2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher <metze@samba.org> 2006-2007
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2008
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "lib/util/dlinklist.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "lib/ldb/include/ldb_module.h"
27 #include "param/param.h"
28 #include "librpc/ndr/libndr.h"
29 #include "librpc/gen_ndr/ndr_misc.h"
30 #include "lib/util/tsort.h"
33 override the name to attribute handler function
35 const struct ldb_schema_attribute *dsdb_attribute_handler_override(struct ldb_context *ldb,
39 struct dsdb_schema *schema = talloc_get_type_abort(private_data, struct dsdb_schema);
40 const struct dsdb_attribute *a = dsdb_attribute_by_lDAPDisplayName(schema, name);
42 /* this will fall back to ldb internal handling */
45 return a->ldb_schema_attribute;
48 static int dsdb_schema_set_attributes(struct ldb_context *ldb, struct dsdb_schema *schema, bool write_attributes)
50 int ret = LDB_SUCCESS;
51 struct ldb_result *res;
52 struct ldb_result *res_idx;
53 struct dsdb_attribute *attr;
54 struct ldb_message *mod_msg;
56 struct ldb_message *msg;
57 struct ldb_message *msg_idx;
59 /* setup our own attribute name to schema handler */
60 ldb_schema_attribute_set_override_handler(ldb, dsdb_attribute_handler_override, schema);
62 if (!write_attributes) {
66 mem_ctx = talloc_new(ldb);
71 msg = ldb_msg_new(mem_ctx);
76 msg_idx = ldb_msg_new(mem_ctx);
81 msg->dn = ldb_dn_new(msg, ldb, "@ATTRIBUTES");
86 msg_idx->dn = ldb_dn_new(msg_idx, ldb, "@INDEXLIST");
92 ret = ldb_msg_add_string(msg_idx, "@IDXONE", "1");
93 if (ret != LDB_SUCCESS) {
97 for (attr = schema->attributes; attr; attr = attr->next) {
98 const char *syntax = attr->syntax->ldb_syntax;
101 syntax = attr->syntax->ldap_oid;
105 * Write out a rough approximation of the schema
106 * as an @ATTRIBUTES value, for bootstrapping
108 if (strcmp(syntax, LDB_SYNTAX_INTEGER) == 0) {
109 ret = ldb_msg_add_string(msg, attr->lDAPDisplayName, "INTEGER");
110 } else if (strcmp(syntax, LDB_SYNTAX_DIRECTORY_STRING) == 0) {
111 ret = ldb_msg_add_string(msg, attr->lDAPDisplayName, "CASE_INSENSITIVE");
113 if (ret != LDB_SUCCESS) {
117 if (attr->searchFlags & SEARCH_FLAG_ATTINDEX) {
118 ret = ldb_msg_add_string(msg_idx, "@IDXATTR", attr->lDAPDisplayName);
119 if (ret != LDB_SUCCESS) {
125 if (ret != LDB_SUCCESS) {
126 talloc_free(mem_ctx);
131 * Try to avoid churning the attributes too much,
132 * we only want to do this if they have changed
134 ret = ldb_search(ldb, mem_ctx, &res, msg->dn, LDB_SCOPE_BASE, NULL,
136 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
137 ret = ldb_add(ldb, msg);
138 } else if (ret != LDB_SUCCESS) {
139 } else if (res->count != 1) {
140 ret = ldb_add(ldb, msg);
143 /* Annoyingly added to our search results */
144 ldb_msg_remove_attr(res->msgs[0], "distinguishedName");
146 ret = ldb_msg_difference(ldb, mem_ctx,
147 res->msgs[0], msg, &mod_msg);
148 if (ret != LDB_SUCCESS) {
151 if (mod_msg->num_elements > 0) {
152 ret = dsdb_replace(ldb, mod_msg, 0);
154 talloc_free(mod_msg);
157 if (ret == LDB_ERR_OPERATIONS_ERROR || ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS || ret == LDB_ERR_INVALID_DN_SYNTAX) {
158 /* We might be on a read-only DB or LDAP */
161 if (ret != LDB_SUCCESS) {
162 talloc_free(mem_ctx);
166 /* Now write out the indexes, as found in the schema (if they have changed) */
168 ret = ldb_search(ldb, mem_ctx, &res_idx, msg_idx->dn, LDB_SCOPE_BASE,
170 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
171 ret = ldb_add(ldb, msg_idx);
172 } else if (ret != LDB_SUCCESS) {
173 } else if (res_idx->count != 1) {
174 ret = ldb_add(ldb, msg_idx);
177 /* Annoyingly added to our search results */
178 ldb_msg_remove_attr(res_idx->msgs[0], "distinguishedName");
180 ret = ldb_msg_difference(ldb, mem_ctx,
181 res_idx->msgs[0], msg_idx, &mod_msg);
182 if (ret != LDB_SUCCESS) {
185 if (mod_msg->num_elements > 0) {
186 ret = dsdb_replace(ldb, mod_msg, 0);
188 talloc_free(mod_msg);
190 if (ret == LDB_ERR_OPERATIONS_ERROR || ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS || ret == LDB_ERR_INVALID_DN_SYNTAX) {
191 /* We might be on a read-only DB */
194 talloc_free(mem_ctx);
198 talloc_free(mem_ctx);
199 return ldb_operr(ldb);
202 static int uint32_cmp(uint32_t c1, uint32_t c2)
204 if (c1 == c2) return 0;
205 return c1 > c2 ? 1 : -1;
208 static int dsdb_compare_class_by_lDAPDisplayName(struct dsdb_class **c1, struct dsdb_class **c2)
210 return strcasecmp((*c1)->lDAPDisplayName, (*c2)->lDAPDisplayName);
212 static int dsdb_compare_class_by_governsID_id(struct dsdb_class **c1, struct dsdb_class **c2)
214 return uint32_cmp((*c1)->governsID_id, (*c2)->governsID_id);
216 static int dsdb_compare_class_by_governsID_oid(struct dsdb_class **c1, struct dsdb_class **c2)
218 return strcasecmp((*c1)->governsID_oid, (*c2)->governsID_oid);
220 static int dsdb_compare_class_by_cn(struct dsdb_class **c1, struct dsdb_class **c2)
222 return strcasecmp((*c1)->cn, (*c2)->cn);
225 static int dsdb_compare_attribute_by_lDAPDisplayName(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
227 return strcasecmp((*a1)->lDAPDisplayName, (*a2)->lDAPDisplayName);
229 static int dsdb_compare_attribute_by_attributeID_id(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
231 return uint32_cmp((*a1)->attributeID_id, (*a2)->attributeID_id);
233 static int dsdb_compare_attribute_by_attributeID_oid(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
235 return strcasecmp((*a1)->attributeID_oid, (*a2)->attributeID_oid);
237 static int dsdb_compare_attribute_by_linkID(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
239 return uint32_cmp((*a1)->linkID, (*a2)->linkID);
243 * Clean up Classes and Attributes accessor arrays
245 static void dsdb_sorted_accessors_free(struct dsdb_schema *schema)
247 /* free classes accessors */
248 TALLOC_FREE(schema->classes_by_lDAPDisplayName);
249 TALLOC_FREE(schema->classes_by_governsID_id);
250 TALLOC_FREE(schema->classes_by_governsID_oid);
251 TALLOC_FREE(schema->classes_by_cn);
252 /* free attribute accessors */
253 TALLOC_FREE(schema->attributes_by_lDAPDisplayName);
254 TALLOC_FREE(schema->attributes_by_attributeID_id);
255 TALLOC_FREE(schema->attributes_by_msDS_IntId);
256 TALLOC_FREE(schema->attributes_by_attributeID_oid);
257 TALLOC_FREE(schema->attributes_by_linkID);
261 create the sorted accessor arrays for the schema
263 static int dsdb_setup_sorted_accessors(struct ldb_context *ldb,
264 struct dsdb_schema *schema)
266 struct dsdb_class *cur;
267 struct dsdb_attribute *a;
269 unsigned int num_int_id;
271 /* free all caches */
272 dsdb_sorted_accessors_free(schema);
274 /* count the classes */
275 for (i=0, cur=schema->classes; cur; i++, cur=cur->next) /* noop */ ;
276 schema->num_classes = i;
278 /* setup classes_by_* */
279 schema->classes_by_lDAPDisplayName = talloc_array(schema, struct dsdb_class *, i);
280 schema->classes_by_governsID_id = talloc_array(schema, struct dsdb_class *, i);
281 schema->classes_by_governsID_oid = talloc_array(schema, struct dsdb_class *, i);
282 schema->classes_by_cn = talloc_array(schema, struct dsdb_class *, i);
283 if (schema->classes_by_lDAPDisplayName == NULL ||
284 schema->classes_by_governsID_id == NULL ||
285 schema->classes_by_governsID_oid == NULL ||
286 schema->classes_by_cn == NULL) {
290 for (i=0, cur=schema->classes; cur; i++, cur=cur->next) {
291 schema->classes_by_lDAPDisplayName[i] = cur;
292 schema->classes_by_governsID_id[i] = cur;
293 schema->classes_by_governsID_oid[i] = cur;
294 schema->classes_by_cn[i] = cur;
297 /* sort the arrays */
298 TYPESAFE_QSORT(schema->classes_by_lDAPDisplayName, schema->num_classes, dsdb_compare_class_by_lDAPDisplayName);
299 TYPESAFE_QSORT(schema->classes_by_governsID_id, schema->num_classes, dsdb_compare_class_by_governsID_id);
300 TYPESAFE_QSORT(schema->classes_by_governsID_oid, schema->num_classes, dsdb_compare_class_by_governsID_oid);
301 TYPESAFE_QSORT(schema->classes_by_cn, schema->num_classes, dsdb_compare_class_by_cn);
303 /* now build the attribute accessor arrays */
305 /* count the attributes
306 * and attributes with msDS-IntId set */
308 for (i=0, a=schema->attributes; a; i++, a=a->next) {
309 if (a->msDS_IntId != 0) {
313 schema->num_attributes = i;
314 schema->num_int_id_attr = num_int_id;
316 /* setup attributes_by_* */
317 schema->attributes_by_lDAPDisplayName = talloc_array(schema, struct dsdb_attribute *, i);
318 schema->attributes_by_attributeID_id = talloc_array(schema, struct dsdb_attribute *, i);
319 schema->attributes_by_msDS_IntId = talloc_array(schema,
320 struct dsdb_attribute *, num_int_id);
321 schema->attributes_by_attributeID_oid = talloc_array(schema, struct dsdb_attribute *, i);
322 schema->attributes_by_linkID = talloc_array(schema, struct dsdb_attribute *, i);
323 if (schema->attributes_by_lDAPDisplayName == NULL ||
324 schema->attributes_by_attributeID_id == NULL ||
325 schema->attributes_by_msDS_IntId == NULL ||
326 schema->attributes_by_attributeID_oid == NULL ||
327 schema->attributes_by_linkID == NULL) {
332 for (i=0, a=schema->attributes; a; i++, a=a->next) {
333 schema->attributes_by_lDAPDisplayName[i] = a;
334 schema->attributes_by_attributeID_id[i] = a;
335 schema->attributes_by_attributeID_oid[i] = a;
336 schema->attributes_by_linkID[i] = a;
337 /* append attr-by-msDS-IntId values */
338 if (a->msDS_IntId != 0) {
339 schema->attributes_by_msDS_IntId[num_int_id] = a;
343 SMB_ASSERT(num_int_id == schema->num_int_id_attr);
345 /* sort the arrays */
346 TYPESAFE_QSORT(schema->attributes_by_lDAPDisplayName, schema->num_attributes, dsdb_compare_attribute_by_lDAPDisplayName);
347 TYPESAFE_QSORT(schema->attributes_by_attributeID_id, schema->num_attributes, dsdb_compare_attribute_by_attributeID_id);
348 TYPESAFE_QSORT(schema->attributes_by_msDS_IntId, schema->num_int_id_attr, dsdb_compare_attribute_by_attributeID_id);
349 TYPESAFE_QSORT(schema->attributes_by_attributeID_oid, schema->num_attributes, dsdb_compare_attribute_by_attributeID_oid);
350 TYPESAFE_QSORT(schema->attributes_by_linkID, schema->num_attributes, dsdb_compare_attribute_by_linkID);
355 dsdb_sorted_accessors_free(schema);
359 int dsdb_setup_schema_inversion(struct ldb_context *ldb, struct dsdb_schema *schema)
361 /* Walk the list of schema classes */
363 /* For each subClassOf, add us to subclasses of the parent */
365 /* collect these subclasses into a recursive list of total subclasses, preserving order */
367 /* For each subclass under 'top', write the index from it's
368 * order as an integer in the dsdb_class (for sorting
369 * objectClass lists efficiently) */
371 /* Walk the list of schema classes */
373 /* Create a 'total possible superiors' on each class */
378 * Attach the schema to an opaque pointer on the ldb,
379 * so ldb modules can find it
381 int dsdb_set_schema(struct ldb_context *ldb, struct dsdb_schema *schema)
383 struct dsdb_schema *old_schema;
386 ret = dsdb_setup_sorted_accessors(ldb, schema);
387 if (ret != LDB_SUCCESS) {
391 ret = schema_fill_constructed(schema);
392 if (ret != LDB_SUCCESS) {
396 old_schema = ldb_get_opaque(ldb, "dsdb_schema");
398 ret = ldb_set_opaque(ldb, "dsdb_schema", schema);
399 if (ret != LDB_SUCCESS) {
403 /* Remove the reference to the schema we just overwrote - if there was
404 * none, NULL is harmless here */
405 if (old_schema != schema) {
406 talloc_unlink(ldb, old_schema);
407 talloc_steal(ldb, schema);
410 ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", NULL);
411 if (ret != LDB_SUCCESS) {
415 /* Set the new attributes based on the new schema */
416 ret = dsdb_schema_set_attributes(ldb, schema, true);
417 if (ret != LDB_SUCCESS) {
425 * Global variable to hold one copy of the schema, used to avoid memory bloat
427 static struct dsdb_schema *global_schema;
430 * Make this ldb use a specified schema, already fully calculated and belonging to another ldb
432 int dsdb_reference_schema(struct ldb_context *ldb, struct dsdb_schema *schema,
433 bool write_attributes)
436 struct dsdb_schema *old_schema;
437 old_schema = ldb_get_opaque(ldb, "dsdb_schema");
438 ret = ldb_set_opaque(ldb, "dsdb_schema", schema);
439 if (ret != LDB_SUCCESS) {
443 /* Remove the reference to the schema we just overwrote - if there was
444 * none, NULL is harmless here */
445 talloc_unlink(ldb, old_schema);
447 if (talloc_reference(ldb, schema) == NULL) {
451 ret = dsdb_schema_set_attributes(ldb, schema, write_attributes);
452 if (ret != LDB_SUCCESS) {
460 * Make this ldb use the 'global' schema, setup to avoid having multiple copies in this process
462 int dsdb_set_global_schema(struct ldb_context *ldb)
465 void *use_global_schema = (void *)1;
466 if (!global_schema) {
469 ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", use_global_schema);
470 if (ret != LDB_SUCCESS) {
474 /* Set the new attributes based on the new schema */
475 ret = dsdb_schema_set_attributes(ldb, global_schema, false /* Don't write attributes, it's expensive */);
476 if (ret == LDB_SUCCESS) {
477 /* Keep a reference to this schema, just in case the original copy is replaced */
478 if (talloc_reference(ldb, global_schema) == NULL) {
487 * Find the schema object for this ldb
489 * If reference_ctx is not NULL, then talloc_reference onto that context
492 struct dsdb_schema *dsdb_get_schema(struct ldb_context *ldb, TALLOC_CTX *reference_ctx)
495 struct dsdb_schema *schema_out;
496 struct dsdb_schema *schema_in;
497 bool use_global_schema;
498 TALLOC_CTX *tmp_ctx = talloc_new(reference_ctx);
503 /* see if we have a cached copy */
504 use_global_schema = (ldb_get_opaque(ldb, "dsdb_use_global_schema") != NULL);
505 if (use_global_schema) {
506 schema_in = global_schema;
508 p = ldb_get_opaque(ldb, "dsdb_schema");
510 schema_in = talloc_get_type(p, struct dsdb_schema);
512 talloc_free(tmp_ctx);
517 if (schema_in->refresh_fn && !schema_in->refresh_in_progress) {
518 if (!talloc_reference(tmp_ctx, schema_in)) {
520 * ensure that the schema_in->refresh_in_progress
521 * remains valid for the right amount of time
523 talloc_free(tmp_ctx);
526 schema_in->refresh_in_progress = true;
527 /* This may change schema, if it needs to reload it from disk */
528 schema_out = schema_in->refresh_fn(schema_in->loaded_from_module,
531 schema_in->refresh_in_progress = false;
533 schema_out = schema_in;
536 /* This removes the extra reference above */
537 talloc_free(tmp_ctx);
538 if (!reference_ctx) {
541 return talloc_reference(reference_ctx, schema_out);
546 * Make the schema found on this ldb the 'global' schema
549 void dsdb_make_schema_global(struct ldb_context *ldb, struct dsdb_schema *schema)
556 talloc_unlink(talloc_autofree_context(), global_schema);
559 /* we want the schema to be around permanently */
560 talloc_reparent(ldb, talloc_autofree_context(), schema);
561 global_schema = schema;
563 /* This calls the talloc_reference() of the global schema back onto the ldb */
564 dsdb_set_global_schema(ldb);
568 * When loading the schema from LDIF files, we don't get the extended DNs.
570 * We need to set these up, so that from the moment we start the provision,
571 * the defaultObjectCategory links are set up correctly.
573 int dsdb_schema_fill_extended_dn(struct ldb_context *ldb, struct dsdb_schema *schema)
575 struct dsdb_class *cur;
576 const struct dsdb_class *target_class;
577 for (cur = schema->classes; cur; cur = cur->next) {
578 const struct ldb_val *rdn;
581 struct ldb_dn *dn = ldb_dn_new(NULL, ldb, cur->defaultObjectCategory);
584 return LDB_ERR_INVALID_DN_SYNTAX;
586 rdn = ldb_dn_get_component_val(dn, 0);
589 return LDB_ERR_INVALID_DN_SYNTAX;
591 target_class = dsdb_class_by_cn_ldb_val(schema, rdn);
594 return LDB_ERR_CONSTRAINT_VIOLATION;
597 status = GUID_to_ndr_blob(&target_class->objectGUID, dn, &guid);
598 if (!NT_STATUS_IS_OK(status)) {
600 return ldb_operr(ldb);
602 ldb_dn_set_extended_component(dn, "GUID", &guid);
604 cur->defaultObjectCategory = ldb_dn_get_extended_linearized(cur, dn, 1);
611 * Add an element to the schema (attribute or class) from an LDB message
613 WERROR dsdb_schema_set_el_from_ldb_msg(struct ldb_context *ldb, struct dsdb_schema *schema,
614 struct ldb_message *msg)
616 if (samdb_find_attribute(ldb, msg,
617 "objectclass", "attributeSchema") != NULL) {
618 return dsdb_attribute_from_ldb(ldb, schema, msg);
619 } else if (samdb_find_attribute(ldb, msg,
620 "objectclass", "classSchema") != NULL) {
621 return dsdb_class_from_ldb(schema, msg);
624 /* Don't fail on things not classes or attributes */
629 * Rather than read a schema from the LDB itself, read it from an ldif
630 * file. This allows schema to be loaded and used while adding the
631 * schema itself to the directory.
634 WERROR dsdb_set_schema_from_ldif(struct ldb_context *ldb, const char *pf, const char *df)
636 struct ldb_ldif *ldif;
637 struct ldb_message *msg;
641 struct dsdb_schema *schema;
642 const struct ldb_val *prefix_val;
643 const struct ldb_val *info_val;
644 struct ldb_val info_val_default;
647 mem_ctx = talloc_new(ldb);
652 schema = dsdb_new_schema(mem_ctx);
654 schema->fsmo.we_are_master = true;
655 schema->fsmo.master_dn = ldb_dn_new_fmt(schema, ldb, "@PROVISION_SCHEMA_MASTER");
656 if (!schema->fsmo.master_dn) {
661 * load the prefixMap attribute from pf
663 ldif = ldb_ldif_read_string(ldb, &pf);
665 status = WERR_INVALID_PARAM;
668 talloc_steal(mem_ctx, ldif);
670 ret = ldb_msg_normalize(ldb, mem_ctx, ldif->msg, &msg);
671 if (ret != LDB_SUCCESS) {
676 prefix_val = ldb_msg_find_ldb_val(msg, "prefixMap");
678 status = WERR_INVALID_PARAM;
682 info_val = ldb_msg_find_ldb_val(msg, "schemaInfo");
684 status = dsdb_schema_info_blob_new(mem_ctx, &info_val_default);
685 W_ERROR_NOT_OK_GOTO(status, failed);
686 info_val = &info_val_default;
689 status = dsdb_load_oid_mappings_ldb(schema, prefix_val, info_val);
690 if (!W_ERROR_IS_OK(status)) {
691 DEBUG(0,("ERROR: dsdb_load_oid_mappings_ldb() failed with %s\n", win_errstr(status)));
695 /* load the attribute and class definitions out of df */
696 while ((ldif = ldb_ldif_read_string(ldb, &df))) {
697 talloc_steal(mem_ctx, ldif);
699 ret = ldb_msg_normalize(ldb, ldif, ldif->msg, &msg);
700 if (ret != LDB_SUCCESS) {
704 status = dsdb_schema_set_el_from_ldb_msg(ldb, schema, msg);
706 if (!W_ERROR_IS_OK(status)) {
711 ret = dsdb_set_schema(ldb, schema);
712 if (ret != LDB_SUCCESS) {
713 status = WERR_FOOBAR;
717 ret = dsdb_schema_fill_extended_dn(ldb, schema);
718 if (ret != LDB_SUCCESS) {
719 status = WERR_FOOBAR;
729 talloc_free(mem_ctx);