git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2004 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/socket.h>
  28 #include <ac/string.h>
  29 #include <ac/time.h>
  30
  31 #include "slap.h"
  32 #include "../back-ldap/back-ldap.h"
  33 #include "back-meta.h"
  34 #include "ldap_pvt.h"
  35 #undef ldap_debug       /* silence a warning in ldap-int.h */
  36 #include "ldap_log.h"
  37 #include "../../../libraries/libldap/ldap-int.h"
  38
  39 static int
  40 meta_send_entry(
  41                 Operation       *op,
  42                 SlapReply       *rs,
  43                 struct metaconn *lc,
  44                 int             i,
  45                 LDAPMessage     *e
  46 );
  47
  48 static int
  49 is_one_level_rdn(
  50                 const char      *rdn,
  51                 int             from
  52 );
  53
  54 int
  55 meta_back_search( Operation *op, SlapReply *rs )
  56 {
  57         struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
  58         struct metaconn *lc;
  59         struct metasingleconn *lsc;
  60         struct timeval  tv = { 0, 0 };
  61         LDAPMessage     *res, *e;
  62         int     rc = 0, *msgid, sres = LDAP_SUCCESS;
  63         char *err = NULL;
  64         struct berval match = { 0, NULL }, mmatch = { 0, NULL };
  65         BerVarray v2refs = NULL;
  66
  67         int i, last = 0, candidates = 0, initial_candidates = 0,
  68                         candidate_match = 0;
  69         struct slap_limits_set *limit = NULL;
  70         int isroot = 0;
  71         dncookie dc;
  72
  73         int     is_scope = 0,
  74                 is_filter = 0;
  75
  76         /*
  77          * controls are set in ldap_back_dobind()
  78          *
  79          * FIXME: in case of values return filter, we might want
  80          * to map attrs and maybe rewrite value
  81          */
  82         lc = meta_back_getconn( op, rs, META_OP_ALLOW_MULTIPLE,
  83                         &op->o_req_ndn, NULL );
  84         if ( !lc ) {
  85                 send_ldap_result( op, rs );
  86                 return -1;
  87         }
  88
  89         if ( !meta_back_dobind( lc, op ) ) {
  90                 rs->sr_err = LDAP_OTHER;
  91                 send_ldap_result( op, rs );
  92                 return -1;
  93         }
  94
  95         /*
  96          * Array of message id of each target
  97          */
  98         msgid = ch_calloc( sizeof( int ), li->ntargets );
  99         if ( msgid == NULL ) {
 100                 rs->sr_err = LDAP_OTHER;
 101                 send_ldap_result( op, rs );
 102                 return -1;
 103         }
 104
 105         /* if not root, get appropriate limits */
 106         if ( be_isroot( op->o_bd, &op->o_ndn ) ) {
 107                 isroot = 1;
 108         } else {
 109                 ( void ) get_limits( op, &op->o_ndn, &limit );
 110         }
 111
 112         /* if no time limit requested, rely on remote server limits */
 113         /* if requested limit higher than hard limit, abort */
 114         if ( !isroot && op->oq_search.rs_tlimit > limit->lms_t_hard ) {
 115                 /* no hard limit means use soft instead */
 116                 if ( limit->lms_t_hard == 0
 117                                 && limit->lms_t_soft > -1
 118                                 && op->oq_search.rs_tlimit > limit->lms_t_soft ) {
 119                         op->oq_search.rs_tlimit = limit->lms_t_soft;
 120
 121                 /* positive hard limit means abort */
 122                 } else if ( limit->lms_t_hard > 0 ) {
 123                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 124                         send_ldap_result( op, rs );
 125                         rc = 0;
 126                         goto finish;
 127                 }
 128
 129                 /* negative hard limit means no limit */
 130         }
 131
 132         /* if no size limit requested, rely on remote server limits */
 133         /* if requested limit higher than hard limit, abort */
 134         if ( !isroot && op->oq_search.rs_slimit > limit->lms_s_hard ) {
 135                 /* no hard limit means use soft instead */
 136                 if ( limit->lms_s_hard == 0
 137                                 && limit->lms_s_soft > -1
 138                                 && op->oq_search.rs_slimit > limit->lms_s_soft ) {
 139                         op->oq_search.rs_slimit = limit->lms_s_soft;
 140
 141                 /* positive hard limit means abort */
 142                 } else if ( limit->lms_s_hard > 0 ) {
 143                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 144                         send_ldap_result( op, rs );
 145                         rc = 0;
 146                         goto finish;
 147                 }
 148
 149                 /* negative hard limit means no limit */
 150         }
 151
 152
 153         dc.conn = op->o_conn;
 154         dc.rs = rs;
 155
 156         /*
 157          * Inits searches
 158          */
 159         for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
 160                 struct berval   realbase = op->o_req_dn;
 161                 int             realscope = op->oq_search.rs_scope;
 162                 ber_len_t       suffixlen = 0;
 163                 struct berval   mbase = { 0, NULL };
 164                 struct berval   mfilter = { 0, NULL };
 165                 char            **mapped_attrs = NULL;
 166
 167                 if ( lsc->candidate != META_CANDIDATE ) {
 168                         msgid[ i ] = -1;
 169                         continue;
 170                 }
 171
 172                 /* should we check return values? */
 173                 if ( op->oq_search.rs_deref != -1 ) {
 174                         ldap_set_option( lsc->ld, LDAP_OPT_DEREF,
 175                                         ( void * )&op->oq_search.rs_deref);
 176                 }
 177                 if ( op->oq_search.rs_tlimit != -1 ) {
 178                         ldap_set_option( lsc->ld, LDAP_OPT_TIMELIMIT,
 179                                         ( void * )&op->oq_search.rs_tlimit);
 180                 }
 181                 if ( op->oq_search.rs_slimit != -1 ) {
 182                         ldap_set_option( lsc->ld, LDAP_OPT_SIZELIMIT,
 183                                         ( void * )&op->oq_search.rs_slimit);
 184                 }
 185
 186                 dc.rwmap = &li->targets[ i ]->rwmap;
 187
 188                 /*
 189                  * modifies the base according to the scope, if required
 190                  */
 191                 suffixlen = li->targets[ i ]->suffix.bv_len;
 192                 if ( suffixlen > op->o_req_ndn.bv_len ) {
 193                         switch ( op->oq_search.rs_scope ) {
 194                         case LDAP_SCOPE_SUBTREE:
 195                                 /*
 196                                  * make the target suffix the new base
 197                                  * FIXME: this is very forgiving, because
 198                                  * illegal bases may be turned into
 199                                  * the suffix of the target.
 200                                  */
 201                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 202                                                 &op->o_req_ndn ) ) {
 203                                         realbase = li->targets[ i ]->suffix;
 204                                         is_scope++;
 205
 206                                 } else {
 207                                         /*
 208                                          * this target is no longer candidate
 209                                          */
 210                                         msgid[ i ] = -1;
 211                                         goto new_candidate;
 212                                 }
 213                                 break;
 214
 215                         case LDAP_SCOPE_ONELEVEL:
 216                                 if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 217                                                 suffixlen - op->o_req_ndn.bv_len - 1 )
 218                         && dnIsSuffix( &li->targets[ i ]->suffix, &op->o_req_ndn ) ) {
 219                                         /*
 220                                          * if there is exactly one level,
 221                                          * make the target suffix the new
 222                                          * base, and make scope "base"
 223                                          */
 224                                         realbase = li->targets[ i ]->suffix;
 225                                         realscope = LDAP_SCOPE_BASE;
 226                                         is_scope++;
 227                                         break;
 228                                 } /* else continue with the next case */
 229
 230                         case LDAP_SCOPE_BASE:
 231                                 /*
 232                                  * this target is no longer candidate
 233                                  */
 234                                 msgid[ i ] = -1;
 235                                 goto new_candidate;
 236                         }
 237
 238                 }
 239
 240                 /*
 241                  * Rewrite the search base, if required
 242                  */
 243                 dc.ctx = "searchBase";
 244                 switch ( ldap_back_dn_massage( &dc, &realbase, &mbase ) ) {
 245                 default:
 246                         break;
 247
 248                 case REWRITE_REGEXEC_UNWILLING:
 249                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 250                         rs->sr_text = "Operation not allowed";
 251                         send_ldap_result( op, rs );
 252                         rc = -1;
 253                         goto finish;
 254
 255                 case REWRITE_REGEXEC_ERR:
 256 #if 0
 257                         rs->sr_err = LDAP_OTHER;
 258                         rs->sr_text = "Rewrite error";
 259                         send_ldap_result( op, rs );
 260                         rc = -1;
 261                         goto finish;
 262 #endif
 263
 264                         /*
 265                          * this target is no longer candidate
 266                          */
 267                         msgid[ i ] = -1;
 268                         goto new_candidate;
 269                 }
 270
 271                 /*
 272                  * Maps filter
 273                  */
 274                 rc = ldap_back_filter_map_rewrite( &dc,
 275                                 op->oq_search.rs_filter,
 276                                 &mfilter, BACKLDAP_MAP );
 277                 switch ( rc ) {
 278                 case LDAP_SUCCESS:
 279                         is_filter++;
 280                         break;
 281
 282                 case LDAP_COMPARE_FALSE:
 283                         rc = 0;
 284
 285                 default:
 286                         /*
 287                          * this target is no longer candidate
 288                          */
 289                         msgid[ i ] = -1;
 290                         goto new_candidate;
 291                 }
 292
 293                 /*
 294                  * Maps required attributes
 295                  */
 296                 rc = ldap_back_map_attrs( &li->targets[ i ]->rwmap.rwm_at,
 297                                 op->oq_search.rs_attrs, BACKLDAP_MAP,
 298                                 &mapped_attrs );
 299                 if ( rc != LDAP_SUCCESS ) {
 300                         /*
 301                          * this target is no longer candidate
 302                          */
 303                         msgid[ i ] = -1;
 304                         goto new_candidate;
 305                 }
 306
 307                 /*
 308                  * Starts the search
 309                  */
 310                 msgid[ i ] = ldap_search( lsc->ld, mbase.bv_val, realscope,
 311                                 mfilter.bv_val, mapped_attrs,
 312                                 op->oq_search.rs_attrsonly );
 313                 if ( mapped_attrs ) {
 314                         free( mapped_attrs );
 315                         mapped_attrs = NULL;
 316                 }
 317                 if ( mfilter.bv_val != op->oq_search.rs_filterstr.bv_val ) {
 318                         free( mfilter.bv_val );
 319                         mfilter.bv_val = NULL;
 320                 }
 321                 if ( mbase.bv_val != realbase.bv_val ) {
 322                         free( mbase.bv_val );
 323                         mbase.bv_val = NULL;
 324                 }
 325
 326                 if ( msgid[ i ] == -1 ) {
 327                         continue;
 328                 }
 329
 330                 ++candidates;
 331
 332 new_candidate:;
 333         }
 334
 335         initial_candidates = candidates;
 336
 337         /* We pull apart the ber result, stuff it into a slapd entry, and
 338          * let send_search_entry stuff it back into ber format. Slow & ugly,
 339          * but this is necessary for version matching, and for ACL processing.
 340          */
 341
 342
 343         /*
 344          * In case there are no candidates, no cycle takes place...
 345          *
 346          * FIXME: we might use a queue, to balance the load
 347          * among the candidates
 348          */
 349         for ( rc = 0; candidates > 0; ) {
 350                 int ab, gotit = 0;
 351
 352                 /* check for abandon */
 353                 ab = op->o_abandon;
 354
 355                 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); lsc++, i++ ) {
 356                         if ( msgid[ i ] == -1 ) {
 357                                 continue;
 358                         }
 359
 360                         if ( ab ) {
 361                                 ldap_abandon( lsc->ld, msgid[ i ] );
 362                                 rc = 0;
 363                                 break;
 364                         }
 365
 366                         if ( op->oq_search.rs_slimit > 0
 367                                         && rs->sr_nentries == op->oq_search.rs_slimit ) {
 368                                 rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
 369                                 rs->sr_v2ref = v2refs;
 370                                 send_ldap_result( op, rs );
 371                                 goto finish;
 372                         }
 373
 374                         /*
 375                          * FIXME: handle time limit as well?
 376                          * Note that target servers are likely
 377                          * to handle it, so at some time we'll
 378                          * get a LDAP_TIMELIMIT_EXCEEDED from
 379                          * one of them ...
 380                          */
 381                         rc = ldap_result( lsc->ld, msgid[ i ],
 382                                         0, &tv, &res );
 383
 384                         if ( rc == 0 ) {
 385                                 continue;
 386
 387                         } else if ( rc == -1 ) {
 388                                 /* something REALLY bad happened! */
 389                                 ( void )meta_clear_unused_candidates( li,
 390                                                 lc, -1, 0 );
 391                                 rs->sr_err = LDAP_OTHER;
 392                                 rs->sr_v2ref = v2refs;
 393                                 send_ldap_result( op, rs );
 394
 395                                 /* anything else needs be done? */
 396                                 goto finish;
 397
 398                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 399                                 e = ldap_first_entry( lsc->ld, res );
 400                                 meta_send_entry( op, rs, lc, i, e );
 401
 402                                 /*
 403                                  * If scope is BASE, we need to jump out
 404                                  * as soon as one entry is found; if
 405                                  * the target pool is properly crafted,
 406                                  * this should correspond to the sole
 407                                  * entry that has the base DN
 408                                  */
 409                                 if ( op->oq_search.rs_scope == LDAP_SCOPE_BASE
 410                                                 && rs->sr_nentries > 0 ) {
 411                                         candidates = 0;
 412                                         sres = LDAP_SUCCESS;
 413                                         break;
 414                                 }
 415                                 ldap_msgfree( res );
 416                                 gotit = 1;
 417
 418                         } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 419                                 char            **references = NULL;
 420                                 int             cnt;
 421
 422                                 /*
 423                                  * FIXME: should we collect references
 424                                  * and send them alltogether at the end?
 425                                  */
 426
 427                                 rc = ldap_parse_reference( lsc->ld, res,
 428                                                 &references, &rs->sr_ctrls, 1 );
 429
 430                                 if ( rc != LDAP_SUCCESS ) {
 431                                         continue;
 432                                 }
 433
 434                                 if ( references == NULL ) {
 435                                         continue;
 436                                 }
 437
 438                                 for ( cnt = 0; references[ cnt ]; cnt++ )
 439                                         /* NO OP */ ;
 440
 441                                 rs->sr_ref = ch_calloc( cnt + 1, sizeof( struct berval ) );
 442
 443                                 for ( cnt = 0; references[ cnt ]; cnt++ ) {
 444                                         rs->sr_ref[ cnt ].bv_val = references[ cnt ];
 445                                         rs->sr_ref[ cnt ].bv_len = strlen( references[ cnt ] );
 446                                 }
 447
 448                                 /* ignore return value by now */
 449                                 ( void )send_search_reference( op, rs );
 450
 451                                 /* cleanup */
 452                                 if ( references ) {
 453                                         ldap_value_free( references );
 454                                         ch_free( rs->sr_ref );
 455                                         rs->sr_ref = NULL;
 456                                 }
 457
 458                                 if ( rs->sr_ctrls ) {
 459                                         ldap_controls_free( rs->sr_ctrls );
 460                                         rs->sr_ctrls = NULL;
 461                                 }
 462
 463                         } else {
 464                                 rs->sr_err = ldap_result2error( lsc->ld,
 465                                                 res, 1 );
 466                                 sres = ldap_back_map_result( rs );
 467                                 if ( err != NULL ) {
 468                                         free( err );
 469                                 }
 470                                 ldap_get_option( lsc->ld,
 471                                                 LDAP_OPT_ERROR_STRING, &err );
 472                                 if ( match.bv_val != NULL ) {
 473                                         free( match.bv_val );
 474                                 }
 475                                 ldap_get_option( lsc->ld,
 476                                                 LDAP_OPT_MATCHED_DN, &match.bv_val );
 477
 478 #ifdef NEW_LOGGING
 479                                 LDAP_LOG( BACK_META, ERR,
 480                                         "meta_back_search [%d] "
 481                                         "match=\"%s\" err=\"%s\"\n",
 482                                         i, match.bv_val, err );
 483 #else /* !NEW_LOGGING */
 484                                 Debug( LDAP_DEBUG_ANY,
 485                                         "=>meta_back_search [%d] "
 486                                         "match=\"%s\" err=\"%s\"\n",
 487                                         i, match.bv_val, err );
 488 #endif /* !NEW_LOGGING */
 489                                 candidate_match++;
 490                                 last = i;
 491                                 rc = 0;
 492
 493                                 /*
 494                                  * When no candidates are left,
 495                                  * the outer cycle finishes
 496                                  */
 497                                 msgid[ i ] = -1;
 498                                 --candidates;
 499                         }
 500                 }
 501
 502                 if ( ab ) {
 503                         goto finish;
 504                 }
 505
 506                 if ( gotit == 0 ) {
 507                         tv.tv_sec = 0;
 508                         tv.tv_usec = 100000;
 509                         ldap_pvt_thread_yield();
 510                 } else {
 511                         tv.tv_sec = 0;
 512                         tv.tv_usec = 0;
 513                 }
 514         }
 515
 516         if ( rc == -1 ) {
 517                 /*
 518                  * FIXME: need a strategy to handle errors
 519                  */
 520                 rc = meta_back_op_result( lc, op, rs );
 521                 goto finish;
 522         }
 523
 524         /*
 525          * Rewrite the matched portion of the search base, if required
 526          *
 527          * FIXME: only the last one gets caught!
 528          */
 529         if ( candidate_match == initial_candidates
 530                         && match.bv_val != NULL && *match.bv_val ) {
 531                 dc.ctx = "matchedDn";
 532                 dc.rwmap = &li->targets[ last ]->rwmap;
 533
 534                 if ( ldap_back_dn_massage( &dc, &match, &mmatch ) ) {
 535                         mmatch.bv_val = NULL;
 536                 }
 537         }
 538
 539         /*
 540          * In case we returned at least one entry, we return LDAP_SUCCESS
 541          * otherwise, the latter error code we got
 542          *
 543          * FIXME: we should handle error codes and return the more
 544          * important/reasonable
 545          */
 546         if ( is_scope == 0 ) {
 547                 sres = LDAP_NO_SUCH_OBJECT;
 548         }
 549
 550         if ( sres == LDAP_SUCCESS && v2refs ) {
 551                 sres = LDAP_REFERRAL;
 552         }
 553         rs->sr_err = sres;
 554         rs->sr_matched = mmatch.bv_val;
 555         rs->sr_v2ref = v2refs;
 556         send_ldap_result( op, rs );
 557         rs->sr_matched = NULL;
 558         rs->sr_v2ref = NULL;
 559
 560
 561 finish:;
 562         if ( match.bv_val ) {
 563                 if ( mmatch.bv_val != match.bv_val ) {
 564                         free( mmatch.bv_val );
 565                 }
 566                 free( match.bv_val );
 567         }
 568
 569         if ( err ) {
 570                 free( err );
 571         }
 572
 573         if ( msgid ) {
 574                 ch_free( msgid );
 575         }
 576
 577         return rc;
 578 }
 579
 580 static int
 581 meta_send_entry(
 582                 Operation       *op,
 583                 SlapReply       *rs,
 584                 struct metaconn *lc,
 585                 int             target,
 586                 LDAPMessage     *e
 587 )
 588 {
 589         struct metainfo         *li = ( struct metainfo * )op->o_bd->be_private;
 590         struct berval           a, mapped;
 591         Entry                   ent = {0};
 592         BerElement              ber = *e->lm_ber;
 593         Attribute               *attr, **attrp;
 594         struct berval           dummy = { 0, NULL };
 595         struct berval           *bv, bdn;
 596         const char              *text;
 597         dncookie                dc;
 598
 599         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 600                 return LDAP_DECODING_ERROR;
 601         }
 602
 603         /*
 604          * Rewrite the dn of the result, if needed
 605          */
 606         dc.rwmap = &li->targets[ target ]->rwmap;
 607         dc.conn = op->o_conn;
 608         dc.rs = rs;
 609         dc.ctx = "searchResult";
 610
 611         rs->sr_err = ldap_back_dn_massage( &dc, &bdn, &ent.e_name );
 612         if ( rs->sr_err != LDAP_SUCCESS) {
 613                 return rs->sr_err;
 614         }
 615
 616         /*
 617          * Note: this may fail if the target host(s) schema differs
 618          * from the one known to the meta, and a DN with unknown
 619          * attributes is returned.
 620          *
 621          * FIXME: should we log anything, or delegate to dnNormalize?
 622          */
 623         if ( dnNormalize( 0, NULL, NULL, &ent.e_name, &ent.e_nname,
 624                 &op->o_tmpmemctx ) != LDAP_SUCCESS )
 625         {
 626                 return LDAP_INVALID_DN_SYNTAX;
 627         }
 628
 629         /*
 630          * cache dn
 631          */
 632         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 633                 ( void )meta_dncache_update_entry( &li->cache,
 634                                 &ent.e_nname, target );
 635         }
 636
 637         attrp = &ent.e_attrs;
 638
 639         dc.ctx = "searchAttrDN";
 640         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 641                 int             last = 0;
 642
 643                 ldap_back_map( &li->targets[ target ]->rwmap.rwm_at,
 644                                 &a, &mapped, BACKLDAP_REMAP );
 645                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0' ) {
 646                         continue;
 647                 }
 648                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 649                 if ( attr == NULL ) {
 650                         continue;
 651                 }
 652                 attr->a_flags = 0;
 653                 attr->a_next = 0;
 654                 attr->a_desc = NULL;
 655                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 656                                 != LDAP_SUCCESS) {
 657                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 658                                         != LDAP_SUCCESS) {
 659 #ifdef NEW_LOGGING
 660                                 LDAP_LOG( BACK_META, DETAIL1,
 661                                         "slap_bv2undef_ad(%s): %s\n", mapped.bv_val, text, 0 );
 662 #else /* !NEW_LOGGING */
 663                                 Debug( LDAP_DEBUG_ANY,
 664                                                 "slap_bv2undef_ad(%s): "
 665                                                 "%s\n%s", mapped.bv_val, text, "" );
 666 #endif /* !NEW_LOGGING */
 667                                 ch_free( attr );
 668                                 continue;
 669                         }
 670                 }
 671
 672                 /* no subschemaSubentry */
 673                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 674
 675                         /*
 676                          * We eat target's subschemaSubentry because
 677                          * a search for this value is likely not
 678                          * to resolve to the appropriate backend;
 679                          * later, the local subschemaSubentry is
 680                          * added.
 681                          */
 682                         ( void )ber_scanf( &ber, "x" /* [W] */ );
 683
 684                         ch_free(attr);
 685                         continue;
 686                 }
 687
 688                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 689                                 || attr->a_vals == NULL ) {
 690                         attr->a_vals = &dummy;
 691
 692                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 693                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 694
 695                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 696
 697                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 698                                 ldap_back_map( &li->targets[ target ]->rwmap.rwm_oc,
 699                                                 bv, &mapped, BACKLDAP_REMAP );
 700                                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 701                                         free( bv->bv_val );
 702                                         bv->bv_val = NULL;
 703                                         if ( --last < 0 ) {
 704                                                 break;
 705                                         }
 706                                         *bv = attr->a_vals[ last ];
 707                                         attr->a_vals[ last ].bv_val = NULL;
 708                                         bv--;
 709
 710                                 } else if ( mapped.bv_val != bv->bv_val ) {
 711                                         free( bv->bv_val );
 712                                         ber_dupbv( bv, &mapped );
 713                                 }
 714                         }
 715                 /*
 716                  * It is necessary to try to rewrite attributes with
 717                  * dn syntax because they might be used in ACLs as
 718                  * members of groups; since ACLs are applied to the
 719                  * rewritten stuff, no dn-based subecj clause could
 720                  * be used at the ldap backend side (see
 721                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 722                  * The problem can be overcome by moving the dn-based
 723                  * ACLs to the target directory server, and letting
 724                  * everything pass thru the ldap backend.
 725                  */
 726                 } else if ( attr->a_desc->ad_type->sat_syntax ==
 727                                 slap_schema.si_syn_distinguishedName ) {
 728                         ldap_dnattr_result_rewrite( &dc, attr->a_vals );
 729                 }
 730
 731                 if ( last && attr->a_desc->ad_type->sat_equality &&
 732                         attr->a_desc->ad_type->sat_equality->smr_normalize ) {
 733                         int i;
 734
 735                         attr->a_nvals = ch_malloc((last + 1)*sizeof(struct berval));
 736                         for ( i = 0; i<last; i++ ) {
 737                                 attr->a_desc->ad_type->sat_equality->smr_normalize(
 738                                         SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
 739                                         attr->a_desc->ad_type->sat_syntax,
 740                                         attr->a_desc->ad_type->sat_equality,
 741                                         &attr->a_vals[i], &attr->a_nvals[i],
 742                                         op->o_tmpmemctx );
 743                         }
 744                         attr->a_nvals[i].bv_val = NULL;
 745                         attr->a_nvals[i].bv_len = 0;
 746                 } else {
 747                         attr->a_nvals = attr->a_vals;
 748                 }
 749
 750                 *attrp = attr;
 751                 attrp = &attr->a_next;
 752         }
 753         rs->sr_entry = &ent;
 754         rs->sr_attrs = op->oq_search.rs_attrs;
 755         send_search_entry( op, rs );
 756         rs->sr_entry = NULL;
 757         rs->sr_attrs = NULL;
 758         while ( ent.e_attrs ) {
 759                 attr = ent.e_attrs;
 760                 ent.e_attrs = attr->a_next;
 761                 if ( attr->a_vals != &dummy ) {
 762                         ber_bvarray_free( attr->a_vals );
 763                 }
 764                 free( attr );
 765         }
 766
 767         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 768                 free( ent.e_dn );
 769         }
 770         if ( ent.e_ndn ) {
 771                 free( ent.e_ndn );
 772         }
 773
 774         return LDAP_SUCCESS;
 775 }
 776
 777 static int
 778 is_one_level_rdn(
 779                 const char      *rdn,
 780                 int             from
 781 )
 782 {
 783         for ( ; from--; ) {
 784                 if ( DN_SEPARATOR( rdn[ from ] ) ) {
 785                         return 0;
 786                 }
 787         }
 788
 789         return 1;
 790 }
 791