]> git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c
Fixup bdb_entry_release now that entry_decode uses two memory blocks
[openldap] / servers / slapd / back-meta / search.c
1 /*
2  * Copyright 1998-2001 The OpenLDAP Foundation, All Rights Reserved.
3  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
4  *
5  * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
6  *
7  * This work has been developed to fulfill the requirements
8  * of SysNet s.n.c. <http:www.sys-net.it> and it has been donated
9  * to the OpenLDAP Foundation in the hope that it may be useful
10  * to the Open Source community, but WITHOUT ANY WARRANTY.
11  *
12  * Permission is granted to anyone to use this software for any purpose
13  * on any computer system, and to alter it and redistribute it, subject
14  * to the following restrictions:
15  *
16  * 1. The author and SysNet s.n.c. are not responsible for the consequences
17  *    of use of this software, no matter how awful, even if they arise from 
18  *    flaws in it.
19  *
20  * 2. The origin of this software must not be misrepresented, either by
21  *    explicit claim or by omission.  Since few users ever read sources,
22  *    credits should appear in the documentation.
23  *
24  * 3. Altered versions must be plainly marked as such, and must not be
25  *    misrepresented as being the original software.  Since few users
26  *    ever read sources, credits should appear in the documentation.
27  *    SysNet s.n.c. cannot be responsible for the consequences of the
28  *    alterations.
29  *
30  * 4. This notice may not be removed or altered.
31  *
32  *
33  * This software is based on the backend back-ldap, implemented
34  * by Howard Chu <hyc@highlandsun.com>, and modified by Mark Valence
35  * <kurash@sassafras.com>, Pierangelo Masarati <ando@sys-net.it> and other
36  * contributors. The contribution of the original software to the present
37  * implementation is acknowledged in this copyright statement.
38  *
39  * A special acknowledgement goes to Howard for the overall architecture
40  * (and for borrowing large pieces of code), and to Mark, who implemented
41  * from scratch the attribute/objectclass mapping.
42  *
43  * The original copyright statement follows.
44  *
45  * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
46  *
47  * Permission is granted to anyone to use this software for any purpose
48  * on any computer system, and to alter it and redistribute it, subject
49  * to the following restrictions:
50  *
51  * 1. The author is not responsible for the consequences of use of this
52  *    software, no matter how awful, even if they arise from flaws in it.
53  *
54  * 2. The origin of this software must not be misrepresented, either by
55  *    explicit claim or by omission.  Since few users ever read sources,
56  *    credits should appear in the documentation.
57  *
58  * 3. Altered versions must be plainly marked as such, and must not be
59  *    misrepresented as being the original software.  Since few users
60  *    ever read sources, credits should appear in the
61  *    documentation.
62  *
63  * 4. This notice may not be removed or altered.
64  *                
65  */
66
67 #include "portable.h"
68
69 #include <stdio.h>
70
71 #include <ac/socket.h>
72 #include <ac/string.h>
73 #include <ac/time.h>
74
75 #include "slap.h"
76 #include "../back-ldap/back-ldap.h"
77 #include "back-meta.h"
78 #include "ldap_pvt.h"
79
80 static void
81 meta_send_entry(
82                 Backend         *be,
83                 Operation       *op,
84                 struct metaconn *lc,
85                 int             i,
86                 LDAPMessage     *e,
87                 char            **attrs,
88                 int             attrsonly
89 );
90
91 static int
92 is_one_level_rdn(
93                 const char *rdn,
94                 int len
95 );
96
97 int
98 meta_back_search(
99                 Backend         *be,
100                 Connection      *conn,
101                 Operation       *op,
102                 const char      *base,
103                 const char      *nbase,
104                 int             scope,
105                 int             deref,
106                 int             slimit,
107                 int             tlimit,
108                 Filter          *filter,
109                 const char      *filterstr,
110                 char            **attrs,
111                 int             attrsonly
112 )
113 {
114         struct metainfo *li = ( struct metainfo * )be->be_private;
115         struct metaconn *lc;
116         struct metasingleconn **lsc;
117         struct timeval  tv;
118         LDAPMessage     *res, *e;
119         int     count, rc = 0, *msgid, sres = LDAP_NO_SUCH_OBJECT;
120         char *match = NULL, *err = NULL;
121         char *mbase = NULL, *mfilter = NULL, *mmatch = NULL, 
122                 *mapped_filter = NULL, **mapped_attrs = NULL;
123                 
124         int i, last = 0, candidates = 0, nbaselen, op_type;
125         struct slap_limits_set *limit = NULL;
126         int isroot = 0;
127
128         if ( scope == LDAP_SCOPE_BASE ) {
129                 op_type = META_OP_REQUIRE_SINGLE;
130         } else {
131                 op_type = META_OP_ALLOW_MULTIPLE;
132         }
133         
134         lc = meta_back_getconn( li, conn, op, op_type, nbase, NULL );
135         if ( !lc || !meta_back_dobind( lc, op ) ) {
136                 return -1;
137         }
138
139         /*
140          * Array of message id of each target
141          */
142         msgid = ch_calloc( sizeof( int ), li->ntargets );
143         if ( msgid == NULL ) {
144                 send_search_result( conn, op, LDAP_OPERATIONS_ERROR,
145                                 NULL, NULL, NULL, NULL, 0 );
146                 return -1;
147         }
148         
149         nbaselen = strlen( nbase );
150
151         /* if not root, get appropriate limits */
152         if ( be_isroot( be, op->o_ndn ) ) {
153                 isroot = 1;
154         } else {
155                 ( void ) get_limits( be, op->o_ndn, &limit );
156         }
157
158         /* if no time limit requested, rely on remote server limits */
159         /* if requested limit higher than hard limit, abort */
160         if ( !isroot && tlimit > limit->lms_t_hard ) {
161                 /* no hard limit means use soft instead */
162                 if ( limit->lms_t_hard == 0 ) {
163                         tlimit = limit->lms_t_soft;
164                         
165                 /* positive hard limit means abort */
166                 } else if ( limit->lms_t_hard > 0 ) {
167                         send_search_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
168                                         NULL, NULL, NULL, NULL, 0 );
169                         rc = 0;
170                         goto finish;
171                 }
172                 
173                 /* negative hard limit means no limit */
174         }
175         
176         /* if no size limit requested, rely on remote server limits */
177         /* if requested limit higher than hard limit, abort */
178         if ( !isroot && slimit > limit->lms_s_hard ) {
179                 /* no hard limit means use soft instead */
180                 if ( limit->lms_s_hard == 0 ) {
181                         slimit = limit->lms_s_soft;
182                         
183                 /* positive hard limit means abort */
184                 } else if ( limit->lms_s_hard > 0 ) {
185                         send_search_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
186                                         NULL, NULL, NULL, NULL, 0 );
187                         rc = 0;
188                         goto finish;
189                 }
190                 
191                 /* negative hard limit means no limit */
192         }
193
194         /*
195          * Inits searches
196          */
197         for ( i = 0, lsc = lc->conns; lsc[ 0 ] != NULL; ++i, ++lsc ) {
198                 char *realbase = ( char * )base;
199                 int realscope = scope;
200                 int suffixlen;
201                 
202                 if ( lsc[ 0 ]->candidate != META_CANDIDATE ) {
203                         continue;
204                 }
205
206                 if ( deref != -1 ) {
207                         ldap_set_option( lsc[ 0 ]->ld, LDAP_OPT_DEREF,
208                                         ( void * )&deref);
209                 }
210                 if ( tlimit != -1 ) {
211                         ldap_set_option( lsc[ 0 ]->ld, LDAP_OPT_TIMELIMIT,
212                                         ( void * )&tlimit);
213                 }
214                 if ( slimit != -1 ) {
215                         ldap_set_option( lsc[ 0 ]->ld, LDAP_OPT_SIZELIMIT,
216                                         ( void * )&slimit);
217                 }
218
219                 /*
220                  * modifies the base according to the scope, if required
221                  */
222                 suffixlen = strlen( li->targets[ i ]->suffix );
223                 if ( suffixlen > nbaselen ) {
224                         switch ( scope ) {
225                         case LDAP_SCOPE_SUBTREE:
226                                 /*
227                                  * make the target suffix the new base
228                                  * FIXME: this is very forgiving, because
229                                  * illegal bases may be turned into 
230                                  * the suffix of the target.
231                                  */
232                                 if ( dn_issuffix( li->targets[ i ]->suffix,
233                                                 nbase ) ) {
234                                         realbase = li->targets[ i ]->suffix;
235                                 } else {
236                                         /*
237                                          * this target is no longer candidate
238                                          */
239                                         lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
240                                         continue;
241                                 }
242                                 break;
243
244                         case LDAP_SCOPE_ONELEVEL:
245                                 if ( is_one_level_rdn( li->targets[ i ]->suffix,
246                                                 suffixlen-nbaselen-1) 
247                         && dn_issuffix( li->targets[ i ]->suffix, nbase ) ) {
248                                         /*
249                                          * if there is exactly one level,
250                                          * make the target suffix the new
251                                          * base, and make scope "base"
252                                          */
253                                         realbase = li->targets[ i ]->suffix;
254                                         realscope = LDAP_SCOPE_BASE;
255                                         break;
256                                 } /* else continue with the next case */
257
258                         case LDAP_SCOPE_BASE:
259                                 /*
260                                  * this target is no longer candidate
261                                  */
262                                 lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
263                                 continue;
264                         }
265
266                 }
267
268                 /*
269                  * Rewrite the search base, if required
270                  */
271                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
272                                         "searchBase",
273                                         realbase, conn, &mbase ) ) {
274                 case REWRITE_REGEXEC_OK:
275                 if ( mbase == NULL ) {
276                         mbase = realbase;
277                 }
278 #ifdef NEW_LOGGING
279                 LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
280                                 "[rw] searchBase: \"%s\" -> \"%s\"\n",
281                                 base, mbase ));
282 #else /* !NEW_LOGGING */
283                 Debug( LDAP_DEBUG_ARGS, "rw> searchBase: \"%s\" -> \"%s\"\n%s",
284                                 base, mbase, "" );
285 #endif /* !NEW_LOGGING */
286                 break;
287                 
288                 case REWRITE_REGEXEC_UNWILLING:
289                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
290                                         NULL, "Unwilling to perform",
291                                         NULL, NULL );
292                         rc = -1;
293                         goto finish;
294
295                 case REWRITE_REGEXEC_ERR:
296                         send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
297                                         NULL, "Operations error",
298                                         NULL, NULL );
299                         rc = -1;
300                         goto finish;
301                 }
302         
303                 /*
304                  * Rewrite the search filter, if required
305                  */
306                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
307                                         "searchFilter",
308                                         filterstr, conn, &mfilter ) ) {
309                 case REWRITE_REGEXEC_OK:
310                         if ( mfilter == NULL || mfilter[ 0 ] == '\0') {
311                                 if ( mfilter != NULL ) {
312                                         free( mfilter );
313                                 }
314                                 mfilter = ( char * )filterstr;
315                         }
316 #ifdef NEW_LOGGING
317                         LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
318                                         "[rw] searchFilter: \"%s\" -> \"%s\"\n",
319                                         filterstr, mfilter ));
320 #else /* !NEW_LOGGING */
321                         Debug( LDAP_DEBUG_ARGS,
322                                 "rw> searchFilter: \"%s\" -> \"%s\"\n%s",
323                                 filterstr, mfilter, "" );
324 #endif /* !NEW_LOGGING */
325                         break;
326                 
327                 case REWRITE_REGEXEC_UNWILLING:
328                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
329                                         NULL, NULL, NULL, NULL );
330                         rc = -1;
331                         goto finish;
332
333                 case REWRITE_REGEXEC_ERR:
334                         send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
335                                         NULL, NULL, NULL, NULL );
336                         rc = -1;
337                         goto finish;
338                 }
339
340                 /*
341                  * Maps attributes in filter
342                  */
343                 mapped_filter = ldap_back_map_filter( &li->targets[ i ]->at_map,
344                                 &li->targets[ i ]->oc_map,
345                                 ( char * )mfilter, 0 );
346                 if ( mapped_filter == NULL ) {
347                         mapped_filter = ( char * )mfilter;
348                 }
349         
350                 /*
351                  * Maps required attributes
352                  */
353                 mapped_attrs = ldap_back_map_attrs( &li->targets[ i ]->at_map,
354                                 attrs, 0 );
355                 if ( mapped_attrs == NULL ) {
356                         mapped_attrs = attrs;
357                 }
358
359                 /*
360                  * Starts the search
361                  */
362                 msgid[ i ] = ldap_search( lsc[ 0 ]->ld, mbase, realscope,
363                                 mapped_filter, mapped_attrs, attrsonly); 
364                 if ( msgid[ i ] == -1 ) {
365                         lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
366                         continue;
367                 }
368
369                 if ( mapped_attrs != attrs ) {
370                         charray_free( mapped_attrs );
371                         mapped_attrs = NULL;
372                 }
373                 if ( mapped_filter != mfilter ) {
374                         free( mapped_filter );
375                         mapped_filter = NULL;
376                 }
377                 if ( mfilter != filterstr ) {
378                         free( mfilter );
379                         mfilter = NULL;
380                 }
381                 if ( mbase != realbase ) {
382                         free( mbase );
383                         mbase = NULL;
384                 }
385
386                 ++candidates;
387         }
388
389         /* We pull apart the ber result, stuff it into a slapd entry, and
390          * let send_search_entry stuff it back into ber format. Slow & ugly,
391          * but this is necessary for version matching, and for ACL processing.
392          */
393
394
395         /*
396          * In case there are no candidates, no cycle takes place...
397          */
398         for ( count = 0, rc = 0; candidates > 0; ) {
399                 int ab, gotit = 0;
400
401                 /* check for abandon */
402                 ldap_pvt_thread_mutex_lock( &op->o_abandonmutex );
403                 ab = op->o_abandon;
404                 ldap_pvt_thread_mutex_unlock( &op->o_abandonmutex );
405
406                 for ( i = 0, lsc = lc->conns; lsc[ 0 ] != NULL; lsc++, i++ ) {
407                         if ( lsc[ 0 ]->candidate != META_CANDIDATE ) {
408                                 continue;
409                         }
410                         
411                         if ( ab ) {
412                                 ldap_abandon( lsc[ 0 ]->ld, msgid[ i ] );
413                                 rc = 0;
414                                 break;
415                         }
416
417                         if ( slimit > 0 && count == slimit ) {
418                                 send_search_result( conn, op,
419                                                 LDAP_SIZELIMIT_EXCEEDED,
420                                                 NULL, NULL, NULL, NULL, count );
421                                 goto finish;
422                         }
423
424                         rc = ldap_result( lsc[ 0 ]->ld, msgid[ i ],
425                                         0, &tv, &res );
426
427                         if ( rc == 0 ) {
428                                 continue;
429                         } else if ( rc == -1 ) {
430                                 /* something REALLY bad happened! */
431                                 ( void )meta_clear_unused_candidates( li,
432                                                 lc, -1, 0 );
433                                 send_search_result( conn, op,
434                                                 LDAP_OPERATIONS_ERROR,
435                                                 "", "", NULL, NULL, count );
436                                 
437                                 /* anything else needs be done? */
438                                 goto finish;
439                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
440                                 e = ldap_first_entry( lsc[ 0 ]->ld,res );
441                                 meta_send_entry(be, op, lc, i, e, attrs,
442                                                 attrsonly);
443                                 count++;
444                                 ldap_msgfree( res );
445                                 gotit = 1;
446                         } else {
447                                 sres = ldap_result2error( lsc[ 0 ]->ld,
448                                                 res, 1 );
449                                 sres = ldap_back_map_result( sres );
450                                 if ( err != NULL ) {
451                                         free( err );
452                                 }
453                                 ldap_get_option( lsc[ 0 ]->ld,
454                                                 LDAP_OPT_ERROR_STRING, &err );
455                                 if ( match != NULL ) {
456                                         free( match );
457                                 }
458                                 ldap_get_option( lsc[ 0 ]->ld,
459                                                 LDAP_OPT_MATCHED_DN, &match );
460
461 #ifdef NEW_LOGGING
462                                 LDAP_LOG(( "backend", LDAP_LEVEL_ERR,
463                                                 "meta_back_search [%d]"
464                                                 " match=\"%s\" err=\"%s\"\n",
465                                                 i, match, err ));
466 #else /* !NEW_LOGGING */
467                                 Debug( LDAP_DEBUG_ANY,
468         "=>meta_back_search [%d] match=\"%s\" err=\"%s\"\n",
469                                         i, match, err );        
470 #endif /* !NEW_LOGGING */
471                                 
472                                 last = i;
473                                 rc = 0;
474
475                                 /*
476                                  * When no candidates are left,
477                                  * the outer cycle finishes
478                                  */
479                                 lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
480                                 --candidates;
481                         }
482                 }
483
484                 if ( ab ) {
485                         goto finish;
486                 }
487
488                 if ( gotit == 0 ) {
489                         tv.tv_sec = 0;
490                         tv.tv_usec = 100000;
491                         ldap_pvt_thread_yield();
492                 } else {
493                         tv.tv_sec = 0;
494                         tv.tv_usec = 0;
495                 }
496         }
497
498         if ( rc == -1 ) {
499                 /*
500                  * FIXME: need a strategy to handle errors
501                  */
502                 rc = meta_back_op_result( lc, op );
503                 goto finish;
504         }
505
506         /*
507          * Rewrite the matched portion of the search base, if required
508          * 
509          * FIXME: only the last one gets caught!
510          */
511         if ( match != NULL ) {
512                 switch ( rewrite_session( li->targets[ last ]->rwinfo,
513                                         "matchedDn", match, conn, &mmatch ) ) {
514                 case REWRITE_REGEXEC_OK:
515                         if ( mmatch == NULL ) {
516                                 mmatch = ( char * )match;
517                         }
518 #ifdef NEW_LOGGING
519                         LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
520                                         "[rw] matchedDn: \"%s\" -> \"%s\"\n",
521                                         match, mmatch ));
522 #else /* !NEW_LOGGING */
523                         Debug( LDAP_DEBUG_ARGS, "rw> matchedDn:"
524                                        " \"%s\" -> \"%s\"\n%s",
525                                        match, mmatch, "" );
526 #endif /* !NEW_LOGGING */
527                         break;
528                         
529                 case REWRITE_REGEXEC_UNWILLING:
530                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
531                                         NULL, NULL, NULL, NULL );
532                         rc = -1;
533                         goto finish;
534                         
535                 case REWRITE_REGEXEC_ERR:
536                         send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
537                                         NULL, NULL, NULL, NULL );
538                         rc = -1;
539                         goto finish;
540                 }
541         }
542
543         send_search_result( conn, op, sres,
544                 mmatch, err, NULL, NULL, count );
545
546 finish:;
547         if ( match ) {
548                 if ( mmatch != match ) {
549                         free( mmatch );
550                 }
551                 free(match);
552         }
553         
554         if ( err ) {
555                 free( err );
556         }
557         
558         if ( msgid ) {
559                 free( msgid );
560         }
561         
562         return rc;
563 }
564
565 static void
566 meta_send_entry(
567                 Backend *be,
568                 Operation *op,
569                 struct metaconn *lc,
570                 int target,
571                 LDAPMessage *e,
572                 char **attrs,
573                 int attrsonly
574 )
575 {
576         struct metainfo *li = ( struct metainfo * )be->be_private;
577         char *a, *mapped;
578         Entry ent;
579         BerElement *ber = NULL;
580         Attribute *attr, **attrp;
581         struct berval *dummy = NULL;
582         struct berval *bv;
583         const char *text;
584         char *dn;
585
586         struct metasingleconn *lsc = lc->conns[ target ];
587
588         dn = ldap_get_dn( lsc->ld, e );
589         if ( dn == NULL ) {
590                 return;
591         }
592
593         /*
594          * Rewrite the dn of the result, if needed
595          */
596         switch ( rewrite_session( li->targets[ target ]->rwinfo,
597                                 "searchResult", dn, lc->conn, &ent.e_dn ) ) {
598         case REWRITE_REGEXEC_OK:
599                 if ( ent.e_dn == NULL ) {
600                         ent.e_dn = dn;
601                 } else {
602 #ifdef NEW_LOGGING
603                         LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
604                                         "[rw] searchResult[%d]:"
605                                         " \"%s\" -> \"%s\"\n",
606                                         target, dn, ent.e_dn ));
607 #else /* !NEW_LOGGING */
608                         Debug( LDAP_DEBUG_ARGS, "rw> searchResult[%d]: \"%s\""
609                                         " -> \"%s\"\n", target, dn, ent.e_dn );
610 #endif /* !NEW_LOGGING */
611                         free( dn );
612                         dn = NULL;
613                 }
614                 break;
615                 
616         case REWRITE_REGEXEC_ERR:
617         case REWRITE_REGEXEC_UNWILLING:
618                 free( dn );
619                 return;
620         }
621
622         ent.e_ndn = ch_strdup( ent.e_dn );
623         ( void )dn_normalize( ent.e_ndn );
624
625         /*
626          * cache dn
627          */
628         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
629                 ( void )meta_dncache_update_entry( &li->cache,
630                                                    ch_strdup( ent.e_ndn ),
631                                                    target );
632         }
633
634         ent.e_id = 0;
635         ent.e_attrs = 0;
636         ent.e_private = 0;
637         attrp = &ent.e_attrs;
638
639         for ( a = ldap_first_attribute( lsc->ld, e, &ber );
640                         a != NULL;
641                         a = ldap_next_attribute( lsc->ld, e, ber ) )
642         {
643                 mapped = ldap_back_map( &li->targets[ target ]->at_map, a, 1 );
644                 if ( mapped == NULL ) {
645                         continue;
646                 }
647                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
648                 if ( attr == NULL ) {
649                         continue;
650                 }
651                 attr->a_next = 0;
652                 attr->a_desc = NULL;
653                 if ( slap_str2ad( mapped, &attr->a_desc, &text )
654                                 != LDAP_SUCCESS) {
655                         if (slap_str2undef_ad(mapped, &attr->a_desc, &text) 
656                                         != LDAP_SUCCESS) {
657 #ifdef NEW_LOGGING
658                                 LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
659                                                 "slap_str2undef_ad(%s): "
660                                                 "%s\n", mapped, text ));
661 #else /* !NEW_LOGGING */
662                                 Debug( LDAP_DEBUG_ANY,
663                                                 "slap_str2undef_ad(%s): "
664                                                 "%s\n%s", mapped, text, "" );
665 #endif /* !NEW_LOGGING */
666                                 ch_free(attr);
667                                 continue;
668                         }
669                 }
670                 attr->a_vals = ldap_get_values_len( lsc->ld, e, a );
671                 if ( !attr->a_vals ) {
672                         attr->a_vals = &dummy;
673                 } else if ( strcasecmp( mapped, "objectClass" ) == 0 ) {
674                         int i, last;
675                         for ( last = 0; attr->a_vals[ last ]; ++last ) ;
676                         for ( i = 0; ( bv = attr->a_vals[ i ] ); i++ ) {
677                                 mapped = ldap_back_map(
678                                                 &li->targets[ target]->oc_map,
679                                                 bv->bv_val, 1 );
680                                 if ( mapped == NULL ) {
681                                         ber_bvfree( attr->a_vals[ i ] );
682                                         attr->a_vals[ i ] = NULL;
683                                         if ( --last < 0 ) {
684                                                 break;
685                                         }
686                                         attr->a_vals[ i ] = 
687                                                 attr->a_vals[ last ];
688                                         attr->a_vals[ last ] = NULL;
689                                         --i;
690                                 } else if ( mapped != bv->bv_val ) {
691                                         ch_free( bv->bv_val );
692                                         bv->bv_val = ch_strdup( mapped );
693                                         bv->bv_len = strlen( mapped );
694                                 }
695                         }
696                 /*
697                  * It is necessary to try to rewrite attributes with
698                  * dn syntax because they might be used in ACLs as
699                  * members of groups; since ACLs are applied to the
700                  * rewritten stuff, no dn-based subecj clause could
701                  * be used at the ldap backend side (see
702                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
703                  * The problem can be overcome by moving the dn-based
704                  * ACLs to the target directory server, and letting
705                  * everything pass thru the ldap backend.
706                  */
707                 } else if ( strcmp( attr->a_desc->ad_type->sat_syntax->ssyn_oid,
708                                         SLAPD_DN_SYNTAX ) == 0 ) {
709                         int i;
710                         for ( i = 0; ( bv = attr->a_vals[ i ] ); i++ ) {
711                                 char *newval;
712
713                                 switch ( rewrite_session( li->targets[ target ]->rwinfo,
714                                                         "searchResult",
715                                                         bv->bv_val,
716                                                         lc->conn, &newval )) {
717                                 case REWRITE_REGEXEC_OK:
718                                         /* left as is */
719                                         if ( newval == NULL ) {
720                                                 break;
721                                         }
722 #ifdef NEW_LOGGING
723                                         LDAP_LOG(( "backend",
724                                                         LDAP_LEVEL_DETAIL1,
725                                                         "[rw] searchResult on"
726                                                         " attr=%s:"
727                                                         " \"%s\" -> \"%s\"\n",
728                                         attr->a_desc->ad_type->sat_cname.bv_val,
729                                                         bv->bv_val, newval ));
730 #else /* !NEW_LOGGING */
731                                         Debug( LDAP_DEBUG_ARGS,
732                                                 "rw> searchResult on attr=%s:"
733                                                 " \"%s\" -> \"%s\"\n",
734                                         attr->a_desc->ad_type->sat_cname.bv_val,
735                                                 bv->bv_val, newval );
736 #endif /* !NEW_LOGGING */
737                                         
738                                         free( bv->bv_val );
739                                         bv->bv_val = newval;
740                                         bv->bv_len = strlen( newval );
741
742                                         break;
743
744                                 case REWRITE_REGEXEC_UNWILLING:
745                                         
746                                 case REWRITE_REGEXEC_ERR:
747                                         /*
748                                          * FIXME: better give up,
749                                          * skip the attribute
750                                          * or leave it untouched?
751                                          */
752                                         break;
753                                 }
754                         }
755                 }
756                 *attrp = attr;
757                 attrp = &attr->a_next;
758         }
759         send_search_entry( be, lc->conn, op, &ent, attrs, attrsonly, NULL );
760         while ( ent.e_attrs ) {
761                 attr = ent.e_attrs;
762                 ent.e_attrs = attr->a_next;
763                 if ( attr->a_vals != &dummy ) {
764                         ber_bvecfree(attr->a_vals);
765                 }
766                 free( attr );
767         }
768         if ( ber ) {
769                 ber_free( ber, 0 );
770         }
771         
772         if ( ent.e_dn ) {
773                 free( ent.e_dn );
774         }
775         if ( ent.e_ndn ) {
776                 free( ent.e_ndn );
777         }
778 }
779
780 static int
781 is_one_level_rdn(
782                 const char *rdn,
783                 int len
784 )
785 {
786         for ( ; len--; ) {
787                 if ( LDAP_DNSEPARATOR( rdn[ len ] ) ) {
788                         return 0;
789                 }
790         }
791
792         return 1;
793 }
794