source4/dsdb/samdb/ldb_modules/objectclass.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Simo Sorce  2006-2008
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
   6    Copyright (C) Matthias Dieter Wallnöfer 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23  *  Name: ldb
  24  *
  25  *  Component: objectClass sorting and constraint checking module
  26  *
  27  *  Description:
  28  *  - sort the objectClass attribute into the class
  29  *    hierarchy and perform constraint checks (correct RDN name,
  30  *    valid parent),
  31  *  - fix DNs into 'standard' case
  32  *  - Add objectCategory and some other attribute defaults
  33  *
  34  *  Author: Andrew Bartlett
  35  */
  36
  37
  38 #include "includes.h"
  39 #include "ldb_module.h"
  40 #include "util/dlinklist.h"
  41 #include "dsdb/samdb/samdb.h"
  42 #include "librpc/ndr/libndr.h"
  43 #include "librpc/gen_ndr/ndr_security.h"
  44 #include "libcli/security/security.h"
  45 #include "auth/auth.h"
  46 #include "param/param.h"
  47 #include "../libds/common/flags.h"
  48 #include "dsdb/samdb/ldb_modules/schema.h"
  49 #include "util.h"
  50
  51 struct oc_context {
  52
  53         struct ldb_module *module;
  54         struct ldb_request *req;
  55         const struct dsdb_schema *schema;
  56
  57         struct ldb_reply *search_res;
  58         struct ldb_reply *search_res2;
  59
  60         int (*step_fn)(struct oc_context *);
  61 };
  62
  63 struct class_list {
  64         struct class_list *prev, *next;
  65         const struct dsdb_class *objectclass;
  66 };
  67
  68 static struct oc_context *oc_init_context(struct ldb_module *module,
  69                                           struct ldb_request *req)
  70 {
  71         struct ldb_context *ldb;
  72         struct oc_context *ac;
  73
  74         ldb = ldb_module_get_ctx(module);
  75
  76         ac = talloc_zero(req, struct oc_context);
  77         if (ac == NULL) {
  78                 ldb_oom(ldb);
  79                 return NULL;
  80         }
  81
  82         ac->module = module;
  83         ac->req = req;
  84         ac->schema = dsdb_get_schema(ldb, ac);
  85
  86         return ac;
  87 }
  88
  89 static int objectclass_do_add(struct oc_context *ac);
  90
  91 /* Sort objectClasses into correct order, and validate that all
  92  * objectClasses specified actually exist in the schema
  93  */
  94
  95 static int objectclass_sort(struct ldb_module *module,
  96                             const struct dsdb_schema *schema,
  97                             TALLOC_CTX *mem_ctx,
  98                             struct ldb_message_element *objectclass_element,
  99                             struct class_list **sorted_out)
 100 {
 101         struct ldb_context *ldb;
 102         unsigned int i, lowest;
 103         struct class_list *unsorted = NULL, *sorted = NULL, *current = NULL, *poss_parent = NULL, *new_parent = NULL, *current_lowest = NULL;
 104
 105         ldb = ldb_module_get_ctx(module);
 106
 107         /* DESIGN:
 108          *
 109          * We work on 4 different 'bins' (implemented here as linked lists):
 110          *
 111          * * sorted:       the eventual list, in the order we wish to push
 112          *                 into the database.  This is the only ordered list.
 113          *
 114          * * parent_class: The current parent class 'bin' we are
 115          *                 trying to find subclasses for
 116          *
 117          * * subclass:     The subclasses we have found so far
 118          *
 119          * * unsorted:     The remaining objectClasses
 120          *
 121          * The process is a matter of filtering objectClasses up from
 122          * unsorted into sorted.  Order is irrelevent in the later 3 'bins'.
 123          *
 124          * We start with 'top' (found and promoted to parent_class
 125          * initially).  Then we find (in unsorted) all the direct
 126          * subclasses of 'top'.  parent_classes is concatenated onto
 127          * the end of 'sorted', and subclass becomes the list in
 128          * parent_class.
 129          *
 130          * We then repeat, until we find no more subclasses.  Any left
 131          * over classes are added to the end.
 132          *
 133          */
 134
 135         /* Firstly, dump all the objectClass elements into the
 136          * unsorted bin, except for 'top', which is special */
 137         for (i=0; i < objectclass_element->num_values; i++) {
 138                 current = talloc(mem_ctx, struct class_list);
 139                 if (!current) {
 140                         return ldb_oom(ldb);
 141                 }
 142                 current->objectclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &objectclass_element->values[i]);
 143                 if (!current->objectclass) {
 144                         ldb_asprintf_errstring(ldb, "objectclass %.*s is not a valid objectClass in schema",
 145                                                (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
 146                         /* This looks weird, but windows apparently returns this for invalid objectClass values */
 147                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 148                 } else if (current->objectclass->isDefunct) {
 149                         ldb_asprintf_errstring(ldb, "objectclass %.*s marked as isDefunct objectClass in schema - not valid for new objects",
 150                                                (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
 151                         /* This looks weird, but windows apparently returns this for invalid objectClass values */
 152                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 153                 }
 154
 155                 /* Don't add top to list, we will do that later */
 156                 if (ldb_attr_cmp("top", current->objectclass->lDAPDisplayName) != 0) {
 157                         DLIST_ADD_END(unsorted, current, struct class_list *);
 158                 }
 159         }
 160
 161         /* Add top here, to prevent duplicates */
 162         current = talloc(mem_ctx, struct class_list);
 163         current->objectclass = dsdb_class_by_lDAPDisplayName(schema, "top");
 164         DLIST_ADD_END(sorted, current, struct class_list *);
 165
 166
 167         /* For each object:  find parent chain */
 168         for (current = unsorted; schema && current; current = current->next) {
 169                 for (poss_parent = unsorted; poss_parent; poss_parent = poss_parent->next) {
 170                         if (ldb_attr_cmp(poss_parent->objectclass->lDAPDisplayName, current->objectclass->subClassOf) == 0) {
 171                                 break;
 172                         }
 173                 }
 174                 /* If we didn't get to the end of the list, we need to add this parent */
 175                 if (poss_parent || (ldb_attr_cmp("top", current->objectclass->subClassOf) == 0)) {
 176                         continue;
 177                 }
 178
 179                 new_parent = talloc(mem_ctx, struct class_list);
 180                 new_parent->objectclass = dsdb_class_by_lDAPDisplayName(schema, current->objectclass->subClassOf);
 181                 DLIST_ADD_END(unsorted, new_parent, struct class_list *);
 182         }
 183
 184         do
 185         {
 186                 lowest = UINT_MAX;
 187                 current_lowest = NULL;
 188                 for (current = unsorted; schema && current; current = current->next) {
 189                         if(current->objectclass->subClass_order < lowest) {
 190                                 current_lowest = current;
 191                                 lowest = current->objectclass->subClass_order;
 192                         }
 193                 }
 194
 195                 if(current_lowest != NULL) {
 196                         DLIST_REMOVE(unsorted,current_lowest);
 197                         DLIST_ADD_END(sorted,current_lowest, struct class_list *);
 198                 }
 199         } while(unsorted);
 200
 201
 202         if (!unsorted) {
 203                 *sorted_out = sorted;
 204                 return LDB_SUCCESS;
 205         }
 206
 207         if (!schema) {
 208                 /* If we don't have schema yet, then just merge the lists again */
 209                 DLIST_CONCATENATE(sorted, unsorted, struct class_list *);
 210                 *sorted_out = sorted;
 211                 return LDB_SUCCESS;
 212         }
 213
 214         /* This shouldn't happen, and would break MMC, perhaps there
 215          * was no 'top', a conflict in the objectClasses or some other
 216          * schema error?
 217          */
 218         ldb_asprintf_errstring(ldb, "objectclass %s is not a valid objectClass in objectClass chain", unsorted->objectclass->lDAPDisplayName);
 219         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 220 }
 221
 222 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
 223 {
 224         struct ldb_context *ldb;
 225         struct oc_context *ac;
 226         int ret;
 227
 228         ac = talloc_get_type(req->context, struct oc_context);
 229         ldb = ldb_module_get_ctx(ac->module);
 230
 231         if (!ares) {
 232                 return ldb_module_done(ac->req, NULL, NULL,
 233                                         LDB_ERR_OPERATIONS_ERROR);
 234         }
 235         if (ares->error != LDB_SUCCESS &&
 236             ares->error != LDB_ERR_NO_SUCH_OBJECT) {
 237                 return ldb_module_done(ac->req, ares->controls,
 238                                         ares->response, ares->error);
 239         }
 240
 241         ldb_reset_err_string(ldb);
 242
 243         switch (ares->type) {
 244         case LDB_REPLY_ENTRY:
 245                 if (ac->search_res != NULL) {
 246                         ldb_set_errstring(ldb, "Too many results");
 247                         talloc_free(ares);
 248                         return ldb_module_done(ac->req, NULL, NULL,
 249                                                 LDB_ERR_OPERATIONS_ERROR);
 250                 }
 251
 252                 ac->search_res = talloc_steal(ac, ares);
 253                 break;
 254
 255         case LDB_REPLY_REFERRAL:
 256                 /* ignore */
 257                 talloc_free(ares);
 258                 break;
 259
 260         case LDB_REPLY_DONE:
 261                 talloc_free(ares);
 262                 ret = ac->step_fn(ac);
 263                 if (ret != LDB_SUCCESS) {
 264                         return ldb_module_done(ac->req, NULL, NULL, ret);
 265                 }
 266                 break;
 267         }
 268
 269         return LDB_SUCCESS;
 270 }
 271
 272 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
 273 {
 274         struct oc_context *ac;
 275
 276         ac = talloc_get_type(req->context, struct oc_context);
 277
 278         if (!ares) {
 279                 return ldb_module_done(ac->req, NULL, NULL,
 280                                         LDB_ERR_OPERATIONS_ERROR);
 281         }
 282
 283         if (ares->type == LDB_REPLY_REFERRAL) {
 284                 return ldb_module_send_referral(ac->req, ares->referral);
 285         }
 286
 287         if (ares->error != LDB_SUCCESS) {
 288                 return ldb_module_done(ac->req, ares->controls,
 289                                         ares->response, ares->error);
 290         }
 291
 292         if (ares->type != LDB_REPLY_DONE) {
 293                 talloc_free(ares);
 294                 return ldb_module_done(ac->req, NULL, NULL,
 295                                         LDB_ERR_OPERATIONS_ERROR);
 296         }
 297
 298         return ldb_module_done(ac->req, ares->controls,
 299                                 ares->response, ares->error);
 300 }
 301
 302 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN
 303
 304    This should mean that if the parent is:
 305     CN=Users,DC=samba,DC=example,DC=com
 306    and a proposed child is
 307     cn=Admins ,cn=USERS,dc=Samba,dc=example,dc=COM
 308
 309    The resulting DN should be:
 310
 311     CN=Admins,CN=Users,DC=samba,DC=example,DC=com
 312
 313  */
 314 static int fix_dn(struct ldb_context *ldb,
 315                   TALLOC_CTX *mem_ctx,
 316                   struct ldb_dn *newdn, struct ldb_dn *parent_dn,
 317                   struct ldb_dn **fixed_dn)
 318 {
 319         char *upper_rdn_attr;
 320         const struct ldb_val *rdn_val;
 321
 322         /* Fix up the DN to be in the standard form, taking particular care to match the parent DN */
 323         *fixed_dn = ldb_dn_copy(mem_ctx, parent_dn);
 324
 325         /* We need the attribute name in upper case */
 326         upper_rdn_attr = strupper_talloc(*fixed_dn,
 327                                          ldb_dn_get_rdn_name(newdn));
 328         if (!upper_rdn_attr) {
 329                 return ldb_operr(ldb);
 330         }
 331
 332         /* Create a new child */
 333         if (ldb_dn_add_child_fmt(*fixed_dn, "X=X") == false) {
 334                 return ldb_operr(ldb);
 335         }
 336
 337         rdn_val = ldb_dn_get_rdn_val(newdn);
 338         if (rdn_val == NULL) {
 339                 return ldb_operr(ldb);
 340         }
 341
 342 #if 0
 343         /* the rules for rDN length constraints are more complex than
 344         this. Until we understand them we need to leave this
 345         constraint out. Otherwise we break replication, as windows
 346         does sometimes send us rDNs longer than 64 */
 347         if (!rdn_val || rdn_val->length > 64) {
 348                 DEBUG(2,(__location__ ": WARNING: rDN longer than 64 limit for '%s'\n", ldb_dn_get_linearized(newdn)));
 349         }
 350 #endif
 351
 352
 353         /* And replace it with CN=foo (we need the attribute in upper case */
 354         return ldb_dn_set_component(*fixed_dn, 0, upper_rdn_attr, *rdn_val);
 355 }
 356
 357
 358 static int objectclass_do_add(struct oc_context *ac);
 359
 360 static int objectclass_add(struct ldb_module *module, struct ldb_request *req)
 361 {
 362         struct ldb_context *ldb;
 363         struct ldb_request *search_req;
 364         struct oc_context *ac;
 365         struct ldb_dn *parent_dn;
 366         const struct ldb_val *val;
 367         char *value;
 368         int ret;
 369         static const char * const parent_attrs[] = { "objectClass", NULL };
 370
 371         ldb = ldb_module_get_ctx(module);
 372
 373         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_add\n");
 374
 375         /* do not manipulate our control entries */
 376         if (ldb_dn_is_special(req->op.add.message->dn)) {
 377                 return ldb_next_request(module, req);
 378         }
 379
 380         /* An add operation on the basedn without "NC-add" operation isn't
 381          * allowed. */
 382         if (ldb_dn_compare(ldb_get_default_basedn(ldb), req->op.add.message->dn) == 0) {
 383                 unsigned int instanceType;
 384
 385                 instanceType = ldb_msg_find_attr_as_uint(req->op.add.message,
 386                                                          "instanceType", 0);
 387                 if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
 388                         /* When we are trying to readd the root basedn then
 389                          * this is denied, but with an interesting mechanism:
 390                          * there is generated a referral with the last
 391                          * component value as hostname. */
 392                         val = ldb_dn_get_component_val(req->op.add.message->dn,
 393                                                        ldb_dn_get_comp_num(req->op.add.message->dn) - 1);
 394                         if (val == NULL) {
 395                                 return ldb_operr(ldb);
 396                         }
 397                         value = talloc_asprintf(req, "ldap://%s/%s", val->data,
 398                                                 ldb_dn_get_linearized(req->op.add.message->dn));
 399                         if (value == NULL) {
 400                                 return ldb_oom(ldb);
 401                         }
 402
 403                         return ldb_module_send_referral(req, value);
 404                 }
 405         }
 406
 407         ac = oc_init_context(module, req);
 408         if (ac == NULL) {
 409                 return ldb_operr(ldb);
 410         }
 411
 412         /* If there isn't a parent, just go on to the add processing */
 413         if (ldb_dn_get_comp_num(ac->req->op.add.message->dn) == 1) {
 414                 return objectclass_do_add(ac);
 415         }
 416
 417         /* get copy of parent DN */
 418         parent_dn = ldb_dn_get_parent(ac, ac->req->op.add.message->dn);
 419         if (parent_dn == NULL) {
 420                 return ldb_oom(ldb);
 421         }
 422
 423         ret = ldb_build_search_req(&search_req, ldb,
 424                                    ac, parent_dn, LDB_SCOPE_BASE,
 425                                    "(objectClass=*)", parent_attrs,
 426                                    NULL,
 427                                    ac, get_search_callback,
 428                                    req);
 429         LDB_REQ_SET_LOCATION(search_req);
 430         if (ret != LDB_SUCCESS) {
 431                 return ret;
 432         }
 433
 434         ac->step_fn = objectclass_do_add;
 435
 436         return ldb_next_request(ac->module, search_req);
 437 }
 438
 439
 440 /*
 441   check if this is a special RODC nTDSDSA add
 442  */
 443 static bool check_rodc_ntdsdsa_add(struct oc_context *ac,
 444                                    const struct dsdb_class *objectclass)
 445 {
 446         struct ldb_control *rodc_control;
 447
 448         if (strcasecmp(objectclass->lDAPDisplayName, "nTDSDSA") != 0) {
 449                 return false;
 450         }
 451         rodc_control = ldb_request_get_control(ac->req, LDB_CONTROL_RODC_DCPROMO_OID);
 452         if (!rodc_control) {
 453                 return false;
 454         }
 455
 456         rodc_control->critical = false;
 457         return true;
 458 }
 459
 460 static int objectclass_do_add(struct oc_context *ac)
 461 {
 462         struct ldb_context *ldb;
 463         struct ldb_request *add_req;
 464         struct ldb_message_element *objectclass_element, *el;
 465         struct ldb_message *msg;
 466         TALLOC_CTX *mem_ctx;
 467         struct class_list *sorted, *current;
 468         const char *rdn_name = NULL;
 469         char *value;
 470         const struct dsdb_class *objectclass;
 471         struct ldb_dn *objectcategory;
 472         int32_t systemFlags = 0;
 473         unsigned int i, j;
 474         bool found;
 475         int ret;
 476
 477         ldb = ldb_module_get_ctx(ac->module);
 478
 479         msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
 480
 481         /* Check if we have a valid parent - this check is needed since
 482          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
 483         if (ac->search_res == NULL) {
 484                 unsigned int instanceType;
 485
 486                 /* An add operation on partition DNs without "NC-add" operation
 487                  * isn't allowed. */
 488                 instanceType = ldb_msg_find_attr_as_uint(ac->req->op.add.message,
 489                                                          "instanceType", 0);
 490                 if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
 491                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, parent does not exist!",
 492                                                ldb_dn_get_linearized(msg->dn));
 493                         return LDB_ERR_NO_SUCH_OBJECT;
 494                 }
 495
 496                 /* Don't keep any error messages - we've to add a partition */
 497                 ldb_set_errstring(ldb, NULL);
 498         } else {
 499                 /* Fix up the DN to be in the standard form, taking
 500                  * particular care to match the parent DN */
 501                 ret = fix_dn(ldb, msg,
 502                              ac->req->op.add.message->dn,
 503                              ac->search_res->message->dn,
 504                              &msg->dn);
 505                 if (ret != LDB_SUCCESS) {
 506                         ldb_asprintf_errstring(ldb, "objectclass: Could not munge DN %s into normal form",
 507                                                ldb_dn_get_linearized(ac->req->op.add.message->dn));
 508                         return ret;
 509                 }
 510         }
 511
 512         mem_ctx = talloc_new(ac);
 513         if (mem_ctx == NULL) {
 514                 return ldb_oom(ldb);
 515         }
 516
 517         if (ac->schema != NULL) {
 518                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 519                 if (!objectclass_element) {
 520                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, no objectclass specified!",
 521                                                ldb_dn_get_linearized(msg->dn));
 522                         talloc_free(mem_ctx);
 523                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 524                 }
 525                 if (objectclass_element->num_values == 0) {
 526                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, at least one (structural) objectclass has to be specified!",
 527                                                ldb_dn_get_linearized(msg->dn));
 528                         talloc_free(mem_ctx);
 529                         return LDB_ERR_CONSTRAINT_VIOLATION;
 530                 }
 531
 532                 /* Here we do now get the "objectClass" list from the
 533                  * database. */
 534                 ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
 535                                        objectclass_element, &sorted);
 536                 if (ret != LDB_SUCCESS) {
 537                         talloc_free(mem_ctx);
 538                         return ret;
 539                 }
 540
 541                 ldb_msg_remove_element(msg, objectclass_element);
 542
 543                 /* Well, now we shouldn't find any additional "objectClass"
 544                  * message element (required by the AD specification). */
 545                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 546                 if (objectclass_element != NULL) {
 547                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, only one 'objectclass' attribute specification is allowed!",
 548                                                ldb_dn_get_linearized(msg->dn));
 549                         talloc_free(mem_ctx);
 550                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 551                 }
 552
 553                 /* We must completely replace the existing objectClass entry,
 554                  * because we need it sorted. */
 555                 ret = ldb_msg_add_empty(msg, "objectClass", 0, NULL);
 556                 if (ret != LDB_SUCCESS) {
 557                         talloc_free(mem_ctx);
 558                         return ret;
 559                 }
 560
 561                 /* Move from the linked list back into an ldb msg */
 562                 for (current = sorted; current; current = current->next) {
 563                         value = talloc_strdup(msg, current->objectclass->lDAPDisplayName);
 564                         if (value == NULL) {
 565                                 talloc_free(mem_ctx);
 566                                 return ldb_oom(ldb);
 567                         }
 568
 569                         ret = ldb_msg_add_string(msg, "objectClass", value);
 570                         if (ret != LDB_SUCCESS) {
 571                                 ldb_set_errstring(ldb,
 572                                                   "objectclass: could not re-add sorted "
 573                                                   "objectclass to modify msg");
 574                                 talloc_free(mem_ctx);
 575                                 return ret;
 576                         }
 577                 }
 578
 579                 talloc_free(mem_ctx);
 580
 581                 /* Retrive the message again so get_last_structural_class works */
 582                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 583
 584                 /* Make sure its valid to add an object of this type */
 585                 objectclass = get_last_structural_class(ac->schema,
 586                                                         objectclass_element);
 587                 if(objectclass == NULL) {
 588                         ldb_asprintf_errstring(ldb,
 589                                                "Failed to find a structural class for %s",
 590                                                ldb_dn_get_linearized(msg->dn));
 591                         return LDB_ERR_UNWILLING_TO_PERFORM;
 592                 }
 593
 594                 rdn_name = ldb_dn_get_rdn_name(msg->dn);
 595                 if (rdn_name == NULL) {
 596                         return ldb_operr(ldb);
 597                 }
 598                 found = false;
 599                 for (i = 0; (!found) && (i < objectclass_element->num_values);
 600                      i++) {
 601                         const struct dsdb_class *tmp_class =
 602                                 dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
 603                                                                       &objectclass_element->values[i]);
 604
 605                         if (tmp_class == NULL) continue;
 606
 607                         if (ldb_attr_cmp(rdn_name, tmp_class->rDNAttID) == 0)
 608                                 found = true;
 609                 }
 610                 if (!found) {
 611                         ldb_asprintf_errstring(ldb,
 612                                                "objectclass: Invalid RDN '%s' for objectclass '%s'!",
 613                                                rdn_name, objectclass->lDAPDisplayName);
 614                         return LDB_ERR_NAMING_VIOLATION;
 615                 }
 616
 617                 if (objectclass->systemOnly &&
 618                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
 619                     !check_rodc_ntdsdsa_add(ac, objectclass)) {
 620                         ldb_asprintf_errstring(ldb, "objectClass %s is systemOnly, rejecting creation of %s",
 621                                                 objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn));
 622                         return LDB_ERR_UNWILLING_TO_PERFORM;
 623                 }
 624
 625                 if (((strcmp(objectclass->lDAPDisplayName, "secret") == 0) ||
 626                      (strcmp(objectclass->lDAPDisplayName, "trustedDomain") == 0)) &&
 627                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
 628                         ldb_asprintf_errstring(ldb, "objectClass %s is LSA-specific, rejecting creation of %s",
 629                                                 objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn));
 630                         return LDB_ERR_UNWILLING_TO_PERFORM;
 631                 }
 632
 633                 if (ac->search_res && ac->search_res->message) {
 634                         struct ldb_message_element *oc_el
 635                                 = ldb_msg_find_element(ac->search_res->message, "objectClass");
 636
 637                         bool allowed_class = false;
 638                         for (i=0; allowed_class == false && oc_el && i < oc_el->num_values; i++) {
 639                                 const struct dsdb_class *sclass;
 640
 641                                 sclass = dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
 642                                                                                &oc_el->values[i]);
 643                                 if (!sclass) {
 644                                         /* We don't know this class?  what is going on? */
 645                                         continue;
 646                                 }
 647                                 for (j=0; sclass->systemPossibleInferiors && sclass->systemPossibleInferiors[j]; j++) {
 648                                         if (ldb_attr_cmp(objectclass->lDAPDisplayName, sclass->systemPossibleInferiors[j]) == 0) {
 649                                                 allowed_class = true;
 650                                                 break;
 651                                         }
 652                                 }
 653                         }
 654
 655                         if (!allowed_class) {
 656                                 ldb_asprintf_errstring(ldb, "structural objectClass %s is not a valid child class for %s",
 657                                                 objectclass->lDAPDisplayName, ldb_dn_get_linearized(ac->search_res->message->dn));
 658                                 return LDB_ERR_NAMING_VIOLATION;
 659                         }
 660                 }
 661
 662                 objectcategory = ldb_msg_find_attr_as_dn(ldb, ac, msg,
 663                                                          "objectCategory");
 664                 if (objectcategory == NULL) {
 665                         struct dsdb_extended_dn_store_format *dn_format =
 666                                         talloc_get_type(ldb_module_get_private(ac->module),
 667                                                         struct dsdb_extended_dn_store_format);
 668                         if (dn_format && dn_format->store_extended_dn_in_ldb == false) {
 669                                 /* Strip off extended components */
 670                                 struct ldb_dn *dn = ldb_dn_new(ac, ldb,
 671                                                                objectclass->defaultObjectCategory);
 672                                 value = ldb_dn_alloc_linearized(msg, dn);
 673                                 talloc_free(dn);
 674                         } else {
 675                                 value = talloc_strdup(msg,
 676                                                       objectclass->defaultObjectCategory);
 677                         }
 678                         if (value == NULL) {
 679                                 return ldb_oom(ldb);
 680                         }
 681
 682                         ret = ldb_msg_add_string(msg, "objectCategory", value);
 683                         if (ret != LDB_SUCCESS) {
 684                                 return ret;
 685                         }
 686                 } else {
 687                         const struct dsdb_class *ocClass =
 688                                         dsdb_class_by_cn_ldb_val(ac->schema,
 689                                                                  ldb_dn_get_rdn_val(objectcategory));
 690                         if (ocClass != NULL) {
 691                                 struct ldb_dn *dn = ldb_dn_new(ac, ldb,
 692                                                                ocClass->defaultObjectCategory);
 693                                 if (ldb_dn_compare(objectcategory, dn) != 0) {
 694                                         ocClass = NULL;
 695                                 }
 696                         }
 697                         talloc_free(objectcategory);
 698                         if (ocClass == NULL) {
 699                                 ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, 'objectCategory' attribute invalid!",
 700                                                        ldb_dn_get_linearized(msg->dn));
 701                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
 702                         }
 703                 }
 704
 705                 if (!ldb_msg_find_element(msg, "showInAdvancedViewOnly") && (objectclass->defaultHidingValue == true)) {
 706                         ldb_msg_add_string(msg, "showInAdvancedViewOnly",
 707                                                 "TRUE");
 708                 }
 709
 710                 /* There are very special rules for systemFlags, see MS-ADTS
 711                  * MS-ADTS 3.1.1.5.2.4 */
 712
 713                 el = ldb_msg_find_element(msg, "systemFlags");
 714                 if ((el != NULL) && (el->num_values > 1)) {
 715                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, 'systemFlags' attribute multivalued!",
 716                                                ldb_dn_get_linearized(msg->dn));
 717                         return LDB_ERR_CONSTRAINT_VIOLATION;
 718                 }
 719
 720                 systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
 721
 722                 ldb_msg_remove_attr(msg, "systemFlags");
 723
 724                 /* Only the following flags may be set by a client */
 725                 if (ldb_request_get_control(ac->req,
 726                                             LDB_CONTROL_RELAX_OID) == NULL) {
 727                         systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME
 728                                        | SYSTEM_FLAG_CONFIG_ALLOW_MOVE
 729                                        | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE
 730                                        | SYSTEM_FLAG_ATTR_IS_RDN );
 731                 }
 732
 733                 /* But the last one ("ATTR_IS_RDN") is only allowed on
 734                  * "attributeSchema" objects. So truncate if it does not fit. */
 735                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, "attributeSchema") != 0) {
 736                         systemFlags &= ~SYSTEM_FLAG_ATTR_IS_RDN;
 737                 }
 738
 739                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, "server") == 0) {
 740                         systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE | SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE);
 741                 } else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "site") == 0
 742                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "serversContainer") == 0
 743                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSDSA") == 0) {
 744                         systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
 745
 746                 } else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLink") == 0
 747                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLinkBridge") == 0
 748                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSConnection") == 0) {
 749                         systemFlags |= (int32_t)(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
 750                 }
 751
 752                 /* TODO: If parent object is site or subnet, also add (SYSTEM_FLAG_CONFIG_ALLOW_RENAME) */
 753
 754                 if (el || systemFlags != 0) {
 755                         ret = samdb_msg_add_int(ldb, msg, msg, "systemFlags",
 756                                                 systemFlags);
 757                         if (ret != LDB_SUCCESS) {
 758                                 return ret;
 759                         }
 760                 }
 761
 762                 /* make sure that "isCriticalSystemObject" is not specified! */
 763                 el = ldb_msg_find_element(msg, "isCriticalSystemObject");
 764                 if ((el != NULL) &&
 765                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
 766                         ldb_set_errstring(ldb,
 767                                           "objectclass: 'isCriticalSystemObject' must not be specified!");
 768                         return LDB_ERR_UNWILLING_TO_PERFORM;
 769                 }
 770         }
 771
 772         ret = ldb_msg_sanity_check(ldb, msg);
 773         if (ret != LDB_SUCCESS) {
 774                 return ret;
 775         }
 776
 777         ret = ldb_build_add_req(&add_req, ldb, ac,
 778                                 msg,
 779                                 ac->req->controls,
 780                                 ac, oc_op_callback,
 781                                 ac->req);
 782         LDB_REQ_SET_LOCATION(add_req);
 783         if (ret != LDB_SUCCESS) {
 784                 return ret;
 785         }
 786
 787         /* perform the add */
 788         return ldb_next_request(ac->module, add_req);
 789 }
 790
 791 static int oc_modify_callback(struct ldb_request *req,
 792                                 struct ldb_reply *ares);
 793 static int objectclass_do_mod(struct oc_context *ac);
 794
 795 static int objectclass_modify(struct ldb_module *module, struct ldb_request *req)
 796 {
 797         struct ldb_context *ldb = ldb_module_get_ctx(module);
 798         struct ldb_message_element *objectclass_element;
 799         struct ldb_message *msg;
 800         struct ldb_request *down_req;
 801         struct oc_context *ac;
 802         bool oc_changes = false;
 803         int ret;
 804
 805         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_modify\n");
 806
 807         /* do not manipulate our control entries */
 808         if (ldb_dn_is_special(req->op.mod.message->dn)) {
 809                 return ldb_next_request(module, req);
 810         }
 811
 812         /* As with the "real" AD we don't accept empty messages */
 813         if (req->op.mod.message->num_elements == 0) {
 814                 ldb_set_errstring(ldb, "objectclass: modify message must have "
 815                                        "elements/attributes!");
 816                 return LDB_ERR_UNWILLING_TO_PERFORM;
 817         }
 818
 819         ac = oc_init_context(module, req);
 820         if (ac == NULL) {
 821                 return ldb_operr(ldb);
 822         }
 823
 824         /* Without schema, there isn't much to do here */
 825         if (ac->schema == NULL) {
 826                 talloc_free(ac);
 827                 return ldb_next_request(module, req);
 828         }
 829
 830         msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
 831         if (msg == NULL) {
 832                 return ldb_operr(ldb);
 833         }
 834
 835         /* For now change everything except the objectclasses */
 836
 837         objectclass_element = ldb_msg_find_element(msg, "objectClass");
 838         if (objectclass_element != NULL) {
 839                 ldb_msg_remove_attr(msg, "objectClass");
 840                 oc_changes = true;
 841         }
 842
 843         ret = ldb_build_mod_req(&down_req, ldb, ac,
 844                                 msg,
 845                                 req->controls, ac,
 846                                 oc_changes ? oc_modify_callback : oc_op_callback,
 847                                 req);
 848         LDB_REQ_SET_LOCATION(down_req);
 849         if (ret != LDB_SUCCESS) {
 850                 return ret;
 851         }
 852
 853         return ldb_next_request(module, down_req);
 854 }
 855
 856 static int oc_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
 857 {
 858         static const char * const attrs[] = { "objectClass", NULL };
 859         struct ldb_context *ldb;
 860         struct ldb_request *search_req;
 861         struct oc_context *ac;
 862         int ret;
 863
 864         ac = talloc_get_type(req->context, struct oc_context);
 865         ldb = ldb_module_get_ctx(ac->module);
 866
 867         if (!ares) {
 868                 return ldb_module_done(ac->req, NULL, NULL,
 869                                         LDB_ERR_OPERATIONS_ERROR);
 870         }
 871
 872         if (ares->type == LDB_REPLY_REFERRAL) {
 873                 return ldb_module_send_referral(ac->req, ares->referral);
 874         }
 875
 876         if (ares->error != LDB_SUCCESS) {
 877                 return ldb_module_done(ac->req, ares->controls,
 878                                         ares->response, ares->error);
 879         }
 880
 881         if (ares->type != LDB_REPLY_DONE) {
 882                 talloc_free(ares);
 883                 return ldb_module_done(ac->req, NULL, NULL,
 884                                         LDB_ERR_OPERATIONS_ERROR);
 885         }
 886
 887         talloc_free(ares);
 888
 889         /* this looks up the real existing object for fetching some important
 890          * informations (objectclasses) */
 891         ret = ldb_build_search_req(&search_req, ldb,
 892                                    ac, ac->req->op.mod.message->dn,
 893                                    LDB_SCOPE_BASE,
 894                                    "(objectClass=*)",
 895                                    attrs, NULL,
 896                                    ac, get_search_callback,
 897                                    ac->req);
 898         LDB_REQ_SET_LOCATION(search_req);
 899         if (ret != LDB_SUCCESS) {
 900                 return ldb_module_done(ac->req, NULL, NULL, ret);
 901         }
 902
 903         ac->step_fn = objectclass_do_mod;
 904
 905         ret = ldb_next_request(ac->module, search_req);
 906         if (ret != LDB_SUCCESS) {
 907                 return ldb_module_done(ac->req, NULL, NULL, ret);
 908         }
 909
 910         return LDB_SUCCESS;
 911 }
 912
 913 static int objectclass_do_mod(struct oc_context *ac)
 914 {
 915         struct ldb_context *ldb;
 916         struct ldb_request *mod_req;
 917         char *value;
 918         struct ldb_message_element *oc_el_entry, *oc_el_change;
 919         struct ldb_val *vals;
 920         struct ldb_message *msg;
 921         TALLOC_CTX *mem_ctx;
 922         struct class_list *sorted, *current;
 923         const struct dsdb_class *objectclass;
 924         unsigned int i, j, k;
 925         bool found, replace = false;
 926         int ret;
 927
 928         ldb = ldb_module_get_ctx(ac->module);
 929
 930         /* we should always have a valid entry when we enter here */
 931         if (ac->search_res == NULL) {
 932                 return ldb_operr(ldb);
 933         }
 934
 935         oc_el_entry = ldb_msg_find_element(ac->search_res->message,
 936                                            "objectClass");
 937         if (oc_el_entry == NULL) {
 938                 /* existing entry without a valid object class? */
 939                 return ldb_operr(ldb);
 940         }
 941
 942         /* use a new message structure */
 943         msg = ldb_msg_new(ac);
 944         if (msg == NULL) {
 945                 return ldb_oom(ldb);
 946         }
 947
 948         msg->dn = ac->req->op.mod.message->dn;
 949
 950         mem_ctx = talloc_new(ac);
 951         if (mem_ctx == NULL) {
 952                 return ldb_oom(ldb);
 953         }
 954
 955         /* We've to walk over all "objectClass" message elements */
 956         for (k = 0; k < ac->req->op.mod.message->num_elements; k++) {
 957                 if (ldb_attr_cmp(ac->req->op.mod.message->elements[k].name,
 958                                  "objectClass") != 0) {
 959                         continue;
 960                 }
 961
 962                 oc_el_change = &ac->req->op.mod.message->elements[k];
 963
 964                 switch (oc_el_change->flags & LDB_FLAG_MOD_MASK) {
 965                 case LDB_FLAG_MOD_ADD:
 966                         /* Merge the two message elements */
 967                         for (i = 0; i < oc_el_change->num_values; i++) {
 968                                 for (j = 0; j < oc_el_entry->num_values; j++) {
 969                                         if (ldb_attr_cmp((char *)oc_el_change->values[i].data,
 970                                                          (char *)oc_el_entry->values[j].data) == 0) {
 971                                                 ldb_asprintf_errstring(ldb,
 972                                                                        "objectclass: cannot re-add an existing objectclass: '%.*s'!",
 973                                                                        (int)oc_el_change->values[i].length,
 974                                                                        (const char *)oc_el_change->values[i].data);
 975                                                 talloc_free(mem_ctx);
 976                                                 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
 977                                         }
 978                                 }
 979                                 /* append the new object class value - code was
 980                                  * copied from "ldb_msg_add_value" */
 981                                 vals = talloc_realloc(oc_el_entry, oc_el_entry->values,
 982                                                       struct ldb_val,
 983                                                       oc_el_entry->num_values + 1);
 984                                 if (vals == NULL) {
 985                                         talloc_free(mem_ctx);
 986                                         return ldb_oom(ldb);
 987                                 }
 988                                 oc_el_entry->values = vals;
 989                                 oc_el_entry->values[oc_el_entry->num_values] =
 990                                                         oc_el_change->values[i];
 991                                 ++(oc_el_entry->num_values);
 992                         }
 993
 994                         objectclass = get_last_structural_class(ac->schema,
 995                                                                 oc_el_change);
 996                         if (objectclass != NULL) {
 997                                 ldb_asprintf_errstring(ldb,
 998                                                        "objectclass: cannot add a new top-most structural objectclass '%s'!",
 999                                                        objectclass->lDAPDisplayName);
1000                                 talloc_free(mem_ctx);
1001                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1002                         }
1003
1004                         /* Now do the sorting */
1005                         ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1006                                                oc_el_entry, &sorted);
1007                         if (ret != LDB_SUCCESS) {
1008                                 talloc_free(mem_ctx);
1009                                 return ret;
1010                         }
1011
1012                         break;
1013
1014                 case LDB_FLAG_MOD_REPLACE:
1015                         /* Do the sorting for the change message element */
1016                         ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1017                                                oc_el_change, &sorted);
1018                         if (ret != LDB_SUCCESS) {
1019                                 talloc_free(mem_ctx);
1020                                 return ret;
1021                         }
1022
1023                         /* this is a replace */
1024                         replace = true;
1025
1026                         break;
1027
1028                 case LDB_FLAG_MOD_DELETE:
1029                         /* get the actual top-most structural objectclass */
1030                         objectclass = get_last_structural_class(ac->schema,
1031                                                                 oc_el_entry);
1032                         if (objectclass == NULL) {
1033                                 talloc_free(mem_ctx);
1034                                 return ldb_operr(ldb);
1035                         }
1036
1037                         /* Merge the two message elements */
1038                         for (i = 0; i < oc_el_change->num_values; i++) {
1039                                 found = false;
1040                                 for (j = 0; j < oc_el_entry->num_values; j++) {
1041                                         if (ldb_attr_cmp((char *)oc_el_change->values[i].data,
1042                                                          (char *)oc_el_entry->values[j].data) == 0) {
1043                                                 found = true;
1044                                                 /* delete the object class value
1045                                                  * - code was copied from
1046                                                  * "ldb_msg_remove_element" */
1047                                                 if (j != oc_el_entry->num_values - 1) {
1048                                                         memmove(&oc_el_entry->values[j],
1049                                                                 &oc_el_entry->values[j+1],
1050                                                                 ((oc_el_entry->num_values-1) - j)*sizeof(struct ldb_val));
1051                                                 }
1052                                                 --(oc_el_entry->num_values);
1053                                                 break;
1054                                         }
1055                                 }
1056                                 if (!found) {
1057                                         /* we cannot delete a not existing
1058                                          * object class */
1059                                         ldb_asprintf_errstring(ldb,
1060                                                                "objectclass: cannot delete this objectclass: '%.*s'!",
1061                                                                (int)oc_el_change->values[i].length,
1062                                                                (const char *)oc_el_change->values[i].data);
1063                                         talloc_free(mem_ctx);
1064                                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
1065                                 }
1066                         }
1067
1068                         /* Make sure that the top-most structural object class
1069                          * hasn't been deleted */
1070                         found = false;
1071                         for (i = 0; i < oc_el_entry->num_values; i++) {
1072                                 if (ldb_attr_cmp(objectclass->lDAPDisplayName,
1073                                                  (char *)oc_el_entry->values[i].data) == 0) {
1074                                         found = true;
1075                                         break;
1076                                 }
1077                         }
1078                         if (!found) {
1079                                 ldb_asprintf_errstring(ldb,
1080                                                        "objectclass: cannot delete the top-most structural objectclass '%s'!",
1081                                                        objectclass->lDAPDisplayName);
1082                                 talloc_free(mem_ctx);
1083                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1084                         }
1085
1086                         /* Now do the sorting */
1087                         ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1088                                                oc_el_entry, &sorted);
1089                         if (ret != LDB_SUCCESS) {
1090                                 talloc_free(mem_ctx);
1091                                 return ret;
1092                         }
1093
1094                         break;
1095                 }
1096
1097                 /* (Re)-add an empty "objectClass" attribute on the object
1098                  * classes change message "msg". */
1099                 ldb_msg_remove_attr(msg, "objectClass");
1100                 ret = ldb_msg_add_empty(msg, "objectClass",
1101                                         LDB_FLAG_MOD_REPLACE, &oc_el_change);
1102                 if (ret != LDB_SUCCESS) {
1103                         talloc_free(mem_ctx);
1104                         return ldb_oom(ldb);
1105                 }
1106
1107                 /* Move from the linked list back into an ldb msg */
1108                 for (current = sorted; current; current = current->next) {
1109                         value = talloc_strdup(msg,
1110                                               current->objectclass->lDAPDisplayName);
1111                         if (value == NULL) {
1112                                 talloc_free(mem_ctx);
1113                                 return ldb_oom(ldb);
1114                         }
1115                         ret = ldb_msg_add_string(msg, "objectClass", value);
1116                         if (ret != LDB_SUCCESS) {
1117                                 ldb_set_errstring(ldb,
1118                                                   "objectclass: could not re-add sorted objectclasses!");
1119                                 talloc_free(mem_ctx);
1120                                 return ret;
1121                         }
1122                 }
1123
1124                 if (replace) {
1125                         /* Well, on replace we are nearly done: we have to test
1126                          * if the change and entry message element are identical
1127                          * ly. We can use "ldb_msg_element_compare" since now
1128                          * the specified objectclasses match for sure in case.
1129                          */
1130                         ret = ldb_msg_element_compare(oc_el_entry,
1131                                                       oc_el_change);
1132                         if (ret == 0) {
1133                                 ret = ldb_msg_element_compare(oc_el_change,
1134                                                               oc_el_entry);
1135                         }
1136                         if (ret == 0) {
1137                                 /* they are the same so we are done in this
1138                                  * case */
1139                                 talloc_free(mem_ctx);
1140                                 return ldb_module_done(ac->req, NULL, NULL,
1141                                                        LDB_SUCCESS);
1142                         } else {
1143                                 ldb_set_errstring(ldb,
1144                                                   "objectclass: the specified objectclasses are not exactly the same as on the entry!");
1145                                 talloc_free(mem_ctx);
1146                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1147                         }
1148                 }
1149
1150                 /* Now we've applied all changes from "oc_el_change" to
1151                  * "oc_el_entry" therefore the new "oc_el_entry" will be
1152                  * "oc_el_change". */
1153                 oc_el_entry = oc_el_change;
1154         }
1155
1156         talloc_free(mem_ctx);
1157
1158         /* Now we have the real and definitive change left to do */
1159
1160         ret = ldb_build_mod_req(&mod_req, ldb, ac,
1161                                 msg,
1162                                 ac->req->controls,
1163                                 ac, oc_op_callback,
1164                                 ac->req);
1165         LDB_REQ_SET_LOCATION(mod_req);
1166         if (ret != LDB_SUCCESS) {
1167                 return ret;
1168         }
1169
1170         return ldb_next_request(ac->module, mod_req);
1171 }
1172
1173 static int objectclass_do_rename(struct oc_context *ac);
1174
1175 static int objectclass_rename(struct ldb_module *module, struct ldb_request *req)
1176 {
1177         static const char * const attrs[] = { "objectClass", NULL };
1178         struct ldb_context *ldb;
1179         struct ldb_request *search_req;
1180         struct oc_context *ac;
1181         struct ldb_dn *parent_dn;
1182         int ret;
1183
1184         ldb = ldb_module_get_ctx(module);
1185
1186         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_rename\n");
1187
1188         /* do not manipulate our control entries */
1189         if (ldb_dn_is_special(req->op.rename.newdn)) {
1190                 return ldb_next_request(module, req);
1191         }
1192
1193         ac = oc_init_context(module, req);
1194         if (ac == NULL) {
1195                 return ldb_operr(ldb);
1196         }
1197
1198         parent_dn = ldb_dn_get_parent(ac, req->op.rename.newdn);
1199         if (parent_dn == NULL) {
1200                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, the parent DN does not exist!",
1201                                        ldb_dn_get_linearized(req->op.rename.olddn));
1202                 return LDB_ERR_NO_SUCH_OBJECT;
1203         }
1204
1205         /* this looks up the parent object for fetching some important
1206          * informations (objectclasses, DN normalisation...) */
1207         ret = ldb_build_search_req(&search_req, ldb,
1208                                    ac, parent_dn, LDB_SCOPE_BASE,
1209                                    "(objectClass=*)",
1210                                    attrs, NULL,
1211                                    ac, get_search_callback,
1212                                    req);
1213         LDB_REQ_SET_LOCATION(search_req);
1214         if (ret != LDB_SUCCESS) {
1215                 return ret;
1216         }
1217
1218         /* we have to add the show recycled control, as otherwise DRS
1219            deletes will be refused as we will think the target parent
1220            does not exist */
1221         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
1222                                       false, NULL);
1223
1224         if (ret != LDB_SUCCESS) {
1225                 return ret;
1226         }
1227
1228         ac->step_fn = objectclass_do_rename;
1229
1230         return ldb_next_request(ac->module, search_req);
1231 }
1232
1233 static int objectclass_do_rename2(struct oc_context *ac);
1234
1235 static int objectclass_do_rename(struct oc_context *ac)
1236 {
1237         static const char * const attrs[] = { "objectClass", NULL };
1238         struct ldb_context *ldb;
1239         struct ldb_request *search_req;
1240         int ret;
1241
1242         ldb = ldb_module_get_ctx(ac->module);
1243
1244         /* Check if we have a valid parent - this check is needed since
1245          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1246         if (ac->search_res == NULL) {
1247                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, parent does not exist!",
1248                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1249                 return LDB_ERR_OTHER;
1250         }
1251
1252         /* now assign "search_res2" to the parent entry to have "search_res"
1253          * free for another lookup */
1254         ac->search_res2 = ac->search_res;
1255         ac->search_res = NULL;
1256
1257         /* this looks up the real existing object for fetching some important
1258          * informations (objectclasses) */
1259         ret = ldb_build_search_req(&search_req, ldb,
1260                                    ac, ac->req->op.rename.olddn,
1261                                    LDB_SCOPE_BASE,
1262                                    "(objectClass=*)",
1263                                    attrs, NULL,
1264                                    ac, get_search_callback,
1265                                    ac->req);
1266         LDB_REQ_SET_LOCATION(search_req);
1267         if (ret != LDB_SUCCESS) {
1268                 return ret;
1269         }
1270
1271         ac->step_fn = objectclass_do_rename2;
1272
1273         return ldb_next_request(ac->module, search_req);
1274 }
1275
1276 static int objectclass_do_rename2(struct oc_context *ac)
1277 {
1278         struct ldb_context *ldb;
1279         struct ldb_request *rename_req;
1280         struct ldb_dn *fixed_dn;
1281         int ret;
1282
1283         ldb = ldb_module_get_ctx(ac->module);
1284
1285         /* Check if we have a valid entry - this check is needed since
1286          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1287         if (ac->search_res == NULL) {
1288                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, entry does not exist!",
1289                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1290                 return LDB_ERR_NO_SUCH_OBJECT;
1291         }
1292
1293         if (ac->schema != NULL) {
1294                 struct ldb_message_element *oc_el_entry, *oc_el_parent;
1295                 const struct dsdb_class *objectclass;
1296                 const char *rdn_name;
1297                 bool allowed_class = false;
1298                 unsigned int i, j;
1299                 bool found;
1300
1301                 oc_el_entry = ldb_msg_find_element(ac->search_res->message,
1302                                                    "objectClass");
1303                 if (oc_el_entry == NULL) {
1304                         /* existing entry without a valid object class? */
1305                         return ldb_operr(ldb);
1306                 }
1307                 objectclass = get_last_structural_class(ac->schema, oc_el_entry);
1308                 if (objectclass == NULL) {
1309                         /* existing entry without a valid object class? */
1310                         return ldb_operr(ldb);
1311                 }
1312
1313                 rdn_name = ldb_dn_get_rdn_name(ac->req->op.rename.newdn);
1314                 if (rdn_name == NULL) {
1315                         return ldb_operr(ldb);
1316                 }
1317                 found = false;
1318                 for (i = 0; (!found) && (i < oc_el_entry->num_values); i++) {
1319                         const struct dsdb_class *tmp_class =
1320                                 dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
1321                                                                       &oc_el_entry->values[i]);
1322
1323                         if (tmp_class == NULL) continue;
1324
1325                         if (ldb_attr_cmp(rdn_name, tmp_class->rDNAttID) == 0)
1326                                 found = true;
1327                 }
1328                 if (!found) {
1329                         ldb_asprintf_errstring(ldb,
1330                                                "objectclass: Invalid RDN '%s' for objectclass '%s'!",
1331                                                rdn_name, objectclass->lDAPDisplayName);
1332                         return LDB_ERR_UNWILLING_TO_PERFORM;
1333                 }
1334
1335                 oc_el_parent = ldb_msg_find_element(ac->search_res2->message,
1336                                                     "objectClass");
1337                 if (oc_el_parent == NULL) {
1338                         /* existing entry without a valid object class? */
1339                         return ldb_operr(ldb);
1340                 }
1341
1342                 for (i=0; allowed_class == false && i < oc_el_parent->num_values; i++) {
1343                         const struct dsdb_class *sclass;
1344
1345                         sclass = dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
1346                                                                        &oc_el_parent->values[i]);
1347                         if (!sclass) {
1348                                 /* We don't know this class?  what is going on? */
1349                                 continue;
1350                         }
1351                         for (j=0; sclass->systemPossibleInferiors && sclass->systemPossibleInferiors[j]; j++) {
1352                                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, sclass->systemPossibleInferiors[j]) == 0) {
1353                                         allowed_class = true;
1354                                         break;
1355                                 }
1356                         }
1357                 }
1358
1359                 if (!allowed_class) {
1360                         ldb_asprintf_errstring(ldb,
1361                                                "objectclass: structural objectClass %s is not a valid child class for %s",
1362                                                objectclass->lDAPDisplayName, ldb_dn_get_linearized(ac->search_res2->message->dn));
1363                         return LDB_ERR_NAMING_VIOLATION;
1364                 }
1365         }
1366
1367         /* Ensure we are not trying to rename it to be a child of itself */
1368         if ((ldb_dn_compare_base(ac->req->op.rename.olddn,
1369                                  ac->req->op.rename.newdn) == 0)  &&
1370             (ldb_dn_compare(ac->req->op.rename.olddn,
1371                             ac->req->op.rename.newdn) != 0)) {
1372                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s to be a child of itself",
1373                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1374                 return LDB_ERR_UNWILLING_TO_PERFORM;
1375         }
1376
1377         /* Fix up the DN to be in the standard form, taking
1378          * particular care to match the parent DN */
1379         ret = fix_dn(ldb, ac,
1380                      ac->req->op.rename.newdn,
1381                      ac->search_res2->message->dn,
1382                      &fixed_dn);
1383         if (ret != LDB_SUCCESS) {
1384                 ldb_asprintf_errstring(ldb, "objectclass: Could not munge DN %s into normal form",
1385                                        ldb_dn_get_linearized(ac->req->op.rename.newdn));
1386                 return ret;
1387
1388         }
1389
1390         ret = ldb_build_rename_req(&rename_req, ldb, ac,
1391                                    ac->req->op.rename.olddn, fixed_dn,
1392                                    ac->req->controls,
1393                                    ac, oc_op_callback,
1394                                    ac->req);
1395         LDB_REQ_SET_LOCATION(rename_req);
1396         if (ret != LDB_SUCCESS) {
1397                 return ret;
1398         }
1399
1400         /* perform the rename */
1401         return ldb_next_request(ac->module, rename_req);
1402 }
1403
1404 static int objectclass_do_delete(struct oc_context *ac);
1405
1406 static int objectclass_delete(struct ldb_module *module, struct ldb_request *req)
1407 {
1408         static const char * const attrs[] = { "nCName", "objectClass",
1409                                               "systemFlags",
1410                                               "isCriticalSystemObject", NULL };
1411         struct ldb_context *ldb;
1412         struct ldb_request *search_req;
1413         struct oc_context *ac;
1414         int ret;
1415
1416         ldb = ldb_module_get_ctx(module);
1417
1418         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_delete\n");
1419
1420         /* do not manipulate our control entries */
1421         if (ldb_dn_is_special(req->op.del.dn)) {
1422                 return ldb_next_request(module, req);
1423         }
1424
1425         /* Bypass the constraint checks when we do have the "RELAX" control
1426          * set. */
1427         if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID) != NULL) {
1428                 return ldb_next_request(module, req);
1429         }
1430
1431         ac = oc_init_context(module, req);
1432         if (ac == NULL) {
1433                 return ldb_operr(ldb);
1434         }
1435
1436         /* this looks up the entry object for fetching some important
1437          * informations (object classes, system flags...) */
1438         ret = ldb_build_search_req(&search_req, ldb,
1439                                    ac, req->op.del.dn, LDB_SCOPE_BASE,
1440                                    "(objectClass=*)",
1441                                    attrs, NULL,
1442                                    ac, get_search_callback,
1443                                    req);
1444         LDB_REQ_SET_LOCATION(search_req);
1445         if (ret != LDB_SUCCESS) {
1446                 return ret;
1447         }
1448
1449         ac->step_fn = objectclass_do_delete;
1450
1451         return ldb_next_request(ac->module, search_req);
1452 }
1453
1454 static int objectclass_do_delete(struct oc_context *ac)
1455 {
1456         struct ldb_context *ldb;
1457         struct ldb_dn *dn;
1458         int32_t systemFlags;
1459         bool isCriticalSystemObject;
1460         int ret;
1461
1462         ldb = ldb_module_get_ctx(ac->module);
1463
1464         /* Check if we have a valid entry - this check is needed since
1465          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1466         if (ac->search_res == NULL) {
1467                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, entry does not exist!",
1468                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1469                 return LDB_ERR_NO_SUCH_OBJECT;
1470         }
1471
1472         /* DC's ntDSDSA object */
1473         if (ldb_dn_compare(ac->req->op.del.dn, samdb_ntds_settings_dn(ldb)) == 0) {
1474                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's ntDSDSA object!",
1475                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1476                 return LDB_ERR_UNWILLING_TO_PERFORM;
1477         }
1478
1479         /* DC's rIDSet object */
1480         /* Perform this check only when it does exist - this is needed in order
1481          * to don't let existing provisions break. */
1482         ret = samdb_rid_set_dn(ldb, ac, &dn);
1483         if ((ret != LDB_SUCCESS) && (ret != LDB_ERR_NO_SUCH_OBJECT)) {
1484                 return ret;
1485         }
1486         if (ret == LDB_SUCCESS) {
1487                 if (ldb_dn_compare(ac->req->op.del.dn, dn) == 0) {
1488                         talloc_free(dn);
1489                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's rIDSet object!",
1490                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1491                         return LDB_ERR_UNWILLING_TO_PERFORM;
1492                 }
1493                 talloc_free(dn);
1494         }
1495
1496         /* crossRef objects regarding config, schema and default domain NCs */
1497         if (samdb_find_attribute(ldb, ac->search_res->message, "objectClass",
1498                                  "crossRef") != NULL) {
1499                 dn = ldb_msg_find_attr_as_dn(ldb, ac, ac->search_res->message,
1500                                              "nCName");
1501                 if ((ldb_dn_compare(dn, ldb_get_default_basedn(ldb)) == 0) ||
1502                     (ldb_dn_compare(dn, ldb_get_config_basedn(ldb)) == 0)) {
1503                         talloc_free(dn);
1504
1505                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's a crossRef object to the main or configuration partition!",
1506                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1507                         return LDB_ERR_NOT_ALLOWED_ON_NON_LEAF;
1508                 }
1509                 if (ldb_dn_compare(dn, ldb_get_schema_basedn(ldb)) == 0) {
1510                         talloc_free(dn);
1511
1512                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's a crossRef object to the schema partition!",
1513                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1514                         return LDB_ERR_UNWILLING_TO_PERFORM;
1515                 }
1516                 talloc_free(dn);
1517         }
1518
1519         /* systemFlags */
1520
1521         systemFlags = ldb_msg_find_attr_as_int(ac->search_res->message,
1522                                                "systemFlags", 0);
1523         if ((systemFlags & SYSTEM_FLAG_DISALLOW_DELETE) != 0) {
1524                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it isn't permitted!",
1525                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1526                 return LDB_ERR_UNWILLING_TO_PERFORM;
1527         }
1528
1529         /* isCriticalSystemObject - but this only applies on tree delete
1530          * operations - MS-ADTS 3.1.1.5.5.7.2 */
1531         if (ldb_request_get_control(ac->req, LDB_CONTROL_TREE_DELETE_OID) != NULL) {
1532                 isCriticalSystemObject = ldb_msg_find_attr_as_bool(ac->search_res->message,
1533                                                                    "isCriticalSystemObject", false);
1534                 if (isCriticalSystemObject) {
1535                         ldb_asprintf_errstring(ldb,
1536                                                "objectclass: Cannot tree-delete %s, it's a critical system object!",
1537                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1538                         return LDB_ERR_UNWILLING_TO_PERFORM;
1539                 }
1540         }
1541
1542         return ldb_next_request(ac->module, ac->req);
1543 }
1544
1545 static int objectclass_init(struct ldb_module *module)
1546 {
1547         struct ldb_context *ldb = ldb_module_get_ctx(module);
1548         int ret;
1549
1550         /* Init everything else */
1551         ret = ldb_next_init(module);
1552         if (ret != LDB_SUCCESS) {
1553                 return ret;
1554         }
1555
1556         /* Look for the opaque to indicate we might have to cut down the DN of defaultObjectCategory */
1557         ldb_module_set_private(module, ldb_get_opaque(ldb, DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME));
1558
1559         ret = ldb_mod_register_control(module, LDB_CONTROL_RODC_DCPROMO_OID);
1560         if (ret != LDB_SUCCESS) {
1561                 ldb_debug(ldb, LDB_DEBUG_ERROR,
1562                           "objectclass_init: Unable to register control DCPROMO with rootdse\n");
1563                 return ldb_operr(ldb);
1564         }
1565
1566         return ret;
1567 }
1568
1569 static const struct ldb_module_ops ldb_objectclass_module_ops = {
1570         .name           = "objectclass",
1571         .add            = objectclass_add,
1572         .modify         = objectclass_modify,
1573         .rename         = objectclass_rename,
1574         .del            = objectclass_delete,
1575         .init_context   = objectclass_init
1576 };
1577
1578 int ldb_objectclass_module_init(const char *version)
1579 {
1580         LDB_MODULE_CHECK_VERSION(version);
1581         return ldb_register_module(&ldb_objectclass_module_ops);
1582 }