source4/dsdb/samdb/ldb_modules/schema_data.c

   1 /*
   2    Unix SMB/CIFS mplementation.
   3
   4    The module that handles the Schema checkings and dynamic attributes
   5
   6    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21
  22 */
  23
  24 #include "includes.h"
  25 #include "ldb_module.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "librpc/gen_ndr/ndr_misc.h"
  28 #include "librpc/gen_ndr/ndr_drsuapi.h"
  29 #include "librpc/gen_ndr/ndr_drsblobs.h"
  30 #include "param/param.h"
  31 #include "dsdb/samdb/ldb_modules/util.h"
  32
  33 static int generate_objectClasses(struct ldb_context *ldb, struct ldb_message *msg,
  34                                   const struct dsdb_schema *schema);
  35 static int generate_attributeTypes(struct ldb_context *ldb, struct ldb_message *msg,
  36                                    const struct dsdb_schema *schema);
  37 static int generate_dITContentRules(struct ldb_context *ldb, struct ldb_message *msg,
  38                                     const struct dsdb_schema *schema);
  39 static int generate_extendedAttributeInfo(struct ldb_context *ldb, struct ldb_message *msg,
  40                                           const struct dsdb_schema *schema);
  41 static int generate_extendedClassInfo(struct ldb_context *ldb, struct ldb_message *msg,
  42                                       const struct dsdb_schema *schema);
  43 static int generate_possibleInferiors(struct ldb_context *ldb, struct ldb_message *msg,
  44                                       const struct dsdb_schema *schema);
  45
  46 static const struct {
  47         const char *attr;
  48         int (*fn)(struct ldb_context *, struct ldb_message *, const struct dsdb_schema *);
  49         bool aggregate;
  50 } generated_attrs[] = {
  51         {
  52                 .attr = "objectClasses",
  53                 .fn = generate_objectClasses,
  54                 .aggregate = true,
  55         },
  56         {
  57                 .attr = "attributeTypes",
  58                 .fn = generate_attributeTypes,
  59                 .aggregate = true,
  60         },
  61         {
  62                 .attr = "dITContentRules",
  63                 .fn = generate_dITContentRules,
  64                 .aggregate = true,
  65         },
  66         {
  67                 .attr = "extendedAttributeInfo",
  68                 .fn = generate_extendedAttributeInfo,
  69                 .aggregate = true,
  70         },
  71         {
  72                 .attr = "extendedClassInfo",
  73                 .fn = generate_extendedClassInfo,
  74                 .aggregate = true,
  75         },
  76         {
  77                 .attr = "possibleInferiors",
  78                 .fn = generate_possibleInferiors,
  79                 .aggregate = false,
  80         }
  81 };
  82
  83 struct schema_data_private_data {
  84         struct ldb_dn *aggregate_dn;
  85         struct ldb_dn *schema_dn;
  86 };
  87
  88 struct schema_data_search_data {
  89         struct ldb_module *module;
  90         struct ldb_request *req;
  91
  92         const struct dsdb_schema *schema;
  93 };
  94
  95 /* context to be used during async operations */
  96 struct schema_data_context {
  97         struct ldb_module *module;
  98         struct ldb_request *req;
  99
 100         const struct dsdb_schema *schema;
 101 };
 102
 103 /* Create new context using
 104  * ldb_request as memory context */
 105 static int _schema_data_context_new(struct ldb_module *module,
 106                                     struct ldb_request *req,
 107                                     struct schema_data_context **pac)
 108 {
 109         struct schema_data_context *ac;
 110         struct ldb_context *ldb;
 111
 112         ldb = ldb_module_get_ctx(module);
 113
 114         *pac = ac = talloc_zero(req, struct schema_data_context);
 115         if (ac == NULL) {
 116                 ldb_oom(ldb);
 117                 return LDB_ERR_OPERATIONS_ERROR;
 118         }
 119         ac->module = module;
 120         ac->req = req;
 121         ac->schema = dsdb_get_schema(ldb);
 122
 123         return LDB_SUCCESS;
 124 }
 125
 126 static int schema_data_init(struct ldb_module *module)
 127 {
 128         struct ldb_context *ldb;
 129         struct ldb_dn *schema_dn;
 130         int ret;
 131         struct schema_data_private_data *data;
 132
 133         ret = ldb_next_init(module);
 134         if (ret != LDB_SUCCESS) {
 135                 return ret;
 136         }
 137
 138         ldb = ldb_module_get_ctx(module);
 139         schema_dn = samdb_schema_dn(ldb);
 140         if (!schema_dn) {
 141                 ldb_reset_err_string(ldb);
 142                 ldb_debug(ldb, LDB_DEBUG_WARNING,
 143                           "schema_data_init: no schema dn present: (skip schema loading)\n");
 144                 return LDB_SUCCESS;
 145         }
 146
 147         data = talloc(module, struct schema_data_private_data);
 148         if (data == NULL) {
 149                 ldb_oom(ldb);
 150                 return LDB_ERR_OPERATIONS_ERROR;
 151         }
 152
 153         data->schema_dn = schema_dn;
 154
 155         /* Used to check to see if this is a result on the CN=Aggregate schema */
 156         data->aggregate_dn = samdb_aggregate_schema_dn(ldb, data);
 157         if (!data->aggregate_dn) {
 158                 ldb_set_errstring(ldb, "Could not build aggregate schema DN");
 159                 return LDB_ERR_OPERATIONS_ERROR;
 160         }
 161
 162         ldb_module_set_private(module, data);
 163         return LDB_SUCCESS;
 164 }
 165
 166
 167 /* Generate new value for msDs-IntId
 168  * Value should be in 0x80000000..0xBFFFFFFF range
 169  * Generated value is added ldb_msg */
 170 static int _schema_data_gen_msds_intid(struct schema_data_context *ac,
 171                                        struct ldb_message *ldb_msg)
 172 {
 173         uint32_t id;
 174
 175         /* generate random num in 0x80000000..0xBFFFFFFF */
 176         id = generate_random() % 0X3FFFFFFF;
 177         id += 0x80000000;
 178
 179         /* make sure id is unique and adjust if not */
 180         while (dsdb_attribute_by_attributeID_id(ac->schema, id)) {
 181                 id++;
 182                 if (id > 0xBFFFFFFF) {
 183                         id = 0x80000001;
 184                 }
 185         }
 186
 187         /* add generated msDS-IntId value to ldb_msg */
 188         return ldb_msg_add_fmt(ldb_msg, "msDS-IntId", "%d", id);
 189 }
 190
 191 static int _schema_data_add_callback(struct ldb_request *req,
 192                                      struct ldb_reply *ares)
 193 {
 194         struct schema_data_context *ac;
 195
 196         ac = talloc_get_type(req->context, struct schema_data_context);
 197
 198         if (!ares) {
 199                 return ldb_module_done(ac->req, NULL, NULL,
 200                                         LDB_ERR_OPERATIONS_ERROR);
 201         }
 202         if (ares->error != LDB_SUCCESS) {
 203                 return ldb_module_done(ac->req, ares->controls,
 204                                         ares->response, ares->error);
 205         }
 206
 207         if (ares->type != LDB_REPLY_DONE) {
 208                 talloc_free(ares);
 209                 return ldb_module_done(ac->req, NULL, NULL,
 210                                         LDB_ERR_OPERATIONS_ERROR);
 211         }
 212
 213         return ldb_module_done(ac->req, ares->controls,
 214                                 ares->response, ares->error);
 215 }
 216
 217 static int schema_data_add(struct ldb_module *module, struct ldb_request *req)
 218 {
 219         struct ldb_context *ldb;
 220         struct dsdb_schema *schema;
 221         const struct ldb_val *attributeID = NULL;
 222         const struct ldb_val *governsID = NULL;
 223         const char *oid_attr = NULL;
 224         const char *oid = NULL;
 225         WERROR status;
 226
 227         ldb = ldb_module_get_ctx(module);
 228
 229         /* special objects should always go through */
 230         if (ldb_dn_is_special(req->op.add.message->dn)) {
 231                 return ldb_next_request(module, req);
 232         }
 233
 234         /* replicated update should always go through */
 235         if (ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
 236                 return ldb_next_request(module, req);
 237         }
 238
 239         schema = dsdb_get_schema(ldb);
 240         if (!schema) {
 241                 return ldb_next_request(module, req);
 242         }
 243
 244         if (!schema->fsmo.we_are_master) {
 245                 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 246                           "schema_data_add: we are not master: reject request\n");
 247                 return LDB_ERR_UNWILLING_TO_PERFORM;
 248         }
 249
 250         attributeID = ldb_msg_find_ldb_val(req->op.add.message, "attributeID");
 251         governsID = ldb_msg_find_ldb_val(req->op.add.message, "governsID");
 252
 253         if (attributeID) {
 254                 /* Sanity check for not allowed attributes */
 255                 if (ldb_msg_find_ldb_val(req->op.add.message, "msDS-IntId")) {
 256                         return LDB_ERR_UNWILLING_TO_PERFORM;
 257                 }
 258
 259                 oid_attr = "attributeID";
 260                 oid = talloc_strndup(req, (const char *)attributeID->data, attributeID->length);
 261         } else if (governsID) {
 262                 oid_attr = "governsID";
 263                 oid = talloc_strndup(req, (const char *)governsID->data, governsID->length);
 264         } else {
 265                 return ldb_next_request(module, req);
 266         }
 267
 268         if (!oid) {
 269                 ldb_oom(ldb);
 270                 return LDB_ERR_OPERATIONS_ERROR;
 271         }
 272
 273         status = dsdb_schema_pfm_find_oid(schema->prefixmap, oid, NULL);
 274         if (!W_ERROR_IS_OK(status)) {
 275                 /* check for internal errors */
 276                 if (!W_ERROR_EQUAL(WERR_DS_NO_MSDS_INTID, status)) {
 277                         ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 278                                       "schema_data_add: failed to map %s[%s]: %s\n",
 279                                       oid_attr, oid, win_errstr(status));
 280                         return LDB_ERR_UNWILLING_TO_PERFORM;
 281                 }
 282
 283                 /* Update prefixMap and save it */
 284                 status = dsdb_create_prefix_mapping(ldb, schema, oid);
 285                 if (!W_ERROR_IS_OK(status)) {
 286                         ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 287                                   "schema_data_add: failed to create prefix mapping for %s[%s]: %s\n",
 288                                   oid_attr, oid, win_errstr(status));
 289                         return LDB_ERR_UNWILLING_TO_PERFORM;
 290                 }
 291         }
 292
 293         /* bypass further processing if CONTROL_RELAX is set */
 294         if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
 295                 return ldb_next_request(module, req);
 296         }
 297
 298         /* generate and add msDS-IntId attr value */
 299         if (attributeID
 300             && (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2003)
 301             && !(ldb_msg_find_attr_as_uint(req->op.add.message, "systemFlags", 0) & SYSTEM_FLAG_SCHEMA_BASE_OBJECT)) {
 302                 struct ldb_message *msg;
 303                 struct schema_data_context *ac;
 304                 struct ldb_request *add_req;
 305
 306                 if (_schema_data_context_new(module, req, &ac) != LDB_SUCCESS) {
 307                         return LDB_ERR_OPERATIONS_ERROR;
 308                 }
 309
 310                 /* we have to copy the message as the caller might have it as a const */
 311                 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
 312                 if (msg == NULL) {
 313                         ldb_oom(ldb);
 314                         return LDB_ERR_OPERATIONS_ERROR;
 315                 }
 316
 317                 /* generate unique value for msDS-IntId attr value */
 318                 if (_schema_data_gen_msds_intid(ac, msg) != LDB_SUCCESS) {
 319                         ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 320                                       "_schema_data_gen_msds_intid() failed to generate msDS-IntId value\n");
 321                         return LDB_ERR_OPERATIONS_ERROR;
 322                 }
 323
 324                 ldb_build_add_req(&add_req, ldb, ac,
 325                                   msg,
 326                                   req->controls,
 327                                   ac, _schema_data_add_callback,
 328                                   req);
 329
 330                 return ldb_next_request(module, add_req);
 331         }
 332
 333         return ldb_next_request(module, req);
 334 }
 335
 336 static int schema_data_modify(struct ldb_module *module, struct ldb_request *req)
 337 {
 338         /* special objects should always go through */
 339         if (ldb_dn_is_special(req->op.mod.message->dn)) {
 340                 return ldb_next_request(module, req);
 341         }
 342
 343         /* replicated update should always go through */
 344         if (ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
 345                 return ldb_next_request(module, req);
 346         }
 347
 348         /* msDS-IntId is not allowed to be modified */
 349         if (ldb_msg_find_ldb_val(req->op.mod.message, "msDS-IntId")) {
 350                 return LDB_ERR_CONSTRAINT_VIOLATION;
 351         }
 352
 353         /* go on with the call chain */
 354         return ldb_next_request(module, req);
 355 }
 356
 357 static int generate_objectClasses(struct ldb_context *ldb, struct ldb_message *msg,
 358                                   const struct dsdb_schema *schema)
 359 {
 360         const struct dsdb_class *sclass;
 361         int ret;
 362
 363         for (sclass = schema->classes; sclass; sclass = sclass->next) {
 364                 ret = ldb_msg_add_string(msg, "objectClasses", schema_class_to_description(msg, sclass));
 365                 if (ret != LDB_SUCCESS) {
 366                         return ret;
 367                 }
 368         }
 369         return LDB_SUCCESS;
 370 }
 371 static int generate_attributeTypes(struct ldb_context *ldb, struct ldb_message *msg,
 372                                   const struct dsdb_schema *schema)
 373 {
 374         const struct dsdb_attribute *attribute;
 375         int ret;
 376
 377         for (attribute = schema->attributes; attribute; attribute = attribute->next) {
 378                 ret = ldb_msg_add_string(msg, "attributeTypes", schema_attribute_to_description(msg, attribute));
 379                 if (ret != LDB_SUCCESS) {
 380                         return ret;
 381                 }
 382         }
 383         return LDB_SUCCESS;
 384 }
 385
 386 static int generate_dITContentRules(struct ldb_context *ldb, struct ldb_message *msg,
 387                                     const struct dsdb_schema *schema)
 388 {
 389         const struct dsdb_class *sclass;
 390         int ret;
 391
 392         for (sclass = schema->classes; sclass; sclass = sclass->next) {
 393                 if (sclass->auxiliaryClass || sclass->systemAuxiliaryClass) {
 394                         char *ditcontentrule = schema_class_to_dITContentRule(msg, sclass, schema);
 395                         if (!ditcontentrule) {
 396                                 ldb_oom(ldb);
 397                                 return LDB_ERR_OPERATIONS_ERROR;
 398                         }
 399                         ret = ldb_msg_add_steal_string(msg, "dITContentRules", ditcontentrule);
 400                         if (ret != LDB_SUCCESS) {
 401                                 return ret;
 402                         }
 403                 }
 404         }
 405         return LDB_SUCCESS;
 406 }
 407
 408 static int generate_extendedAttributeInfo(struct ldb_context *ldb,
 409                                           struct ldb_message *msg,
 410                                           const struct dsdb_schema *schema)
 411 {
 412         const struct dsdb_attribute *attribute;
 413         int ret;
 414
 415         for (attribute = schema->attributes; attribute; attribute = attribute->next) {
 416                 char *val = schema_attribute_to_extendedInfo(msg, attribute);
 417                 if (!val) {
 418                         ldb_oom(ldb);
 419                         return LDB_ERR_OPERATIONS_ERROR;
 420                 }
 421
 422                 ret = ldb_msg_add_string(msg, "extendedAttributeInfo", val);
 423                 if (ret != LDB_SUCCESS) {
 424                         return ret;
 425                 }
 426         }
 427
 428         return LDB_SUCCESS;
 429 }
 430
 431 static int generate_extendedClassInfo(struct ldb_context *ldb,
 432                                       struct ldb_message *msg,
 433                                       const struct dsdb_schema *schema)
 434 {
 435         const struct dsdb_class *sclass;
 436         int ret;
 437
 438         for (sclass = schema->classes; sclass; sclass = sclass->next) {
 439                 char *val = schema_class_to_extendedInfo(msg, sclass);
 440                 if (!val) {
 441                         ldb_oom(ldb);
 442                         return LDB_ERR_OPERATIONS_ERROR;
 443                 }
 444
 445                 ret = ldb_msg_add_string(msg, "extendedClassInfo", val);
 446                 if (ret != LDB_SUCCESS) {
 447                         return ret;
 448                 }
 449         }
 450
 451         return LDB_SUCCESS;
 452 }
 453
 454
 455 static int generate_possibleInferiors(struct ldb_context *ldb, struct ldb_message *msg,
 456                                       const struct dsdb_schema *schema)
 457 {
 458         struct ldb_dn *dn = msg->dn;
 459         int ret, i;
 460         const char *first_component_name = ldb_dn_get_component_name(dn, 0);
 461         const struct ldb_val *first_component_val;
 462         const struct dsdb_class *schema_class;
 463         const char **possibleInferiors;
 464
 465         if (strcasecmp(first_component_name, "cn") != 0) {
 466                 return LDB_SUCCESS;
 467         }
 468
 469         first_component_val = ldb_dn_get_component_val(dn, 0);
 470
 471         schema_class = dsdb_class_by_cn_ldb_val(schema, first_component_val);
 472         if (schema_class == NULL) {
 473                 return LDB_SUCCESS;
 474         }
 475
 476         possibleInferiors = schema_class->possibleInferiors;
 477         if (possibleInferiors == NULL) {
 478                 return LDB_SUCCESS;
 479         }
 480
 481         for (i=0;possibleInferiors[i];i++) {
 482                 ret = ldb_msg_add_string(msg, "possibleInferiors", possibleInferiors[i]);
 483                 if (ret != LDB_SUCCESS) {
 484                         return ret;
 485                 }
 486         }
 487
 488         return LDB_SUCCESS;
 489 }
 490
 491
 492 /* Add objectClasses, attributeTypes and dITContentRules from the
 493    schema object (they are not stored in the database)
 494  */
 495 static int schema_data_search_callback(struct ldb_request *req, struct ldb_reply *ares)
 496 {
 497         struct ldb_context *ldb;
 498         struct schema_data_search_data *ac;
 499         struct schema_data_private_data *mc;
 500         int i, ret;
 501
 502         ac = talloc_get_type(req->context, struct schema_data_search_data);
 503         mc = talloc_get_type(ldb_module_get_private(ac->module), struct schema_data_private_data);
 504         ldb = ldb_module_get_ctx(ac->module);
 505
 506         if (!ares) {
 507                 return ldb_module_done(ac->req, NULL, NULL,
 508                                         LDB_ERR_OPERATIONS_ERROR);
 509         }
 510         if (ares->error != LDB_SUCCESS) {
 511                 return ldb_module_done(ac->req, ares->controls,
 512                                         ares->response, ares->error);
 513         }
 514         /* Only entries are interesting, and we handle the case of the parent seperatly */
 515
 516         switch (ares->type) {
 517         case LDB_REPLY_ENTRY:
 518
 519                 if (ldb_dn_compare(ares->message->dn, mc->aggregate_dn) == 0) {
 520                         for (i=0; i < ARRAY_SIZE(generated_attrs); i++) {
 521                                 if (generated_attrs[i].aggregate &&
 522                                     ldb_attr_in_list(ac->req->op.search.attrs, generated_attrs[i].attr)) {
 523                                         ret = generated_attrs[i].fn(ldb, ares->message, ac->schema);
 524                                         if (ret != LDB_SUCCESS) {
 525                                                 return ret;
 526                                         }
 527                                 }
 528                         }
 529                 } else if ((ldb_dn_compare_base(mc->schema_dn, ares->message->dn) == 0)
 530                            && (ldb_dn_compare(mc->schema_dn, ares->message->dn) != 0)) {
 531                         for (i=0; i < ARRAY_SIZE(generated_attrs); i++) {
 532                                 if (!generated_attrs[i].aggregate &&
 533                                     ldb_attr_in_list(ac->req->op.search.attrs, generated_attrs[i].attr)) {
 534                                         ret = generated_attrs[i].fn(ldb, ares->message, ac->schema);
 535                                         if (ret != LDB_SUCCESS) {
 536                                                 return ret;
 537                                         }
 538                                 }
 539                         }
 540                 }
 541
 542
 543                 return ldb_module_send_entry(ac->req, ares->message, ares->controls);
 544
 545         case LDB_REPLY_REFERRAL:
 546
 547                 return ldb_module_send_referral(ac->req, ares->referral);
 548
 549         case LDB_REPLY_DONE:
 550
 551                 return ldb_module_done(ac->req, ares->controls,
 552                                         ares->response, ares->error);
 553         }
 554
 555         return LDB_SUCCESS;
 556 }
 557
 558 /* search */
 559 static int schema_data_search(struct ldb_module *module, struct ldb_request *req)
 560 {
 561         struct ldb_context *ldb = ldb_module_get_ctx(module);
 562         int i, ret;
 563         struct schema_data_search_data *search_context;
 564         struct ldb_request *down_req;
 565         struct dsdb_schema *schema = dsdb_get_schema(ldb);
 566
 567         if (!schema || !ldb_module_get_private(module)) {
 568                 /* If there is no schema, there is little we can do */
 569                 return ldb_next_request(module, req);
 570         }
 571         for (i=0; i < ARRAY_SIZE(generated_attrs); i++) {
 572                 if (ldb_attr_in_list(req->op.search.attrs, generated_attrs[i].attr)) {
 573                         break;
 574                 }
 575         }
 576         if (i == ARRAY_SIZE(generated_attrs)) {
 577                 /* No request for a generated attr found, nothing to
 578                  * see here, move along... */
 579                 return ldb_next_request(module, req);
 580         }
 581
 582         search_context = talloc(req, struct schema_data_search_data);
 583         if (!search_context) {
 584                 ldb_oom(ldb);
 585                 return LDB_ERR_OPERATIONS_ERROR;
 586         }
 587
 588         search_context->module = module;
 589         search_context->req = req;
 590         search_context->schema = schema;
 591
 592         ret = ldb_build_search_req_ex(&down_req, ldb, search_context,
 593                                         req->op.search.base,
 594                                         req->op.search.scope,
 595                                         req->op.search.tree,
 596                                         req->op.search.attrs,
 597                                         req->controls,
 598                                         search_context, schema_data_search_callback,
 599                                         req);
 600         if (ret != LDB_SUCCESS) {
 601                 return LDB_ERR_OPERATIONS_ERROR;
 602         }
 603
 604         return ldb_next_request(module, down_req);
 605 }
 606
 607
 608 _PUBLIC_ const struct ldb_module_ops ldb_schema_data_module_ops = {
 609         .name           = "schema_data",
 610         .init_context   = schema_data_init,
 611         .add            = schema_data_add,
 612         .modify         = schema_data_modify,
 613         .search         = schema_data_search
 614 };