source4/dsdb/samdb/ldb_modules/objectclass_attrs.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Simo Sorce  2006-2008
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
   6    Copyright (C) Stefan Metzmacher 2009
   7    Copyright (C) Matthias Dieter Wallnöfer 2010
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU Lesser General Public
  20    License along with this library; if not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 /*
  24  *  Name: ldb
  25  *
  26  *  Component: objectclass attribute checking module
  27  *
  28  *  Description: this checks the attributes on a directory entry (if they're
  29  *    allowed, if the syntax is correct, if mandatory ones are missing,
  30  *    denies the deletion of mandatory ones...). The module contains portions
  31  *    of the "objectclass" and the "validate_update" LDB module.
  32  *
  33  *  Author: Matthias Dieter Wallnöfer
  34  */
  35
  36 #include "includes.h"
  37 #include "ldb_module.h"
  38 #include "dsdb/samdb/samdb.h"
  39
  40 struct oc_context {
  41
  42         struct ldb_module *module;
  43         struct ldb_request *req;
  44         const struct dsdb_schema *schema;
  45
  46         struct ldb_reply *search_res;
  47         struct ldb_reply *mod_ares;
  48 };
  49
  50 static struct oc_context *oc_init_context(struct ldb_module *module,
  51                                           struct ldb_request *req)
  52 {
  53         struct ldb_context *ldb;
  54         struct oc_context *ac;
  55
  56         ldb = ldb_module_get_ctx(module);
  57
  58         ac = talloc_zero(req, struct oc_context);
  59         if (ac == NULL) {
  60                 ldb_oom(ldb);
  61                 return NULL;
  62         }
  63
  64         ac->module = module;
  65         ac->req = req;
  66         ac->schema = dsdb_get_schema(ldb, ac);
  67
  68         return ac;
  69 }
  70
  71 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares);
  72
  73 static int attr_handler(struct oc_context *ac)
  74 {
  75         struct ldb_context *ldb;
  76         struct ldb_message *msg;
  77         struct ldb_request *child_req;
  78         const struct dsdb_attribute *attr;
  79         unsigned int i;
  80         int ret;
  81         WERROR werr;
  82         struct dsdb_syntax_ctx syntax_ctx;
  83
  84         ldb = ldb_module_get_ctx(ac->module);
  85
  86         if (ac->req->operation == LDB_ADD) {
  87                 msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
  88         } else {
  89                 msg = ldb_msg_copy_shallow(ac, ac->req->op.mod.message);
  90         }
  91         if (msg == NULL) {
  92                 return ldb_oom(ldb);
  93         }
  94
  95         /* initialize syntax checking context */
  96         dsdb_syntax_ctx_init(&syntax_ctx, ldb, ac->schema);
  97
  98         /* Check if attributes exist in the schema, if the values match,
  99          * if they're not operational and fix the names to the match the schema
 100          * case */
 101         for (i = 0; i < msg->num_elements; i++) {
 102                 attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
 103                                                          msg->elements[i].name);
 104                 if (attr == NULL) {
 105                         ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' was not found in the schema!",
 106                                                msg->elements[i].name,
 107                                                ldb_dn_get_linearized(msg->dn));
 108                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 109                 }
 110
 111                 if ((attr->linkID & 1) == 1) {
 112                         /* Odd is for the target.  Illegal to modify */
 113                         ldb_asprintf_errstring(ldb,
 114                                                "objectclass_attrs: attribute '%s' on entry '%s' must not be modified directly, it is a linked attribute",
 115                                                msg->elements[i].name,
 116                                                ldb_dn_get_linearized(msg->dn));
 117                         return LDB_ERR_UNWILLING_TO_PERFORM;
 118                 }
 119
 120                 if (!(msg->elements[i].flags & LDB_FLAG_INTERNAL_DISABLE_VALIDATION)) {
 121                         werr = attr->syntax->validate_ldb(&syntax_ctx, attr,
 122                                                           &msg->elements[i]);
 123                         if (!W_ERROR_IS_OK(werr)) {
 124                                 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' contains at least one invalid value!",
 125                                                        msg->elements[i].name,
 126                                                        ldb_dn_get_linearized(msg->dn));
 127                                 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
 128                         }
 129                 }
 130
 131                 if ((attr->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED) != 0) {
 132                         ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' is constructed!",
 133                                                msg->elements[i].name,
 134                                                ldb_dn_get_linearized(msg->dn));
 135                         if (ac->req->operation == LDB_ADD) {
 136                                 return LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE;
 137                         } else {
 138                                 return LDB_ERR_CONSTRAINT_VIOLATION;
 139                         }
 140                 }
 141
 142                 /* Multi-valued replace operations are generally denied but
 143                  * there do exist exceptions where attributes have the flag
 144                  * "FLAG_ATTR_REQ_PARTIAL_SET_MEMBER" set. */
 145                 if ((ac->req->operation == LDB_MODIFY) &&
 146                     (LDB_FLAG_MOD_TYPE(msg->elements[i].flags) == LDB_FLAG_MOD_REPLACE) &&
 147                     (msg->elements[i].num_values > 1) &&
 148                     ((attr->systemFlags & DS_FLAG_ATTR_REQ_PARTIAL_SET_MEMBER) == 0)) {
 149                         ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' is replaced multi-valued!",
 150                                                msg->elements[i].name,
 151                                                ldb_dn_get_linearized(msg->dn));
 152                         return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
 153                 }
 154
 155                 /* Substitute the attribute name to match in case */
 156                 msg->elements[i].name = attr->lDAPDisplayName;
 157         }
 158
 159         if (ac->req->operation == LDB_ADD) {
 160                 ret = ldb_build_add_req(&child_req, ldb, ac,
 161                                         msg, ac->req->controls,
 162                                         ac, oc_op_callback, ac->req);
 163                 LDB_REQ_SET_LOCATION(child_req);
 164         } else {
 165                 ret = ldb_build_mod_req(&child_req, ldb, ac,
 166                                         msg, ac->req->controls,
 167                                         ac, oc_op_callback, ac->req);
 168                 LDB_REQ_SET_LOCATION(child_req);
 169         }
 170         if (ret != LDB_SUCCESS) {
 171                 return ret;
 172         }
 173
 174         return ldb_next_request(ac->module, child_req);
 175 }
 176
 177 /*
 178   these are attributes which are left over from old ways of doing
 179   things in ldb, and are harmless
 180  */
 181 static const char *harmless_attrs[] = { "parentGUID", NULL };
 182
 183 static int attr_handler2(struct oc_context *ac)
 184 {
 185         struct ldb_context *ldb;
 186         struct ldb_message_element *oc_element;
 187         struct ldb_message *msg;
 188         const char **must_contain, **may_contain, **found_must_contain;
 189         const struct dsdb_attribute *attr;
 190         unsigned int i;
 191         bool found;
 192
 193         ldb = ldb_module_get_ctx(ac->module);
 194
 195         if (ac->search_res == NULL) {
 196                 return ldb_operr(ldb);
 197         }
 198
 199         /* We rely here on the preceding "objectclass" LDB module which did
 200          * already fix up the objectclass list (inheritance, order...). */
 201         oc_element = ldb_msg_find_element(ac->search_res->message,
 202                                           "objectClass");
 203         if (oc_element == NULL) {
 204                 return ldb_operr(ldb);
 205         }
 206
 207         must_contain = dsdb_full_attribute_list(ac, ac->schema, oc_element,
 208                                                 DSDB_SCHEMA_ALL_MUST);
 209         may_contain =  dsdb_full_attribute_list(ac, ac->schema, oc_element,
 210                                                 DSDB_SCHEMA_ALL_MAY);
 211         found_must_contain = const_str_list(str_list_copy(ac, must_contain));
 212         if ((must_contain == NULL) || (may_contain == NULL)
 213             || (found_must_contain == NULL)) {
 214                 return ldb_operr(ldb);
 215         }
 216
 217         /* Check if all specified attributes are valid in the given
 218          * objectclasses and if they meet additional schema restrictions. */
 219         msg = ac->search_res->message;
 220         for (i = 0; i < msg->num_elements; i++) {
 221                 attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
 222                                                          msg->elements[i].name);
 223                 if (attr == NULL) {
 224                         return ldb_operr(ldb);
 225                 }
 226
 227                 /* Check if they're single-valued if this is requested */
 228                 if ((msg->elements[i].num_values > 1) && (attr->isSingleValued)) {
 229                         ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' is single-valued!",
 230                                                msg->elements[i].name,
 231                                                ldb_dn_get_linearized(msg->dn));
 232                         if (ac->req->operation == LDB_ADD) {
 233                                 return LDB_ERR_CONSTRAINT_VIOLATION;
 234                         } else {
 235                                 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
 236                         }
 237                 }
 238
 239                 /* We can use "str_list_check" with "strcmp" here since the
 240                  * attribute informations from the schema are always equal
 241                  * up-down-cased. */
 242                 found = str_list_check(must_contain, attr->lDAPDisplayName);
 243                 if (found) {
 244                         str_list_remove(found_must_contain, attr->lDAPDisplayName);
 245                 } else {
 246                         found = str_list_check(may_contain, attr->lDAPDisplayName);
 247                 }
 248                 if (!found) {
 249                         found = str_list_check(harmless_attrs, attr->lDAPDisplayName);
 250                 }
 251                 if (!found) {
 252                         ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' does not exist in the specified objectclasses!",
 253                                                msg->elements[i].name,
 254                                                ldb_dn_get_linearized(msg->dn));
 255                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
 256                 }
 257         }
 258
 259         if (found_must_contain[0] != NULL) {
 260                 ldb_asprintf_errstring(ldb, "objectclass_attrs: at least one mandatory attribute ('%s') on entry '%s' wasn't specified!",
 261                                        found_must_contain[0],
 262                                        ldb_dn_get_linearized(msg->dn));
 263                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
 264         }
 265
 266         return ldb_module_done(ac->req, ac->mod_ares->controls,
 267                                ac->mod_ares->response, LDB_SUCCESS);
 268 }
 269
 270 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
 271 {
 272         struct ldb_context *ldb;
 273         struct oc_context *ac;
 274         int ret;
 275
 276         ac = talloc_get_type(req->context, struct oc_context);
 277         ldb = ldb_module_get_ctx(ac->module);
 278
 279         if (!ares) {
 280                 return ldb_module_done(ac->req, NULL, NULL,
 281                                        LDB_ERR_OPERATIONS_ERROR);
 282         }
 283         if (ares->error != LDB_SUCCESS) {
 284                 return ldb_module_done(ac->req, ares->controls,
 285                                        ares->response, ares->error);
 286         }
 287
 288         ldb_reset_err_string(ldb);
 289
 290         switch (ares->type) {
 291         case LDB_REPLY_ENTRY:
 292                 if (ac->search_res != NULL) {
 293                         ldb_set_errstring(ldb, "Too many results");
 294                         talloc_free(ares);
 295                         return ldb_module_done(ac->req, NULL, NULL,
 296                                                LDB_ERR_OPERATIONS_ERROR);
 297                 }
 298
 299                 ac->search_res = talloc_steal(ac, ares);
 300                 break;
 301
 302         case LDB_REPLY_REFERRAL:
 303                 /* ignore */
 304                 talloc_free(ares);
 305                 break;
 306
 307         case LDB_REPLY_DONE:
 308                 talloc_free(ares);
 309                 ret = attr_handler2(ac);
 310                 if (ret != LDB_SUCCESS) {
 311                         return ldb_module_done(ac->req, NULL, NULL, ret);
 312                 }
 313                 break;
 314         }
 315
 316         return LDB_SUCCESS;
 317 }
 318
 319 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
 320 {
 321         struct oc_context *ac;
 322         struct ldb_context *ldb;
 323         struct ldb_request *search_req;
 324         struct ldb_dn *base_dn;
 325         int ret;
 326
 327         ac = talloc_get_type(req->context, struct oc_context);
 328         ldb = ldb_module_get_ctx(ac->module);
 329
 330         if (!ares) {
 331                 return ldb_module_done(ac->req, NULL, NULL,
 332                                        LDB_ERR_OPERATIONS_ERROR);
 333         }
 334
 335         if (ares->type == LDB_REPLY_REFERRAL) {
 336                 return ldb_module_send_referral(ac->req, ares->referral);
 337         }
 338
 339         if (ares->error != LDB_SUCCESS) {
 340                 return ldb_module_done(ac->req, ares->controls, ares->response,
 341                                        ares->error);
 342         }
 343
 344         if (ares->type != LDB_REPLY_DONE) {
 345                 talloc_free(ares);
 346                 return ldb_module_done(ac->req, NULL, NULL,
 347                                        LDB_ERR_OPERATIONS_ERROR);
 348         }
 349
 350         ac->search_res = NULL;
 351         ac->mod_ares = talloc_steal(ac, ares);
 352
 353         /* This looks up all attributes of our just added/modified entry */
 354         base_dn = ac->req->operation == LDB_ADD ? ac->req->op.add.message->dn
 355                 : ac->req->op.mod.message->dn;
 356         ret = ldb_build_search_req(&search_req, ldb, ac, base_dn,
 357                                    LDB_SCOPE_BASE, "(objectClass=*)",
 358                                    NULL, NULL, ac,
 359                                    get_search_callback, ac->req);
 360         LDB_REQ_SET_LOCATION(search_req);
 361         if (ret != LDB_SUCCESS) {
 362                 return ldb_module_done(ac->req, NULL, NULL, ret);
 363         }
 364
 365         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
 366                                       true, NULL);
 367         if (ret != LDB_SUCCESS) {
 368                 return ldb_module_done(ac->req, NULL, NULL, ret);
 369         }
 370
 371         ret = ldb_next_request(ac->module, search_req);
 372         if (ret != LDB_SUCCESS) {
 373                 return ldb_module_done(ac->req, NULL, NULL, ret);
 374         }
 375
 376         /* "ldb_module_done" isn't called here since we need to do additional
 377          * checks. It is called at the end of "attr_handler2". */
 378         return LDB_SUCCESS;
 379 }
 380
 381 static int objectclass_attrs_add(struct ldb_module *module,
 382                                  struct ldb_request *req)
 383 {
 384         struct ldb_context *ldb;
 385         struct oc_context *ac;
 386
 387         ldb = ldb_module_get_ctx(module);
 388
 389         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_attrs_add\n");
 390
 391         /* do not manipulate our control entries */
 392         if (ldb_dn_is_special(req->op.add.message->dn)) {
 393                 return ldb_next_request(module, req);
 394         }
 395
 396         ac = oc_init_context(module, req);
 397         if (ac == NULL) {
 398                 return ldb_operr(ldb);
 399         }
 400
 401         /* without schema, there isn't much to do here */
 402         if (ac->schema == NULL) {
 403                 talloc_free(ac);
 404                 return ldb_next_request(module, req);
 405         }
 406
 407         return attr_handler(ac);
 408 }
 409
 410 static int objectclass_attrs_modify(struct ldb_module *module,
 411                                     struct ldb_request *req)
 412 {
 413         struct ldb_context *ldb;
 414         struct oc_context *ac;
 415
 416         ldb = ldb_module_get_ctx(module);
 417
 418         ldb_debug(ldb, LDB_DEBUG_TRACE, "objectclass_attrs_modify\n");
 419
 420         /* do not manipulate our control entries */
 421         if (ldb_dn_is_special(req->op.mod.message->dn)) {
 422                 return ldb_next_request(module, req);
 423         }
 424
 425         ac = oc_init_context(module, req);
 426         if (ac == NULL) {
 427                 return ldb_operr(ldb);
 428         }
 429
 430         /* without schema, there isn't much to do here */
 431         if (ac->schema == NULL) {
 432                 talloc_free(ac);
 433                 return ldb_next_request(module, req);
 434         }
 435
 436         return attr_handler(ac);
 437 }
 438
 439 _PUBLIC_ const struct ldb_module_ops ldb_objectclass_attrs_module_ops = {
 440         .name              = "objectclass_attrs",
 441         .add               = objectclass_attrs_add,
 442         .modify            = objectclass_attrs_modify
 443 };