f26a99ed0954754de1656394d78ad2c597426c8b
[mat/samba.git] / source4 / dsdb / samdb / ldb_modules / subtree_rename.c
1 /* 
2    ldb database library
3
4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2007
5    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11    
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16    
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 /*
22  *  Name: ldb
23  *
24  *  Component: ldb subtree rename module
25  *
26  *  Description: Rename a subtree in LDB
27  *
28  *  Author: Andrew Bartlett
29  */
30
31 #include "includes.h"
32 #include <ldb.h>
33 #include <ldb_module.h>
34 #include "libds/common/flags.h"
35 #include "dsdb/samdb/samdb.h"
36
37 struct subren_msg_store {
38         struct subren_msg_store *next;
39         struct ldb_dn *olddn;
40         struct ldb_dn *newdn;
41 };
42
43 struct subtree_rename_context {
44         struct ldb_module *module;
45         struct ldb_request *req;
46
47         struct subren_msg_store *list;
48         struct subren_msg_store *current;
49 };
50
51 static struct subtree_rename_context *subren_ctx_init(struct ldb_module *module,
52                                                       struct ldb_request *req)
53 {
54         struct ldb_context *ldb;
55         struct subtree_rename_context *ac;
56
57         ldb = ldb_module_get_ctx(module);
58
59         ac = talloc_zero(req, struct subtree_rename_context);
60         if (ac == NULL) {
61                 return NULL;
62         }
63
64         ac->module = module;
65         ac->req = req;
66
67         return ac;
68 }
69
70 static int subtree_rename_next_request(struct subtree_rename_context *ac);
71
72 static int subtree_rename_callback(struct ldb_request *req,
73                                    struct ldb_reply *ares)
74 {
75         struct ldb_context *ldb;
76         struct subtree_rename_context *ac;
77         int ret;
78
79         ac = talloc_get_type(req->context, struct subtree_rename_context);
80         ldb = ldb_module_get_ctx(ac->module);
81
82         if (!ares) {
83                 return ldb_module_done(ac->req, NULL, NULL,
84                                         LDB_ERR_OPERATIONS_ERROR);
85         }
86
87         if (ares->type == LDB_REPLY_REFERRAL) {
88                 return ldb_module_send_referral(ac->req, ares->referral);
89         }
90
91         if (ares->error != LDB_SUCCESS) {
92                 return ldb_module_done(ac->req, ares->controls,
93                                         ares->response, ares->error);
94         }
95
96         if (ares->type != LDB_REPLY_DONE) {
97                 ldb_set_errstring(ldb, "Invalid reply type!\n");
98                 return ldb_module_done(ac->req, NULL, NULL,
99                                         LDB_ERR_OPERATIONS_ERROR);
100         }
101
102         if (ac->current == NULL) {
103                 /* this was the last one */
104                 return ldb_module_done(ac->req, ares->controls,
105                                         ares->response, LDB_SUCCESS);
106         }
107
108         ret = subtree_rename_next_request(ac);
109         if (ret != LDB_SUCCESS) {
110                 return ldb_module_done(ac->req, NULL, NULL, ret);
111         }
112
113         talloc_free(ares);
114         return LDB_SUCCESS;
115 }
116
117 static int subtree_rename_next_request(struct subtree_rename_context *ac)
118 {
119         struct ldb_context *ldb;
120         struct ldb_request *req;
121         int ret;
122
123         ldb = ldb_module_get_ctx(ac->module);
124
125         if (ac->current == NULL) {
126                 return ldb_operr(ldb);
127         }
128
129         ret = ldb_build_rename_req(&req, ldb, ac->current,
130                                    ac->current->olddn,
131                                    ac->current->newdn,
132                                    ac->req->controls,
133                                    ac, subtree_rename_callback,
134                                    ac->req);
135         LDB_REQ_SET_LOCATION(req);
136         if (ret != LDB_SUCCESS) {
137                 return ret;
138         }
139
140         ac->current = ac->current->next;
141
142         return ldb_next_request(ac->module, req);
143 }
144
145 static int check_constraints(struct ldb_message *msg,
146                              struct subtree_rename_context *ac,
147                              struct ldb_dn *olddn, struct ldb_dn *newdn)
148 {
149         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
150         struct ldb_dn *dn1, *dn2, *nc_root;
151         int32_t systemFlags;
152         bool move_op = false;
153         bool rename_op = false;
154         int ret;
155
156         /* Skip the checks if old and new DN are the same, or if we have the
157          * relax control specified or if the returned objects is already
158          * deleted and needs only to be moved for consistency. */
159
160         if (ldb_dn_compare(olddn, newdn) == 0) {
161                 return LDB_SUCCESS;
162         }
163         if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) != NULL) {
164                 return LDB_SUCCESS;
165         }
166         if (ldb_msg_find_attr_as_bool(msg, "isDeleted", false)) {
167                 return LDB_SUCCESS;
168         }
169
170         /* Objects under CN=System */
171
172         dn1 = ldb_dn_copy(ac, ldb_get_default_basedn(ldb));
173         if (dn1 == NULL) return ldb_oom(ldb);
174
175         if ( ! ldb_dn_add_child_fmt(dn1, "CN=System")) {
176                 talloc_free(dn1);
177                 return LDB_ERR_OPERATIONS_ERROR;
178         }
179
180         if ((ldb_dn_compare_base(dn1, olddn) == 0) &&
181             (ldb_dn_compare_base(dn1, newdn) != 0)) {
182                 talloc_free(dn1);
183                 ldb_asprintf_errstring(ldb,
184                                        "subtree_rename: Cannot move/rename %s. Objects under CN=System have to stay under it!",
185                                        ldb_dn_get_linearized(olddn));
186                 return LDB_ERR_OTHER;
187         }
188
189         talloc_free(dn1);
190
191         /* LSA objects */
192
193         if ((samdb_find_attribute(ldb, msg, "objectClass", "secret") != NULL) ||
194             (samdb_find_attribute(ldb, msg, "objectClass", "trustedDomain") != NULL)) {
195                 ldb_asprintf_errstring(ldb,
196                                        "subtree_rename: Cannot move/rename %s. It's an LSA-specific object!",
197                                        ldb_dn_get_linearized(olddn));
198                 return LDB_ERR_UNWILLING_TO_PERFORM;
199         }
200
201         /* systemFlags */
202
203         dn1 = ldb_dn_get_parent(ac, olddn);
204         if (dn1 == NULL) return ldb_oom(ldb);
205         dn2 = ldb_dn_get_parent(ac, newdn);
206         if (dn2 == NULL) return ldb_oom(ldb);
207
208         if (ldb_dn_compare(dn1, dn2) == 0) {
209                 rename_op = true;
210         } else {
211                 move_op = true;
212         }
213
214         talloc_free(dn1);
215         talloc_free(dn2);
216
217         systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
218
219         /* Fetch name context */
220
221         ret = dsdb_find_nc_root(ldb, ac, olddn, &nc_root);
222         if (ret != LDB_SUCCESS) {
223                 return ret;
224         }
225
226         if (ldb_dn_compare(nc_root, ldb_get_schema_basedn(ldb)) == 0) {
227                 if (move_op) {
228                         ldb_asprintf_errstring(ldb,
229                                                "subtree_rename: Cannot move %s within schema partition",
230                                                ldb_dn_get_linearized(olddn));
231                         return LDB_ERR_UNWILLING_TO_PERFORM;
232                 }
233                 if (rename_op &&
234                     (systemFlags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) != 0) {
235                         ldb_asprintf_errstring(ldb,
236                                                "subtree_rename: Cannot rename %s within schema partition",
237                                                ldb_dn_get_linearized(olddn));
238                         return LDB_ERR_UNWILLING_TO_PERFORM;
239                 }
240         } else if (ldb_dn_compare(nc_root, ldb_get_config_basedn(ldb)) == 0) {
241                 if (move_op &&
242                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_MOVE) == 0) {
243                         /* Here we have to do more: control the
244                          * "ALLOW_LIMITED_MOVE" flag. This means that the
245                          * grand-grand-parents of two objects have to be equal
246                          * in order to perform the move (this is used for
247                          * moving "server" objects in the "sites" container). */
248                         bool limited_move =
249                                 systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE;
250
251                         if (limited_move) {
252                                 dn1 = ldb_dn_copy(ac, olddn);
253                                 if (dn1 == NULL) return ldb_oom(ldb);
254                                 dn2 = ldb_dn_copy(ac, newdn);
255                                 if (dn2 == NULL) return ldb_oom(ldb);
256
257                                 limited_move &= ldb_dn_remove_child_components(dn1, 3);
258                                 limited_move &= ldb_dn_remove_child_components(dn2, 3);
259                                 limited_move &= ldb_dn_compare(dn1, dn2) == 0;
260
261                                 talloc_free(dn1);
262                                 talloc_free(dn2);
263                         }
264
265                         if (!limited_move) {
266                                 ldb_asprintf_errstring(ldb,
267                                                        "subtree_rename: Cannot move %s to %s in config partition",
268                                                        ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
269                                 return LDB_ERR_UNWILLING_TO_PERFORM;
270                         }
271                 }
272                 if (rename_op &&
273                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_RENAME) == 0) {
274                         ldb_asprintf_errstring(ldb,
275                                                "subtree_rename: Cannot rename %s to %s within config partition",
276                                                ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
277                         return LDB_ERR_UNWILLING_TO_PERFORM;
278                 }
279         } else if (ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) == 0) {
280                 if (move_op &&
281                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE) != 0) {
282                         ldb_asprintf_errstring(ldb,
283                                                "subtree_rename: Cannot move %s to %s - DISALLOW_MOVE set",
284                                                ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
285                         return LDB_ERR_UNWILLING_TO_PERFORM;
286                 }
287                 if (rename_op &&
288                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME) != 0) {
289                         ldb_asprintf_errstring(ldb,
290                                                        "subtree_rename: Cannot rename %s to %s - DISALLOW_RENAME set",
291                                                ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
292                         return LDB_ERR_UNWILLING_TO_PERFORM;
293                 }
294         }
295
296         talloc_free(nc_root);
297
298         return LDB_SUCCESS;
299 }
300
301 static int subtree_rename_search_callback(struct ldb_request *req,
302                                           struct ldb_reply *ares)
303 {
304         struct subren_msg_store *store;
305         struct subtree_rename_context *ac;
306         int ret;
307
308         ac = talloc_get_type(req->context, struct subtree_rename_context);
309
310         if (!ares || !ac->current) {
311                 return ldb_module_done(ac->req, NULL, NULL,
312                                         LDB_ERR_OPERATIONS_ERROR);
313         }
314         if (ares->error != LDB_SUCCESS) {
315                 return ldb_module_done(ac->req, ares->controls,
316                                         ares->response, ares->error);
317         }
318
319         switch (ares->type) {
320         case LDB_REPLY_ENTRY:
321                 if (ldb_dn_compare(ares->message->dn, ac->list->olddn) == 0) {
322                         /* this was already stored by the
323                          * subtree_rename_search() */
324
325                         ret = check_constraints(ares->message, ac,
326                                                 ac->list->olddn,
327                                                 ac->list->newdn);
328                         if (ret != LDB_SUCCESS) {
329                                 return ldb_module_done(ac->req, NULL, NULL,
330                                                        ret);
331                         }
332
333                         talloc_free(ares);
334                         return LDB_SUCCESS;
335                 }
336
337                 store = talloc_zero(ac, struct subren_msg_store);
338                 if (store == NULL) {
339                         return ldb_module_done(ac->req, NULL, NULL,
340                                                 LDB_ERR_OPERATIONS_ERROR);
341                 }
342                 ac->current->next = store;
343                 ac->current = store;
344
345                 /* the first list element contains the base for the rename */
346                 store->olddn = talloc_steal(store, ares->message->dn);
347                 store->newdn = ldb_dn_copy(store, store->olddn);
348
349                 if ( ! ldb_dn_remove_base_components(store->newdn,
350                                 ldb_dn_get_comp_num(ac->list->olddn))) {
351                         return ldb_module_done(ac->req, NULL, NULL,
352                                                 LDB_ERR_OPERATIONS_ERROR);
353                 }
354
355                 if ( ! ldb_dn_add_base(store->newdn, ac->list->newdn)) {
356                         return ldb_module_done(ac->req, NULL, NULL,
357                                                 LDB_ERR_OPERATIONS_ERROR);
358                 }
359
360                 ret = check_constraints(ares->message, ac,
361                                         store->olddn, store->newdn);
362                 if (ret != LDB_SUCCESS) {
363                         return ldb_module_done(ac->req, NULL, NULL, ret);
364                 }
365
366                 break;
367
368         case LDB_REPLY_REFERRAL:
369                 /* ignore */
370                 break;
371
372         case LDB_REPLY_DONE:
373
374                 /* rewind ac->current */
375                 ac->current = ac->list;
376
377                 /* All dns set up, start with the first one */
378                 ret = subtree_rename_next_request(ac);
379
380                 if (ret != LDB_SUCCESS) {
381                         return ldb_module_done(ac->req, NULL, NULL, ret);
382                 }
383                 break;
384         }
385
386         talloc_free(ares);
387         return LDB_SUCCESS;
388 }
389
390 /* rename */
391 static int subtree_rename(struct ldb_module *module, struct ldb_request *req)
392 {
393         struct ldb_context *ldb;
394         static const char * const attrs[] = { "objectClass", "systemFlags",
395                                               "isDeleted", NULL };
396         struct ldb_request *search_req;
397         struct subtree_rename_context *ac;
398         int ret;
399
400         if (ldb_dn_is_special(req->op.rename.olddn)) { /* do not manipulate our control entries */
401                 return ldb_next_request(module, req);
402         }
403
404         ldb = ldb_module_get_ctx(module);
405
406         /* This gets complex:  We need to:
407            - Do a search for all entires under this entry 
408            - Wait for these results to appear
409            - In the callback for each result, issue a modify request
410            - That will include this rename, we hope
411            - Wait for each modify result
412            - Regain our sanity
413         */
414
415         ac = subren_ctx_init(module, req);
416         if (!ac) {
417                 return ldb_oom(ldb);
418         }
419
420         /* add this entry as the first to do */
421         ac->current = talloc_zero(ac, struct subren_msg_store);
422         if (ac->current == NULL) {
423                 return ldb_oom(ldb);
424         }
425         ac->current->olddn = req->op.rename.olddn;
426         ac->current->newdn = req->op.rename.newdn;
427         ac->list = ac->current;
428
429         ret = ldb_build_search_req(&search_req, ldb, ac,
430                                    req->op.rename.olddn, 
431                                    LDB_SCOPE_SUBTREE,
432                                    "(objectClass=*)",
433                                    attrs,
434                                    NULL,
435                                    ac, 
436                                    subtree_rename_search_callback,
437                                    req);
438         LDB_REQ_SET_LOCATION(search_req);
439         if (ret != LDB_SUCCESS) {
440                 return ret;
441         }
442
443         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
444                                       true, NULL);
445         if (ret != LDB_SUCCESS) {
446                 return ret;
447         }
448
449         return ldb_next_request(module, search_req);
450 }
451
452 static const struct ldb_module_ops ldb_subtree_rename_module_ops = {
453         .name              = "subtree_rename",
454         .rename            = subtree_rename
455 };
456
457 int ldb_subtree_rename_module_init(const char *version)
458 {
459         LDB_MODULE_CHECK_VERSION(version);
460         return ldb_register_module(&ldb_subtree_rename_module_ops);
461 }