4 Copyright (C) Simo Sorce 2006-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2007
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * Component: objectClass sorting module
27 * - sort the objectClass attribute into the class
29 * - fix DNs and attributes into 'standard' case
30 * - Add objectCategory and ntSecurityDescriptor defaults
32 * Author: Andrew Bartlett
37 #include "ldb_module.h"
38 #include "dlinklist.h"
39 #include "dsdb/samdb/samdb.h"
40 #include "librpc/ndr/libndr.h"
41 #include "librpc/gen_ndr/ndr_security.h"
42 #include "libcli/security/security.h"
43 #include "auth/auth.h"
44 #include "param/param.h"
48 struct ldb_module *module;
49 struct ldb_request *req;
51 struct ldb_reply *search_res;
53 int (*step_fn)(struct oc_context *);
57 struct class_list *prev, *next;
58 const struct dsdb_class *objectclass;
61 static struct oc_context *oc_init_context(struct ldb_module *module,
62 struct ldb_request *req)
64 struct ldb_context *ldb;
65 struct oc_context *ac;
67 ldb = ldb_module_get_ctx(module);
69 ac = talloc_zero(req, struct oc_context);
71 ldb_set_errstring(ldb, "Out of Memory");
81 static int objectclass_do_add(struct oc_context *ac);
83 /* Sort objectClasses into correct order, and validate that all
84 * objectClasses specified actually exist in the schema
87 static int objectclass_sort(struct ldb_module *module,
88 const struct dsdb_schema *schema,
90 struct ldb_message_element *objectclass_element,
91 struct class_list **sorted_out)
93 struct ldb_context *ldb;
96 struct class_list *sorted = NULL, *parent_class = NULL,
97 *subclass = NULL, *unsorted = NULL, *current, *poss_subclass, *poss_parent, *new_parent;
99 ldb = ldb_module_get_ctx(module);
103 * We work on 4 different 'bins' (implemented here as linked lists):
105 * * sorted: the eventual list, in the order we wish to push
106 * into the database. This is the only ordered list.
108 * * parent_class: The current parent class 'bin' we are
109 * trying to find subclasses for
111 * * subclass: The subclasses we have found so far
113 * * unsorted: The remaining objectClasses
115 * The process is a matter of filtering objectClasses up from
116 * unsorted into sorted. Order is irrelevent in the later 3 'bins'.
118 * We start with 'top' (found and promoted to parent_class
119 * initially). Then we find (in unsorted) all the direct
120 * subclasses of 'top'. parent_classes is concatenated onto
121 * the end of 'sorted', and subclass becomes the list in
124 * We then repeat, until we find no more subclasses. Any left
125 * over classes are added to the end.
129 /* Firstly, dump all the objectClass elements into the
130 * unsorted bin, except for 'top', which is special */
131 for (i=0; i < objectclass_element->num_values; i++) {
132 current = talloc(mem_ctx, struct class_list);
135 return LDB_ERR_OPERATIONS_ERROR;
137 current->objectclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &objectclass_element->values[i]);
138 if (!current->objectclass) {
139 ldb_asprintf_errstring(ldb, "objectclass %.*s is not a valid objectClass in schema",
140 (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
141 /* This looks weird, but windows apparently returns this for invalid objectClass values */
142 return LDB_ERR_NO_SUCH_ATTRIBUTE;
143 } else if (current->objectclass->isDefunct) {
144 ldb_asprintf_errstring(ldb, "objectclass %.*s marked as isDefunct objectClass in schema - not valid for new objects",
145 (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
146 /* This looks weird, but windows apparently returns this for invalid objectClass values */
147 return LDB_ERR_NO_SUCH_ATTRIBUTE;
150 /* this is the root of the tree. We will start
151 * looking for subclasses from here */
152 if (ldb_attr_cmp("top", current->objectclass->lDAPDisplayName) == 0) {
153 DLIST_ADD_END(parent_class, current, struct class_list *);
155 DLIST_ADD_END(unsorted, current, struct class_list *);
159 if (parent_class == NULL) {
160 current = talloc(mem_ctx, struct class_list);
161 current->objectclass = dsdb_class_by_lDAPDisplayName(schema, "top");
162 DLIST_ADD_END(parent_class, current, struct class_list *);
165 /* For each object: find parent chain */
166 for (current = unsorted; schema && current; current = current->next) {
167 for (poss_parent = unsorted; poss_parent; poss_parent = poss_parent->next) {
168 if (ldb_attr_cmp(poss_parent->objectclass->lDAPDisplayName, current->objectclass->subClassOf) == 0) {
172 /* If we didn't get to the end of the list, we need to add this parent */
173 if (poss_parent || (ldb_attr_cmp("top", current->objectclass->subClassOf) == 0)) {
177 new_parent = talloc(mem_ctx, struct class_list);
178 new_parent->objectclass = dsdb_class_by_lDAPDisplayName(schema, current->objectclass->subClassOf);
179 DLIST_ADD_END(unsorted, new_parent, struct class_list *);
182 /* DEBUGGING aid: how many layers are we down now? */
186 /* Find all the subclasses of classes in the
187 * parent_classes. Push them onto the subclass list */
189 /* Ensure we don't bother if there are no unsorted entries left */
190 for (current = parent_class; schema && unsorted && current; current = current->next) {
191 /* Walk the list of possible subclasses in unsorted */
192 for (poss_subclass = unsorted; poss_subclass; ) {
193 struct class_list *next;
195 /* Save the next pointer, as the DLIST_ macros will change poss_subclass->next */
196 next = poss_subclass->next;
198 if (ldb_attr_cmp(poss_subclass->objectclass->subClassOf, current->objectclass->lDAPDisplayName) == 0) {
199 DLIST_REMOVE(unsorted, poss_subclass);
200 DLIST_ADD(subclass, poss_subclass);
204 poss_subclass = next;
208 /* Now push the parent_classes as sorted, we are done with
209 these. Add to the END of the list by concatenation */
210 DLIST_CONCATENATE(sorted, parent_class, struct class_list *);
212 /* and now find subclasses of these */
213 parent_class = subclass;
216 /* If we didn't find any subclasses we will fall out
218 } while (parent_class);
221 *sorted_out = sorted;
226 /* If we don't have schema yet, then just merge the lists again */
227 DLIST_CONCATENATE(sorted, unsorted, struct class_list *);
228 *sorted_out = sorted;
232 /* This shouldn't happen, and would break MMC, perhaps there
233 * was no 'top', a conflict in the objectClasses or some other
236 ldb_asprintf_errstring(ldb, "objectclass %s is not a valid objectClass in objectClass chain", unsorted->objectclass->lDAPDisplayName);
237 return LDB_ERR_OBJECT_CLASS_VIOLATION;
240 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
242 struct ldb_context *ldb;
243 struct oc_context *ac;
246 ac = talloc_get_type(req->context, struct oc_context);
247 ldb = ldb_module_get_ctx(ac->module);
250 return ldb_module_done(ac->req, NULL, NULL,
251 LDB_ERR_OPERATIONS_ERROR);
253 if (ares->error != LDB_SUCCESS &&
254 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
255 return ldb_module_done(ac->req, ares->controls,
256 ares->response, ares->error);
259 ldb_reset_err_string(ldb);
261 switch (ares->type) {
262 case LDB_REPLY_ENTRY:
263 if (ac->search_res != NULL) {
264 ldb_set_errstring(ldb, "Too many results");
266 return ldb_module_done(ac->req, NULL, NULL,
267 LDB_ERR_OPERATIONS_ERROR);
270 ac->search_res = talloc_steal(ac, ares);
273 case LDB_REPLY_REFERRAL:
280 ret = ac->step_fn(ac);
281 if (ret != LDB_SUCCESS) {
282 return ldb_module_done(ac->req, NULL, NULL, ret);
290 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
292 struct oc_context *ac;
294 ac = talloc_get_type(req->context, struct oc_context);
297 return ldb_module_done(ac->req, NULL, NULL,
298 LDB_ERR_OPERATIONS_ERROR);
300 if (ares->error != LDB_SUCCESS) {
301 return ldb_module_done(ac->req, ares->controls,
302 ares->response, ares->error);
305 if (ares->type != LDB_REPLY_DONE) {
307 return ldb_module_done(ac->req, NULL, NULL,
308 LDB_ERR_OPERATIONS_ERROR);
311 return ldb_module_done(ac->req, ares->controls,
312 ares->response, ares->error);
315 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN
317 This should mean that if the parent is:
318 CN=Users,DC=samba,DC=example,DC=com
319 and a proposed child is
320 cn=Admins ,cn=USERS,dc=Samba,dc=example,dc=COM
322 The resulting DN should be:
324 CN=Admins,CN=Users,DC=samba,DC=example,DC=com
327 static int fix_dn(TALLOC_CTX *mem_ctx,
328 struct ldb_dn *newdn, struct ldb_dn *parent_dn,
329 struct ldb_dn **fixed_dn)
331 char *upper_rdn_attr;
332 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN */
333 *fixed_dn = ldb_dn_copy(mem_ctx, parent_dn);
335 /* We need the attribute name in upper case */
336 upper_rdn_attr = strupper_talloc(*fixed_dn,
337 ldb_dn_get_rdn_name(newdn));
338 if (!upper_rdn_attr) {
339 return LDB_ERR_OPERATIONS_ERROR;
342 /* Create a new child */
343 if (ldb_dn_add_child_fmt(*fixed_dn, "X=X") == false) {
344 return LDB_ERR_OPERATIONS_ERROR;
347 /* And replace it with CN=foo (we need the attribute in upper case */
348 return ldb_dn_set_component(*fixed_dn, 0, upper_rdn_attr,
349 *ldb_dn_get_rdn_val(newdn));
352 /* Fix all attribute names to be in the correct case, and check they are all valid per the schema */
353 static int fix_attributes(struct ldb_context *ldb, const struct dsdb_schema *schema, struct ldb_message *msg)
356 for (i=0; i < msg->num_elements; i++) {
357 const struct dsdb_attribute *attribute = dsdb_attribute_by_lDAPDisplayName(schema, msg->elements[i].name);
358 /* Add in a very special case for 'clearTextPassword',
359 * which is used for internal processing only, and is
360 * not presented in the schema */
362 if (strcasecmp(msg->elements[i].name, "clearTextPassword") != 0) {
363 ldb_asprintf_errstring(ldb, "attribute %s is not a valid attribute in schema", msg->elements[i].name);
364 return LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE;
367 msg->elements[i].name = attribute->lDAPDisplayName;
374 static int objectclass_do_add(struct oc_context *ac);
376 static int objectclass_add(struct ldb_module *module, struct ldb_request *req)
378 struct ldb_context *ldb;
379 struct ldb_request *search_req;
380 struct oc_context *ac;
381 struct ldb_dn *parent_dn;
383 static const char * const parent_attrs[] = { "objectGUID", NULL };
385 ldb = ldb_module_get_ctx(module);
387 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_add\n");
389 /* do not manipulate our control entries */
390 if (ldb_dn_is_special(req->op.add.message->dn)) {
391 return ldb_next_request(module, req);
394 /* the objectClass must be specified on add */
395 if (ldb_msg_find_element(req->op.add.message,
396 "objectClass") == NULL) {
397 return LDB_ERR_OBJECT_CLASS_VIOLATION;
400 ac = oc_init_context(module, req);
402 return LDB_ERR_OPERATIONS_ERROR;
405 /* If there isn't a parent, just go on to the add processing */
406 if (ldb_dn_get_comp_num(ac->req->op.add.message->dn) == 1) {
407 return objectclass_do_add(ac);
410 /* get copy of parent DN */
411 parent_dn = ldb_dn_get_parent(ac, ac->req->op.add.message->dn);
412 if (parent_dn == NULL) {
414 return LDB_ERR_OPERATIONS_ERROR;
417 ret = ldb_build_search_req(&search_req, ldb,
418 ac, parent_dn, LDB_SCOPE_BASE,
419 "(objectClass=*)", parent_attrs,
421 ac, get_search_callback,
423 if (ret != LDB_SUCCESS) {
426 talloc_steal(search_req, parent_dn);
428 ac->step_fn = objectclass_do_add;
430 return ldb_next_request(ac->module, search_req);
433 static int objectclass_do_add(struct oc_context *ac)
435 struct ldb_context *ldb;
436 const struct dsdb_schema *schema;
437 struct ldb_request *add_req;
439 struct ldb_message_element *objectclass_element;
440 struct ldb_message *msg;
442 struct class_list *sorted, *current;
445 ldb = ldb_module_get_ctx(ac->module);
446 schema = dsdb_get_schema(ldb);
448 mem_ctx = talloc_new(ac);
449 if (mem_ctx == NULL) {
450 return LDB_ERR_OPERATIONS_ERROR;
453 msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
455 /* Check we have a valid parent */
456 if (ac->search_res == NULL) {
457 if (ldb_dn_compare(ldb_get_root_basedn(ldb),
459 /* Allow the tree to be started */
461 /* but don't keep any error string, it's meaningless */
462 ldb_set_errstring(ldb, NULL);
464 ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, parent does not exist!",
465 ldb_dn_get_linearized(msg->dn));
466 talloc_free(mem_ctx);
467 return LDB_ERR_UNWILLING_TO_PERFORM;
470 const struct ldb_val *parent_guid;
472 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN */
474 ac->req->op.add.message->dn,
475 ac->search_res->message->dn,
478 if (ret != LDB_SUCCESS) {
479 ldb_asprintf_errstring(ldb, "Could not munge DN %s into normal form",
480 ldb_dn_get_linearized(ac->req->op.add.message->dn));
481 talloc_free(mem_ctx);
485 parent_guid = ldb_msg_find_ldb_val(ac->search_res->message, "objectGUID");
486 if (parent_guid == NULL) {
487 ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, parent does not have an objectGUID!",
488 ldb_dn_get_linearized(msg->dn));
489 talloc_free(mem_ctx);
490 return LDB_ERR_UNWILLING_TO_PERFORM;
493 /* TODO: Check this is a valid child to this parent,
494 * by reading the allowedChildClasses and
495 * allowedChildClasssesEffective attributes */
496 ret = ldb_msg_add_steal_value(msg, "parentGUID", discard_const(parent_guid));
497 if (ret != LDB_SUCCESS) {
498 ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, failed to add parentGUID",
499 ldb_dn_get_linearized(msg->dn));
500 talloc_free(mem_ctx);
501 return LDB_ERR_UNWILLING_TO_PERFORM;
505 ret = fix_attributes(ldb, schema, msg);
506 if (ret != LDB_SUCCESS) {
507 talloc_free(mem_ctx);
511 /* This is now the objectClass list from the database */
512 objectclass_element = ldb_msg_find_element(msg, "objectClass");
514 if (!objectclass_element) {
515 /* Where did it go? bail now... */
516 talloc_free(mem_ctx);
517 return LDB_ERR_OPERATIONS_ERROR;
519 ret = objectclass_sort(ac->module, schema, mem_ctx, objectclass_element, &sorted);
520 if (ret != LDB_SUCCESS) {
521 talloc_free(mem_ctx);
525 ldb_msg_remove_attr(msg, "objectClass");
526 ret = ldb_msg_add_empty(msg, "objectClass", 0, NULL);
528 if (ret != LDB_SUCCESS) {
529 talloc_free(mem_ctx);
533 /* We must completely replace the existing objectClass entry,
534 * because we need it sorted */
536 /* Move from the linked list back into an ldb msg */
537 for (current = sorted; current; current = current->next) {
538 value = talloc_strdup(msg, current->objectclass->lDAPDisplayName);
541 talloc_free(mem_ctx);
542 return LDB_ERR_OPERATIONS_ERROR;
544 ret = ldb_msg_add_string(msg, "objectClass", value);
545 if (ret != LDB_SUCCESS) {
546 ldb_set_errstring(ldb,
547 "objectclass: could not re-add sorted "
548 "objectclass to modify msg");
549 talloc_free(mem_ctx);
552 /* Last one is the critical one */
553 if (!current->next) {
554 struct ldb_message_element *el;
555 int32_t systemFlags = 0;
556 const char *rdn_name = ldb_dn_get_rdn_name(msg->dn);
557 if (ldb_attr_cmp(rdn_name, current->objectclass->rDNAttID) != 0) {
558 ldb_asprintf_errstring(ldb, "RDN %s is not correct for most specific structural objectclass %s, should be %s",
559 rdn_name, current->objectclass->lDAPDisplayName, current->objectclass->rDNAttID);
560 return LDB_ERR_NAMING_VIOLATION;
563 if (!ldb_msg_find_element(msg, "objectCategory")) {
564 value = talloc_strdup(msg, current->objectclass->defaultObjectCategory);
567 talloc_free(mem_ctx);
568 return LDB_ERR_OPERATIONS_ERROR;
570 ldb_msg_add_string(msg, "objectCategory", value);
572 if (!ldb_msg_find_element(msg, "showInAdvancedViewOnly") && (current->objectclass->defaultHidingValue == true)) {
573 ldb_msg_add_string(msg, "showInAdvancedViewOnly",
577 /* There are very special rules for systemFlags, see MS-ADTS 3.1.1.5.2.4 */
578 el = ldb_msg_find_element(msg, "systemFlags");
580 systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
583 /* Only these flags may be set by a client, but we can't tell between a client and our provision at this point */
584 /* systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_MOVE | SYSTEM_FLAG_CONFIG_LIMITED_MOVE); */
585 ldb_msg_remove_element(msg, el);
588 /* This flag is only allowed on attributeSchema objects */
589 if (ldb_attr_cmp(current->objectclass->lDAPDisplayName, "attributeSchema") == 0) {
590 systemFlags &= ~SYSTEM_FLAG_ATTR_IS_RDN;
593 if (ldb_attr_cmp(current->objectclass->lDAPDisplayName, "server") == 0) {
594 systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE | SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE);
595 } else if (ldb_attr_cmp(current->objectclass->lDAPDisplayName, "site") == 0
596 || ldb_attr_cmp(current->objectclass->lDAPDisplayName, "serverContainer") == 0
597 || ldb_attr_cmp(current->objectclass->lDAPDisplayName, "ntDSDSA") == 0) {
598 systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
600 } else if (ldb_attr_cmp(current->objectclass->lDAPDisplayName, "siteLink") == 0
601 || ldb_attr_cmp(current->objectclass->lDAPDisplayName, "siteLinkBridge") == 0
602 || ldb_attr_cmp(current->objectclass->lDAPDisplayName, "nTDSConnection") == 0) {
603 systemFlags |= (int32_t)(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
606 /* TODO: If parent object is site or subnet, also add (SYSTEM_FLAG_CONFIG_ALLOW_RENAME) */
608 if (el || systemFlags != 0) {
609 samdb_msg_add_int(ldb, msg, msg, "systemFlags", systemFlags);
615 talloc_free(mem_ctx);
616 ret = ldb_msg_sanity_check(ldb, msg);
619 if (ret != LDB_SUCCESS) {
623 ret = ldb_build_add_req(&add_req, ldb, ac,
628 if (ret != LDB_SUCCESS) {
632 /* perform the add */
633 return ldb_next_request(ac->module, add_req);
636 static int oc_modify_callback(struct ldb_request *req,
637 struct ldb_reply *ares);
638 static int objectclass_do_mod(struct oc_context *ac);
640 static int objectclass_modify(struct ldb_module *module, struct ldb_request *req)
642 struct ldb_context *ldb = ldb_module_get_ctx(module);
643 struct ldb_message_element *objectclass_element;
644 struct ldb_message *msg;
645 const struct dsdb_schema *schema = dsdb_get_schema(ldb);
646 struct class_list *sorted, *current;
647 struct ldb_request *down_req;
648 struct oc_context *ac;
653 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_modify\n");
655 /* do not manipulate our control entries */
656 if (ldb_dn_is_special(req->op.mod.message->dn)) {
657 return ldb_next_request(module, req);
660 /* Without schema, there isn't much to do here */
662 return ldb_next_request(module, req);
664 objectclass_element = ldb_msg_find_element(req->op.mod.message, "objectClass");
666 ac = oc_init_context(module, req);
668 return LDB_ERR_OPERATIONS_ERROR;
671 /* If no part of this touches the objectClass, then we don't
672 * need to make any changes. */
674 /* If the only operation is the deletion of the objectClass
675 * then go on with just fixing the attribute case */
676 if (!objectclass_element) {
677 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
679 return LDB_ERR_OPERATIONS_ERROR;
682 ret = fix_attributes(ldb, schema, msg);
683 if (ret != LDB_SUCCESS) {
687 ret = ldb_build_mod_req(&down_req, ldb, ac,
692 if (ret != LDB_SUCCESS) {
696 /* go on with the call chain */
697 return ldb_next_request(module, down_req);
700 switch (objectclass_element->flags & LDB_FLAG_MOD_MASK) {
701 case LDB_FLAG_MOD_DELETE:
702 if (objectclass_element->num_values == 0) {
703 return LDB_ERR_OBJECT_CLASS_MODS_PROHIBITED;
707 case LDB_FLAG_MOD_REPLACE:
708 mem_ctx = talloc_new(ac);
709 if (mem_ctx == NULL) {
710 return LDB_ERR_OPERATIONS_ERROR;
713 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
715 talloc_free(mem_ctx);
716 return LDB_ERR_OPERATIONS_ERROR;
719 ret = fix_attributes(ldb, schema, msg);
720 if (ret != LDB_SUCCESS) {
721 talloc_free(mem_ctx);
725 ret = objectclass_sort(module, schema, mem_ctx, objectclass_element, &sorted);
726 if (ret != LDB_SUCCESS) {
727 talloc_free(mem_ctx);
731 /* We must completely replace the existing objectClass entry,
732 * because we need it sorted */
734 ldb_msg_remove_attr(msg, "objectClass");
735 ret = ldb_msg_add_empty(msg, "objectClass", LDB_FLAG_MOD_REPLACE, NULL);
737 if (ret != LDB_SUCCESS) {
738 talloc_free(mem_ctx);
742 /* Move from the linked list back into an ldb msg */
743 for (current = sorted; current; current = current->next) {
744 /* copy the value as this string is on the schema
745 * context and we can't rely on it not changing
746 * before the operation is over */
747 value = talloc_strdup(msg,
748 current->objectclass->lDAPDisplayName);
751 talloc_free(mem_ctx);
752 return LDB_ERR_OPERATIONS_ERROR;
754 ret = ldb_msg_add_string(msg, "objectClass", value);
755 if (ret != LDB_SUCCESS) {
756 ldb_set_errstring(ldb,
757 "objectclass: could not re-add sorted "
758 "objectclass to modify msg");
759 talloc_free(mem_ctx);
764 talloc_free(mem_ctx);
766 ret = ldb_msg_sanity_check(ldb, msg);
767 if (ret != LDB_SUCCESS) {
771 ret = ldb_build_mod_req(&down_req, ldb, ac,
776 if (ret != LDB_SUCCESS) {
780 /* go on with the call chain */
781 return ldb_next_request(module, down_req);
784 /* This isn't the default branch of the switch, but a 'in any
785 * other case'. When a delete isn't for all objectClasses for
789 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
792 return LDB_ERR_OPERATIONS_ERROR;
795 ret = fix_attributes(ldb, schema, msg);
796 if (ret != LDB_SUCCESS) {
801 ret = ldb_build_mod_req(&down_req, ldb, ac,
804 ac, oc_modify_callback,
806 if (ret != LDB_SUCCESS) {
810 return ldb_next_request(module, down_req);
813 static int oc_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
815 struct ldb_context *ldb;
816 static const char * const attrs[] = { "objectClass", NULL };
817 struct ldb_request *search_req;
818 struct oc_context *ac;
821 ac = talloc_get_type(req->context, struct oc_context);
822 ldb = ldb_module_get_ctx(ac->module);
825 return ldb_module_done(ac->req, NULL, NULL,
826 LDB_ERR_OPERATIONS_ERROR);
828 if (ares->error != LDB_SUCCESS) {
829 return ldb_module_done(ac->req, ares->controls,
830 ares->response, ares->error);
833 if (ares->type != LDB_REPLY_DONE) {
835 return ldb_module_done(ac->req, NULL, NULL,
836 LDB_ERR_OPERATIONS_ERROR);
839 ret = ldb_build_search_req(&search_req, ldb, ac,
840 ac->req->op.mod.message->dn, LDB_SCOPE_BASE,
843 ac, get_search_callback,
845 if (ret != LDB_SUCCESS) {
846 return ldb_module_done(ac->req, NULL, NULL, ret);
849 ac->step_fn = objectclass_do_mod;
851 ret = ldb_next_request(ac->module, search_req);
852 if (ret != LDB_SUCCESS) {
853 return ldb_module_done(ac->req, NULL, NULL, ret);
858 static int objectclass_do_mod(struct oc_context *ac)
860 struct ldb_context *ldb;
861 const struct dsdb_schema *schema;
862 struct ldb_request *mod_req;
864 struct ldb_message_element *objectclass_element;
865 struct ldb_message *msg;
867 struct class_list *sorted, *current;
870 ldb = ldb_module_get_ctx(ac->module);
872 if (ac->search_res == NULL) {
873 return LDB_ERR_OPERATIONS_ERROR;
875 schema = dsdb_get_schema(ldb);
877 mem_ctx = talloc_new(ac);
878 if (mem_ctx == NULL) {
879 return LDB_ERR_OPERATIONS_ERROR;
882 /* use a new message structure */
883 msg = ldb_msg_new(ac);
885 ldb_set_errstring(ldb,
886 "objectclass: could not create new modify msg");
887 talloc_free(mem_ctx);
888 return LDB_ERR_OPERATIONS_ERROR;
891 /* This is now the objectClass list from the database */
892 objectclass_element = ldb_msg_find_element(ac->search_res->message,
894 if (!objectclass_element) {
895 /* Where did it go? bail now... */
896 talloc_free(mem_ctx);
897 return LDB_ERR_OPERATIONS_ERROR;
901 msg->dn = ac->req->op.mod.message->dn;
903 ret = objectclass_sort(ac->module, schema, mem_ctx, objectclass_element, &sorted);
904 if (ret != LDB_SUCCESS) {
908 /* We must completely replace the existing objectClass entry.
909 * We could do a constrained add/del, but we are meant to be
910 * in a transaction... */
912 ret = ldb_msg_add_empty(msg, "objectClass", LDB_FLAG_MOD_REPLACE, NULL);
913 if (ret != LDB_SUCCESS) {
914 ldb_set_errstring(ldb, "objectclass: could not clear objectclass in modify msg");
915 talloc_free(mem_ctx);
919 /* Move from the linked list back into an ldb msg */
920 for (current = sorted; current; current = current->next) {
921 value = talloc_strdup(msg, current->objectclass->lDAPDisplayName);
924 return LDB_ERR_OPERATIONS_ERROR;
926 ret = ldb_msg_add_string(msg, "objectClass", value);
927 if (ret != LDB_SUCCESS) {
928 ldb_set_errstring(ldb, "objectclass: could not re-add sorted objectclass to modify msg");
929 talloc_free(mem_ctx);
934 ret = ldb_msg_sanity_check(ldb, msg);
935 if (ret != LDB_SUCCESS) {
936 talloc_free(mem_ctx);
940 ret = ldb_build_mod_req(&mod_req, ldb, ac,
945 if (ret != LDB_SUCCESS) {
946 talloc_free(mem_ctx);
950 talloc_free(mem_ctx);
951 /* perform the modify */
952 return ldb_next_request(ac->module, mod_req);
955 static int objectclass_do_rename(struct oc_context *ac);
957 static int objectclass_rename(struct ldb_module *module, struct ldb_request *req)
959 static const char * const attrs[] = { "objectGUID", NULL };
960 struct ldb_context *ldb;
961 struct ldb_request *search_req;
962 struct oc_context *ac;
963 struct ldb_dn *parent_dn;
966 ldb = ldb_module_get_ctx(module);
968 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_rename\n");
970 if (ldb_dn_is_special(req->op.rename.newdn)) { /* do not manipulate our control entries */
971 return ldb_next_request(module, req);
974 /* Firstly ensure we are not trying to rename it to be a child of itself */
975 if ((ldb_dn_compare_base(req->op.rename.olddn, req->op.rename.newdn) == 0)
976 && (ldb_dn_compare(req->op.rename.olddn, req->op.rename.newdn) != 0)) {
977 ldb_asprintf_errstring(ldb, "Cannot rename %s to be a child of itself",
978 ldb_dn_get_linearized(req->op.rename.olddn));
979 return LDB_ERR_UNWILLING_TO_PERFORM;
982 ac = oc_init_context(module, req);
984 return LDB_ERR_OPERATIONS_ERROR;
987 parent_dn = ldb_dn_get_parent(ac, req->op.rename.newdn);
988 if (parent_dn == NULL) {
990 return LDB_ERR_OPERATIONS_ERROR;
993 /* note that the results of this search are kept and used to
994 update the parentGUID in objectclass_rename_callback() */
995 ret = ldb_build_search_req(&search_req, ldb,
996 ac, parent_dn, LDB_SCOPE_BASE,
999 ac, get_search_callback,
1001 if (ret != LDB_SUCCESS) {
1005 /* we have to add the show deleted control, as otherwise DRS
1006 deletes will be refused as we will think the target parent
1008 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_DELETED_OID, false, NULL);
1010 if (ret != LDB_SUCCESS) {
1014 ac->step_fn = objectclass_do_rename;
1016 return ldb_next_request(ac->module, search_req);
1020 called after the rename happens.
1021 We now need to fix the parentGUID of the object to be the objectGUID of
1024 static int objectclass_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
1026 struct ldb_context *ldb;
1027 struct oc_context *ac;
1028 const struct ldb_val *parent_guid;
1029 struct ldb_request *mod_req = NULL;
1031 struct ldb_message *msg;
1032 struct ldb_message_element *el = NULL;
1034 ac = talloc_get_type(req->context, struct oc_context);
1035 ldb = ldb_module_get_ctx(ac->module);
1037 /* make sure the rename succeeded */
1039 return ldb_module_done(ac->req, NULL, NULL,
1040 LDB_ERR_OPERATIONS_ERROR);
1042 if (ares->error != LDB_SUCCESS) {
1043 return ldb_module_done(ac->req, ares->controls,
1044 ares->response, ares->error);
1048 /* the ac->search_res should contain the new parents objectGUID */
1049 parent_guid = ldb_msg_find_ldb_val(ac->search_res->message, "objectGUID");
1050 if (parent_guid == NULL) {
1051 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, new parent does not have an objectGUID!",
1052 ldb_dn_get_linearized(ac->req->op.rename.newdn));
1053 return LDB_ERR_UNWILLING_TO_PERFORM;
1057 /* construct the modify message */
1058 msg = ldb_msg_new(ac);
1061 return LDB_ERR_OPERATIONS_ERROR;
1064 msg->dn = ac->req->op.rename.newdn;
1066 ret = ldb_msg_add_value(msg, "parentGUID", parent_guid, &el);
1067 if (ret != LDB_SUCCESS) {
1071 el->flags = LDB_FLAG_MOD_REPLACE;
1073 ret = ldb_build_mod_req(&mod_req, ldb, ac, msg,
1074 NULL, ac, oc_op_callback, req);
1076 return ldb_next_request(ac->module, mod_req);
1079 static int objectclass_do_rename(struct oc_context *ac)
1081 struct ldb_context *ldb;
1082 struct ldb_request *rename_req;
1083 struct ldb_dn *fixed_dn;
1086 ldb = ldb_module_get_ctx(ac->module);
1088 /* Check we have a valid parent */
1089 if (ac->search_res == NULL) {
1090 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, parent does not exist!",
1091 ldb_dn_get_linearized(ac->req->op.rename.newdn));
1092 return LDB_ERR_UNWILLING_TO_PERFORM;
1095 /* Fix up the DN to be in the standard form,
1096 * taking particular care to match the parent DN */
1098 ac->req->op.rename.newdn,
1099 ac->search_res->message->dn,
1101 if (ret != LDB_SUCCESS) {
1105 /* TODO: Check this is a valid child to this parent,
1106 * by reading the allowedChildClasses and
1107 * allowedChildClasssesEffective attributes */
1109 ret = ldb_build_rename_req(&rename_req, ldb, ac,
1110 ac->req->op.rename.olddn, fixed_dn,
1112 ac, objectclass_rename_callback,
1114 if (ret != LDB_SUCCESS) {
1118 /* perform the rename */
1119 return ldb_next_request(ac->module, rename_req);
1122 _PUBLIC_ const struct ldb_module_ops ldb_objectclass_module_ops = {
1123 .name = "objectclass",
1124 .add = objectclass_add,
1125 .modify = objectclass_modify,
1126 .rename = objectclass_rename,