2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher <metze@samba.org> 2006-2007
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2008
7 Copyright (C) Matthieu Patou <mat@matws.net> 2011
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "lib/util/dlinklist.h"
26 #include "dsdb/samdb/samdb.h"
27 #include <ldb_module.h>
28 #include "param/param.h"
29 #include "librpc/ndr/libndr.h"
30 #include "librpc/gen_ndr/ndr_misc.h"
31 #include "lib/util/tsort.h"
34 override the name to attribute handler function
36 const struct ldb_schema_attribute *dsdb_attribute_handler_override(struct ldb_context *ldb,
40 struct dsdb_schema *schema = talloc_get_type_abort(private_data, struct dsdb_schema);
41 const struct dsdb_attribute *a = dsdb_attribute_by_lDAPDisplayName(schema, name);
43 /* this will fall back to ldb internal handling */
46 return a->ldb_schema_attribute;
49 static int dsdb_schema_set_attributes(struct ldb_context *ldb, struct dsdb_schema *schema, bool write_attributes)
51 int ret = LDB_SUCCESS;
52 struct ldb_result *res;
53 struct ldb_result *res_idx;
54 struct dsdb_attribute *attr;
55 struct ldb_message *mod_msg;
57 struct ldb_message *msg;
58 struct ldb_message *msg_idx;
60 /* setup our own attribute name to schema handler */
61 ldb_schema_attribute_set_override_handler(ldb, dsdb_attribute_handler_override, schema);
63 if (!write_attributes) {
67 mem_ctx = talloc_new(ldb);
72 msg = ldb_msg_new(mem_ctx);
77 msg_idx = ldb_msg_new(mem_ctx);
82 msg->dn = ldb_dn_new(msg, ldb, "@ATTRIBUTES");
87 msg_idx->dn = ldb_dn_new(msg_idx, ldb, "@INDEXLIST");
93 ret = ldb_msg_add_string(msg_idx, "@IDXONE", "1");
94 if (ret != LDB_SUCCESS) {
98 for (attr = schema->attributes; attr; attr = attr->next) {
99 const char *syntax = attr->syntax->ldb_syntax;
102 syntax = attr->syntax->ldap_oid;
106 * Write out a rough approximation of the schema
107 * as an @ATTRIBUTES value, for bootstrapping
109 if (strcmp(syntax, LDB_SYNTAX_INTEGER) == 0) {
110 ret = ldb_msg_add_string(msg, attr->lDAPDisplayName, "INTEGER");
111 } else if (strcmp(syntax, LDB_SYNTAX_DIRECTORY_STRING) == 0) {
112 ret = ldb_msg_add_string(msg, attr->lDAPDisplayName, "CASE_INSENSITIVE");
114 if (ret != LDB_SUCCESS) {
118 if (attr->searchFlags & SEARCH_FLAG_ATTINDEX) {
119 ret = ldb_msg_add_string(msg_idx, "@IDXATTR", attr->lDAPDisplayName);
120 if (ret != LDB_SUCCESS) {
126 if (ret != LDB_SUCCESS) {
127 talloc_free(mem_ctx);
132 * Try to avoid churning the attributes too much,
133 * we only want to do this if they have changed
135 ret = ldb_search(ldb, mem_ctx, &res, msg->dn, LDB_SCOPE_BASE, NULL,
137 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
138 ret = ldb_add(ldb, msg);
139 } else if (ret != LDB_SUCCESS) {
140 } else if (res->count != 1) {
141 ret = ldb_add(ldb, msg);
144 /* Annoyingly added to our search results */
145 ldb_msg_remove_attr(res->msgs[0], "distinguishedName");
147 ret = ldb_msg_difference(ldb, mem_ctx,
148 res->msgs[0], msg, &mod_msg);
149 if (ret != LDB_SUCCESS) {
152 if (mod_msg->num_elements > 0) {
153 ret = dsdb_replace(ldb, mod_msg, 0);
155 talloc_free(mod_msg);
158 if (ret == LDB_ERR_OPERATIONS_ERROR || ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS || ret == LDB_ERR_INVALID_DN_SYNTAX) {
159 /* We might be on a read-only DB or LDAP */
162 if (ret != LDB_SUCCESS) {
163 talloc_free(mem_ctx);
167 /* Now write out the indexes, as found in the schema (if they have changed) */
169 ret = ldb_search(ldb, mem_ctx, &res_idx, msg_idx->dn, LDB_SCOPE_BASE,
171 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
172 ret = ldb_add(ldb, msg_idx);
173 } else if (ret != LDB_SUCCESS) {
174 } else if (res_idx->count != 1) {
175 ret = ldb_add(ldb, msg_idx);
178 /* Annoyingly added to our search results */
179 ldb_msg_remove_attr(res_idx->msgs[0], "distinguishedName");
181 ret = ldb_msg_difference(ldb, mem_ctx,
182 res_idx->msgs[0], msg_idx, &mod_msg);
183 if (ret != LDB_SUCCESS) {
186 if (mod_msg->num_elements > 0) {
187 ret = dsdb_replace(ldb, mod_msg, 0);
189 talloc_free(mod_msg);
191 if (ret == LDB_ERR_OPERATIONS_ERROR || ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS || ret == LDB_ERR_INVALID_DN_SYNTAX) {
192 /* We might be on a read-only DB */
195 talloc_free(mem_ctx);
199 talloc_free(mem_ctx);
200 return ldb_operr(ldb);
203 static int uint32_cmp(uint32_t c1, uint32_t c2)
205 if (c1 == c2) return 0;
206 return c1 > c2 ? 1 : -1;
209 static int dsdb_compare_class_by_lDAPDisplayName(struct dsdb_class **c1, struct dsdb_class **c2)
211 return strcasecmp((*c1)->lDAPDisplayName, (*c2)->lDAPDisplayName);
213 static int dsdb_compare_class_by_governsID_id(struct dsdb_class **c1, struct dsdb_class **c2)
215 return uint32_cmp((*c1)->governsID_id, (*c2)->governsID_id);
217 static int dsdb_compare_class_by_governsID_oid(struct dsdb_class **c1, struct dsdb_class **c2)
219 return strcasecmp((*c1)->governsID_oid, (*c2)->governsID_oid);
221 static int dsdb_compare_class_by_cn(struct dsdb_class **c1, struct dsdb_class **c2)
223 return strcasecmp((*c1)->cn, (*c2)->cn);
226 static int dsdb_compare_attribute_by_lDAPDisplayName(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
228 return strcasecmp((*a1)->lDAPDisplayName, (*a2)->lDAPDisplayName);
230 static int dsdb_compare_attribute_by_attributeID_id(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
232 return uint32_cmp((*a1)->attributeID_id, (*a2)->attributeID_id);
234 static int dsdb_compare_attribute_by_msDS_IntId(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
236 return uint32_cmp((*a1)->msDS_IntId, (*a2)->msDS_IntId);
238 static int dsdb_compare_attribute_by_attributeID_oid(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
240 return strcasecmp((*a1)->attributeID_oid, (*a2)->attributeID_oid);
242 static int dsdb_compare_attribute_by_linkID(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
244 return uint32_cmp((*a1)->linkID, (*a2)->linkID);
248 * Clean up Classes and Attributes accessor arrays
250 static void dsdb_sorted_accessors_free(struct dsdb_schema *schema)
252 /* free classes accessors */
253 TALLOC_FREE(schema->classes_by_lDAPDisplayName);
254 TALLOC_FREE(schema->classes_by_governsID_id);
255 TALLOC_FREE(schema->classes_by_governsID_oid);
256 TALLOC_FREE(schema->classes_by_cn);
257 /* free attribute accessors */
258 TALLOC_FREE(schema->attributes_by_lDAPDisplayName);
259 TALLOC_FREE(schema->attributes_by_attributeID_id);
260 TALLOC_FREE(schema->attributes_by_msDS_IntId);
261 TALLOC_FREE(schema->attributes_by_attributeID_oid);
262 TALLOC_FREE(schema->attributes_by_linkID);
266 create the sorted accessor arrays for the schema
268 int dsdb_setup_sorted_accessors(struct ldb_context *ldb,
269 struct dsdb_schema *schema)
271 struct dsdb_class *cur;
272 struct dsdb_attribute *a;
274 unsigned int num_int_id;
276 /* free all caches */
277 dsdb_sorted_accessors_free(schema);
279 /* count the classes */
280 for (i=0, cur=schema->classes; cur; i++, cur=cur->next) /* noop */ ;
281 schema->num_classes = i;
283 /* setup classes_by_* */
284 schema->classes_by_lDAPDisplayName = talloc_array(schema, struct dsdb_class *, i);
285 schema->classes_by_governsID_id = talloc_array(schema, struct dsdb_class *, i);
286 schema->classes_by_governsID_oid = talloc_array(schema, struct dsdb_class *, i);
287 schema->classes_by_cn = talloc_array(schema, struct dsdb_class *, i);
288 if (schema->classes_by_lDAPDisplayName == NULL ||
289 schema->classes_by_governsID_id == NULL ||
290 schema->classes_by_governsID_oid == NULL ||
291 schema->classes_by_cn == NULL) {
295 for (i=0, cur=schema->classes; cur; i++, cur=cur->next) {
296 schema->classes_by_lDAPDisplayName[i] = cur;
297 schema->classes_by_governsID_id[i] = cur;
298 schema->classes_by_governsID_oid[i] = cur;
299 schema->classes_by_cn[i] = cur;
302 /* sort the arrays */
303 TYPESAFE_QSORT(schema->classes_by_lDAPDisplayName, schema->num_classes, dsdb_compare_class_by_lDAPDisplayName);
304 TYPESAFE_QSORT(schema->classes_by_governsID_id, schema->num_classes, dsdb_compare_class_by_governsID_id);
305 TYPESAFE_QSORT(schema->classes_by_governsID_oid, schema->num_classes, dsdb_compare_class_by_governsID_oid);
306 TYPESAFE_QSORT(schema->classes_by_cn, schema->num_classes, dsdb_compare_class_by_cn);
308 /* now build the attribute accessor arrays */
310 /* count the attributes
311 * and attributes with msDS-IntId set */
313 for (i=0, a=schema->attributes; a; i++, a=a->next) {
314 if (a->msDS_IntId != 0) {
318 schema->num_attributes = i;
319 schema->num_int_id_attr = num_int_id;
321 /* setup attributes_by_* */
322 schema->attributes_by_lDAPDisplayName = talloc_array(schema, struct dsdb_attribute *, i);
323 schema->attributes_by_attributeID_id = talloc_array(schema, struct dsdb_attribute *, i);
324 schema->attributes_by_msDS_IntId = talloc_array(schema,
325 struct dsdb_attribute *, num_int_id);
326 schema->attributes_by_attributeID_oid = talloc_array(schema, struct dsdb_attribute *, i);
327 schema->attributes_by_linkID = talloc_array(schema, struct dsdb_attribute *, i);
328 if (schema->attributes_by_lDAPDisplayName == NULL ||
329 schema->attributes_by_attributeID_id == NULL ||
330 schema->attributes_by_msDS_IntId == NULL ||
331 schema->attributes_by_attributeID_oid == NULL ||
332 schema->attributes_by_linkID == NULL) {
337 for (i=0, a=schema->attributes; a; i++, a=a->next) {
338 schema->attributes_by_lDAPDisplayName[i] = a;
339 schema->attributes_by_attributeID_id[i] = a;
340 schema->attributes_by_attributeID_oid[i] = a;
341 schema->attributes_by_linkID[i] = a;
342 /* append attr-by-msDS-IntId values */
343 if (a->msDS_IntId != 0) {
344 schema->attributes_by_msDS_IntId[num_int_id] = a;
348 SMB_ASSERT(num_int_id == schema->num_int_id_attr);
350 /* sort the arrays */
351 TYPESAFE_QSORT(schema->attributes_by_lDAPDisplayName, schema->num_attributes, dsdb_compare_attribute_by_lDAPDisplayName);
352 TYPESAFE_QSORT(schema->attributes_by_attributeID_id, schema->num_attributes, dsdb_compare_attribute_by_attributeID_id);
353 TYPESAFE_QSORT(schema->attributes_by_msDS_IntId, schema->num_int_id_attr, dsdb_compare_attribute_by_msDS_IntId);
354 TYPESAFE_QSORT(schema->attributes_by_attributeID_oid, schema->num_attributes, dsdb_compare_attribute_by_attributeID_oid);
355 TYPESAFE_QSORT(schema->attributes_by_linkID, schema->num_attributes, dsdb_compare_attribute_by_linkID);
360 dsdb_sorted_accessors_free(schema);
364 int dsdb_setup_schema_inversion(struct ldb_context *ldb, struct dsdb_schema *schema)
366 /* Walk the list of schema classes */
368 /* For each subClassOf, add us to subclasses of the parent */
370 /* collect these subclasses into a recursive list of total subclasses, preserving order */
372 /* For each subclass under 'top', write the index from it's
373 * order as an integer in the dsdb_class (for sorting
374 * objectClass lists efficiently) */
376 /* Walk the list of schema classes */
378 /* Create a 'total possible superiors' on each class */
383 * Attach the schema to an opaque pointer on the ldb,
384 * so ldb modules can find it
386 int dsdb_set_schema(struct ldb_context *ldb, struct dsdb_schema *schema)
388 struct dsdb_schema *old_schema;
391 ret = dsdb_setup_sorted_accessors(ldb, schema);
392 if (ret != LDB_SUCCESS) {
396 ret = schema_fill_constructed(schema);
397 if (ret != LDB_SUCCESS) {
401 old_schema = ldb_get_opaque(ldb, "dsdb_schema");
403 ret = ldb_set_opaque(ldb, "dsdb_schema", schema);
404 if (ret != LDB_SUCCESS) {
408 /* Remove the reference to the schema we just overwrote - if there was
409 * none, NULL is harmless here */
410 if (old_schema != schema) {
411 talloc_unlink(ldb, old_schema);
412 talloc_steal(ldb, schema);
415 ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", NULL);
416 if (ret != LDB_SUCCESS) {
420 /* Set the new attributes based on the new schema */
421 ret = dsdb_schema_set_attributes(ldb, schema, true);
422 if (ret != LDB_SUCCESS) {
430 * Global variable to hold one copy of the schema, used to avoid memory bloat
432 static struct dsdb_schema *global_schema;
435 * Make this ldb use a specified schema, already fully calculated and belonging to another ldb
437 int dsdb_reference_schema(struct ldb_context *ldb, struct dsdb_schema *schema,
438 bool write_attributes)
441 struct dsdb_schema *old_schema;
442 old_schema = ldb_get_opaque(ldb, "dsdb_schema");
443 ret = ldb_set_opaque(ldb, "dsdb_schema", schema);
444 if (ret != LDB_SUCCESS) {
448 /* Remove the reference to the schema we just overwrote - if there was
449 * none, NULL is harmless here */
450 talloc_unlink(ldb, old_schema);
452 if (talloc_reference(ldb, schema) == NULL) {
456 /* Make this ldb use local schema preferably */
457 ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", NULL);
458 if (ret != LDB_SUCCESS) {
462 ret = dsdb_schema_set_attributes(ldb, schema, write_attributes);
463 if (ret != LDB_SUCCESS) {
471 * Make this ldb use the 'global' schema, setup to avoid having multiple copies in this process
473 int dsdb_set_global_schema(struct ldb_context *ldb)
476 void *use_global_schema = (void *)1;
477 if (!global_schema) {
480 ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", use_global_schema);
481 if (ret != LDB_SUCCESS) {
485 /* Set the new attributes based on the new schema */
486 ret = dsdb_schema_set_attributes(ldb, global_schema, false /* Don't write attributes, it's expensive */);
487 if (ret == LDB_SUCCESS) {
488 /* Keep a reference to this schema, just in case the original copy is replaced */
489 if (talloc_reference(ldb, global_schema) == NULL) {
497 bool dsdb_uses_global_schema(struct ldb_context *ldb)
499 return (ldb_get_opaque(ldb, "dsdb_use_global_schema") != NULL);
503 * Find the schema object for this ldb
505 * If reference_ctx is not NULL, then talloc_reference onto that context
508 struct dsdb_schema *dsdb_get_schema(struct ldb_context *ldb, TALLOC_CTX *reference_ctx)
511 struct dsdb_schema *schema_out;
512 struct dsdb_schema *schema_in;
513 bool use_global_schema;
514 TALLOC_CTX *tmp_ctx = talloc_new(reference_ctx);
519 /* see if we have a cached copy */
520 use_global_schema = dsdb_uses_global_schema(ldb);
521 if (use_global_schema) {
522 schema_in = global_schema;
524 p = ldb_get_opaque(ldb, "dsdb_schema");
526 schema_in = talloc_get_type(p, struct dsdb_schema);
528 talloc_free(tmp_ctx);
533 if (schema_in->refresh_fn && !schema_in->refresh_in_progress) {
534 if (!talloc_reference(tmp_ctx, schema_in)) {
536 * ensure that the schema_in->refresh_in_progress
537 * remains valid for the right amount of time
539 talloc_free(tmp_ctx);
542 schema_in->refresh_in_progress = true;
543 /* This may change schema, if it needs to reload it from disk */
544 schema_out = schema_in->refresh_fn(schema_in->loaded_from_module,
547 schema_in->refresh_in_progress = false;
549 schema_out = schema_in;
552 /* This removes the extra reference above */
553 talloc_free(tmp_ctx);
554 if (!reference_ctx) {
557 return talloc_reference(reference_ctx, schema_out);
562 * Make the schema found on this ldb the 'global' schema
565 void dsdb_make_schema_global(struct ldb_context *ldb, struct dsdb_schema *schema)
572 talloc_unlink(talloc_autofree_context(), global_schema);
575 /* we want the schema to be around permanently */
576 talloc_reparent(ldb, talloc_autofree_context(), schema);
577 global_schema = schema;
579 /* This calls the talloc_reference() of the global schema back onto the ldb */
580 dsdb_set_global_schema(ldb);
584 * When loading the schema from LDIF files, we don't get the extended DNs.
586 * We need to set these up, so that from the moment we start the provision,
587 * the defaultObjectCategory links are set up correctly.
589 int dsdb_schema_fill_extended_dn(struct ldb_context *ldb, struct dsdb_schema *schema)
591 struct dsdb_class *cur;
592 const struct dsdb_class *target_class;
593 for (cur = schema->classes; cur; cur = cur->next) {
594 const struct ldb_val *rdn;
597 struct ldb_dn *dn = ldb_dn_new(NULL, ldb, cur->defaultObjectCategory);
600 return LDB_ERR_INVALID_DN_SYNTAX;
602 rdn = ldb_dn_get_component_val(dn, 0);
605 return LDB_ERR_INVALID_DN_SYNTAX;
607 target_class = dsdb_class_by_cn_ldb_val(schema, rdn);
610 return LDB_ERR_CONSTRAINT_VIOLATION;
613 status = GUID_to_ndr_blob(&target_class->objectGUID, dn, &guid);
614 if (!NT_STATUS_IS_OK(status)) {
616 return ldb_operr(ldb);
618 ldb_dn_set_extended_component(dn, "GUID", &guid);
620 cur->defaultObjectCategory = ldb_dn_get_extended_linearized(cur, dn, 1);
627 * Add an element to the schema (attribute or class) from an LDB message
629 WERROR dsdb_schema_set_el_from_ldb_msg(struct ldb_context *ldb, struct dsdb_schema *schema,
630 struct ldb_message *msg)
632 if (samdb_find_attribute(ldb, msg,
633 "objectclass", "attributeSchema") != NULL) {
634 return dsdb_attribute_from_ldb(ldb, schema, msg);
635 } else if (samdb_find_attribute(ldb, msg,
636 "objectclass", "classSchema") != NULL) {
637 return dsdb_class_from_ldb(schema, msg);
640 /* Don't fail on things not classes or attributes */
645 * Rather than read a schema from the LDB itself, read it from an ldif
646 * file. This allows schema to be loaded and used while adding the
647 * schema itself to the directory.
650 WERROR dsdb_set_schema_from_ldif(struct ldb_context *ldb, const char *pf, const char *df)
652 struct ldb_ldif *ldif;
653 struct ldb_message *msg;
657 struct dsdb_schema *schema;
658 const struct ldb_val *prefix_val;
659 const struct ldb_val *info_val;
660 struct ldb_val info_val_default;
663 mem_ctx = talloc_new(ldb);
668 schema = dsdb_new_schema(mem_ctx);
670 schema->fsmo.we_are_master = true;
671 schema->fsmo.master_dn = ldb_dn_new_fmt(schema, ldb, "@PROVISION_SCHEMA_MASTER");
672 if (!schema->fsmo.master_dn) {
677 * load the prefixMap attribute from pf
679 ldif = ldb_ldif_read_string(ldb, &pf);
681 status = WERR_INVALID_PARAM;
684 talloc_steal(mem_ctx, ldif);
686 ret = ldb_msg_normalize(ldb, mem_ctx, ldif->msg, &msg);
687 if (ret != LDB_SUCCESS) {
692 prefix_val = ldb_msg_find_ldb_val(msg, "prefixMap");
694 status = WERR_INVALID_PARAM;
698 info_val = ldb_msg_find_ldb_val(msg, "schemaInfo");
700 status = dsdb_schema_info_blob_new(mem_ctx, &info_val_default);
701 W_ERROR_NOT_OK_GOTO(status, failed);
702 info_val = &info_val_default;
705 status = dsdb_load_oid_mappings_ldb(schema, prefix_val, info_val);
706 if (!W_ERROR_IS_OK(status)) {
707 DEBUG(0,("ERROR: dsdb_load_oid_mappings_ldb() failed with %s\n", win_errstr(status)));
711 /* load the attribute and class definitions out of df */
712 while ((ldif = ldb_ldif_read_string(ldb, &df))) {
713 talloc_steal(mem_ctx, ldif);
715 ret = ldb_msg_normalize(ldb, ldif, ldif->msg, &msg);
716 if (ret != LDB_SUCCESS) {
720 status = dsdb_schema_set_el_from_ldb_msg(ldb, schema, msg);
722 if (!W_ERROR_IS_OK(status)) {
727 ret = dsdb_set_schema(ldb, schema);
728 if (ret != LDB_SUCCESS) {
729 status = WERR_FOOBAR;
733 ret = dsdb_schema_fill_extended_dn(ldb, schema);
734 if (ret != LDB_SUCCESS) {
735 status = WERR_FOOBAR;
745 talloc_free(mem_ctx);