2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher <metze@samba.org> 2006-2007
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2008
7 Copyright (C) Matthieu Patou <mat@matws.net> 2011
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "lib/util/dlinklist.h"
26 #include "dsdb/samdb/samdb.h"
27 #include <ldb_module.h>
28 #include "param/param.h"
29 #include "librpc/ndr/libndr.h"
30 #include "librpc/gen_ndr/ndr_misc.h"
31 #include "lib/util/tsort.h"
35 /* change this when we change something in our schema code that
36 * requires a re-index of the database
38 #define SAMDB_INDEXING_VERSION "3"
41 override the name to attribute handler function
43 const struct ldb_schema_attribute
*dsdb_attribute_handler_override(struct ldb_context
*ldb
,
47 struct dsdb_schema
*schema
= talloc_get_type_abort(private_data
, struct dsdb_schema
);
48 const struct dsdb_attribute
*a
= dsdb_attribute_by_lDAPDisplayName(schema
, name
);
50 /* this will fall back to ldb internal handling */
53 return a
->ldb_schema_attribute
;
57 * Set the attribute handlers onto the LDB, and potentially write the
58 * @INDEXLIST, @IDXONE and @ATTRIBUTES records. The @ATTRIBUTES records
59 * are required so we can operate on a schema-less database (say the
60 * backend during emergency fixes) and during the schema load.
62 int dsdb_schema_set_indices_and_attributes(struct ldb_context
*ldb
,
63 struct dsdb_schema
*schema
,
64 enum schema_set_enum mode
)
66 int ret
= LDB_SUCCESS
;
67 struct ldb_result
*res
;
68 struct ldb_result
*res_idx
;
69 struct dsdb_attribute
*attr
;
70 struct ldb_message
*mod_msg
;
72 struct ldb_message
*msg
;
73 struct ldb_message
*msg_idx
;
75 struct loadparm_context
*lp_ctx
=
76 talloc_get_type(ldb_get_opaque(ldb
, "loadparm"),
77 struct loadparm_context
);
78 bool guid_indexing
= true;
79 bool declare_ordered_integer_in_attributes
= true;
80 uint32_t pack_format_override
;
83 * GUID indexing is wanted by Samba by default. This allows
84 * an override in a specific case for downgrades.
86 guid_indexing
= lpcfg_parm_bool(lp_ctx
,
92 * If the pack format has been overridden to a previous
93 * version, then act like ORDERED_INTEGER doesn't exist,
94 * because it's a new type and we don't want to deal with
95 * possible issues with databases containing version 1 pack
96 * format and ordered types.
98 * This approach means that the @ATTRIBUTES will be
99 * incorrect for integers. Many other @ATTRIBUTES
100 * values are gross simplifications, but the presence
101 * of the ORDERED_INTEGER keyword prevents the old
102 * Samba from starting and then forcing a reindex.
104 * It is too difficult to override the actual index
105 * formatter, but this doesn't matter in practice.
107 pack_format_override
=
108 (intptr_t)ldb_get_opaque(ldb
, "pack_format_override");
109 if (pack_format_override
== LDB_PACKING_FORMAT
||
110 pack_format_override
== LDB_PACKING_FORMAT_NODN
) {
111 declare_ordered_integer_in_attributes
= false;
114 /* setup our own attribute name to schema handler */
115 ldb_schema_attribute_set_override_handler(ldb
, dsdb_attribute_handler_override
, schema
);
116 ldb_schema_set_override_indexlist(ldb
, true);
118 ldb_schema_set_override_GUID_index(ldb
, "objectGUID", "GUID");
121 if (mode
== SCHEMA_MEMORY_ONLY
) {
125 mem_ctx
= talloc_new(ldb
);
130 msg
= ldb_msg_new(mem_ctx
);
135 msg_idx
= ldb_msg_new(mem_ctx
);
140 msg
->dn
= ldb_dn_new(msg
, ldb
, "@ATTRIBUTES");
145 msg_idx
->dn
= ldb_dn_new(msg_idx
, ldb
, "@INDEXLIST");
151 ret
= ldb_msg_add_string(msg_idx
, "@IDXONE", "1");
152 if (ret
!= LDB_SUCCESS
) {
157 ret
= ldb_msg_add_string(msg_idx
, "@IDXGUID", "objectGUID");
158 if (ret
!= LDB_SUCCESS
) {
162 ret
= ldb_msg_add_string(msg_idx
, "@IDX_DN_GUID", "GUID");
163 if (ret
!= LDB_SUCCESS
) {
168 ret
= ldb_msg_add_string(msg_idx
, "@SAMDB_INDEXING_VERSION", SAMDB_INDEXING_VERSION
);
169 if (ret
!= LDB_SUCCESS
) {
173 ret
= ldb_msg_add_string(msg_idx
, SAMBA_FEATURES_SUPPORTED_FLAG
, "1");
174 if (ret
!= LDB_SUCCESS
) {
178 for (attr
= schema
->attributes
; attr
; attr
= attr
->next
) {
179 const char *syntax
= attr
->syntax
->ldb_syntax
;
182 syntax
= attr
->syntax
->ldap_oid
;
186 * Write out a rough approximation of the schema
187 * as an @ATTRIBUTES value, for bootstrapping.
188 * Only write ORDERED_INTEGER if we're using GUID indexes,
190 if (strcmp(syntax
, LDB_SYNTAX_INTEGER
) == 0) {
191 ret
= ldb_msg_add_string(msg
, attr
->lDAPDisplayName
, "INTEGER");
192 } else if (strcmp(syntax
, LDB_SYNTAX_ORDERED_INTEGER
) == 0) {
193 if (declare_ordered_integer_in_attributes
&&
196 * The normal production case
198 ret
= ldb_msg_add_string(msg
,
199 attr
->lDAPDisplayName
,
203 * For this mode, we are going back to
204 * before GUID indexing so we write it out
207 * Down in LDB, the special handler
208 * (index_format_fn) that made
209 * ORDERED_INTEGER and INTEGER
210 * different has been disabled.
212 ret
= ldb_msg_add_string(msg
,
213 attr
->lDAPDisplayName
,
216 } else if (strcmp(syntax
, LDB_SYNTAX_DIRECTORY_STRING
) == 0) {
217 ret
= ldb_msg_add_string(msg
, attr
->lDAPDisplayName
,
220 if (ret
!= LDB_SUCCESS
) {
224 if (attr
->searchFlags
& SEARCH_FLAG_ATTINDEX
) {
226 * When preparing to downgrade Samba, we need to write
227 * out an LDB without the new key word ORDERED_INTEGER.
229 if (strcmp(syntax
, LDB_SYNTAX_ORDERED_INTEGER
) == 0
230 && !declare_ordered_integer_in_attributes
) {
232 * Ugly, but do nothing, the best
233 * thing is to omit the reference
234 * entirely, the next transaction will
235 * spot this and rewrite everything.
237 * This way nothing will look at the
238 * index for this attribute until
239 * Samba starts and this is all
243 ret
= ldb_msg_add_string(msg_idx
, "@IDXATTR", attr
->lDAPDisplayName
);
244 if (ret
!= LDB_SUCCESS
) {
251 if (ret
!= LDB_SUCCESS
) {
252 talloc_free(mem_ctx
);
257 * Try to avoid churning the attributes too much,
258 * we only want to do this if they have changed
260 ret
= ldb_search(ldb
, mem_ctx
, &res
, msg
->dn
, LDB_SCOPE_BASE
, NULL
,
262 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
263 if (mode
== SCHEMA_COMPARE
) {
264 /* We are probably not in a transaction */
267 ret
= ldb_add(ldb
, msg
);
268 } else if (ret
!= LDB_SUCCESS
) {
269 } else if (res
->count
!= 1) {
270 if (mode
== SCHEMA_COMPARE
) {
271 /* We are probably not in a transaction */
274 ret
= ldb_add(ldb
, msg
);
276 /* Annoyingly added to our search results */
277 ldb_msg_remove_attr(res
->msgs
[0], "distinguishedName");
279 ret
= ldb_msg_difference(ldb
, mem_ctx
,
280 res
->msgs
[0], msg
, &mod_msg
);
281 if (ret
!= LDB_SUCCESS
) {
284 if (mod_msg
->num_elements
> 0) {
286 * Do the replace with the difference, as we
287 * are under the read lock and we wish to do a
288 * delete of any removed/renamed attributes
290 if (mode
== SCHEMA_COMPARE
) {
291 /* We are probably not in a transaction */
294 ret
= dsdb_modify(ldb
, mod_msg
, 0);
296 talloc_free(mod_msg
);
299 if (ret
== LDB_ERR_OPERATIONS_ERROR
|| ret
== LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
|| ret
== LDB_ERR_INVALID_DN_SYNTAX
) {
300 /* We might be on a read-only DB or LDAP */
303 if (ret
!= LDB_SUCCESS
) {
304 DBG_ERR("Failed to set schema into @ATTRIBUTES: %s\n",
306 talloc_free(mem_ctx
);
310 /* Now write out the indexes, as found in the schema (if they have changed) */
312 ret
= ldb_search(ldb
, mem_ctx
, &res_idx
, msg_idx
->dn
, LDB_SCOPE_BASE
,
314 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
315 if (mode
== SCHEMA_COMPARE
) {
316 /* We are probably not in a transaction */
319 ret
= ldb_add(ldb
, msg_idx
);
320 } else if (ret
!= LDB_SUCCESS
) {
321 } else if (res_idx
->count
!= 1) {
322 if (mode
== SCHEMA_COMPARE
) {
323 /* We are probably not in a transaction */
326 ret
= ldb_add(ldb
, msg_idx
);
328 /* Annoyingly added to our search results */
329 ldb_msg_remove_attr(res_idx
->msgs
[0], "distinguishedName");
331 ret
= ldb_msg_difference(ldb
, mem_ctx
,
332 res_idx
->msgs
[0], msg_idx
, &mod_msg
);
333 if (ret
!= LDB_SUCCESS
) {
338 * We don't want to re-index just because we didn't
341 * DO NOT backport this logic earlier than 4.7, it
342 * isn't needed and would be dangerous before 4.6,
343 * where we add logic to samba_dsdb to manage
344 * @SAMBA_FEATURES_SUPPORTED and need to know if the
345 * DB has been re-opened by an earlier version.
349 if (mod_msg
->num_elements
== 1
350 && ldb_attr_cmp(mod_msg
->elements
[0].name
,
351 SAMBA_FEATURES_SUPPORTED_FLAG
) == 0) {
354 * @SAMBA_FEATURES_SUPPORTED
356 } else if (mod_msg
->num_elements
> 0) {
359 * Do the replace with the difference, as we
360 * are under the read lock and we wish to do a
361 * delete of any removed/renamed attributes
363 if (mode
== SCHEMA_COMPARE
) {
364 /* We are probably not in a transaction */
367 ret
= dsdb_modify(ldb
, mod_msg
, 0);
369 talloc_free(mod_msg
);
371 if (ret
== LDB_ERR_OPERATIONS_ERROR
|| ret
== LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
|| ret
== LDB_ERR_INVALID_DN_SYNTAX
) {
372 /* We might be on a read-only DB */
376 if (ret
!= LDB_SUCCESS
) {
377 DBG_ERR("Failed to set schema into @INDEXLIST: %s\n",
381 talloc_free(mem_ctx
);
385 talloc_free(mem_ctx
);
386 return ldb_operr(ldb
);
389 talloc_free(mem_ctx
);
395 create extra attribute shortcuts
397 static void dsdb_setup_attribute_shortcuts(struct ldb_context
*ldb
, struct dsdb_schema
*schema
)
399 struct dsdb_attribute
*attribute
;
401 /* setup fast access to one_way_link and DN format */
402 for (attribute
=schema
->attributes
; attribute
; attribute
=attribute
->next
) {
403 attribute
->dn_format
= dsdb_dn_oid_to_format(attribute
->syntax
->ldap_oid
);
405 if (attribute
->dn_format
== DSDB_INVALID_DN
) {
406 attribute
->one_way_link
= false;
410 /* these are not considered to be one way links for
411 the purpose of DN link fixups */
412 if (ldb_attr_cmp("distinguishedName", attribute
->lDAPDisplayName
) == 0 ||
413 ldb_attr_cmp("objectCategory", attribute
->lDAPDisplayName
) == 0) {
414 attribute
->one_way_link
= false;
418 if (attribute
->linkID
== 0) {
419 attribute
->one_way_link
= true;
422 /* handle attributes with a linkID but no backlink */
423 if ((attribute
->linkID
& 1) == 0 &&
424 dsdb_attribute_by_linkID(schema
, attribute
->linkID
+ 1) == NULL
) {
425 attribute
->one_way_link
= true;
428 attribute
->one_way_link
= false;
432 static int uint32_cmp(uint32_t c1
, uint32_t c2
)
434 if (c1
== c2
) return 0;
435 return c1
> c2
? 1 : -1;
438 static int dsdb_compare_class_by_lDAPDisplayName(struct dsdb_class
**c1
, struct dsdb_class
**c2
)
440 return strcasecmp((*c1
)->lDAPDisplayName
, (*c2
)->lDAPDisplayName
);
442 static int dsdb_compare_class_by_governsID_id(struct dsdb_class
**c1
, struct dsdb_class
**c2
)
444 return uint32_cmp((*c1
)->governsID_id
, (*c2
)->governsID_id
);
446 static int dsdb_compare_class_by_governsID_oid(struct dsdb_class
**c1
, struct dsdb_class
**c2
)
448 return strcasecmp((*c1
)->governsID_oid
, (*c2
)->governsID_oid
);
450 static int dsdb_compare_class_by_cn(struct dsdb_class
**c1
, struct dsdb_class
**c2
)
452 return strcasecmp((*c1
)->cn
, (*c2
)->cn
);
455 static int dsdb_compare_attribute_by_lDAPDisplayName(struct dsdb_attribute
**a1
, struct dsdb_attribute
**a2
)
457 return strcasecmp((*a1
)->lDAPDisplayName
, (*a2
)->lDAPDisplayName
);
459 static int dsdb_compare_attribute_by_attributeID_id(struct dsdb_attribute
**a1
, struct dsdb_attribute
**a2
)
461 return uint32_cmp((*a1
)->attributeID_id
, (*a2
)->attributeID_id
);
463 static int dsdb_compare_attribute_by_msDS_IntId(struct dsdb_attribute
**a1
, struct dsdb_attribute
**a2
)
465 return uint32_cmp((*a1
)->msDS_IntId
, (*a2
)->msDS_IntId
);
467 static int dsdb_compare_attribute_by_attributeID_oid(struct dsdb_attribute
**a1
, struct dsdb_attribute
**a2
)
469 return strcasecmp((*a1
)->attributeID_oid
, (*a2
)->attributeID_oid
);
471 static int dsdb_compare_attribute_by_linkID(struct dsdb_attribute
**a1
, struct dsdb_attribute
**a2
)
473 return uint32_cmp((*a1
)->linkID
, (*a2
)->linkID
);
477 * Clean up Classes and Attributes accessor arrays
479 static void dsdb_sorted_accessors_free(struct dsdb_schema
*schema
)
481 /* free classes accessors */
482 TALLOC_FREE(schema
->classes_by_lDAPDisplayName
);
483 TALLOC_FREE(schema
->classes_by_governsID_id
);
484 TALLOC_FREE(schema
->classes_by_governsID_oid
);
485 TALLOC_FREE(schema
->classes_by_cn
);
486 /* free attribute accessors */
487 TALLOC_FREE(schema
->attributes_by_lDAPDisplayName
);
488 TALLOC_FREE(schema
->attributes_by_attributeID_id
);
489 TALLOC_FREE(schema
->attributes_by_msDS_IntId
);
490 TALLOC_FREE(schema
->attributes_by_attributeID_oid
);
491 TALLOC_FREE(schema
->attributes_by_linkID
);
495 create the sorted accessor arrays for the schema
497 int dsdb_setup_sorted_accessors(struct ldb_context
*ldb
,
498 struct dsdb_schema
*schema
)
500 struct dsdb_class
*cur
;
501 struct dsdb_attribute
*a
;
503 unsigned int num_int_id
;
506 for (i
=0; i
< schema
->classes_to_remove_size
; i
++) {
507 DLIST_REMOVE(schema
->classes
, schema
->classes_to_remove
[i
]);
508 TALLOC_FREE(schema
->classes_to_remove
[i
]);
510 for (i
=0; i
< schema
->attributes_to_remove_size
; i
++) {
511 DLIST_REMOVE(schema
->attributes
, schema
->attributes_to_remove
[i
]);
512 TALLOC_FREE(schema
->attributes_to_remove
[i
]);
515 TALLOC_FREE(schema
->classes_to_remove
);
516 schema
->classes_to_remove_size
= 0;
517 TALLOC_FREE(schema
->attributes_to_remove
);
518 schema
->attributes_to_remove_size
= 0;
520 /* free all caches */
521 dsdb_sorted_accessors_free(schema
);
523 /* count the classes */
524 for (i
=0, cur
=schema
->classes
; cur
; i
++, cur
=cur
->next
) /* noop */ ;
525 schema
->num_classes
= i
;
527 /* setup classes_by_* */
528 schema
->classes_by_lDAPDisplayName
= talloc_array(schema
, struct dsdb_class
*, i
);
529 schema
->classes_by_governsID_id
= talloc_array(schema
, struct dsdb_class
*, i
);
530 schema
->classes_by_governsID_oid
= talloc_array(schema
, struct dsdb_class
*, i
);
531 schema
->classes_by_cn
= talloc_array(schema
, struct dsdb_class
*, i
);
532 if (schema
->classes_by_lDAPDisplayName
== NULL
||
533 schema
->classes_by_governsID_id
== NULL
||
534 schema
->classes_by_governsID_oid
== NULL
||
535 schema
->classes_by_cn
== NULL
) {
539 for (i
=0, cur
=schema
->classes
; cur
; i
++, cur
=cur
->next
) {
540 schema
->classes_by_lDAPDisplayName
[i
] = cur
;
541 schema
->classes_by_governsID_id
[i
] = cur
;
542 schema
->classes_by_governsID_oid
[i
] = cur
;
543 schema
->classes_by_cn
[i
] = cur
;
546 /* sort the arrays */
547 TYPESAFE_QSORT(schema
->classes_by_lDAPDisplayName
, schema
->num_classes
, dsdb_compare_class_by_lDAPDisplayName
);
548 TYPESAFE_QSORT(schema
->classes_by_governsID_id
, schema
->num_classes
, dsdb_compare_class_by_governsID_id
);
549 TYPESAFE_QSORT(schema
->classes_by_governsID_oid
, schema
->num_classes
, dsdb_compare_class_by_governsID_oid
);
550 TYPESAFE_QSORT(schema
->classes_by_cn
, schema
->num_classes
, dsdb_compare_class_by_cn
);
552 /* now build the attribute accessor arrays */
554 /* count the attributes
555 * and attributes with msDS-IntId set */
557 for (i
=0, a
=schema
->attributes
; a
; i
++, a
=a
->next
) {
558 if (a
->msDS_IntId
!= 0) {
562 schema
->num_attributes
= i
;
563 schema
->num_int_id_attr
= num_int_id
;
565 /* setup attributes_by_* */
566 schema
->attributes_by_lDAPDisplayName
= talloc_array(schema
, struct dsdb_attribute
*, i
);
567 schema
->attributes_by_attributeID_id
= talloc_array(schema
, struct dsdb_attribute
*, i
);
568 schema
->attributes_by_msDS_IntId
= talloc_array(schema
,
569 struct dsdb_attribute
*, num_int_id
);
570 schema
->attributes_by_attributeID_oid
= talloc_array(schema
, struct dsdb_attribute
*, i
);
571 schema
->attributes_by_linkID
= talloc_array(schema
, struct dsdb_attribute
*, i
);
572 if (schema
->attributes_by_lDAPDisplayName
== NULL
||
573 schema
->attributes_by_attributeID_id
== NULL
||
574 schema
->attributes_by_msDS_IntId
== NULL
||
575 schema
->attributes_by_attributeID_oid
== NULL
||
576 schema
->attributes_by_linkID
== NULL
) {
581 for (i
=0, a
=schema
->attributes
; a
; i
++, a
=a
->next
) {
582 schema
->attributes_by_lDAPDisplayName
[i
] = a
;
583 schema
->attributes_by_attributeID_id
[i
] = a
;
584 schema
->attributes_by_attributeID_oid
[i
] = a
;
585 schema
->attributes_by_linkID
[i
] = a
;
586 /* append attr-by-msDS-IntId values */
587 if (a
->msDS_IntId
!= 0) {
588 schema
->attributes_by_msDS_IntId
[num_int_id
] = a
;
592 SMB_ASSERT(num_int_id
== schema
->num_int_id_attr
);
594 /* sort the arrays */
595 TYPESAFE_QSORT(schema
->attributes_by_lDAPDisplayName
, schema
->num_attributes
, dsdb_compare_attribute_by_lDAPDisplayName
);
596 TYPESAFE_QSORT(schema
->attributes_by_attributeID_id
, schema
->num_attributes
, dsdb_compare_attribute_by_attributeID_id
);
597 TYPESAFE_QSORT(schema
->attributes_by_msDS_IntId
, schema
->num_int_id_attr
, dsdb_compare_attribute_by_msDS_IntId
);
598 TYPESAFE_QSORT(schema
->attributes_by_attributeID_oid
, schema
->num_attributes
, dsdb_compare_attribute_by_attributeID_oid
);
599 TYPESAFE_QSORT(schema
->attributes_by_linkID
, schema
->num_attributes
, dsdb_compare_attribute_by_linkID
);
601 dsdb_setup_attribute_shortcuts(ldb
, schema
);
603 ret
= schema_fill_constructed(schema
);
604 if (ret
!= LDB_SUCCESS
) {
605 dsdb_sorted_accessors_free(schema
);
612 dsdb_sorted_accessors_free(schema
);
617 * Attach the schema to an opaque pointer on the ldb,
618 * so ldb modules can find it
620 int dsdb_set_schema_refresh_function(struct ldb_context
*ldb
,
621 dsdb_schema_refresh_fn refresh_fn
,
622 struct ldb_module
*module
)
624 int ret
= ldb_set_opaque(ldb
, "dsdb_schema_refresh_fn", refresh_fn
);
625 if (ret
!= LDB_SUCCESS
) {
629 ret
= ldb_set_opaque(ldb
, "dsdb_schema_refresh_fn_private_data", module
);
630 if (ret
!= LDB_SUCCESS
) {
637 * Attach the schema to an opaque pointer on the ldb,
638 * so ldb modules can find it
640 int dsdb_set_schema(struct ldb_context
*ldb
,
641 struct dsdb_schema
*schema
,
642 enum schema_set_enum write_indices_and_attributes
)
644 struct dsdb_schema
*old_schema
;
647 ret
= dsdb_setup_sorted_accessors(ldb
, schema
);
648 if (ret
!= LDB_SUCCESS
) {
652 old_schema
= ldb_get_opaque(ldb
, "dsdb_schema");
654 ret
= ldb_set_opaque(ldb
, "dsdb_use_global_schema", NULL
);
655 if (ret
!= LDB_SUCCESS
) {
659 ret
= ldb_set_opaque(ldb
, "dsdb_schema", schema
);
660 if (ret
!= LDB_SUCCESS
) {
664 talloc_steal(ldb
, schema
);
666 /* Set the new attributes based on the new schema */
667 ret
= dsdb_schema_set_indices_and_attributes(ldb
, schema
,
668 write_indices_and_attributes
);
669 if (ret
!= LDB_SUCCESS
) {
674 * Remove the reference to the schema we just overwrote - if there was
675 * none, NULL is harmless here.
677 if (old_schema
!= schema
) {
678 talloc_unlink(ldb
, old_schema
);
685 * Global variable to hold one copy of the schema, used to avoid memory bloat
687 static struct dsdb_schema
*global_schema
;
690 * Make this ldb use a specified schema, already fully calculated and belonging to another ldb
692 * The write_indices_and_attributes controls writing of the @ records
693 * because we cannot write to a database that does not yet exist on
696 int dsdb_reference_schema(struct ldb_context
*ldb
, struct dsdb_schema
*schema
,
697 enum schema_set_enum write_indices_and_attributes
)
701 void *schema_parent
= NULL
;
702 bool is_already_parent
;
703 struct dsdb_schema
*old_schema
;
704 old_schema
= ldb_get_opaque(ldb
, "dsdb_schema");
705 ret
= ldb_set_opaque(ldb
, "dsdb_schema", schema
);
706 if (ret
!= LDB_SUCCESS
) {
710 /* Remove the reference to the schema we just overwrote - if there was
711 * none, NULL is harmless here */
712 talloc_unlink(ldb
, old_schema
);
714 /* Reference schema on ldb if it wasn't done already */
715 schema_parent
= talloc_parent(schema
);
716 is_already_parent
= (schema_parent
== ldb
);
717 if (!is_already_parent
) {
718 ptr
= talloc_reference(ldb
, schema
);
724 /* Make this ldb use local schema preferably */
725 ret
= ldb_set_opaque(ldb
, "dsdb_use_global_schema", NULL
);
726 if (ret
!= LDB_SUCCESS
) {
730 ret
= ldb_set_opaque(ldb
, "dsdb_refresh_fn", NULL
);
731 if (ret
!= LDB_SUCCESS
) {
735 ret
= ldb_set_opaque(ldb
, "dsdb_refresh_fn_private_data", NULL
);
736 if (ret
!= LDB_SUCCESS
) {
740 ret
= dsdb_schema_set_indices_and_attributes(ldb
, schema
, write_indices_and_attributes
);
741 if (ret
!= LDB_SUCCESS
) {
749 * Make this ldb use the 'global' schema, setup to avoid having multiple copies in this process
751 int dsdb_set_global_schema(struct ldb_context
*ldb
)
754 void *use_global_schema
= (void *)1;
756 struct dsdb_schema
*old_schema
= ldb_get_opaque(ldb
, "dsdb_schema");
758 ret
= ldb_set_opaque(ldb
, "dsdb_use_global_schema", use_global_schema
);
759 if (ret
!= LDB_SUCCESS
) {
763 if (global_schema
== NULL
) {
767 /* Remove any pointer to a previous schema */
768 ret
= ldb_set_opaque(ldb
, "dsdb_schema", NULL
);
769 if (ret
!= LDB_SUCCESS
) {
773 /* Remove the reference to the schema we just overwrote - if there was
774 * none, NULL is harmless here */
775 talloc_unlink(ldb
, old_schema
);
777 /* Set the new attributes based on the new schema */
778 /* Don't write indices and attributes, it's expensive */
779 ret
= dsdb_schema_set_indices_and_attributes(ldb
, global_schema
, SCHEMA_MEMORY_ONLY
);
780 if (ret
== LDB_SUCCESS
) {
781 void *schema_parent
= talloc_parent(global_schema
);
782 bool is_already_parent
=
783 (schema_parent
== ldb
);
784 if (!is_already_parent
) {
785 ptr
= talloc_reference(ldb
, global_schema
);
789 ret
= ldb_set_opaque(ldb
, "dsdb_schema", global_schema
);
796 bool dsdb_uses_global_schema(struct ldb_context
*ldb
)
798 return (ldb_get_opaque(ldb
, "dsdb_use_global_schema") != NULL
);
802 * Find the schema object for this ldb
804 * If reference_ctx is not NULL, then talloc_reference onto that context
807 struct dsdb_schema
*dsdb_get_schema(struct ldb_context
*ldb
, TALLOC_CTX
*reference_ctx
)
810 struct dsdb_schema
*schema_out
= NULL
;
811 struct dsdb_schema
*schema_in
= NULL
;
812 dsdb_schema_refresh_fn refresh_fn
;
813 struct ldb_module
*loaded_from_module
;
814 bool use_global_schema
;
815 TALLOC_CTX
*tmp_ctx
= talloc_new(reference_ctx
);
816 if (tmp_ctx
== NULL
) {
820 /* see if we have a cached copy */
821 use_global_schema
= dsdb_uses_global_schema(ldb
);
822 if (use_global_schema
) {
823 schema_in
= global_schema
;
825 p
= ldb_get_opaque(ldb
, "dsdb_schema");
827 schema_in
= talloc_get_type_abort(p
, struct dsdb_schema
);
831 refresh_fn
= ldb_get_opaque(ldb
, "dsdb_schema_refresh_fn");
833 loaded_from_module
= ldb_get_opaque(ldb
, "dsdb_schema_refresh_fn_private_data");
835 SMB_ASSERT(loaded_from_module
&& (ldb_module_get_ctx(loaded_from_module
) == ldb
));
839 /* We need to guard against recursive calls here */
840 if (ldb_set_opaque(ldb
, "dsdb_schema_refresh_fn", NULL
) != LDB_SUCCESS
) {
841 ldb_debug_set(ldb
, LDB_DEBUG_FATAL
,
842 "dsdb_get_schema: clearing dsdb_schema_refresh_fn failed");
844 schema_out
= refresh_fn(loaded_from_module
,
845 ldb_get_event_context(ldb
),
849 if (ldb_set_opaque(ldb
, "dsdb_schema_refresh_fn", refresh_fn
) != LDB_SUCCESS
) {
850 ldb_debug_set(ldb
, LDB_DEBUG_FATAL
,
851 "dsdb_get_schema: re-setting dsdb_schema_refresh_fn failed");
854 schema_out
= schema_in
;
855 ldb_debug_set(ldb
, LDB_DEBUG_FATAL
,
856 "dsdb_get_schema: refresh_fn() failed");
859 schema_out
= schema_in
;
862 /* This removes the extra reference above */
863 talloc_free(tmp_ctx
);
866 * If ref ctx exists and doesn't already reference schema, then add
867 * a reference. Otherwise, just return schema.
869 * We must use talloc_parent(), which is not quite free (there
870 * is no direct parent pointer in talloc, only one on the
871 * first child within a linked list), but is much cheaper than
872 * talloc_is_parent() which walks the whole tree up to the top
873 * looking for a potential grand-grand(etc)-parent.
875 if (reference_ctx
== NULL
) {
878 void *schema_parent
= talloc_parent(schema_out
);
879 bool is_already_parent
=
880 schema_parent
== reference_ctx
;
881 if (is_already_parent
) {
884 return talloc_reference(reference_ctx
,
891 * Make the schema found on this ldb the 'global' schema
894 void dsdb_make_schema_global(struct ldb_context
*ldb
, struct dsdb_schema
*schema
)
901 talloc_unlink(NULL
, global_schema
);
904 /* we want the schema to be around permanently */
905 talloc_reparent(ldb
, NULL
, schema
);
906 global_schema
= schema
;
908 /* This calls the talloc_reference() of the global schema back onto the ldb */
909 dsdb_set_global_schema(ldb
);
913 * When loading the schema from LDIF files, we don't get the extended DNs.
915 * We need to set these up, so that from the moment we start the provision,
916 * the defaultObjectCategory links are set up correctly.
918 int dsdb_schema_fill_extended_dn(struct ldb_context
*ldb
, struct dsdb_schema
*schema
)
920 struct dsdb_class
*cur
;
921 const struct dsdb_class
*target_class
;
922 for (cur
= schema
->classes
; cur
; cur
= cur
->next
) {
923 const struct ldb_val
*rdn
;
927 struct ldb_dn
*dn
= ldb_dn_new(NULL
, ldb
, cur
->defaultObjectCategory
);
930 return LDB_ERR_INVALID_DN_SYNTAX
;
932 rdn
= ldb_dn_get_component_val(dn
, 0);
935 return LDB_ERR_INVALID_DN_SYNTAX
;
937 target_class
= dsdb_class_by_cn_ldb_val(schema
, rdn
);
940 return LDB_ERR_CONSTRAINT_VIOLATION
;
943 status
= GUID_to_ndr_blob(&target_class
->objectGUID
, dn
, &guid
);
944 if (!NT_STATUS_IS_OK(status
)) {
946 return ldb_operr(ldb
);
948 ret
= ldb_dn_set_extended_component(dn
, "GUID", &guid
);
949 if (ret
!= LDB_SUCCESS
) {
950 ret
= ldb_error(ldb
, ret
, "Could not set GUID");
955 cur
->defaultObjectCategory
= ldb_dn_get_extended_linearized(cur
, dn
, 1);
962 * @brief Add a new element to the schema and checks if it's a duplicate
964 * This function will add a new element to the schema and checks for existing
967 * @param[in] ldb A pointer to an LDB context
969 * @param[in] schema A pointer to the dsdb_schema where the element
972 * @param[in] msg The ldb_message object representing the element
975 * @param[in] checkdups A boolean to indicate if checks for duplicates
978 * @return A WERROR code
980 WERROR
dsdb_schema_set_el_from_ldb_msg_dups(struct ldb_context
*ldb
, struct dsdb_schema
*schema
,
981 struct ldb_message
*msg
, bool checkdups
)
985 tstring
= ldb_msg_find_attr_as_string(msg
, "whenChanged", NULL
);
986 /* keep a trace of the ts of the most recently changed object */
988 ts
= ldb_string_to_time(tstring
);
989 if (ts
> schema
->ts_last_change
) {
990 schema
->ts_last_change
= ts
;
993 if (samdb_find_attribute(ldb
, msg
,
994 "objectclass", "attributeSchema") != NULL
) {
996 return dsdb_set_attribute_from_ldb_dups(ldb
, schema
, msg
, checkdups
);
997 } else if (samdb_find_attribute(ldb
, msg
,
998 "objectclass", "classSchema") != NULL
) {
999 return dsdb_set_class_from_ldb_dups(schema
, msg
, checkdups
);
1001 /* Don't fail on things not classes or attributes */
1005 WERROR
dsdb_schema_set_el_from_ldb_msg(struct ldb_context
*ldb
,
1006 struct dsdb_schema
*schema
,
1007 struct ldb_message
*msg
)
1009 return dsdb_schema_set_el_from_ldb_msg_dups(ldb
, schema
, msg
, false);
1013 * Rather than read a schema from the LDB itself, read it from an ldif
1014 * file. This allows schema to be loaded and used while adding the
1015 * schema itself to the directory.
1017 * Should be called with a transaction (or failing that, have no concurrent
1018 * access while called).
1021 WERROR
dsdb_set_schema_from_ldif(struct ldb_context
*ldb
,
1022 const char *pf
, const char *df
,
1025 struct ldb_ldif
*ldif
;
1026 struct ldb_message
*msg
;
1027 TALLOC_CTX
*mem_ctx
;
1030 struct dsdb_schema
*schema
;
1031 const struct ldb_val
*prefix_val
;
1032 const struct ldb_val
*info_val
;
1033 struct ldb_val info_val_default
;
1036 mem_ctx
= talloc_new(ldb
);
1041 schema
= dsdb_new_schema(mem_ctx
);
1045 schema
->fsmo
.we_are_master
= true;
1046 schema
->fsmo
.update_allowed
= true;
1047 schema
->fsmo
.master_dn
= ldb_dn_new(schema
, ldb
, "@PROVISION_SCHEMA_MASTER");
1048 if (!schema
->fsmo
.master_dn
) {
1053 * load the prefixMap attribute from pf
1055 ldif
= ldb_ldif_read_string(ldb
, &pf
);
1057 status
= WERR_INVALID_PARAMETER
;
1060 talloc_steal(mem_ctx
, ldif
);
1062 ret
= ldb_msg_normalize(ldb
, mem_ctx
, ldif
->msg
, &msg
);
1063 if (ret
!= LDB_SUCCESS
) {
1068 prefix_val
= ldb_msg_find_ldb_val(msg
, "prefixMap");
1070 status
= WERR_INVALID_PARAMETER
;
1074 info_val
= ldb_msg_find_ldb_val(msg
, "schemaInfo");
1076 status
= dsdb_schema_info_blob_new(mem_ctx
, &info_val_default
);
1077 W_ERROR_NOT_OK_GOTO(status
, failed
);
1078 info_val
= &info_val_default
;
1081 status
= dsdb_load_oid_mappings_ldb(schema
, prefix_val
, info_val
);
1082 if (!W_ERROR_IS_OK(status
)) {
1083 DEBUG(0,("ERROR: dsdb_load_oid_mappings_ldb() failed with %s\n", win_errstr(status
)));
1087 schema
->ts_last_change
= 0;
1088 /* load the attribute and class definitions out of df */
1089 while ((ldif
= ldb_ldif_read_string(ldb
, &df
))) {
1090 talloc_steal(mem_ctx
, ldif
);
1092 ret
= ldb_msg_normalize(ldb
, ldif
, ldif
->msg
, &msg
);
1093 if (ret
!= LDB_SUCCESS
) {
1097 status
= dsdb_schema_set_el_from_ldb_msg(ldb
, schema
, msg
);
1099 if (!W_ERROR_IS_OK(status
)) {
1105 * TODO We may need a transaction here, otherwise this causes races.
1107 * To do so may require an ldb_in_transaction function. In the
1108 * meantime, assume that this is always called with a transaction or in
1111 ret
= dsdb_set_schema(ldb
, schema
, SCHEMA_WRITE
);
1112 if (ret
!= LDB_SUCCESS
) {
1113 status
= WERR_FOOBAR
;
1114 DEBUG(0,("ERROR: dsdb_set_schema() failed with %s / %s\n",
1115 ldb_strerror(ret
), ldb_errstring(ldb
)));
1119 ret
= dsdb_schema_fill_extended_dn(ldb
, schema
);
1120 if (ret
!= LDB_SUCCESS
) {
1121 status
= WERR_FOOBAR
;
1128 status
= WERR_NOT_ENOUGH_MEMORY
;
1131 talloc_free(mem_ctx
);