1 /* schema_check.c - routines to enforce schema definitions */
4 * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
5 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include <ac/string.h>
14 #include <ac/socket.h>
19 static char * oc_check_required(
22 struct berval *ocname );
25 * entry_schema_check - check that entry e conforms to the schema required
26 * by its object class(es).
28 * returns 0 if so, non-zero otherwise.
33 Entry *e, Attribute *oldattrs,
35 char *textbuf, size_t textlen )
37 Attribute *a, *asc, *aoc;
41 AttributeDescription *ad_structuralObjectClass
42 = slap_schema.si_ad_structuralObjectClass;
43 AttributeDescription *ad_objectClass
44 = slap_schema.si_ad_objectClass;
49 /* misc attribute checks */
50 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
51 /* there should be at least one value */
53 assert( a->a_vals[0].bv_val != NULL );
55 if( a->a_desc->ad_type->sat_check ) {
56 int rc = (a->a_desc->ad_type->sat_check)(
57 e, a, text, textbuf, textlen );
58 if( rc != LDAP_SUCCESS ) {
63 /* if single value type, check for multiple values */
64 if( is_at_single_value( a->a_desc->ad_type ) &&
65 a->a_vals[1].bv_val != NULL )
67 char *type = a->a_desc->ad_cname.bv_val;
69 snprintf( textbuf, textlen,
70 "attribute '%s' cannot have multiple values",
74 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
75 "entry_schema_check: dn=\"%s\" %s\n",
78 Debug( LDAP_DEBUG_ANY,
80 e->e_dn, textbuf, 0 );
83 return LDAP_CONSTRAINT_VIOLATION;
87 /* it's a REALLY bad idea to disable schema checks */
88 if( !global_schemacheck ) return LDAP_SUCCESS;
90 /* find the object class attribute - could error out here */
91 asc = attr_find( e->e_attrs, ad_structuralObjectClass );
94 LDAP_LOG(( "schema", LDAP_LEVEL_INFO, "entry_schema_check: "
95 "No structuralObjectClass for entry (%s)\n",
98 Debug( LDAP_DEBUG_ANY,
99 "No structuralObjectClass for entry (%s)\n",
103 *text = "no structuralObjectClass operational attribute";
104 return LDAP_OBJECT_CLASS_VIOLATION;
107 assert( asc->a_vals != NULL );
108 assert( asc->a_vals[0].bv_val != NULL );
109 assert( asc->a_vals[1].bv_val == NULL );
111 sc = oc_bvfind( &asc->a_vals[0] );
113 snprintf( textbuf, textlen,
114 "unrecognized structuralObjectClass '%s'",
115 asc->a_vals[0].bv_val );
118 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
119 "entry_schema_check: dn (%s), %s\n",
122 Debug( LDAP_DEBUG_ANY,
123 "entry_check_schema(%s): %s\n",
124 e->e_dn, textbuf, 0 );
127 return LDAP_OBJECT_CLASS_VIOLATION;
130 if( sc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
131 snprintf( textbuf, textlen,
132 "structuralObjectClass '%s' is not STRUCTURAL",
133 asc->a_vals[0].bv_val );
136 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
137 "entry_schema_check: dn (%s), %s\n",
140 Debug( LDAP_DEBUG_ANY,
141 "entry_check_schema(%s): %s\n",
142 e->e_dn, textbuf, 0 );
145 return LDAP_OBJECT_CLASS_VIOLATION;
148 /* find the object class attribute */
149 aoc = attr_find( e->e_attrs, ad_objectClass );
152 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
153 "entry_schema_check: No objectClass for entry (%s).\n"
156 Debug( LDAP_DEBUG_ANY, "No objectClass for entry (%s)\n",
160 *text = "no objectClass attribute";
161 return LDAP_OBJECT_CLASS_VIOLATION;
164 assert( aoc->a_vals != NULL );
165 assert( aoc->a_vals[0].bv_val != NULL );
167 rc = structural_class( aoc->a_vals, &nsc, &oc, text, textbuf, textlen );
168 if( rc != LDAP_SUCCESS ) {
170 } else if ( nsc.bv_len == 0 ) {
171 return LDAP_OBJECT_CLASS_VIOLATION;
177 snprintf( textbuf, textlen,
178 "unrecognized objectClass '%s'",
179 aoc->a_vals[0].bv_val );
180 return LDAP_OBJECT_CLASS_VIOLATION;
182 } else if ( sc != oc ) {
183 snprintf( textbuf, textlen,
184 "structuralObjectClass modification from '%s' to '%s' not allowed",
185 asc->a_vals[0].bv_val, nsc.bv_val );
186 return LDAP_NO_OBJECT_CLASS_MODS;
189 /* check that the entry has required attrs for each oc */
190 for ( i = 0; aoc->a_vals[i].bv_val != NULL; i++ ) {
191 if ( (oc = oc_bvfind( &aoc->a_vals[i] )) == NULL ) {
192 snprintf( textbuf, textlen,
193 "unrecognized objectClass '%s'",
194 aoc->a_vals[i].bv_val );
197 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
198 "entry_schema_check: dn (%s), %s\n",
201 Debug( LDAP_DEBUG_ANY,
202 "entry_check_schema(%s): %s\n",
203 e->e_dn, textbuf, 0 );
206 return LDAP_OBJECT_CLASS_VIOLATION;
208 } else if ( oc->soc_kind == LDAP_SCHEMA_ABSTRACT ) {
209 /* object class is abstract */
210 if ( oc != slap_schema.si_oc_top &&
211 !is_object_subclass( oc, sc ))
214 ObjectClass *xc = NULL;
215 for( j=0; aoc->a_vals[j].bv_val; j++ ) {
217 xc = oc_bvfind( &aoc->a_vals[i] );
219 snprintf( textbuf, textlen,
220 "unrecognized objectClass '%s'",
221 aoc->a_vals[i].bv_val );
224 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
225 "entry_schema_check: dn (%s), %s\n",
228 Debug( LDAP_DEBUG_ANY,
229 "entry_check_schema(%s): %s\n",
230 e->e_dn, textbuf, 0 );
233 return LDAP_OBJECT_CLASS_VIOLATION;
236 /* since we previous check against the
237 * structural object of this entry, the
238 * abstract class must be a (direct or indirect)
239 * superclass of one of the auxiliary classes of
242 if ( xc->soc_kind == LDAP_SCHEMA_AUXILIARY &&
243 is_object_subclass( oc, xc ) )
253 snprintf( textbuf, textlen, "instanstantiation of "
254 "abstract objectClass '%s' not allowed",
255 aoc->a_vals[i].bv_val );
258 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
259 "entry_schema_check: dn (%s), %s\n",
262 Debug( LDAP_DEBUG_ANY,
263 "entry_check_schema(%s): %s\n",
264 e->e_dn, textbuf, 0 );
267 return LDAP_OBJECT_CLASS_VIOLATION;
271 } else if ( oc->soc_kind != LDAP_SCHEMA_STRUCTURAL || oc == sc ) {
272 char *s = oc_check_required( e, oc, &aoc->a_vals[i] );
275 snprintf( textbuf, textlen,
276 "object class '%s' requires attribute '%s'",
277 aoc->a_vals[i].bv_val, s );
280 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
281 "entry_schema_check: dn=\"%s\" %s",
284 Debug( LDAP_DEBUG_ANY,
286 e->e_dn, textbuf, 0 );
289 return LDAP_OBJECT_CLASS_VIOLATION;
292 if( oc == slap_schema.si_oc_extensibleObject ) {
302 /* check that each attr in the entry is allowed by some oc */
303 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
304 int ret = oc_check_allowed( a->a_desc->ad_type, aoc->a_vals, sc );
305 if ( ret != LDAP_SUCCESS ) {
306 char *type = a->a_desc->ad_cname.bv_val;
308 snprintf( textbuf, textlen,
309 "attribute '%s' not allowed",
313 LDAP_LOG(( "schema", LDAP_LEVEL_INFO,
314 "entry_schema_check: dn=\"%s\" %s\n",
317 Debug( LDAP_DEBUG_ANY,
319 e->e_dn, textbuf, 0 );
333 struct berval *ocname )
340 LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
341 "oc_check_required: dn (%s), objectClass \"%s\"\n",
342 e->e_dn, ocname->bv_val ));
344 Debug( LDAP_DEBUG_TRACE,
345 "oc_check_required entry (%s), objectClass \"%s\"\n",
346 e->e_dn, ocname->bv_val, 0 );
350 /* check for empty oc_required */
351 if(oc->soc_required == NULL) {
355 /* for each required attribute */
356 for ( i = 0; oc->soc_required[i] != NULL; i++ ) {
357 at = oc->soc_required[i];
358 /* see if it's in the entry */
359 for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
360 if( a->a_desc->ad_type == at ) {
364 /* not there => schema violation */
366 return at->sat_cname.bv_val;
373 int oc_check_allowed(
381 LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
382 "oc_check_allowed: type \"%s\"\n", at->sat_cname.bv_val ));
384 Debug( LDAP_DEBUG_TRACE,
385 "oc_check_allowed type \"%s\"\n",
386 at->sat_cname.bv_val, 0, 0 );
389 /* always allow objectClass attribute */
390 if ( strcasecmp( at->sat_cname.bv_val, "objectClass" ) == 0 ) {
395 * All operational attributions are allowed by schema rules.
397 if( is_at_operational(at) ) {
401 /* check to see if its allowed by the structuralObjectClass */
403 /* does it require the type? */
404 for ( j = 0; sc->soc_required != NULL &&
405 sc->soc_required[j] != NULL; j++ )
407 if( at == sc->soc_required[j] ) {
412 /* does it allow the type? */
413 for ( j = 0; sc->soc_allowed != NULL &&
414 sc->soc_allowed[j] != NULL; j++ )
416 if( at == sc->soc_allowed[j] ) {
422 /* check that the type appears as req or opt in at least one oc */
423 for ( i = 0; ocl[i].bv_val != NULL; i++ ) {
424 /* if we know about the oc */
425 ObjectClass *oc = oc_bvfind( &ocl[i] );
426 if ( oc != NULL && oc->soc_kind != LDAP_SCHEMA_ABSTRACT &&
427 ( sc == NULL || oc->soc_kind == LDAP_SCHEMA_AUXILIARY ))
429 /* does it require the type? */
430 for ( j = 0; oc->soc_required != NULL &&
431 oc->soc_required[j] != NULL; j++ )
433 if( at == oc->soc_required[j] ) {
437 /* does it allow the type? */
438 for ( j = 0; oc->soc_allowed != NULL &&
439 oc->soc_allowed[j] != NULL; j++ )
441 if( at == oc->soc_allowed[j] ) {
448 /* not allowed by any oc */
449 return LDAP_OBJECT_CLASS_VIOLATION;
453 * Determine the structural object class from a set of OIDs
455 int structural_class(
460 char *textbuf, size_t textlen )
464 ObjectClass *sc = NULL;
467 *text = "structural_class: internal error";
470 for( i=0; ocs[i].bv_val; i++ ) {
471 oc = oc_bvfind( &ocs[i] );
474 snprintf( textbuf, textlen,
475 "unrecongized objectClass '%s'",
478 return LDAP_OBJECT_CLASS_VIOLATION;
481 if( oc->soc_kind == LDAP_SCHEMA_STRUCTURAL ) {
482 if( sc == NULL || is_object_subclass( sc, oc ) ) {
486 } else if ( !is_object_subclass( oc, sc ) ) {
488 ObjectClass *xc = NULL;
490 /* find common superior */
491 for( j=i+1; ocs[j].bv_val; j++ ) {
492 xc = oc_bvfind( &ocs[j] );
495 snprintf( textbuf, textlen,
496 "unrecongized objectClass '%s'",
499 return LDAP_OBJECT_CLASS_VIOLATION;
502 if( xc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
507 if( is_object_subclass( sc, xc ) &&
508 is_object_subclass( oc, xc ) )
510 /* found common subclass */
518 /* no common subclass */
519 snprintf( textbuf, textlen,
520 "invalid structural object class chain (%s/%s)",
521 ocs[scn].bv_val, ocs[i].bv_val );
523 return LDAP_OBJECT_CLASS_VIOLATION;
533 *text = "no structural object classes provided";
534 return LDAP_OBJECT_CLASS_VIOLATION;
542 * Return structural object class from list of modifications
544 int mods_structural_class(
548 char *textbuf, size_t textlen )
550 Modifications *ocmod = NULL;
552 for( ; mods != NULL; mods = mods->sml_next ) {
553 if( mods->sml_desc == slap_schema.si_ad_objectClass ) {
554 if( ocmod != NULL ) {
555 *text = "entry has multiple objectClass attributes";
556 return LDAP_OBJECT_CLASS_VIOLATION;
562 if( ocmod == NULL ) {
563 *text = "entry has no objectClass attribute";
564 return LDAP_OBJECT_CLASS_VIOLATION;
567 if( ocmod->sml_bvalues == NULL || ocmod->sml_bvalues[0].bv_val == NULL ) {
568 *text = "objectClass attribute has no values";
569 return LDAP_OBJECT_CLASS_VIOLATION;
572 return structural_class( ocmod->sml_bvalues, sc, NULL,
573 text, textbuf, textlen );