1 /* schema_check.c - routines to enforce schema definitions */
4 * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
5 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include <ac/string.h>
14 #include <ac/socket.h>
19 static char * oc_check_required(
22 struct berval *ocname );
25 * entry_schema_check - check that entry e conforms to the schema required
26 * by its object class(es).
28 * returns 0 if so, non-zero otherwise.
33 Entry *e, Attribute *oldattrs,
35 char *textbuf, size_t textlen )
37 Attribute *a, *asc, *aoc;
41 AttributeDescription *ad_structuralObjectClass
42 = slap_schema.si_ad_structuralObjectClass;
43 AttributeDescription *ad_objectClass
44 = slap_schema.si_ad_objectClass;
49 /* misc attribute checks */
50 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
51 /* there should be at least one value */
53 assert( a->a_vals[0].bv_val != NULL );
55 if( a->a_desc->ad_type->sat_check ) {
56 int rc = (a->a_desc->ad_type->sat_check)(
57 e, a, text, textbuf, textlen );
58 if( rc != LDAP_SUCCESS ) {
63 /* if single value type, check for multiple values */
64 if( is_at_single_value( a->a_desc->ad_type ) &&
65 a->a_vals[1].bv_val != NULL )
67 char *type = a->a_desc->ad_cname.bv_val;
69 snprintf( textbuf, textlen,
70 "attribute '%s' cannot have multiple values",
74 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
75 "entry_schema_check: dn=\"%s\" %s\n",
78 Debug( LDAP_DEBUG_ANY,
80 e->e_dn, textbuf, 0 );
83 return LDAP_CONSTRAINT_VIOLATION;
87 /* it's a REALLY bad idea to disable schema checks */
88 if( !global_schemacheck ) return LDAP_SUCCESS;
90 /* find the object class attribute - could error out here */
91 asc = attr_find( e->e_attrs, ad_structuralObjectClass );
94 LDAP_LOG(( "schema", LDAP_LEVEL_INFO, "entry_schema_check: "
95 "No structuralObjectClass for entry (%s)\n",
98 Debug( LDAP_DEBUG_ANY,
99 "No structuralObjectClass for entry (%s)\n",
103 *text = "no structuralObjectClass operational attribute";
104 return LDAP_OBJECT_CLASS_VIOLATION;
107 assert( asc->a_vals != NULL );
108 assert( asc->a_vals[0].bv_val != NULL );
109 assert( asc->a_vals[1].bv_val == NULL );
111 sc = oc_bvfind( &asc->a_vals[0] );
113 snprintf( textbuf, textlen,
114 "unrecognized structuralObjectClass '%s'",
115 asc->a_vals[0].bv_val );
118 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
119 "entry_schema_check: dn (%s), %s\n",
122 Debug( LDAP_DEBUG_ANY,
123 "entry_check_schema(%s): %s\n",
124 e->e_dn, textbuf, 0 );
127 return LDAP_OBJECT_CLASS_VIOLATION;
130 if( sc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
131 snprintf( textbuf, textlen,
132 "structuralObjectClass '%s' is not STRUCTURAL",
133 asc->a_vals[0].bv_val );
136 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
137 "entry_schema_check: dn (%s), %s\n",
140 Debug( LDAP_DEBUG_ANY,
141 "entry_check_schema(%s): %s\n",
142 e->e_dn, textbuf, 0 );
145 return LDAP_OBJECT_CLASS_VIOLATION;
148 /* find the object class attribute */
149 aoc = attr_find( e->e_attrs, ad_objectClass );
152 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
153 "entry_schema_check: No objectClass for entry (%s).\n"
156 Debug( LDAP_DEBUG_ANY, "No objectClass for entry (%s)\n",
160 *text = "no objectClass attribute";
161 return LDAP_OBJECT_CLASS_VIOLATION;
164 assert( aoc->a_vals != NULL );
165 assert( aoc->a_vals[0].bv_val != NULL );
167 rc = structural_class( aoc->a_vals, &nsc, &oc, text, textbuf, textlen );
168 if( rc != LDAP_SUCCESS ) {
170 } else if ( nsc.bv_len == 0 ) {
171 return LDAP_OBJECT_CLASS_VIOLATION;
177 snprintf( textbuf, textlen,
178 "unrecognized objectClass '%s'",
179 aoc->a_vals[0].bv_val );
180 return LDAP_OBJECT_CLASS_VIOLATION;
182 } else if ( sc != oc ) {
183 snprintf( textbuf, textlen,
184 "structuralObjectClass modification from '%s' to '%s' not allowed",
185 asc->a_vals[0].bv_val, nsc.bv_val );
186 return LDAP_NO_OBJECT_CLASS_MODS;
189 /* check that the entry has required attrs for each oc */
190 for ( i = 0; aoc->a_vals[i].bv_val != NULL; i++ ) {
191 if ( (oc = oc_bvfind( &aoc->a_vals[i] )) == NULL ) {
192 snprintf( textbuf, textlen,
193 "unrecognized objectClass '%s'",
194 aoc->a_vals[i].bv_val );
197 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
198 "entry_schema_check: dn (%s), %s\n",
201 Debug( LDAP_DEBUG_ANY,
202 "entry_check_schema(%s): %s\n",
203 e->e_dn, textbuf, 0 );
206 return LDAP_OBJECT_CLASS_VIOLATION;
209 if ( oc->sco_check ) {
210 int rc = (oc->sco_check)( e, oc,
211 text, textbuf, textlen );
212 if( rc != LDAP_SUCCESS ) {
216 if ( oc->soc_kind == LDAP_SCHEMA_ABSTRACT ) {
217 /* object class is abstract */
218 if ( oc != slap_schema.si_oc_top &&
219 !is_object_subclass( oc, sc ))
222 ObjectClass *xc = NULL;
223 for( j=0; aoc->a_vals[j].bv_val; j++ ) {
225 xc = oc_bvfind( &aoc->a_vals[i] );
227 snprintf( textbuf, textlen,
228 "unrecognized objectClass '%s'",
229 aoc->a_vals[i].bv_val );
232 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
233 "entry_schema_check: dn (%s), %s\n",
236 Debug( LDAP_DEBUG_ANY,
237 "entry_check_schema(%s): %s\n",
238 e->e_dn, textbuf, 0 );
241 return LDAP_OBJECT_CLASS_VIOLATION;
244 /* since we previous check against the
245 * structural object of this entry, the
246 * abstract class must be a (direct or indirect)
247 * superclass of one of the auxiliary classes of
250 if ( xc->soc_kind == LDAP_SCHEMA_AUXILIARY &&
251 is_object_subclass( oc, xc ) )
261 snprintf( textbuf, textlen, "instanstantiation of "
262 "abstract objectClass '%s' not allowed",
263 aoc->a_vals[i].bv_val );
266 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
267 "entry_schema_check: dn (%s), %s\n",
270 Debug( LDAP_DEBUG_ANY,
271 "entry_check_schema(%s): %s\n",
272 e->e_dn, textbuf, 0 );
275 return LDAP_OBJECT_CLASS_VIOLATION;
279 } else if ( oc->soc_kind != LDAP_SCHEMA_STRUCTURAL || oc == sc ) {
280 char *s = oc_check_required( e, oc, &aoc->a_vals[i] );
283 snprintf( textbuf, textlen,
284 "object class '%s' requires attribute '%s'",
285 aoc->a_vals[i].bv_val, s );
288 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
289 "entry_schema_check: dn=\"%s\" %s",
292 Debug( LDAP_DEBUG_ANY,
294 e->e_dn, textbuf, 0 );
297 return LDAP_OBJECT_CLASS_VIOLATION;
300 if( oc == slap_schema.si_oc_extensibleObject ) {
310 /* check that each attr in the entry is allowed by some oc */
311 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
312 int ret = oc_check_allowed( a->a_desc->ad_type, aoc->a_vals, sc );
313 if ( ret != LDAP_SUCCESS ) {
314 char *type = a->a_desc->ad_cname.bv_val;
316 snprintf( textbuf, textlen,
317 "attribute '%s' not allowed",
321 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
322 "entry_schema_check: dn=\"%s\" %s\n",
325 Debug( LDAP_DEBUG_ANY,
327 e->e_dn, textbuf, 0 );
341 struct berval *ocname )
348 LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
349 "oc_check_required: dn (%s), objectClass \"%s\"\n",
350 e->e_dn, ocname->bv_val ));
352 Debug( LDAP_DEBUG_TRACE,
353 "oc_check_required entry (%s), objectClass \"%s\"\n",
354 e->e_dn, ocname->bv_val, 0 );
358 /* check for empty oc_required */
359 if(oc->soc_required == NULL) {
363 /* for each required attribute */
364 for ( i = 0; oc->soc_required[i] != NULL; i++ ) {
365 at = oc->soc_required[i];
366 /* see if it's in the entry */
367 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
368 if( a->a_desc->ad_type == at ) {
372 /* not there => schema violation */
374 return at->sat_cname.bv_val;
381 int oc_check_allowed(
389 LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
390 "oc_check_allowed: type \"%s\"\n", at->sat_cname.bv_val ));
392 Debug( LDAP_DEBUG_TRACE,
393 "oc_check_allowed type \"%s\"\n",
394 at->sat_cname.bv_val, 0, 0 );
397 /* always allow objectClass attribute */
398 if ( strcasecmp( at->sat_cname.bv_val, "objectClass" ) == 0 ) {
403 * All operational attributions are allowed by schema rules.
405 if( is_at_operational(at) ) {
409 /* check to see if its allowed by the structuralObjectClass */
411 /* does it require the type? */
412 for ( j = 0; sc->soc_required != NULL &&
413 sc->soc_required[j] != NULL; j++ )
415 if( at == sc->soc_required[j] ) {
420 /* does it allow the type? */
421 for ( j = 0; sc->soc_allowed != NULL &&
422 sc->soc_allowed[j] != NULL; j++ )
424 if( at == sc->soc_allowed[j] ) {
430 /* check that the type appears as req or opt in at least one oc */
431 for ( i = 0; ocl[i].bv_val != NULL; i++ ) {
432 /* if we know about the oc */
433 ObjectClass *oc = oc_bvfind( &ocl[i] );
434 if ( oc != NULL && oc->soc_kind != LDAP_SCHEMA_ABSTRACT &&
435 ( sc == NULL || oc->soc_kind == LDAP_SCHEMA_AUXILIARY ))
437 /* does it require the type? */
438 for ( j = 0; oc->soc_required != NULL &&
439 oc->soc_required[j] != NULL; j++ )
441 if( at == oc->soc_required[j] ) {
445 /* does it allow the type? */
446 for ( j = 0; oc->soc_allowed != NULL &&
447 oc->soc_allowed[j] != NULL; j++ )
449 if( at == oc->soc_allowed[j] ) {
456 /* not allowed by any oc */
457 return LDAP_OBJECT_CLASS_VIOLATION;
461 * Determine the structural object class from a set of OIDs
463 int structural_class(
468 char *textbuf, size_t textlen )
472 ObjectClass *sc = NULL;
475 *text = "structural_class: internal error";
478 for( i=0; ocs[i].bv_val; i++ ) {
479 oc = oc_bvfind( &ocs[i] );
482 snprintf( textbuf, textlen,
483 "unrecongized objectClass '%s'",
486 return LDAP_OBJECT_CLASS_VIOLATION;
489 if( oc->soc_kind == LDAP_SCHEMA_STRUCTURAL ) {
490 if( sc == NULL || is_object_subclass( sc, oc ) ) {
494 } else if ( !is_object_subclass( oc, sc ) ) {
496 ObjectClass *xc = NULL;
498 /* find common superior */
499 for( j=i+1; ocs[j].bv_val; j++ ) {
500 xc = oc_bvfind( &ocs[j] );
503 snprintf( textbuf, textlen,
504 "unrecongized objectClass '%s'",
507 return LDAP_OBJECT_CLASS_VIOLATION;
510 if( xc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
515 if( is_object_subclass( sc, xc ) &&
516 is_object_subclass( oc, xc ) )
518 /* found common subclass */
526 /* no common subclass */
527 snprintf( textbuf, textlen,
528 "invalid structural object class chain (%s/%s)",
529 ocs[scn].bv_val, ocs[i].bv_val );
531 return LDAP_OBJECT_CLASS_VIOLATION;
541 *text = "no structural object classes provided";
542 return LDAP_OBJECT_CLASS_VIOLATION;
550 * Return structural object class from list of modifications
552 int mods_structural_class(
556 char *textbuf, size_t textlen )
558 Modifications *ocmod = NULL;
560 for( ; mods != NULL; mods = mods->sml_next ) {
561 if( mods->sml_desc == slap_schema.si_ad_objectClass ) {
562 if( ocmod != NULL ) {
563 *text = "entry has multiple objectClass attributes";
564 return LDAP_OBJECT_CLASS_VIOLATION;
570 if( ocmod == NULL ) {
571 *text = "entry has no objectClass attribute";
572 return LDAP_OBJECT_CLASS_VIOLATION;
575 if( ocmod->sml_bvalues == NULL || ocmod->sml_bvalues[0].bv_val == NULL ) {
576 *text = "objectClass attribute has no values";
577 return LDAP_OBJECT_CLASS_VIOLATION;
580 return structural_class( ocmod->sml_bvalues, sc, NULL,
581 text, textbuf, textlen );