X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fschema_check.c;h=e45a63d7d7f38a7068de8a5d053fcaeb57a42b93;hb=6f2004961018ccd0cd0334c2165fe53b35d6dd8a;hp=446202e86c640dc183249ddfe1d308651943c0a8;hpb=ea57395f82d26753183a033fea362aea2920964b;p=openldap

diff --git a/servers/slapd/schema_check.c b/servers/slapd/schema_check.c
index 446202e86c..e45a63d7d7 100644
--- a/servers/slapd/schema_check.c
+++ b/servers/slapd/schema_check.c
@@ -1,8 +1,17 @@
 /* schema_check.c - routines to enforce schema definitions */
 /* $OpenLDAP$ */
-/*
- * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
- * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2008 The OpenLDAP Foundation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
  */
 
 #include "portable.h"
@@ -14,7 +23,6 @@
 #include <ac/socket.h>
 
 #include "slap.h"
-#include "ldap_pvt.h"
 
 static char * oc_check_required(
 	Entry *e,
@@ -23,6 +31,8 @@ static char * oc_check_required(
 
 static int entry_naming_check(
 	Entry *e,
+	int manage,
+	int add_naming,
 	const char** text,
 	char *textbuf, size_t textlen );
 /*
@@ -34,20 +44,19 @@ static int entry_naming_check(
 
 int
 entry_schema_check( 
-	Backend *be,
+	Operation *op,
 	Entry *e,
 	Attribute *oldattrs,
+	int manage,
+	int add,
 	const char** text,
 	char *textbuf, size_t textlen )
 {
-	Attribute	*a, *asc, *aoc;
-	ObjectClass *sc, *oc;
-#ifdef SLAP_EXTENDED_SCHEMA
+	Attribute	*a, *asc = NULL, *aoc = NULL;
+	ObjectClass *sc, *oc, **socs = NULL;
 	AttributeType *at;
 	ContentRule *cr;
-#endif
 	int	rc, i;
-	struct berval nsc;
 	AttributeDescription *ad_structuralObjectClass
 		= slap_schema.si_ad_structuralObjectClass;
 	AttributeDescription *ad_objectClass
@@ -56,6 +65,14 @@ entry_schema_check(
 	int subentry = is_entry_subentry( e );
 	int collectiveSubentry = 0;
 
+	if ( SLAP_NO_SCHEMA_CHECK( op->o_bd )) {
+		return LDAP_SUCCESS;
+	}
+
+	if ( get_no_schema_check( op ) ) {
+		return LDAP_SUCCESS;
+	}
+
 	if( subentry ) {
 		collectiveSubentry = is_entry_collectiveAttributeSubentry( e );
 	}
@@ -67,17 +84,22 @@ entry_schema_check(
 		const char *type = a->a_desc->ad_cname.bv_val;
 
 		/* there should be at least one value */
-		assert( a->a_vals );
+		assert( a->a_vals != NULL );
 		assert( a->a_vals[0].bv_val != NULL ); 
 
 		if( a->a_desc->ad_type->sat_check ) {
-			int rc = (a->a_desc->ad_type->sat_check)(
-				be, e, a, text, textbuf, textlen );
+			rc = (a->a_desc->ad_type->sat_check)(
+				op->o_bd, e, a, text, textbuf, textlen );
 			if( rc != LDAP_SUCCESS ) {
 				return rc;
 			}
 		}
 
+		if( a->a_desc == ad_structuralObjectClass )
+			asc = a;
+		else if ( a->a_desc == ad_objectClass )
+			aoc = a;
+
 		if( !collectiveSubentry && is_at_collective( a->a_desc->ad_type ) ) {
 			snprintf( textbuf, textlen,
 				"'%s' can only appear in collectiveAttributeSubentry",
@@ -93,39 +115,49 @@ entry_schema_check(
 				"attribute '%s' cannot have multiple values",
 				type );
 
-#ifdef NEW_LOGGING
-			LDAP_LOG( OPERATION, INFO, 
-				"entry_schema_check: dn=\"%s\" %s\n", e->e_dn, textbuf, 0 );
-#else
 			Debug( LDAP_DEBUG_ANY,
 			    "Entry (%s), %s\n",
 			    e->e_dn, textbuf, 0 );
-#endif
 
 			return LDAP_CONSTRAINT_VIOLATION;
 		}
 	}
 
-	/* it's a REALLY bad idea to disable schema checks */
-	if( !global_schemacheck ) return LDAP_SUCCESS;
+	/* check the object class attribute */
+	if ( aoc == NULL ) {
+		Debug( LDAP_DEBUG_ANY, "No objectClass for entry (%s)\n",
+		    e->e_dn, 0, 0 );
+
+		*text = "no objectClass attribute";
+		return LDAP_OBJECT_CLASS_VIOLATION;
+	}
 
-	/* find the structural object class attribute */
-	asc = attr_find( e->e_attrs, ad_structuralObjectClass );
-	if ( asc == NULL ) {
-#ifdef NEW_LOGGING
-		LDAP_LOG( OPERATION, INFO, 
-			"entry_schema_check: No structuralObjectClass for entry (%s)\n", 
-			e->e_dn, 0, 0 );
-#else
+	assert( aoc->a_vals != NULL );
+	assert( aoc->a_vals[0].bv_val != NULL );
+
+	/* check the structural object class attribute */
+	if ( asc == NULL && !add ) {
 		Debug( LDAP_DEBUG_ANY,
 			"No structuralObjectClass for entry (%s)\n",
 		    e->e_dn, 0, 0 );
-#endif
 
 		*text = "no structuralObjectClass operational attribute";
 		return LDAP_OTHER;
 	}
 
+	rc = structural_class( aoc->a_vals, &oc, &socs, text, textbuf, textlen,
+		op->o_tmpmemctx );
+	if( rc != LDAP_SUCCESS ) {
+		return rc;
+	}
+
+	if ( asc == NULL && add ) {
+		attr_merge_one( e, ad_structuralObjectClass, &oc->soc_cname, NULL );
+		asc = attr_find( e->e_attrs, ad_structuralObjectClass );
+		sc = oc;
+		goto got_soc;
+	}
+
 	assert( asc->a_vals != NULL );
 	assert( asc->a_vals[0].bv_val != NULL );
 	assert( asc->a_vals[1].bv_val == NULL );
@@ -136,16 +168,12 @@ entry_schema_check(
 			"unrecognized structuralObjectClass '%s'",
 			asc->a_vals[0].bv_val );
 
-#ifdef NEW_LOGGING
-		LDAP_LOG( OPERATION, INFO, 
-			"entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 );
-#else
 		Debug( LDAP_DEBUG_ANY,
 			"entry_check_schema(%s): %s\n",
 			e->e_dn, textbuf, 0 );
-#endif
 
-		return LDAP_OBJECT_CLASS_VIOLATION;
+		rc = LDAP_OBJECT_CLASS_VIOLATION;
+		goto done;
 	}
 
 	if( sc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
@@ -153,57 +181,26 @@ entry_schema_check(
 			"structuralObjectClass '%s' is not STRUCTURAL",
 			asc->a_vals[0].bv_val );
 
-#ifdef NEW_LOGGING
-		LDAP_LOG( OPERATION, INFO, 
-			"entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 );
-#else
 		Debug( LDAP_DEBUG_ANY,
 			"entry_check_schema(%s): %s\n",
 			e->e_dn, textbuf, 0 );
-#endif
 
-		return LDAP_OTHER;
+		rc = LDAP_OTHER;
+		goto done;
 	}
 
-	if( sc->soc_obsolete ) {
+got_soc:
+	if( !manage && sc->soc_obsolete ) {
 		snprintf( textbuf, textlen, 
 			"structuralObjectClass '%s' is OBSOLETE",
 			asc->a_vals[0].bv_val );
 
-#ifdef NEW_LOGGING
-		LDAP_LOG( OPERATION, INFO, 
-			"entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 );
-#else
 		Debug( LDAP_DEBUG_ANY,
 			"entry_check_schema(%s): %s\n",
 			e->e_dn, textbuf, 0 );
-#endif
-
-		return LDAP_OBJECT_CLASS_VIOLATION;
-	}
-
-	/* find the object class attribute */
-	aoc = attr_find( e->e_attrs, ad_objectClass );
-	if ( aoc == NULL ) {
-#ifdef NEW_LOGGING
-		LDAP_LOG( OPERATION, INFO, 
-			"entry_schema_check: No objectClass for entry (%s).\n", 
-			e->e_dn, 0, 0 );
-#else
-		Debug( LDAP_DEBUG_ANY, "No objectClass for entry (%s)\n",
-		    e->e_dn, 0, 0 );
-#endif
-
-		*text = "no objectClass attribute";
-		return LDAP_OBJECT_CLASS_VIOLATION;
-	}
-
-	assert( aoc->a_vals != NULL );
-	assert( aoc->a_vals[0].bv_val != NULL );
 
-	rc = structural_class( aoc->a_vals, &nsc, &oc, text, textbuf, textlen );
-	if( rc != LDAP_SUCCESS ) {
-		return rc;
+		rc = LDAP_OBJECT_CLASS_VIOLATION;
+		goto done;
 	}
 
 	*text = textbuf;
@@ -212,43 +209,30 @@ entry_schema_check(
 		snprintf( textbuf, textlen, 
 			"unrecognized objectClass '%s'",
 			aoc->a_vals[0].bv_val );
-		return LDAP_OBJECT_CLASS_VIOLATION;
+		rc = LDAP_OBJECT_CLASS_VIOLATION;
+		goto done;
 
-#ifdef LDAP_SYNCREPL
 	} else if ( sc != slap_schema.si_oc_glue && sc != oc ) {
-#else
-	} else if ( sc != oc ) {
-#endif
 		snprintf( textbuf, textlen, 
 			"structural object class modification "
 			"from '%s' to '%s' not allowed",
-			asc->a_vals[0].bv_val, nsc.bv_val );
-		return LDAP_NO_OBJECT_CLASS_MODS;
-	}
-#ifdef LDAP_SYNCREPL
-	else if ( sc == slap_schema.si_oc_glue ) {
+			asc->a_vals[0].bv_val, oc->soc_cname.bv_val );
+		rc = LDAP_NO_OBJECT_CLASS_MODS;
+		goto done;
+	} else if ( sc == slap_schema.si_oc_glue ) {
 		sc = oc;
 	}
-#endif
 
 	/* naming check */
-#ifdef LDAP_SYNCREPL
-        if ( !is_entry_objectclass ( e, slap_schema.si_oc_glue, 0 ) ) {
-                rc = entry_naming_check( e, text, textbuf, textlen );
-                if( rc != LDAP_SUCCESS ) {
-                        return rc;
-                }
-        } else {
-			/* Glue Entry */
-        }
-#else
-        rc = entry_naming_check( e, text, textbuf, textlen );
-        if( rc != LDAP_SUCCESS ) {
-                return rc;
-        }
-#endif
-
-#ifdef SLAP_EXTENDED_SCHEMA
+	if ( !is_entry_glue ( e ) ) {
+		rc = entry_naming_check( e, manage, add, text, textbuf, textlen );
+		if( rc != LDAP_SUCCESS ) {
+			goto done;
+		}
+	} else {
+		/* Glue Entry */
+	}
+
 	/* find the content rule for the structural class */
 	cr = cr_find( sc->soc_oid );
 
@@ -257,21 +241,17 @@ entry_schema_check(
 
 	/* check that the entry has required attrs of the content rule */
 	if( cr ) {
-		if( cr->scr_obsolete ) {
+		if( !manage && cr->scr_obsolete ) {
 			snprintf( textbuf, textlen, 
 				"content rule '%s' is obsolete",
 				ldap_contentrule2name( &cr->scr_crule ));
 
-#ifdef NEW_LOGGING
-			LDAP_LOG( OPERATION, INFO, 
-				"entry_schema_check: dn=\"%s\" %s", e->e_dn, textbuf, 0 );
-#else
 			Debug( LDAP_DEBUG_ANY,
 				"Entry (%s): %s\n",
 				e->e_dn, textbuf, 0 );
-#endif
 
-			return LDAP_OBJECT_CLASS_VIOLATION;
+			rc = LDAP_OBJECT_CLASS_VIOLATION;
+			goto done;
 		}
 
 		if( cr->scr_required ) for( i=0; cr->scr_required[i]; i++ ) {
@@ -290,16 +270,12 @@ entry_schema_check(
 					ldap_contentrule2name( &cr->scr_crule ),
 					at->sat_cname.bv_val );
 
-#ifdef NEW_LOGGING
-				LDAP_LOG( OPERATION, INFO, 
-					"entry_schema_check: dn=\"%s\" %s", e->e_dn, textbuf, 0 );
-#else
 				Debug( LDAP_DEBUG_ANY,
 					"Entry (%s): %s\n",
 					e->e_dn, textbuf, 0 );
-#endif
 
-				return LDAP_OBJECT_CLASS_VIOLATION;
+				rc = LDAP_OBJECT_CLASS_VIOLATION;
+				goto done;
 			}
 		}
 
@@ -319,63 +295,38 @@ entry_schema_check(
 					ldap_contentrule2name( &cr->scr_crule ),
 					at->sat_cname.bv_val );
 
-#ifdef NEW_LOGGING
-				LDAP_LOG( OPERATION, INFO, 
-					"entry_schema_check: dn=\"%s\" %s", e->e_dn, textbuf, 0 );
-#else
 				Debug( LDAP_DEBUG_ANY,
 					"Entry (%s): %s\n",
 					e->e_dn, textbuf, 0 );
-#endif
 
-				return LDAP_OBJECT_CLASS_VIOLATION;
+				rc = LDAP_OBJECT_CLASS_VIOLATION;
+				goto done;
 			}
 		}
 	}
-#endif /* SLAP_EXTENDED_SCHEMA */
 
 	/* check that the entry has required attrs for each oc */
-	for ( i = 0; aoc->a_vals[i].bv_val != NULL; i++ ) {
-		if ( (oc = oc_bvfind( &aoc->a_vals[i] )) == NULL ) {
-			snprintf( textbuf, textlen, 
-				"unrecognized objectClass '%s'",
-				aoc->a_vals[i].bv_val );
-
-#ifdef NEW_LOGGING
-			LDAP_LOG( OPERATION, INFO, 
-				"entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 );
-#else
-			Debug( LDAP_DEBUG_ANY,
-				"entry_check_schema(%s): %s\n",
-				e->e_dn, textbuf, 0 );
-#endif
-
-			return LDAP_OBJECT_CLASS_VIOLATION;
-		}
-
-		if ( oc->soc_obsolete ) {
+	for ( i = 0; socs[i]; i++ ) {
+		oc = socs[i];
+		if ( !manage && oc->soc_obsolete ) {
 			/* disallow obsolete classes */
 			snprintf( textbuf, textlen, 
 				"objectClass '%s' is OBSOLETE",
 				aoc->a_vals[i].bv_val );
 
-#ifdef NEW_LOGGING
-			LDAP_LOG( OPERATION, INFO, 
-				"entry_schema_check: dn (%s), %s\n", e->e_dn, textbuf, 0 );
-#else
 			Debug( LDAP_DEBUG_ANY,
 				"entry_check_schema(%s): %s\n",
 				e->e_dn, textbuf, 0 );
-#endif
 
-			return LDAP_OBJECT_CLASS_VIOLATION;
+			rc = LDAP_OBJECT_CLASS_VIOLATION;
+			goto done;
 		}
 
 		if ( oc->soc_check ) {
-			int rc = (oc->soc_check)( be, e, oc,
+			rc = (oc->soc_check)( op->o_bd, e, oc,
 				text, textbuf, textlen );
 			if( rc != LDAP_SUCCESS ) {
-				return rc;
+				goto done;
 			}
 		}
 
@@ -386,26 +337,9 @@ entry_schema_check(
 			{
 				int j;
 				ObjectClass *xc = NULL;
-				for( j=0; aoc->a_vals[j].bv_val; j++ ) {
+				for( j=0; socs[j]; j++ ) {
 					if( i != j ) {
-						xc = oc_bvfind( &aoc->a_vals[i] );
-						if( xc == NULL ) {
-							snprintf( textbuf, textlen, 
-								"unrecognized objectClass '%s'",
-								aoc->a_vals[i].bv_val );
-
-#ifdef NEW_LOGGING
-							LDAP_LOG( OPERATION, INFO, 
-								"entry_schema_check: dn (%s), %s\n",
-								e->e_dn, textbuf, 0 );
-#else
-							Debug( LDAP_DEBUG_ANY,
-								"entry_check_schema(%s): %s\n",
-								e->e_dn, textbuf, 0 );
-#endif
-
-							return LDAP_OBJECT_CLASS_VIOLATION;
-						}
+						xc = socs[j];
 
 						/* since we previous check against the
 						 * structural object of this entry, the
@@ -422,29 +356,23 @@ entry_schema_check(
 					}
 				}
 
-				if( xc == NULL ) {
-					snprintf( textbuf, textlen, "instanstantiation of "
+				if( xc != NULL ) {
+					snprintf( textbuf, textlen, "instantiation of "
 						"abstract objectClass '%s' not allowed",
 						aoc->a_vals[i].bv_val );
 
-#ifdef NEW_LOGGING
-					LDAP_LOG( OPERATION, INFO, 
-						"entry_schema_check: dn (%s), %s\n", 
-						e->e_dn, textbuf, 0 );
-#else
 					Debug( LDAP_DEBUG_ANY,
 						"entry_check_schema(%s): %s\n",
 						e->e_dn, textbuf, 0 );
-#endif
 
-					return LDAP_OBJECT_CLASS_VIOLATION;
+					rc = LDAP_OBJECT_CLASS_VIOLATION;
+					goto done;
 				}
 			}
 
 		} else if ( oc->soc_kind != LDAP_SCHEMA_STRUCTURAL || oc == sc ) {
 			char *s;
 
-#ifdef SLAP_EXTENDED_SCHEMA
 			if( oc->soc_kind == LDAP_SCHEMA_AUXILIARY ) {
 				int k;
 
@@ -460,32 +388,30 @@ entry_schema_check(
 							}
 						}
 					}
+					if ( k ) {
+						snprintf( textbuf, textlen, 
+							"class '%s' not allowed by content rule '%s'",
+							oc->soc_cname.bv_val,
+							ldap_contentrule2name( &cr->scr_crule ) );
+					}
 				} else if ( global_disallows & SLAP_DISALLOW_AUX_WO_CR ) {
 					k = -1;
+					snprintf( textbuf, textlen, 
+						"class '%s' not allowed by any content rule",
+						oc->soc_cname.bv_val );
 				} else {
 					k = 0;	
 				}
 
 				if( k == -1 ) {
-					snprintf( textbuf, textlen, 
-						"content rule '%s' does not allow class '%s'",
-						ldap_contentrule2name( &cr->scr_crule ),
-						oc->soc_cname.bv_val );
-
-#ifdef NEW_LOGGING
-					LDAP_LOG( OPERATION, INFO, 
-						"entry_schema_check: dn=\"%s\" %s",
-						e->e_dn, textbuf, 0 );
-#else
 					Debug( LDAP_DEBUG_ANY,
 						"Entry (%s): %s\n",
 						e->e_dn, textbuf, 0 );
-#endif
 
-					return LDAP_OBJECT_CLASS_VIOLATION;
+					rc = LDAP_OBJECT_CLASS_VIOLATION;
+					goto done;
 				}
 			}
-#endif /* SLAP_EXTENDED_SCHEMA */
 
 			s = oc_check_required( e, oc, &aoc->a_vals[i] );
 			if (s != NULL) {
@@ -493,16 +419,12 @@ entry_schema_check(
 					"object class '%s' requires attribute '%s'",
 					aoc->a_vals[i].bv_val, s );
 
-#ifdef NEW_LOGGING
-				LDAP_LOG( OPERATION, INFO, 
-					"entry_schema_check: dn=\"%s\" %s", e->e_dn, textbuf, 0 );
-#else
 				Debug( LDAP_DEBUG_ANY,
 					"Entry (%s): %s\n",
 					e->e_dn, textbuf, 0 );
-#endif
 
-				return LDAP_OBJECT_CLASS_VIOLATION;
+				rc = LDAP_OBJECT_CLASS_VIOLATION;
+				goto done;
 			}
 
 			if( oc == slap_schema.si_oc_extensibleObject ) {
@@ -512,61 +434,57 @@ entry_schema_check(
 	}
 
 	if( extensible ) {
-		return LDAP_SUCCESS;
+		*text = NULL;
+		rc = LDAP_SUCCESS;
+		goto done;
 	}
 
 	/* check that each attr in the entry is allowed by some oc */
 	for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
-		int ret;
-
-#ifdef SLAP_EXTENDED_SCHEMA
- 		ret = LDAP_OBJECT_CLASS_VIOLATION;
+ 		rc = LDAP_OBJECT_CLASS_VIOLATION;
 
 		if( cr && cr->scr_required ) {
 			for( i=0; cr->scr_required[i]; i++ ) {
 				if( cr->scr_required[i] == a->a_desc->ad_type ) {
-					ret = LDAP_SUCCESS;
+					rc = LDAP_SUCCESS;
 					break;
 				}
 			}
 		}
 
-		if( ret != LDAP_SUCCESS && cr && cr->scr_allowed ) {
+		if( rc != LDAP_SUCCESS && cr && cr->scr_allowed ) {
 			for( i=0; cr->scr_allowed[i]; i++ ) {
 				if( cr->scr_allowed[i] == a->a_desc->ad_type ) {
-					ret = LDAP_SUCCESS;
+					rc = LDAP_SUCCESS;
 					break;
 				}
 			}
 		}
 
-		if( ret != LDAP_SUCCESS ) 
-#endif /* SLAP_EXTENDED_SCHEMA */
+		if( rc != LDAP_SUCCESS ) 
 		{
-			ret = oc_check_allowed( a->a_desc->ad_type, aoc->a_vals, sc );
+			rc = oc_check_allowed( a->a_desc->ad_type, socs, sc );
 		}
 
-		if ( ret != LDAP_SUCCESS ) {
+		if ( rc != LDAP_SUCCESS ) {
 			char *type = a->a_desc->ad_cname.bv_val;
 
 			snprintf( textbuf, textlen, 
 				"attribute '%s' not allowed",
 				type );
 
-#ifdef NEW_LOGGING
-			LDAP_LOG( OPERATION, INFO, 
-				"entry_schema_check: dn=\"%s\" %s\n", e->e_dn, textbuf, 0);
-#else
 			Debug( LDAP_DEBUG_ANY,
 			    "Entry (%s), %s\n",
 			    e->e_dn, textbuf, 0 );
-#endif
 
-			return ret;
+			goto done;
 		}
 	}
 
-	return LDAP_SUCCESS;
+	*text = NULL;
+done:
+	slap_sl_free( socs, op->o_tmpmemctx );
+	return rc;
 }
 
 static char *
@@ -579,15 +497,9 @@ oc_check_required(
 	int		i;
 	Attribute	*a;
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( OPERATION, ENTRY, 
-		"oc_check_required: dn (%s), objectClass \"%s\"\n", 
-		e->e_dn, ocname->bv_val, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 		"oc_check_required entry (%s), objectClass \"%s\"\n",
 		e->e_dn, ocname->bv_val, 0 );
-#endif
 
 
 	/* check for empty oc_required */
@@ -615,19 +527,14 @@ oc_check_required(
 
 int oc_check_allowed(
 	AttributeType *at,
-	BerVarray ocl,
+	ObjectClass **socs,
 	ObjectClass *sc )
 {
 	int		i, j;
 
-#ifdef NEW_LOGGING
-	LDAP_LOG( OPERATION, ENTRY, 
-		"oc_check_allowed: type \"%s\"\n", at->sat_cname.bv_val, 0, 0 );
-#else
 	Debug( LDAP_DEBUG_TRACE,
 		"oc_check_allowed type \"%s\"\n",
 		at->sat_cname.bv_val, 0, 0 );
-#endif
 
 	/* always allow objectClass attribute */
 	if ( strcasecmp( at->sat_cname.bv_val, "objectClass" ) == 0 ) {
@@ -663,9 +570,13 @@ int oc_check_allowed(
 	}
 
 	/* check that the type appears as req or opt in at least one oc */
-	for ( i = 0; ocl[i].bv_val != NULL; i++ ) {
+	for ( i = 0; socs[i]; i++ ) {
 		/* if we know about the oc */
-		ObjectClass	*oc = oc_bvfind( &ocl[i] );
+		ObjectClass	*oc = socs[i];
+		/* extensibleObject allows all */
+		if ( oc == slap_schema.si_oc_extensibleObject ) {
+			return LDAP_SUCCESS;
+		}
 		if ( oc != NULL && oc->soc_kind != LDAP_SCHEMA_ABSTRACT &&
 			( sc == NULL || oc->soc_kind == LDAP_SCHEMA_AUXILIARY ))
 		{
@@ -697,30 +608,40 @@ int oc_check_allowed(
  */
 int structural_class(
 	BerVarray ocs,
-	struct berval *scbv,
 	ObjectClass **scp,
+	ObjectClass ***socsp,
 	const char **text,
-	char *textbuf, size_t textlen )
+	char *textbuf, size_t textlen,
+	void *ctx )
 {
-	int i;
-	ObjectClass *oc;
+	int i, nocs;
+	ObjectClass *oc, **socs;
 	ObjectClass *sc = NULL;
 	int scn = -1;
 
 	*text = "structural_class: internal error";
-	scbv->bv_len = 0;
+
+	/* count them */
+	for( i=0; ocs[i].bv_val; i++ ) ;
+	nocs = i;
+	
+	socs = slap_sl_malloc( (nocs+1) * sizeof(ObjectClass *), ctx );
 
 	for( i=0; ocs[i].bv_val; i++ ) {
-		oc = oc_bvfind( &ocs[i] );
+		socs[i] = oc_bvfind( &ocs[i] );
 
-		if( oc == NULL ) {
+		if( socs[i] == NULL ) {
 			snprintf( textbuf, textlen,
 				"unrecognized objectClass '%s'",
 				ocs[i].bv_val );
 			*text = textbuf;
-			return LDAP_OBJECT_CLASS_VIOLATION;
+			goto fail;
 		}
+	}
+	socs[i] = NULL;
 
+	for( i=0; ocs[i].bv_val; i++ ) {
+		oc = socs[i];
 		if( oc->soc_kind == LDAP_SCHEMA_STRUCTURAL ) {
 			if( sc == NULL || is_object_subclass( sc, oc ) ) {
 				sc = oc;
@@ -732,14 +653,14 @@ int structural_class(
 
 				/* find common superior */
 				for( j=i+1; ocs[j].bv_val; j++ ) {
-					xc = oc_bvfind( &ocs[j] );
+					xc = socs[j];
 
 					if( xc == NULL ) {
 						snprintf( textbuf, textlen,
 							"unrecognized objectClass '%s'",
-							ocs[i].bv_val );
+							ocs[j].bv_val );
 						*text = textbuf;
-						return LDAP_OBJECT_CLASS_VIOLATION;
+						goto fail;
 					}
 
 					if( xc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
@@ -763,7 +684,7 @@ int structural_class(
 						"invalid structural object class chain (%s/%s)",
 						ocs[scn].bv_val, ocs[i].bv_val );
 					*text = textbuf;
-					return LDAP_OBJECT_CLASS_VIOLATION;
+					goto fail;
 				}
 			}
 		}
@@ -775,22 +696,26 @@ int structural_class(
 
 	if( sc == NULL ) {
 		*text = "no structural object class provided";
-		return LDAP_OBJECT_CLASS_VIOLATION;
+		goto fail;
 	}
 
 	if( scn < 0 ) {
 		*text = "invalid structural object class";
-		return LDAP_OBJECT_CLASS_VIOLATION;
+		goto fail;
 	}
 
-	*scbv = ocs[scn];
-
-	if( scbv->bv_len == 0 ) {
-		*text = "invalid structural object class";
-		return LDAP_OBJECT_CLASS_VIOLATION;
+	if ( socsp ) {
+		*socsp = socs;
+	} else {
+		slap_sl_free( socs, ctx );
 	}
+	*text = NULL;
 
 	return LDAP_SUCCESS;
+
+fail:
+	slap_sl_free( socs, ctx );
+	return LDAP_OBJECT_CLASS_VIOLATION;
 }
 
 /*
@@ -800,9 +725,11 @@ int mods_structural_class(
 	Modifications *mods,
 	struct berval *sc,
 	const char **text,
-	char *textbuf, size_t textlen )
+	char *textbuf, size_t textlen, void *ctx )
 {
 	Modifications *ocmod = NULL;
+	ObjectClass *ssc;
+	int rc;
 
 	for( ; mods != NULL; mods = mods->sml_next ) {
 		if( mods->sml_desc == slap_schema.si_ad_objectClass ) {
@@ -819,19 +746,24 @@ int mods_structural_class(
 		return LDAP_OBJECT_CLASS_VIOLATION;
 	}
 
-	if( ocmod->sml_bvalues == NULL || ocmod->sml_bvalues[0].bv_val == NULL ) {
+	if( ocmod->sml_values == NULL || ocmod->sml_values[0].bv_val == NULL ) {
 		*text = "objectClass attribute has no values";
 		return LDAP_OBJECT_CLASS_VIOLATION;
 	}
 
-	return structural_class( ocmod->sml_bvalues, sc, NULL,
-		text, textbuf, textlen );
+	rc = structural_class( ocmod->sml_values, &ssc, NULL,
+		text, textbuf, textlen, ctx );
+	if ( rc == LDAP_SUCCESS )
+		*sc = ssc->soc_cname;
+	return rc;
 }
 
 
 static int
 entry_naming_check(
 	Entry *e,
+	int manage,
+	int add_naming,
 	const char** text,
 	char *textbuf, size_t textlen )
 {
@@ -841,6 +773,10 @@ entry_naming_check(
 	ber_len_t	cnt;
 	int		rc = LDAP_SUCCESS;
 
+	if ( BER_BVISEMPTY( &e->e_name )) {
+		return LDAP_SUCCESS;
+	}
+
 	/*
 	 * Get attribute type(s) and attribute value(s) of our RDN
 	 */
@@ -858,6 +794,14 @@ entry_naming_check(
 		AttributeDescription *desc = NULL;
 		Attribute *attr;
 		const char *errtext;
+		int add = 0;
+
+		if( ava->la_flags & LDAP_AVA_BINARY ) {
+			snprintf( textbuf, textlen, 
+				"value of naming attribute '%s' in unsupported BER form",
+				ava->la_attr.bv_val );
+			rc = LDAP_NAMING_VIOLATION;
+		}
 
 		rc = slap_bv2ad( &ava->la_attr, &desc, &errtext );
 		if ( rc != LDAP_SUCCESS ) {
@@ -865,34 +809,103 @@ entry_naming_check(
 			break;
 		}
 
-		/* find the naming attribute */
-		attr = attr_find( e->e_attrs, desc );
-		if ( attr == NULL ) {
+		if( desc->ad_type->sat_usage ) {
 			snprintf( textbuf, textlen, 
-				"naming attribute '%s' is not present in entry",
+				"naming attribute '%s' is operational",
+				ava->la_attr.bv_val );
+			rc = LDAP_NAMING_VIOLATION;
+			break;
+		}
+ 
+		if( desc->ad_type->sat_collective ) {
+			snprintf( textbuf, textlen, 
+				"naming attribute '%s' is collective",
 				ava->la_attr.bv_val );
 			rc = LDAP_NAMING_VIOLATION;
 			break;
 		}
 
-		if( ava->la_flags & LDAP_AVA_BINARY ) {
+		if( !manage && desc->ad_type->sat_obsolete ) {
 			snprintf( textbuf, textlen, 
-				"value of naming attribute '%s' in unsupported BER form",
+				"naming attribute '%s' is obsolete",
 				ava->la_attr.bv_val );
 			rc = LDAP_NAMING_VIOLATION;
+			break;
 		}
 
-		if ( value_find_ex( desc,
-			SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH,
-			attr->a_nvals,
-			&ava->la_value, NULL ) != 0 )
-		{
+		if( !desc->ad_type->sat_equality ) {
+			snprintf( textbuf, textlen, 
+				"naming attribute '%s' has no equality matching rule",
+				ava->la_attr.bv_val );
+			rc = LDAP_NAMING_VIOLATION;
+			break;
+		}
+
+		if( !desc->ad_type->sat_equality->smr_match ) {
 			snprintf( textbuf, textlen, 
-				"value of naming attribute '%s' is not present in entry",
+				"naming attribute '%s' has unsupported equality matching rule",
 				ava->la_attr.bv_val );
 			rc = LDAP_NAMING_VIOLATION;
 			break;
 		}
+
+		/* find the naming attribute */
+		attr = attr_find( e->e_attrs, desc );
+		if ( attr == NULL ) {
+			snprintf( textbuf, textlen, 
+				"naming attribute '%s' is not present in entry",
+				ava->la_attr.bv_val );
+			if ( add_naming ) {
+				add = 1;
+
+			} else {
+				rc = LDAP_NAMING_VIOLATION;
+			}
+
+		} else {
+			rc = attr_valfind( attr, SLAP_MR_VALUE_OF_ASSERTION_SYNTAX|
+				SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH,
+				&ava->la_value, NULL, NULL );
+
+			if( rc != 0 ) {
+				switch( rc ) {
+				case LDAP_INAPPROPRIATE_MATCHING:
+					snprintf( textbuf, textlen, 
+						"inappropriate matching for naming attribute '%s'",
+						ava->la_attr.bv_val );
+					break;
+				case LDAP_INVALID_SYNTAX:
+					snprintf( textbuf, textlen, 
+						"value of naming attribute '%s' is invalid",
+						ava->la_attr.bv_val );
+					break;
+				case LDAP_NO_SUCH_ATTRIBUTE:
+					snprintf( textbuf, textlen, 
+						"value of naming attribute '%s' is not present in entry",
+						ava->la_attr.bv_val );
+					if ( add_naming ) {
+						add = 1;
+						rc = LDAP_SUCCESS;
+					}
+					break;
+				default:
+					snprintf( textbuf, textlen, 
+						"naming attribute '%s' is inappropriate",
+						ava->la_attr.bv_val );
+				}
+
+				if ( !add ) {
+					rc = LDAP_NAMING_VIOLATION;
+				}
+			}
+		}
+
+		if ( add ) {
+			attr_merge_normalize_one( e, desc, &ava->la_value, NULL );
+
+		} else if ( rc != LDAP_SUCCESS ) {
+			break;
+		}
 	}
 
 	ldap_rdnfree( rdn );