X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fschema_check.c;h=87ba819c1d35e1a44a2d361067fe720855245234;hb=0f30fb0d8f0adbbb7b41fd455c57aa56d64c9853;hp=d1c00935c31ff32fea0427985b83de765acf6dd4;hpb=7c7fab11d44680c1145ba24501d041db63f12ee3;p=openldap diff --git a/servers/slapd/schema_check.c b/servers/slapd/schema_check.c index d1c00935c3..87ba819c1d 100644 --- a/servers/slapd/schema_check.c +++ b/servers/slapd/schema_check.c @@ -16,9 +16,6 @@ #include "slap.h" #include "ldap_pvt.h" -#ifndef SLAPD_SCHEMA_NOT_COMPAT -static int oc_check_allowed(char *type, struct berval **oclist); -#endif static char * oc_check_required(Entry *e, struct berval *ocname); /* @@ -30,94 +27,139 @@ static char * oc_check_required(Entry *e, struct berval *ocname); int entry_schema_check( - Entry *e, Attribute *oldattrs, const char** text ) + Entry *e, Attribute *oldattrs, const char** text, + char *textbuf, size_t textlen ) { Attribute *a, *aoc; ObjectClass *oc; int i; - int ret; -#ifdef SLAPD_SCHEMA_NOT_COMPAT AttributeDescription *ad_objectClass = slap_schema.si_ad_objectClass; + int extensible = 0; + + *text = textbuf; + + /* check single-valued attrs for multiple values */ + for ( a = e->e_attrs; a != NULL; a = a->a_next ) { + /* there should be at least one value */ + assert( a->a_vals ); + assert( a->a_vals[0] != NULL ); + + /* if single value type, check for multiple values */ + if( is_at_single_value( a->a_desc->ad_type ) && + a->a_vals[1] != NULL ) + { + char *type = a->a_desc->ad_cname.bv_val; + + snprintf( textbuf, textlen, + "attribute '%s' cannot have multiple values", + type ); + +#ifdef NEW_LOGGING + LDAP_LOG(( "schema", LDAP_LEVEL_INFO, + "entry_schema_check: dn=\"%s\" %s\n", + e->e_dn, textbuf )); #else - static const char *ad_objectClass = "objectclass"; + Debug( LDAP_DEBUG_ANY, + "Entry (%s), %s\n", + e->e_dn, textbuf, 0 ); #endif - int extensible = 0; + + return LDAP_CONSTRAINT_VIOLATION; + } + } if( !global_schemacheck ) return LDAP_SUCCESS; /* find the object class attribute - could error out here */ if ( (aoc = attr_find( e->e_attrs, ad_objectClass )) == NULL ) { - Debug( LDAP_DEBUG_ANY, "No object class for entry (%s)\n", +#ifdef NEW_LOGGING + LDAP_LOG(( "schema", LDAP_LEVEL_INFO, + "entry_schema_check: No objectClass for entry (%s).\n", e->e_dn )); +#else + Debug( LDAP_DEBUG_ANY, "No objectClass for entry (%s)\n", e->e_dn, 0, 0 ); - *text = "no objectclass attribute"; - return oldattrs != NULL - ? LDAP_OBJECT_CLASS_VIOLATION - : LDAP_NO_OBJECT_CLASS_MODS; - } +#endif - ret = LDAP_SUCCESS; + *text = "no objectClass attribute"; + return LDAP_OBJECT_CLASS_VIOLATION; + } /* check that the entry has required attrs for each oc */ for ( i = 0; aoc->a_vals[i] != NULL; i++ ) { if ( (oc = oc_find( aoc->a_vals[i]->bv_val )) == NULL ) { + snprintf( textbuf, textlen, + "unrecognized objectClass '%s'", + aoc->a_vals[i]->bv_val ); + +#ifdef NEW_LOGGING + LDAP_LOG(( "schema", LDAP_LEVEL_INFO, + "entry_schema_check: dn (%s), %s\n", + e->e_dn, textbuf )); +#else Debug( LDAP_DEBUG_ANY, - "entry_check_schema(%s): objectclass \"%s\" not defined\n", - e->e_dn, aoc->a_vals[i]->bv_val, 0 ); + "entry_check_schema(%s): \"%s\" not recognized\n", + e->e_dn, textbuf, 0 ); +#endif + + return LDAP_OBJECT_CLASS_VIOLATION; } else { char *s = oc_check_required( e, aoc->a_vals[i] ); if (s != NULL) { + snprintf( textbuf, textlen, + "object class '%s' requires attribute '%s'", + aoc->a_vals[i]->bv_val, s ); + +#ifdef NEW_LOGGING + LDAP_LOG(( "schema", LDAP_LEVEL_INFO, + "entry_schema_check: dn=\"%s\" %s", + e->e_dn, textbuf )); +#else Debug( LDAP_DEBUG_ANY, - "Entry (%s), oc \"%s\" requires attr \"%s\"\n", - e->e_dn, aoc->a_vals[i]->bv_val, s ); - *text = "missing required attribute"; - ret = LDAP_OBJECT_CLASS_VIOLATION; - break; + "Entry (%s): %s\n", + e->e_dn, textbuf, 0 ); +#endif + + return LDAP_OBJECT_CLASS_VIOLATION; } -#ifdef SLAPD_SCHEMA_NOT_COMPAT - if( oc == slap_schema.si_oc_extensibleObject ) -#else - if( !strcmp( aoc->a_vals[i], "extensibleObject" ) == 0 ) -#endif - { + if( oc == slap_schema.si_oc_extensibleObject ) { extensible=1; } } } - if ( ret != LDAP_SUCCESS ) { - return ret; - } - if( extensible ) { return LDAP_SUCCESS; } /* check that each attr in the entry is allowed by some oc */ for ( a = e->e_attrs; a != NULL; a = a->a_next ) { -#ifdef SLAPD_SCHEMA_NOT_COMPAT - ret = oc_check_allowed( a->a_desc->ad_type, aoc->a_vals ); -#else - ret = oc_check_allowed( a->a_type, aoc->a_vals ); -#endif - if ( ret != 0 ) { -#ifdef SLAPD_SCHEMA_NOT_COMPAT - char *type = a->a_desc->ad_cname->bv_val; + int ret = oc_check_allowed( a->a_desc->ad_type, aoc->a_vals ); + if ( ret != LDAP_SUCCESS ) { + char *type = a->a_desc->ad_cname.bv_val; + + snprintf( textbuf, textlen, + "attribute '%s' not allowed", + type ); + +#ifdef NEW_LOGGING + LDAP_LOG(( "schema", LDAP_LEVEL_INFO, + "entry_schema_check: dn=\"%s\" %s\n", + e->e_dn, textbuf )); #else - char *type = a->a_type; -#endif Debug( LDAP_DEBUG_ANY, - "Entry (%s), attr \"%s\" not allowed\n", - e->e_dn, type, 0 ); - *text = "attribute not allowed"; - break; + "Entry (%s), %s\n", + e->e_dn, textbuf, 0 ); +#endif + + return ret; } } - return( ret ); + return LDAP_SUCCESS; } static char * @@ -128,9 +170,16 @@ oc_check_required( Entry *e, struct berval *ocname ) int i; Attribute *a; +#ifdef NEW_LOGGING + LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY, + "oc_check_required: dn (%s), objectClass \"%s\"\n", + e->e_dn, ocname->bv_val )); +#else Debug( LDAP_DEBUG_TRACE, - "oc_check_required entry (%s), objectclass \"%s\"\n", + "oc_check_required entry (%s), objectClass \"%s\"\n", e->e_dn, ocname->bv_val, 0 ); +#endif + /* find global oc defn. it we don't know about it assume it's ok */ if ( (oc = oc_find( ocname->bv_val )) == NULL ) { @@ -147,123 +196,46 @@ oc_check_required( Entry *e, struct berval *ocname ) at = oc->soc_required[i]; /* see if it's in the entry */ for ( a = e->e_attrs; a != NULL; a = a->a_next ) { -#ifdef SLAPD_SCHEMA_NOT_COMPAT if( a->a_desc->ad_type == at ) { break; } -#else - char **pp; - - if ( at->sat_oid && - strcmp( a->a_type, at->sat_oid ) == 0 ) { - break; - } - pp = at->sat_names; - if ( pp == NULL ) { - /* Empty name list => not found */ - a = NULL; - break; - } - while ( *pp ) { - if ( strcasecmp( a->a_type, *pp ) == 0 ) { - break; - } - pp++; - } - if ( *pp ) { - break; - } -#endif } /* not there => schema violation */ if ( a == NULL ) { -#ifdef SLAPD_SCHEMA_NOT_COMPAT - return at->sat_cname; -#else - if ( at->sat_names && at->sat_names[0] ) { - return at->sat_names[0]; - } else { - return at->sat_oid; - } -#endif + return at->sat_cname.bv_val; } } return( NULL ); } -#ifndef SLAPD_SCHEMA_NOT_COMPAT -static -#endif int oc_check_allowed( -#ifdef SLAPD_SCHEMA_NOT_COMPAT AttributeType *at, -#else - char *type, -#endif struct berval **ocl ) { ObjectClass *oc; int i, j; -#ifdef SLAPD_SCHEMA_NOT_COMPAT - Debug( LDAP_DEBUG_TRACE, - "oc_check_allowed type \"%s\"\n", - at->sat_cname, 0, 0 ); - - /* always allow objectclass attribute */ - if ( strcasecmp( at->sat_cname, "objectclass" ) == 0 ) { - return LDAP_SUCCESS; - } - +#ifdef NEW_LOGGING + LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY, + "oc_check_allowed: type \"%s\"\n", at->sat_cname.bv_val )); #else - AttributeType *at; - char **pp; - char *p; - char *t; - Debug( LDAP_DEBUG_TRACE, - "oc_check_allowed type \"%s\"\n", type, 0, 0 ); - - /* always allow objectclass attribute */ - if ( strcasecmp( type, "objectclass" ) == 0 ) { - return LDAP_SUCCESS; - } + "oc_check_allowed type \"%s\"\n", + at->sat_cname.bv_val, 0, 0 ); #endif -#ifdef SLAPD_SCHEMA_NOT_COMPAT - /* - * All operational attributions are allowed by schema rules. - */ - if( is_at_operational(at) ) { + /* always allow objectClass attribute */ + if ( strcasecmp( at->sat_cname.bv_val, "objectClass" ) == 0 ) { return LDAP_SUCCESS; } -#else - /* - * The "type" we have received is actually an AttributeDescription. - * Let's find out the corresponding type. - */ - p = strchr( type, ';' ); - if ( p ) { - t = ch_malloc( p-type+1 ); - strncpy( t, type, p-type ); - t[p-type] = '\0'; - Debug( LDAP_DEBUG_TRACE, - "oc_check_allowed type \"%s\" from \"%s\"\n", - t, type, 0 ); - - } else - { - t = type; - } /* * All operational attributions are allowed by schema rules. */ - if ( oc_check_op_attr( t ) ) { + if( is_at_operational(at) ) { return LDAP_SUCCESS; } -#endif /* check that the type appears as req or opt in at least one oc */ for ( i = 0; ocl[i] != NULL; i++ ) { @@ -273,78 +245,22 @@ int oc_check_allowed( for ( j = 0; oc->soc_required != NULL && oc->soc_required[j] != NULL; j++ ) { -#ifdef SLAPD_SCHEMA_NOT_COMPAT if( at == oc->soc_required[j] ) { return LDAP_SUCCESS; } -#else - at = oc->soc_required[j]; - if ( at->sat_oid && - strcmp(at->sat_oid, t ) == 0 ) { - if ( t != type ) - ldap_memfree( t ); - return LDAP_SUCCESS; - } - pp = at->sat_names; - if ( pp == NULL ) - continue; - while ( *pp ) { - if ( strcasecmp( *pp, t ) == 0 ) { - if ( t != type ) - ldap_memfree( t ); - return LDAP_SUCCESS; - } - pp++; - } -#endif } /* does it allow the type? */ for ( j = 0; oc->soc_allowed != NULL && oc->soc_allowed[j] != NULL; j++ ) { -#ifdef SLAPD_SCHEMA_NOT_COMPAT if( at == oc->soc_allowed[j] ) { return LDAP_SUCCESS; } -#else - at = oc->soc_allowed[j]; - if ( at->sat_oid && - strcmp( at->sat_oid, t ) == 0 ) { - if ( t != type ) - ldap_memfree( t ); - return LDAP_SUCCESS; - } - pp = at->sat_names; - if ( pp == NULL ) - continue; - while ( *pp ) { - if ( strcasecmp( *pp, t ) == 0 || - strcmp( *pp, "*" ) == 0 ) { - if ( t != type ) - ldap_memfree( t ); - return LDAP_SUCCESS; - } - pp++; - } -#endif } /* maybe the next oc allows it */ - -#ifdef OC_UNDEFINED_IMPLES_EXTENSIBLE - /* we don't know about the oc. assume it allows it */ - } else { - if ( t != type ) - ldap_memfree( t ); - return LDAP_SUCCESS; -#endif } } -#ifndef SLAPD_SCHEMA_NOT_COMPAT - if ( t != type ) - ldap_memfree( t ); -#endif - /* not allowed by any oc */ return LDAP_OBJECT_CLASS_VIOLATION; }