4 Copyright (C) Simo Sorce 2006-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2007
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * Component: objectClass sorting module
27 * - sort the objectClass attribute into the class
29 * - fix DNs and attributes into 'standard' case
30 * - Add objectCategory and ntSecurityDescriptor defaults
32 * Author: Andrew Bartlett
37 #include "ldb_module.h"
38 #include "dlinklist.h"
39 #include "dsdb/samdb/samdb.h"
40 #include "librpc/ndr/libndr.h"
41 #include "librpc/gen_ndr/ndr_security.h"
42 #include "libcli/security/security.h"
43 #include "auth/auth.h"
44 #include "param/param.h"
48 struct ldb_module *module;
49 struct ldb_request *req;
51 struct ldb_reply *search_res;
53 int (*step_fn)(struct oc_context *);
57 struct class_list *prev, *next;
58 const struct dsdb_class *objectclass;
61 static struct oc_context *oc_init_context(struct ldb_module *module,
62 struct ldb_request *req)
64 struct ldb_context *ldb;
65 struct oc_context *ac;
67 ldb = ldb_module_get_ctx(module);
69 ac = talloc_zero(req, struct oc_context);
71 ldb_set_errstring(ldb, "Out of Memory");
81 static int objectclass_do_add(struct oc_context *ac);
83 /* Sort objectClasses into correct order, and validate that all
84 * objectClasses specified actually exist in the schema
87 static int objectclass_sort(struct ldb_module *module,
88 const struct dsdb_schema *schema,
90 struct ldb_message_element *objectclass_element,
91 struct class_list **sorted_out)
93 struct ldb_context *ldb;
96 struct class_list *sorted = NULL, *parent_class = NULL,
97 *subclass = NULL, *unsorted = NULL, *current, *poss_subclass, *poss_parent, *new_parent;
99 ldb = ldb_module_get_ctx(module);
103 * We work on 4 different 'bins' (implemented here as linked lists):
105 * * sorted: the eventual list, in the order we wish to push
106 * into the database. This is the only ordered list.
108 * * parent_class: The current parent class 'bin' we are
109 * trying to find subclasses for
111 * * subclass: The subclasses we have found so far
113 * * unsorted: The remaining objectClasses
115 * The process is a matter of filtering objectClasses up from
116 * unsorted into sorted. Order is irrelevent in the later 3 'bins'.
118 * We start with 'top' (found and promoted to parent_class
119 * initially). Then we find (in unsorted) all the direct
120 * subclasses of 'top'. parent_classes is concatenated onto
121 * the end of 'sorted', and subclass becomes the list in
124 * We then repeat, until we find no more subclasses. Any left
125 * over classes are added to the end.
129 /* Firstly, dump all the objectClass elements into the
130 * unsorted bin, except for 'top', which is special */
131 for (i=0; i < objectclass_element->num_values; i++) {
132 current = talloc(mem_ctx, struct class_list);
135 return LDB_ERR_OPERATIONS_ERROR;
137 current->objectclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &objectclass_element->values[i]);
138 if (!current->objectclass) {
139 ldb_asprintf_errstring(ldb, "objectclass %.*s is not a valid objectClass in schema",
140 (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
141 /* This looks weird, but windows apparently returns this for invalid objectClass values */
142 return LDB_ERR_NO_SUCH_ATTRIBUTE;
143 } else if (current->objectclass->isDefunct) {
144 ldb_asprintf_errstring(ldb, "objectclass %.*s marked as isDefunct objectClass in schema - not valid for new objects",
145 (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
146 /* This looks weird, but windows apparently returns this for invalid objectClass values */
147 return LDB_ERR_NO_SUCH_ATTRIBUTE;
150 /* this is the root of the tree. We will start
151 * looking for subclasses from here */
152 if (ldb_attr_cmp("top", current->objectclass->lDAPDisplayName) == 0) {
153 DLIST_ADD_END(parent_class, current, struct class_list *);
155 DLIST_ADD_END(unsorted, current, struct class_list *);
159 if (parent_class == NULL) {
160 current = talloc(mem_ctx, struct class_list);
161 current->objectclass = dsdb_class_by_lDAPDisplayName(schema, "top");
162 DLIST_ADD_END(parent_class, current, struct class_list *);
165 /* For each object: find parent chain */
166 for (current = unsorted; schema && current; current = current->next) {
167 for (poss_parent = unsorted; poss_parent; poss_parent = poss_parent->next) {
168 if (ldb_attr_cmp(poss_parent->objectclass->lDAPDisplayName, current->objectclass->subClassOf) == 0) {
172 /* If we didn't get to the end of the list, we need to add this parent */
173 if (poss_parent || (ldb_attr_cmp("top", current->objectclass->subClassOf) == 0)) {
177 new_parent = talloc(mem_ctx, struct class_list);
178 new_parent->objectclass = dsdb_class_by_lDAPDisplayName(schema, current->objectclass->subClassOf);
179 DLIST_ADD_END(unsorted, new_parent, struct class_list *);
182 /* DEBUGGING aid: how many layers are we down now? */
186 /* Find all the subclasses of classes in the
187 * parent_classes. Push them onto the subclass list */
189 /* Ensure we don't bother if there are no unsorted entries left */
190 for (current = parent_class; schema && unsorted && current; current = current->next) {
191 /* Walk the list of possible subclasses in unsorted */
192 for (poss_subclass = unsorted; poss_subclass; ) {
193 struct class_list *next;
195 /* Save the next pointer, as the DLIST_ macros will change poss_subclass->next */
196 next = poss_subclass->next;
198 if (ldb_attr_cmp(poss_subclass->objectclass->subClassOf, current->objectclass->lDAPDisplayName) == 0) {
199 DLIST_REMOVE(unsorted, poss_subclass);
200 DLIST_ADD(subclass, poss_subclass);
204 poss_subclass = next;
208 /* Now push the parent_classes as sorted, we are done with
209 these. Add to the END of the list by concatenation */
210 DLIST_CONCATENATE(sorted, parent_class, struct class_list *);
212 /* and now find subclasses of these */
213 parent_class = subclass;
216 /* If we didn't find any subclasses we will fall out
218 } while (parent_class);
221 *sorted_out = sorted;
226 /* If we don't have schema yet, then just merge the lists again */
227 DLIST_CONCATENATE(sorted, unsorted, struct class_list *);
228 *sorted_out = sorted;
232 /* This shouldn't happen, and would break MMC, perhaps there
233 * was no 'top', a conflict in the objectClasses or some other
236 ldb_asprintf_errstring(ldb, "objectclass %s is not a valid objectClass in objectClass chain", unsorted->objectclass->lDAPDisplayName);
237 return LDB_ERR_OBJECT_CLASS_VIOLATION;
240 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
242 struct ldb_context *ldb;
243 struct oc_context *ac;
246 ac = talloc_get_type(req->context, struct oc_context);
247 ldb = ldb_module_get_ctx(ac->module);
250 return ldb_module_done(ac->req, NULL, NULL,
251 LDB_ERR_OPERATIONS_ERROR);
253 if (ares->error != LDB_SUCCESS &&
254 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
255 return ldb_module_done(ac->req, ares->controls,
256 ares->response, ares->error);
259 ldb_reset_err_string(ldb);
261 switch (ares->type) {
262 case LDB_REPLY_ENTRY:
263 if (ac->search_res != NULL) {
264 ldb_set_errstring(ldb, "Too many results");
266 return ldb_module_done(ac->req, NULL, NULL,
267 LDB_ERR_OPERATIONS_ERROR);
270 ac->search_res = talloc_steal(ac, ares);
273 case LDB_REPLY_REFERRAL:
280 ret = ac->step_fn(ac);
281 if (ret != LDB_SUCCESS) {
282 return ldb_module_done(ac->req, NULL, NULL, ret);
290 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
292 struct oc_context *ac;
294 ac = talloc_get_type(req->context, struct oc_context);
297 return ldb_module_done(ac->req, NULL, NULL,
298 LDB_ERR_OPERATIONS_ERROR);
300 if (ares->error != LDB_SUCCESS) {
301 return ldb_module_done(ac->req, ares->controls,
302 ares->response, ares->error);
305 if (ares->type != LDB_REPLY_DONE) {
307 return ldb_module_done(ac->req, NULL, NULL,
308 LDB_ERR_OPERATIONS_ERROR);
311 return ldb_module_done(ac->req, ares->controls,
312 ares->response, ares->error);
315 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN
317 This should mean that if the parent is:
318 CN=Users,DC=samba,DC=example,DC=com
319 and a proposed child is
320 cn=Admins ,cn=USERS,dc=Samba,dc=example,dc=COM
322 The resulting DN should be:
324 CN=Admins,CN=Users,DC=samba,DC=example,DC=com
327 static int fix_dn(TALLOC_CTX *mem_ctx,
328 struct ldb_dn *newdn, struct ldb_dn *parent_dn,
329 struct ldb_dn **fixed_dn)
331 char *upper_rdn_attr;
332 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN */
333 *fixed_dn = ldb_dn_copy(mem_ctx, parent_dn);
335 /* We need the attribute name in upper case */
336 upper_rdn_attr = strupper_talloc(*fixed_dn,
337 ldb_dn_get_rdn_name(newdn));
338 if (!upper_rdn_attr) {
339 return LDB_ERR_OPERATIONS_ERROR;
342 /* Create a new child */
343 if (ldb_dn_add_child_fmt(*fixed_dn, "X=X") == false) {
344 return LDB_ERR_OPERATIONS_ERROR;
347 /* And replace it with CN=foo (we need the attribute in upper case */
348 return ldb_dn_set_component(*fixed_dn, 0, upper_rdn_attr,
349 *ldb_dn_get_rdn_val(newdn));
352 /* Fix all attribute names to be in the correct case, and check they are all valid per the schema */
353 static int fix_attributes(struct ldb_context *ldb, const struct dsdb_schema *schema, struct ldb_message *msg)
356 for (i=0; i < msg->num_elements; i++) {
357 const struct dsdb_attribute *attribute = dsdb_attribute_by_lDAPDisplayName(schema, msg->elements[i].name);
358 /* Add in a very special case for 'clearTextPassword',
359 * which is used for internal processing only, and is
360 * not presented in the schema */
362 if (strcasecmp(msg->elements[i].name, "clearTextPassword") != 0) {
363 ldb_asprintf_errstring(ldb, "attribute %s is not a valid attribute in schema", msg->elements[i].name);
364 /* Apparently Windows sends exactly this behaviour */
365 return LDB_ERR_NO_SUCH_ATTRIBUTE;
368 msg->elements[i].name = attribute->lDAPDisplayName;
375 static int objectclass_do_add(struct oc_context *ac);
377 static int objectclass_add(struct ldb_module *module, struct ldb_request *req)
379 struct ldb_context *ldb;
380 struct ldb_request *search_req;
381 struct oc_context *ac;
382 struct ldb_dn *parent_dn;
384 static const char * const parent_attrs[] = { "objectGUID", NULL };
386 ldb = ldb_module_get_ctx(module);
388 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_add\n");
390 /* do not manipulate our control entries */
391 if (ldb_dn_is_special(req->op.add.message->dn)) {
392 return ldb_next_request(module, req);
395 /* the objectClass must be specified on add */
396 if (ldb_msg_find_element(req->op.add.message,
397 "objectClass") == NULL) {
398 return LDB_ERR_OBJECT_CLASS_VIOLATION;
401 ac = oc_init_context(module, req);
403 return LDB_ERR_OPERATIONS_ERROR;
406 /* If there isn't a parent, just go on to the add processing */
407 if (ldb_dn_get_comp_num(ac->req->op.add.message->dn) == 1) {
408 return objectclass_do_add(ac);
411 /* get copy of parent DN */
412 parent_dn = ldb_dn_get_parent(ac, ac->req->op.add.message->dn);
413 if (parent_dn == NULL) {
415 return LDB_ERR_OPERATIONS_ERROR;
418 ret = ldb_build_search_req(&search_req, ldb,
419 ac, parent_dn, LDB_SCOPE_BASE,
420 "(objectClass=*)", parent_attrs,
422 ac, get_search_callback,
424 if (ret != LDB_SUCCESS) {
427 talloc_steal(search_req, parent_dn);
429 ac->step_fn = objectclass_do_add;
431 return ldb_next_request(ac->module, search_req);
434 static int objectclass_do_add(struct oc_context *ac)
436 struct ldb_context *ldb;
437 const struct dsdb_schema *schema;
438 struct ldb_request *add_req;
440 struct ldb_message_element *objectclass_element;
441 struct ldb_message *msg;
443 struct class_list *sorted, *current;
446 ldb = ldb_module_get_ctx(ac->module);
447 schema = dsdb_get_schema(ldb);
449 mem_ctx = talloc_new(ac);
450 if (mem_ctx == NULL) {
451 return LDB_ERR_OPERATIONS_ERROR;
454 msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
456 /* Check we have a valid parent */
457 if (ac->search_res == NULL) {
458 if (ldb_dn_compare(ldb_get_root_basedn(ldb),
460 /* Allow the tree to be started */
462 /* but don't keep any error string, it's meaningless */
463 ldb_set_errstring(ldb, NULL);
465 ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, parent does not exist!",
466 ldb_dn_get_linearized(msg->dn));
467 talloc_free(mem_ctx);
468 return LDB_ERR_UNWILLING_TO_PERFORM;
471 const struct ldb_val *parent_guid;
473 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN */
475 ac->req->op.add.message->dn,
476 ac->search_res->message->dn,
479 if (ret != LDB_SUCCESS) {
480 ldb_asprintf_errstring(ldb, "Could not munge DN %s into normal form",
481 ldb_dn_get_linearized(ac->req->op.add.message->dn));
482 talloc_free(mem_ctx);
486 parent_guid = ldb_msg_find_ldb_val(ac->search_res->message, "objectGUID");
487 if (parent_guid == NULL) {
488 ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, parent does not have an objectGUID!",
489 ldb_dn_get_linearized(msg->dn));
490 talloc_free(mem_ctx);
491 return LDB_ERR_UNWILLING_TO_PERFORM;
494 /* TODO: Check this is a valid child to this parent,
495 * by reading the allowedChildClasses and
496 * allowedChildClasssesEffective attributes */
497 ret = ldb_msg_add_steal_value(msg, "parentGUID", discard_const(parent_guid));
498 if (ret != LDB_SUCCESS) {
499 ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, failed to add parentGUID",
500 ldb_dn_get_linearized(msg->dn));
501 talloc_free(mem_ctx);
502 return LDB_ERR_UNWILLING_TO_PERFORM;
506 ret = fix_attributes(ldb, schema, msg);
507 if (ret != LDB_SUCCESS) {
508 talloc_free(mem_ctx);
512 /* This is now the objectClass list from the database */
513 objectclass_element = ldb_msg_find_element(msg, "objectClass");
515 if (!objectclass_element) {
516 /* Where did it go? bail now... */
517 talloc_free(mem_ctx);
518 return LDB_ERR_OPERATIONS_ERROR;
520 ret = objectclass_sort(ac->module, schema, mem_ctx, objectclass_element, &sorted);
521 if (ret != LDB_SUCCESS) {
522 talloc_free(mem_ctx);
526 ldb_msg_remove_attr(msg, "objectClass");
527 ret = ldb_msg_add_empty(msg, "objectClass", 0, NULL);
529 if (ret != LDB_SUCCESS) {
530 talloc_free(mem_ctx);
534 /* We must completely replace the existing objectClass entry,
535 * because we need it sorted */
537 /* Move from the linked list back into an ldb msg */
538 for (current = sorted; current; current = current->next) {
539 value = talloc_strdup(msg, current->objectclass->lDAPDisplayName);
542 talloc_free(mem_ctx);
543 return LDB_ERR_OPERATIONS_ERROR;
545 ret = ldb_msg_add_string(msg, "objectClass", value);
546 if (ret != LDB_SUCCESS) {
547 ldb_set_errstring(ldb,
548 "objectclass: could not re-add sorted "
549 "objectclass to modify msg");
550 talloc_free(mem_ctx);
553 /* Last one is the critical one */
554 if (!current->next) {
555 struct ldb_message_element *el;
556 int32_t systemFlags = 0;
557 const char *rdn_name = ldb_dn_get_rdn_name(msg->dn);
558 if (ldb_attr_cmp(rdn_name, current->objectclass->rDNAttID) != 0) {
559 ldb_asprintf_errstring(ldb, "RDN %s is not correct for most specific structural objectclass %s, should be %s",
560 rdn_name, current->objectclass->lDAPDisplayName, current->objectclass->rDNAttID);
561 return LDB_ERR_NAMING_VIOLATION;
564 if (!ldb_msg_find_element(msg, "objectCategory")) {
565 value = talloc_strdup(msg, current->objectclass->defaultObjectCategory);
568 talloc_free(mem_ctx);
569 return LDB_ERR_OPERATIONS_ERROR;
571 ldb_msg_add_string(msg, "objectCategory", value);
573 if (!ldb_msg_find_element(msg, "showInAdvancedViewOnly") && (current->objectclass->defaultHidingValue == true)) {
574 ldb_msg_add_string(msg, "showInAdvancedViewOnly",
578 /* There are very special rules for systemFlags, see MS-ADTS 3.1.1.5.2.4 */
579 el = ldb_msg_find_element(msg, "systemFlags");
581 systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
584 /* Only these flags may be set by a client, but we can't tell between a client and our provision at this point */
585 /* systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_MOVE | SYSTEM_FLAG_CONFIG_LIMITED_MOVE); */
586 ldb_msg_remove_element(msg, el);
589 /* This flag is only allowed on attributeSchema objects */
590 if (ldb_attr_cmp(current->objectclass->lDAPDisplayName, "attributeSchema") == 0) {
591 systemFlags &= ~SYSTEM_FLAG_ATTR_IS_RDN;
594 if (ldb_attr_cmp(current->objectclass->lDAPDisplayName, "server") == 0) {
595 systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE | SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE);
596 } else if (ldb_attr_cmp(current->objectclass->lDAPDisplayName, "site") == 0
597 || ldb_attr_cmp(current->objectclass->lDAPDisplayName, "serverContainer") == 0
598 || ldb_attr_cmp(current->objectclass->lDAPDisplayName, "ntDSDSA") == 0) {
599 systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
601 } else if (ldb_attr_cmp(current->objectclass->lDAPDisplayName, "siteLink") == 0
602 || ldb_attr_cmp(current->objectclass->lDAPDisplayName, "siteLinkBridge") == 0
603 || ldb_attr_cmp(current->objectclass->lDAPDisplayName, "nTDSConnection") == 0) {
604 systemFlags |= (int32_t)(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
607 /* TODO: If parent object is site or subnet, also add (SYSTEM_FLAG_CONFIG_ALLOW_RENAME) */
609 if (el || systemFlags != 0) {
610 samdb_msg_add_int(ldb, msg, msg, "systemFlags", systemFlags);
616 talloc_free(mem_ctx);
617 ret = ldb_msg_sanity_check(ldb, msg);
620 if (ret != LDB_SUCCESS) {
624 ret = ldb_build_add_req(&add_req, ldb, ac,
629 if (ret != LDB_SUCCESS) {
633 /* perform the add */
634 return ldb_next_request(ac->module, add_req);
637 static int oc_modify_callback(struct ldb_request *req,
638 struct ldb_reply *ares);
639 static int objectclass_do_mod(struct oc_context *ac);
641 static int objectclass_modify(struct ldb_module *module, struct ldb_request *req)
643 struct ldb_context *ldb = ldb_module_get_ctx(module);
644 struct ldb_message_element *objectclass_element;
645 struct ldb_message *msg;
646 const struct dsdb_schema *schema = dsdb_get_schema(ldb);
647 struct class_list *sorted, *current;
648 struct ldb_request *down_req;
649 struct oc_context *ac;
654 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_modify\n");
656 /* do not manipulate our control entries */
657 if (ldb_dn_is_special(req->op.mod.message->dn)) {
658 return ldb_next_request(module, req);
661 /* Without schema, there isn't much to do here */
663 return ldb_next_request(module, req);
665 objectclass_element = ldb_msg_find_element(req->op.mod.message, "objectClass");
667 ac = oc_init_context(module, req);
669 return LDB_ERR_OPERATIONS_ERROR;
672 /* If no part of this touches the objectClass, then we don't
673 * need to make any changes. */
675 /* If the only operation is the deletion of the objectClass
676 * then go on with just fixing the attribute case */
677 if (!objectclass_element) {
678 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
680 return LDB_ERR_OPERATIONS_ERROR;
683 ret = fix_attributes(ldb, schema, msg);
684 if (ret != LDB_SUCCESS) {
688 ret = ldb_build_mod_req(&down_req, ldb, ac,
693 if (ret != LDB_SUCCESS) {
697 /* go on with the call chain */
698 return ldb_next_request(module, down_req);
701 switch (objectclass_element->flags & LDB_FLAG_MOD_MASK) {
702 case LDB_FLAG_MOD_DELETE:
703 if (objectclass_element->num_values == 0) {
704 return LDB_ERR_OBJECT_CLASS_MODS_PROHIBITED;
708 case LDB_FLAG_MOD_REPLACE:
709 mem_ctx = talloc_new(ac);
710 if (mem_ctx == NULL) {
711 return LDB_ERR_OPERATIONS_ERROR;
714 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
716 talloc_free(mem_ctx);
717 return LDB_ERR_OPERATIONS_ERROR;
720 ret = fix_attributes(ldb, schema, msg);
721 if (ret != LDB_SUCCESS) {
722 talloc_free(mem_ctx);
726 ret = objectclass_sort(module, schema, mem_ctx, objectclass_element, &sorted);
727 if (ret != LDB_SUCCESS) {
728 talloc_free(mem_ctx);
732 /* We must completely replace the existing objectClass entry,
733 * because we need it sorted */
735 ldb_msg_remove_attr(msg, "objectClass");
736 ret = ldb_msg_add_empty(msg, "objectClass", LDB_FLAG_MOD_REPLACE, NULL);
738 if (ret != LDB_SUCCESS) {
739 talloc_free(mem_ctx);
743 /* Move from the linked list back into an ldb msg */
744 for (current = sorted; current; current = current->next) {
745 /* copy the value as this string is on the schema
746 * context and we can't rely on it not changing
747 * before the operation is over */
748 value = talloc_strdup(msg,
749 current->objectclass->lDAPDisplayName);
752 talloc_free(mem_ctx);
753 return LDB_ERR_OPERATIONS_ERROR;
755 ret = ldb_msg_add_string(msg, "objectClass", value);
756 if (ret != LDB_SUCCESS) {
757 ldb_set_errstring(ldb,
758 "objectclass: could not re-add sorted "
759 "objectclass to modify msg");
760 talloc_free(mem_ctx);
765 talloc_free(mem_ctx);
767 ret = ldb_msg_sanity_check(ldb, msg);
768 if (ret != LDB_SUCCESS) {
772 ret = ldb_build_mod_req(&down_req, ldb, ac,
777 if (ret != LDB_SUCCESS) {
781 /* go on with the call chain */
782 return ldb_next_request(module, down_req);
785 /* This isn't the default branch of the switch, but a 'in any
786 * other case'. When a delete isn't for all objectClasses for
790 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
793 return LDB_ERR_OPERATIONS_ERROR;
796 ret = fix_attributes(ldb, schema, msg);
797 if (ret != LDB_SUCCESS) {
802 ret = ldb_build_mod_req(&down_req, ldb, ac,
805 ac, oc_modify_callback,
807 if (ret != LDB_SUCCESS) {
811 return ldb_next_request(module, down_req);
814 static int oc_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
816 struct ldb_context *ldb;
817 static const char * const attrs[] = { "objectClass", NULL };
818 struct ldb_request *search_req;
819 struct oc_context *ac;
822 ac = talloc_get_type(req->context, struct oc_context);
823 ldb = ldb_module_get_ctx(ac->module);
826 return ldb_module_done(ac->req, NULL, NULL,
827 LDB_ERR_OPERATIONS_ERROR);
829 if (ares->error != LDB_SUCCESS) {
830 return ldb_module_done(ac->req, ares->controls,
831 ares->response, ares->error);
834 if (ares->type != LDB_REPLY_DONE) {
836 return ldb_module_done(ac->req, NULL, NULL,
837 LDB_ERR_OPERATIONS_ERROR);
840 ret = ldb_build_search_req(&search_req, ldb, ac,
841 ac->req->op.mod.message->dn, LDB_SCOPE_BASE,
844 ac, get_search_callback,
846 if (ret != LDB_SUCCESS) {
847 return ldb_module_done(ac->req, NULL, NULL, ret);
850 ac->step_fn = objectclass_do_mod;
852 ret = ldb_next_request(ac->module, search_req);
853 if (ret != LDB_SUCCESS) {
854 return ldb_module_done(ac->req, NULL, NULL, ret);
859 static int objectclass_do_mod(struct oc_context *ac)
861 struct ldb_context *ldb;
862 const struct dsdb_schema *schema;
863 struct ldb_request *mod_req;
865 struct ldb_message_element *objectclass_element;
866 struct ldb_message *msg;
868 struct class_list *sorted, *current;
871 ldb = ldb_module_get_ctx(ac->module);
873 if (ac->search_res == NULL) {
874 return LDB_ERR_OPERATIONS_ERROR;
876 schema = dsdb_get_schema(ldb);
878 mem_ctx = talloc_new(ac);
879 if (mem_ctx == NULL) {
880 return LDB_ERR_OPERATIONS_ERROR;
883 /* use a new message structure */
884 msg = ldb_msg_new(ac);
886 ldb_set_errstring(ldb,
887 "objectclass: could not create new modify msg");
888 talloc_free(mem_ctx);
889 return LDB_ERR_OPERATIONS_ERROR;
892 /* This is now the objectClass list from the database */
893 objectclass_element = ldb_msg_find_element(ac->search_res->message,
895 if (!objectclass_element) {
896 /* Where did it go? bail now... */
897 talloc_free(mem_ctx);
898 return LDB_ERR_OPERATIONS_ERROR;
902 msg->dn = ac->req->op.mod.message->dn;
904 ret = objectclass_sort(ac->module, schema, mem_ctx, objectclass_element, &sorted);
905 if (ret != LDB_SUCCESS) {
909 /* We must completely replace the existing objectClass entry.
910 * We could do a constrained add/del, but we are meant to be
911 * in a transaction... */
913 ret = ldb_msg_add_empty(msg, "objectClass", LDB_FLAG_MOD_REPLACE, NULL);
914 if (ret != LDB_SUCCESS) {
915 ldb_set_errstring(ldb, "objectclass: could not clear objectclass in modify msg");
916 talloc_free(mem_ctx);
920 /* Move from the linked list back into an ldb msg */
921 for (current = sorted; current; current = current->next) {
922 value = talloc_strdup(msg, current->objectclass->lDAPDisplayName);
925 return LDB_ERR_OPERATIONS_ERROR;
927 ret = ldb_msg_add_string(msg, "objectClass", value);
928 if (ret != LDB_SUCCESS) {
929 ldb_set_errstring(ldb, "objectclass: could not re-add sorted objectclass to modify msg");
930 talloc_free(mem_ctx);
935 ret = ldb_msg_sanity_check(ldb, msg);
936 if (ret != LDB_SUCCESS) {
937 talloc_free(mem_ctx);
941 ret = ldb_build_mod_req(&mod_req, ldb, ac,
946 if (ret != LDB_SUCCESS) {
947 talloc_free(mem_ctx);
951 talloc_free(mem_ctx);
952 /* perform the modify */
953 return ldb_next_request(ac->module, mod_req);
956 static int objectclass_do_rename(struct oc_context *ac);
958 static int objectclass_rename(struct ldb_module *module, struct ldb_request *req)
960 static const char * const attrs[] = { "objectGUID", NULL };
961 struct ldb_context *ldb;
962 struct ldb_request *search_req;
963 struct oc_context *ac;
964 struct ldb_dn *parent_dn;
967 ldb = ldb_module_get_ctx(module);
969 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_rename\n");
971 if (ldb_dn_is_special(req->op.rename.newdn)) { /* do not manipulate our control entries */
972 return ldb_next_request(module, req);
975 /* Firstly ensure we are not trying to rename it to be a child of itself */
976 if ((ldb_dn_compare_base(req->op.rename.olddn, req->op.rename.newdn) == 0)
977 && (ldb_dn_compare(req->op.rename.olddn, req->op.rename.newdn) != 0)) {
978 ldb_asprintf_errstring(ldb, "Cannot rename %s to be a child of itself",
979 ldb_dn_get_linearized(req->op.rename.olddn));
980 return LDB_ERR_UNWILLING_TO_PERFORM;
983 ac = oc_init_context(module, req);
985 return LDB_ERR_OPERATIONS_ERROR;
988 parent_dn = ldb_dn_get_parent(ac, req->op.rename.newdn);
989 if (parent_dn == NULL) {
991 return LDB_ERR_OPERATIONS_ERROR;
994 /* note that the results of this search are kept and used to
995 update the parentGUID in objectclass_rename_callback() */
996 ret = ldb_build_search_req(&search_req, ldb,
997 ac, parent_dn, LDB_SCOPE_BASE,
1000 ac, get_search_callback,
1002 if (ret != LDB_SUCCESS) {
1006 /* we have to add the show deleted control, as otherwise DRS
1007 deletes will be refused as we will think the target parent
1009 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_DELETED_OID, false, NULL);
1011 if (ret != LDB_SUCCESS) {
1015 ac->step_fn = objectclass_do_rename;
1017 return ldb_next_request(ac->module, search_req);
1021 called after the rename happens.
1022 We now need to fix the parentGUID of the object to be the objectGUID of
1025 static int objectclass_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
1027 struct ldb_context *ldb;
1028 struct oc_context *ac;
1029 const struct ldb_val *parent_guid;
1030 struct ldb_request *mod_req = NULL;
1032 struct ldb_message *msg;
1033 struct ldb_message_element *el = NULL;
1035 ac = talloc_get_type(req->context, struct oc_context);
1036 ldb = ldb_module_get_ctx(ac->module);
1038 /* make sure the rename succeeded */
1040 return ldb_module_done(ac->req, NULL, NULL,
1041 LDB_ERR_OPERATIONS_ERROR);
1043 if (ares->error != LDB_SUCCESS) {
1044 return ldb_module_done(ac->req, ares->controls,
1045 ares->response, ares->error);
1049 /* the ac->search_res should contain the new parents objectGUID */
1050 parent_guid = ldb_msg_find_ldb_val(ac->search_res->message, "objectGUID");
1051 if (parent_guid == NULL) {
1052 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, new parent does not have an objectGUID!",
1053 ldb_dn_get_linearized(ac->req->op.rename.newdn));
1054 return LDB_ERR_UNWILLING_TO_PERFORM;
1058 /* construct the modify message */
1059 msg = ldb_msg_new(ac);
1062 return LDB_ERR_OPERATIONS_ERROR;
1065 msg->dn = ac->req->op.rename.newdn;
1067 ret = ldb_msg_add_value(msg, "parentGUID", parent_guid, &el);
1068 if (ret != LDB_SUCCESS) {
1072 el->flags = LDB_FLAG_MOD_REPLACE;
1074 ret = ldb_build_mod_req(&mod_req, ldb, ac, msg,
1075 NULL, ac, oc_op_callback, req);
1077 return ldb_next_request(ac->module, mod_req);
1080 static int objectclass_do_rename(struct oc_context *ac)
1082 struct ldb_context *ldb;
1083 struct ldb_request *rename_req;
1084 struct ldb_dn *fixed_dn;
1087 ldb = ldb_module_get_ctx(ac->module);
1089 /* Check we have a valid parent */
1090 if (ac->search_res == NULL) {
1091 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, parent does not exist!",
1092 ldb_dn_get_linearized(ac->req->op.rename.newdn));
1093 return LDB_ERR_UNWILLING_TO_PERFORM;
1096 /* Fix up the DN to be in the standard form,
1097 * taking particular care to match the parent DN */
1099 ac->req->op.rename.newdn,
1100 ac->search_res->message->dn,
1102 if (ret != LDB_SUCCESS) {
1106 /* TODO: Check this is a valid child to this parent,
1107 * by reading the allowedChildClasses and
1108 * allowedChildClasssesEffective attributes */
1110 ret = ldb_build_rename_req(&rename_req, ldb, ac,
1111 ac->req->op.rename.olddn, fixed_dn,
1113 ac, objectclass_rename_callback,
1115 if (ret != LDB_SUCCESS) {
1119 /* perform the rename */
1120 return ldb_next_request(ac->module, rename_req);
1123 _PUBLIC_ const struct ldb_module_ops ldb_objectclass_module_ops = {
1124 .name = "objectclass",
1125 .add = objectclass_add,
1126 .modify = objectclass_modify,
1127 .rename = objectclass_rename,