source4/dsdb/samdb/ldb_modules/subtree_rename.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2007
   5    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 /*
  22  *  Name: ldb
  23  *
  24  *  Component: ldb subtree rename module
  25  *
  26  *  Description: Rename a subtree in LDB
  27  *
  28  *  Author: Andrew Bartlett
  29  */
  30
  31 #include "includes.h"
  32 #include <ldb.h>
  33 #include <ldb_module.h>
  34 #include "libds/common/flags.h"
  35 #include "dsdb/samdb/samdb.h"
  36
  37 struct subren_msg_store {
  38         struct subren_msg_store *next;
  39         struct ldb_dn *olddn;
  40         struct ldb_dn *newdn;
  41 };
  42
  43 struct subtree_rename_context {
  44         struct ldb_module *module;
  45         struct ldb_request *req;
  46
  47         struct subren_msg_store *list;
  48         struct subren_msg_store *current;
  49 };
  50
  51 static struct subtree_rename_context *subren_ctx_init(struct ldb_module *module,
  52                                                       struct ldb_request *req)
  53 {
  54         struct ldb_context *ldb;
  55         struct subtree_rename_context *ac;
  56
  57         ldb = ldb_module_get_ctx(module);
  58
  59         ac = talloc_zero(req, struct subtree_rename_context);
  60         if (ac == NULL) {
  61                 return NULL;
  62         }
  63
  64         ac->module = module;
  65         ac->req = req;
  66
  67         return ac;
  68 }
  69
  70 static int subtree_rename_next_request(struct subtree_rename_context *ac);
  71
  72 static int subtree_rename_callback(struct ldb_request *req,
  73                                    struct ldb_reply *ares)
  74 {
  75         struct ldb_context *ldb;
  76         struct subtree_rename_context *ac;
  77         int ret;
  78
  79         ac = talloc_get_type(req->context, struct subtree_rename_context);
  80         ldb = ldb_module_get_ctx(ac->module);
  81
  82         if (!ares) {
  83                 return ldb_module_done(ac->req, NULL, NULL,
  84                                         LDB_ERR_OPERATIONS_ERROR);
  85         }
  86
  87         if (ares->type == LDB_REPLY_REFERRAL) {
  88                 return ldb_module_send_referral(ac->req, ares->referral);
  89         }
  90
  91         if (ares->error != LDB_SUCCESS) {
  92                 return ldb_module_done(ac->req, ares->controls,
  93                                         ares->response, ares->error);
  94         }
  95
  96         if (ares->type != LDB_REPLY_DONE) {
  97                 ldb_set_errstring(ldb, "Invalid reply type!\n");
  98                 return ldb_module_done(ac->req, NULL, NULL,
  99                                         LDB_ERR_OPERATIONS_ERROR);
 100         }
 101
 102         if (ac->current == NULL) {
 103                 /* this was the last one */
 104                 return ldb_module_done(ac->req, ares->controls,
 105                                         ares->response, LDB_SUCCESS);
 106         }
 107
 108         ret = subtree_rename_next_request(ac);
 109         if (ret != LDB_SUCCESS) {
 110                 return ldb_module_done(ac->req, NULL, NULL, ret);
 111         }
 112
 113         talloc_free(ares);
 114         return LDB_SUCCESS;
 115 }
 116
 117 static int subtree_rename_next_request(struct subtree_rename_context *ac)
 118 {
 119         struct ldb_context *ldb;
 120         struct ldb_request *req;
 121         int ret;
 122
 123         ldb = ldb_module_get_ctx(ac->module);
 124
 125         if (ac->current == NULL) {
 126                 return ldb_operr(ldb);
 127         }
 128
 129         ret = ldb_build_rename_req(&req, ldb, ac->current,
 130                                    ac->current->olddn,
 131                                    ac->current->newdn,
 132                                    ac->req->controls,
 133                                    ac, subtree_rename_callback,
 134                                    ac->req);
 135         if (ret != LDB_SUCCESS) {
 136                 return ret;
 137         }
 138
 139         ac->current = ac->current->next;
 140
 141         return ldb_next_request(ac->module, req);
 142 }
 143
 144 static int check_constraints(struct ldb_message *msg,
 145                              struct subtree_rename_context *ac,
 146                              struct ldb_dn *olddn, struct ldb_dn *newdn)
 147 {
 148         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 149         struct ldb_dn *dn1, *dn2;
 150         int32_t systemFlags;
 151         bool move_op = false;
 152         bool rename_op = false;
 153
 154         /* Skip the checks if old and new DN are the same or if we relax */
 155
 156         if (ldb_dn_compare(olddn, newdn) == 0) {
 157                 return LDB_SUCCESS;
 158         }
 159         if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) != NULL) {
 160                 return LDB_SUCCESS;
 161         }
 162
 163         /* Objects under CN=System */
 164
 165         dn1 = ldb_dn_copy(ac, ldb_get_default_basedn(ldb));
 166         if (dn1 == NULL) return ldb_oom(ldb);
 167
 168         if ( ! ldb_dn_add_child_fmt(dn1, "CN=System")) {
 169                 talloc_free(dn1);
 170                 return LDB_ERR_OPERATIONS_ERROR;
 171         }
 172
 173         if ((ldb_dn_compare_base(dn1, olddn) == 0) &&
 174             (ldb_dn_compare_base(dn1, newdn) != 0)) {
 175                 talloc_free(dn1);
 176                 ldb_asprintf_errstring(ldb,
 177                                        "subtree_rename: Cannot move/rename %s. Objects under CN=System have to stay under it!",
 178                                        ldb_dn_get_linearized(olddn));
 179                 return LDB_ERR_OTHER;
 180         }
 181
 182         talloc_free(dn1);
 183
 184         /* LSA objects */
 185
 186         if ((samdb_find_attribute(ldb, msg, "objectClass", "secret") != NULL) ||
 187             (samdb_find_attribute(ldb, msg, "objectClass", "trustedDomain") != NULL)) {
 188                 ldb_asprintf_errstring(ldb,
 189                                        "subtree_rename: Cannot move/rename %s. It's an LSA-specific object!",
 190                                        ldb_dn_get_linearized(olddn));
 191                 return LDB_ERR_UNWILLING_TO_PERFORM;
 192         }
 193
 194         /* systemFlags */
 195
 196         dn1 = ldb_dn_get_parent(ac, olddn);
 197         if (dn1 == NULL) return ldb_oom(ldb);
 198         dn2 = ldb_dn_get_parent(ac, newdn);
 199         if (dn2 == NULL) return ldb_oom(ldb);
 200
 201         if (ldb_dn_compare(dn1, dn2) == 0) {
 202                 rename_op = true;
 203         } else {
 204                 move_op = true;
 205         }
 206
 207         talloc_free(dn1);
 208         talloc_free(dn2);
 209
 210         systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
 211
 212         /* the config system flags don't apply for the schema partition */
 213         if ((ldb_dn_compare_base(ldb_get_config_basedn(ldb), olddn) == 0) &&
 214             (ldb_dn_compare_base(ldb_get_schema_basedn(ldb), olddn) != 0)) {
 215                 if (move_op &&
 216                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_MOVE) == 0) {
 217                         /* Here we have to do more: control the
 218                          * "ALLOW_LIMITED_MOVE" flag. This means that the
 219                          * grand-grand-parents of two objects have to be equal
 220                          * in order to perform the move (this is used for
 221                          * moving "server" objects in the "sites" container). */
 222                         bool limited_move =
 223                                 systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE;
 224
 225                         if (limited_move) {
 226                                 dn1 = ldb_dn_copy(ac, olddn);
 227                                 if (dn1 == NULL) return ldb_oom(ldb);
 228                                 dn2 = ldb_dn_copy(ac, newdn);
 229                                 if (dn2 == NULL) return ldb_oom(ldb);
 230
 231                                 limited_move &= ldb_dn_remove_child_components(dn1, 3);
 232                                 limited_move &= ldb_dn_remove_child_components(dn2, 3);
 233                                 limited_move &= ldb_dn_compare(dn1, dn2) == 0;
 234
 235                                 talloc_free(dn1);
 236                                 talloc_free(dn2);
 237                         }
 238
 239                         if (!limited_move) {
 240                                 ldb_asprintf_errstring(ldb,
 241                                                        "subtree_rename: Cannot move %s, it isn't permitted!",
 242                                                        ldb_dn_get_linearized(olddn));
 243                                 return LDB_ERR_UNWILLING_TO_PERFORM;
 244                         }
 245                 }
 246                 if (rename_op &&
 247                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_RENAME) == 0) {
 248                         ldb_asprintf_errstring(ldb,
 249                                                "subtree_rename: Cannot rename %s, it isn't permitted!",
 250                                                ldb_dn_get_linearized(olddn));
 251                         return LDB_ERR_UNWILLING_TO_PERFORM;
 252                 }
 253         }
 254         if (ldb_dn_compare_base(ldb_get_schema_basedn(ldb), olddn) == 0) {
 255                 if (move_op) {
 256                         ldb_asprintf_errstring(ldb,
 257                                                "subtree_rename: Cannot move %s, it isn't permitted!",
 258                                                ldb_dn_get_linearized(olddn));
 259                         return LDB_ERR_UNWILLING_TO_PERFORM;
 260                 }
 261                 if (rename_op &&
 262                     (systemFlags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) != 0) {
 263                         ldb_asprintf_errstring(ldb,
 264                                                "subtree_rename: Cannot rename %s, it isn't permitted!",
 265                                                ldb_dn_get_linearized(olddn));
 266                         return LDB_ERR_UNWILLING_TO_PERFORM;
 267                 }
 268         }
 269         if (ldb_dn_compare_base(ldb_get_default_basedn(ldb),
 270                                 ac->current->olddn) == 0) {
 271                 if (move_op &&
 272                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE) != 0) {
 273                         ldb_asprintf_errstring(ldb,
 274                                                "subtree_rename: Cannot move %s, it isn't permitted!",
 275                                                ldb_dn_get_linearized(olddn));
 276                         return LDB_ERR_UNWILLING_TO_PERFORM;
 277                 }
 278                 if (rename_op &&
 279                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME) != 0) {
 280                         ldb_asprintf_errstring(ldb,
 281                                                        "subtree_rename: Cannot rename %s, it isn't permitted!",
 282                                                ldb_dn_get_linearized(olddn));
 283                         return LDB_ERR_UNWILLING_TO_PERFORM;
 284                 }
 285         }
 286
 287         return LDB_SUCCESS;
 288 }
 289
 290 static int subtree_rename_search_callback(struct ldb_request *req,
 291                                           struct ldb_reply *ares)
 292 {
 293         struct subren_msg_store *store;
 294         struct subtree_rename_context *ac;
 295         int ret;
 296
 297         ac = talloc_get_type(req->context, struct subtree_rename_context);
 298
 299         if (!ares || !ac->current) {
 300                 return ldb_module_done(ac->req, NULL, NULL,
 301                                         LDB_ERR_OPERATIONS_ERROR);
 302         }
 303         if (ares->error != LDB_SUCCESS) {
 304                 return ldb_module_done(ac->req, ares->controls,
 305                                         ares->response, ares->error);
 306         }
 307
 308         switch (ares->type) {
 309         case LDB_REPLY_ENTRY:
 310                 if (ldb_dn_compare(ares->message->dn, ac->list->olddn) == 0) {
 311                         /* this was already stored by the
 312                          * subtree_rename_search() */
 313
 314                         ret = check_constraints(ares->message, ac,
 315                                                 ac->list->olddn,
 316                                                 ac->list->newdn);
 317                         if (ret != LDB_SUCCESS) {
 318                                 return ldb_module_done(ac->req, NULL, NULL,
 319                                                        ret);
 320                         }
 321
 322                         talloc_free(ares);
 323                         return LDB_SUCCESS;
 324                 }
 325
 326                 store = talloc_zero(ac, struct subren_msg_store);
 327                 if (store == NULL) {
 328                         return ldb_module_done(ac->req, NULL, NULL,
 329                                                 LDB_ERR_OPERATIONS_ERROR);
 330                 }
 331                 ac->current->next = store;
 332                 ac->current = store;
 333
 334                 /* the first list element contains the base for the rename */
 335                 store->olddn = talloc_steal(store, ares->message->dn);
 336                 store->newdn = ldb_dn_copy(store, store->olddn);
 337
 338                 if ( ! ldb_dn_remove_base_components(store->newdn,
 339                                 ldb_dn_get_comp_num(ac->list->olddn))) {
 340                         return ldb_module_done(ac->req, NULL, NULL,
 341                                                 LDB_ERR_OPERATIONS_ERROR);
 342                 }
 343
 344                 if ( ! ldb_dn_add_base(store->newdn, ac->list->newdn)) {
 345                         return ldb_module_done(ac->req, NULL, NULL,
 346                                                 LDB_ERR_OPERATIONS_ERROR);
 347                 }
 348
 349                 ret = check_constraints(ares->message, ac,
 350                                         store->olddn, store->newdn);
 351                 if (ret != LDB_SUCCESS) {
 352                         return ldb_module_done(ac->req, NULL, NULL, ret);
 353                 }
 354
 355                 break;
 356
 357         case LDB_REPLY_REFERRAL:
 358                 /* ignore */
 359                 break;
 360
 361         case LDB_REPLY_DONE:
 362
 363                 /* rewind ac->current */
 364                 ac->current = ac->list;
 365
 366                 /* All dns set up, start with the first one */
 367                 ret = subtree_rename_next_request(ac);
 368
 369                 if (ret != LDB_SUCCESS) {
 370                         return ldb_module_done(ac->req, NULL, NULL, ret);
 371                 }
 372                 break;
 373         }
 374
 375         talloc_free(ares);
 376         return LDB_SUCCESS;
 377 }
 378
 379 /* rename */
 380 static int subtree_rename(struct ldb_module *module, struct ldb_request *req)
 381 {
 382         struct ldb_context *ldb;
 383         static const char * const attrs[] = { "objectClass", "systemFlags",
 384                                               NULL };
 385         struct ldb_request *search_req;
 386         struct subtree_rename_context *ac;
 387         int ret;
 388
 389         if (ldb_dn_is_special(req->op.rename.olddn)) { /* do not manipulate our control entries */
 390                 return ldb_next_request(module, req);
 391         }
 392
 393         ldb = ldb_module_get_ctx(module);
 394
 395         /* This gets complex:  We need to:
 396            - Do a search for all entires under this entry
 397            - Wait for these results to appear
 398            - In the callback for each result, issue a modify request
 399            - That will include this rename, we hope
 400            - Wait for each modify result
 401            - Regain our sanity
 402         */
 403
 404         ac = subren_ctx_init(module, req);
 405         if (!ac) {
 406                 return ldb_oom(ldb);
 407         }
 408
 409         /* add this entry as the first to do */
 410         ac->current = talloc_zero(ac, struct subren_msg_store);
 411         if (ac->current == NULL) {
 412                 return ldb_oom(ldb);
 413         }
 414         ac->current->olddn = req->op.rename.olddn;
 415         ac->current->newdn = req->op.rename.newdn;
 416         ac->list = ac->current;
 417
 418         ret = ldb_build_search_req(&search_req, ldb, ac,
 419                                    req->op.rename.olddn,
 420                                    LDB_SCOPE_SUBTREE,
 421                                    "(objectClass=*)",
 422                                    attrs,
 423                                    NULL,
 424                                    ac,
 425                                    subtree_rename_search_callback,
 426                                    req);
 427         if (ret != LDB_SUCCESS) {
 428                 return ret;
 429         }
 430
 431         return ldb_next_request(module, search_req);
 432 }
 433
 434 _PUBLIC_ const struct ldb_module_ops ldb_subtree_rename_module_ops = {
 435         .name              = "subtree_rename",
 436         .rename            = subtree_rename
 437 };