1 /* schema_check.c - routines to enforce schema definitions */
4 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
5 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include <ac/string.h>
14 #include <ac/socket.h>
19 static char * oc_check_required(
22 struct berval *ocname );
25 * Determine the structural object class from a set of OIDs
34 ObjectClass *sc = NULL;
37 *text = "structural object error";
40 for( i=0; ocs[i]; i++ ) {
41 oc = oc_find( ocs[i]->bv_val );
44 *text = "unrecongized objectClass attribute";
45 return LDAP_OBJECT_CLASS_VIOLATION;
48 if( oc->soc_kind == LDAP_SCHEMA_STRUCTURAL ) {
49 if( sc == NULL || is_object_subclass( sc, oc ) ) {
53 } else if ( !is_object_subclass( oc, sc ) ) {
54 /* FIXME: multiple inheritance possible! */
55 *text = "invalid strucutural object class chain";
56 return LDAP_OBJECT_CLASS_VIOLATION;
62 *text = "no strucutural object classes";
63 return LDAP_OBJECT_CLASS_VIOLATION;
71 * Return structural object class from list of modifications
73 int mods_structural_class(
78 Modifications *ocmod = NULL;
80 for( ; mods != NULL; mods = mods->sml_next ) {
81 if( mods->sml_desc == slap_schema.si_ad_objectClass ) {
83 *text = "entry has multiple objectClass attributes";
84 return LDAP_OBJECT_CLASS_VIOLATION;
91 *text = "entry has no objectClass attribute";
92 return LDAP_OBJECT_CLASS_VIOLATION;
95 if( ocmod->sml_bvalues == NULL || ocmod->sml_bvalues[0] == NULL ) {
96 *text = "objectClass attribute has no values";
97 return LDAP_OBJECT_CLASS_VIOLATION;
100 return structural_class( ocmod->sml_bvalues, sc, text );
104 * entry_schema_check - check that entry e conforms to the schema required
105 * by its object class(es).
107 * returns 0 if so, non-zero otherwise.
112 Entry *e, Attribute *oldattrs,
114 char *textbuf, size_t textlen )
116 Attribute *a, *asc, *aoc;
117 ObjectClass *sc, *oc;
120 AttributeDescription *ad_structuralObjectClass
121 = slap_schema.si_ad_structuralObjectClass;
122 AttributeDescription *ad_objectClass
123 = slap_schema.si_ad_objectClass;
128 /* check single-valued attrs for multiple values */
129 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
130 /* there should be at least one value */
132 assert( a->a_vals[0] != NULL );
134 /* if single value type, check for multiple values */
135 if( is_at_single_value( a->a_desc->ad_type ) &&
136 a->a_vals[1] != NULL )
138 char *type = a->a_desc->ad_cname.bv_val;
140 snprintf( textbuf, textlen,
141 "attribute '%s' cannot have multiple values",
145 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
146 "entry_schema_check: dn=\"%s\" %s\n",
149 Debug( LDAP_DEBUG_ANY,
151 e->e_dn, textbuf, 0 );
154 return LDAP_CONSTRAINT_VIOLATION;
158 if( !global_schemacheck ) return LDAP_SUCCESS;
160 /* find the object class attribute - could error out here */
161 asc = attr_find( e->e_attrs, ad_structuralObjectClass );
164 LDAP_LOG(( "schema", LDAP_LEVEL_INFO, "entry_schema_check: "
165 "No structuralObjectClass for entry (%s)\n",
168 Debug( LDAP_DEBUG_ANY,
169 "No structuralObjectClass for entry (%s)\n",
173 *text = "no structuralObjectClass operational attribute";
174 return LDAP_OBJECT_CLASS_VIOLATION;
177 assert( asc->a_vals != NULL );
178 assert( asc->a_vals[0] != NULL );
179 assert( asc->a_vals[1] == NULL );
181 sc = oc_find( asc->a_vals[0]->bv_val );
183 snprintf( textbuf, textlen,
184 "unrecognized structuralObjectClass '%s'",
185 aoc->a_vals[0]->bv_val );
188 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
189 "entry_schema_check: dn (%s), %s\n",
192 Debug( LDAP_DEBUG_ANY,
193 "entry_check_schema(%s): %s\n",
194 e->e_dn, textbuf, 0 );
197 return LDAP_OBJECT_CLASS_VIOLATION;
200 if( sc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
201 snprintf( textbuf, textlen,
202 "structuralObjectClass '%s' is not STRUCTURAL",
203 aoc->a_vals[0]->bv_val );
206 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
207 "entry_schema_check: dn (%s), %s\n",
210 Debug( LDAP_DEBUG_ANY,
211 "entry_check_schema(%s): %s\n",
212 e->e_dn, textbuf, 0 );
215 return LDAP_OBJECT_CLASS_VIOLATION;
218 /* find the object class attribute */
219 aoc = attr_find( e->e_attrs, ad_objectClass );
222 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
223 "entry_schema_check: No objectClass for entry (%s).\n", e->e_dn ));
225 Debug( LDAP_DEBUG_ANY, "No objectClass for entry (%s)\n",
229 *text = "no objectClass attribute";
230 return LDAP_OBJECT_CLASS_VIOLATION;
233 assert( aoc->a_vals != NULL );
234 assert( aoc->a_vals[0] != NULL );
236 rc = structural_class( aoc->a_vals, &nsc, text );
237 if( rc != LDAP_SUCCESS ) {
239 } else if ( nsc.bv_len == 0 ) {
240 return LDAP_OBJECT_CLASS_VIOLATION;
243 oc = oc_find( nsc.bv_val );
245 snprintf( textbuf, textlen,
246 "unrecognized objectClass '%s'",
247 aoc->a_vals[i]->bv_val );
248 return LDAP_OBJECT_CLASS_VIOLATION;
250 } else if ( sc != oc ) {
251 snprintf( textbuf, textlen,
252 "structuralObjectClass modification from '%s' to '%s' not allowed",
253 asc->a_vals[0]->bv_val, nsc.bv_val );
254 return LDAP_NO_OBJECT_CLASS_MODS;
257 /* check that the entry has required attrs for each oc */
258 for ( i = 0; aoc->a_vals[i] != NULL; i++ ) {
259 if ( (oc = oc_find( aoc->a_vals[i]->bv_val )) == NULL ) {
260 snprintf( textbuf, textlen,
261 "unrecognized objectClass '%s'",
262 aoc->a_vals[i]->bv_val );
265 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
266 "entry_schema_check: dn (%s), %s\n",
269 Debug( LDAP_DEBUG_ANY,
270 "entry_check_schema(%s): \"%s\" not recognized\n",
271 e->e_dn, textbuf, 0 );
274 return LDAP_OBJECT_CLASS_VIOLATION;
276 } else if ( oc->soc_kind == LDAP_SCHEMA_ABSTRACT ) {
277 /* object class is abstract */
278 /* FIXME: need to check that is is a superclass of something */
280 } else if ( oc->soc_kind == LDAP_SCHEMA_STRUCTURAL && oc != sc ) {
281 /* object class is a superclass of the structural class */
282 /* nothing in particular to check */
285 char *s = oc_check_required( e, oc, aoc->a_vals[i] );
288 snprintf( textbuf, textlen,
289 "object class '%s' requires attribute '%s'",
290 aoc->a_vals[i]->bv_val, s );
293 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
294 "entry_schema_check: dn=\"%s\" %s",
297 Debug( LDAP_DEBUG_ANY,
299 e->e_dn, textbuf, 0 );
302 return LDAP_OBJECT_CLASS_VIOLATION;
305 if( oc == slap_schema.si_oc_extensibleObject ) {
315 /* check that each attr in the entry is allowed by some oc */
316 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
317 int ret = oc_check_allowed( a->a_desc->ad_type, aoc->a_vals );
318 if ( ret != LDAP_SUCCESS ) {
319 char *type = a->a_desc->ad_cname.bv_val;
321 snprintf( textbuf, textlen,
322 "attribute '%s' not allowed",
326 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
327 "entry_schema_check: dn=\"%s\" %s\n",
330 Debug( LDAP_DEBUG_ANY,
332 e->e_dn, textbuf, 0 );
346 struct berval *ocname )
353 LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
354 "oc_check_required: dn (%s), objectClass \"%s\"\n",
355 e->e_dn, ocname->bv_val ));
357 Debug( LDAP_DEBUG_TRACE,
358 "oc_check_required entry (%s), objectClass \"%s\"\n",
359 e->e_dn, ocname->bv_val, 0 );
363 /* check for empty oc_required */
364 if(oc->soc_required == NULL) {
368 /* for each required attribute */
369 for ( i = 0; oc->soc_required[i] != NULL; i++ ) {
370 at = oc->soc_required[i];
371 /* see if it's in the entry */
372 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
373 if( a->a_desc->ad_type == at ) {
377 /* not there => schema violation */
379 return at->sat_cname.bv_val;
386 int oc_check_allowed(
388 struct berval **ocl )
394 LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
395 "oc_check_allowed: type \"%s\"\n", at->sat_cname.bv_val ));
397 Debug( LDAP_DEBUG_TRACE,
398 "oc_check_allowed type \"%s\"\n",
399 at->sat_cname.bv_val, 0, 0 );
402 /* always allow objectClass attribute */
403 if ( strcasecmp( at->sat_cname.bv_val, "objectClass" ) == 0 ) {
408 * All operational attributions are allowed by schema rules.
410 if( is_at_operational(at) ) {
414 /* check that the type appears as req or opt in at least one oc */
415 for ( i = 0; ocl[i] != NULL; i++ ) {
416 /* if we know about the oc */
417 if ( (oc = oc_find( ocl[i]->bv_val )) != NULL ) {
418 /* does it require the type? */
419 for ( j = 0; oc->soc_required != NULL &&
420 oc->soc_required[j] != NULL; j++ )
422 if( at == oc->soc_required[j] ) {
426 /* does it allow the type? */
427 for ( j = 0; oc->soc_allowed != NULL &&
428 oc->soc_allowed[j] != NULL; j++ )
430 if( at == oc->soc_allowed[j] ) {
434 /* maybe the next oc allows it */
438 /* not allowed by any oc */
439 return LDAP_OBJECT_CLASS_VIOLATION;