samba-mirror/source4/torture/dns/dlz_bind9.c

/*
   Unix SMB/CIFS implementation.
   SMB torture tester
   Copyright (C) Andrew Bartlett 2012

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "includes.h"
#include "torture/smbtorture.h"
#include "system/network.h"
#include "dns_server/dlz_minimal.h"
#include <talloc.h>
#include <ldb.h>
#include "lib/param/param.h"
#include "dsdb/samdb/samdb.h"
#include "dsdb/common/util.h"
#include "auth/session.h"
#include "auth/gensec/gensec.h"
#include "auth/credentials/credentials.h"
#include "lib/cmdline/cmdline.h"
#include "system/network.h"
#include "dns_server/dnsserver_common.h"
#include "librpc/gen_ndr/ndr_dnsserver.h"
#include "librpc/gen_ndr/ndr_dnsserver_c.h"
#include "torture/rpc/torture_rpc.h"
#include "librpc/gen_ndr/ndr_dnsp.h"

#include "librpc/rpc/dcerpc.h"
#include "librpc/rpc/dcerpc_proto.h"

/* Tests that configure multiple DLZs will use this. Increase to add stress. */
#define NUM_DLZS_TO_CONFIGURE 4

struct torture_context *tctx_static;

static void dlz_bind9_log_wrapper(int level, const char *fmt, ...)
				  PRINTF_ATTRIBUTE(2,3);

static void dlz_bind9_log_wrapper(int level, const char *fmt, ...)
{
	va_list ap;
	char *msg;
	va_start(ap, fmt);
	msg = talloc_vasprintf(NULL, fmt, ap);
	torture_comment(tctx_static, "%s\n", msg);
	TALLOC_FREE(msg);
	va_end(ap);
}

static bool test_dlz_bind9_version(struct torture_context *tctx)
{
	unsigned int flags = 0;
	torture_assert_int_equal(tctx, dlz_version(&flags),
				 DLZ_DLOPEN_VERSION, "got wrong DLZ version");
	return true;
}

static char *dlz_bind9_binddns_dir(struct torture_context *tctx,
				   const char *file)
{
	return talloc_asprintf(tctx,
			       "ldb://%s/%s",
			       lpcfg_binddns_dir(tctx->lp_ctx),
			       file);
}

static bool test_dlz_bind9_create(struct torture_context *tctx)
{
	void *dbdata;
	const char *argv[] = {
		"samba_dlz",
		"-H",
		dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
		NULL
	};
	tctx_static = tctx;
	torture_assert_int_equal(tctx, dlz_create("samba_dlz", 3, argv, &dbdata,
						  "log", dlz_bind9_log_wrapper, NULL), ISC_R_SUCCESS,
		"Failed to create samba_dlz");

	dlz_destroy(dbdata);

	return true;
}

static bool calls_zone_hook = false;

static isc_result_t dlz_bind9_writeable_zone_hook(dns_view_t *view,
						  dns_dlzdb_t *dlzdb,
						  const char *zone_name)
{
	struct torture_context *tctx = talloc_get_type((void *)view, struct torture_context);
	struct ldb_context *samdb = NULL;
	char *errstring = NULL;
	int ret = samdb_connect_url(
			tctx,
			NULL,
			tctx->lp_ctx,
			system_session(tctx->lp_ctx),
			0,
			dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
			NULL,
			&samdb,
			&errstring);
	struct ldb_message *msg;
	const char *attrs[] = {
		NULL
	};
	if (ret != LDB_SUCCESS) {
		torture_comment(tctx, "Failed to connect to samdb");
		return ISC_R_FAILURE;
	}

	ret = dsdb_search_one(samdb, tctx, &msg, NULL,
			      LDB_SCOPE_SUBTREE, attrs, DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
			      "(&(objectClass=dnsZone)(name=%s))", zone_name);
	if (ret != LDB_SUCCESS) {
		torture_comment(tctx,
				"Failed to search for %s: %s",
				zone_name,
				ldb_errstring(samdb));
		return ISC_R_FAILURE;
	}
	talloc_free(msg);

	calls_zone_hook = true;

	return ISC_R_SUCCESS;
}

static bool test_dlz_bind9_configure(struct torture_context *tctx)
{
	void *dbdata = NULL;
	dns_dlzdb_t *dlzdb = NULL;
	int ret;
	const char *argv[] = {
		"samba_dlz",
		"-H",
		dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
		NULL
	};
	tctx_static = tctx;
	ret = dlz_create("samba_dlz", 3, argv, &dbdata,
			 "log", dlz_bind9_log_wrapper,
			 "writeable_zone", dlz_bind9_writeable_zone_hook,
			 NULL);
	torture_assert_int_equal(tctx,
				 ret,
				 ISC_R_SUCCESS,
				 "Failed to create samba_dlz");

	calls_zone_hook = false;
	torture_assert_int_equal(tctx, dlz_configure((void*)tctx,
						     dlzdb,
						     dbdata),
						     ISC_R_SUCCESS,
				 "Failed to configure samba_dlz");

	dlz_destroy(dbdata);

	torture_assert_int_equal(tctx, calls_zone_hook, 1, "Hasn't called zone hook");

	return true;
}

static bool test_dlz_bind9_multiple_configure(struct torture_context *tctx)
{
	int i;
	for(i = 0; i < NUM_DLZS_TO_CONFIGURE; i++){
		test_dlz_bind9_configure(tctx);
	}
	return true;
}

static bool configure_multiple_dlzs(struct torture_context *tctx,
				    void **dbdata, int count)
{
	int i, res;
	dns_dlzdb_t *dlzdb = NULL;
	const char *argv[] = {
		"samba_dlz",
		"-H",
		dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
		NULL
	};

	tctx_static = tctx;
	for(i = 0; i < count; i++){
		res = dlz_create("samba_dlz", 3, argv, &(dbdata[i]),
				 "log", dlz_bind9_log_wrapper,
				 "writeable_zone",
				 dlz_bind9_writeable_zone_hook, NULL);
		torture_assert_int_equal(tctx, res, ISC_R_SUCCESS,
					 "Failed to create samba_dlz");

		res = dlz_configure((void*)tctx, dlzdb, dbdata[i]);
		torture_assert_int_equal(tctx, res, ISC_R_SUCCESS,
					 "Failed to configure samba_dlz");
	}

	return true;
}

static bool test_dlz_bind9_destroy_oldest_first(struct torture_context *tctx)
{
	void *dbdata[NUM_DLZS_TO_CONFIGURE];
	int i;
	bool ret = configure_multiple_dlzs(tctx,
					   dbdata,
					   NUM_DLZS_TO_CONFIGURE);
	if (ret == false) {
		/* failure: has already been printed */
		return false;
	}

	/* Reload faults are reported to happen on the first destroy */
	dlz_destroy(dbdata[0]);

	for(i = 1; i < NUM_DLZS_TO_CONFIGURE; i++){
		dlz_destroy(dbdata[i]);
	}

	return true;
}

static bool test_dlz_bind9_destroy_newest_first(struct torture_context *tctx)
{
	void *dbdata[NUM_DLZS_TO_CONFIGURE];
	int i;
	bool ret = configure_multiple_dlzs(tctx,
					   dbdata,
					   NUM_DLZS_TO_CONFIGURE);
	if (ret == false) {
		/* failure: has already been printed */
		return false;
	}

	for(i = NUM_DLZS_TO_CONFIGURE - 1; i >= 0; i--) {
		dlz_destroy(dbdata[i]);
	}

	return true;
}

/*
 * Test that a ticket obtained for the DNS service will be accepted on the Samba DLZ side
 *
 */
static bool test_dlz_bind9_gensec(struct torture_context *tctx, const char *mech)
{
	NTSTATUS status;
	dns_dlzdb_t *dlzdb = NULL;

	struct gensec_security *gensec_client_context;

	DATA_BLOB client_to_server, server_to_client;

	void *dbdata;
	const char *argv[] = {
		"samba_dlz",
		"-H",
		dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
		NULL
	};
	tctx_static = tctx;
	torture_assert_int_equal(tctx, dlz_create("samba_dlz", 3, argv, &dbdata,
						  "log", dlz_bind9_log_wrapper,
						  "writeable_zone", dlz_bind9_writeable_zone_hook, NULL),
				 ISC_R_SUCCESS,
				 "Failed to create samba_dlz");

	torture_assert_int_equal(tctx, dlz_configure((void*)tctx,
						     dlzdb, dbdata),
						     ISC_R_SUCCESS,
				 "Failed to configure samba_dlz");

	status = gensec_client_start(tctx, &gensec_client_context,
				     lpcfg_gensec_settings(tctx, tctx->lp_ctx));
	torture_assert_ntstatus_ok(tctx, status, "gensec_client_start (client) failed");

	/*
	 * dlz_bind9 use the special dns/host.domain account
	 */
	status = gensec_set_target_hostname(gensec_client_context,
					    talloc_asprintf(tctx,
				"%s.%s",
				torture_setting_string(tctx, "host", NULL),
				lpcfg_dnsdomain(tctx->lp_ctx)));
	torture_assert_ntstatus_ok(tctx, status, "gensec_set_target_hostname (client) failed");

	status = gensec_set_target_service(gensec_client_context, "dns");
	torture_assert_ntstatus_ok(tctx, status, "gensec_set_target_service failed");

	status = gensec_set_credentials(gensec_client_context,
			samba_cmdline_get_creds());
	torture_assert_ntstatus_ok(tctx, status, "gensec_set_credentials (client) failed");

	status = gensec_start_mech_by_sasl_name(gensec_client_context, mech);
	torture_assert_ntstatus_ok(tctx, status, "gensec_start_mech_by_sasl_name (client) failed");

	server_to_client = data_blob(NULL, 0);

	/* Do one step of the client-server update dance */
	status = gensec_update(gensec_client_context, tctx, server_to_client, &client_to_server);
	if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {;
		torture_assert_ntstatus_ok(tctx, status, "gensec_update (client) failed");
	}

	torture_assert_int_equal(tctx, dlz_ssumatch(
					cli_credentials_get_username(
						samba_cmdline_get_creds()),
					lpcfg_dnsdomain(tctx->lp_ctx),
					"127.0.0.1", "type", "key",
					client_to_server.length,
					client_to_server.data,
					dbdata),
					ISC_TRUE,
			 "Failed to check key for update rights samba_dlz");

	dlz_destroy(dbdata);

	return true;
}

static bool test_dlz_bind9_gssapi(struct torture_context *tctx)
{
	return test_dlz_bind9_gensec(tctx, "GSSAPI");
}

static bool test_dlz_bind9_spnego(struct torture_context *tctx)
{
	return test_dlz_bind9_gensec(tctx, "GSS-SPNEGO");
}

struct test_expected_record {
	const char *name;
	const char *type;
	const char *data;
	int ttl;
	bool printed;
	const char *rdata;
};

struct test_expected_rr {
	struct torture_context *tctx;
	const char *query_name;
	size_t num_records;
	struct test_expected_record *records;
	size_t num_rr;
};

static bool dlz_bind9_putnamedrr_torture_hook(struct test_expected_rr *expected,
					      const char *name,
					      const char *type,
					      dns_ttl_t ttl,
					      const char *data)
{
	size_t i;

	torture_assert(expected->tctx, name != NULL,
		       talloc_asprintf(expected->tctx,
		       "Got unnamed record type[%s] data[%s]\n",
		       type, data));

	expected->num_rr++;
	torture_comment(expected->tctx, "%u: name[%s] type[%s] ttl[%u] data[%s]\n",
			(unsigned)expected->num_rr, name, type, (unsigned)ttl, data);

	for (i = 0; i < expected->num_records; i++) {
		if (expected->records[i].name != NULL) {
			if (strcmp(name, expected->records[i].name) != 0) {
				continue;
			}
		}

		if (strcmp(type, expected->records[i].type) != 0) {
			continue;
		}

		if (expected->records[i].data != NULL) {
			/*
			 * For most types the data will have been reformatted
			 * or normalised, so we need to do approximately the
			 * same to compare.
			 */
			const char *data2 = expected->records[i].data;
			if (strcmp(type, "aaaa") == 0) {
				struct in6_addr adr1;
				struct in6_addr adr2;
				int ret;
				ret = inet_pton(AF_INET6, data, &adr1);
				if (ret != 1) {
					continue;
				}
				ret = inet_pton(AF_INET6, data2, &adr2);
				if (ret != 1) {
					continue;
				}
				if (memcmp(&adr1, &adr2, sizeof(adr1)) != 0) {
					continue;
				}
			} else if (strcmp(type, "cname") == 0 ||
				 strcmp(type, "ptr") == 0   ||
				 strcmp(type, "ns") == 0) {
				if (!samba_dns_name_equal(data, data2)) {
					continue;
				}
			} else if (strcmp(type, "mx") == 0) {
				/*
				 * samba_dns_name_equal works for MX records
				 * because the space in "10 example.com." is
				 * theoretically OK as a DNS character. And we
				 * need it because dlz will add the trailing
				 * dot.
				 */
				if (!samba_dns_name_equal(data, data2)) {
					continue;
				}
			} else if (strcmp(data, data2) != 0) {
				/* default, works for A records */
				continue;
			}
		}

		torture_assert_int_equal(expected->tctx, ttl,
					 expected->records[i].ttl,
					 talloc_asprintf(expected->tctx,
					 "TTL did not match expectations for type %s",
					 type));

		expected->records[i].printed = true;
	}

	return true;
}

/*
 * Lookups in these tests end up coming round to run this function.
 */
static isc_result_t dlz_bind9_putrr_hook(dns_sdlzlookup_t *lookup,
					 const char *type,
					 dns_ttl_t ttl,
					 const char *data)
{
	struct test_expected_rr *expected =
		talloc_get_type_abort(lookup, struct test_expected_rr);
	bool ok;

	ok = dlz_bind9_putnamedrr_torture_hook(expected, expected->query_name,
					       type, ttl, data);
	if (!ok) {
		return ISC_R_FAILURE;
	}

	return ISC_R_SUCCESS;
}

static isc_result_t dlz_bind9_putnamedrr_hook(dns_sdlzallnodes_t *allnodes,
					      const char *name,
					      const char *type,
					      dns_ttl_t ttl,
					      const char *data)
{
	struct test_expected_rr *expected =
		talloc_get_type_abort(allnodes, struct test_expected_rr);
	bool ok;

	ok = dlz_bind9_putnamedrr_torture_hook(expected, name, type, ttl, data);
	if (!ok) {
		return ISC_R_FAILURE;
	}

	return ISC_R_SUCCESS;
}

/*
 * Tests some lookups
 */
static bool test_dlz_bind9_lookup(struct torture_context *tctx)
{
	size_t i;
	void *dbdata = NULL;
	dns_clientinfomethods_t *methods = NULL;
	dns_clientinfo_t *clientinfo = NULL;
	dns_dlzdb_t *dlzdb = NULL;
	const char *argv[] = {
		"samba_dlz",
		"-H",
		dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
		NULL
	};
	struct test_expected_rr *expected1 = NULL;
	struct test_expected_rr *expected2 = NULL;

	tctx_static = tctx;
	torture_assert_int_equal(tctx, dlz_create("samba_dlz", 3, argv, &dbdata,
						  "log", dlz_bind9_log_wrapper,
						  "writeable_zone", dlz_bind9_writeable_zone_hook,
						  "putrr", dlz_bind9_putrr_hook,
						  "putnamedrr", dlz_bind9_putnamedrr_hook,
						  NULL),
				 ISC_R_SUCCESS,
				 "Failed to create samba_dlz");

	torture_assert_int_equal(tctx,
				 dlz_configure((void*)tctx, dlzdb, dbdata),
				 ISC_R_SUCCESS,
				 "Failed to configure samba_dlz");

	expected1 = talloc_zero(tctx, struct test_expected_rr);
	torture_assert(tctx, expected1 != NULL, "talloc failed");
	expected1->tctx = tctx;

	expected1->query_name = "@";

	expected1->num_records = 4;
	expected1->records = talloc_zero_array(expected1,
					       struct test_expected_record,
					       expected1->num_records);
	torture_assert(tctx, expected1->records != NULL, "talloc failed");

	expected1->records[0].name = expected1->query_name;
	expected1->records[0].type = "soa";
	expected1->records[0].ttl = 3600;
	expected1->records[0].data = talloc_asprintf(expected1->records,
				"%s.%s. hostmaster.%s. 1 900 600 86400 3600",
				torture_setting_string(tctx, "host", NULL),
				lpcfg_dnsdomain(tctx->lp_ctx),
				lpcfg_dnsdomain(tctx->lp_ctx));
	torture_assert(tctx, expected1->records[0].data != NULL, "talloc failed");

	expected1->records[1].name = expected1->query_name;
	expected1->records[1].type = "ns";
	expected1->records[1].ttl = 900;
	expected1->records[1].data = talloc_asprintf(expected1->records, "%s.%s.",
				torture_setting_string(tctx, "host", NULL),
				lpcfg_dnsdomain(tctx->lp_ctx));
	torture_assert(tctx, expected1->records[1].data != NULL, "talloc failed");

	expected1->records[2].name = expected1->query_name;
	expected1->records[2].type = "aaaa";
	expected1->records[2].ttl = 900;

	expected1->records[3].name = expected1->query_name;
	expected1->records[3].type = "a";
	expected1->records[3].ttl = 900;

	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_SUCCESS,
				 "Failed to lookup @");
	for (i = 0; i < expected1->num_records; i++) {
		torture_assert(tctx, expected1->records[i].printed,
			       talloc_asprintf(tctx,
			       "Failed to have putrr callback run for type %s",
			       expected1->records[i].type));
	}
	torture_assert_int_equal(tctx, expected1->num_rr,
				 expected1->num_records,
				 "Got too much data");

	expected2 = talloc_zero(tctx, struct test_expected_rr);
	torture_assert(tctx, expected2 != NULL, "talloc failed");
	expected2->tctx = tctx;

	expected2->query_name = torture_setting_string(tctx, "host", NULL);
	torture_assert(tctx, expected2->query_name != NULL, "unknown host");

	expected2->num_records = 2;
	expected2->records = talloc_zero_array(expected2,
					       struct test_expected_record,
					       expected2->num_records);
	torture_assert(tctx, expected2->records != NULL, "talloc failed");

	expected2->records[0].name = expected2->query_name;
	expected2->records[0].type = "aaaa";
	expected2->records[0].ttl = 900;

	expected2->records[1].name = expected2->query_name;
	expected2->records[1].type = "a";
	expected2->records[1].ttl = 900;

	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected2->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected2,
						  methods, clientinfo),
				 ISC_R_SUCCESS,
				 "Failed to lookup hostname");
	for (i = 0; i < expected2->num_records; i++) {
		torture_assert(tctx, expected2->records[i].printed,
			       talloc_asprintf(tctx,
			       "Failed to have putrr callback run name[%s] for type %s",
			       expected2->records[i].name,
			       expected2->records[i].type));
	}
	torture_assert_int_equal(tctx, expected2->num_rr,
				 expected2->num_records,
				 "Got too much data");

	dlz_destroy(dbdata);

	return true;
}

/*
 * Test some zone dumps
 */
static bool test_dlz_bind9_zonedump(struct torture_context *tctx)
{
	size_t i;
	void *dbdata = NULL;
	dns_dlzdb_t *dlzdb = NULL;
	const char *argv[] = {
		"samba_dlz",
		"-H",
		dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
		NULL
	};
	struct test_expected_rr *expected1 = NULL;

	tctx_static = tctx;
	torture_assert_int_equal(tctx, dlz_create("samba_dlz", 3, argv, &dbdata,
						  "log", dlz_bind9_log_wrapper,
						  "writeable_zone", dlz_bind9_writeable_zone_hook,
						  "putrr", dlz_bind9_putrr_hook,
						  "putnamedrr", dlz_bind9_putnamedrr_hook,
						  NULL),
				 ISC_R_SUCCESS,
				 "Failed to create samba_dlz");

	torture_assert_int_equal(tctx, dlz_configure((void*)tctx, dlzdb, dbdata),
						     ISC_R_SUCCESS,
				 "Failed to configure samba_dlz");

	expected1 = talloc_zero(tctx, struct test_expected_rr);
	torture_assert(tctx, expected1 != NULL, "talloc failed");
	expected1->tctx = tctx;

	expected1->num_records = 7;
	expected1->records = talloc_zero_array(expected1,
					       struct test_expected_record,
					       expected1->num_records);
	torture_assert(tctx, expected1->records != NULL, "talloc failed");

	expected1->records[0].name = talloc_asprintf(expected1->records,
				"%s.", lpcfg_dnsdomain(tctx->lp_ctx));
	expected1->records[0].type = "soa";
	expected1->records[0].ttl = 3600;
	expected1->records[0].data = talloc_asprintf(expected1->records,
				"%s.%s. hostmaster.%s. 1 900 600 86400 3600",
				torture_setting_string(tctx, "host", NULL),
				lpcfg_dnsdomain(tctx->lp_ctx),
				lpcfg_dnsdomain(tctx->lp_ctx));
	torture_assert(tctx, expected1->records[0].data != NULL, "talloc failed");

	expected1->records[1].name = talloc_asprintf(expected1->records,
				"%s.", lpcfg_dnsdomain(tctx->lp_ctx));
	expected1->records[1].type = "ns";
	expected1->records[1].ttl = 900;
	expected1->records[1].data = talloc_asprintf(expected1->records, "%s.%s.",
				torture_setting_string(tctx, "host", NULL),
				lpcfg_dnsdomain(tctx->lp_ctx));
	torture_assert(tctx, expected1->records[1].data != NULL, "talloc failed");

	expected1->records[2].name = talloc_asprintf(expected1->records,
				"%s.", lpcfg_dnsdomain(tctx->lp_ctx));
	expected1->records[2].type = "aaaa";
	expected1->records[2].ttl = 900;

	expected1->records[3].name = talloc_asprintf(expected1->records,
				"%s.", lpcfg_dnsdomain(tctx->lp_ctx));
	expected1->records[3].type = "a";
	expected1->records[3].ttl = 900;

	expected1->records[4].name = talloc_asprintf(expected1->records, "%s.%s.",
				torture_setting_string(tctx, "host", NULL),
				lpcfg_dnsdomain(tctx->lp_ctx));
	torture_assert(tctx, expected1->records[4].name != NULL, "unknown host");
	expected1->records[4].type = "aaaa";
	expected1->records[4].ttl = 900;

	expected1->records[5].name = talloc_asprintf(expected1->records, "%s.%s.",
				torture_setting_string(tctx, "host", NULL),
				lpcfg_dnsdomain(tctx->lp_ctx));
	torture_assert(tctx, expected1->records[5].name != NULL, "unknown host");
	expected1->records[5].type = "a";
	expected1->records[5].ttl = 900;

	/*
	 * We expect multiple srv records
	 */
	expected1->records[6].name = NULL;
	expected1->records[6].type = "srv";
	expected1->records[6].ttl = 900;

	torture_assert_int_equal(tctx, dlz_allnodes(lpcfg_dnsdomain(tctx->lp_ctx),
						    dbdata, (dns_sdlzallnodes_t *)expected1),
				 ISC_R_SUCCESS,
				 "Failed to configure samba_dlz");
	for (i = 0; i < expected1->num_records; i++) {
		torture_assert(tctx, expected1->records[i].printed,
			       talloc_asprintf(tctx,
			       "Failed to have putrr callback run name[%s] for type %s",
			       expected1->records[i].name,
			       expected1->records[i].type));
	}
	torture_assert_int_equal(tctx, expected1->num_rr, 24,
				 "Got wrong record count");

	dlz_destroy(dbdata);

	return true;
}

/*
 * Test some updates
 */
static bool test_dlz_bind9_update01(struct torture_context *tctx)
{
	NTSTATUS status;
	struct gensec_security *gensec_client_context;
	DATA_BLOB client_to_server, server_to_client;
	void *dbdata = NULL;
	dns_dlzdb_t *dlzdb = NULL;
	void *version = NULL;
	const char *argv[] = {
		"samba_dlz",
		"-H",
		dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
		NULL
	};
	struct test_expected_rr *expected1 = NULL;
	char *name = NULL;
	char *data0 = NULL;
	char *data1 = NULL;
	char *data2 = NULL;
	bool ret = false;
	dns_clientinfomethods_t *methods = NULL;
	dns_clientinfo_t *clientinfo = NULL;

	tctx_static = tctx;
	torture_assert_int_equal(tctx, dlz_create("samba_dlz", 3, argv, &dbdata,
						  "log", dlz_bind9_log_wrapper,
						  "writeable_zone", dlz_bind9_writeable_zone_hook,
						  "putrr", dlz_bind9_putrr_hook,
						  "putnamedrr", dlz_bind9_putnamedrr_hook,
						  NULL),
				 ISC_R_SUCCESS,
				 "Failed to create samba_dlz");

	torture_assert_int_equal(tctx, dlz_configure((void*)tctx, dlzdb, dbdata),
						     ISC_R_SUCCESS,
				 "Failed to configure samba_dlz");

	expected1 = talloc_zero(tctx, struct test_expected_rr);
	torture_assert(tctx, expected1 != NULL, "talloc failed");
	expected1->tctx = tctx;

	expected1->query_name = __func__;

	name = talloc_asprintf(expected1, "%s.%s",
				expected1->query_name,
				lpcfg_dnsdomain(tctx->lp_ctx));
	torture_assert(tctx, name != NULL, "talloc failed");

	expected1->num_records = 2;
	expected1->records = talloc_zero_array(expected1,
					       struct test_expected_record,
					       expected1->num_records);
	torture_assert(tctx, expected1->records != NULL, "talloc failed");

	expected1->records[0].name = expected1->query_name;
	expected1->records[0].type = "a";
	expected1->records[0].ttl = 3600;
	expected1->records[0].data = "127.1.2.3";
	expected1->records[0].printed = false;

	data0 = talloc_asprintf(expected1,
				"%s.\t" "%u\t" "%s\t" "%s\t" "%s",
				name,
				(unsigned)expected1->records[0].ttl,
				"in",
				expected1->records[0].type,
				expected1->records[0].data);
	torture_assert(tctx, data0 != NULL, "talloc failed");

	expected1->records[1].name = expected1->query_name;
	expected1->records[1].type = "a";
	expected1->records[1].ttl = 3600;
	expected1->records[1].data = "127.3.2.1";
	expected1->records[1].printed = false;

	data1 = talloc_asprintf(expected1,
				"%s.\t" "%u\t" "%s\t" "%s\t" "%s",
				name,
				(unsigned)expected1->records[1].ttl,
				"in",
				expected1->records[1].type,
				expected1->records[1].data);
	torture_assert(tctx, data1 != NULL, "talloc failed");

	data2 = talloc_asprintf(expected1,
				"%s.\t" "0\t" "in\t" "a\t" "127.3.3.3",
				name);
	torture_assert(tctx, data2 != NULL, "talloc failed");

	/*
	 * Prepare session info
	 */
	status = gensec_client_start(tctx, &gensec_client_context,
				     lpcfg_gensec_settings(tctx, tctx->lp_ctx));
	torture_assert_ntstatus_ok(tctx, status, "gensec_client_start (client) failed");

	/*
	 * dlz_bind9 use the special dns/host.domain account
	 */
	status = gensec_set_target_hostname(gensec_client_context,
					    talloc_asprintf(tctx,
				"%s.%s",
				torture_setting_string(tctx, "host", NULL),
				lpcfg_dnsdomain(tctx->lp_ctx)));
	torture_assert_ntstatus_ok(tctx, status, "gensec_set_target_hostname (client) failed");

	status = gensec_set_target_service(gensec_client_context, "dns");
	torture_assert_ntstatus_ok(tctx, status, "gensec_set_target_service failed");

	status = gensec_set_credentials(gensec_client_context,
			samba_cmdline_get_creds());
	torture_assert_ntstatus_ok(tctx, status, "gensec_set_credentials (client) failed");

	status = gensec_start_mech_by_sasl_name(gensec_client_context, "GSS-SPNEGO");
	torture_assert_ntstatus_ok(tctx, status, "gensec_start_mech_by_sasl_name (client) failed");

	server_to_client = data_blob(NULL, 0);

	/* Do one step of the client-server update dance */
	status = gensec_update(gensec_client_context, tctx, server_to_client, &client_to_server);
	if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {;
		torture_assert_ntstatus_ok(tctx, status, "gensec_update (client) failed");
	}

	torture_assert_int_equal(tctx, dlz_ssumatch(
				cli_credentials_get_username(
					samba_cmdline_get_creds()),
				name,
				"127.0.0.1",
				expected1->records[0].type,
				"key",
				client_to_server.length,
				client_to_server.data,
				dbdata),
				ISC_TRUE,
			 "Failed to check key for update rights samba_dlz");

	/*
	 * We test the following:
	 *
	 *  1. lookup the records => NOT_FOUND
	 *  2. delete all records => NOT_FOUND
	 *  3. delete 1st record => NOT_FOUND
	 *  4. create 1st record => SUCCESS
	 *  5. lookup the records => found 1st
	 *  6. create 2nd record => SUCCESS
	 *  7. lookup the records => found 1st and 2nd
	 *  8. delete unknown record => NOT_FOUND
	 *  9. lookup the records => found 1st and 2nd
	 * 10. delete 1st record => SUCCESS
	 * 11. lookup the records => found 2nd
	 * 12. delete 2nd record => SUCCESS
	 * 13. lookup the records => NOT_FOUND
	 * 14. create 1st record => SUCCESS
	 * 15. lookup the records => found 1st
	 * 16. create 2nd record => SUCCESS
	 * 17. lookup the records => found 1st and 2nd
	 * 18. update 1st record => SUCCESS
	 * 19. lookup the records => found 1st and 2nd
	 * 20. delete all unknown type records => NOT_FOUND
	 * 21. lookup the records => found 1st and 2nd
	 * 22. delete all records => SUCCESS
	 * 23. lookup the records => NOT_FOUND
	 */

	/* Step 1. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_NOTFOUND,
				 "Found hostname");
	torture_assert_int_equal(tctx, expected1->num_rr, 0,
				 "Got wrong record count");

	/* Step 2. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_delrdataset(name,
					expected1->records[0].type,
					dbdata, version),
			ISC_R_NOTFOUND, ret, cancel_version,
			talloc_asprintf(tctx, "Deleted name[%s] type[%s]\n",
			name, expected1->records[0].type));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), false, dbdata, &version);

	/* Step 3. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_subrdataset(name, data0, dbdata, version),
			ISC_R_NOTFOUND, ret, cancel_version,
			talloc_asprintf(tctx, "Deleted name[%s] data[%s]\n",
			name, data0));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), false, dbdata, &version);

	/* Step 4. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_addrdataset(name, data0, dbdata, version),
			ISC_R_SUCCESS, ret, cancel_version,
			talloc_asprintf(tctx, "Failed to add name[%s] data[%s]\n",
			name, data0));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), true, dbdata, &version);

	/* Step 5. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_SUCCESS,
				 "Not found hostname");
	torture_assert(tctx, expected1->records[0].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[0].name,
		       expected1->records[0].type));
	torture_assert_int_equal(tctx, expected1->num_rr, 1,
				 "Got wrong record count");

	/* Step 6. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_addrdataset(name, data1, dbdata, version),
			ISC_R_SUCCESS, ret, cancel_version,
			talloc_asprintf(tctx, "Failed to add name[%s] data[%s]\n",
			name, data1));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), true, dbdata, &version);

	/* Step 7. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_SUCCESS,
				 "Not found hostname");
	torture_assert(tctx, expected1->records[0].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[0].name,
		       expected1->records[0].type));
	torture_assert(tctx, expected1->records[1].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[1].name,
		       expected1->records[1].type));
	torture_assert_int_equal(tctx, expected1->num_rr, 2,
				 "Got wrong record count");

	/* Step 8. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_subrdataset(name, data2, dbdata, version),
			ISC_R_NOTFOUND, ret, cancel_version,
			talloc_asprintf(tctx, "Deleted name[%s] data[%s]\n",
			name, data2));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), true, dbdata, &version);

	/* Step 9. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_SUCCESS,
				 "Not found hostname");
	torture_assert(tctx, expected1->records[0].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[0].name,
		       expected1->records[0].type));
	torture_assert(tctx, expected1->records[1].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[1].name,
		       expected1->records[1].type));
	torture_assert_int_equal(tctx, expected1->num_rr, 2,
				 "Got wrong record count");

	/* Step 10. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_subrdataset(name, data0, dbdata, version),
			ISC_R_SUCCESS, ret, cancel_version,
			talloc_asprintf(tctx, "Failed to delete name[%s] data[%s]\n",
			name, data0));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), true, dbdata, &version);

	/* Step 11. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_SUCCESS,
				 "Not found hostname");
	torture_assert(tctx, expected1->records[1].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[1].name,
		       expected1->records[1].type));
	torture_assert_int_equal(tctx, expected1->num_rr, 1,
				 "Got wrong record count");

	/* Step 12. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_subrdataset(name, data1, dbdata, version),
			ISC_R_SUCCESS, ret, cancel_version,
			talloc_asprintf(tctx, "Failed to delete name[%s] data[%s]\n",
			name, data1));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), true, dbdata, &version);

	/* Step 13. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_NOTFOUND,
				 "Found hostname");
	torture_assert_int_equal(tctx, expected1->num_rr, 0,
				 "Got wrong record count");

	/* Step 14. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_addrdataset(name, data0, dbdata, version),
			ISC_R_SUCCESS, ret, cancel_version,
			talloc_asprintf(tctx, "Failed to add name[%s] data[%s]\n",
			name, data0));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), true, dbdata, &version);

	/* Step 15. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_SUCCESS,
				 "Not found hostname");
	torture_assert(tctx, expected1->records[0].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[0].name,
		       expected1->records[0].type));
	torture_assert_int_equal(tctx, expected1->num_rr, 1,
				 "Got wrong record count");

	/* Step 16. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_addrdataset(name, data1, dbdata, version),
			ISC_R_SUCCESS, ret, cancel_version,
			talloc_asprintf(tctx, "Failed to add name[%s] data[%s]\n",
			name, data1));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), true, dbdata, &version);

	/* Step 17. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_SUCCESS,
				 "Not found hostname");
	torture_assert(tctx, expected1->records[0].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[0].name,
		       expected1->records[0].type));
	torture_assert(tctx, expected1->records[1].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[1].name,
		       expected1->records[1].type));
	torture_assert_int_equal(tctx, expected1->num_rr, 2,
				 "Got wrong record count");

	/* Step 18. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_addrdataset(name, data0, dbdata, version),
			ISC_R_SUCCESS, ret, cancel_version,
			talloc_asprintf(tctx, "Failed to update name[%s] data[%s]\n",
			name, data0));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), true, dbdata, &version);

	/* Step 19. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_SUCCESS,
				 "Not found hostname");
	torture_assert(tctx, expected1->records[0].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[0].name,
		       expected1->records[0].type));
	torture_assert(tctx, expected1->records[1].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[1].name,
		       expected1->records[1].type));
	torture_assert_int_equal(tctx, expected1->num_rr, 2,
				 "Got wrong record count");

	/* Step 20. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_delrdataset(name, "txt", dbdata, version),
			ISC_R_FAILURE, ret, cancel_version,
			talloc_asprintf(tctx, "Deleted name[%s] type[%s]\n",
			name, "txt"));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), false, dbdata, &version);

	/* Step 21. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_SUCCESS,
				 "Not found hostname");
	torture_assert(tctx, expected1->records[0].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[0].name,
		       expected1->records[0].type));
	torture_assert(tctx, expected1->records[1].printed,
		       talloc_asprintf(tctx,
		       "Failed to have putrr callback run name[%s] for type %s",
		       expected1->records[1].name,
		       expected1->records[1].type));
	torture_assert_int_equal(tctx, expected1->num_rr, 2,
				 "Got wrong record count");

	/* Step 22. */
	torture_assert_int_equal(tctx, dlz_newversion(lpcfg_dnsdomain(tctx->lp_ctx),
						      dbdata, &version),
				 ISC_R_SUCCESS,
				 "Failed to start transaction");
	torture_assert_int_equal_goto(tctx,
			dlz_delrdataset(name,
					expected1->records[0].type,
					dbdata, version),
			ISC_R_SUCCESS, ret, cancel_version,
			talloc_asprintf(tctx, "Failed to delete name[%s] type[%s]\n",
			name, expected1->records[0].type));
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), true, dbdata, &version);

	/* Step 23. */
	expected1->num_rr = 0;
	expected1->records[0].printed = false;
	expected1->records[1].printed = false;
	torture_assert_int_equal(tctx, dlz_lookup(lpcfg_dnsdomain(tctx->lp_ctx),
						  expected1->query_name, dbdata,
						  (dns_sdlzlookup_t *)expected1,
						  methods, clientinfo),
				 ISC_R_NOTFOUND,
				 "Found hostname");
	torture_assert_int_equal(tctx, expected1->num_rr, 0,
				 "Got wrong record count");

	dlz_destroy(dbdata);

	return true;

cancel_version:
	dlz_closeversion(lpcfg_dnsdomain(tctx->lp_ctx), false, dbdata, &version);
	return ret;
}

/*
 * Test zone transfer requests restrictions
 *
 * 1: test that zone transfer is denied by default
 * 2: with an authorized list of IPs set in smb.conf, test that zone transfer
 *    is accepted only for selected IPs.
 */
static bool test_dlz_bind9_allowzonexfr(struct torture_context *tctx)
{
	void *dbdata;
	const char *argv[] = {
		"samba_dlz",
		"-H",
		dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
		NULL
	};
	isc_result_t ret;
	dns_dlzdb_t *dlzdb = NULL;
	bool ok;

	tctx_static = tctx;
	torture_assert_int_equal(tctx, dlz_create("samba_dlz", 3, argv, &dbdata,
						  "log", dlz_bind9_log_wrapper,
						  "writeable_zone", dlz_bind9_writeable_zone_hook,
						  "putrr", dlz_bind9_putrr_hook,
						  "putnamedrr", dlz_bind9_putnamedrr_hook,
						  NULL),
				 ISC_R_SUCCESS,
				 "Failed to create samba_dlz");

	torture_assert_int_equal(tctx, dlz_configure((void*)tctx, dlzdb, dbdata),
						     ISC_R_SUCCESS,
				             "Failed to configure samba_dlz");

    /* Ask for zone transfer with no specific config => expect denied */
    ret = dlz_allowzonexfr(dbdata, lpcfg_dnsdomain(tctx->lp_ctx), "127.0.0.1");
    torture_assert_int_equal(tctx, ret, ISC_R_NOPERM,
                            "Zone transfer accepted with default settings");

    /* Ask for zone transfer with authorizations set */
    ok = lpcfg_set_option(tctx->lp_ctx, "dns zone transfer clients allow=127.0.0.1,1234:5678::1,192.168.0.");
    torture_assert(tctx, ok, "Failed to set dns zone transfer clients allow option.");

    ok = lpcfg_set_option(tctx->lp_ctx, "dns zone transfer clients deny=192.168.0.2");
    torture_assert(tctx, ok, "Failed to set dns zone transfer clients deny option.");

    ret = dlz_allowzonexfr(dbdata, lpcfg_dnsdomain(tctx->lp_ctx), "127.0.0.1");
    torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
                            "Zone transfer refused for authorized IPv4 address");

    ret = dlz_allowzonexfr(dbdata, lpcfg_dnsdomain(tctx->lp_ctx), "1234:5678::1");
    torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
                             "Zone transfer refused for authorized IPv6 address.");

    ret = dlz_allowzonexfr(dbdata, lpcfg_dnsdomain(tctx->lp_ctx), "10.0.0.1");
    torture_assert_int_equal(tctx, ret, ISC_R_NOPERM,
                            "Zone transfer accepted for unauthorized IP");

    ret = dlz_allowzonexfr(dbdata, lpcfg_dnsdomain(tctx->lp_ctx), "192.168.0.1");
    torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
                             "Zone transfer refused for address in authorized IPv4 subnet.");

    ret = dlz_allowzonexfr(dbdata, lpcfg_dnsdomain(tctx->lp_ctx), "192.168.0.2");
    torture_assert_int_equal(tctx, ret, ISC_R_NOPERM,
                            "Zone transfer allowed for denied client.");

    dlz_destroy(dbdata);
    return true;
}


static int init_dlz(struct torture_context *tctx,
		    void **dbdata)
{
	isc_result_t ret;
	const char *argv[] = {
		"samba_dlz",
		"-H",
		dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
		NULL
	};

	ret = dlz_create("samba_dlz", 3, argv, dbdata,
			 "log", dlz_bind9_log_wrapper,
			 "writeable_zone", dlz_bind9_writeable_zone_hook,
			 "putrr", dlz_bind9_putrr_hook,
			 "putnamedrr", dlz_bind9_putnamedrr_hook,
			 NULL);

	torture_assert_int_equal(tctx,
				 ret,
				 ISC_R_SUCCESS,
				 "Failed to create samba_dlz");

	ret = dlz_configure((void*)tctx, NULL, *dbdata);
	torture_assert_int_equal(tctx,
				 ret,
				 ISC_R_SUCCESS,
				 "Failed to configure samba_dlz");

	return true;
}


static int init_gensec(struct torture_context *tctx,
		       struct gensec_security **gensec_client_context)
{
	NTSTATUS status;
	/*
	 * Prepare session info
	 */
	status = gensec_client_start(tctx, gensec_client_context,
				     lpcfg_gensec_settings(tctx, tctx->lp_ctx));
	torture_assert_ntstatus_ok(tctx, status,
				   "gensec_client_start (client) failed");

	/*
	 * dlz_bind9 use the special dns/host.domain account
	 */
	status = gensec_set_target_hostname(*gensec_client_context,
					    talloc_asprintf(tctx,
				"%s.%s",
				torture_setting_string(tctx, "host", NULL),
				lpcfg_dnsdomain(tctx->lp_ctx)));
	torture_assert_ntstatus_ok(tctx, status,
				   "gensec_set_target_hostname (client) failed");

	status = gensec_set_target_service(*gensec_client_context, "dns");
	torture_assert_ntstatus_ok(tctx, status,
				   "gensec_set_target_service failed");

	status = gensec_set_credentials(*gensec_client_context,
					samba_cmdline_get_creds());
	torture_assert_ntstatus_ok(tctx, status,
				   "gensec_set_credentials (client) failed");

	status = gensec_start_mech_by_sasl_name(*gensec_client_context,
						"GSS-SPNEGO");
	torture_assert_ntstatus_ok(tctx, status,
				   "gensec_start_mech_by_sasl_name (client) failed");


	return true;
}



static bool expected_record(TALLOC_CTX *mem_ctx,
			    struct test_expected_record *r,
			    const char *name,
			    const char *type,
			    const char *data)
{
	unsigned int ttl = 3600;
	const char *rdata = talloc_asprintf(
		mem_ctx,
		"%s.\t" "%u\t" "in\t" "%s\t" "%s",
		name, ttl, type, data);
	if (rdata == NULL) {
		return false;
	}

	*r = (struct test_expected_record){
		.name = name,
		.type = type,
		.data = data,
		.ttl = ttl,
		.printed = false,
		.rdata = rdata
	};
	return true;
}


struct dlz_test_handle {
	struct dcerpc_pipe *p;
};


static bool set_zone_aging(struct torture_context *tctx,
			   const char *zone,
			   int value)
{
	int ret;
	char *cmd = talloc_asprintf(tctx,
				    "bin/samba-tool dns zoneoptions "
				    "$SERVER %s -U$USERNAME%%$PASSWORD "
				    "--aging %d", zone, value);

	if (cmd == NULL) {
		return false;
	}

	ret = system(cmd);
	if (ret != 0) {
		TALLOC_FREE(cmd);
		return false;
	}
	TALLOC_FREE(cmd);
	return true;
}


static struct ldb_context* get_samdb(struct torture_context *tctx)
{
	struct ldb_context *samdb = NULL;
	char *errstring;
	int ret = samdb_connect_url(
		tctx,
		NULL,
		tctx->lp_ctx,
		system_session(tctx->lp_ctx),
		0,
		dlz_bind9_binddns_dir(tctx, "dns/sam.ldb"),
		NULL,
		&samdb,
		&errstring);
	if (ret != LDB_SUCCESS) {
		return NULL;
	}
	return samdb;
}


static void print_node_records(struct torture_context *tctx,
			       struct ldb_context *samdb,
			       struct ldb_dn *node_dn,
			       const char *msg)
{
	int ret;
	struct ldb_result *result = NULL;
	struct dnsp_DnssrvRpcRecord rec;
	struct ldb_message_element *el = NULL;
	size_t i;

	if (msg != NULL) {
		torture_comment(tctx,
				"\033[1;32m%s\033[0m\n",
				msg);
	}

	ret = dsdb_search(samdb, tctx, &result, node_dn,
			  LDB_SCOPE_SUBTREE, NULL,
			  0, NULL);
	if (ret != LDB_SUCCESS) {
		torture_comment(tctx,
				"Failed to find node: %s",
				ldb_errstring(samdb));
	}

	el = ldb_msg_find_element(result->msgs[0], "dnsRecord");

	for (i = 0; i < el->num_values; i++) {
		ret = ndr_pull_struct_blob(
			&(el->values[i]),
			result,
			&rec,
			(ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
		if (!NDR_ERR_CODE_IS_SUCCESS(ret)) {
			DBG_ERR("Failed to pull dns rec blob [%zu].\n",
				i);
			TALLOC_FREE(result);
		}
		torture_comment(tctx, "record[%zu]:\n", i);
		torture_comment(tctx, "type: %d\n", rec.wType);
		torture_comment(tctx, "timestamp: %u\n", rec.dwTimeStamp);
		torture_comment(tctx, "%s\n",
				NDR_PRINT_STRUCT_STRING(result,
							dnsp_DnssrvRpcRecord,
							&rec));
	}
}



/*
 * Test some MORE updates, this time focussing on more record types and aging.
 */
static bool test_dlz_bind9_aging(struct torture_context *tctx)
{
	struct gensec_security *gensec_client_context = NULL;
	DATA_BLOB client_to_server, server_to_client;
	NTSTATUS status;
	void *dbdata = NULL;
	void *version = NULL;
	struct test_expected_rr *testdata = NULL;
	bool ok = false;
	struct ldb_context *samdb = NULL;
	isc_result_t ret;
	size_t i, j;
	const char *domain = lpcfg_dnsdomain(tctx->lp_ctx);
	struct ldb_dn *domain_dn = NULL;
	struct ldb_dn *node_dn = NULL;
	struct ldb_result *result = NULL;
	uint32_t dns_timestamp_before;
	uint32_t dns_timestamp_after;
	const char *name = NULL;
	const char *attrs[] = {"dnsrecord", NULL};
	const char *node_dn_str = NULL;
	struct ldb_message_element *el = NULL;
	struct ldb_message *msg = NULL;

	tctx_static = tctx;

	/* Step 0. set things up */

	ok = init_dlz(tctx, &dbdata);
	if (! ok) {
		torture_fail(tctx, "Failed to init_dlz");
	}
	ok = init_gensec(tctx, &gensec_client_context);
	if (! ok) {
		torture_fail(tctx, "Failed to init_gensec");
	}

	samdb = get_samdb(tctx);
	if (samdb == NULL) {
		torture_fail(tctx, "Failed to connect to samdb");
	}

	domain_dn = ldb_get_default_basedn(samdb);
	testdata = talloc_zero(tctx, struct test_expected_rr);
	torture_assert(tctx, testdata != NULL, "talloc failed");
	testdata->tctx = tctx;

	testdata->query_name = __func__;

	name = talloc_asprintf(testdata, "%s.%s",
			       testdata->query_name,
			       domain);
	torture_assert(tctx, name != NULL, "talloc failed");

	testdata->num_records = 6;
	testdata->records = talloc_zero_array(testdata,
					      struct test_expected_record,
					      testdata->num_records);
	torture_assert(tctx, testdata->records != NULL, "talloc failed");

	torture_assert(tctx,
		       expected_record(testdata->records,
				       &testdata->records[0],
				       testdata->query_name,
				       "aaaa",
				       "::1"),
		       "failed to add record");

	torture_assert(tctx,
		       expected_record(testdata->records,
				       &testdata->records[1],
				       testdata->query_name,
				       "a",
				       "127.11.12.13"),
		       "failed to add record");
	torture_assert(tctx,
		       expected_record(testdata->records,
				       &testdata->records[2],
				       testdata->query_name,
				       "a",
				       "127.11.12.14"),
		       "failed to add record");

	torture_assert(tctx,
		       expected_record(testdata->records,
				       &testdata->records[3],
				       testdata->query_name,
				       "ptr",
				       "samba.example.com"),
		       "failed to add record");

	/*
	 * NOTE: Here we add the MX record with the priority before the name,
	 * rather than the other way around which you are more likely to see
	 * ("samba.example.com 11" e.g. in samba-tool dns), because this is
	 * how it goes in BIND9 configuration.
	 */
	torture_assert(tctx,
		       expected_record(testdata->records,
				       &testdata->records[4],
				       testdata->query_name,
				       "mx",
				       "11 samba.example.com."),
		       "failed to add record");

	torture_assert(tctx,
		       expected_record(testdata->records,
				       &testdata->records[5],
				       testdata->query_name,
				       "cname",
				       "samba.example.com"),
		       "failed to add record");


	server_to_client = data_blob(NULL, 0);

	/* Do one step of the client-server update dance */
	status = gensec_update(gensec_client_context, tctx, server_to_client,
			       &client_to_server);
	if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {;
		torture_assert_ntstatus_ok(tctx, status,
					   "gensec_update (client) failed");
	}

	torture_assert_int_equal(tctx, dlz_ssumatch(
				cli_credentials_get_username(
					samba_cmdline_get_creds()),
				domain,
				"127.0.0.1",
				testdata->records[0].type,
				"key",
				client_to_server.length,
				client_to_server.data,
				dbdata),
				ISC_TRUE,
			 "Failed to check key for update rights samba_dlz");

	/* remember the DN for use below */
	node_dn = ldb_dn_copy(testdata, domain_dn);
	if (node_dn == NULL) {
		torture_fail(tctx, "Failed to make node dn");
	}

	ok = ldb_dn_add_child_fmt(
		node_dn,
		"DC=%s,DC=%s,CN=MicrosoftDNS,DC=DomainDnsZones",
		testdata->query_name,
		domain);
	if (! ok) {
		torture_fail(tctx, "Failed to make node dn");
	}
	node_dn_str = ldb_dn_get_linearized(node_dn);
	if (node_dn_str == NULL) {
		torture_fail(tctx, "Failed to linearise node dn");
	}

	/* LOOK: we are chopping off the last one (the CNAME) for now */
	testdata->num_records = 5;

	/*
	 * We test the following:
	 *
	 * Step 1.  Ensure we are starting with an empty node.
	 * Step 2.  Add all the records (with aging off).
	 * Step 3.  Check the timestamps are now-ish.
	 * Step 4.  Add all the records AGAIN.
	 * Step 5:  Turn aging on.
	 * Step 6.  Add all the records again.
	 * Step 7.  Check the timestamps are still now-ish.
	 * Step 8.  Wind back the timestamps in the database.
	 * Step 9.  Do another update, changing some timestamps
	 * Step 10. Check that the timestamps are right.
	 * Step 11. Set one record to be static.
	 * Step 12. Do updates on some records, zeroing their timestamps
	 * Step 13. Check that the record timeouts are *mostly* zero.
	 * Step 14. Turn aging off
	 * Step 15. Update, setting timestamps to zero
	 * Step 16. Check that the timestamps are all zero.
	 * Step 17. Reset to non-zero via ldb, with aging still off.
	 * Step 18. Update with aging off. Nothing should change.
	 * Step 19. Check that the timestamps didn't change.
	 * Step 20. Delete all the records, 1 by 1.
	 */


	/*
	 * Step 1. Ensure we are starting with an empty node.
	 */
	torture_comment(tctx, "step 1: %s records are not there\n",
			testdata->query_name);
	testdata->num_rr = 0;
	torture_assert_int_equal(tctx, dlz_lookup(domain,
						  testdata->query_name,
						  dbdata,
						  (dns_sdlzlookup_t *)testdata,
						  NULL, NULL),
				 ISC_R_NOTFOUND,
				 "Found hostname");
	torture_assert_int_equal(tctx, testdata->num_rr, 0,
				 "Got records when there should be none");


	dns_timestamp_before = unix_to_dns_timestamp(time(NULL));

	/*
	 * Step 2. Add all the records (with aging off).
	 * After adding each one, expect to find it and earlier ones.
	 */
	torture_comment(tctx,
			"step 2: add %zu records\n",
			testdata->num_records);

	for (i = 0; i < testdata->num_records; i++) {
		struct test_expected_record r = testdata->records[i];
		ret = dlz_newversion(domain, dbdata, &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to start transaction");

		ret = dlz_addrdataset(name, r.rdata, dbdata, version);
		torture_assert_int_equal_goto(
			tctx, ret, ISC_R_SUCCESS, ok,
			cancel_version,
			talloc_asprintf(tctx,
					"Failed to add record %zu «%s»\n",
					i, r.rdata));

		dlz_closeversion(domain, true, dbdata, &version);

		testdata->num_rr = 0;

		ret = dlz_lookup(domain, testdata->query_name, dbdata,
				 (dns_sdlzlookup_t *)testdata, NULL, NULL);

		torture_assert_int_equal(tctx, ret,
					 ISC_R_SUCCESS,
					 "Not found hostname");
		torture_assert_int_equal(tctx, testdata->num_rr, i + 1,
					 "Got wrong record count");

		for (j = 0; j < testdata->num_records; j++) {
			struct test_expected_record *r2 = &testdata->records[j];
			if (j <= i) {
				torture_assertf(
					tctx,
					r2->printed,
					"putrr callback not run on %s «%s»",
					r2->type, r2->name);
			} else {
				torture_assertf(
					tctx,
					! r2->printed,
					"putrr callback should not see %s «%s»",
					r2->type, r2->name);
			}
			r2->printed = false;
		}
	}

	dns_timestamp_after = unix_to_dns_timestamp(time(NULL));
	/*
	 * Step 3. Check the timestamps are now-ish.
	 *
	 * Those records should have DNS timestamps between
	 * dns_timestamp_before and dns_timestamp_after (the resolution is
	 * hourly, so probably both are equal).
	 */
	ret = dsdb_search(samdb, tctx, &result, node_dn,
			  LDB_SCOPE_SUBTREE, NULL,
			  0, NULL);
	if (ret != LDB_SUCCESS) {
		torture_fail(tctx,
			     talloc_asprintf(
				     tctx,
				     "Failed to find %s node: %s",
				     name, ldb_errstring(samdb)));
	}
	torture_assert_int_equal(tctx, result->count, 1,
				 "Should be one node");

	el = ldb_msg_find_element(result->msgs[0], "dnsRecord");
	torture_assert_not_null(tctx, el, "el");
	torture_assert(tctx, dns_timestamp_before <= dns_timestamp_after, "<");
	torture_assert_int_equal(tctx, el->num_values, testdata->num_records,
				 "num_values != num_records");

	for (i = 0; i < el->num_values; i++) {
		struct dnsp_DnssrvRpcRecord rec;
		ret = ndr_pull_struct_blob(
			&(el->values[i]),
			result,
			&rec,
			(ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
		if (!NDR_ERR_CODE_IS_SUCCESS(ret)) {
			DBG_ERR("Failed to pull dns rec blob [%zu].\n",
				i);
			TALLOC_FREE(result);
			torture_fail(tctx, "Failed to pull dns rec blob");
		}
		torture_comment(tctx, "record[%zu]:\n", i);
		torture_comment(tctx, "type: %d\n", rec.wType);
		torture_comment(tctx, "timestamp: %u\n", rec.dwTimeStamp);
		torture_comment(tctx, "%s\n",
				NDR_PRINT_STRUCT_STRING(result,
							dnsp_DnssrvRpcRecord,
							&rec));

		torture_assert(tctx, rec.dwTimeStamp >= dns_timestamp_before,
			       "timestamp < dns_timestamp_before");
		torture_assert(tctx, rec.dwTimeStamp <= dns_timestamp_after,
			       "timestamp > dns_timestamp_after");
	}

	talloc_free(result);

	/*
	 * Step 4. Add all the records AGAIN.
	 *
	 * After adding each one, we expect no change in the number or nature
	 * of records.
	 */
	torture_comment(tctx, "step 4: add the records again\n");
	for (i = 0; i < testdata->num_records; i++) {
		struct test_expected_record r = testdata->records[i];

		ret = dlz_newversion(domain, dbdata, &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to start transaction");

		ret = dlz_addrdataset(name, r.rdata, dbdata, version);
		torture_assert_int_equal_goto(
			tctx, ret, ISC_R_SUCCESS, ok,
			cancel_version,
			talloc_asprintf(tctx,
					"Failed to add record %zu «%s»\n",
					i, r.rdata));

		dlz_closeversion(domain, true, dbdata, &version);

		testdata->num_rr = 0;

		ret = dlz_lookup(domain, testdata->query_name, dbdata,
				 (dns_sdlzlookup_t *)testdata, NULL, NULL);

		torture_assert_int_equal(tctx, ret,
					 ISC_R_SUCCESS,
					 "Not found hostname");
		torture_assert_int_equal(tctx,
					 testdata->num_rr,
					 testdata->num_records,
					 "Got wrong record count");

		for (j = 0; j <= i; j++) {
			/* these ones are printed again. */
			struct test_expected_record *r2 = &testdata->records[j];
			torture_assert(
				tctx,
				r2->printed,
				talloc_asprintf(
					tctx,
					"putrr callback not run on %s «%s»",
					r2->type, r2->name));
			r2->printed = false;
		}
	}

	print_node_records(tctx, samdb, node_dn, "after adding again");


	/*
	 * Step 5: Turn aging on.
	 */
	torture_comment(tctx, "step 5: turn aging on\n");
	ok = set_zone_aging(tctx, domain, 1);
	torture_assert(tctx, ok, "failed to enable aging");

	print_node_records(tctx, samdb, node_dn, "aging on");

	/*
	 * Step 6. Add all the records again.
	 *
	 * We expect no change in the number or nature of records, even with
	 * aging on, because the default noRefreshInterval is 7 days (also,
	 * there should be no change because almost no time has passed).
	 */
	torture_comment(tctx, "step 6: add records again\n");

	for (i = 0; i < testdata->num_records; i++) {
		struct test_expected_record r = testdata->records[i];

		ret = dlz_newversion(domain, dbdata, &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to start transaction");

		ret = dlz_addrdataset(domain, r.rdata, dbdata, version);
		torture_assert_int_equal_goto(
			tctx, ret, ISC_R_SUCCESS, ok,
			cancel_version,
			talloc_asprintf(tctx,
					"Failed to add record %zu «%s»\n",
					i, r.rdata));

		dlz_closeversion(domain, true, dbdata, &version);
	}

	print_node_records(tctx, samdb, node_dn, "add again");


	/*
	 * Step 7. Check the timestamps are still now-ish.
	 *
	 */
	ret = dsdb_search(samdb, tctx, &result, node_dn,
			  LDB_SCOPE_SUBTREE, NULL,
			  0, NULL);
	if (ret != LDB_SUCCESS) {
		torture_fail(tctx,
			     talloc_asprintf(
				     tctx,
				     "Failed to find %s node: %s",
				     name, ldb_errstring(samdb)));
	}
	torture_assert_int_equal(tctx, result->count, 1,
				 "Should be one node");

	el = ldb_msg_find_element(result->msgs[0], "dnsRecord");
	torture_assert_not_null(tctx, el, "el");
	torture_assert(tctx, dns_timestamp_before <= dns_timestamp_after, "<");
	torture_assert_int_equal(tctx, el->num_values, testdata->num_records,
				 "num_values != num_records");

	for (i = 0; i < el->num_values; i++) {
		struct dnsp_DnssrvRpcRecord rec;
		ret = ndr_pull_struct_blob(
			&(el->values[i]),
			result,
			&rec,
			(ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
		if (!NDR_ERR_CODE_IS_SUCCESS(ret)) {
			DBG_ERR("Failed to pull dns rec blob [%zu].\n",
				i);
			TALLOC_FREE(result);
			torture_fail(tctx, "Failed to pull dns rec blob");
		}
		torture_comment(tctx, "record[%zu]:\n", i);
		torture_comment(tctx, "type: %d\n", rec.wType);
		torture_comment(tctx, "timestamp: %u\n", rec.dwTimeStamp);
		torture_comment(tctx, "%s\n",
				NDR_PRINT_STRUCT_STRING(result,
							dnsp_DnssrvRpcRecord,
							&rec));

		torture_assert(tctx, rec.dwTimeStamp >= dns_timestamp_before,
			       "timestamp < dns_timestamp_before");
		torture_assert(tctx, rec.dwTimeStamp <= dns_timestamp_after,
			       "timestamp > dns_timestamp_after");
	}

	talloc_free(result);

	/*
	 * Step 8. Wind back the timestamps in the database.
	 *
	 * We use a different number of days for each record, so that some
	 * should be refreshed, and some shouldn't.
	 */
	torture_comment(tctx, "step 8: alter timestamps\n");
	ret = dsdb_search_one(samdb, tctx, &msg, node_dn,
			      LDB_SCOPE_BASE, attrs,
			      0, NULL);
	if (ret != LDB_SUCCESS) {
		torture_fail(tctx,
			     talloc_asprintf(
				     tctx,
				     "Failed to find %s node: %s",
				     name, ldb_errstring(samdb)));
	}

	el = ldb_msg_find_element(msg, "dnsRecord");
	torture_assert_not_null(tctx, el, "el");
	torture_assert_int_equal(tctx, el->num_values,
				 testdata->num_records,
				 "num_values != num_records");

	for (i = 0; i < el->num_values; i++) {
		struct dnsp_DnssrvRpcRecord rec;
		ret = ndr_pull_struct_blob(
			&(el->values[i]),
			msg,
			&rec,
			(ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
		torture_assert_ndr_success(tctx, ret, "failed to pull record");

		rec.dwTimeStamp = dns_timestamp_after + 3 - 24 * (i + 5);

		ret = ndr_push_struct_blob(
			&el->values[i],
			msg,
			&rec,
			(ndr_push_flags_fn_t)ndr_push_dnsp_DnssrvRpcRecord);
		torture_assert_ndr_success(tctx, ret, "failed to PUSH record");
	}
	el->flags = LDB_FLAG_MOD_REPLACE;

	ret = ldb_modify(samdb, msg);
	torture_assert_int_equal(tctx, ret, 0, "failed to ldb_modify");
	print_node_records(tctx, samdb, node_dn, "after ldb_modify");


	/*
	 * Step 9. Do another update, changing some timestamps
	 */

	for (i = 0; i < testdata->num_records; i++) {
		struct test_expected_record r = testdata->records[i];

		ret = dlz_newversion(domain, dbdata, &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to start transaction");

		ret = dlz_addrdataset(name, r.rdata, dbdata, version);
		dlz_closeversion(domain, ret == ISC_R_SUCCESS, dbdata,
				 &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to update record\n");
	}
	print_node_records(tctx, samdb, node_dn, "after update");

	/*
	 * Step 10. Check that the timestamps are right.
	 *
	 * The formula was
	 *    (i + 5) days + 3 hours
	 * so 1 is 6 days + 3 hours, and should not be renewed.
	 *    2 is 7 days + 3 hours, and should be renewed
	 *
	 * NOTE: the ldb record order is different from the insertion order,
	 * but it should stay the same between searches.
	 */
	ret = dsdb_search_one(samdb, tctx, &msg, node_dn,
			      LDB_SCOPE_BASE, attrs,
			      0, NULL);
	if (ret != LDB_SUCCESS) {
		torture_fail(tctx,
			     talloc_asprintf(
				     tctx,
				     "Failed to find %s node: %s",
				     name, ldb_errstring(samdb)));
	}

	el = ldb_msg_find_element(msg, "dnsRecord");
	torture_assert_not_null(tctx, el, "el");
	torture_assert_int_equal(tctx, el->num_values,
				 testdata->num_records,
				 "num_values != num_records");

	for (i = 0; i < el->num_values; i++) {
		struct dnsp_DnssrvRpcRecord rec;
		ret = ndr_pull_struct_blob(
			&(el->values[i]),
			msg,
			&rec,
			(ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
		torture_assert_ndr_success(tctx, ret, "failed to pull record");
		if (i < 3) {
			/* records 0 and 1 should not have been renewed */
			int old_ts = dns_timestamp_after + 3 - 24 * (i + 5);
			torture_assertf(
				tctx,
				rec.dwTimeStamp == old_ts,
				"record[%zu] timestamp should not be altered."
				" diff is %d\n",
				i, rec.dwTimeStamp - old_ts);
		} else {
			/* records 3+ should have a now-ish timestamp */
			int old_ts = dns_timestamp_after + 3 - 24 * (i + 5);
			torture_assertf(
				tctx,
				rec.dwTimeStamp >= dns_timestamp_before,
				"record[%zu] should have altered timestamp "
				"now ~= %d, then ~= %d, has %d, diff %d\n", i,
				dns_timestamp_before, old_ts, rec.dwTimeStamp,
				dns_timestamp_before - rec.dwTimeStamp
				);
		}
	}

	/*
	 * Step 11. Set one record to be static.
	 *
	 * This should make the node static, but it won't "know" that until we
	 * force it with an update.
	 */
	torture_comment(tctx, "step 11: alter one timestamp to be 0\n");
	ret = dsdb_search_one(samdb, tctx, &msg, node_dn,
			      LDB_SCOPE_BASE, attrs,
			      0, NULL);
	if (ret != LDB_SUCCESS) {
		torture_fail(tctx,
			     talloc_asprintf(
				     tctx,
				     "Failed to find %s node: %s",
				     name, ldb_errstring(samdb)));
	}

	el = ldb_msg_find_element(msg, "dnsRecord");
	torture_assert_not_null(tctx, el, "el");
	torture_assert_int_equal(tctx, el->num_values,
				 testdata->num_records,
				 "num_values != num_records");

	{
		/* we're arbitrarily picking on record 3 */
		struct dnsp_DnssrvRpcRecord rec;
		ret = ndr_pull_struct_blob(
			&(el->values[3]),
			msg,
			&rec,
			(ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
		torture_assert_ndr_success(tctx, ret, "failed to pull record");

		rec.dwTimeStamp = 0;

		ret = ndr_push_struct_blob(
			&el->values[3],
			msg,
			&rec,
			(ndr_push_flags_fn_t)ndr_push_dnsp_DnssrvRpcRecord);
		torture_assert_ndr_success(tctx, ret, "failed to PUSH record");
	}
	el->flags = LDB_FLAG_MOD_REPLACE;

	ret = ldb_modify(samdb, msg);
	torture_assert_int_equal(tctx, ret, 0, "failed to ldb_modify");
	print_node_records(tctx, samdb, node_dn, "after ldb_modify");


	/*
	 * Step 12. Do updates on some records, zeroing their timestamps
	 *
	 * Zero means static. A single zero timestamp is infectious, so other
	 * records get it when they are updated.
	 */

	for (i = 0; i < testdata->num_records - 2; i++) {
		struct test_expected_record r = testdata->records[i];

		ret = dlz_newversion(domain, dbdata, &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to start transaction");

		ret = dlz_addrdataset(name, r.rdata, dbdata, version);
		dlz_closeversion(domain, ret == ISC_R_SUCCESS, dbdata,
				 &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to update record\n");
	}
	print_node_records(tctx, samdb, node_dn, "after update to static");


	/*
	 * Step 13. Check that the record timeouts are *mostly* zero.
	 *
	 * one or two will be non-zero: we updated all but two, but one of
	 * excluded ones might be the el->records[3] that we explicitly set to
	 * zero.
	 */
	ret = dsdb_search_one(samdb, tctx, &msg, node_dn,
			      LDB_SCOPE_BASE, attrs,
			      0, NULL);
	if (ret != LDB_SUCCESS) {
		torture_fail(tctx,
			     talloc_asprintf(
				     tctx,
				     "Failed to find %s node: %s",
				     name, ldb_errstring(samdb)));
	}

	el = ldb_msg_find_element(msg, "dnsRecord");
	{
		unsigned n_zero = 0;
		for (i = 0; i < el->num_values; i++) {
			struct dnsp_DnssrvRpcRecord rec;
			ret = ndr_pull_struct_blob(
				&(el->values[i]),
				msg,
				&rec,
				(ndr_pull_flags_fn_t)\
				ndr_pull_dnsp_DnssrvRpcRecord);
			torture_assert_ndr_success(tctx, ret,
						   "failed to pull record");
			if (rec.dwTimeStamp == 0) {
				n_zero++;
			}
		}
		if (n_zero != el->num_values - 1 &&
		    n_zero != el->num_values - 2) {
			torture_comment(tctx, "got %u zeros, expected %u or %u",
					n_zero,
					el->num_values - 2,
					el->num_values - 1);
			torture_fail(tctx,
				     "static node not setting zero timestamps\n");

		}
	}


	/*
	 * Step 14. Turn aging off.
	 */
	torture_comment(tctx, "step 14: turn aging off\n");
	ok = set_zone_aging(tctx, domain, 0);
	torture_assert(tctx, ok, "failed to disable aging");
	print_node_records(tctx, samdb, node_dn, "aging off");

	/*
	 * Step 15. Update, setting timestamps to zero.
	 *
	 * Even with aging off, timestamps are still changed to static.
	 */
	for (i = 0; i < testdata->num_records; i++) {
		struct test_expected_record r = testdata->records[i];

		ret = dlz_newversion(domain, dbdata, &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to start transaction");

		ret = dlz_addrdataset(name, r.rdata, dbdata, version);
		dlz_closeversion(domain, ret == ISC_R_SUCCESS, dbdata,
				 &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to update record\n");
	}
	print_node_records(tctx, samdb, node_dn, "after update with aging off");


	/*
	 * Step 16. Check that the timestamps are all zero.
	 */
	ret = dsdb_search_one(samdb, tctx, &msg, node_dn,
			      LDB_SCOPE_BASE, attrs,
			      0, NULL);
	if (ret != LDB_SUCCESS) {
		torture_fail(tctx,
			     talloc_asprintf(
				     tctx,
				     "Failed to find %s node: %s",
				     name, ldb_errstring(samdb)));
	}

	el = ldb_msg_find_element(msg, "dnsRecord");
	for (i = 0; i < el->num_values; i++) {
		struct dnsp_DnssrvRpcRecord rec;
		ret = ndr_pull_struct_blob(
			&(el->values[i]),
			msg,
			&rec,
			(ndr_pull_flags_fn_t) ndr_pull_dnsp_DnssrvRpcRecord);
		torture_assert_ndr_success(tctx, ret,
					   "failed to pull record");
		torture_assertf(tctx, rec.dwTimeStamp == 0,
				"record[%zu].dwTimeStamp is %u, expected 0\n",
				i, rec.dwTimeStamp);

	}


	/*
	 * Step 17. Reset to non-zero via ldb, with aging still off.
	 *
	 * We chose timestamps in the distant past that would all be updated
	 * if aging was on.
	 */
	torture_comment(tctx, "step 17: reset to non-zero timestamps\n");
	ret = dsdb_search_one(samdb, tctx, &msg, node_dn,
			      LDB_SCOPE_BASE, attrs,
			      0, NULL);
	if (ret != LDB_SUCCESS) {
		torture_fail(tctx,
			     talloc_asprintf(
				     tctx,
				     "Failed to find %s node: %s",
				     name, ldb_errstring(samdb)));
	}

	el = ldb_msg_find_element(msg, "dnsRecord");

	for (i = 0; i < el->num_values; i++) {
		struct dnsp_DnssrvRpcRecord rec;
		ret = ndr_pull_struct_blob(
			&(el->values[i]),
			msg,
			&rec,
			(ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
		torture_assert_ndr_success(tctx, ret, "failed to pull record");

		rec.dwTimeStamp = 10000 + i; /* a long time ago */

		ret = ndr_push_struct_blob(
			&el->values[i],
			msg,
			&rec,
			(ndr_push_flags_fn_t)ndr_push_dnsp_DnssrvRpcRecord);
		torture_assert_ndr_success(tctx, ret, "failed to PUSH record");
	}
	el->flags = LDB_FLAG_MOD_REPLACE;

	ret = ldb_modify(samdb, msg);
	torture_assert_int_equal(tctx, ret, 0, "failed to ldb_modify");
	print_node_records(tctx, samdb, node_dn, "timestamps no-zero, aging off");


	/*
	 * Step 18. Update with aging off. Nothing should change.
	 *
	 */

	/* now, with another update, some will be updated and some won't */
	for (i = 0; i < testdata->num_records; i++) {
		struct test_expected_record r = testdata->records[i];

		ret = dlz_newversion(domain, dbdata, &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to start transaction");

		ret = dlz_addrdataset(name, r.rdata, dbdata, version);
		dlz_closeversion(domain, ret == ISC_R_SUCCESS, dbdata,
				 &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to update record\n");
	}
	print_node_records(tctx, samdb, node_dn, "after update");


	/*
	 * Step 19. Check that the timestamps didn't change.
	 */
	el = ldb_msg_find_element(msg, "dnsRecord");
	torture_assert_not_null(tctx, el, "el");
	torture_assert_int_equal(tctx, el->num_values,
				 testdata->num_records,
				 "num_values != num_records");

	for (i = 0; i < el->num_values; i++) {
		struct dnsp_DnssrvRpcRecord rec;
		ret = ndr_pull_struct_blob(
			&(el->values[i]),
			msg,
			&rec,
			(ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
		torture_assert_ndr_success(tctx, ret, "failed to pull record");
		torture_assertf(
			tctx,
			rec.dwTimeStamp == 10000 + i,
			"record[%zu] timestamp should not be altered.\n",
			i);
	}


	/*
	 * Step 20. Delete all the records, 1 by 1.
	 *
	 */
	torture_comment(tctx, "step 20: delete the records\n");

	for (i = 0; i < testdata->num_records; i++) {
		struct test_expected_record r = testdata->records[i];

		ret = dlz_newversion(domain, dbdata, &version);
		torture_assert_int_equal(tctx, ret, ISC_R_SUCCESS,
					 "Failed to start transaction");

		ret = dlz_subrdataset(name, r.rdata, dbdata, version);
		torture_assert_int_equal_goto(
			tctx, ret, ISC_R_SUCCESS, ok,
			cancel_version,
			talloc_asprintf(tctx,
					"Failed to delete record %zu «%s»\n",
					i, r.rdata));

		dlz_closeversion(domain, true, dbdata, &version);

		testdata->num_rr = 0;

		ret = dlz_lookup(domain, testdata->query_name, dbdata,
				 (dns_sdlzlookup_t *)testdata, NULL, NULL);

		if (i ==  testdata->num_records - 1) {
			torture_assert_int_equal(tctx, ret,
						 ISC_R_NOTFOUND,
						 "no records should exist");
		} else {
			torture_assert_int_equal(tctx, ret,
						 ISC_R_SUCCESS,
						 "records not found");
		}

		torture_assert_int_equal(tctx,
					 testdata->num_rr,
					 testdata->num_records - 1 - i,
					 "Got wrong record count");

		for (j = 0; j < testdata->num_records; j++) {
			struct test_expected_record *r2 = &testdata->records[j];
			if (j > i) {
				torture_assert(
					tctx,
					r2->printed,
					talloc_asprintf(tctx,
					    "putrr callback not run on %s «%s»",
							r2->type, r2->name));
			} else {
				torture_assert(
					tctx,
					! r2->printed,
					talloc_asprintf(tctx,
					    "putrr callback should not see  %s «%s»",
							r2->type, r2->name));
			}
			r2->printed = false;
		}
	}

	dlz_destroy(dbdata);

	return true;

cancel_version:
	DBG_ERR("exiting with %d\n", ret);
	dlz_closeversion(domain, false, dbdata, &version);
	return ret;
}


static struct torture_suite *dlz_bind9_suite(TALLOC_CTX *ctx)
{
	struct torture_suite *suite = torture_suite_create(ctx, "dlz_bind9");

	suite->description = talloc_strdup(suite,
	                                   "Tests for the BIND 9 DLZ module");
	torture_suite_add_simple_test(suite, "version", test_dlz_bind9_version);
	torture_suite_add_simple_test(suite, "create", test_dlz_bind9_create);
	torture_suite_add_simple_test(suite, "configure", test_dlz_bind9_configure);
	torture_suite_add_simple_test(suite, "destroyoldestfirst",
				      test_dlz_bind9_destroy_oldest_first);
	torture_suite_add_simple_test(suite, "destroynewestfirst",
				      test_dlz_bind9_destroy_newest_first);
	torture_suite_add_simple_test(suite, "multipleconfigure",
				      test_dlz_bind9_multiple_configure);

	torture_suite_add_simple_test(suite, "gssapi", test_dlz_bind9_gssapi);
	torture_suite_add_simple_test(suite, "spnego", test_dlz_bind9_spnego);
	torture_suite_add_simple_test(suite, "lookup", test_dlz_bind9_lookup);
	torture_suite_add_simple_test(suite, "zonedump", test_dlz_bind9_zonedump);
	torture_suite_add_simple_test(suite, "update01", test_dlz_bind9_update01);
	torture_suite_add_simple_test(suite, "aging", test_dlz_bind9_aging);
	torture_suite_add_simple_test(suite, "allowzonexfr", test_dlz_bind9_allowzonexfr);
	return suite;
}

/**
 * DNS torture module initialization
 */
NTSTATUS torture_bind_dns_init(TALLOC_CTX *);
NTSTATUS torture_bind_dns_init(TALLOC_CTX *ctx)
{
	struct torture_suite *suite;

	/* register DNS related test cases */
	suite = dlz_bind9_suite(ctx);
	if (!suite) return NT_STATUS_NO_MEMORY;
	torture_register_suite(ctx, suite);

	return NT_STATUS_OK;
}