4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2007
5 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
6 Copyright (C) Matthias Dieter Wallnöfer <mdw@samba.org> 2010-2011
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 * Component: ldb subtree rename module
27 * Description: Rename a subtree in LDB
29 * Author: Andrew Bartlett
34 #include <ldb_module.h>
35 #include "libds/common/flags.h"
36 #include "dsdb/samdb/samdb.h"
38 struct subren_msg_store
{
39 struct subren_msg_store
*next
;
44 struct subtree_rename_context
{
45 struct ldb_module
*module
;
46 struct ldb_request
*req
;
48 struct subren_msg_store
*list
;
49 struct subren_msg_store
*current
;
52 static struct subtree_rename_context
*subren_ctx_init(struct ldb_module
*module
,
53 struct ldb_request
*req
)
55 struct ldb_context
*ldb
;
56 struct subtree_rename_context
*ac
;
58 ldb
= ldb_module_get_ctx(module
);
60 ac
= talloc_zero(req
, struct subtree_rename_context
);
71 static int subtree_rename_next_request(struct subtree_rename_context
*ac
);
73 static int subtree_rename_callback(struct ldb_request
*req
,
74 struct ldb_reply
*ares
)
76 struct ldb_context
*ldb
;
77 struct subtree_rename_context
*ac
;
80 ac
= talloc_get_type(req
->context
, struct subtree_rename_context
);
81 ldb
= ldb_module_get_ctx(ac
->module
);
84 return ldb_module_done(ac
->req
, NULL
, NULL
,
85 LDB_ERR_OPERATIONS_ERROR
);
88 if (ares
->type
== LDB_REPLY_REFERRAL
) {
89 return ldb_module_send_referral(ac
->req
, ares
->referral
);
92 if (ares
->error
!= LDB_SUCCESS
) {
93 return ldb_module_done(ac
->req
, ares
->controls
,
94 ares
->response
, ares
->error
);
97 if (ares
->type
!= LDB_REPLY_DONE
) {
98 ldb_asprintf_errstring(ldb
, "Invalid LDB reply type %d", ares
->type
);
99 return ldb_module_done(ac
->req
, NULL
, NULL
,
100 LDB_ERR_OPERATIONS_ERROR
);
103 if (ac
->current
== NULL
) {
104 /* this was the last one */
105 return ldb_module_done(ac
->req
, ares
->controls
,
106 ares
->response
, LDB_SUCCESS
);
109 ret
= subtree_rename_next_request(ac
);
110 if (ret
!= LDB_SUCCESS
) {
111 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
118 static int subtree_rename_next_request(struct subtree_rename_context
*ac
)
120 struct ldb_context
*ldb
;
121 struct ldb_request
*req
;
124 ldb
= ldb_module_get_ctx(ac
->module
);
126 if (ac
->current
== NULL
) {
127 return ldb_operr(ldb
);
130 ret
= ldb_build_rename_req(&req
, ldb
, ac
->current
,
134 ac
, subtree_rename_callback
,
136 LDB_REQ_SET_LOCATION(req
);
137 if (ret
!= LDB_SUCCESS
) {
141 ac
->current
= ac
->current
->next
;
143 return ldb_next_request(ac
->module
, req
);
146 static int check_constraints(struct ldb_message
*msg
,
147 struct subtree_rename_context
*ac
,
148 struct ldb_dn
*olddn
, struct ldb_dn
*newdn
)
150 struct ldb_context
*ldb
= ldb_module_get_ctx(ac
->module
);
151 struct ldb_dn
*dn1
, *dn2
, *nc_root
;
153 bool move_op
= false;
154 bool rename_op
= false;
157 /* Skip the checks if old and new DN are the same, or if we have the
158 * relax control specified or if the returned objects is already
159 * deleted and needs only to be moved for consistency. */
161 if (ldb_dn_compare(olddn
, newdn
) == 0) {
164 if (ldb_request_get_control(ac
->req
, LDB_CONTROL_RELAX_OID
) != NULL
) {
167 if (ldb_msg_find_attr_as_bool(msg
, "isDeleted", false)) {
171 /* Objects under CN=System */
173 dn1
= ldb_dn_copy(ac
, ldb_get_default_basedn(ldb
));
174 if (dn1
== NULL
) return ldb_oom(ldb
);
176 if ( ! ldb_dn_add_child_fmt(dn1
, "CN=System")) {
178 return LDB_ERR_OPERATIONS_ERROR
;
181 if ((ldb_dn_compare_base(dn1
, olddn
) == 0) &&
182 (ldb_dn_compare_base(dn1
, newdn
) != 0)) {
184 ldb_asprintf_errstring(ldb
,
185 "subtree_rename: Cannot move/rename %s. Objects under CN=System have to stay under it!",
186 ldb_dn_get_linearized(olddn
));
187 return LDB_ERR_OTHER
;
194 if ((samdb_find_attribute(ldb
, msg
, "objectClass", "secret") != NULL
) ||
195 (samdb_find_attribute(ldb
, msg
, "objectClass", "trustedDomain") != NULL
)) {
196 ldb_asprintf_errstring(ldb
,
197 "subtree_rename: Cannot move/rename %s. It's an LSA-specific object!",
198 ldb_dn_get_linearized(olddn
));
199 return LDB_ERR_UNWILLING_TO_PERFORM
;
204 dn1
= ldb_dn_get_parent(ac
, olddn
);
205 if (dn1
== NULL
) return ldb_oom(ldb
);
206 dn2
= ldb_dn_get_parent(ac
, newdn
);
207 if (dn2
== NULL
) return ldb_oom(ldb
);
209 if (ldb_dn_compare(dn1
, dn2
) == 0) {
218 systemFlags
= ldb_msg_find_attr_as_int(msg
, "systemFlags", 0);
220 /* Fetch name context */
222 ret
= dsdb_find_nc_root(ldb
, ac
, olddn
, &nc_root
);
223 if (ret
!= LDB_SUCCESS
) {
227 if (ldb_dn_compare(nc_root
, ldb_get_schema_basedn(ldb
)) == 0) {
229 ldb_asprintf_errstring(ldb
,
230 "subtree_rename: Cannot move %s within schema partition",
231 ldb_dn_get_linearized(olddn
));
232 return LDB_ERR_UNWILLING_TO_PERFORM
;
235 (systemFlags
& SYSTEM_FLAG_SCHEMA_BASE_OBJECT
) != 0) {
236 ldb_asprintf_errstring(ldb
,
237 "subtree_rename: Cannot rename %s within schema partition",
238 ldb_dn_get_linearized(olddn
));
239 return LDB_ERR_UNWILLING_TO_PERFORM
;
241 } else if (ldb_dn_compare(nc_root
, ldb_get_config_basedn(ldb
)) == 0) {
243 (systemFlags
& SYSTEM_FLAG_CONFIG_ALLOW_MOVE
) == 0) {
244 /* Here we have to do more: control the
245 * "ALLOW_LIMITED_MOVE" flag. This means that the
246 * grand-grand-parents of two objects have to be equal
247 * in order to perform the move (this is used for
248 * moving "server" objects in the "sites" container). */
250 systemFlags
& SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE
;
253 dn1
= ldb_dn_copy(ac
, olddn
);
254 if (dn1
== NULL
) return ldb_oom(ldb
);
255 dn2
= ldb_dn_copy(ac
, newdn
);
256 if (dn2
== NULL
) return ldb_oom(ldb
);
258 limited_move
&= ldb_dn_remove_child_components(dn1
, 3);
259 limited_move
&= ldb_dn_remove_child_components(dn2
, 3);
260 limited_move
&= ldb_dn_compare(dn1
, dn2
) == 0;
267 ldb_asprintf_errstring(ldb
,
268 "subtree_rename: Cannot move %s to %s in config partition",
269 ldb_dn_get_linearized(olddn
), ldb_dn_get_linearized(newdn
));
270 return LDB_ERR_UNWILLING_TO_PERFORM
;
274 (systemFlags
& SYSTEM_FLAG_CONFIG_ALLOW_RENAME
) == 0) {
275 ldb_asprintf_errstring(ldb
,
276 "subtree_rename: Cannot rename %s to %s within config partition",
277 ldb_dn_get_linearized(olddn
), ldb_dn_get_linearized(newdn
));
278 return LDB_ERR_UNWILLING_TO_PERFORM
;
280 } else if (ldb_dn_compare(nc_root
, ldb_get_default_basedn(ldb
)) == 0) {
282 (systemFlags
& SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE
) != 0) {
283 ldb_asprintf_errstring(ldb
,
284 "subtree_rename: Cannot move %s to %s - DISALLOW_MOVE set",
285 ldb_dn_get_linearized(olddn
), ldb_dn_get_linearized(newdn
));
286 return LDB_ERR_UNWILLING_TO_PERFORM
;
289 (systemFlags
& SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME
) != 0) {
290 ldb_asprintf_errstring(ldb
,
291 "subtree_rename: Cannot rename %s to %s - DISALLOW_RENAME set",
292 ldb_dn_get_linearized(olddn
), ldb_dn_get_linearized(newdn
));
293 return LDB_ERR_UNWILLING_TO_PERFORM
;
297 talloc_free(nc_root
);
302 static int subtree_rename_search_callback(struct ldb_request
*req
,
303 struct ldb_reply
*ares
)
305 struct subren_msg_store
*store
;
306 struct subtree_rename_context
*ac
;
309 ac
= talloc_get_type(req
->context
, struct subtree_rename_context
);
311 if (!ares
|| !ac
->current
) {
312 return ldb_module_done(ac
->req
, NULL
, NULL
,
313 LDB_ERR_OPERATIONS_ERROR
);
315 if (ares
->error
!= LDB_SUCCESS
) {
316 return ldb_module_done(ac
->req
, ares
->controls
,
317 ares
->response
, ares
->error
);
320 switch (ares
->type
) {
321 case LDB_REPLY_ENTRY
:
322 if (ldb_dn_compare(ares
->message
->dn
, ac
->list
->olddn
) == 0) {
324 * This is the root entry of the originating move
325 * respectively rename request. It has been already
326 * stored in the list using "subtree_rename_search()".
327 * Only this one is subject to constraint checking.
329 ret
= check_constraints(ares
->message
, ac
,
332 if (ret
!= LDB_SUCCESS
) {
333 return ldb_module_done(ac
->req
, NULL
, NULL
,
341 store
= talloc_zero(ac
, struct subren_msg_store
);
343 return ldb_module_done(ac
->req
, NULL
, NULL
,
344 LDB_ERR_OPERATIONS_ERROR
);
346 ac
->current
->next
= store
;
349 /* the first list element contains the base for the rename */
350 store
->olddn
= talloc_steal(store
, ares
->message
->dn
);
351 store
->newdn
= ldb_dn_copy(store
, store
->olddn
);
353 if ( ! ldb_dn_remove_base_components(store
->newdn
,
354 ldb_dn_get_comp_num(ac
->list
->olddn
))) {
355 return ldb_module_done(ac
->req
, NULL
, NULL
,
356 LDB_ERR_OPERATIONS_ERROR
);
359 if ( ! ldb_dn_add_base(store
->newdn
, ac
->list
->newdn
)) {
360 return ldb_module_done(ac
->req
, NULL
, NULL
,
361 LDB_ERR_OPERATIONS_ERROR
);
365 case LDB_REPLY_REFERRAL
:
371 /* rewind ac->current */
372 ac
->current
= ac
->list
;
374 /* All dns set up, start with the first one */
375 ret
= subtree_rename_next_request(ac
);
377 if (ret
!= LDB_SUCCESS
) {
378 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
388 static int subtree_rename(struct ldb_module
*module
, struct ldb_request
*req
)
390 struct ldb_context
*ldb
;
391 static const char * const attrs
[] = { "objectClass", "systemFlags",
393 struct ldb_request
*search_req
;
394 struct subtree_rename_context
*ac
;
397 if (ldb_dn_is_special(req
->op
.rename
.olddn
)) { /* do not manipulate our control entries */
398 return ldb_next_request(module
, req
);
401 ldb
= ldb_module_get_ctx(module
);
403 /* This gets complex: We need to:
404 - Do a search for all entires under this entry
405 - Wait for these results to appear
406 - In the callback for each result, issue a modify request
407 - That will include this rename, we hope
408 - Wait for each modify result
412 ac
= subren_ctx_init(module
, req
);
417 /* add this entry as the first to do */
418 ac
->current
= talloc_zero(ac
, struct subren_msg_store
);
419 if (ac
->current
== NULL
) {
422 ac
->current
->olddn
= req
->op
.rename
.olddn
;
423 ac
->current
->newdn
= req
->op
.rename
.newdn
;
424 ac
->list
= ac
->current
;
426 ret
= ldb_build_search_req(&search_req
, ldb
, ac
,
427 req
->op
.rename
.olddn
,
433 subtree_rename_search_callback
,
435 LDB_REQ_SET_LOCATION(search_req
);
436 if (ret
!= LDB_SUCCESS
) {
440 ret
= ldb_request_add_control(search_req
, LDB_CONTROL_SHOW_RECYCLED_OID
,
442 if (ret
!= LDB_SUCCESS
) {
446 return ldb_next_request(module
, search_req
);
449 static const struct ldb_module_ops ldb_subtree_rename_module_ops
= {
450 .name
= "subtree_rename",
451 .rename
= subtree_rename
454 int ldb_subtree_rename_module_init(const char *version
)
456 LDB_MODULE_CHECK_VERSION(version
);
457 return ldb_register_module(&ldb_subtree_rename_module_ops
);