?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: consistently use talloc_tos() memory for rpc_pipe_open_interface()
[Samba.git] / source4 / dsdb / samdb / ldb_modules / objectclass_attrs.c
blobcfacaf56420a3ae2981992ba820d8928ac576610
1 /*
2 ldb database library
3
4 Copyright (C) Simo Sorce 2006-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
6 Copyright (C) Stefan Metzmacher 2009
7 Copyright (C) Matthias Dieter Wallnöfer 2010
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU Lesser General Public
20 License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 */
22
23 /*
24 * Name: ldb
25 *
26 * Component: objectclass attribute checking module
27 *
28 * Description: this checks the attributes on a directory entry (if they're
29 * allowed, if the syntax is correct, if mandatory ones are missing,
30 * denies the deletion of mandatory ones...). The module contains portions
31 * of the "objectclass" and the "validate_update" LDB module.
32 *
33 * Author: Matthias Dieter Wallnöfer
34 */
35
36 #include "includes.h"
37 #include "ldb_module.h"
38 #include "dsdb/samdb/samdb.h"
39 #include "dsdb/samdb/ldb_modules/util.h"
40
41 struct oc_context {
42
43 struct ldb_module *module;
44 struct ldb_request *req;
45 const struct dsdb_schema *schema;
46
47 struct ldb_message *msg;
48
49 struct ldb_reply *search_res;
50 struct ldb_reply *mod_ares;
51 };
52
53 static struct oc_context *oc_init_context(struct ldb_module *module,
54 struct ldb_request *req)
55 {
56 struct ldb_context *ldb;
57 struct oc_context *ac;
58
59 ldb = ldb_module_get_ctx(module);
60
61 ac = talloc_zero(req, struct oc_context);
62 if (ac == NULL) {
63 ldb_oom(ldb);
64 return NULL;
65 }
66
67 ac->module = module;
68 ac->req = req;
69 ac->schema = dsdb_get_schema(ldb, ac);
70
71 return ac;
72 }
73
74 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares);
75
76 /*
77 * Checks the correctness of the "dSHeuristics" attribute as described in both
78 * MS-ADTS 7.1.1.2.4.1.2 dSHeuristics and MS-ADTS 3.1.1.5.3.2 Constraints
79 */
80 static int oc_validate_dsheuristics(struct ldb_message_element *el)
81 {
82 if (el->num_values > 0) {
83 if ((el->values[0].length >= DS_HR_NINETIETH_CHAR) &&
84 (el->values[0].data[DS_HR_NINETIETH_CHAR-1] != '9')) {
85 return LDB_ERR_CONSTRAINT_VIOLATION;
86 }
87 if ((el->values[0].length >= DS_HR_EIGHTIETH_CHAR) &&
88 (el->values[0].data[DS_HR_EIGHTIETH_CHAR-1] != '8')) {
89 return LDB_ERR_CONSTRAINT_VIOLATION;
90 }
91 if ((el->values[0].length >= DS_HR_SEVENTIETH_CHAR) &&
92 (el->values[0].data[DS_HR_SEVENTIETH_CHAR-1] != '7')) {
93 return LDB_ERR_CONSTRAINT_VIOLATION;
94 }
95 if ((el->values[0].length >= DS_HR_SIXTIETH_CHAR) &&
96 (el->values[0].data[DS_HR_SIXTIETH_CHAR-1] != '6')) {
97 return LDB_ERR_CONSTRAINT_VIOLATION;
98 }
99 if ((el->values[0].length >= DS_HR_FIFTIETH_CHAR) &&
100 (el->values[0].data[DS_HR_FIFTIETH_CHAR-1] != '5')) {
101 return LDB_ERR_CONSTRAINT_VIOLATION;
102 }
103 if ((el->values[0].length >= DS_HR_FOURTIETH_CHAR) &&
104 (el->values[0].data[DS_HR_FOURTIETH_CHAR-1] != '4')) {
105 return LDB_ERR_CONSTRAINT_VIOLATION;
106 }
107 if ((el->values[0].length >= DS_HR_THIRTIETH_CHAR) &&
108 (el->values[0].data[DS_HR_THIRTIETH_CHAR-1] != '3')) {
109 return LDB_ERR_CONSTRAINT_VIOLATION;
110 }
111 if ((el->values[0].length >= DS_HR_TWENTIETH_CHAR) &&
112 (el->values[0].data[DS_HR_TWENTIETH_CHAR-1] != '2')) {
113 return LDB_ERR_CONSTRAINT_VIOLATION;
114 }
115 if ((el->values[0].length >= DS_HR_TENTH_CHAR) &&
116 (el->values[0].data[DS_HR_TENTH_CHAR-1] != '1')) {
117 return LDB_ERR_CONSTRAINT_VIOLATION;
118 }
119 }
120
121 return LDB_SUCCESS;
122 }
123
124 /*
125 auto normalise values on input
126 */
127 static int oc_auto_normalise(struct ldb_context *ldb, const struct dsdb_attribute *attr,
128 struct ldb_message *msg, struct ldb_message_element *el)
129 {
130 int i;
131 bool values_copied = false;
132
133 for (i=0; i<el->num_values; i++) {
134 struct ldb_val v;
135 int ret;
136 ret = attr->ldb_schema_attribute->syntax->canonicalise_fn(ldb, el->values, &el->values[i], &v);
137 if (ret != LDB_SUCCESS) {
138 return ret;
139 }
140 if (data_blob_cmp(&v, &el->values[i]) == 0) {
141 /* no need to replace it */
142 talloc_free(v.data);
143 continue;
144 }
145
146 /* we need to copy the values array on the first change */
147 if (!values_copied) {
148 struct ldb_val *v2;
149 v2 = talloc_array(msg->elements, struct ldb_val, el->num_values);
150 if (v2 == NULL) {
151 return ldb_oom(ldb);
152 }
153 memcpy(v2, el->values, sizeof(struct ldb_val) * el->num_values);
154 el->values = v2;
155 values_copied = true;
156 }
157
158 el->values[i] = v;
159 }
160 return LDB_SUCCESS;
161 }
162
163 static int attr_handler(struct oc_context *ac)
164 {
165 struct ldb_context *ldb;
166 struct ldb_message *msg;
167 struct ldb_request *child_req;
168 const struct dsdb_attribute *attr;
169 unsigned int i;
170 int ret;
171 WERROR werr;
172 struct dsdb_syntax_ctx syntax_ctx;
173
174 ldb = ldb_module_get_ctx(ac->module);
175
176 if (ac->req->operation == LDB_ADD) {
177 msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
178 } else {
179 msg = ldb_msg_copy_shallow(ac, ac->req->op.mod.message);
180 }
181 if (msg == NULL) {
182 return ldb_oom(ldb);
183 }
184 ac->msg = msg;
185
186 /* initialize syntax checking context */
187 dsdb_syntax_ctx_init(&syntax_ctx, ldb, ac->schema);
188
189 /* Check if attributes exist in the schema, if the values match,
190 * if they're not operational and fix the names to the match the schema
191 * case */
192 for (i = 0; i < msg->num_elements; i++) {
193 attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
194 msg->elements[i].name);
195 if (attr == NULL) {
196 if (ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK) &&
197 ac->req->operation != LDB_ADD) {
198 /* we allow this for dbcheck to fix
199 broken attributes */
200 goto no_attribute;
201 }
202 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' was not found in the schema!",
203 msg->elements[i].name,
204 ldb_dn_get_linearized(msg->dn));
205 return LDB_ERR_NO_SUCH_ATTRIBUTE;
206 }
207
208 if ((attr->linkID & 1) == 1 &&
209 !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
210 !ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK)) {
211 /* Odd is for the target. Illegal to modify */
212 ldb_asprintf_errstring(ldb,
213 "objectclass_attrs: attribute '%s' on entry '%s' must not be modified directly, it is a linked attribute",
214 msg->elements[i].name,
215 ldb_dn_get_linearized(msg->dn));
216 return LDB_ERR_UNWILLING_TO_PERFORM;
217 }
218
219 /*
220 * Enforce systemOnly checks from [ADTS] 3.1.1.5.3.2
221 * Constraints in Modify Operation
222 */
223 if (ac->req->operation == LDB_MODIFY && attr->systemOnly) {
224 /*
225 * Allow dbcheck and relax to bypass. objectClass, name
226 * and distinguishedName are generally handled
227 * elsewhere.
228 *
229 * The remaining cases, undelete, msDS-AdditionalDnsHostName
230 * and wellKnownObjects are documented in the specification.
231 */
232 if (!ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
233 !ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK) &&
234 !ldb_request_get_control(ac->req, DSDB_CONTROL_RESTORE_TOMBSTONE_OID) &&
235 ldb_attr_cmp(attr->lDAPDisplayName, "objectClass") != 0 &&
236 ldb_attr_cmp(attr->lDAPDisplayName, "name") != 0 &&
237 ldb_attr_cmp(attr->lDAPDisplayName, "distinguishedName") != 0 &&
238 ldb_attr_cmp(attr->lDAPDisplayName, "msDS-AdditionalDnsHostName") != 0 &&
239 ldb_attr_cmp(attr->lDAPDisplayName, "wellKnownObjects") != 0) {
240 /*
241 * Comparison against base schema DN is used as a substitute for
242 * fschemaUpgradeInProgress and other specific schema checks.
243 */
244 if (ldb_dn_compare_base(ldb_get_schema_basedn(ldb), msg->dn) != 0) {
245 struct ldb_control *as_system = ldb_request_get_control(ac->req,
246 LDB_CONTROL_AS_SYSTEM_OID);
247 if (!dsdb_module_am_system(ac->module) && !as_system) {
248 ldb_asprintf_errstring(ldb,
249 "objectclass_attrs: attribute '%s' on entry '%s' must can only be modified as system",
250 msg->elements[i].name,
251 ldb_dn_get_linearized(msg->dn));
252 return LDB_ERR_CONSTRAINT_VIOLATION;
253 }
254 }
255 }
256 }
257
258 if (!(msg->elements[i].flags & LDB_FLAG_INTERNAL_DISABLE_VALIDATION)) {
259 werr = attr->syntax->validate_ldb(&syntax_ctx, attr,
260 &msg->elements[i]);
261 if (!W_ERROR_IS_OK(werr) &&
262 !ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK)) {
263 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' contains at least one invalid value!",
264 msg->elements[i].name,
265 ldb_dn_get_linearized(msg->dn));
266 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
267 }
268 }
269
270 if ((attr->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED) != 0) {
271 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' is constructed!",
272 msg->elements[i].name,
273 ldb_dn_get_linearized(msg->dn));
274 if (ac->req->operation == LDB_ADD) {
275 return LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE;
276 } else {
277 return LDB_ERR_CONSTRAINT_VIOLATION;
278 }
279 }
280
281 /* "dSHeuristics" syntax check */
282 if (ldb_attr_cmp(attr->lDAPDisplayName, "dSHeuristics") == 0) {
283 ret = oc_validate_dsheuristics(&(msg->elements[i]));
284 if (ret != LDB_SUCCESS) {
285 return ret;
286 }
287 }
288
289 /* auto normalise some attribute values */
290 if (attr->syntax->auto_normalise) {
291 ret = oc_auto_normalise(ldb, attr, msg, &msg->elements[i]);
292 if (ret != LDB_SUCCESS) {
293 return ret;
294 }
295 }
296
297 /* Substitute the attribute name to match in case */
298 msg->elements[i].name = attr->lDAPDisplayName;
299 }
300
301 no_attribute:
302 if (ac->req->operation == LDB_ADD) {
303 ret = ldb_build_add_req(&child_req, ldb, ac,
304 msg, ac->req->controls,
305 ac, oc_op_callback, ac->req);
306 LDB_REQ_SET_LOCATION(child_req);
307 } else {
308 ret = ldb_build_mod_req(&child_req, ldb, ac,
309 msg, ac->req->controls,
310 ac, oc_op_callback, ac->req);
311 LDB_REQ_SET_LOCATION(child_req);
312 }
313 if (ret != LDB_SUCCESS) {
314 return ret;
315 }
316
317 return ldb_next_request(ac->module, child_req);
318 }
319
320 /*
321 these are attributes which are left over from old ways of doing
322 things in ldb, and are harmless
323 */
324 static const char *harmless_attrs[] = { "parentGUID", NULL };
325
326 static int attr_handler2(struct oc_context *ac)
327 {
328 struct ldb_context *ldb;
329 struct ldb_message_element *oc_element;
330 struct ldb_message *msg;
331 const char **must_contain, **may_contain, **found_must_contain;
332 /* There exists a hardcoded delete-protected attributes list in AD */
333 const char *del_prot_attributes[] = { "nTSecurityDescriptor",
334 "objectSid", "sAMAccountType", "sAMAccountName", "groupType",
335 "primaryGroupID", "userAccountControl", "accountExpires",
336 "badPasswordTime", "badPwdCount", "codePage", "countryCode",
337 "lastLogoff", "lastLogon", "logonCount", "pwdLastSet", NULL },
338 **l;
339 const struct dsdb_attribute *attr;
340 unsigned int i;
341 bool found;
342 bool isSchemaAttr = false;
343
344 ldb = ldb_module_get_ctx(ac->module);
345
346 if (ac->search_res == NULL) {
347 return ldb_operr(ldb);
348 }
349
350 /* We rely here on the preceeding "objectclass" LDB module which did
351 * already fix up the objectclass list (inheritance, order...). */
352 oc_element = ldb_msg_find_element(ac->search_res->message,
353 "objectClass");
354 if (oc_element == NULL) {
355 return ldb_operr(ldb);
356 }
357
358 /* LSA-specific object classes are not allowed to be created over LDAP,
359 * so we need to tell if this connection is internal (trusted) or not
360 * (untrusted).
361 *
362 * Hongwei Sun from Microsoft explains:
363 * The constraint in 3.1.1.5.2.2 MS-ADTS means that LSA objects cannot
364 * be added or modified through the LDAP interface, instead they can
365 * only be handled through LSA Policy API. This is also explained in
366 * 7.1.6.9.7 MS-ADTS as follows:
367 * "Despite being replicated normally between peer DCs in a domain,
368 * the process of creating or manipulating TDOs is specifically
369 * restricted to the LSA Policy APIs, as detailed in [MS-LSAD] section
370 * 3.1.1.5. Unlike other objects in the DS, TDOs may not be created or
371 * manipulated by client machines over the LDAPv3 transport."
372 */
373 for (i = 0; i < oc_element->num_values; i++) {
374 char * attname = (char *)oc_element->values[i].data;
375 if (ldb_req_is_untrusted(ac->req)) {
376 if (strcmp(attname, "secret") == 0 ||
377 strcmp(attname, "trustedDomain") == 0) {
378 ldb_asprintf_errstring(ldb, "objectclass_attrs: LSA objectclasses (entry '%s') cannot be created or changed over LDAP!",
379 ldb_dn_get_linearized(ac->search_res->message->dn));
380 return LDB_ERR_UNWILLING_TO_PERFORM;
381 }
382 }
383 if (strcmp(attname, "attributeSchema") == 0) {
384 isSchemaAttr = true;
385 }
386 }
387
388 must_contain = dsdb_full_attribute_list(ac, ac->schema, oc_element,
389 DSDB_SCHEMA_ALL_MUST);
390 may_contain = dsdb_full_attribute_list(ac, ac->schema, oc_element,
391 DSDB_SCHEMA_ALL_MAY);
392 found_must_contain = const_str_list(str_list_copy(ac, must_contain));
393 if ((must_contain == NULL) || (may_contain == NULL)
394 || (found_must_contain == NULL)) {
395 return ldb_operr(ldb);
396 }
397
398 /* Check the delete-protected attributes list */
399 msg = ac->search_res->message;
400 for (l = del_prot_attributes; *l != NULL; l++) {
401 struct ldb_message_element *el;
402
403 el = ldb_msg_find_element(ac->msg, *l);
404 if (el == NULL) {
405 /*
406 * It was not specified in the add or modify,
407 * so it doesn't need to be in the stored record
408 */
409 continue;
410 }
411
412 found = str_list_check_ci(must_contain, *l);
413 if (!found) {
414 found = str_list_check_ci(may_contain, *l);
415 }
416 if (found && (ldb_msg_find_element(msg, *l) == NULL)) {
417 ldb_asprintf_errstring(ldb, "objectclass_attrs: delete protected attribute '%s' on entry '%s' missing!",
418 *l,
419 ldb_dn_get_linearized(msg->dn));
420 return LDB_ERR_UNWILLING_TO_PERFORM;
421 }
422 }
423
424 /* Check if all specified attributes are valid in the given
425 * objectclasses and if they meet additional schema restrictions. */
426 for (i = 0; i < msg->num_elements; i++) {
427 attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
428 msg->elements[i].name);
429 if (attr == NULL) {
430 if (ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK)) {
431 /* allow this to make it possible for dbcheck
432 to remove bad attributes */
433 continue;
434 }
435 return ldb_operr(ldb);
436 }
437
438 /* We can use "str_list_check" with "strcmp" here since the
439 * attribute information from the schema are always equal
440 * up-down-cased. */
441 found = str_list_check(must_contain, attr->lDAPDisplayName);
442 if (found) {
443 str_list_remove(found_must_contain, attr->lDAPDisplayName);
444 } else {
445 found = str_list_check(may_contain, attr->lDAPDisplayName);
446 }
447 if (!found) {
448 found = str_list_check(harmless_attrs, attr->lDAPDisplayName);
449 }
450 if (!found) {
451 /* we allow this for dbcheck to fix the rest of this broken entry */
452 if (!ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK) ||
453 ac->req->operation == LDB_ADD) {
454 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' does not exist in the specified objectclasses!",
455 msg->elements[i].name,
456 ldb_dn_get_linearized(msg->dn));
457 return LDB_ERR_OBJECT_CLASS_VIOLATION;
458 }
459 }
460 }
461
462 /*
463 * We skip this check under dbcheck to allow fixing of other
464 * attributes even if an attribute is missing. This matters
465 * for CN=RID Set as the required attribute rIDNextRid is not
466 * replicated.
467 */
468 if (found_must_contain[0] != NULL &&
469 ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE") == 0) {
470
471 for (i = 0; found_must_contain[i] != NULL; i++) {
472 const struct dsdb_attribute *broken_attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
473 found_must_contain[i]);
474
475 bool replicated = (broken_attr->systemFlags &
476 (DS_FLAG_ATTR_NOT_REPLICATED | DS_FLAG_ATTR_IS_CONSTRUCTED)) == 0;
477
478 if (replicated) {
479 ldb_asprintf_errstring(ldb, "objectclass_attrs: at least one mandatory "
480 "attribute ('%s') on entry '%s' wasn't specified!",
481 found_must_contain[i],
482 ldb_dn_get_linearized(msg->dn));
483 return LDB_ERR_OBJECT_CLASS_VIOLATION;
484 }
485 }
486 }
487
488 if (isSchemaAttr) {
489 /*
490 * Before really adding an attribute in the database,
491 * let's check that we can translate it into a dsdb_attribute and
492 * that we can find a valid syntax object.
493 * If not it's better to reject this attribute than not be able
494 * to start samba next time due to schema being unloadable.
495 */
496 struct dsdb_attribute *att = talloc(ac, struct dsdb_attribute);
497 const struct dsdb_syntax *attrSyntax;
498 WERROR status;
499
500 status = dsdb_attribute_from_ldb(NULL, msg, att);
501 if (!W_ERROR_IS_OK(status)) {
502 ldb_set_errstring(ldb,
503 "objectclass: failed to translate the schemaAttribute to a dsdb_attribute");
504 return LDB_ERR_UNWILLING_TO_PERFORM;
505 }
506
507 attrSyntax = dsdb_syntax_for_attribute(att);
508 if (!attrSyntax) {
509 ldb_set_errstring(ldb,
510 "objectclass: unknown attribute syntax");
511 return LDB_ERR_UNWILLING_TO_PERFORM;
512 }
513 }
514 return ldb_module_done(ac->req, ac->mod_ares->controls,
515 ac->mod_ares->response, LDB_SUCCESS);
516 }
517
518 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
519 {
520 struct ldb_context *ldb;
521 struct oc_context *ac;
522 int ret;
523
524 ac = talloc_get_type(req->context, struct oc_context);
525 ldb = ldb_module_get_ctx(ac->module);
526
527 if (!ares) {
528 return ldb_module_done(ac->req, NULL, NULL,
529 LDB_ERR_OPERATIONS_ERROR);
530 }
531 if (ares->error != LDB_SUCCESS) {
532 return ldb_module_done(ac->req, ares->controls,
533 ares->response, ares->error);
534 }
535
536 ldb_reset_err_string(ldb);
537
538 switch (ares->type) {
539 case LDB_REPLY_ENTRY:
540 if (ac->search_res != NULL) {
541 ldb_set_errstring(ldb, "Too many results");
542 talloc_free(ares);
543 return ldb_module_done(ac->req, NULL, NULL,
544 LDB_ERR_OPERATIONS_ERROR);
545 }
546
547 ac->search_res = talloc_steal(ac, ares);
548 break;
549
550 case LDB_REPLY_REFERRAL:
551 /* ignore */
552 talloc_free(ares);
553 break;
554
555 case LDB_REPLY_DONE:
556 talloc_free(ares);
557 ret = attr_handler2(ac);
558 if (ret != LDB_SUCCESS) {
559 return ldb_module_done(ac->req, NULL, NULL, ret);
560 }
561 break;
562 }
563
564 return LDB_SUCCESS;
565 }
566
567 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
568 {
569 struct oc_context *ac;
570 struct ldb_context *ldb;
571 struct ldb_request *search_req;
572 struct ldb_dn *base_dn;
573 int ret;
574 static const char *attrs[] = {"nTSecurityDescriptor", "*", NULL};
575
576 ac = talloc_get_type(req->context, struct oc_context);
577 ldb = ldb_module_get_ctx(ac->module);
578
579 if (!ares) {
580 return ldb_module_done(ac->req, NULL, NULL,
581 LDB_ERR_OPERATIONS_ERROR);
582 }
583
584 if (ares->type == LDB_REPLY_REFERRAL) {
585 return ldb_module_send_referral(ac->req, ares->referral);
586 }
587
588 if (ares->error != LDB_SUCCESS) {
589 return ldb_module_done(ac->req, ares->controls, ares->response,
590 ares->error);
591 }
592
593 if (ares->type != LDB_REPLY_DONE) {
594 talloc_free(ares);
595 return ldb_module_done(ac->req, NULL, NULL,
596 LDB_ERR_OPERATIONS_ERROR);
597 }
598
599 ac->search_res = NULL;
600 ac->mod_ares = talloc_steal(ac, ares);
601
602 /* This looks up all attributes of our just added/modified entry */
603 base_dn = ac->req->operation == LDB_ADD ? ac->req->op.add.message->dn
604 : ac->req->op.mod.message->dn;
605 ret = ldb_build_search_req(&search_req, ldb, ac, base_dn,
606 LDB_SCOPE_BASE, "(objectClass=*)",
607 attrs, NULL, ac,
608 get_search_callback, ac->req);
609 LDB_REQ_SET_LOCATION(search_req);
610 if (ret != LDB_SUCCESS) {
611 return ldb_module_done(ac->req, NULL, NULL, ret);
612 }
613
614 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
615 true, NULL);
616 if (ret != LDB_SUCCESS) {
617 return ldb_module_done(ac->req, NULL, NULL, ret);
618 }
619
620 ret = ldb_next_request(ac->module, search_req);
621 if (ret != LDB_SUCCESS) {
622 return ldb_module_done(ac->req, NULL, NULL, ret);
623 }
624
625 /* "ldb_module_done" isn't called here since we need to do additional
626 * checks. It is called at the end of "attr_handler2". */
627 return LDB_SUCCESS;
628 }
629
630 static int objectclass_attrs_add(struct ldb_module *module,
631 struct ldb_request *req)
632 {
633 struct ldb_context *ldb;
634 struct oc_context *ac;
635
636 ldb = ldb_module_get_ctx(module);
637
638 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_attrs_add\n");
639
640 /* do not manipulate our control entries */
641 if (ldb_dn_is_special(req->op.add.message->dn)) {
642 return ldb_next_request(module, req);
643 }
644
645 ac = oc_init_context(module, req);
646 if (ac == NULL) {
647 return ldb_operr(ldb);
648 }
649
650 /* without schema, there isn't much to do here */
651 if (ac->schema == NULL) {
652 talloc_free(ac);
653 return ldb_next_request(module, req);
654 }
655
656 return attr_handler(ac);
657 }
658
659 static int objectclass_attrs_modify(struct ldb_module *module,
660 struct ldb_request *req)
661 {
662 struct ldb_context *ldb;
663 struct ldb_control *sd_propagation_control;
664 int ret;
665
666 struct oc_context *ac;
667
668 ldb = ldb_module_get_ctx(module);
669
670 ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_attrs_modify\n");
671
672 /* do not manipulate our control entries */
673 if (ldb_dn_is_special(req->op.mod.message->dn)) {
674 return ldb_next_request(module, req);
675 }
676
677 sd_propagation_control = ldb_request_get_control(req,
678 DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
679 if (sd_propagation_control != NULL) {
680 if (req->op.mod.message->num_elements != 1) {
681 return ldb_module_operr(module);
682 }
683 ret = strcmp(req->op.mod.message->elements[0].name,
684 "nTSecurityDescriptor");
685 if (ret != 0) {
686 return ldb_module_operr(module);
687 }
688
689 return ldb_next_request(module, req);
690 }
691
692 ac = oc_init_context(module, req);
693 if (ac == NULL) {
694 return ldb_operr(ldb);
695 }
696
697 /* without schema, there isn't much to do here */
698 if (ac->schema == NULL) {
699 talloc_free(ac);
700 return ldb_next_request(module, req);
701 }
702
703 return attr_handler(ac);
704 }
705
706 static const struct ldb_module_ops ldb_objectclass_attrs_module_ops = {
707 .name = "objectclass_attrs",
708 .add = objectclass_attrs_add,
709 .modify = objectclass_attrs_modify
710 };
711
712 int ldb_objectclass_attrs_module_init(const char *version)
713 {
714 LDB_MODULE_CHECK_VERSION(version);
715 return ldb_register_module(&ldb_objectclass_attrs_module_ops);
716 }
Samba GIT mirror