source4/dsdb/samdb/ldb_modules/subtree_rename.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2007
   5    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
   6    Copyright (C) Matthias Dieter WallnÃ¶fer <mdw@samba.org> 2010-2011
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23  *  Name: ldb
  24  *
  25  *  Component: ldb subtree rename module
  26  *
  27  *  Description: Rename a subtree in LDB
  28  *
  29  *  Author: Andrew Bartlett
  30  */
  31
  32 #include "includes.h"
  33 #include <ldb.h>
  34 #include <ldb_module.h>
  35 #include "libds/common/flags.h"
  36 #include "dsdb/samdb/samdb.h"
  37
  38 struct subren_msg_store {
  39         struct subren_msg_store *next;
  40         struct ldb_dn *olddn;
  41         struct ldb_dn *newdn;
  42 };
  43
  44 struct subtree_rename_context {
  45         struct ldb_module *module;
  46         struct ldb_request *req;
  47
  48         struct subren_msg_store *list;
  49         struct subren_msg_store *current;
  50 };
  51
  52 static struct subtree_rename_context *subren_ctx_init(struct ldb_module *module,
  53                                                       struct ldb_request *req)
  54 {
  55         struct subtree_rename_context *ac;
  56
  57
  58         ac = talloc_zero(req, struct subtree_rename_context);
  59         if (ac == NULL) {
  60                 return NULL;
  61         }
  62
  63         ac->module = module;
  64         ac->req = req;
  65
  66         return ac;
  67 }
  68
  69 static int subtree_rename_next_request(struct subtree_rename_context *ac);
  70
  71 static int subtree_rename_callback(struct ldb_request *req,
  72                                    struct ldb_reply *ares)
  73 {
  74         struct ldb_context *ldb;
  75         struct subtree_rename_context *ac;
  76         int ret;
  77
  78         ac = talloc_get_type(req->context, struct subtree_rename_context);
  79         ldb = ldb_module_get_ctx(ac->module);
  80
  81         if (!ares) {
  82                 return ldb_module_done(ac->req, NULL, NULL,
  83                                         LDB_ERR_OPERATIONS_ERROR);
  84         }
  85
  86         if (ares->type == LDB_REPLY_REFERRAL) {
  87                 return ldb_module_send_referral(ac->req, ares->referral);
  88         }
  89
  90         if (ares->error != LDB_SUCCESS) {
  91                 return ldb_module_done(ac->req, ares->controls,
  92                                         ares->response, ares->error);
  93         }
  94
  95         if (ares->type != LDB_REPLY_DONE) {
  96                 ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
  97                 return ldb_module_done(ac->req, NULL, NULL,
  98                                         LDB_ERR_OPERATIONS_ERROR);
  99         }
 100
 101         if (ac->current == NULL) {
 102                 /* this was the last one */
 103                 return ldb_module_done(ac->req, ares->controls,
 104                                         ares->response, LDB_SUCCESS);
 105         }
 106
 107         ret = subtree_rename_next_request(ac);
 108         if (ret != LDB_SUCCESS) {
 109                 return ldb_module_done(ac->req, NULL, NULL, ret);
 110         }
 111
 112         talloc_free(ares);
 113         return LDB_SUCCESS;
 114 }
 115
 116 static int subtree_rename_next_request(struct subtree_rename_context *ac)
 117 {
 118         struct ldb_context *ldb;
 119         struct ldb_request *req;
 120         int ret;
 121
 122         ldb = ldb_module_get_ctx(ac->module);
 123
 124         if (ac->current == NULL) {
 125                 return ldb_operr(ldb);
 126         }
 127
 128         ret = ldb_build_rename_req(&req, ldb, ac->current,
 129                                    ac->current->olddn,
 130                                    ac->current->newdn,
 131                                    ac->req->controls,
 132                                    ac, subtree_rename_callback,
 133                                    ac->req);
 134         LDB_REQ_SET_LOCATION(req);
 135         if (ret != LDB_SUCCESS) {
 136                 return ret;
 137         }
 138
 139         ac->current = ac->current->next;
 140
 141         return ldb_next_request(ac->module, req);
 142 }
 143
 144 static int check_constraints(struct ldb_message *msg,
 145                              struct subtree_rename_context *ac,
 146                              struct ldb_dn *olddn, struct ldb_dn *newdn)
 147 {
 148         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 149         struct ldb_dn *dn1, *dn2, *nc_root;
 150         int32_t systemFlags;
 151         bool move_op = false;
 152         bool rename_op = false;
 153         int ret;
 154
 155         /* Skip the checks if old and new DN are the same, or if we have the
 156          * relax control specified or if the returned objects is already
 157          * deleted and needs only to be moved for consistency. */
 158
 159         if (ldb_dn_compare(olddn, newdn) == 0) {
 160                 return LDB_SUCCESS;
 161         }
 162         if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) != NULL) {
 163                 return LDB_SUCCESS;
 164         }
 165         if (ldb_msg_find_attr_as_bool(msg, "isDeleted", false)) {
 166                 return LDB_SUCCESS;
 167         }
 168
 169         /* Objects under CN=System */
 170
 171         dn1 = ldb_dn_copy(ac, ldb_get_default_basedn(ldb));
 172         if (dn1 == NULL) return ldb_oom(ldb);
 173
 174         if ( ! ldb_dn_add_child_fmt(dn1, "CN=System")) {
 175                 talloc_free(dn1);
 176                 return LDB_ERR_OPERATIONS_ERROR;
 177         }
 178
 179         if ((ldb_dn_compare_base(dn1, olddn) == 0) &&
 180             (ldb_dn_compare_base(dn1, newdn) != 0)) {
 181                 talloc_free(dn1);
 182                 ldb_asprintf_errstring(ldb,
 183                                        "subtree_rename: Cannot move/rename %s. Objects under CN=System have to stay under it!",
 184                                        ldb_dn_get_linearized(olddn));
 185                 return LDB_ERR_OTHER;
 186         }
 187
 188         talloc_free(dn1);
 189
 190         /* LSA objects */
 191
 192         if ((samdb_find_attribute(ldb, msg, "objectClass", "secret") != NULL) ||
 193             (samdb_find_attribute(ldb, msg, "objectClass", "trustedDomain") != NULL)) {
 194                 ldb_asprintf_errstring(ldb,
 195                                        "subtree_rename: Cannot move/rename %s. It's an LSA-specific object!",
 196                                        ldb_dn_get_linearized(olddn));
 197                 return LDB_ERR_UNWILLING_TO_PERFORM;
 198         }
 199
 200         /* systemFlags */
 201
 202         dn1 = ldb_dn_get_parent(ac, olddn);
 203         if (dn1 == NULL) return ldb_oom(ldb);
 204         dn2 = ldb_dn_get_parent(ac, newdn);
 205         if (dn2 == NULL) return ldb_oom(ldb);
 206
 207         if (ldb_dn_compare(dn1, dn2) == 0) {
 208                 rename_op = true;
 209         } else {
 210                 move_op = true;
 211         }
 212
 213         talloc_free(dn1);
 214         talloc_free(dn2);
 215
 216         systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
 217
 218         /* Fetch name context */
 219
 220         ret = dsdb_find_nc_root(ldb, ac, olddn, &nc_root);
 221         if (ret != LDB_SUCCESS) {
 222                 return ret;
 223         }
 224
 225         if (ldb_dn_compare(nc_root, ldb_get_schema_basedn(ldb)) == 0) {
 226                 if (move_op) {
 227                         ldb_asprintf_errstring(ldb,
 228                                                "subtree_rename: Cannot move %s within schema partition",
 229                                                ldb_dn_get_linearized(olddn));
 230                         return LDB_ERR_UNWILLING_TO_PERFORM;
 231                 }
 232                 if (rename_op &&
 233                     (systemFlags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) != 0) {
 234                         ldb_asprintf_errstring(ldb,
 235                                                "subtree_rename: Cannot rename %s within schema partition",
 236                                                ldb_dn_get_linearized(olddn));
 237                         return LDB_ERR_UNWILLING_TO_PERFORM;
 238                 }
 239         } else if (ldb_dn_compare(nc_root, ldb_get_config_basedn(ldb)) == 0) {
 240                 if (move_op &&
 241                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_MOVE) == 0) {
 242                         /* Here we have to do more: control the
 243                          * "ALLOW_LIMITED_MOVE" flag. This means that the
 244                          * grand-grand-parents of two objects have to be equal
 245                          * in order to perform the move (this is used for
 246                          * moving "server" objects in the "sites" container). */
 247                         bool limited_move =
 248                                 systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE;
 249
 250                         if (limited_move) {
 251                                 dn1 = ldb_dn_copy(ac, olddn);
 252                                 if (dn1 == NULL) return ldb_oom(ldb);
 253                                 dn2 = ldb_dn_copy(ac, newdn);
 254                                 if (dn2 == NULL) return ldb_oom(ldb);
 255
 256                                 limited_move &= ldb_dn_remove_child_components(dn1, 3);
 257                                 limited_move &= ldb_dn_remove_child_components(dn2, 3);
 258                                 limited_move &= ldb_dn_compare(dn1, dn2) == 0;
 259
 260                                 talloc_free(dn1);
 261                                 talloc_free(dn2);
 262                         }
 263
 264                         if (!limited_move) {
 265                                 ldb_asprintf_errstring(ldb,
 266                                                        "subtree_rename: Cannot move %s to %s in config partition",
 267                                                        ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
 268                                 return LDB_ERR_UNWILLING_TO_PERFORM;
 269                         }
 270                 }
 271                 if (rename_op &&
 272                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_RENAME) == 0) {
 273                         ldb_asprintf_errstring(ldb,
 274                                                "subtree_rename: Cannot rename %s to %s within config partition",
 275                                                ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
 276                         return LDB_ERR_UNWILLING_TO_PERFORM;
 277                 }
 278         } else if (ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) == 0) {
 279                 if (move_op &&
 280                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE) != 0) {
 281                         ldb_asprintf_errstring(ldb,
 282                                                "subtree_rename: Cannot move %s to %s - DISALLOW_MOVE set",
 283                                                ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
 284                         return LDB_ERR_UNWILLING_TO_PERFORM;
 285                 }
 286                 if (rename_op &&
 287                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME) != 0) {
 288                         ldb_asprintf_errstring(ldb,
 289                                                        "subtree_rename: Cannot rename %s to %s - DISALLOW_RENAME set",
 290                                                ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
 291                         return LDB_ERR_UNWILLING_TO_PERFORM;
 292                 }
 293         }
 294
 295         talloc_free(nc_root);
 296
 297         return LDB_SUCCESS;
 298 }
 299
 300 static int subtree_rename_search_callback(struct ldb_request *req,
 301                                           struct ldb_reply *ares)
 302 {
 303         struct subren_msg_store *store;
 304         struct subtree_rename_context *ac;
 305         int ret;
 306
 307         ac = talloc_get_type(req->context, struct subtree_rename_context);
 308
 309         if (!ares || !ac->current) {
 310                 return ldb_module_done(ac->req, NULL, NULL,
 311                                         LDB_ERR_OPERATIONS_ERROR);
 312         }
 313         if (ares->error != LDB_SUCCESS) {
 314                 return ldb_module_done(ac->req, ares->controls,
 315                                         ares->response, ares->error);
 316         }
 317
 318         switch (ares->type) {
 319         case LDB_REPLY_ENTRY:
 320                 if (ldb_dn_compare(ares->message->dn, ac->list->olddn) == 0) {
 321                         /*
 322                          * This is the root entry of the originating move
 323                          * respectively rename request. It has been already
 324                          * stored in the list using "subtree_rename_search()".
 325                          * Only this one is subject to constraint checking.
 326                          */
 327                         ret = check_constraints(ares->message, ac,
 328                                                 ac->list->olddn,
 329                                                 ac->list->newdn);
 330                         if (ret != LDB_SUCCESS) {
 331                                 return ldb_module_done(ac->req, NULL, NULL,
 332                                                        ret);
 333                         }
 334
 335                         talloc_free(ares);
 336                         return LDB_SUCCESS;
 337                 }
 338
 339                 store = talloc_zero(ac, struct subren_msg_store);
 340                 if (store == NULL) {
 341                         return ldb_module_done(ac->req, NULL, NULL,
 342                                                 LDB_ERR_OPERATIONS_ERROR);
 343                 }
 344                 ac->current->next = store;
 345                 ac->current = store;
 346
 347                 /* the first list element contains the base for the rename */
 348                 store->olddn = talloc_steal(store, ares->message->dn);
 349                 store->newdn = ldb_dn_copy(store, store->olddn);
 350
 351                 if ( ! ldb_dn_remove_base_components(store->newdn,
 352                                 ldb_dn_get_comp_num(ac->list->olddn))) {
 353                         return ldb_module_done(ac->req, NULL, NULL,
 354                                                 LDB_ERR_OPERATIONS_ERROR);
 355                 }
 356
 357                 if ( ! ldb_dn_add_base(store->newdn, ac->list->newdn)) {
 358                         return ldb_module_done(ac->req, NULL, NULL,
 359                                                 LDB_ERR_OPERATIONS_ERROR);
 360                 }
 361                 break;
 362
 363         case LDB_REPLY_REFERRAL:
 364                 /* ignore */
 365                 break;
 366
 367         case LDB_REPLY_DONE:
 368
 369                 /* rewind ac->current */
 370                 ac->current = ac->list;
 371
 372                 /* All dns set up, start with the first one */
 373                 ret = subtree_rename_next_request(ac);
 374
 375                 if (ret != LDB_SUCCESS) {
 376                         return ldb_module_done(ac->req, NULL, NULL, ret);
 377                 }
 378                 break;
 379         }
 380
 381         talloc_free(ares);
 382         return LDB_SUCCESS;
 383 }
 384
 385 /* rename */
 386 static int subtree_rename(struct ldb_module *module, struct ldb_request *req)
 387 {
 388         struct ldb_context *ldb;
 389         static const char * const attrs[] = { "objectClass", "systemFlags",
 390                                               "isDeleted", NULL };
 391         struct ldb_request *search_req;
 392         struct subtree_rename_context *ac;
 393         int ret;
 394
 395         if (ldb_dn_is_special(req->op.rename.olddn)) { /* do not manipulate our control entries */
 396                 return ldb_next_request(module, req);
 397         }
 398
 399         ldb = ldb_module_get_ctx(module);
 400
 401         /* This gets complex:  We need to:
 402            - Do a search for all entires under this entry
 403            - Wait for these results to appear
 404            - In the callback for each result, issue a modify request
 405            - That will include this rename, we hope
 406            - Wait for each modify result
 407            - Regain our sanity
 408         */
 409
 410         ac = subren_ctx_init(module, req);
 411         if (!ac) {
 412                 return ldb_oom(ldb);
 413         }
 414
 415         /* add this entry as the first to do */
 416         ac->current = talloc_zero(ac, struct subren_msg_store);
 417         if (ac->current == NULL) {
 418                 return ldb_oom(ldb);
 419         }
 420         ac->current->olddn = req->op.rename.olddn;
 421         ac->current->newdn = req->op.rename.newdn;
 422         ac->list = ac->current;
 423
 424         ret = ldb_build_search_req(&search_req, ldb, ac,
 425                                    req->op.rename.olddn,
 426                                    LDB_SCOPE_SUBTREE,
 427                                    "(objectClass=*)",
 428                                    attrs,
 429                                    NULL,
 430                                    ac,
 431                                    subtree_rename_search_callback,
 432                                    req);
 433         LDB_REQ_SET_LOCATION(search_req);
 434         if (ret != LDB_SUCCESS) {
 435                 return ret;
 436         }
 437
 438         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
 439                                       true, NULL);
 440         if (ret != LDB_SUCCESS) {
 441                 return ret;
 442         }
 443
 444         return ldb_next_request(module, search_req);
 445 }
 446
 447 static const struct ldb_module_ops ldb_subtree_rename_module_ops = {
 448         .name              = "subtree_rename",
 449         .rename            = subtree_rename
 450 };
 451
 452 int ldb_subtree_rename_module_init(const char *version)
 453 {
 454         LDB_MODULE_CHECK_VERSION(version);
 455         return ldb_register_module(&ldb_subtree_rename_module_ops);
 456 }