source4/dsdb/samdb/ldb_modules/objectclass.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Simo Sorce  2006-2008
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
   6    Copyright (C) Matthias Dieter Wallnöfer 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23  *  Name: ldb
  24  *
  25  *  Component: objectClass sorting and constraint checking module
  26  *
  27  *  Description:
  28  *  - sort the objectClass attribute into the class
  29  *    hierarchy and perform constraint checks (correct RDN name,
  30  *    valid parent),
  31  *  - fix DNs into 'standard' case
  32  *  - Add objectCategory and some other attribute defaults
  33  *
  34  *  Author: Andrew Bartlett
  35  */
  36
  37
  38 #include "includes.h"
  39 #include "ldb_module.h"
  40 #include "util/dlinklist.h"
  41 #include "dsdb/samdb/samdb.h"
  42 #include "librpc/ndr/libndr.h"
  43 #include "librpc/gen_ndr/ndr_security.h"
  44 #include "libcli/security/security.h"
  45 #include "auth/auth.h"
  46 #include "param/param.h"
  47 #include "../libds/common/flags.h"
  48 #include "dsdb/samdb/ldb_modules/schema.h"
  49 #include "util.h"
  50
  51 struct oc_context {
  52
  53         struct ldb_module *module;
  54         struct ldb_request *req;
  55         const struct dsdb_schema *schema;
  56
  57         struct ldb_reply *search_res;
  58         struct ldb_reply *search_res2;
  59
  60         int (*step_fn)(struct oc_context *);
  61 };
  62
  63 struct class_list {
  64         struct class_list *prev, *next;
  65         const struct dsdb_class *objectclass;
  66 };
  67
  68 static struct oc_context *oc_init_context(struct ldb_module *module,
  69                                           struct ldb_request *req)
  70 {
  71         struct ldb_context *ldb;
  72         struct oc_context *ac;
  73
  74         ldb = ldb_module_get_ctx(module);
  75
  76         ac = talloc_zero(req, struct oc_context);
  77         if (ac == NULL) {
  78                 ldb_oom(ldb);
  79                 return NULL;
  80         }
  81
  82         ac->module = module;
  83         ac->req = req;
  84         ac->schema = dsdb_get_schema(ldb, ac);
  85
  86         return ac;
  87 }
  88
  89 static int objectclass_do_add(struct oc_context *ac);
  90
  91 /* Sort objectClasses into correct order, and validate that all
  92  * objectClasses specified actually exist in the schema
  93  */
  94
  95 static int objectclass_sort(struct ldb_module *module,
  96                             const struct dsdb_schema *schema,
  97                             TALLOC_CTX *mem_ctx,
  98                             struct ldb_message_element *objectclass_element,
  99                             struct class_list **sorted_out)
 100 {
 101         struct ldb_context *ldb;
 102         unsigned int i, lowest;
 103         struct class_list *unsorted = NULL, *sorted = NULL, *current = NULL, *poss_parent = NULL, *new_parent = NULL, *current_lowest = NULL;
 104
 105         ldb = ldb_module_get_ctx(module);
 106
 107         /* DESIGN:
 108          *
 109          * We work on 4 different 'bins' (implemented here as linked lists):
 110          *
 111          * * sorted:       the eventual list, in the order we wish to push
 112          *                 into the database.  This is the only ordered list.
 113          *
 114          * * parent_class: The current parent class 'bin' we are
 115          *                 trying to find subclasses for
 116          *
 117          * * subclass:     The subclasses we have found so far
 118          *
 119          * * unsorted:     The remaining objectClasses
 120          *
 121          * The process is a matter of filtering objectClasses up from
 122          * unsorted into sorted.  Order is irrelevent in the later 3 'bins'.
 123          *
 124          * We start with 'top' (found and promoted to parent_class
 125          * initially).  Then we find (in unsorted) all the direct
 126          * subclasses of 'top'.  parent_classes is concatenated onto
 127          * the end of 'sorted', and subclass becomes the list in
 128          * parent_class.
 129          *
 130          * We then repeat, until we find no more subclasses.  Any left
 131          * over classes are added to the end.
 132          *
 133          */
 134
 135         /* Firstly, dump all the objectClass elements into the
 136          * unsorted bin, except for 'top', which is special */
 137         for (i=0; i < objectclass_element->num_values; i++) {
 138                 current = talloc(mem_ctx, struct class_list);
 139                 if (!current) {
 140                         return ldb_oom(ldb);
 141                 }
 142                 current->objectclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &objectclass_element->values[i]);
 143                 if (!current->objectclass) {
 144                         ldb_asprintf_errstring(ldb, "objectclass %.*s is not a valid objectClass in schema",
 145                                                (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
 146                         /* This looks weird, but windows apparently returns this for invalid objectClass values */
 147                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 148                 } else if (current->objectclass->isDefunct) {
 149                         ldb_asprintf_errstring(ldb, "objectclass %.*s marked as isDefunct objectClass in schema - not valid for new objects",
 150                                                (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
 151                         /* This looks weird, but windows apparently returns this for invalid objectClass values */
 152                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 153                 }
 154
 155                 /* Don't add top to list, we will do that later */
 156                 if (ldb_attr_cmp("top", current->objectclass->lDAPDisplayName) != 0) {
 157                         DLIST_ADD_END(unsorted, current, struct class_list *);
 158                 }
 159         }
 160
 161         /* Add top here, to prevent duplicates */
 162         current = talloc(mem_ctx, struct class_list);
 163         current->objectclass = dsdb_class_by_lDAPDisplayName(schema, "top");
 164         DLIST_ADD_END(sorted, current, struct class_list *);
 165
 166
 167         /* For each object:  find parent chain */
 168         for (current = unsorted; schema && current; current = current->next) {
 169                 for (poss_parent = unsorted; poss_parent; poss_parent = poss_parent->next) {
 170                         if (ldb_attr_cmp(poss_parent->objectclass->lDAPDisplayName, current->objectclass->subClassOf) == 0) {
 171                                 break;
 172                         }
 173                 }
 174                 /* If we didn't get to the end of the list, we need to add this parent */
 175                 if (poss_parent || (ldb_attr_cmp("top", current->objectclass->subClassOf) == 0)) {
 176                         continue;
 177                 }
 178
 179                 new_parent = talloc(mem_ctx, struct class_list);
 180                 new_parent->objectclass = dsdb_class_by_lDAPDisplayName(schema, current->objectclass->subClassOf);
 181                 DLIST_ADD_END(unsorted, new_parent, struct class_list *);
 182         }
 183
 184         do
 185         {
 186                 lowest = UINT_MAX;
 187                 current_lowest = NULL;
 188                 for (current = unsorted; schema && current; current = current->next) {
 189                         if(current->objectclass->subClass_order < lowest) {
 190                                 current_lowest = current;
 191                                 lowest = current->objectclass->subClass_order;
 192                         }
 193                 }
 194
 195                 if(current_lowest != NULL) {
 196                         DLIST_REMOVE(unsorted,current_lowest);
 197                         DLIST_ADD_END(sorted,current_lowest, struct class_list *);
 198                 }
 199         } while(unsorted);
 200
 201
 202         if (!unsorted) {
 203                 *sorted_out = sorted;
 204                 return LDB_SUCCESS;
 205         }
 206
 207         if (!schema) {
 208                 /* If we don't have schema yet, then just merge the lists again */
 209                 DLIST_CONCATENATE(sorted, unsorted, struct class_list *);
 210                 *sorted_out = sorted;
 211                 return LDB_SUCCESS;
 212         }
 213
 214         /* This shouldn't happen, and would break MMC, perhaps there
 215          * was no 'top', a conflict in the objectClasses or some other
 216          * schema error?
 217          */
 218         ldb_asprintf_errstring(ldb, "objectclass %s is not a valid objectClass in objectClass chain", unsorted->objectclass->lDAPDisplayName);
 219         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 220 }
 221
 222 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
 223 {
 224         struct ldb_context *ldb;
 225         struct oc_context *ac;
 226         int ret;
 227
 228         ac = talloc_get_type(req->context, struct oc_context);
 229         ldb = ldb_module_get_ctx(ac->module);
 230
 231         if (!ares) {
 232                 return ldb_module_done(ac->req, NULL, NULL,
 233                                         LDB_ERR_OPERATIONS_ERROR);
 234         }
 235         if (ares->error != LDB_SUCCESS &&
 236             ares->error != LDB_ERR_NO_SUCH_OBJECT) {
 237                 return ldb_module_done(ac->req, ares->controls,
 238                                         ares->response, ares->error);
 239         }
 240
 241         ldb_reset_err_string(ldb);
 242
 243         switch (ares->type) {
 244         case LDB_REPLY_ENTRY:
 245                 if (ac->search_res != NULL) {
 246                         ldb_set_errstring(ldb, "Too many results");
 247                         talloc_free(ares);
 248                         return ldb_module_done(ac->req, NULL, NULL,
 249                                                 LDB_ERR_OPERATIONS_ERROR);
 250                 }
 251
 252                 ac->search_res = talloc_steal(ac, ares);
 253                 break;
 254
 255         case LDB_REPLY_REFERRAL:
 256                 /* ignore */
 257                 talloc_free(ares);
 258                 break;
 259
 260         case LDB_REPLY_DONE:
 261                 talloc_free(ares);
 262                 ret = ac->step_fn(ac);
 263                 if (ret != LDB_SUCCESS) {
 264                         return ldb_module_done(ac->req, NULL, NULL, ret);
 265                 }
 266                 break;
 267         }
 268
 269         return LDB_SUCCESS;
 270 }
 271
 272 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
 273 {
 274         struct oc_context *ac;
 275
 276         ac = talloc_get_type(req->context, struct oc_context);
 277
 278         if (!ares) {
 279                 return ldb_module_done(ac->req, NULL, NULL,
 280                                         LDB_ERR_OPERATIONS_ERROR);
 281         }
 282
 283         if (ares->type == LDB_REPLY_REFERRAL) {
 284                 return ldb_module_send_referral(ac->req, ares->referral);
 285         }
 286
 287         if (ares->error != LDB_SUCCESS) {
 288                 return ldb_module_done(ac->req, ares->controls,
 289                                         ares->response, ares->error);
 290         }
 291
 292         if (ares->type != LDB_REPLY_DONE) {
 293                 talloc_free(ares);
 294                 return ldb_module_done(ac->req, NULL, NULL,
 295                                         LDB_ERR_OPERATIONS_ERROR);
 296         }
 297
 298         return ldb_module_done(ac->req, ares->controls,
 299                                 ares->response, ares->error);
 300 }
 301
 302 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN
 303
 304    This should mean that if the parent is:
 305     CN=Users,DC=samba,DC=example,DC=com
 306    and a proposed child is
 307     cn=Admins ,cn=USERS,dc=Samba,dc=example,dc=COM
 308
 309    The resulting DN should be:
 310
 311     CN=Admins,CN=Users,DC=samba,DC=example,DC=com
 312
 313  */
 314 static int fix_dn(struct ldb_context *ldb,
 315                   TALLOC_CTX *mem_ctx,
 316                   struct ldb_dn *newdn, struct ldb_dn *parent_dn,
 317                   struct ldb_dn **fixed_dn)
 318 {
 319         char *upper_rdn_attr;
 320         const struct ldb_val *rdn_val;
 321
 322         /* Fix up the DN to be in the standard form, taking particular care to
 323          * match the parent DN */
 324         *fixed_dn = ldb_dn_copy(mem_ctx, parent_dn);
 325         if (*fixed_dn == NULL) {
 326                 return ldb_oom(ldb);
 327         }
 328
 329         /* We need the attribute name in upper case */
 330         upper_rdn_attr = strupper_talloc(*fixed_dn,
 331                                          ldb_dn_get_rdn_name(newdn));
 332         if (upper_rdn_attr == NULL) {
 333                 return ldb_oom(ldb);
 334         }
 335
 336         /* Create a new child */
 337         if (ldb_dn_add_child_fmt(*fixed_dn, "X=X") == false) {
 338                 return ldb_operr(ldb);
 339         }
 340
 341         rdn_val = ldb_dn_get_rdn_val(newdn);
 342         if (rdn_val == NULL) {
 343                 return ldb_operr(ldb);
 344         }
 345
 346 #if 0
 347         /* the rules for rDN length constraints are more complex than
 348         this. Until we understand them we need to leave this
 349         constraint out. Otherwise we break replication, as windows
 350         does sometimes send us rDNs longer than 64 */
 351         if (!rdn_val || rdn_val->length > 64) {
 352                 DEBUG(2,(__location__ ": WARNING: rDN longer than 64 limit for '%s'\n", ldb_dn_get_linearized(newdn)));
 353         }
 354 #endif
 355
 356
 357         /* And replace it with CN=foo (we need the attribute in upper case */
 358         return ldb_dn_set_component(*fixed_dn, 0, upper_rdn_attr, *rdn_val);
 359 }
 360
 361
 362 static int objectclass_do_add(struct oc_context *ac);
 363
 364 static int objectclass_add(struct ldb_module *module, struct ldb_request *req)
 365 {
 366         struct ldb_context *ldb;
 367         struct ldb_request *search_req;
 368         struct oc_context *ac;
 369         struct ldb_dn *parent_dn;
 370         const struct ldb_val *val;
 371         int ret;
 372         static const char * const parent_attrs[] = { "objectClass", NULL };
 373
 374         ldb = ldb_module_get_ctx(module);
 375
 376         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_add\n");
 377
 378         /* do not manipulate our control entries */
 379         if (ldb_dn_is_special(req->op.add.message->dn)) {
 380                 return ldb_next_request(module, req);
 381         }
 382
 383         /* An add operation on the basedn without "NC-add" operation isn't
 384          * allowed. */
 385         if (ldb_dn_compare(ldb_get_default_basedn(ldb), req->op.add.message->dn) == 0) {
 386                 unsigned int instanceType;
 387
 388                 instanceType = ldb_msg_find_attr_as_uint(req->op.add.message,
 389                                                          "instanceType", 0);
 390                 if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
 391                         char *referral_uri;
 392                         /* When we are trying to readd the root basedn then
 393                          * this is denied, but with an interesting mechanism:
 394                          * there is generated a referral with the last
 395                          * component value as hostname. */
 396                         val = ldb_dn_get_component_val(req->op.add.message->dn,
 397                                                        ldb_dn_get_comp_num(req->op.add.message->dn) - 1);
 398                         if (val == NULL) {
 399                                 return ldb_operr(ldb);
 400                         }
 401                         referral_uri = talloc_asprintf(req, "ldap://%s/%s", val->data,
 402                                                        ldb_dn_get_linearized(req->op.add.message->dn));
 403                         if (referral_uri == NULL) {
 404                                 return ldb_module_oom(module);
 405                         }
 406
 407                         return ldb_module_send_referral(req, referral_uri);
 408                 }
 409         }
 410
 411         ac = oc_init_context(module, req);
 412         if (ac == NULL) {
 413                 return ldb_operr(ldb);
 414         }
 415
 416         /* If there isn't a parent, just go on to the add processing */
 417         if (ldb_dn_get_comp_num(ac->req->op.add.message->dn) == 1) {
 418                 return objectclass_do_add(ac);
 419         }
 420
 421         /* get copy of parent DN */
 422         parent_dn = ldb_dn_get_parent(ac, ac->req->op.add.message->dn);
 423         if (parent_dn == NULL) {
 424                 return ldb_operr(ldb);
 425         }
 426
 427         ret = ldb_build_search_req(&search_req, ldb,
 428                                    ac, parent_dn, LDB_SCOPE_BASE,
 429                                    "(objectClass=*)", parent_attrs,
 430                                    NULL,
 431                                    ac, get_search_callback,
 432                                    req);
 433         LDB_REQ_SET_LOCATION(search_req);
 434         if (ret != LDB_SUCCESS) {
 435                 return ret;
 436         }
 437
 438         ac->step_fn = objectclass_do_add;
 439
 440         return ldb_next_request(ac->module, search_req);
 441 }
 442
 443
 444 /*
 445   check if this is a special RODC nTDSDSA add
 446  */
 447 static bool check_rodc_ntdsdsa_add(struct oc_context *ac,
 448                                    const struct dsdb_class *objectclass)
 449 {
 450         struct ldb_control *rodc_control;
 451
 452         if (strcasecmp(objectclass->lDAPDisplayName, "nTDSDSA") != 0) {
 453                 return false;
 454         }
 455         rodc_control = ldb_request_get_control(ac->req, LDB_CONTROL_RODC_DCPROMO_OID);
 456         if (!rodc_control) {
 457                 return false;
 458         }
 459
 460         rodc_control->critical = false;
 461         return true;
 462 }
 463
 464 static int objectclass_do_add(struct oc_context *ac)
 465 {
 466         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 467         struct ldb_request *add_req;
 468         struct ldb_message_element *objectclass_element, *el;
 469         struct ldb_message *msg;
 470         TALLOC_CTX *mem_ctx;
 471         struct class_list *sorted, *current;
 472         const char *rdn_name = NULL;
 473         char *value;
 474         const struct dsdb_class *objectclass;
 475         struct ldb_dn *objectcategory;
 476         int32_t systemFlags = 0;
 477         unsigned int i, j;
 478         bool found;
 479         int ret;
 480
 481         msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
 482         if (msg == NULL) {
 483                 return ldb_module_oom(ac->module);
 484         }
 485
 486         /* Check if we have a valid parent - this check is needed since
 487          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
 488         if (ac->search_res == NULL) {
 489                 unsigned int instanceType;
 490
 491                 /* An add operation on partition DNs without "NC-add" operation
 492                  * isn't allowed. */
 493                 instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType",
 494                                                          0);
 495                 if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
 496                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, parent does not exist!",
 497                                                ldb_dn_get_linearized(msg->dn));
 498                         return LDB_ERR_NO_SUCH_OBJECT;
 499                 }
 500
 501                 /* Don't keep any error messages - we've to add a partition */
 502                 ldb_set_errstring(ldb, NULL);
 503         } else {
 504                 /* Fix up the DN to be in the standard form, taking
 505                  * particular care to match the parent DN */
 506                 ret = fix_dn(ldb, msg,
 507                              ac->req->op.add.message->dn,
 508                              ac->search_res->message->dn,
 509                              &msg->dn);
 510                 if (ret != LDB_SUCCESS) {
 511                         ldb_asprintf_errstring(ldb, "objectclass: Could not munge DN %s into normal form",
 512                                                ldb_dn_get_linearized(ac->req->op.add.message->dn));
 513                         return ret;
 514                 }
 515         }
 516
 517         if (ac->schema != NULL) {
 518                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 519                 if (!objectclass_element) {
 520                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, no objectclass specified!",
 521                                                ldb_dn_get_linearized(msg->dn));
 522                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 523                 }
 524                 if (objectclass_element->num_values == 0) {
 525                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, at least one (structural) objectclass has to be specified!",
 526                                                ldb_dn_get_linearized(msg->dn));
 527                         return LDB_ERR_CONSTRAINT_VIOLATION;
 528                 }
 529
 530                 mem_ctx = talloc_new(ac);
 531                 if (mem_ctx == NULL) {
 532                         return ldb_module_oom(ac->module);
 533                 }
 534
 535                 /* Here we do now get the "objectClass" list from the
 536                  * database. */
 537                 ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
 538                                        objectclass_element, &sorted);
 539                 if (ret != LDB_SUCCESS) {
 540                         talloc_free(mem_ctx);
 541                         return ret;
 542                 }
 543
 544                 ldb_msg_remove_element(msg, objectclass_element);
 545
 546                 /* Well, now we shouldn't find any additional "objectClass"
 547                  * message element (required by the AD specification). */
 548                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 549                 if (objectclass_element != NULL) {
 550                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, only one 'objectclass' attribute specification is allowed!",
 551                                                ldb_dn_get_linearized(msg->dn));
 552                         talloc_free(mem_ctx);
 553                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 554                 }
 555
 556                 /* We must completely replace the existing objectClass entry,
 557                  * because we need it sorted. */
 558                 ret = ldb_msg_add_empty(msg, "objectClass", 0, NULL);
 559                 if (ret != LDB_SUCCESS) {
 560                         talloc_free(mem_ctx);
 561                         return ret;
 562                 }
 563
 564                 /* Move from the linked list back into an ldb msg */
 565                 for (current = sorted; current; current = current->next) {
 566                         const char *objectclass_name = current->objectclass->lDAPDisplayName;
 567
 568                         ret = ldb_msg_add_string(msg, "objectClass", objectclass_name);
 569                         if (ret != LDB_SUCCESS) {
 570                                 ldb_set_errstring(ldb,
 571                                                   "objectclass: could not re-add sorted "
 572                                                   "objectclass to modify msg");
 573                                 talloc_free(mem_ctx);
 574                                 return ret;
 575                         }
 576                 }
 577
 578                 talloc_free(mem_ctx);
 579
 580                 /* Retrive the message again so get_last_structural_class works */
 581                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 582
 583                 /* Make sure its valid to add an object of this type */
 584                 objectclass = get_last_structural_class(ac->schema,
 585                                                         objectclass_element, ac->req);
 586                 if(objectclass == NULL) {
 587                         ldb_asprintf_errstring(ldb,
 588                                                "Failed to find a structural class for %s",
 589                                                ldb_dn_get_linearized(msg->dn));
 590                         return LDB_ERR_UNWILLING_TO_PERFORM;
 591                 }
 592
 593                 rdn_name = ldb_dn_get_rdn_name(msg->dn);
 594                 if (rdn_name == NULL) {
 595                         return ldb_operr(ldb);
 596                 }
 597                 found = false;
 598                 for (i = 0; (!found) && (i < objectclass_element->num_values);
 599                      i++) {
 600                         const struct dsdb_class *tmp_class =
 601                                 dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
 602                                                                       &objectclass_element->values[i]);
 603
 604                         if (tmp_class == NULL) continue;
 605
 606                         if (ldb_attr_cmp(rdn_name, tmp_class->rDNAttID) == 0)
 607                                 found = true;
 608                 }
 609                 if (!found) {
 610                         ldb_asprintf_errstring(ldb,
 611                                                "objectclass: Invalid RDN '%s' for objectclass '%s'!",
 612                                                rdn_name, objectclass->lDAPDisplayName);
 613                         return LDB_ERR_NAMING_VIOLATION;
 614                 }
 615
 616                 if (objectclass->systemOnly &&
 617                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
 618                     !check_rodc_ntdsdsa_add(ac, objectclass)) {
 619                         ldb_asprintf_errstring(ldb,
 620                                                "objectclass: object class '%s' is system-only, rejecting creation of '%s'!",
 621                                                objectclass->lDAPDisplayName,
 622                                                ldb_dn_get_linearized(msg->dn));
 623                         return LDB_ERR_UNWILLING_TO_PERFORM;
 624                 }
 625
 626                 if (ac->search_res && ac->search_res->message) {
 627                         struct ldb_message_element *oc_el
 628                                 = ldb_msg_find_element(ac->search_res->message, "objectClass");
 629
 630                         bool allowed_class = false;
 631                         for (i=0; allowed_class == false && oc_el && i < oc_el->num_values; i++) {
 632                                 const struct dsdb_class *sclass;
 633
 634                                 sclass = dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
 635                                                                                &oc_el->values[i]);
 636                                 if (!sclass) {
 637                                         /* We don't know this class?  what is going on? */
 638                                         continue;
 639                                 }
 640                                 for (j=0; sclass->systemPossibleInferiors && sclass->systemPossibleInferiors[j]; j++) {
 641                                         if (ldb_attr_cmp(objectclass->lDAPDisplayName, sclass->systemPossibleInferiors[j]) == 0) {
 642                                                 allowed_class = true;
 643                                                 break;
 644                                         }
 645                                 }
 646                         }
 647
 648                         if (!allowed_class) {
 649                                 ldb_asprintf_errstring(ldb, "structural objectClass %s is not a valid child class for %s",
 650                                                 objectclass->lDAPDisplayName, ldb_dn_get_linearized(ac->search_res->message->dn));
 651                                 return LDB_ERR_NAMING_VIOLATION;
 652                         }
 653                 }
 654
 655                 objectcategory = ldb_msg_find_attr_as_dn(ldb, ac, msg,
 656                                                          "objectCategory");
 657                 if (objectcategory == NULL) {
 658                         struct dsdb_extended_dn_store_format *dn_format =
 659                                         talloc_get_type(ldb_module_get_private(ac->module),
 660                                                         struct dsdb_extended_dn_store_format);
 661                         if (dn_format && dn_format->store_extended_dn_in_ldb == false) {
 662                                 /* Strip off extended components */
 663                                 struct ldb_dn *dn = ldb_dn_new(ac, ldb,
 664                                                                objectclass->defaultObjectCategory);
 665                                 value = ldb_dn_alloc_linearized(msg, dn);
 666                                 talloc_free(dn);
 667                         } else {
 668                                 value = talloc_strdup(msg,
 669                                                       objectclass->defaultObjectCategory);
 670                         }
 671                         if (value == NULL) {
 672                                 return ldb_module_oom(ac->module);
 673                         }
 674
 675                         ret = ldb_msg_add_string(msg, "objectCategory", value);
 676                         if (ret != LDB_SUCCESS) {
 677                                 return ret;
 678                         }
 679                 } else {
 680                         const struct dsdb_class *ocClass =
 681                                         dsdb_class_by_cn_ldb_val(ac->schema,
 682                                                                  ldb_dn_get_rdn_val(objectcategory));
 683                         if (ocClass != NULL) {
 684                                 struct ldb_dn *dn = ldb_dn_new(ac, ldb,
 685                                                                ocClass->defaultObjectCategory);
 686                                 if (ldb_dn_compare(objectcategory, dn) != 0) {
 687                                         ocClass = NULL;
 688                                 }
 689                         }
 690                         talloc_free(objectcategory);
 691                         if (ocClass == NULL) {
 692                                 ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, 'objectCategory' attribute invalid!",
 693                                                        ldb_dn_get_linearized(msg->dn));
 694                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
 695                         }
 696                 }
 697
 698                 if (!ldb_msg_find_element(msg, "showInAdvancedViewOnly") && (objectclass->defaultHidingValue == true)) {
 699                         ldb_msg_add_string(msg, "showInAdvancedViewOnly",
 700                                                 "TRUE");
 701                 }
 702
 703                 /* There are very special rules for systemFlags, see MS-ADTS
 704                  * MS-ADTS 3.1.1.5.2.4 */
 705
 706                 el = ldb_msg_find_element(msg, "systemFlags");
 707                 if ((el != NULL) && (el->num_values > 1)) {
 708                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, 'systemFlags' attribute multivalued!",
 709                                                ldb_dn_get_linearized(msg->dn));
 710                         return LDB_ERR_CONSTRAINT_VIOLATION;
 711                 }
 712
 713                 systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
 714
 715                 ldb_msg_remove_attr(msg, "systemFlags");
 716
 717                 /* Only the following flags may be set by a client */
 718                 if (ldb_request_get_control(ac->req,
 719                                             LDB_CONTROL_RELAX_OID) == NULL) {
 720                         systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME
 721                                        | SYSTEM_FLAG_CONFIG_ALLOW_MOVE
 722                                        | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE
 723                                        | SYSTEM_FLAG_ATTR_IS_RDN );
 724                 }
 725
 726                 /* But the last one ("ATTR_IS_RDN") is only allowed on
 727                  * "attributeSchema" objects. So truncate if it does not fit. */
 728                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, "attributeSchema") != 0) {
 729                         systemFlags &= ~SYSTEM_FLAG_ATTR_IS_RDN;
 730                 }
 731
 732                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, "server") == 0) {
 733                         systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE | SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE);
 734                 } else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "site") == 0
 735                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "serversContainer") == 0
 736                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSDSA") == 0) {
 737                         systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
 738
 739                 } else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLink") == 0
 740                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLinkBridge") == 0
 741                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSConnection") == 0) {
 742                         systemFlags |= (int32_t)(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
 743                 }
 744
 745                 /* TODO: If parent object is site or subnet, also add (SYSTEM_FLAG_CONFIG_ALLOW_RENAME) */
 746
 747                 if (el || systemFlags != 0) {
 748                         ret = samdb_msg_add_int(ldb, msg, msg, "systemFlags",
 749                                                 systemFlags);
 750                         if (ret != LDB_SUCCESS) {
 751                                 return ret;
 752                         }
 753                 }
 754
 755                 /* make sure that "isCriticalSystemObject" is not specified! */
 756                 el = ldb_msg_find_element(msg, "isCriticalSystemObject");
 757                 if ((el != NULL) &&
 758                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
 759                         ldb_set_errstring(ldb,
 760                                           "objectclass: 'isCriticalSystemObject' must not be specified!");
 761                         return LDB_ERR_UNWILLING_TO_PERFORM;
 762                 }
 763         }
 764
 765         ret = ldb_msg_sanity_check(ldb, msg);
 766         if (ret != LDB_SUCCESS) {
 767                 return ret;
 768         }
 769
 770         ret = ldb_build_add_req(&add_req, ldb, ac,
 771                                 msg,
 772                                 ac->req->controls,
 773                                 ac, oc_op_callback,
 774                                 ac->req);
 775         LDB_REQ_SET_LOCATION(add_req);
 776         if (ret != LDB_SUCCESS) {
 777                 return ret;
 778         }
 779
 780         /* perform the add */
 781         return ldb_next_request(ac->module, add_req);
 782 }
 783
 784 static int oc_modify_callback(struct ldb_request *req,
 785                                 struct ldb_reply *ares);
 786 static int objectclass_do_mod(struct oc_context *ac);
 787
 788 static int objectclass_modify(struct ldb_module *module, struct ldb_request *req)
 789 {
 790         struct ldb_context *ldb = ldb_module_get_ctx(module);
 791         struct ldb_message_element *objectclass_element;
 792         struct ldb_message *msg;
 793         struct ldb_request *down_req;
 794         struct oc_context *ac;
 795         bool oc_changes = false;
 796         int ret;
 797
 798         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_modify\n");
 799
 800         /* do not manipulate our control entries */
 801         if (ldb_dn_is_special(req->op.mod.message->dn)) {
 802                 return ldb_next_request(module, req);
 803         }
 804
 805         /* As with the "real" AD we don't accept empty messages */
 806         if (req->op.mod.message->num_elements == 0) {
 807                 ldb_set_errstring(ldb, "objectclass: modify message must have "
 808                                        "elements/attributes!");
 809                 return LDB_ERR_UNWILLING_TO_PERFORM;
 810         }
 811
 812         ac = oc_init_context(module, req);
 813         if (ac == NULL) {
 814                 return ldb_operr(ldb);
 815         }
 816
 817         /* Without schema, there isn't much to do here */
 818         if (ac->schema == NULL) {
 819                 talloc_free(ac);
 820                 return ldb_next_request(module, req);
 821         }
 822
 823         msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
 824         if (msg == NULL) {
 825                 return ldb_module_oom(ac->module);
 826         }
 827
 828         /* For now change everything except the objectclasses */
 829
 830         objectclass_element = ldb_msg_find_element(msg, "objectClass");
 831         if (objectclass_element != NULL) {
 832                 ldb_msg_remove_attr(msg, "objectClass");
 833                 oc_changes = true;
 834         }
 835
 836         /* MS-ADTS 3.1.1.5.3.5 - on a forest level < 2003 we do allow updates
 837          * only on application NCs - not on the default ones */
 838         if (oc_changes &&
 839             (dsdb_forest_functional_level(ldb) < DS_DOMAIN_FUNCTION_2003)) {
 840                 struct ldb_dn *nc_root;
 841
 842                 ret = dsdb_find_nc_root(ldb, ac, req->op.mod.message->dn,
 843                                         &nc_root);
 844                 if (ret != LDB_SUCCESS) {
 845                         return ret;
 846                 }
 847
 848                 if ((ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) == 0) ||
 849                     (ldb_dn_compare(nc_root, ldb_get_config_basedn(ldb)) == 0) ||
 850                     (ldb_dn_compare(nc_root, ldb_get_schema_basedn(ldb)) == 0)) {
 851                         ldb_set_errstring(ldb,
 852                                           "objectclass: object class changes on objects under the standard name contexts not allowed!");
 853                         return LDB_ERR_UNWILLING_TO_PERFORM;
 854                 }
 855
 856                 talloc_free(nc_root);
 857         }
 858
 859         ret = ldb_build_mod_req(&down_req, ldb, ac,
 860                                 msg,
 861                                 req->controls, ac,
 862                                 oc_changes ? oc_modify_callback : oc_op_callback,
 863                                 req);
 864         LDB_REQ_SET_LOCATION(down_req);
 865         if (ret != LDB_SUCCESS) {
 866                 return ret;
 867         }
 868
 869         return ldb_next_request(module, down_req);
 870 }
 871
 872 static int oc_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
 873 {
 874         static const char * const attrs[] = { "objectClass", NULL };
 875         struct ldb_context *ldb;
 876         struct ldb_request *search_req;
 877         struct oc_context *ac;
 878         int ret;
 879
 880         ac = talloc_get_type(req->context, struct oc_context);
 881         ldb = ldb_module_get_ctx(ac->module);
 882
 883         if (!ares) {
 884                 return ldb_module_done(ac->req, NULL, NULL,
 885                                         LDB_ERR_OPERATIONS_ERROR);
 886         }
 887
 888         if (ares->type == LDB_REPLY_REFERRAL) {
 889                 return ldb_module_send_referral(ac->req, ares->referral);
 890         }
 891
 892         if (ares->error != LDB_SUCCESS) {
 893                 return ldb_module_done(ac->req, ares->controls,
 894                                         ares->response, ares->error);
 895         }
 896
 897         if (ares->type != LDB_REPLY_DONE) {
 898                 talloc_free(ares);
 899                 return ldb_module_done(ac->req, NULL, NULL,
 900                                         LDB_ERR_OPERATIONS_ERROR);
 901         }
 902
 903         talloc_free(ares);
 904
 905         /* this looks up the real existing object for fetching some important
 906          * information (objectclasses) */
 907         ret = ldb_build_search_req(&search_req, ldb,
 908                                    ac, ac->req->op.mod.message->dn,
 909                                    LDB_SCOPE_BASE,
 910                                    "(objectClass=*)",
 911                                    attrs, NULL,
 912                                    ac, get_search_callback,
 913                                    ac->req);
 914         LDB_REQ_SET_LOCATION(search_req);
 915         if (ret != LDB_SUCCESS) {
 916                 return ldb_module_done(ac->req, NULL, NULL, ret);
 917         }
 918
 919         ac->step_fn = objectclass_do_mod;
 920
 921         ret = ldb_next_request(ac->module, search_req);
 922         if (ret != LDB_SUCCESS) {
 923                 return ldb_module_done(ac->req, NULL, NULL, ret);
 924         }
 925
 926         return LDB_SUCCESS;
 927 }
 928
 929 static int objectclass_do_mod(struct oc_context *ac)
 930 {
 931         struct ldb_context *ldb;
 932         struct ldb_request *mod_req;
 933         char *value;
 934         struct ldb_message_element *oc_el_entry, *oc_el_change;
 935         struct ldb_val *vals;
 936         struct ldb_message *msg;
 937         TALLOC_CTX *mem_ctx;
 938         struct class_list *sorted, *current;
 939         const struct dsdb_class *objectclass;
 940         unsigned int i, j, k;
 941         bool found, replace = false;
 942         int ret;
 943
 944         ldb = ldb_module_get_ctx(ac->module);
 945
 946         /* we should always have a valid entry when we enter here */
 947         if (ac->search_res == NULL) {
 948                 return ldb_operr(ldb);
 949         }
 950
 951         oc_el_entry = ldb_msg_find_element(ac->search_res->message,
 952                                            "objectClass");
 953         if (oc_el_entry == NULL) {
 954                 /* existing entry without a valid object class? */
 955                 return ldb_operr(ldb);
 956         }
 957
 958         /* use a new message structure */
 959         msg = ldb_msg_new(ac);
 960         if (msg == NULL) {
 961                 return ldb_module_oom(ac->module);
 962         }
 963
 964         msg->dn = ac->req->op.mod.message->dn;
 965
 966         mem_ctx = talloc_new(ac);
 967         if (mem_ctx == NULL) {
 968                 return ldb_module_oom(ac->module);
 969         }
 970
 971         /* We've to walk over all "objectClass" message elements */
 972         for (k = 0; k < ac->req->op.mod.message->num_elements; k++) {
 973                 if (ldb_attr_cmp(ac->req->op.mod.message->elements[k].name,
 974                                  "objectClass") != 0) {
 975                         continue;
 976                 }
 977
 978                 oc_el_change = &ac->req->op.mod.message->elements[k];
 979
 980                 switch (oc_el_change->flags & LDB_FLAG_MOD_MASK) {
 981                 case LDB_FLAG_MOD_ADD:
 982                         /* Merge the two message elements */
 983                         for (i = 0; i < oc_el_change->num_values; i++) {
 984                                 for (j = 0; j < oc_el_entry->num_values; j++) {
 985                                         if (ldb_attr_cmp((char *)oc_el_change->values[i].data,
 986                                                          (char *)oc_el_entry->values[j].data) == 0) {
 987                                                 ldb_asprintf_errstring(ldb,
 988                                                                        "objectclass: cannot re-add an existing objectclass: '%.*s'!",
 989                                                                        (int)oc_el_change->values[i].length,
 990                                                                        (const char *)oc_el_change->values[i].data);
 991                                                 talloc_free(mem_ctx);
 992                                                 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
 993                                         }
 994                                 }
 995                                 /* append the new object class value - code was
 996                                  * copied from "ldb_msg_add_value" */
 997                                 vals = talloc_realloc(oc_el_entry, oc_el_entry->values,
 998                                                       struct ldb_val,
 999                                                       oc_el_entry->num_values + 1);
1000                                 if (vals == NULL) {
1001                                         talloc_free(mem_ctx);
1002                                         return ldb_module_oom(ac->module);
1003                                 }
1004                                 oc_el_entry->values = vals;
1005                                 oc_el_entry->values[oc_el_entry->num_values] =
1006                                                         oc_el_change->values[i];
1007                                 ++(oc_el_entry->num_values);
1008                         }
1009
1010                         objectclass = get_last_structural_class(ac->schema,
1011                                                                 oc_el_change, ac->req);
1012                         if (objectclass != NULL) {
1013                                 ldb_asprintf_errstring(ldb,
1014                                                        "objectclass: cannot add a new top-most structural objectclass '%s'!",
1015                                                        objectclass->lDAPDisplayName);
1016                                 talloc_free(mem_ctx);
1017                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1018                         }
1019
1020                         /* Now do the sorting */
1021                         ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1022                                                oc_el_entry, &sorted);
1023                         if (ret != LDB_SUCCESS) {
1024                                 talloc_free(mem_ctx);
1025                                 return ret;
1026                         }
1027
1028                         break;
1029
1030                 case LDB_FLAG_MOD_REPLACE:
1031                         /* Do the sorting for the change message element */
1032                         ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1033                                                oc_el_change, &sorted);
1034                         if (ret != LDB_SUCCESS) {
1035                                 talloc_free(mem_ctx);
1036                                 return ret;
1037                         }
1038
1039                         /* this is a replace */
1040                         replace = true;
1041
1042                         break;
1043
1044                 case LDB_FLAG_MOD_DELETE:
1045                         /* get the actual top-most structural objectclass */
1046                         objectclass = get_last_structural_class(ac->schema,
1047                                                                 oc_el_entry, ac->req);
1048                         if (objectclass == NULL) {
1049                                 /* no structural objectclass? */
1050                                 talloc_free(mem_ctx);
1051                                 return ldb_operr(ldb);
1052                         }
1053
1054                         /* Merge the two message elements */
1055                         for (i = 0; i < oc_el_change->num_values; i++) {
1056                                 found = false;
1057                                 for (j = 0; j < oc_el_entry->num_values; j++) {
1058                                         if (ldb_attr_cmp((char *)oc_el_change->values[i].data,
1059                                                          (char *)oc_el_entry->values[j].data) == 0) {
1060                                                 found = true;
1061                                                 /* delete the object class value
1062                                                  * - code was copied from
1063                                                  * "ldb_msg_remove_element" */
1064                                                 if (j != oc_el_entry->num_values - 1) {
1065                                                         memmove(&oc_el_entry->values[j],
1066                                                                 &oc_el_entry->values[j+1],
1067                                                                 ((oc_el_entry->num_values-1) - j)*sizeof(struct ldb_val));
1068                                                 }
1069                                                 --(oc_el_entry->num_values);
1070                                                 break;
1071                                         }
1072                                 }
1073                                 if (!found) {
1074                                         /* we cannot delete a not existing
1075                                          * object class */
1076                                         ldb_asprintf_errstring(ldb,
1077                                                                "objectclass: cannot delete this objectclass: '%.*s'!",
1078                                                                (int)oc_el_change->values[i].length,
1079                                                                (const char *)oc_el_change->values[i].data);
1080                                         talloc_free(mem_ctx);
1081                                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
1082                                 }
1083                         }
1084
1085                         /* Make sure that the top-most structural object class
1086                          * hasn't been deleted */
1087                         found = false;
1088                         for (i = 0; i < oc_el_entry->num_values; i++) {
1089                                 if (ldb_attr_cmp(objectclass->lDAPDisplayName,
1090                                                  (char *)oc_el_entry->values[i].data) == 0) {
1091                                         found = true;
1092                                         break;
1093                                 }
1094                         }
1095                         if (!found) {
1096                                 ldb_asprintf_errstring(ldb,
1097                                                        "objectclass: cannot delete the top-most structural objectclass '%s'!",
1098                                                        objectclass->lDAPDisplayName);
1099                                 talloc_free(mem_ctx);
1100                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1101                         }
1102
1103                         /* Now do the sorting */
1104                         ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1105                                                oc_el_entry, &sorted);
1106                         if (ret != LDB_SUCCESS) {
1107                                 talloc_free(mem_ctx);
1108                                 return ret;
1109                         }
1110
1111                         break;
1112                 }
1113
1114                 /* (Re)-add an empty "objectClass" attribute on the object
1115                  * classes change message "msg". */
1116                 ldb_msg_remove_attr(msg, "objectClass");
1117                 ret = ldb_msg_add_empty(msg, "objectClass",
1118                                         LDB_FLAG_MOD_REPLACE, &oc_el_change);
1119                 if (ret != LDB_SUCCESS) {
1120                         talloc_free(mem_ctx);
1121                         return ret;
1122                 }
1123
1124                 /* Move from the linked list back into an ldb msg */
1125                 for (current = sorted; current; current = current->next) {
1126                         value = talloc_strdup(msg,
1127                                               current->objectclass->lDAPDisplayName);
1128                         if (value == NULL) {
1129                                 talloc_free(mem_ctx);
1130                                 return ldb_module_oom(ac->module);
1131                         }
1132                         ret = ldb_msg_add_string(msg, "objectClass", value);
1133                         if (ret != LDB_SUCCESS) {
1134                                 ldb_set_errstring(ldb,
1135                                                   "objectclass: could not re-add sorted objectclasses!");
1136                                 talloc_free(mem_ctx);
1137                                 return ret;
1138                         }
1139                 }
1140
1141                 if (replace) {
1142                         /* Well, on replace we are nearly done: we have to test
1143                          * if the change and entry message element are identical
1144                          * ly. We can use "ldb_msg_element_compare" since now
1145                          * the specified objectclasses match for sure in case.
1146                          */
1147                         ret = ldb_msg_element_compare(oc_el_entry,
1148                                                       oc_el_change);
1149                         if (ret == 0) {
1150                                 ret = ldb_msg_element_compare(oc_el_change,
1151                                                               oc_el_entry);
1152                         }
1153                         if (ret == 0) {
1154                                 /* they are the same so we are done in this
1155                                  * case */
1156                                 talloc_free(mem_ctx);
1157                                 return ldb_module_done(ac->req, NULL, NULL,
1158                                                        LDB_SUCCESS);
1159                         } else {
1160                                 ldb_set_errstring(ldb,
1161                                                   "objectclass: the specified objectclasses are not exactly the same as on the entry!");
1162                                 talloc_free(mem_ctx);
1163                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1164                         }
1165                 }
1166
1167                 /* Now we've applied all changes from "oc_el_change" to
1168                  * "oc_el_entry" therefore the new "oc_el_entry" will be
1169                  * "oc_el_change". */
1170                 oc_el_entry = oc_el_change;
1171         }
1172
1173         talloc_free(mem_ctx);
1174
1175         /* Now we have the real and definitive change left to do */
1176
1177         ret = ldb_build_mod_req(&mod_req, ldb, ac,
1178                                 msg,
1179                                 ac->req->controls,
1180                                 ac, oc_op_callback,
1181                                 ac->req);
1182         LDB_REQ_SET_LOCATION(mod_req);
1183         if (ret != LDB_SUCCESS) {
1184                 return ret;
1185         }
1186
1187         return ldb_next_request(ac->module, mod_req);
1188 }
1189
1190 static int objectclass_do_rename(struct oc_context *ac);
1191
1192 static int objectclass_rename(struct ldb_module *module, struct ldb_request *req)
1193 {
1194         static const char * const attrs[] = { "objectClass", NULL };
1195         struct ldb_context *ldb;
1196         struct ldb_request *search_req;
1197         struct oc_context *ac;
1198         struct ldb_dn *parent_dn;
1199         int ret;
1200
1201         ldb = ldb_module_get_ctx(module);
1202
1203         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_rename\n");
1204
1205         /* do not manipulate our control entries */
1206         if (ldb_dn_is_special(req->op.rename.olddn)) {
1207                 return ldb_next_request(module, req);
1208         }
1209
1210         ac = oc_init_context(module, req);
1211         if (ac == NULL) {
1212                 return ldb_operr(ldb);
1213         }
1214
1215         parent_dn = ldb_dn_get_parent(ac, req->op.rename.newdn);
1216         if (parent_dn == NULL) {
1217                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, the parent DN does not exist!",
1218                                        ldb_dn_get_linearized(req->op.rename.olddn));
1219                 return LDB_ERR_NO_SUCH_OBJECT;
1220         }
1221
1222         /* this looks up the parent object for fetching some important
1223          * information (objectclasses, DN normalisation...) */
1224         ret = ldb_build_search_req(&search_req, ldb,
1225                                    ac, parent_dn, LDB_SCOPE_BASE,
1226                                    "(objectClass=*)",
1227                                    attrs, NULL,
1228                                    ac, get_search_callback,
1229                                    req);
1230         LDB_REQ_SET_LOCATION(search_req);
1231         if (ret != LDB_SUCCESS) {
1232                 return ret;
1233         }
1234
1235         /* we have to add the show recycled control, as otherwise DRS
1236            deletes will be refused as we will think the target parent
1237            does not exist */
1238         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
1239                                       false, NULL);
1240
1241         if (ret != LDB_SUCCESS) {
1242                 return ret;
1243         }
1244
1245         ac->step_fn = objectclass_do_rename;
1246
1247         return ldb_next_request(ac->module, search_req);
1248 }
1249
1250 static int objectclass_do_rename2(struct oc_context *ac);
1251
1252 static int objectclass_do_rename(struct oc_context *ac)
1253 {
1254         static const char * const attrs[] = { "objectClass", NULL };
1255         struct ldb_context *ldb;
1256         struct ldb_request *search_req;
1257         int ret;
1258
1259         ldb = ldb_module_get_ctx(ac->module);
1260
1261         /* Check if we have a valid parent - this check is needed since
1262          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1263         if (ac->search_res == NULL) {
1264                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, parent does not exist!",
1265                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1266                 return LDB_ERR_OTHER;
1267         }
1268
1269         /* now assign "search_res2" to the parent entry to have "search_res"
1270          * free for another lookup */
1271         ac->search_res2 = ac->search_res;
1272         ac->search_res = NULL;
1273
1274         /* this looks up the real existing object for fetching some important
1275          * information (objectclasses) */
1276         ret = ldb_build_search_req(&search_req, ldb,
1277                                    ac, ac->req->op.rename.olddn,
1278                                    LDB_SCOPE_BASE,
1279                                    "(objectClass=*)",
1280                                    attrs, NULL,
1281                                    ac, get_search_callback,
1282                                    ac->req);
1283         LDB_REQ_SET_LOCATION(search_req);
1284         if (ret != LDB_SUCCESS) {
1285                 return ret;
1286         }
1287
1288         ac->step_fn = objectclass_do_rename2;
1289
1290         return ldb_next_request(ac->module, search_req);
1291 }
1292
1293 static int objectclass_do_rename2(struct oc_context *ac)
1294 {
1295         struct ldb_context *ldb;
1296         struct ldb_request *rename_req;
1297         struct ldb_dn *fixed_dn;
1298         int ret;
1299
1300         ldb = ldb_module_get_ctx(ac->module);
1301
1302         /* Check if we have a valid entry - this check is needed since
1303          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1304         if (ac->search_res == NULL) {
1305                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, entry does not exist!",
1306                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1307                 return LDB_ERR_NO_SUCH_OBJECT;
1308         }
1309
1310         if (ac->schema != NULL) {
1311                 struct ldb_message_element *oc_el_entry, *oc_el_parent;
1312                 const struct dsdb_class *objectclass;
1313                 const char *rdn_name;
1314                 bool allowed_class = false;
1315                 unsigned int i, j;
1316                 bool found;
1317
1318                 oc_el_entry = ldb_msg_find_element(ac->search_res->message,
1319                                                    "objectClass");
1320                 if (oc_el_entry == NULL) {
1321                         /* existing entry without a valid object class? */
1322                         return ldb_operr(ldb);
1323                 }
1324                 objectclass = get_last_structural_class(ac->schema, oc_el_entry, ac->req);
1325                 if (objectclass == NULL) {
1326                         /* existing entry without a valid object class? */
1327                         return ldb_operr(ldb);
1328                 }
1329
1330                 rdn_name = ldb_dn_get_rdn_name(ac->req->op.rename.newdn);
1331                 if (rdn_name == NULL) {
1332                         return ldb_operr(ldb);
1333                 }
1334                 found = false;
1335                 for (i = 0; (!found) && (i < oc_el_entry->num_values); i++) {
1336                         const struct dsdb_class *tmp_class =
1337                                 dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
1338                                                                       &oc_el_entry->values[i]);
1339
1340                         if (tmp_class == NULL) continue;
1341
1342                         if (ldb_attr_cmp(rdn_name, tmp_class->rDNAttID) == 0)
1343                                 found = true;
1344                 }
1345                 if (!found) {
1346                         ldb_asprintf_errstring(ldb,
1347                                                "objectclass: Invalid RDN '%s' for objectclass '%s'!",
1348                                                rdn_name, objectclass->lDAPDisplayName);
1349                         return LDB_ERR_UNWILLING_TO_PERFORM;
1350                 }
1351
1352                 oc_el_parent = ldb_msg_find_element(ac->search_res2->message,
1353                                                     "objectClass");
1354                 if (oc_el_parent == NULL) {
1355                         /* existing entry without a valid object class? */
1356                         return ldb_operr(ldb);
1357                 }
1358
1359                 for (i=0; allowed_class == false && i < oc_el_parent->num_values; i++) {
1360                         const struct dsdb_class *sclass;
1361
1362                         sclass = dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
1363                                                                        &oc_el_parent->values[i]);
1364                         if (!sclass) {
1365                                 /* We don't know this class?  what is going on? */
1366                                 continue;
1367                         }
1368                         for (j=0; sclass->systemPossibleInferiors && sclass->systemPossibleInferiors[j]; j++) {
1369                                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, sclass->systemPossibleInferiors[j]) == 0) {
1370                                         allowed_class = true;
1371                                         break;
1372                                 }
1373                         }
1374                 }
1375
1376                 if (!allowed_class) {
1377                         ldb_asprintf_errstring(ldb,
1378                                                "objectclass: structural objectClass %s is not a valid child class for %s",
1379                                                objectclass->lDAPDisplayName, ldb_dn_get_linearized(ac->search_res2->message->dn));
1380                         return LDB_ERR_NAMING_VIOLATION;
1381                 }
1382         }
1383
1384         /* Ensure we are not trying to rename it to be a child of itself */
1385         if ((ldb_dn_compare_base(ac->req->op.rename.olddn,
1386                                  ac->req->op.rename.newdn) == 0)  &&
1387             (ldb_dn_compare(ac->req->op.rename.olddn,
1388                             ac->req->op.rename.newdn) != 0)) {
1389                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s to be a child of itself",
1390                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1391                 return LDB_ERR_UNWILLING_TO_PERFORM;
1392         }
1393
1394         /* Fix up the DN to be in the standard form, taking
1395          * particular care to match the parent DN */
1396         ret = fix_dn(ldb, ac,
1397                      ac->req->op.rename.newdn,
1398                      ac->search_res2->message->dn,
1399                      &fixed_dn);
1400         if (ret != LDB_SUCCESS) {
1401                 ldb_asprintf_errstring(ldb, "objectclass: Could not munge DN %s into normal form",
1402                                        ldb_dn_get_linearized(ac->req->op.rename.newdn));
1403                 return ret;
1404
1405         }
1406
1407         ret = ldb_build_rename_req(&rename_req, ldb, ac,
1408                                    ac->req->op.rename.olddn, fixed_dn,
1409                                    ac->req->controls,
1410                                    ac, oc_op_callback,
1411                                    ac->req);
1412         LDB_REQ_SET_LOCATION(rename_req);
1413         if (ret != LDB_SUCCESS) {
1414                 return ret;
1415         }
1416
1417         /* perform the rename */
1418         return ldb_next_request(ac->module, rename_req);
1419 }
1420
1421 static int objectclass_do_delete(struct oc_context *ac);
1422
1423 static int objectclass_delete(struct ldb_module *module, struct ldb_request *req)
1424 {
1425         static const char * const attrs[] = { "nCName", "objectClass",
1426                                               "systemFlags",
1427                                               "isCriticalSystemObject", NULL };
1428         struct ldb_context *ldb;
1429         struct ldb_request *search_req;
1430         struct oc_context *ac;
1431         int ret;
1432
1433         ldb = ldb_module_get_ctx(module);
1434
1435         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_delete\n");
1436
1437         /* do not manipulate our control entries */
1438         if (ldb_dn_is_special(req->op.del.dn)) {
1439                 return ldb_next_request(module, req);
1440         }
1441
1442         /* Bypass the constraint checks when we do have the "RELAX" control
1443          * set. */
1444         if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID) != NULL) {
1445                 return ldb_next_request(module, req);
1446         }
1447
1448         ac = oc_init_context(module, req);
1449         if (ac == NULL) {
1450                 return ldb_operr(ldb);
1451         }
1452
1453         /* this looks up the entry object for fetching some important
1454          * information (object classes, system flags...) */
1455         ret = ldb_build_search_req(&search_req, ldb,
1456                                    ac, req->op.del.dn, LDB_SCOPE_BASE,
1457                                    "(objectClass=*)",
1458                                    attrs, NULL,
1459                                    ac, get_search_callback,
1460                                    req);
1461         LDB_REQ_SET_LOCATION(search_req);
1462         if (ret != LDB_SUCCESS) {
1463                 return ret;
1464         }
1465
1466         ac->step_fn = objectclass_do_delete;
1467
1468         return ldb_next_request(ac->module, search_req);
1469 }
1470
1471 static int objectclass_do_delete(struct oc_context *ac)
1472 {
1473         struct ldb_context *ldb;
1474         struct ldb_dn *dn;
1475         int32_t systemFlags;
1476         bool isCriticalSystemObject;
1477         int ret;
1478
1479         ldb = ldb_module_get_ctx(ac->module);
1480
1481         /* Check if we have a valid entry - this check is needed since
1482          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1483         if (ac->search_res == NULL) {
1484                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, entry does not exist!",
1485                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1486                 return LDB_ERR_NO_SUCH_OBJECT;
1487         }
1488
1489         /* DC's ntDSDSA object */
1490         if (ldb_dn_compare(ac->req->op.del.dn, samdb_ntds_settings_dn(ldb)) == 0) {
1491                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's ntDSDSA object!",
1492                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1493                 return LDB_ERR_UNWILLING_TO_PERFORM;
1494         }
1495
1496         /* DC's rIDSet object */
1497         /* Perform this check only when it does exist - this is needed in order
1498          * to don't let existing provisions break. */
1499         ret = samdb_rid_set_dn(ldb, ac, &dn);
1500         if ((ret != LDB_SUCCESS) && (ret != LDB_ERR_NO_SUCH_OBJECT)) {
1501                 return ret;
1502         }
1503         if (ret == LDB_SUCCESS) {
1504                 if (ldb_dn_compare(ac->req->op.del.dn, dn) == 0) {
1505                         talloc_free(dn);
1506                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's rIDSet object!",
1507                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1508                         return LDB_ERR_UNWILLING_TO_PERFORM;
1509                 }
1510                 talloc_free(dn);
1511         }
1512
1513         /* crossRef objects regarding config, schema and default domain NCs */
1514         if (samdb_find_attribute(ldb, ac->search_res->message, "objectClass",
1515                                  "crossRef") != NULL) {
1516                 dn = ldb_msg_find_attr_as_dn(ldb, ac, ac->search_res->message,
1517                                              "nCName");
1518                 if ((ldb_dn_compare(dn, ldb_get_default_basedn(ldb)) == 0) ||
1519                     (ldb_dn_compare(dn, ldb_get_config_basedn(ldb)) == 0)) {
1520                         talloc_free(dn);
1521
1522                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's a crossRef object to the main or configuration partition!",
1523                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1524                         return LDB_ERR_NOT_ALLOWED_ON_NON_LEAF;
1525                 }
1526                 if (ldb_dn_compare(dn, ldb_get_schema_basedn(ldb)) == 0) {
1527                         talloc_free(dn);
1528
1529                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's a crossRef object to the schema partition!",
1530                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1531                         return LDB_ERR_UNWILLING_TO_PERFORM;
1532                 }
1533                 talloc_free(dn);
1534         }
1535
1536         /* systemFlags */
1537
1538         systemFlags = ldb_msg_find_attr_as_int(ac->search_res->message,
1539                                                "systemFlags", 0);
1540         if ((systemFlags & SYSTEM_FLAG_DISALLOW_DELETE) != 0) {
1541                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it isn't permitted!",
1542                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1543                 return LDB_ERR_UNWILLING_TO_PERFORM;
1544         }
1545
1546         /* isCriticalSystemObject - but this only applies on tree delete
1547          * operations - MS-ADTS 3.1.1.5.5.7.2 */
1548         if (ldb_request_get_control(ac->req, LDB_CONTROL_TREE_DELETE_OID) != NULL) {
1549                 isCriticalSystemObject = ldb_msg_find_attr_as_bool(ac->search_res->message,
1550                                                                    "isCriticalSystemObject", false);
1551                 if (isCriticalSystemObject) {
1552                         ldb_asprintf_errstring(ldb,
1553                                                "objectclass: Cannot tree-delete %s, it's a critical system object!",
1554                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1555                         return LDB_ERR_UNWILLING_TO_PERFORM;
1556                 }
1557         }
1558
1559         return ldb_next_request(ac->module, ac->req);
1560 }
1561
1562 static int objectclass_init(struct ldb_module *module)
1563 {
1564         struct ldb_context *ldb = ldb_module_get_ctx(module);
1565         int ret;
1566
1567         /* Init everything else */
1568         ret = ldb_next_init(module);
1569         if (ret != LDB_SUCCESS) {
1570                 return ret;
1571         }
1572
1573         /* Look for the opaque to indicate we might have to cut down the DN of defaultObjectCategory */
1574         ldb_module_set_private(module, ldb_get_opaque(ldb, DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME));
1575
1576         ret = ldb_mod_register_control(module, LDB_CONTROL_RODC_DCPROMO_OID);
1577         if (ret != LDB_SUCCESS) {
1578                 ldb_debug(ldb, LDB_DEBUG_ERROR,
1579                           "objectclass_init: Unable to register control DCPROMO with rootdse\n");
1580                 return ldb_operr(ldb);
1581         }
1582
1583         return ret;
1584 }
1585
1586 static const struct ldb_module_ops ldb_objectclass_module_ops = {
1587         .name           = "objectclass",
1588         .add            = objectclass_add,
1589         .modify         = objectclass_modify,
1590         .rename         = objectclass_rename,
1591         .del            = objectclass_delete,
1592         .init_context   = objectclass_init
1593 };
1594
1595 int ldb_objectclass_module_init(const char *version)
1596 {
1597         LDB_MODULE_CHECK_VERSION(version);
1598         return ldb_register_module(&ldb_objectclass_module_ops);
1599 }