From: Kai Blin <kai@samba.org>
Date: Tue, 4 Sep 2012 23:27:00 +0000 (+0200)
Subject: s4 dns: Allow configuring signed updates
X-Git-Tag: samba-4.0.0rc1~222
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2311a2c9f5fdcb6f8336dbdb972963a35890a200;p=thirdparty%2Fsamba.git

s4 dns: Allow configuring signed updates

Autobuild-User(master): Kai Blin <kai@samba.org>
Autobuild-Date(master): Wed Sep  5 10:45:22 CEST 2012 on sn-devel-104
---

diff --git a/source4/dns_server/dns_update.c b/source4/dns_server/dns_update.c
index e7514acace0..61850a10564 100644
--- a/source4/dns_server/dns_update.c
+++ b/source4/dns_server/dns_update.c
@@ -734,10 +734,15 @@ WERROR dns_server_process_update(struct dns_server *dns,
 	/* TODO: Check if update is allowed, we probably want "always",
 	 * key-based GSSAPI, key-based bind-style TSIG and "never" as
 	 * smb.conf options. */
-	if (lpcfg_allow_dns_updates(dns->task->lp_ctx) != DNS_UPDATE_ON) {
+	if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_OFF) {
 		DEBUG(0, ("Update not allowed.\n"));
 		return DNS_ERR(REFUSED);
 	}
+	if (lpcfg_allow_dns_updates(dns->task->lp_ctx) == DNS_UPDATE_SIGNED &&
+	    state->authenticated == false ) {
+		DEBUG(0, ("Update not allowed for unsigned packet.\n"));
+		return DNS_ERR(REFUSED);
+	}
 
 	*update_count = in->nscount;
 	*updates = in->nsrecs;