/*
* Do basic attribute type checking and syntax validation.
*/
int slap_mods_check(
Operation *op,
Modifications *ml,
const char **text,
char *textbuf,
size_t textlen,
void *ctx )
{
int rc;
for( ; ml != NULL; ml = ml->sml_next ) {
AttributeDescription *ad = NULL;
/* convert to attribute description */
if ( ml->sml_desc == NULL ) {
rc = slap_bv2ad( &ml->sml_type, &ml->sml_desc, text );
if( rc != LDAP_SUCCESS ) {
if ( get_no_schema_check( op )) {
rc = slap_bv2undef_ad( &ml->sml_type, &ml->sml_desc,
text, 0 );
}
}
if( rc != LDAP_SUCCESS ) {
snprintf( textbuf, textlen, "%s: %s",
ml->sml_type.bv_val, *text );
*text = textbuf;
return rc;
}
}
ad = ml->sml_desc;
if( slap_syntax_is_binary( ad->ad_type->sat_syntax )
&& !slap_ad_is_binary( ad ))
{
/* attribute requires binary transfer */
snprintf( textbuf, textlen,
"%s: requires ;binary transfer",
ml->sml_type.bv_val );
*text = textbuf;
return LDAP_UNDEFINED_TYPE;
}
if( !slap_syntax_is_binary( ad->ad_type->sat_syntax )
&& slap_ad_is_binary( ad ))
{
/* attribute does not require binary transfer */
snprintf( textbuf, textlen,
"%s: disallows ;binary transfer",
ml->sml_type.bv_val );
*text = textbuf;
return LDAP_UNDEFINED_TYPE;
}
if( slap_ad_is_tag_range( ad )) {
/* attribute requires binary transfer */
snprintf( textbuf, textlen,
"%s: inappropriate use of tag range option",
ml->sml_type.bv_val );
*text = textbuf;
return LDAP_UNDEFINED_TYPE;
}
#if 0
if ( is_at_obsolete( ad->ad_type ) &&
(( ml->sml_op != LDAP_MOD_REPLACE &&
ml->sml_op != LDAP_MOD_DELETE ) ||
ml->sml_values != NULL ))
{
/*
* attribute is obsolete,
* only allow replace/delete with no values
*/
snprintf( textbuf, textlen,
"%s: attribute is obsolete",
ml->sml_type.bv_val );
*text = textbuf;
return LDAP_CONSTRAINT_VIOLATION;
}
#endif
if ( ml->sml_op == LDAP_MOD_INCREMENT &&
#ifdef SLAPD_REAL_SYNTAX
!is_at_syntax( ad->ad_type, SLAPD_REAL_SYNTAX ) &&
#endif
!is_at_syntax( ad->ad_type, SLAPD_INTEGER_SYNTAX ) )
{
/*
* attribute values must be INTEGER or REAL
*/
snprintf( textbuf, textlen,
"%s: attribute syntax inappropriate for increment",
ml->sml_type.bv_val );
*text = textbuf;
return LDAP_CONSTRAINT_VIOLATION;
}
/*
* check values
*/
if( ml->sml_values != NULL ) {
ber_len_t nvals;
slap_syntax_validate_func *validate =
ad->ad_type->sat_syntax->ssyn_validate;
slap_syntax_transform_func *pretty =
ad->ad_type->sat_syntax->ssyn_pretty;
if( !pretty && !validate ) {
*text = "no validator for syntax";
snprintf( textbuf, textlen,
"%s: no validator for syntax %s",
ml->sml_type.bv_val,
ad->ad_type->sat_syntax->ssyn_oid );
*text = textbuf;
return LDAP_INVALID_SYNTAX;
}
/*
* check that each value is valid per syntax
* and pretty if appropriate
*/
for ( nvals = 0; !BER_BVISNULL( &ml->sml_values[nvals] ); nvals++ ) {
struct berval pval;
if ( pretty ) {
rc = ordered_value_pretty( ad,
&ml->sml_values[nvals], &pval, ctx );
} else {
rc = ordered_value_validate( ad,
&ml->sml_values[nvals], ml->sml_op );
}
if( rc != 0 ) {
snprintf( textbuf, textlen,
"%s: value #%ld invalid per syntax",
ml->sml_type.bv_val, (long) nvals );
*text = textbuf;
return LDAP_INVALID_SYNTAX;
}
if( pretty ) {
ber_memfree_x( ml->sml_values[nvals].bv_val, ctx );
ml->sml_values[nvals] = pval;
}
}
ml->sml_values[nvals].bv_len = 0;
ml->sml_numvals = nvals;
/*
* a rough single value check... an additional check is needed
* to catch add of single value to existing single valued attribute
*/
if ((ml->sml_op == LDAP_MOD_ADD || ml->sml_op == LDAP_MOD_REPLACE)
&& nvals > 1 && is_at_single_value( ad->ad_type ))
{
snprintf( textbuf, textlen,
"%s: multiple values provided",
ml->sml_type.bv_val );
*text = textbuf;
return LDAP_CONSTRAINT_VIOLATION;
}
/* if the type has a normalizer, generate the
* normalized values. otherwise leave them NULL.
*
* this is different from the rule for attributes
* in an entry - in an attribute list, the normalized
* value is set equal to the non-normalized value
* when there is no normalizer.
*/
if( nvals && ad->ad_type->sat_equality &&
ad->ad_type->sat_equality->smr_normalize )
{
ml->sml_nvalues = ber_memalloc_x(
(nvals+1)*sizeof(struct berval), ctx );
for ( nvals = 0; !BER_BVISNULL( &ml->sml_values[nvals] ); nvals++ ) {
rc = ordered_value_normalize(
SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
ad,
ad->ad_type->sat_equality,
&ml->sml_values[nvals], &ml->sml_nvalues[nvals], ctx );
if ( rc ) {
Debug( LDAP_DEBUG_ANY,
"<= str2entry NULL (ssyn_normalize %d)\n",
rc, 0, 0 );
snprintf( textbuf, textlen,
"%s: value #%ld normalization failed",
ml->sml_type.bv_val, (long) nvals );
*text = textbuf;
BER_BVZERO( &ml->sml_nvalues[nvals] );
return rc;
}
}
BER_BVZERO( &ml->sml_nvalues[nvals] );
}
/* check for duplicates, but ignore Deletes.
*/
if( nvals > 1 && ml->sml_op != LDAP_MOD_DELETE ) {
int i;
rc = slap_sort_vals( ml, text, &i, ctx );
if ( rc == LDAP_TYPE_OR_VALUE_EXISTS ) {
/* value exists already */
snprintf( textbuf, textlen,
"%s: value #%d provided more than once",
ml->sml_desc->ad_cname.bv_val, i );
*text = textbuf;
}
if ( rc )
return rc;
}
} else {
ml->sml_numvals = 0;
}
}
return LDAP_SUCCESS;
}
static int
valsort_cf_func(ConfigArgs *c) {
slap_overinst *on = (slap_overinst *)c->bi;
valsort_info vitmp, *vi;
const char *text = NULL;
int i, is_numeric;
struct berval bv = BER_BVNULL;
if ( c->op == SLAP_CONFIG_EMIT ) {
for ( vi = on->on_bi.bi_private; vi; vi = vi->vi_next ) {
struct berval bv2 = BER_BVNULL, bvret;
char *ptr;
int len;
len = vi->vi_ad->ad_cname.bv_len + 1 + vi->vi_dn.bv_len + 2;
i = vi->vi_sort;
if ( i & VALSORT_WEIGHTED ) {
enum_to_verb( sorts, VALSORT_WEIGHTED, &bv2 );
len += bv2.bv_len + 1;
i ^= VALSORT_WEIGHTED;
}
if ( i ) {
enum_to_verb( sorts, i, &bv );
len += bv.bv_len + 1;
}
bvret.bv_val = ch_malloc( len+1 );
bvret.bv_len = len;
ptr = lutil_strcopy( bvret.bv_val, vi->vi_ad->ad_cname.bv_val );
*ptr++ = ' ';
*ptr++ = '"';
ptr = lutil_strcopy( ptr, vi->vi_dn.bv_val );
*ptr++ = '"';
if ( vi->vi_sort & VALSORT_WEIGHTED ) {
*ptr++ = ' ';
ptr = lutil_strcopy( ptr, bv2.bv_val );
}
if ( i ) {
*ptr++ = ' ';
strcpy( ptr, bv.bv_val );
}
ber_bvarray_add( &c->rvalue_vals, &bvret );
}
i = ( c->rvalue_vals != NULL ) ? 0 : 1;
return i;
} else if ( c->op == LDAP_MOD_DELETE ) {
if ( c->valx < 0 ) {
for ( vi = on->on_bi.bi_private; vi; vi = on->on_bi.bi_private ) {
on->on_bi.bi_private = vi->vi_next;
ch_free( vi->vi_dn.bv_val );
ch_free( vi );
}
} else {
valsort_info **prev;
for (i=0, prev = (valsort_info **)&on->on_bi.bi_private,
vi = *prev; vi && i<c->valx;
prev = &vi->vi_next, vi = vi->vi_next, i++ );
(*prev)->vi_next = vi->vi_next;
ch_free( vi->vi_dn.bv_val );
ch_free( vi );
}
return 0;
}
vitmp.vi_ad = NULL;
i = slap_str2ad( c->argv[1], &vitmp.vi_ad, &text );
if ( i ) {
snprintf( c->cr_msg, sizeof( c->cr_msg), "<%s> %s", c->argv[0], text );
Debug( LDAP_DEBUG_ANY, "%s: %s (%s)!\n",
c->log, c->cr_msg, c->argv[1] );
return(1);
}
if ( is_at_single_value( vitmp.vi_ad->ad_type )) {
snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> %s is single-valued, ignoring", c->argv[0],
vitmp.vi_ad->ad_cname.bv_val );
Debug( LDAP_DEBUG_ANY, "%s: %s (%s)!\n",
c->log, c->cr_msg, c->argv[1] );
return(0);
}
is_numeric = ( vitmp.vi_ad->ad_type->sat_syntax == syn_numericString ||
vitmp.vi_ad->ad_type->sat_syntax == slap_schema.si_syn_integer ) ? 1
: 0;
ber_str2bv( c->argv[2], 0, 0, &bv );
i = dnNormalize( 0, NULL, NULL, &bv, &vitmp.vi_dn, NULL );
if ( i ) {
snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> unable to normalize DN", c->argv[0] );
Debug( LDAP_DEBUG_ANY, "%s: %s (%s)!\n",
c->log, c->cr_msg, c->argv[2] );
return(1);
}
i = verb_to_mask( c->argv[3], sorts );
if ( BER_BVISNULL( &sorts[i].word )) {
snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> unrecognized sort type", c->argv[0] );
Debug( LDAP_DEBUG_ANY, "%s: %s (%s)!\n",
c->log, c->cr_msg, c->argv[3] );
return(1);
}
vitmp.vi_sort = sorts[i].mask;
if ( sorts[i].mask == VALSORT_WEIGHTED && c->argc == 5 ) {
i = verb_to_mask( c->argv[4], sorts );
if ( BER_BVISNULL( &sorts[i].word )) {
snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> unrecognized sort type", c->argv[0] );
Debug( LDAP_DEBUG_ANY, "%s: %s (%s)!\n",
c->log, c->cr_msg, c->argv[4] );
return(1);
}
vitmp.vi_sort |= sorts[i].mask;
}
if (( vitmp.vi_sort & VALSORT_NUMERIC ) && !is_numeric ) {
snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> numeric sort specified for non-numeric syntax",
c->argv[0] );
Debug( LDAP_DEBUG_ANY, "%s: %s (%s)!\n",
c->log, c->cr_msg, c->argv[1] );
return(1);
}
vi = ch_malloc( sizeof(valsort_info) );
*vi = vitmp;
vi->vi_next = on->on_bi.bi_private;
on->on_bi.bi_private = vi;
return 0;
}
static int
entry_naming_check(
Entry *e,
int manage,
int add_naming,
const char** text,
char *textbuf, size_t textlen )
{
/* naming check */
LDAPRDN rdn = NULL;
const char *p = NULL;
ber_len_t cnt;
int rc = LDAP_SUCCESS;
if ( BER_BVISEMPTY( &e->e_name )) {
return LDAP_SUCCESS;
}
/*
* Get attribute type(s) and attribute value(s) of our RDN
*/
if ( ldap_bv2rdn( &e->e_name, &rdn, (char **)&p,
LDAP_DN_FORMAT_LDAP ) )
{
*text = "unrecognized attribute type(s) in RDN";
return LDAP_INVALID_DN_SYNTAX;
}
/* Check that each AVA of the RDN is present in the entry */
/* FIXME: Should also check that each AVA lists a distinct type */
for ( cnt = 0; rdn[cnt]; cnt++ ) {
LDAPAVA *ava = rdn[cnt];
AttributeDescription *desc = NULL;
Attribute *attr;
const char *errtext;
int add = 0;
if( ava->la_flags & LDAP_AVA_BINARY ) {
snprintf( textbuf, textlen,
"value of naming attribute '%s' in unsupported BER form",
ava->la_attr.bv_val );
rc = LDAP_NAMING_VIOLATION;
break;
}
rc = slap_bv2ad( &ava->la_attr, &desc, &errtext );
if ( rc != LDAP_SUCCESS ) {
snprintf( textbuf, textlen, "%s (in RDN)", errtext );
break;
}
if( desc->ad_type->sat_usage ) {
snprintf( textbuf, textlen,
"naming attribute '%s' is operational",
ava->la_attr.bv_val );
rc = LDAP_NAMING_VIOLATION;
break;
}
if( desc->ad_type->sat_collective ) {
snprintf( textbuf, textlen,
"naming attribute '%s' is collective",
ava->la_attr.bv_val );
rc = LDAP_NAMING_VIOLATION;
break;
}
if( !manage && desc->ad_type->sat_obsolete ) {
snprintf( textbuf, textlen,
"naming attribute '%s' is obsolete",
ava->la_attr.bv_val );
rc = LDAP_NAMING_VIOLATION;
break;
}
if( !desc->ad_type->sat_equality ) {
snprintf( textbuf, textlen,
"naming attribute '%s' has no equality matching rule",
ava->la_attr.bv_val );
rc = LDAP_NAMING_VIOLATION;
break;
}
if( !desc->ad_type->sat_equality->smr_match ) {
snprintf( textbuf, textlen,
"naming attribute '%s' has unsupported equality matching rule",
ava->la_attr.bv_val );
rc = LDAP_NAMING_VIOLATION;
break;
}
/* find the naming attribute */
attr = attr_find( e->e_attrs, desc );
if ( attr == NULL ) {
snprintf( textbuf, textlen,
"naming attribute '%s' is not present in entry",
ava->la_attr.bv_val );
if ( add_naming ) {
add = 1;
} else {
rc = LDAP_NAMING_VIOLATION;
}
} else {
rc = attr_valfind( attr, SLAP_MR_VALUE_OF_ASSERTION_SYNTAX|
SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH,
&ava->la_value, NULL, NULL );
if ( rc != 0 ) {
switch( rc ) {
case LDAP_INAPPROPRIATE_MATCHING:
snprintf( textbuf, textlen,
"inappropriate matching for naming attribute '%s'",
ava->la_attr.bv_val );
break;
case LDAP_INVALID_SYNTAX:
snprintf( textbuf, textlen,
"value of naming attribute '%s' is invalid",
ava->la_attr.bv_val );
break;
case LDAP_NO_SUCH_ATTRIBUTE:
if ( add_naming ) {
if ( is_at_single_value( desc->ad_type ) ) {
snprintf( textbuf, textlen,
"value of single-valued naming attribute '%s' conflicts with value present in entry",
ava->la_attr.bv_val );
} else {
add = 1;
rc = LDAP_SUCCESS;
}
} else {
snprintf( textbuf, textlen,
"value of naming attribute '%s' is not present in entry",
ava->la_attr.bv_val );
}
break;
default:
snprintf( textbuf, textlen,
"naming attribute '%s' is inappropriate",
ava->la_attr.bv_val );
}
if ( !add ) {
rc = LDAP_NAMING_VIOLATION;
}
}
}
if ( add ) {
attr_merge_normalize_one( e, desc, &ava->la_value, NULL );
} else if ( rc != LDAP_SUCCESS ) {
break;
}
}
ldap_rdnfree( rdn );
return rc;
}
static int
dynlist_sc_update( Operation *op, SlapReply *rs )
{
Entry *e;
Attribute *a;
int opattrs,
userattrs;
AccessControlState acl_state = ACL_STATE_INIT;
dynlist_sc_t *dlc;
dynlist_map_t *dlm;
if ( rs->sr_type != REP_SEARCH ) {
return 0;
}
dlc = (dynlist_sc_t *)op->o_callback->sc_private;
e = dlc->dlc_e;
assert( e != NULL );
assert( rs->sr_entry != NULL );
/* test access to entry */
if ( !access_allowed( op, rs->sr_entry, slap_schema.si_ad_entry,
NULL, ACL_READ, NULL ) )
{
goto done;
}
/* if there is only one member_ad, and it's not mapped,
* consider it as old-style member listing */
dlm = dlc->dlc_dli->dli_dlm;
if ( dlm && dlm->dlm_mapped_ad == NULL && dlm->dlm_next == NULL ) {
/* if access allowed, try to add values, emulating permissive
* control to silently ignore duplicates */
if ( access_allowed( op, rs->sr_entry, slap_schema.si_ad_entry,
NULL, ACL_READ, NULL ) )
{
Modification mod;
const char *text = NULL;
char textbuf[1024];
struct berval vals[ 2 ], nvals[ 2 ];
vals[ 0 ] = rs->sr_entry->e_name;
BER_BVZERO( &vals[ 1 ] );
nvals[ 0 ] = rs->sr_entry->e_nname;
BER_BVZERO( &nvals[ 1 ] );
mod.sm_op = LDAP_MOD_ADD;
mod.sm_desc = dlm->dlm_member_ad;
mod.sm_type = dlm->dlm_member_ad->ad_cname;
mod.sm_values = vals;
mod.sm_nvalues = nvals;
mod.sm_numvals = 1;
(void)modify_add_values( e, &mod, /* permissive */ 1,
&text, textbuf, sizeof( textbuf ) );
}
goto done;
}
opattrs = SLAP_OPATTRS( rs->sr_attr_flags );
userattrs = SLAP_USERATTRS( rs->sr_attr_flags );
for ( a = rs->sr_entry->e_attrs; a != NULL; a = a->a_next ) {
BerVarray vals, nvals = NULL;
int i, j,
is_oc = a->a_desc == slap_schema.si_ad_objectClass;
/* if attribute is not requested, skip it */
if ( rs->sr_attrs == NULL ) {
if ( is_at_operational( a->a_desc->ad_type ) ) {
continue;
}
} else {
if ( is_at_operational( a->a_desc->ad_type ) ) {
if ( !opattrs && !ad_inlist( a->a_desc, rs->sr_attrs ) )
{
continue;
}
} else {
if ( !userattrs && !ad_inlist( a->a_desc, rs->sr_attrs ) )
{
continue;
}
}
}
/* test access to attribute */
if ( op->ors_attrsonly ) {
if ( !access_allowed( op, rs->sr_entry, a->a_desc, NULL,
ACL_READ, &acl_state ) )
{
continue;
}
}
/* single-value check: keep first only */
if ( is_at_single_value( a->a_desc->ad_type ) ) {
if ( attr_find( e->e_attrs, a->a_desc ) != NULL ) {
continue;
}
}
/* test access to attribute */
i = a->a_numvals;
vals = op->o_tmpalloc( ( i + 1 ) * sizeof( struct berval ), op->o_tmpmemctx );
if ( a->a_nvals != a->a_vals ) {
nvals = op->o_tmpalloc( ( i + 1 ) * sizeof( struct berval ), op->o_tmpmemctx );
}
for ( i = 0, j = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ ) {
if ( is_oc ) {
ObjectClass *soc = oc_bvfind( &a->a_vals[i] );
if ( soc->soc_kind == LDAP_SCHEMA_STRUCTURAL ) {
continue;
}
}
if ( access_allowed( op, rs->sr_entry, a->a_desc,
&a->a_nvals[i], ACL_READ, &acl_state ) )
{
vals[j] = a->a_vals[i];
if ( nvals ) {
nvals[j] = a->a_nvals[i];
}
j++;
}
}
/* if access allowed, try to add values, emulating permissive
* control to silently ignore duplicates */
if ( j != 0 ) {
Modification mod;
const char *text = NULL;
char textbuf[1024];
dynlist_map_t *dlm;
AttributeDescription *ad;
BER_BVZERO( &vals[j] );
if ( nvals ) {
BER_BVZERO( &nvals[j] );
}
ad = a->a_desc;
for ( dlm = dlc->dlc_dli->dli_dlm; dlm; dlm = dlm->dlm_next ) {
if ( dlm->dlm_member_ad == a->a_desc ) {
if ( dlm->dlm_mapped_ad ) {
ad = dlm->dlm_mapped_ad;
}
break;
}
}
mod.sm_op = LDAP_MOD_ADD;
mod.sm_desc = ad;
mod.sm_type = ad->ad_cname;
mod.sm_values = vals;
mod.sm_nvalues = nvals;
mod.sm_numvals = j;
(void)modify_add_values( e, &mod, /* permissive */ 1,
&text, textbuf, sizeof( textbuf ) );
}
op->o_tmpfree( vals, op->o_tmpmemctx );
if ( nvals ) {
op->o_tmpfree( nvals, op->o_tmpmemctx );
}
}
done:;
if ( rs->sr_flags & REP_ENTRY_MUSTBEFREED ) {
entry_free( rs->sr_entry );
rs->sr_entry = NULL;
rs->sr_flags &= ~REP_ENTRY_MASK;
}
return 0;
}
int
entry_schema_check(
Operation *op,
Entry *e,
Attribute *oldattrs,
int manage,
int add,
Attribute **socp,
const char** text,
char *textbuf, size_t textlen )
{
Attribute *a, *asc = NULL, *aoc = NULL;
ObjectClass *sc, *oc, **socs = NULL;
AttributeType *at;
ContentRule *cr;
int rc, i;
AttributeDescription *ad_structuralObjectClass
= slap_schema.si_ad_structuralObjectClass;
AttributeDescription *ad_objectClass
= slap_schema.si_ad_objectClass;
int extensible = 0;
int subentry = is_entry_subentry( e );
int collectiveSubentry = 0;
if ( SLAP_NO_SCHEMA_CHECK( op->o_bd )) {
return LDAP_SUCCESS;
}
if ( get_no_schema_check( op ) ) {
return LDAP_SUCCESS;
}
if( subentry ) {
collectiveSubentry = is_entry_collectiveAttributeSubentry( e );
}
*text = textbuf;
/* misc attribute checks */
for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
const char *type = a->a_desc->ad_cname.bv_val;
/* there should be at least one value */
assert( a->a_vals != NULL );
assert( a->a_vals[0].bv_val != NULL );
if( a->a_desc->ad_type->sat_check ) {
rc = (a->a_desc->ad_type->sat_check)(
op->o_bd, e, a, text, textbuf, textlen );
if( rc != LDAP_SUCCESS ) {
return rc;
}
}
if( a->a_desc == ad_structuralObjectClass )
asc = a;
else if ( a->a_desc == ad_objectClass )
aoc = a;
if( !collectiveSubentry && is_at_collective( a->a_desc->ad_type ) ) {
snprintf( textbuf, textlen,
"'%s' can only appear in collectiveAttributeSubentry",
type );
return LDAP_OBJECT_CLASS_VIOLATION;
}
/* if single value type, check for multiple values */
if( is_at_single_value( a->a_desc->ad_type ) &&
a->a_vals[1].bv_val != NULL )
{
Debug(LDAP_DEBUG_ANY,
"Entry (%s), attribute '%s' cannot have multiple values\n",
e->e_dn, type );
return LDAP_CONSTRAINT_VIOLATION;
}
}
/* check the object class attribute */
if ( aoc == NULL ) {
Debug( LDAP_DEBUG_ANY, "No objectClass for entry (%s)\n",
e->e_dn );
*text = "no objectClass attribute";
return LDAP_OBJECT_CLASS_VIOLATION;
}
assert( aoc->a_vals != NULL );
assert( aoc->a_vals[0].bv_val != NULL );
/* check the structural object class attribute */
if ( asc == NULL && !add ) {
Debug( LDAP_DEBUG_ANY,
"No structuralObjectClass for entry (%s)\n",
e->e_dn );
*text = "no structuralObjectClass operational attribute";
return LDAP_OTHER;
}
rc = structural_class( aoc->a_vals, &oc, &socs, text, textbuf, textlen,
op->o_tmpmemctx );
if( rc != LDAP_SUCCESS ) {
return rc;
}
if ( asc == NULL && add ) {
attr_merge_one( e, ad_structuralObjectClass, &oc->soc_cname, NULL );
asc = attr_find( e->e_attrs, ad_structuralObjectClass );
sc = oc;
goto got_soc;
}
assert( asc->a_vals != NULL );
assert( asc->a_vals[0].bv_val != NULL );
assert( asc->a_vals[1].bv_val == NULL );
sc = oc_bvfind( &asc->a_vals[0] );
if( sc == NULL ) {
Debug(LDAP_DEBUG_ANY,
"entry_check_schema(%s): unrecognized structuralObjectClass '%s'\n",
e->e_dn, asc->a_vals[0].bv_val );
rc = LDAP_OBJECT_CLASS_VIOLATION;
goto done;
}
if( sc->soc_kind != LDAP_SCHEMA_STRUCTURAL ) {
Debug(LDAP_DEBUG_ANY,
"entry_check_schema(%s): structuralObjectClass '%s' is not STRUCTURAL\n",
e->e_dn, asc->a_vals[0].bv_val );
rc = LDAP_OTHER;
goto done;
}
got_soc:
if( !manage && sc->soc_obsolete ) {
Debug(LDAP_DEBUG_ANY,
"entry_check_schema(%s): structuralObjectClass '%s' is OBSOLETE\n",
e->e_dn, asc->a_vals[0].bv_val );
rc = LDAP_OBJECT_CLASS_VIOLATION;
goto done;
}
*text = textbuf;
if ( oc == NULL ) {
snprintf( textbuf, textlen,
"unrecognized objectClass '%s'",
aoc->a_vals[0].bv_val );
rc = LDAP_OBJECT_CLASS_VIOLATION;
goto done;
} else if ( sc != oc ) {
if ( !manage && sc != slap_schema.si_oc_glue ) {
snprintf( textbuf, textlen,
"structural object class modification "
"from '%s' to '%s' not allowed",
asc->a_vals[0].bv_val, oc->soc_cname.bv_val );
rc = LDAP_NO_OBJECT_CLASS_MODS;
goto done;
}
assert( asc->a_vals != NULL );
assert( !BER_BVISNULL( &asc->a_vals[0] ) );
assert( BER_BVISNULL( &asc->a_vals[1] ) );
assert( asc->a_nvals == asc->a_vals );
/* draft-zeilenga-ldap-relax: automatically modify
* structuralObjectClass if changed with relax */
sc = oc;
ber_bvreplace( &asc->a_vals[ 0 ], &sc->soc_cname );
if ( socp ) {
*socp = asc;
}
}
/* naming check */
if ( !is_entry_glue ( e ) ) {
rc = entry_naming_check( e, manage, add, text, textbuf, textlen );
if( rc != LDAP_SUCCESS ) {
goto done;
}
} else {
/* Glue Entry */
}
/* find the content rule for the structural class */
cr = cr_find( sc->soc_oid );
/* the cr must be same as the structural class */
assert( !cr || !strcmp( cr->scr_oid, sc->soc_oid ) );
/* check that the entry has required attrs of the content rule */
if( cr ) {
if( !manage && cr->scr_obsolete ) {
Debug(LDAP_DEBUG_ANY,
"Entry (%s): content rule '%s' is obsolete\n",
e->e_dn, ldap_contentrule2name(&cr->scr_crule) );
rc = LDAP_OBJECT_CLASS_VIOLATION;
goto done;
}
if( cr->scr_required ) for( i=0; cr->scr_required[i]; i++ ) {
at = cr->scr_required[i];
for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
if( a->a_desc->ad_type == at ) {
break;
}
}
/* not there => schema violation */
if ( a == NULL ) {
Debug(LDAP_DEBUG_ANY,
"Entry (%s): content rule '%s' requires attribute '%s'\n",
e->e_dn,
ldap_contentrule2name(&cr->scr_crule),
at->sat_cname.bv_val );
rc = LDAP_OBJECT_CLASS_VIOLATION;
goto done;
}
}
if( cr->scr_precluded ) for( i=0; cr->scr_precluded[i]; i++ ) {
at = cr->scr_precluded[i];
for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
if( a->a_desc->ad_type == at ) {
break;
}
}
/* there => schema violation */
if ( a != NULL ) {
Debug(LDAP_DEBUG_ANY,
"Entry (%s): content rule '%s' precluded attribute '%s'\n",
e->e_dn,
ldap_contentrule2name(&cr->scr_crule),
at->sat_cname.bv_val );
rc = LDAP_OBJECT_CLASS_VIOLATION;
goto done;
}
}
}
/* check that the entry has required attrs for each oc */
for ( i = 0; socs[i]; i++ ) {
oc = socs[i];
if ( !manage && oc->soc_obsolete ) {
/* disallow obsolete classes */
Debug(LDAP_DEBUG_ANY,
"entry_check_schema(%s): objectClass '%s' is OBSOLETE\n",
e->e_dn, aoc->a_vals[i].bv_val );
rc = LDAP_OBJECT_CLASS_VIOLATION;
goto done;
}
if ( oc->soc_check ) {
rc = (oc->soc_check)( op->o_bd, e, oc,
text, textbuf, textlen );
if( rc != LDAP_SUCCESS ) {
goto done;
}
}
if ( oc->soc_kind == LDAP_SCHEMA_ABSTRACT ) {
/* object class is abstract */
if ( oc != slap_schema.si_oc_top &&
!is_object_subclass( oc, sc ))
{
int j;
ObjectClass *xc = NULL;
for( j=0; socs[j]; j++ ) {
if( i != j ) {
xc = socs[j];
/* since we previous check against the
* structural object of this entry, the
* abstract class must be a (direct or indirect)
* superclass of one of the auxiliary classes of
* the entry.
*/
if ( xc->soc_kind == LDAP_SCHEMA_AUXILIARY &&
is_object_subclass( oc, xc ) )
{
xc = NULL;
break;
}
}
}
if( xc != NULL ) {
Debug(LDAP_DEBUG_ANY,
"entry_check_schema(%s): instantiation of " "abstract objectClass '%s' not allowed\n",
e->e_dn, aoc->a_vals[i].bv_val );
rc = LDAP_OBJECT_CLASS_VIOLATION;
goto done;
}
}
} else if ( oc->soc_kind != LDAP_SCHEMA_STRUCTURAL || oc == sc ) {
char *s;
if( oc->soc_kind == LDAP_SCHEMA_AUXILIARY ) {
int k;
if( cr ) {
int j;
k = -1;
if( cr->scr_auxiliaries ) {
for( j = 0; cr->scr_auxiliaries[j]; j++ ) {
if( cr->scr_auxiliaries[j] == oc ) {
k = 0;
break;
}
}
}
if ( k ) {
snprintf( textbuf, textlen,
"class '%s' not allowed by content rule '%s'",
oc->soc_cname.bv_val,
ldap_contentrule2name( &cr->scr_crule ) );
}
} else if ( global_disallows & SLAP_DISALLOW_AUX_WO_CR ) {
k = -1;
snprintf( textbuf, textlen,
"class '%s' not allowed by any content rule",
oc->soc_cname.bv_val );
} else {
k = 0;
}
if( k == -1 ) {
Debug( LDAP_DEBUG_ANY,
"Entry (%s): %s\n",
e->e_dn, textbuf );
rc = LDAP_OBJECT_CLASS_VIOLATION;
goto done;
}
}
s = oc_check_required( e, oc, &aoc->a_vals[i] );
if (s != NULL) {
Debug(LDAP_DEBUG_ANY,
"Entry (%s): object class '%s' requires attribute '%s'\n",
e->e_dn, aoc->a_vals[i].bv_val, s );
rc = LDAP_OBJECT_CLASS_VIOLATION;
goto done;
}
if( oc == slap_schema.si_oc_extensibleObject ) {
extensible=1;
}
}
}
if( extensible ) {
*text = NULL;
rc = LDAP_SUCCESS;
goto done;
}
/* check that each attr in the entry is allowed by some oc */
for ( a = e->e_attrs; a != NULL; a = a->a_next ) {
rc = LDAP_OBJECT_CLASS_VIOLATION;
if( cr && cr->scr_required ) {
for( i=0; cr->scr_required[i]; i++ ) {
if( cr->scr_required[i] == a->a_desc->ad_type ) {
rc = LDAP_SUCCESS;
break;
}
}
}
if( rc != LDAP_SUCCESS && cr && cr->scr_allowed ) {
for( i=0; cr->scr_allowed[i]; i++ ) {
if( cr->scr_allowed[i] == a->a_desc->ad_type ) {
rc = LDAP_SUCCESS;
break;
}
}
}
if( rc != LDAP_SUCCESS )
{
rc = oc_check_allowed( a->a_desc->ad_type, socs, sc );
}
if ( rc != LDAP_SUCCESS ) {
char *type = a->a_desc->ad_cname.bv_val;
Debug(LDAP_DEBUG_ANY,
"Entry (%s), attribute '%s' not allowed\n",
e->e_dn, type );
goto done;
}
}
*text = NULL;
done:
slap_sl_free( socs, op->o_tmpmemctx );
return rc;
}
