1 /* schema_check.c - routines to enforce schema definitions */
4 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
5 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include <ac/string.h>
14 #include <ac/socket.h>
19 static char * oc_check_required(
22 struct berval *ocname );
25 * Determine the structural object class from a set of OIDs
31 char *textbuf, size_t textlen )
35 ObjectClass *sc = NULL;
38 *text = "structural_class: internal error";
41 for( i=0; ocs[i]; i++ ) {
42 oc = oc_find( ocs[i]->bv_val );
45 snprintf( textbuf, textlen,
46 "unrecongized objectClass '%s'",
49 return LDAP_OBJECT_CLASS_VIOLATION;
52 if( oc->soc_kind == LDAP_SCHEMA_STRUCTURAL ) {
53 if( sc == NULL || is_object_subclass( sc, oc ) ) {
57 } else if ( !is_object_subclass( oc, sc ) ) {
59 ObjectClass *xc = NULL;
61 /* find common superior */
62 for( j=i+1; ocs[j]; j++ ) {
63 xc = oc_find( ocs[j]->bv_val );
66 snprintf( textbuf, textlen,
67 "unrecongized objectClass '%s'",
70 return LDAP_OBJECT_CLASS_VIOLATION;
73 if( xc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
78 if( is_object_subclass( sc, xc ) &&
79 is_object_subclass( oc, xc ) )
81 /* found common subclass */
89 /* no common subclass */
90 snprintf( textbuf, textlen,
91 "invalid structural object class chain (%s/%s)",
92 ocs[scn]->bv_val, ocs[i]->bv_val );
94 return LDAP_OBJECT_CLASS_VIOLATION;
101 *text = "no structural object classes provided";
102 return LDAP_OBJECT_CLASS_VIOLATION;
110 * Return structural object class from list of modifications
112 int mods_structural_class(
116 char *textbuf, size_t textlen )
118 Modifications *ocmod = NULL;
120 for( ; mods != NULL; mods = mods->sml_next ) {
121 if( mods->sml_desc == slap_schema.si_ad_objectClass ) {
122 if( ocmod != NULL ) {
123 *text = "entry has multiple objectClass attributes";
124 return LDAP_OBJECT_CLASS_VIOLATION;
130 if( ocmod == NULL ) {
131 *text = "entry has no objectClass attribute";
132 return LDAP_OBJECT_CLASS_VIOLATION;
135 if( ocmod->sml_bvalues == NULL || ocmod->sml_bvalues[0] == NULL ) {
136 *text = "objectClass attribute has no values";
137 return LDAP_OBJECT_CLASS_VIOLATION;
140 return structural_class( ocmod->sml_bvalues, sc,
141 text, textbuf, textlen );
145 * entry_schema_check - check that entry e conforms to the schema required
146 * by its object class(es).
148 * returns 0 if so, non-zero otherwise.
153 Entry *e, Attribute *oldattrs,
155 char *textbuf, size_t textlen )
157 Attribute *a, *asc, *aoc;
158 ObjectClass *sc, *oc;
161 AttributeDescription *ad_structuralObjectClass
162 = slap_schema.si_ad_structuralObjectClass;
163 AttributeDescription *ad_objectClass
164 = slap_schema.si_ad_objectClass;
169 /* check single-valued attrs for multiple values */
170 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
171 /* there should be at least one value */
173 assert( a->a_vals[0] != NULL );
175 /* if single value type, check for multiple values */
176 if( is_at_single_value( a->a_desc->ad_type ) &&
177 a->a_vals[1] != NULL )
179 char *type = a->a_desc->ad_cname.bv_val;
181 snprintf( textbuf, textlen,
182 "attribute '%s' cannot have multiple values",
186 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
187 "entry_schema_check: dn=\"%s\" %s\n",
190 Debug( LDAP_DEBUG_ANY,
192 e->e_dn, textbuf, 0 );
195 return LDAP_CONSTRAINT_VIOLATION;
199 if( !global_schemacheck ) return LDAP_SUCCESS;
201 /* find the object class attribute - could error out here */
202 asc = attr_find( e->e_attrs, ad_structuralObjectClass );
205 LDAP_LOG(( "schema", LDAP_LEVEL_INFO, "entry_schema_check: "
206 "No structuralObjectClass for entry (%s)\n",
209 Debug( LDAP_DEBUG_ANY,
210 "No structuralObjectClass for entry (%s)\n",
214 *text = "no structuralObjectClass operational attribute";
215 return LDAP_OBJECT_CLASS_VIOLATION;
218 assert( asc->a_vals != NULL );
219 assert( asc->a_vals[0] != NULL );
220 assert( asc->a_vals[1] == NULL );
222 sc = oc_find( asc->a_vals[0]->bv_val );
224 snprintf( textbuf, textlen,
225 "unrecognized structuralObjectClass '%s'",
226 aoc->a_vals[0]->bv_val );
229 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
230 "entry_schema_check: dn (%s), %s\n",
233 Debug( LDAP_DEBUG_ANY,
234 "entry_check_schema(%s): %s\n",
235 e->e_dn, textbuf, 0 );
238 return LDAP_OBJECT_CLASS_VIOLATION;
241 if( sc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
242 snprintf( textbuf, textlen,
243 "structuralObjectClass '%s' is not STRUCTURAL",
244 aoc->a_vals[0]->bv_val );
247 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
248 "entry_schema_check: dn (%s), %s\n",
251 Debug( LDAP_DEBUG_ANY,
252 "entry_check_schema(%s): %s\n",
253 e->e_dn, textbuf, 0 );
256 return LDAP_OBJECT_CLASS_VIOLATION;
259 /* find the object class attribute */
260 aoc = attr_find( e->e_attrs, ad_objectClass );
263 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
264 "entry_schema_check: No objectClass for entry (%s).\n", e->e_dn ));
266 Debug( LDAP_DEBUG_ANY, "No objectClass for entry (%s)\n",
270 *text = "no objectClass attribute";
271 return LDAP_OBJECT_CLASS_VIOLATION;
274 assert( aoc->a_vals != NULL );
275 assert( aoc->a_vals[0] != NULL );
277 rc = structural_class( aoc->a_vals, &nsc, text, textbuf, textlen );
278 if( rc != LDAP_SUCCESS ) {
280 } else if ( nsc.bv_len == 0 ) {
281 return LDAP_OBJECT_CLASS_VIOLATION;
286 oc = oc_find( nsc.bv_val );
288 snprintf( textbuf, textlen,
289 "unrecognized objectClass '%s'",
290 aoc->a_vals[i]->bv_val );
291 return LDAP_OBJECT_CLASS_VIOLATION;
293 } else if ( sc != oc ) {
294 snprintf( textbuf, textlen,
295 "structuralObjectClass modification from '%s' to '%s' not allowed",
296 asc->a_vals[0]->bv_val, nsc.bv_val );
297 return LDAP_NO_OBJECT_CLASS_MODS;
300 /* check that the entry has required attrs for each oc */
301 for ( i = 0; aoc->a_vals[i] != NULL; i++ ) {
302 if ( (oc = oc_find( aoc->a_vals[i]->bv_val )) == NULL ) {
303 snprintf( textbuf, textlen,
304 "unrecognized objectClass '%s'",
305 aoc->a_vals[i]->bv_val );
308 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
309 "entry_schema_check: dn (%s), %s\n",
312 Debug( LDAP_DEBUG_ANY,
313 "entry_check_schema(%s): \"%s\" not recognized\n",
314 e->e_dn, textbuf, 0 );
317 return LDAP_OBJECT_CLASS_VIOLATION;
319 } else if ( oc->soc_kind == LDAP_SCHEMA_ABSTRACT ) {
320 /* object class is abstract */
321 /* FIXME: need to check that is is a superclass of something */
323 } else if ( oc->soc_kind == LDAP_SCHEMA_STRUCTURAL && oc != sc ) {
324 /* object class is a superclass of the structural class */
325 /* nothing in particular to check */
328 char *s = oc_check_required( e, oc, aoc->a_vals[i] );
331 snprintf( textbuf, textlen,
332 "object class '%s' requires attribute '%s'",
333 aoc->a_vals[i]->bv_val, s );
336 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
337 "entry_schema_check: dn=\"%s\" %s",
340 Debug( LDAP_DEBUG_ANY,
342 e->e_dn, textbuf, 0 );
345 return LDAP_OBJECT_CLASS_VIOLATION;
348 if( oc == slap_schema.si_oc_extensibleObject ) {
358 /* check that each attr in the entry is allowed by some oc */
359 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
360 int ret = oc_check_allowed( a->a_desc->ad_type, aoc->a_vals );
361 if ( ret != LDAP_SUCCESS ) {
362 char *type = a->a_desc->ad_cname.bv_val;
364 snprintf( textbuf, textlen,
365 "attribute '%s' not allowed",
369 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
370 "entry_schema_check: dn=\"%s\" %s\n",
373 Debug( LDAP_DEBUG_ANY,
375 e->e_dn, textbuf, 0 );
389 struct berval *ocname )
396 LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
397 "oc_check_required: dn (%s), objectClass \"%s\"\n",
398 e->e_dn, ocname->bv_val ));
400 Debug( LDAP_DEBUG_TRACE,
401 "oc_check_required entry (%s), objectClass \"%s\"\n",
402 e->e_dn, ocname->bv_val, 0 );
406 /* check for empty oc_required */
407 if(oc->soc_required == NULL) {
411 /* for each required attribute */
412 for ( i = 0; oc->soc_required[i] != NULL; i++ ) {
413 at = oc->soc_required[i];
414 /* see if it's in the entry */
415 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
416 if( a->a_desc->ad_type == at ) {
420 /* not there => schema violation */
422 return at->sat_cname.bv_val;
429 int oc_check_allowed(
431 struct berval **ocl )
437 LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
438 "oc_check_allowed: type \"%s\"\n", at->sat_cname.bv_val ));
440 Debug( LDAP_DEBUG_TRACE,
441 "oc_check_allowed type \"%s\"\n",
442 at->sat_cname.bv_val, 0, 0 );
445 /* always allow objectClass attribute */
446 if ( strcasecmp( at->sat_cname.bv_val, "objectClass" ) == 0 ) {
451 * All operational attributions are allowed by schema rules.
453 if( is_at_operational(at) ) {
457 /* check that the type appears as req or opt in at least one oc */
458 for ( i = 0; ocl[i] != NULL; i++ ) {
459 /* if we know about the oc */
460 if ( (oc = oc_find( ocl[i]->bv_val )) != NULL ) {
461 /* does it require the type? */
462 for ( j = 0; oc->soc_required != NULL &&
463 oc->soc_required[j] != NULL; j++ )
465 if( at == oc->soc_required[j] ) {
469 /* does it allow the type? */
470 for ( j = 0; oc->soc_allowed != NULL &&
471 oc->soc_allowed[j] != NULL; j++ )
473 if( at == oc->soc_allowed[j] ) {
477 /* maybe the next oc allows it */
481 /* not allowed by any oc */
482 return LDAP_OBJECT_CLASS_VIOLATION;