git.sur5r.net Git - openldap/blob - servers/slapd/back-ldap/search.c

   1 /* search.c - ldap backend search function */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7 /* This is an altered version */
   8 /*
   9  * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
  10  *
  11  * Permission is granted to anyone to use this software for any purpose
  12  * on any computer system, and to alter it and redistribute it, subject
  13  * to the following restrictions:
  14  *
  15  * 1. The author is not responsible for the consequences of use of this
  16  *    software, no matter how awful, even if they arise from flaws in it.
  17  *
  18  * 2. The origin of this software must not be misrepresented, either by
  19  *    explicit claim or by omission.  Since few users ever read sources,
  20  *    credits should appear in the documentation.
  21  *
  22  * 3. Altered versions must be plainly marked as such, and must not be
  23  *    misrepresented as being the original software.  Since few users
  24  *    ever read sources, credits should appear in the documentation.
  25  *
  26  * 4. This notice may not be removed or altered.
  27  *
  28  *
  29  *
  30  * Copyright 2000, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
  31  *
  32  * This software is being modified by Pierangelo Masarati.
  33  * The previously reported conditions apply to the modified code as well.
  34  * Changes in the original code are highlighted where required.
  35  * Credits for the original code go to the author, Howard Chu.
  36  */
  37
  38 #include "portable.h"
  39
  40 #include <stdio.h>
  41
  42 #include <ac/socket.h>
  43 #include <ac/string.h>
  44 #include <ac/time.h>
  45
  46 #include "slap.h"
  47 #include "back-ldap.h"
  48 #undef ldap_debug       /* silence a warning in ldap-int.h */
  49 #include "../../../libraries/libldap/ldap-int.h"
  50
  51 #include "lutil.h"
  52
  53 static int
  54 ldap_build_entry( Operation *op, LDAPMessage *e, Entry *ent,
  55          struct berval *bdn, int flags );
  56 #define LDAP_BUILD_ENTRY_PRIVATE        0x01
  57 #define LDAP_BUILD_ENTRY_NORMALIZE      0x02
  58
  59 static struct berval dummy = { 0, NULL };
  60
  61 int
  62 ldap_back_search(
  63     Operation   *op,
  64     SlapReply *rs )
  65 {
  66         struct ldapinfo *li = (struct ldapinfo *) op->o_bd->be_private;
  67         struct ldapconn *lc;
  68         struct timeval  tv;
  69         LDAPMessage             *res, *e;
  70         int     count, rc = 0, msgid;
  71         char *match = NULL;
  72         char **mapped_attrs = NULL;
  73         struct berval mbase;
  74         struct berval mfilter = { 0, NULL };
  75         struct slap_limits_set *limit = NULL;
  76         int isroot = 0;
  77
  78         lc = ldap_back_getconn(op, rs);
  79         if ( !lc ) {
  80                 return( -1 );
  81         }
  82
  83         /*
  84          * FIXME: in case of values return filter, we might want
  85          * to map attrs and maybe rewrite value
  86          */
  87         if ( !ldap_back_dobind( lc, op, rs ) ) {
  88                 return( -1 );
  89         }
  90
  91         /* if not root, get appropriate limits */
  92         if ( be_isroot( op->o_bd, &op->o_ndn ) ) {
  93                 isroot = 1;
  94         } else {
  95                 ( void ) get_limits( op->o_bd, &op->o_ndn, &limit );
  96         }
  97
  98         /* if no time limit requested, rely on remote server limits */
  99         /* if requested limit higher than hard limit, abort */
 100         if ( !isroot && op->oq_search.rs_tlimit > limit->lms_t_hard ) {
 101                 /* no hard limit means use soft instead */
 102                 if ( limit->lms_t_hard == 0
 103                                 && limit->lms_t_soft > -1
 104                                 && op->oq_search.rs_tlimit > limit->lms_t_soft ) {
 105                         op->oq_search.rs_tlimit = limit->lms_t_soft;
 106
 107                 /* positive hard limit means abort */
 108                 } else if ( limit->lms_t_hard > 0 ) {
 109                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 110                         send_ldap_result( op, rs );
 111                         rc = 0;
 112                         goto finish;
 113                 }
 114
 115                 /* negative hard limit means no limit */
 116         }
 117
 118         /* if no size limit requested, rely on remote server limits */
 119         /* if requested limit higher than hard limit, abort */
 120         if ( !isroot && op->oq_search.rs_slimit > limit->lms_s_hard ) {
 121                 /* no hard limit means use soft instead */
 122                 if ( limit->lms_s_hard == 0
 123                                 && limit->lms_s_soft > -1
 124                                 && op->oq_search.rs_slimit > limit->lms_s_soft ) {
 125                         op->oq_search.rs_slimit = limit->lms_s_soft;
 126
 127                 /* positive hard limit means abort */
 128                 } else if ( limit->lms_s_hard > 0 ) {
 129                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 130                         send_ldap_result( op, rs );
 131                         rc = 0;
 132                         goto finish;
 133                 }
 134
 135                 /* negative hard limit means no limit */
 136         }
 137
 138         /* should we check return values? */
 139         if (op->oq_search.rs_deref != -1)
 140                 ldap_set_option( lc->ld, LDAP_OPT_DEREF, (void *)&op->oq_search.rs_deref);
 141         if (op->oq_search.rs_tlimit != -1) {
 142                 tv.tv_sec = op->oq_search.rs_tlimit;
 143                 tv.tv_usec = 0;
 144         } else {
 145                 tv.tv_sec = 0;
 146         }
 147
 148         /*
 149          * Rewrite the search base, if required
 150          */
 151 #ifdef ENABLE_REWRITE
 152         switch ( rewrite_session( li->rwinfo, "searchBase",
 153                                 op->o_req_dn.bv_val, op->o_conn, &mbase.bv_val ) ) {
 154         case REWRITE_REGEXEC_OK:
 155                 if ( mbase.bv_val == NULL ) {
 156                         mbase = op->o_req_dn;
 157                 } else {
 158                         mbase.bv_len = strlen( mbase.bv_val );
 159                 }
 160 #ifdef NEW_LOGGING
 161                 LDAP_LOG( BACK_LDAP, DETAIL1,
 162                         "[rw] searchBase: \"%s\" -> \"%s\"\n",
 163                         op->o_req_dn.bv_val, mbase.bv_val, 0 );
 164 #else /* !NEW_LOGGING */
 165                 Debug( LDAP_DEBUG_ARGS, "rw> searchBase: \"%s\" -> \"%s\"\n%s",
 166                                 op->o_req_dn.bv_val, mbase.bv_val, "" );
 167 #endif /* !NEW_LOGGING */
 168                 break;
 169
 170         case REWRITE_REGEXEC_UNWILLING:
 171                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 172                                 "Operation not allowed" );
 173                 rc = -1;
 174                 goto finish;
 175
 176         case REWRITE_REGEXEC_ERR:
 177                 send_ldap_error( op, rs, LDAP_OTHER,
 178                                 "Rewrite error" );
 179                 rc = -1;
 180                 goto finish;
 181         }
 182
 183 #else /* !ENABLE_REWRITE */
 184         ldap_back_dn_massage( li, &op->o_req_dn, &mbase, 0, 1 );
 185 #endif /* !ENABLE_REWRITE */
 186
 187 #ifdef ENABLE_REWRITE
 188         rc = ldap_back_filter_map_rewrite_( li->rwinfo, op->o_conn,
 189                         &li->at_map, &li->oc_map, op->oq_search.rs_filter, &mfilter,
 190                         BACKLDAP_MAP );
 191 #else /* ! ENABLE_REWRITE */
 192         rc = ldap_back_filter_map_rewrite_( &li->at_map, &li->oc_map,
 193                         op->oq_search.rs_filter, &mfilter, BACKLDAP_MAP );
 194 #endif /* ! ENABLE_REWRITE */
 195
 196         if ( rc ) {
 197                 rc = -1;
 198                 goto finish;
 199         }
 200
 201         mapped_attrs = ldap_back_map_attrs(&li->at_map, op->oq_search.rs_attrs, BACKLDAP_MAP);
 202         if ( mapped_attrs == NULL && op->oq_search.rs_attrs) {
 203                 for (count=0; op->oq_search.rs_attrs[count].an_name.bv_val; count++);
 204                 mapped_attrs = ch_malloc( (count+1) * sizeof(char *));
 205                 for (count=0; op->oq_search.rs_attrs[count].an_name.bv_val; count++) {
 206                         mapped_attrs[count] = op->oq_search.rs_attrs[count].an_name.bv_val;
 207                 }
 208                 mapped_attrs[count] = NULL;
 209         }
 210
 211         rs->sr_err = ldap_search_ext(lc->ld, mbase.bv_val, op->oq_search.rs_scope, mfilter.bv_val,
 212                         mapped_attrs, op->oq_search.rs_attrsonly, op->o_ctrls, NULL, tv.tv_sec ? &tv
 213                         : NULL, op->oq_search.rs_slimit, &msgid);
 214         if ( rs->sr_err != LDAP_SUCCESS ) {
 215 fail:;
 216                 rc = ldap_back_op_result(lc, op, rs, msgid, 0);
 217                 goto finish;
 218         }
 219
 220         /* We pull apart the ber result, stuff it into a slapd entry, and
 221          * let send_search_entry stuff it back into ber format. Slow & ugly,
 222          * but this is necessary for version matching, and for ACL processing.
 223          */
 224
 225         for ( rc=0; rc != -1; rc = ldap_result(lc->ld, msgid, 0, &tv, &res))
 226         {
 227                 /* check for abandon */
 228                 if (op->o_abandon) {
 229                         ldap_abandon(lc->ld, msgid);
 230                         rc = 0;
 231                         goto finish;
 232                 }
 233
 234                 if (rc == 0) {
 235                         tv.tv_sec = 0;
 236                         tv.tv_usec = 100000;
 237                         ldap_pvt_thread_yield();
 238
 239                 } else if (rc == LDAP_RES_SEARCH_ENTRY) {
 240                         Entry ent;
 241                         struct berval bdn;
 242                         e = ldap_first_entry(lc->ld,res);
 243                         if ( ldap_build_entry(op, e, &ent, &bdn,
 244                                                 LDAP_BUILD_ENTRY_PRIVATE) == LDAP_SUCCESS ) {
 245                                 rs->sr_entry = &ent;
 246                                 rs->sr_attrs = op->oq_search.rs_attrs;
 247                                 send_search_entry( op, rs );
 248                                 while (ent.e_attrs) {
 249                                         Attribute *a;
 250                                         BerVarray v;
 251
 252                                         a = ent.e_attrs;
 253                                         ent.e_attrs = a->a_next;
 254
 255                                         v = a->a_vals;
 256                                         if (a->a_vals != &dummy)
 257                                                 ber_bvarray_free(a->a_vals);
 258 #ifdef SLAP_NVALUES
 259                                         if (a->a_nvals != v)
 260                                                 ber_bvarray_free(a->a_nvals);
 261 #endif
 262                                         ch_free(a);
 263                                 }
 264
 265                                 if ( ent.e_dn && ( ent.e_dn != bdn.bv_val ) )
 266                                         free( ent.e_dn );
 267                                 if ( ent.e_ndn )
 268                                         free( ent.e_ndn );
 269                         }
 270                         ldap_msgfree(res);
 271
 272                 } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 273                         char            **references = NULL;
 274                         int             cnt;
 275
 276                         rc = ldap_parse_reference( lc->ld, res,
 277                                         &references, &rs->sr_ctrls, 1 );
 278
 279                         if ( rc != LDAP_SUCCESS ) {
 280                                 continue;
 281                         }
 282
 283                         if ( references == NULL ) {
 284                                 continue;
 285                         }
 286
 287                         for ( cnt = 0; references[ cnt ]; cnt++ )
 288                                 /* NO OP */ ;
 289
 290                         rs->sr_ref = ch_calloc( cnt + 1, sizeof( struct berval ) );
 291
 292                         for ( cnt = 0; references[ cnt ]; cnt++ ) {
 293                                 rs->sr_ref[ cnt ].bv_val = references[ cnt ];
 294                                 rs->sr_ref[ cnt ].bv_len = strlen( references[ cnt ] );
 295                         }
 296
 297                         /* ignore return value by now */
 298                         ( void )send_search_reference( op, rs );
 299
 300                         /* cleanup */
 301                         if ( references ) {
 302                                 ldap_value_free( references );
 303                                 ch_free( rs->sr_ref );
 304                                 rs->sr_ref = NULL;
 305                         }
 306
 307                         if ( rs->sr_ctrls ) {
 308                                 ldap_controls_free( rs->sr_ctrls );
 309                                 rs->sr_ctrls = NULL;
 310                         }
 311
 312                 } else {
 313                         rc = ldap_parse_result(lc->ld, res, &rs->sr_err, &match,
 314                                 (char **)&rs->sr_text, NULL, NULL, 1);
 315                         if (rc != LDAP_SUCCESS ) rs->sr_err = rc;
 316                         rs->sr_err = ldap_back_map_result(rs);
 317                         rc = 0;
 318                         break;
 319                 }
 320         }
 321
 322         if (rc == -1)
 323                 goto fail;
 324
 325 #ifdef ENABLE_REWRITE
 326         /*
 327          * Rewrite the matched portion of the search base, if required
 328          */
 329         if ( match != NULL ) {
 330                 switch ( rewrite_session( li->rwinfo, "matchedDn",
 331                                 match, op->o_conn, (char **)&rs->sr_matched ) ) {
 332                 case REWRITE_REGEXEC_OK:
 333                         if ( rs->sr_matched == NULL ) {
 334                                 rs->sr_matched = ( char * )match;
 335                         }
 336 #ifdef NEW_LOGGING
 337                         LDAP_LOG( BACK_LDAP, DETAIL1,
 338                                 "[rw]  matchedDn:" " \"%s\" -> \"%s\"\n", match, rs->sr_matched, 0 );
 339 #else /* !NEW_LOGGING */
 340                         Debug( LDAP_DEBUG_ARGS, "rw> matchedDn:"
 341                                         " \"%s\" -> \"%s\"\n%s",
 342                                         match, rs->sr_matched, "" );
 343 #endif /* !NEW_LOGGING */
 344                         break;
 345
 346                 case REWRITE_REGEXEC_UNWILLING:
 347
 348                 case REWRITE_REGEXEC_ERR:
 349                         /* FIXME: no error, but no matched ... */
 350                         rs->sr_matched = NULL;
 351                         break;
 352                 }
 353         }
 354 #else /* !ENABLE_REWRITE */
 355         if ( match != NULL ) {
 356                 struct berval dn, mdn;
 357
 358                 ber_str2bv(match, 0, 0, &dn);
 359                 ldap_back_dn_massage(li, &dn, &mdn, 0, 0);
 360                 rs->sr_matched = mdn.bv_val;
 361         }
 362 #endif /* !ENABLE_REWRITE */
 363         if ( rs->sr_v2ref ) {
 364                 rs->sr_err = LDAP_REFERRAL;
 365         }
 366         send_ldap_result( op, rs );
 367
 368 finish:;
 369         if ( match ) {
 370                 if ( rs->sr_matched != match ) {
 371                         free( (char *)rs->sr_matched );
 372                 }
 373                 rs->sr_matched = NULL;
 374                 LDAP_FREE(match);
 375         }
 376         if ( rs->sr_text ) {
 377                 LDAP_FREE( (char *)rs->sr_text );
 378                 rs->sr_text = NULL;
 379         }
 380         if ( mapped_attrs ) {
 381                 ch_free( mapped_attrs );
 382         }
 383         if ( mfilter.bv_val != op->oq_search.rs_filterstr.bv_val ) {
 384                 ch_free( mfilter.bv_val );
 385         }
 386         if ( mbase.bv_val != op->o_req_dn.bv_val ) {
 387                 free( mbase.bv_val );
 388         }
 389
 390         return rc;
 391 }
 392
 393 static int
 394 ldap_build_entry(
 395         Operation *op,
 396         LDAPMessage *e,
 397         Entry *ent,
 398         struct berval *bdn,
 399         int flags
 400 )
 401 {
 402         struct ldapinfo *li = (struct ldapinfo *) op->o_bd->be_private;
 403         struct berval a, mapped;
 404         BerElement ber = *e->lm_ber;
 405         Attribute *attr, **attrp;
 406         struct berval *bv;
 407         const char *text;
 408         int last;
 409         int private = flags & LDAP_BUILD_ENTRY_PRIVATE;
 410 #ifdef SLAP_NVALUES
 411         int normalize = flags & LDAP_BUILD_ENTRY_NORMALIZE;
 412 #endif /* SLAP_NVALUES */
 413
 414         /* safe assumptions ... */
 415         assert( ent );
 416         ent->e_bv.bv_val = NULL;
 417
 418         if ( ber_scanf( &ber, "{m{", bdn ) == LBER_ERROR ) {
 419                 return LDAP_DECODING_ERROR;
 420         }
 421 #ifdef ENABLE_REWRITE
 422
 423         /*
 424          * Rewrite the dn of the result, if needed
 425          */
 426         switch ( rewrite_session( li->rwinfo, "searchResult",
 427                                 bdn->bv_val, op->o_conn,
 428                                 &ent->e_name.bv_val ) ) {
 429         case REWRITE_REGEXEC_OK:
 430                 if ( ent->e_name.bv_val == NULL ) {
 431                         ent->e_name = *bdn;
 432                 } else {
 433 #ifdef NEW_LOGGING
 434                         LDAP_LOG( BACK_LDAP, DETAIL1,
 435                                 "[rw] searchResult: \"%s\"" " -> \"%s\"\n",
 436                                 bdn->bv_val, ent->e_dn, 0 );
 437 #else /* !NEW_LOGGING */
 438                         Debug( LDAP_DEBUG_ARGS, "rw> searchResult: \"%s\""
 439                                         " -> \"%s\"\n%s", bdn->bv_val, ent->e_dn, "" );
 440 #endif /* !NEW_LOGGING */
 441                         ent->e_name.bv_len = strlen( ent->e_name.bv_val );
 442                 }
 443                 break;
 444
 445         case REWRITE_REGEXEC_ERR:
 446         case REWRITE_REGEXEC_UNWILLING:
 447                 return LDAP_OTHER;
 448         }
 449 #else /* !ENABLE_REWRITE */
 450         ldap_back_dn_massage( li, bdn, &ent->e_name, 0, 0 );
 451 #endif /* !ENABLE_REWRITE */
 452
 453         /*
 454          * Note: this may fail if the target host(s) schema differs
 455          * from the one known to the meta, and a DN with unknown
 456          * attributes is returned.
 457          *
 458          * FIXME: should we log anything, or delegate to dnNormalize2?
 459          */
 460         if ( dnNormalize2( NULL, &ent->e_name, &ent->e_nname ) != LDAP_SUCCESS ) {
 461                 return LDAP_INVALID_DN_SYNTAX;
 462         }
 463
 464         ent->e_id = 0;
 465         ent->e_attrs = 0;
 466         ent->e_private = 0;
 467         attrp = &ent->e_attrs;
 468
 469         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 470                 ldap_back_map(&li->at_map, &a, &mapped, BACKLDAP_REMAP);
 471                 if (mapped.bv_val == NULL || mapped.bv_val[0] == '\0')
 472                         continue;
 473                 attr = (Attribute *)ch_malloc( sizeof(Attribute) );
 474                 if (attr == NULL)
 475                         continue;
 476                 attr->a_flags = 0;
 477                 attr->a_next = 0;
 478                 attr->a_desc = NULL;
 479                 if (slap_bv2ad(&mapped, &attr->a_desc, &text) != LDAP_SUCCESS) {
 480                         if (slap_bv2undef_ad(&mapped, &attr->a_desc, &text)
 481                                         != LDAP_SUCCESS) {
 482 #ifdef NEW_LOGGING
 483                                 LDAP_LOG( BACK_LDAP, DETAIL1,
 484                                         "slap_bv2undef_ad(%s):  %s\n", mapped.bv_val, text, 0 );
 485 #else /* !NEW_LOGGING */
 486                                 Debug( LDAP_DEBUG_ANY,
 487                                                 "slap_bv2undef_ad(%s):  "
 488                                                 "%s\n%s", mapped.bv_val, text, "" );
 489 #endif /* !NEW_LOGGING */
 490                                 ch_free(attr);
 491                                 continue;
 492                         }
 493                 }
 494
 495                 /* no subschemaSubentry */
 496                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 497                         BerVarray       vals;
 498
 499                         /*
 500                          * We eat target's subschemaSubentry because
 501                          * a search for this value is likely not
 502                          * to resolve to the appropriate backend;
 503                          * later, the local subschemaSubentry is
 504                          * added.
 505                          */
 506                         ( void )ber_scanf( &ber, "x" /* [W] */ );
 507
 508                         ch_free(attr);
 509                         continue;
 510                 }
 511
 512                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 513                                 || attr->a_vals == NULL ) {
 514                         /*
 515                          * Note: attr->a_vals can be null when using
 516                          * values result filter
 517                          */
 518                         if (private) {
 519                                 attr->a_vals = &dummy;
 520                         } else {
 521                                 attr->a_vals = ch_malloc(sizeof(struct berval));
 522                                 attr->a_vals->bv_val = NULL;
 523                                 attr->a_vals->bv_len = 0;
 524                         }
 525                         last = 0;
 526                 } else {
 527                         for ( last = 0; attr->a_vals[last].bv_val; last++ );
 528                 }
 529                 if ( last == 0 ) {
 530                         /* empty */
 531                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 532                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 533                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 534                                 ldap_back_map(&li->oc_map, bv, &mapped,
 535                                                 BACKLDAP_REMAP);
 536                                 if (mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 537                                         LBER_FREE(bv->bv_val);
 538                                         bv->bv_val = NULL;
 539                                         if (--last < 0)
 540                                                 break;
 541                                         *bv = attr->a_vals[last];
 542                                         attr->a_vals[last].bv_val = NULL;
 543                                         bv--;
 544
 545                                 } else if ( mapped.bv_val != bv->bv_val ) {
 546                                         /*
 547                                          * FIXME: after LBER_FREEing
 548                                          * the value is replaced by
 549                                          * ch_alloc'ed memory
 550                                          */
 551                                         LBER_FREE(bv->bv_val);
 552                                         ber_dupbv( bv, &mapped );
 553                                 }
 554                         }
 555
 556                 /*
 557                  * It is necessary to try to rewrite attributes with
 558                  * dn syntax because they might be used in ACLs as
 559                  * members of groups; since ACLs are applied to the
 560                  * rewritten stuff, no dn-based subject clause could
 561                  * be used at the ldap backend side (see
 562                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 563                  * The problem can be overcome by moving the dn-based
 564                  * ACLs to the target directory server, and letting
 565                  * everything pass thru the ldap backend.
 566                  */
 567                 } else if ( strcmp( attr->a_desc->ad_type->sat_syntax->ssyn_oid,
 568                                         SLAPD_DN_SYNTAX ) == 0 ) {
 569                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 570                                 struct berval   newval;
 571
 572 #ifdef ENABLE_REWRITE
 573                                 switch ( rewrite_session( li->rwinfo,
 574                                                         "searchResult",
 575                                                         bv->bv_val,
 576                                                         op->o_conn,
 577                                                         &newval.bv_val )) {
 578                                 case REWRITE_REGEXEC_OK:
 579                                         /* left as is */
 580                                         if ( newval.bv_val == NULL ) {
 581                                                 break;
 582                                         }
 583                                         newval.bv_len = strlen( newval.bv_val );
 584 #ifdef NEW_LOGGING
 585                                         LDAP_LOG( BACK_LDAP, DETAIL1,
 586                                                 "[rw] searchResult on attr=%s: \"%s\" -> \"%s\"\n",
 587                                                 attr->a_desc->ad_type->sat_cname.bv_val,
 588                                                 bv->bv_val, newval.bv_val );
 589 #else /* !NEW_LOGGING */
 590                                         Debug( LDAP_DEBUG_ARGS,
 591                 "rw> searchResult on attr=%s: \"%s\" -> \"%s\"\n",
 592                                                 attr->a_desc->ad_type->sat_cname.bv_val,
 593                                                 bv->bv_val, newval.bv_val );
 594 #endif /* !NEW_LOGGING */
 595                                         free( bv->bv_val );
 596                                         *bv = newval;
 597                                         break;
 598
 599                                 case REWRITE_REGEXEC_UNWILLING:
 600                                         LBER_FREE(bv->bv_val);
 601                                         bv->bv_val = NULL;
 602                                         if (--last < 0)
 603                                                 goto next_attr;
 604                                         *bv = attr->a_vals[last];
 605                                         attr->a_vals[last].bv_val = NULL;
 606                                         bv--;
 607                                         break;
 608
 609                                 case REWRITE_REGEXEC_ERR:
 610                                         /*
 611                                          * FIXME: better give up,
 612                                          * skip the attribute
 613                                          * or leave it untouched?
 614                                          */
 615                                         break;
 616                                 }
 617 #else /* !ENABLE_REWRITE */
 618                                 ldap_back_dn_massage( li, bv, &newval, 0, 0 );
 619                                 if ( bv->bv_val != newval.bv_val ) {
 620                                         LBER_FREE( bv->bv_val );
 621                                 }
 622                                 *bv = newval;
 623 #endif /* !ENABLE_REWRITE */
 624                         }
 625                 }
 626
 627 next_attr:;
 628
 629 #ifdef SLAP_NVALUES
 630                 if ( normalize ) {
 631                         if ( last && attr->a_desc->ad_type->sat_equality &&
 632                                 attr->a_desc->ad_type->sat_equality->smr_normalize ) {
 633                                 int i;
 634
 635                                 attr->a_nvals = ch_malloc((last+1)*sizeof(struct berval));
 636                                 for (i=0; i<last; i++) {
 637                                         attr->a_desc->ad_type->sat_equality->smr_normalize(
 638                                                 SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
 639                                                 attr->a_desc->ad_type->sat_syntax,
 640                                                 attr->a_desc->ad_type->sat_equality,
 641                                                 &attr->a_vals[i], &attr->a_nvals[i] );
 642                                 }
 643                                 attr->a_nvals[i].bv_val = NULL;
 644                                 attr->a_nvals[i].bv_len = 0;
 645                         } else {
 646                                 attr->a_nvals = attr->a_vals;
 647                         }
 648                 } else {
 649                         attr->a_nvals = NULL;
 650                 }
 651 #endif
 652                 *attrp = attr;
 653                 attrp = &attr->a_next;
 654         }
 655         /* make sure it's free'able */
 656         if (!private && ent->e_name.bv_val == bdn->bv_val)
 657                 ber_dupbv( &ent->e_name, bdn );
 658         return LDAP_SUCCESS;
 659 }
 660
 661 /* return 0 IFF we can retrieve the entry with ndn
 662  */
 663 int
 664 ldap_back_entry_get(
 665         Operation *op,
 666         struct berval   *ndn,
 667         ObjectClass *oc,
 668         AttributeDescription *at,
 669         int rw,
 670         Entry **ent
 671 )
 672 {
 673         struct ldapinfo *li = (struct ldapinfo *) op->o_bd->be_private;
 674         struct ldapconn *lc;
 675         int rc = 1, is_oc;
 676         struct berval mapped = { 0, NULL }, bdn, mdn;
 677         LDAPMessage     *result = NULL, *e = NULL;
 678         char *gattr[3];
 679         char *filter = NULL;
 680         Connection *oconn;
 681         SlapReply rs;
 682
 683         /* Tell getconn this is a privileged op */
 684         is_oc = op->o_do_not_cache;
 685         op->o_do_not_cache = 1;
 686         lc = ldap_back_getconn(op, &rs);
 687         oconn = op->o_conn;
 688         op->o_conn = NULL;
 689         if ( !lc || !ldap_back_dobind(lc, op, &rs) ) {
 690                 op->o_do_not_cache = is_oc;
 691                 op->o_conn = oconn;
 692                 return 1;
 693         }
 694         op->o_do_not_cache = is_oc;
 695         op->o_conn = oconn;
 696
 697         /*
 698          * Rewrite the search base, if required
 699          */
 700 #ifdef ENABLE_REWRITE
 701         switch ( rewrite_session( li->rwinfo, "searchBase",
 702                                 ndn->bv_val, op->o_conn, &mdn.bv_val ) ) {
 703         case REWRITE_REGEXEC_OK:
 704                 if ( mdn.bv_val == NULL ) {
 705                         mdn = *ndn;
 706                 } else {
 707                         mdn.bv_len = strlen( mdn.bv_val );
 708                 }
 709
 710 #ifdef NEW_LOGGING
 711                 LDAP_LOG( BACK_LDAP, DETAIL1,
 712                         "[rw] searchBase: \"%s\" -> \"%s\"\n",
 713                         ndn->bv_val, mdn.bv_val, 0 );
 714 #else /* !NEW_LOGGING */
 715                 Debug( LDAP_DEBUG_ARGS, "rw> searchBase: \"%s\" -> \"%s\"\n",
 716                                 ndn->bv_val, mdn.bv_val, 0 );
 717 #endif /* !NEW_LOGGING */
 718                 break;
 719
 720         case REWRITE_REGEXEC_UNWILLING:
 721         case REWRITE_REGEXEC_ERR:
 722                 return 1;
 723         }
 724
 725 #else /* !ENABLE_REWRITE */
 726         ldap_back_dn_massage( li, ndn, &mdn, 0, 1 );
 727 #endif /* !ENABLE_REWRITE */
 728
 729         ldap_back_map(&li->at_map, &at->ad_cname, &mapped, BACKLDAP_MAP);
 730         if (mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 731                 rc = 1;
 732                 goto cleanup;
 733         }
 734
 735         is_oc = (strcasecmp("objectclass", mapped.bv_val) == 0);
 736         if (oc && !is_oc) {
 737                 gattr[0] = "objectclass";
 738                 gattr[1] = mapped.bv_val;
 739                 gattr[2] = NULL;
 740         } else {
 741                 gattr[0] = mapped.bv_val;
 742                 gattr[1] = NULL;
 743         }
 744         if (oc) {
 745                 char *ptr;
 746                 ldap_back_map(&li->oc_map, &oc->soc_cname, &mapped,
 747                                                 BACKLDAP_MAP);
 748                 filter = ch_malloc(sizeof("(objectclass=)") + mapped.bv_len);
 749                 ptr = lutil_strcopy(filter, "(objectclass=");
 750                 ptr = lutil_strcopy(ptr, mapped.bv_val);
 751                 *ptr++ = ')';
 752                 *ptr++ = '\0';
 753         }
 754
 755         if (ldap_search_ext_s(lc->ld, mdn.bv_val, LDAP_SCOPE_BASE, filter,
 756                                 gattr, 0, NULL, NULL, LDAP_NO_LIMIT,
 757                                 LDAP_NO_LIMIT, &result) != LDAP_SUCCESS)
 758         {
 759                 goto cleanup;
 760         }
 761
 762         if ((e = ldap_first_entry(lc->ld, result)) == NULL) {
 763                 goto cleanup;
 764         }
 765
 766         *ent = ch_calloc(1,sizeof(Entry));
 767
 768         rc = ldap_build_entry(op, e, *ent, &bdn, LDAP_BUILD_ENTRY_NORMALIZE);
 769
 770         if (rc != LDAP_SUCCESS) {
 771                 ch_free(*ent);
 772                 *ent = NULL;
 773         }
 774
 775 cleanup:
 776         if (result) {
 777                 ldap_msgfree(result);
 778         }
 779
 780         if ( filter ) {
 781                 ch_free( filter );
 782         }
 783
 784         if ( mdn.bv_val != ndn->bv_val ) {
 785                 ch_free( mdn.bv_val );
 786         }
 787
 788         return(rc);
 789 }
 790