source4/dsdb/samdb/ldb_modules/objectclass.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Simo Sorce  2006-2008
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
   6    Copyright (C) Matthias Dieter Wallnöfer 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23  *  Name: ldb
  24  *
  25  *  Component: objectClass sorting and constraint checking module
  26  *
  27  *  Description:
  28  *  - sort the objectClass attribute into the class
  29  *    hierarchy and perform constraint checks (correct RDN name,
  30  *    valid parent),
  31  *  - fix DNs into 'standard' case
  32  *  - Add objectCategory and some other attribute defaults
  33  *
  34  *  Author: Andrew Bartlett
  35  */
  36
  37
  38 #include "includes.h"
  39 #include "ldb_module.h"
  40 #include "util/dlinklist.h"
  41 #include "dsdb/samdb/samdb.h"
  42 #include "librpc/ndr/libndr.h"
  43 #include "librpc/gen_ndr/ndr_security.h"
  44 #include "libcli/security/security.h"
  45 #include "auth/auth.h"
  46 #include "param/param.h"
  47 #include "../libds/common/flags.h"
  48 #include "dsdb/samdb/ldb_modules/schema.h"
  49 #include "util.h"
  50
  51 struct oc_context {
  52
  53         struct ldb_module *module;
  54         struct ldb_request *req;
  55         const struct dsdb_schema *schema;
  56
  57         struct ldb_reply *search_res;
  58         struct ldb_reply *search_res2;
  59
  60         int (*step_fn)(struct oc_context *);
  61 };
  62
  63 struct class_list {
  64         struct class_list *prev, *next;
  65         const struct dsdb_class *objectclass;
  66 };
  67
  68 static struct oc_context *oc_init_context(struct ldb_module *module,
  69                                           struct ldb_request *req)
  70 {
  71         struct ldb_context *ldb;
  72         struct oc_context *ac;
  73
  74         ldb = ldb_module_get_ctx(module);
  75
  76         ac = talloc_zero(req, struct oc_context);
  77         if (ac == NULL) {
  78                 ldb_oom(ldb);
  79                 return NULL;
  80         }
  81
  82         ac->module = module;
  83         ac->req = req;
  84         ac->schema = dsdb_get_schema(ldb, ac);
  85
  86         return ac;
  87 }
  88
  89 static int objectclass_do_add(struct oc_context *ac);
  90
  91 /* Sort objectClasses into correct order, and validate that all
  92  * objectClasses specified actually exist in the schema
  93  */
  94
  95 static int objectclass_sort(struct ldb_module *module,
  96                             const struct dsdb_schema *schema,
  97                             TALLOC_CTX *mem_ctx,
  98                             struct ldb_message_element *objectclass_element,
  99                             struct class_list **sorted_out)
 100 {
 101         struct ldb_context *ldb;
 102         unsigned int i, lowest;
 103         struct class_list *unsorted = NULL, *sorted = NULL, *current = NULL, *poss_parent = NULL, *new_parent = NULL, *current_lowest = NULL;
 104
 105         ldb = ldb_module_get_ctx(module);
 106
 107         /* DESIGN:
 108          *
 109          * We work on 4 different 'bins' (implemented here as linked lists):
 110          *
 111          * * sorted:       the eventual list, in the order we wish to push
 112          *                 into the database.  This is the only ordered list.
 113          *
 114          * * parent_class: The current parent class 'bin' we are
 115          *                 trying to find subclasses for
 116          *
 117          * * subclass:     The subclasses we have found so far
 118          *
 119          * * unsorted:     The remaining objectClasses
 120          *
 121          * The process is a matter of filtering objectClasses up from
 122          * unsorted into sorted.  Order is irrelevent in the later 3 'bins'.
 123          *
 124          * We start with 'top' (found and promoted to parent_class
 125          * initially).  Then we find (in unsorted) all the direct
 126          * subclasses of 'top'.  parent_classes is concatenated onto
 127          * the end of 'sorted', and subclass becomes the list in
 128          * parent_class.
 129          *
 130          * We then repeat, until we find no more subclasses.  Any left
 131          * over classes are added to the end.
 132          *
 133          */
 134
 135         /* Firstly, dump all the objectClass elements into the
 136          * unsorted bin, except for 'top', which is special */
 137         for (i=0; i < objectclass_element->num_values; i++) {
 138                 current = talloc(mem_ctx, struct class_list);
 139                 if (!current) {
 140                         return ldb_oom(ldb);
 141                 }
 142                 current->objectclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &objectclass_element->values[i]);
 143                 if (!current->objectclass) {
 144                         ldb_asprintf_errstring(ldb, "objectclass %.*s is not a valid objectClass in schema",
 145                                                (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
 146                         /* This looks weird, but windows apparently returns this for invalid objectClass values */
 147                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 148                 } else if (current->objectclass->isDefunct) {
 149                         ldb_asprintf_errstring(ldb, "objectclass %.*s marked as isDefunct objectClass in schema - not valid for new objects",
 150                                                (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
 151                         /* This looks weird, but windows apparently returns this for invalid objectClass values */
 152                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 153                 }
 154
 155                 /* Don't add top to list, we will do that later */
 156                 if (ldb_attr_cmp("top", current->objectclass->lDAPDisplayName) != 0) {
 157                         DLIST_ADD_END(unsorted, current, struct class_list *);
 158                 }
 159         }
 160
 161         /* Add top here, to prevent duplicates */
 162         current = talloc(mem_ctx, struct class_list);
 163         current->objectclass = dsdb_class_by_lDAPDisplayName(schema, "top");
 164         DLIST_ADD_END(sorted, current, struct class_list *);
 165
 166
 167         /* For each object:  find parent chain */
 168         for (current = unsorted; schema && current; current = current->next) {
 169                 for (poss_parent = unsorted; poss_parent; poss_parent = poss_parent->next) {
 170                         if (ldb_attr_cmp(poss_parent->objectclass->lDAPDisplayName, current->objectclass->subClassOf) == 0) {
 171                                 break;
 172                         }
 173                 }
 174                 /* If we didn't get to the end of the list, we need to add this parent */
 175                 if (poss_parent || (ldb_attr_cmp("top", current->objectclass->subClassOf) == 0)) {
 176                         continue;
 177                 }
 178
 179                 new_parent = talloc(mem_ctx, struct class_list);
 180                 new_parent->objectclass = dsdb_class_by_lDAPDisplayName(schema, current->objectclass->subClassOf);
 181                 DLIST_ADD_END(unsorted, new_parent, struct class_list *);
 182         }
 183
 184         do
 185         {
 186                 lowest = UINT_MAX;
 187                 current_lowest = NULL;
 188                 for (current = unsorted; schema && current; current = current->next) {
 189                         if(current->objectclass->subClass_order < lowest) {
 190                                 current_lowest = current;
 191                                 lowest = current->objectclass->subClass_order;
 192                         }
 193                 }
 194
 195                 if(current_lowest != NULL) {
 196                         DLIST_REMOVE(unsorted,current_lowest);
 197                         DLIST_ADD_END(sorted,current_lowest, struct class_list *);
 198                 }
 199         } while(unsorted);
 200
 201
 202         if (!unsorted) {
 203                 *sorted_out = sorted;
 204                 return LDB_SUCCESS;
 205         }
 206
 207         if (!schema) {
 208                 /* If we don't have schema yet, then just merge the lists again */
 209                 DLIST_CONCATENATE(sorted, unsorted, struct class_list *);
 210                 *sorted_out = sorted;
 211                 return LDB_SUCCESS;
 212         }
 213
 214         /* This shouldn't happen, and would break MMC, perhaps there
 215          * was no 'top', a conflict in the objectClasses or some other
 216          * schema error?
 217          */
 218         ldb_asprintf_errstring(ldb, "objectclass %s is not a valid objectClass in objectClass chain", unsorted->objectclass->lDAPDisplayName);
 219         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 220 }
 221
 222 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
 223 {
 224         struct ldb_context *ldb;
 225         struct oc_context *ac;
 226         int ret;
 227
 228         ac = talloc_get_type(req->context, struct oc_context);
 229         ldb = ldb_module_get_ctx(ac->module);
 230
 231         if (!ares) {
 232                 return ldb_module_done(ac->req, NULL, NULL,
 233                                         LDB_ERR_OPERATIONS_ERROR);
 234         }
 235         if (ares->error != LDB_SUCCESS &&
 236             ares->error != LDB_ERR_NO_SUCH_OBJECT) {
 237                 return ldb_module_done(ac->req, ares->controls,
 238                                         ares->response, ares->error);
 239         }
 240
 241         ldb_reset_err_string(ldb);
 242
 243         switch (ares->type) {
 244         case LDB_REPLY_ENTRY:
 245                 if (ac->search_res != NULL) {
 246                         ldb_set_errstring(ldb, "Too many results");
 247                         talloc_free(ares);
 248                         return ldb_module_done(ac->req, NULL, NULL,
 249                                                 LDB_ERR_OPERATIONS_ERROR);
 250                 }
 251
 252                 ac->search_res = talloc_steal(ac, ares);
 253                 break;
 254
 255         case LDB_REPLY_REFERRAL:
 256                 /* ignore */
 257                 talloc_free(ares);
 258                 break;
 259
 260         case LDB_REPLY_DONE:
 261                 talloc_free(ares);
 262                 ret = ac->step_fn(ac);
 263                 if (ret != LDB_SUCCESS) {
 264                         return ldb_module_done(ac->req, NULL, NULL, ret);
 265                 }
 266                 break;
 267         }
 268
 269         return LDB_SUCCESS;
 270 }
 271
 272 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
 273 {
 274         struct oc_context *ac;
 275
 276         ac = talloc_get_type(req->context, struct oc_context);
 277
 278         if (!ares) {
 279                 return ldb_module_done(ac->req, NULL, NULL,
 280                                         LDB_ERR_OPERATIONS_ERROR);
 281         }
 282
 283         if (ares->type == LDB_REPLY_REFERRAL) {
 284                 return ldb_module_send_referral(ac->req, ares->referral);
 285         }
 286
 287         if (ares->error != LDB_SUCCESS) {
 288                 return ldb_module_done(ac->req, ares->controls,
 289                                         ares->response, ares->error);
 290         }
 291
 292         if (ares->type != LDB_REPLY_DONE) {
 293                 talloc_free(ares);
 294                 return ldb_module_done(ac->req, NULL, NULL,
 295                                         LDB_ERR_OPERATIONS_ERROR);
 296         }
 297
 298         return ldb_module_done(ac->req, ares->controls,
 299                                 ares->response, ares->error);
 300 }
 301
 302 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN
 303
 304    This should mean that if the parent is:
 305     CN=Users,DC=samba,DC=example,DC=com
 306    and a proposed child is
 307     cn=Admins ,cn=USERS,dc=Samba,dc=example,dc=COM
 308
 309    The resulting DN should be:
 310
 311     CN=Admins,CN=Users,DC=samba,DC=example,DC=com
 312
 313  */
 314 static int fix_dn(struct ldb_context *ldb,
 315                   TALLOC_CTX *mem_ctx,
 316                   struct ldb_dn *newdn, struct ldb_dn *parent_dn,
 317                   struct ldb_dn **fixed_dn)
 318 {
 319         char *upper_rdn_attr;
 320         const struct ldb_val *rdn_val;
 321
 322         /* Fix up the DN to be in the standard form, taking particular care to match the parent DN */
 323         *fixed_dn = ldb_dn_copy(mem_ctx, parent_dn);
 324
 325         /* We need the attribute name in upper case */
 326         upper_rdn_attr = strupper_talloc(*fixed_dn,
 327                                          ldb_dn_get_rdn_name(newdn));
 328         if (!upper_rdn_attr) {
 329                 return ldb_operr(ldb);
 330         }
 331
 332         /* Create a new child */
 333         if (ldb_dn_add_child_fmt(*fixed_dn, "X=X") == false) {
 334                 return ldb_operr(ldb);
 335         }
 336
 337         rdn_val = ldb_dn_get_rdn_val(newdn);
 338         if (rdn_val == NULL) {
 339                 return ldb_operr(ldb);
 340         }
 341
 342 #if 0
 343         /* the rules for rDN length constraints are more complex than
 344         this. Until we understand them we need to leave this
 345         constraint out. Otherwise we break replication, as windows
 346         does sometimes send us rDNs longer than 64 */
 347         if (!rdn_val || rdn_val->length > 64) {
 348                 DEBUG(2,(__location__ ": WARNING: rDN longer than 64 limit for '%s'\n", ldb_dn_get_linearized(newdn)));
 349         }
 350 #endif
 351
 352
 353         /* And replace it with CN=foo (we need the attribute in upper case */
 354         return ldb_dn_set_component(*fixed_dn, 0, upper_rdn_attr, *rdn_val);
 355 }
 356
 357
 358 static int objectclass_do_add(struct oc_context *ac);
 359
 360 static int objectclass_add(struct ldb_module *module, struct ldb_request *req)
 361 {
 362         struct ldb_context *ldb;
 363         struct ldb_request *search_req;
 364         struct oc_context *ac;
 365         struct ldb_dn *parent_dn;
 366         const struct ldb_val *val;
 367         char *value;
 368         int ret;
 369         static const char * const parent_attrs[] = { "objectClass", NULL };
 370
 371         ldb = ldb_module_get_ctx(module);
 372
 373         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_add\n");
 374
 375         /* do not manipulate our control entries */
 376         if (ldb_dn_is_special(req->op.add.message->dn)) {
 377                 return ldb_next_request(module, req);
 378         }
 379
 380         /* An add operation on the basedn without "NC-add" operation isn't
 381          * allowed. */
 382         if (ldb_dn_compare(ldb_get_default_basedn(ldb), req->op.add.message->dn) == 0) {
 383                 unsigned int instanceType;
 384
 385                 instanceType = ldb_msg_find_attr_as_uint(req->op.add.message,
 386                                                          "instanceType", 0);
 387                 if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
 388                         /* When we are trying to readd the root basedn then
 389                          * this is denied, but with an interesting mechanism:
 390                          * there is generated a referral with the last
 391                          * component value as hostname. */
 392                         val = ldb_dn_get_component_val(req->op.add.message->dn,
 393                                                        ldb_dn_get_comp_num(req->op.add.message->dn) - 1);
 394                         if (val == NULL) {
 395                                 return ldb_operr(ldb);
 396                         }
 397                         value = talloc_asprintf(req, "ldap://%s/%s", val->data,
 398                                                 ldb_dn_get_linearized(req->op.add.message->dn));
 399                         if (value == NULL) {
 400                                 return ldb_oom(ldb);
 401                         }
 402
 403                         return ldb_module_send_referral(req, value);
 404                 }
 405         }
 406
 407         ac = oc_init_context(module, req);
 408         if (ac == NULL) {
 409                 return ldb_operr(ldb);
 410         }
 411
 412         /* If there isn't a parent, just go on to the add processing */
 413         if (ldb_dn_get_comp_num(ac->req->op.add.message->dn) == 1) {
 414                 return objectclass_do_add(ac);
 415         }
 416
 417         /* get copy of parent DN */
 418         parent_dn = ldb_dn_get_parent(ac, ac->req->op.add.message->dn);
 419         if (parent_dn == NULL) {
 420                 return ldb_oom(ldb);
 421         }
 422
 423         ret = ldb_build_search_req(&search_req, ldb,
 424                                    ac, parent_dn, LDB_SCOPE_BASE,
 425                                    "(objectClass=*)", parent_attrs,
 426                                    NULL,
 427                                    ac, get_search_callback,
 428                                    req);
 429         LDB_REQ_SET_LOCATION(search_req);
 430         if (ret != LDB_SUCCESS) {
 431                 return ret;
 432         }
 433
 434         ac->step_fn = objectclass_do_add;
 435
 436         return ldb_next_request(ac->module, search_req);
 437 }
 438
 439
 440 /*
 441   check if this is a special RODC nTDSDSA add
 442  */
 443 static bool check_rodc_ntdsdsa_add(struct oc_context *ac,
 444                                    const struct dsdb_class *objectclass)
 445 {
 446         struct ldb_control *rodc_control;
 447
 448         if (strcasecmp(objectclass->lDAPDisplayName, "nTDSDSA") != 0) {
 449                 return false;
 450         }
 451         rodc_control = ldb_request_get_control(ac->req, LDB_CONTROL_RODC_DCPROMO_OID);
 452         if (!rodc_control) {
 453                 return false;
 454         }
 455
 456         rodc_control->critical = false;
 457         return true;
 458 }
 459
 460 static int objectclass_do_add(struct oc_context *ac)
 461 {
 462         struct ldb_context *ldb;
 463         struct ldb_request *add_req;
 464         struct ldb_message_element *objectclass_element, *el;
 465         struct ldb_message *msg;
 466         TALLOC_CTX *mem_ctx;
 467         struct class_list *sorted, *current;
 468         const char *rdn_name = NULL;
 469         char *value;
 470         const struct dsdb_class *objectclass;
 471         struct ldb_dn *objectcategory;
 472         int32_t systemFlags = 0;
 473         unsigned int i, j;
 474         bool found;
 475         int ret;
 476
 477         ldb = ldb_module_get_ctx(ac->module);
 478
 479         msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
 480
 481         /* Check if we have a valid parent - this check is needed since
 482          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
 483         if (ac->search_res == NULL) {
 484                 unsigned int instanceType;
 485
 486                 /* An add operation on partition DNs without "NC-add" operation
 487                  * isn't allowed. */
 488                 instanceType = ldb_msg_find_attr_as_uint(ac->req->op.add.message,
 489                                                          "instanceType", 0);
 490                 if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
 491                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, parent does not exist!",
 492                                                ldb_dn_get_linearized(msg->dn));
 493                         return LDB_ERR_NO_SUCH_OBJECT;
 494                 }
 495
 496                 /* Don't keep any error messages - we've to add a partition */
 497                 ldb_set_errstring(ldb, NULL);
 498         } else {
 499                 /* Fix up the DN to be in the standard form, taking
 500                  * particular care to match the parent DN */
 501                 ret = fix_dn(ldb, msg,
 502                              ac->req->op.add.message->dn,
 503                              ac->search_res->message->dn,
 504                              &msg->dn);
 505                 if (ret != LDB_SUCCESS) {
 506                         ldb_asprintf_errstring(ldb, "objectclass: Could not munge DN %s into normal form",
 507                                                ldb_dn_get_linearized(ac->req->op.add.message->dn));
 508                         return ret;
 509                 }
 510         }
 511
 512         mem_ctx = talloc_new(ac);
 513         if (mem_ctx == NULL) {
 514                 return ldb_oom(ldb);
 515         }
 516
 517         if (ac->schema != NULL) {
 518                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 519                 if (!objectclass_element) {
 520                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, no objectclass specified!",
 521                                                ldb_dn_get_linearized(msg->dn));
 522                         talloc_free(mem_ctx);
 523                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 524                 }
 525                 if (objectclass_element->num_values == 0) {
 526                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, at least one (structural) objectclass has to be specified!",
 527                                                ldb_dn_get_linearized(msg->dn));
 528                         talloc_free(mem_ctx);
 529                         return LDB_ERR_CONSTRAINT_VIOLATION;
 530                 }
 531
 532                 /* Here we do now get the "objectClass" list from the
 533                  * database. */
 534                 ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
 535                                        objectclass_element, &sorted);
 536                 if (ret != LDB_SUCCESS) {
 537                         talloc_free(mem_ctx);
 538                         return ret;
 539                 }
 540
 541                 ldb_msg_remove_element(msg, objectclass_element);
 542
 543                 /* Well, now we shouldn't find any additional "objectClass"
 544                  * message element (required by the AD specification). */
 545                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 546                 if (objectclass_element != NULL) {
 547                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, only one 'objectclass' attribute specification is allowed!",
 548                                                ldb_dn_get_linearized(msg->dn));
 549                         talloc_free(mem_ctx);
 550                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 551                 }
 552
 553                 /* We must completely replace the existing objectClass entry,
 554                  * because we need it sorted. */
 555                 ret = ldb_msg_add_empty(msg, "objectClass", 0, NULL);
 556                 if (ret != LDB_SUCCESS) {
 557                         talloc_free(mem_ctx);
 558                         return ret;
 559                 }
 560
 561                 /* Move from the linked list back into an ldb msg */
 562                 for (current = sorted; current; current = current->next) {
 563                         value = talloc_strdup(msg, current->objectclass->lDAPDisplayName);
 564                         if (value == NULL) {
 565                                 talloc_free(mem_ctx);
 566                                 return ldb_oom(ldb);
 567                         }
 568
 569                         ret = ldb_msg_add_string(msg, "objectClass", value);
 570                         if (ret != LDB_SUCCESS) {
 571                                 ldb_set_errstring(ldb,
 572                                                   "objectclass: could not re-add sorted "
 573                                                   "objectclass to modify msg");
 574                                 talloc_free(mem_ctx);
 575                                 return ret;
 576                         }
 577                 }
 578
 579                 talloc_free(mem_ctx);
 580
 581                 /* Retrive the message again so get_last_structural_class works */
 582                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
 583
 584                 /* Make sure its valid to add an object of this type */
 585                 objectclass = get_last_structural_class(ac->schema,
 586                                                         objectclass_element);
 587                 if(objectclass == NULL) {
 588                         ldb_asprintf_errstring(ldb,
 589                                                "Failed to find a structural class for %s",
 590                                                ldb_dn_get_linearized(msg->dn));
 591                         return LDB_ERR_UNWILLING_TO_PERFORM;
 592                 }
 593
 594                 rdn_name = ldb_dn_get_rdn_name(msg->dn);
 595                 if (rdn_name == NULL) {
 596                         return ldb_operr(ldb);
 597                 }
 598                 found = false;
 599                 for (i = 0; (!found) && (i < objectclass_element->num_values);
 600                      i++) {
 601                         const struct dsdb_class *tmp_class =
 602                                 dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
 603                                                                       &objectclass_element->values[i]);
 604
 605                         if (tmp_class == NULL) continue;
 606
 607                         if (ldb_attr_cmp(rdn_name, tmp_class->rDNAttID) == 0)
 608                                 found = true;
 609                 }
 610                 if (!found) {
 611                         ldb_asprintf_errstring(ldb,
 612                                                "objectclass: Invalid RDN '%s' for objectclass '%s'!",
 613                                                rdn_name, objectclass->lDAPDisplayName);
 614                         return LDB_ERR_NAMING_VIOLATION;
 615                 }
 616
 617                 if (objectclass->systemOnly &&
 618                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
 619                     !check_rodc_ntdsdsa_add(ac, objectclass)) {
 620                         ldb_asprintf_errstring(ldb, "objectClass %s is systemOnly, rejecting creation of %s",
 621                                                 objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn));
 622                         return LDB_ERR_UNWILLING_TO_PERFORM;
 623                 }
 624
 625                 if (((strcmp(objectclass->lDAPDisplayName, "secret") == 0) ||
 626                      (strcmp(objectclass->lDAPDisplayName, "trustedDomain") == 0)) &&
 627                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
 628                         ldb_asprintf_errstring(ldb, "objectClass %s is LSA-specific, rejecting creation of %s",
 629                                                 objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn));
 630                         return LDB_ERR_UNWILLING_TO_PERFORM;
 631                 }
 632
 633                 if (ac->search_res && ac->search_res->message) {
 634                         struct ldb_message_element *oc_el
 635                                 = ldb_msg_find_element(ac->search_res->message, "objectClass");
 636
 637                         bool allowed_class = false;
 638                         for (i=0; allowed_class == false && oc_el && i < oc_el->num_values; i++) {
 639                                 const struct dsdb_class *sclass;
 640
 641                                 sclass = dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
 642                                                                                &oc_el->values[i]);
 643                                 if (!sclass) {
 644                                         /* We don't know this class?  what is going on? */
 645                                         continue;
 646                                 }
 647                                 for (j=0; sclass->systemPossibleInferiors && sclass->systemPossibleInferiors[j]; j++) {
 648                                         if (ldb_attr_cmp(objectclass->lDAPDisplayName, sclass->systemPossibleInferiors[j]) == 0) {
 649                                                 allowed_class = true;
 650                                                 break;
 651                                         }
 652                                 }
 653                         }
 654
 655                         if (!allowed_class) {
 656                                 ldb_asprintf_errstring(ldb, "structural objectClass %s is not a valid child class for %s",
 657                                                 objectclass->lDAPDisplayName, ldb_dn_get_linearized(ac->search_res->message->dn));
 658                                 return LDB_ERR_NAMING_VIOLATION;
 659                         }
 660                 }
 661
 662                 objectcategory = ldb_msg_find_attr_as_dn(ldb, ac, msg,
 663                                                          "objectCategory");
 664                 if (objectcategory == NULL) {
 665                         struct dsdb_extended_dn_store_format *dn_format =
 666                                         talloc_get_type(ldb_module_get_private(ac->module),
 667                                                         struct dsdb_extended_dn_store_format);
 668                         if (dn_format && dn_format->store_extended_dn_in_ldb == false) {
 669                                 /* Strip off extended components */
 670                                 struct ldb_dn *dn = ldb_dn_new(ac, ldb,
 671                                                                objectclass->defaultObjectCategory);
 672                                 value = ldb_dn_alloc_linearized(msg, dn);
 673                                 talloc_free(dn);
 674                         } else {
 675                                 value = talloc_strdup(msg,
 676                                                       objectclass->defaultObjectCategory);
 677                         }
 678                         if (value == NULL) {
 679                                 return ldb_oom(ldb);
 680                         }
 681
 682                         ret = ldb_msg_add_string(msg, "objectCategory", value);
 683                         if (ret != LDB_SUCCESS) {
 684                                 return ret;
 685                         }
 686                 } else {
 687                         const struct dsdb_class *ocClass =
 688                                         dsdb_class_by_cn_ldb_val(ac->schema,
 689                                                                  ldb_dn_get_rdn_val(objectcategory));
 690                         if (ocClass != NULL) {
 691                                 struct ldb_dn *dn = ldb_dn_new(ac, ldb,
 692                                                                ocClass->defaultObjectCategory);
 693                                 if (ldb_dn_compare(objectcategory, dn) != 0) {
 694                                         ocClass = NULL;
 695                                 }
 696                         }
 697                         talloc_free(objectcategory);
 698                         if (ocClass == NULL) {
 699                                 ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, 'objectCategory' attribute invalid!",
 700                                                        ldb_dn_get_linearized(msg->dn));
 701                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
 702                         }
 703                 }
 704
 705                 if (!ldb_msg_find_element(msg, "showInAdvancedViewOnly") && (objectclass->defaultHidingValue == true)) {
 706                         ldb_msg_add_string(msg, "showInAdvancedViewOnly",
 707                                                 "TRUE");
 708                 }
 709
 710                 /* There are very special rules for systemFlags, see MS-ADTS
 711                  * MS-ADTS 3.1.1.5.2.4 */
 712
 713                 el = ldb_msg_find_element(msg, "systemFlags");
 714                 if ((el != NULL) && (el->num_values > 1)) {
 715                         ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, 'systemFlags' attribute multivalued!",
 716                                                ldb_dn_get_linearized(msg->dn));
 717                         return LDB_ERR_CONSTRAINT_VIOLATION;
 718                 }
 719
 720                 systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
 721
 722                 ldb_msg_remove_attr(msg, "systemFlags");
 723
 724                 /* Only the following flags may be set by a client */
 725                 if (ldb_request_get_control(ac->req,
 726                                             LDB_CONTROL_RELAX_OID) == NULL) {
 727                         systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME
 728                                        | SYSTEM_FLAG_CONFIG_ALLOW_MOVE
 729                                        | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE
 730                                        | SYSTEM_FLAG_ATTR_IS_RDN );
 731                 }
 732
 733                 /* But the last one ("ATTR_IS_RDN") is only allowed on
 734                  * "attributeSchema" objects. So truncate if it does not fit. */
 735                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, "attributeSchema") != 0) {
 736                         systemFlags &= ~SYSTEM_FLAG_ATTR_IS_RDN;
 737                 }
 738
 739                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, "server") == 0) {
 740                         systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE | SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE);
 741                 } else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "site") == 0
 742                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "serversContainer") == 0
 743                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSDSA") == 0) {
 744                         systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
 745
 746                 } else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLink") == 0
 747                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLinkBridge") == 0
 748                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSConnection") == 0) {
 749                         systemFlags |= (int32_t)(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
 750                 }
 751
 752                 /* TODO: If parent object is site or subnet, also add (SYSTEM_FLAG_CONFIG_ALLOW_RENAME) */
 753
 754                 if (el || systemFlags != 0) {
 755                         ret = samdb_msg_add_int(ldb, msg, msg, "systemFlags",
 756                                                 systemFlags);
 757                         if (ret != LDB_SUCCESS) {
 758                                 return ret;
 759                         }
 760                 }
 761
 762                 /* make sure that "isCriticalSystemObject" is not specified! */
 763                 el = ldb_msg_find_element(msg, "isCriticalSystemObject");
 764                 if ((el != NULL) &&
 765                     !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
 766                         ldb_set_errstring(ldb,
 767                                           "objectclass: 'isCriticalSystemObject' must not be specified!");
 768                         return LDB_ERR_UNWILLING_TO_PERFORM;
 769                 }
 770         }
 771
 772         ret = ldb_msg_sanity_check(ldb, msg);
 773         if (ret != LDB_SUCCESS) {
 774                 return ret;
 775         }
 776
 777         ret = ldb_build_add_req(&add_req, ldb, ac,
 778                                 msg,
 779                                 ac->req->controls,
 780                                 ac, oc_op_callback,
 781                                 ac->req);
 782         LDB_REQ_SET_LOCATION(add_req);
 783         if (ret != LDB_SUCCESS) {
 784                 return ret;
 785         }
 786
 787         /* perform the add */
 788         return ldb_next_request(ac->module, add_req);
 789 }
 790
 791 static int oc_modify_callback(struct ldb_request *req,
 792                                 struct ldb_reply *ares);
 793 static int objectclass_do_mod(struct oc_context *ac);
 794
 795 static int objectclass_modify(struct ldb_module *module, struct ldb_request *req)
 796 {
 797         struct ldb_context *ldb = ldb_module_get_ctx(module);
 798         struct ldb_message_element *objectclass_element;
 799         struct ldb_message *msg;
 800         struct ldb_request *down_req;
 801         struct oc_context *ac;
 802         bool oc_changes = false;
 803         int ret;
 804
 805         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_modify\n");
 806
 807         /* do not manipulate our control entries */
 808         if (ldb_dn_is_special(req->op.mod.message->dn)) {
 809                 return ldb_next_request(module, req);
 810         }
 811
 812         /* As with the "real" AD we don't accept empty messages */
 813         if (req->op.mod.message->num_elements == 0) {
 814                 ldb_set_errstring(ldb, "objectclass: modify message must have "
 815                                        "elements/attributes!");
 816                 return LDB_ERR_UNWILLING_TO_PERFORM;
 817         }
 818
 819         ac = oc_init_context(module, req);
 820         if (ac == NULL) {
 821                 return ldb_operr(ldb);
 822         }
 823
 824         /* Without schema, there isn't much to do here */
 825         if (ac->schema == NULL) {
 826                 talloc_free(ac);
 827                 return ldb_next_request(module, req);
 828         }
 829
 830         msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
 831         if (msg == NULL) {
 832                 return ldb_operr(ldb);
 833         }
 834
 835         /* For now change everything except the objectclasses */
 836
 837         objectclass_element = ldb_msg_find_element(msg, "objectClass");
 838         if (objectclass_element != NULL) {
 839                 ldb_msg_remove_attr(msg, "objectClass");
 840                 oc_changes = true;
 841         }
 842
 843         ret = ldb_build_mod_req(&down_req, ldb, ac,
 844                                 msg,
 845                                 req->controls, ac,
 846                                 oc_changes ? oc_modify_callback : oc_op_callback,
 847                                 req);
 848         LDB_REQ_SET_LOCATION(down_req);
 849         if (ret != LDB_SUCCESS) {
 850                 return ret;
 851         }
 852
 853         return ldb_next_request(module, down_req);
 854 }
 855
 856 static int oc_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
 857 {
 858         static const char * const attrs[] = { "objectClass", NULL };
 859         struct ldb_context *ldb;
 860         struct ldb_request *search_req;
 861         struct oc_context *ac;
 862         int ret;
 863
 864         ac = talloc_get_type(req->context, struct oc_context);
 865         ldb = ldb_module_get_ctx(ac->module);
 866
 867         if (!ares) {
 868                 return ldb_module_done(ac->req, NULL, NULL,
 869                                         LDB_ERR_OPERATIONS_ERROR);
 870         }
 871
 872         if (ares->type == LDB_REPLY_REFERRAL) {
 873                 return ldb_module_send_referral(ac->req, ares->referral);
 874         }
 875
 876         if (ares->error != LDB_SUCCESS) {
 877                 return ldb_module_done(ac->req, ares->controls,
 878                                         ares->response, ares->error);
 879         }
 880
 881         if (ares->type != LDB_REPLY_DONE) {
 882                 talloc_free(ares);
 883                 return ldb_module_done(ac->req, NULL, NULL,
 884                                         LDB_ERR_OPERATIONS_ERROR);
 885         }
 886
 887         talloc_free(ares);
 888
 889         /* this looks up the real existing object for fetching some important
 890          * informations (objectclasses) */
 891         ret = ldb_build_search_req(&search_req, ldb,
 892                                    ac, ac->req->op.mod.message->dn,
 893                                    LDB_SCOPE_BASE,
 894                                    "(objectClass=*)",
 895                                    attrs, NULL,
 896                                    ac, get_search_callback,
 897                                    ac->req);
 898         LDB_REQ_SET_LOCATION(search_req);
 899         if (ret != LDB_SUCCESS) {
 900                 return ldb_module_done(ac->req, NULL, NULL, ret);
 901         }
 902
 903         ac->step_fn = objectclass_do_mod;
 904
 905         ret = ldb_next_request(ac->module, search_req);
 906         if (ret != LDB_SUCCESS) {
 907                 return ldb_module_done(ac->req, NULL, NULL, ret);
 908         }
 909
 910         return LDB_SUCCESS;
 911 }
 912
 913 static int objectclass_do_mod(struct oc_context *ac)
 914 {
 915         struct ldb_context *ldb;
 916         struct ldb_request *mod_req;
 917         char *value;
 918         struct ldb_message_element *oc_el_entry, *oc_el_change;
 919         struct ldb_val *vals;
 920         struct ldb_message *msg;
 921         TALLOC_CTX *mem_ctx;
 922         struct class_list *sorted, *current;
 923         const struct dsdb_class *objectclass;
 924         unsigned int i, j;
 925         bool found, replace = false;
 926         int ret;
 927
 928         ldb = ldb_module_get_ctx(ac->module);
 929
 930         /* we should always have a valid entry when we enter here */
 931         if (ac->search_res == NULL) {
 932                 return ldb_operr(ldb);
 933         }
 934
 935         oc_el_entry = ldb_msg_find_element(ac->search_res->message,
 936                                            "objectClass");
 937         if (oc_el_entry == NULL) {
 938                 /* existing entry without a valid object class? */
 939                 return ldb_operr(ldb);
 940         }
 941
 942         oc_el_change = ldb_msg_find_element(ac->req->op.mod.message,
 943                                             "objectClass");
 944         if (oc_el_change == NULL) {
 945                 /* we should have an objectclass change operation */
 946                 return ldb_operr(ldb);
 947         }
 948
 949         /* use a new message structure */
 950         msg = ldb_msg_new(ac);
 951         if (msg == NULL) {
 952                 return ldb_oom(ldb);
 953         }
 954
 955         msg->dn = ac->req->op.mod.message->dn;
 956
 957         mem_ctx = talloc_new(ac);
 958         if (mem_ctx == NULL) {
 959                 return ldb_oom(ldb);
 960         }
 961
 962         switch (oc_el_change->flags & LDB_FLAG_MOD_MASK) {
 963         case LDB_FLAG_MOD_ADD:
 964                 /* Merge the two message elements */
 965                 for (i = 0; i < oc_el_change->num_values; i++) {
 966                         for (j = 0; j < oc_el_entry->num_values; j++) {
 967                                 if (strcasecmp((char *)oc_el_change->values[i].data,
 968                                                (char *)oc_el_entry->values[j].data) == 0) {
 969                                         /* we cannot add an already existing object class */
 970                                         talloc_free(mem_ctx);
 971                                         return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
 972                                 }
 973                         }
 974                         /* append the new object class value - code was copied
 975                          * from "ldb_msg_add_value" */
 976                         vals = talloc_realloc(oc_el_entry, oc_el_entry->values,
 977                                               struct ldb_val,
 978                                               oc_el_entry->num_values + 1);
 979                         if (vals == NULL) {
 980                                 talloc_free(mem_ctx);
 981                                 return ldb_oom(ldb);
 982                         }
 983                         oc_el_entry->values = vals;
 984                         oc_el_entry->values[oc_el_entry->num_values] =
 985                                 oc_el_change->values[i];
 986                         ++(oc_el_entry->num_values);
 987                 }
 988
 989                 objectclass = get_last_structural_class(ac->schema,
 990                                                         oc_el_change);
 991                 if (objectclass != NULL) {
 992                         /* we cannot add a new structural object class */
 993                         talloc_free(mem_ctx);
 994                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 995                 }
 996
 997                 /* Now do the sorting */
 998                 ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
 999                                        oc_el_entry, &sorted);
1000                 if (ret != LDB_SUCCESS) {
1001                         talloc_free(mem_ctx);
1002                         return ret;
1003                 }
1004
1005                 break;
1006
1007         case LDB_FLAG_MOD_REPLACE:
1008                 /* Do the sorting for the change message element */
1009                 ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1010                                        oc_el_change, &sorted);
1011                 if (ret != LDB_SUCCESS) {
1012                         talloc_free(mem_ctx);
1013                         return ret;
1014                 }
1015
1016                 /* this is a replace */
1017                 replace = true;
1018
1019                 break;
1020
1021         case LDB_FLAG_MOD_DELETE:
1022                 /* get the actual top-most structural objectclass */
1023                 objectclass = get_last_structural_class(ac->schema,
1024                                                         oc_el_entry);
1025                 if (objectclass == NULL) {
1026                         talloc_free(mem_ctx);
1027                         return ldb_operr(ldb);
1028                 }
1029
1030                 /* Merge the two message elements */
1031                 for (i = 0; i < oc_el_change->num_values; i++) {
1032                         found = false;
1033                         for (j = 0; j < oc_el_entry->num_values; j++) {
1034                                 if (strcasecmp((char *)oc_el_change->values[i].data,
1035                                                (char *)oc_el_entry->values[j].data) == 0) {
1036                                         found = true;
1037                                         /* delete the object class value -
1038                                          * code was copied from
1039                                          * "ldb_msg_remove_element" */
1040                                         if (j != oc_el_entry->num_values - 1) {
1041                                                 memmove(&oc_el_entry->values[j],
1042                                                         &oc_el_entry->values[j+1],
1043                                                         ((oc_el_entry->num_values-1) - j)*sizeof(struct ldb_val));
1044                                         }
1045                                         --(oc_el_entry->num_values);
1046                                         break;
1047                                 }
1048                         }
1049                         if (!found) {
1050                                 /* we cannot delete a not existing object class */
1051                                 ldb_asprintf_errstring(ldb, "Cannot delete this %.*s ",
1052                                                (int)oc_el_change->values[i].length, (const char *)oc_el_change->values[i].data);
1053
1054                                 talloc_free(mem_ctx);
1055                                 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1056                         }
1057                 }
1058
1059                 /* Make sure that the top-most structural objectclass wasn't
1060                  * deleted */
1061                 found = false;
1062                 for (i = 0; i < oc_el_entry->num_values; i++) {
1063                         if (strcasecmp(objectclass->lDAPDisplayName,
1064                             (char *)oc_el_entry->values[i].data) == 0) {
1065                                 found = true; break;
1066                         }
1067                 }
1068                 if (!found) {
1069                         talloc_free(mem_ctx);
1070                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
1071                 }
1072
1073
1074                 /* Now do the sorting */
1075                 ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
1076                                        oc_el_entry, &sorted);
1077                 if (ret != LDB_SUCCESS) {
1078                         talloc_free(mem_ctx);
1079                         return ret;
1080                 }
1081
1082                 break;
1083         }
1084
1085         ret = ldb_msg_add_empty(msg, "objectClass",
1086                                 LDB_FLAG_MOD_REPLACE, &oc_el_change);
1087         if (ret != LDB_SUCCESS) {
1088                 ldb_oom(ldb);
1089                 talloc_free(mem_ctx);
1090                 return ret;
1091         }
1092
1093         /* Move from the linked list back into an ldb msg */
1094         for (current = sorted; current; current = current->next) {
1095                 value = talloc_strdup(msg,
1096                                       current->objectclass->lDAPDisplayName);
1097                 if (value == NULL) {
1098                         talloc_free(mem_ctx);
1099                         return ldb_oom(ldb);
1100                 }
1101                 ret = ldb_msg_add_string(msg, "objectClass", value);
1102                 if (ret != LDB_SUCCESS) {
1103                         ldb_set_errstring(ldb, "objectclass: could not re-add sorted objectclass to modify msg");
1104                         talloc_free(mem_ctx);
1105                         return ret;
1106                 }
1107         }
1108
1109         talloc_free(mem_ctx);
1110
1111         if (replace) {
1112                 /* Well, on replace we are nearly done: we have to test if
1113                  * the change and entry message element are identically. We
1114                  * can use "ldb_msg_element_compare" since now the specified
1115                  * objectclasses match for sure in case. */
1116                 ret = ldb_msg_element_compare(oc_el_entry, oc_el_change);
1117                 if (ret == 0) {
1118                         ret = ldb_msg_element_compare(oc_el_change,
1119                                                       oc_el_entry);
1120                 }
1121                 if (ret == 0) {
1122                         /* they are the same so we are done in this case */
1123                         return ldb_module_done(ac->req, NULL, NULL,
1124                                                LDB_SUCCESS);
1125                 } else {
1126                         /* they're not exactly the same */
1127                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
1128                 }
1129         }
1130
1131         /* in the other cases we have the real change left to do */
1132
1133         ret = ldb_msg_sanity_check(ldb, msg);
1134         if (ret != LDB_SUCCESS) {
1135                 return ret;
1136         }
1137
1138         ret = ldb_build_mod_req(&mod_req, ldb, ac,
1139                                 msg,
1140                                 ac->req->controls,
1141                                 ac, oc_op_callback,
1142                                 ac->req);
1143         LDB_REQ_SET_LOCATION(mod_req);
1144         if (ret != LDB_SUCCESS) {
1145                 return ret;
1146         }
1147
1148         return ldb_next_request(ac->module, mod_req);
1149 }
1150
1151 static int objectclass_do_rename(struct oc_context *ac);
1152
1153 static int objectclass_rename(struct ldb_module *module, struct ldb_request *req)
1154 {
1155         static const char * const attrs[] = { "objectClass", NULL };
1156         struct ldb_context *ldb;
1157         struct ldb_request *search_req;
1158         struct oc_context *ac;
1159         struct ldb_dn *parent_dn;
1160         int ret;
1161
1162         ldb = ldb_module_get_ctx(module);
1163
1164         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_rename\n");
1165
1166         /* do not manipulate our control entries */
1167         if (ldb_dn_is_special(req->op.rename.newdn)) {
1168                 return ldb_next_request(module, req);
1169         }
1170
1171         ac = oc_init_context(module, req);
1172         if (ac == NULL) {
1173                 return ldb_operr(ldb);
1174         }
1175
1176         parent_dn = ldb_dn_get_parent(ac, req->op.rename.newdn);
1177         if (parent_dn == NULL) {
1178                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, the parent DN does not exist!",
1179                                        ldb_dn_get_linearized(req->op.rename.olddn));
1180                 return LDB_ERR_NO_SUCH_OBJECT;
1181         }
1182
1183         /* this looks up the parent object for fetching some important
1184          * informations (objectclasses, DN normalisation...) */
1185         ret = ldb_build_search_req(&search_req, ldb,
1186                                    ac, parent_dn, LDB_SCOPE_BASE,
1187                                    "(objectClass=*)",
1188                                    attrs, NULL,
1189                                    ac, get_search_callback,
1190                                    req);
1191         LDB_REQ_SET_LOCATION(search_req);
1192         if (ret != LDB_SUCCESS) {
1193                 return ret;
1194         }
1195
1196         /* we have to add the show recycled control, as otherwise DRS
1197            deletes will be refused as we will think the target parent
1198            does not exist */
1199         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
1200                                       false, NULL);
1201
1202         if (ret != LDB_SUCCESS) {
1203                 return ret;
1204         }
1205
1206         ac->step_fn = objectclass_do_rename;
1207
1208         return ldb_next_request(ac->module, search_req);
1209 }
1210
1211 static int objectclass_do_rename2(struct oc_context *ac);
1212
1213 static int objectclass_do_rename(struct oc_context *ac)
1214 {
1215         static const char * const attrs[] = { "objectClass", NULL };
1216         struct ldb_context *ldb;
1217         struct ldb_request *search_req;
1218         int ret;
1219
1220         ldb = ldb_module_get_ctx(ac->module);
1221
1222         /* Check if we have a valid parent - this check is needed since
1223          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1224         if (ac->search_res == NULL) {
1225                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, parent does not exist!",
1226                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1227                 return LDB_ERR_OTHER;
1228         }
1229
1230         /* now assign "search_res2" to the parent entry to have "search_res"
1231          * free for another lookup */
1232         ac->search_res2 = ac->search_res;
1233         ac->search_res = NULL;
1234
1235         /* this looks up the real existing object for fetching some important
1236          * informations (objectclasses) */
1237         ret = ldb_build_search_req(&search_req, ldb,
1238                                    ac, ac->req->op.rename.olddn,
1239                                    LDB_SCOPE_BASE,
1240                                    "(objectClass=*)",
1241                                    attrs, NULL,
1242                                    ac, get_search_callback,
1243                                    ac->req);
1244         LDB_REQ_SET_LOCATION(search_req);
1245         if (ret != LDB_SUCCESS) {
1246                 return ret;
1247         }
1248
1249         ac->step_fn = objectclass_do_rename2;
1250
1251         return ldb_next_request(ac->module, search_req);
1252 }
1253
1254 static int objectclass_do_rename2(struct oc_context *ac)
1255 {
1256         struct ldb_context *ldb;
1257         struct ldb_request *rename_req;
1258         struct ldb_dn *fixed_dn;
1259         int ret;
1260
1261         ldb = ldb_module_get_ctx(ac->module);
1262
1263         /* Check if we have a valid entry - this check is needed since
1264          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1265         if (ac->search_res == NULL) {
1266                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s, entry does not exist!",
1267                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1268                 return LDB_ERR_NO_SUCH_OBJECT;
1269         }
1270
1271         if (ac->schema != NULL) {
1272                 struct ldb_message_element *oc_el_entry, *oc_el_parent;
1273                 const struct dsdb_class *objectclass;
1274                 const char *rdn_name;
1275                 bool allowed_class = false;
1276                 unsigned int i, j;
1277                 bool found;
1278
1279                 oc_el_entry = ldb_msg_find_element(ac->search_res->message,
1280                                                    "objectClass");
1281                 if (oc_el_entry == NULL) {
1282                         /* existing entry without a valid object class? */
1283                         return ldb_operr(ldb);
1284                 }
1285                 objectclass = get_last_structural_class(ac->schema, oc_el_entry);
1286                 if (objectclass == NULL) {
1287                         /* existing entry without a valid object class? */
1288                         return ldb_operr(ldb);
1289                 }
1290
1291                 rdn_name = ldb_dn_get_rdn_name(ac->req->op.rename.newdn);
1292                 if (rdn_name == NULL) {
1293                         return ldb_operr(ldb);
1294                 }
1295                 found = false;
1296                 for (i = 0; (!found) && (i < oc_el_entry->num_values); i++) {
1297                         const struct dsdb_class *tmp_class =
1298                                 dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
1299                                                                       &oc_el_entry->values[i]);
1300
1301                         if (tmp_class == NULL) continue;
1302
1303                         if (ldb_attr_cmp(rdn_name, tmp_class->rDNAttID) == 0)
1304                                 found = true;
1305                 }
1306                 if (!found) {
1307                         ldb_asprintf_errstring(ldb,
1308                                                "objectclass: Invalid RDN '%s' for objectclass '%s'!",
1309                                                rdn_name, objectclass->lDAPDisplayName);
1310                         return LDB_ERR_UNWILLING_TO_PERFORM;
1311                 }
1312
1313                 oc_el_parent = ldb_msg_find_element(ac->search_res2->message,
1314                                                     "objectClass");
1315                 if (oc_el_parent == NULL) {
1316                         /* existing entry without a valid object class? */
1317                         return ldb_operr(ldb);
1318                 }
1319
1320                 for (i=0; allowed_class == false && i < oc_el_parent->num_values; i++) {
1321                         const struct dsdb_class *sclass;
1322
1323                         sclass = dsdb_class_by_lDAPDisplayName_ldb_val(ac->schema,
1324                                                                        &oc_el_parent->values[i]);
1325                         if (!sclass) {
1326                                 /* We don't know this class?  what is going on? */
1327                                 continue;
1328                         }
1329                         for (j=0; sclass->systemPossibleInferiors && sclass->systemPossibleInferiors[j]; j++) {
1330                                 if (ldb_attr_cmp(objectclass->lDAPDisplayName, sclass->systemPossibleInferiors[j]) == 0) {
1331                                         allowed_class = true;
1332                                         break;
1333                                 }
1334                         }
1335                 }
1336
1337                 if (!allowed_class) {
1338                         ldb_asprintf_errstring(ldb,
1339                                                "objectclass: structural objectClass %s is not a valid child class for %s",
1340                                                objectclass->lDAPDisplayName, ldb_dn_get_linearized(ac->search_res2->message->dn));
1341                         return LDB_ERR_NAMING_VIOLATION;
1342                 }
1343         }
1344
1345         /* Ensure we are not trying to rename it to be a child of itself */
1346         if ((ldb_dn_compare_base(ac->req->op.rename.olddn,
1347                                  ac->req->op.rename.newdn) == 0)  &&
1348             (ldb_dn_compare(ac->req->op.rename.olddn,
1349                             ac->req->op.rename.newdn) != 0)) {
1350                 ldb_asprintf_errstring(ldb, "objectclass: Cannot rename %s to be a child of itself",
1351                                        ldb_dn_get_linearized(ac->req->op.rename.olddn));
1352                 return LDB_ERR_UNWILLING_TO_PERFORM;
1353         }
1354
1355         /* Fix up the DN to be in the standard form, taking
1356          * particular care to match the parent DN */
1357         ret = fix_dn(ldb, ac,
1358                      ac->req->op.rename.newdn,
1359                      ac->search_res2->message->dn,
1360                      &fixed_dn);
1361         if (ret != LDB_SUCCESS) {
1362                 ldb_asprintf_errstring(ldb, "objectclass: Could not munge DN %s into normal form",
1363                                        ldb_dn_get_linearized(ac->req->op.rename.newdn));
1364                 return ret;
1365
1366         }
1367
1368         ret = ldb_build_rename_req(&rename_req, ldb, ac,
1369                                    ac->req->op.rename.olddn, fixed_dn,
1370                                    ac->req->controls,
1371                                    ac, oc_op_callback,
1372                                    ac->req);
1373         LDB_REQ_SET_LOCATION(rename_req);
1374         if (ret != LDB_SUCCESS) {
1375                 return ret;
1376         }
1377
1378         /* perform the rename */
1379         return ldb_next_request(ac->module, rename_req);
1380 }
1381
1382 static int objectclass_do_delete(struct oc_context *ac);
1383
1384 static int objectclass_delete(struct ldb_module *module, struct ldb_request *req)
1385 {
1386         static const char * const attrs[] = { "nCName", "objectClass",
1387                                               "systemFlags",
1388                                               "isCriticalSystemObject", NULL };
1389         struct ldb_context *ldb;
1390         struct ldb_request *search_req;
1391         struct oc_context *ac;
1392         int ret;
1393
1394         ldb = ldb_module_get_ctx(module);
1395
1396         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_delete\n");
1397
1398         /* do not manipulate our control entries */
1399         if (ldb_dn_is_special(req->op.del.dn)) {
1400                 return ldb_next_request(module, req);
1401         }
1402
1403         /* Bypass the constraint checks when we do have the "RELAX" control
1404          * set. */
1405         if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID) != NULL) {
1406                 return ldb_next_request(module, req);
1407         }
1408
1409         ac = oc_init_context(module, req);
1410         if (ac == NULL) {
1411                 return ldb_operr(ldb);
1412         }
1413
1414         /* this looks up the entry object for fetching some important
1415          * informations (object classes, system flags...) */
1416         ret = ldb_build_search_req(&search_req, ldb,
1417                                    ac, req->op.del.dn, LDB_SCOPE_BASE,
1418                                    "(objectClass=*)",
1419                                    attrs, NULL,
1420                                    ac, get_search_callback,
1421                                    req);
1422         LDB_REQ_SET_LOCATION(search_req);
1423         if (ret != LDB_SUCCESS) {
1424                 return ret;
1425         }
1426
1427         ac->step_fn = objectclass_do_delete;
1428
1429         return ldb_next_request(ac->module, search_req);
1430 }
1431
1432 static int objectclass_do_delete(struct oc_context *ac)
1433 {
1434         struct ldb_context *ldb;
1435         struct ldb_dn *dn;
1436         int32_t systemFlags;
1437         bool isCriticalSystemObject;
1438         int ret;
1439
1440         ldb = ldb_module_get_ctx(ac->module);
1441
1442         /* Check if we have a valid entry - this check is needed since
1443          * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
1444         if (ac->search_res == NULL) {
1445                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, entry does not exist!",
1446                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1447                 return LDB_ERR_NO_SUCH_OBJECT;
1448         }
1449
1450         /* DC's ntDSDSA object */
1451         if (ldb_dn_compare(ac->req->op.del.dn, samdb_ntds_settings_dn(ldb)) == 0) {
1452                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's ntDSDSA object!",
1453                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1454                 return LDB_ERR_UNWILLING_TO_PERFORM;
1455         }
1456
1457         /* DC's rIDSet object */
1458         /* Perform this check only when it does exist - this is needed in order
1459          * to don't let existing provisions break. */
1460         ret = samdb_rid_set_dn(ldb, ac, &dn);
1461         if ((ret != LDB_SUCCESS) && (ret != LDB_ERR_NO_SUCH_OBJECT)) {
1462                 return ret;
1463         }
1464         if (ret == LDB_SUCCESS) {
1465                 if (ldb_dn_compare(ac->req->op.del.dn, dn) == 0) {
1466                         talloc_free(dn);
1467                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's rIDSet object!",
1468                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1469                         return LDB_ERR_UNWILLING_TO_PERFORM;
1470                 }
1471                 talloc_free(dn);
1472         }
1473
1474         /* crossRef objects regarding config, schema and default domain NCs */
1475         if (samdb_find_attribute(ldb, ac->search_res->message, "objectClass",
1476                                  "crossRef") != NULL) {
1477                 dn = ldb_msg_find_attr_as_dn(ldb, ac, ac->search_res->message,
1478                                              "nCName");
1479                 if ((ldb_dn_compare(dn, ldb_get_default_basedn(ldb)) == 0) ||
1480                     (ldb_dn_compare(dn, ldb_get_config_basedn(ldb)) == 0)) {
1481                         talloc_free(dn);
1482
1483                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's a crossRef object to the main or configuration partition!",
1484                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1485                         return LDB_ERR_NOT_ALLOWED_ON_NON_LEAF;
1486                 }
1487                 if (ldb_dn_compare(dn, ldb_get_schema_basedn(ldb)) == 0) {
1488                         talloc_free(dn);
1489
1490                         ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's a crossRef object to the schema partition!",
1491                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1492                         return LDB_ERR_UNWILLING_TO_PERFORM;
1493                 }
1494                 talloc_free(dn);
1495         }
1496
1497         /* systemFlags */
1498
1499         systemFlags = ldb_msg_find_attr_as_int(ac->search_res->message,
1500                                                "systemFlags", 0);
1501         if ((systemFlags & SYSTEM_FLAG_DISALLOW_DELETE) != 0) {
1502                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it isn't permitted!",
1503                                        ldb_dn_get_linearized(ac->req->op.del.dn));
1504                 return LDB_ERR_UNWILLING_TO_PERFORM;
1505         }
1506
1507         /* isCriticalSystemObject - but this only applies on tree delete
1508          * operations - MS-ADTS 3.1.1.5.5.7.2 */
1509         if (ldb_request_get_control(ac->req, LDB_CONTROL_TREE_DELETE_OID) != NULL) {
1510                 isCriticalSystemObject = ldb_msg_find_attr_as_bool(ac->search_res->message,
1511                                                                    "isCriticalSystemObject", false);
1512                 if (isCriticalSystemObject) {
1513                         ldb_asprintf_errstring(ldb,
1514                                                "objectclass: Cannot tree-delete %s, it's a critical system object!",
1515                                                ldb_dn_get_linearized(ac->req->op.del.dn));
1516                         return LDB_ERR_UNWILLING_TO_PERFORM;
1517                 }
1518         }
1519
1520         return ldb_next_request(ac->module, ac->req);
1521 }
1522
1523 static int objectclass_init(struct ldb_module *module)
1524 {
1525         struct ldb_context *ldb = ldb_module_get_ctx(module);
1526         int ret;
1527
1528         /* Init everything else */
1529         ret = ldb_next_init(module);
1530         if (ret != LDB_SUCCESS) {
1531                 return ret;
1532         }
1533
1534         /* Look for the opaque to indicate we might have to cut down the DN of defaultObjectCategory */
1535         ldb_module_set_private(module, ldb_get_opaque(ldb, DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME));
1536
1537         ret = ldb_mod_register_control(module, LDB_CONTROL_RODC_DCPROMO_OID);
1538         if (ret != LDB_SUCCESS) {
1539                 ldb_debug(ldb, LDB_DEBUG_ERROR,
1540                           "objectclass_init: Unable to register control DCPROMO with rootdse\n");
1541                 return ldb_operr(ldb);
1542         }
1543
1544         return ret;
1545 }
1546
1547 static const struct ldb_module_ops ldb_objectclass_module_ops = {
1548         .name           = "objectclass",
1549         .add            = objectclass_add,
1550         .modify         = objectclass_modify,
1551         .rename         = objectclass_rename,
1552         .del            = objectclass_delete,
1553         .init_context   = objectclass_init
1554 };
1555
1556 int ldb_objectclass_module_init(const char *version)
1557 {
1558         LDB_MODULE_CHECK_VERSION(version);
1559         return ldb_register_module(&ldb_objectclass_module_ops);
1560 }