X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fschema_check.c;h=e95b3625cd132e1c265cdade85405cf292fd96ac;hb=447f3f746e59fc5b724b8dd8bfb1ec0e02cc8d9f;hp=cbc7134005f4f37e4d2fdeb4b21d2057adb3579e;hpb=da6d9eb0463255782f3fa70c61fd958d94c048cf;p=openldap

diff --git a/servers/slapd/schema_check.c b/servers/slapd/schema_check.c
index cbc7134005..e95b3625cd 100644
--- a/servers/slapd/schema_check.c
+++ b/servers/slapd/schema_check.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2007 The OpenLDAP Foundation.
+ * Copyright 1998-2009 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -32,6 +32,7 @@ static char * oc_check_required(
 static int entry_naming_check(
 	Entry *e,
 	int manage,
+	int add_naming,
 	const char** text,
 	char *textbuf, size_t textlen );
 /*
@@ -47,7 +48,8 @@ entry_schema_check(
 	Entry *e,
 	Attribute *oldattrs,
 	int manage,
-	int add_soc,
+	int add,
+	Attribute **socp,
 	const char** text,
 	char *textbuf, size_t textlen )
 {
@@ -135,7 +137,7 @@ entry_schema_check(
 	assert( aoc->a_vals[0].bv_val != NULL );
 
 	/* check the structural object class attribute */
-	if ( asc == NULL && !add_soc ) {
+	if ( asc == NULL && !add ) {
 		Debug( LDAP_DEBUG_ANY,
 			"No structuralObjectClass for entry (%s)\n",
 		    e->e_dn, 0, 0 );
@@ -150,7 +152,7 @@ entry_schema_check(
 		return rc;
 	}
 
-	if ( asc == NULL && add_soc ) {
+	if ( asc == NULL && add ) {
 		attr_merge_one( e, ad_structuralObjectClass, &oc->soc_cname, NULL );
 		asc = attr_find( e->e_attrs, ad_structuralObjectClass );
 		sc = oc;
@@ -171,7 +173,8 @@ entry_schema_check(
 			"entry_check_schema(%s): %s\n",
 			e->e_dn, textbuf, 0 );
 
-		return LDAP_OBJECT_CLASS_VIOLATION;
+		rc = LDAP_OBJECT_CLASS_VIOLATION;
+		goto done;
 	}
 
 	if( sc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
@@ -183,7 +186,8 @@ entry_schema_check(
 			"entry_check_schema(%s): %s\n",
 			e->e_dn, textbuf, 0 );
 
-		return LDAP_OTHER;
+		rc = LDAP_OTHER;
+		goto done;
 	}
 
 got_soc:
@@ -196,7 +200,8 @@ got_soc:
 			"entry_check_schema(%s): %s\n",
 			e->e_dn, textbuf, 0 );
 
-		return LDAP_OBJECT_CLASS_VIOLATION;
+		rc = LDAP_OBJECT_CLASS_VIOLATION;
+		goto done;
 	}
 
 	*text = textbuf;
@@ -206,24 +211,37 @@ got_soc:
 			"unrecognized objectClass '%s'",
 			aoc->a_vals[0].bv_val );
 		rc = LDAP_OBJECT_CLASS_VIOLATION;
-		goto leave;
+		goto done;
 
-	} else if ( sc != slap_schema.si_oc_glue && sc != oc ) {
-		snprintf( textbuf, textlen, 
-			"structural object class modification "
-			"from '%s' to '%s' not allowed",
-			asc->a_vals[0].bv_val, oc->soc_cname.bv_val );
-		rc = LDAP_NO_OBJECT_CLASS_MODS;
-		goto leave;
-	} else if ( sc == slap_schema.si_oc_glue ) {
+	} else if ( sc != oc ) {
+		if ( !manage && sc != slap_schema.si_oc_glue ) {
+			snprintf( textbuf, textlen, 
+				"structural object class modification "
+				"from '%s' to '%s' not allowed",
+				asc->a_vals[0].bv_val, oc->soc_cname.bv_val );
+			rc = LDAP_NO_OBJECT_CLASS_MODS;
+			goto done;
+		}
+
+		assert( asc->a_vals != NULL );
+		assert( !BER_BVISNULL( &asc->a_vals[0] ) );
+		assert( BER_BVISNULL( &asc->a_vals[1] ) );
+		assert( asc->a_nvals == asc->a_vals );
+
+		/* draft-zeilenga-ldap-relax: automatically modify
+		 * structuralObjectClass if changed with relax */
 		sc = oc;
+		ber_bvreplace( &asc->a_vals[ 0 ], &sc->soc_cname );
+		if ( socp ) {
+			*socp = asc;
+		}
 	}
 
 	/* naming check */
 	if ( !is_entry_glue ( e ) ) {
-		rc = entry_naming_check( e, manage, text, textbuf, textlen );
+		rc = entry_naming_check( e, manage, add, text, textbuf, textlen );
 		if( rc != LDAP_SUCCESS ) {
-			goto leave;
+			goto done;
 		}
 	} else {
 		/* Glue Entry */
@@ -247,7 +265,7 @@ got_soc:
 				e->e_dn, textbuf, 0 );
 
 			rc = LDAP_OBJECT_CLASS_VIOLATION;
-			goto leave;
+			goto done;
 		}
 
 		if( cr->scr_required ) for( i=0; cr->scr_required[i]; i++ ) {
@@ -271,7 +289,7 @@ got_soc:
 					e->e_dn, textbuf, 0 );
 
 				rc = LDAP_OBJECT_CLASS_VIOLATION;
-				goto leave;
+				goto done;
 			}
 		}
 
@@ -296,7 +314,7 @@ got_soc:
 					e->e_dn, textbuf, 0 );
 
 				rc = LDAP_OBJECT_CLASS_VIOLATION;
-				goto leave;
+				goto done;
 			}
 		}
 	}
@@ -315,14 +333,14 @@ got_soc:
 				e->e_dn, textbuf, 0 );
 
 			rc = LDAP_OBJECT_CLASS_VIOLATION;
-			goto leave;
+			goto done;
 		}
 
 		if ( oc->soc_check ) {
 			rc = (oc->soc_check)( op->o_bd, e, oc,
 				text, textbuf, textlen );
 			if( rc != LDAP_SUCCESS ) {
-				goto leave;
+				goto done;
 			}
 		}
 
@@ -352,8 +370,8 @@ got_soc:
 					}
 				}
 
-				if( xc == NULL ) {
-					snprintf( textbuf, textlen, "instanstantiation of "
+				if( xc != NULL ) {
+					snprintf( textbuf, textlen, "instantiation of "
 						"abstract objectClass '%s' not allowed",
 						aoc->a_vals[i].bv_val );
 
@@ -362,7 +380,7 @@ got_soc:
 						e->e_dn, textbuf, 0 );
 
 					rc = LDAP_OBJECT_CLASS_VIOLATION;
-					goto leave;
+					goto done;
 				}
 			}
 
@@ -384,24 +402,28 @@ got_soc:
 							}
 						}
 					}
+					if ( k ) {
+						snprintf( textbuf, textlen, 
+							"class '%s' not allowed by content rule '%s'",
+							oc->soc_cname.bv_val,
+							ldap_contentrule2name( &cr->scr_crule ) );
+					}
 				} else if ( global_disallows & SLAP_DISALLOW_AUX_WO_CR ) {
 					k = -1;
+					snprintf( textbuf, textlen, 
+						"class '%s' not allowed by any content rule",
+						oc->soc_cname.bv_val );
 				} else {
 					k = 0;	
 				}
 
 				if( k == -1 ) {
-					snprintf( textbuf, textlen, 
-						"content rule '%s' does not allow class '%s'",
-						ldap_contentrule2name( &cr->scr_crule ),
-						oc->soc_cname.bv_val );
-
 					Debug( LDAP_DEBUG_ANY,
 						"Entry (%s): %s\n",
 						e->e_dn, textbuf, 0 );
 
 					rc = LDAP_OBJECT_CLASS_VIOLATION;
-					goto leave;
+					goto done;
 				}
 			}
 
@@ -416,7 +438,7 @@ got_soc:
 					e->e_dn, textbuf, 0 );
 
 				rc = LDAP_OBJECT_CLASS_VIOLATION;
-				goto leave;
+				goto done;
 			}
 
 			if( oc == slap_schema.si_oc_extensibleObject ) {
@@ -428,7 +450,7 @@ got_soc:
 	if( extensible ) {
 		*text = NULL;
 		rc = LDAP_SUCCESS;
-		goto leave;
+		goto done;
 	}
 
 	/* check that each attr in the entry is allowed by some oc */
@@ -469,12 +491,12 @@ got_soc:
 			    "Entry (%s), %s\n",
 			    e->e_dn, textbuf, 0 );
 
-			goto leave;
+			goto done;
 		}
 	}
 
 	*text = NULL;
-leave:
+done:
 	slap_sl_free( socs, op->o_tmpmemctx );
 	return rc;
 }
@@ -565,6 +587,10 @@ int oc_check_allowed(
 	for ( i = 0; socs[i]; i++ ) {
 		/* if we know about the oc */
 		ObjectClass	*oc = socs[i];
+		/* extensibleObject allows all */
+		if ( oc == slap_schema.si_oc_extensibleObject ) {
+			return LDAP_SUCCESS;
+		}
 		if ( oc != NULL && oc->soc_kind != LDAP_SCHEMA_ABSTRACT &&
 			( sc == NULL || oc->soc_kind == LDAP_SCHEMA_AUXILIARY ))
 		{
@@ -751,6 +777,7 @@ static int
 entry_naming_check(
 	Entry *e,
 	int manage,
+	int add_naming,
 	const char** text,
 	char *textbuf, size_t textlen )
 {
@@ -781,6 +808,7 @@ entry_naming_check(
 		AttributeDescription *desc = NULL;
 		Attribute *attr;
 		const char *errtext;
+		int add = 0;
 
 		if( ava->la_flags & LDAP_AVA_BINARY ) {
 			snprintf( textbuf, textlen, 
@@ -841,37 +869,64 @@ entry_naming_check(
 			snprintf( textbuf, textlen, 
 				"naming attribute '%s' is not present in entry",
 				ava->la_attr.bv_val );
-			rc = LDAP_NAMING_VIOLATION;
-			break;
-		}
+			if ( add_naming ) {
+				add = 1;
 
-		rc = value_find_ex( desc, SLAP_MR_VALUE_OF_ASSERTION_SYNTAX|
-			SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH,
-			attr->a_nvals, &ava->la_value, NULL );
+			} else {
+				rc = LDAP_NAMING_VIOLATION;
+			}
 
-		if( rc != 0 ) {
-			switch( rc ) {
-			case LDAP_INAPPROPRIATE_MATCHING:
-				snprintf( textbuf, textlen, 
-					"inappropriate matching for naming attribute '%s'",
-					ava->la_attr.bv_val );
-				break;
-			case LDAP_INVALID_SYNTAX:
-				snprintf( textbuf, textlen, 
-					"value of naming attribute '%s' is invalid",
-					ava->la_attr.bv_val );
-				break;
-			case LDAP_NO_SUCH_ATTRIBUTE:
-				snprintf( textbuf, textlen, 
-					"value of naming attribute '%s' is not present in entry",
-					ava->la_attr.bv_val );
-				break;
-			default:
-				snprintf( textbuf, textlen, 
-					"naming attribute '%s' is inappropriate",
-					ava->la_attr.bv_val );
+		} else {
+			rc = attr_valfind( attr, SLAP_MR_VALUE_OF_ASSERTION_SYNTAX|
+				SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH,
+				&ava->la_value, NULL, NULL );
+
+			if ( rc != 0 ) {
+				switch( rc ) {
+				case LDAP_INAPPROPRIATE_MATCHING:
+					snprintf( textbuf, textlen, 
+						"inappropriate matching for naming attribute '%s'",
+						ava->la_attr.bv_val );
+					break;
+				case LDAP_INVALID_SYNTAX:
+					snprintf( textbuf, textlen, 
+						"value of naming attribute '%s' is invalid",
+						ava->la_attr.bv_val );
+					break;
+				case LDAP_NO_SUCH_ATTRIBUTE:
+					if ( add_naming ) {
+						if ( is_at_single_value( desc->ad_type ) ) {
+							snprintf( textbuf, textlen, 
+								"value of single-valued naming attribute '%s' conflicts with value present in entry",
+								ava->la_attr.bv_val );
+
+						} else {
+							add = 1;
+							rc = LDAP_SUCCESS;
+						}
+
+					} else {
+						snprintf( textbuf, textlen, 
+							"value of naming attribute '%s' is not present in entry",
+							ava->la_attr.bv_val );
+					}
+					break;
+				default:
+					snprintf( textbuf, textlen, 
+						"naming attribute '%s' is inappropriate",
+						ava->la_attr.bv_val );
+				}
+
+				if ( !add ) {
+					rc = LDAP_NAMING_VIOLATION;
+				}
 			}
-			rc = LDAP_NAMING_VIOLATION;
+		}
+
+		if ( add ) {
+			attr_merge_normalize_one( e, desc, &ava->la_value, NULL );
+
+		} else if ( rc != LDAP_SUCCESS ) {
 			break;
 		}
 	}