git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /*
   2  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   3  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   4  *
   5  * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
   6  *
   7  * This work has been developed to fulfill the requirements
   8  * of SysNet s.n.c. <http:www.sys-net.it> and it has been donated
   9  * to the OpenLDAP Foundation in the hope that it may be useful
  10  * to the Open Source community, but WITHOUT ANY WARRANTY.
  11  *
  12  * Permission is granted to anyone to use this software for any purpose
  13  * on any computer system, and to alter it and redistribute it, subject
  14  * to the following restrictions:
  15  *
  16  * 1. The author and SysNet s.n.c. are not responsible for the consequences
  17  *    of use of this software, no matter how awful, even if they arise from
  18  *    flaws in it.
  19  *
  20  * 2. The origin of this software must not be misrepresented, either by
  21  *    explicit claim or by omission.  Since few users ever read sources,
  22  *    credits should appear in the documentation.
  23  *
  24  * 3. Altered versions must be plainly marked as such, and must not be
  25  *    misrepresented as being the original software.  Since few users
  26  *    ever read sources, credits should appear in the documentation.
  27  *    SysNet s.n.c. cannot be responsible for the consequences of the
  28  *    alterations.
  29  *
  30  * 4. This notice may not be removed or altered.
  31  *
  32  *
  33  * This software is based on the backend back-ldap, implemented
  34  * by Howard Chu <hyc@highlandsun.com>, and modified by Mark Valence
  35  * <kurash@sassafras.com>, Pierangelo Masarati <ando@sys-net.it> and other
  36  * contributors. The contribution of the original software to the present
  37  * implementation is acknowledged in this copyright statement.
  38  *
  39  * A special acknowledgement goes to Howard for the overall architecture
  40  * (and for borrowing large pieces of code), and to Mark, who implemented
  41  * from scratch the attribute/objectclass mapping.
  42  *
  43  * The original copyright statement follows.
  44  *
  45  * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
  46  *
  47  * Permission is granted to anyone to use this software for any purpose
  48  * on any computer system, and to alter it and redistribute it, subject
  49  * to the following restrictions:
  50  *
  51  * 1. The author is not responsible for the consequences of use of this
  52  *    software, no matter how awful, even if they arise from flaws in it.
  53  *
  54  * 2. The origin of this software must not be misrepresented, either by
  55  *    explicit claim or by omission.  Since few users ever read sources,
  56  *    credits should appear in the documentation.
  57  *
  58  * 3. Altered versions must be plainly marked as such, and must not be
  59  *    misrepresented as being the original software.  Since few users
  60  *    ever read sources, credits should appear in the
  61  *    documentation.
  62  *
  63  * 4. This notice may not be removed or altered.
  64  *
  65  */
  66
  67 #include "portable.h"
  68
  69 #include <stdio.h>
  70
  71 #include <ac/socket.h>
  72 #include <ac/string.h>
  73 #include <ac/time.h>
  74
  75 #include "slap.h"
  76 #include "../back-ldap/back-ldap.h"
  77 #include "back-meta.h"
  78 #include "ldap_pvt.h"
  79 #undef ldap_debug       /* silence a warning in ldap-int.h */
  80 #include "ldap_log.h"
  81 #include "../../../libraries/libldap/ldap-int.h"
  82
  83 static int
  84 meta_send_entry(
  85                 Backend         *be,
  86                 Operation       *op,
  87                 struct metaconn *lc,
  88                 int             i,
  89                 LDAPMessage     *e,
  90                 AttributeName   *attrs,
  91                 int             attrsonly
  92 );
  93
  94 static int
  95 is_one_level_rdn(
  96                 const char      *rdn,
  97                 int             from
  98 );
  99
 100 int
 101 meta_back_search(
 102                 Backend         *be,
 103                 Connection      *conn,
 104                 Operation       *op,
 105                 struct berval   *base,
 106                 struct berval   *nbase,
 107                 int             scope,
 108                 int             deref,
 109                 int             slimit,
 110                 int             tlimit,
 111                 Filter          *filter,
 112                 struct berval   *filterstr,
 113                 AttributeName   *attrs,
 114                 int             attrsonly
 115 )
 116 {
 117         struct metainfo *li = ( struct metainfo * )be->be_private;
 118         struct metaconn *lc;
 119         struct metasingleconn *lsc;
 120         struct timeval  tv = { 0, 0 };
 121         LDAPMessage     *res, *e;
 122         int     count, rc = 0, *msgid, sres = LDAP_NO_SUCH_OBJECT;
 123         char *match = NULL, *err = NULL;
 124         char *mbase = NULL, *mmatch = NULL;
 125         struct berval mfilter;
 126         BerVarray v2refs = NULL;
 127
 128         int i, last = 0, candidates = 0, op_type;
 129         struct slap_limits_set *limit = NULL;
 130         int isroot = 0;
 131
 132         if ( scope == LDAP_SCOPE_BASE ) {
 133                 op_type = META_OP_REQUIRE_SINGLE;
 134         } else {
 135                 op_type = META_OP_ALLOW_MULTIPLE;
 136         }
 137
 138         /*
 139          * controls are set in ldap_back_dobind()
 140          *
 141          * FIXME: in case of values return filter, we might want
 142          * to map attrs and maybe rewrite value
 143          */
 144         lc = meta_back_getconn( li, conn, op, op_type, nbase, NULL );
 145         if ( !lc || !meta_back_dobind( lc, op ) ) {
 146                 return -1;
 147         }
 148
 149         /*
 150          * Array of message id of each target
 151          */
 152         msgid = ch_calloc( sizeof( int ), li->ntargets );
 153         if ( msgid == NULL ) {
 154                 send_ldap_result( conn, op, LDAP_OTHER,
 155                                 NULL, NULL, NULL, NULL );
 156                 return -1;
 157         }
 158
 159         /* if not root, get appropriate limits */
 160         if ( be_isroot( be, &op->o_ndn ) ) {
 161                 isroot = 1;
 162         } else {
 163                 ( void ) get_limits( be, &op->o_ndn, &limit );
 164         }
 165
 166         /* if no time limit requested, rely on remote server limits */
 167         /* if requested limit higher than hard limit, abort */
 168         if ( !isroot && tlimit > limit->lms_t_hard ) {
 169                 /* no hard limit means use soft instead */
 170                 if ( limit->lms_t_hard == 0
 171                                 && limit->lms_t_soft > -1
 172                                 && tlimit > limit->lms_t_soft ) {
 173                         tlimit = limit->lms_t_soft;
 174
 175                 /* positive hard limit means abort */
 176                 } else if ( limit->lms_t_hard > 0 ) {
 177                         send_ldap_result( conn, op, LDAP_ADMINLIMIT_EXCEEDED,
 178                                         NULL, NULL, NULL, NULL );
 179                         rc = 0;
 180                         goto finish;
 181                 }
 182
 183                 /* negative hard limit means no limit */
 184         }
 185
 186         /* if no size limit requested, rely on remote server limits */
 187         /* if requested limit higher than hard limit, abort */
 188         if ( !isroot && slimit > limit->lms_s_hard ) {
 189                 /* no hard limit means use soft instead */
 190                 if ( limit->lms_s_hard == 0
 191                                 && limit->lms_s_soft > -1
 192                                 && slimit > limit->lms_s_soft ) {
 193                         slimit = limit->lms_s_soft;
 194
 195                 /* positive hard limit means abort */
 196                 } else if ( limit->lms_s_hard > 0 ) {
 197                         send_ldap_result( conn, op, LDAP_ADMINLIMIT_EXCEEDED,
 198                                         NULL, NULL, NULL, NULL );
 199                         rc = 0;
 200                         goto finish;
 201                 }
 202
 203                 /* negative hard limit means no limit */
 204         }
 205
 206         /*
 207          * Inits searches
 208          */
 209         for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
 210                 char    *realbase = ( char * )base->bv_val;
 211                 int     realscope = scope;
 212                 ber_len_t suffixlen;
 213                 char    *mapped_filter, **mapped_attrs;
 214
 215                 if ( lsc->candidate != META_CANDIDATE ) {
 216                         msgid[ i ] = -1;
 217                         continue;
 218                 }
 219
 220                 /* should we check return values? */
 221                 if ( deref != -1 ) {
 222                         ldap_set_option( lsc->ld, LDAP_OPT_DEREF,
 223                                         ( void * )&deref);
 224                 }
 225                 if ( tlimit != -1 ) {
 226                         ldap_set_option( lsc->ld, LDAP_OPT_TIMELIMIT,
 227                                         ( void * )&tlimit);
 228                 }
 229                 if ( slimit != -1 ) {
 230                         ldap_set_option( lsc->ld, LDAP_OPT_SIZELIMIT,
 231                                         ( void * )&slimit);
 232                 }
 233
 234                 /*
 235                  * modifies the base according to the scope, if required
 236                  */
 237                 suffixlen = li->targets[ i ]->suffix.bv_len;
 238                 if ( suffixlen > nbase->bv_len ) {
 239                         switch ( scope ) {
 240                         case LDAP_SCOPE_SUBTREE:
 241                                 /*
 242                                  * make the target suffix the new base
 243                                  * FIXME: this is very forgiving, because
 244                                  * illegal bases may be turned into
 245                                  * the suffix of the target.
 246                                  */
 247                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 248                                                 nbase ) ) {
 249                                         realbase = li->targets[ i ]->suffix.bv_val;
 250                                 } else {
 251                                         /*
 252                                          * this target is no longer candidate
 253                                          */
 254                                         msgid[ i ] = -1;
 255                                         continue;
 256                                 }
 257                                 break;
 258
 259                         case LDAP_SCOPE_ONELEVEL:
 260                                 if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 261                                                 suffixlen - nbase->bv_len - 1 )
 262                         && dnIsSuffix( &li->targets[ i ]->suffix, nbase ) ) {
 263                                         /*
 264                                          * if there is exactly one level,
 265                                          * make the target suffix the new
 266                                          * base, and make scope "base"
 267                                          */
 268                                         realbase = li->targets[ i ]->suffix.bv_val;
 269                                         realscope = LDAP_SCOPE_BASE;
 270                                         break;
 271                                 } /* else continue with the next case */
 272
 273                         case LDAP_SCOPE_BASE:
 274                                 /*
 275                                  * this target is no longer candidate
 276                                  */
 277                                 msgid[ i ] = -1;
 278                                 continue;
 279                         }
 280
 281                 }
 282
 283                 /*
 284                  * Rewrite the search base, if required
 285                  */
 286                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 287                                         "searchBase",
 288                                         realbase, conn, &mbase ) ) {
 289                 case REWRITE_REGEXEC_OK:
 290                 if ( mbase == NULL ) {
 291                         mbase = realbase;
 292                 }
 293 #ifdef NEW_LOGGING
 294                 LDAP_LOG( BACK_META, DETAIL1,
 295                         "[rw] searchBase: \"%s\" -> \"%s\"\n", base->bv_val, mbase, 0 );
 296 #else /* !NEW_LOGGING */
 297                 Debug( LDAP_DEBUG_ARGS, "rw> searchBase: \"%s\" -> \"%s\"\n%s",
 298                                 base->bv_val, mbase, "" );
 299 #endif /* !NEW_LOGGING */
 300                 break;
 301
 302                 case REWRITE_REGEXEC_UNWILLING:
 303                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 304                                         NULL, "Operation not allowed",
 305                                         NULL, NULL );
 306                         rc = -1;
 307                         goto finish;
 308
 309                 case REWRITE_REGEXEC_ERR:
 310                         send_ldap_result( conn, op, LDAP_OTHER,
 311                                         NULL, "rewrite error", NULL, NULL );
 312                         rc = -1;
 313                         goto finish;
 314                 }
 315
 316                 /*
 317                  * Rewrite the search filter, if required
 318                  */
 319                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 320                                         "searchFilter",
 321                                         filterstr->bv_val, conn, &mfilter.bv_val ) ) {
 322                 case REWRITE_REGEXEC_OK:
 323                         if ( mfilter.bv_val != NULL && mfilter.bv_val[ 0 ] != '\0') {
 324                                 mfilter.bv_len = strlen( mfilter.bv_val );
 325                         } else {
 326                                 if ( mfilter.bv_val != NULL ) {
 327                                         free( mfilter.bv_val );
 328                                 }
 329                                 mfilter = *filterstr;
 330                         }
 331 #ifdef NEW_LOGGING
 332                         LDAP_LOG( BACK_META, DETAIL1,
 333                                 "[rw] searchFilter: \"%s\" -> \"%s\"\n",
 334                                 filterstr->bv_val, mfilter.bv_val, 0 );
 335 #else /* !NEW_LOGGING */
 336                         Debug( LDAP_DEBUG_ARGS,
 337                                 "rw> searchFilter: \"%s\" -> \"%s\"\n%s",
 338                                 filterstr->bv_val, mfilter.bv_val, "" );
 339 #endif /* !NEW_LOGGING */
 340                         break;
 341
 342                 case REWRITE_REGEXEC_UNWILLING:
 343                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 344                                         NULL, "Operation not allowed",
 345                                         NULL, NULL );
 346                         rc = -1;
 347                         goto finish;
 348
 349                 case REWRITE_REGEXEC_ERR:
 350                         send_ldap_result( conn, op, LDAP_OTHER,
 351                                         NULL, "Rewrite error", NULL, NULL );
 352                         rc = -1;
 353                         goto finish;
 354                 }
 355
 356                 /*
 357                  * Maps attributes in filter
 358                  */
 359                 mapped_filter = ldap_back_map_filter( &li->targets[ i ]->at_map,
 360                                 &li->targets[ i ]->oc_map, &mfilter,
 361                                 BACKLDAP_MAP );
 362                 if ( mapped_filter == NULL ) {
 363                         mapped_filter = ( char * )mfilter.bv_val;
 364                 } else {
 365                         if ( mfilter.bv_val != filterstr->bv_val ) {
 366                                 free( mfilter.bv_val );
 367                         }
 368                 }
 369                 mfilter.bv_val = NULL;
 370                 mfilter.bv_len = 0;
 371
 372                 /*
 373                  * Maps required attributes
 374                  */
 375                 mapped_attrs = ldap_back_map_attrs( &li->targets[ i ]->at_map,
 376                                 attrs, BACKLDAP_MAP );
 377                 if ( mapped_attrs == NULL && attrs) {
 378                         for ( count=0; attrs[ count ].an_name.bv_val; count++ );
 379                         mapped_attrs = ch_malloc( ( count + 1 ) * sizeof(char *));
 380                         for ( count=0; attrs[ count ].an_name.bv_val; count++ ) {
 381                                 mapped_attrs[ count ] = attrs[ count ].an_name.bv_val;
 382                         }
 383                         mapped_attrs[ count ] = NULL;
 384                 }
 385
 386                 /*
 387                  * Starts the search
 388                  */
 389                 msgid[ i ] = ldap_search( lsc->ld, mbase, realscope,
 390                                 mapped_filter, mapped_attrs, attrsonly );
 391                 if ( mapped_attrs ) {
 392                         free( mapped_attrs );
 393                         mapped_attrs = NULL;
 394                 }
 395                 if ( mapped_filter != filterstr->bv_val ) {
 396                         free( mapped_filter );
 397                         mapped_filter = NULL;
 398                 }
 399                 if ( mbase != realbase ) {
 400                         free( mbase );
 401                         mbase = NULL;
 402                 }
 403
 404                 if ( msgid[ i ] == -1 ) {
 405                         continue;
 406                 }
 407
 408                 ++candidates;
 409         }
 410
 411         /* We pull apart the ber result, stuff it into a slapd entry, and
 412          * let send_search_entry stuff it back into ber format. Slow & ugly,
 413          * but this is necessary for version matching, and for ACL processing.
 414          */
 415
 416
 417         /*
 418          * In case there are no candidates, no cycle takes place...
 419          *
 420          * FIXME: we might use a queue, to balance the load
 421          * among the candidates
 422          */
 423         for ( count = 0, rc = 0; candidates > 0; ) {
 424                 int ab, gotit = 0;
 425
 426                 /* check for abandon */
 427                 ab = op->o_abandon;
 428
 429                 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); lsc++, i++ ) {
 430                         if ( msgid[ i ] == -1 ) {
 431                                 continue;
 432                         }
 433
 434                         if ( ab ) {
 435                                 ldap_abandon( lsc->ld, msgid[ i ] );
 436                                 rc = 0;
 437                                 break;
 438                         }
 439
 440                         if ( slimit > 0 && count == slimit ) {
 441                                 send_search_result( conn, op,
 442                                                 LDAP_SIZELIMIT_EXCEEDED,
 443                                                 NULL, NULL, v2refs, NULL,
 444                                                 count );
 445                                 goto finish;
 446                         }
 447
 448                         /*
 449                          * FIXME: handle time limit as well?
 450                          * Note that target servers are likely
 451                          * to handle it, so at some time we'll
 452                          * get a LDAP_TIMELIMIT_EXCEEDED from
 453                          * one of them ...
 454                          */
 455                         rc = ldap_result( lsc->ld, msgid[ i ],
 456                                         0, &tv, &res );
 457
 458                         if ( rc == 0 ) {
 459                                 continue;
 460
 461                         } else if ( rc == -1 ) {
 462                                 /* something REALLY bad happened! */
 463                                 ( void )meta_clear_unused_candidates( li,
 464                                                 lc, -1, 0 );
 465                                 send_search_result( conn, op, LDAP_OTHER,
 466                                                 NULL, NULL, v2refs, NULL,
 467                                                 count );
 468
 469                                 /* anything else needs be done? */
 470                                 goto finish;
 471
 472                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 473                                 e = ldap_first_entry( lsc->ld, res );
 474                                 if ( meta_send_entry( be, op, lc, i, e, attrs,
 475                                                 attrsonly ) == LDAP_SUCCESS ) {
 476                                         count++;
 477                                 }
 478                                 ldap_msgfree( res );
 479                                 gotit = 1;
 480
 481                         } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 482                                 char            **references = NULL;
 483                                 LDAPControl     **ctrls = NULL;
 484                                 BerVarray       refs;
 485                                 int             cnt;
 486
 487                                 /*
 488                                  * FIXME: should we collect references
 489                                  * and send them alltogether at the end?
 490                                  */
 491
 492                                 rc = ldap_parse_reference( lsc->ld, res,
 493                                                 &references, &ctrls, 1 );
 494
 495                                 if ( rc != LDAP_SUCCESS ) {
 496                                         continue;
 497                                 }
 498
 499                                 if ( references == NULL ) {
 500                                         continue;
 501                                 }
 502
 503                                 for ( cnt = 0; references[ cnt ]; cnt++ )
 504                                         /* NO OP */ ;
 505
 506                                 refs = ch_calloc( cnt + 1, sizeof( struct berval ) );
 507
 508                                 for ( cnt = 0; references[ cnt ]; cnt++ ) {
 509                                         refs[ cnt ].bv_val = references[ cnt ];
 510                                         refs[ cnt ].bv_len = strlen( references[ cnt ] );
 511                                 }
 512
 513                                 /* ignore return value by now */
 514                                 ( void )send_search_reference( be, conn, op,
 515                                                 NULL, refs, ctrls, &v2refs );
 516
 517                                 /* cleanup */
 518                                 if ( references ) {
 519                                         ldap_value_free( references );
 520                                         ch_free( refs );
 521                                 }
 522
 523                                 if ( ctrls ) {
 524                                         ldap_controls_free( ctrls );
 525                                 }
 526
 527                         } else {
 528                                 sres = ldap_result2error( lsc->ld,
 529                                                 res, 1 );
 530                                 sres = ldap_back_map_result( sres );
 531                                 if ( err != NULL ) {
 532                                         free( err );
 533                                 }
 534                                 ldap_get_option( lsc->ld,
 535                                                 LDAP_OPT_ERROR_STRING, &err );
 536                                 if ( match != NULL ) {
 537                                         free( match );
 538                                 }
 539                                 ldap_get_option( lsc->ld,
 540                                                 LDAP_OPT_MATCHED_DN, &match );
 541
 542 #ifdef NEW_LOGGING
 543                                 LDAP_LOG( BACK_META, ERR,
 544                                         "meta_back_search [%d] "
 545                                         "match=\"%s\" err=\"%s\"\n",
 546                                         i, match, err );
 547 #else /* !NEW_LOGGING */
 548                                 Debug( LDAP_DEBUG_ANY,
 549                                         "=>meta_back_search [%d] "
 550                                         "match=\"%s\" err=\"%s\"\n",
 551                                         i, match, err );
 552 #endif /* !NEW_LOGGING */
 553
 554                                 last = i;
 555                                 rc = 0;
 556
 557                                 /*
 558                                  * When no candidates are left,
 559                                  * the outer cycle finishes
 560                                  */
 561                                 msgid[ i ] = -1;
 562                                 --candidates;
 563                         }
 564                 }
 565
 566                 if ( ab ) {
 567                         goto finish;
 568                 }
 569
 570                 if ( gotit == 0 ) {
 571                         tv.tv_sec = 0;
 572                         tv.tv_usec = 100000;
 573                         ldap_pvt_thread_yield();
 574                 } else {
 575                         tv.tv_sec = 0;
 576                         tv.tv_usec = 0;
 577                 }
 578         }
 579
 580         if ( rc == -1 ) {
 581                 /*
 582                  * FIXME: need a strategy to handle errors
 583                  */
 584                 rc = meta_back_op_result( lc, op );
 585                 goto finish;
 586         }
 587
 588         /*
 589          * Rewrite the matched portion of the search base, if required
 590          *
 591          * FIXME: only the last one gets caught!
 592          */
 593         if ( match != NULL ) {
 594                 switch ( rewrite_session( li->targets[ last ]->rwinfo,
 595                                         "matchedDn", match, conn, &mmatch ) ) {
 596                 case REWRITE_REGEXEC_OK:
 597                         if ( mmatch == NULL ) {
 598                                 mmatch = ( char * )match;
 599                         }
 600 #ifdef NEW_LOGGING
 601                         LDAP_LOG( BACK_META, DETAIL1,
 602                                 "[rw] matchedDn: \"%s\" -> \"%s\"\n", match, mmatch, 0 );
 603 #else /* !NEW_LOGGING */
 604                         Debug( LDAP_DEBUG_ARGS, "rw> matchedDn:"
 605                                        " \"%s\" -> \"%s\"\n%s",
 606                                        match, mmatch, "" );
 607 #endif /* !NEW_LOGGING */
 608                         break;
 609
 610                 case REWRITE_REGEXEC_UNWILLING:
 611
 612                 case REWRITE_REGEXEC_ERR:
 613                         /* FIXME: no error, but no matched ... */
 614                         mmatch = NULL;
 615                         break;
 616                 }
 617         }
 618
 619         /*
 620          * In case we returned at least one entry, we return LDAP_SUCCESS
 621          * otherwise, the latter error code we got
 622          *
 623          * FIXME: we should handle error codes and return the more
 624          * important/reasonable
 625          */
 626         if ( sres == LDAP_SUCCESS && v2refs ) {
 627                 sres = LDAP_REFERRAL;
 628         }
 629         send_search_result( conn, op, sres, mmatch, err, v2refs, NULL, count );
 630
 631 finish:;
 632         if ( match ) {
 633                 if ( mmatch != match ) {
 634                         free( mmatch );
 635                 }
 636                 free(match);
 637         }
 638
 639         if ( err ) {
 640                 free( err );
 641         }
 642
 643         if ( msgid ) {
 644                 ch_free( msgid );
 645         }
 646
 647         return rc;
 648 }
 649
 650 static int
 651 meta_send_entry(
 652                 Backend         *be,
 653                 Operation       *op,
 654                 struct metaconn *lc,
 655                 int             target,
 656                 LDAPMessage     *e,
 657                 AttributeName   *attrs,
 658                 int             attrsonly
 659 )
 660 {
 661         struct metainfo         *li = ( struct metainfo * )be->be_private;
 662         struct berval           a, mapped;
 663         Entry                   ent;
 664         BerElement              ber = *e->lm_ber;
 665         Attribute               *attr, **attrp;
 666         struct berval           dummy = { 0, NULL };
 667         struct berval           *bv, bdn;
 668         const char              *text;
 669
 670         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 671                 return LDAP_DECODING_ERROR;
 672         }
 673
 674         /*
 675          * Rewrite the dn of the result, if needed
 676          */
 677         switch ( rewrite_session( li->targets[ target ]->rwinfo,
 678                                 "searchResult", bdn.bv_val, lc->conn, &ent.e_name.bv_val ) ) {
 679         case REWRITE_REGEXEC_OK:
 680                 if ( ent.e_name.bv_val == NULL ) {
 681                         ent.e_name = bdn;
 682
 683                 } else {
 684 #ifdef NEW_LOGGING
 685                         LDAP_LOG( BACK_META, DETAIL1,
 686                                 "[rw] searchResult[%d]: \"%s\" -> \"%s\"\n",
 687                                 target, bdn.bv_val, ent.e_name.bv_val );
 688 #else /* !NEW_LOGGING */
 689                         Debug( LDAP_DEBUG_ARGS, "rw> searchResult[%d]: \"%s\""
 690                                         " -> \"%s\"\n", target, bdn.bv_val, ent.e_name.bv_val );
 691 #endif /* !NEW_LOGGING */
 692                         ent.e_name.bv_len = strlen( ent.e_name.bv_val );
 693                 }
 694                 break;
 695
 696         case REWRITE_REGEXEC_UNWILLING:
 697                 return LDAP_UNWILLING_TO_PERFORM;
 698
 699         case REWRITE_REGEXEC_ERR:
 700                 return LDAP_OTHER;
 701         }
 702
 703         /*
 704          * Note: this may fail if the target host(s) schema differs
 705          * from the one known to the meta, and a DN with unknown
 706          * attributes is returned.
 707          *
 708          * FIXME: should we log anything, or delegate to dnNormalize2?
 709          */
 710         if ( dnNormalize2( NULL, &ent.e_name, &ent.e_nname ) != LDAP_SUCCESS ) {
 711                 return LDAP_INVALID_DN_SYNTAX;
 712         }
 713
 714         /*
 715          * cache dn
 716          */
 717         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 718                 ( void )meta_dncache_update_entry( &li->cache,
 719                                                    &ent.e_nname,
 720                                                    target );
 721         }
 722
 723         ent.e_id = 0;
 724         ent.e_attrs = 0;
 725         ent.e_private = 0;
 726         attrp = &ent.e_attrs;
 727
 728         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 729                 ldap_back_map( &li->targets[ target ]->at_map,
 730                                 &a, &mapped, BACKLDAP_REMAP );
 731                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0' ) {
 732                         continue;
 733                 }
 734                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 735                 if ( attr == NULL ) {
 736                         continue;
 737                 }
 738                 attr->a_flags = 0;
 739                 attr->a_next = 0;
 740                 attr->a_desc = NULL;
 741                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 742                                 != LDAP_SUCCESS) {
 743                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 744                                         != LDAP_SUCCESS) {
 745 #ifdef NEW_LOGGING
 746                                 LDAP_LOG( BACK_META, DETAIL1,
 747                                         "slap_bv2undef_ad(%s): %s\n", mapped.bv_val, text, 0 );
 748 #else /* !NEW_LOGGING */
 749                                 Debug( LDAP_DEBUG_ANY,
 750                                                 "slap_bv2undef_ad(%s): "
 751                                                 "%s\n%s", mapped.bv_val, text, "" );
 752 #endif /* !NEW_LOGGING */
 753                                 ch_free( attr );
 754                                 continue;
 755                         }
 756                 }
 757
 758                 /* no subschemaSubentry */
 759                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 760                         ch_free(attr);
 761                         continue;
 762                 }
 763
 764                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 765                                 || attr->a_vals == NULL ) {
 766                         attr->a_vals = &dummy;
 767
 768                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 769                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 770                         int i, last;
 771                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 772                         for ( i = 0, bv = attr->a_vals; bv->bv_val; bv++, i++ ) {
 773                                 ldap_back_map( &li->targets[ target]->oc_map,
 774                                                 bv, &mapped, BACKLDAP_REMAP );
 775                                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 776                                         free( bv->bv_val );
 777                                         bv->bv_val = NULL;
 778                                         if ( --last < 0 ) {
 779                                                 break;
 780                                         }
 781                                         *bv = attr->a_vals[ last ];
 782                                         attr->a_vals[ last ].bv_val = NULL;
 783                                         i--;
 784
 785                                 } else if ( mapped.bv_val != bv->bv_val ) {
 786                                         free( bv->bv_val );
 787                                         ber_dupbv( bv, &mapped );
 788                                 }
 789                         }
 790                 /*
 791                  * It is necessary to try to rewrite attributes with
 792                  * dn syntax because they might be used in ACLs as
 793                  * members of groups; since ACLs are applied to the
 794                  * rewritten stuff, no dn-based subecj clause could
 795                  * be used at the ldap backend side (see
 796                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 797                  * The problem can be overcome by moving the dn-based
 798                  * ACLs to the target directory server, and letting
 799                  * everything pass thru the ldap backend.
 800                  */
 801                 } else if ( strcmp( attr->a_desc->ad_type->sat_syntax->ssyn_oid,
 802                                         SLAPD_DN_SYNTAX ) == 0 ) {
 803                         int i;
 804                         for ( i = 0, bv = attr->a_vals; bv->bv_val; bv++, i++ ) {
 805                                 char *newval;
 806
 807                                 switch ( rewrite_session( li->targets[ target ]->rwinfo,
 808                                                         "searchResult",
 809                                                         bv->bv_val,
 810                                                         lc->conn, &newval )) {
 811                                 case REWRITE_REGEXEC_OK:
 812                                         /* left as is */
 813                                         if ( newval == NULL ) {
 814                                                 break;
 815                                         }
 816 #ifdef NEW_LOGGING
 817                                         LDAP_LOG( BACK_META, DETAIL1,
 818                                                 "[rw] searchResult on attr=%s: \"%s\" -> \"%s\"\n",
 819                                                 attr->a_desc->ad_type->sat_cname.bv_val,
 820                                                 bv->bv_val, newval );
 821 #else /* !NEW_LOGGING */
 822                                         Debug( LDAP_DEBUG_ARGS,
 823                                                 "rw> searchResult on attr=%s:"
 824                                                 " \"%s\" -> \"%s\"\n",
 825                                         attr->a_desc->ad_type->sat_cname.bv_val,
 826                                                 bv->bv_val, newval );
 827 #endif /* !NEW_LOGGING */
 828                                         free( bv->bv_val );
 829                                         bv->bv_val = newval;
 830                                         bv->bv_len = strlen( newval );
 831
 832                                         break;
 833
 834                                 case REWRITE_REGEXEC_UNWILLING:
 835
 836                                 case REWRITE_REGEXEC_ERR:
 837                                         /*
 838                                          * FIXME: better give up,
 839                                          * skip the attribute
 840                                          * or leave it untouched?
 841                                          */
 842                                         break;
 843                                 }
 844                         }
 845                 }
 846                 *attrp = attr;
 847                 attrp = &attr->a_next;
 848         }
 849         send_search_entry( be, lc->conn, op, &ent, attrs, attrsonly, NULL );
 850         while ( ent.e_attrs ) {
 851                 attr = ent.e_attrs;
 852                 ent.e_attrs = attr->a_next;
 853                 if ( attr->a_vals != &dummy ) {
 854                         ber_bvarray_free( attr->a_vals );
 855                 }
 856                 free( attr );
 857         }
 858
 859         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 860                 free( ent.e_dn );
 861         }
 862         if ( ent.e_ndn ) {
 863                 free( ent.e_ndn );
 864         }
 865
 866         return LDAP_SUCCESS;
 867 }
 868
 869 static int
 870 is_one_level_rdn(
 871                 const char      *rdn,
 872                 int             from
 873 )
 874 {
 875         for ( ; from--; ) {
 876                 if ( DN_SEPARATOR( rdn[ from ] ) ) {
 877                         return 0;
 878                 }
 879         }
 880
 881         return 1;
 882 }
 883