7 files changed, 134 insertions, 93 deletions

diff --git a/source4/dsdb/samdb/ldb_modules/acl.c b/source4/dsdb/samdb/ldb_modules/acl.c
index 149c6b105e..660b4df818 100644
--- a/source4/dsdb/samdb/ldb_modules/acl.c
+++ b/source4/dsdb/samdb/ldb_modules/acl.c
@@ -39,6 +39,7 @@
 #include "librpc/gen_ndr/ndr_security.h"
 #include "param/param.h"
 #include "dsdb/samdb/ldb_modules/util.h"
+#include "dsdb/samdb/ldb_modules/schema.h"
 #include "lib/util/tsort.h"
 
 struct extended_access_check_attribute {
diff --git a/source4/dsdb/samdb/ldb_modules/acl_util.c b/source4/dsdb/samdb/ldb_modules/acl_util.c
index 6c41602a82..1a84704079 100644
--- a/source4/dsdb/samdb/ldb_modules/acl_util.c
+++ b/source4/dsdb/samdb/ldb_modules/acl_util.c
@@ -178,67 +178,6 @@ fail:
 	return ldb_operr(ldb_module_get_ctx(module));
 }
 
-int acl_check_access_on_class(struct ldb_module *module,
-			      const struct dsdb_schema *schema,
-			      TALLOC_CTX *mem_ctx,
-			      struct security_descriptor *sd,
-			      struct dom_sid *rp_sid,
-			      uint32_t access,
-			      const char *class_name)
-{
-	int ret;
-	NTSTATUS status;
-	uint32_t access_granted;
-	struct object_tree *root = NULL;
-	struct object_tree *new_node = NULL;
-	const struct GUID *guid;
-	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
-	struct security_token *token = acl_user_token(module);
-	if (class_name) {
-		guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
-		if (!guid) {
-			DEBUG(10, ("acl_search: cannot find class %s\n",
-				   class_name));
-			goto fail;
-		}
-		if (!insert_in_object_tree(tmp_ctx,
-					   guid, access,
-					   &root, &new_node)) {
-			DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
-			goto fail;
-		}
-	}
-	status = sec_access_check_ds(sd, token,
-				     access,
-				     &access_granted,
-				     root,
-				     rp_sid);
-	if (!NT_STATUS_IS_OK(status)) {
-		ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
-	}
-	else {
-		ret = LDB_SUCCESS;
-	}
-	return ret;
-fail:
-	return ldb_operr(ldb_module_get_ctx(module));
-}
-
-const struct GUID *get_oc_guid_from_message(struct ldb_module *module,
-						   const struct dsdb_schema *schema,
-						   struct ldb_message *msg)
-{
-	struct ldb_message_element *oc_el;
-
-	oc_el = ldb_msg_find_element(msg, "objectClass");
-	if (!oc_el) {
-		return NULL;
-	}
-
-	return class_schemaid_guid_by_lDAPDisplayName(schema,
-						      (char *)oc_el->values[oc_el->num_values-1].data);
-}
-
 
 /* checks for validated writes */
 int acl_check_extended_right(TALLOC_CTX *mem_ctx,
diff --git a/source4/dsdb/samdb/ldb_modules/descriptor.c b/source4/dsdb/samdb/ldb_modules/descriptor.c
index 959a7d8cd1..c94d6bdf0b 100644
--- a/source4/dsdb/samdb/ldb_modules/descriptor.c
+++ b/source4/dsdb/samdb/ldb_modules/descriptor.c
@@ -39,6 +39,7 @@
 #include "librpc/ndr/libndr.h"
 #include "librpc/gen_ndr/ndr_security.h"
 #include "libcli/security/security.h"
+#include "dsdb/samdb/ldb_modules/schema.h"
 #include "auth/auth.h"
 #include "param/param.h"
 #include "util.h"
diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c
index fa956269f4..940290bace 100644
--- a/source4/dsdb/samdb/ldb_modules/objectclass.c
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -45,6 +45,7 @@
 #include "auth/auth.h"
 #include "param/param.h"
 #include "../libds/common/flags.h"
+#include "dsdb/samdb/ldb_modules/schema.h"
 #include "util.h"
 
 struct oc_context {
diff --git a/source4/dsdb/samdb/ldb_modules/schema.c b/source4/dsdb/samdb/ldb_modules/schema.c
new file mode 100644
index 0000000000..77bf9dc21e
--- /dev/null
+++ b/source4/dsdb/samdb/ldb_modules/schema.c
@@ -0,0 +1,120 @@
+/* 
+   Unix SMB/CIFS implementation.
+   Samba utility functions
+
+   Copyright (C) Andrew Tridgell 2009
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "ldb.h"
+#include "ldb_module.h"
+#include "librpc/ndr/libndr.h"
+#include "dsdb/samdb/ldb_modules/util.h"
+#include "dsdb/samdb/samdb.h"
+#include "util.h"
+#include "libcli/security/security.h"
+#include "lib/ldb/include/ldb_private.h"
+
+const struct dsdb_class * get_last_structural_class(const struct dsdb_schema *schema,const struct ldb_message_element *element)
+{
+	const struct dsdb_class *last_class = NULL;
+	unsigned int i;
+
+	for (i = 0; i < element->num_values; i++){
+		const struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &element->values[i]);
+
+		if(tmp_class == NULL) {
+			continue;
+		}
+
+		if(tmp_class->objectClassCategory > 1) {
+			continue;
+		}
+
+		if (!last_class) {
+			last_class = tmp_class;
+		} else {
+			if (tmp_class->subClass_order > last_class->subClass_order)
+				last_class = tmp_class;
+		}
+	}
+
+	return last_class;
+}
+
+int acl_check_access_on_class(struct ldb_module *module,
+			      const struct dsdb_schema *schema,
+			      TALLOC_CTX *mem_ctx,
+			      struct security_descriptor *sd,
+			      struct dom_sid *rp_sid,
+			      uint32_t access,
+			      const char *class_name)
+{
+	int ret;
+	NTSTATUS status;
+	uint32_t access_granted;
+	struct object_tree *root = NULL;
+	struct object_tree *new_node = NULL;
+	const struct GUID *guid;
+	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+	struct security_token *token = acl_user_token(module);
+	if (class_name) {
+		guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
+		if (!guid) {
+			DEBUG(10, ("acl_search: cannot find class %s\n",
+				   class_name));
+			goto fail;
+		}
+		if (!insert_in_object_tree(tmp_ctx,
+					   guid, access,
+					   &root, &new_node)) {
+			DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
+			goto fail;
+		}
+	}
+	status = sec_access_check_ds(sd, token,
+				     access,
+				     &access_granted,
+				     root,
+				     rp_sid);
+	if (!NT_STATUS_IS_OK(status)) {
+		ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+	}
+	else {
+		ret = LDB_SUCCESS;
+	}
+	return ret;
+fail:
+	return ldb_operr(ldb_module_get_ctx(module));
+}
+
+const struct GUID *get_oc_guid_from_message(struct ldb_module *module,
+						   const struct dsdb_schema *schema,
+						   struct ldb_message *msg)
+{
+	struct ldb_message_element *oc_el;
+
+	oc_el = ldb_msg_find_element(msg, "objectClass");
+	if (!oc_el) {
+		return NULL;
+	}
+
+	return class_schemaid_guid_by_lDAPDisplayName(schema,
+						      (char *)oc_el->values[oc_el->num_values-1].data);
+}
+
+
diff --git a/source4/dsdb/samdb/ldb_modules/util.c b/source4/dsdb/samdb/ldb_modules/util.c
index 569c967e95..d7bf807c24 100644
--- a/source4/dsdb/samdb/ldb_modules/util.c
+++ b/source4/dsdb/samdb/ldb_modules/util.c
@@ -484,33 +484,6 @@ int dsdb_module_del(struct ldb_module *module,
 	return ret;
 }
 
-const struct dsdb_class * get_last_structural_class(const struct dsdb_schema *schema,const struct ldb_message_element *element)
-{
-	const struct dsdb_class *last_class = NULL;
-	unsigned int i;
-
-	for (i = 0; i < element->num_values; i++){
-		const struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &element->values[i]);
-
-		if(tmp_class == NULL) {
-			continue;
-		}
-
-		if(tmp_class->objectClassCategory > 1) {
-			continue;
-		}
-
-		if (!last_class) {
-			last_class = tmp_class;
-		} else {
-			if (tmp_class->subClass_order > last_class->subClass_order)
-				last_class = tmp_class;
-		}
-	}
-
-	return last_class;
-}
-
 /*
   check if a single valued link has multiple non-deleted values
 
diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build b/source4/dsdb/samdb/ldb_modules/wscript_build
index 399105332a..03b138b2ac 100644
--- a/source4/dsdb/samdb/ldb_modules/wscript_build
+++ b/source4/dsdb/samdb/ldb_modules/wscript_build
@@ -3,7 +3,7 @@
 bld.SAMBA_SUBSYSTEM('DSDB_MODULE_HELPERS',
 	source='util.c acl_util.c',
 	autoproto='util_proto.h',
-	deps='ldb LIBNDR SAMDB_SCHEMA'
+	deps='ldb LIBNDR SAMDB_COMMON'
 	)
 
 bld.SAMBA_SUBSYSTEM('DSDB_MODULE_HELPER_RIDALLOC',
@@ -12,6 +12,12 @@ bld.SAMBA_SUBSYSTEM('DSDB_MODULE_HELPER_RIDALLOC',
 	deps='MESSAGING',
 	)
 
+bld.SAMBA_SUBSYSTEM('DSDB_MODULE_HELPER_SCHEMA',
+	source='schema.c',
+	autoproto='schema.h',
+	deps='SAMDB_SCHEMA'
+	)
+
 bld.SAMBA_MODULE('ldb_samba_dsdb',
 	source='samba_dsdb.c',
 	subsystem='ldb',
@@ -135,7 +141,7 @@ bld.SAMBA_MODULE('ldb_rootdse',
 	subsystem='ldb',
 	init_function='LDB_MODULE(rootdse)',
 	internal_module=not bld.CONFIG_SET('USING_SYSTEM_LDB'),
-	deps='talloc LIBEVENTS SAMDB'
+	deps='talloc LIBEVENTS SAMDB MESSAGING'
 	)
 
 
@@ -226,7 +232,7 @@ bld.SAMBA_MODULE('ldb_objectclass',
 	subsystem='ldb',
 	init_function='LDB_MODULE(objectclass)',
 	internal_module=not bld.CONFIG_SET('USING_SYSTEM_LDB'),
-	deps='talloc LIBEVENTS LIBSECURITY NDR_SECURITY SAMDB DSDB_MODULE_HELPERS LIBSAMBA-UTIL'
+	deps='talloc LIBEVENTS LIBSECURITY NDR_SECURITY SAMDB DSDB_MODULE_HELPERS LIBSAMBA-UTIL DSDB_MODULE_HELPER_SCHEMA'
 	)
 
 
@@ -307,7 +313,7 @@ bld.SAMBA_MODULE('ldb_descriptor',
 	subsystem='ldb',
 	init_function='LDB_MODULE(descriptor)',
 	internal_module=not bld.CONFIG_SET('USING_SYSTEM_LDB'),
-	deps='talloc LIBEVENTS LIBSECURITY NDR_SECURITY SAMDB DSDB_MODULE_HELPERS'
+	deps='talloc LIBEVENTS LIBSECURITY NDR_SECURITY SAMDB DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_SCHEMA'
 	)
 
 
@@ -325,7 +331,7 @@ bld.SAMBA_MODULE('ldb_acl',
 	subsystem='ldb',
 	init_function='LDB_MODULE(acl)',
 	internal_module=not bld.CONFIG_SET('USING_SYSTEM_LDB'),
-	deps='talloc LIBEVENTS LIBSECURITY SAMDB DSDB_MODULE_HELPERS'
+	deps='talloc LIBEVENTS LIBSECURITY SAMDB DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_SCHEMA'
 	)