1 /*	$NetBSD: schema_prep.c,v 1.3 2021/08/14 16:14:58 christos Exp $	*/
2 
3 /* schema_prep.c - load builtin schema */
4 /* $OpenLDAP$ */
5 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
6  *
7  * Copyright 1998-2021 The OpenLDAP Foundation.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted only as authorized by the OpenLDAP
12  * Public License.
13  *
14  * A copy of this license is available in the file LICENSE in the
15  * top-level directory of the distribution or, alternatively, at
16  * <http://www.OpenLDAP.org/license.html>.
17  */
18 
19 #include <sys/cdefs.h>
20 __RCSID("$NetBSD: schema_prep.c,v 1.3 2021/08/14 16:14:58 christos Exp $");
21 
22 #include "portable.h"
23 
24 #include <stdio.h>
25 
26 #include <ac/ctype.h>
27 #include <ac/string.h>
28 #include <ac/socket.h>
29 
30 #include "slap.h"
31 
32 #define OCDEBUG 0
33 
34 int schema_init_done = 0;
35 
36 struct slap_internal_schema slap_schema;
37 
38 static int
oidValidate(Syntax * syntax,struct berval * in)39 oidValidate(
40 	Syntax *syntax,
41 	struct berval *in )
42 {
43 	struct berval val = *in;
44 
45 	if( val.bv_len == 0 ) {
46 		/* disallow empty strings */
47 		return LDAP_INVALID_SYNTAX;
48 	}
49 
50 	if( DESC_LEADCHAR( val.bv_val[0] ) ) {
51 		val.bv_val++;
52 		val.bv_len--;
53 		if ( val.bv_len == 0 ) return LDAP_SUCCESS;
54 
55 		while( DESC_CHAR( val.bv_val[0] ) ) {
56 			val.bv_val++;
57 			val.bv_len--;
58 
59 			if ( val.bv_len == 0 ) return LDAP_SUCCESS;
60 		}
61 
62 	} else {
63 		int sep = 0;
64 		while( OID_LEADCHAR( val.bv_val[0] ) ) {
65 			val.bv_val++;
66 			val.bv_len--;
67 
68 			if ( val.bv_val[-1] != '0' ) {
69 				while ( OID_LEADCHAR( val.bv_val[0] )) {
70 					val.bv_val++;
71 					val.bv_len--;
72 				}
73 			}
74 
75 			if( val.bv_len == 0 ) {
76 				if( sep == 0 ) break;
77 				return LDAP_SUCCESS;
78 			}
79 
80 			if( !OID_SEPARATOR( val.bv_val[0] )) break;
81 
82 			sep++;
83 			val.bv_val++;
84 			val.bv_len--;
85 		}
86 	}
87 
88 	return LDAP_INVALID_SYNTAX;
89 }
90 
91 
objectClassPretty(Syntax * syntax,struct berval * in,struct berval * out,void * ctx)92 static int objectClassPretty(
93 	Syntax *syntax,
94 	struct berval *in,
95 	struct berval *out,
96 	void *ctx )
97 {
98 	ObjectClass *oc;
99 
100 	if( oidValidate( NULL, in )) return LDAP_INVALID_SYNTAX;
101 
102 	oc = oc_bvfind( in );
103 	if( oc == NULL ) return LDAP_INVALID_SYNTAX;
104 
105 	ber_dupbv_x( out, &oc->soc_cname, ctx );
106 	return LDAP_SUCCESS;
107 }
108 
109 static int
attributeTypeMatch(int * matchp,slap_mask_t flags,Syntax * syntax,MatchingRule * mr,struct berval * value,void * assertedValue)110 attributeTypeMatch(
111 	int *matchp,
112 	slap_mask_t flags,
113 	Syntax *syntax,
114 	MatchingRule *mr,
115 	struct berval *value,
116 	void *assertedValue )
117 {
118 	struct berval *a = (struct berval *) assertedValue;
119 	AttributeType *at = at_bvfind( value );
120 	AttributeType *asserted = at_bvfind( a );
121 
122 	if( asserted == NULL ) {
123 		if( OID_LEADCHAR( *a->bv_val ) ) {
124 			/* OID form, return FALSE */
125 			*matchp = 1;
126 			return LDAP_SUCCESS;
127 		}
128 
129 		/* desc form, return undefined */
130 		return LDAP_INVALID_SYNTAX;
131 	}
132 
133 	if ( at == NULL ) {
134 		/* unrecognized stored value */
135 		return LDAP_INVALID_SYNTAX;
136 	}
137 
138 	*matchp = ( asserted != at );
139 	return LDAP_SUCCESS;
140 }
141 
142 static int
matchingRuleMatch(int * matchp,slap_mask_t flags,Syntax * syntax,MatchingRule * mr,struct berval * value,void * assertedValue)143 matchingRuleMatch(
144 	int *matchp,
145 	slap_mask_t flags,
146 	Syntax *syntax,
147 	MatchingRule *mr,
148 	struct berval *value,
149 	void *assertedValue )
150 {
151 	struct berval *a = (struct berval *) assertedValue;
152 	MatchingRule *mrv = mr_bvfind( value );
153 	MatchingRule *asserted = mr_bvfind( a );
154 
155 	if( asserted == NULL ) {
156 		if( OID_LEADCHAR( *a->bv_val ) ) {
157 			/* OID form, return FALSE */
158 			*matchp = 1;
159 			return LDAP_SUCCESS;
160 		}
161 
162 		/* desc form, return undefined */
163 		return LDAP_INVALID_SYNTAX;
164 	}
165 
166 	if ( mrv == NULL ) {
167 		/* unrecognized stored value */
168 		return LDAP_INVALID_SYNTAX;
169 	}
170 
171 	*matchp = ( asserted != mrv );
172 	return LDAP_SUCCESS;
173 }
174 
175 static int
objectClassMatch(int * matchp,slap_mask_t flags,Syntax * syntax,MatchingRule * mr,struct berval * value,void * assertedValue)176 objectClassMatch(
177 	int *matchp,
178 	slap_mask_t flags,
179 	Syntax *syntax,
180 	MatchingRule *mr,
181 	struct berval *value,
182 	void *assertedValue )
183 {
184 	struct berval *a = (struct berval *) assertedValue;
185 	ObjectClass *oc = oc_bvfind( value );
186 	ObjectClass *asserted = oc_bvfind( a );
187 
188 	if( asserted == NULL ) {
189 		if( OID_LEADCHAR( *a->bv_val ) ) {
190 			/* OID form, return FALSE */
191 			*matchp = 1;
192 			return LDAP_SUCCESS;
193 		}
194 
195 		/* desc form, return undefined */
196 		return LDAP_INVALID_SYNTAX;
197 	}
198 
199 	if ( oc == NULL ) {
200 		/* unrecognized stored value */
201 		return LDAP_INVALID_SYNTAX;
202 	}
203 
204 	*matchp = ( asserted != oc );
205 	return LDAP_SUCCESS;
206 }
207 
208 static int
objectSubClassMatch(int * matchp,slap_mask_t flags,Syntax * syntax,MatchingRule * mr,struct berval * value,void * assertedValue)209 objectSubClassMatch(
210 	int *matchp,
211 	slap_mask_t flags,
212 	Syntax *syntax,
213 	MatchingRule *mr,
214 	struct berval *value,
215 	void *assertedValue )
216 {
217 	struct berval *a = (struct berval *) assertedValue;
218 	ObjectClass *oc = oc_bvfind( value );
219 	ObjectClass *asserted = oc_bvfind( a );
220 
221 	if( asserted == NULL ) {
222 		if( OID_LEADCHAR( *a->bv_val ) ) {
223 			/* OID form, return FALSE */
224 			*matchp = 1;
225 			return LDAP_SUCCESS;
226 		}
227 
228 		/* desc form, return undefined */
229 		return LDAP_INVALID_SYNTAX;
230 	}
231 
232 	if ( oc == NULL ) {
233 		/* unrecognized stored value */
234 		return LDAP_INVALID_SYNTAX;
235 	}
236 
237 	if( SLAP_MR_IS_VALUE_OF_ATTRIBUTE_SYNTAX( flags ) ) {
238 		*matchp = ( asserted != oc );
239 	} else {
240 		*matchp = !is_object_subclass( asserted, oc );
241 	}
242 
243 	return LDAP_SUCCESS;
244 }
245 
objectSubClassIndexer(slap_mask_t use,slap_mask_t mask,Syntax * syntax,MatchingRule * mr,struct berval * prefix,BerVarray values,BerVarray * keysp,void * ctx)246 static int objectSubClassIndexer(
247 	slap_mask_t use,
248 	slap_mask_t mask,
249 	Syntax *syntax,
250 	MatchingRule *mr,
251 	struct berval *prefix,
252 	BerVarray values,
253 	BerVarray *keysp,
254 	void *ctx )
255 {
256 	int rc, noc, i;
257 	BerVarray ocvalues;
258 	ObjectClass **socs;
259 
260 	for( noc=0; values[noc].bv_val != NULL; noc++ ) {
261 		/* just count em */;
262 	}
263 
264 	/* over allocate */
265 	socs = slap_sl_malloc( (noc+16) * sizeof( ObjectClass * ), ctx );
266 
267 	/* initialize */
268 	for( i=0; i<noc; i++ ) {
269 		socs[i] = oc_bvfind( &values[i] );
270 	}
271 
272 	/* expand values */
273 	for( i=0; i<noc; i++ ) {
274 		int j;
275 		ObjectClass *oc = socs[i];
276 		if( oc == NULL || oc->soc_sups == NULL ) continue;
277 
278 		for( j=0; oc->soc_sups[j] != NULL; j++ ) {
279 			int found = 0;
280 			ObjectClass *sup = oc->soc_sups[j];
281 			int k;
282 
283 			for( k=0; k<noc; k++ ) {
284 				if( sup == socs[k] ) {
285 					found++;
286 					break;
287 				}
288 			}
289 
290 			if( !found ) {
291 				socs = slap_sl_realloc( socs,
292 					sizeof( ObjectClass * ) * (noc+2), ctx );
293 
294 				assert( k == noc );
295 				socs[noc++] = sup;
296 			}
297 		}
298 	}
299 
300 	ocvalues = slap_sl_malloc( sizeof( struct berval ) * (noc+1), ctx );
301 	/* copy values */
302 	for( i=0; i<noc; i++ ) {
303 		if ( socs[i] )
304 			ocvalues[i] = socs[i]->soc_cname;
305 		else
306 			ocvalues[i] = values[i];
307 	}
308 	BER_BVZERO( &ocvalues[i] );
309 
310 	rc = octetStringIndexer( use, mask, syntax, mr,
311 		prefix, ocvalues, keysp, ctx );
312 
313 	slap_sl_free( ocvalues, ctx );
314 	slap_sl_free( socs, ctx );
315 	return rc;
316 }
317 
318 #define objectSubClassFilter octetStringFilter
319 
320 static ObjectClassSchemaCheckFN rootDseObjectClass;
321 static ObjectClassSchemaCheckFN aliasObjectClass;
322 static ObjectClassSchemaCheckFN referralObjectClass;
323 static ObjectClassSchemaCheckFN subentryObjectClass;
324 #ifdef LDAP_DYNAMIC_OBJECTS
325 static ObjectClassSchemaCheckFN dynamicObjectClass;
326 #endif
327 
328 static struct slap_schema_oc_map {
329 	char *ssom_name;
330 	char *ssom_defn;
331 	ObjectClassSchemaCheckFN *ssom_check;
332 	slap_mask_t ssom_flags;
333 	size_t ssom_offset;
334 } oc_map[] = {
335 	{ "top", "( 2.5.6.0 NAME 'top' "
336 			"DESC 'top of the superclass chain' "
337 			"ABSTRACT MUST objectClass )",
338 		0, 0, offsetof(struct slap_internal_schema, si_oc_top) },
339 	{ "extensibleObject", "( 1.3.6.1.4.1.1466.101.120.111 "
340 			"NAME 'extensibleObject' "
341 			"DESC 'RFC4512: extensible object' "
342 			"SUP top AUXILIARY )",
343 		0, SLAP_OC_OPERATIONAL,
344 		offsetof(struct slap_internal_schema, si_oc_extensibleObject) },
345 	{ "alias", "( 2.5.6.1 NAME 'alias' "
346 			"DESC 'RFC4512: an alias' "
347 			"SUP top STRUCTURAL "
348 			"MUST aliasedObjectName )",
349 		aliasObjectClass, SLAP_OC_ALIAS|SLAP_OC_OPERATIONAL,
350 		offsetof(struct slap_internal_schema, si_oc_alias) },
351 	{ "referral", "( 2.16.840.1.113730.3.2.6 NAME 'referral' "
352 			"DESC 'namedref: named subordinate referral' "
353 			"SUP top STRUCTURAL MUST ref )",
354 		referralObjectClass, SLAP_OC_REFERRAL|SLAP_OC_OPERATIONAL,
355 		offsetof(struct slap_internal_schema, si_oc_referral) },
356 	{ "LDAProotDSE", "( 1.3.6.1.4.1.4203.1.4.1 "
357 			"NAME ( 'OpenLDAProotDSE' 'LDAProotDSE' ) "
358 			"DESC 'OpenLDAP Root DSE object' "
359 			"SUP top STRUCTURAL MAY cn )",
360 		rootDseObjectClass, SLAP_OC_OPERATIONAL,
361 		offsetof(struct slap_internal_schema, si_oc_rootdse) },
362 	{ "subentry", "( 2.5.17.0 NAME 'subentry' "
363 			"DESC 'RFC3672: subentry' "
364 			"SUP top STRUCTURAL "
365 			"MUST ( cn $ subtreeSpecification ) )",
366 		subentryObjectClass, SLAP_OC_SUBENTRY|SLAP_OC_OPERATIONAL,
367 		offsetof(struct slap_internal_schema, si_oc_subentry) },
368 	{ "subschema", "( 2.5.20.1 NAME 'subschema' "
369 		"DESC 'RFC4512: controlling subschema (sub)entry' "
370 		"AUXILIARY "
371 		"MAY ( dITStructureRules $ nameForms $ dITContentRules $ "
372 			"objectClasses $ attributeTypes $ matchingRules $ "
373 			"matchingRuleUse ) )",
374 		subentryObjectClass, SLAP_OC_OPERATIONAL,
375 		offsetof(struct slap_internal_schema, si_oc_subschema) },
376 #ifdef LDAP_COLLECTIVE_ATTRIBUTES
377 	{ "collectiveAttributeSubentry", "( 2.5.17.2 "
378 			"NAME 'collectiveAttributeSubentry' "
379 			"DESC 'RFC3671: collective attribute subentry' "
380 			"AUXILIARY )",
381 		subentryObjectClass,
382 		SLAP_OC_COLLECTIVEATTRIBUTESUBENTRY|SLAP_OC_OPERATIONAL|SLAP_OC_HIDE,
383 		offsetof( struct slap_internal_schema,
384 			si_oc_collectiveAttributeSubentry) },
385 #endif
386 #ifdef LDAP_DYNAMIC_OBJECTS
387 	{ "dynamicObject", "( 1.3.6.1.4.1.1466.101.119.2 "
388 			"NAME 'dynamicObject' "
389 			"DESC 'RFC2589: Dynamic Object' "
390 			"SUP top AUXILIARY )",
391 		dynamicObjectClass, SLAP_OC_DYNAMICOBJECT,
392 		offsetof(struct slap_internal_schema, si_oc_dynamicObject) },
393 #endif
394 	{ "glue", "( 1.3.6.1.4.1.4203.666.3.4 "
395 			"NAME 'glue' "
396 			"DESC 'Glue Entry' "
397 			"SUP top STRUCTURAL )",
398 		0, SLAP_OC_GLUE|SLAP_OC_OPERATIONAL|SLAP_OC_HIDE,
399 		offsetof(struct slap_internal_schema, si_oc_glue) },
400 	{ "syncConsumerSubentry", "( 1.3.6.1.4.1.4203.666.3.5 "
401 			"NAME 'syncConsumerSubentry' "
402 			"DESC 'Persistent Info for SyncRepl Consumer' "
403 			"AUXILIARY "
404 			"MAY syncreplCookie )",
405 		0, SLAP_OC_SYNCCONSUMERSUBENTRY|SLAP_OC_OPERATIONAL|SLAP_OC_HIDE,
406 		offsetof(struct slap_internal_schema, si_oc_syncConsumerSubentry) },
407 	{ "syncProviderSubentry", "( 1.3.6.1.4.1.4203.666.3.6 "
408 			"NAME 'syncProviderSubentry' "
409 			"DESC 'Persistent Info for SyncRepl Producer' "
410 			"AUXILIARY "
411 			"MAY contextCSN )",
412 		0, SLAP_OC_SYNCPROVIDERSUBENTRY|SLAP_OC_OPERATIONAL|SLAP_OC_HIDE,
413 		offsetof(struct slap_internal_schema, si_oc_syncProviderSubentry) },
414 
415 	{ NULL, NULL, NULL, 0, 0 }
416 };
417 
418 static AttributeTypeSchemaCheckFN rootDseAttribute;
419 static AttributeTypeSchemaCheckFN aliasAttribute;
420 static AttributeTypeSchemaCheckFN referralAttribute;
421 static AttributeTypeSchemaCheckFN subentryAttribute;
422 static AttributeTypeSchemaCheckFN administrativeRoleAttribute;
423 #ifdef LDAP_DYNAMIC_OBJECTS
424 static AttributeTypeSchemaCheckFN dynamicAttribute;
425 #endif
426 
427 static struct slap_schema_ad_map {
428 	char *ssam_name;
429 	char *ssam_defn;
430 	AttributeTypeSchemaCheckFN *ssam_check;
431 	slap_mask_t ssam_flags;
432 	slap_syntax_validate_func *ssam_syn_validate;
433 	slap_syntax_transform_func *ssam_syn_pretty;
434 	slap_mr_convert_func *ssam_mr_convert;
435 	slap_mr_normalize_func *ssam_mr_normalize;
436 	slap_mr_match_func *ssam_mr_match;
437 	slap_mr_indexer_func *ssam_mr_indexer;
438 	slap_mr_filter_func *ssam_mr_filter;
439 	size_t ssam_offset;
440 } ad_map[] = {
441 	{ "objectClass", "( 2.5.4.0 NAME 'objectClass' "
442 			"DESC 'RFC4512: object classes of the entity' "
443 			"EQUALITY objectIdentifierMatch "
444 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )",
445 		NULL, SLAP_AT_FINAL,
446 		oidValidate, objectClassPretty,
447 		NULL, NULL, objectSubClassMatch,
448 			objectSubClassIndexer, objectSubClassFilter,
449 		offsetof(struct slap_internal_schema, si_ad_objectClass) },
450 
451 	/* user entry operational attributes */
452 	{ "structuralObjectClass", "( 2.5.21.9 NAME 'structuralObjectClass' "
453 			"DESC 'RFC4512: structural object class of entry' "
454 			"EQUALITY objectIdentifierMatch "
455 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 "
456 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
457 		NULL, 0,
458 		oidValidate, objectClassPretty,
459 		NULL, NULL, objectSubClassMatch,
460 			objectSubClassIndexer, objectSubClassFilter,
461 		offsetof(struct slap_internal_schema, si_ad_structuralObjectClass) },
462 	{ "createTimestamp", "( 2.5.18.1 NAME 'createTimestamp' "
463 			"DESC 'RFC4512: time which object was created' "
464 			"EQUALITY generalizedTimeMatch "
465 			"ORDERING generalizedTimeOrderingMatch "
466 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
467 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
468 		NULL, SLAP_AT_MANAGEABLE,
469 		NULL, NULL,
470 		NULL, NULL, NULL, NULL, NULL,
471 		offsetof(struct slap_internal_schema, si_ad_createTimestamp) },
472 	{ "modifyTimestamp", "( 2.5.18.2 NAME 'modifyTimestamp' "
473 			"DESC 'RFC4512: time which object was last modified' "
474 			"EQUALITY generalizedTimeMatch "
475 			"ORDERING generalizedTimeOrderingMatch "
476 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
477 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
478 		NULL, SLAP_AT_MANAGEABLE,
479 		NULL, NULL,
480 		NULL, NULL, NULL, NULL, NULL,
481 		offsetof(struct slap_internal_schema, si_ad_modifyTimestamp) },
482 	{ "creatorsName", "( 2.5.18.3 NAME 'creatorsName' "
483 			"DESC 'RFC4512: name of creator' "
484 			"EQUALITY distinguishedNameMatch "
485 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
486 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
487 		NULL, SLAP_AT_MANAGEABLE,
488 		NULL, NULL,
489 		NULL, NULL, NULL, NULL, NULL,
490 		offsetof(struct slap_internal_schema, si_ad_creatorsName) },
491 	{ "modifiersName", "( 2.5.18.4 NAME 'modifiersName' "
492 			"DESC 'RFC4512: name of last modifier' "
493 			"EQUALITY distinguishedNameMatch "
494 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
495 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
496 		NULL, SLAP_AT_MANAGEABLE,
497 		NULL, NULL,
498 		NULL, NULL, NULL, NULL, NULL,
499 		offsetof(struct slap_internal_schema, si_ad_modifiersName) },
500 	{ "hasSubordinates", "( 2.5.18.9 NAME 'hasSubordinates' "
501 			"DESC 'X.501: entry has children' "
502 			"EQUALITY booleanMatch "
503 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 "
504 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
505 		NULL, SLAP_AT_DYNAMIC,
506 		NULL, NULL,
507 		NULL, NULL, NULL, NULL, NULL,
508 		offsetof(struct slap_internal_schema, si_ad_hasSubordinates) },
509 	{ "subschemaSubentry", "( 2.5.18.10 NAME 'subschemaSubentry' "
510 			"DESC 'RFC4512: name of controlling subschema entry' "
511 			"EQUALITY distinguishedNameMatch "
512 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE "
513 			"NO-USER-MODIFICATION USAGE directoryOperation )",
514 		NULL, SLAP_AT_DYNAMIC,
515 		NULL, NULL,
516 		NULL, NULL, NULL, NULL, NULL,
517 		offsetof(struct slap_internal_schema, si_ad_subschemaSubentry) },
518 #ifdef LDAP_COLLECTIVE_ATTRIBUTES
519 	{ "collectiveAttributeSubentries", "( 2.5.18.12 "
520 			"NAME 'collectiveAttributeSubentries' "
521 			"DESC 'RFC3671: collective attribute subentries' "
522 			"EQUALITY distinguishedNameMatch "
523 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
524 			"NO-USER-MODIFICATION USAGE directoryOperation )",
525 		NULL, SLAP_AT_HIDE,
526 		NULL, NULL,
527 		NULL, NULL, NULL, NULL, NULL,
528 		offsetof(struct slap_internal_schema, si_ad_collectiveSubentries) },
529 	{ "collectiveExclusions", "( 2.5.18.7 NAME 'collectiveExclusions' "
530 			"DESC 'RFC3671: collective attribute exclusions' "
531 			"EQUALITY objectIdentifierMatch "
532 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 "
533 			"USAGE directoryOperation )",
534 		NULL, SLAP_AT_HIDE,
535 		NULL, NULL,
536 		NULL, NULL, NULL, NULL, NULL,
537 		offsetof(struct slap_internal_schema, si_ad_collectiveExclusions) },
538 #endif
539 
540 	{ "entryDN", "( 1.3.6.1.1.20 NAME 'entryDN' "
541 			"DESC 'DN of the entry' "
542 			"EQUALITY distinguishedNameMatch "
543 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
544 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
545 		NULL, SLAP_AT_DYNAMIC,
546 		NULL, NULL,
547 		NULL, NULL, NULL, NULL, NULL,
548 		offsetof(struct slap_internal_schema, si_ad_entryDN) },
549 	{ "entryUUID", "( 1.3.6.1.1.16.4 NAME 'entryUUID' "
550 			"DESC 'UUID of the entry' "
551 			"EQUALITY UUIDMatch "
552 			"ORDERING UUIDOrderingMatch "
553 			"SYNTAX 1.3.6.1.1.16.1 "
554 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
555 		NULL, SLAP_AT_MANAGEABLE,
556 		NULL, NULL,
557 		NULL, NULL, NULL, NULL, NULL,
558 		offsetof(struct slap_internal_schema, si_ad_entryUUID) },
559 	{ "entryCSN", "( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' "
560 			"DESC 'change sequence number of the entry content' "
561 			"EQUALITY CSNMatch "
562 			"ORDERING CSNOrderingMatch "
563 			"SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} "
564 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
565 		NULL, 0,
566 		NULL, NULL,
567 		NULL, NULL, NULL, NULL, NULL,
568 		offsetof(struct slap_internal_schema, si_ad_entryCSN) },
569 	{ "namingCSN", "( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' "
570 			"DESC 'change sequence number of the entry naming (RDN)' "
571 			"EQUALITY CSNMatch "
572 			"ORDERING CSNOrderingMatch "
573 			"SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} "
574 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
575 		NULL, SLAP_AT_HIDE,
576 		NULL, NULL,
577 		NULL, NULL, NULL, NULL, NULL,
578 		offsetof(struct slap_internal_schema, si_ad_namingCSN) },
579 
580 #ifdef LDAP_SUPERIOR_UUID
581 	{ "superiorUUID", "( 1.3.6.1.4.1.4203.666.1.11 NAME 'superiorUUID' "
582 			"DESC 'UUID of the superior entry' "
583 			"EQUALITY UUIDMatch "
584 			"ORDERING UUIDOrderingMatch "
585 			"SYNTAX 1.3.6.1.1.16.1 "
586 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
587 		NULL, SLAP_AT_HIDE,
588 		NULL, NULL,
589 		NULL, NULL, NULL, NULL, NULL,
590 		offsetof(struct slap_internal_schema, si_ad_superiorUUID) },
591 #endif
592 
593 	{ "syncreplCookie", "( 1.3.6.1.4.1.4203.666.1.23 "
594 			"NAME 'syncreplCookie' "
595 			"DESC 'syncrepl Cookie for shadow copy' "
596 			"EQUALITY octetStringMatch "
597 			"ORDERING octetStringOrderingMatch "
598 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 "
599 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )",
600 		NULL, SLAP_AT_HIDE,
601 		NULL, NULL,
602 		NULL, NULL, NULL, NULL, NULL,
603 		offsetof(struct slap_internal_schema, si_ad_syncreplCookie) },
604 
605 	{ "contextCSN", "( 1.3.6.1.4.1.4203.666.1.25 "
606 			"NAME 'contextCSN' "
607 			"DESC 'the largest committed CSN of a context' "
608 			"EQUALITY CSNMatch "
609 			"ORDERING CSNOrderingMatch "
610 			"SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} "
611 			"NO-USER-MODIFICATION USAGE dSAOperation )",
612 		NULL, 0,
613 		NULL, NULL,
614 		NULL, NULL, NULL, NULL, NULL,
615 		offsetof(struct slap_internal_schema, si_ad_contextCSN) },
616 
617 #ifdef LDAP_SYNC_TIMESTAMP
618 	{ "syncTimestamp", "( 1.3.6.1.4.1.4203.666.1.26 NAME 'syncTimestamp' "
619 			"DESC 'Time which object was replicated' "
620 			"EQUALITY generalizedTimeMatch "
621 			"ORDERING generalizedTimeOrderingMatch "
622 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
623 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )",
624 		NULL, 0,
625 		NULL, NULL,
626 		NULL, NULL, NULL, NULL, NULL,
627 		offsetof(struct slap_internal_schema, si_ad_syncTimestamp) },
628 #endif
629 
630 	/* root DSE attributes */
631 	{ "altServer", "( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' "
632 			"DESC 'RFC4512: alternative servers' "
633 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 USAGE dSAOperation )",
634 		rootDseAttribute, 0,
635 		NULL, NULL,
636 		NULL, NULL, NULL, NULL, NULL,
637 		offsetof(struct slap_internal_schema, si_ad_altServer) },
638 	{ "namingContexts", "( 1.3.6.1.4.1.1466.101.120.5 "
639 			"NAME 'namingContexts' "
640 			"DESC 'RFC4512: naming contexts' "
641 			"EQUALITY distinguishedNameMatch "
642 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 USAGE dSAOperation )",
643 		rootDseAttribute, 0,
644 		NULL, NULL,
645 		NULL, NULL, NULL, NULL, NULL,
646 		offsetof(struct slap_internal_schema, si_ad_namingContexts) },
647 	{ "supportedControl", "( 1.3.6.1.4.1.1466.101.120.13 "
648 			"NAME 'supportedControl' "
649 			"DESC 'RFC4512: supported controls' "
650 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation )",
651 		rootDseAttribute, 0,
652 		NULL, NULL,
653 		NULL, NULL, NULL, NULL, NULL,
654 		offsetof(struct slap_internal_schema, si_ad_supportedControl) },
655 	{ "supportedExtension", "( 1.3.6.1.4.1.1466.101.120.7 "
656 			"NAME 'supportedExtension' "
657 			"DESC 'RFC4512: supported extended operations' "
658 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation )",
659 		rootDseAttribute, 0,
660 		NULL, NULL,
661 		NULL, NULL, NULL, NULL, NULL,
662 		offsetof(struct slap_internal_schema, si_ad_supportedExtension) },
663 	{ "supportedLDAPVersion", "( 1.3.6.1.4.1.1466.101.120.15 "
664 			"NAME 'supportedLDAPVersion' "
665 			"DESC 'RFC4512: supported LDAP versions' "
666 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 USAGE dSAOperation )",
667 		rootDseAttribute, 0,
668 		NULL, NULL,
669 		NULL, NULL, NULL, NULL, NULL,
670 		offsetof(struct slap_internal_schema, si_ad_supportedLDAPVersion) },
671 	{ "supportedSASLMechanisms", "( 1.3.6.1.4.1.1466.101.120.14 "
672 			"NAME 'supportedSASLMechanisms' "
673 			"DESC 'RFC4512: supported SASL mechanisms'"
674 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation )",
675 		rootDseAttribute, 0,
676 		NULL, NULL,
677 		NULL, NULL, NULL, NULL, NULL,
678 		offsetof(struct slap_internal_schema, si_ad_supportedSASLMechanisms) },
679 	{ "supportedFeatures", "( 1.3.6.1.4.1.4203.1.3.5 "
680 			"NAME 'supportedFeatures' "
681 			"DESC 'RFC4512: features supported by the server' "
682 			"EQUALITY objectIdentifierMatch "
683 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 "
684 			"USAGE dSAOperation )",
685 		rootDseAttribute, 0,
686 		NULL, NULL,
687 		NULL, NULL, NULL, NULL, NULL,
688 		offsetof(struct slap_internal_schema, si_ad_supportedFeatures) },
689 	{ "monitorContext", "( 1.3.6.1.4.1.4203.666.1.10 "
690 			"NAME 'monitorContext' "
691 			"DESC 'monitor context' "
692 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
693 			"EQUALITY distinguishedNameMatch "
694 			"SINGLE-VALUE NO-USER-MODIFICATION "
695 			"USAGE dSAOperation )",
696 		rootDseAttribute, SLAP_AT_HIDE,
697 		NULL, NULL,
698 		NULL, NULL, NULL, NULL, NULL,
699 		offsetof(struct slap_internal_schema, si_ad_monitorContext) },
700 	{ "configContext", "( 1.3.6.1.4.1.4203.1.12.2.1 "
701 			"NAME 'configContext' "
702 			"DESC 'config context' "
703 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
704 			"EQUALITY distinguishedNameMatch "
705 			"SINGLE-VALUE NO-USER-MODIFICATION "
706 			"USAGE dSAOperation )",
707 		rootDseAttribute, SLAP_AT_HIDE,
708 		NULL, NULL,
709 		NULL, NULL, NULL, NULL, NULL,
710 		offsetof(struct slap_internal_schema, si_ad_configContext) },
711 	{ "vendorName", "( 1.3.6.1.1.4 NAME 'vendorName' "
712 			"DESC 'RFC3045: name of implementation vendor' "
713 			"EQUALITY caseExactMatch "
714 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 "
715 			"SINGLE-VALUE NO-USER-MODIFICATION "
716 			"USAGE dSAOperation )",
717 		rootDseAttribute, 0,
718 		NULL, NULL,
719 		NULL, NULL, NULL, NULL, NULL,
720 		offsetof(struct slap_internal_schema, si_ad_vendorName) },
721 	{ "vendorVersion", "( 1.3.6.1.1.5 NAME 'vendorVersion' "
722 			"DESC 'RFC3045: version of implementation' "
723 			"EQUALITY caseExactMatch "
724 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 "
725 			"SINGLE-VALUE NO-USER-MODIFICATION "
726 			"USAGE dSAOperation )",
727 		rootDseAttribute, 0,
728 		NULL, NULL,
729 		NULL, NULL, NULL, NULL, NULL,
730 		offsetof(struct slap_internal_schema, si_ad_vendorVersion) },
731 
732 	/* subentry attributes */
733 	{ "administrativeRole", "( 2.5.18.5 NAME 'administrativeRole' "
734 			"DESC 'RFC3672: administrative role' "
735 			"EQUALITY objectIdentifierMatch "
736 			"USAGE directoryOperation "
737 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )",
738 		administrativeRoleAttribute, SLAP_AT_HIDE,
739 		NULL, NULL,
740 		NULL, NULL, NULL, NULL, NULL,
741 		offsetof(struct slap_internal_schema, si_ad_administrativeRole) },
742 	{ "subtreeSpecification", "( 2.5.18.6 NAME 'subtreeSpecification' "
743 			"DESC 'RFC3672: subtree specification' "
744 			"SINGLE-VALUE "
745 			"USAGE directoryOperation "
746 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.45 )",
747 		subentryAttribute, SLAP_AT_HIDE,
748 		NULL, NULL,
749 		NULL, NULL, NULL, NULL, NULL,
750 		offsetof(struct slap_internal_schema, si_ad_subtreeSpecification) },
751 
752 	/* subschema subentry attributes */
753 	{ "dITStructureRules", "( 2.5.21.1 NAME 'dITStructureRules' "
754 			"DESC 'RFC4512: DIT structure rules' "
755 			"EQUALITY integerFirstComponentMatch "
756 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.17 "
757 			"USAGE directoryOperation ) ",
758 		subentryAttribute, SLAP_AT_HIDE,
759 		NULL, NULL,
760 		NULL, NULL, NULL, NULL, NULL,
761 		offsetof(struct slap_internal_schema, si_ad_ditStructureRules) },
762 	{ "dITContentRules", "( 2.5.21.2 NAME 'dITContentRules' "
763 			"DESC 'RFC4512: DIT content rules' "
764 			"EQUALITY objectIdentifierFirstComponentMatch "
765 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.16 USAGE directoryOperation )",
766 		subentryAttribute, SLAP_AT_HIDE,
767 		oidValidate, NULL,
768 		NULL, NULL, objectClassMatch, NULL, NULL,
769 		offsetof(struct slap_internal_schema, si_ad_ditContentRules) },
770 	{ "matchingRules", "( 2.5.21.4 NAME 'matchingRules' "
771 			"DESC 'RFC4512: matching rules' "
772 			"EQUALITY objectIdentifierFirstComponentMatch "
773 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.30 USAGE directoryOperation )",
774 		subentryAttribute, 0,
775 		oidValidate, NULL,
776 		NULL, NULL, matchingRuleMatch, NULL, NULL,
777 		offsetof(struct slap_internal_schema, si_ad_matchingRules) },
778 	{ "attributeTypes", "( 2.5.21.5 NAME 'attributeTypes' "
779 			"DESC 'RFC4512: attribute types' "
780 			"EQUALITY objectIdentifierFirstComponentMatch "
781 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.3 USAGE directoryOperation )",
782 		subentryAttribute, 0,
783 		oidValidate, NULL,
784 		NULL, NULL, attributeTypeMatch, NULL, NULL,
785 		offsetof(struct slap_internal_schema, si_ad_attributeTypes) },
786 	{ "objectClasses", "( 2.5.21.6 NAME 'objectClasses' "
787 			"DESC 'RFC4512: object classes' "
788 			"EQUALITY objectIdentifierFirstComponentMatch "
789 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.37 USAGE directoryOperation )",
790 		subentryAttribute, 0,
791 		oidValidate, NULL,
792 		NULL, NULL, objectClassMatch, NULL, NULL,
793 		offsetof(struct slap_internal_schema, si_ad_objectClasses) },
794 	{ "nameForms", "( 2.5.21.7 NAME 'nameForms' "
795 			"DESC 'RFC4512: name forms ' "
796 			"EQUALITY objectIdentifierFirstComponentMatch "
797 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.35 USAGE directoryOperation )",
798 		subentryAttribute, SLAP_AT_HIDE,
799 		NULL, NULL,
800 		NULL, NULL, NULL, NULL, NULL,
801 		offsetof(struct slap_internal_schema, si_ad_nameForms) },
802 	{ "matchingRuleUse", "( 2.5.21.8 NAME 'matchingRuleUse' "
803 			"DESC 'RFC4512: matching rule uses' "
804 			"EQUALITY objectIdentifierFirstComponentMatch "
805 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.31 USAGE directoryOperation )",
806 		subentryAttribute, 0,
807 		oidValidate, NULL,
808 		NULL, NULL, matchingRuleMatch, NULL, NULL,
809 		offsetof(struct slap_internal_schema, si_ad_matchingRuleUse) },
810 
811 	{ "ldapSyntaxes", "( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' "
812 			"DESC 'RFC4512: LDAP syntaxes' "
813 			"EQUALITY objectIdentifierFirstComponentMatch "
814 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.54 USAGE directoryOperation )",
815 		subentryAttribute, 0,
816 		NULL, NULL,
817 		NULL, NULL, NULL, NULL, NULL,
818 		offsetof(struct slap_internal_schema, si_ad_ldapSyntaxes) },
819 
820 	/* knowledge information */
821 	{ "aliasedObjectName", "( 2.5.4.1 "
822 			"NAME ( 'aliasedObjectName' 'aliasedEntryName' ) "
823 			"DESC 'RFC4512: name of aliased object' "
824 			"EQUALITY distinguishedNameMatch "
825 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )",
826 		aliasAttribute, SLAP_AT_FINAL,
827 		NULL, NULL,
828 		NULL, NULL, NULL, NULL, NULL,
829 		offsetof(struct slap_internal_schema, si_ad_aliasedObjectName) },
830 	{ "ref", "( 2.16.840.1.113730.3.1.34 NAME 'ref' "
831 			"DESC 'RFC3296: subordinate referral URL' "
832 			"EQUALITY caseExactMatch "
833 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 "
834 			"USAGE distributedOperation )",
835 		referralAttribute, 0,
836 		NULL, NULL,
837 		NULL, NULL, NULL, NULL, NULL,
838 		offsetof(struct slap_internal_schema, si_ad_ref) },
839 
840 	/* access control internals */
841 	{ "entry", "( 1.3.6.1.4.1.4203.1.3.1 "
842 			"NAME 'entry' "
843 			"DESC 'OpenLDAP ACL entry pseudo-attribute' "
844 			"SYNTAX 1.3.6.1.4.1.4203.1.1.1 "
845 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )",
846 		NULL, SLAP_AT_HIDE,
847 		NULL, NULL,
848 		NULL, NULL, NULL, NULL, NULL,
849 		offsetof(struct slap_internal_schema, si_ad_entry) },
850 	{ "children", "( 1.3.6.1.4.1.4203.1.3.2 "
851 			"NAME 'children' "
852 			"DESC 'OpenLDAP ACL children pseudo-attribute' "
853 			"SYNTAX 1.3.6.1.4.1.4203.1.1.1 "
854 			"SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )",
855 		NULL, SLAP_AT_HIDE,
856 		NULL, NULL,
857 		NULL, NULL, NULL, NULL, NULL,
858 		offsetof(struct slap_internal_schema, si_ad_children) },
859 
860 	/* access control externals */
861 	{ "authzTo", "( 1.3.6.1.4.1.4203.666.1.8 "
862 			"NAME ( 'authzTo' 'saslAuthzTo' ) "
863 			"DESC 'proxy authorization targets' "
864 			"EQUALITY authzMatch "
865 			"SYNTAX 1.3.6.1.4.1.4203.666.2.7 "
866 			"X-ORDERED 'VALUES' "
867 			"USAGE distributedOperation )",
868 		NULL, SLAP_AT_HIDE,
869 		NULL, NULL,
870 		NULL, NULL, NULL, NULL, NULL,
871 		offsetof(struct slap_internal_schema, si_ad_saslAuthzTo) },
872 	{ "authzFrom", "( 1.3.6.1.4.1.4203.666.1.9 "
873 			"NAME ( 'authzFrom' 'saslAuthzFrom' ) "
874 			"DESC 'proxy authorization sources' "
875 			"EQUALITY authzMatch "
876 			"SYNTAX 1.3.6.1.4.1.4203.666.2.7 "
877 			"X-ORDERED 'VALUES' "
878 			"USAGE distributedOperation )",
879 		NULL, SLAP_AT_HIDE,
880 		NULL, NULL,
881 		NULL, NULL, NULL, NULL, NULL,
882 		offsetof(struct slap_internal_schema, si_ad_saslAuthzFrom) },
883 
884 #ifdef LDAP_DYNAMIC_OBJECTS
885 	{ "entryTtl", "( 1.3.6.1.4.1.1466.101.119.3 NAME 'entryTtl' "
886 			"DESC 'RFC2589: entry time-to-live' "
887 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE "
888 			"NO-USER-MODIFICATION USAGE dSAOperation )",
889 		dynamicAttribute, SLAP_AT_MANAGEABLE,
890 		NULL, NULL,
891 		NULL, NULL, NULL, NULL, NULL,
892 		offsetof(struct slap_internal_schema, si_ad_entryTtl) },
893 	{ "dynamicSubtrees", "( 1.3.6.1.4.1.1466.101.119.4 "
894 			"NAME 'dynamicSubtrees' "
895 			"DESC 'RFC2589: dynamic subtrees' "
896 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION "
897 			"USAGE dSAOperation )",
898 		rootDseAttribute, 0,
899 		NULL, NULL,
900 		NULL, NULL, NULL, NULL, NULL,
901 		offsetof(struct slap_internal_schema, si_ad_dynamicSubtrees) },
902 #endif
903 
904 	/* userApplication attributes (which system schema depends upon) */
905 	{ "distinguishedName", "( 2.5.4.49 NAME 'distinguishedName' "
906 			"DESC 'RFC4519: common supertype of DN attributes' "
907 			"EQUALITY distinguishedNameMatch "
908 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )",
909 		NULL, SLAP_AT_ABSTRACT,
910 		NULL, NULL,
911 		NULL, NULL, NULL, NULL, NULL,
912 		offsetof(struct slap_internal_schema, si_ad_distinguishedName) },
913 	{ "name", "( 2.5.4.41 NAME 'name' "
914 			"DESC 'RFC4519: common supertype of name attributes' "
915 			"EQUALITY caseIgnoreMatch "
916 			"SUBSTR caseIgnoreSubstringsMatch "
917 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )",
918 		NULL, SLAP_AT_ABSTRACT,
919 		NULL, NULL,
920 		NULL, NULL, NULL, NULL, NULL,
921 		offsetof(struct slap_internal_schema, si_ad_name) },
922 	{ "cn", "( 2.5.4.3 NAME ( 'cn' 'commonName' ) "
923 			"DESC 'RFC4519: common name(s) for which the entity is known by' "
924 			"SUP name )",
925 		NULL, 0,
926 		NULL, NULL,
927 		NULL, NULL, NULL, NULL, NULL,
928 		offsetof(struct slap_internal_schema, si_ad_cn) },
929 	{ "uid", "( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) "
930 			"DESC 'RFC4519: user identifier' "
931 			"EQUALITY caseIgnoreMatch "
932 			"SUBSTR caseIgnoreSubstringsMatch "
933 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )",
934 		NULL, 0,
935 		NULL, NULL,
936 		NULL, NULL, NULL, NULL, NULL,
937 		offsetof(struct slap_internal_schema, si_ad_uid) },
938 	{ "uidNumber", /* for ldapi:// */
939 		"( 1.3.6.1.1.1.1.0 NAME 'uidNumber' "
940     		"DESC 'RFC2307: An integer uniquely identifying a user "
941 				"in an administrative domain' "
942     		"EQUALITY integerMatch "
943     		"ORDERING integerOrderingMatch "
944     		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )",
945 		NULL, 0,
946 		NULL, NULL,
947 		NULL, NULL, NULL, NULL, NULL,
948 		offsetof(struct slap_internal_schema, si_ad_uidNumber) },
949 	{ "gidNumber", /* for ldapi:// */
950 		"( 1.3.6.1.1.1.1.1 NAME 'gidNumber' "
951     		"DESC 'RFC2307: An integer uniquely identifying a group "
952 				"in an administrative domain' "
953     		"EQUALITY integerMatch "
954     		"ORDERING integerOrderingMatch "
955     		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )",
956 		NULL, 0,
957 		NULL, NULL,
958 		NULL, NULL, NULL, NULL, NULL,
959 		offsetof(struct slap_internal_schema, si_ad_gidNumber) },
960 	{ "userPassword", "( 2.5.4.35 NAME 'userPassword' "
961 			"DESC 'RFC4519/2307: password of user' "
962 			"EQUALITY octetStringMatch "
963 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} )",
964 		NULL, 0,
965 		NULL, NULL,
966 		NULL, NULL, NULL, NULL, NULL,
967 		offsetof(struct slap_internal_schema, si_ad_userPassword) },
968 
969 	{ "labeledURI", "( 1.3.6.1.4.1.250.1.57 NAME 'labeledURI' "
970 			"DESC 'RFC2079: Uniform Resource Identifier with optional label' "
971 			"EQUALITY caseExactMatch "
972 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
973 		NULL, 0,
974 		NULL, NULL,
975 		NULL, NULL, NULL, NULL, NULL,
976 		offsetof(struct slap_internal_schema, si_ad_labeledURI) },
977 
978 #ifdef SLAPD_AUTHPASSWD
979 	{ "authPassword", "( 1.3.6.1.4.1.4203.1.3.4 "
980 			"NAME 'authPassword' "
981 			"DESC 'RFC3112: authentication password attribute' "
982 			"EQUALITY 1.3.6.1.4.1.4203.1.2.2 "
983 			"SYNTAX 1.3.6.1.4.1.4203.1.1.2 )",
984 		NULL, 0,
985 		NULL, NULL,
986 		NULL, NULL, NULL, NULL, NULL,
987 		offsetof(struct slap_internal_schema, si_ad_authPassword) },
988 	{ "supportedAuthPasswordSchemes", "( 1.3.6.1.4.1.4203.1.3.3 "
989 			"NAME 'supportedAuthPasswordSchemes' "
990 			"DESC 'RFC3112: supported authPassword schemes' "
991 			"EQUALITY caseExactIA5Match "
992 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} "
993 			"USAGE dSAOperation )",
994 		subschemaAttribute, 0,
995 		NULL, NULL,
996 		NULL, NULL, NULL, NULL, NULL,
997 		offsetof(struct slap_internal_schema, si_ad_authPasswordSchemes) },
998 #endif
999 
1000 	{ "description", "( 2.5.4.13 NAME 'description' "
1001 			"DESC 'RFC4519: descriptive information' "
1002 			"EQUALITY caseIgnoreMatch "
1003 			"SUBSTR caseIgnoreSubstringsMatch "
1004 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} )",
1005 		NULL, 0,
1006 		NULL, NULL,
1007 		NULL, NULL, NULL, NULL, NULL,
1008 		offsetof(struct slap_internal_schema, si_ad_description) },
1009 
1010 	{ "seeAlso", "( 2.5.4.34 NAME 'seeAlso' "
1011 			"DESC 'RFC4519: DN of related object' "
1012 			"SUP distinguishedName )",
1013 		NULL, 0,
1014 		NULL, NULL,
1015 		NULL, NULL, NULL, NULL, NULL,
1016 		offsetof(struct slap_internal_schema, si_ad_seeAlso) },
1017 
1018 	{ "pKCS8PrivateKey", "( 1.3.6.1.4.1.4203.666.1.60 "
1019 			"NAME 'pKCS8PrivateKey' "
1020 			"DESC 'PKCS#8 PrivateKeyInfo, use ;binary' "
1021 			"EQUALITY privateKeyMatch "
1022 			"SYNTAX 1.2.840.113549.1.8.1.1 )",
1023 		NULL, 0,
1024 		NULL, NULL,
1025 		NULL, NULL, NULL, NULL, NULL,
1026 		offsetof(struct slap_internal_schema, si_ad_pKCS8PrivateKey) },
1027 
1028 	{ "pwdLastSuccess", "( 1.3.6.1.4.1.42.2.27.8.1.29 NAME 'pwdLastSuccess' "
1029 			"DESC 'The timestamp of the last successful authentication' "
1030 			"EQUALITY generalizedTimeMatch "
1031 			"ORDERING generalizedTimeOrderingMatch "
1032 			"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
1033 			"SINGLE-VALUE "
1034 			"NO-USER-MODIFICATION "
1035 			"USAGE directoryOperation )",
1036 		NULL, 0,
1037 		NULL, NULL,
1038 		NULL, NULL, NULL, NULL, NULL,
1039 		offsetof(struct slap_internal_schema, si_ad_pwdLastSuccess) },
1040 
1041 	{ NULL, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 0 }
1042 };
1043 
1044 static AttributeType slap_at_undefined = {
1045 	{ "1.1.1", NULL, "Catchall for undefined attribute types", 1, NULL,
1046 		NULL, NULL, NULL, NULL,
1047 		0, 0, 0, 1, LDAP_SCHEMA_DSA_OPERATION, NULL }, /* LDAPAttributeType */
1048 	BER_BVC("UNDEFINED"), /* cname */
1049 	NULL, /* sup */
1050 	NULL, /* subtypes */
1051 	NULL, NULL, NULL, NULL,	/* matching rules routines */
1052 	NULL, /* syntax (will be set later to "octetString") */
1053 	NULL, /* schema check function */
1054 	NULL, /* oidmacro */
1055 	NULL, /* soidmacro */
1056 	SLAP_AT_ABSTRACT|SLAP_AT_FINAL,	/* mask */
1057 	{ NULL }, /* next */
1058 	NULL /* attribute description */
1059 	/* mutex (don't know how to initialize it :) */
1060 };
1061 
1062 static AttributeType slap_at_proxied = {
1063 	{ "1.1.1", NULL, "Catchall for undefined proxied attribute types", 1, NULL,
1064 		NULL, NULL, NULL, NULL,
1065 		0, 0, 0, 0, LDAP_SCHEMA_USER_APPLICATIONS, NULL }, /* LDAPAttributeType */
1066 	BER_BVC("PROXIED"), /* cname */
1067 	NULL, /* sup */
1068 	NULL, /* subtypes */
1069 	NULL, NULL, NULL, NULL,	/* matching rules routines (will be set later) */
1070 	NULL, /* syntax (will be set later to "octetString") */
1071 	NULL, /* schema check function */
1072 	NULL, /* oidmacro */
1073 	NULL, /* soidmacro */
1074 	SLAP_AT_ABSTRACT|SLAP_AT_FINAL,	/* mask */
1075 	{ NULL }, /* next */
1076 	NULL /* attribute description */
1077 	/* mutex (don't know how to initialize it :) */
1078 };
1079 
1080 static struct slap_schema_mr_map {
1081 	char *ssmm_name;
1082 	size_t ssmm_offset;
1083 } mr_map[] = {
1084 	{ "caseExactIA5Match",
1085 		offsetof(struct slap_internal_schema, si_mr_caseExactIA5Match) },
1086 	{ "caseExactMatch",
1087 		offsetof(struct slap_internal_schema, si_mr_caseExactMatch) },
1088 	{ "caseExactSubstringsMatch",
1089 		offsetof(struct slap_internal_schema, si_mr_caseExactSubstringsMatch) },
1090 	{ "distinguishedNameMatch",
1091 		offsetof(struct slap_internal_schema, si_mr_distinguishedNameMatch) },
1092 	{ "dnSubtreeMatch",
1093 		offsetof(struct slap_internal_schema, si_mr_dnSubtreeMatch) },
1094 	{ "dnOneLevelMatch",
1095 		offsetof(struct slap_internal_schema, si_mr_dnOneLevelMatch) },
1096 	{ "dnSubordinateMatch",
1097 		offsetof(struct slap_internal_schema, si_mr_dnSubordinateMatch) },
1098 	{ "dnSuperiorMatch",
1099 		offsetof(struct slap_internal_schema, si_mr_dnSuperiorMatch) },
1100 	{ "integerMatch",
1101 		offsetof(struct slap_internal_schema, si_mr_integerMatch) },
1102 	{ "integerFirstComponentMatch",
1103 		offsetof(struct slap_internal_schema,
1104 			si_mr_integerFirstComponentMatch) },
1105 	{ "objectIdentifierFirstComponentMatch",
1106 		offsetof(struct slap_internal_schema,
1107 			si_mr_objectIdentifierFirstComponentMatch) },
1108 	{ "caseIgnoreMatch",
1109 		offsetof(struct slap_internal_schema, si_mr_caseIgnoreMatch) },
1110 	{ "caseIgnoreListMatch",
1111 		offsetof(struct slap_internal_schema, si_mr_caseIgnoreListMatch) },
1112 	{ NULL, 0 }
1113 };
1114 
1115 static struct slap_schema_syn_map {
1116 	char *sssm_name;
1117 	size_t sssm_offset;
1118 } syn_map[] = {
1119 	{ "1.3.6.1.4.1.1466.115.121.1.15",
1120 		offsetof(struct slap_internal_schema, si_syn_directoryString) },
1121 	{ "1.3.6.1.4.1.1466.115.121.1.12",
1122 		offsetof(struct slap_internal_schema, si_syn_distinguishedName) },
1123 	{ "1.3.6.1.4.1.1466.115.121.1.27",
1124 		offsetof(struct slap_internal_schema, si_syn_integer) },
1125 	{ "1.3.6.1.4.1.1466.115.121.1.40",
1126 		offsetof(struct slap_internal_schema, si_syn_octetString) },
1127 	{ "1.3.6.1.4.1.1466.115.121.1.3",
1128 		offsetof(struct slap_internal_schema, si_syn_attributeTypeDesc) },
1129 	{ "1.3.6.1.4.1.1466.115.121.1.16",
1130 		offsetof(struct slap_internal_schema, si_syn_ditContentRuleDesc) },
1131 	{ "1.3.6.1.4.1.1466.115.121.1.54",
1132 		offsetof(struct slap_internal_schema, si_syn_ldapSyntaxDesc) },
1133 	{ "1.3.6.1.4.1.1466.115.121.1.30",
1134 		offsetof(struct slap_internal_schema, si_syn_matchingRuleDesc) },
1135 	{ "1.3.6.1.4.1.1466.115.121.1.31",
1136 		offsetof(struct slap_internal_schema, si_syn_matchingRuleUseDesc) },
1137 	{ "1.3.6.1.4.1.1466.115.121.1.35",
1138 		offsetof(struct slap_internal_schema, si_syn_nameFormDesc) },
1139 	{ "1.3.6.1.4.1.1466.115.121.1.37",
1140 		offsetof(struct slap_internal_schema, si_syn_objectClassDesc) },
1141 	{ "1.3.6.1.4.1.1466.115.121.1.17",
1142 		offsetof(struct slap_internal_schema, si_syn_ditStructureRuleDesc) },
1143 	{ NULL, 0 }
1144 };
1145 
1146 int
slap_schema_load(void)1147 slap_schema_load( void )
1148 {
1149 	int i;
1150 
1151 	for( i=0; syn_map[i].sssm_name; i++ ) {
1152 		Syntax ** synp = (Syntax **)
1153 			&(((char *) &slap_schema)[syn_map[i].sssm_offset]);
1154 
1155 		assert( *synp == NULL );
1156 
1157 		*synp = syn_find( syn_map[i].sssm_name );
1158 
1159 		if( *synp == NULL ) {
1160 			fprintf( stderr, "slap_schema_load: Syntax: "
1161 				"No syntax \"%s\" defined in schema\n",
1162 				syn_map[i].sssm_name );
1163 			return LDAP_INVALID_SYNTAX;
1164 		}
1165 	}
1166 
1167 	for( i=0; mr_map[i].ssmm_name; i++ ) {
1168 		MatchingRule ** mrp = (MatchingRule **)
1169 			&(((char *) &slap_schema)[mr_map[i].ssmm_offset]);
1170 
1171 		assert( *mrp == NULL );
1172 
1173 		*mrp = mr_find( mr_map[i].ssmm_name );
1174 
1175 		if( *mrp == NULL ) {
1176 			fprintf( stderr, "slap_schema_load: MatchingRule: "
1177 				"No matching rule \"%s\" defined in schema\n",
1178 				mr_map[i].ssmm_name );
1179 			return LDAP_INAPPROPRIATE_MATCHING;
1180 		}
1181 	}
1182 
1183 	slap_at_undefined.sat_syntax = slap_schema.si_syn_octetString;
1184 	slap_schema.si_at_undefined = &slap_at_undefined;
1185 
1186 	slap_at_proxied.sat_equality = mr_find( "octetStringMatch" );
1187 	slap_at_proxied.sat_approx = mr_find( "octetStringMatch" );
1188 	slap_at_proxied.sat_ordering = mr_find( "octetStringOrderingMatch" );
1189 	slap_at_proxied.sat_substr = mr_find( "octetStringSubstringsMatch" );
1190 	slap_at_proxied.sat_syntax = slap_schema.si_syn_octetString;
1191 	slap_schema.si_at_proxied = &slap_at_proxied;
1192 
1193 	ldap_pvt_thread_mutex_init( &ad_index_mutex );
1194 	ldap_pvt_thread_mutex_init( &ad_undef_mutex );
1195 	ldap_pvt_thread_mutex_init( &oc_undef_mutex );
1196 
1197 	for( i=0; ad_map[i].ssam_name; i++ ) {
1198 		assert( ad_map[i].ssam_defn != NULL );
1199 		{
1200 			LDAPAttributeType *at;
1201 			int		code;
1202 			const char	*err;
1203 
1204 			at = ldap_str2attributetype( ad_map[i].ssam_defn,
1205 				&code, &err, LDAP_SCHEMA_ALLOW_ALL );
1206 			if ( !at ) {
1207 				fprintf( stderr,
1208 					"slap_schema_load: AttributeType \"%s\": %s before %s\n",
1209 					 ad_map[i].ssam_name, ldap_scherr2str(code), err );
1210 				return code;
1211 			}
1212 
1213 			if ( at->at_oid == NULL ) {
1214 				fprintf( stderr, "slap_schema_load: "
1215 					"AttributeType \"%s\": no OID\n",
1216 					ad_map[i].ssam_name );
1217 				ldap_attributetype_free( at );
1218 				return LDAP_OTHER;
1219 			}
1220 
1221 			code = at_add( at, 0, NULL, NULL, &err );
1222 			if ( code ) {
1223 				ldap_attributetype_free( at );
1224 				fprintf( stderr, "slap_schema_load: AttributeType "
1225 					"\"%s\": %s: \"%s\"\n",
1226 					 ad_map[i].ssam_name, scherr2str(code), err );
1227 				return code;
1228 			}
1229 			ldap_memfree( at );
1230 		}
1231 		{
1232 			int rc;
1233 			const char *text;
1234 			Syntax *syntax = NULL;
1235 
1236 			AttributeDescription ** adp = (AttributeDescription **)
1237 				&(((char *) &slap_schema)[ad_map[i].ssam_offset]);
1238 
1239 			assert( *adp == NULL );
1240 
1241 			rc = slap_str2ad( ad_map[i].ssam_name, adp, &text );
1242 			if( rc != LDAP_SUCCESS ) {
1243 				fprintf( stderr, "slap_schema_load: AttributeType \"%s\": "
1244 					"not defined in schema\n",
1245 					ad_map[i].ssam_name );
1246 				return rc;
1247 			}
1248 
1249 			if( ad_map[i].ssam_check ) {
1250 				/* install check routine */
1251 				(*adp)->ad_type->sat_check = ad_map[i].ssam_check;
1252 			}
1253 			/* install flags */
1254 			(*adp)->ad_type->sat_flags |= ad_map[i].ssam_flags;
1255 
1256 			/* install custom syntax routines */
1257 			if( ad_map[i].ssam_syn_validate ||
1258 				ad_map[i].ssam_syn_pretty )
1259 			{
1260 				Syntax *syn;
1261 
1262 				syntax = (*adp)->ad_type->sat_syntax;
1263 
1264 				syn = ch_malloc( sizeof( Syntax ) );
1265 				*syn = *syntax;
1266 
1267 				if( ad_map[i].ssam_syn_validate ) {
1268 					syn->ssyn_validate = ad_map[i].ssam_syn_validate;
1269 				}
1270 				if( ad_map[i].ssam_syn_pretty ) {
1271 					syn->ssyn_pretty = ad_map[i].ssam_syn_pretty;
1272 				}
1273 
1274 				(*adp)->ad_type->sat_syntax = syn;
1275 			}
1276 
1277 			/* install custom rule routines */
1278 			if( syntax != NULL ||
1279 				ad_map[i].ssam_mr_convert ||
1280 				ad_map[i].ssam_mr_normalize ||
1281 				ad_map[i].ssam_mr_match ||
1282 				ad_map[i].ssam_mr_indexer ||
1283 				ad_map[i].ssam_mr_filter )
1284 			{
1285 				MatchingRule *mr = ch_malloc( sizeof( MatchingRule ) );
1286 				*mr = *(*adp)->ad_type->sat_equality;
1287 
1288 				if ( syntax != NULL ) {
1289 					mr->smr_syntax = (*adp)->ad_type->sat_syntax;
1290 				}
1291 				if ( ad_map[i].ssam_mr_convert ) {
1292 					mr->smr_convert = ad_map[i].ssam_mr_convert;
1293 				}
1294 				if ( ad_map[i].ssam_mr_normalize ) {
1295 					mr->smr_normalize = ad_map[i].ssam_mr_normalize;
1296 				}
1297 				if ( ad_map[i].ssam_mr_match ) {
1298 					mr->smr_match = ad_map[i].ssam_mr_match;
1299 				}
1300 				if ( ad_map[i].ssam_mr_indexer ) {
1301 					mr->smr_indexer = ad_map[i].ssam_mr_indexer;
1302 				}
1303 				if ( ad_map[i].ssam_mr_filter ) {
1304 					mr->smr_filter = ad_map[i].ssam_mr_filter;
1305 				}
1306 
1307 				(*adp)->ad_type->sat_equality = mr;
1308 			}
1309 		}
1310 	}
1311 
1312 	for( i=0; oc_map[i].ssom_name; i++ ) {
1313 		assert( oc_map[i].ssom_defn != NULL );
1314 		{
1315 			LDAPObjectClass *oc;
1316 			int		code;
1317 			const char	*err;
1318 
1319 			oc = ldap_str2objectclass( oc_map[i].ssom_defn, &code, &err,
1320 				LDAP_SCHEMA_ALLOW_ALL );
1321 			if ( !oc ) {
1322 				fprintf( stderr, "slap_schema_load: ObjectClass "
1323 					"\"%s\": %s before %s\n",
1324 				 	oc_map[i].ssom_name, ldap_scherr2str(code), err );
1325 				return code;
1326 			}
1327 
1328 			if ( oc->oc_oid == NULL ) {
1329 				fprintf( stderr, "slap_schema_load: ObjectClass "
1330 					"\"%s\": no OID\n",
1331 					oc_map[i].ssom_name );
1332 				ldap_objectclass_free( oc );
1333 				return LDAP_OTHER;
1334 			}
1335 
1336 			code = oc_add(oc,0,NULL,NULL,&err);
1337 			if ( code ) {
1338 				ldap_objectclass_free( oc );
1339 				fprintf( stderr, "slap_schema_load: ObjectClass "
1340 					"\"%s\": %s: \"%s\"\n",
1341 				 	oc_map[i].ssom_name, scherr2str(code), err);
1342 				return code;
1343 			}
1344 			ldap_memfree(oc);
1345 
1346 		}
1347 		{
1348 			ObjectClass ** ocp = (ObjectClass **)
1349 				&(((char *) &slap_schema)[oc_map[i].ssom_offset]);
1350 
1351 			assert( *ocp == NULL );
1352 
1353 			*ocp = oc_find( oc_map[i].ssom_name );
1354 			if( *ocp == NULL ) {
1355 				fprintf( stderr, "slap_schema_load: "
1356 					"ObjectClass \"%s\": not defined in schema\n",
1357 					oc_map[i].ssom_name );
1358 				return LDAP_OBJECT_CLASS_VIOLATION;
1359 			}
1360 
1361 			if( oc_map[i].ssom_check ) {
1362 				/* install check routine */
1363 				(*ocp)->soc_check = oc_map[i].ssom_check;
1364 			}
1365 			/* install flags */
1366 			(*ocp)->soc_flags |= oc_map[i].ssom_flags;
1367 		}
1368 	}
1369 
1370 	return LDAP_SUCCESS;
1371 }
1372 
1373 int
slap_schema_check(void)1374 slap_schema_check( void )
1375 {
1376 	/* we should only be called once after schema_init() was called */
1377 	assert( schema_init_done == 1 );
1378 
1379 	/*
1380 	 * cycle thru attributeTypes to build matchingRuleUse
1381 	 */
1382 	if ( matching_rule_use_init() ) {
1383 		return LDAP_OTHER;
1384 	}
1385 
1386 	++schema_init_done;
1387 	return LDAP_SUCCESS;
1388 }
1389 
rootDseObjectClass(Backend * be,Entry * e,ObjectClass * oc,const char ** text,char * textbuf,size_t textlen)1390 static int rootDseObjectClass (
1391 	Backend *be,
1392 	Entry *e,
1393 	ObjectClass *oc,
1394 	const char** text,
1395 	char *textbuf, size_t textlen )
1396 {
1397 	*text = textbuf;
1398 
1399 	if( e->e_nname.bv_len ) {
1400 		snprintf( textbuf, textlen,
1401 			"objectClass \"%s\" only allowed in the root DSE",
1402 			oc->soc_oid );
1403 		return LDAP_OBJECT_CLASS_VIOLATION;
1404 	}
1405 
1406 	/* we should not be called for the root DSE */
1407 	assert( 0 );
1408 	return LDAP_SUCCESS;
1409 }
1410 
aliasObjectClass(Backend * be,Entry * e,ObjectClass * oc,const char ** text,char * textbuf,size_t textlen)1411 static int aliasObjectClass (
1412 	Backend *be,
1413 	Entry *e,
1414 	ObjectClass *oc,
1415 	const char** text,
1416 	char *textbuf, size_t textlen )
1417 {
1418 	*text = textbuf;
1419 
1420 	if( !SLAP_ALIASES(be) ) {
1421 		snprintf( textbuf, textlen,
1422 			"objectClass \"%s\" not supported in context",
1423 			oc->soc_oid );
1424 		return LDAP_OBJECT_CLASS_VIOLATION;
1425 	}
1426 
1427 	return LDAP_SUCCESS;
1428 }
1429 
referralObjectClass(Backend * be,Entry * e,ObjectClass * oc,const char ** text,char * textbuf,size_t textlen)1430 static int referralObjectClass (
1431 	Backend *be,
1432 	Entry *e,
1433 	ObjectClass *oc,
1434 	const char** text,
1435 	char *textbuf, size_t textlen )
1436 {
1437 	*text = textbuf;
1438 
1439 	if( !SLAP_REFERRALS(be) ) {
1440 		snprintf( textbuf, textlen,
1441 			"objectClass \"%s\" not supported in context",
1442 			oc->soc_oid );
1443 		return LDAP_OBJECT_CLASS_VIOLATION;
1444 	}
1445 
1446 	return LDAP_SUCCESS;
1447 }
1448 
subentryObjectClass(Backend * be,Entry * e,ObjectClass * oc,const char ** text,char * textbuf,size_t textlen)1449 static int subentryObjectClass (
1450 	Backend *be,
1451 	Entry *e,
1452 	ObjectClass *oc,
1453 	const char** text,
1454 	char *textbuf, size_t textlen )
1455 {
1456 	*text = textbuf;
1457 
1458 	if( !SLAP_SUBENTRIES(be) ) {
1459 		snprintf( textbuf, textlen,
1460 			"objectClass \"%s\" not supported in context",
1461 			oc->soc_oid );
1462 		return LDAP_OBJECT_CLASS_VIOLATION;
1463 	}
1464 
1465 	if( oc != slap_schema.si_oc_subentry && !is_entry_subentry( e ) ) {
1466 		snprintf( textbuf, textlen,
1467 			"objectClass \"%s\" only allowed in subentries",
1468 			oc->soc_oid );
1469 		return LDAP_OBJECT_CLASS_VIOLATION;
1470 	}
1471 
1472 	return LDAP_SUCCESS;
1473 }
1474 
1475 #ifdef LDAP_DYNAMIC_OBJECTS
dynamicObjectClass(Backend * be,Entry * e,ObjectClass * oc,const char ** text,char * textbuf,size_t textlen)1476 static int dynamicObjectClass (
1477 	Backend *be,
1478 	Entry *e,
1479 	ObjectClass *oc,
1480 	const char** text,
1481 	char *textbuf, size_t textlen )
1482 {
1483 	*text = textbuf;
1484 
1485 	if( !SLAP_DYNAMIC(be) ) {
1486 		snprintf( textbuf, textlen,
1487 			"objectClass \"%s\" not supported in context",
1488 			oc->soc_oid );
1489 		return LDAP_OBJECT_CLASS_VIOLATION;
1490 	}
1491 
1492 	return LDAP_SUCCESS;
1493 }
1494 #endif /* LDAP_DYNAMIC_OBJECTS */
1495 
rootDseAttribute(Backend * be,Entry * e,Attribute * attr,const char ** text,char * textbuf,size_t textlen)1496 static int rootDseAttribute (
1497 	Backend *be,
1498 	Entry *e,
1499 	Attribute *attr,
1500 	const char** text,
1501 	char *textbuf, size_t textlen )
1502 {
1503 	*text = textbuf;
1504 
1505 	if( e->e_nname.bv_len ) {
1506 		snprintf( textbuf, textlen,
1507 			"attribute \"%s\" only allowed in the root DSE",
1508 			attr->a_desc->ad_cname.bv_val );
1509 		return LDAP_OBJECT_CLASS_VIOLATION;
1510 	}
1511 
1512 	/* we should not be called for the root DSE */
1513 	assert( 0 );
1514 	return LDAP_SUCCESS;
1515 }
1516 
aliasAttribute(Backend * be,Entry * e,Attribute * attr,const char ** text,char * textbuf,size_t textlen)1517 static int aliasAttribute (
1518 	Backend *be,
1519 	Entry *e,
1520 	Attribute *attr,
1521 	const char** text,
1522 	char *textbuf, size_t textlen )
1523 {
1524 	*text = textbuf;
1525 
1526 	if( !SLAP_ALIASES(be) ) {
1527 		snprintf( textbuf, textlen,
1528 			"attribute \"%s\" not supported in context",
1529 			attr->a_desc->ad_cname.bv_val );
1530 		return LDAP_OBJECT_CLASS_VIOLATION;
1531 	}
1532 
1533 	if( !is_entry_alias( e ) ) {
1534 		snprintf( textbuf, textlen,
1535 			"attribute \"%s\" only allowed in the alias",
1536 			attr->a_desc->ad_cname.bv_val );
1537 		return LDAP_OBJECT_CLASS_VIOLATION;
1538 	}
1539 
1540 	return LDAP_SUCCESS;
1541 }
1542 
referralAttribute(Backend * be,Entry * e,Attribute * attr,const char ** text,char * textbuf,size_t textlen)1543 static int referralAttribute (
1544 	Backend *be,
1545 	Entry *e,
1546 	Attribute *attr,
1547 	const char** text,
1548 	char *textbuf, size_t textlen )
1549 {
1550 	*text = textbuf;
1551 
1552 	if( !SLAP_REFERRALS(be) ) {
1553 		snprintf( textbuf, textlen,
1554 			"attribute \"%s\" not supported in context",
1555 			attr->a_desc->ad_cname.bv_val );
1556 		return LDAP_OBJECT_CLASS_VIOLATION;
1557 	}
1558 
1559 	if( !is_entry_referral( e ) ) {
1560 		snprintf( textbuf, textlen,
1561 			"attribute \"%s\" only allowed in the referral",
1562 			attr->a_desc->ad_cname.bv_val );
1563 		return LDAP_OBJECT_CLASS_VIOLATION;
1564 	}
1565 
1566 	return LDAP_SUCCESS;
1567 }
1568 
subentryAttribute(Backend * be,Entry * e,Attribute * attr,const char ** text,char * textbuf,size_t textlen)1569 static int subentryAttribute (
1570 	Backend *be,
1571 	Entry *e,
1572 	Attribute *attr,
1573 	const char** text,
1574 	char *textbuf, size_t textlen )
1575 {
1576 	*text = textbuf;
1577 
1578 	if( !SLAP_SUBENTRIES(be) ) {
1579 		snprintf( textbuf, textlen,
1580 			"attribute \"%s\" not supported in context",
1581 			attr->a_desc->ad_cname.bv_val );
1582 		return LDAP_OBJECT_CLASS_VIOLATION;
1583 	}
1584 
1585 	if( !is_entry_subentry( e ) ) {
1586 		snprintf( textbuf, textlen,
1587 			"attribute \"%s\" only allowed in the subentry",
1588 			attr->a_desc->ad_cname.bv_val );
1589 		return LDAP_OBJECT_CLASS_VIOLATION;
1590 	}
1591 
1592 	return LDAP_SUCCESS;
1593 }
1594 
administrativeRoleAttribute(Backend * be,Entry * e,Attribute * attr,const char ** text,char * textbuf,size_t textlen)1595 static int administrativeRoleAttribute (
1596 	Backend *be,
1597 	Entry *e,
1598 	Attribute *attr,
1599 	const char** text,
1600 	char *textbuf, size_t textlen )
1601 {
1602 	*text = textbuf;
1603 
1604 	if( !SLAP_SUBENTRIES(be) ) {
1605 		snprintf( textbuf, textlen,
1606 			"attribute \"%s\" not supported in context",
1607 			attr->a_desc->ad_cname.bv_val );
1608 		return LDAP_OBJECT_CLASS_VIOLATION;
1609 	}
1610 
1611 	snprintf( textbuf, textlen,
1612 		"attribute \"%s\" not supported!",
1613 		attr->a_desc->ad_cname.bv_val );
1614 	return LDAP_OBJECT_CLASS_VIOLATION;
1615 }
1616 
1617 #ifdef LDAP_DYNAMIC_OBJECTS
dynamicAttribute(Backend * be,Entry * e,Attribute * attr,const char ** text,char * textbuf,size_t textlen)1618 static int dynamicAttribute (
1619 	Backend *be,
1620 	Entry *e,
1621 	Attribute *attr,
1622 	const char** text,
1623 	char *textbuf, size_t textlen )
1624 {
1625 	*text = textbuf;
1626 
1627 	if( !SLAP_DYNAMIC(be) ) {
1628 		snprintf( textbuf, textlen,
1629 			"attribute \"%s\" not supported in context",
1630 			attr->a_desc->ad_cname.bv_val );
1631 		return LDAP_OBJECT_CLASS_VIOLATION;
1632 	}
1633 
1634 	if( !is_entry_dynamicObject( e ) ) {
1635 		snprintf( textbuf, textlen,
1636 			"attribute \"%s\" only allowed in dynamic object",
1637 			attr->a_desc->ad_cname.bv_val );
1638 		return LDAP_OBJECT_CLASS_VIOLATION;
1639 	}
1640 
1641 	return LDAP_SUCCESS;
1642 }
1643 #endif /* LDAP_DYNAMIC_OBJECTS */
1644