git.sur5r.net Git - openldap/blob - servers/slapd/schema.c

   1 /* schema.c - routines to enforce schema definitions */
   2
   3 #include "portable.h"
   4
   5 #include <stdio.h>
   6
   7 #include <ac/string.h>
   8 #include <ac/socket.h>
   9
  10 #include "ldapconfig.h"
  11 #include "slap.h"
  12
  13 static char *   oc_check_required(Entry *e, char *ocname);
  14 static int              oc_check_allowed(char *type, struct berval **ocl);
  15
  16 /*
  17  * oc_check - check that entry e conforms to the schema required by
  18  * its object class(es). returns 0 if so, non-zero otherwise.
  19  */
  20
  21 int
  22 oc_schema_check( Entry *e )
  23 {
  24         Attribute       *a, *aoc;
  25         int             i;
  26         int             ret = 0;
  27
  28         /* find the object class attribute - could error out here */
  29         if ( (aoc = attr_find( e->e_attrs, "objectclass" )) == NULL ) {
  30                 Debug( LDAP_DEBUG_ANY, "No object class for entry (%s)\n",
  31                     e->e_dn, 0, 0 );
  32                 return( 0 );
  33         }
  34
  35         /* check that the entry has required attrs for each oc */
  36         for ( i = 0; aoc->a_vals[i] != NULL; i++ ) {
  37                 char *s = oc_check_required( e, aoc->a_vals[i]->bv_val );
  38
  39                 if (s != NULL) {
  40                         Debug( LDAP_DEBUG_ANY,
  41                             "Entry (%s), oc \"%s\" requires attr \"%s\"\n",
  42                             e->e_dn, aoc->a_vals[i]->bv_val, s );
  43                         ret = 1;
  44                 }
  45         }
  46
  47         if ( ret != 0 ) {
  48             return( ret );
  49         }
  50
  51         /* check that each attr in the entry is allowed by some oc */
  52         for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
  53                 if ( oc_check_allowed( a->a_type, aoc->a_vals ) != 0 ) {
  54                         Debug( LDAP_DEBUG_ANY,
  55                             "Entry (%s), attr \"%s\" not allowed\n",
  56                             e->e_dn, a->a_type, 0 );
  57                         ret = 1;
  58                 }
  59         }
  60
  61         return( ret );
  62 }
  63
  64 static char *
  65 oc_check_required( Entry *e, char *ocname )
  66 {
  67         ObjectClass     *oc;
  68         AttributeType   *at;
  69         int             i;
  70         Attribute       *a;
  71         char            **pp;
  72
  73         Debug( LDAP_DEBUG_TRACE,
  74                "oc_check_required entry (%s), objectclass \"%s\"\n",
  75                e->e_dn, ocname, 0 );
  76
  77         /* find global oc defn. it we don't know about it assume it's ok */
  78         if ( (oc = oc_find( ocname )) == NULL ) {
  79                 return( 0 );
  80         }
  81
  82         /* check for empty oc_required */
  83         if(oc->soc_required == NULL) {
  84                 return( 0 );
  85         }
  86
  87         /* for each required attribute */
  88         for ( i = 0; oc->soc_required[i] != NULL; i++ ) {
  89                 at = oc->soc_required[i];
  90                 /* see if it's in the entry */
  91                 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
  92                         if ( at->sat_oid &&
  93                              strcmp( a->a_type, at->sat_oid ) == 0 ) {
  94                                 break;
  95                         }
  96                         pp = at->sat_names;
  97                         if ( pp  == NULL ) {
  98                                 /* Empty name list => not found */
  99                                 a = NULL;
 100                                 break;
 101                         }
 102                         while ( *pp ) {
 103                                 if ( strcasecmp( a->a_type, *pp ) == 0 ) {
 104                                         break;
 105                                 }
 106                                 pp++;
 107                         }
 108                         if ( *pp ) {
 109                                 break;
 110                         }
 111                 }
 112                 /* not there => schema violation */
 113                 if ( a == NULL ) {
 114                         if ( at->sat_names && at->sat_names[0] ) {
 115                                 return at->sat_names[0];
 116                         } else {
 117                                 return at->sat_oid;
 118                         }
 119                 }
 120         }
 121
 122         return( NULL );
 123 }
 124
 125 /*
 126  * check to see if attribute is 'operational' or not.
 127  * this function should be externalized...
 128  */
 129 static int
 130 oc_check_operational( char *type )
 131 {
 132         return ( strcasecmp( type, "modifiersname" ) == 0 ||
 133                 strcasecmp( type, "modifytimestamp" ) == 0 ||
 134                 strcasecmp( type, "creatorsname" ) == 0 ||
 135                 strcasecmp( type, "createtimestamp" ) == 0 )
 136                 ? 1 : 0;
 137 }
 138
 139 static int
 140 oc_check_allowed( char *type, struct berval **ocl )
 141 {
 142         ObjectClass     *oc;
 143         AttributeType   *at;
 144         int             i, j;
 145         char            **pp;
 146
 147         Debug( LDAP_DEBUG_TRACE,
 148                "oc_check_allowed type \"%s\"\n", type, 0, 0 );
 149
 150         /* always allow objectclass attribute */
 151         if ( strcasecmp( type, "objectclass" ) == 0 ) {
 152                 return( 0 );
 153         }
 154
 155         if ( oc_check_operational( type ) ) {
 156                 return( 0 );
 157         }
 158
 159         /* check that the type appears as req or opt in at least one oc */
 160         for ( i = 0; ocl[i] != NULL; i++ ) {
 161                 /* if we know about the oc */
 162                 if ( (oc = oc_find( ocl[i]->bv_val )) != NULL ) {
 163                         /* does it require the type? */
 164                         for ( j = 0; oc->soc_required != NULL &&
 165                                 oc->soc_required[j] != NULL; j++ ) {
 166                                 at = oc->soc_required[j];
 167                                 if ( at->sat_oid &&
 168                                      strcmp(at->sat_oid, type ) == 0 ) {
 169                                         return( 0 );
 170                                 }
 171                                 pp = at->sat_names;
 172                                 if ( pp == NULL )
 173                                         continue;
 174                                 while ( *pp ) {
 175                                         if ( strcasecmp( *pp, type ) == 0 ) {
 176                                                 return( 0 );
 177                                         }
 178                                         pp++;
 179                                 }
 180                         }
 181                         /* does it allow the type? */
 182                         for ( j = 0; oc->soc_allowed != NULL &&
 183                                 oc->soc_allowed[j] != NULL; j++ ) {
 184                                 at = oc->soc_allowed[j];
 185                                 if ( at->sat_oid &&
 186                                      strcmp(at->sat_oid, type ) == 0 ) {
 187                                         return( 0 );
 188                                 }
 189                                 pp = at->sat_names;
 190                                 if ( pp == NULL )
 191                                         continue;
 192                                 while ( *pp ) {
 193                                         if ( strcasecmp( *pp, type ) == 0 ||
 194                                              strcmp( *pp, "*" ) == 0 ) {
 195                                                 return( 0 );
 196                                         }
 197                                         pp++;
 198                                 }
 199                         }
 200                         /* maybe the next oc allows it */
 201
 202                 /* we don't know about the oc. assume it allows it */
 203                 } else {
 204                         return( 0 );
 205                 }
 206         }
 207
 208         /* not allowed by any oc */
 209         return( 1 );
 210 }
 211
 212 struct oindexrec {
 213         char            *oir_name;
 214         ObjectClass     *oir_oc;
 215 };
 216
 217 static Avlnode  *oc_index = NULL;
 218 static ObjectClass *oc_list = NULL;
 219
 220 static int
 221 oc_index_cmp(
 222     struct oindexrec    *oir1,
 223     struct oindexrec    *oir2
 224 )
 225 {
 226         return (strcasecmp( oir1->oir_name, oir2->oir_name ));
 227 }
 228
 229 static int
 230 oc_index_name_cmp(
 231     char                *type,
 232     struct oindexrec    *oir
 233 )
 234 {
 235         return (strcasecmp( type, oir->oir_name ));
 236 }
 237
 238 ObjectClass *
 239 oc_find( char *ocname )
 240 {
 241         struct oindexrec        *oir = NULL;
 242
 243         if ( (oir = (struct oindexrec *) avl_find( oc_index, ocname,
 244             (AVL_CMP) oc_index_name_cmp )) != NULL ) {
 245                 return( oir->oir_oc );
 246         }
 247         return( NULL );
 248 }
 249
 250 static int
 251 oc_create_required(
 252     ObjectClass         *soc,
 253     char                **attrs,
 254     char                **err
 255 )
 256 {
 257         char            **attrs1;
 258         int             nattrs;
 259         AttributeType   *sat;
 260         AttributeType   **satp;
 261         int             i;
 262
 263         if ( attrs ) {
 264                 attrs1 = attrs;
 265                 while ( *attrs1 ) {
 266                         sat = at_find(*attrs1);
 267                         if ( !sat ) {
 268                                 *err = *attrs1;
 269                                 return SLAP_SCHERR_ATTR_NOT_FOUND;
 270                         }
 271                         if ( at_find_in_list(sat, soc->soc_required) < 0) {
 272                                 if ( at_append_to_list(sat, &soc->soc_required) ) {
 273                                         *err = *attrs1;
 274                                         return SLAP_SCHERR_OUTOFMEM;
 275                                 }
 276                         }
 277                         attrs1++;
 278                 }
 279                 /* Now delete duplicates from the allowed list */
 280                 for ( satp = soc->soc_required; *satp; satp++ ) {
 281                         i = at_find_in_list(*satp,soc->soc_allowed);
 282                         if ( i >= 0 ) {
 283                                 at_delete_from_list(i, &soc->soc_allowed);
 284                         }
 285                 }
 286         }
 287         return 0;
 288 }
 289
 290 static int
 291 oc_create_allowed(
 292     ObjectClass         *soc,
 293     char                **attrs,
 294     char                **err
 295 )
 296 {
 297         char            **attrs1;
 298         int             nattrs;
 299         AttributeType   *sat;
 300         AttributeType   **satp;
 301         int             i;
 302
 303         if ( attrs ) {
 304                 attrs1 = attrs;
 305                 while ( *attrs1 ) {
 306                         sat = at_find(*attrs1);
 307                         if ( !sat ) {
 308                                 *err = *attrs1;
 309                                 return SLAP_SCHERR_ATTR_NOT_FOUND;
 310                         }
 311                         if ( at_find_in_list(sat, soc->soc_required) < 0 &&
 312                              at_find_in_list(sat, soc->soc_allowed) < 0 ) {
 313                                 if ( at_append_to_list(sat, &soc->soc_allowed) ) {
 314                                         *err = *attrs1;
 315                                         return SLAP_SCHERR_OUTOFMEM;
 316                                 }
 317                         }
 318                         attrs1++;
 319                 }
 320         }
 321         return 0;
 322 }
 323
 324 static int
 325 oc_add_sups(
 326     ObjectClass         *soc,
 327     char                **sups,
 328     char                **err
 329 )
 330 {
 331         int             code;
 332         ObjectClass     *soc1;
 333         int             nsups;
 334         char            **sups1;
 335         int             add_sups = 0;
 336
 337         if ( sups ) {
 338                 if ( !soc->soc_sups ) {
 339                         /* We are at the first recursive level */
 340                         add_sups = 1;
 341                         nsups = 0;
 342                         sups1 = sups;
 343                         while ( *sups1 ) {
 344                                 nsups++;
 345                                 sups1++;
 346                         }
 347                         nsups++;
 348                         soc->soc_sups = (ObjectClass **)ch_calloc(1,
 349                                           nsups*sizeof(ObjectClass *));
 350                 }
 351                 nsups = 0;
 352                 sups1 = sups;
 353                 while ( *sups1 ) {
 354                         soc1 = oc_find(*sups1);
 355                         if ( !soc1 ) {
 356                                 *err = *sups1;
 357                                 return SLAP_SCHERR_CLASS_NOT_FOUND;
 358                         }
 359
 360                         if ( add_sups )
 361                                 soc->soc_sups[nsups] = soc1;
 362
 363                         code = oc_add_sups(soc,soc1->soc_sup_oids, err);
 364                         if ( code )
 365                                 return code;
 366
 367                         if ( code = oc_create_required(soc,
 368                                 soc1->soc_at_oids_must,err) )
 369                                 return code;
 370                         if ( code = oc_create_allowed(soc,
 371                                 soc1->soc_at_oids_may,err) )
 372                                 return code;
 373                         nsups++;
 374                         sups1++;
 375                 }
 376         }
 377         return 0;
 378 }
 379
 380 static int
 381 oc_insert(
 382     ObjectClass         *soc,
 383     char                **err
 384 )
 385 {
 386         ObjectClass     **ocp;
 387         struct oindexrec        *oir;
 388         char                    **names;
 389
 390         ocp = &oc_list;
 391         while ( *ocp != NULL ) {
 392                 ocp = &(*ocp)->soc_next;
 393         }
 394         *ocp = soc;
 395
 396         if ( soc->soc_oid ) {
 397                 oir = (struct oindexrec *)
 398                         ch_calloc( 1, sizeof(struct oindexrec) );
 399                 oir->oir_name = soc->soc_oid;
 400                 oir->oir_oc = soc;
 401                 if ( avl_insert( &oc_index, (caddr_t) oir,
 402                                  (AVL_CMP) oc_index_cmp,
 403                                  (AVL_DUP) avl_dup_error ) ) {
 404                         *err = soc->soc_oid;
 405                         ldap_memfree(oir);
 406                         return SLAP_SCHERR_DUP_CLASS;
 407                 }
 408                 /* FIX: temporal consistency check */
 409                 oc_find(oir->oir_name);
 410         }
 411         if ( (names = soc->soc_names) ) {
 412                 while ( *names ) {
 413                         oir = (struct oindexrec *)
 414                                 ch_calloc( 1, sizeof(struct oindexrec) );
 415                         oir->oir_name = ch_strdup(*names);
 416                         oir->oir_oc = soc;
 417                         if ( avl_insert( &oc_index, (caddr_t) oir,
 418                                          (AVL_CMP) oc_index_cmp,
 419                                          (AVL_DUP) avl_dup_error ) ) {
 420                                 *err = *names;
 421                                 ldap_memfree(oir);
 422                                 return SLAP_SCHERR_DUP_CLASS;
 423                         }
 424                         /* FIX: temporal consistency check */
 425                         oc_find(oir->oir_name);
 426                         names++;
 427                 }
 428         }
 429         return 0;
 430 }
 431
 432 int
 433 oc_add(
 434     LDAP_OBJECT_CLASS   *oc,
 435     char                **err
 436 )
 437 {
 438         ObjectClass     *soc;
 439         int             code;
 440
 441         soc = (ObjectClass *) ch_calloc( 1, sizeof(ObjectClass) );
 442         memcpy( &soc->soc_oclass, oc, sizeof(LDAP_OBJECT_CLASS));
 443         if ( code = oc_add_sups(soc,soc->soc_sup_oids,err) )
 444                 return code;
 445         if ( code = oc_create_required(soc,soc->soc_at_oids_must,err) )
 446                 return code;
 447         if ( code = oc_create_allowed(soc,soc->soc_at_oids_may,err) )
 448                 return code;
 449         code = oc_insert(soc,err);
 450         return code;
 451 }
 452
 453 #if defined( SLAPD_SCHEMA_DN )
 454
 455 static int
 456 oc_schema_info( Entry *e )
 457 {
 458         struct berval   val;
 459         struct berval   *vals[2];
 460         ObjectClass     *oc;
 461
 462         vals[0] = &val;
 463         vals[1] = NULL;
 464
 465         for ( oc = oc_list; oc; oc = oc->soc_next ) {
 466                 val.bv_val = ldap_objectclass2str( &oc->soc_oclass );
 467                 if ( val.bv_val ) {
 468                         val.bv_len = strlen( val.bv_val );
 469                         Debug( LDAP_DEBUG_TRACE, "Merging oc [%d] %s\n",
 470                                val.bv_len, val.bv_val, 0 );
 471                         attr_merge( e, "objectclasses", vals );
 472                         ldap_memfree( val.bv_val );
 473                 } else {
 474                         return -1;
 475                 }
 476         }
 477         return 0;
 478 }
 479
 480 void
 481 schema_info( Connection *conn, Operation *op, char **attrs, int attrsonly )
 482 {
 483         Entry           *e;
 484         struct berval   val;
 485         struct berval   *vals[2];
 486
 487         vals[0] = &val;
 488         vals[1] = NULL;
 489
 490         e = (Entry *) ch_calloc( 1, sizeof(Entry) );
 491
 492         e->e_attrs = NULL;
 493         e->e_dn = ch_strdup( SLAPD_SCHEMA_DN );
 494         e->e_ndn = dn_normalize_case( ch_strdup( SLAPD_SCHEMA_DN ));
 495         e->e_private = NULL;
 496
 497         val.bv_val = ch_strdup( "top" );
 498         val.bv_len = strlen( val.bv_val );
 499         attr_merge( e, "objectclass", vals );
 500         ldap_memfree( val.bv_val );
 501
 502         val.bv_val = ch_strdup( "subschema" );
 503         val.bv_len = strlen( val.bv_val );
 504         attr_merge( e, "objectclass", vals );
 505         ldap_memfree( val.bv_val );
 506
 507         if ( at_schema_info( e ) ) {
 508                 /* Out of memory, do something about it */
 509                 entry_free( e );
 510                 return;
 511         }
 512         if ( oc_schema_info( e ) ) {
 513                 /* Out of memory, do something about it */
 514                 entry_free( e );
 515                 return;
 516         }
 517
 518         send_search_entry( &backends[0], conn, op, e, attrs, attrsonly );
 519         send_ldap_search_result( conn, op, LDAP_SUCCESS, NULL, NULL, 1 );
 520
 521         entry_free( e );
 522 }
 523 #endif
 524
 525 #ifdef LDAP_DEBUG
 526
 527 static void
 528 oc_print( ObjectClass *oc )
 529 {
 530         int     i;
 531
 532         if ( oc->soc_names && oc->soc_names[0] ) {
 533                 printf( "objectclass %s\n", oc->soc_names[0] );
 534         } else {
 535                 printf( "objectclass %s\n", oc->soc_oid );
 536         }
 537         if ( oc->soc_required != NULL ) {
 538                 printf( "\trequires %s", oc->soc_required[0] );
 539                 for ( i = 1; oc->soc_required[i] != NULL; i++ ) {
 540                         printf( ",%s", oc->soc_required[i] );
 541                 }
 542                 printf( "\n" );
 543         }
 544         if ( oc->soc_allowed != NULL ) {
 545                 printf( "\tallows %s", oc->soc_allowed[0] );
 546                 for ( i = 1; oc->soc_allowed[i] != NULL; i++ ) {
 547                         printf( ",%s", oc->soc_allowed[i] );
 548                 }
 549                 printf( "\n" );
 550         }
 551 }
 552
 553 #endif