X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fschema_check.c;h=0412bb4f2028bd2ebefec86835c42cca688d9a97;hb=b4e1ea15f3081a065318f5ee99336494c8765bca;hp=c30ee24612353980a3a47583a3655f9505744753;hpb=d23313a06862d599f45c1bbb3160974231b39157;p=openldap diff --git a/servers/slapd/schema_check.c b/servers/slapd/schema_check.c index c30ee24612..0412bb4f20 100644 --- a/servers/slapd/schema_check.c +++ b/servers/slapd/schema_check.c @@ -1,7 +1,7 @@ /* schema_check.c - routines to enforce schema definitions */ /* $OpenLDAP$ */ /* - * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved. + * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved. * COPYING RESTRICTIONS APPLY, see COPYRIGHT file */ @@ -30,7 +30,9 @@ static char * oc_check_required( int entry_schema_check( - Entry *e, Attribute *oldattrs, + Backend *be, + Entry *e, + Attribute *oldattrs, const char** text, char *textbuf, size_t textlen ) { @@ -43,29 +45,47 @@ entry_schema_check( AttributeDescription *ad_objectClass = slap_schema.si_ad_objectClass; int extensible = 0; + int subentry = is_entry_subentry( e ); + int collectiveSubentry = 0; + + if( subentry) collectiveSubentry = is_entry_collectiveAttributeSubentry( e ); *text = textbuf; - /* check single-valued attrs for multiple values */ + /* misc attribute checks */ for ( a = e->e_attrs; a != NULL; a = a->a_next ) { + const char *type = a->a_desc->ad_cname.bv_val; + /* there should be at least one value */ assert( a->a_vals ); - assert( a->a_vals[0] != NULL ); + assert( a->a_vals[0].bv_val != NULL ); + + if( a->a_desc->ad_type->sat_check ) { + int rc = (a->a_desc->ad_type->sat_check)( + be, e, a, text, textbuf, textlen ); + if( rc != LDAP_SUCCESS ) { + return rc; + } + } + + if( !collectiveSubentry && is_at_collective( a->a_desc->ad_type ) ) { + snprintf( textbuf, textlen, + "'%s' can only appear in collectiveAttributeSubentry", + type ); + return LDAP_OBJECT_CLASS_VIOLATION; + } /* if single value type, check for multiple values */ if( is_at_single_value( a->a_desc->ad_type ) && - a->a_vals[1] != NULL ) + a->a_vals[1].bv_val != NULL ) { - char *type = a->a_desc->ad_cname.bv_val; - snprintf( textbuf, textlen, "attribute '%s' cannot have multiple values", type ); #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_INFO, - "entry_schema_check: dn=\"%s\" %s\n", - e->e_dn, textbuf )); + LDAP_LOG( OPERATION, INFO, + "entry_schema_check: dn=\"%s\" %s\n", e->e_dn, textbuf, 0 ); #else Debug( LDAP_DEBUG_ANY, "Entry (%s), %s\n", @@ -79,13 +99,13 @@ entry_schema_check( /* it's a REALLY bad idea to disable schema checks */ if( !global_schemacheck ) return LDAP_SUCCESS; - /* find the object class attribute - could error out here */ + /* find the structural object class attribute */ asc = attr_find( e->e_attrs, ad_structuralObjectClass ); if ( asc == NULL ) { #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_INFO, "entry_schema_check: " - "No structuralObjectClass for entry (%s)\n", - e->e_dn )); + LDAP_LOG( OPERATION, INFO, + "entry_schema_check: No structuralObjectClass for entry (%s)\n", + e->e_dn, 0, 0 ); #else Debug( LDAP_DEBUG_ANY, "No structuralObjectClass for entry (%s)\n", @@ -93,23 +113,22 @@ entry_schema_check( #endif *text = "no structuralObjectClass operational attribute"; - return LDAP_OBJECT_CLASS_VIOLATION; + return LDAP_OTHER; } assert( asc->a_vals != NULL ); - assert( asc->a_vals[0] != NULL ); - assert( asc->a_vals[1] == NULL ); + assert( asc->a_vals[0].bv_val != NULL ); + assert( asc->a_vals[1].bv_val == NULL ); - sc = oc_find( asc->a_vals[0]->bv_val ); + sc = oc_bvfind( &asc->a_vals[0] ); if( sc == NULL ) { snprintf( textbuf, textlen, "unrecognized structuralObjectClass '%s'", - aoc->a_vals[0]->bv_val ); + asc->a_vals[0].bv_val ); #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_INFO, - "entry_schema_check: dn (%s), %s\n", - e->e_dn, textbuf )); + LDAP_LOG( OPERATION, INFO, + "entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 ); #else Debug( LDAP_DEBUG_ANY, "entry_check_schema(%s): %s\n", @@ -122,28 +141,27 @@ entry_schema_check( if( sc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) { snprintf( textbuf, textlen, "structuralObjectClass '%s' is not STRUCTURAL", - aoc->a_vals[0]->bv_val ); + asc->a_vals[0].bv_val ); #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_INFO, - "entry_schema_check: dn (%s), %s\n", - e->e_dn, textbuf )); + LDAP_LOG( OPERATION, INFO, + "entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 ); #else Debug( LDAP_DEBUG_ANY, "entry_check_schema(%s): %s\n", e->e_dn, textbuf, 0 ); #endif - return LDAP_OBJECT_CLASS_VIOLATION; + return LDAP_OTHER; } /* find the object class attribute */ aoc = attr_find( e->e_attrs, ad_objectClass ); if ( aoc == NULL ) { #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_INFO, - "entry_schema_check: No objectClass for entry (%s).\n" - e->e_dn )); + LDAP_LOG( OPERATION, INFO, + "entry_schema_check: No objectClass for entry (%s).\n", + e->e_dn, 0, 0 ); #else Debug( LDAP_DEBUG_ANY, "No objectClass for entry (%s)\n", e->e_dn, 0, 0 ); @@ -154,42 +172,38 @@ entry_schema_check( } assert( aoc->a_vals != NULL ); - assert( aoc->a_vals[0] != NULL ); + assert( aoc->a_vals[0].bv_val != NULL ); - rc = structural_class( aoc->a_vals, &nsc, text, textbuf, textlen ); + rc = structural_class( aoc->a_vals, &nsc, &oc, text, textbuf, textlen ); if( rc != LDAP_SUCCESS ) { return rc; - } else if ( nsc.bv_len == 0 ) { - return LDAP_OBJECT_CLASS_VIOLATION; } *text = textbuf; - oc = oc_find( nsc.bv_val ); if ( oc == NULL ) { snprintf( textbuf, textlen, "unrecognized objectClass '%s'", - aoc->a_vals[i]->bv_val ); + aoc->a_vals[0].bv_val ); return LDAP_OBJECT_CLASS_VIOLATION; } else if ( sc != oc ) { snprintf( textbuf, textlen, - "structuralObjectClass modification from '%s' to '%s' not allowed", - asc->a_vals[0]->bv_val, nsc.bv_val ); + "structural object class modification from '%s' to '%s' not allowed", + asc->a_vals[0].bv_val, nsc.bv_val ); return LDAP_NO_OBJECT_CLASS_MODS; } /* check that the entry has required attrs for each oc */ - for ( i = 0; aoc->a_vals[i] != NULL; i++ ) { - if ( (oc = oc_find( aoc->a_vals[i]->bv_val )) == NULL ) { + for ( i = 0; aoc->a_vals[i].bv_val != NULL; i++ ) { + if ( (oc = oc_bvfind( &aoc->a_vals[i] )) == NULL ) { snprintf( textbuf, textlen, "unrecognized objectClass '%s'", - aoc->a_vals[i]->bv_val ); + aoc->a_vals[i].bv_val ); #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_INFO, - "entry_schema_check: dn (%s), %s\n", - e->e_dn, textbuf )); + LDAP_LOG( OPERATION, INFO, + "entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 ); #else Debug( LDAP_DEBUG_ANY, "entry_check_schema(%s): %s\n", @@ -197,26 +211,35 @@ entry_schema_check( #endif return LDAP_OBJECT_CLASS_VIOLATION; + } - } else if ( oc->soc_kind == LDAP_SCHEMA_ABSTRACT ) { + if ( oc->soc_check ) { + int rc = (oc->soc_check)( be, e, oc, + text, textbuf, textlen ); + if( rc != LDAP_SUCCESS ) { + return rc; + } + } + + if ( oc->soc_kind == LDAP_SCHEMA_ABSTRACT ) { /* object class is abstract */ if ( oc != slap_schema.si_oc_top && !is_object_subclass( oc, sc )) { int j; ObjectClass *xc = NULL; - for( j=0; aoc->a_vals[j]; j++ ) { + for( j=0; aoc->a_vals[j].bv_val; j++ ) { if( i != j ) { - xc = oc_find( aoc->a_vals[i]->bv_val ); + xc = oc_bvfind( &aoc->a_vals[i] ); if( xc == NULL ) { snprintf( textbuf, textlen, "unrecognized objectClass '%s'", - aoc->a_vals[i]->bv_val ); + aoc->a_vals[i].bv_val ); #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_INFO, + LDAP_LOG( OPERATION, INFO, "entry_schema_check: dn (%s), %s\n", - e->e_dn, textbuf )); + e->e_dn, textbuf, 0 ); #else Debug( LDAP_DEBUG_ANY, "entry_check_schema(%s): %s\n", @@ -235,22 +258,21 @@ entry_schema_check( if ( xc->soc_kind == LDAP_SCHEMA_AUXILIARY && is_object_subclass( oc, xc ) ) { - break;; + xc = NULL; + break; } - - xc = NULL; } } if( xc == NULL ) { snprintf( textbuf, textlen, "instanstantiation of " "abstract objectClass '%s' not allowed", - aoc->a_vals[i]->bv_val ); + aoc->a_vals[i].bv_val ); #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_INFO, - "entry_schema_check: dn (%s), %s\n", - e->e_dn, textbuf )); + LDAP_LOG( OPERATION, INFO, + "entry_schema_check: dn (%s), %s\n", + e->e_dn, textbuf, 0 ); #else Debug( LDAP_DEBUG_ANY, "entry_check_schema(%s): %s\n", @@ -262,17 +284,16 @@ entry_schema_check( } } else if ( oc->soc_kind != LDAP_SCHEMA_STRUCTURAL || oc == sc ) { - char *s = oc_check_required( e, oc, aoc->a_vals[i] ); + char *s = oc_check_required( e, oc, &aoc->a_vals[i] ); if (s != NULL) { snprintf( textbuf, textlen, "object class '%s' requires attribute '%s'", - aoc->a_vals[i]->bv_val, s ); + aoc->a_vals[i].bv_val, s ); #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_INFO, - "entry_schema_check: dn=\"%s\" %s", - e->e_dn, textbuf )); + LDAP_LOG( OPERATION, INFO, + "entry_schema_check: dn=\"%s\" %s", e->e_dn, textbuf, 0 ); #else Debug( LDAP_DEBUG_ANY, "Entry (%s): %s\n", @@ -303,9 +324,8 @@ entry_schema_check( type ); #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_INFO, - "entry_schema_check: dn=\"%s\" %s\n", - e->e_dn, textbuf )); + LDAP_LOG( OPERATION, INFO, + "entry_schema_check: dn=\"%s\" %s\n", e->e_dn, textbuf, 0); #else Debug( LDAP_DEBUG_ANY, "Entry (%s), %s\n", @@ -330,9 +350,9 @@ oc_check_required( Attribute *a; #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY, - "oc_check_required: dn (%s), objectClass \"%s\"\n", - e->e_dn, ocname->bv_val )); + LDAP_LOG( OPERATION, ENTRY, + "oc_check_required: dn (%s), objectClass \"%s\"\n", + e->e_dn, ocname->bv_val, 0 ); #else Debug( LDAP_DEBUG_TRACE, "oc_check_required entry (%s), objectClass \"%s\"\n", @@ -365,14 +385,14 @@ oc_check_required( int oc_check_allowed( AttributeType *at, - struct berval **ocl, + BerVarray ocl, ObjectClass *sc ) { int i, j; #ifdef NEW_LOGGING - LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY, - "oc_check_allowed: type \"%s\"\n", at->sat_cname.bv_val )); + LDAP_LOG( OPERATION, ENTRY, + "oc_check_allowed: type \"%s\"\n", at->sat_cname.bv_val, 0, 0 ); #else Debug( LDAP_DEBUG_TRACE, "oc_check_allowed type \"%s\"\n", @@ -413,9 +433,9 @@ int oc_check_allowed( } /* check that the type appears as req or opt in at least one oc */ - for ( i = 0; ocl[i] != NULL; i++ ) { + for ( i = 0; ocl[i].bv_val != NULL; i++ ) { /* if we know about the oc */ - ObjectClass *oc = oc_find( ocl[i]->bv_val ); + ObjectClass *oc = oc_bvfind( &ocl[i] ); if ( oc != NULL && oc->soc_kind != LDAP_SCHEMA_ABSTRACT && ( sc == NULL || oc->soc_kind == LDAP_SCHEMA_AUXILIARY )) { @@ -446,8 +466,9 @@ int oc_check_allowed( * Determine the structural object class from a set of OIDs */ int structural_class( - struct berval **ocs, + BerVarray ocs, struct berval *scbv, + ObjectClass **scp, const char **text, char *textbuf, size_t textlen ) { @@ -459,13 +480,13 @@ int structural_class( *text = "structural_class: internal error"; scbv->bv_len = 0; - for( i=0; ocs[i]; i++ ) { - oc = oc_find( ocs[i]->bv_val ); + for( i=0; ocs[i].bv_val; i++ ) { + oc = oc_bvfind( &ocs[i] ); if( oc == NULL ) { snprintf( textbuf, textlen, - "unrecongized objectClass '%s'", - ocs[i]->bv_val ); + "unrecognized objectClass '%s'", + ocs[i].bv_val ); *text = textbuf; return LDAP_OBJECT_CLASS_VIOLATION; } @@ -480,13 +501,13 @@ int structural_class( ObjectClass *xc = NULL; /* find common superior */ - for( j=i+1; ocs[j]; j++ ) { - xc = oc_find( ocs[j]->bv_val ); + for( j=i+1; ocs[j].bv_val; j++ ) { + xc = oc_bvfind( &ocs[j] ); if( xc == NULL ) { snprintf( textbuf, textlen, - "unrecongized objectClass '%s'", - ocs[i]->bv_val ); + "unrecognized objectClass '%s'", + ocs[i].bv_val ); *text = textbuf; return LDAP_OBJECT_CLASS_VIOLATION; } @@ -510,7 +531,7 @@ int structural_class( /* no common subclass */ snprintf( textbuf, textlen, "invalid structural object class chain (%s/%s)", - ocs[scn]->bv_val, ocs[i]->bv_val ); + ocs[scn].bv_val, ocs[i].bv_val ); *text = textbuf; return LDAP_OBJECT_CLASS_VIOLATION; } @@ -518,12 +539,27 @@ int structural_class( } } + if( scp ) { + *scp = sc; + } + if( sc == NULL ) { *text = "no structural object classes provided"; return LDAP_OBJECT_CLASS_VIOLATION; } - *scbv = *ocs[scn]; + if( scn < 0 ) { + *text = "invalid structural object class"; + return LDAP_OBJECT_CLASS_VIOLATION; + } + + *scbv = ocs[scn]; + + if( scbv->bv_len == 0 ) { + *text = "invalid structural object class"; + return LDAP_OBJECT_CLASS_VIOLATION; + } + return LDAP_SUCCESS; } @@ -553,11 +589,11 @@ int mods_structural_class( return LDAP_OBJECT_CLASS_VIOLATION; } - if( ocmod->sml_bvalues == NULL || ocmod->sml_bvalues[0] == NULL ) { + if( ocmod->sml_bvalues == NULL || ocmod->sml_bvalues[0].bv_val == NULL ) { *text = "objectClass attribute has no values"; return LDAP_OBJECT_CLASS_VIOLATION; } - return structural_class( ocmod->sml_bvalues, sc, + return structural_class( ocmod->sml_bvalues, sc, NULL, text, textbuf, textlen ); }