source4/dsdb/samdb/ldb_modules/subtree_rename.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2007
   5    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 /*
  22  *  Name: ldb
  23  *
  24  *  Component: ldb subtree rename module
  25  *
  26  *  Description: Rename a subtree in LDB
  27  *
  28  *  Author: Andrew Bartlett
  29  */
  30
  31 #include "includes.h"
  32 #include <ldb.h>
  33 #include <ldb_module.h>
  34 #include "libds/common/flags.h"
  35 #include "dsdb/samdb/samdb.h"
  36
  37 struct subren_msg_store {
  38         struct subren_msg_store *next;
  39         struct ldb_dn *olddn;
  40         struct ldb_dn *newdn;
  41 };
  42
  43 struct subtree_rename_context {
  44         struct ldb_module *module;
  45         struct ldb_request *req;
  46
  47         struct subren_msg_store *list;
  48         struct subren_msg_store *current;
  49 };
  50
  51 static struct subtree_rename_context *subren_ctx_init(struct ldb_module *module,
  52                                                       struct ldb_request *req)
  53 {
  54         struct ldb_context *ldb;
  55         struct subtree_rename_context *ac;
  56
  57         ldb = ldb_module_get_ctx(module);
  58
  59         ac = talloc_zero(req, struct subtree_rename_context);
  60         if (ac == NULL) {
  61                 return NULL;
  62         }
  63
  64         ac->module = module;
  65         ac->req = req;
  66
  67         return ac;
  68 }
  69
  70 static int subtree_rename_next_request(struct subtree_rename_context *ac);
  71
  72 static int subtree_rename_callback(struct ldb_request *req,
  73                                    struct ldb_reply *ares)
  74 {
  75         struct ldb_context *ldb;
  76         struct subtree_rename_context *ac;
  77         int ret;
  78
  79         ac = talloc_get_type(req->context, struct subtree_rename_context);
  80         ldb = ldb_module_get_ctx(ac->module);
  81
  82         if (!ares) {
  83                 return ldb_module_done(ac->req, NULL, NULL,
  84                                         LDB_ERR_OPERATIONS_ERROR);
  85         }
  86
  87         if (ares->type == LDB_REPLY_REFERRAL) {
  88                 return ldb_module_send_referral(ac->req, ares->referral);
  89         }
  90
  91         if (ares->error != LDB_SUCCESS) {
  92                 return ldb_module_done(ac->req, ares->controls,
  93                                         ares->response, ares->error);
  94         }
  95
  96         if (ares->type != LDB_REPLY_DONE) {
  97                 ldb_set_errstring(ldb, "Invalid reply type!\n");
  98                 return ldb_module_done(ac->req, NULL, NULL,
  99                                         LDB_ERR_OPERATIONS_ERROR);
 100         }
 101
 102         if (ac->current == NULL) {
 103                 /* this was the last one */
 104                 return ldb_module_done(ac->req, ares->controls,
 105                                         ares->response, LDB_SUCCESS);
 106         }
 107
 108         ret = subtree_rename_next_request(ac);
 109         if (ret != LDB_SUCCESS) {
 110                 return ldb_module_done(ac->req, NULL, NULL, ret);
 111         }
 112
 113         talloc_free(ares);
 114         return LDB_SUCCESS;
 115 }
 116
 117 static int subtree_rename_next_request(struct subtree_rename_context *ac)
 118 {
 119         struct ldb_context *ldb;
 120         struct ldb_request *req;
 121         int ret;
 122
 123         ldb = ldb_module_get_ctx(ac->module);
 124
 125         if (ac->current == NULL) {
 126                 return ldb_operr(ldb);
 127         }
 128
 129         ret = ldb_build_rename_req(&req, ldb, ac->current,
 130                                    ac->current->olddn,
 131                                    ac->current->newdn,
 132                                    ac->req->controls,
 133                                    ac, subtree_rename_callback,
 134                                    ac->req);
 135         LDB_REQ_SET_LOCATION(req);
 136         if (ret != LDB_SUCCESS) {
 137                 return ret;
 138         }
 139
 140         ac->current = ac->current->next;
 141
 142         return ldb_next_request(ac->module, req);
 143 }
 144
 145 static int check_constraints(struct ldb_message *msg,
 146                              struct subtree_rename_context *ac,
 147                              struct ldb_dn *olddn, struct ldb_dn *newdn)
 148 {
 149         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 150         struct ldb_dn *dn1, *dn2, *nc_root;
 151         int32_t systemFlags;
 152         bool move_op = false;
 153         bool rename_op = false;
 154         int ret;
 155
 156         /* Skip the checks if old and new DN are the same, or if we have the
 157          * relax control specified or if the returned objects is already
 158          * deleted and needs only to be moved for consistency. */
 159
 160         if (ldb_dn_compare(olddn, newdn) == 0) {
 161                 return LDB_SUCCESS;
 162         }
 163         if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) != NULL) {
 164                 return LDB_SUCCESS;
 165         }
 166         if (ldb_msg_find_attr_as_bool(msg, "isDeleted", false)) {
 167                 return LDB_SUCCESS;
 168         }
 169
 170         /* Objects under CN=System */
 171
 172         dn1 = ldb_dn_copy(ac, ldb_get_default_basedn(ldb));
 173         if (dn1 == NULL) return ldb_oom(ldb);
 174
 175         if ( ! ldb_dn_add_child_fmt(dn1, "CN=System")) {
 176                 talloc_free(dn1);
 177                 return LDB_ERR_OPERATIONS_ERROR;
 178         }
 179
 180         if ((ldb_dn_compare_base(dn1, olddn) == 0) &&
 181             (ldb_dn_compare_base(dn1, newdn) != 0)) {
 182                 talloc_free(dn1);
 183                 ldb_asprintf_errstring(ldb,
 184                                        "subtree_rename: Cannot move/rename %s. Objects under CN=System have to stay under it!",
 185                                        ldb_dn_get_linearized(olddn));
 186                 return LDB_ERR_OTHER;
 187         }
 188
 189         talloc_free(dn1);
 190
 191         /* LSA objects */
 192
 193         if ((samdb_find_attribute(ldb, msg, "objectClass", "secret") != NULL) ||
 194             (samdb_find_attribute(ldb, msg, "objectClass", "trustedDomain") != NULL)) {
 195                 ldb_asprintf_errstring(ldb,
 196                                        "subtree_rename: Cannot move/rename %s. It's an LSA-specific object!",
 197                                        ldb_dn_get_linearized(olddn));
 198                 return LDB_ERR_UNWILLING_TO_PERFORM;
 199         }
 200
 201         /* systemFlags */
 202
 203         dn1 = ldb_dn_get_parent(ac, olddn);
 204         if (dn1 == NULL) return ldb_oom(ldb);
 205         dn2 = ldb_dn_get_parent(ac, newdn);
 206         if (dn2 == NULL) return ldb_oom(ldb);
 207
 208         if (ldb_dn_compare(dn1, dn2) == 0) {
 209                 rename_op = true;
 210         } else {
 211                 move_op = true;
 212         }
 213
 214         talloc_free(dn1);
 215         talloc_free(dn2);
 216
 217         systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
 218
 219         /* Fetch name context */
 220
 221         ret = dsdb_find_nc_root(ldb, ac, olddn, &nc_root);
 222         if (ret != LDB_SUCCESS) {
 223                 return ret;
 224         }
 225
 226         if (ldb_dn_compare(nc_root, ldb_get_schema_basedn(ldb)) == 0) {
 227                 if (move_op) {
 228                         ldb_asprintf_errstring(ldb,
 229                                                "subtree_rename: Cannot move %s, it isn't permitted!",
 230                                                ldb_dn_get_linearized(olddn));
 231                         return LDB_ERR_UNWILLING_TO_PERFORM;
 232                 }
 233                 if (rename_op &&
 234                     (systemFlags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) != 0) {
 235                         ldb_asprintf_errstring(ldb,
 236                                                "subtree_rename: Cannot rename %s, it isn't permitted!",
 237                                                ldb_dn_get_linearized(olddn));
 238                         return LDB_ERR_UNWILLING_TO_PERFORM;
 239                 }
 240         } else if (ldb_dn_compare(nc_root, ldb_get_config_basedn(ldb)) == 0) {
 241                 if (move_op &&
 242                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_MOVE) == 0) {
 243                         /* Here we have to do more: control the
 244                          * "ALLOW_LIMITED_MOVE" flag. This means that the
 245                          * grand-grand-parents of two objects have to be equal
 246                          * in order to perform the move (this is used for
 247                          * moving "server" objects in the "sites" container). */
 248                         bool limited_move =
 249                                 systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE;
 250
 251                         if (limited_move) {
 252                                 dn1 = ldb_dn_copy(ac, olddn);
 253                                 if (dn1 == NULL) return ldb_oom(ldb);
 254                                 dn2 = ldb_dn_copy(ac, newdn);
 255                                 if (dn2 == NULL) return ldb_oom(ldb);
 256
 257                                 limited_move &= ldb_dn_remove_child_components(dn1, 3);
 258                                 limited_move &= ldb_dn_remove_child_components(dn2, 3);
 259                                 limited_move &= ldb_dn_compare(dn1, dn2) == 0;
 260
 261                                 talloc_free(dn1);
 262                                 talloc_free(dn2);
 263                         }
 264
 265                         if (!limited_move) {
 266                                 ldb_asprintf_errstring(ldb,
 267                                                        "subtree_rename: Cannot move %s, it isn't permitted!",
 268                                                        ldb_dn_get_linearized(olddn));
 269                                 return LDB_ERR_UNWILLING_TO_PERFORM;
 270                         }
 271                 }
 272                 if (rename_op &&
 273                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_RENAME) == 0) {
 274                         ldb_asprintf_errstring(ldb,
 275                                                "subtree_rename: Cannot rename %s, it isn't permitted!",
 276                                                ldb_dn_get_linearized(olddn));
 277                         return LDB_ERR_UNWILLING_TO_PERFORM;
 278                 }
 279         } else if (ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) == 0) {
 280                 if (move_op &&
 281                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE) != 0) {
 282                         ldb_asprintf_errstring(ldb,
 283                                                "subtree_rename: Cannot move %s, it isn't permitted!",
 284                                                ldb_dn_get_linearized(olddn));
 285                         return LDB_ERR_UNWILLING_TO_PERFORM;
 286                 }
 287                 if (rename_op &&
 288                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME) != 0) {
 289                         ldb_asprintf_errstring(ldb,
 290                                                        "subtree_rename: Cannot rename %s, it isn't permitted!",
 291                                                ldb_dn_get_linearized(olddn));
 292                         return LDB_ERR_UNWILLING_TO_PERFORM;
 293                 }
 294         }
 295
 296         talloc_free(nc_root);
 297
 298         return LDB_SUCCESS;
 299 }
 300
 301 static int subtree_rename_search_callback(struct ldb_request *req,
 302                                           struct ldb_reply *ares)
 303 {
 304         struct subren_msg_store *store;
 305         struct subtree_rename_context *ac;
 306         int ret;
 307
 308         ac = talloc_get_type(req->context, struct subtree_rename_context);
 309
 310         if (!ares || !ac->current) {
 311                 return ldb_module_done(ac->req, NULL, NULL,
 312                                         LDB_ERR_OPERATIONS_ERROR);
 313         }
 314         if (ares->error != LDB_SUCCESS) {
 315                 return ldb_module_done(ac->req, ares->controls,
 316                                         ares->response, ares->error);
 317         }
 318
 319         switch (ares->type) {
 320         case LDB_REPLY_ENTRY:
 321                 if (ldb_dn_compare(ares->message->dn, ac->list->olddn) == 0) {
 322                         /* this was already stored by the
 323                          * subtree_rename_search() */
 324
 325                         ret = check_constraints(ares->message, ac,
 326                                                 ac->list->olddn,
 327                                                 ac->list->newdn);
 328                         if (ret != LDB_SUCCESS) {
 329                                 return ldb_module_done(ac->req, NULL, NULL,
 330                                                        ret);
 331                         }
 332
 333                         talloc_free(ares);
 334                         return LDB_SUCCESS;
 335                 }
 336
 337                 store = talloc_zero(ac, struct subren_msg_store);
 338                 if (store == NULL) {
 339                         return ldb_module_done(ac->req, NULL, NULL,
 340                                                 LDB_ERR_OPERATIONS_ERROR);
 341                 }
 342                 ac->current->next = store;
 343                 ac->current = store;
 344
 345                 /* the first list element contains the base for the rename */
 346                 store->olddn = talloc_steal(store, ares->message->dn);
 347                 store->newdn = ldb_dn_copy(store, store->olddn);
 348
 349                 if ( ! ldb_dn_remove_base_components(store->newdn,
 350                                 ldb_dn_get_comp_num(ac->list->olddn))) {
 351                         return ldb_module_done(ac->req, NULL, NULL,
 352                                                 LDB_ERR_OPERATIONS_ERROR);
 353                 }
 354
 355                 if ( ! ldb_dn_add_base(store->newdn, ac->list->newdn)) {
 356                         return ldb_module_done(ac->req, NULL, NULL,
 357                                                 LDB_ERR_OPERATIONS_ERROR);
 358                 }
 359
 360                 ret = check_constraints(ares->message, ac,
 361                                         store->olddn, store->newdn);
 362                 if (ret != LDB_SUCCESS) {
 363                         return ldb_module_done(ac->req, NULL, NULL, ret);
 364                 }
 365
 366                 break;
 367
 368         case LDB_REPLY_REFERRAL:
 369                 /* ignore */
 370                 break;
 371
 372         case LDB_REPLY_DONE:
 373
 374                 /* rewind ac->current */
 375                 ac->current = ac->list;
 376
 377                 /* All dns set up, start with the first one */
 378                 ret = subtree_rename_next_request(ac);
 379
 380                 if (ret != LDB_SUCCESS) {
 381                         return ldb_module_done(ac->req, NULL, NULL, ret);
 382                 }
 383                 break;
 384         }
 385
 386         talloc_free(ares);
 387         return LDB_SUCCESS;
 388 }
 389
 390 /* rename */
 391 static int subtree_rename(struct ldb_module *module, struct ldb_request *req)
 392 {
 393         struct ldb_context *ldb;
 394         static const char * const attrs[] = { "objectClass", "systemFlags",
 395                                               "isDeleted", NULL };
 396         struct ldb_request *search_req;
 397         struct subtree_rename_context *ac;
 398         int ret;
 399
 400         if (ldb_dn_is_special(req->op.rename.olddn)) { /* do not manipulate our control entries */
 401                 return ldb_next_request(module, req);
 402         }
 403
 404         ldb = ldb_module_get_ctx(module);
 405
 406         /* This gets complex:  We need to:
 407            - Do a search for all entires under this entry
 408            - Wait for these results to appear
 409            - In the callback for each result, issue a modify request
 410            - That will include this rename, we hope
 411            - Wait for each modify result
 412            - Regain our sanity
 413         */
 414
 415         ac = subren_ctx_init(module, req);
 416         if (!ac) {
 417                 return ldb_oom(ldb);
 418         }
 419
 420         /* add this entry as the first to do */
 421         ac->current = talloc_zero(ac, struct subren_msg_store);
 422         if (ac->current == NULL) {
 423                 return ldb_oom(ldb);
 424         }
 425         ac->current->olddn = req->op.rename.olddn;
 426         ac->current->newdn = req->op.rename.newdn;
 427         ac->list = ac->current;
 428
 429         ret = ldb_build_search_req(&search_req, ldb, ac,
 430                                    req->op.rename.olddn,
 431                                    LDB_SCOPE_SUBTREE,
 432                                    "(objectClass=*)",
 433                                    attrs,
 434                                    NULL,
 435                                    ac,
 436                                    subtree_rename_search_callback,
 437                                    req);
 438         LDB_REQ_SET_LOCATION(search_req);
 439         if (ret != LDB_SUCCESS) {
 440                 return ret;
 441         }
 442
 443         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
 444                                       true, NULL);
 445         if (ret != LDB_SUCCESS) {
 446                 return ret;
 447         }
 448
 449         return ldb_next_request(module, search_req);
 450 }
 451
 452 static const struct ldb_module_ops ldb_subtree_rename_module_ops = {
 453         .name              = "subtree_rename",
 454         .rename            = subtree_rename
 455 };
 456
 457 int ldb_subtree_rename_module_init(const char *version)
 458 {
 459         LDB_MODULE_CHECK_VERSION(version);
 460         return ldb_register_module(&ldb_subtree_rename_module_ops);
 461 }