git.sur5r.net Git - openldap/blob - servers/slapd/schema.c

   1 /* schema.c - routines to enforce schema definitions */
   2
   3 #include "portable.h"
   4
   5 #include <stdio.h>
   6
   7 #include <ac/string.h>
   8 #include <ac/socket.h>
   9
  10 #include "ldapconfig.h"
  11 #include "slap.h"
  12
  13 static char *   oc_check_required(Entry *e, char *ocname);
  14 static int              oc_check_allowed(char *type, struct berval **ocl);
  15
  16 /*
  17  * oc_check - check that entry e conforms to the schema required by
  18  * its object class(es). returns 0 if so, non-zero otherwise.
  19  */
  20
  21 int
  22 oc_schema_check( Entry *e )
  23 {
  24         Attribute       *a, *aoc;
  25         int             i;
  26         int             ret = 0;
  27
  28         /* find the object class attribute - could error out here */
  29         if ( (aoc = attr_find( e->e_attrs, "objectclass" )) == NULL ) {
  30                 Debug( LDAP_DEBUG_ANY, "No object class for entry (%s)\n",
  31                     e->e_dn, 0, 0 );
  32                 return( 0 );
  33         }
  34
  35         /* check that the entry has required attrs for each oc */
  36         for ( i = 0; aoc->a_vals[i] != NULL; i++ ) {
  37                 char *s = oc_check_required( e, aoc->a_vals[i]->bv_val );
  38
  39                 if (s != NULL) {
  40                         Debug( LDAP_DEBUG_ANY,
  41                             "Entry (%s), oc \"%s\" requires attr \"%s\"\n",
  42                             e->e_dn, aoc->a_vals[i]->bv_val, s );
  43                         ret = 1;
  44                 }
  45         }
  46
  47         if ( ret != 0 ) {
  48             return( ret );
  49         }
  50
  51         /* check that each attr in the entry is allowed by some oc */
  52         for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
  53                 if ( oc_check_allowed( a->a_type, aoc->a_vals ) != 0 ) {
  54                         Debug( LDAP_DEBUG_ANY,
  55                             "Entry (%s), attr \"%s\" not allowed\n",
  56                             e->e_dn, a->a_type, 0 );
  57                         ret = 1;
  58                 }
  59         }
  60
  61         return( ret );
  62 }
  63
  64 static char *
  65 oc_check_required( Entry *e, char *ocname )
  66 {
  67         ObjectClass     *oc;
  68         AttributeType   *at;
  69         int             i;
  70         Attribute       *a;
  71         char            **pp;
  72
  73         Debug( LDAP_DEBUG_TRACE,
  74                "oc_check_required entry (%s), objectclass \"%s\"\n",
  75                e->e_dn, ocname, 0 );
  76
  77         /* find global oc defn. it we don't know about it assume it's ok */
  78         if ( (oc = oc_find( ocname )) == NULL ) {
  79                 return( 0 );
  80         }
  81
  82         /* check for empty oc_required */
  83         if(oc->soc_required == NULL) {
  84                 return( 0 );
  85         }
  86
  87         /* for each required attribute */
  88         for ( i = 0; oc->soc_required[i] != NULL; i++ ) {
  89                 at = oc->soc_required[i];
  90                 /* see if it's in the entry */
  91                 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
  92                         if ( at->sat_oid &&
  93                              strcmp( a->a_type, at->sat_oid ) == 0 ) {
  94                                 break;
  95                         }
  96                         pp = at->sat_names;
  97                         if ( pp  == NULL ) {
  98                                 /* Empty name list => not found */
  99                                 a = NULL;
 100                                 break;
 101                         }
 102                         while ( *pp ) {
 103                                 if ( strcasecmp( a->a_type, *pp ) == 0 ) {
 104                                         break;
 105                                 }
 106                                 pp++;
 107                         }
 108                         if ( *pp ) {
 109                                 break;
 110                         }
 111                 }
 112                 /* not there => schema violation */
 113                 if ( a == NULL ) {
 114                         if ( at->sat_names && at->sat_names[0] ) {
 115                                 return at->sat_names[0];
 116                         } else {
 117                                 return at->sat_oid;
 118                         }
 119                 }
 120         }
 121
 122         return( NULL );
 123 }
 124
 125 /*
 126  * check to see if attribute is 'operational' or not.
 127  * this function should be externalized...
 128  */
 129 static int
 130 oc_check_operational( char *type )
 131 {
 132         return ( strcasecmp( type, "modifiersname" ) == 0 ||
 133                 strcasecmp( type, "modifytimestamp" ) == 0 ||
 134                 strcasecmp( type, "creatorsname" ) == 0 ||
 135                 strcasecmp( type, "createtimestamp" ) == 0 )
 136                 ? 1 : 0;
 137 }
 138
 139 static int
 140 oc_check_allowed( char *type, struct berval **ocl )
 141 {
 142         ObjectClass     *oc;
 143         AttributeType   *at;
 144         int             i, j;
 145         char            **pp;
 146
 147         Debug( LDAP_DEBUG_TRACE,
 148                "oc_check_allowed type \"%s\"\n", type, 0, 0 );
 149
 150         /* always allow objectclass attribute */
 151         if ( strcasecmp( type, "objectclass" ) == 0 ) {
 152                 return( 0 );
 153         }
 154
 155         if ( oc_check_operational( type ) ) {
 156                 return( 0 );
 157         }
 158
 159         /* check that the type appears as req or opt in at least one oc */
 160         for ( i = 0; ocl[i] != NULL; i++ ) {
 161                 /* if we know about the oc */
 162                 if ( (oc = oc_find( ocl[i]->bv_val )) != NULL ) {
 163                         /* does it require the type? */
 164                         for ( j = 0; oc->soc_required != NULL &&
 165                                 oc->soc_required[j] != NULL; j++ ) {
 166                                 at = oc->soc_required[j];
 167                                 if ( at->sat_oid &&
 168                                      strcmp(at->sat_oid, type ) == 0 ) {
 169                                         return( 0 );
 170                                 }
 171                                 pp = at->sat_names;
 172                                 if ( pp == NULL )
 173                                         continue;
 174                                 while ( *pp ) {
 175                                         if ( strcasecmp( *pp, type ) == 0 ) {
 176                                                 return( 0 );
 177                                         }
 178                                         pp++;
 179                                 }
 180                         }
 181                         /* does it allow the type? */
 182                         for ( j = 0; oc->soc_allowed != NULL &&
 183                                 oc->soc_allowed[j] != NULL; j++ ) {
 184                                 at = oc->soc_allowed[j];
 185                                 if ( at->sat_oid &&
 186                                      strcmp(at->sat_oid, type ) == 0 ) {
 187                                         return( 0 );
 188                                 }
 189                                 pp = at->sat_names;
 190                                 if ( pp == NULL )
 191                                         continue;
 192                                 while ( *pp ) {
 193                                         if ( strcasecmp( *pp, type ) == 0 ||
 194                                              strcmp( *pp, "*" ) == 0 ) {
 195                                                 return( 0 );
 196                                         }
 197                                         pp++;
 198                                 }
 199                         }
 200                         /* maybe the next oc allows it */
 201
 202                 /* we don't know about the oc. assume it allows it */
 203                 } else {
 204                         return( 0 );
 205                 }
 206         }
 207
 208         /* not allowed by any oc */
 209         return( 1 );
 210 }
 211
 212 struct oindexrec {
 213         char            *oir_name;
 214         ObjectClass     *oir_oc;
 215 };
 216
 217 static Avlnode  *oc_index = NULL;
 218 static ObjectClass *oc_list = NULL;
 219
 220 static int
 221 oc_index_cmp(
 222     struct oindexrec    *oir1,
 223     struct oindexrec    *oir2
 224 )
 225 {
 226         return (strcasecmp( oir1->oir_name, oir2->oir_name ));
 227 }
 228
 229 static int
 230 oc_index_name_cmp(
 231     char                *type,
 232     struct oindexrec    *oir
 233 )
 234 {
 235         return (strcasecmp( type, oir->oir_name ));
 236 }
 237
 238 ObjectClass *
 239 oc_find( char *ocname )
 240 {
 241         struct oindexrec        *oir = NULL;
 242
 243         if ( (oir = (struct oindexrec *) avl_find( oc_index, ocname,
 244             (AVL_CMP) oc_index_name_cmp )) != NULL ) {
 245                 return( oir->oir_oc );
 246         }
 247         return( NULL );
 248 }
 249
 250 static int
 251 oc_create_required(
 252     ObjectClass         *soc,
 253     char                **attrs,
 254     char                **err
 255 )
 256 {
 257         char            **attrs1;
 258         AttributeType   *sat;
 259         AttributeType   **satp;
 260         int             i;
 261
 262         if ( attrs ) {
 263                 attrs1 = attrs;
 264                 while ( *attrs1 ) {
 265                         sat = at_find(*attrs1);
 266                         if ( !sat ) {
 267                                 *err = *attrs1;
 268                                 return SLAP_SCHERR_ATTR_NOT_FOUND;
 269                         }
 270                         if ( at_find_in_list(sat, soc->soc_required) < 0) {
 271                                 if ( at_append_to_list(sat, &soc->soc_required) ) {
 272                                         *err = *attrs1;
 273                                         return SLAP_SCHERR_OUTOFMEM;
 274                                 }
 275                         }
 276                         attrs1++;
 277                 }
 278                 /* Now delete duplicates from the allowed list */
 279                 for ( satp = soc->soc_required; *satp; satp++ ) {
 280                         i = at_find_in_list(*satp,soc->soc_allowed);
 281                         if ( i >= 0 ) {
 282                                 at_delete_from_list(i, &soc->soc_allowed);
 283                         }
 284                 }
 285         }
 286         return 0;
 287 }
 288
 289 static int
 290 oc_create_allowed(
 291     ObjectClass         *soc,
 292     char                **attrs,
 293     char                **err
 294 )
 295 {
 296         char            **attrs1;
 297         AttributeType   *sat;
 298
 299         if ( attrs ) {
 300                 attrs1 = attrs;
 301                 while ( *attrs1 ) {
 302                         sat = at_find(*attrs1);
 303                         if ( !sat ) {
 304                                 *err = *attrs1;
 305                                 return SLAP_SCHERR_ATTR_NOT_FOUND;
 306                         }
 307                         if ( at_find_in_list(sat, soc->soc_required) < 0 &&
 308                              at_find_in_list(sat, soc->soc_allowed) < 0 ) {
 309                                 if ( at_append_to_list(sat, &soc->soc_allowed) ) {
 310                                         *err = *attrs1;
 311                                         return SLAP_SCHERR_OUTOFMEM;
 312                                 }
 313                         }
 314                         attrs1++;
 315                 }
 316         }
 317         return 0;
 318 }
 319
 320 static int
 321 oc_add_sups(
 322     ObjectClass         *soc,
 323     char                **sups,
 324     char                **err
 325 )
 326 {
 327         int             code;
 328         ObjectClass     *soc1;
 329         int             nsups;
 330         char            **sups1;
 331         int             add_sups = 0;
 332
 333         if ( sups ) {
 334                 if ( !soc->soc_sups ) {
 335                         /* We are at the first recursive level */
 336                         add_sups = 1;
 337                         nsups = 0;
 338                         sups1 = sups;
 339                         while ( *sups1 ) {
 340                                 nsups++;
 341                                 sups1++;
 342                         }
 343                         nsups++;
 344                         soc->soc_sups = (ObjectClass **)ch_calloc(1,
 345                                           nsups*sizeof(ObjectClass *));
 346                 }
 347                 nsups = 0;
 348                 sups1 = sups;
 349                 while ( *sups1 ) {
 350                         soc1 = oc_find(*sups1);
 351                         if ( !soc1 ) {
 352                                 *err = *sups1;
 353                                 return SLAP_SCHERR_CLASS_NOT_FOUND;
 354                         }
 355
 356                         if ( add_sups )
 357                                 soc->soc_sups[nsups] = soc1;
 358
 359                         code = oc_add_sups(soc,soc1->soc_sup_oids, err);
 360                         if ( code )
 361                                 return code;
 362
 363                         if ( code = oc_create_required(soc,
 364                                 soc1->soc_at_oids_must,err) )
 365                                 return code;
 366                         if ( code = oc_create_allowed(soc,
 367                                 soc1->soc_at_oids_may,err) )
 368                                 return code;
 369                         nsups++;
 370                         sups1++;
 371                 }
 372         }
 373         return 0;
 374 }
 375
 376 static int
 377 oc_insert(
 378     ObjectClass         *soc,
 379     char                **err
 380 )
 381 {
 382         ObjectClass     **ocp;
 383         struct oindexrec        *oir;
 384         char                    **names;
 385
 386         ocp = &oc_list;
 387         while ( *ocp != NULL ) {
 388                 ocp = &(*ocp)->soc_next;
 389         }
 390         *ocp = soc;
 391
 392         if ( soc->soc_oid ) {
 393                 oir = (struct oindexrec *)
 394                         ch_calloc( 1, sizeof(struct oindexrec) );
 395                 oir->oir_name = soc->soc_oid;
 396                 oir->oir_oc = soc;
 397                 if ( avl_insert( &oc_index, (caddr_t) oir,
 398                                  (AVL_CMP) oc_index_cmp,
 399                                  (AVL_DUP) avl_dup_error ) ) {
 400                         *err = soc->soc_oid;
 401                         ldap_memfree(oir);
 402                         return SLAP_SCHERR_DUP_CLASS;
 403                 }
 404                 /* FIX: temporal consistency check */
 405                 oc_find(oir->oir_name);
 406         }
 407         if ( (names = soc->soc_names) ) {
 408                 while ( *names ) {
 409                         oir = (struct oindexrec *)
 410                                 ch_calloc( 1, sizeof(struct oindexrec) );
 411                         oir->oir_name = ch_strdup(*names);
 412                         oir->oir_oc = soc;
 413                         if ( avl_insert( &oc_index, (caddr_t) oir,
 414                                          (AVL_CMP) oc_index_cmp,
 415                                          (AVL_DUP) avl_dup_error ) ) {
 416                                 *err = *names;
 417                                 ldap_memfree(oir);
 418                                 return SLAP_SCHERR_DUP_CLASS;
 419                         }
 420                         /* FIX: temporal consistency check */
 421                         oc_find(oir->oir_name);
 422                         names++;
 423                 }
 424         }
 425         return 0;
 426 }
 427
 428 int
 429 oc_add(
 430     LDAP_OBJECT_CLASS   *oc,
 431     char                **err
 432 )
 433 {
 434         ObjectClass     *soc;
 435         int             code;
 436
 437         soc = (ObjectClass *) ch_calloc( 1, sizeof(ObjectClass) );
 438         memcpy( &soc->soc_oclass, oc, sizeof(LDAP_OBJECT_CLASS));
 439         if ( code = oc_add_sups(soc,soc->soc_sup_oids,err) )
 440                 return code;
 441         if ( code = oc_create_required(soc,soc->soc_at_oids_must,err) )
 442                 return code;
 443         if ( code = oc_create_allowed(soc,soc->soc_at_oids_may,err) )
 444                 return code;
 445         code = oc_insert(soc,err);
 446         return code;
 447 }
 448
 449 #if defined( SLAPD_SCHEMA_DN )
 450
 451 static int
 452 oc_schema_info( Entry *e )
 453 {
 454         struct berval   val;
 455         struct berval   *vals[2];
 456         ObjectClass     *oc;
 457
 458         vals[0] = &val;
 459         vals[1] = NULL;
 460
 461         for ( oc = oc_list; oc; oc = oc->soc_next ) {
 462                 val.bv_val = ldap_objectclass2str( &oc->soc_oclass );
 463                 if ( val.bv_val ) {
 464                         val.bv_len = strlen( val.bv_val );
 465                         Debug( LDAP_DEBUG_TRACE, "Merging oc [%d] %s\n",
 466                                val.bv_len, val.bv_val, 0 );
 467                         attr_merge( e, "objectclasses", vals );
 468                         ldap_memfree( val.bv_val );
 469                 } else {
 470                         return -1;
 471                 }
 472         }
 473         return 0;
 474 }
 475
 476 void
 477 schema_info( Connection *conn, Operation *op, char **attrs, int attrsonly )
 478 {
 479         Entry           *e;
 480         struct berval   val;
 481         struct berval   *vals[2];
 482
 483         vals[0] = &val;
 484         vals[1] = NULL;
 485
 486         e = (Entry *) ch_calloc( 1, sizeof(Entry) );
 487
 488         e->e_attrs = NULL;
 489         e->e_dn = ch_strdup( SLAPD_SCHEMA_DN );
 490         e->e_ndn = dn_normalize_case( ch_strdup( SLAPD_SCHEMA_DN ));
 491         e->e_private = NULL;
 492
 493         val.bv_val = ch_strdup( "top" );
 494         val.bv_len = strlen( val.bv_val );
 495         attr_merge( e, "objectclass", vals );
 496         ldap_memfree( val.bv_val );
 497
 498         val.bv_val = ch_strdup( "subschema" );
 499         val.bv_len = strlen( val.bv_val );
 500         attr_merge( e, "objectclass", vals );
 501         ldap_memfree( val.bv_val );
 502
 503         if ( at_schema_info( e ) ) {
 504                 /* Out of memory, do something about it */
 505                 entry_free( e );
 506                 return;
 507         }
 508         if ( oc_schema_info( e ) ) {
 509                 /* Out of memory, do something about it */
 510                 entry_free( e );
 511                 return;
 512         }
 513
 514         send_search_entry( &backends[0], conn, op, e, attrs, attrsonly );
 515         send_ldap_search_result( conn, op, LDAP_SUCCESS, NULL, NULL, 1 );
 516
 517         entry_free( e );
 518 }
 519 #endif
 520
 521 #ifdef LDAP_DEBUG
 522
 523 static void
 524 oc_print( ObjectClass *oc )
 525 {
 526         int     i;
 527
 528         if ( oc->soc_names && oc->soc_names[0] ) {
 529                 printf( "objectclass %s\n", oc->soc_names[0] );
 530         } else {
 531                 printf( "objectclass %s\n", oc->soc_oid );
 532         }
 533         if ( oc->soc_required != NULL ) {
 534                 printf( "\trequires %s", oc->soc_required[0] );
 535                 for ( i = 1; oc->soc_required[i] != NULL; i++ ) {
 536                         printf( ",%s", oc->soc_required[i] );
 537                 }
 538                 printf( "\n" );
 539         }
 540         if ( oc->soc_allowed != NULL ) {
 541                 printf( "\tallows %s", oc->soc_allowed[0] );
 542                 for ( i = 1; oc->soc_allowed[i] != NULL; i++ ) {
 543                         printf( ",%s", oc->soc_allowed[i] );
 544                 }
 545                 printf( "\n" );
 546         }
 547 }
 548
 549 #endif