2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher <metze@samba.org> 2006-2007
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2008
7 Copyright (C) Matthieu Patou <mat@matws.net> 2011
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "lib/util/dlinklist.h"
26 #include "dsdb/samdb/samdb.h"
27 #include <ldb_module.h>
28 #include "param/param.h"
29 #include "librpc/ndr/libndr.h"
30 #include "librpc/gen_ndr/ndr_misc.h"
31 #include "lib/util/tsort.h"
33 /* change this when we change something in our schema code that
34 * requires a re-index of the database
36 #define SAMDB_INDEXING_VERSION "3"
39 override the name to attribute handler function
41 const struct ldb_schema_attribute
*dsdb_attribute_handler_override(struct ldb_context
*ldb
,
45 struct dsdb_schema
*schema
= talloc_get_type_abort(private_data
, struct dsdb_schema
);
46 const struct dsdb_attribute
*a
= dsdb_attribute_by_lDAPDisplayName(schema
, name
);
48 /* this will fall back to ldb internal handling */
51 return a
->ldb_schema_attribute
;
55 * Set the attribute handlers onto the LDB, and potentially write the
56 * @INDEXLIST, @IDXONE and @ATTRIBUTES records. The @ATTRIBUTES records
57 * are required so we can operate on a schema-less database (say the
58 * backend during emergency fixes) and during the schema load.
60 int dsdb_schema_set_indices_and_attributes(struct ldb_context
*ldb
,
61 struct dsdb_schema
*schema
,
62 enum schema_set_enum mode
)
64 int ret
= LDB_SUCCESS
;
65 struct ldb_result
*res
;
66 struct ldb_result
*res_idx
;
67 struct dsdb_attribute
*attr
;
68 struct ldb_message
*mod_msg
;
70 struct ldb_message
*msg
;
71 struct ldb_message
*msg_idx
;
73 struct loadparm_context
*lp_ctx
=
74 talloc_get_type(ldb_get_opaque(ldb
, "loadparm"),
75 struct loadparm_context
);
76 bool guid_indexing
= true;
77 bool declare_ordered_integer_in_attributes
= true;
78 uint32_t pack_format_override
;
81 * GUID indexing is wanted by Samba by default. This allows
82 * an override in a specific case for downgrades.
84 guid_indexing
= lpcfg_parm_bool(lp_ctx
,
90 * If the pack format has been overridden to a previous
91 * version, then act like ORDERED_INTEGER doesn't exist,
92 * because it's a new type and we don't want to deal with
93 * possible issues with databases containing version 1 pack
94 * format and ordered types.
96 * This approach means that the @ATTRIBUTES will be
97 * incorrect for integers. Many other @ATTRIBUTES
98 * values are gross simplifications, but the presence
99 * of the ORDERED_INTEGER keyword prevents the old
100 * Samba from starting and then forcing a reindex.
102 * It is too difficult to override the actual index
103 * formatter, but this doesn't matter in practice.
105 pack_format_override
=
106 (intptr_t)ldb_get_opaque(ldb
, "pack_format_override");
107 if (pack_format_override
== LDB_PACKING_FORMAT
||
108 pack_format_override
== LDB_PACKING_FORMAT_NODN
) {
109 declare_ordered_integer_in_attributes
= false;
112 /* setup our own attribute name to schema handler */
113 ldb_schema_attribute_set_override_handler(ldb
, dsdb_attribute_handler_override
, schema
);
114 ldb_schema_set_override_indexlist(ldb
, true);
116 ldb_schema_set_override_GUID_index(ldb
, "objectGUID", "GUID");
119 if (mode
== SCHEMA_MEMORY_ONLY
) {
123 mem_ctx
= talloc_new(ldb
);
128 msg
= ldb_msg_new(mem_ctx
);
133 msg_idx
= ldb_msg_new(mem_ctx
);
138 msg
->dn
= ldb_dn_new(msg
, ldb
, "@ATTRIBUTES");
143 msg_idx
->dn
= ldb_dn_new(msg_idx
, ldb
, "@INDEXLIST");
149 ret
= ldb_msg_add_string(msg_idx
, "@IDXONE", "1");
150 if (ret
!= LDB_SUCCESS
) {
155 ret
= ldb_msg_add_string(msg_idx
, "@IDXGUID", "objectGUID");
156 if (ret
!= LDB_SUCCESS
) {
160 ret
= ldb_msg_add_string(msg_idx
, "@IDX_DN_GUID", "GUID");
161 if (ret
!= LDB_SUCCESS
) {
166 ret
= ldb_msg_add_string(msg_idx
, "@SAMDB_INDEXING_VERSION", SAMDB_INDEXING_VERSION
);
167 if (ret
!= LDB_SUCCESS
) {
171 ret
= ldb_msg_add_string(msg_idx
, SAMBA_FEATURES_SUPPORTED_FLAG
, "1");
172 if (ret
!= LDB_SUCCESS
) {
176 for (attr
= schema
->attributes
; attr
; attr
= attr
->next
) {
177 const char *syntax
= attr
->syntax
->ldb_syntax
;
180 syntax
= attr
->syntax
->ldap_oid
;
184 * Write out a rough approximation of the schema
185 * as an @ATTRIBUTES value, for bootstrapping.
186 * Only write ORDERED_INTEGER if we're using GUID indexes,
188 if (strcmp(syntax
, LDB_SYNTAX_INTEGER
) == 0) {
189 ret
= ldb_msg_add_string(msg
, attr
->lDAPDisplayName
, "INTEGER");
190 } else if (strcmp(syntax
, LDB_SYNTAX_ORDERED_INTEGER
) == 0) {
191 if (declare_ordered_integer_in_attributes
&&
194 * The normal production case
196 ret
= ldb_msg_add_string(msg
,
197 attr
->lDAPDisplayName
,
201 * For this mode, we are going back to
202 * before GUID indexing so we write it out
205 * Down in LDB, the special handler
206 * (index_format_fn) that made
207 * ORDERED_INTEGER and INTEGER
208 * different has been disabled.
210 ret
= ldb_msg_add_string(msg
,
211 attr
->lDAPDisplayName
,
214 } else if (strcmp(syntax
, LDB_SYNTAX_DIRECTORY_STRING
) == 0) {
215 ret
= ldb_msg_add_string(msg
, attr
->lDAPDisplayName
,
218 if (ret
!= LDB_SUCCESS
) {
222 if (attr
->searchFlags
& SEARCH_FLAG_ATTINDEX
) {
224 * When preparing to downgrade Samba, we need to write
225 * out an LDB without the new key word ORDERED_INTEGER.
227 if (strcmp(syntax
, LDB_SYNTAX_ORDERED_INTEGER
) == 0
228 && !declare_ordered_integer_in_attributes
) {
230 * Ugly, but do nothing, the best
231 * thing is to omit the reference
232 * entirely, the next transaction will
233 * spot this and rewrite everything.
235 * This way nothing will look at the
236 * index for this attribute until
237 * Samba starts and this is all
241 ret
= ldb_msg_add_string(msg_idx
, "@IDXATTR", attr
->lDAPDisplayName
);
242 if (ret
!= LDB_SUCCESS
) {
249 if (ret
!= LDB_SUCCESS
) {
250 talloc_free(mem_ctx
);
255 * Try to avoid churning the attributes too much,
256 * we only want to do this if they have changed
258 ret
= ldb_search(ldb
, mem_ctx
, &res
, msg
->dn
, LDB_SCOPE_BASE
, NULL
,
260 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
261 if (mode
== SCHEMA_COMPARE
) {
262 /* We are probably not in a transaction */
265 ret
= ldb_add(ldb
, msg
);
266 } else if (ret
!= LDB_SUCCESS
) {
267 } else if (res
->count
!= 1) {
268 if (mode
== SCHEMA_COMPARE
) {
269 /* We are probably not in a transaction */
272 ret
= ldb_add(ldb
, msg
);
274 /* Annoyingly added to our search results */
275 ldb_msg_remove_attr(res
->msgs
[0], "distinguishedName");
277 ret
= ldb_msg_difference(ldb
, mem_ctx
,
278 res
->msgs
[0], msg
, &mod_msg
);
279 if (ret
!= LDB_SUCCESS
) {
282 if (mod_msg
->num_elements
> 0) {
284 * Do the replace with the difference, as we
285 * are under the read lock and we wish to do a
286 * delete of any removed/renamed attributes
288 if (mode
== SCHEMA_COMPARE
) {
289 /* We are probably not in a transaction */
292 ret
= dsdb_modify(ldb
, mod_msg
, 0);
294 talloc_free(mod_msg
);
297 if (ret
== LDB_ERR_OPERATIONS_ERROR
|| ret
== LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
|| ret
== LDB_ERR_INVALID_DN_SYNTAX
) {
298 /* We might be on a read-only DB or LDAP */
301 if (ret
!= LDB_SUCCESS
) {
302 DBG_ERR("Failed to set schema into @ATTRIBUTES: %s\n",
304 talloc_free(mem_ctx
);
308 /* Now write out the indexes, as found in the schema (if they have changed) */
310 ret
= ldb_search(ldb
, mem_ctx
, &res_idx
, msg_idx
->dn
, LDB_SCOPE_BASE
,
312 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
313 if (mode
== SCHEMA_COMPARE
) {
314 /* We are probably not in a transaction */
317 ret
= ldb_add(ldb
, msg_idx
);
318 } else if (ret
!= LDB_SUCCESS
) {
319 } else if (res_idx
->count
!= 1) {
320 if (mode
== SCHEMA_COMPARE
) {
321 /* We are probably not in a transaction */
324 ret
= ldb_add(ldb
, msg_idx
);
326 /* Annoyingly added to our search results */
327 ldb_msg_remove_attr(res_idx
->msgs
[0], "distinguishedName");
329 ret
= ldb_msg_difference(ldb
, mem_ctx
,
330 res_idx
->msgs
[0], msg_idx
, &mod_msg
);
331 if (ret
!= LDB_SUCCESS
) {
336 * We don't want to re-index just because we didn't
339 * DO NOT backport this logic earlier than 4.7, it
340 * isn't needed and would be dangerous before 4.6,
341 * where we add logic to samba_dsdb to manage
342 * @SAMBA_FEATURES_SUPPORTED and need to know if the
343 * DB has been re-opened by an earlier version.
347 if (mod_msg
->num_elements
== 1
348 && ldb_attr_cmp(mod_msg
->elements
[0].name
,
349 SAMBA_FEATURES_SUPPORTED_FLAG
) == 0) {
352 * @SAMBA_FEATURES_SUPPORTED
354 } else if (mod_msg
->num_elements
> 0) {
357 * Do the replace with the difference, as we
358 * are under the read lock and we wish to do a
359 * delete of any removed/renamed attributes
361 if (mode
== SCHEMA_COMPARE
) {
362 /* We are probably not in a transaction */
365 ret
= dsdb_modify(ldb
, mod_msg
, 0);
367 talloc_free(mod_msg
);
369 if (ret
== LDB_ERR_OPERATIONS_ERROR
|| ret
== LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
|| ret
== LDB_ERR_INVALID_DN_SYNTAX
) {
370 /* We might be on a read-only DB */
374 if (ret
!= LDB_SUCCESS
) {
375 DBG_ERR("Failed to set schema into @INDEXLIST: %s\n",
379 talloc_free(mem_ctx
);
383 talloc_free(mem_ctx
);
384 return ldb_operr(ldb
);
387 talloc_free(mem_ctx
);
393 create extra attribute shortcuts
395 static void dsdb_setup_attribute_shortcuts(struct ldb_context
*ldb
, struct dsdb_schema
*schema
)
397 struct dsdb_attribute
*attribute
;
399 /* setup fast access to one_way_link and DN format */
400 for (attribute
=schema
->attributes
; attribute
; attribute
=attribute
->next
) {
401 attribute
->dn_format
= dsdb_dn_oid_to_format(attribute
->syntax
->ldap_oid
);
403 if (attribute
->dn_format
== DSDB_INVALID_DN
) {
404 attribute
->one_way_link
= false;
408 /* these are not considered to be one way links for
409 the purpose of DN link fixups */
410 if (ldb_attr_cmp("distinguishedName", attribute
->lDAPDisplayName
) == 0 ||
411 ldb_attr_cmp("objectCategory", attribute
->lDAPDisplayName
) == 0) {
412 attribute
->one_way_link
= false;
416 if (attribute
->linkID
== 0) {
417 attribute
->one_way_link
= true;
420 /* handle attributes with a linkID but no backlink */
421 if ((attribute
->linkID
& 1) == 0 &&
422 dsdb_attribute_by_linkID(schema
, attribute
->linkID
+ 1) == NULL
) {
423 attribute
->one_way_link
= true;
426 attribute
->one_way_link
= false;
430 static int uint32_cmp(uint32_t c1
, uint32_t c2
)
432 if (c1
== c2
) return 0;
433 return c1
> c2
? 1 : -1;
436 static int dsdb_compare_class_by_lDAPDisplayName(struct dsdb_class
**c1
, struct dsdb_class
**c2
)
438 return strcasecmp((*c1
)->lDAPDisplayName
, (*c2
)->lDAPDisplayName
);
440 static int dsdb_compare_class_by_governsID_id(struct dsdb_class
**c1
, struct dsdb_class
**c2
)
442 return uint32_cmp((*c1
)->governsID_id
, (*c2
)->governsID_id
);
444 static int dsdb_compare_class_by_governsID_oid(struct dsdb_class
**c1
, struct dsdb_class
**c2
)
446 return strcasecmp((*c1
)->governsID_oid
, (*c2
)->governsID_oid
);
448 static int dsdb_compare_class_by_cn(struct dsdb_class
**c1
, struct dsdb_class
**c2
)
450 return strcasecmp((*c1
)->cn
, (*c2
)->cn
);
453 static int dsdb_compare_attribute_by_lDAPDisplayName(struct dsdb_attribute
**a1
, struct dsdb_attribute
**a2
)
455 return strcasecmp((*a1
)->lDAPDisplayName
, (*a2
)->lDAPDisplayName
);
457 static int dsdb_compare_attribute_by_attributeID_id(struct dsdb_attribute
**a1
, struct dsdb_attribute
**a2
)
459 return uint32_cmp((*a1
)->attributeID_id
, (*a2
)->attributeID_id
);
461 static int dsdb_compare_attribute_by_msDS_IntId(struct dsdb_attribute
**a1
, struct dsdb_attribute
**a2
)
463 return uint32_cmp((*a1
)->msDS_IntId
, (*a2
)->msDS_IntId
);
465 static int dsdb_compare_attribute_by_attributeID_oid(struct dsdb_attribute
**a1
, struct dsdb_attribute
**a2
)
467 return strcasecmp((*a1
)->attributeID_oid
, (*a2
)->attributeID_oid
);
469 static int dsdb_compare_attribute_by_linkID(struct dsdb_attribute
**a1
, struct dsdb_attribute
**a2
)
471 return uint32_cmp((*a1
)->linkID
, (*a2
)->linkID
);
475 * Clean up Classes and Attributes accessor arrays
477 static void dsdb_sorted_accessors_free(struct dsdb_schema
*schema
)
479 /* free classes accessors */
480 TALLOC_FREE(schema
->classes_by_lDAPDisplayName
);
481 TALLOC_FREE(schema
->classes_by_governsID_id
);
482 TALLOC_FREE(schema
->classes_by_governsID_oid
);
483 TALLOC_FREE(schema
->classes_by_cn
);
484 /* free attribute accessors */
485 TALLOC_FREE(schema
->attributes_by_lDAPDisplayName
);
486 TALLOC_FREE(schema
->attributes_by_attributeID_id
);
487 TALLOC_FREE(schema
->attributes_by_msDS_IntId
);
488 TALLOC_FREE(schema
->attributes_by_attributeID_oid
);
489 TALLOC_FREE(schema
->attributes_by_linkID
);
493 create the sorted accessor arrays for the schema
495 int dsdb_setup_sorted_accessors(struct ldb_context
*ldb
,
496 struct dsdb_schema
*schema
)
498 struct dsdb_class
*cur
;
499 struct dsdb_attribute
*a
;
501 unsigned int num_int_id
;
504 for (i
=0; i
< schema
->classes_to_remove_size
; i
++) {
505 DLIST_REMOVE(schema
->classes
, schema
->classes_to_remove
[i
]);
506 TALLOC_FREE(schema
->classes_to_remove
[i
]);
508 for (i
=0; i
< schema
->attributes_to_remove_size
; i
++) {
509 DLIST_REMOVE(schema
->attributes
, schema
->attributes_to_remove
[i
]);
510 TALLOC_FREE(schema
->attributes_to_remove
[i
]);
513 TALLOC_FREE(schema
->classes_to_remove
);
514 schema
->classes_to_remove_size
= 0;
515 TALLOC_FREE(schema
->attributes_to_remove
);
516 schema
->attributes_to_remove_size
= 0;
518 /* free all caches */
519 dsdb_sorted_accessors_free(schema
);
521 /* count the classes */
522 for (i
=0, cur
=schema
->classes
; cur
; i
++, cur
=cur
->next
) /* noop */ ;
523 schema
->num_classes
= i
;
525 /* setup classes_by_* */
526 schema
->classes_by_lDAPDisplayName
= talloc_array(schema
, struct dsdb_class
*, i
);
527 schema
->classes_by_governsID_id
= talloc_array(schema
, struct dsdb_class
*, i
);
528 schema
->classes_by_governsID_oid
= talloc_array(schema
, struct dsdb_class
*, i
);
529 schema
->classes_by_cn
= talloc_array(schema
, struct dsdb_class
*, i
);
530 if (schema
->classes_by_lDAPDisplayName
== NULL
||
531 schema
->classes_by_governsID_id
== NULL
||
532 schema
->classes_by_governsID_oid
== NULL
||
533 schema
->classes_by_cn
== NULL
) {
537 for (i
=0, cur
=schema
->classes
; cur
; i
++, cur
=cur
->next
) {
538 schema
->classes_by_lDAPDisplayName
[i
] = cur
;
539 schema
->classes_by_governsID_id
[i
] = cur
;
540 schema
->classes_by_governsID_oid
[i
] = cur
;
541 schema
->classes_by_cn
[i
] = cur
;
544 /* sort the arrays */
545 TYPESAFE_QSORT(schema
->classes_by_lDAPDisplayName
, schema
->num_classes
, dsdb_compare_class_by_lDAPDisplayName
);
546 TYPESAFE_QSORT(schema
->classes_by_governsID_id
, schema
->num_classes
, dsdb_compare_class_by_governsID_id
);
547 TYPESAFE_QSORT(schema
->classes_by_governsID_oid
, schema
->num_classes
, dsdb_compare_class_by_governsID_oid
);
548 TYPESAFE_QSORT(schema
->classes_by_cn
, schema
->num_classes
, dsdb_compare_class_by_cn
);
550 /* now build the attribute accessor arrays */
552 /* count the attributes
553 * and attributes with msDS-IntId set */
555 for (i
=0, a
=schema
->attributes
; a
; i
++, a
=a
->next
) {
556 if (a
->msDS_IntId
!= 0) {
560 schema
->num_attributes
= i
;
561 schema
->num_int_id_attr
= num_int_id
;
563 /* setup attributes_by_* */
564 schema
->attributes_by_lDAPDisplayName
= talloc_array(schema
, struct dsdb_attribute
*, i
);
565 schema
->attributes_by_attributeID_id
= talloc_array(schema
, struct dsdb_attribute
*, i
);
566 schema
->attributes_by_msDS_IntId
= talloc_array(schema
,
567 struct dsdb_attribute
*, num_int_id
);
568 schema
->attributes_by_attributeID_oid
= talloc_array(schema
, struct dsdb_attribute
*, i
);
569 schema
->attributes_by_linkID
= talloc_array(schema
, struct dsdb_attribute
*, i
);
570 if (schema
->attributes_by_lDAPDisplayName
== NULL
||
571 schema
->attributes_by_attributeID_id
== NULL
||
572 schema
->attributes_by_msDS_IntId
== NULL
||
573 schema
->attributes_by_attributeID_oid
== NULL
||
574 schema
->attributes_by_linkID
== NULL
) {
579 for (i
=0, a
=schema
->attributes
; a
; i
++, a
=a
->next
) {
580 schema
->attributes_by_lDAPDisplayName
[i
] = a
;
581 schema
->attributes_by_attributeID_id
[i
] = a
;
582 schema
->attributes_by_attributeID_oid
[i
] = a
;
583 schema
->attributes_by_linkID
[i
] = a
;
584 /* append attr-by-msDS-IntId values */
585 if (a
->msDS_IntId
!= 0) {
586 schema
->attributes_by_msDS_IntId
[num_int_id
] = a
;
590 SMB_ASSERT(num_int_id
== schema
->num_int_id_attr
);
592 /* sort the arrays */
593 TYPESAFE_QSORT(schema
->attributes_by_lDAPDisplayName
, schema
->num_attributes
, dsdb_compare_attribute_by_lDAPDisplayName
);
594 TYPESAFE_QSORT(schema
->attributes_by_attributeID_id
, schema
->num_attributes
, dsdb_compare_attribute_by_attributeID_id
);
595 TYPESAFE_QSORT(schema
->attributes_by_msDS_IntId
, schema
->num_int_id_attr
, dsdb_compare_attribute_by_msDS_IntId
);
596 TYPESAFE_QSORT(schema
->attributes_by_attributeID_oid
, schema
->num_attributes
, dsdb_compare_attribute_by_attributeID_oid
);
597 TYPESAFE_QSORT(schema
->attributes_by_linkID
, schema
->num_attributes
, dsdb_compare_attribute_by_linkID
);
599 dsdb_setup_attribute_shortcuts(ldb
, schema
);
601 ret
= schema_fill_constructed(schema
);
602 if (ret
!= LDB_SUCCESS
) {
603 dsdb_sorted_accessors_free(schema
);
610 dsdb_sorted_accessors_free(schema
);
615 * Attach the schema to an opaque pointer on the ldb,
616 * so ldb modules can find it
618 int dsdb_set_schema_refresh_function(struct ldb_context
*ldb
,
619 dsdb_schema_refresh_fn refresh_fn
,
620 struct ldb_module
*module
)
622 int ret
= ldb_set_opaque(ldb
, "dsdb_schema_refresh_fn", refresh_fn
);
623 if (ret
!= LDB_SUCCESS
) {
627 ret
= ldb_set_opaque(ldb
, "dsdb_schema_refresh_fn_private_data", module
);
628 if (ret
!= LDB_SUCCESS
) {
635 * Attach the schema to an opaque pointer on the ldb,
636 * so ldb modules can find it
638 int dsdb_set_schema(struct ldb_context
*ldb
,
639 struct dsdb_schema
*schema
,
640 enum schema_set_enum write_indices_and_attributes
)
642 struct dsdb_schema
*old_schema
;
645 ret
= dsdb_setup_sorted_accessors(ldb
, schema
);
646 if (ret
!= LDB_SUCCESS
) {
650 old_schema
= ldb_get_opaque(ldb
, "dsdb_schema");
652 ret
= ldb_set_opaque(ldb
, "dsdb_use_global_schema", NULL
);
653 if (ret
!= LDB_SUCCESS
) {
657 ret
= ldb_set_opaque(ldb
, "dsdb_schema", schema
);
658 if (ret
!= LDB_SUCCESS
) {
662 talloc_steal(ldb
, schema
);
664 /* Set the new attributes based on the new schema */
665 ret
= dsdb_schema_set_indices_and_attributes(ldb
, schema
,
666 write_indices_and_attributes
);
667 if (ret
!= LDB_SUCCESS
) {
672 * Remove the reference to the schema we just overwrote - if there was
673 * none, NULL is harmless here.
675 if (old_schema
!= schema
) {
676 talloc_unlink(ldb
, old_schema
);
683 * Global variable to hold one copy of the schema, used to avoid memory bloat
685 static struct dsdb_schema
*global_schema
;
688 * Make this ldb use a specified schema, already fully calculated and belonging to another ldb
690 * The write_indices_and_attributes controls writing of the @ records
691 * because we cannot write to a database that does not yet exist on
694 int dsdb_reference_schema(struct ldb_context
*ldb
, struct dsdb_schema
*schema
,
695 enum schema_set_enum write_indices_and_attributes
)
699 void *schema_parent
= NULL
;
700 bool is_already_parent
;
701 struct dsdb_schema
*old_schema
;
702 old_schema
= ldb_get_opaque(ldb
, "dsdb_schema");
703 ret
= ldb_set_opaque(ldb
, "dsdb_schema", schema
);
704 if (ret
!= LDB_SUCCESS
) {
708 /* Remove the reference to the schema we just overwrote - if there was
709 * none, NULL is harmless here */
710 talloc_unlink(ldb
, old_schema
);
712 /* Reference schema on ldb if it wasn't done already */
713 schema_parent
= talloc_parent(schema
);
714 is_already_parent
= (schema_parent
== ldb
);
715 if (!is_already_parent
) {
716 ptr
= talloc_reference(ldb
, schema
);
722 /* Make this ldb use local schema preferably */
723 ret
= ldb_set_opaque(ldb
, "dsdb_use_global_schema", NULL
);
724 if (ret
!= LDB_SUCCESS
) {
728 ret
= ldb_set_opaque(ldb
, "dsdb_refresh_fn", NULL
);
729 if (ret
!= LDB_SUCCESS
) {
733 ret
= ldb_set_opaque(ldb
, "dsdb_refresh_fn_private_data", NULL
);
734 if (ret
!= LDB_SUCCESS
) {
738 ret
= dsdb_schema_set_indices_and_attributes(ldb
, schema
, write_indices_and_attributes
);
739 if (ret
!= LDB_SUCCESS
) {
747 * Make this ldb use the 'global' schema, setup to avoid having multiple copies in this process
749 int dsdb_set_global_schema(struct ldb_context
*ldb
)
752 void *use_global_schema
= (void *)1;
754 struct dsdb_schema
*old_schema
= ldb_get_opaque(ldb
, "dsdb_schema");
756 ret
= ldb_set_opaque(ldb
, "dsdb_use_global_schema", use_global_schema
);
757 if (ret
!= LDB_SUCCESS
) {
761 if (global_schema
== NULL
) {
765 /* Remove any pointer to a previous schema */
766 ret
= ldb_set_opaque(ldb
, "dsdb_schema", NULL
);
767 if (ret
!= LDB_SUCCESS
) {
771 /* Remove the reference to the schema we just overwrote - if there was
772 * none, NULL is harmless here */
773 talloc_unlink(ldb
, old_schema
);
775 /* Set the new attributes based on the new schema */
776 /* Don't write indices and attributes, it's expensive */
777 ret
= dsdb_schema_set_indices_and_attributes(ldb
, global_schema
, SCHEMA_MEMORY_ONLY
);
778 if (ret
== LDB_SUCCESS
) {
779 void *schema_parent
= talloc_parent(global_schema
);
780 bool is_already_parent
=
781 (schema_parent
== ldb
);
782 if (!is_already_parent
) {
783 ptr
= talloc_reference(ldb
, global_schema
);
787 ret
= ldb_set_opaque(ldb
, "dsdb_schema", global_schema
);
794 bool dsdb_uses_global_schema(struct ldb_context
*ldb
)
796 return (ldb_get_opaque(ldb
, "dsdb_use_global_schema") != NULL
);
800 * Find the schema object for this ldb
802 * If reference_ctx is not NULL, then talloc_reference onto that context
805 struct dsdb_schema
*dsdb_get_schema(struct ldb_context
*ldb
, TALLOC_CTX
*reference_ctx
)
808 struct dsdb_schema
*schema_out
= NULL
;
809 struct dsdb_schema
*schema_in
= NULL
;
810 dsdb_schema_refresh_fn refresh_fn
;
811 struct ldb_module
*loaded_from_module
;
812 bool use_global_schema
;
813 TALLOC_CTX
*tmp_ctx
= talloc_new(reference_ctx
);
814 if (tmp_ctx
== NULL
) {
818 /* see if we have a cached copy */
819 use_global_schema
= dsdb_uses_global_schema(ldb
);
820 if (use_global_schema
) {
821 schema_in
= global_schema
;
823 p
= ldb_get_opaque(ldb
, "dsdb_schema");
825 schema_in
= talloc_get_type_abort(p
, struct dsdb_schema
);
829 refresh_fn
= ldb_get_opaque(ldb
, "dsdb_schema_refresh_fn");
831 loaded_from_module
= ldb_get_opaque(ldb
, "dsdb_schema_refresh_fn_private_data");
833 SMB_ASSERT(loaded_from_module
&& (ldb_module_get_ctx(loaded_from_module
) == ldb
));
837 /* We need to guard against recursive calls here */
838 if (ldb_set_opaque(ldb
, "dsdb_schema_refresh_fn", NULL
) != LDB_SUCCESS
) {
839 ldb_debug_set(ldb
, LDB_DEBUG_FATAL
,
840 "dsdb_get_schema: clearing dsdb_schema_refresh_fn failed");
842 schema_out
= refresh_fn(loaded_from_module
,
843 ldb_get_event_context(ldb
),
847 if (ldb_set_opaque(ldb
, "dsdb_schema_refresh_fn", refresh_fn
) != LDB_SUCCESS
) {
848 ldb_debug_set(ldb
, LDB_DEBUG_FATAL
,
849 "dsdb_get_schema: re-setting dsdb_schema_refresh_fn failed");
852 schema_out
= schema_in
;
853 ldb_debug_set(ldb
, LDB_DEBUG_FATAL
,
854 "dsdb_get_schema: refresh_fn() failed");
857 schema_out
= schema_in
;
860 /* This removes the extra reference above */
861 talloc_free(tmp_ctx
);
864 * If ref ctx exists and doesn't already reference schema, then add
865 * a reference. Otherwise, just return schema.
867 * We must use talloc_parent(), which is not quite free (there
868 * is no direct parent pointer in talloc, only one on the
869 * first child within a linked list), but is much cheaper than
870 * talloc_is_parent() which walks the whole tree up to the top
871 * looking for a potential grand-grand(etc)-parent.
873 if (reference_ctx
== NULL
) {
876 void *schema_parent
= talloc_parent(schema_out
);
877 bool is_already_parent
=
878 schema_parent
== reference_ctx
;
879 if (is_already_parent
) {
882 return talloc_reference(reference_ctx
,
889 * Make the schema found on this ldb the 'global' schema
892 void dsdb_make_schema_global(struct ldb_context
*ldb
, struct dsdb_schema
*schema
)
899 talloc_unlink(NULL
, global_schema
);
902 /* we want the schema to be around permanently */
903 talloc_reparent(ldb
, NULL
, schema
);
904 global_schema
= schema
;
906 /* This calls the talloc_reference() of the global schema back onto the ldb */
907 dsdb_set_global_schema(ldb
);
911 * When loading the schema from LDIF files, we don't get the extended DNs.
913 * We need to set these up, so that from the moment we start the provision,
914 * the defaultObjectCategory links are set up correctly.
916 int dsdb_schema_fill_extended_dn(struct ldb_context
*ldb
, struct dsdb_schema
*schema
)
918 struct dsdb_class
*cur
;
919 const struct dsdb_class
*target_class
;
920 for (cur
= schema
->classes
; cur
; cur
= cur
->next
) {
921 const struct ldb_val
*rdn
;
925 struct ldb_dn
*dn
= ldb_dn_new(NULL
, ldb
, cur
->defaultObjectCategory
);
928 return LDB_ERR_INVALID_DN_SYNTAX
;
930 rdn
= ldb_dn_get_component_val(dn
, 0);
933 return LDB_ERR_INVALID_DN_SYNTAX
;
935 target_class
= dsdb_class_by_cn_ldb_val(schema
, rdn
);
938 return LDB_ERR_CONSTRAINT_VIOLATION
;
941 status
= GUID_to_ndr_blob(&target_class
->objectGUID
, dn
, &guid
);
942 if (!NT_STATUS_IS_OK(status
)) {
944 return ldb_operr(ldb
);
946 ret
= ldb_dn_set_extended_component(dn
, "GUID", &guid
);
947 if (ret
!= LDB_SUCCESS
) {
948 ret
= ldb_error(ldb
, ret
, "Could not set GUID");
953 cur
->defaultObjectCategory
= ldb_dn_get_extended_linearized(cur
, dn
, 1);
960 * @brief Add a new element to the schema and checks if it's a duplicate
962 * This function will add a new element to the schema and checks for existing
965 * @param[in] ldb A pointer to an LDB context
967 * @param[in] schema A pointer to the dsdb_schema where the element
970 * @param[in] msg The ldb_message object representing the element
973 * @param[in] checkdups A boolean to indicate if checks for duplicates
976 * @return A WERROR code
978 WERROR
dsdb_schema_set_el_from_ldb_msg_dups(struct ldb_context
*ldb
, struct dsdb_schema
*schema
,
979 struct ldb_message
*msg
, bool checkdups
)
983 tstring
= ldb_msg_find_attr_as_string(msg
, "whenChanged", NULL
);
984 /* keep a trace of the ts of the most recently changed object */
986 ts
= ldb_string_to_time(tstring
);
987 if (ts
> schema
->ts_last_change
) {
988 schema
->ts_last_change
= ts
;
991 if (samdb_find_attribute(ldb
, msg
,
992 "objectclass", "attributeSchema") != NULL
) {
994 return dsdb_set_attribute_from_ldb_dups(ldb
, schema
, msg
, checkdups
);
995 } else if (samdb_find_attribute(ldb
, msg
,
996 "objectclass", "classSchema") != NULL
) {
997 return dsdb_set_class_from_ldb_dups(schema
, msg
, checkdups
);
999 /* Don't fail on things not classes or attributes */
1003 WERROR
dsdb_schema_set_el_from_ldb_msg(struct ldb_context
*ldb
,
1004 struct dsdb_schema
*schema
,
1005 struct ldb_message
*msg
)
1007 return dsdb_schema_set_el_from_ldb_msg_dups(ldb
, schema
, msg
, false);
1011 * Rather than read a schema from the LDB itself, read it from an ldif
1012 * file. This allows schema to be loaded and used while adding the
1013 * schema itself to the directory.
1015 * Should be called with a transaction (or failing that, have no concurrent
1016 * access while called).
1019 WERROR
dsdb_set_schema_from_ldif(struct ldb_context
*ldb
,
1020 const char *pf
, const char *df
,
1023 struct ldb_ldif
*ldif
;
1024 struct ldb_message
*msg
;
1025 TALLOC_CTX
*mem_ctx
;
1028 struct dsdb_schema
*schema
;
1029 const struct ldb_val
*prefix_val
;
1030 const struct ldb_val
*info_val
;
1031 struct ldb_val info_val_default
;
1034 mem_ctx
= talloc_new(ldb
);
1039 schema
= dsdb_new_schema(mem_ctx
);
1043 schema
->fsmo
.we_are_master
= true;
1044 schema
->fsmo
.update_allowed
= true;
1045 schema
->fsmo
.master_dn
= ldb_dn_new(schema
, ldb
, "@PROVISION_SCHEMA_MASTER");
1046 if (!schema
->fsmo
.master_dn
) {
1051 * load the prefixMap attribute from pf
1053 ldif
= ldb_ldif_read_string(ldb
, &pf
);
1055 status
= WERR_INVALID_PARAMETER
;
1058 talloc_steal(mem_ctx
, ldif
);
1060 ret
= ldb_msg_normalize(ldb
, mem_ctx
, ldif
->msg
, &msg
);
1061 if (ret
!= LDB_SUCCESS
) {
1066 prefix_val
= ldb_msg_find_ldb_val(msg
, "prefixMap");
1068 status
= WERR_INVALID_PARAMETER
;
1072 info_val
= ldb_msg_find_ldb_val(msg
, "schemaInfo");
1074 status
= dsdb_schema_info_blob_new(mem_ctx
, &info_val_default
);
1075 W_ERROR_NOT_OK_GOTO(status
, failed
);
1076 info_val
= &info_val_default
;
1079 status
= dsdb_load_oid_mappings_ldb(schema
, prefix_val
, info_val
);
1080 if (!W_ERROR_IS_OK(status
)) {
1081 DEBUG(0,("ERROR: dsdb_load_oid_mappings_ldb() failed with %s\n", win_errstr(status
)));
1085 schema
->ts_last_change
= 0;
1086 /* load the attribute and class definitions out of df */
1087 while ((ldif
= ldb_ldif_read_string(ldb
, &df
))) {
1088 talloc_steal(mem_ctx
, ldif
);
1090 ret
= ldb_msg_normalize(ldb
, ldif
, ldif
->msg
, &msg
);
1091 if (ret
!= LDB_SUCCESS
) {
1095 status
= dsdb_schema_set_el_from_ldb_msg(ldb
, schema
, msg
);
1097 if (!W_ERROR_IS_OK(status
)) {
1103 * TODO We may need a transaction here, otherwise this causes races.
1105 * To do so may require an ldb_in_transaction function. In the
1106 * meantime, assume that this is always called with a transaction or in
1109 ret
= dsdb_set_schema(ldb
, schema
, SCHEMA_WRITE
);
1110 if (ret
!= LDB_SUCCESS
) {
1111 status
= WERR_FOOBAR
;
1112 DEBUG(0,("ERROR: dsdb_set_schema() failed with %s / %s\n",
1113 ldb_strerror(ret
), ldb_errstring(ldb
)));
1117 ret
= dsdb_schema_fill_extended_dn(ldb
, schema
);
1118 if (ret
!= LDB_SUCCESS
) {
1119 status
= WERR_FOOBAR
;
1126 status
= WERR_NOT_ENOUGH_MEMORY
;
1129 talloc_free(mem_ctx
);