source4/dsdb/samdb/ldb_modules/objectclass.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Simo Sorce  2006-2008
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
   6    Copyright (C) Matthias Dieter Wallnöfer 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23  *  Name: ldb
  24  *
  25  *  Component: objectClass sorting and constraint checking module
  26  *
  27  *  Description:
  28  *  - sort the objectClass attribute into the class
  29  *    hierarchy and perform constraint checks (correct RDN name,
  30  *    valid parent),
  31  *  - fix DNs into 'standard' case
  32  *  - Add objectCategory and some other attribute defaults
  33  *
  34  *  Author: Andrew Bartlett
  35  */
  36
  37
  38 #include "includes.h"
  39 #include "ldb_module.h"
  40 #include "util/dlinklist.h"
  41 #include "dsdb/samdb/samdb.h"
  42 #include "librpc/ndr/libndr.h"
  43 #include "librpc/gen_ndr/ndr_security.h"
  44 #include "libcli/security/security.h"
  45 #include "auth/auth.h"
  46 #include "param/param.h"
  47 #include "../libds/common/flags.h"
  48 #include "dsdb/samdb/ldb_modules/schema.h"
  49 #include "util.h"
  50
  51 struct oc_context {
  52
  53         struct ldb_module *module;
  54         struct ldb_request *req;
  55         const struct dsdb_schema *schema;
  56
  57         struct ldb_reply *search_res;
  58         struct ldb_reply *search_res2;
  59
  60         int (*step_fn)(struct oc_context *);
  61 };
  62
  63 struct class_list {
  64         struct class_list *prev, *next;
  65         const struct dsdb_class *objectclass;
  66 };
  67
  68 static struct oc_context *oc_init_context(struct ldb_module *module,
  69                                           struct ldb_request *req)
  70 {
  71         struct ldb_context *ldb;
  72         struct oc_context *ac;
  73
  74         ldb = ldb_module_get_ctx(module);
  75
  76         ac = talloc_zero(req, struct oc_context);
  77         if (ac == NULL) {
  78                 ldb_oom(ldb);
  79                 return NULL;
  80         }
  81
  82         ac->module = module;
  83         ac->req = req;
  84         ac->schema = dsdb_get_schema(ldb, ac);
  85
  86         return ac;
  87 }
  88
  89 static int objectclass_do_add(struct oc_context *ac);
  90
  91 /* Sort objectClasses into correct order, and validate that all
  92  * objectClasses specified actually exist in the schema
  93  */
  94
  95 static int objectclass_sort(struct ldb_module *module,
  96                             const struct dsdb_schema *schema,
  97                             TALLOC_CTX *mem_ctx,
  98                             struct ldb_message_element *objectclass_element,
  99                             struct class_list **sorted_out)
 100 {
 101         struct ldb_context *ldb;
 102         unsigned int i, lowest;
 103         struct class_list *unsorted = NULL, *sorted = NULL, *current = NULL, *poss_parent = NULL, *new_parent = NULL, *current_lowest = NULL;
 104
 105         ldb = ldb_module_get_ctx(module);
 106
 107         /* DESIGN:
 108          *
 109          * We work on 4 different 'bins' (implemented here as linked lists):
 110          *
 111          * * sorted:       the eventual list, in the order we wish to push
 112          *                 into the database.  This is the only ordered list.
 113          *
 114          * * parent_class: The current parent class 'bin' we are
 115          *                 trying to find subclasses for
 116          *
 117          * * subclass:     The subclasses we have found so far
 118          *
 119          * * unsorted:     The remaining objectClasses
 120          *
 121          * The process is a matter of filtering objectClasses up from
 122          * unsorted into sorted.  Order is irrelevent in the later 3 'bins'.
 123          *
 124          * We start with 'top' (found and promoted to parent_class
 125          * initially).  Then we find (in unsorted) all the direct
 126          * subclasses of 'top'.  parent_classes is concatenated onto
 127          * the end of 'sorted', and subclass becomes the list in
 128          * parent_class.
 129          *
 130          * We then repeat, until we find no more subclasses.  Any left
 131          * over classes are added to the end.
 132          *
 133          */
 134
 135         /* Firstly, dump all the objectClass elements into the
 136          * unsorted bin, except for 'top', which is special */
 137         for (i=0; i < objectclass_element->num_values; i++) {
 138                 current = talloc(mem_ctx, struct class_list);
 139                 if (!current) {
 140                         return ldb_oom(ldb);
 141                 }
 142                 current->objectclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &objectclass_element->values[i]);
 143                 if (!current->objectclass) {
 144                         ldb_asprintf_errstring(ldb, "objectclass %.*s is not a valid objectClass in schema",
 145                                                (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
 146                         /* This looks weird, but windows apparently returns this for invalid objectClass values */
 147                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 148                 } else if (current->objectclass->isDefunct) {
 149                         ldb_asprintf_errstring(ldb, "objectclass %.*s marked as isDefunct objectClass in schema - not valid for new objects",
 150                                                (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
 151                         /* This looks weird, but windows apparently returns this for invalid objectClass values */
 152                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 153                 }
 154
 155                 /* Don't add top to list, we will do that later */
 156                 if (ldb_attr_cmp("top", current->objectclass->lDAPDisplayName) != 0) {
 157                         DLIST_ADD_END(unsorted, current, struct class_list *);
 158                 }
 159         }
 160
 161         /* Add top here, to prevent duplicates */
 162         current = talloc(mem_ctx, struct class_list);
 163         current->objectclass = dsdb_class_by_lDAPDisplayName(schema, "top");
 164         DLIST_ADD_END(sorted, current, struct class_list *);
 165
 166
 167         /* For each object:  find parent chain */
 168         for (current = unsorted; schema && current; current = current->next) {
 169                 for (poss_parent = unsorted; poss_parent; poss_parent = poss_parent->next) {
 170                         if (ldb_attr_cmp(poss_parent->objectclass->lDAPDisplayName, current->objectclass->subClassOf) == 0) {
 171                                 break;
 172                         }
 173                 }
 174                 /* If we didn't get to the end of the list, we need to add this parent */
 175                 if (poss_parent || (ldb_attr_cmp("top", current->objectclass->subClassOf) == 0)) {
 176                         continue;
 177                 }
 178
 179                 new_parent = talloc(mem_ctx, struct class_list);
 180                 new_parent->objectclass = dsdb_class_by_lDAPDisplayName(schema, current->objectclass->subClassOf);
 181                 DLIST_ADD_END(unsorted, new_parent, struct class_list *);
 182         }
 183
 184         do
 185         {
 186                 lowest = UINT_MAX;
 187                 current_lowest = NULL;
 188                 for (current = unsorted; schema && current; current = current->next) {
 189                         if(current->objectclass->subClass_order < lowest) {
 190                                 current_lowest = current;
 191                                 lowest = current->objectclass->subClass_order;
 192                         }
 193                 }
 194
 195                 if(current_lowest != NULL) {
 196                         DLIST_REMOVE(unsorted,current_lowest);
 197                         DLIST_ADD_END(sorted,current_lowest, struct class_list *);
 198                 }
 199         } while(unsorted);
 200
 201
 202         if (!unsorted) {
 203                 *sorted_out = sorted;
 204                 return LDB_SUCCESS;
 205         }
 206
 207         if (!schema) {
 208                 /* If we don't have schema yet, then just merge the lists again */
 209                 DLIST_CONCATENATE(sorted, unsorted, struct class_list *);
 210                 *sorted_out = sorted;
 211                 return LDB_SUCCESS;
 212         }
 213
 214         /* This shouldn't happen, and would break MMC, perhaps there
 215          * was no 'top', a conflict in the objectClasses or some other
 216          * schema error?
 217          */
 218         ldb_asprintf_errstring(ldb, "objectclass %s is not a valid objectClass in objectClass chain", unsorted->objectclass->lDAPDisplayName);
 219         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 220 }
 221
 222 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
 223 {
 224         struct ldb_context *ldb;
 225         struct oc_context *ac;
 226         int ret;
 227
 228         ac = talloc_get_type(req->context, struct oc_context);
 229         ldb = ldb_module_get_ctx(ac->module);
 230
 231         if (!ares) {
 232                 return ldb_module_done(ac->req, NULL, NULL,
 233                                         LDB_ERR_OPERATIONS_ERROR);
 234         }
 235         if (ares->error != LDB_SUCCESS &&
 236             ares->error != LDB_ERR_NO_SUCH_OBJECT) {
 237                 return ldb_module_done(ac->req, ares->controls,
 238                                         ares->response, ares->error);
 239         }
 240
 241         ldb_reset_err_string(ldb);
 242
 243         switch (ares->type) {
 244         case LDB_REPLY_ENTRY:
 245                 if (ac->search_res != NULL) {
 246                         ldb_set_errstring(ldb, "Too many results");
 247                         talloc_free(ares);
 248                         return ldb_module_done(ac->req, NULL, NULL,
 249                                                 LDB_ERR_OPERATIONS_ERROR);
 250                 }
 251
 252                 ac->search_res = talloc_steal(ac, ares);
 253                 break;
 254
 255         case LDB_REPLY_REFERRAL:
 256                 /* ignore */
 257                 talloc_free(ares);
 258                 break;
 259
 260         case LDB_REPLY_DONE:
 261                 talloc_free(ares);
 262                 ret = ac->step_fn(ac);
 263                 if (ret != LDB_SUCCESS) {
 264                         return ldb_module_done(ac->req, NULL, NULL, ret);
 265                 }
 266                 break;
 267         }
 268
 269         return LDB_SUCCESS;
 270 }
 271
 272 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
 273 {
 274         struct oc_context *ac;
 275
 276         ac = talloc_get_type(req->context, struct oc_context);
 277
 278         if (!ares) {
 279                 return ldb_module_done(ac->req, NULL, NULL,
 280                                         LDB_ERR_OPERATIONS_ERROR);
 281         }
 282
 283         if (ares->type == LDB_REPLY_REFERRAL) {
 284                 return ldb_module_send_referral(ac->req, ares->referral);
 285         }
 286
 287         if (ares->error != LDB_SUCCESS) {
 288                 return ldb_module_done(ac->req, ares->controls,
 289                                         ares->response, ares->error);
 290         }
 291
 292         if (ares->type != LDB_REPLY_DONE) {
 293                 talloc_free(ares);
 294                 return ldb_module_done(ac->req, NULL, NULL,
 295                                         LDB_ERR_OPERATIONS_ERROR);
 296         }
 297
 298         return ldb_module_done(ac->req, ares->controls,
 299                                 ares->response, ares->error);
 300 }
 301
 302 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN
 303
 304    This should mean that if the parent is:
 305     CN=Users,DC=samba,DC=example,DC=com
 306    and a proposed child is
 307     cn=Admins ,cn=USERS,dc=Samba,dc=example,dc=COM
 308
 309    The resulting DN should be:
 310
 311     CN=Admins,CN=Users,DC=samba,DC=example,DC=com
 312
 313  */
 314 static int fix_dn(struct ldb_context *ldb,
 315                   TALLOC_CTX *mem_ctx,
 316                   struct ldb_dn *newdn, struct ldb_dn *parent_dn,
 317                   struct ldb_dn **fixed_dn)
 318 {
 319         char *upper_rdn_attr;
 320         const struct ldb_val *rdn_val;
 321
 322         /* Fix up the DN to be in the standard form, taking particular care to match the parent DN */
 323         *fixed_dn = ldb_dn_copy(mem_ctx, parent_dn);
 324
 325         /* We need the attribute name in upper case */
 326         upper_rdn_attr = strupper_talloc(*fixed_dn,
 327                                          ldb_dn_get_rdn_name(newdn));
 328         if (!upper_rdn_attr) {
 329                 return ldb_operr(ldb);
 330         }
 331
 332         /* Create a new child */
 333         if (ldb_dn_add_child_fmt(*fixed_dn, "X=X") == false) {
 334                 return ldb_operr(ldb);
 335         }
 336
 337         rdn_val = ldb_dn_get_rdn_val(newdn);
 338         if (rdn_val == NULL) {
 339                 return ldb_operr(ldb);
 340         }
 341
 342 #if 0
 343         /* the rules for rDN length constraints are more complex than
 344         this. Until we understand them we need to leave this
 345         constraint out. Otherwise we break replication, as windows
 346         does sometimes send us rDNs longer than 64 */
 347         if (!rdn_val || rdn_val->length > 64) {
 348                 DEBUG(2,(__location__ ": WARNING: rDN longer than 64 limit for '%s'\n", ldb_dn_get_linearized(newdn)));
 349         }
 350 #endif
 351
 352
 353         /* And replace it with CN=foo (we need the attribute in upper case */
 354         return ldb_dn_set_component(*fixed_dn, 0, upper_rdn_attr, *rdn_val);
 355 }
 356
 357
 358 static int objectclass_do_add(struct oc_context *ac);
 359
 360 static int objectclass_add(struct ldb_module *module, struct ldb_request *req)
 361 {
 362         struct ldb_context *ldb;
 363         struct ldb_request *search_req;
 364         struct oc_context *ac;
 365         struct ldb_dn *parent_dn;
 366         const struct ldb_val *val;
 367         char *value;
 368         int ret;
 369         static const char * const parent_attrs[] = { "objectClass", NULL };
 370
 371         ldb = ldb_module_get_ctx(module);
 372
 373         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_add\n");
 374
 375         /* do not manipulate our control entries */
 376         if (ldb_dn_is_special(req->op.add.message->dn)) {
 377                 return ldb_next_request(module, req);
 378         }
 379
 380         /* An add operation on the basedn without "NC-add" operation isn't
 381          * allowed. */
 382         if (ldb_dn_compare(ldb_get_default_basedn(ldb), req->op.add.message->dn) == 0) {
 383                 unsigned int instanceType;
 384
 385                 instanceType = ldb_msg_find_attr_as_uint(req->op.add.message,
 386                                                          "instanceType", 0);
 387                 if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
 388                         /* When we are trying to readd the root basedn then
 389                          * this is denied, but with an interesting mechanism:
 390                          * there is generated a referral with the last
 391                          * component value as hostname. */
 392                         val = ldb_dn_get_component_val(req->op.add.message->dn,
 393                                                        ldb_dn_get_comp_num(req->op.add.message->dn) - 1);
 394                         if (val == NULL) {
 395                                 return ldb_operr(ldb);
 396                         }
 397                         value = talloc_asprintf(req, "ldap://%s/%s", val->data,
 398                                                 ldb_dn_get_linearized(req->op.add.message->dn));
 399                         if (value == NULL) {
 400                                 return ldb_oom(ldb);
 401                         }
 402
 403                         return ldb_module_send_referral(req, value);
 404                 }
 405         }
 406
 407         ac = oc_init_context(module, req);
 408         if (ac == NULL) {
 409                 return ldb_operr(ldb);
 410         }
 411
 412         /* If there isn't a parent, just go on to the add processing */
 413         if (ldb_dn_get_comp_num(ac->req->op.add.message->dn) == 1) {
 414                 return objectclass_do_add(ac);
 415         }
 416
 417         /* get copy of parent DN */
 418         parent_dn = ldb_dn_get_parent(ac, ac->req->op.add.message->dn);
 419         if (parent_dn == NULL) {
 420                 return ldb_oom(ldb);
 421         }
 422
 423         ret = ldb_build_search_req(&search_req, ldb,
 424                                    ac, parent_dn, LDB_SCOPE_BASE,
 425                                    "(objectClass=*)", parent_attrs,
 426                                    NULL,
 427                                    ac, get_search_callback,
 428                                    req);
 429         LDB_REQ_SET_LOCATION(search_req);
 430         if (ret != LDB_SUCCESS) {
 431                 return ret;
 432         }
 433
 434         ac->step_fn = objectclass_do_add;
 435
 436         return ldb_next_request(ac->module, search_req);
 437 }
 438
 439
 440 /*
 441   check if this is a special RODC nTDSDSA add
 442  */
 443 static bool check_rodc_ntdsdsa_add(struct oc_context *ac,
 444                                    const struct dsdb_class *objectclass)
 445 {
 446         struct ldb_control *rodc_control;
 447
 448         if (strcasecmp(objectclass->lDAPDisplayName, "nTDSDSA") != 0) {
 449                 return false;
 450         }
 451         rodc_control = ldb_request_get_control(ac->req, LDB_CONTROL_RODC_DCPROMO_OID);
 452         if (!rodc_control) {
 453                 return false;
 454         }
 455
 456         rodc_control->critical = false;
 457         return true;
 458 }
 459
 460 static int objectclass_do_add(struct oc_context *ac)
 461 {
 462         struct ldb_context *ldb;
 463         struct ldb_request *add_req;
 464         struct ldb_message_element *objectclass_element, *el;
 465         struct ldb_message *msg;
 466         TALLOC_CTX *mem_ctx;
 467         struct class_list *sorted, *current;
 468         const char *rdn_name = NULL;
 469         char *value;
 470         const struct dsdb_class *objectclass;
 471         struct ldb_dn *objectcategory;
 472         int32_t systemFlags = 0;
 473         unsigned int i, j;
 474         bool found;
 475         int ret;
 476
 477         ldb = ldb_module_get_ctx(ac->module);
 478
 479         msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
 480
 481         /* Check if we have a valid parent - this check is needed since
 482          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
 483         if (ac->search_res == NULL) {
 484                 unsigned int instanceType;
 485
 486                 /* An add operation on partition DNs without "NC-add" operation
 487                  * isn't allowed. */
 488                 instanceType = ldb_msg_find_attr_as_uint(ac->req->op.add.message,
 489                                                          "instanceType", 0);
 490                 if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
 491                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, parent does not exist!",
 492                                                ldb_dn_get_linearized(msg->dn));
 493                         return LDB_ERR_NO_SUCH_OBJECT;
 494                 }
 495
 496                 /* Don't keep any error messages - we've to add a partition */
 497                 ldb_set_errstring(ldb, NULL);
 498         } else {
 499                 /* Fix up the DN to be in the standard form, taking
 500                  * particular care to match the parent DN */
 501                 ret = fix_dn(ldb, msg,
 502                              ac->req->op.add.message->dn,
 503                              ac->search_res->message->dn,
 504                              &msg->dn);
 505                 if (ret != LDB_SUCCESS) {
 506                         ldb_asprintf_errstring(ldb, "objectclass: Could not munge DN %s into normal form",
 507                                                ldb_dn_get_linearized(ac->req->op.add.message->dn));
 508                         return ret;
 509                 }
 510         }
 511
 512         mem_ctx = talloc_new(ac);
 513         if (mem_ctx == NULL) {
 514                 return ldb_oom(ldb);
 515         }
 516
 517         if (ac->schema != NULL) {
 518                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 519                 if (!objectclass_element) {
 520                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, no objectclass specified!",
 521                                                ldb_dn_get_linearized(msg->dn));
 522                         talloc_free(mem_ctx);
 523                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 524                 }
 525                 if (objectclass_element->num_values == 0) {
 526                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, at least one (structural) objectclass has to be specified!",
 527                                                ldb_dn_get_linearized(msg->dn));
 528                         talloc_free(mem_ctx);
 529                         return LDB_ERR_CONSTRAINT_VIOLATION;
 530                 }
 531
 532                 /* Here we do now get the "objectClass" list from the
 533                  * database. */
 534                 ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
 535                                        objectclass_element, &sorted);
 536                 if (ret != LDB_SUCCESS) {
 537                         talloc_free(mem_ctx);
 538                         return ret;
 539                 }
 540
 541                 ldb_msg_remove_element(msg, objectclass_element);
 542
 543                 /* Well, now we shouldn't find any additional "objectClass"
 544                  * message element (required by the AD specification). */
 545                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 546                 if (objectclass_element != NULL) {
 547                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, only one 'objectclass' attribute specification is allowed!",
 548                                                ldb_dn_get_linearized(msg->dn));
 549                         talloc_free(mem_ctx);
 550                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 551                 }
 552
 553                 /* We must completely replace the existing objectClass entry,
 554                  * because we need it sorted. */
 555                 ret = ldb_msg_add_empty(msg, "objectClass", 0, NULL);
 556                 if (ret != LDB_SUCCESS) {
 557                         talloc_free(mem_ctx);
 558                         return ret;
 559                 }
 560
 561                 /* Move from the linked list back into an ldb msg */
 562                 for (current = sorted; current; current = current->next) {
 563                         value = talloc_strdup(msg, current->objectclass->lDAPDisplayName);
 564                         if (value == NULL) {
 565                                 talloc_free(mem_ctx);
 566                                 return ldb_oom(ldb);
 567                         }
 568
 569                         ret = ldb_msg_add_string(msg, "objectClass", value);
 570                         if (ret != LDB_SUCCESS) {
 571                                 ldb_set_errstring(ldb,
 572                                                   "objectclass: could not re-add sorted "
 573                                                   "objectclass to modify msg");
 574                                 talloc_free(mem_ctx);
 575                                 return ret;
 576                         }
 577                 }
 578
 579                 talloc_free(mem_ctx);
 580
 581                 /* Retrive the message again so get_last_structural_class works */
 582                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 583
 584                 /* Make sure its valid to add an object of this type */
 585                 objectclass = get_last_structural_class(ac->schema,
 586                                                         objectclass_element);
 587                 if(objectclass == NULL) {
 588                         ldb_asprintf_errstring(ldb,
 589                                                "Failed to find a structural class for %s",
 590                                                ldb_dn_get_linearized(msg->dn));
 591                         return LDB_ERR_UNWILLING_TO_PERFORM;
 592                 }
 593
 594                 rdn_name = ldb_dn_get_rdn_name(msg->dn);
 595                 if (rdn_name == NULL) {
 596                         return ldb_operr(ldb);
 597                 }
 598                 found = false;
 599                 for (i = 0; (!found) && (i < objectclass_element->num_values);
 600                      i++) {
 601                         const struct dsdb_class *tmp_class =
 602                                 dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
 603                                                                       &objectclass_element->values[i]);
 604
 605                         if (tmp_class == NULL) continue;
 606
 607                         if (ldb_attr_cmp(rdn_name, tmp_class->rDNAttID) == 0)
 608                                 found = true;
 609                 }
 610                 if (!found) {
 611                         ldb_asprintf_errstring(ldb,
 612                                                "objectclass: Invalid RDN '%s' for objectclass '%s'!",
 613                                                rdn_name, objectclass->lDAPDisplayName);
 614                         return LDB_ERR_NAMING_VIOLATION;
 615                 }
 616
 617                 if (objectclass->systemOnly &&
 618                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
 619                     !check_rodc_ntdsdsa_add(ac, objectclass)) {
 620                         ldb_asprintf_errstring(ldb, "objectClass %s is systemOnly, rejecting creation of %s",
 621                                                 objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn));
 622                         return LDB_ERR_UNWILLING_TO_PERFORM;
 623                 }
 624
 625                 if (((strcmp(objectclass->lDAPDisplayName, "secret") == 0) ||
 626                      (strcmp(objectclass->lDAPDisplayName, "trustedDomain") == 0)) &&
 627                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
 628                         ldb_asprintf_errstring(ldb, "objectClass %s is LSA-specific, rejecting creation of %s",
 629                                                 objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn));
 630                         return LDB_ERR_UNWILLING_TO_PERFORM;
 631                 }
 632
 633                 if (ac->search_res && ac->search_res->message) {
 634                         struct ldb_message_element *oc_el
 635                                 = ldb_msg_find_element(ac->search_res->message, "objectClass");
 636
 637                         bool allowed_class = false;
 638                         for (i=0; allowed_class == false && oc_el && i < oc_el->num_values; i++) {
 639                                 const struct dsdb_class *sclass;
 640
 641                                 sclass = dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
 642                                                                                &oc_el->values[i]);
 643                                 if (!sclass) {
 644                                         /* We don't know this class?  what is going on? */
 645                                         continue;
 646                                 }
 647                                 for (j=0; sclass->systemPossibleInferiors && sclass->systemPossibleInferiors[j]; j++) {
 648                                         if (ldb_attr_cmp(objectclass->lDAPDisplayName, sclass->systemPossibleInferiors[j]) == 0) {
 649                                                 allowed_class = true;
 650                                                 break;
 651                                         }
 652                                 }
 653                         }
 654
 655                         if (!allowed_class) {
 656                                 ldb_asprintf_errstring(ldb, "structural objectClass %s is not a valid child class for %s",
 657                                                 objectclass->lDAPDisplayName, ldb_dn_get_linearized(ac->search_res->message->dn));
 658                                 return LDB_ERR_NAMING_VIOLATION;
 659                         }
 660                 }
 661
 662                 objectcategory = ldb_msg_find_attr_as_dn(ldb, ac, msg,
 663                                                          "objectCategory");
 664                 if (objectcategory == NULL) {
 665                         struct dsdb_extended_dn_store_format *dn_format =
 666                                         talloc_get_type(ldb_module_get_private(ac->module),
 667                                                         struct dsdb_extended_dn_store_format);
 668                         if (dn_format && dn_format->store_extended_dn_in_ldb == false) {
 669                                 /* Strip off extended components */
 670                                 struct ldb_dn *dn = ldb_dn_new(ac, ldb,
 671                                                                objectclass->defaultObjectCategory);
 672                                 value = ldb_dn_alloc_linearized(msg, dn);
 673                                 talloc_free(dn);
 674                         } else {
 675                                 value = talloc_strdup(msg,
 676                                                       objectclass->defaultObjectCategory);
 677                         }
 678                         if (value == NULL) {
 679                                 return ldb_oom(ldb);
 680                         }
 681
 682                         ret = ldb_msg_add_string(msg, "objectCategory", value);
 683                         if (ret != LDB_SUCCESS) {
 684                                 return ret;
 685                         }
 686                 } else {
 687                         const struct dsdb_class *ocClass =
 688                                         dsdb_class_by_cn_ldb_val(ac->schema,
 689                                                                  ldb_dn_get_rdn_val(objectcategory));
 690                         if (ocClass != NULL) {
 691                                 struct ldb_dn *dn = ldb_dn_new(ac, ldb,
 692                                                                ocClass->defaultObjectCategory);
 693                                 if (ldb_dn_compare(objectcategory, dn) != 0) {
 694                                         ocClass = NULL;
 695                                 }
 696                         }
 697                         talloc_free(objectcategory);
 698                         if (ocClass == NULL) {
 699                                 ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, 'objectCategory' attribute invalid!",
 700                                                        ldb_dn_get_linearized(msg->dn));
 701                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
 702                         }
 703                 }
 704
 705                 if (!ldb_msg_find_element(msg, "showInAdvancedViewOnly") && (objectclass->defaultHidingValue == true)) {
 706                         ldb_msg_add_string(msg, "showInAdvancedViewOnly",
 707                                                 "TRUE");
 708                 }
 709
 710                 /* There are very special rules for systemFlags, see MS-ADTS
 711                  * MS-ADTS 3.1.1.5.2.4 */
 712
 713                 el = ldb_msg_find_element(msg, "systemFlags");
 714                 if ((el != NULL) && (el->num_values > 1)) {
 715                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, 'systemFlags' attribute multivalued!",
 716                                                ldb_dn_get_linearized(msg->dn));
 717                         return LDB_ERR_CONSTRAINT_VIOLATION;
 718                 }
 719
 720                 systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
 721
 722                 ldb_msg_remove_attr(msg, "systemFlags");
 723
 724                 /* Only the following flags may be set by a client */
 725                 if (ldb_request_get_control(ac->req,
 726                                             LDB_CONTROL_RELAX_OID) == NULL) {
 727                         systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME
 728                                        | SYSTEM_FLAG_CONFIG_ALLOW_MOVE
 729                                        | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE
 730                                        | SYSTEM_FLAG_ATTR_IS_RDN );
 731                 }
 732
 733                 /* But the last one ("ATTR_IS_RDN") is only allowed on
 734                  * "attributeSchema" objects. So truncate if it does not fit. */
 735                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, "attributeSchema") != 0) {
 736                         systemFlags &= ~SYSTEM_FLAG_ATTR_IS_RDN;
 737                 }
 738
 739                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, "server") == 0) {
 740                         systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE | SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE);
 741                 } else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "site") == 0
 742                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "serversContainer") == 0
 743                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSDSA") == 0) {
 744                         systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
 745
 746                 } else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLink") == 0
 747                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLinkBridge") == 0
 748                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSConnection") == 0) {
 749                         systemFlags |= (int32_t)(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
 750                 }
 751
 752                 /* TODO: If parent object is site or subnet, also add (SYSTEM_FLAG_CONFIG_ALLOW_RENAME) */
 753
 754                 if (el || systemFlags != 0) {
 755                         ret = samdb_msg_add_int(ldb, msg, msg, "systemFlags",
 756                                                 systemFlags);
 757                         if (ret != LDB_SUCCESS) {
 758                                 return ret;
 759                         }
 760                 }
 761
 762                 /* make sure that "isCriticalSystemObject" is not specified! */
 763                 el = ldb_msg_find_element(msg, "isCriticalSystemObject");
 764                 if ((el != NULL) &&
 765                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
 766                         ldb_set_errstring(ldb,
 767                                           "objectclass: 'isCriticalSystemObject' must not be specified!");
 768                         return LDB_ERR_UNWILLING_TO_PERFORM;
 769                 }
 770         }
 771
 772         ret = ldb_msg_sanity_check(ldb, msg);
 773         if (ret != LDB_SUCCESS) {
 774                 return ret;
 775         }
 776
 777         ret = ldb_build_add_req(&add_req, ldb, ac,
 778                                 msg,
 779                                 ac->req->controls,
 780                                 ac, oc_op_callback,
 781                                 ac->req);
 782         LDB_REQ_SET_LOCATION(add_req);
 783         if (ret != LDB_SUCCESS) {
 784                 return ret;
 785         }
 786
 787         /* perform the add */
 788         return ldb_next_request(ac->module, add_req);
 789 }
 790
 791 static int oc_modify_callback(struct ldb_request *req,
 792                                 struct ldb_reply *ares);
 793 static int objectclass_do_mod(struct oc_context *ac);
 794
 795 static int objectclass_modify(struct ldb_module *module, struct ldb_request *req)
 796 {
 797         struct ldb_context *ldb = ldb_module_get_ctx(module);
 798         struct ldb_message_element *objectclass_element;
 799         struct ldb_message *msg;
 800         struct ldb_request *down_req;
 801         struct oc_context *ac;
 802         bool oc_changes = false;
 803         int ret;
 804
 805         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_modify\n");
 806
 807         /* do not manipulate our control entries */
 808         if (ldb_dn_is_special(req->op.mod.message->dn)) {
 809                 return ldb_next_request(module, req);
 810         }
 811
 812         /* As with the "real" AD we don't accept empty messages */
 813         if (req->op.mod.message->num_elements == 0) {
 814                 ldb_set_errstring(ldb, "objectclass: modify message must have "
 815                                        "elements/attributes!");
 816                 return LDB_ERR_UNWILLING_TO_PERFORM;
 817         }
 818
 819         ac = oc_init_context(module, req);
 820         if (ac == NULL) {
 821                 return ldb_operr(ldb);
 822         }
 823
 824         /* Without schema, there isn't much to do here */
 825         if (ac->schema == NULL) {
 826                 talloc_free(ac);
 827                 return ldb_next_request(module, req);
 828         }
 829
 830         msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
 831         if (msg == NULL) {
 832                 return ldb_operr(ldb);
 833         }
 834
 835         /* For now change everything except the objectclasses */
 836
 837         objectclass_element = ldb_msg_find_element(msg, "objectClass");
 838         if (objectclass_element != NULL) {
 839                 ldb_msg_remove_attr(msg, "objectClass");
 840                 oc_changes = true;
 841         }
 842
 843         /* MS-ADTS 3.1.1.5.3.5 - on a forest level < 2003 we do allow updates
 844          * only on application NCs - not on the standard DCs */
 845         if (oc_changes &&
 846             (dsdb_forest_functional_level(ldb) < DS_DOMAIN_FUNCTION_2003)) {
 847                 struct ldb_dn *nc_root;
 848
 849                 ret = dsdb_find_nc_root(ldb, ac, req->op.mod.message->dn,
 850                                         &nc_root);
 851                 if (ret != LDB_SUCCESS) {
 852                         return ret;
 853                 }
 854
 855                 if ((ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) == 0) ||
 856                     (ldb_dn_compare(nc_root, ldb_get_config_basedn(ldb)) == 0) ||
 857                     (ldb_dn_compare(nc_root, ldb_get_schema_basedn(ldb)) == 0)) {
 858                         ldb_set_errstring(ldb,
 859                                           "objectclass: object class changes on objects under the standard name contexts not allowed!");
 860                         return LDB_ERR_UNWILLING_TO_PERFORM;
 861                 }
 862
 863                 talloc_free(nc_root);
 864         }
 865
 866         ret = ldb_build_mod_req(&down_req, ldb, ac,
 867                                 msg,
 868                                 req->controls, ac,
 869                                 oc_changes ? oc_modify_callback : oc_op_callback,
 870                                 req);
 871         LDB_REQ_SET_LOCATION(down_req);
 872         if (ret != LDB_SUCCESS) {
 873                 return ret;
 874         }
 875
 876         return ldb_next_request(module, down_req);
 877 }
 878
 879 static int oc_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
 880 {
 881         static const char * const attrs[] = { "objectClass", NULL };
 882         struct ldb_context *ldb;
 883         struct ldb_request *search_req;
 884         struct oc_context *ac;
 885         int ret;
 886
 887         ac = talloc_get_type(req->context, struct oc_context);
 888         ldb = ldb_module_get_ctx(ac->module);
 889
 890         if (!ares) {
 891                 return ldb_module_done(ac->req, NULL, NULL,
 892                                         LDB_ERR_OPERATIONS_ERROR);
 893         }
 894
 895         if (ares->type == LDB_REPLY_REFERRAL) {
 896                 return ldb_module_send_referral(ac->req, ares->referral);
 897         }
 898
 899         if (ares->error != LDB_SUCCESS) {
 900                 return ldb_module_done(ac->req, ares->controls,
 901                                         ares->response, ares->error);
 902         }
 903
 904         if (ares->type != LDB_REPLY_DONE) {
 905                 talloc_free(ares);
 906                 return ldb_module_done(ac->req, NULL, NULL,
 907                                         LDB_ERR_OPERATIONS_ERROR);
 908         }
 909
 910         talloc_free(ares);
 911
 912         /* this looks up the real existing object for fetching some important
 913          * informations (objectclasses) */
 914         ret = ldb_build_search_req(&search_req, ldb,
 915                                    ac, ac->req->op.mod.message->dn,
 916                                    LDB_SCOPE_BASE,
 917                                    "(objectClass=*)",
 918                                    attrs, NULL,
 919                                    ac, get_search_callback,
 920                                    ac->req);
 921         LDB_REQ_SET_LOCATION(search_req);
 922         if (ret != LDB_SUCCESS) {
 923                 return ldb_module_done(ac->req, NULL, NULL, ret);
 924         }
 925
 926         ac->step_fn = objectclass_do_mod;
 927
 928         ret = ldb_next_request(ac->module, search_req);
 929         if (ret != LDB_SUCCESS) {
 930                 return ldb_module_done(ac->req, NULL, NULL, ret);
 931         }
 932
 933         return LDB_SUCCESS;
 934 }
 935
 936 static int objectclass_do_mod(struct oc_context *ac)
 937 {
 938         struct ldb_context *ldb;
 939         struct ldb_request *mod_req;
 940         char *value;
 941         struct ldb_message_element *oc_el_entry, *oc_el_change;
 942         struct ldb_val *vals;
 943         struct ldb_message *msg;
 944         TALLOC_CTX *mem_ctx;
 945         struct class_list *sorted, *current;
 946         const struct dsdb_class *objectclass;
 947         unsigned int i, j, k;
 948         bool found, replace = false;
 949         int ret;
 950
 951         ldb = ldb_module_get_ctx(ac->module);
 952
 953         /* we should always have a valid entry when we enter here */
 954         if (ac->search_res == NULL) {
 955                 return ldb_operr(ldb);
 956         }
 957
 958         oc_el_entry = ldb_msg_find_element(ac->search_res->message,
 959                                            "objectClass");
 960         if (oc_el_entry == NULL) {
 961                 /* existing entry without a valid object class? */
 962                 return ldb_operr(ldb);
 963         }
 964
 965         /* use a new message structure */
 966         msg = ldb_msg_new(ac);
 967         if (msg == NULL) {
 968                 return ldb_oom(ldb);
 969         }
 970
 971         msg->dn = ac->req->op.mod.message->dn;
 972
 973         mem_ctx = talloc_new(ac);
 974         if (mem_ctx == NULL) {
 975                 return ldb_oom(ldb);
 976         }
 977
 978         /* We've to walk over all "objectClass" message elements */
 979         for (k = 0; k < ac->req->op.mod.message->num_elements; k++) {
 980                 if (ldb_attr_cmp(ac->req->op.mod.message->elements[k].name,
 981                                  "objectClass") != 0) {
 982                         continue;
 983                 }
 984
 985                 oc_el_change = &ac->req->op.mod.message->elements[k];
 986
 987                 switch (oc_el_change->flags & LDB_FLAG_MOD_MASK) {
 988                 case LDB_FLAG_MOD_ADD:
 989                         /* Merge the two message elements */
 990                         for (i = 0; i < oc_el_change->num_values; i++) {
 991                                 for (j = 0; j < oc_el_entry->num_values; j++) {
 992                                         if (ldb_attr_cmp((char *)oc_el_change->values[i].data,
 993                                                          (char *)oc_el_entry->values[j].data) == 0) {
 994                                                 ldb_asprintf_errstring(ldb,
 995                                                                        "objectclass: cannot re-add an existing objectclass: '%.*s'!",
 996                                                                        (int)oc_el_change->values[i].length,
 997                                                                        (const char *)oc_el_change->values[i].data);
 998                                                 talloc_free(mem_ctx);
 999                                                 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1000                                         }
1001                                 }
1002                                 /* append the new object class value - code was
1003                                  * copied from "ldb_msg_add_value" */
1004                                 vals = talloc_realloc(oc_el_entry, oc_el_entry->values,
1005                                                       struct ldb_val,
1006                                                       oc_el_entry->num_values + 1);
1007                                 if (vals == NULL) {
1008                                         talloc_free(mem_ctx);
1009                                         return ldb_oom(ldb);
1010                                 }
1011                                 oc_el_entry->values = vals;
1012                                 oc_el_entry->values[oc_el_entry->num_values] =
1013                                                         oc_el_change->values[i];
1014                                 ++(oc_el_entry->num_values);
1015                         }
1016
1017                         objectclass = get_last_structural_class(ac->schema,
1018                                                                 oc_el_change);
1019                         if (objectclass != NULL) {
1020                                 ldb_asprintf_errstring(ldb,
1021                                                        "objectclass: cannot add a new top-most structural objectclass '%s'!",
1022                                                        objectclass->lDAPDisplayName);
1023                                 talloc_free(mem_ctx);
1024                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1025                         }
1026
1027                         /* Now do the sorting */
1028                         ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1029                                                oc_el_entry, &sorted);
1030                         if (ret != LDB_SUCCESS) {
1031                                 talloc_free(mem_ctx);
1032                                 return ret;
1033                         }
1034
1035                         break;
1036
1037                 case LDB_FLAG_MOD_REPLACE:
1038                         /* Do the sorting for the change message element */
1039                         ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1040                                                oc_el_change, &sorted);
1041                         if (ret != LDB_SUCCESS) {
1042                                 talloc_free(mem_ctx);
1043                                 return ret;
1044                         }
1045
1046                         /* this is a replace */
1047                         replace = true;
1048
1049                         break;
1050
1051                 case LDB_FLAG_MOD_DELETE:
1052                         /* get the actual top-most structural objectclass */
1053                         objectclass = get_last_structural_class(ac->schema,
1054                                                                 oc_el_entry);
1055                         if (objectclass == NULL) {
1056                                 talloc_free(mem_ctx);
1057                                 return ldb_operr(ldb);
1058                         }
1059
1060                         /* Merge the two message elements */
1061                         for (i = 0; i < oc_el_change->num_values; i++) {
1062                                 found = false;
1063                                 for (j = 0; j < oc_el_entry->num_values; j++) {
1064                                         if (ldb_attr_cmp((char *)oc_el_change->values[i].data,
1065                                                          (char *)oc_el_entry->values[j].data) == 0) {
1066                                                 found = true;
1067                                                 /* delete the object class value
1068                                                  * - code was copied from
1069                                                  * "ldb_msg_remove_element" */
1070                                                 if (j != oc_el_entry->num_values - 1) {
1071                                                         memmove(&oc_el_entry->values[j],
1072                                                                 &oc_el_entry->values[j+1],
1073                                                                 ((oc_el_entry->num_values-1) - j)*sizeof(struct ldb_val));
1074                                                 }
1075                                                 --(oc_el_entry->num_values);
1076                                                 break;
1077                                         }
1078                                 }
1079                                 if (!found) {
1080                                         /* we cannot delete a not existing
1081                                          * object class */
1082                                         ldb_asprintf_errstring(ldb,
1083                                                                "objectclass: cannot delete this objectclass: '%.*s'!",
1084                                                                (int)oc_el_change->values[i].length,
1085                                                                (const char *)oc_el_change->values[i].data);
1086                                         talloc_free(mem_ctx);
1087                                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
1088                                 }
1089                         }
1090
1091                         /* Make sure that the top-most structural object class
1092                          * hasn't been deleted */
1093                         found = false;
1094                         for (i = 0; i < oc_el_entry->num_values; i++) {
1095                                 if (ldb_attr_cmp(objectclass->lDAPDisplayName,
1096                                                  (char *)oc_el_entry->values[i].data) == 0) {
1097                                         found = true;
1098                                         break;
1099                                 }
1100                         }
1101                         if (!found) {
1102                                 ldb_asprintf_errstring(ldb,
1103                                                        "objectclass: cannot delete the top-most structural objectclass '%s'!",
1104                                                        objectclass->lDAPDisplayName);
1105                                 talloc_free(mem_ctx);
1106                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1107                         }
1108
1109                         /* Now do the sorting */
1110                         ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1111                                                oc_el_entry, &sorted);
1112                         if (ret != LDB_SUCCESS) {
1113                                 talloc_free(mem_ctx);
1114                                 return ret;
1115                         }
1116
1117                         break;
1118                 }
1119
1120                 /* (Re)-add an empty "objectClass" attribute on the object
1121                  * classes change message "msg". */
1122                 ldb_msg_remove_attr(msg, "objectClass");
1123                 ret = ldb_msg_add_empty(msg, "objectClass",
1124                                         LDB_FLAG_MOD_REPLACE, &oc_el_change);
1125                 if (ret != LDB_SUCCESS) {
1126                         talloc_free(mem_ctx);
1127                         return ldb_oom(ldb);
1128                 }
1129
1130                 /* Move from the linked list back into an ldb msg */
1131                 for (current = sorted; current; current = current->next) {
1132                         value = talloc_strdup(msg,
1133                                               current->objectclass->lDAPDisplayName);
1134                         if (value == NULL) {
1135                                 talloc_free(mem_ctx);
1136                                 return ldb_oom(ldb);
1137                         }
1138                         ret = ldb_msg_add_string(msg, "objectClass", value);
1139                         if (ret != LDB_SUCCESS) {
1140                                 ldb_set_errstring(ldb,
1141                                                   "objectclass: could not re-add sorted objectclasses!");
1142                                 talloc_free(mem_ctx);
1143                                 return ret;
1144                         }
1145                 }
1146
1147                 if (replace) {
1148                         /* Well, on replace we are nearly done: we have to test
1149                          * if the change and entry message element are identical
1150                          * ly. We can use "ldb_msg_element_compare" since now
1151                          * the specified objectclasses match for sure in case.
1152                          */
1153                         ret = ldb_msg_element_compare(oc_el_entry,
1154                                                       oc_el_change);
1155                         if (ret == 0) {
1156                                 ret = ldb_msg_element_compare(oc_el_change,
1157                                                               oc_el_entry);
1158                         }
1159                         if (ret == 0) {
1160                                 /* they are the same so we are done in this
1161                                  * case */
1162                                 talloc_free(mem_ctx);
1163                                 return ldb_module_done(ac->req, NULL, NULL,
1164                                                        LDB_SUCCESS);
1165                         } else {
1166                                 ldb_set_errstring(ldb,
1167                                                   "objectclass: the specified objectclasses are not exactly the same as on the entry!");
1168                                 talloc_free(mem_ctx);
1169                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1170                         }
1171                 }
1172
1173                 /* Now we've applied all changes from "oc_el_change" to
1174                  * "oc_el_entry" therefore the new "oc_el_entry" will be
1175                  * "oc_el_change". */
1176                 oc_el_entry = oc_el_change;
1177         }
1178
1179         talloc_free(mem_ctx);
1180
1181         /* Now we have the real and definitive change left to do */
1182
1183         ret = ldb_build_mod_req(&mod_req, ldb, ac,
1184                                 msg,
1185                                 ac->req->controls,
1186                                 ac, oc_op_callback,
1187                                 ac->req);
1188         LDB_REQ_SET_LOCATION(mod_req);
1189         if (ret != LDB_SUCCESS) {
1190                 return ret;
1191         }
1192
1193         return ldb_next_request(ac->module, mod_req);
1194 }
1195
1196 static int objectclass_do_rename(struct oc_context *ac);
1197
1198 static int objectclass_rename(struct ldb_module *module, struct ldb_request *req)
1199 {
1200         static const char * const attrs[] = { "objectClass", NULL };
1201         struct ldb_context *ldb;
1202         struct ldb_request *search_req;
1203         struct oc_context *ac;
1204         struct ldb_dn *parent_dn;
1205         int ret;
1206
1207         ldb = ldb_module_get_ctx(module);
1208
1209         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_rename\n");
1210
1211         /* do not manipulate our control entries */
1212         if (ldb_dn_is_special(req->op.rename.newdn)) {
1213                 return ldb_next_request(module, req);
1214         }
1215
1216         ac = oc_init_context(module, req);
1217         if (ac == NULL) {
1218                 return ldb_operr(ldb);
1219         }
1220
1221         parent_dn = ldb_dn_get_parent(ac, req->op.rename.newdn);
1222         if (parent_dn == NULL) {
1223                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, the parent DN does not exist!",
1224                                        ldb_dn_get_linearized(req->op.rename.olddn));
1225                 return LDB_ERR_NO_SUCH_OBJECT;
1226         }
1227
1228         /* this looks up the parent object for fetching some important
1229          * informations (objectclasses, DN normalisation...) */
1230         ret = ldb_build_search_req(&search_req, ldb,
1231                                    ac, parent_dn, LDB_SCOPE_BASE,
1232                                    "(objectClass=*)",
1233                                    attrs, NULL,
1234                                    ac, get_search_callback,
1235                                    req);
1236         LDB_REQ_SET_LOCATION(search_req);
1237         if (ret != LDB_SUCCESS) {
1238                 return ret;
1239         }
1240
1241         /* we have to add the show recycled control, as otherwise DRS
1242            deletes will be refused as we will think the target parent
1243            does not exist */
1244         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
1245                                       false, NULL);
1246
1247         if (ret != LDB_SUCCESS) {
1248                 return ret;
1249         }
1250
1251         ac->step_fn = objectclass_do_rename;
1252
1253         return ldb_next_request(ac->module, search_req);
1254 }
1255
1256 static int objectclass_do_rename2(struct oc_context *ac);
1257
1258 static int objectclass_do_rename(struct oc_context *ac)
1259 {
1260         static const char * const attrs[] = { "objectClass", NULL };
1261         struct ldb_context *ldb;
1262         struct ldb_request *search_req;
1263         int ret;
1264
1265         ldb = ldb_module_get_ctx(ac->module);
1266
1267         /* Check if we have a valid parent - this check is needed since
1268          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1269         if (ac->search_res == NULL) {
1270                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, parent does not exist!",
1271                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1272                 return LDB_ERR_OTHER;
1273         }
1274
1275         /* now assign "search_res2" to the parent entry to have "search_res"
1276          * free for another lookup */
1277         ac->search_res2 = ac->search_res;
1278         ac->search_res = NULL;
1279
1280         /* this looks up the real existing object for fetching some important
1281          * informations (objectclasses) */
1282         ret = ldb_build_search_req(&search_req, ldb,
1283                                    ac, ac->req->op.rename.olddn,
1284                                    LDB_SCOPE_BASE,
1285                                    "(objectClass=*)",
1286                                    attrs, NULL,
1287                                    ac, get_search_callback,
1288                                    ac->req);
1289         LDB_REQ_SET_LOCATION(search_req);
1290         if (ret != LDB_SUCCESS) {
1291                 return ret;
1292         }
1293
1294         ac->step_fn = objectclass_do_rename2;
1295
1296         return ldb_next_request(ac->module, search_req);
1297 }
1298
1299 static int objectclass_do_rename2(struct oc_context *ac)
1300 {
1301         struct ldb_context *ldb;
1302         struct ldb_request *rename_req;
1303         struct ldb_dn *fixed_dn;
1304         int ret;
1305
1306         ldb = ldb_module_get_ctx(ac->module);
1307
1308         /* Check if we have a valid entry - this check is needed since
1309          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1310         if (ac->search_res == NULL) {
1311                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, entry does not exist!",
1312                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1313                 return LDB_ERR_NO_SUCH_OBJECT;
1314         }
1315
1316         if (ac->schema != NULL) {
1317                 struct ldb_message_element *oc_el_entry, *oc_el_parent;
1318                 const struct dsdb_class *objectclass;
1319                 const char *rdn_name;
1320                 bool allowed_class = false;
1321                 unsigned int i, j;
1322                 bool found;
1323
1324                 oc_el_entry = ldb_msg_find_element(ac->search_res->message,
1325                                                    "objectClass");
1326                 if (oc_el_entry == NULL) {
1327                         /* existing entry without a valid object class? */
1328                         return ldb_operr(ldb);
1329                 }
1330                 objectclass = get_last_structural_class(ac->schema, oc_el_entry);
1331                 if (objectclass == NULL) {
1332                         /* existing entry without a valid object class? */
1333                         return ldb_operr(ldb);
1334                 }
1335
1336                 rdn_name = ldb_dn_get_rdn_name(ac->req->op.rename.newdn);
1337                 if (rdn_name == NULL) {
1338                         return ldb_operr(ldb);
1339                 }
1340                 found = false;
1341                 for (i = 0; (!found) && (i < oc_el_entry->num_values); i++) {
1342                         const struct dsdb_class *tmp_class =
1343                                 dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
1344                                                                       &oc_el_entry->values[i]);
1345
1346                         if (tmp_class == NULL) continue;
1347
1348                         if (ldb_attr_cmp(rdn_name, tmp_class->rDNAttID) == 0)
1349                                 found = true;
1350                 }
1351                 if (!found) {
1352                         ldb_asprintf_errstring(ldb,
1353                                                "objectclass: Invalid RDN '%s' for objectclass '%s'!",
1354                                                rdn_name, objectclass->lDAPDisplayName);
1355                         return LDB_ERR_UNWILLING_TO_PERFORM;
1356                 }
1357
1358                 oc_el_parent = ldb_msg_find_element(ac->search_res2->message,
1359                                                     "objectClass");
1360                 if (oc_el_parent == NULL) {
1361                         /* existing entry without a valid object class? */
1362                         return ldb_operr(ldb);
1363                 }
1364
1365                 for (i=0; allowed_class == false && i < oc_el_parent->num_values; i++) {
1366                         const struct dsdb_class *sclass;
1367
1368                         sclass = dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
1369                                                                        &oc_el_parent->values[i]);
1370                         if (!sclass) {
1371                                 /* We don't know this class?  what is going on? */
1372                                 continue;
1373                         }
1374                         for (j=0; sclass->systemPossibleInferiors && sclass->systemPossibleInferiors[j]; j++) {
1375                                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, sclass->systemPossibleInferiors[j]) == 0) {
1376                                         allowed_class = true;
1377                                         break;
1378                                 }
1379                         }
1380                 }
1381
1382                 if (!allowed_class) {
1383                         ldb_asprintf_errstring(ldb,
1384                                                "objectclass: structural objectClass %s is not a valid child class for %s",
1385                                                objectclass->lDAPDisplayName, ldb_dn_get_linearized(ac->search_res2->message->dn));
1386                         return LDB_ERR_NAMING_VIOLATION;
1387                 }
1388         }
1389
1390         /* Ensure we are not trying to rename it to be a child of itself */
1391         if ((ldb_dn_compare_base(ac->req->op.rename.olddn,
1392                                  ac->req->op.rename.newdn) == 0)  &&
1393             (ldb_dn_compare(ac->req->op.rename.olddn,
1394                             ac->req->op.rename.newdn) != 0)) {
1395                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s to be a child of itself",
1396                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1397                 return LDB_ERR_UNWILLING_TO_PERFORM;
1398         }
1399
1400         /* Fix up the DN to be in the standard form, taking
1401          * particular care to match the parent DN */
1402         ret = fix_dn(ldb, ac,
1403                      ac->req->op.rename.newdn,
1404                      ac->search_res2->message->dn,
1405                      &fixed_dn);
1406         if (ret != LDB_SUCCESS) {
1407                 ldb_asprintf_errstring(ldb, "objectclass: Could not munge DN %s into normal form",
1408                                        ldb_dn_get_linearized(ac->req->op.rename.newdn));
1409                 return ret;
1410
1411         }
1412
1413         ret = ldb_build_rename_req(&rename_req, ldb, ac,
1414                                    ac->req->op.rename.olddn, fixed_dn,
1415                                    ac->req->controls,
1416                                    ac, oc_op_callback,
1417                                    ac->req);
1418         LDB_REQ_SET_LOCATION(rename_req);
1419         if (ret != LDB_SUCCESS) {
1420                 return ret;
1421         }
1422
1423         /* perform the rename */
1424         return ldb_next_request(ac->module, rename_req);
1425 }
1426
1427 static int objectclass_do_delete(struct oc_context *ac);
1428
1429 static int objectclass_delete(struct ldb_module *module, struct ldb_request *req)
1430 {
1431         static const char * const attrs[] = { "nCName", "objectClass",
1432                                               "systemFlags",
1433                                               "isCriticalSystemObject", NULL };
1434         struct ldb_context *ldb;
1435         struct ldb_request *search_req;
1436         struct oc_context *ac;
1437         int ret;
1438
1439         ldb = ldb_module_get_ctx(module);
1440
1441         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_delete\n");
1442
1443         /* do not manipulate our control entries */
1444         if (ldb_dn_is_special(req->op.del.dn)) {
1445                 return ldb_next_request(module, req);
1446         }
1447
1448         /* Bypass the constraint checks when we do have the "RELAX" control
1449          * set. */
1450         if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID) != NULL) {
1451                 return ldb_next_request(module, req);
1452         }
1453
1454         ac = oc_init_context(module, req);
1455         if (ac == NULL) {
1456                 return ldb_operr(ldb);
1457         }
1458
1459         /* this looks up the entry object for fetching some important
1460          * informations (object classes, system flags...) */
1461         ret = ldb_build_search_req(&search_req, ldb,
1462                                    ac, req->op.del.dn, LDB_SCOPE_BASE,
1463                                    "(objectClass=*)",
1464                                    attrs, NULL,
1465                                    ac, get_search_callback,
1466                                    req);
1467         LDB_REQ_SET_LOCATION(search_req);
1468         if (ret != LDB_SUCCESS) {
1469                 return ret;
1470         }
1471
1472         ac->step_fn = objectclass_do_delete;
1473
1474         return ldb_next_request(ac->module, search_req);
1475 }
1476
1477 static int objectclass_do_delete(struct oc_context *ac)
1478 {
1479         struct ldb_context *ldb;
1480         struct ldb_dn *dn;
1481         int32_t systemFlags;
1482         bool isCriticalSystemObject;
1483         int ret;
1484
1485         ldb = ldb_module_get_ctx(ac->module);
1486
1487         /* Check if we have a valid entry - this check is needed since
1488          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1489         if (ac->search_res == NULL) {
1490                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, entry does not exist!",
1491                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1492                 return LDB_ERR_NO_SUCH_OBJECT;
1493         }
1494
1495         /* DC's ntDSDSA object */
1496         if (ldb_dn_compare(ac->req->op.del.dn, samdb_ntds_settings_dn(ldb)) == 0) {
1497                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's ntDSDSA object!",
1498                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1499                 return LDB_ERR_UNWILLING_TO_PERFORM;
1500         }
1501
1502         /* DC's rIDSet object */
1503         /* Perform this check only when it does exist - this is needed in order
1504          * to don't let existing provisions break. */
1505         ret = samdb_rid_set_dn(ldb, ac, &dn);
1506         if ((ret != LDB_SUCCESS) && (ret != LDB_ERR_NO_SUCH_OBJECT)) {
1507                 return ret;
1508         }
1509         if (ret == LDB_SUCCESS) {
1510                 if (ldb_dn_compare(ac->req->op.del.dn, dn) == 0) {
1511                         talloc_free(dn);
1512                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's rIDSet object!",
1513                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1514                         return LDB_ERR_UNWILLING_TO_PERFORM;
1515                 }
1516                 talloc_free(dn);
1517         }
1518
1519         /* crossRef objects regarding config, schema and default domain NCs */
1520         if (samdb_find_attribute(ldb, ac->search_res->message, "objectClass",
1521                                  "crossRef") != NULL) {
1522                 dn = ldb_msg_find_attr_as_dn(ldb, ac, ac->search_res->message,
1523                                              "nCName");
1524                 if ((ldb_dn_compare(dn, ldb_get_default_basedn(ldb)) == 0) ||
1525                     (ldb_dn_compare(dn, ldb_get_config_basedn(ldb)) == 0)) {
1526                         talloc_free(dn);
1527
1528                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's a crossRef object to the main or configuration partition!",
1529                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1530                         return LDB_ERR_NOT_ALLOWED_ON_NON_LEAF;
1531                 }
1532                 if (ldb_dn_compare(dn, ldb_get_schema_basedn(ldb)) == 0) {
1533                         talloc_free(dn);
1534
1535                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's a crossRef object to the schema partition!",
1536                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1537                         return LDB_ERR_UNWILLING_TO_PERFORM;
1538                 }
1539                 talloc_free(dn);
1540         }
1541
1542         /* systemFlags */
1543
1544         systemFlags = ldb_msg_find_attr_as_int(ac->search_res->message,
1545                                                "systemFlags", 0);
1546         if ((systemFlags & SYSTEM_FLAG_DISALLOW_DELETE) != 0) {
1547                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it isn't permitted!",
1548                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1549                 return LDB_ERR_UNWILLING_TO_PERFORM;
1550         }
1551
1552         /* isCriticalSystemObject - but this only applies on tree delete
1553          * operations - MS-ADTS 3.1.1.5.5.7.2 */
1554         if (ldb_request_get_control(ac->req, LDB_CONTROL_TREE_DELETE_OID) != NULL) {
1555                 isCriticalSystemObject = ldb_msg_find_attr_as_bool(ac->search_res->message,
1556                                                                    "isCriticalSystemObject", false);
1557                 if (isCriticalSystemObject) {
1558                         ldb_asprintf_errstring(ldb,
1559                                                "objectclass: Cannot tree-delete %s, it's a critical system object!",
1560                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1561                         return LDB_ERR_UNWILLING_TO_PERFORM;
1562                 }
1563         }
1564
1565         return ldb_next_request(ac->module, ac->req);
1566 }
1567
1568 static int objectclass_init(struct ldb_module *module)
1569 {
1570         struct ldb_context *ldb = ldb_module_get_ctx(module);
1571         int ret;
1572
1573         /* Init everything else */
1574         ret = ldb_next_init(module);
1575         if (ret != LDB_SUCCESS) {
1576                 return ret;
1577         }
1578
1579         /* Look for the opaque to indicate we might have to cut down the DN of defaultObjectCategory */
1580         ldb_module_set_private(module, ldb_get_opaque(ldb, DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME));
1581
1582         ret = ldb_mod_register_control(module, LDB_CONTROL_RODC_DCPROMO_OID);
1583         if (ret != LDB_SUCCESS) {
1584                 ldb_debug(ldb, LDB_DEBUG_ERROR,
1585                           "objectclass_init: Unable to register control DCPROMO with rootdse\n");
1586                 return ldb_operr(ldb);
1587         }
1588
1589         return ret;
1590 }
1591
1592 static const struct ldb_module_ops ldb_objectclass_module_ops = {
1593         .name           = "objectclass",
1594         .add            = objectclass_add,
1595         .modify         = objectclass_modify,
1596         .rename         = objectclass_rename,
1597         .del            = objectclass_delete,
1598         .init_context   = objectclass_init
1599 };
1600
1601 int ldb_objectclass_module_init(const char *version)
1602 {
1603         LDB_MODULE_CHECK_VERSION(version);
1604         return ldb_register_module(&ldb_objectclass_module_ops);
1605 }