4 Copyright (C) Simo Sorce 2006-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
6 Copyright (C) Stefan Metzmacher 2009
7 Copyright (C) Matthias Dieter Wallnöfer 2010
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU Lesser General Public
20 License along with this library; if not, see <http://www.gnu.org/licenses/>.
26 * Component: objectclass attribute checking module
28 * Description: this checks the attributes on a directory entry (if they're
29 * allowed, if the syntax is correct, if mandatory ones are missing,
30 * denies the deletion of mandatory ones...). The module contains portions
31 * of the "objectclass" and the "validate_update" LDB module.
33 * Author: Matthias Dieter Wallnöfer
37 #include "ldb_module.h"
38 #include "dsdb/samdb/samdb.h"
42 struct ldb_module *module;
43 struct ldb_request *req;
44 const struct dsdb_schema *schema;
46 struct ldb_reply *search_res;
47 struct ldb_reply *mod_ares;
50 static struct oc_context *oc_init_context(struct ldb_module *module,
51 struct ldb_request *req)
53 struct ldb_context *ldb;
54 struct oc_context *ac;
56 ldb = ldb_module_get_ctx(module);
58 ac = talloc_zero(req, struct oc_context);
66 ac->schema = dsdb_get_schema(ldb, ac);
71 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares);
73 static int attr_handler(struct oc_context *ac)
75 struct ldb_context *ldb;
76 struct ldb_message *msg;
77 struct ldb_request *child_req;
78 const struct dsdb_attribute *attr;
82 struct dsdb_syntax_ctx syntax_ctx;
84 ldb = ldb_module_get_ctx(ac->module);
86 if (ac->req->operation == LDB_ADD) {
87 msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
89 msg = ldb_msg_copy_shallow(ac, ac->req->op.mod.message);
95 /* initialize syntax checking context */
96 dsdb_syntax_ctx_init(&syntax_ctx, ldb, ac->schema);
98 /* Check if attributes exist in the schema, if the values match,
99 * if they're not operational and fix the names to the match the schema
101 for (i = 0; i < msg->num_elements; i++) {
102 attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
103 msg->elements[i].name);
105 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' was not found in the schema!",
106 msg->elements[i].name,
107 ldb_dn_get_linearized(msg->dn));
108 return LDB_ERR_NO_SUCH_ATTRIBUTE;
111 if ((attr->linkID & 1) == 1) {
112 /* Odd is for the target. Illegal to modify */
113 ldb_asprintf_errstring(ldb,
114 "objectclass_attrs: attribute '%s' on entry '%s' must not be modified directly, it is a linked attribute",
115 msg->elements[i].name,
116 ldb_dn_get_linearized(msg->dn));
117 return LDB_ERR_UNWILLING_TO_PERFORM;
120 if (!(msg->elements[i].flags & LDB_FLAG_INTERNAL_DISABLE_VALIDATION)) {
121 werr = attr->syntax->validate_ldb(&syntax_ctx, attr,
123 if (!W_ERROR_IS_OK(werr)) {
124 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' contains at least one invalid value!",
125 msg->elements[i].name,
126 ldb_dn_get_linearized(msg->dn));
127 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
131 if ((attr->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED) != 0) {
132 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' is constructed!",
133 msg->elements[i].name,
134 ldb_dn_get_linearized(msg->dn));
135 if (ac->req->operation == LDB_ADD) {
136 return LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE;
138 return LDB_ERR_CONSTRAINT_VIOLATION;
142 /* "description" on AD is very special: it's nearly single-
143 * valued (only on add operations it isn't). */
144 if ((ac->req->operation == LDB_MODIFY) &&
145 (ldb_attr_cmp(attr->lDAPDisplayName, "description") == 0)) {
146 /* Multi-valued add or replace operations are always
148 if ((LDB_FLAG_MOD_TYPE(msg->elements[i].flags)
149 != LDB_FLAG_MOD_DELETE) &&
150 (msg->elements[i].num_values > 1)) {
151 ldb_asprintf_errstring(ldb,
152 "objectclass_attrs: attribute '%s' on entry '%s' is changed using a multi-valued add or replace operation!",
153 msg->elements[i].name,
154 ldb_dn_get_linearized(msg->dn));
155 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
158 /* Add operations are only allowed if no value exists */
159 if (LDB_FLAG_MOD_TYPE(msg->elements[i].flags)
160 == LDB_FLAG_MOD_ADD) {
161 const char *attrs[] = { attr->lDAPDisplayName,
163 struct ldb_result *res;
164 struct ldb_message_element *el;
166 ret = ldb_search(ldb, ac, &res, msg->dn,
167 LDB_SCOPE_BASE, attrs, NULL);
168 if (ret != LDB_SUCCESS) {
172 el = ldb_msg_find_element(res->msgs[0],
173 attr->lDAPDisplayName);
175 ldb_asprintf_errstring(ldb,
176 "objectclass_attrs: attribute '%s' on entry '%s' is changed using an add operation, but there a value already exists!",
177 msg->elements[i].name,
178 ldb_dn_get_linearized(msg->dn));
179 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
185 /* Substitute the attribute name to match in case */
186 msg->elements[i].name = attr->lDAPDisplayName;
189 if (ac->req->operation == LDB_ADD) {
190 ret = ldb_build_add_req(&child_req, ldb, ac,
191 msg, ac->req->controls,
192 ac, oc_op_callback, ac->req);
193 LDB_REQ_SET_LOCATION(child_req);
195 ret = ldb_build_mod_req(&child_req, ldb, ac,
196 msg, ac->req->controls,
197 ac, oc_op_callback, ac->req);
198 LDB_REQ_SET_LOCATION(child_req);
200 if (ret != LDB_SUCCESS) {
204 return ldb_next_request(ac->module, child_req);
208 these are attributes which are left over from old ways of doing
209 things in ldb, and are harmless
211 static const char *harmless_attrs[] = { "parentGUID", NULL };
213 static int attr_handler2(struct oc_context *ac)
215 struct ldb_context *ldb;
216 struct ldb_message_element *oc_element;
217 struct ldb_message *msg;
218 const char **must_contain, **may_contain, **found_must_contain;
219 const struct dsdb_attribute *attr;
223 ldb = ldb_module_get_ctx(ac->module);
225 if (ac->search_res == NULL) {
226 return ldb_operr(ldb);
229 /* We rely here on the preceding "objectclass" LDB module which did
230 * already fix up the objectclass list (inheritance, order...). */
231 oc_element = ldb_msg_find_element(ac->search_res->message,
233 if (oc_element == NULL) {
234 return ldb_operr(ldb);
237 must_contain = dsdb_full_attribute_list(ac, ac->schema, oc_element,
238 DSDB_SCHEMA_ALL_MUST);
239 may_contain = dsdb_full_attribute_list(ac, ac->schema, oc_element,
240 DSDB_SCHEMA_ALL_MAY);
241 found_must_contain = const_str_list(str_list_copy(ac, must_contain));
242 if ((must_contain == NULL) || (may_contain == NULL)
243 || (found_must_contain == NULL)) {
244 return ldb_operr(ldb);
247 /* Check if all specified attributes are valid in the given
248 * objectclasses and if they meet additional schema restrictions. */
249 msg = ac->search_res->message;
250 for (i = 0; i < msg->num_elements; i++) {
251 attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
252 msg->elements[i].name);
254 return ldb_operr(ldb);
257 /* Check if they're single-valued if this is requested */
258 if ((msg->elements[i].num_values > 1) && (attr->isSingleValued)) {
259 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' is single-valued!",
260 msg->elements[i].name,
261 ldb_dn_get_linearized(msg->dn));
262 if (ac->req->operation == LDB_ADD) {
263 return LDB_ERR_CONSTRAINT_VIOLATION;
265 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
269 /* We can use "str_list_check" with "strcmp" here since the
270 * attribute informations from the schema are always equal
272 found = str_list_check(must_contain, attr->lDAPDisplayName);
274 str_list_remove(found_must_contain, attr->lDAPDisplayName);
276 found = str_list_check(may_contain, attr->lDAPDisplayName);
279 found = str_list_check(harmless_attrs, attr->lDAPDisplayName);
282 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' does not exist in the specified objectclasses!",
283 msg->elements[i].name,
284 ldb_dn_get_linearized(msg->dn));
285 return LDB_ERR_OBJECT_CLASS_VIOLATION;
289 if (found_must_contain[0] != NULL) {
290 ldb_asprintf_errstring(ldb, "objectclass_attrs: at least one mandatory attribute ('%s') on entry '%s' wasn't specified!",
291 found_must_contain[0],
292 ldb_dn_get_linearized(msg->dn));
293 return LDB_ERR_OBJECT_CLASS_VIOLATION;
296 return ldb_module_done(ac->req, ac->mod_ares->controls,
297 ac->mod_ares->response, LDB_SUCCESS);
300 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
302 struct ldb_context *ldb;
303 struct oc_context *ac;
306 ac = talloc_get_type(req->context, struct oc_context);
307 ldb = ldb_module_get_ctx(ac->module);
310 return ldb_module_done(ac->req, NULL, NULL,
311 LDB_ERR_OPERATIONS_ERROR);
313 if (ares->error != LDB_SUCCESS) {
314 return ldb_module_done(ac->req, ares->controls,
315 ares->response, ares->error);
318 ldb_reset_err_string(ldb);
320 switch (ares->type) {
321 case LDB_REPLY_ENTRY:
322 if (ac->search_res != NULL) {
323 ldb_set_errstring(ldb, "Too many results");
325 return ldb_module_done(ac->req, NULL, NULL,
326 LDB_ERR_OPERATIONS_ERROR);
329 ac->search_res = talloc_steal(ac, ares);
332 case LDB_REPLY_REFERRAL:
339 ret = attr_handler2(ac);
340 if (ret != LDB_SUCCESS) {
341 return ldb_module_done(ac->req, NULL, NULL, ret);
349 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
351 struct oc_context *ac;
352 struct ldb_context *ldb;
353 struct ldb_request *search_req;
354 struct ldb_dn *base_dn;
357 ac = talloc_get_type(req->context, struct oc_context);
358 ldb = ldb_module_get_ctx(ac->module);
361 return ldb_module_done(ac->req, NULL, NULL,
362 LDB_ERR_OPERATIONS_ERROR);
365 if (ares->type == LDB_REPLY_REFERRAL) {
366 return ldb_module_send_referral(ac->req, ares->referral);
369 if (ares->error != LDB_SUCCESS) {
370 return ldb_module_done(ac->req, ares->controls, ares->response,
374 if (ares->type != LDB_REPLY_DONE) {
376 return ldb_module_done(ac->req, NULL, NULL,
377 LDB_ERR_OPERATIONS_ERROR);
380 ac->search_res = NULL;
381 ac->mod_ares = talloc_steal(ac, ares);
383 /* This looks up all attributes of our just added/modified entry */
384 base_dn = ac->req->operation == LDB_ADD ? ac->req->op.add.message->dn
385 : ac->req->op.mod.message->dn;
386 ret = ldb_build_search_req(&search_req, ldb, ac, base_dn,
387 LDB_SCOPE_BASE, "(objectClass=*)",
389 get_search_callback, ac->req);
390 LDB_REQ_SET_LOCATION(search_req);
391 if (ret != LDB_SUCCESS) {
392 return ldb_module_done(ac->req, NULL, NULL, ret);
395 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
397 if (ret != LDB_SUCCESS) {
398 return ldb_module_done(ac->req, NULL, NULL, ret);
401 ret = ldb_next_request(ac->module, search_req);
402 if (ret != LDB_SUCCESS) {
403 return ldb_module_done(ac->req, NULL, NULL, ret);
406 /* "ldb_module_done" isn't called here since we need to do additional
407 * checks. It is called at the end of "attr_handler2". */
411 static int objectclass_attrs_add(struct ldb_module *module,
412 struct ldb_request *req)
414 struct ldb_context *ldb;
415 struct oc_context *ac;
417 ldb = ldb_module_get_ctx(module);
419 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_attrs_add\n");
421 /* do not manipulate our control entries */
422 if (ldb_dn_is_special(req->op.add.message->dn)) {
423 return ldb_next_request(module, req);
426 ac = oc_init_context(module, req);
428 return ldb_operr(ldb);
431 /* without schema, there isn't much to do here */
432 if (ac->schema == NULL) {
434 return ldb_next_request(module, req);
437 return attr_handler(ac);
440 static int objectclass_attrs_modify(struct ldb_module *module,
441 struct ldb_request *req)
443 struct ldb_context *ldb;
444 struct oc_context *ac;
446 ldb = ldb_module_get_ctx(module);
448 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_attrs_modify\n");
450 /* do not manipulate our control entries */
451 if (ldb_dn_is_special(req->op.mod.message->dn)) {
452 return ldb_next_request(module, req);
455 ac = oc_init_context(module, req);
457 return ldb_operr(ldb);
460 /* without schema, there isn't much to do here */
461 if (ac->schema == NULL) {
463 return ldb_next_request(module, req);
466 return attr_handler(ac);
469 static const struct ldb_module_ops ldb_objectclass_attrs_module_ops = {
470 .name = "objectclass_attrs",
471 .add = objectclass_attrs_add,
472 .modify = objectclass_attrs_modify
475 int ldb_objectclass_attrs_module_init(const char *version)
477 return ldb_register_module(&ldb_objectclass_attrs_module_ops);