git.sur5r.net Git - openldap/blob - servers/slapd/schema_check.c

   1 /* schema_check.c - routines to enforce schema definitions */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/ctype.h>
  13 #include <ac/string.h>
  14 #include <ac/socket.h>
  15
  16 #include "slap.h"
  17 #include "ldap_pvt.h"
  18
  19 static char *   oc_check_required(Entry *e, char *ocname);
  20 static int              oc_check_allowed(char *type, struct berval **ocl);
  21
  22 /*
  23  * entry_schema_check - check that entry e conforms to the schema required
  24  * by its object class(es).
  25  *
  26  * returns 0 if so, non-zero otherwise.
  27  */
  28
  29 int
  30 schema_check_entry( Entry *e )
  31 {
  32         Attribute       *a, *aoc;
  33         ObjectClass *oc;
  34         int             i;
  35         int             ret = 0;
  36
  37         if( !global_schemacheck ) return 0;
  38
  39         /* find the object class attribute - could error out here */
  40         if ( (aoc = attr_find( e->e_attrs, "objectclass" )) == NULL ) {
  41                 Debug( LDAP_DEBUG_ANY, "No object class for entry (%s)\n",
  42                     e->e_dn, 0, 0 );
  43                 return( 1 );
  44         }
  45
  46         /* check that the entry has required attrs for each oc */
  47         for ( i = 0; aoc->a_vals[i] != NULL; i++ ) {
  48                 if ( (oc = oc_find( aoc->a_vals[i]->bv_val )) == NULL ) {
  49                         Debug( LDAP_DEBUG_ANY,
  50                                 "Objectclass \"%s\" not defined\n",
  51                                 aoc->a_vals[i]->bv_val, 0, 0 );
  52                 }
  53                 else
  54                 {
  55                         char *s = oc_check_required( e, aoc->a_vals[i]->bv_val );
  56
  57                         if (s != NULL) {
  58                                 Debug( LDAP_DEBUG_ANY,
  59                                         "Entry (%s), oc \"%s\" requires attr \"%s\"\n",
  60                                         e->e_dn, aoc->a_vals[i]->bv_val, s );
  61                                 ret = 1;
  62                         }
  63                 }
  64         }
  65
  66         if ( ret != 0 ) {
  67             return( ret );
  68         }
  69
  70         /* check that each attr in the entry is allowed by some oc */
  71         for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
  72 #ifdef SLAPD_SCHEMA_NOT_COMPAT
  73                 if ( oc_check_allowed( a->a_desc.ad_type, aoc->a_vals ) != 0 ) {
  74                         Debug( LDAP_DEBUG_ANY,
  75                             "Entry (%s), attr \"%s\" not allowed\n",
  76                             e->e_dn, a->a_desc.ad_cname->bv_val, 0 );
  77                         ret = 1;
  78                 }
  79 #else
  80                 if ( oc_check_allowed( a->a_type, aoc->a_vals ) != 0 ) {
  81                         Debug( LDAP_DEBUG_ANY,
  82                             "Entry (%s), attr \"%s\" not allowed\n",
  83                             e->e_dn, a->a_type, 0 );
  84                         ret = 1;
  85                 }
  86 #endif
  87         }
  88
  89         return( ret );
  90 }
  91
  92 static char *
  93 oc_check_required( Entry *e, char *ocname )
  94 {
  95         ObjectClass     *oc;
  96         AttributeType   *at;
  97         int             i;
  98         Attribute       *a;
  99
 100         Debug( LDAP_DEBUG_TRACE,
 101                "oc_check_required entry (%s), objectclass \"%s\"\n",
 102                e->e_dn, ocname, 0 );
 103
 104         /* find global oc defn. it we don't know about it assume it's ok */
 105         if ( (oc = oc_find( ocname )) == NULL ) {
 106                 return( 0 );
 107         }
 108
 109         /* check for empty oc_required */
 110         if(oc->soc_required == NULL) {
 111                 return( 0 );
 112         }
 113
 114         /* for each required attribute */
 115         for ( i = 0; oc->soc_required[i] != NULL; i++ ) {
 116                 at = oc->soc_required[i];
 117                 /* see if it's in the entry */
 118                 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
 119 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 120                         if( a->a_desc.ad_type == at ) {
 121                                 break;
 122                         }
 123 #else
 124                         char            **pp;
 125
 126                         if ( at->sat_oid &&
 127                              strcmp( a->a_type, at->sat_oid ) == 0 ) {
 128                                 break;
 129                         }
 130                         pp = at->sat_names;
 131                         if ( pp  == NULL ) {
 132                                 /* Empty name list => not found */
 133                                 a = NULL;
 134                                 break;
 135                         }
 136                         while ( *pp ) {
 137                                 if ( strcasecmp( a->a_type, *pp ) == 0 ) {
 138                                         break;
 139                                 }
 140                                 pp++;
 141                         }
 142                         if ( *pp ) {
 143                                 break;
 144                         }
 145 #endif
 146                 }
 147                 /* not there => schema violation */
 148                 if ( a == NULL ) {
 149                         if ( at->sat_names && at->sat_names[0] ) {
 150                                 return at->sat_names[0];
 151                         } else {
 152                                 return at->sat_oid;
 153                         }
 154                 }
 155         }
 156
 157         return( NULL );
 158 }
 159
 160 static int
 161 oc_check_allowed( char *type, struct berval **ocl )
 162 {
 163         ObjectClass     *oc;
 164         AttributeType   *at;
 165         int             i, j;
 166         char            **pp;
 167         char            *p, *t;
 168
 169         Debug( LDAP_DEBUG_TRACE,
 170                "oc_check_allowed type \"%s\"\n", type, 0, 0 );
 171
 172         /* always allow objectclass attribute */
 173         if ( strcasecmp( type, "objectclass" ) == 0 ) {
 174                 return( 0 );
 175         }
 176
 177 #ifndef SLAPD_SCHEMA_NOT_COMPAT
 178         /* Treat any attribute type with option as an unknown attribute type */
 179         /*
 180          * The "type" we have received is actually an AttributeDescription.
 181          * Let's find out the corresponding type.
 182          */
 183         p = strchr( type, ';' );
 184         if ( p ) {
 185                 t = ch_malloc( p-type+1 );
 186                 strncpy( t, type, p-type );
 187                 t[p-type] = '\0';
 188                 Debug( LDAP_DEBUG_TRACE,
 189                        "oc_check_allowed type \"%s\" from \"%s\"\n",
 190                        t, type, 0 );
 191
 192         } else
 193 #endif
 194         {
 195                 t = type;
 196         }
 197
 198
 199         /*
 200          * All operational attributions are allowed by schema rules.
 201          */
 202         if ( oc_check_op_attr( t ) ) {
 203                 return( 0 );
 204         }
 205
 206         /* check that the type appears as req or opt in at least one oc */
 207         for ( i = 0; ocl[i] != NULL; i++ ) {
 208                 /* if we know about the oc */
 209                 if ( (oc = oc_find( ocl[i]->bv_val )) != NULL ) {
 210                         /* does it require the type? */
 211                         for ( j = 0; oc->soc_required != NULL &&
 212                                 oc->soc_required[j] != NULL; j++ ) {
 213                                 at = oc->soc_required[j];
 214                                 if ( at->sat_oid &&
 215                                      strcmp(at->sat_oid, t ) == 0 ) {
 216                                         if ( t != type )
 217                                                 ldap_memfree( t );
 218                                         return( 0 );
 219                                 }
 220                                 pp = at->sat_names;
 221                                 if ( pp == NULL )
 222                                         continue;
 223                                 while ( *pp ) {
 224                                         if ( strcasecmp( *pp, t ) == 0 ) {
 225                                                 if ( t != type )
 226                                                         ldap_memfree( t );
 227                                                 return( 0 );
 228                                         }
 229                                         pp++;
 230                                 }
 231                         }
 232                         /* does it allow the type? */
 233                         for ( j = 0; oc->soc_allowed != NULL &&
 234                                 oc->soc_allowed[j] != NULL; j++ ) {
 235                                 at = oc->soc_allowed[j];
 236                                 if ( at->sat_oid &&
 237                                      strcmp( at->sat_oid, t ) == 0 ) {
 238                                         if ( t != type )
 239                                                 ldap_memfree( t );
 240                                         return( 0 );
 241                                 }
 242                                 pp = at->sat_names;
 243                                 if ( pp == NULL )
 244                                         continue;
 245                                 while ( *pp ) {
 246                                         if ( strcasecmp( *pp, t ) == 0 ||
 247                                              strcmp( *pp, "*" ) == 0 ) {
 248                                                 if ( t != type )
 249                                                         ldap_memfree( t );
 250                                                 return( 0 );
 251                                         }
 252                                         pp++;
 253                                 }
 254                         }
 255                         /* maybe the next oc allows it */
 256
 257 #ifdef OC_UNDEFINED_IMPLES_EXTENSIBLE
 258                 /* we don't know about the oc. assume it allows it */
 259                 } else {
 260                         if ( t != type )
 261                                 ldap_memfree( t );
 262                         return( 0 );
 263 #endif
 264                 }
 265         }
 266
 267         if ( t != type )
 268                 ldap_memfree( t );
 269         /* not allowed by any oc */
 270         return( 1 );
 271 }