git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /*
   2  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   3  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   4  *
   5  * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
   6  *
   7  * This work has been developed to fulfill the requirements
   8  * of SysNet s.n.c. <http:www.sys-net.it> and it has been donated
   9  * to the OpenLDAP Foundation in the hope that it may be useful
  10  * to the Open Source community, but WITHOUT ANY WARRANTY.
  11  *
  12  * Permission is granted to anyone to use this software for any purpose
  13  * on any computer system, and to alter it and redistribute it, subject
  14  * to the following restrictions:
  15  *
  16  * 1. The author and SysNet s.n.c. are not responsible for the consequences
  17  *    of use of this software, no matter how awful, even if they arise from
  18  *    flaws in it.
  19  *
  20  * 2. The origin of this software must not be misrepresented, either by
  21  *    explicit claim or by omission.  Since few users ever read sources,
  22  *    credits should appear in the documentation.
  23  *
  24  * 3. Altered versions must be plainly marked as such, and must not be
  25  *    misrepresented as being the original software.  Since few users
  26  *    ever read sources, credits should appear in the documentation.
  27  *    SysNet s.n.c. cannot be responsible for the consequences of the
  28  *    alterations.
  29  *
  30  * 4. This notice may not be removed or altered.
  31  *
  32  *
  33  * This software is based on the backend back-ldap, implemented
  34  * by Howard Chu <hyc@highlandsun.com>, and modified by Mark Valence
  35  * <kurash@sassafras.com>, Pierangelo Masarati <ando@sys-net.it> and other
  36  * contributors. The contribution of the original software to the present
  37  * implementation is acknowledged in this copyright statement.
  38  *
  39  * A special acknowledgement goes to Howard for the overall architecture
  40  * (and for borrowing large pieces of code), and to Mark, who implemented
  41  * from scratch the attribute/objectclass mapping.
  42  *
  43  * The original copyright statement follows.
  44  *
  45  * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
  46  *
  47  * Permission is granted to anyone to use this software for any purpose
  48  * on any computer system, and to alter it and redistribute it, subject
  49  * to the following restrictions:
  50  *
  51  * 1. The author is not responsible for the consequences of use of this
  52  *    software, no matter how awful, even if they arise from flaws in it.
  53  *
  54  * 2. The origin of this software must not be misrepresented, either by
  55  *    explicit claim or by omission.  Since few users ever read sources,
  56  *    credits should appear in the documentation.
  57  *
  58  * 3. Altered versions must be plainly marked as such, and must not be
  59  *    misrepresented as being the original software.  Since few users
  60  *    ever read sources, credits should appear in the
  61  *    documentation.
  62  *
  63  * 4. This notice may not be removed or altered.
  64  *
  65  */
  66
  67 #include "portable.h"
  68
  69 #include <stdio.h>
  70
  71 #include <ac/socket.h>
  72 #include <ac/string.h>
  73 #include <ac/time.h>
  74
  75 #include "slap.h"
  76 #include "../back-ldap/back-ldap.h"
  77 #include "back-meta.h"
  78 #include "ldap_pvt.h"
  79 #undef ldap_debug       /* silence a warning in ldap-int.h */
  80 #include "ldap_log.h"
  81 #include "../../../libraries/libldap/ldap-int.h"
  82
  83 static int
  84 meta_send_entry(
  85                 Backend         *be,
  86                 Operation       *op,
  87                 struct metaconn *lc,
  88                 int             i,
  89                 LDAPMessage     *e,
  90                 AttributeName   *attrs,
  91                 int             attrsonly
  92 );
  93
  94 static int
  95 is_one_level_rdn(
  96                 const char      *rdn,
  97                 int             from
  98 );
  99
 100 int
 101 meta_back_search(
 102                 Backend         *be,
 103                 Connection      *conn,
 104                 Operation       *op,
 105                 struct berval   *base,
 106                 struct berval   *nbase,
 107                 int             scope,
 108                 int             deref,
 109                 int             slimit,
 110                 int             tlimit,
 111                 Filter          *filter,
 112                 struct berval   *filterstr,
 113                 AttributeName   *attrs,
 114                 int             attrsonly
 115 )
 116 {
 117         struct metainfo *li = ( struct metainfo * )be->be_private;
 118         struct metaconn *lc;
 119         struct metasingleconn *lsc;
 120         struct timeval  tv = { 0, 0 };
 121         LDAPMessage     *res, *e;
 122         int     count, rc = 0, *msgid, sres = LDAP_NO_SUCH_OBJECT;
 123         char *match = NULL, *err = NULL;
 124         char *mbase = NULL, *mmatch = NULL;
 125         struct berval mfilter;
 126         BerVarray v2refs = NULL;
 127
 128         int i, last = 0, candidates = 0;
 129         struct slap_limits_set *limit = NULL;
 130         int isroot = 0;
 131
 132 #ifdef LDAP_CACHING
 133         cache_manager*  cm = li->cm;
 134
 135         if (cm->caching) {
 136                 return meta_back_cache_search(be, conn, op, base, nbase,
 137                                         scope, deref, slimit, tlimit,
 138                                         filter, filterstr, attrs, attrsonly);
 139         }
 140 #endif /* LDAP_CACHING */
 141
 142         /*
 143          * controls are set in ldap_back_dobind()
 144          *
 145          * FIXME: in case of values return filter, we might want
 146          * to map attrs and maybe rewrite value
 147          */
 148         lc = meta_back_getconn( li, conn, op, META_OP_ALLOW_MULTIPLE,
 149                         nbase, NULL );
 150         if ( !lc || !meta_back_dobind( lc, op ) ) {
 151                 send_ldap_result( conn, op, LDAP_OTHER,
 152                                 NULL, NULL, NULL, NULL );
 153                 return -1;
 154         }
 155
 156         /*
 157          * Array of message id of each target
 158          */
 159         msgid = ch_calloc( sizeof( int ), li->ntargets );
 160         if ( msgid == NULL ) {
 161                 send_ldap_result( conn, op, LDAP_OTHER,
 162                                 NULL, NULL, NULL, NULL );
 163                 return -1;
 164         }
 165
 166         /* if not root, get appropriate limits */
 167         if ( be_isroot( be, &op->o_ndn ) ) {
 168                 isroot = 1;
 169         } else {
 170                 ( void ) get_limits( be, &op->o_ndn, &limit );
 171         }
 172
 173         /* if no time limit requested, rely on remote server limits */
 174         /* if requested limit higher than hard limit, abort */
 175         if ( !isroot && tlimit > limit->lms_t_hard ) {
 176                 /* no hard limit means use soft instead */
 177                 if ( limit->lms_t_hard == 0
 178                                 && limit->lms_t_soft > -1
 179                                 && tlimit > limit->lms_t_soft ) {
 180                         tlimit = limit->lms_t_soft;
 181
 182                 /* positive hard limit means abort */
 183                 } else if ( limit->lms_t_hard > 0 ) {
 184                         send_ldap_result( conn, op, LDAP_ADMINLIMIT_EXCEEDED,
 185                                         NULL, NULL, NULL, NULL );
 186                         rc = 0;
 187                         goto finish;
 188                 }
 189
 190                 /* negative hard limit means no limit */
 191         }
 192
 193         /* if no size limit requested, rely on remote server limits */
 194         /* if requested limit higher than hard limit, abort */
 195         if ( !isroot && slimit > limit->lms_s_hard ) {
 196                 /* no hard limit means use soft instead */
 197                 if ( limit->lms_s_hard == 0
 198                                 && limit->lms_s_soft > -1
 199                                 && slimit > limit->lms_s_soft ) {
 200                         slimit = limit->lms_s_soft;
 201
 202                 /* positive hard limit means abort */
 203                 } else if ( limit->lms_s_hard > 0 ) {
 204                         send_ldap_result( conn, op, LDAP_ADMINLIMIT_EXCEEDED,
 205                                         NULL, NULL, NULL, NULL );
 206                         rc = 0;
 207                         goto finish;
 208                 }
 209
 210                 /* negative hard limit means no limit */
 211         }
 212
 213         /*
 214          * Inits searches
 215          */
 216         for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
 217                 char    *realbase = ( char * )base->bv_val;
 218                 int     realscope = scope;
 219                 ber_len_t suffixlen;
 220                 char    **mapped_attrs;
 221
 222                 if ( lsc->candidate != META_CANDIDATE ) {
 223                         msgid[ i ] = -1;
 224                         continue;
 225                 }
 226
 227                 /* should we check return values? */
 228                 if ( deref != -1 ) {
 229                         ldap_set_option( lsc->ld, LDAP_OPT_DEREF,
 230                                         ( void * )&deref);
 231                 }
 232                 if ( tlimit != -1 ) {
 233                         ldap_set_option( lsc->ld, LDAP_OPT_TIMELIMIT,
 234                                         ( void * )&tlimit);
 235                 }
 236                 if ( slimit != -1 ) {
 237                         ldap_set_option( lsc->ld, LDAP_OPT_SIZELIMIT,
 238                                         ( void * )&slimit);
 239                 }
 240
 241                 /*
 242                  * modifies the base according to the scope, if required
 243                  */
 244                 suffixlen = li->targets[ i ]->suffix.bv_len;
 245                 if ( suffixlen > nbase->bv_len ) {
 246                         switch ( scope ) {
 247                         case LDAP_SCOPE_SUBTREE:
 248                                 /*
 249                                  * make the target suffix the new base
 250                                  * FIXME: this is very forgiving, because
 251                                  * illegal bases may be turned into
 252                                  * the suffix of the target.
 253                                  */
 254                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 255                                                 nbase ) ) {
 256                                         realbase = li->targets[ i ]->suffix.bv_val;
 257                                 } else {
 258                                         /*
 259                                          * this target is no longer candidate
 260                                          */
 261                                         msgid[ i ] = -1;
 262                                         goto new_candidate;
 263                                 }
 264                                 break;
 265
 266                         case LDAP_SCOPE_ONELEVEL:
 267                                 if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 268                                                 suffixlen - nbase->bv_len - 1 )
 269                         && dnIsSuffix( &li->targets[ i ]->suffix, nbase ) ) {
 270                                         /*
 271                                          * if there is exactly one level,
 272                                          * make the target suffix the new
 273                                          * base, and make scope "base"
 274                                          */
 275                                         realbase = li->targets[ i ]->suffix.bv_val;
 276                                         realscope = LDAP_SCOPE_BASE;
 277                                         break;
 278                                 } /* else continue with the next case */
 279
 280                         case LDAP_SCOPE_BASE:
 281                                 /*
 282                                  * this target is no longer candidate
 283                                  */
 284                                 msgid[ i ] = -1;
 285                                 goto new_candidate;
 286                         }
 287
 288                 }
 289
 290                 /*
 291                  * Rewrite the search base, if required
 292                  */
 293                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 294                                         "searchBase",
 295                                         realbase, conn, &mbase ) ) {
 296                 case REWRITE_REGEXEC_OK:
 297                 if ( mbase == NULL ) {
 298                         mbase = realbase;
 299                 }
 300 #ifdef NEW_LOGGING
 301                 LDAP_LOG( BACK_META, DETAIL1,
 302                         "[rw] searchBase [%d]: \"%s\" -> \"%s\"\n",
 303                         i, base->bv_val, mbase );
 304 #else /* !NEW_LOGGING */
 305                 Debug( LDAP_DEBUG_ARGS,
 306                         "rw> searchBase [%d]: \"%s\" -> \"%s\"\n",
 307                                 i, base->bv_val, mbase );
 308 #endif /* !NEW_LOGGING */
 309                 break;
 310
 311                 case REWRITE_REGEXEC_UNWILLING:
 312                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 313                                         NULL, "Operation not allowed",
 314                                         NULL, NULL );
 315                         rc = -1;
 316                         goto finish;
 317
 318                 case REWRITE_REGEXEC_ERR:
 319                         send_ldap_result( conn, op, LDAP_OTHER,
 320                                         NULL, "rewrite error", NULL, NULL );
 321                         rc = -1;
 322                         goto finish;
 323                 }
 324
 325 #if 0
 326                 /*
 327                  * Rewrite the search filter, if required
 328                  */
 329                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 330                                         "searchFilter",
 331                                         filterstr->bv_val, conn, &mfilter.bv_val ) ) {
 332                 case REWRITE_REGEXEC_OK:
 333                         if ( mfilter.bv_val != NULL && mfilter.bv_val[ 0 ] != '\0') {
 334                                 mfilter.bv_len = strlen( mfilter.bv_val );
 335                         } else {
 336                                 if ( mfilter.bv_val != NULL ) {
 337                                         free( mfilter.bv_val );
 338                                 }
 339                                 mfilter = *filterstr;
 340                         }
 341 #ifdef NEW_LOGGING
 342                         LDAP_LOG( BACK_META, DETAIL1,
 343                                 "[rw] searchFilter [%d]: \"%s\" -> \"%s\"\n",
 344                                 i, filterstr->bv_val, mfilter.bv_val );
 345 #else /* !NEW_LOGGING */
 346                         Debug( LDAP_DEBUG_ARGS,
 347                                 "rw> searchFilter [%d]: \"%s\" -> \"%s\"\n",
 348                                 i, filterstr->bv_val, mfilter.bv_val );
 349 #endif /* !NEW_LOGGING */
 350                         break;
 351
 352                 case REWRITE_REGEXEC_UNWILLING:
 353                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 354                                         NULL, "Operation not allowed",
 355                                         NULL, NULL );
 356                         rc = -1;
 357                         goto finish;
 358
 359                 case REWRITE_REGEXEC_ERR:
 360                         send_ldap_result( conn, op, LDAP_OTHER,
 361                                         NULL, "Rewrite error", NULL, NULL );
 362                         rc = -1;
 363                         goto finish;
 364                 }
 365
 366                 /*
 367                  * Maps attributes in filter
 368                  */
 369                 mapped_filter = ldap_back_map_filter( &li->targets[ i ]->at_map,
 370                                 &li->targets[ i ]->oc_map, &mfilter,
 371                                 BACKLDAP_MAP );
 372                 if ( mapped_filter == NULL ) {
 373                         mapped_filter = ( char * )mfilter.bv_val;
 374                 } else {
 375                         if ( mfilter.bv_val != filterstr->bv_val ) {
 376                                 free( mfilter.bv_val );
 377                         }
 378                 }
 379                 mfilter.bv_val = NULL;
 380                 mfilter.bv_len = 0;
 381 #endif
 382
 383                 rc = ldap_back_filter_map_rewrite_( li->targets[ i ]->rwinfo, conn,
 384                         &li->targets[ i ]->at_map, &li->targets[ i ]->oc_map,
 385                         filter, &mfilter, BACKLDAP_MAP );
 386
 387                 /*
 388                  * Maps required attributes
 389                  */
 390                 mapped_attrs = ldap_back_map_attrs( &li->targets[ i ]->at_map,
 391                                 attrs, BACKLDAP_MAP );
 392                 if ( mapped_attrs == NULL && attrs) {
 393                         for ( count=0; attrs[ count ].an_name.bv_val; count++ );
 394                         mapped_attrs = ch_malloc( ( count + 1 ) * sizeof(char *));
 395                         for ( count=0; attrs[ count ].an_name.bv_val; count++ ) {
 396                                 mapped_attrs[ count ] = attrs[ count ].an_name.bv_val;
 397                         }
 398                         mapped_attrs[ count ] = NULL;
 399                 }
 400
 401                 /*
 402                  * Starts the search
 403                  */
 404                 msgid[ i ] = ldap_search( lsc->ld, mbase, realscope,
 405                                 mfilter.bv_val, mapped_attrs, attrsonly );
 406                 if ( mapped_attrs ) {
 407                         free( mapped_attrs );
 408                         mapped_attrs = NULL;
 409                 }
 410                 if ( mfilter.bv_val != filterstr->bv_val ) {
 411                         free( mfilter.bv_val );
 412                         mfilter.bv_val = NULL;
 413                 }
 414                 if ( mbase != realbase ) {
 415                         free( mbase );
 416                         mbase = NULL;
 417                 }
 418
 419                 if ( msgid[ i ] == -1 ) {
 420                         continue;
 421                 }
 422
 423                 ++candidates;
 424
 425 new_candidate:;
 426         }
 427
 428         /* We pull apart the ber result, stuff it into a slapd entry, and
 429          * let send_search_entry stuff it back into ber format. Slow & ugly,
 430          * but this is necessary for version matching, and for ACL processing.
 431          */
 432
 433
 434         /*
 435          * In case there are no candidates, no cycle takes place...
 436          *
 437          * FIXME: we might use a queue, to balance the load
 438          * among the candidates
 439          */
 440         for ( count = 0, rc = 0; candidates > 0; ) {
 441                 int ab, gotit = 0;
 442
 443                 /* check for abandon */
 444                 ab = op->o_abandon;
 445
 446                 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); lsc++, i++ ) {
 447                         if ( msgid[ i ] == -1 ) {
 448                                 continue;
 449                         }
 450
 451                         if ( ab ) {
 452                                 ldap_abandon( lsc->ld, msgid[ i ] );
 453                                 rc = 0;
 454                                 break;
 455                         }
 456
 457                         if ( slimit > 0 && count == slimit ) {
 458                                 send_search_result( conn, op,
 459                                                 LDAP_SIZELIMIT_EXCEEDED,
 460                                                 NULL, NULL, v2refs, NULL,
 461                                                 count );
 462                                 goto finish;
 463                         }
 464
 465                         /*
 466                          * FIXME: handle time limit as well?
 467                          * Note that target servers are likely
 468                          * to handle it, so at some time we'll
 469                          * get a LDAP_TIMELIMIT_EXCEEDED from
 470                          * one of them ...
 471                          */
 472                         rc = ldap_result( lsc->ld, msgid[ i ],
 473                                         0, &tv, &res );
 474
 475                         if ( rc == 0 ) {
 476                                 continue;
 477
 478                         } else if ( rc == -1 ) {
 479                                 /* something REALLY bad happened! */
 480                                 ( void )meta_clear_unused_candidates( li,
 481                                                 lc, -1, 0 );
 482                                 send_search_result( conn, op, LDAP_OTHER,
 483                                                 NULL, NULL, v2refs, NULL,
 484                                                 count );
 485
 486                                 /* anything else needs be done? */
 487                                 goto finish;
 488
 489                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 490                                 e = ldap_first_entry( lsc->ld, res );
 491                                 if ( meta_send_entry( be, op, lc, i, e, attrs,
 492                                                 attrsonly ) == LDAP_SUCCESS ) {
 493                                         count++;
 494                                 }
 495
 496                                 /*
 497                                  * If scope is BASE, we need to jump out
 498                                  * as soon as one entry is found; if
 499                                  * the target pool is properly crafted,
 500                                  * this should correspond to the sole
 501                                  * entry that has the base DN
 502                                  */
 503                                 if ( scope == LDAP_SCOPE_BASE && count > 0 ) {
 504                                         candidates = 0;
 505                                         sres = LDAP_SUCCESS;
 506                                         break;
 507                                 }
 508                                 ldap_msgfree( res );
 509                                 gotit = 1;
 510
 511                         } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 512                                 char            **references = NULL;
 513                                 LDAPControl     **ctrls = NULL;
 514                                 BerVarray       refs;
 515                                 int             cnt;
 516
 517                                 /*
 518                                  * FIXME: should we collect references
 519                                  * and send them alltogether at the end?
 520                                  */
 521
 522                                 rc = ldap_parse_reference( lsc->ld, res,
 523                                                 &references, &ctrls, 1 );
 524
 525                                 if ( rc != LDAP_SUCCESS ) {
 526                                         continue;
 527                                 }
 528
 529                                 if ( references == NULL ) {
 530                                         continue;
 531                                 }
 532
 533                                 for ( cnt = 0; references[ cnt ]; cnt++ )
 534                                         /* NO OP */ ;
 535
 536                                 refs = ch_calloc( cnt + 1, sizeof( struct berval ) );
 537
 538                                 for ( cnt = 0; references[ cnt ]; cnt++ ) {
 539                                         refs[ cnt ].bv_val = references[ cnt ];
 540                                         refs[ cnt ].bv_len = strlen( references[ cnt ] );
 541                                 }
 542
 543                                 /* ignore return value by now */
 544                                 ( void )send_search_reference( be, conn, op,
 545                                                 NULL, refs, ctrls, &v2refs );
 546
 547                                 /* cleanup */
 548                                 if ( references ) {
 549                                         ldap_value_free( references );
 550                                         ch_free( refs );
 551                                 }
 552
 553                                 if ( ctrls ) {
 554                                         ldap_controls_free( ctrls );
 555                                 }
 556
 557                         } else {
 558                                 sres = ldap_result2error( lsc->ld,
 559                                                 res, 1 );
 560                                 sres = ldap_back_map_result( sres );
 561                                 if ( err != NULL ) {
 562                                         free( err );
 563                                 }
 564                                 ldap_get_option( lsc->ld,
 565                                                 LDAP_OPT_ERROR_STRING, &err );
 566                                 if ( match != NULL ) {
 567                                         free( match );
 568                                 }
 569                                 ldap_get_option( lsc->ld,
 570                                                 LDAP_OPT_MATCHED_DN, &match );
 571
 572 #ifdef NEW_LOGGING
 573                                 LDAP_LOG( BACK_META, ERR,
 574                                         "meta_back_search [%d] "
 575                                         "match=\"%s\" err=\"%s\"\n",
 576                                         i, match, err );
 577 #else /* !NEW_LOGGING */
 578                                 Debug( LDAP_DEBUG_ANY,
 579                                         "=>meta_back_search [%d] "
 580                                         "match=\"%s\" err=\"%s\"\n",
 581                                         i, match, err );
 582 #endif /* !NEW_LOGGING */
 583
 584                                 last = i;
 585                                 rc = 0;
 586
 587                                 /*
 588                                  * When no candidates are left,
 589                                  * the outer cycle finishes
 590                                  */
 591                                 msgid[ i ] = -1;
 592                                 --candidates;
 593                         }
 594                 }
 595
 596                 if ( ab ) {
 597                         goto finish;
 598                 }
 599
 600                 if ( gotit == 0 ) {
 601                         tv.tv_sec = 0;
 602                         tv.tv_usec = 100000;
 603                         ldap_pvt_thread_yield();
 604                 } else {
 605                         tv.tv_sec = 0;
 606                         tv.tv_usec = 0;
 607                 }
 608         }
 609
 610         if ( rc == -1 ) {
 611                 /*
 612                  * FIXME: need a strategy to handle errors
 613                  */
 614                 rc = meta_back_op_result( lc, op );
 615                 goto finish;
 616         }
 617
 618         /*
 619          * Rewrite the matched portion of the search base, if required
 620          *
 621          * FIXME: only the last one gets caught!
 622          */
 623         if ( match != NULL ) {
 624                 switch ( rewrite_session( li->targets[ last ]->rwinfo,
 625                                         "matchedDn", match, conn, &mmatch ) ) {
 626                 case REWRITE_REGEXEC_OK:
 627                         if ( mmatch == NULL ) {
 628                                 mmatch = ( char * )match;
 629                         }
 630 #ifdef NEW_LOGGING
 631                         LDAP_LOG( BACK_META, DETAIL1,
 632                                 "[rw] matchedDn: \"%s\" -> \"%s\"\n",
 633                                 match, mmatch, 0 );
 634 #else /* !NEW_LOGGING */
 635                         Debug( LDAP_DEBUG_ARGS,
 636                                 "rw> matchedDn: \"%s\" -> \"%s\"\n",
 637                                 match, mmatch, 0 );
 638 #endif /* !NEW_LOGGING */
 639                         break;
 640
 641                 case REWRITE_REGEXEC_UNWILLING:
 642
 643                 case REWRITE_REGEXEC_ERR:
 644                         /* FIXME: no error, but no matched ... */
 645                         mmatch = NULL;
 646                         break;
 647                 }
 648         }
 649
 650         /*
 651          * In case we returned at least one entry, we return LDAP_SUCCESS
 652          * otherwise, the latter error code we got
 653          *
 654          * FIXME: we should handle error codes and return the more
 655          * important/reasonable
 656          */
 657         if ( sres == LDAP_SUCCESS && v2refs ) {
 658                 sres = LDAP_REFERRAL;
 659         }
 660         send_search_result( conn, op, sres, mmatch, err, v2refs, NULL, count );
 661
 662 finish:;
 663         if ( match ) {
 664                 if ( mmatch != match ) {
 665                         free( mmatch );
 666                 }
 667                 free(match);
 668         }
 669
 670         if ( err ) {
 671                 free( err );
 672         }
 673
 674         if ( msgid ) {
 675                 ch_free( msgid );
 676         }
 677
 678         return rc;
 679 }
 680
 681 static int
 682 meta_send_entry(
 683                 Backend         *be,
 684                 Operation       *op,
 685                 struct metaconn *lc,
 686                 int             target,
 687                 LDAPMessage     *e,
 688                 AttributeName   *attrs,
 689                 int             attrsonly
 690 )
 691 {
 692         struct metainfo         *li = ( struct metainfo * )be->be_private;
 693         struct berval           a, mapped;
 694         Entry                   ent;
 695         BerElement              ber = *e->lm_ber;
 696         Attribute               *attr, **attrp;
 697         struct berval           dummy = { 0, NULL };
 698         struct berval           *bv, bdn;
 699         const char              *text;
 700
 701         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 702                 return LDAP_DECODING_ERROR;
 703         }
 704
 705         /*
 706          * Rewrite the dn of the result, if needed
 707          */
 708         switch ( rewrite_session( li->targets[ target ]->rwinfo,
 709                                 "searchResult", bdn.bv_val, lc->conn, &ent.e_name.bv_val ) ) {
 710         case REWRITE_REGEXEC_OK:
 711                 if ( ent.e_name.bv_val == NULL ) {
 712                         ent.e_name = bdn;
 713
 714                 } else {
 715 #ifdef NEW_LOGGING
 716                         LDAP_LOG( BACK_META, DETAIL1,
 717                                 "[rw] searchResult[%d]: \"%s\" -> \"%s\"\n",
 718                                 target, bdn.bv_val, ent.e_name.bv_val );
 719 #else /* !NEW_LOGGING */
 720                         Debug( LDAP_DEBUG_ARGS, "rw> searchResult[%d]: \"%s\""
 721                                         " -> \"%s\"\n", target, bdn.bv_val, ent.e_name.bv_val );
 722 #endif /* !NEW_LOGGING */
 723                         ent.e_name.bv_len = strlen( ent.e_name.bv_val );
 724                 }
 725                 break;
 726
 727         case REWRITE_REGEXEC_UNWILLING:
 728                 return LDAP_UNWILLING_TO_PERFORM;
 729
 730         case REWRITE_REGEXEC_ERR:
 731                 return LDAP_OTHER;
 732         }
 733
 734         /*
 735          * Note: this may fail if the target host(s) schema differs
 736          * from the one known to the meta, and a DN with unknown
 737          * attributes is returned.
 738          *
 739          * FIXME: should we log anything, or delegate to dnNormalize2?
 740          */
 741         if ( dnNormalize2( NULL, &ent.e_name, &ent.e_nname ) != LDAP_SUCCESS ) {
 742                 return LDAP_INVALID_DN_SYNTAX;
 743         }
 744
 745         /*
 746          * cache dn
 747          */
 748         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 749                 ( void )meta_dncache_update_entry( &li->cache,
 750                                                    &ent.e_nname,
 751                                                    target );
 752         }
 753
 754         ent.e_id = 0;
 755         ent.e_attrs = 0;
 756         ent.e_private = 0;
 757         attrp = &ent.e_attrs;
 758
 759         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 760                 ldap_back_map( &li->targets[ target ]->at_map,
 761                                 &a, &mapped, BACKLDAP_REMAP );
 762                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0' ) {
 763                         continue;
 764                 }
 765                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 766                 if ( attr == NULL ) {
 767                         continue;
 768                 }
 769                 attr->a_flags = 0;
 770                 attr->a_next = 0;
 771                 attr->a_desc = NULL;
 772                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 773                                 != LDAP_SUCCESS) {
 774                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 775                                         != LDAP_SUCCESS) {
 776 #ifdef NEW_LOGGING
 777                                 LDAP_LOG( BACK_META, DETAIL1,
 778                                         "slap_bv2undef_ad(%s): %s\n", mapped.bv_val, text, 0 );
 779 #else /* !NEW_LOGGING */
 780                                 Debug( LDAP_DEBUG_ANY,
 781                                                 "slap_bv2undef_ad(%s): "
 782                                                 "%s\n%s", mapped.bv_val, text, "" );
 783 #endif /* !NEW_LOGGING */
 784                                 ch_free( attr );
 785                                 continue;
 786                         }
 787                 }
 788
 789                 /* no subschemaSubentry */
 790                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 791                         ch_free(attr);
 792                         continue;
 793                 }
 794
 795                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 796                                 || attr->a_vals == NULL ) {
 797                         attr->a_vals = &dummy;
 798
 799                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 800                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 801                         int             last;
 802
 803                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 804
 805                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 806                                 ldap_back_map( &li->targets[ target]->oc_map,
 807                                                 bv, &mapped, BACKLDAP_REMAP );
 808                                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 809                                         free( bv->bv_val );
 810                                         bv->bv_val = NULL;
 811                                         if ( --last < 0 ) {
 812                                                 break;
 813                                         }
 814                                         *bv = attr->a_vals[ last ];
 815                                         attr->a_vals[ last ].bv_val = NULL;
 816                                         bv--;
 817
 818                                 } else if ( mapped.bv_val != bv->bv_val ) {
 819                                         free( bv->bv_val );
 820                                         ber_dupbv( bv, &mapped );
 821                                 }
 822                         }
 823                 /*
 824                  * It is necessary to try to rewrite attributes with
 825                  * dn syntax because they might be used in ACLs as
 826                  * members of groups; since ACLs are applied to the
 827                  * rewritten stuff, no dn-based subecj clause could
 828                  * be used at the ldap backend side (see
 829                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 830                  * The problem can be overcome by moving the dn-based
 831                  * ACLs to the target directory server, and letting
 832                  * everything pass thru the ldap backend.
 833                  */
 834                 } else if ( strcmp( attr->a_desc->ad_type->sat_syntax->ssyn_oid,
 835                                         SLAPD_DN_SYNTAX ) == 0 ) {
 836                         int             last;
 837
 838                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 839
 840                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 841                                 char *newval;
 842
 843                                 switch ( rewrite_session( li->targets[ target ]->rwinfo,
 844                                                         "searchResult",
 845                                                         bv->bv_val,
 846                                                         lc->conn, &newval )) {
 847                                 case REWRITE_REGEXEC_OK:
 848                                         /* left as is */
 849                                         if ( newval == NULL ) {
 850                                                 break;
 851                                         }
 852 #ifdef NEW_LOGGING
 853                                         LDAP_LOG( BACK_META, DETAIL1,
 854                                                 "[rw] searchResult on attr=%s: \"%s\" -> \"%s\"\n",
 855                                                 attr->a_desc->ad_type->sat_cname.bv_val,
 856                                                 bv->bv_val, newval );
 857 #else /* !NEW_LOGGING */
 858                                         Debug( LDAP_DEBUG_ARGS,
 859                                                 "rw> searchResult on attr=%s:"
 860                                                 " \"%s\" -> \"%s\"\n",
 861                                         attr->a_desc->ad_type->sat_cname.bv_val,
 862                                                 bv->bv_val, newval );
 863 #endif /* !NEW_LOGGING */
 864                                         free( bv->bv_val );
 865                                         bv->bv_val = newval;
 866                                         bv->bv_len = strlen( newval );
 867
 868                                         break;
 869
 870                                 case REWRITE_REGEXEC_UNWILLING:
 871                                         LBER_FREE(bv->bv_val);
 872                                         bv->bv_val = NULL;
 873                                         if (--last < 0)
 874                                                 goto next_attr;
 875                                         *bv = attr->a_vals[last];
 876                                         attr->a_vals[last].bv_val = NULL;
 877                                         bv--;
 878                                         break;
 879
 880                                 case REWRITE_REGEXEC_ERR:
 881                                         /*
 882                                          * FIXME: better give up,
 883                                          * skip the attribute
 884                                          * or leave it untouched?
 885                                          */
 886                                         break;
 887                                 }
 888                         }
 889                 }
 890 next_attr:;
 891
 892                 *attrp = attr;
 893                 attrp = &attr->a_next;
 894         }
 895         send_search_entry( be, lc->conn, op, &ent, attrs, attrsonly, NULL );
 896         while ( ent.e_attrs ) {
 897                 attr = ent.e_attrs;
 898                 ent.e_attrs = attr->a_next;
 899                 if ( attr->a_vals != &dummy ) {
 900                         ber_bvarray_free( attr->a_vals );
 901                 }
 902                 free( attr );
 903         }
 904
 905         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 906                 free( ent.e_dn );
 907         }
 908         if ( ent.e_ndn ) {
 909                 free( ent.e_ndn );
 910         }
 911
 912         return LDAP_SUCCESS;
 913 }
 914
 915 static int
 916 is_one_level_rdn(
 917                 const char      *rdn,
 918                 int             from
 919 )
 920 {
 921         for ( ; from--; ) {
 922                 if ( DN_SEPARATOR( rdn[ from ] ) ) {
 923                         return 0;
 924                 }
 925         }
 926
 927         return 1;
 928 }
 929