dsdb: audit samdb and password changes
[sfrench/samba-autobuild/.git] / source4 / dsdb / samdb / ldb_modules / instancetype.c
index 064c28ec6501b83ea6af601ae614a53027d6b332..9a3fd1141fc056876fb1f00df8e564c295ca19a7 100644 (file)
@@ -1,27 +1,23 @@
 /* 
    ldb database library
 
-   Copyright (C) Simo Sorce  2004-2006
+   Copyright (C) Simo Sorce  2004-2008
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
    Copyright (C) Andrew Tridgell 2005
    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
 
-     ** NOTE! The following LGPL license applies to the ldb
-     ** library. This does NOT imply that all of Samba is released
-     ** under the LGPL
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
    
-   This library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Lesser General Public
-   License as published by the Free Software Foundation; either
-   version 3 of the License, or (at your option) any later version.
-
-   This library is distributed in the hope that it will be useful,
+   This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Lesser General Public License for more details.
-
-   You should have received a copy of the GNU Lesser General Public
-   License along with this library; if not, see <http://www.gnu.org/licenses/>.
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 /*
  */
 
 #include "includes.h"
-#include "ldb/include/ldb_includes.h"
+#include "ldb.h"
+#include "ldb_module.h"
 #include "librpc/gen_ndr/ndr_misc.h"
-#include "param/param.h"
 #include "dsdb/samdb/samdb.h"
-#include "dsdb/common/flags.h"
+#include "../libds/common/flags.h"
+#include "dsdb/samdb/ldb_modules/util.h"
 
 /* add_record: add instancetype attribute */
 static int instancetype_add(struct ldb_module *module, struct ldb_request *req)
 {
+       struct ldb_context *ldb = ldb_module_get_ctx(module);
        struct ldb_request *down_req;
        struct ldb_message *msg;
-       uint32_t instance_type;
+       struct ldb_message_element *el;
+       uint32_t instanceType;
        int ret;
-       const struct ldb_control *partition_ctrl;
-       const struct dsdb_control_current_partition *partition;
-
-       ldb_debug(module->ldb, LDB_DEBUG_TRACE, "instancetype_add_record\n");
 
        /* do not manipulate our control entries */
        if (ldb_dn_is_special(req->op.add.message->dn)) {
                return ldb_next_request(module, req);
        }
 
-       partition_ctrl = ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID);
-       if (!partition_ctrl) {
-               ldb_debug_set(module->ldb, LDB_DEBUG_FATAL,
-                             "instancetype_add: no current partition control found");
-               return LDB_ERR_CONSTRAINT_VIOLATION;
-       }
+       ldb_debug(ldb, LDB_DEBUG_TRACE, "instancetype_add\n");
+
+       el = ldb_msg_find_element(req->op.add.message, "instanceType");
+       if (el != NULL) {
+               if (el->num_values != 1) {
+                       ldb_set_errstring(ldb, "instancetype: the 'instanceType' attribute is single-valued!");
+                       return LDB_ERR_UNWILLING_TO_PERFORM;
+               }
 
-       partition = talloc_get_type(partition_ctrl->data,
-                                   struct dsdb_control_current_partition);
-       SMB_ASSERT(partition && partition->version == DSDB_CONTROL_CURRENT_PARTITION_VERSION);
+               instanceType = ldb_msg_find_attr_as_uint(req->op.add.message,
+                                                        "instanceType", 0);
+               if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
+                       /*
+                        * If we have no NC add operation (no TYPE_IS_NC_HEAD)
+                        * then "instanceType" can only be "0" or "TYPE_WRITE".
+                        */
+                       if ((instanceType != 0) &&
+                           ((instanceType & INSTANCE_TYPE_WRITE) == 0)) {
+                               ldb_set_errstring(ldb, "instancetype: if TYPE_IS_NC_HEAD wasn't set, then only TYPE_WRITE or 0 are allowed!");
+                               return LDB_ERR_UNWILLING_TO_PERFORM;
+                       }
+               } else {
+                       /*
+                        * If we have a NC add operation then we need also the
+                        * "TYPE_WRITE" flag in order to succeed,
+                        * unless this NC is not instantiated
+                        */
+                       if (ldb_request_get_control(req, DSDB_CONTROL_PARTIAL_REPLICA)) {
+                               if (!(instanceType & INSTANCE_TYPE_UNINSTANT)) {
+                                       ldb_set_errstring(ldb, "instancetype: if TYPE_IS_NC_HEAD "
+                                                         "was set, and we are creating a new NC "
+                                                         "over DsAddEntry then also TYPE_UNINSTANT is requested!");
+                                       return LDB_ERR_UNWILLING_TO_PERFORM;
+                               }
+                       } else {
+                               if (!(instanceType & INSTANCE_TYPE_WRITE)) {
+                                       ldb_set_errstring(ldb, "instancetype: if TYPE_IS_NC_HEAD "
+                                                         "was set, then also TYPE_WRITE is requested!");
+                                       return LDB_ERR_UNWILLING_TO_PERFORM;
+                               }
+                       }
+
+                       /*
+                        * TODO: Confirm we are naming master or start
+                        * a remote call to the naming master to
+                        * create the crossRef object
+                        */
+               }
 
-       down_req = talloc(req, struct ldb_request);
-       if (down_req == NULL) {
-               return LDB_ERR_OPERATIONS_ERROR;
+               /* we did only tests, so proceed with the original request */
+               return ldb_next_request(module, req);
        }
 
-       *down_req = *req;
-
        /* we have to copy the message as the caller might have it as a const */
-       down_req->op.add.message = msg = ldb_msg_copy_shallow(down_req, req->op.add.message);
+       msg = ldb_msg_copy_shallow(req, req->op.add.message);
        if (msg == NULL) {
-               talloc_free(down_req);
-               return LDB_ERR_OPERATIONS_ERROR;
+               return ldb_oom(ldb);
        }
 
        /*
         * TODO: calculate correct instance type
         */
-       instance_type = INSTANCE_TYPE_WRITE;
-       if (ldb_dn_compare(partition->dn, msg->dn) == 0) {
-               instance_type |= INSTANCE_TYPE_IS_NC_HEAD;
-               if (ldb_dn_compare(msg->dn, samdb_base_dn(module->ldb)) != 0) {
-                       instance_type |= INSTANCE_TYPE_NC_ABOVE;
-               }
-       }
+       instanceType = INSTANCE_TYPE_WRITE;
 
-       ret = ldb_msg_add_fmt(msg, "instanceType", "%u", instance_type);
+       ret = samdb_msg_add_uint(ldb, msg, msg, "instanceType", instanceType);
        if (ret != LDB_SUCCESS) {
-               talloc_free(down_req);
-               ldb_oom(module->ldb);
-               return LDB_ERR_OPERATIONS_ERROR;
+               return ret;
        }
 
-       ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
+       ret = ldb_build_add_req(&down_req, ldb, req,
+                               msg,
+                               req->controls,
+                               req, dsdb_next_callback,
+                               req);
+       LDB_REQ_SET_LOCATION(down_req);
+       if (ret != LDB_SUCCESS) {
+               return ret;
+       }
 
        /* go on with the call chain */
-       ret = ldb_next_request(module, down_req);
+       return ldb_next_request(module, down_req);
+}
 
-       /* do not free down_req as the call results may be linked to it,
-        * it will be freed when the upper level request get freed */
-       if (ret == LDB_SUCCESS) {
-               req->handle = down_req->handle;
+/* deny instancetype modification */
+static int instancetype_mod(struct ldb_module *module, struct ldb_request *req)
+{
+       struct ldb_context *ldb = ldb_module_get_ctx(module);
+       struct ldb_message_element *el;
+
+       /* do not manipulate our control entries */
+       if (ldb_dn_is_special(req->op.mod.message->dn)) {
+               return ldb_next_request(module, req);
        }
 
-       return ret;
+       ldb_debug(ldb, LDB_DEBUG_TRACE, "instancetype_mod\n");
+
+       el = ldb_msg_find_element(req->op.mod.message, "instanceType");
+       if (el != NULL) {
+               /* Except to allow dbcheck to fix things, this must never be modified */
+               if (!ldb_request_get_control(req, DSDB_CONTROL_DBCHECK)) {
+                       ldb_set_errstring(ldb, "instancetype: the 'instanceType' attribute can never be changed!");
+                       return LDB_ERR_CONSTRAINT_VIOLATION;
+               }
+       }
+       return ldb_next_request(module, req);
 }
 
-static const struct ldb_module_ops instancetype_ops = {
+static const struct ldb_module_ops ldb_instancetype_module_ops = {
        .name          = "instancetype",
        .add           = instancetype_add,
+       .modify        = instancetype_mod
 };
 
-
-int ldb_instancetype_init(void)
+int ldb_instancetype_module_init(const char *version)
 {
-       return ldb_register_module(&instancetype_ops);
+       LDB_MODULE_CHECK_VERSION(version);
+       return ldb_register_module(&ldb_instancetype_module_ops);
 }