git.sur5r.net Git - openldap/blob - back-meta/search.c

   1 /*
   2  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   3  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   4  *
   5  * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
   6  *
   7  * This work has been developed to fulfill the requirements
   8  * of SysNet s.n.c. <http:www.sys-net.it> and it has been donated
   9  * to the OpenLDAP Foundation in the hope that it may be useful
  10  * to the Open Source community, but WITHOUT ANY WARRANTY.
  11  *
  12  * Permission is granted to anyone to use this software for any purpose
  13  * on any computer system, and to alter it and redistribute it, subject
  14  * to the following restrictions:
  15  *
  16  * 1. The author and SysNet s.n.c. are not responsible for the consequences
  17  *    of use of this software, no matter how awful, even if they arise from
  18  *    flaws in it.
  19  *
  20  * 2. The origin of this software must not be misrepresented, either by
  21  *    explicit claim or by omission.  Since few users ever read sources,
  22  *    credits should appear in the documentation.
  23  *
  24  * 3. Altered versions must be plainly marked as such, and must not be
  25  *    misrepresented as being the original software.  Since few users
  26  *    ever read sources, credits should appear in the documentation.
  27  *    SysNet s.n.c. cannot be responsible for the consequences of the
  28  *    alterations.
  29  *
  30  * 4. This notice may not be removed or altered.
  31  *
  32  *
  33  * This software is based on the backend back-ldap, implemented
  34  * by Howard Chu <hyc@highlandsun.com>, and modified by Mark Valence
  35  * <kurash@sassafras.com>, Pierangelo Masarati <ando@sys-net.it> and other
  36  * contributors. The contribution of the original software to the present
  37  * implementation is acknowledged in this copyright statement.
  38  *
  39  * A special acknowledgement goes to Howard for the overall architecture
  40  * (and for borrowing large pieces of code), and to Mark, who implemented
  41  * from scratch the attribute/objectclass mapping.
  42  *
  43  * The original copyright statement follows.
  44  *
  45  * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
  46  *
  47  * Permission is granted to anyone to use this software for any purpose
  48  * on any computer system, and to alter it and redistribute it, subject
  49  * to the following restrictions:
  50  *
  51  * 1. The author is not responsible for the consequences of use of this
  52  *    software, no matter how awful, even if they arise from flaws in it.
  53  *
  54  * 2. The origin of this software must not be misrepresented, either by
  55  *    explicit claim or by omission.  Since few users ever read sources,
  56  *    credits should appear in the documentation.
  57  *
  58  * 3. Altered versions must be plainly marked as such, and must not be
  59  *    misrepresented as being the original software.  Since few users
  60  *    ever read sources, credits should appear in the
  61  *    documentation.
  62  *
  63  * 4. This notice may not be removed or altered.
  64  *
  65  */
  66
  67 #include "portable.h"
  68
  69 #include <stdio.h>
  70
  71 #include <ac/socket.h>
  72 #include <ac/string.h>
  73 #include <ac/time.h>
  74
  75 #include "slap.h"
  76 #include "../back-ldap/back-ldap.h"
  77 #include "back-meta.h"
  78 #include "ldap_pvt.h"
  79 #undef ldap_debug       /* silence a warning in ldap-int.h */
  80 #include "ldap_log.h"
  81 #include "../../../libraries/libldap/ldap-int.h"
  82
  83 static int
  84 meta_send_entry(
  85                 Backend         *be,
  86                 Operation       *op,
  87                 struct metaconn *lc,
  88                 int             i,
  89                 LDAPMessage     *e,
  90                 AttributeName   *attrs,
  91                 int             attrsonly
  92 );
  93
  94 static int
  95 is_one_level_rdn(
  96                 const char      *rdn,
  97                 int             from
  98 );
  99
 100 int
 101 meta_back_search(
 102                 Backend         *be,
 103                 Connection      *conn,
 104                 Operation       *op,
 105                 struct berval   *base,
 106                 struct berval   *nbase,
 107                 int             scope,
 108                 int             deref,
 109                 int             slimit,
 110                 int             tlimit,
 111                 Filter          *filter,
 112                 struct berval   *filterstr,
 113                 AttributeName   *attrs,
 114                 int             attrsonly
 115 )
 116 {
 117         struct metainfo *li = ( struct metainfo * )be->be_private;
 118         struct metaconn *lc;
 119         struct metasingleconn *lsc;
 120         struct timeval  tv = { 0, 0 };
 121         LDAPMessage     *res, *e;
 122         int     count, rc = 0, *msgid, sres = LDAP_NO_SUCH_OBJECT;
 123         char *match = NULL, *err = NULL;
 124         char *mbase = NULL, *mmatch = NULL;
 125         struct berval mfilter;
 126
 127         int i, last = 0, candidates = 0, op_type;
 128         struct slap_limits_set *limit = NULL;
 129         int isroot = 0;
 130
 131         if ( scope == LDAP_SCOPE_BASE ) {
 132                 op_type = META_OP_REQUIRE_SINGLE;
 133         } else {
 134                 op_type = META_OP_ALLOW_MULTIPLE;
 135         }
 136
 137         lc = meta_back_getconn( li, conn, op, op_type, nbase, NULL );
 138         if ( !lc || !meta_back_dobind( lc, op ) ) {
 139                 return -1;
 140         }
 141
 142         /*
 143          * Array of message id of each target
 144          */
 145         msgid = ch_calloc( sizeof( int ), li->ntargets );
 146         if ( msgid == NULL ) {
 147                 send_search_result( conn, op, LDAP_OTHER,
 148                                 NULL, NULL, NULL, NULL, 0 );
 149                 return -1;
 150         }
 151
 152         /* if not root, get appropriate limits */
 153         if ( be_isroot( be, &op->o_ndn ) ) {
 154                 isroot = 1;
 155         } else {
 156                 ( void ) get_limits( be, &op->o_ndn, &limit );
 157         }
 158
 159         /* if no time limit requested, rely on remote server limits */
 160         /* if requested limit higher than hard limit, abort */
 161         if ( !isroot && tlimit > limit->lms_t_hard ) {
 162                 /* no hard limit means use soft instead */
 163                 if ( limit->lms_t_hard == 0 && tlimit > limit->lms_t_soft ) {
 164                         tlimit = limit->lms_t_soft;
 165
 166                 /* positive hard limit means abort */
 167                 } else if ( limit->lms_t_hard > 0 ) {
 168                         send_search_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 169                                         NULL, NULL, NULL, NULL, 0 );
 170                         rc = 0;
 171                         goto finish;
 172                 }
 173
 174                 /* negative hard limit means no limit */
 175         }
 176
 177         /* if no size limit requested, rely on remote server limits */
 178         /* if requested limit higher than hard limit, abort */
 179         if ( !isroot && slimit > limit->lms_s_hard ) {
 180                 /* no hard limit means use soft instead */
 181                 if ( limit->lms_s_hard == 0 && slimit > limit->lms_s_soft ) {
 182                         slimit = limit->lms_s_soft;
 183
 184                 /* positive hard limit means abort */
 185                 } else if ( limit->lms_s_hard > 0 ) {
 186                         send_search_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 187                                         NULL, NULL, NULL, NULL, 0 );
 188                         rc = 0;
 189                         goto finish;
 190                 }
 191
 192                 /* negative hard limit means no limit */
 193         }
 194
 195         /*
 196          * Inits searches
 197          */
 198         for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
 199                 char    *realbase = ( char * )base->bv_val;
 200                 int     realscope = scope;
 201                 ber_len_t suffixlen;
 202                 char    *mapped_filter, **mapped_attrs;
 203
 204                 if ( lsc->candidate != META_CANDIDATE ) {
 205                         continue;
 206                 }
 207
 208                 if ( deref != -1 ) {
 209                         ldap_set_option( lsc->ld, LDAP_OPT_DEREF,
 210                                         ( void * )&deref);
 211                 }
 212                 if ( tlimit != -1 ) {
 213                         ldap_set_option( lsc->ld, LDAP_OPT_TIMELIMIT,
 214                                         ( void * )&tlimit);
 215                 }
 216                 if ( slimit != -1 ) {
 217                         ldap_set_option( lsc->ld, LDAP_OPT_SIZELIMIT,
 218                                         ( void * )&slimit);
 219                 }
 220
 221                 /*
 222                  * modifies the base according to the scope, if required
 223                  */
 224                 suffixlen = li->targets[ i ]->suffix.bv_len;
 225                 if ( suffixlen > nbase->bv_len ) {
 226                         switch ( scope ) {
 227                         case LDAP_SCOPE_SUBTREE:
 228                                 /*
 229                                  * make the target suffix the new base
 230                                  * FIXME: this is very forgiving, because
 231                                  * illegal bases may be turned into
 232                                  * the suffix of the target.
 233                                  */
 234                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 235                                                 nbase ) ) {
 236                                         realbase = li->targets[ i ]->suffix.bv_val;
 237                                 } else {
 238                                         /*
 239                                          * this target is no longer candidate
 240                                          */
 241                                         lsc->candidate = META_NOT_CANDIDATE;
 242                                         continue;
 243                                 }
 244                                 break;
 245
 246                         case LDAP_SCOPE_ONELEVEL:
 247                                 if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 248                                                 suffixlen - nbase->bv_len - 1 )
 249                         && dnIsSuffix( &li->targets[ i ]->suffix, nbase ) ) {
 250                                         /*
 251                                          * if there is exactly one level,
 252                                          * make the target suffix the new
 253                                          * base, and make scope "base"
 254                                          */
 255                                         realbase = li->targets[ i ]->suffix.bv_val;
 256                                         realscope = LDAP_SCOPE_BASE;
 257                                         break;
 258                                 } /* else continue with the next case */
 259
 260                         case LDAP_SCOPE_BASE:
 261                                 /*
 262                                  * this target is no longer candidate
 263                                  */
 264                                 lsc->candidate = META_NOT_CANDIDATE;
 265                                 continue;
 266                         }
 267
 268                 }
 269
 270                 /*
 271                  * Rewrite the search base, if required
 272                  */
 273                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 274                                         "searchBase",
 275                                         realbase, conn, &mbase ) ) {
 276                 case REWRITE_REGEXEC_OK:
 277                 if ( mbase == NULL ) {
 278                         mbase = realbase;
 279                 }
 280 #ifdef NEW_LOGGING
 281                 LDAP_LOG( BACK_META, DETAIL1,
 282                         "[rw] searchBase: \"%s\" -> \"%s\"\n", base->bv_val, mbase, 0 );
 283 #else /* !NEW_LOGGING */
 284                 Debug( LDAP_DEBUG_ARGS, "rw> searchBase: \"%s\" -> \"%s\"\n%s",
 285                                 base->bv_val, mbase, "" );
 286 #endif /* !NEW_LOGGING */
 287                 break;
 288
 289                 case REWRITE_REGEXEC_UNWILLING:
 290                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 291                                         NULL, "Unwilling to perform",
 292                                         NULL, NULL );
 293                         rc = -1;
 294                         goto finish;
 295
 296                 case REWRITE_REGEXEC_ERR:
 297                         send_ldap_result( conn, op, LDAP_OTHER,
 298                                         NULL, "Rewrite error",
 299                                         NULL, NULL );
 300                         rc = -1;
 301                         goto finish;
 302                 }
 303
 304                 /*
 305                  * Rewrite the search filter, if required
 306                  */
 307                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 308                                         "searchFilter",
 309                                         filterstr->bv_val, conn, &mfilter.bv_val ) ) {
 310                 case REWRITE_REGEXEC_OK:
 311                         if ( mfilter.bv_val != NULL && mfilter.bv_val[ 0 ] != '\0') {
 312                                 mfilter.bv_len = strlen( mfilter.bv_val );
 313                         } else {
 314                                 if ( mfilter.bv_val != NULL ) {
 315                                         free( mfilter.bv_val );
 316                                 }
 317                                 mfilter = *filterstr;
 318                         }
 319 #ifdef NEW_LOGGING
 320                         LDAP_LOG( BACK_META, DETAIL1,
 321                                 "[rw] searchFilter: \"%s\" -> \"%s\"\n",
 322                                 filterstr->bv_val, mfilter.bv_val, 0 );
 323 #else /* !NEW_LOGGING */
 324                         Debug( LDAP_DEBUG_ARGS,
 325                                 "rw> searchFilter: \"%s\" -> \"%s\"\n%s",
 326                                 filterstr->bv_val, mfilter.bv_val, "" );
 327 #endif /* !NEW_LOGGING */
 328                         break;
 329
 330                 case REWRITE_REGEXEC_UNWILLING:
 331                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 332                                         NULL, NULL, NULL, NULL );
 333                         rc = -1;
 334                         goto finish;
 335
 336                 case REWRITE_REGEXEC_ERR:
 337                         send_ldap_result( conn, op, LDAP_OTHER,
 338                                         NULL, NULL, NULL, NULL );
 339                         rc = -1;
 340                         goto finish;
 341                 }
 342
 343                 /*
 344                  * Maps attributes in filter
 345                  */
 346                 mapped_filter = ldap_back_map_filter( &li->targets[ i ]->at_map,
 347                                 &li->targets[ i ]->oc_map, &mfilter, 0 );
 348                 if ( mapped_filter == NULL ) {
 349                         mapped_filter = ( char * )mfilter.bv_val;
 350                 } else {
 351                         if ( mfilter.bv_val != filterstr->bv_val ) {
 352                                 free( mfilter.bv_val );
 353                         }
 354                 }
 355                 mfilter.bv_val = NULL;
 356                 mfilter.bv_len = 0;
 357
 358                 /*
 359                  * Maps required attributes
 360                  */
 361                 mapped_attrs = ldap_back_map_attrs( &li->targets[ i ]->at_map,
 362                                 attrs, 0 );
 363                 if ( mapped_attrs == NULL && attrs) {
 364                         for ( count=0; attrs[ count ].an_name.bv_val; count++ );
 365                         mapped_attrs = ch_malloc( ( count + 1 ) * sizeof(char *));
 366                         for ( count=0; attrs[ count ].an_name.bv_val; count++ ) {
 367                                 mapped_attrs[ count ] = attrs[ count ].an_name.bv_val;
 368                         }
 369                         mapped_attrs[ count ] = NULL;
 370                 }
 371
 372                 /*
 373                  * Starts the search
 374                  */
 375                 msgid[ i ] = ldap_search( lsc->ld, mbase, realscope,
 376                                 mapped_filter, mapped_attrs, attrsonly );
 377                 if ( msgid[ i ] == -1 ) {
 378                         lsc->candidate = META_NOT_CANDIDATE;
 379                         continue;
 380                 }
 381
 382                 if ( mapped_attrs ) {
 383                         free( mapped_attrs );
 384                         mapped_attrs = NULL;
 385                 }
 386                 if ( mapped_filter != filterstr->bv_val ) {
 387                         free( mapped_filter );
 388                         mapped_filter = NULL;
 389                 }
 390                 if ( mbase != realbase ) {
 391                         free( mbase );
 392                         mbase = NULL;
 393                 }
 394
 395                 ++candidates;
 396         }
 397
 398         /* We pull apart the ber result, stuff it into a slapd entry, and
 399          * let send_search_entry stuff it back into ber format. Slow & ugly,
 400          * but this is necessary for version matching, and for ACL processing.
 401          */
 402
 403
 404         /*
 405          * In case there are no candidates, no cycle takes place...
 406          */
 407         for ( count = 0, rc = 0; candidates > 0; ) {
 408                 int ab, gotit = 0;
 409
 410                 /* check for abandon */
 411                 ab = op->o_abandon;
 412
 413                 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); lsc++, i++ ) {
 414                         if ( lsc->candidate != META_CANDIDATE ) {
 415                                 continue;
 416                         }
 417
 418                         if ( ab ) {
 419                                 ldap_abandon( lsc->ld, msgid[ i ] );
 420                                 rc = 0;
 421                                 break;
 422                         }
 423
 424                         if ( slimit > 0 && count == slimit ) {
 425                                 send_search_result( conn, op,
 426                                                 LDAP_SIZELIMIT_EXCEEDED,
 427                                                 NULL, NULL, NULL, NULL, count );
 428                                 goto finish;
 429                         }
 430
 431                         rc = ldap_result( lsc->ld, msgid[ i ],
 432                                         0, &tv, &res );
 433
 434                         if ( rc == 0 ) {
 435                                 continue;
 436                         } else if ( rc == -1 ) {
 437                                 /* something REALLY bad happened! */
 438                                 ( void )meta_clear_unused_candidates( li,
 439                                                 lc, -1, 0 );
 440                                 send_search_result( conn, op,
 441                                                 LDAP_OTHER,
 442                                                 "", "", NULL, NULL, count );
 443
 444                                 /* anything else needs be done? */
 445                                 goto finish;
 446                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 447                                 e = ldap_first_entry( lsc->ld, res );
 448                                 if ( meta_send_entry( be, op, lc, i, e, attrs,
 449                                                 attrsonly ) == LDAP_SUCCESS ) {
 450                                         count++;
 451                                 }
 452                                 ldap_msgfree( res );
 453                                 gotit = 1;
 454                         } else {
 455                                 sres = ldap_result2error( lsc->ld,
 456                                                 res, 1 );
 457                                 sres = ldap_back_map_result( sres );
 458                                 if ( err != NULL ) {
 459                                         free( err );
 460                                 }
 461                                 ldap_get_option( lsc->ld,
 462                                                 LDAP_OPT_ERROR_STRING, &err );
 463                                 if ( match != NULL ) {
 464                                         free( match );
 465                                 }
 466                                 ldap_get_option( lsc->ld,
 467                                                 LDAP_OPT_MATCHED_DN, &match );
 468
 469 #ifdef NEW_LOGGING
 470                                 LDAP_LOG( BACK_META, ERR,
 471                                         "meta_back_search [%d] "
 472                                         "match=\"%s\" err=\"%s\"\n",
 473                                         i, match, err );
 474 #else /* !NEW_LOGGING */
 475                                 Debug( LDAP_DEBUG_ANY,
 476                                         "=>meta_back_search [%d] "
 477                                         "match=\"%s\" err=\"%s\"\n",
 478                                         i, match, err );
 479 #endif /* !NEW_LOGGING */
 480
 481                                 last = i;
 482                                 rc = 0;
 483
 484                                 /*
 485                                  * When no candidates are left,
 486                                  * the outer cycle finishes
 487                                  */
 488                                 lsc->candidate = META_NOT_CANDIDATE;
 489                                 --candidates;
 490                         }
 491                 }
 492
 493                 if ( ab ) {
 494                         goto finish;
 495                 }
 496
 497                 if ( gotit == 0 ) {
 498                         tv.tv_sec = 0;
 499                         tv.tv_usec = 100000;
 500                         ldap_pvt_thread_yield();
 501                 } else {
 502                         tv.tv_sec = 0;
 503                         tv.tv_usec = 0;
 504                 }
 505         }
 506
 507         if ( rc == -1 ) {
 508                 /*
 509                  * FIXME: need a strategy to handle errors
 510                  */
 511                 rc = meta_back_op_result( lc, op );
 512                 goto finish;
 513         }
 514
 515         /*
 516          * Rewrite the matched portion of the search base, if required
 517          *
 518          * FIXME: only the last one gets caught!
 519          */
 520         if ( match != NULL ) {
 521                 switch ( rewrite_session( li->targets[ last ]->rwinfo,
 522                                         "matchedDn", match, conn, &mmatch ) ) {
 523                 case REWRITE_REGEXEC_OK:
 524                         if ( mmatch == NULL ) {
 525                                 mmatch = ( char * )match;
 526                         }
 527 #ifdef NEW_LOGGING
 528                         LDAP_LOG( BACK_META, DETAIL1,
 529                                 "[rw] matchedDn: \"%s\" -> \"%s\"\n", match, mmatch, 0 );
 530 #else /* !NEW_LOGGING */
 531                         Debug( LDAP_DEBUG_ARGS, "rw> matchedDn:"
 532                                        " \"%s\" -> \"%s\"\n%s",
 533                                        match, mmatch, "" );
 534 #endif /* !NEW_LOGGING */
 535                         break;
 536
 537                 case REWRITE_REGEXEC_UNWILLING:
 538                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 539                                         NULL, NULL, NULL, NULL );
 540                         rc = -1;
 541                         goto finish;
 542
 543                 case REWRITE_REGEXEC_ERR:
 544                         send_ldap_result( conn, op, LDAP_OTHER,
 545                                         NULL, NULL, NULL, NULL );
 546                         rc = -1;
 547                         goto finish;
 548                 }
 549         }
 550
 551         send_search_result( conn, op, sres,
 552                 mmatch, err, NULL, NULL, count );
 553
 554 finish:;
 555         if ( match ) {
 556                 if ( mmatch != match ) {
 557                         free( mmatch );
 558                 }
 559                 free(match);
 560         }
 561
 562         if ( err ) {
 563                 free( err );
 564         }
 565
 566         if ( msgid ) {
 567                 ch_free( msgid );
 568         }
 569
 570         return rc;
 571 }
 572
 573 static int
 574 meta_send_entry(
 575                 Backend         *be,
 576                 Operation       *op,
 577                 struct metaconn *lc,
 578                 int             target,
 579                 LDAPMessage     *e,
 580                 AttributeName   *attrs,
 581                 int             attrsonly
 582 )
 583 {
 584         struct metainfo         *li = ( struct metainfo * )be->be_private;
 585         struct berval           a, mapped;
 586         Entry                   ent;
 587         BerElement              ber = *e->lm_ber;
 588         Attribute               *attr, **attrp;
 589         struct berval           dummy = { 0, NULL };
 590         struct berval           *bv, bdn;
 591         const char              *text;
 592
 593         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 594                 return LDAP_DECODING_ERROR;
 595         }
 596
 597         /*
 598          * Rewrite the dn of the result, if needed
 599          */
 600         switch ( rewrite_session( li->targets[ target ]->rwinfo,
 601                                 "searchResult", bdn.bv_val, lc->conn, &ent.e_name.bv_val ) ) {
 602         case REWRITE_REGEXEC_OK:
 603                 if ( ent.e_name.bv_val == NULL ) {
 604                         ent.e_name = bdn;
 605
 606                 } else {
 607 #ifdef NEW_LOGGING
 608                         LDAP_LOG( BACK_META, DETAIL1,
 609                                 "[rw] searchResult[%d]: \"%s\" -> \"%s\"\n",
 610                                 target, bdn.bv_val, ent.e_name.bv_val );
 611 #else /* !NEW_LOGGING */
 612                         Debug( LDAP_DEBUG_ARGS, "rw> searchResult[%d]: \"%s\""
 613                                         " -> \"%s\"\n", target, bdn.bv_val, ent.e_name.bv_val );
 614 #endif /* !NEW_LOGGING */
 615                         ent.e_name.bv_len = strlen( ent.e_name.bv_val );
 616                 }
 617                 break;
 618
 619         case REWRITE_REGEXEC_ERR:
 620         case REWRITE_REGEXEC_UNWILLING:
 621                 return LDAP_OTHER;
 622         }
 623
 624         /*
 625          * Note: this may fail if the target host(s) schema differs
 626          * from the one known to the meta, and a DN with unknown
 627          * attributes is returned.
 628          *
 629          * FIXME: should we log anything, or delegate to dnNormalize2?
 630          */
 631         if ( dnNormalize2( NULL, &ent.e_name, &ent.e_nname ) != LDAP_SUCCESS ) {
 632                 return LDAP_INVALID_DN_SYNTAX;
 633         }
 634
 635         /*
 636          * cache dn
 637          */
 638         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 639                 ( void )meta_dncache_update_entry( &li->cache,
 640                                                    &ent.e_nname,
 641                                                    target );
 642         }
 643
 644         ent.e_id = 0;
 645         ent.e_attrs = 0;
 646         ent.e_private = 0;
 647         attrp = &ent.e_attrs;
 648
 649         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 650                 ldap_back_map( &li->targets[ target ]->at_map,
 651                                 &a, &mapped, 1 );
 652                 if ( mapped.bv_val == NULL ) {
 653                         continue;
 654                 }
 655                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 656                 if ( attr == NULL ) {
 657                         continue;
 658                 }
 659                 attr->a_flags = 0;
 660                 attr->a_next = 0;
 661                 attr->a_desc = NULL;
 662                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 663                                 != LDAP_SUCCESS) {
 664                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 665                                         != LDAP_SUCCESS) {
 666 #ifdef NEW_LOGGING
 667                                 LDAP_LOG( BACK_META, DETAIL1,
 668                                         "slap_bv2undef_ad(%s): %s\n", mapped.bv_val, text, 0 );
 669 #else /* !NEW_LOGGING */
 670                                 Debug( LDAP_DEBUG_ANY,
 671                                                 "slap_bv2undef_ad(%s): "
 672                                                 "%s\n%s", mapped.bv_val, text, "" );
 673 #endif /* !NEW_LOGGING */
 674                                 ch_free( attr );
 675                                 continue;
 676                         }
 677                 }
 678
 679                 /* no subschemaSubentry */
 680                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 681                         ch_free(attr);
 682                         continue;
 683                 }
 684
 685                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 686                                 || attr->a_vals == NULL ) {
 687                         attr->a_vals = &dummy;
 688
 689                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 690                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 691                         int i, last;
 692                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 693                         for ( i = 0, bv = attr->a_vals; bv->bv_val; bv++, i++ ) {
 694                                 ldap_back_map( &li->targets[ target]->oc_map,
 695                                                 bv, &mapped, 1 );
 696                                 if ( mapped.bv_val == NULL ) {
 697                                         free( bv->bv_val );
 698                                         bv->bv_val = NULL;
 699                                         if ( --last < 0 ) {
 700                                                 break;
 701                                         }
 702                                         *bv = attr->a_vals[ last ];
 703                                         attr->a_vals[ last ].bv_val = NULL;
 704                                         i--;
 705
 706                                 } else if ( mapped.bv_val != bv->bv_val ) {
 707                                         free( bv->bv_val );
 708                                         ber_dupbv( bv, &mapped );
 709                                 }
 710                         }
 711                 /*
 712                  * It is necessary to try to rewrite attributes with
 713                  * dn syntax because they might be used in ACLs as
 714                  * members of groups; since ACLs are applied to the
 715                  * rewritten stuff, no dn-based subecj clause could
 716                  * be used at the ldap backend side (see
 717                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 718                  * The problem can be overcome by moving the dn-based
 719                  * ACLs to the target directory server, and letting
 720                  * everything pass thru the ldap backend.
 721                  */
 722                 } else if ( strcmp( attr->a_desc->ad_type->sat_syntax->ssyn_oid,
 723                                         SLAPD_DN_SYNTAX ) == 0 ) {
 724                         int i;
 725                         for ( i = 0, bv = attr->a_vals; bv->bv_val; bv++, i++ ) {
 726                                 char *newval;
 727
 728                                 switch ( rewrite_session( li->targets[ target ]->rwinfo,
 729                                                         "searchResult",
 730                                                         bv->bv_val,
 731                                                         lc->conn, &newval )) {
 732                                 case REWRITE_REGEXEC_OK:
 733                                         /* left as is */
 734                                         if ( newval == NULL ) {
 735                                                 break;
 736                                         }
 737 #ifdef NEW_LOGGING
 738                                         LDAP_LOG( BACK_META, DETAIL1,
 739                                                 "[rw] searchResult on attr=%s: \"%s\" -> \"%s\"\n",
 740                                                 attr->a_desc->ad_type->sat_cname.bv_val,
 741                                                 bv->bv_val, newval );
 742 #else /* !NEW_LOGGING */
 743                                         Debug( LDAP_DEBUG_ARGS,
 744                                                 "rw> searchResult on attr=%s:"
 745                                                 " \"%s\" -> \"%s\"\n",
 746                                         attr->a_desc->ad_type->sat_cname.bv_val,
 747                                                 bv->bv_val, newval );
 748 #endif /* !NEW_LOGGING */
 749                                         free( bv->bv_val );
 750                                         bv->bv_val = newval;
 751                                         bv->bv_len = strlen( newval );
 752
 753                                         break;
 754
 755                                 case REWRITE_REGEXEC_UNWILLING:
 756
 757                                 case REWRITE_REGEXEC_ERR:
 758                                         /*
 759                                          * FIXME: better give up,
 760                                          * skip the attribute
 761                                          * or leave it untouched?
 762                                          */
 763                                         break;
 764                                 }
 765                         }
 766                 }
 767                 *attrp = attr;
 768                 attrp = &attr->a_next;
 769         }
 770         send_search_entry( be, lc->conn, op, &ent, attrs, attrsonly, NULL );
 771         while ( ent.e_attrs ) {
 772                 attr = ent.e_attrs;
 773                 ent.e_attrs = attr->a_next;
 774                 if ( attr->a_vals != &dummy ) {
 775                         ber_bvarray_free( attr->a_vals );
 776                 }
 777                 free( attr );
 778         }
 779
 780         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 781                 free( ent.e_dn );
 782         }
 783         if ( ent.e_ndn ) {
 784                 free( ent.e_ndn );
 785         }
 786
 787         return LDAP_SUCCESS;
 788 }
 789
 790 static int
 791 is_one_level_rdn(
 792                 const char      *rdn,
 793                 int             from
 794 )
 795 {
 796         for ( ; from--; ) {
 797                 if ( DN_SEPARATOR( rdn[ from ] ) ) {
 798                         return 0;
 799                 }
 800         }
 801
 802         return 1;
 803 }
 804