Changeset 988 for vendor/current/source4/dsdb/schema

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source4/dsdb/schema

Files:

• schema.h (modified) (10 diffs)
• schema_convert_to_ol.c (modified) (7 diffs)
• schema_inferiors.c (modified) (13 diffs)
• schema_init.c (modified) (15 diffs)
• schema_prefixmap.c (modified) (3 diffs)
• schema_query.c (modified) (3 diffs)
• schema_set.c (modified) (21 diffs)
• schema_syntax.c (modified) (60 diffs)
• tests/schema_syntax.c (modified) (2 diffs)

vendor/current/source4/dsdb/schema/schema.h

@@ -24 +24 @@
 
 #include "prefixmap.h"
+
+enum dsdb_dn_format {
+        DSDB_NORMAL_DN,
+        DSDB_BINARY_DN,
+        DSDB_STRING_DN,
+        DSDB_INVALID_DN
+};
+
 
 struct dsdb_attribute;
@@ -66 +74 @@
                                const struct dsdb_attribute *attr,
                                const struct ldb_message_element *in);
+        bool auto_normalise;
+        bool userParameters; /* Indicates the syntax userParameters should be forced to */
 };
 
@@ -108 +118 @@
         bool systemOnly;
 
+        bool one_way_link;
+        enum dsdb_dn_format dn_format;
+
         /* internal stuff */
         const struct dsdb_syntax *syntax;
@@ -144 +157 @@
 
         uint32_t schemaFlagsEx;
+        uint32_t systemFlags;
         struct ldb_val msDs_Schema_Extensions;
 
@@ -154 +168 @@
         bool systemOnly;
 
-        const char **supclasses;
-        const char **subclasses;
-        const char **subclasses_direct;
-        const char **posssuperiors;
         uint32_t subClassOf_id;
         uint32_t *systemAuxiliaryClass_ids;
@@ -174 +184 @@
          * 3 */ 
         uint32_t subClass_order;
+
+        struct {
+                const char **supclasses;
+                const char **subclasses;
+                const char **subclasses_direct;
+                const char **posssuperiors;
+        } tmp;
 };
 
@@ -186 +203 @@
 
 struct dsdb_schema {
-        struct ldb_dn *base_dn;
-
         struct dsdb_schema_prefixmap *prefixmap;
 
@@ -206 +221 @@
         struct dsdb_class *classes;
 
+        struct dsdb_attribute **attributes_to_remove;
+        uint32_t attributes_to_remove_size;
+        struct dsdb_class **classes_to_remove;
+        uint32_t classes_to_remove_size;
+
         /* lists of classes sorted by various attributes, for faster
            access */
@@ -225 +245 @@
         struct {
                 bool we_are_master;
+                bool update_allowed;
                 struct ldb_dn *master_dn;
         } fsmo;
 
         /* Was this schema loaded from ldb (if so, then we will reload it when we detect a change in ldb) */
-        struct ldb_module *loaded_from_module;
-        struct dsdb_schema *(*refresh_fn)(struct ldb_module *module, struct dsdb_schema *schema, bool is_global_schema);
         bool refresh_in_progress;
-        /* an 'opaque' sequence number that the reload function may also wish to use */
-        uint64_t reload_seq_number;
+        time_t ts_last_change;
+        time_t last_refresh;
+        time_t refresh_interval;
+        /* This 'opaque' is stored in the metadata and is used to check if the currently
+         * loaded schema needs a reload because another process has signaled that it has been
+         * requested to reload the schema (either due through DRS or via the schemaUpdateNow).
+         */
+        uint64_t metadata_usn;
 
         /* Should the syntax handlers in this case handle all incoming OIDs automatically, assigning them as an OID if no text name is known? */
@@ -255 +280 @@
 };
 
+struct ldb_module;
+
+typedef struct dsdb_schema *(*dsdb_schema_refresh_fn)(struct ldb_module *module,
+                                                      struct tevent_context *ev,
+                                                      struct dsdb_schema *schema, bool is_global_schema);
 #include "dsdb/schema/proto.h"
 

vendor/current/source4/dsdb/schema/schema_convert_to_ol.c

@@ -135 +135 @@
                                                         NULL);
                 if (schema_entry == NULL) {
+                        talloc_free(mem_ctx);
                         DEBUG(0, ("failed to generate schema description for %s\n", name));
                         return NULL;
@@ -146 +147 @@
                         out = talloc_asprintf_append(out, "objectClasses: %s\n", schema_entry);
                         break;
+                default:
+                        talloc_free(mem_ctx);
+                        DEBUG(0,(__location__ " Wrong type of target %u!", (unsigned)target));
+                        return NULL;
                 }
                 talloc_free(mem_ctx);
@@ -200 +205 @@
                 target = TARGET_FEDORA_DS;
         } else {
+                talloc_free(mem_ctx);
                 DEBUG(0, ("Invalid target type for schema conversion %s\n", target_str));
                 return NULL;
         }
 
-        /* The mappings are line-seperated, and specify details such as OIDs to skip etc */
+        /* The mappings are line-separated, and specify details such as OIDs to skip etc */
         while (1) {
                 line = next_line;
@@ -264 +270 @@
         schema = dsdb_get_schema(ldb, mem_ctx);
         if (!schema) {
+                talloc_free(mem_ctx);
                 DEBUG(0, ("No schema on ldb to convert!\n"));
                 return NULL;
@@ -275 +282 @@
                 out = talloc_strdup(mem_ctx, "dn: cn=schema\n");
                 break;
+        default:
+                talloc_free(mem_ctx);
+                DEBUG(0,(__location__ " Wrong type of target %u!", (unsigned)target));
+                return NULL;
         }
 
@@ -340 +351 @@
 
                 if (schema_entry == NULL) {
+                        talloc_free(mem_ctx);
                         DEBUG(0, ("failed to generate attribute description for %s\n", name));
                         return NULL;
@@ -351 +363 @@
                         out = talloc_asprintf_append(out, "attributeTypes: %s\n", schema_entry);
                         break;
+                default:
+                        talloc_free(mem_ctx);
+                        DEBUG(0,(__location__ " Wrong type of target %u!", (unsigned)target));
+                        return NULL;
                 }
         }
 
         out = print_schema_recursive(out, schema, "top", target, attrs_skip, attr_map, oid_map);
+
+        talloc_steal(ldb, out);
+        talloc_free(mem_ctx);
 
         return out;

vendor/current/source4/dsdb/schema/schema_inferiors.c

@@ -40 +40 @@
         const char **list;
 
-        if (schema_class->supclasses) {
-                return schema_class->supclasses;
+        if (schema_class->tmp.supclasses) {
+                return schema_class->tmp.supclasses;
         }
 
@@ -53 +53 @@
         if (schema_class->subClassOf &&
             strcmp(schema_class->lDAPDisplayName, schema_class->subClassOf) == 0) {
-                schema_class->supclasses = list;
+                schema_class->tmp.supclasses = list;
                 return list;
         }
@@ -66 +66 @@
         }
 
-        schema_class->supclasses = str_list_unique(list);
-
-        return schema_class->supclasses;
+        schema_class->tmp.supclasses = str_list_unique(list);
+
+        return schema_class->tmp.supclasses;
 }
 
@@ -88 +88 @@
                         continue;
                 }
-                list = str_list_append_const(list, schema_class->subclasses);
+                list = str_list_append_const(list, schema_class->tmp.subclasses);
         }
         return list;
@@ -100 +100 @@
                                          struct dsdb_class *schema_class)
 {
-        if (schema_class->posssuperiors == NULL) {
+        if (schema_class->tmp.posssuperiors == NULL) {
                 const char **list2 = const_str_list(str_list_make_empty(schema_class));
                 const char **list3;
@@ -119 +119 @@
                 list2 = str_list_append_const(list2, schema_subclasses(schema, list2, list2));
 
-                schema_class->posssuperiors = str_list_unique(list2);
-        }
-
-        return schema_class->posssuperiors;
+                schema_class->tmp.posssuperiors = str_list_unique(list2);
+        }
+
+        return schema_class->tmp.posssuperiors;
 }
 
@@ -128 +128 @@
                                               struct dsdb_class *schema_class)
 {
-        const char **list = str_list_copy_const(schema_class, schema_class->subclasses_direct);
+        const char **list = str_list_copy_const(schema_class, schema_class->tmp.subclasses_direct);
         unsigned int i;
         for (i=0;list && list[i]; i++) {
@@ -142 +142 @@
 /* Walk down the subClass tree, setting a higher index as we go down
  * each level.  top is 1, subclasses of top are 2, etc */
-void schema_subclasses_order_recurse(const struct dsdb_schema *schema,
-                                     struct dsdb_class *schema_class,
-                                     const int order)
-{
-        const char **list = schema_class->subclasses_direct;
+static void schema_subclasses_order_recurse(const struct dsdb_schema *schema,
+                                            struct dsdb_class *schema_class,
+                                            const int order)
+{
+        const char **list = schema_class->tmp.subclasses_direct;
         unsigned int i;
         schema_class->subClass_order = order;
@@ -170 +170 @@
                 }
                 if (schema_class2 && schema_class != schema_class2) {
-                        if (schema_class2->subclasses_direct == NULL) {
-                                schema_class2->subclasses_direct = const_str_list(str_list_make_empty(schema_class2));
-                                if (!schema_class2->subclasses_direct) {
+                        if (schema_class2->tmp.subclasses_direct == NULL) {
+                                schema_class2->tmp.subclasses_direct = const_str_list(str_list_make_empty(schema_class2));
+                                if (!schema_class2->tmp.subclasses_direct) {
                                         return LDB_ERR_OPERATIONS_ERROR;
                                 }
                         }
-                        schema_class2->subclasses_direct = str_list_add_const(schema_class2->subclasses_direct,
+                        schema_class2->tmp.subclasses_direct = str_list_add_const(schema_class2->tmp.subclasses_direct,
                                                 schema_class->lDAPDisplayName);
                 }
@@ -182 +182 @@
 
         for (schema_class=schema->classes; schema_class; schema_class=schema_class->next) {
-                schema_class->subclasses = str_list_unique(schema_subclasses_recurse(schema, schema_class));
+                schema_class->tmp.subclasses = str_list_unique(schema_subclasses_recurse(schema, schema_class));
 
                 /* Initialize the subClass order, to ensure we can't have uninitialized sort on the subClass hierarchy */
@@ -202 +202 @@
 {
         struct dsdb_class *c2;
-
-        for (c2=schema->classes; c2; c2=c2->next) {
+        const char **poss_inf = NULL;
+        const char **sys_poss_inf = NULL;
+
+        for (c2 = schema->classes; c2; c2 = c2->next) {
                 const char **superiors = schema_posssuperiors(schema, c2);
-                if (c2->systemOnly == false 
-                    && c2->objectClassCategory != 2 
-                    && c2->objectClassCategory != 3
-                    && str_list_check(superiors, schema_class->lDAPDisplayName)) {
-                        if (schema_class->possibleInferiors == NULL) {
-                                schema_class->possibleInferiors = const_str_list(str_list_make_empty(schema_class));
-                        }
-                        schema_class->possibleInferiors = str_list_add_const(schema_class->possibleInferiors,
-                                                        c2->lDAPDisplayName);
-                }
-        }
-        schema_class->possibleInferiors = str_list_unique(schema_class->possibleInferiors);
-}
-
-static void schema_fill_system_possible_inferiors(const struct dsdb_schema *schema,
-                                                  struct dsdb_class *schema_class)
-{
-        struct dsdb_class *c2;
-
-        for (c2=schema->classes; c2; c2=c2->next) {
-                const char **superiors = schema_posssuperiors(schema, c2);
-                if (c2->objectClassCategory != 2
-                    && c2->objectClassCategory != 3
-                    && str_list_check(superiors, schema_class->lDAPDisplayName)) {
-                        if (schema_class->systemPossibleInferiors == NULL) {
-                                schema_class->systemPossibleInferiors = const_str_list(str_list_make_empty(schema_class));
-                        }
-                        schema_class->systemPossibleInferiors = str_list_add_const(schema_class->systemPossibleInferiors,
-                                                        c2->lDAPDisplayName);
-                }
-        }
-        schema_class->systemPossibleInferiors = str_list_unique(schema_class->systemPossibleInferiors);
+                if (c2->objectClassCategory != 2 &&
+                    c2->objectClassCategory != 3 &&
+                    str_list_check(superiors, schema_class->lDAPDisplayName))
+                {
+                        if (c2->systemOnly == false) {
+                                if (poss_inf == NULL) {
+                                        poss_inf = const_str_list(str_list_make_empty(schema_class));
+                                }
+                                poss_inf = str_list_add_const(poss_inf,
+                                                              c2->lDAPDisplayName);
+                        }
+                        if (sys_poss_inf == NULL) {
+                                sys_poss_inf = const_str_list(str_list_make_empty(schema_class));
+                        }
+                        sys_poss_inf = str_list_add_const(sys_poss_inf,
+                                                          c2->lDAPDisplayName);
+                }
+        }
+        schema_class->systemPossibleInferiors = str_list_unique(sys_poss_inf);
+        schema_class->possibleInferiors = str_list_unique(poss_inf);
 }
 
@@ -330 +320 @@
         struct dsdb_class *schema_class;
 
+        /* make sure we start with a clean cache */
+        for (schema_class=schema->classes; schema_class; schema_class=schema_class->next) {
+                ZERO_STRUCT(schema_class->tmp);
+        }
+
         schema_fill_from_ids(schema);
 
@@ -339 +334 @@
         for (schema_class=schema->classes; schema_class; schema_class=schema_class->next) {
                 schema_fill_possible_inferiors(schema, schema_class);
-                schema_fill_system_possible_inferiors(schema, schema_class);
         }
 
         /* free up our internal cache elements */
         for (schema_class=schema->classes; schema_class; schema_class=schema_class->next) {
-                talloc_free(schema_class->supclasses);
-                talloc_free(schema_class->subclasses_direct);
-                talloc_free(schema_class->subclasses);
-                talloc_free(schema_class->posssuperiors);
-                schema_class->supclasses = NULL;
-                schema_class->subclasses_direct = NULL;
-                schema_class->subclasses = NULL;
-                schema_class->posssuperiors = NULL;
+                TALLOC_FREE(schema_class->tmp.supclasses);
+                TALLOC_FREE(schema_class->tmp.subclasses_direct);
+                TALLOC_FREE(schema_class->tmp.subclasses);
+                TALLOC_FREE(schema_class->tmp.posssuperiors);
         }
 

vendor/current/source4/dsdb/schema/schema_init.c

@@ -40 +40 @@
                 return NULL;
         }
+        schema->refresh_interval = 120;
 
         return schema;
@@ -56 +57 @@
         if (!schema_copy) {
                 return NULL;
-        }
-
-        /* schema base_dn */
-        schema_copy->base_dn = ldb_dn_copy(schema_copy, schema->base_dn);
-        if (!schema_copy->base_dn) {
-                goto failed;
         }
 
@@ -94 +89 @@
         schema_copy->num_attributes = schema->num_attributes;
 
+        schema_copy->refresh_interval = schema->refresh_interval;
+
         /* rebuild indexes */
         ret = dsdb_setup_sorted_accessors(ldb, schema_copy);
@@ -101 +98 @@
 
         /* leave reload_seq_number = 0 so it will be refresh ASAP */
-        schema_copy->refresh_fn = schema->refresh_fn;
-        schema_copy->loaded_from_module = schema->loaded_from_module;
 
         return schema_copy;
@@ -459 +454 @@
         unsigned int i;
         for (i=0;attrs[i];i++) {
-                if (strcasecmp(attr, attrs[i]) == 0) {
+                if (ldb_attr_cmp(attr, attrs[i]) == 0) {
                         return true;
                 }
@@ -615 +610 @@
 } while (0)
 
-WERROR dsdb_attribute_from_ldb(struct ldb_context *ldb,
-                               struct dsdb_schema *schema,
-                               struct ldb_message *msg)
+/** Create an dsdb_attribute out of ldb message, attr must be already talloced
+ */
+
+WERROR dsdb_attribute_from_ldb(const struct dsdb_schema *schema,
+                               struct ldb_message *msg,
+                               struct dsdb_attribute *attr)
 {
         WERROR status;
-        struct dsdb_attribute *attr = talloc_zero(schema, struct dsdb_attribute);
-        if (!attr) {
-                return WERR_NOMEM;
+        if (attr == NULL) {
+                DEBUG(0, ("%s: attr is null, it's expected not to be so\n", __location__));
+                return WERR_INVALID_PARAM;
         }
 
@@ -691 +689 @@
         GET_BOOL_LDB(msg, "systemOnly", attr, systemOnly, false);
 
+        return WERR_OK;
+}
+
+WERROR dsdb_set_attribute_from_ldb_dups(struct ldb_context *ldb,
+                                        struct dsdb_schema *schema,
+                                        struct ldb_message *msg,
+                                        bool checkdups)
+{
+        WERROR status;
+        struct dsdb_attribute *attr = talloc_zero(schema, struct dsdb_attribute);
+        if (!attr) {
+                return WERR_NOMEM;
+        }
+
+        status = dsdb_attribute_from_ldb(schema, msg, attr);
+        if (!W_ERROR_IS_OK(status)) {
+                return status;
+        }
+
         attr->syntax = dsdb_syntax_for_attribute(attr);
         if (!attr->syntax) {
@@ -706 +723 @@
         }
 
+        if (checkdups) {
+                const struct dsdb_attribute *a2;
+                struct dsdb_attribute **a;
+                uint32_t i;
+
+                a2 = dsdb_attribute_by_attributeID_id(schema,
+                                                      attr->attributeID_id);
+                if (a2 == NULL) {
+                        goto done;
+                }
+
+                i = schema->attributes_to_remove_size;
+                a = talloc_realloc(schema, schema->attributes_to_remove,
+                                   struct dsdb_attribute *, i + 1);
+                if (a == NULL) {
+                        return WERR_NOMEM;
+                }
+                /* Mark the old attribute as to be removed */
+                a[i] = discard_const_p(struct dsdb_attribute, a2);
+                schema->attributes_to_remove = a;
+                schema->attributes_to_remove_size++;
+        }
+
+done:
         DLIST_ADD(schema->attributes, attr);
         return WERR_OK;
 }
 
-WERROR dsdb_class_from_ldb(struct dsdb_schema *schema,
-                           struct ldb_message *msg)
+WERROR dsdb_set_attribute_from_ldb(struct ldb_context *ldb,
+                                   struct dsdb_schema *schema,
+                                   struct ldb_message *msg)
+{
+        return dsdb_set_attribute_from_ldb_dups(ldb, schema, msg, false);
+}
+
+WERROR dsdb_set_class_from_ldb_dups(struct dsdb_schema *schema,
+                                    struct ldb_message *msg,
+                                    bool checkdups)
 {
         WERROR status;
@@ -758 +807 @@
 
         GET_UINT32_LDB(msg, "schemaFlagsEx", obj, schemaFlagsEx);
+        GET_UINT32_LDB(msg, "systemFlags", obj, systemFlags);
         GET_BLOB_LDB(msg, "msDs-Schema-Extensions", obj, obj, msDs_Schema_Extensions);
 
@@ -768 +818 @@
         GET_BOOL_LDB(msg, "systemOnly", obj, systemOnly, false);
 
+        if (checkdups) {
+                const struct dsdb_class *c2;
+                struct dsdb_class **c;
+                uint32_t i;
+
+                c2 = dsdb_class_by_governsID_id(schema, obj->governsID_id);
+                if (c2 == NULL) {
+                        goto done;
+                }
+
+                i = schema->classes_to_remove_size;
+                c = talloc_realloc(schema, schema->classes_to_remove,
+                                   struct dsdb_class *, i + 1);
+                if (c == NULL) {
+                        return WERR_NOMEM;
+                }
+                /* Mark the old class to be removed */
+                c[i] = discard_const_p(struct dsdb_class, c2);
+                schema->classes_to_remove = c;
+                schema->classes_to_remove_size++;
+        }
+
+done:
         DLIST_ADD(schema->classes, obj);
         return WERR_OK;
 }
 
+WERROR dsdb_set_class_from_ldb(struct dsdb_schema *schema,
+                               struct ldb_message *msg)
+{
+        return dsdb_set_class_from_ldb_dups(schema, msg, false);
+}
+
 #define dsdb_oom(error_string, mem_ctx) *error_string = talloc_asprintf(mem_ctx, "dsdb out of memory at %s:%d\n", __FILE__, __LINE__)
 
 /* 
+ Fill a DSDB schema from the ldb results provided.  This is called
+ directly when a schema must be created with a pre-initialised prefixMap
+*/
+
+int dsdb_load_ldb_results_into_schema(TALLOC_CTX *mem_ctx, struct ldb_context *ldb,
+                                      struct dsdb_schema *schema,
+                                      struct ldb_result *attrs_class_res,
+                                      char **error_string)
+{
+        unsigned int i;
+
+        schema->ts_last_change = 0;
+        for (i=0; i < attrs_class_res->count; i++) {
+                WERROR status = dsdb_schema_set_el_from_ldb_msg(ldb, schema, attrs_class_res->msgs[i]);
+                if (!W_ERROR_IS_OK(status)) {
+                        *error_string = talloc_asprintf(mem_ctx,
+                                      "dsdb_load_ldb_results_into_schema: failed to load attribute or class definition: %s:%s",
+                                      ldb_dn_get_linearized(attrs_class_res->msgs[i]->dn),
+                                      win_errstr(status));
+                        DEBUG(0,(__location__ ": %s\n", *error_string));
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+        }
+
+        return LDB_SUCCESS;
+}
+
+/*
  Create a DSDB schema from the ldb results provided.  This is called
  directly when the schema is provisioned from an on-disk LDIF file, or
@@ -782 +889 @@
 int dsdb_schema_from_ldb_results(TALLOC_CTX *mem_ctx, struct ldb_context *ldb,
                                  struct ldb_result *schema_res,
-                                 struct ldb_result *attrs_res, struct ldb_result *objectclass_res, 
+                                 struct ldb_result *attrs_class_res,
                                  struct dsdb_schema **schema_out,
                                  char **error_string)
 {
         WERROR status;
-        unsigned int i;
         const struct ldb_val *prefix_val;
         const struct ldb_val *info_val;
         struct ldb_val info_val_default;
         struct dsdb_schema *schema;
-
-        schema = dsdb_new_schema(mem_ctx);
+        void *lp_opaque = ldb_get_opaque(ldb, "loadparm");
+        int ret;
+
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                dsdb_oom(error_string, mem_ctx);
+                return ldb_operr(ldb);
+        }
+
+        schema = dsdb_new_schema(tmp_ctx);
         if (!schema) {
                 dsdb_oom(error_string, mem_ctx);
+                talloc_free(tmp_ctx);
                 return ldb_operr(ldb);
         }
 
-        schema->base_dn = talloc_steal(schema, schema_res->msgs[0]->dn);
+        if (lp_opaque) {
+                struct loadparm_context *lp_ctx = talloc_get_type_abort(lp_opaque, struct loadparm_context);
+                schema->refresh_interval = lpcfg_parm_int(lp_ctx, NULL, "dsdb", "schema_reload_interval", schema->refresh_interval);
+                lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
+                                         struct loadparm_context);
+                schema->fsmo.update_allowed = lpcfg_parm_bool(lp_ctx, NULL,
+                                                              "dsdb", "schema update allowed",
+                                                              false);
+        }
 
         prefix_val = ldb_msg_find_ldb_val(schema_res->msgs[0], "prefixMap");
@@ -806 +929 @@
                                                 "schema_fsmo_init: no prefixMap attribute found");
                 DEBUG(0,(__location__ ": %s\n", *error_string));
+                talloc_free(tmp_ctx);
                 return LDB_ERR_CONSTRAINT_VIOLATION;
         }
@@ -816 +940 @@
                                                         win_errstr(status));
                         DEBUG(0,(__location__ ": %s\n", *error_string));
+                        talloc_free(tmp_ctx);
                         return ldb_operr(ldb);
                 }
@@ -827 +952 @@
                               win_errstr(status));
                 DEBUG(0,(__location__ ": %s\n", *error_string));
+                talloc_free(tmp_ctx);
                 return LDB_ERR_CONSTRAINT_VIOLATION;
         }
 
-        for (i=0; i < attrs_res->count; i++) {
-                status = dsdb_attribute_from_ldb(ldb, schema, attrs_res->msgs[i]);
-                if (!W_ERROR_IS_OK(status)) {
-                        *error_string = talloc_asprintf(mem_ctx, 
-                                      "schema_fsmo_init: failed to load attribute definition: %s:%s",
-                                      ldb_dn_get_linearized(attrs_res->msgs[i]->dn),
-                                      win_errstr(status));
-                        DEBUG(0,(__location__ ": %s\n", *error_string));
-                        return LDB_ERR_CONSTRAINT_VIOLATION;
-                }
-        }
-
-        for (i=0; i < objectclass_res->count; i++) {
-                status = dsdb_class_from_ldb(schema, objectclass_res->msgs[i]);
-                if (!W_ERROR_IS_OK(status)) {
-                        *error_string = talloc_asprintf(mem_ctx, 
-                                      "schema_fsmo_init: failed to load class definition: %s:%s",
-                                      ldb_dn_get_linearized(objectclass_res->msgs[i]->dn),
-                                      win_errstr(status));
-                        DEBUG(0,(__location__ ": %s\n", *error_string));
-                        return LDB_ERR_CONSTRAINT_VIOLATION;
-                }
+        ret = dsdb_load_ldb_results_into_schema(mem_ctx, ldb, schema, attrs_class_res, error_string);
+        if (ret != LDB_SUCCESS) {
+                talloc_free(tmp_ctx);
+                return ret;
         }
 
         schema->fsmo.master_dn = ldb_msg_find_attr_as_dn(ldb, schema, schema_res->msgs[0], "fSMORoleOwner");
-        if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), schema->fsmo.master_dn) == 0) {
+        if (ldb_dn_compare(samdb_ntds_settings_dn(ldb, tmp_ctx), schema->fsmo.master_dn) == 0) {
                 schema->fsmo.we_are_master = true;
         } else {
@@ -861 +969 @@
         }
 
-        DEBUG(5, ("schema_fsmo_init: we are master: %s\n",
-                  (schema->fsmo.we_are_master?"yes":"no")));
-
-        *schema_out = schema;
+        DEBUG(5, ("schema_fsmo_init: we are master[%s] updates allowed[%s]\n",
+                  (schema->fsmo.we_are_master?"yes":"no"),
+                  (schema->fsmo.update_allowed?"yes":"no")));
+
+        *schema_out = talloc_steal(mem_ctx, schema);
+        talloc_free(tmp_ctx);
         return LDB_SUCCESS;
 }

vendor/current/source4/dsdb/schema/schema_prefixmap.c

@@ -156 +156 @@
 
         /* dup memory for bin-oid prefix to be added */
-        bin_oid = data_blob_dup_talloc(pfm, &bin_oid);
+        bin_oid = data_blob_dup_talloc(pfm, bin_oid);
         W_ERROR_HAVE_NO_MEMORY(bin_oid.data);
 
@@ -312 +312 @@
                 /* return error in read-only mode */
                 if (!can_change_pfm) {
+                        DEBUG(0, ("Unable to convert %s to an attid, and can_change_pfm=false!\n", oid));
                         return werr;
                 }
@@ -616 +617 @@
         /* copy entries from schema_prefixMap */
         for (i = 0; i < pfm->length; i++) {
-                blob = data_blob_dup_talloc(ctr, &pfm->prefixes[i].bin_oid);
+                blob = data_blob_dup_talloc(ctr, pfm->prefixes[i].bin_oid);
                 if (!blob.data) {
                         talloc_free(ctr);

vendor/current/source4/dsdb/schema/schema_query.c

@@ -23 +23 @@
 #include "includes.h"
 #include "dsdb/samdb/samdb.h"
+#include <ldb_module.h>
 #include "lib/util/binsearch.h"
 #include "lib/util/tsort.h"
+#include "util/dlinklist.h"
 
 static const char **dsdb_full_attribute_list_internal(TALLOC_CTX *mem_ctx, 
@@ -329 +331 @@
 }
 
-/* Return a full attribute list for a given class list (as a ldb_message_element)
+/* Return a full attribute list for a given class list
 
    Via attribute_list_from_class() this calls itself when recursing on auxiliary classes
@@ -444 +446 @@
         return &attr->schemaIDGUID;
 }
+
+/*
+ * Sort a "objectClass" attribute (LDB message element "objectclass_element")
+ * into correct order and validate that all object classes specified actually
+ * exist in the schema.
+ * The output is written in an existing LDB message element
+ * "out_objectclass_element" where the values will be allocated on "mem_ctx".
+ */
+int dsdb_sort_objectClass_attr(struct ldb_context *ldb,
+                               const struct dsdb_schema *schema,
+                               const struct ldb_message_element *objectclass_element,
+                               TALLOC_CTX *mem_ctx,
+                               struct ldb_message_element *out_objectclass_element)
+{
+        unsigned int i, lowest;
+        struct class_list {
+                struct class_list *prev, *next;
+                const struct dsdb_class *objectclass;
+        } *unsorted = NULL, *sorted = NULL, *current = NULL,
+          *poss_parent = NULL, *new_parent = NULL,
+          *current_lowest = NULL, *current_lowest_struct = NULL;
+        struct ldb_message_element *el;
+        TALLOC_CTX *tmp_mem_ctx;
+
+        tmp_mem_ctx = talloc_new(mem_ctx);
+        if (tmp_mem_ctx == NULL) {
+                return ldb_oom(ldb);
+        }
+
+        /*
+         * DESIGN:
+         *
+         * We work on 4 different 'bins' (implemented here as linked lists):
+         *
+         * * sorted:       the eventual list, in the order we wish to push
+         *                 into the database.  This is the only ordered list.
+         *
+         * * parent_class: The current parent class 'bin' we are
+         *                 trying to find subclasses for
+         *
+         * * subclass:     The subclasses we have found so far
+         *
+         * * unsorted:     The remaining objectClasses
+         *
+         * The process is a matter of filtering objectClasses up from
+         * unsorted into sorted.  Order is irrelevent in the later 3 'bins'.
+         *
+         * We start with 'top' (found and promoted to parent_class
+         * initially).  Then we find (in unsorted) all the direct
+         * subclasses of 'top'.  parent_classes is concatenated onto
+         * the end of 'sorted', and subclass becomes the list in
+         * parent_class.
+         *
+         * We then repeat, until we find no more subclasses.  Any left
+         * over classes are added to the end.
+         *
+         */
+
+        /*
+         * Firstly, dump all the "objectClass" values into the unsorted bin,
+         * except for 'top', which is special
+         */
+        for (i=0; i < objectclass_element->num_values; i++) {
+                current = talloc(tmp_mem_ctx, struct class_list);
+                if (!current) {
+                        talloc_free(tmp_mem_ctx);
+                        return ldb_oom(ldb);
+                }
+                current->objectclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &objectclass_element->values[i]);
+                if (!current->objectclass) {
+                        ldb_asprintf_errstring(ldb, "objectclass %.*s is not a valid objectClass in schema",
+                                               (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
+                        /* This looks weird, but windows apparently returns this for invalid objectClass values */
+                        talloc_free(tmp_mem_ctx);
+                        return LDB_ERR_NO_SUCH_ATTRIBUTE;
+                } else if (current->objectclass->isDefunct) {
+                        ldb_asprintf_errstring(ldb, "objectclass %.*s marked as isDefunct objectClass in schema - not valid for new objects",
+                                               (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
+                        /* This looks weird, but windows apparently returns this for invalid objectClass values */
+                        talloc_free(tmp_mem_ctx);
+                        return LDB_ERR_NO_SUCH_ATTRIBUTE;
+                }
+
+                /* Don't add top to list, we will do that later */
+                if (ldb_attr_cmp("top", current->objectclass->lDAPDisplayName) != 0) {
+                        DLIST_ADD_END(unsorted, current);
+                }
+        }
+
+
+        /* Add top here, to prevent duplicates */
+        current = talloc(tmp_mem_ctx, struct class_list);
+        current->objectclass = dsdb_class_by_lDAPDisplayName(schema, "top");
+        DLIST_ADD_END(sorted, current);
+
+        /* For each object: find parent chain */
+        for (current = unsorted; current != NULL; current = current->next) {
+                for (poss_parent = unsorted; poss_parent; poss_parent = poss_parent->next) {
+                        if (ldb_attr_cmp(poss_parent->objectclass->lDAPDisplayName, current->objectclass->subClassOf) == 0) {
+                                break;
+                        }
+                }
+                /* If we didn't get to the end of the list, we need to add this parent */
+                if (poss_parent || (ldb_attr_cmp("top", current->objectclass->subClassOf) == 0)) {
+                        continue;
+                }
+
+                new_parent = talloc(tmp_mem_ctx, struct class_list);
+                new_parent->objectclass = dsdb_class_by_lDAPDisplayName(schema, current->objectclass->subClassOf);
+                DLIST_ADD_END(unsorted, new_parent);
+        }
+
+        /* For each object: order by hierarchy */
+        while (unsorted != NULL) {
+                lowest = UINT_MAX;
+                current_lowest = current_lowest_struct = NULL;
+                for (current = unsorted; current != NULL; current = current->next) {
+                        if (current->objectclass->subClass_order <= lowest) {
+                                /*
+                                 * According to MS-ADTS 3.1.1.1.4 structural
+                                 * and 88 object classes are always listed after
+                                 * the other class types in a subclass hierarchy
+                                 */
+                                if (current->objectclass->objectClassCategory > 1) {
+                                        current_lowest = current;
+                                } else {
+                                        current_lowest_struct = current;
+                                }
+                                lowest = current->objectclass->subClass_order;
+                        }
+                }
+                if (current_lowest == NULL) {
+                        current_lowest = current_lowest_struct;
+                }
+
+                if (current_lowest != NULL) {
+                        DLIST_REMOVE(unsorted,current_lowest);
+                        DLIST_ADD_END(sorted,current_lowest);
+                }
+        }
+
+        /* Now rebuild the sorted "objectClass" message element */
+        el = out_objectclass_element;
+
+        el->flags = objectclass_element->flags;
+        el->name = talloc_strdup(mem_ctx, objectclass_element->name);
+        if (el->name == NULL) {
+                talloc_free(tmp_mem_ctx);
+                return ldb_oom(ldb);
+        }
+        el->num_values = 0;
+        el->values = NULL;
+        for (current = sorted; current != NULL; current = current->next) {
+                el->values = talloc_realloc(mem_ctx, el->values,
+                                            struct ldb_val, el->num_values + 1);
+                if (el->values == NULL) {
+                        talloc_free(tmp_mem_ctx);
+                        return ldb_oom(ldb);
+                }
+                el->values[el->num_values] = data_blob_string_const(current->objectclass->lDAPDisplayName);
+
+                ++(el->num_values);
+        }
+
+        talloc_free(tmp_mem_ctx);
+        return LDB_SUCCESS;
+}

vendor/current/source4/dsdb/schema/schema_set.c

@@ -5 +5 @@
    Copyright (C) Stefan Metzmacher <metze@samba.org> 2006-2007
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2008
+   Copyright (C) Matthieu Patou <mat@matws.net> 2011
 
    This program is free software; you can redistribute it and/or modify
@@ -30 +31 @@
 #include "lib/util/tsort.h"
 
+/* change this when we change something in our schema code that
+ * requires a re-index of the database
+ */
+#define SAMDB_INDEXING_VERSION "2"
+
 /*
   override the name to attribute handler function
@@ -45 +51 @@
         return a->ldb_schema_attribute;
 }
-
-static int dsdb_schema_set_attributes(struct ldb_context *ldb, struct dsdb_schema *schema, bool write_attributes)
+/*
+ * Set the attribute handlers onto the LDB, and potentially write the
+ * @INDEXLIST, @IDXONE and @ATTRIBUTES records.  The @ATTRIBUTES records
+ * are required so we can operate on a schema-less database (say the
+ * backend during emergency fixes) and during the schema load.
+ */
+static int dsdb_schema_set_indices_and_attributes(struct ldb_context *ldb, struct dsdb_schema *schema, bool write_indices_and_attributes)
 {
         int ret = LDB_SUCCESS;
@@ -60 +71 @@
         ldb_schema_attribute_set_override_handler(ldb, dsdb_attribute_handler_override, schema);
 
-        if (!write_attributes) {
+        if (!write_indices_and_attributes) {
                 return ret;
         }
@@ -91 +102 @@
 
         ret = ldb_msg_add_string(msg_idx, "@IDXONE", "1");
+        if (ret != LDB_SUCCESS) {
+                goto op_error;
+        }
+
+
+        ret = ldb_msg_add_string(msg_idx, "@IDXVERSION", SAMDB_INDEXING_VERSION);
         if (ret != LDB_SUCCESS) {
                 goto op_error;
@@ -200 +217 @@
 }
 
+
+/*
+  create extra attribute shortcuts
+ */
+static void dsdb_setup_attribute_shortcuts(struct ldb_context *ldb, struct dsdb_schema *schema)
+{
+        struct dsdb_attribute *attribute;
+
+        /* setup fast access to one_way_link and DN format */
+        for (attribute=schema->attributes; attribute; attribute=attribute->next) {
+                attribute->dn_format = dsdb_dn_oid_to_format(attribute->syntax->ldap_oid);
+
+                if (attribute->dn_format == DSDB_INVALID_DN) {
+                        attribute->one_way_link = false;
+                        continue;
+                }
+
+                /* these are not considered to be one way links for
+                   the purpose of DN link fixups */
+                if (ldb_attr_cmp("distinguishedName", attribute->lDAPDisplayName) == 0 ||
+                    ldb_attr_cmp("objectCategory", attribute->lDAPDisplayName) == 0) {
+                        attribute->one_way_link = false;
+                        continue;
+                }
+
+                if (attribute->linkID == 0) {
+                        attribute->one_way_link = true;
+                        continue;
+                }
+                /* handle attributes with a linkID but no backlink */
+                if ((attribute->linkID & 1) == 0 &&
+                    dsdb_attribute_by_linkID(schema, attribute->linkID + 1) == NULL) {
+                        attribute->one_way_link = true;
+                        continue;
+                }
+                attribute->one_way_link = false;
+        }
+}
+
 static int uint32_cmp(uint32_t c1, uint32_t c2)
 {
@@ -272 +328 @@
         unsigned int i;
         unsigned int num_int_id;
+        int ret;
+
+        for (i=0; i < schema->classes_to_remove_size; i++) {
+                DLIST_REMOVE(schema->classes, schema->classes_to_remove[i]);
+                TALLOC_FREE(schema->classes_to_remove[i]);
+        }
+        for (i=0; i < schema->attributes_to_remove_size; i++) {
+                DLIST_REMOVE(schema->attributes, schema->attributes_to_remove[i]);
+                TALLOC_FREE(schema->attributes_to_remove[i]);
+        }
+
+        TALLOC_FREE(schema->classes_to_remove);
+        schema->classes_to_remove_size = 0;
+        TALLOC_FREE(schema->attributes_to_remove);
+        schema->attributes_to_remove_size = 0;
 
         /* free all caches */
@@ -354 +425 @@
         TYPESAFE_QSORT(schema->attributes_by_linkID, schema->num_attributes, dsdb_compare_attribute_by_linkID);
 
+        dsdb_setup_attribute_shortcuts(ldb, schema);
+
+        ret = schema_fill_constructed(schema);
+        if (ret != LDB_SUCCESS) {
+                dsdb_sorted_accessors_free(schema);
+                return ret;
+        }
+
         return LDB_SUCCESS;
 
@@ -361 +440 @@
 }
 
-int dsdb_setup_schema_inversion(struct ldb_context *ldb, struct dsdb_schema *schema)
-{
-        /* Walk the list of schema classes */
-
-        /*  For each subClassOf, add us to subclasses of the parent */
-
-        /* collect these subclasses into a recursive list of total subclasses, preserving order */
-
-        /* For each subclass under 'top', write the index from it's
-         * order as an integer in the dsdb_class (for sorting
-         * objectClass lists efficiently) */
-
-        /* Walk the list of schema classes */
-
-        /*  Create a 'total possible superiors' on each class */
-        return LDB_SUCCESS;
-}
-
 /**
  * Attach the schema to an opaque pointer on the ldb,
  * so ldb modules can find it
  */
+int dsdb_set_schema_refresh_function(struct ldb_context *ldb,
+                                     dsdb_schema_refresh_fn refresh_fn,
+                                     struct ldb_module *module)
+{
+        int ret = ldb_set_opaque(ldb, "dsdb_schema_refresh_fn", refresh_fn);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        ret = ldb_set_opaque(ldb, "dsdb_schema_refresh_fn_private_data", module);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        return LDB_SUCCESS;
+}
+
+/**
+ * Attach the schema to an opaque pointer on the ldb,
+ * so ldb modules can find it
+ */
 int dsdb_set_schema(struct ldb_context *ldb, struct dsdb_schema *schema)
 {
@@ -389 +470 @@
 
         ret = dsdb_setup_sorted_accessors(ldb, schema);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-
-        ret = schema_fill_constructed(schema);
         if (ret != LDB_SUCCESS) {
                 return ret;
@@ -412 +488 @@
         }
 
+        talloc_steal(ldb, schema);
+
         ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", NULL);
         if (ret != LDB_SUCCESS) {
@@ -418 +496 @@
 
         /* Set the new attributes based on the new schema */
-        ret = dsdb_schema_set_attributes(ldb, schema, true);
+        ret = dsdb_schema_set_indices_and_attributes(ldb, schema, true);
         if (ret != LDB_SUCCESS) {
                 return ret;
@@ -433 +511 @@
 /**
  * Make this ldb use a specified schema, already fully calculated and belonging to another ldb
+ *
+ * The write_indices_and_attributes controls writing of the @ records
+ * because we cannot write to a database that does not yet exist on
+ * disk.
  */
 int dsdb_reference_schema(struct ldb_context *ldb, struct dsdb_schema *schema,
-                          bool write_attributes)
+                          bool write_indices_and_attributes)
 {
         int ret;
@@ -459 +541 @@
         }
 
-        ret = dsdb_schema_set_attributes(ldb, schema, write_attributes);
+        ret = ldb_set_opaque(ldb, "dsdb_refresh_fn", NULL);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        ret = ldb_set_opaque(ldb, "dsdb_refresh_fn_private_data", NULL);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        ret = dsdb_schema_set_indices_and_attributes(ldb, schema, write_indices_and_attributes);
         if (ret != LDB_SUCCESS) {
                 return ret;
@@ -474 +566 @@
         int ret;
         void *use_global_schema = (void *)1;
-        if (!global_schema) {
+        ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", use_global_schema);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        if (global_schema == NULL) {
                 return LDB_SUCCESS;
         }
-        ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", use_global_schema);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
 
         /* Set the new attributes based on the new schema */
-        ret = dsdb_schema_set_attributes(ldb, global_schema, false /* Don't write attributes, it's expensive */);
+        ret = dsdb_schema_set_indices_and_attributes(ldb, global_schema, false /* Don't write indices and attributes, it's expensive */);
         if (ret == LDB_SUCCESS) {
                 /* Keep a reference to this schema, just in case the original copy is replaced */
@@ -508 +601 @@
 {
         const void *p;
-        struct dsdb_schema *schema_out;
-        struct dsdb_schema *schema_in;
+        struct dsdb_schema *schema_out = NULL;
+        struct dsdb_schema *schema_in = NULL;
+        dsdb_schema_refresh_fn refresh_fn;
+        struct ldb_module *loaded_from_module;
         bool use_global_schema;
         TALLOC_CTX *tmp_ctx = talloc_new(reference_ctx);
-        if (!tmp_ctx) {
+        if (tmp_ctx == NULL) {
                 return NULL;
         }
@@ -522 +617 @@
         } else {
                 p = ldb_get_opaque(ldb, "dsdb_schema");
-
-                schema_in = talloc_get_type(p, struct dsdb_schema);
-                if (!schema_in) {
-                        talloc_free(tmp_ctx);
-                        return NULL;
-                }
-        }
-
-        if (schema_in->refresh_fn && !schema_in->refresh_in_progress) {
-                if (!talloc_reference(tmp_ctx, schema_in)) {
-                        /*
-                         * ensure that the schema_in->refresh_in_progress
-                         * remains valid for the right amount of time
-                         */
-                        talloc_free(tmp_ctx);
-                        return NULL;
-                }
-                schema_in->refresh_in_progress = true;
-                /* This may change schema, if it needs to reload it from disk */
-                schema_out = schema_in->refresh_fn(schema_in->loaded_from_module,
-                                                   schema_in,
-                                                   use_global_schema);
-                schema_in->refresh_in_progress = false;
+                if (p != NULL) {
+                        schema_in = talloc_get_type_abort(p, struct dsdb_schema);
+                }
+        }
+
+        refresh_fn = ldb_get_opaque(ldb, "dsdb_schema_refresh_fn");
+        if (refresh_fn) {
+                loaded_from_module = ldb_get_opaque(ldb, "dsdb_schema_refresh_fn_private_data");
+
+                SMB_ASSERT(loaded_from_module && (ldb_module_get_ctx(loaded_from_module) == ldb));
+        }
+
+        if (refresh_fn) {
+                /* We need to guard against recurisve calls here */
+                if (ldb_set_opaque(ldb, "dsdb_schema_refresh_fn", NULL) != LDB_SUCCESS) {
+                        ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                      "dsdb_get_schema: clearing dsdb_schema_refresh_fn failed");
+                } else {
+                        schema_out = refresh_fn(loaded_from_module,
+                                                ldb_get_event_context(ldb),
+                                                schema_in,
+                                                use_global_schema);
+                }
+                if (ldb_set_opaque(ldb, "dsdb_schema_refresh_fn", refresh_fn) != LDB_SUCCESS) {
+                        ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                      "dsdb_get_schema: re-setting dsdb_schema_refresh_fn failed");
+                }
+                if (!schema_out) {
+                        schema_out = schema_in;
+                        ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                      "dsdb_get_schema: refresh_fn() failed");
+                }
         } else {
                 schema_out = schema_in;
@@ -624 +728 @@
 
 /**
- * Add an element to the schema (attribute or class) from an LDB message
- */
-WERROR dsdb_schema_set_el_from_ldb_msg(struct ldb_context *ldb, struct dsdb_schema *schema,
-                                       struct ldb_message *msg)
-{
+ * @brief Add a new element to the schema and checks if it's a duplicate
+ *
+ * This function will add a new element to the schema and checks for existing
+ * duplicates.
+ *
+ * @param[in]  ldb                A pointer to an LDB context
+ *
+ * @param[in]  schema             A pointer to the dsdb_schema where the element
+ *                                will be added.
+ *
+ * @param[in]  msg                The ldb_message object representing the element
+ *                                to add.
+ *
+ * @param[in]  checkdups          A boolean to indicate if checks for duplicates
+ *                                should be done.
+ *
+ * @return                        A WERROR code
+ */
+WERROR dsdb_schema_set_el_from_ldb_msg_dups(struct ldb_context *ldb, struct dsdb_schema *schema,
+                                            struct ldb_message *msg, bool checkdups)
+{
+        const char* tstring;
+        time_t ts;
+        tstring = ldb_msg_find_attr_as_string(msg, "whenChanged", NULL);
+        /* keep a trace of the ts of the most recently changed object */
+        if (tstring) {
+                ts = ldb_string_to_time(tstring);
+                if (ts > schema->ts_last_change) {
+                        schema->ts_last_change = ts;
+                }
+        }
         if (samdb_find_attribute(ldb, msg,
                                  "objectclass", "attributeSchema") != NULL) {
-                return dsdb_attribute_from_ldb(ldb, schema, msg);
+
+                return dsdb_set_attribute_from_ldb_dups(ldb, schema, msg, checkdups);
         } else if (samdb_find_attribute(ldb, msg,
                                  "objectclass", "classSchema") != NULL) {
-                return dsdb_class_from_ldb(schema, msg);
-        }
-
+                return dsdb_set_class_from_ldb_dups(schema, msg, checkdups);
+        }
         /* Don't fail on things not classes or attributes */
         return WERR_OK;
+}
+
+WERROR dsdb_schema_set_el_from_ldb_msg(struct ldb_context *ldb,
+                                       struct dsdb_schema *schema,
+                                       struct ldb_message *msg)
+{
+        return dsdb_schema_set_el_from_ldb_msg_dups(ldb, schema, msg, false);
 }
 
@@ -647 +784 @@
  */
 
-WERROR dsdb_set_schema_from_ldif(struct ldb_context *ldb, const char *pf, const char *df)
+WERROR dsdb_set_schema_from_ldif(struct ldb_context *ldb,
+                                 const char *pf, const char *df,
+                                 const char *dn)
 {
         struct ldb_ldif *ldif;
@@ -666 +805 @@
 
         schema = dsdb_new_schema(mem_ctx);
-
+        if (!schema) {
+                goto nomem;
+        }
         schema->fsmo.we_are_master = true;
-        schema->fsmo.master_dn = ldb_dn_new_fmt(schema, ldb, "@PROVISION_SCHEMA_MASTER");
+        schema->fsmo.update_allowed = true;
+        schema->fsmo.master_dn = ldb_dn_new(schema, ldb, "@PROVISION_SCHEMA_MASTER");
         if (!schema->fsmo.master_dn) {
                 goto nomem;
@@ -708 +850 @@
         }
 
+        schema->ts_last_change = 0;
         /* load the attribute and class definitions out of df */
         while ((ldif = ldb_ldif_read_string(ldb, &df))) {

vendor/current/source4/dsdb/schema/schema_syntax.c

@@ -210 +210 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -230 +230 @@
                 W_ERROR_HAVE_NO_MEMORY(blobs[i].data);
 
-                if (strcmp("TRUE", (const char *)in->values[i].data) == 0) {
+                if (in->values[i].length >= 4 &&
+                    strncmp("TRUE", (const char *)in->values[i].data, in->values[i].length) == 0) {
                         SIVAL(blobs[i].data, 0, 0x00000001);
-                } else if (strcmp("FALSE", (const char *)in->values[i].data) == 0) {
+                } else if (in->values[i].length >= 5 &&
+                           strncmp("FALSE", (const char *)in->values[i].data, in->values[i].length) == 0) {
                         SIVAL(blobs[i].data, 0, 0x00000000);
                 } else {
@@ -249 +251 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
         for (i=0; i < in->num_values; i++) {
-                int t, f;
-
-                t = strncmp("TRUE",
+                if (in->values[i].length == 0) {
+                        return WERR_DS_INVALID_ATTRIBUTE_SYNTAX;
+                }
+
+                if (in->values[i].length >= 4 &&
+                    strncmp("TRUE",
                             (const char *)in->values[i].data,
-                            in->values[i].length);
-                f = strncmp("FALSE",
+                            in->values[i].length) == 0) {
+                        continue;
+                }
+                if (in->values[i].length >= 5 &&
+                    strncmp("FALSE",
                             (const char *)in->values[i].data,
-                            in->values[i].length);
-
-                if (t != 0 && f != 0) {
-                        return WERR_DS_INVALID_ATTRIBUTE_SYNTAX;
-                }
+                            in->values[i].length) == 0) {
+                        continue;
+                }
+                return WERR_DS_INVALID_ATTRIBUTE_SYNTAX;
         }
 
@@ -319 +326 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -358 +365 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -446 +453 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -483 +490 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -551 +558 @@
 
                 v = BVAL(in->value_ctr.values[i].blob->data, 0);
+                if (v == 0) {
+                        /* special case for 1601 zero timestamp */
+                        out->values[i] = data_blob_string_const("16010101000000.0Z");
+                        continue;
+                }
                 v *= 10000000;
                 t = nt_time_to_unix(v);
@@ -581 +593 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -604 +616 @@
                 W_ERROR_HAVE_NO_MEMORY(blobs[i].data);
 
+                if (ldb_val_string_cmp(&in->values[i], "16010101000000.0Z") == 0) {
+                        SBVALS(blobs[i].data, 0, 0);
+                        continue;
+                }
+
                 t = ldb_string_utc_to_time((const char *)in->values[i].data);
                 unix_to_nt_time(&v, t);
@@ -621 +638 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -634 +651 @@
                 memcpy(buf, in->values[i].data, in->values[i].length);
 
-                errno = 0;
                 t = ldb_string_utc_to_time(buf);
-                if (errno != 0) {
+                if (t == 0) {
                         return WERR_DS_INVALID_ATTRIBUTE_SYNTAX;
                 }
@@ -691 +707 @@
 
                 v = BVAL(in->value_ctr.values[i].blob->data, 0);
+                if (v == 0) {
+                        /* special case for 1601 zero timestamp */
+                        out->values[i] = data_blob_string_const("16010101000000.0Z");
+                        continue;
+                }
                 v *= 10000000;
                 t = nt_time_to_unix(v);
@@ -713 +734 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -737 +758 @@
                 W_ERROR_HAVE_NO_MEMORY(blobs[i].data);
 
+                if (ldb_val_string_cmp(&in->values[i], "16010101000000.0Z") == 0) {
+                        SBVALS(blobs[i].data, 0, 0);
+                        continue;
+                }
+
                 ret = ldb_val_to_time(&in->values[i], &t);
                 if (ret != LDB_SUCCESS) {
@@ -757 +783 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -776 +802 @@
 
                 if (attr->rangeUpper) {
-                        if ((int32_t)t > (int32_t)*attr->rangeLower) {
+                        if ((int32_t)t > (int32_t)*attr->rangeUpper) {
                                 return WERR_DS_INVALID_ATTRIBUTE_SYNTAX;
                         }
@@ -811 +837 @@
 
                 out->values[i] = data_blob_dup_talloc(out->values,
-                                                      in->value_ctr.values[i].blob);
+                                                      *in->value_ctr.values[i].blob);
                 W_ERROR_HAVE_NO_MEMORY(out->values[i].data);
         }
@@ -828 +854 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -845 +871 @@
                 out->value_ctr.values[i].blob   = &blobs[i];
 
-                blobs[i] = data_blob_dup_talloc(blobs, &in->values[i]);
+                blobs[i] = data_blob_dup_talloc(blobs, in->values[i]);
                 W_ERROR_HAVE_NO_MEMORY(blobs[i].data);
         }
@@ -857 +883 @@
 {
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -883 +909 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -1029 +1055 @@
 
                 if (in->value_ctr.values[i].blob == NULL) {
+                        DEBUG(0, ("Attribute has no value\n"));
                         return WERR_FOOBAR;
                 }
 
                 if (in->value_ctr.values[i].blob->length != 4) {
+                        DEBUG(0, ("Attribute has a value with 0 length\n"));
                         return WERR_FOOBAR;
                 }
@@ -1067 +1095 @@
 {
         unsigned int i;
-
-        SMB_ASSERT(ctx->pfm_remote);
+        const struct dsdb_schema_prefixmap *prefixmap;
+
+        if (ctx->pfm_remote != NULL) {
+                prefixmap = ctx->pfm_remote;
+        } else {
+                prefixmap = ctx->schema->prefixmap;
+        }
+        SMB_ASSERT(prefixmap);
 
         out->flags      = 0;
@@ -1093 +1127 @@
                 attid = IVAL(in->value_ctr.values[i].blob->data, 0);
 
-                status = dsdb_schema_pfm_oid_from_attid(ctx->pfm_remote, attid,
+                status = dsdb_schema_pfm_oid_from_attid(prefixmap, attid,
                                                         out->values, &oid);
                 if (!W_ERROR_IS_OK(status)) {
@@ -1233 +1267 @@
                 obj_attr = dsdb_attribute_by_lDAPDisplayName(ctx->schema, (const char *)in->values[i].data);
                 if (!obj_attr) {
+                        DEBUG(0, ("Unable to find attribute %s in the schema\n", (const char *)in->values[i].data));
                         return WERR_FOOBAR;
                 }
@@ -1335 +1370 @@
 {
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -1380 +1415 @@
                 const char *oid = (const char*)in->values[i].data;
 
+                if (in->values[i].length == 0) {
+                        talloc_free(tmp_ctx);
+                        return WERR_DS_INVALID_ATTRIBUTE_SYNTAX;
+                }
+
                 if (!ber_write_OID_String(tmp_ctx, &blob, oid)) {
                         DEBUG(0,("ber_write_OID_String() failed for %s\n", oid));
@@ -1413 +1453 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -1471 +1511 @@
 
         for (i=0; i < out->num_values; i++) {
+                size_t converted_size = 0;
                 char *str;
 
@@ -1485 +1526 @@
                                            in->value_ctr.values[i].blob->data,
                                            in->value_ctr.values[i].blob->length,
-                                           (void **)&str, NULL, false)) {
-                        return WERR_FOOBAR;
-                }
-
-                out->values[i] = data_blob_string_const(str);
+                                           (void **)&str, &converted_size)) {
+                        return WERR_FOOBAR;
+                }
+
+                out->values[i] = data_blob_const(str, converted_size);
         }
 
@@ -1505 +1546 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -1525 +1566 @@
                                            CH_UNIX, CH_UTF16,
                                            in->values[i].data, in->values[i].length,
-                                           (void **)&blobs[i].data, &blobs[i].length, false)) {
+                                           (void **)&blobs[i].data, &blobs[i].length)) {
                         return WERR_FOOBAR;
                 }
@@ -1542 +1583 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -1550 +1591 @@
                                    val->length,
                                    (void **)&dst,
-                                   &size, false);
+                                   &size);
         TALLOC_FREE(dst);
         if (!ok) {
@@ -1579 +1620 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -1718 +1759 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -1800 +1841 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -1883 +1924 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -1969 +2010 @@
                 }
 
-                status = GUID_to_ndr_blob(&id3.guid, tmp_ctx, &guid_blob);
-                if (!NT_STATUS_IS_OK(status)) {
-                        talloc_free(tmp_ctx);
-                        return ntstatus_to_werror(status);
-                }
-
-                ret = ldb_dn_set_extended_component(dn, "GUID", &guid_blob);
-                if (ret != LDB_SUCCESS) {
-                        talloc_free(tmp_ctx);
-                        return WERR_FOOBAR;
-                }
-
-                talloc_free(guid_blob.data);
+                if (!GUID_all_zero(&id3.guid)) {
+                        status = GUID_to_ndr_blob(&id3.guid, tmp_ctx, &guid_blob);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                talloc_free(tmp_ctx);
+                                return ntstatus_to_werror(status);
+                        }
+
+                        ret = ldb_dn_set_extended_component(dn, "GUID", &guid_blob);
+                        if (ret != LDB_SUCCESS) {
+                                talloc_free(tmp_ctx);
+                                return WERR_FOOBAR;
+                        }
+                        talloc_free(guid_blob.data);
+                }
 
                 if (id3.__ndr_size_sid) {
@@ -2024 +2066 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -2103 +2145 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -2173 +2215 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -2228 +2270 @@
         for (i=0; i < out->num_values; i++) {
                 size_t len;
+                size_t converted_size = 0;
                 char *str;
 
@@ -2247 +2290 @@
                                            in->value_ctr.values[i].blob->data+4,
                                            in->value_ctr.values[i].blob->length-4,
-                                           (void **)&str, NULL, false)) {
+                                           (void **)&str, &converted_size)) {
                         return WERR_FOOBAR;
                 }
@@ -2267 +2310 @@
 
         if (attr->attributeID_id == DRSUAPI_ATTID_INVALID) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 
@@ -2290 +2333 @@
                                            in->values[i].data,
                                            in->values[i].length,
-                                           (void **)&data, &ret, false)) {
+                                           (void **)&data, &ret)) {
                         return WERR_FOOBAR;
                 }
@@ -2329 +2372 @@
                 .validate_ldb           = dsdb_syntax_BOOL_validate_ldb,
                 .equality               = "booleanMatch",
-                .comment                = "Boolean"
+                .comment                = "Boolean",
+                .auto_normalise         = true
         },{
                 .name                   = "Integer",
@@ -2340 +2384 @@
                 .equality               = "integerMatch",
                 .comment                = "Integer",
-                .ldb_syntax             = LDB_SYNTAX_SAMBA_INT32
+                .ldb_syntax             = LDB_SYNTAX_SAMBA_INT32,
+                .auto_normalise         = true
         },{
                 .name                   = "String(Octet)",
@@ -2351 +2396 @@
                 .equality               = "octetStringMatch",
                 .comment                = "Octet String",
+                .userParameters         = true
         },{
                 .name                   = "String(Sid)",
@@ -2381 +2427 @@
                 .ldb_to_drsuapi         = dsdb_syntax_INT32_ldb_to_drsuapi,
                 .validate_ldb           = dsdb_syntax_INT32_validate_ldb,
-                .ldb_syntax             = LDB_SYNTAX_SAMBA_INT32
+                .ldb_syntax             = LDB_SYNTAX_SAMBA_INT32,
+                .auto_normalise         = true
         },{
         /* not used in w2k3 forest */
@@ -2437 +2484 @@
                 .equality               = "generalizedTimeMatch",
                 .comment                = "UTC Time",
+                .auto_normalise         = true
         },{
                 .name                   = "String(Generalized-Time)",
@@ -2447 +2495 @@
                 .equality               = "generalizedTimeMatch",
                 .comment                = "Generalized Time",
-                .ldb_syntax             = LDB_SYNTAX_UTC_TIME,
+                .auto_normalise         = true
         },{
         /* not used in w2k3 schema */
@@ -2486 +2534 @@
                 .comment                = "Large Integer",
                 .ldb_syntax             = LDB_SYNTAX_INTEGER,
+                .auto_normalise         = true
         },{
                 .name                   = "String(NT-Sec-Desc)",
@@ -2557 +2606 @@
         /* not used in w2k3 schema */
                 .name                   = "Object(Access-Point)",
-                .ldap_oid               = "1.3.6.1.4.1.1466.115.121.1.2",
+                .ldap_oid               = DSDB_SYNTAX_ACCESS_POINT,
                 .oMSyntax               = 127,
                 .oMObjectClass          = OMOBJECTCLASS("\x2b\x0c\x02\x87\x73\x1c\x00\x85\x3e"),
@@ -2618 +2667 @@
 
         for (i=0; i < ARRAY_SIZE(dsdb_syntaxes); i++) {
+                /*
+                 * We must pretend that userParamters was declared
+                 * binary string, so we can store the 'UTF16' (not
+                 * really string) structure as given over SAMR to samba
+                 */
+                if (dsdb_syntaxes[i].userParameters &&
+                    (strcasecmp(attr->lDAPDisplayName, "userParameters") == 0))
+                {
+                        return &dsdb_syntaxes[i];
+                }
                 if (attr->oMSyntax != dsdb_syntaxes[i].oMSyntax) continue;
 
@@ -2643 +2702 @@
                                      const struct drsuapi_DsReplicaAttribute *in,
                                      TALLOC_CTX *mem_ctx,
-                                     struct ldb_message_element *out)
+                                     struct ldb_message_element *out,
+                                     enum drsuapi_DsAttributeId *local_attid_as_enum)
 {
         const struct dsdb_attribute *sa;
@@ -2659 +2719 @@
                         DEBUG(0,(__location__ ": Can't find local ATTID for 0x%08X\n",
                                  in->attid));
-                        return WERR_FOOBAR;
+                        return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
                 }
                 break;
@@ -2676 +2736 @@
         if (!sa) {
                 DEBUG(1,(__location__ ": Unknown attributeID_id 0x%08X\n", in->attid));
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
+        }
+
+        /*
+         * We return the same class of attid as we were given.  That
+         * is, we trust the remote server not to use an
+         * msDS-IntId value in the schema partition
+         */
+        if (local_attid_as_enum != NULL) {
+                *local_attid_as_enum = (enum drsuapi_DsAttributeId)attid_local;
         }
 
@@ -2693 +2762 @@
         sa = dsdb_attribute_by_lDAPDisplayName(schema, in->name);
         if (!sa) {
-                return WERR_FOOBAR;
+                return WERR_DS_ATT_NOT_DEF_IN_SCHEMA;
         }
 

vendor/current/source4/dsdb/schema/tests/schema_syntax.c

@@ -75 +75 @@
         torture_assert(tctx, ldif, "Failed to parse LDIF for authOrig");
 
-        werr = dsdb_attribute_from_ldb(ldb, schema, ldif->msg);
+        werr = dsdb_set_attribute_from_ldb(ldb, schema, ldif->msg);
         ldb_ldif_read_free(ldb, ldif);
-        torture_assert_werr_ok(tctx, werr, "dsdb_attribute_from_ldb() failed!");
+        torture_assert_werr_ok(tctx, werr, "dsdb_set_attribute_from_ldb() failed!");
 
         ldb_res = dsdb_set_schema(ldb, schema);
@@ -206 +206 @@
         torture_assert(tctx, priv, "No memory");
 
-        priv->ldb = provision_get_schema(priv, tctx->lp_ctx, NULL);
+        priv->ldb = provision_get_schema(priv, tctx->lp_ctx, NULL, NULL);
         torture_assert(tctx, priv->ldb, "Failed to load schema from disk");