git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2010 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/socket.h>
  28 #include <ac/string.h>
  29 #include <ac/time.h>
  30
  31 #include "lutil.h"
  32 #include "slap.h"
  33 #include "../back-ldap/back-ldap.h"
  34 #include "back-meta.h"
  35 #undef ldap_debug       /* silence a warning in ldap-int.h */
  36 #include "ldap_log.h"
  37 #include "../../../libraries/libldap/ldap-int.h"
  38
  39 /* IGNORE means that target does not (no longer) participate
  40  * in the search;
  41  * NOTREADY means the search on that target has not been initialized yet
  42  */
  43 #define META_MSGID_IGNORE       (-1)
  44 #define META_MSGID_NEED_BIND    (-2)
  45 #define META_MSGID_CONNECTING   (-3)
  46
  47 static int
  48 meta_send_entry(
  49         Operation       *op,
  50         SlapReply       *rs,
  51         metaconn_t      *mc,
  52         int             i,
  53         LDAPMessage     *e );
  54
  55 typedef enum meta_search_candidate_t {
  56         META_SEARCH_UNDEFINED = -2,
  57         META_SEARCH_ERR = -1,
  58         META_SEARCH_NOT_CANDIDATE,
  59         META_SEARCH_CANDIDATE,
  60         META_SEARCH_BINDING,
  61         META_SEARCH_NEED_BIND,
  62         META_SEARCH_CONNECTING
  63 } meta_search_candidate_t;
  64
  65 /*
  66  * meta_search_dobind_init()
  67  *
  68  * initiates bind for a candidate target of a search.
  69  */
  70 static meta_search_candidate_t
  71 meta_search_dobind_init(
  72         Operation               *op,
  73         SlapReply               *rs,
  74         metaconn_t              **mcp,
  75         int                     candidate,
  76         SlapReply               *candidates )
  77 {
  78         metaconn_t              *mc = *mcp;
  79         metainfo_t              *mi = ( metainfo_t * )op->o_bd->be_private;
  80         metatarget_t            *mt = mi->mi_targets[ candidate ];
  81         metasingleconn_t        *msc = &mc->mc_conns[ candidate ];
  82
  83         struct berval           binddn = msc->msc_bound_ndn,
  84                                 cred = msc->msc_cred;
  85         int                     method;
  86
  87         int                     rc;
  88
  89         meta_search_candidate_t retcode;
  90
  91         Debug( LDAP_DEBUG_TRACE, "%s >>> meta_search_dobind_init[%d]\n",
  92                 op->o_log_prefix, candidate, 0 );
  93
  94         /*
  95          * all the targets are already bound as pseudoroot
  96          */
  97         if ( mc->mc_authz_target == META_BOUND_ALL ) {
  98                 return META_SEARCH_CANDIDATE;
  99         }
 100
 101         retcode = META_SEARCH_BINDING;
 102         ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
 103         if ( LDAP_BACK_CONN_ISBOUND( msc ) || LDAP_BACK_CONN_ISANON( msc ) ) {
 104                 /* already bound (or anonymous) */
 105
 106 #ifdef DEBUG_205
 107                 char    buf[ SLAP_TEXT_BUFLEN ] = { '\0' };
 108                 int     bound = 0;
 109
 110                 if ( LDAP_BACK_CONN_ISBOUND( msc ) ) {
 111                         bound = 1;
 112                 }
 113
 114                 snprintf( buf, sizeof( buf ), " mc=%p ld=%p%s DN=\"%s\"",
 115                         (void *)mc, (void *)msc->msc_ld,
 116                         bound ? " bound" : " anonymous",
 117                         bound == 0 ? "" : msc->msc_bound_ndn.bv_val );
 118                 Debug( LDAP_DEBUG_ANY, "### %s meta_search_dobind_init[%d]%s\n",
 119                         op->o_log_prefix, candidate, buf );
 120 #endif /* DEBUG_205 */
 121
 122                 retcode = META_SEARCH_CANDIDATE;
 123
 124         } else if ( META_BACK_CONN_CREATING( msc ) || LDAP_BACK_CONN_BINDING( msc ) ) {
 125                 /* another thread is binding the target for this conn; wait */
 126
 127 #ifdef DEBUG_205
 128                 char    buf[ SLAP_TEXT_BUFLEN ] = { '\0' };
 129
 130                 snprintf( buf, sizeof( buf ), " mc=%p ld=%p needbind",
 131                         (void *)mc, (void *)msc->msc_ld );
 132                 Debug( LDAP_DEBUG_ANY, "### %s meta_search_dobind_init[%d]%s\n",
 133                         op->o_log_prefix, candidate, buf );
 134 #endif /* DEBUG_205 */
 135
 136                 candidates[ candidate ].sr_msgid = META_MSGID_NEED_BIND;
 137                 retcode = META_SEARCH_NEED_BIND;
 138
 139         } else {
 140                 /* we'll need to bind the target for this conn */
 141
 142 #ifdef DEBUG_205
 143                 char buf[ SLAP_TEXT_BUFLEN ];
 144
 145                 snprintf( buf, sizeof( buf ), " mc=%p ld=%p binding",
 146                         (void *)mc, (void *)msc->msc_ld );
 147                 Debug( LDAP_DEBUG_ANY, "### %s meta_search_dobind_init[%d]%s\n",
 148                         op->o_log_prefix, candidate, buf );
 149 #endif /* DEBUG_205 */
 150
 151                 if ( msc->msc_ld == NULL ) {
 152                         /* for some reason (e.g. because formerly in "binding"
 153                          * state, with eventual connection expiration or invalidation)
 154                          * it was not initialized as expected */
 155
 156                         Debug( LDAP_DEBUG_ANY, "%s meta_search_dobind_init[%d] mc=%p ld=NULL\n",
 157                                 op->o_log_prefix, candidate, (void *)mc );
 158
 159                         rc = meta_back_init_one_conn( op, rs, *mcp, candidate,
 160                                 LDAP_BACK_CONN_ISPRIV( *mcp ), LDAP_BACK_DONTSEND, 0 );
 161                         switch ( rc ) {
 162                         case LDAP_SUCCESS:
 163                                 assert( msc->msc_ld != NULL );
 164                                 break;
 165
 166                         case LDAP_SERVER_DOWN:
 167                         case LDAP_UNAVAILABLE:
 168                                 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 169                                 goto down;
 170
 171                         default:
 172                                 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 173                                 goto other;
 174                         }
 175                 }
 176
 177                 LDAP_BACK_CONN_BINDING_SET( msc );
 178         }
 179
 180         ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 181
 182         if ( retcode != META_SEARCH_BINDING ) {
 183                 return retcode;
 184         }
 185
 186         /* NOTE: this obsoletes pseudorootdn */
 187         if ( op->o_conn != NULL &&
 188                 !op->o_do_not_cache &&
 189                 ( BER_BVISNULL( &msc->msc_bound_ndn ) ||
 190                         BER_BVISEMPTY( &msc->msc_bound_ndn ) ||
 191                         ( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) ) )
 192         {
 193                 rc = meta_back_proxy_authz_cred( mc, candidate, op, rs, LDAP_BACK_DONTSEND, &binddn, &cred, &method );
 194                 switch ( rc ) {
 195                 case LDAP_SUCCESS:
 196                         break;
 197                 case LDAP_UNAVAILABLE:
 198                         goto down;
 199                 default:
 200                         goto other;
 201                 }
 202
 203                 /* NOTE: we copy things here, even if bind didn't succeed yet,
 204                  * because the connection is not shared until bind is over */
 205                 if ( !BER_BVISNULL( &binddn ) ) {
 206                         ber_bvreplace( &msc->msc_bound_ndn, &binddn );
 207                         if ( META_BACK_TGT_SAVECRED( mt ) && !BER_BVISNULL( &cred ) ) {
 208                                 if ( !BER_BVISNULL( &msc->msc_cred ) ) {
 209                                         memset( msc->msc_cred.bv_val, 0,
 210                                                 msc->msc_cred.bv_len );
 211                                 }
 212                                 ber_bvreplace( &msc->msc_cred, &cred );
 213                         }
 214                 }
 215
 216                 if ( LDAP_BACK_CONN_ISBOUND( msc ) ) {
 217                         /* apparently, idassert was configured with SASL bind,
 218                          * so bind occurred inside meta_back_proxy_authz_cred() */
 219                         ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
 220                         LDAP_BACK_CONN_BINDING_CLEAR( msc );
 221                         ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 222                         return META_SEARCH_CANDIDATE;
 223                 }
 224
 225                 /* paranoid */
 226                 switch ( method ) {
 227                 case LDAP_AUTH_NONE:
 228                 case LDAP_AUTH_SIMPLE:
 229                         /* do a simple bind with binddn, cred */
 230                         break;
 231
 232                 default:
 233                         assert( 0 );
 234                         break;
 235                 }
 236         }
 237
 238         assert( msc->msc_ld != NULL );
 239
 240         if ( !BER_BVISEMPTY( &binddn ) && BER_BVISEMPTY( &cred ) ) {
 241                 /* bind anonymously? */
 242                 Debug( LDAP_DEBUG_ANY, "%s meta_search_dobind_init[%d] mc=%p: "
 243                         "non-empty dn with empty cred; binding anonymously\n",
 244                         op->o_log_prefix, candidate, (void *)mc );
 245                 cred = slap_empty_bv;
 246
 247         } else if ( BER_BVISEMPTY( &binddn ) && !BER_BVISEMPTY( &cred ) ) {
 248                 /* error */
 249                 Debug( LDAP_DEBUG_ANY, "%s meta_search_dobind_init[%d] mc=%p: "
 250                         "empty dn with non-empty cred: error\n",
 251                         op->o_log_prefix, candidate, (void *)mc );
 252                 goto other;
 253         }
 254
 255         /* connect must be async only the first time... */
 256         ldap_set_option( msc->msc_ld, LDAP_OPT_CONNECT_ASYNC, LDAP_OPT_ON );
 257
 258 retry:;
 259         rc = ldap_sasl_bind( msc->msc_ld, binddn.bv_val, LDAP_SASL_SIMPLE, &cred,
 260                         NULL, NULL, &candidates[ candidate ].sr_msgid );
 261
 262 #ifdef DEBUG_205
 263         {
 264                 char buf[ SLAP_TEXT_BUFLEN ];
 265
 266                 snprintf( buf, sizeof( buf ), "meta_search_dobind_init[%d] mc=%p ld=%p rc=%d",
 267                         candidate, (void *)mc, (void *)mc->mc_conns[ candidate ].msc_ld, rc );
 268                 Debug( LDAP_DEBUG_ANY, "### %s %s\n",
 269                         op->o_log_prefix, buf, 0 );
 270         }
 271 #endif /* DEBUG_205 */
 272
 273         switch ( rc ) {
 274         case LDAP_SUCCESS:
 275                 assert( candidates[ candidate ].sr_msgid >= 0 );
 276                 META_BINDING_SET( &candidates[ candidate ] );
 277                 return META_SEARCH_BINDING;
 278
 279         case LDAP_X_CONNECTING:
 280                 /* must retry, same conn */
 281                 candidates[ candidate ].sr_msgid = META_MSGID_CONNECTING;
 282                 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
 283                 LDAP_BACK_CONN_BINDING_CLEAR( msc );
 284                 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 285                 return META_SEARCH_CONNECTING;
 286
 287         case LDAP_SERVER_DOWN:
 288 down:;
 289                 /* This is the worst thing that could happen:
 290                  * the search will wait until the retry is over. */
 291                 if ( !META_IS_RETRYING( &candidates[ candidate ] ) ) {
 292                         META_RETRYING_SET( &candidates[ candidate ] );
 293
 294                         ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
 295
 296                         assert( mc->mc_refcnt > 0 );
 297                         if ( LogTest( LDAP_DEBUG_ANY ) ) {
 298                                 char    buf[ SLAP_TEXT_BUFLEN ];
 299
 300                                 /* this lock is required; however,
 301                                  * it's invoked only when logging is on */
 302                                 ldap_pvt_thread_mutex_lock( &mt->mt_uri_mutex );
 303                                 snprintf( buf, sizeof( buf ),
 304                                         "retrying URI=\"%s\" DN=\"%s\"",
 305                                         mt->mt_uri,
 306                                         BER_BVISNULL( &msc->msc_bound_ndn ) ?
 307                                                 "" : msc->msc_bound_ndn.bv_val );
 308                                 ldap_pvt_thread_mutex_unlock( &mt->mt_uri_mutex );
 309
 310                                 Debug( LDAP_DEBUG_ANY,
 311                                         "%s meta_search_dobind_init[%d]: %s.\n",
 312                                         op->o_log_prefix, candidate, buf );
 313                         }
 314
 315                         meta_clear_one_candidate( op, mc, candidate );
 316                         LDAP_BACK_CONN_ISBOUND_CLEAR( msc );
 317
 318                         ( void )rewrite_session_delete( mt->mt_rwmap.rwm_rw, op->o_conn );
 319
 320                         /* mc here must be the regular mc, reset and ready for init */
 321                         rc = meta_back_init_one_conn( op, rs, mc, candidate,
 322                                 LDAP_BACK_CONN_ISPRIV( mc ), LDAP_BACK_DONTSEND, 0 );
 323
 324                         if ( rc == LDAP_SUCCESS ) {
 325                                 LDAP_BACK_CONN_BINDING_SET( msc );
 326                         }
 327
 328                         ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 329
 330                         if ( rc == LDAP_SUCCESS ) {
 331                                 candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
 332                                 goto retry;
 333                         }
 334                 }
 335
 336                 if ( *mcp == NULL ) {
 337                         retcode = META_SEARCH_ERR;
 338                         rs->sr_err = LDAP_UNAVAILABLE;
 339                         candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
 340                         break;
 341                 }
 342                 /* fall thru */
 343
 344         default:
 345 other:;
 346                 rs->sr_err = rc;
 347                 rc = slap_map_api2result( rs );
 348
 349                 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
 350                 meta_clear_one_candidate( op, mc, candidate );
 351                 candidates[ candidate ].sr_err = rc;
 352                 if ( META_BACK_ONERR_STOP( mi ) ) {
 353                         LDAP_BACK_CONN_TAINTED_SET( mc );
 354                         meta_back_release_conn_lock( mi, mc, 0 );
 355                         *mcp = NULL;
 356                         rs->sr_err = rc;
 357
 358                         retcode = META_SEARCH_ERR;
 359
 360                 } else {
 361                         retcode = META_SEARCH_NOT_CANDIDATE;
 362                 }
 363                 candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
 364                 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 365                 break;
 366         }
 367
 368         return retcode;
 369 }
 370
 371 static meta_search_candidate_t
 372 meta_search_dobind_result(
 373         Operation               *op,
 374         SlapReply               *rs,
 375         metaconn_t              **mcp,
 376         int                     candidate,
 377         SlapReply               *candidates,
 378         LDAPMessage             *res )
 379 {
 380         metainfo_t              *mi = ( metainfo_t * )op->o_bd->be_private;
 381         metatarget_t            *mt = mi->mi_targets[ candidate ];
 382         metaconn_t              *mc = *mcp;
 383         metasingleconn_t        *msc = &mc->mc_conns[ candidate ];
 384
 385         meta_search_candidate_t retcode = META_SEARCH_NOT_CANDIDATE;
 386         int                     rc;
 387
 388         assert( msc->msc_ld != NULL );
 389
 390         /* FIXME: matched? referrals? response controls? */
 391         rc = ldap_parse_result( msc->msc_ld, res,
 392                 &candidates[ candidate ].sr_err,
 393                 NULL, NULL, NULL, NULL, 0 );
 394         if ( rc != LDAP_SUCCESS ) {
 395                 candidates[ candidate ].sr_err = rc;
 396         }
 397         rc = slap_map_api2result( &candidates[ candidate ] );
 398
 399         ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
 400         LDAP_BACK_CONN_BINDING_CLEAR( msc );
 401         if ( rc != LDAP_SUCCESS ) {
 402                 meta_clear_one_candidate( op, mc, candidate );
 403                 candidates[ candidate ].sr_err = rc;
 404                 if ( META_BACK_ONERR_STOP( mi ) ) {
 405                         LDAP_BACK_CONN_TAINTED_SET( mc );
 406                         meta_back_release_conn_lock( mi, mc, 0 );
 407                         *mcp = NULL;
 408                         retcode = META_SEARCH_ERR;
 409                         rs->sr_err = rc;
 410                 }
 411
 412         } else {
 413                 /* FIXME: check if bound as idassert authcDN! */
 414                 if ( BER_BVISNULL( &msc->msc_bound_ndn )
 415                         || BER_BVISEMPTY( &msc->msc_bound_ndn ) )
 416                 {
 417                         LDAP_BACK_CONN_ISANON_SET( msc );
 418
 419                 } else {
 420                         if ( META_BACK_TGT_SAVECRED( mt ) &&
 421                                 !BER_BVISNULL( &msc->msc_cred ) &&
 422                                 !BER_BVISEMPTY( &msc->msc_cred ) )
 423                         {
 424                                 ldap_set_rebind_proc( msc->msc_ld, mt->mt_rebind_f, msc );
 425                         }
 426                         LDAP_BACK_CONN_ISBOUND_SET( msc );
 427                 }
 428                 retcode = META_SEARCH_CANDIDATE;
 429
 430                 /* connect must be async */
 431                 ldap_set_option( msc->msc_ld, LDAP_OPT_CONNECT_ASYNC, LDAP_OPT_OFF );
 432         }
 433
 434         candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
 435         META_BINDING_CLEAR( &candidates[ candidate ] );
 436
 437         ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 438
 439         return retcode;
 440 }
 441
 442 static meta_search_candidate_t
 443 meta_back_search_start(
 444         Operation               *op,
 445         SlapReply               *rs,
 446         dncookie                *dc,
 447         metaconn_t              **mcp,
 448         int                     candidate,
 449         SlapReply               *candidates )
 450 {
 451         metainfo_t              *mi = ( metainfo_t * )op->o_bd->be_private;
 452         metatarget_t            *mt = mi->mi_targets[ candidate ];
 453         metasingleconn_t        *msc = &(*mcp)->mc_conns[ candidate ];
 454         struct berval           realbase = op->o_req_dn;
 455         int                     realscope = op->ors_scope;
 456         struct berval           mbase = BER_BVNULL;
 457         struct berval           mfilter = BER_BVNULL;
 458         char                    **mapped_attrs = NULL;
 459         int                     rc;
 460         meta_search_candidate_t retcode;
 461         struct timeval          tv, *tvp = NULL;
 462         int                     nretries = 1;
 463         LDAPControl             **ctrls = NULL;
 464
 465         /* this should not happen; just in case... */
 466         if ( msc->msc_ld == NULL ) {
 467                 Debug( LDAP_DEBUG_ANY,
 468                         "%s: meta_back_search_start candidate=%d ld=NULL%s.\n",
 469                         op->o_log_prefix, candidate,
 470                         META_BACK_ONERR_STOP( mi ) ? "" : " (ignored)" );
 471                 candidates[ candidate ].sr_err = LDAP_OTHER;
 472                 if ( META_BACK_ONERR_STOP( mi ) ) {
 473                         return META_SEARCH_ERR;
 474                 }
 475                 candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
 476                 return META_SEARCH_NOT_CANDIDATE;
 477         }
 478
 479         Debug( LDAP_DEBUG_TRACE, "%s >>> meta_back_search_start[%d]\n", op->o_log_prefix, candidate, 0 );
 480
 481         /*
 482          * modifies the base according to the scope, if required
 483          */
 484         if ( mt->mt_nsuffix.bv_len > op->o_req_ndn.bv_len ) {
 485                 switch ( op->ors_scope ) {
 486                 case LDAP_SCOPE_SUBTREE:
 487                         /*
 488                          * make the target suffix the new base
 489                          * FIXME: this is very forgiving, because
 490                          * "illegal" searchBases may be turned
 491                          * into the suffix of the target; however,
 492                          * the requested searchBase already passed
 493                          * thru the candidate analyzer...
 494                          */
 495                         if ( dnIsSuffix( &mt->mt_nsuffix, &op->o_req_ndn ) ) {
 496                                 realbase = mt->mt_nsuffix;
 497                                 if ( mt->mt_scope == LDAP_SCOPE_SUBORDINATE ) {
 498                                         realscope = LDAP_SCOPE_SUBORDINATE;
 499                                 }
 500
 501                         } else {
 502                                 /*
 503                                  * this target is no longer candidate
 504                                  */
 505                                 retcode = META_SEARCH_NOT_CANDIDATE;
 506                                 goto doreturn;
 507                         }
 508                         break;
 509
 510                 case LDAP_SCOPE_SUBORDINATE:
 511                 case LDAP_SCOPE_ONELEVEL:
 512                 {
 513                         struct berval   rdn = mt->mt_nsuffix;
 514                         rdn.bv_len -= op->o_req_ndn.bv_len + STRLENOF( "," );
 515                         if ( dnIsOneLevelRDN( &rdn )
 516                                         && dnIsSuffix( &mt->mt_nsuffix, &op->o_req_ndn ) )
 517                         {
 518                                 /*
 519                                  * if there is exactly one level,
 520                                  * make the target suffix the new
 521                                  * base, and make scope "base"
 522                                  */
 523                                 realbase = mt->mt_nsuffix;
 524                                 if ( op->ors_scope == LDAP_SCOPE_SUBORDINATE ) {
 525                                         if ( mt->mt_scope == LDAP_SCOPE_SUBORDINATE ) {
 526                                                 realscope = LDAP_SCOPE_SUBORDINATE;
 527                                         } else {
 528                                                 realscope = LDAP_SCOPE_SUBTREE;
 529                                         }
 530                                 } else {
 531                                         realscope = LDAP_SCOPE_BASE;
 532                                 }
 533                                 break;
 534                         } /* else continue with the next case */
 535                 }
 536
 537                 case LDAP_SCOPE_BASE:
 538                         /*
 539                          * this target is no longer candidate
 540                          */
 541                         retcode = META_SEARCH_NOT_CANDIDATE;
 542                         goto doreturn;
 543                 }
 544         }
 545
 546         /* initiate dobind */
 547         retcode = meta_search_dobind_init( op, rs, mcp, candidate, candidates );
 548
 549         Debug( LDAP_DEBUG_TRACE, "%s <<< meta_search_dobind_init[%d]=%d\n", op->o_log_prefix, candidate, retcode );
 550
 551         if ( retcode != META_SEARCH_CANDIDATE ) {
 552                 goto doreturn;
 553         }
 554
 555         /*
 556          * Rewrite the search base, if required
 557          */
 558         dc->target = mt;
 559         dc->ctx = "searchBase";
 560         switch ( ldap_back_dn_massage( dc, &realbase, &mbase ) ) {
 561         case LDAP_SUCCESS:
 562                 break;
 563
 564         case LDAP_UNWILLING_TO_PERFORM:
 565                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 566                 rs->sr_text = "Operation not allowed";
 567                 send_ldap_result( op, rs );
 568                 retcode = META_SEARCH_ERR;
 569                 goto doreturn;
 570
 571         default:
 572
 573                 /*
 574                  * this target is no longer candidate
 575                  */
 576                 retcode = META_SEARCH_NOT_CANDIDATE;
 577                 goto doreturn;
 578         }
 579
 580         /*
 581          * Maps filter
 582          */
 583         rc = ldap_back_filter_map_rewrite( dc, op->ors_filter,
 584                         &mfilter, BACKLDAP_MAP, op->o_tmpmemctx );
 585         switch ( rc ) {
 586         case LDAP_SUCCESS:
 587                 break;
 588
 589         case LDAP_COMPARE_FALSE:
 590         default:
 591                 /*
 592                  * this target is no longer candidate
 593                  */
 594                 retcode = META_SEARCH_NOT_CANDIDATE;
 595                 goto done;
 596         }
 597
 598         /*
 599          * Maps required attributes
 600          */
 601         rc = ldap_back_map_attrs( &mt->mt_rwmap.rwm_at,
 602                         op->ors_attrs, BACKLDAP_MAP, &mapped_attrs,
 603                         op->o_tmpmemctx );
 604         if ( rc != LDAP_SUCCESS ) {
 605                 /*
 606                  * this target is no longer candidate
 607                  */
 608                 retcode = META_SEARCH_NOT_CANDIDATE;
 609                 goto done;
 610         }
 611
 612         if ( op->ors_tlimit != SLAP_NO_LIMIT ) {
 613                 tv.tv_sec = op->ors_tlimit > 0 ? op->ors_tlimit : 1;
 614                 tv.tv_usec = 0;
 615                 tvp = &tv;
 616         }
 617
 618 retry:;
 619         ctrls = op->o_ctrls;
 620         if ( meta_back_controls_add( op, rs, *mcp, candidate, &ctrls )
 621                 != LDAP_SUCCESS )
 622         {
 623                 candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
 624                 retcode = META_SEARCH_NOT_CANDIDATE;
 625                 goto done;
 626         }
 627
 628         /*
 629          * Starts the search
 630          */
 631         assert( msc->msc_ld != NULL );
 632         rc = ldap_pvt_search( msc->msc_ld,
 633                         mbase.bv_val, realscope, mfilter.bv_val,
 634                         mapped_attrs, op->ors_attrsonly,
 635                         ctrls, NULL, tvp, op->ors_slimit, op->ors_deref,
 636                         &candidates[ candidate ].sr_msgid );
 637         switch ( rc ) {
 638         case LDAP_SUCCESS:
 639                 retcode = META_SEARCH_CANDIDATE;
 640                 break;
 641
 642         case LDAP_SERVER_DOWN:
 643                 if ( nretries && meta_back_retry( op, rs, mcp, candidate, LDAP_BACK_DONTSEND ) ) {
 644                         nretries = 0;
 645                         /* if the identity changed, there might be need to re-authz */
 646                         (void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
 647                         goto retry;
 648                 }
 649
 650                 if ( *mcp == NULL ) {
 651                         retcode = META_SEARCH_ERR;
 652                         candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
 653                         break;
 654                 }
 655                 /* fall thru */
 656
 657         default:
 658                 candidates[ candidate ].sr_msgid = META_MSGID_IGNORE;
 659                 retcode = META_SEARCH_NOT_CANDIDATE;
 660         }
 661
 662 done:;
 663         (void)mi->mi_ldap_extra->controls_free( op, rs, &ctrls );
 664
 665         if ( mapped_attrs ) {
 666                 ber_memfree_x( mapped_attrs, op->o_tmpmemctx );
 667         }
 668         if ( mfilter.bv_val != op->ors_filterstr.bv_val ) {
 669                 ber_memfree_x( mfilter.bv_val, op->o_tmpmemctx );
 670         }
 671         if ( mbase.bv_val != realbase.bv_val ) {
 672                 free( mbase.bv_val );
 673         }
 674
 675 doreturn:;
 676         Debug( LDAP_DEBUG_TRACE, "%s <<< meta_back_search_start[%d]=%d\n", op->o_log_prefix, candidate, retcode );
 677
 678         return retcode;
 679 }
 680
 681 int
 682 meta_back_search( Operation *op, SlapReply *rs )
 683 {
 684         metainfo_t      *mi = ( metainfo_t * )op->o_bd->be_private;
 685         metaconn_t      *mc;
 686         struct timeval  save_tv = { 0, 0 },
 687                         tv;
 688         time_t          stoptime = (time_t)(-1),
 689                         lastres_time = slap_get_time(),
 690                         timeout = 0;
 691         int             rc = 0, sres = LDAP_SUCCESS;
 692         char            *matched = NULL;
 693         int             last = 0, ncandidates = 0,
 694                         initial_candidates = 0, candidate_match = 0,
 695                         needbind = 0;
 696         ldap_back_send_t        sendok = LDAP_BACK_SENDERR;
 697         long            i;
 698         dncookie        dc;
 699         int             is_ok = 0;
 700         void            *savepriv;
 701         SlapReply       *candidates = NULL;
 702         int             do_taint = 0;
 703
 704         /*
 705          * controls are set in ldap_back_dobind()
 706          *
 707          * FIXME: in case of values return filter, we might want
 708          * to map attrs and maybe rewrite value
 709          */
 710 getconn:;
 711         mc = meta_back_getconn( op, rs, NULL, sendok );
 712         if ( !mc ) {
 713                 return rs->sr_err;
 714         }
 715
 716         dc.conn = op->o_conn;
 717         dc.rs = rs;
 718
 719         if ( candidates == NULL ) candidates = meta_back_candidates_get( op );
 720         /*
 721          * Inits searches
 722          */
 723         for ( i = 0; i < mi->mi_ntargets; i++ ) {
 724                 /* reset sr_msgid; it is used in most loops
 725                  * to check if that target is still to be considered */
 726                 candidates[ i ].sr_msgid = META_MSGID_IGNORE;
 727
 728                 /* a target is marked as candidate by meta_back_getconn();
 729                  * if for any reason (an error, it's over or so) it is
 730                  * no longer active, sr_msgid is set to META_MSGID_IGNORE
 731                  * but it remains candidate, which means it has been active
 732                  * at some point during the operation.  This allows to
 733                  * use its response code and more to compute the final
 734                  * response */
 735                 if ( !META_IS_CANDIDATE( &candidates[ i ] ) ) {
 736                         continue;
 737                 }
 738
 739                 candidates[ i ].sr_matched = NULL;
 740                 candidates[ i ].sr_text = NULL;
 741                 candidates[ i ].sr_ref = NULL;
 742                 candidates[ i ].sr_ctrls = NULL;
 743
 744                 /* get largest timeout among candidates */
 745                 if ( mi->mi_targets[ i ]->mt_timeout[ SLAP_OP_SEARCH ]
 746                         && mi->mi_targets[ i ]->mt_timeout[ SLAP_OP_SEARCH ] > timeout )
 747                 {
 748                         timeout = mi->mi_targets[ i ]->mt_timeout[ SLAP_OP_SEARCH ];
 749                 }
 750         }
 751
 752         for ( i = 0; i < mi->mi_ntargets; i++ ) {
 753                 if ( !META_IS_CANDIDATE( &candidates[ i ] )
 754                         || candidates[ i ].sr_err != LDAP_SUCCESS )
 755                 {
 756                         continue;
 757                 }
 758
 759                 switch ( meta_back_search_start( op, rs, &dc, &mc, i, candidates ) )
 760                 {
 761                 case META_SEARCH_NOT_CANDIDATE:
 762                         candidates[ i ].sr_msgid = META_MSGID_IGNORE;
 763                         break;
 764
 765                 case META_SEARCH_NEED_BIND:
 766                         ++needbind;
 767                         /* fallthru */
 768
 769                 case META_SEARCH_CONNECTING:
 770                 case META_SEARCH_CANDIDATE:
 771                 case META_SEARCH_BINDING:
 772                         candidates[ i ].sr_type = REP_INTERMEDIATE;
 773                         ++ncandidates;
 774                         break;
 775
 776                 case META_SEARCH_ERR:
 777                         savepriv = op->o_private;
 778                         op->o_private = (void *)i;
 779                         send_ldap_result( op, rs );
 780                         op->o_private = savepriv;
 781                         rc = -1;
 782                         goto finish;
 783
 784                 default:
 785                         assert( 0 );
 786                         break;
 787                 }
 788         }
 789
 790         if ( ncandidates > 0 && needbind == ncandidates ) {
 791                 /*
 792                  * give up the second time...
 793                  *
 794                  * NOTE: this should not occur the second time, since a fresh
 795                  * connection has ben created; however, targets may also
 796                  * need bind because the bind timed out or so.
 797                  */
 798                 if ( sendok & LDAP_BACK_BINDING ) {
 799                         Debug( LDAP_DEBUG_ANY,
 800                                 "%s meta_back_search: unable to initialize conn\n",
 801                                 op->o_log_prefix, 0, 0 );
 802                         rs->sr_err = LDAP_UNAVAILABLE;
 803                         rs->sr_text = "unable to initialize connection to remote targets";
 804                         send_ldap_result( op, rs );
 805                         rc = -1;
 806                         goto finish;
 807                 }
 808
 809                 /* FIXME: better create a separate connection? */
 810                 sendok |= LDAP_BACK_BINDING;
 811
 812 #ifdef DEBUG_205
 813                 Debug( LDAP_DEBUG_ANY, "*** %s drop mc=%p create new connection\n",
 814                         op->o_log_prefix, (void *)mc, 0 );
 815 #endif /* DEBUG_205 */
 816
 817                 meta_back_release_conn( mi, mc );
 818                 mc = NULL;
 819
 820                 needbind = 0;
 821                 ncandidates = 0;
 822
 823                 goto getconn;
 824         }
 825
 826         initial_candidates = ncandidates;
 827
 828         if ( LogTest( LDAP_DEBUG_TRACE ) ) {
 829                 char    cnd[ SLAP_TEXT_BUFLEN ];
 830                 int     c;
 831
 832                 for ( c = 0; c < mi->mi_ntargets; c++ ) {
 833                         if ( META_IS_CANDIDATE( &candidates[ c ] ) ) {
 834                                 cnd[ c ] = '*';
 835                         } else {
 836                                 cnd[ c ] = ' ';
 837                         }
 838                 }
 839                 cnd[ c ] = '\0';
 840
 841                 Debug( LDAP_DEBUG_TRACE, "%s meta_back_search: ncandidates=%d "
 842                         "cnd=\"%s\"\n", op->o_log_prefix, ncandidates, cnd );
 843         }
 844
 845         if ( initial_candidates == 0 ) {
 846                 /* NOTE: here we are not sending any matchedDN;
 847                  * this is intended, because if the back-meta
 848                  * is serving this search request, but no valid
 849                  * candidate could be looked up, it means that
 850                  * there is a hole in the mapping of the targets
 851                  * and thus no knowledge of any remote superior
 852                  * is available */
 853                 Debug( LDAP_DEBUG_ANY, "%s meta_back_search: "
 854                         "base=\"%s\" scope=%d: "
 855                         "no candidate could be selected\n",
 856                         op->o_log_prefix, op->o_req_dn.bv_val,
 857                         op->ors_scope );
 858
 859                 /* FIXME: we're sending the first error we encounter;
 860                  * maybe we should pick the worst... */
 861                 rc = LDAP_NO_SUCH_OBJECT;
 862                 for ( i = 0; i < mi->mi_ntargets; i++ ) {
 863                         if ( META_IS_CANDIDATE( &candidates[ i ] )
 864                                 && candidates[ i ].sr_err != LDAP_SUCCESS )
 865                         {
 866                                 rc = candidates[ i ].sr_err;
 867                                 break;
 868                         }
 869                 }
 870
 871                 send_ldap_error( op, rs, rc, NULL );
 872
 873                 goto finish;
 874         }
 875
 876         /* We pull apart the ber result, stuff it into a slapd entry, and
 877          * let send_search_entry stuff it back into ber format. Slow & ugly,
 878          * but this is necessary for version matching, and for ACL processing.
 879          */
 880
 881         if ( op->ors_tlimit != SLAP_NO_LIMIT ) {
 882                 stoptime = op->o_time + op->ors_tlimit;
 883         }
 884
 885         /*
 886          * In case there are no candidates, no cycle takes place...
 887          *
 888          * FIXME: we might use a queue, to better balance the load
 889          * among the candidates
 890          */
 891         for ( rc = 0; ncandidates > 0; ) {
 892                 int     gotit = 0,
 893                         doabandon = 0,
 894                         alreadybound = ncandidates;
 895
 896                 /* check timeout */
 897                 if ( timeout && lastres_time > 0
 898                         && ( slap_get_time() - lastres_time ) > timeout )
 899                 {
 900                         doabandon = 1;
 901                         rs->sr_text = "Operation timed out";
 902                         rc = rs->sr_err = op->o_protocol >= LDAP_VERSION3 ?
 903                                 LDAP_ADMINLIMIT_EXCEEDED : LDAP_OTHER;
 904                         savepriv = op->o_private;
 905                         op->o_private = (void *)i;
 906                         send_ldap_result( op, rs );
 907                         op->o_private = savepriv;
 908                         goto finish;
 909                 }
 910
 911                 /* check time limit */
 912                 if ( op->ors_tlimit != SLAP_NO_LIMIT
 913                                 && slap_get_time() > stoptime )
 914                 {
 915                         doabandon = 1;
 916                         rc = rs->sr_err = LDAP_TIMELIMIT_EXCEEDED;
 917                         savepriv = op->o_private;
 918                         op->o_private = (void *)i;
 919                         send_ldap_result( op, rs );
 920                         op->o_private = savepriv;
 921                         goto finish;
 922                 }
 923
 924                 for ( i = 0; i < mi->mi_ntargets; i++ ) {
 925                         meta_search_candidate_t retcode = META_SEARCH_UNDEFINED;
 926                         metasingleconn_t        *msc = &mc->mc_conns[ i ];
 927                         LDAPMessage             *res = NULL, *msg;
 928
 929                         /* if msgid is invalid, don't ldap_result() */
 930                         if ( candidates[ i ].sr_msgid == META_MSGID_IGNORE ) {
 931                                 continue;
 932                         }
 933
 934                         /* if target still needs bind, retry */
 935                         if ( candidates[ i ].sr_msgid == META_MSGID_NEED_BIND
 936                                 || candidates[ i ].sr_msgid == META_MSGID_CONNECTING )
 937                         {
 938                                 /* initiate dobind */
 939                                 retcode = meta_search_dobind_init( op, rs, &mc, i, candidates );
 940
 941                                 Debug( LDAP_DEBUG_TRACE, "%s <<< meta_search_dobind_init[%ld]=%d\n",
 942                                         op->o_log_prefix, i, retcode );
 943
 944                                 switch ( retcode ) {
 945                                 case META_SEARCH_NEED_BIND:
 946                                         alreadybound--;
 947                                         /* fallthru */
 948
 949                                 case META_SEARCH_CONNECTING:
 950                                 case META_SEARCH_BINDING:
 951                                         break;
 952
 953                                 case META_SEARCH_ERR:
 954                                         candidates[ i ].sr_err = rs->sr_err;
 955                                         if ( META_BACK_ONERR_STOP( mi ) ) {
 956                                                 savepriv = op->o_private;
 957                                                 op->o_private = (void *)i;
 958                                                 send_ldap_result( op, rs );
 959                                                 op->o_private = savepriv;
 960                                                 goto finish;
 961                                         }
 962                                         /* fallthru */
 963
 964                                 case META_SEARCH_NOT_CANDIDATE:
 965                                         /*
 966                                          * When no candidates are left,
 967                                          * the outer cycle finishes
 968                                          */
 969                                         candidates[ i ].sr_msgid = META_MSGID_IGNORE;
 970                                         assert( ncandidates > 0 );
 971                                         --ncandidates;
 972                                         break;
 973
 974                                 case META_SEARCH_CANDIDATE:
 975                                         candidates[ i ].sr_msgid = META_MSGID_IGNORE;
 976                                         switch ( meta_back_search_start( op, rs, &dc, &mc, i, candidates ) )
 977                                         {
 978                                         case META_SEARCH_CANDIDATE:
 979                                                 assert( candidates[ i ].sr_msgid >= 0 );
 980                                                 break;
 981
 982                                         case META_SEARCH_ERR:
 983                                                 candidates[ i ].sr_err = rs->sr_err;
 984                                                 if ( META_BACK_ONERR_STOP( mi ) ) {
 985                                                         savepriv = op->o_private;
 986                                                         op->o_private = (void *)i;
 987                                                         send_ldap_result( op, rs );
 988                                                         op->o_private = savepriv;
 989                                                         goto finish;
 990                                                 }
 991                                                 /* fallthru */
 992
 993                                         case META_SEARCH_NOT_CANDIDATE:
 994                                                 /* means that meta_back_search_start()
 995                                                  * failed but onerr == continue */
 996                                                 candidates[ i ].sr_msgid = META_MSGID_IGNORE;
 997                                                 assert( ncandidates > 0 );
 998                                                 --ncandidates;
 999                                                 break;
1000
1001                                         default:
1002                                                 /* impossible */
1003                                                 assert( 0 );
1004                                                 break;
1005                                         }
1006                                         break;
1007
1008                                 default:
1009                                         /* impossible */
1010                                         assert( 0 );
1011                                         break;
1012                                 }
1013                                 continue;
1014                         }
1015
1016                         /* check for abandon */
1017                         if ( op->o_abandon || LDAP_BACK_CONN_ABANDON( mc ) ) {
1018                                 break;
1019                         }
1020
1021 #ifdef DEBUG_205
1022                         if ( msc->msc_ld == NULL ) {
1023                                 char    buf[ SLAP_TEXT_BUFLEN ];
1024
1025                                 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
1026                                 snprintf( buf, sizeof( buf ),
1027                                         "%s meta_back_search[%ld] mc=%p msgid=%d%s%s%s\n",
1028                                         op->o_log_prefix, (long)i, (void *)mc,
1029                                         candidates[ i ].sr_msgid,
1030                                         META_IS_BINDING( &candidates[ i ] ) ? " binding" : "",
1031                                         LDAP_BACK_CONN_BINDING( &mc->mc_conns[ i ] ) ? " connbinding" : "",
1032                                         META_BACK_CONN_CREATING( &mc->mc_conns[ i ] ) ? " conncreating" : "" );
1033                                 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
1034
1035                                 Debug( LDAP_DEBUG_ANY, "!!! %s\n", buf, 0, 0 );
1036                         }
1037 #endif /* DEBUG_205 */
1038
1039                         /*
1040                          * FIXME: handle time limit as well?
1041                          * Note that target servers are likely
1042                          * to handle it, so at some time we'll
1043                          * get a LDAP_TIMELIMIT_EXCEEDED from
1044                          * one of them ...
1045                          */
1046                         tv = save_tv;
1047                         rc = ldap_result( msc->msc_ld, candidates[ i ].sr_msgid,
1048                                         LDAP_MSG_RECEIVED, &tv, &res );
1049                         switch ( rc ) {
1050                         case 0:
1051                                 /* FIXME: res should not need to be freed */
1052                                 assert( res == NULL );
1053                                 continue;
1054
1055                         case -1:
1056 really_bad:;
1057                                 /* something REALLY bad happened! */
1058                                 if ( candidates[ i ].sr_type == REP_INTERMEDIATE ) {
1059                                         candidates[ i ].sr_type = REP_RESULT;
1060
1061                                         if ( meta_back_retry( op, rs, &mc, i, LDAP_BACK_DONTSEND ) ) {
1062                                                 candidates[ i ].sr_msgid = META_MSGID_IGNORE;
1063                                                 switch ( meta_back_search_start( op, rs, &dc, &mc, i, candidates ) )
1064                                                 {
1065                                                         /* means that failed but onerr == continue */
1066                                                 case META_SEARCH_NOT_CANDIDATE:
1067                                                         candidates[ i ].sr_msgid = META_MSGID_IGNORE;
1068
1069                                                         assert( ncandidates > 0 );
1070                                                         --ncandidates;
1071
1072                                                         candidates[ i ].sr_err = rs->sr_err;
1073                                                         if ( META_BACK_ONERR_STOP( mi ) ) {
1074                                                                 savepriv = op->o_private;
1075                                                                 op->o_private = (void *)i;
1076                                                                 send_ldap_result( op, rs );
1077                                                                 op->o_private = savepriv;
1078                                                                 goto finish;
1079                                                         }
1080                                                         /* fall thru */
1081
1082                                                 case META_SEARCH_CANDIDATE:
1083                                                         /* get back into business... */
1084                                                         continue;
1085
1086                                                 case META_SEARCH_BINDING:
1087                                                 case META_SEARCH_CONNECTING:
1088                                                 case META_SEARCH_NEED_BIND:
1089                                                 case META_SEARCH_UNDEFINED:
1090                                                         assert( 0 );
1091
1092                                                 default:
1093                                                         /* unrecoverable error */
1094                                                         candidates[ i ].sr_msgid = META_MSGID_IGNORE;
1095                                                         rc = rs->sr_err = LDAP_OTHER;
1096                                                         goto finish;
1097                                                 }
1098                                         }
1099
1100                                         candidates[ i ].sr_err = rs->sr_err;
1101                                         if ( META_BACK_ONERR_STOP( mi ) ) {
1102                                                 savepriv = op->o_private;
1103                                                 op->o_private = (void *)i;
1104                                                 send_ldap_result( op, rs );
1105                                                 op->o_private = savepriv;
1106                                                 goto finish;
1107                                         }
1108                                 }
1109
1110                                 /*
1111                                  * When no candidates are left,
1112                                  * the outer cycle finishes
1113                                  */
1114                                 candidates[ i ].sr_msgid = META_MSGID_IGNORE;
1115                                 assert( ncandidates > 0 );
1116                                 --ncandidates;
1117                                 rs->sr_err = candidates[ i ].sr_err;
1118                                 continue;
1119
1120                         default:
1121                                 lastres_time = slap_get_time();
1122
1123                                 /* only touch when activity actually took place... */
1124                                 if ( mi->mi_idle_timeout != 0 && msc->msc_time < lastres_time ) {
1125                                         msc->msc_time = lastres_time;
1126                                 }
1127                                 break;
1128                         }
1129
1130                         for ( msg = ldap_first_message( msc->msc_ld, res );
1131                                 msg != NULL;
1132                                 msg = ldap_next_message( msc->msc_ld, msg ) )
1133                         {
1134                                 rc = ldap_msgtype( msg );
1135                                 if ( rc == LDAP_RES_SEARCH_ENTRY ) {
1136                                         LDAPMessage     *e;
1137
1138                                         if ( candidates[ i ].sr_type == REP_INTERMEDIATE ) {
1139                                                 /* don't retry any more... */
1140                                                 candidates[ i ].sr_type = REP_RESULT;
1141                                         }
1142
1143                                         is_ok++;
1144
1145                                         e = ldap_first_entry( msc->msc_ld, msg );
1146                                         savepriv = op->o_private;
1147                                         op->o_private = (void *)i;
1148                                         rs->sr_err = meta_send_entry( op, rs, mc, i, e );
1149
1150                                         switch ( rs->sr_err ) {
1151                                         case LDAP_SIZELIMIT_EXCEEDED:
1152                                                 savepriv = op->o_private;
1153                                                 op->o_private = (void *)i;
1154                                                 send_ldap_result( op, rs );
1155                                                 op->o_private = savepriv;
1156                                                 rs->sr_err = LDAP_SUCCESS;
1157                                                 ldap_msgfree( res );
1158                                                 res = NULL;
1159                                                 goto finish;
1160
1161                                         case LDAP_UNAVAILABLE:
1162                                                 rs->sr_err = LDAP_OTHER;
1163                                                 ldap_msgfree( res );
1164                                                 res = NULL;
1165                                                 goto finish;
1166                                         }
1167                                         op->o_private = savepriv;
1168
1169                                         /* don't wait any longer... */
1170                                         gotit = 1;
1171                                         save_tv.tv_sec = 0;
1172                                         save_tv.tv_usec = 0;
1173
1174                                 } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
1175                                         char            **references = NULL;
1176                                         int             cnt;
1177
1178                                         if ( META_BACK_TGT_NOREFS( mi->mi_targets[ i ] ) ) {
1179                                                 continue;
1180                                         }
1181
1182                                         if ( candidates[ i ].sr_type == REP_INTERMEDIATE ) {
1183                                                 /* don't retry any more... */
1184                                                 candidates[ i ].sr_type = REP_RESULT;
1185                                         }
1186
1187                                         is_ok++;
1188
1189                                         rc = ldap_parse_reference( msc->msc_ld, msg,
1190                                                         &references, &rs->sr_ctrls, 0 );
1191
1192                                         if ( rc != LDAP_SUCCESS ) {
1193                                                 continue;
1194                                         }
1195
1196                                         if ( references == NULL ) {
1197                                                 continue;
1198                                         }
1199
1200 #ifdef ENABLE_REWRITE
1201                                         dc.ctx = "referralDN";
1202 #else /* ! ENABLE_REWRITE */
1203                                         dc.tofrom = 0;
1204                                         dc.normalized = 0;
1205 #endif /* ! ENABLE_REWRITE */
1206
1207                                         /* FIXME: merge all and return at the end */
1208
1209                                         for ( cnt = 0; references[ cnt ]; cnt++ )
1210                                                 ;
1211
1212                                         rs->sr_ref = ber_memalloc_x( sizeof( struct berval ) * ( cnt + 1 ),
1213                                                 op->o_tmpmemctx );
1214
1215                                         for ( cnt = 0; references[ cnt ]; cnt++ ) {
1216                                                 ber_str2bv_x( references[ cnt ], 0, 1, &rs->sr_ref[ cnt ],
1217                                                 op->o_tmpmemctx );
1218                                         }
1219                                         BER_BVZERO( &rs->sr_ref[ cnt ] );
1220
1221                                         ( void )ldap_back_referral_result_rewrite( &dc, rs->sr_ref,
1222                                                 op->o_tmpmemctx );
1223
1224                                         if ( rs->sr_ref != NULL && !BER_BVISNULL( &rs->sr_ref[ 0 ] ) ) {
1225                                                 /* ignore return value by now */
1226                                                 savepriv = op->o_private;
1227                                                 op->o_private = (void *)i;
1228                                                 ( void )send_search_reference( op, rs );
1229                                                 op->o_private = savepriv;
1230
1231                                                 ber_bvarray_free_x( rs->sr_ref, op->o_tmpmemctx );
1232                                                 rs->sr_ref = NULL;
1233                                         }
1234
1235                                         /* cleanup */
1236                                         if ( references ) {
1237                                                 ber_memvfree( (void **)references );
1238                                         }
1239
1240                                         if ( rs->sr_ctrls ) {
1241                                                 ldap_controls_free( rs->sr_ctrls );
1242                                                 rs->sr_ctrls = NULL;
1243                                         }
1244
1245                                 } else if ( rc == LDAP_RES_INTERMEDIATE ) {
1246                                         if ( candidates[ i ].sr_type == REP_INTERMEDIATE ) {
1247                                                 /* don't retry any more... */
1248                                                 candidates[ i ].sr_type = REP_RESULT;
1249                                         }
1250
1251                                         /* FIXME: response controls
1252                                          * are passed without checks */
1253                                         rs->sr_err = ldap_parse_intermediate( msc->msc_ld,
1254                                                 msg,
1255                                                 (char **)&rs->sr_rspoid,
1256                                                 &rs->sr_rspdata,
1257                                                 &rs->sr_ctrls,
1258                                                 0 );
1259                                         if ( rs->sr_err != LDAP_SUCCESS ) {
1260                                                 candidates[ i ].sr_type = REP_RESULT;
1261                                                 ldap_msgfree( res );
1262                                                 res = NULL;
1263                                                 goto really_bad;
1264                                         }
1265
1266                                         slap_send_ldap_intermediate( op, rs );
1267
1268                                         if ( rs->sr_rspoid != NULL ) {
1269                                                 ber_memfree( (char *)rs->sr_rspoid );
1270                                                 rs->sr_rspoid = NULL;
1271                                         }
1272
1273                                         if ( rs->sr_rspdata != NULL ) {
1274                                                 ber_bvfree( rs->sr_rspdata );
1275                                                 rs->sr_rspdata = NULL;
1276                                         }
1277
1278                                         if ( rs->sr_ctrls != NULL ) {
1279                                                 ldap_controls_free( rs->sr_ctrls );
1280                                                 rs->sr_ctrls = NULL;
1281                                         }
1282
1283                                 } else if ( rc == LDAP_RES_SEARCH_RESULT ) {
1284                                         char            buf[ SLAP_TEXT_BUFLEN ];
1285                                         char            **references = NULL;
1286
1287                                         if ( candidates[ i ].sr_type == REP_INTERMEDIATE ) {
1288                                                 /* don't retry any more... */
1289                                                 candidates[ i ].sr_type = REP_RESULT;
1290                                         }
1291
1292                                         candidates[ i ].sr_msgid = META_MSGID_IGNORE;
1293
1294                                         /* NOTE: ignores response controls
1295                                          * (and intermediate response controls
1296                                          * as well, except for those with search
1297                                          * references); this may not be correct,
1298                                          * but if they're not ignored then
1299                                          * back-meta would need to merge them
1300                                          * consistently (think of pagedResults...)
1301                                          */
1302                                         /* FIXME: response controls? */
1303                                         rs->sr_err = ldap_parse_result( msc->msc_ld,
1304                                                 msg,
1305                                                 &candidates[ i ].sr_err,
1306                                                 (char **)&candidates[ i ].sr_matched,
1307                                                 (char **)&candidates[ i ].sr_text,
1308                                                 &references,
1309                                                 NULL /* &candidates[ i ].sr_ctrls (unused) */ ,
1310                                                 0 );
1311                                         if ( rs->sr_err != LDAP_SUCCESS ) {
1312                                                 candidates[ i ].sr_err = rs->sr_err;
1313                                                 sres = slap_map_api2result( &candidates[ i ] );
1314                                                 candidates[ i ].sr_type = REP_RESULT;
1315                                                 ldap_msgfree( res );
1316                                                 res = NULL;
1317                                                 goto really_bad;
1318                                         }
1319
1320                                         rs->sr_err = candidates[ i ].sr_err;
1321
1322                                         /* massage matchedDN if need be */
1323                                         if ( candidates[ i ].sr_matched != NULL ) {
1324                                                 struct berval   match, mmatch;
1325
1326                                                 ber_str2bv( candidates[ i ].sr_matched,
1327                                                         0, 0, &match );
1328                                                 candidates[ i ].sr_matched = NULL;
1329
1330                                                 dc.ctx = "matchedDN";
1331                                                 dc.target = mi->mi_targets[ i ];
1332                                                 if ( !ldap_back_dn_massage( &dc, &match, &mmatch ) ) {
1333                                                         if ( mmatch.bv_val == match.bv_val ) {
1334                                                                 candidates[ i ].sr_matched
1335                                                                         = ch_strdup( mmatch.bv_val );
1336
1337                                                         } else {
1338                                                                 candidates[ i ].sr_matched = mmatch.bv_val;
1339                                                         }
1340
1341                                                         candidate_match++;
1342                                                 }
1343                                                 ldap_memfree( match.bv_val );
1344                                         }
1345
1346                                         /* add references to array */
1347                                         /* RFC 4511: referrals can only appear
1348                                          * if result code is LDAP_REFERRAL */
1349                                         if ( references != NULL
1350                                                 && references[ 0 ] != NULL
1351                                                 && references[ 0 ][ 0 ] != '\0' )
1352                                         {
1353                                                 if ( rs->sr_err != LDAP_REFERRAL ) {
1354                                                         Debug( LDAP_DEBUG_ANY,
1355                                                                 "%s meta_back_search[%ld]: "
1356                                                                 "got referrals with err=%d\n",
1357                                                                 op->o_log_prefix,
1358                                                                 i, rs->sr_err );
1359
1360                                                 } else {
1361                                                         BerVarray       sr_ref;
1362                                                         int             cnt;
1363
1364                                                         for ( cnt = 0; references[ cnt ]; cnt++ )
1365                                                                 ;
1366
1367                                                         sr_ref = ber_memalloc_x( sizeof( struct berval ) * ( cnt + 1 ),
1368                                                                 op->o_tmpmemctx );
1369
1370                                                         for ( cnt = 0; references[ cnt ]; cnt++ ) {
1371                                                                 ber_str2bv_x( references[ cnt ], 0, 1, &sr_ref[ cnt ],
1372                                                                         op->o_tmpmemctx );
1373                                                         }
1374                                                         BER_BVZERO( &sr_ref[ cnt ] );
1375
1376                                                         ( void )ldap_back_referral_result_rewrite( &dc, sr_ref,
1377                                                                 op->o_tmpmemctx );
1378
1379                                                         if ( rs->sr_v2ref == NULL ) {
1380                                                                 rs->sr_v2ref = sr_ref;
1381
1382                                                         } else {
1383                                                                 for ( cnt = 0; !BER_BVISNULL( &sr_ref[ cnt ] ); cnt++ ) {
1384                                                                         ber_bvarray_add_x( &rs->sr_v2ref, &sr_ref[ cnt ],
1385                                                                                 op->o_tmpmemctx );
1386                                                                 }
1387                                                                 ber_memfree_x( sr_ref, op->o_tmpmemctx );
1388                                                         }
1389                                                 }
1390
1391                                         } else if ( rs->sr_err == LDAP_REFERRAL ) {
1392                                                 Debug( LDAP_DEBUG_ANY,
1393                                                         "%s meta_back_search[%ld]: "
1394                                                         "got err=%d with null "
1395                                                         "or empty referrals\n",
1396                                                         op->o_log_prefix,
1397                                                         i, rs->sr_err );
1398
1399                                                 rs->sr_err = LDAP_NO_SUCH_OBJECT;
1400                                         }
1401
1402                                         /* cleanup */
1403                                         ber_memvfree( (void **)references );
1404
1405                                         sres = slap_map_api2result( rs );
1406
1407                                         if ( LogTest( LDAP_DEBUG_TRACE | LDAP_DEBUG_ANY ) ) {
1408                                                 snprintf( buf, sizeof( buf ),
1409                                                         "%s meta_back_search[%ld] "
1410                                                         "match=\"%s\" err=%ld",
1411                                                         op->o_log_prefix, i,
1412                                                         candidates[ i ].sr_matched ? candidates[ i ].sr_matched : "",
1413                                                         (long) candidates[ i ].sr_err );
1414                                                 if ( candidates[ i ].sr_err == LDAP_SUCCESS ) {
1415                                                         Debug( LDAP_DEBUG_TRACE, "%s.\n", buf, 0, 0 );
1416
1417                                                 } else {
1418                                                         Debug( LDAP_DEBUG_ANY, "%s (%s).\n",
1419                                                                 buf, ldap_err2string( candidates[ i ].sr_err ), 0 );
1420                                                 }
1421                                         }
1422
1423                                         switch ( sres ) {
1424                                         case LDAP_NO_SUCH_OBJECT:
1425                                                 /* is_ok is touched any time a valid
1426                                                  * (even intermediate) result is
1427                                                  * returned; as a consequence, if
1428                                                  * a candidate returns noSuchObject
1429                                                  * it is ignored and the candidate
1430                                                  * is simply demoted. */
1431                                                 if ( is_ok ) {
1432                                                         sres = LDAP_SUCCESS;
1433                                                 }
1434                                                 break;
1435
1436                                         case LDAP_SUCCESS:
1437                                         case LDAP_REFERRAL:
1438                                                 is_ok++;
1439                                                 break;
1440
1441                                         case LDAP_SIZELIMIT_EXCEEDED:
1442                                                 /* if a target returned sizelimitExceeded
1443                                                  * and the entry count is equal to the
1444                                                  * proxy's limit, the target would have
1445                                                  * returned more, and the error must be
1446                                                  * propagated to the client; otherwise,
1447                                                  * the target enforced a limit lower
1448                                                  * than what requested by the proxy;
1449                                                  * ignore it */
1450                                                 candidates[ i ].sr_err = rs->sr_err;
1451                                                 if ( rs->sr_nentries == op->ors_slimit
1452                                                         || META_BACK_ONERR_STOP( mi ) )
1453                                                 {
1454                                                         char *save_text = rs->sr_text;
1455                                                         savepriv = op->o_private;
1456                                                         op->o_private = (void *)i;
1457                                                         rs->sr_text = candidates[ i ].sr_text;
1458                                                         send_ldap_result( op, rs );
1459                                                         rs->sr_text = save_text;
1460                                                         op->o_private = savepriv;
1461                                                         ldap_msgfree( res );
1462                                                         res = NULL;
1463                                                         goto finish;
1464                                                 }
1465                                                 break;
1466
1467                                         default:
1468                                                 candidates[ i ].sr_err = rs->sr_err;
1469                                                 if ( META_BACK_ONERR_STOP( mi ) ) {
1470                                                         char *save_text = rs->sr_text;
1471                                                         savepriv = op->o_private;
1472                                                         op->o_private = (void *)i;
1473                                                         rs->sr_text = candidates[ i ].sr_text;
1474                                                         send_ldap_result( op, rs );
1475                                                         rs->sr_text = save_text;
1476                                                         op->o_private = savepriv;
1477                                                         ldap_msgfree( res );
1478                                                         res = NULL;
1479                                                         goto finish;
1480                                                 }
1481                                                 break;
1482                                         }
1483
1484                                         last = i;
1485                                         rc = 0;
1486
1487                                         /*
1488                                          * When no candidates are left,
1489                                          * the outer cycle finishes
1490                                          */
1491                                         assert( ncandidates > 0 );
1492                                         --ncandidates;
1493
1494                                 } else if ( rc == LDAP_RES_BIND ) {
1495                                         meta_search_candidate_t retcode;
1496
1497                                         retcode = meta_search_dobind_result( op, rs, &mc, i, candidates, msg );
1498                                         if ( retcode == META_SEARCH_CANDIDATE ) {
1499                                                 candidates[ i ].sr_msgid = META_MSGID_IGNORE;
1500                                                 retcode = meta_back_search_start( op, rs, &dc, &mc, i, candidates );
1501                                         }
1502
1503                                         switch ( retcode ) {
1504                                         case META_SEARCH_CANDIDATE:
1505                                                 break;
1506
1507                                                 /* means that failed but onerr == continue */
1508                                         case META_SEARCH_NOT_CANDIDATE:
1509                                         case META_SEARCH_ERR:
1510                                                 candidates[ i ].sr_msgid = META_MSGID_IGNORE;
1511                                                 assert( ncandidates > 0 );
1512                                                 --ncandidates;
1513
1514                                                 candidates[ i ].sr_err = rs->sr_err;
1515                                                 if ( META_BACK_ONERR_STOP( mi ) ) {
1516                                                         savepriv = op->o_private;
1517                                                         op->o_private = (void *)i;
1518                                                         send_ldap_result( op, rs );
1519                                                         op->o_private = savepriv;
1520                                                         ldap_msgfree( res );
1521                                                         res = NULL;
1522                                                         goto finish;
1523                                                 }
1524                                                 goto free_message;
1525
1526                                         default:
1527                                                 assert( 0 );
1528                                                 break;
1529                                         }
1530
1531                                 } else {
1532                                         Debug( LDAP_DEBUG_ANY,
1533                                                 "%s meta_back_search[%ld]: "
1534                                                 "unrecognized response message tag=%d\n",
1535                                                 op->o_log_prefix,
1536                                                 i, rc );
1537
1538                                         ldap_msgfree( res );
1539                                         res = NULL;
1540                                         goto really_bad;
1541                                 }
1542                         }
1543
1544 free_message:;
1545                         ldap_msgfree( res );
1546                         res = NULL;
1547                 }
1548
1549                 /* check for abandon */
1550                 if ( op->o_abandon || LDAP_BACK_CONN_ABANDON( mc ) ) {
1551                         for ( i = 0; i < mi->mi_ntargets; i++ ) {
1552                                 if ( candidates[ i ].sr_msgid >= 0
1553                                         || candidates[ i ].sr_msgid == META_MSGID_CONNECTING )
1554                                 {
1555                                         if ( META_IS_BINDING( &candidates[ i ] )
1556                                                 || candidates[ i ].sr_msgid == META_MSGID_CONNECTING )
1557                                         {
1558                                                 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
1559                                                 if ( LDAP_BACK_CONN_BINDING( &mc->mc_conns[ i ] )
1560                                                         || candidates[ i ].sr_msgid == META_MSGID_CONNECTING )
1561                                                 {
1562                                                         /* if still binding, destroy */
1563
1564 #ifdef DEBUG_205
1565                                                         char buf[ SLAP_TEXT_BUFLEN ];
1566
1567                                                         snprintf( buf, sizeof( buf), "%s meta_back_search(abandon) "
1568                                                                 "ldap_unbind_ext[%ld] mc=%p ld=%p",
1569                                                                 op->o_log_prefix, i, (void *)mc,
1570                                                                 (void *)mc->mc_conns[i].msc_ld );
1571
1572                                                         Debug( LDAP_DEBUG_ANY, "### %s\n", buf, 0, 0 );
1573 #endif /* DEBUG_205 */
1574
1575                                                         meta_clear_one_candidate( op, mc, i );
1576                                                 }
1577                                                 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
1578                                                 META_BINDING_CLEAR( &candidates[ i ] );
1579
1580                                         } else {
1581                                                 (void)meta_back_cancel( mc, op, rs,
1582                                                         candidates[ i ].sr_msgid, i,
1583                                                         LDAP_BACK_DONTSEND );
1584                                         }
1585
1586                                         candidates[ i ].sr_msgid = META_MSGID_IGNORE;
1587                                         assert( ncandidates > 0 );
1588                                         --ncandidates;
1589                                 }
1590                         }
1591
1592                         if ( op->o_abandon ) {
1593                                 rc = SLAPD_ABANDON;
1594                         }
1595
1596                         /* let send_ldap_result play cleanup handlers (ITS#4645) */
1597                         break;
1598                 }
1599
1600                 /* if no entry was found during this loop,
1601                  * set a minimal timeout */
1602                 if ( ncandidates > 0 && gotit == 0 ) {
1603                         if ( save_tv.tv_sec == 0 && save_tv.tv_usec == 0 ) {
1604                                 save_tv.tv_usec = LDAP_BACK_RESULT_UTIMEOUT/initial_candidates;
1605
1606                                 /* arbitrarily limit to something between 1 and 2 minutes */
1607                         } else if ( ( stoptime == -1 && save_tv.tv_sec < 60 )
1608                                 || save_tv.tv_sec < ( stoptime - slap_get_time() ) / ( 2 * ncandidates ) )
1609                         {
1610                                 /* double the timeout */
1611                                 lutil_timermul( &save_tv, 2, &save_tv );
1612                         }
1613
1614                         if ( alreadybound == 0 ) {
1615                                 tv = save_tv;
1616                                 (void)select( 0, NULL, NULL, NULL, &tv );
1617
1618                         } else {
1619                                 ldap_pvt_thread_yield();
1620                         }
1621                 }
1622         }
1623
1624         if ( rc == -1 ) {
1625                 /*
1626                  * FIXME: need a better strategy to handle errors
1627                  */
1628                 if ( mc ) {
1629                         rc = meta_back_op_result( mc, op, rs, META_TARGET_NONE,
1630                                 -1, stoptime != -1 ? (stoptime - slap_get_time()) : 0,
1631                                 LDAP_BACK_SENDERR );
1632                 } else {
1633                         rc = rs->sr_err;
1634                 }
1635                 goto finish;
1636         }
1637
1638         /*
1639          * Rewrite the matched portion of the search base, if required
1640          *
1641          * FIXME: only the last one gets caught!
1642          */
1643         savepriv = op->o_private;
1644         op->o_private = (void *)(long)mi->mi_ntargets;
1645         if ( candidate_match > 0 ) {
1646                 struct berval   pmatched = BER_BVNULL;
1647
1648                 /* we use the first one */
1649                 for ( i = 0; i < mi->mi_ntargets; i++ ) {
1650                         if ( META_IS_CANDIDATE( &candidates[ i ] )
1651                                         && candidates[ i ].sr_matched != NULL )
1652                         {
1653                                 struct berval   bv, pbv;
1654                                 int             rc;
1655
1656                                 /* if we got success, and this target
1657                                  * returned noSuchObject, and its suffix
1658                                  * is a superior of the searchBase,
1659                                  * ignore the matchedDN */
1660                                 if ( sres == LDAP_SUCCESS
1661                                         && candidates[ i ].sr_err == LDAP_NO_SUCH_OBJECT
1662                                         && op->o_req_ndn.bv_len > mi->mi_targets[ i ]->mt_nsuffix.bv_len )
1663                                 {
1664                                         free( (char *)candidates[ i ].sr_matched );
1665                                         candidates[ i ].sr_matched = NULL;
1666                                         continue;
1667                                 }
1668
1669                                 ber_str2bv( candidates[ i ].sr_matched, 0, 0, &bv );
1670                                 rc = dnPretty( NULL, &bv, &pbv, op->o_tmpmemctx );
1671
1672                                 if ( rc == LDAP_SUCCESS ) {
1673
1674                                         /* NOTE: if they all are superiors
1675                                          * of the baseDN, the shorter is also
1676                                          * superior of the longer... */
1677                                         if ( pbv.bv_len > pmatched.bv_len ) {
1678                                                 if ( !BER_BVISNULL( &pmatched ) ) {
1679                                                         op->o_tmpfree( pmatched.bv_val, op->o_tmpmemctx );
1680                                                 }
1681                                                 pmatched = pbv;
1682                                                 op->o_private = (void *)i;
1683
1684                                         } else {
1685                                                 op->o_tmpfree( pbv.bv_val, op->o_tmpmemctx );
1686                                         }
1687                                 }
1688
1689                                 if ( candidates[ i ].sr_matched != NULL ) {
1690                                         free( (char *)candidates[ i ].sr_matched );
1691                                         candidates[ i ].sr_matched = NULL;
1692                                 }
1693                         }
1694                 }
1695
1696                 if ( !BER_BVISNULL( &pmatched ) ) {
1697                         matched = pmatched.bv_val;
1698                 }
1699
1700         } else if ( sres == LDAP_NO_SUCH_OBJECT ) {
1701                 matched = op->o_bd->be_suffix[ 0 ].bv_val;
1702         }
1703
1704         /*
1705          * In case we returned at least one entry, we return LDAP_SUCCESS
1706          * otherwise, the latter error code we got
1707          */
1708
1709         if ( sres == LDAP_SUCCESS ) {
1710                 if ( rs->sr_v2ref ) {
1711                         sres = LDAP_REFERRAL;
1712                 }
1713
1714                 if ( META_BACK_ONERR_REPORT( mi ) ) {
1715                         /*
1716                          * Report errors, if any
1717                          *
1718                          * FIXME: we should handle error codes and return the more
1719                          * important/reasonable
1720                          */
1721                         for ( i = 0; i < mi->mi_ntargets; i++ ) {
1722                                 if ( !META_IS_CANDIDATE( &candidates[ i ] ) ) {
1723                                         continue;
1724                                 }
1725
1726                                 if ( candidates[ i ].sr_err != LDAP_SUCCESS
1727                                         && candidates[ i ].sr_err != LDAP_NO_SUCH_OBJECT )
1728                                 {
1729                                         sres = candidates[ i ].sr_err;
1730                                         break;
1731                                 }
1732                         }
1733                 }
1734         }
1735
1736         rs->sr_err = sres;
1737         rs->sr_matched = matched;
1738         rs->sr_ref = ( sres == LDAP_REFERRAL ? rs->sr_v2ref : NULL );
1739         send_ldap_result( op, rs );
1740         op->o_private = savepriv;
1741         rs->sr_matched = NULL;
1742         rs->sr_ref = NULL;
1743
1744 finish:;
1745         if ( matched && matched != op->o_bd->be_suffix[ 0 ].bv_val ) {
1746                 op->o_tmpfree( matched, op->o_tmpmemctx );
1747         }
1748
1749         if ( rs->sr_v2ref ) {
1750                 ber_bvarray_free_x( rs->sr_v2ref, op->o_tmpmemctx );
1751         }
1752
1753         for ( i = 0; i < mi->mi_ntargets; i++ ) {
1754                 if ( !META_IS_CANDIDATE( &candidates[ i ] ) ) {
1755                         continue;
1756                 }
1757
1758                 if ( mc ) {
1759                         if ( META_IS_BINDING( &candidates[ i ] )
1760                                 || candidates[ i ].sr_msgid == META_MSGID_CONNECTING )
1761                         {
1762                                 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
1763                                 if ( LDAP_BACK_CONN_BINDING( &mc->mc_conns[ i ] )
1764                                         || candidates[ i ].sr_msgid == META_MSGID_CONNECTING )
1765                                 {
1766                                         assert( candidates[ i ].sr_msgid >= 0
1767                                                 || candidates[ i ].sr_msgid == META_MSGID_CONNECTING );
1768                                         assert( mc->mc_conns[ i ].msc_ld != NULL );
1769
1770 #ifdef DEBUG_205
1771                                         Debug( LDAP_DEBUG_ANY, "### %s meta_back_search(cleanup) "
1772                                                 "ldap_unbind_ext[%ld] ld=%p\n",
1773                                                 op->o_log_prefix, i, (void *)mc->mc_conns[i].msc_ld );
1774 #endif /* DEBUG_205 */
1775
1776                                         /* if still binding, destroy */
1777                                         meta_clear_one_candidate( op, mc, i );
1778                                 }
1779                                 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
1780                                 META_BINDING_CLEAR( &candidates[ i ] );
1781
1782                         } else if ( candidates[ i ].sr_msgid >= 0 ) {
1783                                 (void)meta_back_cancel( mc, op, rs,
1784                                         candidates[ i ].sr_msgid, i,
1785                                         LDAP_BACK_DONTSEND );
1786                         }
1787                 }
1788
1789                 if ( candidates[ i ].sr_matched ) {
1790                         free( (char *)candidates[ i ].sr_matched );
1791                         candidates[ i ].sr_matched = NULL;
1792                 }
1793
1794                 if ( candidates[ i ].sr_text ) {
1795                         ldap_memfree( (char *)candidates[ i ].sr_text );
1796                         candidates[ i ].sr_text = NULL;
1797                 }
1798
1799                 if ( candidates[ i ].sr_ref ) {
1800                         ber_bvarray_free( candidates[ i ].sr_ref );
1801                         candidates[ i ].sr_ref = NULL;
1802                 }
1803
1804                 if ( candidates[ i ].sr_ctrls ) {
1805                         ldap_controls_free( candidates[ i ].sr_ctrls );
1806                         candidates[ i ].sr_ctrls = NULL;
1807                 }
1808
1809                 if ( META_BACK_TGT_QUARANTINE( mi->mi_targets[ i ] ) ) {
1810                         meta_back_quarantine( op, &candidates[ i ], i );
1811                 }
1812
1813                 /* only in case of timelimit exceeded, if the timelimit exceeded because
1814                  * one contacted target never responded, invalidate the connection
1815                  * NOTE: should we quarantine the target as well?  right now, the connection
1816                  * is invalidated; the next time it will be recreated and the target
1817                  * will be quarantined if it cannot be contacted */
1818                 if ( mi->mi_idle_timeout != 0
1819                         && rs->sr_err == LDAP_TIMELIMIT_EXCEEDED
1820                         && op->o_time > mc->mc_conns[ i ].msc_time )
1821                 {
1822                         /* don't let anyone else use this expired connection */
1823                         do_taint++;
1824                 }
1825         }
1826
1827         if ( mc ) {
1828                 ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
1829                 if ( do_taint ) {
1830                         LDAP_BACK_CONN_TAINTED_SET( mc );
1831                 }
1832                 meta_back_release_conn_lock( mi, mc, 0 );
1833                 ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
1834         }
1835
1836         return rs->sr_err;
1837 }
1838
1839 static int
1840 meta_send_entry(
1841         Operation       *op,
1842         SlapReply       *rs,
1843         metaconn_t      *mc,
1844         int             target,
1845         LDAPMessage     *e )
1846 {
1847         metainfo_t              *mi = ( metainfo_t * )op->o_bd->be_private;
1848         struct berval           a, mapped;
1849         int                     check_duplicate_attrs = 0;
1850         int                     check_sorted_attrs = 0;
1851         Entry                   ent = { 0 };
1852         BerElement              ber = *e->lm_ber;
1853         Attribute               *attr, **attrp;
1854         struct berval           bdn,
1855                                 dn = BER_BVNULL;
1856         const char              *text;
1857         dncookie                dc;
1858         ber_len_t               len;
1859         int                     rc;
1860
1861         if ( ber_scanf( &ber, "l{", &len ) == LBER_ERROR ) {
1862                 return LDAP_DECODING_ERROR;
1863         }
1864
1865         if ( ber_set_option( &ber, LBER_OPT_REMAINING_BYTES, &len ) != LBER_OPT_SUCCESS ) {
1866                 return LDAP_OTHER;
1867         }
1868
1869         if ( ber_scanf( &ber, "m{", &bdn ) == LBER_ERROR ) {
1870                 return LDAP_DECODING_ERROR;
1871         }
1872
1873         /*
1874          * Rewrite the dn of the result, if needed
1875          */
1876         dc.target = mi->mi_targets[ target ];
1877         dc.conn = op->o_conn;
1878         dc.rs = rs;
1879         dc.ctx = "searchResult";
1880
1881         rs->sr_err = ldap_back_dn_massage( &dc, &bdn, &dn );
1882         if ( rs->sr_err != LDAP_SUCCESS) {
1883                 return rs->sr_err;
1884         }
1885
1886         /*
1887          * Note: this may fail if the target host(s) schema differs
1888          * from the one known to the meta, and a DN with unknown
1889          * attributes is returned.
1890          *
1891          * FIXME: should we log anything, or delegate to dnNormalize?
1892          */
1893         rc = dnPrettyNormal( NULL, &dn, &ent.e_name, &ent.e_nname,
1894                 op->o_tmpmemctx );
1895         if ( dn.bv_val != bdn.bv_val ) {
1896                 free( dn.bv_val );
1897         }
1898         BER_BVZERO( &dn );
1899
1900         if ( rc != LDAP_SUCCESS ) {
1901                 Debug( LDAP_DEBUG_ANY,
1902                         "%s meta_send_entry(\"%s\"): "
1903                         "invalid DN syntax\n",
1904                         op->o_log_prefix, ent.e_name.bv_val, 0 );
1905                 rc = LDAP_INVALID_DN_SYNTAX;
1906                 goto done;
1907         }
1908
1909         /*
1910          * cache dn
1911          */
1912         if ( mi->mi_cache.ttl != META_DNCACHE_DISABLED ) {
1913                 ( void )meta_dncache_update_entry( &mi->mi_cache,
1914                                 &ent.e_nname, target );
1915         }
1916
1917         attrp = &ent.e_attrs;
1918
1919         dc.ctx = "searchAttrDN";
1920         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
1921                 int                             last = 0;
1922                 slap_syntax_validate_func       *validate;
1923                 slap_syntax_transform_func      *pretty;
1924
1925                 if ( ber_pvt_ber_remaining( &ber ) < 0 ) {
1926                         Debug( LDAP_DEBUG_ANY,
1927                                 "%s meta_send_entry(\"%s\"): "
1928                                 "unable to parse attr \"%s\".\n",
1929                                 op->o_log_prefix, ent.e_name.bv_val, a.bv_val );
1930
1931                         rc = LDAP_OTHER;
1932                         goto done;
1933                 }
1934
1935                 if ( ber_pvt_ber_remaining( &ber ) == 0 ) {
1936                         break;
1937                 }
1938
1939                 ldap_back_map( &mi->mi_targets[ target ]->mt_rwmap.rwm_at,
1940                                 &a, &mapped, BACKLDAP_REMAP );
1941                 if ( BER_BVISNULL( &mapped ) || mapped.bv_val[0] == '\0' ) {
1942                         ( void )ber_scanf( &ber, "x" /* [W] */ );
1943                         continue;
1944                 }
1945                 if ( mapped.bv_val != a.bv_val ) {
1946                         /* will need to check for duplicate attrs */
1947                         check_duplicate_attrs++;
1948                 }
1949                 attr = attr_alloc( NULL );
1950                 if ( attr == NULL ) {
1951                         rc = LDAP_OTHER;
1952                         goto done;
1953                 }
1954                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
1955                                 != LDAP_SUCCESS) {
1956                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text,
1957                                 SLAP_AD_PROXIED ) != LDAP_SUCCESS )
1958                         {
1959                                 char    buf[ SLAP_TEXT_BUFLEN ];
1960
1961                                 snprintf( buf, sizeof( buf ),
1962                                         "%s meta_send_entry(\"%s\"): "
1963                                         "slap_bv2undef_ad(%s): %s\n",
1964                                         op->o_log_prefix, ent.e_name.bv_val,
1965                                         mapped.bv_val, text );
1966
1967                                 Debug( LDAP_DEBUG_ANY, "%s", buf, 0, 0 );
1968                                 ( void )ber_scanf( &ber, "x" /* [W] */ );
1969                                 attr_free( attr );
1970                                 continue;
1971                         }
1972                 }
1973
1974                 if ( attr->a_desc->ad_type->sat_flags & SLAP_AT_SORTED_VAL )
1975                         check_sorted_attrs = 1;
1976
1977                 /* no subschemaSubentry */
1978                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry
1979                         || attr->a_desc == slap_schema.si_ad_entryDN )
1980                 {
1981
1982                         /*
1983                          * We eat target's subschemaSubentry because
1984                          * a search for this value is likely not
1985                          * to resolve to the appropriate backend;
1986                          * later, the local subschemaSubentry is
1987                          * added.
1988                          *
1989                          * We also eat entryDN because the frontend
1990                          * will reattach it without checking if already
1991                          * present...
1992                          */
1993                         ( void )ber_scanf( &ber, "x" /* [W] */ );
1994                         attr_free(attr);
1995                         continue;
1996                 }
1997
1998                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
1999                                 || attr->a_vals == NULL )
2000                 {
2001                         attr->a_vals = (struct berval *)&slap_dummy_bv;
2002
2003                 } else {
2004                         for ( last = 0; !BER_BVISNULL( &attr->a_vals[ last ] ); ++last )
2005                                 ;
2006                 }
2007                 attr->a_numvals = last;
2008
2009                 validate = attr->a_desc->ad_type->sat_syntax->ssyn_validate;
2010                 pretty = attr->a_desc->ad_type->sat_syntax->ssyn_pretty;
2011
2012                 if ( !validate && !pretty ) {
2013                         attr_free( attr );
2014                         goto next_attr;
2015                 }
2016
2017                 if ( attr->a_desc == slap_schema.si_ad_objectClass
2018                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass )
2019                 {
2020                         struct berval   *bv;
2021
2022                         for ( bv = attr->a_vals; !BER_BVISNULL( bv ); bv++ ) {
2023                                 ObjectClass *oc;
2024
2025                                 ldap_back_map( &mi->mi_targets[ target ]->mt_rwmap.rwm_oc,
2026                                                 bv, &mapped, BACKLDAP_REMAP );
2027                                 if ( BER_BVISNULL( &mapped ) || mapped.bv_val[0] == '\0') {
2028 remove_oc:;
2029                                         free( bv->bv_val );
2030                                         BER_BVZERO( bv );
2031                                         if ( --last < 0 ) {
2032                                                 break;
2033                                         }
2034                                         *bv = attr->a_vals[ last ];
2035                                         BER_BVZERO( &attr->a_vals[ last ] );
2036                                         bv--;
2037
2038                                 } else if ( mapped.bv_val != bv->bv_val ) {
2039                                         int     i;
2040
2041                                         for ( i = 0; !BER_BVISNULL( &attr->a_vals[ i ] ); i++ ) {
2042                                                 if ( &attr->a_vals[ i ] == bv ) {
2043                                                         continue;
2044                                                 }
2045
2046                                                 if ( ber_bvstrcasecmp( &mapped, &attr->a_vals[ i ] ) == 0 ) {
2047                                                         break;
2048                                                 }
2049                                         }
2050
2051                                         if ( !BER_BVISNULL( &attr->a_vals[ i ] ) ) {
2052                                                 goto remove_oc;
2053                                         }
2054
2055                                         ber_bvreplace( bv, &mapped );
2056
2057                                 } else if ( ( oc = oc_bvfind_undef( bv ) ) == NULL ) {
2058                                         goto remove_oc;
2059
2060                                 } else {
2061                                         ber_bvreplace( bv, &oc->soc_cname );
2062                                 }
2063                         }
2064                 /*
2065                  * It is necessary to try to rewrite attributes with
2066                  * dn syntax because they might be used in ACLs as
2067                  * members of groups; since ACLs are applied to the
2068                  * rewritten stuff, no dn-based subecj clause could
2069                  * be used at the ldap backend side (see
2070                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
2071                  * The problem can be overcome by moving the dn-based
2072                  * ACLs to the target directory server, and letting
2073                  * everything pass thru the ldap backend.
2074                  */
2075                 } else {
2076                         int     i;
2077
2078                         if ( attr->a_desc->ad_type->sat_syntax ==
2079                                 slap_schema.si_syn_distinguishedName )
2080                         {
2081                                 ldap_dnattr_result_rewrite( &dc, attr->a_vals );
2082
2083                         } else if ( attr->a_desc == slap_schema.si_ad_ref ) {
2084                                 ldap_back_referral_result_rewrite( &dc, attr->a_vals, NULL );
2085
2086                         }
2087
2088                         for ( i = 0; i < last; i++ ) {
2089                                 struct berval   pval;
2090                                 int             rc;
2091
2092                                 if ( pretty ) {
2093                                         rc = ordered_value_pretty( attr->a_desc,
2094                                                 &attr->a_vals[i], &pval, NULL );
2095
2096                                 } else {
2097                                         rc = ordered_value_validate( attr->a_desc,
2098                                                 &attr->a_vals[i], 0 );
2099                                 }
2100
2101                                 if ( rc ) {
2102                                         LBER_FREE( attr->a_vals[i].bv_val );
2103                                         if ( --last == i ) {
2104                                                 BER_BVZERO( &attr->a_vals[ i ] );
2105                                                 break;
2106                                         }
2107                                         attr->a_vals[i] = attr->a_vals[last];
2108                                         BER_BVZERO( &attr->a_vals[last] );
2109                                         i--;
2110                                         continue;
2111                                 }
2112
2113                                 if ( pretty ) {
2114                                         LBER_FREE( attr->a_vals[i].bv_val );
2115                                         attr->a_vals[i] = pval;
2116                                 }
2117                         }
2118
2119                         if ( last == 0 && attr->a_vals != &slap_dummy_bv ) {
2120                                 attr_free( attr );
2121                                 goto next_attr;
2122                         }
2123                 }
2124
2125                 if ( last && attr->a_desc->ad_type->sat_equality &&
2126                         attr->a_desc->ad_type->sat_equality->smr_normalize )
2127                 {
2128                         int i;
2129
2130                         attr->a_nvals = ch_malloc( ( last + 1 ) * sizeof( struct berval ) );
2131                         for ( i = 0; i<last; i++ ) {
2132                                 /* if normalizer fails, drop this value */
2133                                 if ( ordered_value_normalize(
2134                                         SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
2135                                         attr->a_desc,
2136                                         attr->a_desc->ad_type->sat_equality,
2137                                         &attr->a_vals[i], &attr->a_nvals[i],
2138                                         NULL )) {
2139                                         LBER_FREE( attr->a_vals[i].bv_val );
2140                                         if ( --last == i ) {
2141                                                 BER_BVZERO( &attr->a_vals[ i ] );
2142                                                 break;
2143                                         }
2144                                         attr->a_vals[i] = attr->a_vals[last];
2145                                         BER_BVZERO( &attr->a_vals[last] );
2146                                         i--;
2147                                 }
2148                         }
2149                         BER_BVZERO( &attr->a_nvals[i] );
2150                         if ( last == 0 ) {
2151                                 attr_free( attr );
2152                                 goto next_attr;
2153                         }
2154
2155                 } else {
2156                         attr->a_nvals = attr->a_vals;
2157                 }
2158
2159                 attr->a_numvals = last;
2160                 *attrp = attr;
2161                 attrp = &attr->a_next;
2162 next_attr:;
2163         }
2164
2165         /* only check if some mapping occurred */
2166         if ( check_duplicate_attrs ) {
2167                 Attribute       **ap;
2168
2169                 for ( ap = &ent.e_attrs; *ap != NULL; ap = &(*ap)->a_next ) {
2170                         Attribute       **tap;
2171
2172                         for ( tap = &(*ap)->a_next; *tap != NULL; ) {
2173                                 if ( (*tap)->a_desc == (*ap)->a_desc ) {
2174                                         Entry           e = { 0 };
2175                                         Modification    mod = { 0 };
2176                                         const char      *text = NULL;
2177                                         char            textbuf[ SLAP_TEXT_BUFLEN ];
2178                                         Attribute       *next = (*tap)->a_next;
2179
2180                                         BER_BVSTR( &e.e_name, "" );
2181                                         BER_BVSTR( &e.e_nname, "" );
2182                                         e.e_attrs = *ap;
2183                                         mod.sm_op = LDAP_MOD_ADD;
2184                                         mod.sm_desc = (*ap)->a_desc;
2185                                         mod.sm_type = mod.sm_desc->ad_cname;
2186                                         mod.sm_numvals = (*ap)->a_numvals;
2187                                         mod.sm_values = (*tap)->a_vals;
2188                                         if ( (*tap)->a_nvals != (*tap)->a_vals ) {
2189                                                 mod.sm_nvalues = (*tap)->a_nvals;
2190                                         }
2191
2192                                         (void)modify_add_values( &e, &mod,
2193                                                 /* permissive */ 1,
2194                                                 &text, textbuf, sizeof( textbuf ) );
2195
2196                                         /* should not insert new attrs! */
2197                                         assert( e.e_attrs == *ap );
2198
2199                                         attr_free( *tap );
2200                                         *tap = next;
2201
2202                                 } else {
2203                                         tap = &(*tap)->a_next;
2204                                 }
2205                         }
2206                 }
2207         }
2208
2209         /* Check for sorted attributes */
2210         if ( check_sorted_attrs ) {
2211                 for ( attr = ent.e_attrs; attr; attr = attr->a_next ) {
2212                         if ( attr->a_desc->ad_type->sat_flags & SLAP_AT_SORTED_VAL ) {
2213                                 while ( attr->a_numvals > 1 ) {
2214                                         int i;
2215                                         int rc = slap_sort_vals( (Modifications *)attr, &text, &i, op->o_tmpmemctx );
2216                                         if ( rc != LDAP_TYPE_OR_VALUE_EXISTS )
2217                                                 break;
2218
2219                                         /* Strip duplicate values */
2220                                         if ( attr->a_nvals != attr->a_vals )
2221                                                 LBER_FREE( attr->a_nvals[i].bv_val );
2222                                         LBER_FREE( attr->a_vals[i].bv_val );
2223                                         attr->a_numvals--;
2224                                         if ( (unsigned)i < attr->a_numvals ) {
2225                                                 attr->a_vals[i] = attr->a_vals[attr->a_numvals];
2226                                                 if ( attr->a_nvals != attr->a_vals )
2227                                                         attr->a_nvals[i] = attr->a_nvals[attr->a_numvals];
2228                                         }
2229                                         BER_BVZERO(&attr->a_vals[attr->a_numvals]);
2230                                         if ( attr->a_nvals != attr->a_vals )
2231                                                 BER_BVZERO(&attr->a_nvals[attr->a_numvals]);
2232                                 }
2233                                 attr->a_flags |= SLAP_ATTR_SORTED_VALS;
2234                         }
2235                 }
2236         }
2237
2238         ldap_get_entry_controls( mc->mc_conns[target].msc_ld,
2239                 e, &rs->sr_ctrls );
2240         rs->sr_entry = &ent;
2241         rs->sr_attrs = op->ors_attrs;
2242         rs->sr_operational_attrs = NULL;
2243         rs->sr_flags = mi->mi_targets[ target ]->mt_rep_flags;
2244         rs->sr_err = LDAP_SUCCESS;
2245         rc = send_search_entry( op, rs );
2246         switch ( rc ) {
2247         case LDAP_UNAVAILABLE:
2248                 rc = LDAP_OTHER;
2249                 break;
2250         }
2251
2252 done:;
2253         rs->sr_entry = NULL;
2254         rs->sr_attrs = NULL;
2255         if ( rs->sr_ctrls != NULL ) {
2256                 ldap_controls_free( rs->sr_ctrls );
2257                 rs->sr_ctrls = NULL;
2258         }
2259         if ( !BER_BVISNULL( &ent.e_name ) ) {
2260                 free( ent.e_name.bv_val );
2261                 BER_BVZERO( &ent.e_name );
2262         }
2263         if ( !BER_BVISNULL( &ent.e_nname ) ) {
2264                 free( ent.e_nname.bv_val );
2265                 BER_BVZERO( &ent.e_nname );
2266         }
2267         entry_clean( &ent );
2268
2269         return rc;
2270 }
2271