source4/dsdb/samdb/ldb_modules/subtree_rename.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2007
   5    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 /*
  22  *  Name: ldb
  23  *
  24  *  Component: ldb subtree rename module
  25  *
  26  *  Description: Rename a subtree in LDB
  27  *
  28  *  Author: Andrew Bartlett
  29  */
  30
  31 #include "includes.h"
  32 #include <ldb.h>
  33 #include <ldb_module.h>
  34 #include "libds/common/flags.h"
  35 #include "dsdb/samdb/samdb.h"
  36
  37 struct subren_msg_store {
  38         struct subren_msg_store *next;
  39         struct ldb_dn *olddn;
  40         struct ldb_dn *newdn;
  41 };
  42
  43 struct subtree_rename_context {
  44         struct ldb_module *module;
  45         struct ldb_request *req;
  46
  47         struct subren_msg_store *list;
  48         struct subren_msg_store *current;
  49 };
  50
  51 static struct subtree_rename_context *subren_ctx_init(struct ldb_module *module,
  52                                                       struct ldb_request *req)
  53 {
  54         struct ldb_context *ldb;
  55         struct subtree_rename_context *ac;
  56
  57         ldb = ldb_module_get_ctx(module);
  58
  59         ac = talloc_zero(req, struct subtree_rename_context);
  60         if (ac == NULL) {
  61                 return NULL;
  62         }
  63
  64         ac->module = module;
  65         ac->req = req;
  66
  67         return ac;
  68 }
  69
  70 static int subtree_rename_next_request(struct subtree_rename_context *ac);
  71
  72 static int subtree_rename_callback(struct ldb_request *req,
  73                                    struct ldb_reply *ares)
  74 {
  75         struct ldb_context *ldb;
  76         struct subtree_rename_context *ac;
  77         int ret;
  78
  79         ac = talloc_get_type(req->context, struct subtree_rename_context);
  80         ldb = ldb_module_get_ctx(ac->module);
  81
  82         if (!ares) {
  83                 return ldb_module_done(ac->req, NULL, NULL,
  84                                         LDB_ERR_OPERATIONS_ERROR);
  85         }
  86
  87         if (ares->type == LDB_REPLY_REFERRAL) {
  88                 return ldb_module_send_referral(ac->req, ares->referral);
  89         }
  90
  91         if (ares->error != LDB_SUCCESS) {
  92                 return ldb_module_done(ac->req, ares->controls,
  93                                         ares->response, ares->error);
  94         }
  95
  96         if (ares->type != LDB_REPLY_DONE) {
  97                 ldb_set_errstring(ldb, "Invalid reply type!\n");
  98                 return ldb_module_done(ac->req, NULL, NULL,
  99                                         LDB_ERR_OPERATIONS_ERROR);
 100         }
 101
 102         if (ac->current == NULL) {
 103                 /* this was the last one */
 104                 return ldb_module_done(ac->req, ares->controls,
 105                                         ares->response, LDB_SUCCESS);
 106         }
 107
 108         ret = subtree_rename_next_request(ac);
 109         if (ret != LDB_SUCCESS) {
 110                 return ldb_module_done(ac->req, NULL, NULL, ret);
 111         }
 112
 113         talloc_free(ares);
 114         return LDB_SUCCESS;
 115 }
 116
 117 static int subtree_rename_next_request(struct subtree_rename_context *ac)
 118 {
 119         struct ldb_context *ldb;
 120         struct ldb_request *req;
 121         int ret;
 122
 123         ldb = ldb_module_get_ctx(ac->module);
 124
 125         if (ac->current == NULL) {
 126                 return ldb_operr(ldb);
 127         }
 128
 129         ret = ldb_build_rename_req(&req, ldb, ac->current,
 130                                    ac->current->olddn,
 131                                    ac->current->newdn,
 132                                    ac->req->controls,
 133                                    ac, subtree_rename_callback,
 134                                    ac->req);
 135         LDB_REQ_SET_LOCATION(req);
 136         if (ret != LDB_SUCCESS) {
 137                 return ret;
 138         }
 139
 140         ac->current = ac->current->next;
 141
 142         return ldb_next_request(ac->module, req);
 143 }
 144
 145 static int check_constraints(struct ldb_message *msg,
 146                              struct subtree_rename_context *ac,
 147                              struct ldb_dn *olddn, struct ldb_dn *newdn)
 148 {
 149         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 150         struct ldb_dn *dn1, *dn2;
 151         int32_t systemFlags;
 152         bool move_op = false;
 153         bool rename_op = false;
 154
 155         /* Skip the checks if old and new DN are the same, or if we have the
 156          * relax control specified or if the returned objects is already
 157          * deleted and needs only to be moved for consistency. */
 158
 159         if (ldb_dn_compare(olddn, newdn) == 0) {
 160                 return LDB_SUCCESS;
 161         }
 162         if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) != NULL) {
 163                 return LDB_SUCCESS;
 164         }
 165         if (ldb_msg_find_attr_as_bool(msg, "isDeleted", false)) {
 166                 return LDB_SUCCESS;
 167         }
 168
 169         /* Objects under CN=System */
 170
 171         dn1 = ldb_dn_copy(ac, ldb_get_default_basedn(ldb));
 172         if (dn1 == NULL) return ldb_oom(ldb);
 173
 174         if ( ! ldb_dn_add_child_fmt(dn1, "CN=System")) {
 175                 talloc_free(dn1);
 176                 return LDB_ERR_OPERATIONS_ERROR;
 177         }
 178
 179         if ((ldb_dn_compare_base(dn1, olddn) == 0) &&
 180             (ldb_dn_compare_base(dn1, newdn) != 0)) {
 181                 talloc_free(dn1);
 182                 ldb_asprintf_errstring(ldb,
 183                                        "subtree_rename: Cannot move/rename %s. Objects under CN=System have to stay under it!",
 184                                        ldb_dn_get_linearized(olddn));
 185                 return LDB_ERR_OTHER;
 186         }
 187
 188         talloc_free(dn1);
 189
 190         /* LSA objects */
 191
 192         if ((samdb_find_attribute(ldb, msg, "objectClass", "secret") != NULL) ||
 193             (samdb_find_attribute(ldb, msg, "objectClass", "trustedDomain") != NULL)) {
 194                 ldb_asprintf_errstring(ldb,
 195                                        "subtree_rename: Cannot move/rename %s. It's an LSA-specific object!",
 196                                        ldb_dn_get_linearized(olddn));
 197                 return LDB_ERR_UNWILLING_TO_PERFORM;
 198         }
 199
 200         /* systemFlags */
 201
 202         dn1 = ldb_dn_get_parent(ac, olddn);
 203         if (dn1 == NULL) return ldb_oom(ldb);
 204         dn2 = ldb_dn_get_parent(ac, newdn);
 205         if (dn2 == NULL) return ldb_oom(ldb);
 206
 207         if (ldb_dn_compare(dn1, dn2) == 0) {
 208                 rename_op = true;
 209         } else {
 210                 move_op = true;
 211         }
 212
 213         talloc_free(dn1);
 214         talloc_free(dn2);
 215
 216         systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
 217
 218         /* the config system flags don't apply for the schema partition */
 219         if ((ldb_dn_compare_base(ldb_get_config_basedn(ldb), olddn) == 0) &&
 220             (ldb_dn_compare_base(ldb_get_schema_basedn(ldb), olddn) != 0)) {
 221                 if (move_op &&
 222                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_MOVE) == 0) {
 223                         /* Here we have to do more: control the
 224                          * "ALLOW_LIMITED_MOVE" flag. This means that the
 225                          * grand-grand-parents of two objects have to be equal
 226                          * in order to perform the move (this is used for
 227                          * moving "server" objects in the "sites" container). */
 228                         bool limited_move =
 229                                 systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE;
 230
 231                         if (limited_move) {
 232                                 dn1 = ldb_dn_copy(ac, olddn);
 233                                 if (dn1 == NULL) return ldb_oom(ldb);
 234                                 dn2 = ldb_dn_copy(ac, newdn);
 235                                 if (dn2 == NULL) return ldb_oom(ldb);
 236
 237                                 limited_move &= ldb_dn_remove_child_components(dn1, 3);
 238                                 limited_move &= ldb_dn_remove_child_components(dn2, 3);
 239                                 limited_move &= ldb_dn_compare(dn1, dn2) == 0;
 240
 241                                 talloc_free(dn1);
 242                                 talloc_free(dn2);
 243                         }
 244
 245                         if (!limited_move) {
 246                                 ldb_asprintf_errstring(ldb,
 247                                                        "subtree_rename: Cannot move %s, it isn't permitted!",
 248                                                        ldb_dn_get_linearized(olddn));
 249                                 return LDB_ERR_UNWILLING_TO_PERFORM;
 250                         }
 251                 }
 252                 if (rename_op &&
 253                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_RENAME) == 0) {
 254                         ldb_asprintf_errstring(ldb,
 255                                                "subtree_rename: Cannot rename %s, it isn't permitted!",
 256                                                ldb_dn_get_linearized(olddn));
 257                         return LDB_ERR_UNWILLING_TO_PERFORM;
 258                 }
 259         }
 260         if (ldb_dn_compare_base(ldb_get_schema_basedn(ldb), olddn) == 0) {
 261                 if (move_op) {
 262                         ldb_asprintf_errstring(ldb,
 263                                                "subtree_rename: Cannot move %s, it isn't permitted!",
 264                                                ldb_dn_get_linearized(olddn));
 265                         return LDB_ERR_UNWILLING_TO_PERFORM;
 266                 }
 267                 if (rename_op &&
 268                     (systemFlags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) != 0) {
 269                         ldb_asprintf_errstring(ldb,
 270                                                "subtree_rename: Cannot rename %s, it isn't permitted!",
 271                                                ldb_dn_get_linearized(olddn));
 272                         return LDB_ERR_UNWILLING_TO_PERFORM;
 273                 }
 274         }
 275         if (ldb_dn_compare_base(ldb_get_default_basedn(ldb),
 276                                 ac->current->olddn) == 0) {
 277                 if (move_op &&
 278                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE) != 0) {
 279                         ldb_asprintf_errstring(ldb,
 280                                                "subtree_rename: Cannot move %s, it isn't permitted!",
 281                                                ldb_dn_get_linearized(olddn));
 282                         return LDB_ERR_UNWILLING_TO_PERFORM;
 283                 }
 284                 if (rename_op &&
 285                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME) != 0) {
 286                         ldb_asprintf_errstring(ldb,
 287                                                        "subtree_rename: Cannot rename %s, it isn't permitted!",
 288                                                ldb_dn_get_linearized(olddn));
 289                         return LDB_ERR_UNWILLING_TO_PERFORM;
 290                 }
 291         }
 292
 293         return LDB_SUCCESS;
 294 }
 295
 296 static int subtree_rename_search_callback(struct ldb_request *req,
 297                                           struct ldb_reply *ares)
 298 {
 299         struct subren_msg_store *store;
 300         struct subtree_rename_context *ac;
 301         int ret;
 302
 303         ac = talloc_get_type(req->context, struct subtree_rename_context);
 304
 305         if (!ares || !ac->current) {
 306                 return ldb_module_done(ac->req, NULL, NULL,
 307                                         LDB_ERR_OPERATIONS_ERROR);
 308         }
 309         if (ares->error != LDB_SUCCESS) {
 310                 return ldb_module_done(ac->req, ares->controls,
 311                                         ares->response, ares->error);
 312         }
 313
 314         switch (ares->type) {
 315         case LDB_REPLY_ENTRY:
 316                 if (ldb_dn_compare(ares->message->dn, ac->list->olddn) == 0) {
 317                         /* this was already stored by the
 318                          * subtree_rename_search() */
 319
 320                         ret = check_constraints(ares->message, ac,
 321                                                 ac->list->olddn,
 322                                                 ac->list->newdn);
 323                         if (ret != LDB_SUCCESS) {
 324                                 return ldb_module_done(ac->req, NULL, NULL,
 325                                                        ret);
 326                         }
 327
 328                         talloc_free(ares);
 329                         return LDB_SUCCESS;
 330                 }
 331
 332                 store = talloc_zero(ac, struct subren_msg_store);
 333                 if (store == NULL) {
 334                         return ldb_module_done(ac->req, NULL, NULL,
 335                                                 LDB_ERR_OPERATIONS_ERROR);
 336                 }
 337                 ac->current->next = store;
 338                 ac->current = store;
 339
 340                 /* the first list element contains the base for the rename */
 341                 store->olddn = talloc_steal(store, ares->message->dn);
 342                 store->newdn = ldb_dn_copy(store, store->olddn);
 343
 344                 if ( ! ldb_dn_remove_base_components(store->newdn,
 345                                 ldb_dn_get_comp_num(ac->list->olddn))) {
 346                         return ldb_module_done(ac->req, NULL, NULL,
 347                                                 LDB_ERR_OPERATIONS_ERROR);
 348                 }
 349
 350                 if ( ! ldb_dn_add_base(store->newdn, ac->list->newdn)) {
 351                         return ldb_module_done(ac->req, NULL, NULL,
 352                                                 LDB_ERR_OPERATIONS_ERROR);
 353                 }
 354
 355                 ret = check_constraints(ares->message, ac,
 356                                         store->olddn, store->newdn);
 357                 if (ret != LDB_SUCCESS) {
 358                         return ldb_module_done(ac->req, NULL, NULL, ret);
 359                 }
 360
 361                 break;
 362
 363         case LDB_REPLY_REFERRAL:
 364                 /* ignore */
 365                 break;
 366
 367         case LDB_REPLY_DONE:
 368
 369                 /* rewind ac->current */
 370                 ac->current = ac->list;
 371
 372                 /* All dns set up, start with the first one */
 373                 ret = subtree_rename_next_request(ac);
 374
 375                 if (ret != LDB_SUCCESS) {
 376                         return ldb_module_done(ac->req, NULL, NULL, ret);
 377                 }
 378                 break;
 379         }
 380
 381         talloc_free(ares);
 382         return LDB_SUCCESS;
 383 }
 384
 385 /* rename */
 386 static int subtree_rename(struct ldb_module *module, struct ldb_request *req)
 387 {
 388         struct ldb_context *ldb;
 389         static const char * const attrs[] = { "objectClass", "systemFlags",
 390                                               "isDeleted", NULL };
 391         struct ldb_request *search_req;
 392         struct subtree_rename_context *ac;
 393         int ret;
 394
 395         if (ldb_dn_is_special(req->op.rename.olddn)) { /* do not manipulate our control entries */
 396                 return ldb_next_request(module, req);
 397         }
 398
 399         ldb = ldb_module_get_ctx(module);
 400
 401         /* This gets complex:  We need to:
 402            - Do a search for all entires under this entry
 403            - Wait for these results to appear
 404            - In the callback for each result, issue a modify request
 405            - That will include this rename, we hope
 406            - Wait for each modify result
 407            - Regain our sanity
 408         */
 409
 410         ac = subren_ctx_init(module, req);
 411         if (!ac) {
 412                 return ldb_oom(ldb);
 413         }
 414
 415         /* add this entry as the first to do */
 416         ac->current = talloc_zero(ac, struct subren_msg_store);
 417         if (ac->current == NULL) {
 418                 return ldb_oom(ldb);
 419         }
 420         ac->current->olddn = req->op.rename.olddn;
 421         ac->current->newdn = req->op.rename.newdn;
 422         ac->list = ac->current;
 423
 424         ret = ldb_build_search_req(&search_req, ldb, ac,
 425                                    req->op.rename.olddn,
 426                                    LDB_SCOPE_SUBTREE,
 427                                    "(objectClass=*)",
 428                                    attrs,
 429                                    NULL,
 430                                    ac,
 431                                    subtree_rename_search_callback,
 432                                    req);
 433         LDB_REQ_SET_LOCATION(search_req);
 434         if (ret != LDB_SUCCESS) {
 435                 return ret;
 436         }
 437
 438         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
 439                                       true, NULL);
 440         if (ret != LDB_SUCCESS) {
 441                 return ret;
 442         }
 443
 444         return ldb_next_request(module, search_req);
 445 }
 446
 447 _PUBLIC_ const struct ldb_module_ops ldb_subtree_rename_module_ops = {
 448         .name              = "subtree_rename",
 449         .rename            = subtree_rename
 450 };