git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2004 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/socket.h>
  28 #include <ac/string.h>
  29 #include <ac/time.h>
  30
  31 #include "slap.h"
  32 #include "../back-ldap/back-ldap.h"
  33 #include "back-meta.h"
  34 #include "ldap_pvt.h"
  35 #undef ldap_debug       /* silence a warning in ldap-int.h */
  36 #include "ldap_log.h"
  37 #include "../../../libraries/libldap/ldap-int.h"
  38
  39 static int
  40 meta_send_entry(
  41                 Operation       *op,
  42                 SlapReply       *rs,
  43                 struct metaconn *lc,
  44                 int             i,
  45                 LDAPMessage     *e
  46 );
  47
  48 static int
  49 is_one_level_rdn(
  50                 const char      *rdn,
  51                 int             from
  52 );
  53
  54 int
  55 meta_back_search( Operation *op, SlapReply *rs )
  56 {
  57         struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
  58         struct metaconn *lc;
  59         struct metasingleconn *lsc;
  60         struct timeval  tv = { 0, 0 };
  61         LDAPMessage     *res, *e;
  62         int     rc = 0, *msgid, sres = LDAP_NO_SUCH_OBJECT;
  63         char *err = NULL;
  64         struct berval match = { 0, NULL }, mmatch = { 0, NULL };
  65         BerVarray v2refs = NULL;
  66
  67         int i, last = 0, candidates = 0, initial_candidates = 0,
  68                         candidate_match = 0;
  69         struct slap_limits_set *limit = NULL;
  70         int isroot = 0;
  71         dncookie dc;
  72
  73         /*
  74          * controls are set in ldap_back_dobind()
  75          *
  76          * FIXME: in case of values return filter, we might want
  77          * to map attrs and maybe rewrite value
  78          */
  79         lc = meta_back_getconn( op, rs, META_OP_ALLOW_MULTIPLE,
  80                         &op->o_req_ndn, NULL );
  81         if ( !lc ) {
  82                 send_ldap_result( op, rs );
  83                 return -1;
  84         }
  85
  86         if ( !meta_back_dobind( lc, op ) ) {
  87                 rs->sr_err = LDAP_OTHER;
  88                 send_ldap_result( op, rs );
  89                 return -1;
  90         }
  91
  92         /*
  93          * Array of message id of each target
  94          */
  95         msgid = ch_calloc( sizeof( int ), li->ntargets );
  96         if ( msgid == NULL ) {
  97                 rs->sr_err = LDAP_OTHER;
  98                 send_ldap_result( op, rs );
  99                 return -1;
 100         }
 101
 102         /* if not root, get appropriate limits */
 103         if ( be_isroot( op->o_bd, &op->o_ndn ) ) {
 104                 isroot = 1;
 105         } else {
 106                 ( void ) get_limits( op->o_bd, &op->o_ndn, &limit );
 107         }
 108
 109         /* if no time limit requested, rely on remote server limits */
 110         /* if requested limit higher than hard limit, abort */
 111         if ( !isroot && op->oq_search.rs_tlimit > limit->lms_t_hard ) {
 112                 /* no hard limit means use soft instead */
 113                 if ( limit->lms_t_hard == 0
 114                                 && limit->lms_t_soft > -1
 115                                 && op->oq_search.rs_tlimit > limit->lms_t_soft ) {
 116                         op->oq_search.rs_tlimit = limit->lms_t_soft;
 117
 118                 /* positive hard limit means abort */
 119                 } else if ( limit->lms_t_hard > 0 ) {
 120                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 121                         send_ldap_result( op, rs );
 122                         rc = 0;
 123                         goto finish;
 124                 }
 125
 126                 /* negative hard limit means no limit */
 127         }
 128
 129         /* if no size limit requested, rely on remote server limits */
 130         /* if requested limit higher than hard limit, abort */
 131         if ( !isroot && op->oq_search.rs_slimit > limit->lms_s_hard ) {
 132                 /* no hard limit means use soft instead */
 133                 if ( limit->lms_s_hard == 0
 134                                 && limit->lms_s_soft > -1
 135                                 && op->oq_search.rs_slimit > limit->lms_s_soft ) {
 136                         op->oq_search.rs_slimit = limit->lms_s_soft;
 137
 138                 /* positive hard limit means abort */
 139                 } else if ( limit->lms_s_hard > 0 ) {
 140                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 141                         send_ldap_result( op, rs );
 142                         rc = 0;
 143                         goto finish;
 144                 }
 145
 146                 /* negative hard limit means no limit */
 147         }
 148
 149
 150         dc.conn = op->o_conn;
 151         dc.rs = rs;
 152
 153         /*
 154          * Inits searches
 155          */
 156         for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
 157                 struct berval   realbase = op->o_req_dn;
 158                 int             realscope = op->oq_search.rs_scope;
 159                 ber_len_t       suffixlen = 0;
 160                 struct berval   mbase = { 0, NULL };
 161                 struct berval   mfilter = { 0, NULL };
 162                 char            **mapped_attrs = NULL;
 163
 164                 if ( lsc->candidate != META_CANDIDATE ) {
 165                         msgid[ i ] = -1;
 166                         continue;
 167                 }
 168
 169                 /* should we check return values? */
 170                 if ( op->oq_search.rs_deref != -1 ) {
 171                         ldap_set_option( lsc->ld, LDAP_OPT_DEREF,
 172                                         ( void * )&op->oq_search.rs_deref);
 173                 }
 174                 if ( op->oq_search.rs_tlimit != -1 ) {
 175                         ldap_set_option( lsc->ld, LDAP_OPT_TIMELIMIT,
 176                                         ( void * )&op->oq_search.rs_tlimit);
 177                 }
 178                 if ( op->oq_search.rs_slimit != -1 ) {
 179                         ldap_set_option( lsc->ld, LDAP_OPT_SIZELIMIT,
 180                                         ( void * )&op->oq_search.rs_slimit);
 181                 }
 182
 183                 dc.rwmap = &li->targets[ i ]->rwmap;
 184
 185                 /*
 186                  * modifies the base according to the scope, if required
 187                  */
 188                 suffixlen = li->targets[ i ]->suffix.bv_len;
 189                 if ( suffixlen > op->o_req_ndn.bv_len ) {
 190                         switch ( op->oq_search.rs_scope ) {
 191                         case LDAP_SCOPE_SUBTREE:
 192                                 /*
 193                                  * make the target suffix the new base
 194                                  * FIXME: this is very forgiving, because
 195                                  * illegal bases may be turned into
 196                                  * the suffix of the target.
 197                                  */
 198                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 199                                                 &op->o_req_ndn ) ) {
 200                                         realbase = li->targets[ i ]->suffix;
 201                                 } else {
 202                                         /*
 203                                          * this target is no longer candidate
 204                                          */
 205                                         msgid[ i ] = -1;
 206                                         goto new_candidate;
 207                                 }
 208                                 break;
 209
 210                         case LDAP_SCOPE_ONELEVEL:
 211                                 if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 212                                                 suffixlen - op->o_req_ndn.bv_len - 1 )
 213                         && dnIsSuffix( &li->targets[ i ]->suffix, &op->o_req_ndn ) ) {
 214                                         /*
 215                                          * if there is exactly one level,
 216                                          * make the target suffix the new
 217                                          * base, and make scope "base"
 218                                          */
 219                                         realbase = li->targets[ i ]->suffix;
 220                                         realscope = LDAP_SCOPE_BASE;
 221                                         break;
 222                                 } /* else continue with the next case */
 223
 224                         case LDAP_SCOPE_BASE:
 225                                 /*
 226                                  * this target is no longer candidate
 227                                  */
 228                                 msgid[ i ] = -1;
 229                                 goto new_candidate;
 230                         }
 231
 232                 }
 233
 234                 /*
 235                  * Rewrite the search base, if required
 236                  */
 237                 dc.ctx = "searchBase";
 238                 switch ( ldap_back_dn_massage( &dc, &realbase, &mbase ) ) {
 239                 default:
 240                         break;
 241
 242                 case REWRITE_REGEXEC_UNWILLING:
 243                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 244                         rs->sr_text = "Operation not allowed";
 245                         send_ldap_result( op, rs );
 246                         rc = -1;
 247                         goto finish;
 248
 249                 case REWRITE_REGEXEC_ERR:
 250 #if 0
 251                         rs->sr_err = LDAP_OTHER;
 252                         rs->sr_text = "Rewrite error";
 253                         send_ldap_result( op, rs );
 254                         rc = -1;
 255                         goto finish;
 256 #endif
 257
 258                         /*
 259                          * this target is no longer candidate
 260                          */
 261                         msgid[ i ] = -1;
 262                         goto new_candidate;
 263                 }
 264
 265                 /*
 266                  * Maps filter
 267                  */
 268                 rc = ldap_back_filter_map_rewrite( &dc,
 269                                 op->oq_search.rs_filter,
 270                                 &mfilter, BACKLDAP_MAP );
 271                 if ( rc != 0 ) {
 272                         /*
 273                          * this target is no longer candidate
 274                          */
 275                         msgid[ i ] = -1;
 276                         goto new_candidate;
 277                 }
 278
 279                 /*
 280                  * Maps required attributes
 281                  */
 282                 rc = ldap_back_map_attrs( &li->targets[ i ]->rwmap.rwm_at,
 283                                 op->oq_search.rs_attrs, BACKLDAP_MAP,
 284                                 &mapped_attrs );
 285                 if ( rc != LDAP_SUCCESS ) {
 286                         /*
 287                          * this target is no longer candidate
 288                          */
 289                         msgid[ i ] = -1;
 290                         goto new_candidate;
 291                 }
 292
 293                 /*
 294                  * Starts the search
 295                  */
 296                 msgid[ i ] = ldap_search( lsc->ld, mbase.bv_val, realscope,
 297                                 mfilter.bv_val, mapped_attrs,
 298                                 op->oq_search.rs_attrsonly );
 299                 if ( mapped_attrs ) {
 300                         free( mapped_attrs );
 301                         mapped_attrs = NULL;
 302                 }
 303                 if ( mfilter.bv_val != op->oq_search.rs_filterstr.bv_val ) {
 304                         free( mfilter.bv_val );
 305                         mfilter.bv_val = NULL;
 306                 }
 307                 if ( mbase.bv_val != realbase.bv_val ) {
 308                         free( mbase.bv_val );
 309                         mbase.bv_val = NULL;
 310                 }
 311
 312                 if ( msgid[ i ] == -1 ) {
 313                         continue;
 314                 }
 315
 316                 ++candidates;
 317
 318 new_candidate:;
 319         }
 320
 321         initial_candidates = candidates;
 322
 323         /* We pull apart the ber result, stuff it into a slapd entry, and
 324          * let send_search_entry stuff it back into ber format. Slow & ugly,
 325          * but this is necessary for version matching, and for ACL processing.
 326          */
 327
 328
 329         /*
 330          * In case there are no candidates, no cycle takes place...
 331          *
 332          * FIXME: we might use a queue, to balance the load
 333          * among the candidates
 334          */
 335         for ( rc = 0; candidates > 0; ) {
 336                 int ab, gotit = 0;
 337
 338                 /* check for abandon */
 339                 ab = op->o_abandon;
 340
 341                 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); lsc++, i++ ) {
 342                         if ( msgid[ i ] == -1 ) {
 343                                 continue;
 344                         }
 345
 346                         if ( ab ) {
 347                                 ldap_abandon( lsc->ld, msgid[ i ] );
 348                                 rc = 0;
 349                                 break;
 350                         }
 351
 352                         if ( op->oq_search.rs_slimit > 0
 353                                         && rs->sr_nentries == op->oq_search.rs_slimit ) {
 354                                 rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
 355                                 rs->sr_v2ref = v2refs;
 356                                 send_ldap_result( op, rs );
 357                                 goto finish;
 358                         }
 359
 360                         /*
 361                          * FIXME: handle time limit as well?
 362                          * Note that target servers are likely
 363                          * to handle it, so at some time we'll
 364                          * get a LDAP_TIMELIMIT_EXCEEDED from
 365                          * one of them ...
 366                          */
 367                         rc = ldap_result( lsc->ld, msgid[ i ],
 368                                         0, &tv, &res );
 369
 370                         if ( rc == 0 ) {
 371                                 continue;
 372
 373                         } else if ( rc == -1 ) {
 374                                 /* something REALLY bad happened! */
 375                                 ( void )meta_clear_unused_candidates( li,
 376                                                 lc, -1, 0 );
 377                                 rs->sr_err = LDAP_OTHER;
 378                                 rs->sr_v2ref = v2refs;
 379                                 send_ldap_result( op, rs );
 380
 381                                 /* anything else needs be done? */
 382                                 goto finish;
 383
 384                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 385                                 e = ldap_first_entry( lsc->ld, res );
 386                                 meta_send_entry( op, rs, lc, i, e );
 387
 388                                 /*
 389                                  * If scope is BASE, we need to jump out
 390                                  * as soon as one entry is found; if
 391                                  * the target pool is properly crafted,
 392                                  * this should correspond to the sole
 393                                  * entry that has the base DN
 394                                  */
 395                                 if ( op->oq_search.rs_scope == LDAP_SCOPE_BASE
 396                                                 && rs->sr_nentries > 0 ) {
 397                                         candidates = 0;
 398                                         sres = LDAP_SUCCESS;
 399                                         break;
 400                                 }
 401                                 ldap_msgfree( res );
 402                                 gotit = 1;
 403
 404                         } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 405                                 char            **references = NULL;
 406                                 int             cnt;
 407
 408                                 /*
 409                                  * FIXME: should we collect references
 410                                  * and send them alltogether at the end?
 411                                  */
 412
 413                                 rc = ldap_parse_reference( lsc->ld, res,
 414                                                 &references, &rs->sr_ctrls, 1 );
 415
 416                                 if ( rc != LDAP_SUCCESS ) {
 417                                         continue;
 418                                 }
 419
 420                                 if ( references == NULL ) {
 421                                         continue;
 422                                 }
 423
 424                                 for ( cnt = 0; references[ cnt ]; cnt++ )
 425                                         /* NO OP */ ;
 426
 427                                 rs->sr_ref = ch_calloc( cnt + 1, sizeof( struct berval ) );
 428
 429                                 for ( cnt = 0; references[ cnt ]; cnt++ ) {
 430                                         rs->sr_ref[ cnt ].bv_val = references[ cnt ];
 431                                         rs->sr_ref[ cnt ].bv_len = strlen( references[ cnt ] );
 432                                 }
 433
 434                                 /* ignore return value by now */
 435                                 ( void )send_search_reference( op, rs );
 436
 437                                 /* cleanup */
 438                                 if ( references ) {
 439                                         ldap_value_free( references );
 440                                         ch_free( rs->sr_ref );
 441                                         rs->sr_ref = NULL;
 442                                 }
 443
 444                                 if ( rs->sr_ctrls ) {
 445                                         ldap_controls_free( rs->sr_ctrls );
 446                                         rs->sr_ctrls = NULL;
 447                                 }
 448
 449                         } else {
 450                                 rs->sr_err = ldap_result2error( lsc->ld,
 451                                                 res, 1 );
 452                                 sres = ldap_back_map_result( rs );
 453                                 if ( err != NULL ) {
 454                                         free( err );
 455                                 }
 456                                 ldap_get_option( lsc->ld,
 457                                                 LDAP_OPT_ERROR_STRING, &err );
 458                                 if ( match.bv_val != NULL ) {
 459                                         free( match.bv_val );
 460                                 }
 461                                 ldap_get_option( lsc->ld,
 462                                                 LDAP_OPT_MATCHED_DN, &match.bv_val );
 463
 464 #ifdef NEW_LOGGING
 465                                 LDAP_LOG( BACK_META, ERR,
 466                                         "meta_back_search [%d] "
 467                                         "match=\"%s\" err=\"%s\"\n",
 468                                         i, match.bv_val, err );
 469 #else /* !NEW_LOGGING */
 470                                 Debug( LDAP_DEBUG_ANY,
 471                                         "=>meta_back_search [%d] "
 472                                         "match=\"%s\" err=\"%s\"\n",
 473                                         i, match.bv_val, err );
 474 #endif /* !NEW_LOGGING */
 475                                 candidate_match++;
 476                                 last = i;
 477                                 rc = 0;
 478
 479                                 /*
 480                                  * When no candidates are left,
 481                                  * the outer cycle finishes
 482                                  */
 483                                 msgid[ i ] = -1;
 484                                 --candidates;
 485                         }
 486                 }
 487
 488                 if ( ab ) {
 489                         goto finish;
 490                 }
 491
 492                 if ( gotit == 0 ) {
 493                         tv.tv_sec = 0;
 494                         tv.tv_usec = 100000;
 495                         ldap_pvt_thread_yield();
 496                 } else {
 497                         tv.tv_sec = 0;
 498                         tv.tv_usec = 0;
 499                 }
 500         }
 501
 502         if ( rc == -1 ) {
 503                 /*
 504                  * FIXME: need a strategy to handle errors
 505                  */
 506                 rc = meta_back_op_result( lc, op, rs );
 507                 goto finish;
 508         }
 509
 510         /*
 511          * Rewrite the matched portion of the search base, if required
 512          *
 513          * FIXME: only the last one gets caught!
 514          */
 515         if ( candidate_match == initial_candidates
 516                         && match.bv_val != NULL && *match.bv_val ) {
 517                 dc.ctx = "matchedDn";
 518                 dc.rwmap = &li->targets[ last ]->rwmap;
 519
 520                 if ( ldap_back_dn_massage( &dc, &match, &mmatch ) ) {
 521                         mmatch.bv_val = NULL;
 522                 }
 523         }
 524
 525         /*
 526          * In case we returned at least one entry, we return LDAP_SUCCESS
 527          * otherwise, the latter error code we got
 528          *
 529          * FIXME: we should handle error codes and return the more
 530          * important/reasonable
 531          */
 532         if ( sres == LDAP_SUCCESS && v2refs ) {
 533                 sres = LDAP_REFERRAL;
 534         }
 535         rs->sr_err = sres;
 536         rs->sr_matched = mmatch.bv_val;
 537         rs->sr_v2ref = v2refs;
 538         send_ldap_result( op, rs );
 539         rs->sr_matched = NULL;
 540         rs->sr_v2ref = NULL;
 541
 542
 543 finish:;
 544         if ( match.bv_val ) {
 545                 if ( mmatch.bv_val != match.bv_val ) {
 546                         free( mmatch.bv_val );
 547                 }
 548                 free( match.bv_val );
 549         }
 550
 551         if ( err ) {
 552                 free( err );
 553         }
 554
 555         if ( msgid ) {
 556                 ch_free( msgid );
 557         }
 558
 559         return rc;
 560 }
 561
 562 static int
 563 meta_send_entry(
 564                 Operation       *op,
 565                 SlapReply       *rs,
 566                 struct metaconn *lc,
 567                 int             target,
 568                 LDAPMessage     *e
 569 )
 570 {
 571         struct metainfo         *li = ( struct metainfo * )op->o_bd->be_private;
 572         struct berval           a, mapped;
 573         Entry                   ent = {0};
 574         BerElement              ber = *e->lm_ber;
 575         Attribute               *attr, **attrp;
 576         struct berval           dummy = { 0, NULL };
 577         struct berval           *bv, bdn;
 578         const char              *text;
 579         dncookie                dc;
 580
 581         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 582                 return LDAP_DECODING_ERROR;
 583         }
 584
 585         /*
 586          * Rewrite the dn of the result, if needed
 587          */
 588         dc.rwmap = &li->targets[ target ]->rwmap;
 589         dc.conn = op->o_conn;
 590         dc.rs = rs;
 591         dc.ctx = "searchResult";
 592
 593         rs->sr_err = ldap_back_dn_massage( &dc, &bdn, &ent.e_name );
 594         if ( rs->sr_err != LDAP_SUCCESS) {
 595                 return rs->sr_err;
 596         }
 597
 598         /*
 599          * Note: this may fail if the target host(s) schema differs
 600          * from the one known to the meta, and a DN with unknown
 601          * attributes is returned.
 602          *
 603          * FIXME: should we log anything, or delegate to dnNormalize?
 604          */
 605         if ( dnNormalize( 0, NULL, NULL, &ent.e_name, &ent.e_nname,
 606                 &op->o_tmpmemctx ) != LDAP_SUCCESS )
 607         {
 608                 return LDAP_INVALID_DN_SYNTAX;
 609         }
 610
 611         /*
 612          * cache dn
 613          */
 614         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 615                 ( void )meta_dncache_update_entry( &li->cache,
 616                                 &ent.e_nname, target );
 617         }
 618
 619         attrp = &ent.e_attrs;
 620
 621         dc.ctx = "searchAttrDN";
 622         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 623                 int             last = 0;
 624
 625                 ldap_back_map( &li->targets[ target ]->rwmap.rwm_at,
 626                                 &a, &mapped, BACKLDAP_REMAP );
 627                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0' ) {
 628                         continue;
 629                 }
 630                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 631                 if ( attr == NULL ) {
 632                         continue;
 633                 }
 634                 attr->a_flags = 0;
 635                 attr->a_next = 0;
 636                 attr->a_desc = NULL;
 637                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 638                                 != LDAP_SUCCESS) {
 639                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 640                                         != LDAP_SUCCESS) {
 641 #ifdef NEW_LOGGING
 642                                 LDAP_LOG( BACK_META, DETAIL1,
 643                                         "slap_bv2undef_ad(%s): %s\n", mapped.bv_val, text, 0 );
 644 #else /* !NEW_LOGGING */
 645                                 Debug( LDAP_DEBUG_ANY,
 646                                                 "slap_bv2undef_ad(%s): "
 647                                                 "%s\n%s", mapped.bv_val, text, "" );
 648 #endif /* !NEW_LOGGING */
 649                                 ch_free( attr );
 650                                 continue;
 651                         }
 652                 }
 653
 654                 /* no subschemaSubentry */
 655                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 656
 657                         /*
 658                          * We eat target's subschemaSubentry because
 659                          * a search for this value is likely not
 660                          * to resolve to the appropriate backend;
 661                          * later, the local subschemaSubentry is
 662                          * added.
 663                          */
 664                         ( void )ber_scanf( &ber, "x" /* [W] */ );
 665
 666                         ch_free(attr);
 667                         continue;
 668                 }
 669
 670                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 671                                 || attr->a_vals == NULL ) {
 672                         attr->a_vals = &dummy;
 673
 674                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 675                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 676
 677                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 678
 679                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 680                                 ldap_back_map( &li->targets[ target ]->rwmap.rwm_oc,
 681                                                 bv, &mapped, BACKLDAP_REMAP );
 682                                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 683                                         free( bv->bv_val );
 684                                         bv->bv_val = NULL;
 685                                         if ( --last < 0 ) {
 686                                                 break;
 687                                         }
 688                                         *bv = attr->a_vals[ last ];
 689                                         attr->a_vals[ last ].bv_val = NULL;
 690                                         bv--;
 691
 692                                 } else if ( mapped.bv_val != bv->bv_val ) {
 693                                         free( bv->bv_val );
 694                                         ber_dupbv( bv, &mapped );
 695                                 }
 696                         }
 697                 /*
 698                  * It is necessary to try to rewrite attributes with
 699                  * dn syntax because they might be used in ACLs as
 700                  * members of groups; since ACLs are applied to the
 701                  * rewritten stuff, no dn-based subecj clause could
 702                  * be used at the ldap backend side (see
 703                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 704                  * The problem can be overcome by moving the dn-based
 705                  * ACLs to the target directory server, and letting
 706                  * everything pass thru the ldap backend.
 707                  */
 708                 } else if ( attr->a_desc->ad_type->sat_syntax ==
 709                                 slap_schema.si_syn_distinguishedName ) {
 710                         ldap_dnattr_result_rewrite( &dc, attr->a_vals );
 711                 }
 712
 713                 if ( last && attr->a_desc->ad_type->sat_equality &&
 714                         attr->a_desc->ad_type->sat_equality->smr_normalize ) {
 715                         int i;
 716
 717                         attr->a_nvals = ch_malloc((last + 1)*sizeof(struct berval));
 718                         for ( i = 0; i<last; i++ ) {
 719                                 attr->a_desc->ad_type->sat_equality->smr_normalize(
 720                                         SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
 721                                         attr->a_desc->ad_type->sat_syntax,
 722                                         attr->a_desc->ad_type->sat_equality,
 723                                         &attr->a_vals[i], &attr->a_nvals[i],
 724                                         op->o_tmpmemctx );
 725                         }
 726                         attr->a_nvals[i].bv_val = NULL;
 727                         attr->a_nvals[i].bv_len = 0;
 728                 } else {
 729                         attr->a_nvals = attr->a_vals;
 730                 }
 731
 732                 *attrp = attr;
 733                 attrp = &attr->a_next;
 734         }
 735         rs->sr_entry = &ent;
 736         rs->sr_attrs = op->oq_search.rs_attrs;
 737         send_search_entry( op, rs );
 738         rs->sr_entry = NULL;
 739         rs->sr_attrs = NULL;
 740         while ( ent.e_attrs ) {
 741                 attr = ent.e_attrs;
 742                 ent.e_attrs = attr->a_next;
 743                 if ( attr->a_vals != &dummy ) {
 744                         ber_bvarray_free( attr->a_vals );
 745                 }
 746                 free( attr );
 747         }
 748
 749         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 750                 free( ent.e_dn );
 751         }
 752         if ( ent.e_ndn ) {
 753                 free( ent.e_ndn );
 754         }
 755
 756         return LDAP_SUCCESS;
 757 }
 758
 759 static int
 760 is_one_level_rdn(
 761                 const char      *rdn,
 762                 int             from
 763 )
 764 {
 765         for ( ; from--; ) {
 766                 if ( DN_SEPARATOR( rdn[ from ] ) ) {
 767                         return 0;
 768                 }
 769         }
 770
 771         return 1;
 772 }
 773