *req)
+{
+        struct handle_authoritative_state *state = tevent_req_data(
+                req, struct handle_authoritative_state);
+        WERROR werr;
+
+        if (tevent_req_is_werror(req, &werr)) {
+                return werr;
+        }
+
+        werr = add_zone_authority_record(state->dns, state, state->question,
+                                         state->nsrecs);
+        if (!W_ERROR_IS_OK(werr)) {
+                return werr;
+        }
+
+        return WERR_OK;
+}
+
+static NTSTATUS create_tkey(struct dns_server *dns,
+                            const char* name,
+                            const char* algorithm,
+                            struct dns_server_tkey **tkey)
+{
+        NTSTATUS status;
+        struct dns_server_tkey_store *store = dns->tkeys;
+        struct dns_server_tkey *k = talloc_zero(store, struct dns_server_tkey);
+
+        if (k == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        k->name = talloc_strdup(k, name);
+
+        if (k->name  == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        k->algorithm = talloc_strdup(k, algorithm);
+        if (k->algorithm == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        status = samba_server_gensec_start(k,
+                                           dns->task->event_ctx,
+                                           dns->task->msg_ctx,
+                                           dns->task->lp_ctx,
+                                           dns->server_credentials,
+                                           "dns",
+                                           &k->gensec);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status)));
+                *tkey = NULL;
+                return status;
+        }
+
+        gensec_want_feature(k->gensec, GENSEC_FEATURE_SIGN);
+
+        status = gensec_start_mech_by_oid(k->gensec, GENSEC_OID_SPNEGO);
+
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("Failed to start GENSEC server code: %s\n",
+                          nt_errstr(status)));
+                *tkey = NULL;
+                return status;
+        }
+
+        if (store->tkeys[store->next_idx] != NULL) {
+                TALLOC_FREE(store->tkeys[store->next_idx]);
+        }
+
+        store->tkeys[store->next_idx] = k;
+        (store->next_idx)++;
+        store->next_idx %= store->size;
+
+        *tkey = k;
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS accept_gss_ticket(TALLOC_CTX *mem_ctx,
+                                  struct dns_server *dns,
+                                  struct dns_server_tkey *tkey,
+                                  const DATA_BLOB *key,
+                                  DATA_BLOB *reply,
+                                  uint16_t *dns_auth_error)
+{
+        NTSTATUS status;
+
+        status = gensec_update_ev(tkey->gensec, mem_ctx, dns->task->event_ctx,
+                                  *key, reply);
+
+        if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
+                *dns_auth_error = DNS_RCODE_OK;
+                return status;
+        }
+
+        if (NT_STATUS_IS_OK(status)) {
+
+                status = gensec_session_info(tkey->gensec, tkey, &tkey->session_info);
+                if (!NT_STATUS_IS_OK(status)) {
+                        *dns_auth_error = DNS_RCODE_BADKEY;
+                        return status;
+                }
+                *dns_auth_error = DNS_RCODE_OK;
+        }
+
+        return status;
+}
+
+static WERROR handle_tkey(struct dns_server *dns,
+                          TALLOC_CTX *mem_ctx,
+                          const struct dns_name_packet *in,
+                          struct dns_request_state *state,
+                          struct dns_res_rec **answers,
+                          uint16_t *ancount)
+{
+        struct dns_res_rec *in_tkey = NULL;
+        struct dns_res_rec *ret_tkey;
+        uint16_t i;
+
+        for (i = 0; i < in->arcount; i++) {
+                if (in->additional[i].rr_type == DNS_QTYPE_TKEY) {
+                        in_tkey = &in->additional[i];
+                        break;
+                }
+        }
+
+        /* If this is a TKEY query, it should have a TKEY RR.
+         * Behaviour is not really specified in RFC 2930 or RFC 3645, but
+         * FORMAT_ERROR seems to be what BIND uses .*/
+        if (in_tkey == NULL) {
+                return DNS_ERR(FORMAT_ERROR);
+        }
+
+        ret_tkey = talloc_zero(mem_ctx, struct dns_res_rec);
+        if (ret_tkey == NULL) {
+                return WERR_NOMEM;
+        }
+
+        ret_tkey->name = talloc_strdup(ret_tkey, in_tkey->name);
+        if (ret_tkey->name == NULL) {
+                return WERR_NOMEM;
+        }
+
+        ret_tkey->rr_type = DNS_QTYPE_TKEY;
+        ret_tkey->rr_class = DNS_QCLASS_ANY;
+        ret_tkey->length = UINT16_MAX;
+
+        ret_tkey->rdata.tkey_record.algorithm = talloc_strdup(ret_tkey,
+                        in_tkey->rdata.tkey_record.algorithm);
+        if (ret_tkey->rdata.tkey_record.algorithm  == NULL) {
+                return WERR_NOMEM;
+        }
+
+        ret_tkey->rdata.tkey_record.inception = in_tkey->rdata.tkey_record.inception;
+        ret_tkey->rdata.tkey_record.expiration = in_tkey->rdata.tkey_record.expiration;
+        ret_tkey->rdata.tkey_record.mode = in_tkey->rdata.tkey_record.mode;
+
+        switch (in_tkey->rdata.tkey_record.mode) {
+        case DNS_TKEY_MODE_DH:
+                /* FIXME: According to RFC 2930, we MUST support this, but we don't.
+                 * Still, claim it's a bad key instead of a bad mode */
+                ret_tkey->rdata.tkey_record.error = DNS_RCODE_BADKEY;
+                break;
+        case DNS_TKEY_MODE_GSSAPI: {
+                NTSTATUS status;
+                struct dns_server_tkey *tkey;
+                DATA_BLOB key;
+                DATA_BLOB reply;
+
+                tkey = dns_find_tkey(dns->tkeys, in->questions[0].name);
+                if (tkey != NULL && tkey->complete) {
+                        /* TODO: check if the key is still valid */
+                        DEBUG(1, ("Rejecting tkey negotiation for already established key\n"));
+                        ret_tkey->rdata.tkey_record.error = DNS_RCODE_BADNAME;
+                        break;
+                }
+
+                if (tkey == NULL) {
+                        status  = create_tkey(dns, in->questions[0].name,
+                                              in_tkey->rdata.tkey_record.algorithm,
+                                              &tkey);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                ret_tkey->rdata.tkey_record.error = DNS_RCODE_BADKEY;
+                                return ntstatus_to_werror(status);
                         }
-
-                        ZERO_STRUCT(ans[ai]);
-                        ans[ai].name = talloc_strdup(ans, question->name);
-                        ans[ai].rr_type = DNS_QTYPE_CNAME;
-                        ans[ai].rr_class = DNS_QCLASS_IP;
-                        ans[ai].ttl = recs[ri].dwTtlSeconds;
-                        ans[ai].length = UINT16_MAX;
-                        ans[ai].rdata.cname_record = talloc_strdup(ans, recs[ri].data.cname);
-                        ai++;
-                }
-                break;
-        case DNS_QTYPE_A:
-                for (ri = 0; ri < el->num_values; ri++) {
-                        if (recs[ri].wType != question->question_type) {
-                                continue;
+                }
+
+                key.data = in_tkey->rdata.tkey_record.key_data;
+                key.length = in_tkey->rdata.tkey_record.key_size;
+
+                status = accept_gss_ticket(ret_tkey, dns, tkey, &key, &reply,
+                                           &ret_tkey->rdata.tkey_record.error);
+                if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+                        DEBUG(1, ("More processing required\n"));
+                        ret_tkey->rdata.tkey_record.error = DNS_RCODE_BADKEY;
+                } else if (NT_STATUS_IS_OK(status)) {
+                        DEBUG(1, ("Tkey handshake completed\n"));
+                        ret_tkey->rdata.tkey_record.key_size = reply.length;
+                        ret_tkey->rdata.tkey_record.key_data = talloc_memdup(ret_tkey,
+                                                                reply.data,
+                                                                reply.length);
+                        state->sign = true;
+                        state->key_name = talloc_strdup(state->mem_ctx, tkey->name);
+                        if (state->key_name == NULL) {
+                                return WERR_NOMEM;
                         }
-
-                        /* TODO: if the record actually is a DNS_QTYPE_A */
-
-                        ZERO_STRUCT(ans[ai]);
-                        ans[ai].name = talloc_strdup(ans, question->name);
-                        ans[ai].rr_type = DNS_QTYPE_A;
-                        ans[ai].rr_class = DNS_QCLASS_IP;
-                        ans[ai].ttl = recs[ri].dwTtlSeconds;
-                        ans[ai].length = UINT16_MAX;
-                        ans[ai].rdata.ipv4_record = talloc_strdup(ans, recs[ri].data.ipv4);
-                        ai++;
-                }
-                break;
-        case DNS_QTYPE_AAAA:
-                for (ri = 0; ri < el->num_values; ri++) {
-                        if (recs[ri].wType != question->question_type) {
-                                continue;
-                        }
-
-                        ZERO_STRUCT(ans[ai]);
-                        ans[ai].name = talloc_strdup(ans, question->name);
-                        ans[ai].rr_type = DNS_QTYPE_AAAA;
-                        ans[ai].rr_class = DNS_QCLASS_IP;
-                        ans[ai].ttl = recs[ri].dwTtlSeconds;
-                        ans[ai].length = UINT16_MAX;
-                        ans[ai].rdata.ipv6_record = recs[ri].data.ipv6;
-                        ai++;
-                }
-                break;
-        case DNS_QTYPE_NS:
-                for (ri = 0; ri < el->num_values; ri++) {
-                        if (recs[ri].wType != question->question_type) {
-                                continue;
-                        }
-
-                        ZERO_STRUCT(ans[ai]);
-                        ans[ai].name = question->name;
-                        ans[ai].rr_type = DNS_QTYPE_NS;
-                        ans[ai].rr_class = DNS_QCLASS_IP;
-                        ans[ai].ttl = recs[ri].dwTtlSeconds;
-                        ans[ai].length = UINT16_MAX;
-                        ans[ai].rdata.ns_record = recs[ri].data.ns;
-                        ai++;
-                }
-                break;
-        case DNS_QTYPE_SRV:
-                for (ri = 0; ri < el->num_values; ri++) {
-                        if (recs[ri].wType != question->question_type) {
-                                continue;
-                        }
-
-                        ZERO_STRUCT(ans[ai]);
-                        ans[ai].name = question->name;
-                        ans[ai].rr_type = DNS_QTYPE_SRV;
-                        ans[ai].rr_class = DNS_QCLASS_IP;
-                        ans[ai].ttl = recs[ri].dwTtlSeconds;
-                        ans[ai].length = UINT16_MAX;
-                        ans[ai].rdata.srv_record.priority = recs[ri].data.srv.wPriority;
-                        ans[ai].rdata.srv_record.weight = recs[ri].data.srv.wWeight;
-                        ans[ai].rdata.srv_record.port = recs[ri].data.srv.wPort;
-                        ans[ai].rdata.srv_record.target = recs[ri].data.srv.nameTarget;
-                        ai++;
-                }
-                break;
-        case DNS_QTYPE_SOA:
-                for (ri = 0; ri < el->num_values; ri++) {
-                        if (recs[ri].wType != question->question_type) {
-                                continue;
-                        }
-
-                        ZERO_STRUCT(ans[ai]);
-                        ans[ai].name = question->name;
-                        ans[ai].rr_type = DNS_QTYPE_SOA;
-                        ans[ai].rr_class = DNS_QCLASS_IP;
-                        ans[ai].ttl = recs[ri].dwTtlSeconds;
-                        ans[ai].length = UINT16_MAX;
-                        ans[ai].rdata.soa_record.mname  = recs[ri].data.soa.mname;
-                        ans[ai].rdata.soa_record.rname  = recs[ri].data.soa.rname;
-                        ans[ai].rdata.soa_record.serial = recs[ri].data.soa.serial;
-                        ans[ai].rdata.soa_record.refresh= recs[ri].data.soa.refresh;
-                        ans[ai].rdata.soa_record.retry  = recs[ri].data.soa.retry;
-                        ans[ai].rdata.soa_record.expire = recs[ri].data.soa.expire;
-                        ans[ai].rdata.soa_record.minimum= recs[ri].data.soa.minimum;
-                        ai++;
-                }
+                } else {
+                        DEBUG(1, ("GSS key negotiation returned %s\n", nt_errstr(status)));
+                        ret_tkey->rdata.tkey_record.error = DNS_RCODE_BADKEY;
+                }
+
+                break;
+                }
+        case DNS_TKEY_MODE_DELETE:
+                /* TODO: implement me */
+                DEBUG(1, ("Should delete tkey here\n"));
+                ret_tkey->rdata.tkey_record.error = DNS_RCODE_OK;
+                break;
+        case DNS_TKEY_MODE_NULL:
+        case DNS_TKEY_MODE_SERVER:
+        case DNS_TKEY_MODE_CLIENT:
+        case DNS_TKEY_MODE_LAST:
+                /* We don't have to implement these, return a mode error */
+                ret_tkey->rdata.tkey_record.error = DNS_RCODE_BADMODE;
                 break;
         default:
-                return DNS_ERR(NOT_IMPLEMENTED);
-        }
-
-        if (*ancount == ai) {
-                return DNS_ERR(NAME_ERROR);
-        }
-
-        *ancount = ai;
-        *answers = ans;
+                DEBUG(1, ("Unsupported TKEY mode %d\n",
+                      in_tkey->rdata.tkey_record.mode));
+        }
+
+        *answers = ret_tkey;
+        *ancount = 1;
 
         return WERR_OK;
-
-}
-
-WERROR dns_server_process_query(struct dns_server *dns,
-                                TALLOC_CTX *mem_ctx,
-                                struct dns_name_packet *in,
-                                struct dns_res_rec **answers,    uint16_t *ancount,
-                                struct dns_res_rec **nsrecs,     uint16_t *nscount,
-                                struct dns_res_rec **additional, uint16_t *arcount)
-{
-        uint16_t i, num_answers=0;
-        struct dns_res_rec *ans=NULL;
-        WERROR werror;
-
-        ans = talloc_array(mem_ctx, struct dns_res_rec, 0);
-        W_ERROR_HAVE_NO_MEMORY(ans);
-
-        for (i = 0; i < in->qdcount; ++i) {
-                werror = handle_question(dns, mem_ctx, &in->questions[i], &ans, &num_answers);
-                W_ERROR_NOT_OK_RETURN(werror);
-        }
-
-        *answers = ans;
-        *ancount = num_answers;
-
-        /*FIXME: Do something for these */
-        *nsrecs  = NULL;
-        *nscount = 0;
-
-        *additional = NULL;
-        *arcount    = 0;
-
-        return WERR_OK;
-}
+}
+
+struct dns_server_process_query_state {
+        struct dns_res_rec *answers;
+        uint16_t ancount;
+        struct dns_res_rec *nsrecs;
+        uint16_t nscount;
+        struct dns_res_rec *additional;
+        uint16_t arcount;
+};
+
+static void dns_server_process_query_got_auth(struct tevent_req *subreq);
+static void dns_server_process_query_got_response(struct tevent_req *subreq);
+
+struct tevent_req *dns_server_process_query_send(
+        TALLOC_CTX *mem_ctx, struct tevent_context *ev,
+        struct dns_server *dns, struct dns_request_state *req_state,
+        const struct dns_name_packet *in)
+{
+        struct tevent_req *req, *subreq;
+        struct dns_server_process_query_state *state;
+
+        req = tevent_req_create(mem_ctx, &state,
+                                struct dns_server_process_query_state);
+        if (req == NULL) {
+                return NULL;
+        }
+        if (in->qdcount != 1) {
+                tevent_req_werror(req, DNS_ERR(FORMAT_ERROR));
+                return tevent_req_post(req, ev);
+        }
+
+        /* Windows returns NOT_IMPLEMENTED on this as well */
+        if (in->questions[0].question_class == DNS_QCLASS_NONE) {
+                tevent_req_werror(req, DNS_ERR(NOT_IMPLEMENTED));
+                return tevent_req_post(req, ev);
+        }
+
+        if (in->questions[0].question_type == DNS_QTYPE_TKEY) {
+                WERROR err;
+
+                err = handle_tkey(dns, state, in, req_state,
+                                  &state->answers, &state->ancount);
+                if (tevent_req_werror(req, err)) {
+                        return tevent_req_post(req, ev);
+                }
+                tevent_req_done(req);
+                return tevent_req_post(req, ev);
+        }
+
+        if (dns_authorative_for_zone(dns, in->questions[0].name)) {
+
+                req_state->flags |= DNS_FLAG_AUTHORITATIVE;
+
+                /*
+                 * Initialize the response arrays, so that we can use
+                 * them as their own talloc contexts when doing the
+                 * realloc
+                 */
+                state->answers = talloc_array(state, struct dns_res_rec, 0);
+                if (tevent_req_nomem(state->answers, req)) {
+                        return tevent_req_post(req, ev);
+                }
+                state->nsrecs = talloc_array(state, struct dns_res_rec, 0);
+                if (tevent_req_nomem(state->nsrecs, req)) {
+                        return tevent_req_post(req, ev);
+                }
+
+                subreq = handle_authoritative_send(
+                        state, ev, dns, lpcfg_dns_forwarder(dns->task->lp_ctx),
+                        &in->questions[0], &state->answers, &state->nsrecs);
+                if (tevent_req_nomem(subreq, req)) {
+                        return tevent_req_post(req, ev);
+                }
+                tevent_req_set_callback(
+                        subreq, dns_server_process_query_got_auth, req);
+                return req;
+        }
+
+        if ((req_state->flags & DNS_FLAG_RECURSION_DESIRED) &&
+            (req_state->flags & DNS_FLAG_RECURSION_AVAIL)) {
+                DEBUG(2, ("Not authoritative for '%s', forwarding\n",
+                          in->questions[0].name));
+
+                subreq = ask_forwarder_send(
+                        state, ev, dns, lpcfg_dns_forwarder(dns->task->lp_ctx),
+                        &in->questions[0]);
+                if (tevent_req_nomem(subreq, req)) {
+                        return tevent_req_post(req, ev);
+                }
+                tevent_req_set_callback(
+                        subreq, dns_server_process_query_got_response, req);
+                return req;
+        }
+
+        tevent_req_werror(req, DNS_ERR(NAME_ERROR));
+        return tevent_req_post(req, ev);
+}
+
+static void dns_server_process_query_got_response(struct tevent_req *subreq)
+{
+        struct tevent_req *req = tevent_req_callback_data(
+                subreq, struct tevent_req);
+        struct dns_server_process_query_state *state = tevent_req_data(
+                req, struct dns_server_process_query_state);
+        WERROR err;
+
+        err = ask_forwarder_recv(subreq, state,
+                                 &state->answers, &state->ancount,
+                                 &state->nsrecs, &state->nscount,
+                                 &state->additional, &state->arcount);
+        TALLOC_FREE(subreq);
+        if (tevent_req_werror(req, err)) {
+                return;
+        }
+        tevent_req_done(req);
+}
+
+static void dns_server_process_query_got_auth(struct tevent_req *subreq)
+{
+        struct tevent_req *req = tevent_req_callback_data(
+                subreq, struct tevent_req);
+        struct dns_server_process_query_state *state = tevent_req_data(
+                req, struct dns_server_process_query_state);
+        WERROR werr;
+
+        werr = handle_authoritative_recv(subreq);
+        TALLOC_FREE(subreq);
+        if (tevent_req_werror(req, werr)) {
+                return;
+        }
+        state->ancount = talloc_array_length(state->answers);
+        state->nscount = talloc_array_length(state->nsrecs);
+        state->arcount = talloc_array_length(state->additional);
+
+        tevent_req_done(req);
+}
+
+WERROR dns_server_process_query_recv(
+        struct tevent_req *req, TALLOC_CTX *mem_ctx,
+        struct dns_res_rec **answers,    uint16_t *ancount,
+        struct dns_res_rec **nsrecs,     uint16_t *nscount,
+        struct dns_res_rec **additional, uint16_t *arcount)
+{
+        struct dns_server_process_query_state *state = tevent_req_data(
+                req, struct dns_server_process_query_state);
+        WERROR err = WERR_OK;
+
+        if (tevent_req_is_werror(req, &err)) {
+
+                if ((!W_ERROR_EQUAL(err, DNS_ERR(NAME_ERROR))) &&
+                    (!W_ERROR_EQUAL(err, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST))) {
+                        return err;
+                }
+        }
+        *answers = talloc_move(mem_ctx, &state->answers);
+        *ancount = state->ancount;
+        *nsrecs = talloc_move(mem_ctx, &state->nsrecs);
+        *nscount = state->nscount;
+        *additional = talloc_move(mem_ctx, &state->additional);
+        *arcount = state->arcount;
+        return err;
+}

vendor/current/source4/dns_server/dns_server.c

@@ -43 +43 @@
 #include "auth/session.h"
 #include "lib/util/dlinklist.h"
+#include "lib/util/tevent_werror.h"
+#include "auth/auth.h"
+#include "auth/credentials/credentials.h"
+#include "librpc/gen_ndr/ndr_irpc.h"
+#include "lib/messaging/irpc.h"
+#include "libds/common/roles.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_DNS
+
+NTSTATUS server_service_dns_init(void);
 
 /* hold information about one dns socket */
@@ -92 +103 @@
 }
 
-static NTSTATUS dns_process(struct dns_server *dns,
-                            TALLOC_CTX *mem_ctx,
-                            DATA_BLOB *in,
-                            DATA_BLOB *out)
-{
+struct dns_process_state {
+        DATA_BLOB *in;
+        struct dns_server *dns;
+        struct dns_name_packet in_packet;
+        struct dns_request_state state;
+        uint16_t dns_err;
+        struct dns_name_packet out_packet;
+        DATA_BLOB out;
+};
+
+static void dns_process_done(struct tevent_req *subreq);
+
+static struct tevent_req *dns_process_send(TALLOC_CTX *mem_ctx,
+                                           struct tevent_context *ev,
+                                           struct dns_server *dns,
+                                           DATA_BLOB *in)
+{
+        struct tevent_req *req, *subreq;
+        struct dns_process_state *state;
         enum ndr_err_code ndr_err;
         WERROR ret;
-        struct dns_name_packet *in_packet;
-        struct dns_name_packet *out_packet;
-        struct dns_res_rec *answers = NULL, *nsrecs = NULL, *additional = NULL;
-        uint16_t num_answers = 0 , num_nsrecs = 0, num_additional = 0;
+        const char *forwarder = lpcfg_dns_forwarder(dns->task->lp_ctx);
+        req = tevent_req_create(mem_ctx, &state, struct dns_process_state);
+        if (req == NULL) {
+                return NULL;
+        }
+        state->state.mem_ctx = state;
+        state->in = in;
+
+        state->dns = dns;
 
         if (in->length < 12) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        in_packet = talloc_zero(mem_ctx, struct dns_name_packet);
-        /* TODO: We don't really need an out_packet. */
-        out_packet = talloc_zero(mem_ctx, struct dns_name_packet);
-
-        if (in_packet == NULL) return NT_STATUS_NO_MEMORY;
-        if (out_packet == NULL) return NT_STATUS_NO_MEMORY;
-
-        dump_data(2, in->data, in->length);
-
-        ndr_err = ndr_pull_struct_blob(in, in_packet, in_packet,
-                        (ndr_pull_flags_fn_t)ndr_pull_dns_name_packet);
+                tevent_req_werror(req, WERR_INVALID_PARAM);
+                return tevent_req_post(req, ev);
+        }
+        dump_data_dbgc(DBGC_DNS, 8, in->data, in->length);
+
+        ndr_err = ndr_pull_struct_blob(
+                in, state, &state->in_packet,
+                (ndr_pull_flags_fn_t)ndr_pull_dns_name_packet);
+
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                TALLOC_FREE(in_packet);
-                DEBUG(0, ("Failed to parse packet %d!\n", ndr_err));
-                *out = *in;
-
-                out->data[2] |= 0x80; /* Toggle DNS_FLAG_REPLY */
-                out->data[3] |= DNS_RCODE_FORMERR;
-
-                return NT_STATUS_OK;
-        }
-
-        NDR_PRINT_DEBUG(dns_name_packet, in_packet);
-        *out_packet = *in_packet;
-        out_packet->operation |= DNS_FLAG_REPLY;
-
-        switch (in_packet->operation & DNS_OPCODE) {
+                state->dns_err = DNS_RCODE_FORMERR;
+                tevent_req_done(req);
+                return tevent_req_post(req, ev);
+        }
+        if (DEBUGLVLC(DBGC_DNS, 8)) {
+                NDR_PRINT_DEBUGC(DBGC_DNS, dns_name_packet, &state->in_packet);
+        }
+
+        ret = dns_verify_tsig(dns, state, &state->state, &state->in_packet, in);
+        if (!W_ERROR_IS_OK(ret)) {
+                DEBUG(1, ("Failed to verify TSIG!\n"));
+                state->dns_err = werr_to_dns_err(ret);
+                tevent_req_done(req);
+                return tevent_req_post(req, ev);
+        }
+
+        if (state->in_packet.operation & DNS_FLAG_REPLY) {
+                DEBUG(1, ("Won't reply to replies.\n"));
+                tevent_req_werror(req, WERR_INVALID_PARAM);
+                return tevent_req_post(req, ev);
+        }
+
+        state->state.flags = state->in_packet.operation;
+        state->state.flags |= DNS_FLAG_REPLY;
+
+        
+        if (forwarder && *forwarder) {
+                state->state.flags |= DNS_FLAG_RECURSION_AVAIL;
+        }
+
+        state->out_packet = state->in_packet;
+
+        switch (state->in_packet.operation & DNS_OPCODE) {
         case DNS_OPCODE_QUERY:
-
-                ret = dns_server_process_query(dns, out_packet, in_packet,
-                                               &answers, &num_answers,
-                                               &nsrecs,  &num_nsrecs,
-                                               &additional, &num_additional);
-
-                break;
-        case DNS_OPCODE_REGISTER:
-                ret = dns_server_process_update(dns, out_packet, in_packet,
-                                                answers, num_answers,
-                                                &nsrecs,  &num_nsrecs,
-                                                &additional, &num_additional);
+                subreq = dns_server_process_query_send(
+                        state, ev, dns, &state->state, &state->in_packet);
+                if (tevent_req_nomem(subreq, req)) {
+                        return tevent_req_post(req, ev);
+                }
+                tevent_req_set_callback(subreq, dns_process_done, req);
+                return req;
+        case DNS_OPCODE_UPDATE:
+                ret = dns_server_process_update(
+                        dns, &state->state, state, &state->in_packet,
+                        &state->out_packet.answers, &state->out_packet.ancount,
+                        &state->out_packet.nsrecs,  &state->out_packet.nscount,
+                        &state->out_packet.additional,
+                        &state->out_packet.arcount);
                 break;
         default:
                 ret = WERR_DNS_ERROR_RCODE_NOT_IMPLEMENTED;
-                break;
-        }
-
-        if (W_ERROR_IS_OK(ret)) {
-                out_packet->ancount = num_answers;
-                out_packet->answers = answers;
-
-                out_packet->nscount = num_nsrecs;
-                out_packet->nsrecs  = nsrecs;
-
-                out_packet->arcount = num_additional;
-                out_packet->additional = additional;
-        } else {
-                out_packet->operation |= werr_to_dns_err(ret);
-        }
-
-        NDR_PRINT_DEBUG(dns_name_packet, out_packet);
-        ndr_err = ndr_push_struct_blob(out, out_packet, out_packet,
-                        (ndr_push_flags_fn_t)ndr_push_dns_name_packet);
+        }
+        if (!W_ERROR_IS_OK(ret)) {
+                state->dns_err = werr_to_dns_err(ret);
+        }
+        tevent_req_done(req);
+        return tevent_req_post(req, ev);
+}
+
+static void dns_process_done(struct tevent_req *subreq)
+{
+        struct tevent_req *req = tevent_req_callback_data(
+                subreq, struct tevent_req);
+        struct dns_process_state *state = tevent_req_data(
+                req, struct dns_process_state);
+        WERROR ret;
+
+        ret = dns_server_process_query_recv(
+                subreq, state,
+                &state->out_packet.answers, &state->out_packet.ancount,
+                &state->out_packet.nsrecs,  &state->out_packet.nscount,
+                &state->out_packet.additional, &state->out_packet.arcount);
+        TALLOC_FREE(subreq);
+
+        if (!W_ERROR_IS_OK(ret)) {
+                state->dns_err = werr_to_dns_err(ret);
+        }
+        tevent_req_done(req);
+}
+
+static WERROR dns_process_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
+                               DATA_BLOB *out)
+{
+        struct dns_process_state *state = tevent_req_data(
+                req, struct dns_process_state);
+        enum ndr_err_code ndr_err;
+        WERROR ret;
+
+        if (tevent_req_is_werror(req, &ret)) {
+                return ret;
+        }
+        if ((state->dns_err != DNS_RCODE_OK) &&
+            (state->dns_err != DNS_RCODE_NXDOMAIN)) {
+                goto drop;
+        }
+        if (state->dns_err != DNS_RCODE_OK) {
+                state->out_packet.operation |= state->dns_err;
+        }
+        state->out_packet.operation |= state->state.flags;
+
+        if (state->state.sign) {
+                ret = dns_sign_tsig(state->dns, mem_ctx, &state->state,
+                                    &state->out_packet, 0);
+                if (!W_ERROR_IS_OK(ret)) {
+                        state->dns_err = DNS_RCODE_SERVFAIL;
+                        goto drop;
+                }
+        }
+
+        if (DEBUGLVLC(DBGC_DNS, 8)) {
+                NDR_PRINT_DEBUGC(DBGC_DNS, dns_name_packet, &state->out_packet);
+        }
+
+        ndr_err = ndr_push_struct_blob(
+                out, mem_ctx, &state->out_packet,
+                (ndr_push_flags_fn_t)ndr_push_dns_name_packet);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                TALLOC_FREE(in_packet);
-                TALLOC_FREE(out_packet);
-                DEBUG(0, ("Failed to push packet %d!\n", ndr_err));
-                *out = *in;
-
-                out->data[2] |= 0x80; /* Toggle DNS_FLAG_REPLY */
-                out->data[3] |= DNS_RCODE_SERVFAIL;
-
-                return NT_STATUS_OK;
-        }
-
-        dump_data(2, out->data, out->length);
-        return NT_STATUS_OK;
+                DEBUG(1, ("Failed to push packet: %s!\n",
+                          ndr_errstr(ndr_err)));
+                state->dns_err = DNS_RCODE_SERVFAIL;
+                goto drop;
+        }
+        return WERR_OK;
+
+drop:
+        *out = data_blob_talloc(mem_ctx, state->in->data, state->in->length);
+        if (out->data == NULL) {
+                return WERR_NOMEM;
+        }
+        out->data[2] |= 0x80; /* Toggle DNS_FLAG_REPLY */
+        out->data[3] |= state->dns_err;
+        return WERR_OK;
 }
 
@@ -194 +287 @@
 };
 
+static void dns_tcp_call_process_done(struct tevent_req *subreq);
 static void dns_tcp_call_writev_done(struct tevent_req *subreq);
 
@@ -200 +294 @@
         struct dns_tcp_connection *dns_conn = tevent_req_callback_data(subreq,
                                       struct dns_tcp_connection);
+        struct dns_server *dns = dns_conn->dns_socket->dns;
         struct dns_tcp_call *call;
         NTSTATUS status;
@@ -229 +324 @@
         }
 
-        DEBUG(10,("Received krb5 TCP packet of length %lu from %s\n",
+        DEBUG(10,("Received DNS TCP packet of length %lu from %s\n",
                  (long) call->in.length,
                  tsocket_address_string(dns_conn->conn->remote_address, call)));
 
         /* skip length header */
-        call->in.data +=4;
-        call->in.length -= 4;
-
-        /* Call dns */
-        status = dns_process(dns_conn->dns_socket->dns, call, &call->in, &call->out);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0, ("dns_process returned %s\n", nt_errstr(status)));
+        call->in.data += 2;
+        call->in.length -= 2;
+
+        subreq = dns_process_send(call, dns->task->event_ctx, dns,
+                                  &call->in);
+        if (subreq == NULL) {
+                dns_tcp_terminate_connection(
+                        dns_conn, "dns_tcp_call_loop: dns_process_send "
+                        "failed\n");
+                return;
+        }
+        tevent_req_set_callback(subreq, dns_tcp_call_process_done, call);
+
+        /*
+         * The dns tcp pdu's has the length as 2 byte (initial_read_size),
+         * packet_full_request_u16 provides the pdu length then.
+         */
+        subreq = tstream_read_pdu_blob_send(dns_conn,
+                                            dns_conn->conn->event.ctx,
+                                            dns_conn->tstream,
+                                            2, /* initial_read_size */
+                                            packet_full_request_u16,
+                                            dns_conn);
+        if (subreq == NULL) {
+                dns_tcp_terminate_connection(dns_conn, "dns_tcp_call_loop: "
+                                "no memory for tstream_read_pdu_blob_send");
+                return;
+        }
+        tevent_req_set_callback(subreq, dns_tcp_call_loop, dns_conn);
+}
+
+static void dns_tcp_call_process_done(struct tevent_req *subreq)
+{
+        struct dns_tcp_call *call = tevent_req_callback_data(subreq,
+                        struct dns_tcp_call);
+        struct dns_tcp_connection *dns_conn = call->dns_conn;
+        WERROR err;
+
+        err = dns_process_recv(subreq, call, &call->out);
+        TALLOC_FREE(subreq);
+        if (!W_ERROR_IS_OK(err)) {
+                DEBUG(1, ("dns_process returned %s\n", win_errstr(err)));
                 dns_tcp_terminate_connection(dns_conn,
                                 "dns_tcp_call_loop: process function failed");
@@ -247 +377 @@
 
         /* First add the length of the out buffer */
-        RSIVAL(call->out_hdr, 0, call->out.length);
+        RSSVAL(call->out_hdr, 0, call->out.length);
         call->out_iov[0].iov_base = (char *) call->out_hdr;
-        call->out_iov[0].iov_len = 4;
+        call->out_iov[0].iov_len = 2;
 
         call->out_iov[1].iov_base = (char *) call->out.data;
@@ -265 +395 @@
         }
         tevent_req_set_callback(subreq, dns_tcp_call_writev_done, call);
-
-        /*
-         * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
-         * packet_full_request_u32 provides the pdu length then.
-         */
-        subreq = tstream_read_pdu_blob_send(dns_conn,
-                                            dns_conn->conn->event.ctx,
-                                            dns_conn->tstream,
-                                            4, /* initial_read_size */
-                                            packet_full_request_u32,
-                                            dns_conn);
-        if (subreq == NULL) {
-                dns_tcp_terminate_connection(dns_conn, "dns_tcp_call_loop: "
-                                "no memory for tstream_read_pdu_blob_send");
-                return;
-        }
-        tevent_req_set_callback(subreq, dns_tcp_call_loop, dns_conn);
 }
 
@@ -354 +467 @@
 
         /*
-         * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
-         * packet_full_request_u32 provides the pdu length then.
+         * The dns tcp pdu's has the length as 2 byte (initial_read_size),
+         * packet_full_request_u16 provides the pdu length then.
          */
         subreq = tstream_read_pdu_blob_send(dns_conn,
                                             dns_conn->conn->event.ctx,
                                             dns_conn->tstream,
-                                            4, /* initial_read_size */
-                                            packet_full_request_u32,
+                                            2, /* initial_read_size */
+                                            packet_full_request_u16,
                                             dns_conn);
         if (subreq == NULL) {
@@ -379 +492 @@
 
 struct dns_udp_call {
+        struct dns_udp_socket *sock;
         struct tsocket_address *src;
         DATA_BLOB in;
@@ -384 +498 @@
 };
 
+static void dns_udp_call_process_done(struct tevent_req *subreq);
 static void dns_udp_call_sendto_done(struct tevent_req *subreq);
 
@@ -390 +505 @@
         struct dns_udp_socket *sock = tevent_req_callback_data(subreq,
                                       struct dns_udp_socket);
+        struct dns_server *dns = sock->dns_socket->dns;
         struct dns_udp_call *call;
         uint8_t *buf;
         ssize_t len;
         int sys_errno;
-        NTSTATUS status;
 
         call = talloc(sock, struct dns_udp_call);
@@ -401 +516 @@
                 goto done;
         }
+        call->sock = sock;
 
         len = tdgram_recvfrom_recv(subreq, &sys_errno,
@@ -413 +529 @@
         call->in.length = len;
 
-        DEBUG(10,("Received krb5 UDP packet of length %lu from %s\n",
+        DEBUG(10,("Received DNS UDP packet of length %lu from %s\n",
                  (long)call->in.length,
                  tsocket_address_string(call->src, call)));
 
-        /* Call krb5 */
-        status = dns_process(sock->dns_socket->dns, call, &call->in, &call->out);
-        if (!NT_STATUS_IS_OK(status)) {
-                talloc_free(call);
-                DEBUG(0, ("dns_process returned %s\n", nt_errstr(status)));
+        subreq = dns_process_send(call, dns->task->event_ctx, dns,
+                                  &call->in);
+        if (subreq == NULL) {
+                TALLOC_FREE(call);
                 goto done;
         }
-
-        subreq = tdgram_sendto_queue_send(call,
-                                          sock->dns_socket->dns->task->event_ctx,
-                                          sock->dgram,
-                                          sock->send_queue,
-                                          call->out.data,
-                                          call->out.length,
-                                          call->src);
-        if (subreq == NULL) {
-                talloc_free(call);
-                goto done;
-        }
-        tevent_req_set_callback(subreq, dns_udp_call_sendto_done, call);
+        tevent_req_set_callback(subreq, dns_udp_call_process_done, call);
 
 done:
@@ -451 +554 @@
 }
 
+static void dns_udp_call_process_done(struct tevent_req *subreq)
+{
+        struct dns_udp_call *call = tevent_req_callback_data(
+                subreq, struct dns_udp_call);
+        struct dns_udp_socket *sock = call->sock;
+        struct dns_server *dns = sock->dns_socket->dns;
+        WERROR err;
+
+        err = dns_process_recv(subreq, call, &call->out);
+        TALLOC_FREE(subreq);
+        if (!W_ERROR_IS_OK(err)) {
+                DEBUG(1, ("dns_process returned %s\n", win_errstr(err)));
+                TALLOC_FREE(call);
+                return;
+        }
+
+        subreq = tdgram_sendto_queue_send(call,
+                                          dns->task->event_ctx,
+                                          sock->dgram,
+                                          sock->send_queue,
+                                          call->out.data,
+                                          call->out.length,
+                                          call->src);
+        if (subreq == NULL) {
+                talloc_free(call);
+                return;
+        }
+        tevent_req_set_callback(subreq, dns_udp_call_sendto_done, call);
+
+}
 static void dns_udp_call_sendto_done(struct tevent_req *subreq)
 {
         struct dns_udp_call *call = tevent_req_callback_data(subreq,
                                        struct dns_udp_call);
-        ssize_t ret;
         int sys_errno;
 
-        ret = tdgram_sendto_queue_recv(subreq, &sys_errno);
+        tdgram_sendto_queue_recv(subreq, &sys_errno);
 
         /* We don't care about errors */
@@ -489 +621 @@
                                                 &dns_socket->local_address);
         if (ret != 0) {
-                status = map_nt_error_from_unix(errno);
+                status = map_nt_error_from_unix_common(errno);
                 return status;
         }
@@ -518 +650 @@
                                      &dns_udp_socket->dgram);
         if (ret != 0) {
-                status = map_nt_error_from_unix(errno);
+                status = map_nt_error_from_unix_common(errno);
                 DEBUG(0,("Failed to bind to %s:%u UDP - %s\n",
                          address, port, nt_errstr(status)));
@@ -540 +672 @@
   setup our listening sockets on the configured network interfaces
 */
-static NTSTATUS dns_startup_interfaces(struct dns_server *dns, struct loadparm_context *lp_ctx,
+static NTSTATUS dns_startup_interfaces(struct dns_server *dns,
                                        struct interface *ifaces)
 {
@@ -558 +690 @@
         }
 
-        num_interfaces = iface_count(ifaces);
-
-        for (i=0; i<num_interfaces; i++) {
-                const char *address = talloc_strdup(tmp_ctx, iface_n_ip(ifaces, i));
-
-                status = dns_add_socket(dns, model_ops, "dns", address, DNS_SERVICE_PORT);
-                NT_STATUS_NOT_OK_RETURN(status);
+        if (ifaces != NULL) {
+                num_interfaces = iface_list_count(ifaces);
+
+                for (i=0; i<num_interfaces; i++) {
+                        const char *address = talloc_strdup(tmp_ctx,
+                                                            iface_list_n_ip(ifaces, i));
+
+                        status = dns_add_socket(dns, model_ops, "dns", address,
+                                                DNS_SERVICE_PORT);
+                        NT_STATUS_NOT_OK_RETURN(status);
+                }
+        } else {
+                int num_binds = 0;
+                char **wcard;
+                wcard = iface_list_wildcard(tmp_ctx);
+                if (wcard == NULL) {
+                        DEBUG(0, ("No wildcard address available\n"));
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+                for (i = 0; wcard[i] != NULL; i++) {
+                        status = dns_add_socket(dns, model_ops, "dns", wcard[i],
+                                                DNS_SERVICE_PORT);
+                        if (NT_STATUS_IS_OK(status)) {
+                                num_binds++;
+                        }
+                }
+                if (num_binds == 0) {
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_INVALID_PARAMETER_MIX;
+                }
         }
 
@@ -572 +727 @@
 }
 
-static int dns_server_sort_zones(struct ldb_message **m1, struct ldb_message **m2)
-{
-        const char *n1, *n2;
-        size_t l1, l2;
-
-        n1 = ldb_msg_find_attr_as_string(*m1, "name", NULL);
-        n2 = ldb_msg_find_attr_as_string(*m2, "name", NULL);
-
-        l1 = strlen(n1);
-        l2 = strlen(n2);
-
-        /* If the string lengths are not equal just sort by length */
-        if (l1 != l2) {
-                /* If m1 is the larger zone name, return it first */
-                return l2 - l1;
-        }
-
-        /*TODO: We need to compare DNs here, we want the DomainDNSZones first */
-        return 0;
+static struct dns_server_tkey_store *tkey_store_init(TALLOC_CTX *mem_ctx,
+                                                     uint16_t size)
+{
+        struct dns_server_tkey_store *buffer = talloc_zero(mem_ctx,
+                                                struct dns_server_tkey_store);
+
+        if (buffer == NULL) {
+                return NULL;
+        }
+
+        buffer->size = size;
+        buffer->next_idx = 0;
+
+        buffer->tkeys = talloc_zero_array(buffer, struct dns_server_tkey *, size);
+        if (buffer->tkeys == NULL) {
+                TALLOC_FREE(buffer);
+        }
+
+        return buffer;
+}
+
+static NTSTATUS dns_server_reload_zones(struct dns_server *dns)
+{
+        NTSTATUS status;
+        struct dns_server_zone *new_list = NULL;
+        struct dns_server_zone *old_list = NULL;
+        struct dns_server_zone *old_zone;
+        status = dns_common_zones(dns->samdb, dns, &new_list);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+        dns->zones = new_list;
+        while ((old_zone = DLIST_TAIL(old_list)) != NULL) {
+                DLIST_REMOVE(old_list, old_zone);
+                talloc_free(old_zone);
+        }
+
+        return NT_STATUS_OK;
+}
+
+/**
+ * Called when the internal DNS server should reload the zones from DB, for
+ * example, when zones are added or deleted through RPC or replicated by
+ * inbound DRS.
+ */
+static NTSTATUS dns_reload_zones(struct irpc_message *msg,
+                                 struct dnssrv_reload_dns_zones *r)
+{
+        struct dns_server *dns;
+
+        dns = talloc_get_type(msg->private_data, struct dns_server);
+        if (dns == NULL) {
+                r->out.result = NT_STATUS_INTERNAL_ERROR;
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        r->out.result = dns_server_reload_zones(dns);
+
+        return NT_STATUS_OK;
 }
 
@@ -597 +792 @@
         struct dns_server *dns;
         NTSTATUS status;
-        struct interface *ifaces;
+        struct interface *ifaces = NULL;
         int ret;
-        struct ldb_result *res;
-        struct ldb_dn *rootdn;
-        static const char * const attrs[] = { "name", NULL};
-        unsigned int i;
+        static const char * const attrs_none[] = { NULL};
+        struct ldb_message *dns_acc;
+        char *hostname_lower;
+        char *dns_spn;
 
         switch (lpcfg_server_role(task->lp_ctx)) {
@@ -611 +806 @@
                 task_server_terminate(task, "dns: no DNS required in member server configuration", false);
                 return;
-        case ROLE_DOMAIN_CONTROLLER:
+        case ROLE_ACTIVE_DIRECTORY_DC:
                 /* Yes, we want a DNS */
                 break;
         }
 
-        load_interfaces(task, lpcfg_interfaces(task->lp_ctx), &ifaces);
-
-        if (iface_count(ifaces) == 0) {
-                task_server_terminate(task, "dns: no network interfaces configured", false);
-                return;
+        if (lpcfg_interfaces(task->lp_ctx) && lpcfg_bind_interfaces_only(task->lp_ctx)) {
+                load_interface_list(task, task->lp_ctx, &ifaces);
+
+                if (iface_list_count(ifaces) == 0) {
+                        task_server_terminate(task, "dns: no network interfaces configured", false);
+                        return;
+                }
         }
 
@@ -632 +829 @@
 
         dns->task = task;
+        /*FIXME: Make this a configurable option */
+        dns->max_payload = 4096;
+
+        dns->server_credentials = cli_credentials_init(dns);
+        if (!dns->server_credentials) {
+                task_server_terminate(task, "Failed to init server credentials\n", true);
+                return;
+        }
 
         dns->samdb = samdb_connect(dns, dns->task->event_ctx, dns->task->lp_ctx,
@@ -640 +845 @@
         }
 
-        rootdn = ldb_dn_new(dns, dns->samdb, "");
-        if (rootdn == NULL) {
-                task_server_terminate(task, "dns: out of memory", true);
-                return;
-        }
-
-        // TODO: this search does not work against windows
-        ret = dsdb_search(dns->samdb, dns, &res, rootdn, LDB_SCOPE_SUBTREE,
-                          attrs, DSDB_SEARCH_SEARCH_ALL_PARTITIONS, "(objectClass=dnsZone)");
-        if (ret != LDB_SUCCESS) {
-                task_server_terminate(task,
-                                      "dns: failed to look up root DNS zones",
-                                      true);
-                return;
-        }
-
-        TYPESAFE_QSORT(res->msgs, res->count, dns_server_sort_zones);
-
-        for (i=0; i < res->count; i++) {
-                struct dns_server_zone *z;
-
-                z = talloc_zero(dns, struct dns_server_zone);
-                if (z == NULL) {
-                }
-
-                z->name = ldb_msg_find_attr_as_string(res->msgs[i], "name", NULL);
-                z->dn = talloc_move(z, &res->msgs[i]->dn);
-
-                DLIST_ADD_END(dns->zones, z, NULL);
-        }
-
-        status = dns_startup_interfaces(dns, task->lp_ctx, ifaces);
+        cli_credentials_set_conf(dns->server_credentials, task->lp_ctx);
+
+        hostname_lower = strlower_talloc(dns, lpcfg_netbios_name(task->lp_ctx));
+        dns_spn = talloc_asprintf(dns, "DNS/%s.%s",
+                                  hostname_lower,
+                                  lpcfg_dnsdomain(task->lp_ctx));
+        TALLOC_FREE(hostname_lower);
+
+        ret = dsdb_search_one(dns->samdb, dns, &dns_acc,
+                              ldb_get_default_basedn(dns->samdb), LDB_SCOPE_SUBTREE,
+                              attrs_none, 0, "(servicePrincipalName=%s)",
+                              dns_spn);
+        if (ret == LDB_SUCCESS) {
+                TALLOC_FREE(dns_acc);
+                if (!dns_spn) {
+                        task_server_terminate(task, "dns: talloc_asprintf failed", true);
+                        return;
+                }
+                status = cli_credentials_set_stored_principal(dns->server_credentials, task->lp_ctx, dns_spn);
+                if (!NT_STATUS_IS_OK(status)) {
+                        task_server_terminate(task,
+                                              talloc_asprintf(task, "Failed to obtain server credentials for DNS, "
+                                                              "despite finding it in the samdb! %s\n",
+                                                              nt_errstr(status)),
+                                              true);
+                        return;
+                }
+        } else {
+                TALLOC_FREE(dns_spn);
+                status = cli_credentials_set_machine_account(dns->server_credentials, task->lp_ctx);
+                if (!NT_STATUS_IS_OK(status)) {
+                        task_server_terminate(task,
+                                              talloc_asprintf(task, "Failed to obtain server credentials, perhaps a standalone server?: %s\n",
+                                                              nt_errstr(status)),
+                                              true);
+                        return;
+                }
+        }
+
+        dns->tkeys = tkey_store_init(dns, TKEY_BUFFER_SIZE);
+        if (!dns->tkeys) {
+                task_server_terminate(task, "Failed to allocate tkey storage\n", true);
+                return;
+        }
+
+        status = dns_server_reload_zones(dns);
+        if (!NT_STATUS_IS_OK(status)) {
+                task_server_terminate(task, "dns: failed to load DNS zones", true);
+                return;
+        }
+
+        status = dns_startup_interfaces(dns, ifaces);
         if (!NT_STATUS_IS_OK(status)) {
                 task_server_terminate(task, "dns failed to setup interfaces", true);
                 return;
         }
+
+        /* Setup the IRPC interface and register handlers */
+        status = irpc_add_name(task->msg_ctx, "dnssrv");
+        if (!NT_STATUS_IS_OK(status)) {
+                task_server_terminate(task, "dns: failed to register IRPC name", true);
+                return;
+        }
+
+        status = IRPC_REGISTER(task->msg_ctx, irpc, DNSSRV_RELOAD_DNS_ZONES,
+                               dns_reload_zones, dns);
+        if (!NT_STATUS_IS_OK(status)) {
+                task_server_terminate(task, "dns: failed to setup reload handler", true);
+                return;
+        }
 }
 

vendor/current/source4/dns_server/dns_server.h

@@ -24 +24 @@
 
 #include "librpc/gen_ndr/dns.h"
+#include "librpc/gen_ndr/ndr_dnsp.h"
+#include "dnsserver_common.h"
 
 struct tsocket_address;
+struct dns_server_tkey {
+        const char *name;
+        enum dns_tkey_mode mode;
+        const char *algorithm;
+        struct auth_session_info *session_info;
+        struct gensec_security *gensec;
+        bool complete;
+};
 
-struct dns_server_zone {
-        struct dns_server_zone *prev, *next;
-        const char *name;
-        struct ldb_dn *dn;
+#define TKEY_BUFFER_SIZE 128
+
+struct dns_server_tkey_store {
+        struct dns_server_tkey **tkeys;
+        uint16_t next_idx;
+        uint16_t size;
 };
 
@@ -37 +49 @@
         struct ldb_context *samdb;
         struct dns_server_zone *zones;
+        struct dns_server_tkey_store *tkeys;
+        struct cli_credentials *server_credentials;
+        uint16_t max_payload;
 };
 
+struct dns_request_state {
+        TALLOC_CTX *mem_ctx;
+        uint16_t flags;
+        bool authenticated;
+        bool sign;
+        char *key_name;
+        struct dns_res_rec *tsig;
+        uint16_t tsig_error;
+};
 
-WERROR dns_server_process_query(struct dns_server *dns,
-                                TALLOC_CTX *mem_ctx,
-                                struct dns_name_packet *in,
-                                struct dns_res_rec **answers,    uint16_t *ancount,
-                                struct dns_res_rec **nsrecs,     uint16_t *nscount,
-                                struct dns_res_rec **additional, uint16_t *arcount);
+struct tevent_req *dns_server_process_query_send(
+        TALLOC_CTX *mem_ctx, struct tevent_context *ev,
+        struct dns_server *dns, struct dns_request_state *req_state,
+        const struct dns_name_packet *in);
+WERROR dns_server_process_query_recv(
+        struct tevent_req *req, TALLOC_CTX *mem_ctx,
+        struct dns_res_rec **answers,    uint16_t *ancount,
+        struct dns_res_rec **nsrecs,     uint16_t *nscount,
+        struct dns_res_rec **additional, uint16_t *arcount);
 
 WERROR dns_server_process_update(struct dns_server *dns,
+                                 const struct dns_request_state *state,
                                  TALLOC_CTX *mem_ctx,
-                                 struct dns_name_packet *in,
-                                 const struct dns_res_rec *prereqs, uint16_t prereq_count,
-                                 struct dns_res_rec **updates,      uint16_t *update_count,
-                                 struct dns_res_rec **additional,   uint16_t *arcount);
+                                 const struct dns_name_packet *in,
+                                 struct dns_res_rec **prereqs,    uint16_t *prereq_count,
+                                 struct dns_res_rec **updates,    uint16_t *update_count,
+                                 struct dns_res_rec **additional, uint16_t *arcount);
 
-uint8_t werr_to_dns_err(WERROR werror);
-bool dns_name_match(const char *zone, const char *name, size_t *host_part_len);
+bool dns_name_equal(const char *name1, const char *name2);
+bool dns_records_match(struct dnsp_DnssrvRpcRecord *rec1,
+                       struct dnsp_DnssrvRpcRecord *rec2);
+bool dns_authorative_for_zone(struct dns_server *dns,
+                              const char *name);
+const char *dns_get_authoritative_zone(struct dns_server *dns,
+                                       const char *name);
+WERROR dns_lookup_records(struct dns_server *dns,
+                          TALLOC_CTX *mem_ctx,
+                          struct ldb_dn *dn,
+                          struct dnsp_DnssrvRpcRecord **records,
+                          uint16_t *rec_count);
+WERROR dns_replace_records(struct dns_server *dns,
+                           TALLOC_CTX *mem_ctx,
+                           struct ldb_dn *dn,
+                           bool needs_add,
+                           struct dnsp_DnssrvRpcRecord *records,
+                           uint16_t rec_count);
 WERROR dns_name2dn(struct dns_server *dns,
                    TALLOC_CTX *mem_ctx,
                    const char *name,
                    struct ldb_dn **_dn);
+WERROR dns_generate_options(struct dns_server *dns,
+                            TALLOC_CTX *mem_ctx,
+                            struct dns_res_rec **options);
+struct dns_server_tkey *dns_find_tkey(struct dns_server_tkey_store *store,
+                                      const char *name);
+WERROR dns_verify_tsig(struct dns_server *dns,
+                       TALLOC_CTX *mem_ctx,
+                       struct dns_request_state *state,
+                       struct dns_name_packet *packet,
+                       DATA_BLOB *in);
+WERROR dns_sign_tsig(struct dns_server *dns,
+                     TALLOC_CTX *mem_ctx,
+                     struct dns_request_state *state,
+                     struct dns_name_packet *packet,
+                     uint16_t error);
 
-#define DNS_ERR(err_str) WERR_DNS_ERROR_RCODE_##err_str
+#include "source4/dns_server/dnsserver_common.h"
+
 #endif /* __DNS_SERVER_H__ */

vendor/current/source4/dns_server/dns_update.c

@@ -26 +26 @@
 #include "librpc/gen_ndr/ndr_dnsp.h"
 #include <ldb.h>
+#include "param/param.h"
+#include "param/loadparm.h"
 #include "dsdb/samdb/samdb.h"
 #include "dsdb/common/util.h"
+#include "smbd/service_task.h"
 #include "dns_server/dns_server.h"
-
-static WERROR check_prerequsites(struct dns_server *dns,
-                                 TALLOC_CTX *mem_ctx,
-                                 const struct dns_name_packet *in,
-                                 const struct dns_res_rec *prereqs, uint16_t count)
+#include "auth/auth.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_DNS
+
+static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
+                             const struct dns_res_rec *rrec,
+                             struct dnsp_DnssrvRpcRecord *r);
+
+static WERROR check_one_prerequisite(struct dns_server *dns,
+                                     TALLOC_CTX *mem_ctx,
+                                     const struct dns_name_question *zone,
+                                     const struct dns_res_rec *pr,
+                                     bool *final_result)
 {
-        const struct dns_name_question *zone;
+        bool match;
+        WERROR werror;
+        struct ldb_dn *dn;
+        uint16_t i;
+        bool found = false;
+        struct dnsp_DnssrvRpcRecord *rec = NULL;
+        struct dnsp_DnssrvRpcRecord *ans;
+        uint16_t acount;
+
         size_t host_part_len = 0;
+
+        *final_result = true;
+
+        if (pr->ttl != 0) {
+                return DNS_ERR(FORMAT_ERROR);
+        }
+
+        match = dns_name_match(zone->name, pr->name, &host_part_len);
+        if (!match) {
+                return DNS_ERR(NOTZONE);
+        }
+
+        werror = dns_name2dn(dns, mem_ctx, pr->name, &dn);
+        W_ERROR_NOT_OK_RETURN(werror);
+
+        if (pr->rr_class == DNS_QCLASS_ANY) {
+
+                if (pr->length != 0) {
+                        return DNS_ERR(FORMAT_ERROR);
+                }
+
+
+                if (pr->rr_type == DNS_QTYPE_ALL) {
+                        /*
+                         */
+                        werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
+                        if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
+                                return DNS_ERR(NAME_ERROR);
+                        }
+                        W_ERROR_NOT_OK_RETURN(werror);
+
+                        if (acount == 0) {
+                                return DNS_ERR(NAME_ERROR);
+                        }
+                } else {
+                        /*
+                         */
+                        werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
+                        if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
+                                return DNS_ERR(NXRRSET);
+                        }
+                        if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
+                                return DNS_ERR(NXRRSET);
+                        }
+                        W_ERROR_NOT_OK_RETURN(werror);
+
+                        for (i = 0; i < acount; i++) {
+                                if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
+                                        found = true;
+                                        break;
+                                }
+                        }
+                        if (!found) {
+                                return DNS_ERR(NXRRSET);
+                        }
+                }
+
+                /*
+                 * RFC2136 3.2.5 doesn't actually mention the need to return
+                 * OK here, but otherwise we'd always return a FORMAT_ERROR
+                 * later on. This also matches Microsoft DNS behavior.
+                 */
+                return WERR_OK;
+        }
+
+        if (pr->rr_class == DNS_QCLASS_NONE) {
+                if (pr->length != 0) {
+                        return DNS_ERR(FORMAT_ERROR);
+                }
+
+                if (pr->rr_type == DNS_QTYPE_ALL) {
+                        /*
+                         */
+                        werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
+                        if (W_ERROR_EQUAL(werror, WERR_OK)) {
+                                return DNS_ERR(YXDOMAIN);
+                        }
+                } else {
+                        /*
+                         */
+                        werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
+                        if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
+                                werror = WERR_OK;
+                        }
+                        if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
+                                werror = WERR_OK;
+                        }
+
+                        for (i = 0; i < acount; i++) {
+                                if (ans[i].wType == (enum dns_record_type) pr->rr_type) {
+                                        found = true;
+                                        break;
+                                }
+                        }
+                        if (found) {
+                                return DNS_ERR(YXRRSET);
+                        }
+                }
+
+                /*
+                 * RFC2136 3.2.5 doesn't actually mention the need to return
+                 * OK here, but otherwise we'd always return a FORMAT_ERROR
+                 * later on. This also matches Microsoft DNS behavior.
+                 */
+                return WERR_OK;
+        }
+
+        if (pr->rr_class != zone->question_class) {
+                return DNS_ERR(FORMAT_ERROR);
+        }
+
+        *final_result = false;
+
+        werror = dns_lookup_records(dns, mem_ctx, dn, &ans, &acount);
+        if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
+                return DNS_ERR(NXRRSET);
+        }
+        if (W_ERROR_EQUAL(werror, DNS_ERR(NAME_ERROR))) {
+                return DNS_ERR(NXRRSET);
+        }
+        W_ERROR_NOT_OK_RETURN(werror);
+
+        rec = talloc_zero(mem_ctx, struct dnsp_DnssrvRpcRecord);
+        W_ERROR_HAVE_NO_MEMORY(rec);
+
+        werror = dns_rr_to_dnsp(rec, pr, rec);
+        W_ERROR_NOT_OK_RETURN(werror);
+
+        for (i = 0; i < acount; i++) {
+                if (dns_records_match(rec, &ans[i])) {
+                        found = true;
+                        break;
+                }
+        }
+
+        if (!found) {
+                return DNS_ERR(NXRRSET);
+        }
+
+        return WERR_OK;
+}
+
+static WERROR check_prerequisites(struct dns_server *dns,
+                                  TALLOC_CTX *mem_ctx,
+                                  const struct dns_name_question *zone,
+                                  const struct dns_res_rec *prereqs, uint16_t count)
+{
         uint16_t i;
-
-        zone = in->questions;
+        WERROR final_error = WERR_OK;
 
         for (i = 0; i < count; i++) {
-                const struct dns_res_rec *r = &prereqs[i];
-                bool match;
-
-                if (r->ttl != 0) {
-                        return DNS_ERR(FORMAT_ERROR);
-                }
-                match = dns_name_match(zone->name, r->name, &host_part_len);
-                if (!match) {
-                        /* TODO: check if we need to echo all prereqs if the
-                         * first fails */
-                        return DNS_ERR(NOTZONE);
-                }
-                if (r->rr_class == DNS_QCLASS_ANY) {
-                        if (r->length != 0) {
-                                return DNS_ERR(FORMAT_ERROR);
-                        }
-                        if (r->rr_type == DNS_QTYPE_ALL) {
-                                /* TODO: Check if zone has at least one RR */
-                                return DNS_ERR(NAME_ERROR);
-                        } else {
-                                /* TODO: Check if RR exists of the specified type */
-                                return DNS_ERR(NXRRSET);
-                        }
-                }
-                if (r->rr_class == DNS_QCLASS_NONE) {
-                        if (r->length != 0) {
-                                return DNS_ERR(FORMAT_ERROR);
-                        }
-                        if (r->rr_type == DNS_QTYPE_ALL) {
-                                /* TODO: Return this error if the given name exits in this zone */
-                                return DNS_ERR(YXDOMAIN);
-                        } else {
-                                /* TODO: Return error if there's an RRset of this type in the zone */
-                                return DNS_ERR(YXRRSET);
-                        }
-                }
-                if (r->rr_class == zone->question_class) {
-                        /* Check if there's a RR with this */
-                        return DNS_ERR(NOT_IMPLEMENTED);
-                } else {
-                        return DNS_ERR(FORMAT_ERROR);
-                }
-        }
-
+                bool final;
+                WERROR werror;
+
+                werror = check_one_prerequisite(dns, mem_ctx, zone,
+                                                &prereqs[i], &final);
+                if (!W_ERROR_IS_OK(werror)) {
+                        if (final) {
+                                return werror;
+                        }
+                        if (W_ERROR_IS_OK(final_error)) {
+                                final_error = werror;
+                        }
+                }
+        }
+
+        if (!W_ERROR_IS_OK(final_error)) {
+                return final_error;
+        }
 
         return WERR_OK;
@@ -105 +245 @@
                 }
                 if (zone->question_class == r->rr_class) {
-                        /*TODO: also check for AXFR,MAILA,MAILB  */
                         if (r->rr_type == DNS_QTYPE_ALL) {
                                 return DNS_ERR(FORMAT_ERROR);
                         }
+                        if (r->rr_type == DNS_QTYPE_AXFR) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
+                        if (r->rr_type == DNS_QTYPE_MAILB) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
+                        if (r->rr_type == DNS_QTYPE_MAILA) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
                 } else if (r->rr_class == DNS_QCLASS_ANY) {
-                        if (r->ttl != 0 || r->length != 0) {
+                        if (r->ttl != 0) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
+                        if (r->length != 0) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
+                        if (r->rr_type == DNS_QTYPE_AXFR) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
+                        if (r->rr_type == DNS_QTYPE_MAILB) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
+                        if (r->rr_type == DNS_QTYPE_MAILA) {
                                 return DNS_ERR(FORMAT_ERROR);
                         }
                 } else if (r->rr_class == DNS_QCLASS_NONE) {
-                        if (r->ttl != 0 || r->rr_type == DNS_QTYPE_ALL) {
+                        if (r->ttl != 0) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
+                        if (r->rr_type == DNS_QTYPE_ALL) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
+                        if (r->rr_type == DNS_QTYPE_AXFR) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
+                        if (r->rr_type == DNS_QTYPE_MAILB) {
+                                return DNS_ERR(FORMAT_ERROR);
+                        }
+                        if (r->rr_type == DNS_QTYPE_MAILA) {
                                 return DNS_ERR(FORMAT_ERROR);
                         }
@@ -124 +296 @@
 }
 
+static WERROR dns_rr_to_dnsp(TALLOC_CTX *mem_ctx,
+                             const struct dns_res_rec *rrec,
+                             struct dnsp_DnssrvRpcRecord *r)
+{
+        enum ndr_err_code ndr_err;
+
+        if (rrec->rr_type == DNS_QTYPE_ALL) {
+                return DNS_ERR(FORMAT_ERROR);
+        }
+
+        ZERO_STRUCTP(r);
+
+        r->wType = (enum dns_record_type) rrec->rr_type;
+        r->dwTtlSeconds = rrec->ttl;
+        r->rank = DNS_RANK_ZONE;
+
+        /* If we get QCLASS_ANY, we're done here */
+        if (rrec->rr_class == DNS_QCLASS_ANY) {
+                goto done;
+        }
+
+        switch(rrec->rr_type) {
+        case DNS_QTYPE_A:
+                r->data.ipv4 = talloc_strdup(mem_ctx, rrec->rdata.ipv4_record);
+                W_ERROR_HAVE_NO_MEMORY(r->data.ipv4);
+                break;
+        case DNS_QTYPE_AAAA:
+                r->data.ipv6 = talloc_strdup(mem_ctx, rrec->rdata.ipv6_record);
+                W_ERROR_HAVE_NO_MEMORY(r->data.ipv6);
+                break;
+        case DNS_QTYPE_NS:
+                r->data.ns = talloc_strdup(mem_ctx, rrec->rdata.ns_record);
+                W_ERROR_HAVE_NO_MEMORY(r->data.ns);
+                break;
+        case DNS_QTYPE_CNAME:
+                r->data.cname = talloc_strdup(mem_ctx, rrec->rdata.cname_record);
+                W_ERROR_HAVE_NO_MEMORY(r->data.cname);
+                break;
+        case DNS_QTYPE_SRV:
+                r->data.srv.wPriority = rrec->rdata.srv_record.priority;
+                r->data.srv.wWeight = rrec->rdata.srv_record.weight;
+                r->data.srv.wPort = rrec->rdata.srv_record.port;
+                r->data.srv.nameTarget = talloc_strdup(mem_ctx,
+                                rrec->rdata.srv_record.target);
+                W_ERROR_HAVE_NO_MEMORY(r->data.srv.nameTarget);
+                break;
+        case DNS_QTYPE_PTR:
+                r->data.ptr = talloc_strdup(mem_ctx, rrec->rdata.ptr_record);
+                W_ERROR_HAVE_NO_MEMORY(r->data.ptr);
+                break;
+        case DNS_QTYPE_MX:
+                r->data.mx.wPriority = rrec->rdata.mx_record.preference;
+                r->data.mx.nameTarget = talloc_strdup(mem_ctx,
+                                rrec->rdata.mx_record.exchange);
+                W_ERROR_HAVE_NO_MEMORY(r->data.mx.nameTarget);
+                break;
+        case DNS_QTYPE_TXT:
+                ndr_err = ndr_dnsp_string_list_copy(mem_ctx,
+                                                    &rrec->rdata.txt_record.txt,
+                                                    &r->data.txt);
+                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                        return WERR_NOMEM;
+                }
+
+                break;
+        default:
+                DEBUG(0, ("Got a qytpe of %d\n", rrec->rr_type));
+                return DNS_ERR(NOT_IMPLEMENTED);
+        }
+
+done:
+
+        return WERR_OK;
+}
+
+
+static WERROR handle_one_update(struct dns_server *dns,
+                                TALLOC_CTX *mem_ctx,
+                                const struct dns_name_question *zone,
+                                const struct dns_res_rec *update,
+                                const struct dns_server_tkey *tkey)
+{
+        struct dnsp_DnssrvRpcRecord *recs = NULL;
+        uint16_t rcount = 0;
+        struct ldb_dn *dn;
+        uint16_t i;
+        uint16_t first = 0;
+        WERROR werror;
+        bool tombstoned = false;
+        bool needs_add = false;
+
+        DEBUG(2, ("Looking at record: \n"));
+        if (DEBUGLVL(2)) {
+                NDR_PRINT_DEBUG(dns_res_rec, discard_const(update));
+        }
+
+        switch (update->rr_type) {
+        case DNS_QTYPE_A:
+        case DNS_QTYPE_NS:
+        case DNS_QTYPE_CNAME:
+        case DNS_QTYPE_SOA:
+        case DNS_QTYPE_PTR:
+        case DNS_QTYPE_MX:
+        case DNS_QTYPE_AAAA:
+        case DNS_QTYPE_SRV:
+        case DNS_QTYPE_TXT:
+                break;
+        default:
+                DEBUG(0, ("Can't handle updates of type %u yet\n",
+                          update->rr_type));
+                return DNS_ERR(NOT_IMPLEMENTED);
+        }
+
+        werror = dns_name2dn(dns, mem_ctx, update->name, &dn);
+        W_ERROR_NOT_OK_RETURN(werror);
+
+        werror = dns_common_lookup(dns->samdb, mem_ctx, dn,
+                                   &recs, &rcount, &tombstoned);
+        if (W_ERROR_EQUAL(werror, WERR_DNS_ERROR_NAME_DOES_NOT_EXIST)) {
+                needs_add = true;
+                werror = WERR_OK;
+        }
+        W_ERROR_NOT_OK_RETURN(werror);
+
+        if (tombstoned) {
+                /*
+                 * we need to keep the existing tombstone record
+                 * and ignore it
+                 */
+                first = rcount;
+        }
+
+        if (update->rr_class == zone->question_class) {
+                if (update->rr_type == DNS_QTYPE_CNAME) {
+                        /*
+                         * If there is a record in the directory
+                         * that's not a CNAME, ignore update
+                         */
+                        for (i = first; i < rcount; i++) {
+                                if (recs[i].wType != DNS_TYPE_CNAME) {
+                                        DEBUG(5, ("Skipping update\n"));
+                                        return WERR_OK;
+                                }
+                                break;
+                        }
+
+                        /*
+                         * There should be no entries besides one CNAME record
+                         * per name, so replace everything with the new CNAME
+                         */
+
+                        rcount = first;
+                        recs = talloc_realloc(mem_ctx, recs,
+                                        struct dnsp_DnssrvRpcRecord, rcount + 1);
+                        W_ERROR_HAVE_NO_MEMORY(recs);
+
+                        werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
+                        W_ERROR_NOT_OK_RETURN(werror);
+                        rcount += 1;
+
+                        werror = dns_replace_records(dns, mem_ctx, dn,
+                                                     needs_add, recs, rcount);
+                        W_ERROR_NOT_OK_RETURN(werror);
+
+                        return WERR_OK;
+                } else {
+                        /*
+                         * If there is a CNAME record for this name,
+                         * ignore update
+                         */
+                        for (i = first; i < rcount; i++) {
+                                if (recs[i].wType == DNS_TYPE_CNAME) {
+                                        DEBUG(5, ("Skipping update\n"));
+                                        return WERR_OK;
+                                }
+                        }
+                }
+                if (update->rr_type == DNS_QTYPE_SOA) {
+                        bool found = false;
+
+                        /*
+                         * If the zone has no SOA record?? or update's
+                         * serial number is smaller than existing SOA's,
+                         * ignore update
+                         */
+                        for (i = first; i < rcount; i++) {
+                                if (recs[i].wType == DNS_TYPE_SOA) {
+                                        uint16_t n, o;
+
+                                        n = update->rdata.soa_record.serial;
+                                        o = recs[i].data.soa.serial;
+                                        /*
+                                         * TODO: Implement RFC 1982 comparison
+                                         * logic for RFC2136
+                                         */
+                                        if (n <= o) {
+                                                DEBUG(5, ("Skipping update\n"));
+                                                return WERR_OK;
+                                        }
+                                        found = true;
+                                        break;
+                                }
+                        }
+                        if (!found) {
+                                DEBUG(5, ("Skipping update\n"));
+                                return WERR_OK;
+                        }
+
+                        werror = dns_rr_to_dnsp(mem_ctx, update, &recs[i]);
+                        W_ERROR_NOT_OK_RETURN(werror);
+
+                        for (i++; i < rcount; i++) {
+                                if (recs[i].wType != DNS_TYPE_SOA) {
+                                        continue;
+                                }
+
+                                recs[i] = (struct dnsp_DnssrvRpcRecord) {
+                                        .wType = DNS_TYPE_TOMBSTONE,
+                                };
+                        }
+
+                        werror = dns_replace_records(dns, mem_ctx, dn,
+                                                     needs_add, recs, rcount);
+                        W_ERROR_NOT_OK_RETURN(werror);
+
+                        return WERR_OK;
+                }
+
+                recs = talloc_realloc(mem_ctx, recs,
+                                struct dnsp_DnssrvRpcRecord, rcount+1);
+                W_ERROR_HAVE_NO_MEMORY(recs);
+
+                werror = dns_rr_to_dnsp(recs, update, &recs[rcount]);
+                W_ERROR_NOT_OK_RETURN(werror);
+
+                for (i = first; i < rcount; i++) {
+                        if (!dns_records_match(&recs[i], &recs[rcount])) {
+                                continue;
+                        }
+
+                        recs[i] = recs[rcount];
+
+                        werror = dns_replace_records(dns, mem_ctx, dn,
+                                                     needs_add, recs, rcount);
+                        W_ERROR_NOT_OK_RETURN(werror);
+
+                        return WERR_OK;
+                }
+
+                werror = dns_replace_records(dns, mem_ctx, dn,
+                                             needs_add, recs, rcount+1);
+                W_ERROR_NOT_OK_RETURN(werror);
+
+                return WERR_OK;
+        } else if (update->rr_class == DNS_QCLASS_ANY) {
+                if (update->rr_type == DNS_QTYPE_ALL) {
+                        if (dns_name_equal(update->name, zone->name)) {
+                                for (i = first; i < rcount; i++) {
+
+                                        if (recs[i].wType == DNS_TYPE_SOA) {
+                                                continue;
+                                        }
+
+                                        if (recs[i].wType == DNS_TYPE_NS) {
+                                                continue;
+                                        }
+
+                                        recs[i] = (struct dnsp_DnssrvRpcRecord) {
+                                                .wType = DNS_TYPE_TOMBSTONE,
+                                        };
+                                }
+
+                        } else {
+                                for (i = first; i < rcount; i++) {
+                                        recs[i] = (struct dnsp_DnssrvRpcRecord) {
+                                                .wType = DNS_TYPE_TOMBSTONE,
+                                        };
+                                }
+                        }
+
+                } else if (dns_name_equal(update->name, zone->name)) {
+
+                        if (update->rr_type == DNS_QTYPE_SOA) {
+                                return WERR_OK;
+                        }
+
+                        if (update->rr_type == DNS_QTYPE_NS) {
+                                return WERR_OK;
+                        }
+                }
+                for (i = first; i < rcount; i++) {
+                        if (recs[i].wType == (enum dns_record_type) update->rr_type) {
+                                recs[i] = (struct dnsp_DnssrvRpcRecord) {
+                                        .wType = DNS_TYPE_TOMBSTONE,
+                                };
+                        }
+                }
+
+                werror = dns_replace_records(dns, mem_ctx, dn,
+                                             needs_add, recs, rcount);
+                W_ERROR_NOT_OK_RETURN(werror);
+
+                return WERR_OK;
+        } else if (update->rr_class == DNS_QCLASS_NONE) {
+                struct dnsp_DnssrvRpcRecord *del_rec;
+
+                if (update->rr_type == DNS_QTYPE_SOA) {
+                        return WERR_OK;
+                }
+                if (update->rr_type == DNS_QTYPE_NS) {
+                        bool found = false;
+                        struct dnsp_DnssrvRpcRecord *ns_rec = talloc(mem_ctx,
+                                                struct dnsp_DnssrvRpcRecord);
+                        W_ERROR_HAVE_NO_MEMORY(ns_rec);
+
+
+                        werror = dns_rr_to_dnsp(ns_rec, update, ns_rec);
+                        W_ERROR_NOT_OK_RETURN(werror);
+
+                        for (i = first; i < rcount; i++) {
+                                if (dns_records_match(ns_rec, &recs[i])) {
+                                        found = true;
+                                        break;
+                                }
+                        }
+                        if (found) {
+                                return WERR_OK;
+                        }
+                }
+
+                del_rec = talloc(mem_ctx, struct dnsp_DnssrvRpcRecord);
+                W_ERROR_HAVE_NO_MEMORY(del_rec);
+
+                werror = dns_rr_to_dnsp(del_rec, update, del_rec);
+                W_ERROR_NOT_OK_RETURN(werror);
+
+                for (i = first; i < rcount; i++) {
+                        if (dns_records_match(del_rec, &recs[i])) {
+                                recs[i] = (struct dnsp_DnssrvRpcRecord) {
+                                        .wType = DNS_TYPE_TOMBSTONE,
+                                };
+                        }
+                }
+
+                werror = dns_replace_records(dns, mem_ctx, dn,
+                                             needs_add, recs, rcount);
+                W_ERROR_NOT_OK_RETURN(werror);
+        }
+
+        return WERR_OK;
+}
+
+static WERROR handle_updates(struct dns_server *dns,
+                             TALLOC_CTX *mem_ctx,
+                             const struct dns_name_question *zone,
+                             const struct dns_res_rec *prereqs, uint16_t pcount,
+                             struct dns_res_rec *updates, uint16_t upd_count,
+                             struct dns_server_tkey *tkey)
+{
+        struct ldb_dn *zone_dn = NULL;
+        WERROR werror = WERR_OK;
+        int ret;
+        uint16_t ri;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+        if (tkey != NULL) {
+                ret = ldb_set_opaque(dns->samdb, "sessionInfo", tkey->session_info);
+                if (ret != LDB_SUCCESS) {
+                        DEBUG(1, ("unable to set session info\n"));
+                        werror = DNS_ERR(SERVER_FAILURE);
+                        goto failed;
+                }
+        }
+
+        werror = dns_name2dn(dns, tmp_ctx, zone->name, &zone_dn);
+        W_ERROR_NOT_OK_GOTO(werror, failed);
+
+        ret = ldb_transaction_start(dns->samdb);
+        if (ret != LDB_SUCCESS) {
+                werror = DNS_ERR(SERVER_FAILURE);
+                goto failed;
+        }
+
+        werror = check_prerequisites(dns, tmp_ctx, zone, prereqs, pcount);
+        W_ERROR_NOT_OK_GOTO(werror, failed);
+
+        DEBUG(1, ("update count is %u\n", upd_count));
+
+        for (ri = 0; ri < upd_count; ri++) {
+                werror = handle_one_update(dns, tmp_ctx, zone,
+                                           &updates[ri], tkey);
+                W_ERROR_NOT_OK_GOTO(werror, failed);
+        }
+
+        ldb_transaction_commit(dns->samdb);
+        TALLOC_FREE(tmp_ctx);
+
+        if (tkey != NULL) {
+                ldb_set_opaque(dns->samdb, "sessionInfo",
+                               system_session(dns->task->lp_ctx));
+        }
+
+        return WERR_OK;
+
+failed:
+        ldb_transaction_cancel(dns->samdb);
+
+        if (tkey != NULL) {
+                ldb_set_opaque(dns->samdb, "sessionInfo",
+                               system_session(dns->task->lp_ctx));
+        }
+
+        TALLOC_FREE(tmp_ctx);
+        return werror;
+
+}
+
+static WERROR dns_update_allowed(struct dns_server *dns,
+                                 const struct dns_request_state *state,
+                                 struct dns_server_tkey **tkey)
+{
+        if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_ON) {
+                DEBUG(2, ("All updates allowed.\n"));
+                return WERR_OK;
+        }
+
+        if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
+                DEBUG(2, ("Updates disabled.\n"));
+                return DNS_ERR(REFUSED);
+        }
+
+        if (state->authenticated == false ) {
+                DEBUG(2, ("Update not allowed for unsigned packet.\n"));
+                return DNS_ERR(REFUSED);
+        }
+
+        *tkey = dns_find_tkey(dns->tkeys, state->key_name);
+        if (*tkey == NULL) {
+                DEBUG(0, ("Authenticated, but key not found. Something is wrong.\n"));
+                return DNS_ERR(REFUSED);
+        }
+
+        return WERR_OK;
+}
+
+
 WERROR dns_server_process_update(struct dns_server *dns,
+                                 const struct dns_request_state *state,
                                  TALLOC_CTX *mem_ctx,
-                                 struct dns_name_packet *in,
-                                 const struct dns_res_rec *prereqs, uint16_t prereq_count,
-                                 struct dns_res_rec **updates,      uint16_t *update_count,
-                                 struct dns_res_rec **additional,   uint16_t *arcount)
+                                 const struct dns_name_packet *in,
+                                 struct dns_res_rec **prereqs,    uint16_t *prereq_count,
+                                 struct dns_res_rec **updates,    uint16_t *update_count,
+                                 struct dns_res_rec **additional, uint16_t *arcount)
 {
         struct dns_name_question *zone;
@@ -135 +754 @@
         size_t host_part_len = 0;
         WERROR werror = DNS_ERR(NOT_IMPLEMENTED);
-        bool update_allowed = false;
+        struct dns_server_tkey *tkey = NULL;
 
         if (in->qdcount != 1) {
@@ -141 +760 @@
         }
 
-        zone = in->questions;
+        zone = &in->questions[0];
+
+        if (zone->question_class != DNS_QCLASS_IN &&
+            zone->question_class != DNS_QCLASS_ANY) {
+                return DNS_ERR(NOT_IMPLEMENTED);
+        }
 
         if (zone->question_type != DNS_QTYPE_SOA) {
@@ -147 +771 @@
         }
 
-        DEBUG(0, ("Got a dns update request.\n"));
+        DEBUG(2, ("Got a dns update request.\n"));
 
         for (z = dns->zones; z != NULL; z = z->next) {
@@ -159 +783 @@
 
         if (z == NULL) {
+                DEBUG(1, ("We're not authoritative for this zone\n"));
                 return DNS_ERR(NOTAUTH);
         }
@@ -164 +789 @@
         if (host_part_len != 0) {
                 /* TODO: We need to delegate this one */
+                DEBUG(1, ("Would have to delegate zone '%s'.\n", zone->name));
                 return DNS_ERR(NOT_IMPLEMENTED);
         }
 
-        werror = check_prerequsites(dns, mem_ctx, in, prereqs, prereq_count);
+        *prereq_count = in->ancount;
+        *prereqs = in->answers;
+        werror = check_prerequisites(dns, mem_ctx, in->questions, *prereqs,
+                                     *prereq_count);
         W_ERROR_NOT_OK_RETURN(werror);
 
-        /* TODO: Check if update is allowed, we probably want "always",
-         * key-based GSSAPI, key-based bind-style TSIG and "never" as
-         * smb.conf options. */
-        if (!update_allowed) {
-                return DNS_ERR(REFUSED);
-        }
-
+        werror = dns_update_allowed(dns, state, &tkey);
+        if (!W_ERROR_IS_OK(werror)) {
+                return werror;
+        }
+
+        *update_count = in->nscount;
+        *updates = in->nsrecs;
         werror = update_prescan(in->questions, *updates, *update_count);
         W_ERROR_NOT_OK_RETURN(werror);
 
+        werror = handle_updates(dns, mem_ctx, in->questions, *prereqs,
+                                *prereq_count, *updates, *update_count, tkey);
+        W_ERROR_NOT_OK_RETURN(werror);
+
         return werror;
 }

vendor/current/source4/dns_server/dns_utils.c

@@ -31 +31 @@
 #include "dns_server/dns_server.h"
 
-uint8_t werr_to_dns_err(WERROR werr)
-{
-        if (W_ERROR_EQUAL(WERR_OK, werr)) {
-                return DNS_RCODE_OK;
-        } else if (W_ERROR_EQUAL(DNS_ERR(FORMAT_ERROR), werr)) {
-                return DNS_RCODE_FORMERR;
-        } else if (W_ERROR_EQUAL(DNS_ERR(SERVER_FAILURE), werr)) {
-                return DNS_RCODE_SERVFAIL;
-        } else if (W_ERROR_EQUAL(DNS_ERR(NAME_ERROR), werr)) {
-                return DNS_RCODE_NXDOMAIN;
-        } else if (W_ERROR_EQUAL(DNS_ERR(NOT_IMPLEMENTED), werr)) {
-                return DNS_RCODE_NOTIMP;
-        } else if (W_ERROR_EQUAL(DNS_ERR(REFUSED), werr)) {
-                return DNS_RCODE_REFUSED;
-        } else if (W_ERROR_EQUAL(DNS_ERR(YXDOMAIN), werr)) {
-                return DNS_RCODE_YXDOMAIN;
-        } else if (W_ERROR_EQUAL(DNS_ERR(YXRRSET), werr)) {
-                return DNS_RCODE_YXRRSET;
-        } else if (W_ERROR_EQUAL(DNS_ERR(NXRRSET), werr)) {
-                return DNS_RCODE_NXRRSET;
-        } else if (W_ERROR_EQUAL(DNS_ERR(NOTAUTH), werr)) {
-                return DNS_RCODE_NOTAUTH;
-        } else if (W_ERROR_EQUAL(DNS_ERR(NOTZONE), werr)) {
-                return DNS_RCODE_NOTZONE;
-        }
-        DEBUG(5, ("No mapping exists for %%s\n"));
-        return DNS_RCODE_SERVFAIL;
-}
-
-bool dns_name_match(const char *zone, const char *name, size_t *host_part_len)
-{
-        size_t zl = strlen(zone);
-        size_t nl = strlen(name);
-        ssize_t zi, ni;
-        static const size_t fixup = 'a' - 'A';
-
-        if (zl > nl) {
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_DNS
+
+/* Names are equal if they match and there's nothing left over */
+bool dns_name_equal(const char *name1, const char *name2)
+{
+        size_t host_part_len;
+        bool ret = dns_name_match(name1, name2, &host_part_len);
+
+        return ret && (host_part_len == 0);
+}
+
+/*
+  see if two dns records match
+ */
+bool dns_records_match(struct dnsp_DnssrvRpcRecord *rec1,
+                       struct dnsp_DnssrvRpcRecord *rec2)
+{
+        bool status;
+        int i;
+
+        if (rec1->wType != rec2->wType) {
                 return false;
         }
 
-        for (zi = zl, ni = nl; zi >= 0; zi--, ni--) {
-                char zc = zone[zi];
-                char nc = name[ni];
-
-                /* convert to lower case */
-                if (zc >= 'A' && zc <= 'Z') {
-                        zc += fixup;
-                }
-                if (nc >= 'A' && nc <= 'Z') {
-                        nc += fixup;
-                }
-
-                if (zc != nc) {
+        /* see if the data matches */
+        switch (rec1->wType) {
+        case DNS_TYPE_A:
+                return strcmp(rec1->data.ipv4, rec2->data.ipv4) == 0;
+        case DNS_TYPE_AAAA:
+                return strcmp(rec1->data.ipv6, rec2->data.ipv6) == 0;
+        case DNS_TYPE_CNAME:
+                return dns_name_equal(rec1->data.cname, rec2->data.cname);
+        case DNS_TYPE_TXT:
+                if (rec1->data.txt.count != rec2->data.txt.count) {
                         return false;
                 }
-        }
-
-        if (ni >= 0) {
-                if (name[ni] != '.') {
-                        return false;
-                }
-
-                ni--;
-        }
-
-        *host_part_len = ni+1;
+                status = true;
+                for (i=0; i<rec1->data.txt.count; i++) {
+                        status = status && (strcmp(rec1->data.txt.str[i],
+                                                rec2->data.txt.str[i]) == 0);
+                }
+                return status;
+        case DNS_TYPE_PTR:
+                return strcmp(rec1->data.ptr, rec2->data.ptr) == 0;
+        case DNS_TYPE_NS:
+                return dns_name_equal(rec1->data.ns, rec2->data.ns);
+
+        case DNS_TYPE_SRV:
+                return rec1->data.srv.wPriority == rec2->data.srv.wPriority &&
+                        rec1->data.srv.wWeight  == rec2->data.srv.wWeight &&
+                        rec1->data.srv.wPort    == rec2->data.srv.wPort &&
+                        dns_name_equal(rec1->data.srv.nameTarget, rec2->data.srv.nameTarget);
+
+        case DNS_TYPE_MX:
+                return rec1->data.mx.wPriority == rec2->data.mx.wPriority &&
+                        dns_name_equal(rec1->data.mx.nameTarget, rec2->data.mx.nameTarget);
+
+        case DNS_TYPE_HINFO:
+                return strcmp(rec1->data.hinfo.cpu, rec2->data.hinfo.cpu) == 0 &&
+                        strcmp(rec1->data.hinfo.os, rec2->data.hinfo.os) == 0;
+
+        case DNS_TYPE_SOA:
+                return dns_name_equal(rec1->data.soa.mname, rec2->data.soa.mname) &&
+                        dns_name_equal(rec1->data.soa.rname, rec2->data.soa.rname) &&
+                        rec1->data.soa.serial == rec2->data.soa.serial &&
+                        rec1->data.soa.refresh == rec2->data.soa.refresh &&
+                        rec1->data.soa.retry == rec2->data.soa.retry &&
+                        rec1->data.soa.expire == rec2->data.soa.expire &&
+                        rec1->data.soa.minimum == rec2->data.soa.minimum;
+        default:
+                break;
+        }
+
+        return false;
+}
+
+WERROR dns_lookup_records(struct dns_server *dns,
+                          TALLOC_CTX *mem_ctx,
+                          struct ldb_dn *dn,
+                          struct dnsp_DnssrvRpcRecord **records,
+                          uint16_t *rec_count)
+{
+        return dns_common_lookup(dns->samdb, mem_ctx, dn,
+                                 records, rec_count, NULL);
+}
+
+WERROR dns_replace_records(struct dns_server *dns,
+                           TALLOC_CTX *mem_ctx,
+                           struct ldb_dn *dn,
+                           bool needs_add,
+                           struct dnsp_DnssrvRpcRecord *records,
+                           uint16_t rec_count)
+{
+        /* TODO: Autogenerate this somehow */
+        uint32_t dwSerial = 110;
+        return dns_common_replace(dns->samdb, mem_ctx, dn,
+                                  needs_add, dwSerial, records, rec_count);
+}
+
+bool dns_authorative_for_zone(struct dns_server *dns,
+                              const char *name)
+{
+        const struct dns_server_zone *z;
+        size_t host_part_len = 0;
+
+        if (name == NULL) {
+                return false;
+        }
+
+        if (strcmp(name, "") == 0) {
+                return true;
+        }
+        for (z = dns->zones; z != NULL; z = z->next) {
+                bool match;
+
+                match = dns_name_match(z->name, name, &host_part_len);
+                if (match) {
+                        break;
+                }
+        }
+        if (z == NULL) {
+                return false;
+        }
 
         return true;
+}
+
+const char *dns_get_authoritative_zone(struct dns_server *dns,
+                                       const char *name)
+{
+        const struct dns_server_zone *z;
+        size_t host_part_len = 0;
+
+        for (z = dns->zones; z != NULL; z = z->next) {
+                bool match;
+                match = dns_name_match(z->name, name, &host_part_len);
+                if (match) {
+                        return z->name;
+                }
+        }
+        return NULL;
 }
 
@@ -104 +178 @@
                    TALLOC_CTX *mem_ctx,
                    const char *name,
-                   struct ldb_dn **_dn)
-{
-        struct ldb_dn *base;
-        struct ldb_dn *dn;
-        const struct dns_server_zone *z;
-        size_t host_part_len = 0;
-
-        if (name == NULL) {
-                return DNS_ERR(FORMAT_ERROR);
-        }
-
-        /*TODO: Check if 'name' is a valid DNS name */
-
-        if (strcmp(name, "") == 0) {
-                base = ldb_get_default_basedn(dns->samdb);
-                dn = ldb_dn_copy(mem_ctx, base);
-                ldb_dn_add_child_fmt(dn, "DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=System");
-                *_dn = dn;
-                return WERR_OK;
-        }
-
-        for (z = dns->zones; z != NULL; z = z->next) {
-                bool match;
-
-                match = dns_name_match(z->name, name, &host_part_len);
-                if (match) {
-                        break;
-                }
-        }
-
-        if (z == NULL) {
-                return DNS_ERR(NAME_ERROR);
-        }
-
-        if (host_part_len == 0) {
-                dn = ldb_dn_copy(mem_ctx, z->dn);
-                ldb_dn_add_child_fmt(dn, "DC=@");
-                *_dn = dn;
-                return WERR_OK;
-        }
-
-        dn = ldb_dn_copy(mem_ctx, z->dn);
-        ldb_dn_add_child_fmt(dn, "DC=%*.*s", (int)host_part_len, (int)host_part_len, name);
-        *_dn = dn;
+                   struct ldb_dn **dn)
+{
+        return dns_common_name2dn(dns->samdb, dns->zones,
+                                  mem_ctx, name, dn);
+}
+
+WERROR dns_generate_options(struct dns_server *dns,
+                            TALLOC_CTX *mem_ctx,
+                            struct dns_res_rec **options)
+{
+        struct dns_res_rec *o;
+
+        o = talloc_zero(mem_ctx, struct dns_res_rec);
+        if (o == NULL) {
+                return WERR_NOMEM;
+        }
+        o->name = NULL;
+        o->rr_type = DNS_QTYPE_OPT;
+        /* This is ugly, but RFC2671 wants the payload size in this field */
+        o->rr_class = (enum dns_qclass) dns->max_payload;
+        o->ttl = 0;
+        o->length = 0;
+
+        *options = o;
         return WERR_OK;
 }

vendor/current/source4/dns_server/wscript_build

@@ -1 +1 @@
 #!/usr/bin/env python
 
+bld.SAMBA_LIBRARY('dnsserver_common',
+        source='dnsserver_common.c',
+        deps='samba-util samba-errors ldbsamba clidns',
+        private_library=True,
+        enabled=bld.AD_DC_BUILD_IS_ENABLED())
+
 bld.SAMBA_MODULE('service_dns',
-        source='dns_server.c dns_query.c dns_update.c dns_utils.c',
+        source='dns_server.c dns_query.c dns_update.c dns_utils.c dns_crypto.c',
         subsystem='service',
         init_function='server_service_dns_init',
-        deps='samba-hostconfig LIBTSOCKET LIBSAMBA_TSOCKET ldbsamba',
+        deps='samba-hostconfig LIBTSOCKET LIBSAMBA_TSOCKET ldbsamba clidns gensec auth samba_server_gensec dnsserver_common',
         local_include=False,
         internal_module=False,
+        enabled=bld.AD_DC_BUILD_IS_ENABLED()
         )
 
@@ -13 +20 @@
 bld.SAMBA_LIBRARY('dlz_bind9',
                   source='dlz_bind9.c',
+                  cflags='-DBIND_VERSION_9_8',
                   private_library=True,
                   link_name='modules/bind9/dlz_bind9.so',
-                  deps='samba-hostconfig ldbsamba samba-util popt')
+                  realname='dlz_bind9.so',
+                  install_path='${MODULESDIR}/bind9',
+                  deps='samba-hostconfig samdb-common gensec popt dnsserver_common',
+                  enabled=bld.AD_DC_BUILD_IS_ENABLED())
+
+bld.SAMBA_LIBRARY('dlz_bind9_9',
+                  source='dlz_bind9.c',
+                  cflags='-DBIND_VERSION_9_9',
+                  private_library=True,
+                  link_name='modules/bind9/dlz_bind9_9.so',
+                  realname='dlz_bind9_9.so',
+                  install_path='${MODULESDIR}/bind9',
+                  deps='samba-hostconfig samdb-common gensec popt dnsserver_common',
+                  enabled=bld.AD_DC_BUILD_IS_ENABLED())
+
+bld.SAMBA_LIBRARY('dlz_bind9_10',
+                  source='dlz_bind9.c',
+                  cflags='-DBIND_VERSION_9_10',
+                  private_library=True,
+                  link_name='modules/bind9/dlz_bind9_10.so',
+                  realname='dlz_bind9_10.so',
+                  install_path='${MODULESDIR}/bind9',
+                  deps='samba-hostconfig samdb-common gensec popt dnsserver_common',
+                  enabled=bld.AD_DC_BUILD_IS_ENABLED())
+
+bld.SAMBA_LIBRARY('dlz_bind9_for_torture',
+                  source='dlz_bind9.c',
+                  cflags='-DBIND_VERSION_9_8',
+                  private_library=True,
+                  deps='samba-hostconfig samdb-common gensec popt dnsserver_common',
+                  enabled=bld.AD_DC_BUILD_IS_ENABLED())
+
+
+bld.SAMBA_PYTHON('python_dsdb_dns',
+                 source='pydns.c',
+                 deps='samdb pyldb-util pyrpc_util dnsserver_common pytalloc-util',
+                 realname='samba/dsdb_dns.so')