git.sur5r.net Git - openldap/blob - servers/slapd/schema_check.c

   1 /* schema_check.c - routines to enforce schema definitions */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/ctype.h>
  13 #include <ac/string.h>
  14 #include <ac/socket.h>
  15
  16 #include "slap.h"
  17 #include "ldap_pvt.h"
  18
  19 #ifdef SLAPD_SCHEMA_NOT_COMPAT
  20 static int oc_check_allowed(
  21         AttributeType *type,
  22         struct berval **oclist );
  23 #else
  24 static int              oc_check_allowed(char *type, struct berval **oclist);
  25 #endif
  26 static char *   oc_check_required(Entry *e, struct berval *ocname);
  27
  28 /*
  29  * entry_schema_check - check that entry e conforms to the schema required
  30  * by its object class(es).
  31  *
  32  * returns 0 if so, non-zero otherwise.
  33  */
  34
  35 int
  36 entry_schema_check(
  37         Entry *e, Attribute *oldattrs, const char** text )
  38 {
  39         Attribute       *a, *aoc;
  40         ObjectClass *oc;
  41         int             i;
  42         int             ret;
  43 #ifdef SLAPD_SCHEMA_NOT_COMPAT
  44         AttributeDescription *ad_objectClass = slap_schema.si_ad_objectClass;
  45 #else
  46         static const char *ad_objectClass = "objectclass";
  47 #endif
  48
  49         if( !global_schemacheck ) return LDAP_SUCCESS;
  50
  51         /* find the object class attribute - could error out here */
  52         if ( (aoc = attr_find( e->e_attrs, ad_objectClass )) == NULL ) {
  53                 Debug( LDAP_DEBUG_ANY, "No object class for entry (%s)\n",
  54                     e->e_dn, 0, 0 );
  55                 assert(0);
  56
  57                 *text = "no objectclass attribute";
  58                 return oldattrs != NULL
  59                         ? LDAP_OBJECT_CLASS_VIOLATION
  60                         : LDAP_NO_OBJECT_CLASS_MODS;
  61         }
  62
  63         ret = LDAP_SUCCESS;
  64
  65         /* check that the entry has required attrs for each oc */
  66         for ( i = 0; aoc->a_vals[i] != NULL; i++ ) {
  67                 if ( (oc = oc_find( aoc->a_vals[i]->bv_val )) == NULL ) {
  68                         Debug( LDAP_DEBUG_ANY,
  69                                 "Objectclass \"%s\" not defined\n",
  70                                 aoc->a_vals[i]->bv_val, 0, 0 );
  71
  72                 } else {
  73                         char *s = oc_check_required( e, aoc->a_vals[i] );
  74
  75                         if (s != NULL) {
  76                                 Debug( LDAP_DEBUG_ANY,
  77                                         "Entry (%s), oc \"%s\" requires attr \"%s\"\n",
  78                                         e->e_dn, aoc->a_vals[i]->bv_val, s );
  79                                 *text = "missing required attribute";
  80                                 ret = LDAP_OBJECT_CLASS_VIOLATION;
  81                                 break;
  82                         }
  83                 }
  84         }
  85
  86         if ( ret != LDAP_SUCCESS ) {
  87             return ret;
  88         }
  89
  90         /* check that each attr in the entry is allowed by some oc */
  91         for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
  92 #ifdef SLAPD_SCHEMA_NOT_COMPAT
  93                 ret = oc_check_allowed( a->a_desc->ad_type, aoc->a_vals );
  94 #else
  95                 ret = oc_check_allowed( a->a_type, aoc->a_vals );
  96 #endif
  97                 if ( ret != 0 ) {
  98 #ifdef SLAPD_SCHEMA_NOT_COMPAT
  99                         char *type = a->a_desc->ad_cname->bv_val;
 100 #else
 101                         char *type = a->a_type;
 102 #endif
 103                         Debug( LDAP_DEBUG_ANY,
 104                             "Entry (%s), attr \"%s\" not allowed\n",
 105                             e->e_dn, type, 0 );
 106                         *text = "attribute not allowed";
 107                         break;
 108                 }
 109         }
 110
 111         return( ret );
 112 }
 113
 114 static char *
 115 oc_check_required( Entry *e, struct berval *ocname )
 116 {
 117         ObjectClass     *oc;
 118         AttributeType   *at;
 119         int             i;
 120         Attribute       *a;
 121
 122         Debug( LDAP_DEBUG_TRACE,
 123                "oc_check_required entry (%s), objectclass \"%s\"\n",
 124                e->e_dn, ocname->bv_val, 0 );
 125
 126         /* find global oc defn. it we don't know about it assume it's ok */
 127         if ( (oc = oc_find( ocname->bv_val )) == NULL ) {
 128                 return NULL;
 129         }
 130
 131         /* check for empty oc_required */
 132         if(oc->soc_required == NULL) {
 133                 return NULL;
 134         }
 135
 136         /* for each required attribute */
 137         for ( i = 0; oc->soc_required[i] != NULL; i++ ) {
 138                 at = oc->soc_required[i];
 139                 /* see if it's in the entry */
 140                 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
 141 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 142                         if( a->a_desc->ad_type == at ) {
 143                                 break;
 144                         }
 145 #else
 146                         char            **pp;
 147
 148                         if ( at->sat_oid &&
 149                              strcmp( a->a_type, at->sat_oid ) == 0 ) {
 150                                 break;
 151                         }
 152                         pp = at->sat_names;
 153                         if ( pp  == NULL ) {
 154                                 /* Empty name list => not found */
 155                                 a = NULL;
 156                                 break;
 157                         }
 158                         while ( *pp ) {
 159                                 if ( strcasecmp( a->a_type, *pp ) == 0 ) {
 160                                         break;
 161                                 }
 162                                 pp++;
 163                         }
 164                         if ( *pp ) {
 165                                 break;
 166                         }
 167 #endif
 168                 }
 169                 /* not there => schema violation */
 170                 if ( a == NULL ) {
 171 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 172                         return at->sat_cname;
 173 #else
 174                         if ( at->sat_names && at->sat_names[0] ) {
 175                                 return at->sat_names[0];
 176                         } else {
 177                                 return at->sat_oid;
 178                         }
 179 #endif
 180                 }
 181         }
 182
 183         return( NULL );
 184 }
 185
 186 static int
 187 oc_check_allowed(
 188 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 189         AttributeType *at,
 190 #else
 191         char *type,
 192 #endif
 193         struct berval **ocl )
 194 {
 195         ObjectClass     *oc;
 196         int             i, j;
 197
 198 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 199         Debug( LDAP_DEBUG_TRACE,
 200                 "oc_check_allowed type \"%s\"\n",
 201                 at->sat_cname, 0, 0 );
 202
 203         /* always allow objectclass attribute */
 204         if ( strcasecmp( at->sat_cname, "objectclass" ) == 0 ) {
 205                 return LDAP_SUCCESS;
 206         }
 207
 208 #else
 209         AttributeType   *at;
 210         char            **pp;
 211         char            *p;
 212         char            *t;
 213
 214         Debug( LDAP_DEBUG_TRACE,
 215                "oc_check_allowed type \"%s\"\n", type, 0, 0 );
 216
 217         /* always allow objectclass attribute */
 218         if ( strcasecmp( type, "objectclass" ) == 0 ) {
 219                 return LDAP_SUCCESS;
 220         }
 221 #endif
 222
 223 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 224         /*
 225          * All operational attributions are allowed by schema rules.
 226          */
 227         if( is_at_operational(at) ) {
 228                 return LDAP_SUCCESS;
 229         }
 230 #else
 231         /*
 232          * The "type" we have received is actually an AttributeDescription.
 233          * Let's find out the corresponding type.
 234          */
 235         p = strchr( type, ';' );
 236         if ( p ) {
 237                 t = ch_malloc( p-type+1 );
 238                 strncpy( t, type, p-type );
 239                 t[p-type] = '\0';
 240                 Debug( LDAP_DEBUG_TRACE,
 241                        "oc_check_allowed type \"%s\" from \"%s\"\n",
 242                        t, type, 0 );
 243
 244         } else
 245         {
 246                 t = type;
 247         }
 248
 249         /*
 250          * All operational attributions are allowed by schema rules.
 251          */
 252         if ( oc_check_op_attr( t ) ) {
 253                 return LDAP_SUCCESS;
 254         }
 255 #endif
 256
 257         /* check that the type appears as req or opt in at least one oc */
 258         for ( i = 0; ocl[i] != NULL; i++ ) {
 259                 /* if we know about the oc */
 260                 if ( (oc = oc_find( ocl[i]->bv_val )) != NULL ) {
 261                         /* does it require the type? */
 262                         for ( j = 0; oc->soc_required != NULL &&
 263                                 oc->soc_required[j] != NULL; j++ )
 264                         {
 265 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 266                                 if( at == oc->soc_required[j] ) {
 267                                         return LDAP_SUCCESS;
 268                                 }
 269 #else
 270                                 at = oc->soc_required[j];
 271                                 if ( at->sat_oid &&
 272                                      strcmp(at->sat_oid, t ) == 0 ) {
 273                                         if ( t != type )
 274                                                 ldap_memfree( t );
 275                                         return LDAP_SUCCESS;
 276                                 }
 277                                 pp = at->sat_names;
 278                                 if ( pp == NULL )
 279                                         continue;
 280                                 while ( *pp ) {
 281                                         if ( strcasecmp( *pp, t ) == 0 ) {
 282                                                 if ( t != type )
 283                                                         ldap_memfree( t );
 284                                                 return LDAP_SUCCESS;
 285                                         }
 286                                         pp++;
 287                                 }
 288 #endif
 289                         }
 290                         /* does it allow the type? */
 291                         for ( j = 0; oc->soc_allowed != NULL &&
 292                                 oc->soc_allowed[j] != NULL; j++ )
 293                         {
 294 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 295                                 if( at == oc->soc_allowed[j] ) {
 296                                         return LDAP_SUCCESS;
 297                                 }
 298 #else
 299                                 at = oc->soc_allowed[j];
 300                                 if ( at->sat_oid &&
 301                                      strcmp( at->sat_oid, t ) == 0 ) {
 302                                         if ( t != type )
 303                                                 ldap_memfree( t );
 304                                         return LDAP_SUCCESS;
 305                                 }
 306                                 pp = at->sat_names;
 307                                 if ( pp == NULL )
 308                                         continue;
 309                                 while ( *pp ) {
 310                                         if ( strcasecmp( *pp, t ) == 0 ||
 311                                              strcmp( *pp, "*" ) == 0 ) {
 312                                                 if ( t != type )
 313                                                         ldap_memfree( t );
 314                                                 return LDAP_SUCCESS;
 315                                         }
 316                                         pp++;
 317                                 }
 318 #endif
 319                         }
 320                         /* maybe the next oc allows it */
 321
 322 #ifdef OC_UNDEFINED_IMPLES_EXTENSIBLE
 323                 /* we don't know about the oc. assume it allows it */
 324                 } else {
 325                         if ( t != type )
 326                                 ldap_memfree( t );
 327                         return LDAP_SUCCESS;
 328 #endif
 329                 }
 330         }
 331
 332 #ifndef SLAPD_SCHEMA_NOT_COMPAT
 333         if ( t != type )
 334                 ldap_memfree( t );
 335 #endif
 336
 337         /* not allowed by any oc */
 338         return LDAP_OBJECT_CLASS_VIOLATION;
 339 }