4 Copyright (C) Simo Sorce 2006-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
6 Copyright (C) Stefan Metzmacher 2009
7 Copyright (C) Matthias Dieter Wallnöfer 2010
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU Lesser General Public
20 License along with this library; if not, see <http://www.gnu.org/licenses/>.
26 * Component: objectclass attribute checking module
28 * Description: this checks the attributes on a directory entry (if they're
29 * allowed, if the syntax is correct, if mandatory ones are missing,
30 * denies the deletion of mandatory ones...). The module contains portions
31 * of the "objectclass" and the "validate_update" LDB module.
33 * Author: Matthias Dieter Wallnöfer
37 #include "ldb_module.h"
38 #include "dsdb/samdb/samdb.h"
42 struct ldb_module *module;
43 struct ldb_request *req;
44 const struct dsdb_schema *schema;
46 struct ldb_message *msg;
48 struct ldb_reply *search_res;
49 struct ldb_reply *mod_ares;
52 static struct oc_context *oc_init_context(struct ldb_module *module,
53 struct ldb_request *req)
55 struct ldb_context *ldb;
56 struct oc_context *ac;
58 ldb = ldb_module_get_ctx(module);
60 ac = talloc_zero(req, struct oc_context);
68 ac->schema = dsdb_get_schema(ldb, ac);
73 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares);
75 /* checks correctness of dSHeuristics attribute
76 * as described in MS-ADTS 7.1.1.2.4.1.2 dSHeuristics */
77 static int oc_validate_dsheuristics(struct ldb_message_element *el)
79 if (el->num_values > 0) {
80 if (el->values[0].length > DS_HR_LDAP_BYPASS_UPPER_LIMIT_BOUNDS) {
81 return LDB_ERR_CONSTRAINT_VIOLATION;
82 } else if (el->values[0].length >= DS_HR_TENTH_CHAR
83 && el->values[0].data[DS_HR_TENTH_CHAR-1] != '1') {
84 return LDB_ERR_CONSTRAINT_VIOLATION;
91 static int attr_handler(struct oc_context *ac)
93 struct ldb_context *ldb;
94 struct ldb_message *msg;
95 struct ldb_request *child_req;
96 const struct dsdb_attribute *attr;
100 struct dsdb_syntax_ctx syntax_ctx;
102 ldb = ldb_module_get_ctx(ac->module);
104 if (ac->req->operation == LDB_ADD) {
105 msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
107 msg = ldb_msg_copy_shallow(ac, ac->req->op.mod.message);
114 /* initialize syntax checking context */
115 dsdb_syntax_ctx_init(&syntax_ctx, ldb, ac->schema);
117 /* Check if attributes exist in the schema, if the values match,
118 * if they're not operational and fix the names to the match the schema
120 for (i = 0; i < msg->num_elements; i++) {
121 attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
122 msg->elements[i].name);
124 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' was not found in the schema!",
125 msg->elements[i].name,
126 ldb_dn_get_linearized(msg->dn));
127 return LDB_ERR_NO_SUCH_ATTRIBUTE;
130 if ((attr->linkID & 1) == 1) {
131 /* Odd is for the target. Illegal to modify */
132 ldb_asprintf_errstring(ldb,
133 "objectclass_attrs: attribute '%s' on entry '%s' must not be modified directly, it is a linked attribute",
134 msg->elements[i].name,
135 ldb_dn_get_linearized(msg->dn));
136 return LDB_ERR_UNWILLING_TO_PERFORM;
139 if (!(msg->elements[i].flags & LDB_FLAG_INTERNAL_DISABLE_VALIDATION)) {
140 werr = attr->syntax->validate_ldb(&syntax_ctx, attr,
142 if (!W_ERROR_IS_OK(werr)) {
143 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' contains at least one invalid value!",
144 msg->elements[i].name,
145 ldb_dn_get_linearized(msg->dn));
146 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
150 if ((attr->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED) != 0) {
151 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' is constructed!",
152 msg->elements[i].name,
153 ldb_dn_get_linearized(msg->dn));
154 if (ac->req->operation == LDB_ADD) {
155 return LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE;
157 return LDB_ERR_CONSTRAINT_VIOLATION;
161 /* "description" on AD is very special: it's nearly single-
162 * valued (only on add operations it isn't). */
163 if ((ac->req->operation == LDB_MODIFY) &&
164 (ldb_attr_cmp(attr->lDAPDisplayName, "description") == 0)) {
165 /* Multi-valued add or replace operations are always
167 if ((LDB_FLAG_MOD_TYPE(msg->elements[i].flags)
168 != LDB_FLAG_MOD_DELETE) &&
169 (msg->elements[i].num_values > 1)) {
170 ldb_asprintf_errstring(ldb,
171 "objectclass_attrs: attribute '%s' on entry '%s' is changed using a multi-valued add or replace operation!",
172 msg->elements[i].name,
173 ldb_dn_get_linearized(msg->dn));
174 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
177 /* Add operations are only allowed if no value exists */
178 if (LDB_FLAG_MOD_TYPE(msg->elements[i].flags)
179 == LDB_FLAG_MOD_ADD) {
180 const char *attrs[] = { attr->lDAPDisplayName,
182 struct ldb_result *res;
183 struct ldb_message_element *el;
185 ret = ldb_search(ldb, ac, &res, msg->dn,
186 LDB_SCOPE_BASE, attrs, NULL);
187 if (ret != LDB_SUCCESS) {
191 el = ldb_msg_find_element(res->msgs[0],
192 attr->lDAPDisplayName);
194 ldb_asprintf_errstring(ldb,
195 "objectclass_attrs: attribute '%s' on entry '%s' is changed using an add operation, but there a value already exists!",
196 msg->elements[i].name,
197 ldb_dn_get_linearized(msg->dn));
198 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
204 /* "dSHeuristics" syntax check */
205 if (ldb_attr_cmp(attr->lDAPDisplayName, "dSHeuristics") == 0) {
206 ret = oc_validate_dsheuristics(&(msg->elements[i]));
207 if (ret != LDB_SUCCESS) {
212 /* Substitute the attribute name to match in case */
213 msg->elements[i].name = attr->lDAPDisplayName;
216 if (ac->req->operation == LDB_ADD) {
217 ret = ldb_build_add_req(&child_req, ldb, ac,
218 msg, ac->req->controls,
219 ac, oc_op_callback, ac->req);
220 LDB_REQ_SET_LOCATION(child_req);
222 ret = ldb_build_mod_req(&child_req, ldb, ac,
223 msg, ac->req->controls,
224 ac, oc_op_callback, ac->req);
225 LDB_REQ_SET_LOCATION(child_req);
227 if (ret != LDB_SUCCESS) {
231 return ldb_next_request(ac->module, child_req);
235 these are attributes which are left over from old ways of doing
236 things in ldb, and are harmless
238 static const char *harmless_attrs[] = { "parentGUID", NULL };
240 static int attr_handler2(struct oc_context *ac)
242 struct ldb_context *ldb;
243 struct ldb_message_element *oc_element;
244 struct ldb_message *msg;
245 const char **must_contain, **may_contain, **found_must_contain;
246 /* There exists a hardcoded delete-protected attributes list in AD */
247 const char *del_prot_attributes[] = { "nTSecurityDescriptor",
248 "objectSid", "sAMAccountType", "sAMAccountName", "groupType",
249 "primaryGroupID", "userAccountControl", NULL }, **l;
250 const struct dsdb_attribute *attr;
254 ldb = ldb_module_get_ctx(ac->module);
256 if (ac->search_res == NULL) {
257 return ldb_operr(ldb);
260 /* We rely here on the preceding "objectclass" LDB module which did
261 * already fix up the objectclass list (inheritance, order...). */
262 oc_element = ldb_msg_find_element(ac->search_res->message,
264 if (oc_element == NULL) {
265 return ldb_operr(ldb);
268 must_contain = dsdb_full_attribute_list(ac, ac->schema, oc_element,
269 DSDB_SCHEMA_ALL_MUST);
270 may_contain = dsdb_full_attribute_list(ac, ac->schema, oc_element,
271 DSDB_SCHEMA_ALL_MAY);
272 found_must_contain = const_str_list(str_list_copy(ac, must_contain));
273 if ((must_contain == NULL) || (may_contain == NULL)
274 || (found_must_contain == NULL)) {
275 return ldb_operr(ldb);
278 /* Check the delete-protected attributes list */
279 msg = ac->search_res->message;
280 for (l = del_prot_attributes; *l != NULL; l++) {
281 struct ldb_message_element *el;
283 el = ldb_msg_find_element(ac->msg, *l);
286 * It was not specified in the add or modify,
287 * so it doesn't need to be in the stored record
292 found = str_list_check_ci(must_contain, *l);
294 found = str_list_check_ci(may_contain, *l);
296 if (found && (ldb_msg_find_element(msg, *l) == NULL)) {
297 ldb_asprintf_errstring(ldb, "objectclass_attrs: delete protected attribute '%s' on entry '%s' missing!",
299 ldb_dn_get_linearized(msg->dn));
300 return LDB_ERR_UNWILLING_TO_PERFORM;
304 /* Check if all specified attributes are valid in the given
305 * objectclasses and if they meet additional schema restrictions. */
306 for (i = 0; i < msg->num_elements; i++) {
307 attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
308 msg->elements[i].name);
310 return ldb_operr(ldb);
313 /* We can use "str_list_check" with "strcmp" here since the
314 * attribute informations from the schema are always equal
316 found = str_list_check(must_contain, attr->lDAPDisplayName);
318 str_list_remove(found_must_contain, attr->lDAPDisplayName);
320 found = str_list_check(may_contain, attr->lDAPDisplayName);
323 found = str_list_check(harmless_attrs, attr->lDAPDisplayName);
326 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' does not exist in the specified objectclasses!",
327 msg->elements[i].name,
328 ldb_dn_get_linearized(msg->dn));
329 return LDB_ERR_OBJECT_CLASS_VIOLATION;
333 if (found_must_contain[0] != NULL) {
334 ldb_asprintf_errstring(ldb, "objectclass_attrs: at least one mandatory attribute ('%s') on entry '%s' wasn't specified!",
335 found_must_contain[0],
336 ldb_dn_get_linearized(msg->dn));
337 return LDB_ERR_OBJECT_CLASS_VIOLATION;
340 return ldb_module_done(ac->req, ac->mod_ares->controls,
341 ac->mod_ares->response, LDB_SUCCESS);
344 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
346 struct ldb_context *ldb;
347 struct oc_context *ac;
350 ac = talloc_get_type(req->context, struct oc_context);
351 ldb = ldb_module_get_ctx(ac->module);
354 return ldb_module_done(ac->req, NULL, NULL,
355 LDB_ERR_OPERATIONS_ERROR);
357 if (ares->error != LDB_SUCCESS) {
358 return ldb_module_done(ac->req, ares->controls,
359 ares->response, ares->error);
362 ldb_reset_err_string(ldb);
364 switch (ares->type) {
365 case LDB_REPLY_ENTRY:
366 if (ac->search_res != NULL) {
367 ldb_set_errstring(ldb, "Too many results");
369 return ldb_module_done(ac->req, NULL, NULL,
370 LDB_ERR_OPERATIONS_ERROR);
373 ac->search_res = talloc_steal(ac, ares);
376 case LDB_REPLY_REFERRAL:
383 ret = attr_handler2(ac);
384 if (ret != LDB_SUCCESS) {
385 return ldb_module_done(ac->req, NULL, NULL, ret);
393 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
395 struct oc_context *ac;
396 struct ldb_context *ldb;
397 struct ldb_request *search_req;
398 struct ldb_dn *base_dn;
401 ac = talloc_get_type(req->context, struct oc_context);
402 ldb = ldb_module_get_ctx(ac->module);
405 return ldb_module_done(ac->req, NULL, NULL,
406 LDB_ERR_OPERATIONS_ERROR);
409 if (ares->type == LDB_REPLY_REFERRAL) {
410 return ldb_module_send_referral(ac->req, ares->referral);
413 if (ares->error != LDB_SUCCESS) {
414 return ldb_module_done(ac->req, ares->controls, ares->response,
418 if (ares->type != LDB_REPLY_DONE) {
420 return ldb_module_done(ac->req, NULL, NULL,
421 LDB_ERR_OPERATIONS_ERROR);
424 ac->search_res = NULL;
425 ac->mod_ares = talloc_steal(ac, ares);
427 /* This looks up all attributes of our just added/modified entry */
428 base_dn = ac->req->operation == LDB_ADD ? ac->req->op.add.message->dn
429 : ac->req->op.mod.message->dn;
430 ret = ldb_build_search_req(&search_req, ldb, ac, base_dn,
431 LDB_SCOPE_BASE, "(objectClass=*)",
433 get_search_callback, ac->req);
434 LDB_REQ_SET_LOCATION(search_req);
435 if (ret != LDB_SUCCESS) {
436 return ldb_module_done(ac->req, NULL, NULL, ret);
439 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
441 if (ret != LDB_SUCCESS) {
442 return ldb_module_done(ac->req, NULL, NULL, ret);
445 ret = ldb_next_request(ac->module, search_req);
446 if (ret != LDB_SUCCESS) {
447 return ldb_module_done(ac->req, NULL, NULL, ret);
450 /* "ldb_module_done" isn't called here since we need to do additional
451 * checks. It is called at the end of "attr_handler2". */
455 static int objectclass_attrs_add(struct ldb_module *module,
456 struct ldb_request *req)
458 struct ldb_context *ldb;
459 struct oc_context *ac;
461 ldb = ldb_module_get_ctx(module);
463 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_attrs_add\n");
465 /* do not manipulate our control entries */
466 if (ldb_dn_is_special(req->op.add.message->dn)) {
467 return ldb_next_request(module, req);
470 ac = oc_init_context(module, req);
472 return ldb_operr(ldb);
475 /* without schema, there isn't much to do here */
476 if (ac->schema == NULL) {
478 return ldb_next_request(module, req);
481 return attr_handler(ac);
484 static int objectclass_attrs_modify(struct ldb_module *module,
485 struct ldb_request *req)
487 struct ldb_context *ldb;
488 struct oc_context *ac;
490 ldb = ldb_module_get_ctx(module);
492 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_attrs_modify\n");
494 /* do not manipulate our control entries */
495 if (ldb_dn_is_special(req->op.mod.message->dn)) {
496 return ldb_next_request(module, req);
499 ac = oc_init_context(module, req);
501 return ldb_operr(ldb);
504 /* without schema, there isn't much to do here */
505 if (ac->schema == NULL) {
507 return ldb_next_request(module, req);
510 return attr_handler(ac);
513 static const struct ldb_module_ops ldb_objectclass_attrs_module_ops = {
514 .name = "objectclass_attrs",
515 .add = objectclass_attrs_add,
516 .modify = objectclass_attrs_modify
519 int ldb_objectclass_attrs_module_init(const char *version)
521 LDB_MODULE_CHECK_VERSION(version);
522 return ldb_register_module(&ldb_objectclass_attrs_module_ops);