git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /*
   2  * Copyright 1998-2001 The OpenLDAP Foundation, All Rights Reserved.
   3  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   4  *
   5  * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
   6  *
   7  * This work has been developed to fulfill the requirements
   8  * of SysNet s.n.c. <http:www.sys-net.it> and it has been donated
   9  * to the OpenLDAP Foundation in the hope that it may be useful
  10  * to the Open Source community, but WITHOUT ANY WARRANTY.
  11  *
  12  * Permission is granted to anyone to use this software for any purpose
  13  * on any computer system, and to alter it and redistribute it, subject
  14  * to the following restrictions:
  15  *
  16  * 1. The author and SysNet s.n.c. are not responsible for the consequences
  17  *    of use of this software, no matter how awful, even if they arise from
  18  *    flaws in it.
  19  *
  20  * 2. The origin of this software must not be misrepresented, either by
  21  *    explicit claim or by omission.  Since few users ever read sources,
  22  *    credits should appear in the documentation.
  23  *
  24  * 3. Altered versions must be plainly marked as such, and must not be
  25  *    misrepresented as being the original software.  Since few users
  26  *    ever read sources, credits should appear in the documentation.
  27  *    SysNet s.n.c. cannot be responsible for the consequences of the
  28  *    alterations.
  29  *
  30  * 4. This notice may not be removed or altered.
  31  *
  32  *
  33  * This software is based on the backend back-ldap, implemented
  34  * by Howard Chu <hyc@highlandsun.com>, and modified by Mark Valence
  35  * <kurash@sassafras.com>, Pierangelo Masarati <ando@sys-net.it> and other
  36  * contributors. The contribution of the original software to the present
  37  * implementation is acknowledged in this copyright statement.
  38  *
  39  * A special acknowledgement goes to Howard for the overall architecture
  40  * (and for borrowing large pieces of code), and to Mark, who implemented
  41  * from scratch the attribute/objectclass mapping.
  42  *
  43  * The original copyright statement follows.
  44  *
  45  * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
  46  *
  47  * Permission is granted to anyone to use this software for any purpose
  48  * on any computer system, and to alter it and redistribute it, subject
  49  * to the following restrictions:
  50  *
  51  * 1. The author is not responsible for the consequences of use of this
  52  *    software, no matter how awful, even if they arise from flaws in it.
  53  *
  54  * 2. The origin of this software must not be misrepresented, either by
  55  *    explicit claim or by omission.  Since few users ever read sources,
  56  *    credits should appear in the documentation.
  57  *
  58  * 3. Altered versions must be plainly marked as such, and must not be
  59  *    misrepresented as being the original software.  Since few users
  60  *    ever read sources, credits should appear in the
  61  *    documentation.
  62  *
  63  * 4. This notice may not be removed or altered.
  64  *
  65  */
  66
  67 #include "portable.h"
  68
  69 #include <stdio.h>
  70
  71 #include <ac/socket.h>
  72 #include <ac/string.h>
  73 #include <ac/time.h>
  74
  75 #include "slap.h"
  76 #include "../back-ldap/back-ldap.h"
  77 #include "back-meta.h"
  78 #include "ldap_pvt.h"
  79 #include "../../../libraries/libldap/ldap-int.h"
  80
  81 static void
  82 meta_send_entry(
  83                 Backend         *be,
  84                 Operation       *op,
  85                 struct metaconn *lc,
  86                 int             i,
  87                 LDAPMessage     *e,
  88                 AttributeName   *attrs,
  89                 int             attrsonly
  90 );
  91
  92 static int
  93 is_one_level_rdn(
  94                 const char      *rdn,
  95                 int             from
  96 );
  97
  98 int
  99 meta_back_search(
 100                 Backend         *be,
 101                 Connection      *conn,
 102                 Operation       *op,
 103                 struct berval   *base,
 104                 struct berval   *nbase,
 105                 int             scope,
 106                 int             deref,
 107                 int             slimit,
 108                 int             tlimit,
 109                 Filter          *filter,
 110                 struct berval   *filterstr,
 111                 AttributeName   *attrs,
 112                 int             attrsonly
 113 )
 114 {
 115         struct metainfo *li = ( struct metainfo * )be->be_private;
 116         struct metaconn *lc;
 117         struct metasingleconn **lsc;
 118         struct timeval  tv;
 119         LDAPMessage     *res, *e;
 120         int     count, rc = 0, *msgid, sres = LDAP_NO_SUCH_OBJECT;
 121         char *match = NULL, *err = NULL;
 122         char *mbase = NULL, *mmatch = NULL;
 123         struct berval mfilter;
 124
 125         int i, last = 0, candidates = 0, op_type;
 126         struct slap_limits_set *limit = NULL;
 127         int isroot = 0;
 128
 129         if ( scope == LDAP_SCOPE_BASE ) {
 130                 op_type = META_OP_REQUIRE_SINGLE;
 131         } else {
 132                 op_type = META_OP_ALLOW_MULTIPLE;
 133         }
 134
 135         lc = meta_back_getconn( li, conn, op, op_type, nbase, NULL );
 136         if ( !lc || !meta_back_dobind( lc, op ) ) {
 137                 return -1;
 138         }
 139
 140         /*
 141          * Array of message id of each target
 142          */
 143         msgid = ch_calloc( sizeof( int ), li->ntargets );
 144         if ( msgid == NULL ) {
 145                 send_search_result( conn, op, LDAP_OPERATIONS_ERROR,
 146                                 NULL, NULL, NULL, NULL, 0 );
 147                 return -1;
 148         }
 149
 150         /* if not root, get appropriate limits */
 151         if ( be_isroot( be, &op->o_ndn ) ) {
 152                 isroot = 1;
 153         } else {
 154                 ( void ) get_limits( be, &op->o_ndn, &limit );
 155         }
 156
 157         /* if no time limit requested, rely on remote server limits */
 158         /* if requested limit higher than hard limit, abort */
 159         if ( !isroot && tlimit > limit->lms_t_hard ) {
 160                 /* no hard limit means use soft instead */
 161                 if ( limit->lms_t_hard == 0 ) {
 162                         tlimit = limit->lms_t_soft;
 163
 164                 /* positive hard limit means abort */
 165                 } else if ( limit->lms_t_hard > 0 ) {
 166                         send_search_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 167                                         NULL, NULL, NULL, NULL, 0 );
 168                         rc = 0;
 169                         goto finish;
 170                 }
 171
 172                 /* negative hard limit means no limit */
 173         }
 174
 175         /* if no size limit requested, rely on remote server limits */
 176         /* if requested limit higher than hard limit, abort */
 177         if ( !isroot && slimit > limit->lms_s_hard ) {
 178                 /* no hard limit means use soft instead */
 179                 if ( limit->lms_s_hard == 0 ) {
 180                         slimit = limit->lms_s_soft;
 181
 182                 /* positive hard limit means abort */
 183                 } else if ( limit->lms_s_hard > 0 ) {
 184                         send_search_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 185                                         NULL, NULL, NULL, NULL, 0 );
 186                         rc = 0;
 187                         goto finish;
 188                 }
 189
 190                 /* negative hard limit means no limit */
 191         }
 192
 193         /*
 194          * Inits searches
 195          */
 196         for ( i = 0, lsc = lc->conns; lsc[ 0 ] != NULL; ++i, ++lsc ) {
 197                 char    *realbase = ( char * )base->bv_val;
 198                 int     realscope = scope;
 199                 int     suffixlen;
 200                 char    *mapped_filter, **mapped_attrs;
 201
 202                 if ( lsc[ 0 ]->candidate != META_CANDIDATE ) {
 203                         continue;
 204                 }
 205
 206                 if ( deref != -1 ) {
 207                         ldap_set_option( lsc[ 0 ]->ld, LDAP_OPT_DEREF,
 208                                         ( void * )&deref);
 209                 }
 210                 if ( tlimit != -1 ) {
 211                         ldap_set_option( lsc[ 0 ]->ld, LDAP_OPT_TIMELIMIT,
 212                                         ( void * )&tlimit);
 213                 }
 214                 if ( slimit != -1 ) {
 215                         ldap_set_option( lsc[ 0 ]->ld, LDAP_OPT_SIZELIMIT,
 216                                         ( void * )&slimit);
 217                 }
 218
 219                 /*
 220                  * modifies the base according to the scope, if required
 221                  */
 222                 suffixlen = li->targets[ i ]->suffix.bv_len;
 223                 if ( suffixlen > nbase->bv_len ) {
 224                         switch ( scope ) {
 225                         case LDAP_SCOPE_SUBTREE:
 226                                 /*
 227                                  * make the target suffix the new base
 228                                  * FIXME: this is very forgiving, because
 229                                  * illegal bases may be turned into
 230                                  * the suffix of the target.
 231                                  */
 232                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 233                                                 nbase ) ) {
 234                                         realbase = li->targets[ i ]->suffix.bv_val;
 235                                 } else {
 236                                         /*
 237                                          * this target is no longer candidate
 238                                          */
 239                                         lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
 240                                         continue;
 241                                 }
 242                                 break;
 243
 244                         case LDAP_SCOPE_ONELEVEL:
 245                                 if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 246                                                 suffixlen - nbase->bv_len - 1 )
 247                         && dnIsSuffix( &li->targets[ i ]->suffix, nbase ) ) {
 248                                         /*
 249                                          * if there is exactly one level,
 250                                          * make the target suffix the new
 251                                          * base, and make scope "base"
 252                                          */
 253                                         realbase = li->targets[ i ]->suffix.bv_val;
 254                                         realscope = LDAP_SCOPE_BASE;
 255                                         break;
 256                                 } /* else continue with the next case */
 257
 258                         case LDAP_SCOPE_BASE:
 259                                 /*
 260                                  * this target is no longer candidate
 261                                  */
 262                                 lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
 263                                 continue;
 264                         }
 265
 266                 }
 267
 268                 /*
 269                  * Rewrite the search base, if required
 270                  */
 271                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 272                                         "searchBase",
 273                                         realbase, conn, &mbase ) ) {
 274                 case REWRITE_REGEXEC_OK:
 275                 if ( mbase == NULL ) {
 276                         mbase = realbase;
 277                 }
 278 #ifdef NEW_LOGGING
 279                 LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 280                                 "[rw] searchBase: \"%s\" -> \"%s\"\n",
 281                                 base->bv_val, mbase ));
 282 #else /* !NEW_LOGGING */
 283                 Debug( LDAP_DEBUG_ARGS, "rw> searchBase: \"%s\" -> \"%s\"\n%s",
 284                                 base->bv_val, mbase, "" );
 285 #endif /* !NEW_LOGGING */
 286                 break;
 287
 288                 case REWRITE_REGEXEC_UNWILLING:
 289                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 290                                         NULL, "Unwilling to perform",
 291                                         NULL, NULL );
 292                         rc = -1;
 293                         goto finish;
 294
 295                 case REWRITE_REGEXEC_ERR:
 296                         send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
 297                                         NULL, "Operations error",
 298                                         NULL, NULL );
 299                         rc = -1;
 300                         goto finish;
 301                 }
 302
 303                 /*
 304                  * Rewrite the search filter, if required
 305                  */
 306                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 307                                         "searchFilter",
 308                                         filterstr->bv_val, conn, &mfilter.bv_val ) ) {
 309                 case REWRITE_REGEXEC_OK:
 310                         if ( mfilter.bv_val != NULL && mfilter.bv_val[ 0 ] != '\0') {
 311                                 mfilter.bv_len = strlen( mfilter.bv_val );
 312                         } else {
 313                                 if ( mfilter.bv_val != NULL ) {
 314                                         free( mfilter.bv_val );
 315                                 }
 316                                 mfilter = *filterstr;
 317                         }
 318 #ifdef NEW_LOGGING
 319                         LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 320                                         "[rw] searchFilter: \"%s\" -> \"%s\"\n",
 321                                         filterstr->bv_val, mfilter.bv_val ));
 322 #else /* !NEW_LOGGING */
 323                         Debug( LDAP_DEBUG_ARGS,
 324                                 "rw> searchFilter: \"%s\" -> \"%s\"\n%s",
 325                                 filterstr->bv_val, mfilter.bv_val, "" );
 326 #endif /* !NEW_LOGGING */
 327                         break;
 328
 329                 case REWRITE_REGEXEC_UNWILLING:
 330                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 331                                         NULL, NULL, NULL, NULL );
 332                         rc = -1;
 333                         goto finish;
 334
 335                 case REWRITE_REGEXEC_ERR:
 336                         send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
 337                                         NULL, NULL, NULL, NULL );
 338                         rc = -1;
 339                         goto finish;
 340                 }
 341
 342                 /*
 343                  * Maps attributes in filter
 344                  */
 345                 mapped_filter = ldap_back_map_filter( &li->targets[ i ]->at_map,
 346                                 &li->targets[ i ]->oc_map, &mfilter, 0 );
 347                 if ( mapped_filter == NULL ) {
 348                         mapped_filter = ( char * )mfilter.bv_val;
 349                 } else {
 350                         free( mfilter.bv_val );
 351                 }
 352                 mfilter.bv_val = NULL;
 353                 mfilter.bv_len = 0;
 354
 355                 /*
 356                  * Maps required attributes
 357                  */
 358                 mapped_attrs = ldap_back_map_attrs( &li->targets[ i ]->at_map,
 359                                 attrs, 0 );
 360                 if ( mapped_attrs == NULL && attrs) {
 361                         for ( count=0; attrs[ count ].an_name.bv_val; count++ );
 362                         mapped_attrs = ch_malloc( ( count + 1 ) * sizeof(char *));
 363                         for ( count=0; attrs[ count ].an_name.bv_val; count++ ) {
 364                                 mapped_attrs[ count ] = attrs[ count ].an_name.bv_val;
 365                         }
 366                         mapped_attrs[ count ] = NULL;
 367                 }
 368
 369                 /*
 370                  * Starts the search
 371                  */
 372                 msgid[ i ] = ldap_search( lsc[ 0 ]->ld, mbase, realscope,
 373                                 mapped_filter, mapped_attrs, attrsonly );
 374                 if ( msgid[ i ] == -1 ) {
 375                         lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
 376                         continue;
 377                 }
 378
 379                 if ( mapped_attrs ) {
 380                         free( mapped_attrs );
 381                         mapped_attrs = NULL;
 382                 }
 383                 if ( mapped_filter != filterstr->bv_val ) {
 384                         free( mapped_filter );
 385                         mapped_filter = NULL;
 386                 }
 387                 if ( mbase != realbase ) {
 388                         free( mbase );
 389                         mbase = NULL;
 390                 }
 391
 392                 ++candidates;
 393         }
 394
 395         /* We pull apart the ber result, stuff it into a slapd entry, and
 396          * let send_search_entry stuff it back into ber format. Slow & ugly,
 397          * but this is necessary for version matching, and for ACL processing.
 398          */
 399
 400
 401         /*
 402          * In case there are no candidates, no cycle takes place...
 403          */
 404         for ( count = 0, rc = 0; candidates > 0; ) {
 405                 int ab, gotit = 0;
 406
 407                 /* check for abandon */
 408                 ldap_pvt_thread_mutex_lock( &op->o_abandonmutex );
 409                 ab = op->o_abandon;
 410                 ldap_pvt_thread_mutex_unlock( &op->o_abandonmutex );
 411
 412                 for ( i = 0, lsc = lc->conns; lsc[ 0 ] != NULL; lsc++, i++ ) {
 413                         if ( lsc[ 0 ]->candidate != META_CANDIDATE ) {
 414                                 continue;
 415                         }
 416
 417                         if ( ab ) {
 418                                 ldap_abandon( lsc[ 0 ]->ld, msgid[ i ] );
 419                                 rc = 0;
 420                                 break;
 421                         }
 422
 423                         if ( slimit > 0 && count == slimit ) {
 424                                 send_search_result( conn, op,
 425                                                 LDAP_SIZELIMIT_EXCEEDED,
 426                                                 NULL, NULL, NULL, NULL, count );
 427                                 goto finish;
 428                         }
 429
 430                         rc = ldap_result( lsc[ 0 ]->ld, msgid[ i ],
 431                                         0, &tv, &res );
 432
 433                         if ( rc == 0 ) {
 434                                 continue;
 435                         } else if ( rc == -1 ) {
 436                                 /* something REALLY bad happened! */
 437                                 ( void )meta_clear_unused_candidates( li,
 438                                                 lc, -1, 0 );
 439                                 send_search_result( conn, op,
 440                                                 LDAP_OPERATIONS_ERROR,
 441                                                 "", "", NULL, NULL, count );
 442
 443                                 /* anything else needs be done? */
 444                                 goto finish;
 445                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 446                                 e = ldap_first_entry( lsc[ 0 ]->ld, res );
 447                                 meta_send_entry(be, op, lc, i, e, attrs,
 448                                                 attrsonly);
 449                                 count++;
 450                                 ldap_msgfree( res );
 451                                 gotit = 1;
 452                         } else {
 453                                 sres = ldap_result2error( lsc[ 0 ]->ld,
 454                                                 res, 1 );
 455                                 sres = ldap_back_map_result( sres );
 456                                 if ( err != NULL ) {
 457                                         free( err );
 458                                 }
 459                                 ldap_get_option( lsc[ 0 ]->ld,
 460                                                 LDAP_OPT_ERROR_STRING, &err );
 461                                 if ( match != NULL ) {
 462                                         free( match );
 463                                 }
 464                                 ldap_get_option( lsc[ 0 ]->ld,
 465                                                 LDAP_OPT_MATCHED_DN, &match );
 466
 467 #ifdef NEW_LOGGING
 468                                 LDAP_LOG(( "backend", LDAP_LEVEL_ERR,
 469                                                 "meta_back_search [%d]"
 470                                                 " match=\"%s\" err=\"%s\"\n",
 471                                                 i, match, err ));
 472 #else /* !NEW_LOGGING */
 473                                 Debug( LDAP_DEBUG_ANY,
 474         "=>meta_back_search [%d] match=\"%s\" err=\"%s\"\n",
 475                                         i, match, err );
 476 #endif /* !NEW_LOGGING */
 477
 478                                 last = i;
 479                                 rc = 0;
 480
 481                                 /*
 482                                  * When no candidates are left,
 483                                  * the outer cycle finishes
 484                                  */
 485                                 lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
 486                                 --candidates;
 487                         }
 488                 }
 489
 490                 if ( ab ) {
 491                         goto finish;
 492                 }
 493
 494                 if ( gotit == 0 ) {
 495                         tv.tv_sec = 0;
 496                         tv.tv_usec = 100000;
 497                         ldap_pvt_thread_yield();
 498                 } else {
 499                         tv.tv_sec = 0;
 500                         tv.tv_usec = 0;
 501                 }
 502         }
 503
 504         if ( rc == -1 ) {
 505                 /*
 506                  * FIXME: need a strategy to handle errors
 507                  */
 508                 rc = meta_back_op_result( lc, op );
 509                 goto finish;
 510         }
 511
 512         /*
 513          * Rewrite the matched portion of the search base, if required
 514          *
 515          * FIXME: only the last one gets caught!
 516          */
 517         if ( match != NULL ) {
 518                 switch ( rewrite_session( li->targets[ last ]->rwinfo,
 519                                         "matchedDn", match, conn, &mmatch ) ) {
 520                 case REWRITE_REGEXEC_OK:
 521                         if ( mmatch == NULL ) {
 522                                 mmatch = ( char * )match;
 523                         }
 524 #ifdef NEW_LOGGING
 525                         LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 526                                         "[rw] matchedDn: \"%s\" -> \"%s\"\n",
 527                                         match, mmatch ));
 528 #else /* !NEW_LOGGING */
 529                         Debug( LDAP_DEBUG_ARGS, "rw> matchedDn:"
 530                                        " \"%s\" -> \"%s\"\n%s",
 531                                        match, mmatch, "" );
 532 #endif /* !NEW_LOGGING */
 533                         break;
 534
 535                 case REWRITE_REGEXEC_UNWILLING:
 536                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 537                                         NULL, NULL, NULL, NULL );
 538                         rc = -1;
 539                         goto finish;
 540
 541                 case REWRITE_REGEXEC_ERR:
 542                         send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
 543                                         NULL, NULL, NULL, NULL );
 544                         rc = -1;
 545                         goto finish;
 546                 }
 547         }
 548
 549         send_search_result( conn, op, sres,
 550                 mmatch, err, NULL, NULL, count );
 551
 552 finish:;
 553         if ( match ) {
 554                 if ( mmatch != match ) {
 555                         free( mmatch );
 556                 }
 557                 free(match);
 558         }
 559
 560         if ( err ) {
 561                 free( err );
 562         }
 563
 564         if ( msgid ) {
 565                 free( msgid );
 566         }
 567
 568         return rc;
 569 }
 570
 571 static void
 572 meta_send_entry(
 573                 Backend         *be,
 574                 Operation       *op,
 575                 struct metaconn *lc,
 576                 int             target,
 577                 LDAPMessage     *e,
 578                 AttributeName   *attrs,
 579                 int             attrsonly
 580 )
 581 {
 582         struct metainfo         *li = ( struct metainfo * )be->be_private;
 583         struct berval           a, mapped;
 584         Entry                   ent;
 585         BerElement              ber = *e->lm_ber;
 586         Attribute               *attr, **attrp;
 587         struct berval           dummy = { 0, NULL };
 588         struct berval           *bv, bdn;
 589         const char              *text;
 590
 591         if ( ber_scanf( &ber, "{o{", &bdn ) == LBER_ERROR ) {
 592                 return;
 593         }
 594
 595         /*
 596          * Rewrite the dn of the result, if needed
 597          */
 598         switch ( rewrite_session( li->targets[ target ]->rwinfo,
 599                                 "searchResult", bdn.bv_val, lc->conn, &ent.e_name.bv_val ) ) {
 600         case REWRITE_REGEXEC_OK:
 601                 if ( ent.e_name.bv_val == NULL ) {
 602                         ent.e_name = bdn;
 603
 604                 } else {
 605 #ifdef NEW_LOGGING
 606                         LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 607                                         "[rw] searchResult[%d]:"
 608                                         " \"%s\" -> \"%s\"\n",
 609                                         target, bdn.bv_val, ent.e_name.bv_val ));
 610 #else /* !NEW_LOGGING */
 611                         Debug( LDAP_DEBUG_ARGS, "rw> searchResult[%d]: \"%s\""
 612                                         " -> \"%s\"\n", target, bdn.bv_val, ent.e_name.bv_val );
 613 #endif /* !NEW_LOGGING */
 614                         free( bdn.bv_val );
 615                         bdn.bv_val = NULL;
 616                         ent.e_name.bv_len = strlen( ent.e_name.bv_val );
 617                 }
 618                 break;
 619
 620         case REWRITE_REGEXEC_ERR:
 621         case REWRITE_REGEXEC_UNWILLING:
 622                 return;
 623         }
 624
 625         dnNormalize2( NULL, &ent.e_name, &ent.e_nname );
 626
 627         /*
 628          * cache dn
 629          */
 630         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 631                 ( void )meta_dncache_update_entry( &li->cache,
 632                                                    &ent.e_nname,
 633                                                    target );
 634         }
 635
 636         ent.e_id = 0;
 637         ent.e_attrs = 0;
 638         ent.e_private = 0;
 639         attrp = &ent.e_attrs;
 640
 641         while ( ber_scanf( &ber, "{o", &a ) != LBER_ERROR ) {
 642                 ldap_back_map( &li->targets[ target ]->at_map,
 643                                 &a, &mapped, 1 );
 644                 if ( mapped.bv_val != a.bv_val ) {
 645                         free( a.bv_val );
 646                 }
 647                 if ( mapped.bv_val == NULL ) {
 648                         continue;
 649                 }
 650                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 651                 if ( attr == NULL ) {
 652                         continue;
 653                 }
 654                 attr->a_next = 0;
 655                 attr->a_desc = NULL;
 656                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 657                                 != LDAP_SUCCESS) {
 658                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 659                                         != LDAP_SUCCESS) {
 660 #ifdef NEW_LOGGING
 661                                 LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 662                                                 "slap_bv2undef_ad(%s): "
 663                                                 "%s\n", mapped.bv_val, text ));
 664 #else /* !NEW_LOGGING */
 665                                 Debug( LDAP_DEBUG_ANY,
 666                                                 "slap_bv2undef_ad(%s): "
 667                                                 "%s\n%s", mapped.bv_val, text, "" );
 668 #endif /* !NEW_LOGGING */
 669                                 ch_free( attr );
 670                                 continue;
 671                         }
 672                 }
 673
 674                 /* no subschemaSubentry */
 675                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 676                         ch_free(attr);
 677                         continue;
 678                 }
 679
 680                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR ) {
 681                         attr->a_vals = &dummy;
 682                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 683                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 684                         int i, last;
 685                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 686                         for ( i = 0, bv = attr->a_vals; bv->bv_val; bv++, i++ ) {
 687                                 ldap_back_map( &li->targets[ target]->oc_map,
 688                                                 bv, &mapped, 1 );
 689                                 if ( mapped.bv_val == NULL ) {
 690                                         free( bv->bv_val );
 691                                         bv->bv_val = NULL;
 692                                         if ( --last < 0 ) {
 693                                                 break;
 694                                         }
 695                                         *bv = attr->a_vals[ last ];
 696                                         attr->a_vals[ last ].bv_val = NULL;
 697                                         i--;
 698
 699                                 } else if ( mapped.bv_val != bv->bv_val ) {
 700                                         ch_free( bv->bv_val );
 701                                         ber_dupbv( bv, &mapped );
 702                                 }
 703                         }
 704                 /*
 705                  * It is necessary to try to rewrite attributes with
 706                  * dn syntax because they might be used in ACLs as
 707                  * members of groups; since ACLs are applied to the
 708                  * rewritten stuff, no dn-based subecj clause could
 709                  * be used at the ldap backend side (see
 710                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 711                  * The problem can be overcome by moving the dn-based
 712                  * ACLs to the target directory server, and letting
 713                  * everything pass thru the ldap backend.
 714                  */
 715                 } else if ( strcmp( attr->a_desc->ad_type->sat_syntax->ssyn_oid,
 716                                         SLAPD_DN_SYNTAX ) == 0 ) {
 717                         int i;
 718                         for ( i = 0, bv = attr->a_vals; bv->bv_val; bv++, i++ ) {
 719                                 char *newval;
 720
 721                                 switch ( rewrite_session( li->targets[ target ]->rwinfo,
 722                                                         "searchResult",
 723                                                         bv->bv_val,
 724                                                         lc->conn, &newval )) {
 725                                 case REWRITE_REGEXEC_OK:
 726                                         /* left as is */
 727                                         if ( newval == NULL ) {
 728                                                 break;
 729                                         }
 730 #ifdef NEW_LOGGING
 731                                         LDAP_LOG(( "backend",
 732                                                         LDAP_LEVEL_DETAIL1,
 733                                                         "[rw] searchResult on"
 734                                                         " attr=%s:"
 735                                                         " \"%s\" -> \"%s\"\n",
 736                                         attr->a_desc->ad_type->sat_cname.bv_val,
 737                                                         bv->bv_val, newval ));
 738 #else /* !NEW_LOGGING */
 739                                         Debug( LDAP_DEBUG_ARGS,
 740                                                 "rw> searchResult on attr=%s:"
 741                                                 " \"%s\" -> \"%s\"\n",
 742                                         attr->a_desc->ad_type->sat_cname.bv_val,
 743                                                 bv->bv_val, newval );
 744 #endif /* !NEW_LOGGING */
 745
 746                                         free( bv->bv_val );
 747                                         bv->bv_val = newval;
 748                                         bv->bv_len = strlen( newval );
 749
 750                                         break;
 751
 752                                 case REWRITE_REGEXEC_UNWILLING:
 753
 754                                 case REWRITE_REGEXEC_ERR:
 755                                         /*
 756                                          * FIXME: better give up,
 757                                          * skip the attribute
 758                                          * or leave it untouched?
 759                                          */
 760                                         break;
 761                                 }
 762                         }
 763                 }
 764                 *attrp = attr;
 765                 attrp = &attr->a_next;
 766         }
 767         send_search_entry( be, lc->conn, op, &ent, attrs, attrsonly, NULL );
 768         while ( ent.e_attrs ) {
 769                 attr = ent.e_attrs;
 770                 ent.e_attrs = attr->a_next;
 771                 if ( attr->a_vals != &dummy ) {
 772                         bvarray_free( attr->a_vals );
 773                 }
 774                 free( attr );
 775         }
 776
 777         if ( ent.e_dn ) {
 778                 free( ent.e_dn );
 779         }
 780         if ( ent.e_ndn ) {
 781                 free( ent.e_ndn );
 782         }
 783 }
 784
 785 static int
 786 is_one_level_rdn(
 787                 const char      *rdn,
 788                 int             from
 789 )
 790 {
 791         for ( ; from--; ) {
 792                 if ( DN_SEPARATOR( rdn[ from ] )
 793                                 && ! DN_ESCAPE( rdn[ from ] - 1 ) ) {
 794                         return 0;
 795                 }
 796         }
 797
 798         return 1;
 799 }
 800