git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2004 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/socket.h>
  28 #include <ac/string.h>
  29 #include <ac/time.h>
  30
  31 #include "slap.h"
  32 #include "../back-ldap/back-ldap.h"
  33 #include "back-meta.h"
  34 #undef ldap_debug       /* silence a warning in ldap-int.h */
  35 #include "ldap_log.h"
  36 #include "../../../libraries/libldap/ldap-int.h"
  37
  38 static int
  39 meta_send_entry(
  40                 Operation       *op,
  41                 SlapReply       *rs,
  42                 struct metaconn *lc,
  43                 int             i,
  44                 LDAPMessage     *e
  45 );
  46
  47 int
  48 meta_back_search( Operation *op, SlapReply *rs )
  49 {
  50         struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
  51         struct metaconn *lc;
  52         struct metasingleconn *lsc;
  53         struct timeval  tv = { 0, 0 };
  54         LDAPMessage     *res = NULL, *e;
  55         int     rc = 0, *msgid, sres = LDAP_SUCCESS;
  56         char *err = NULL;
  57         struct berval match = BER_BVNULL, mmatch = BER_BVNULL;
  58         BerVarray v2refs = NULL;
  59
  60         int i, last = 0, candidates = 0, initial_candidates = 0,
  61                         candidate_match = 0;
  62         dncookie dc;
  63
  64         int     is_scope = 0,
  65                 is_filter = 0;
  66
  67         /*
  68          * controls are set in ldap_back_dobind()
  69          *
  70          * FIXME: in case of values return filter, we might want
  71          * to map attrs and maybe rewrite value
  72          */
  73         lc = meta_back_getconn( op, rs, META_OP_ALLOW_MULTIPLE,
  74                         &op->o_req_ndn, NULL );
  75         if ( !lc ) {
  76                 send_ldap_result( op, rs );
  77                 return -1;
  78         }
  79
  80         if ( !meta_back_dobind( lc, op ) ) {
  81                 rs->sr_err = LDAP_OTHER;
  82                 send_ldap_result( op, rs );
  83                 return -1;
  84         }
  85
  86         /*
  87          * Array of message id of each target
  88          */
  89         msgid = ch_calloc( sizeof( int ), li->ntargets );
  90         if ( msgid == NULL ) {
  91                 rs->sr_err = LDAP_OTHER;
  92                 send_ldap_result( op, rs );
  93                 return -1;
  94         }
  95
  96         dc.conn = op->o_conn;
  97         dc.rs = rs;
  98
  99         /*
 100          * Inits searches
 101          */
 102         for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
 103                 struct berval   realbase = op->o_req_dn;
 104                 int             realscope = op->ors_scope;
 105                 ber_len_t       suffixlen = 0;
 106                 struct berval   mbase = BER_BVNULL;
 107                 struct berval   mfilter = BER_BVNULL;
 108                 char            **mapped_attrs = NULL;
 109
 110                 if ( lsc->candidate != META_CANDIDATE ) {
 111                         msgid[ i ] = -1;
 112                         continue;
 113                 }
 114
 115                 /* should we check return values? */
 116                 if ( op->ors_deref != -1 ) {
 117                         ldap_set_option( lsc->ld, LDAP_OPT_DEREF,
 118                                         ( void * )&op->ors_deref);
 119                 }
 120                 if ( op->ors_tlimit != SLAP_NO_LIMIT ) {
 121                         ldap_set_option( lsc->ld, LDAP_OPT_TIMELIMIT,
 122                                         ( void * )&op->ors_tlimit);
 123                 }
 124                 if ( op->ors_slimit != SLAP_NO_LIMIT ) {
 125                         ldap_set_option( lsc->ld, LDAP_OPT_SIZELIMIT,
 126                                         ( void * )&op->ors_slimit);
 127                 }
 128
 129                 dc.rwmap = &li->targets[ i ]->rwmap;
 130
 131                 /*
 132                  * modifies the base according to the scope, if required
 133                  */
 134                 suffixlen = li->targets[ i ]->suffix.bv_len;
 135                 if ( suffixlen > op->o_req_ndn.bv_len ) {
 136                         switch ( op->ors_scope ) {
 137                         case LDAP_SCOPE_SUBTREE:
 138                                 /*
 139                                  * make the target suffix the new base
 140                                  * FIXME: this is very forgiving, because
 141                                  * illegal bases may be turned into
 142                                  * the suffix of the target.
 143                                  */
 144                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 145                                                 &op->o_req_ndn ) ) {
 146                                         realbase = li->targets[ i ]->suffix;
 147                                         is_scope++;
 148
 149                                 } else {
 150                                         /*
 151                                          * this target is no longer candidate
 152                                          */
 153                                         msgid[ i ] = -1;
 154                                         goto new_candidate;
 155                                 }
 156                                 break;
 157
 158                         case LDAP_SCOPE_ONELEVEL:
 159                         {
 160                                 struct berval   rdn = li->targets[ i ]->suffix;
 161                                 rdn.bv_len -= op->o_req_ndn.bv_len + STRLENOF( "," );
 162                                 if ( dnIsOneLevelRDN( &rdn )
 163                                                 && dnIsSuffix( &li->targets[ i ]->suffix, &op->o_req_ndn ) )
 164                                 {
 165                                         /*
 166                                          * if there is exactly one level,
 167                                          * make the target suffix the new
 168                                          * base, and make scope "base"
 169                                          */
 170                                         realbase = li->targets[ i ]->suffix;
 171                                         realscope = LDAP_SCOPE_BASE;
 172                                         is_scope++;
 173                                         break;
 174                                 } /* else continue with the next case */
 175                         }
 176
 177                         case LDAP_SCOPE_BASE:
 178                                 /*
 179                                  * this target is no longer candidate
 180                                  */
 181                                 msgid[ i ] = -1;
 182                                 goto new_candidate;
 183                         }
 184
 185                 } else {
 186                         is_scope++;
 187                 }
 188
 189                 /*
 190                  * Rewrite the search base, if required
 191                  */
 192                 dc.ctx = "searchBase";
 193                 switch ( ldap_back_dn_massage( &dc, &realbase, &mbase ) ) {
 194                 default:
 195                         break;
 196
 197                 case REWRITE_REGEXEC_UNWILLING:
 198                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 199                         rs->sr_text = "Operation not allowed";
 200                         send_ldap_result( op, rs );
 201                         rc = -1;
 202                         goto finish;
 203
 204                 case REWRITE_REGEXEC_ERR:
 205 #if 0
 206                         rs->sr_err = LDAP_OTHER;
 207                         rs->sr_text = "Rewrite error";
 208                         send_ldap_result( op, rs );
 209                         rc = -1;
 210                         goto finish;
 211 #endif
 212
 213                         /*
 214                          * this target is no longer candidate
 215                          */
 216                         msgid[ i ] = -1;
 217                         goto new_candidate;
 218                 }
 219
 220                 /*
 221                  * Maps filter
 222                  */
 223                 rc = ldap_back_filter_map_rewrite( &dc,
 224                                 op->ors_filter,
 225                                 &mfilter, BACKLDAP_MAP );
 226                 switch ( rc ) {
 227                 case LDAP_SUCCESS:
 228                         is_filter++;
 229                         break;
 230
 231                 case LDAP_COMPARE_FALSE:
 232                         rc = 0;
 233
 234                 default:
 235                         /*
 236                          * this target is no longer candidate
 237                          */
 238                         msgid[ i ] = -1;
 239                         goto new_candidate;
 240                 }
 241
 242                 /*
 243                  * Maps required attributes
 244                  */
 245                 rc = ldap_back_map_attrs( &li->targets[ i ]->rwmap.rwm_at,
 246                                 op->ors_attrs, BACKLDAP_MAP,
 247                                 &mapped_attrs );
 248                 if ( rc != LDAP_SUCCESS ) {
 249                         /*
 250                          * this target is no longer candidate
 251                          */
 252                         msgid[ i ] = -1;
 253                         goto new_candidate;
 254                 }
 255
 256                 /*
 257                  * Starts the search
 258                  */
 259                 msgid[ i ] = ldap_search( lsc->ld, mbase.bv_val, realscope,
 260                                 mfilter.bv_val, mapped_attrs,
 261                                 op->ors_attrsonly );
 262                 if ( mapped_attrs ) {
 263                         free( mapped_attrs );
 264                         mapped_attrs = NULL;
 265                 }
 266                 if ( mfilter.bv_val != op->ors_filterstr.bv_val ) {
 267                         free( mfilter.bv_val );
 268                         mfilter.bv_val = NULL;
 269                 }
 270                 if ( mbase.bv_val != realbase.bv_val ) {
 271                         free( mbase.bv_val );
 272                         mbase.bv_val = NULL;
 273                 }
 274
 275                 if ( msgid[ i ] == -1 ) {
 276                         continue;
 277                 }
 278
 279                 ++candidates;
 280
 281 new_candidate:;
 282         }
 283
 284         initial_candidates = candidates;
 285
 286         /* We pull apart the ber result, stuff it into a slapd entry, and
 287          * let send_search_entry stuff it back into ber format. Slow & ugly,
 288          * but this is necessary for version matching, and for ACL processing.
 289          */
 290
 291
 292         /*
 293          * In case there are no candidates, no cycle takes place...
 294          *
 295          * FIXME: we might use a queue, to balance the load
 296          * among the candidates
 297          */
 298         for ( rc = 0; candidates > 0; ) {
 299                 int ab, gotit = 0;
 300
 301                 /* check for abandon */
 302                 ab = op->o_abandon;
 303
 304                 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); lsc++, i++ ) {
 305                         if ( msgid[ i ] == -1 ) {
 306                                 continue;
 307                         }
 308
 309                         if ( ab ) {
 310                                 ldap_abandon( lsc->ld, msgid[ i ] );
 311                                 rc = 0;
 312                                 break;
 313                         }
 314
 315                         if ( op->ors_slimit > 0
 316                                         && rs->sr_nentries == op->ors_slimit ) {
 317                                 rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
 318                                 rs->sr_v2ref = v2refs;
 319                                 send_ldap_result( op, rs );
 320                                 goto finish;
 321                         }
 322
 323                         /*
 324                          * FIXME: handle time limit as well?
 325                          * Note that target servers are likely
 326                          * to handle it, so at some time we'll
 327                          * get a LDAP_TIMELIMIT_EXCEEDED from
 328                          * one of them ...
 329                          */
 330                         rc = ldap_result( lsc->ld, msgid[ i ],
 331                                         0, &tv, &res );
 332
 333                         if ( rc == 0 ) {
 334                                 /* timeout exceeded */
 335
 336                                 /* FIXME: res should not need to be freed */
 337                                 assert( res == NULL );
 338
 339                                 continue;
 340
 341                         } else if ( rc == -1 ) {
 342                                 /* something REALLY bad happened! */
 343                                 ( void )meta_clear_unused_candidates( li,
 344                                                 lc, -1, 0 );
 345                                 rs->sr_err = LDAP_OTHER;
 346                                 rs->sr_v2ref = v2refs;
 347                                 send_ldap_result( op, rs );
 348
 349                                 /* anything else needs be done? */
 350
 351                                 /* FIXME: res should not need to be freed */
 352                                 assert( res == NULL );
 353
 354                                 goto finish;
 355
 356                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 357                                 e = ldap_first_entry( lsc->ld, res );
 358                                 meta_send_entry( op, rs, lc, i, e );
 359
 360                                 ldap_msgfree( res );
 361                                 res = NULL;
 362
 363                                 /*
 364                                  * If scope is BASE, we need to jump out
 365                                  * as soon as one entry is found; if
 366                                  * the target pool is properly crafted,
 367                                  * this should correspond to the sole
 368                                  * entry that has the base DN
 369                                  */
 370                                 if ( op->ors_scope == LDAP_SCOPE_BASE
 371                                                 && rs->sr_nentries > 0 ) {
 372                                         candidates = 0;
 373                                         sres = LDAP_SUCCESS;
 374                                         break;
 375                                 }
 376
 377                                 gotit = 1;
 378
 379                         } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 380                                 char            **references = NULL;
 381                                 int             cnt;
 382
 383                                 /*
 384                                  * FIXME: should we collect references
 385                                  * and send them alltogether at the end?
 386                                  */
 387
 388                                 rc = ldap_parse_reference( lsc->ld, res,
 389                                                 &references, &rs->sr_ctrls, 1 );
 390                                 res = NULL;
 391
 392                                 if ( rc != LDAP_SUCCESS ) {
 393                                         continue;
 394                                 }
 395
 396                                 if ( references == NULL ) {
 397                                         continue;
 398                                 }
 399
 400                                 for ( cnt = 0; references[ cnt ]; cnt++ )
 401                                         /* NO OP */ ;
 402
 403                                 rs->sr_ref = ch_calloc( cnt + 1, sizeof( struct berval ) );
 404
 405                                 for ( cnt = 0; references[ cnt ]; cnt++ ) {
 406                                         rs->sr_ref[ cnt ].bv_val = references[ cnt ];
 407                                         rs->sr_ref[ cnt ].bv_len = strlen( references[ cnt ] );
 408                                 }
 409
 410                                 /* ignore return value by now */
 411                                 ( void )send_search_reference( op, rs );
 412
 413                                 /* cleanup */
 414                                 if ( references ) {
 415                                         ldap_value_free( references );
 416                                         ch_free( rs->sr_ref );
 417                                         rs->sr_ref = NULL;
 418                                 }
 419
 420                                 if ( rs->sr_ctrls ) {
 421                                         ldap_controls_free( rs->sr_ctrls );
 422                                         rs->sr_ctrls = NULL;
 423                                 }
 424
 425                         } else {
 426                                 rs->sr_err = ldap_result2error( lsc->ld,
 427                                                 res, 1 );
 428                                 res = NULL;
 429
 430                                 sres = slap_map_api2result( rs );
 431                                 if ( err != NULL ) {
 432                                         free( err );
 433                                 }
 434                                 ldap_get_option( lsc->ld,
 435                                                 LDAP_OPT_ERROR_STRING, &err );
 436                                 if ( match.bv_val != NULL ) {
 437                                         free( match.bv_val );
 438                                 }
 439                                 ldap_get_option( lsc->ld,
 440                                                 LDAP_OPT_MATCHED_DN, &match.bv_val );
 441
 442                                 Debug( LDAP_DEBUG_ANY,
 443                                         "=>meta_back_search [%d] "
 444                                         "match=\"%s\" err=\"%s\"\n",
 445                                         i, match.bv_val, err );
 446                                 candidate_match++;
 447                                 last = i;
 448                                 rc = 0;
 449
 450                                 /*
 451                                  * When no candidates are left,
 452                                  * the outer cycle finishes
 453                                  */
 454                                 msgid[ i ] = -1;
 455                                 --candidates;
 456                         }
 457                 }
 458
 459                 if ( ab ) {
 460                         goto finish;
 461                 }
 462
 463                 if ( gotit == 0 ) {
 464                         tv.tv_sec = 0;
 465                         tv.tv_usec = 100000;
 466                         ldap_pvt_thread_yield();
 467                 } else {
 468                         tv.tv_sec = 0;
 469                         tv.tv_usec = 0;
 470                 }
 471         }
 472
 473         if ( rc == -1 ) {
 474                 /*
 475                  * FIXME: need a strategy to handle errors
 476                  */
 477                 rc = meta_back_op_result( lc, op, rs );
 478                 goto finish;
 479         }
 480
 481         /*
 482          * Rewrite the matched portion of the search base, if required
 483          *
 484          * FIXME: only the last one gets caught!
 485          */
 486         if ( candidate_match == initial_candidates
 487                         && match.bv_val != NULL && *match.bv_val ) {
 488                 dc.ctx = "matchedDN";
 489                 dc.rwmap = &li->targets[ last ]->rwmap;
 490
 491                 if ( ldap_back_dn_massage( &dc, &match, &mmatch ) ) {
 492                         mmatch.bv_val = NULL;
 493                 }
 494         }
 495
 496         /*
 497          * In case we returned at least one entry, we return LDAP_SUCCESS
 498          * otherwise, the latter error code we got
 499          *
 500          * FIXME: we should handle error codes and return the more
 501          * important/reasonable
 502          */
 503         if ( is_scope == 0 ) {
 504                 sres = LDAP_NO_SUCH_OBJECT;
 505         }
 506
 507         if ( sres == LDAP_SUCCESS && v2refs ) {
 508                 sres = LDAP_REFERRAL;
 509         }
 510         rs->sr_err = sres;
 511         rs->sr_matched = mmatch.bv_val;
 512         rs->sr_v2ref = v2refs;
 513         send_ldap_result( op, rs );
 514         rs->sr_matched = NULL;
 515         rs->sr_v2ref = NULL;
 516
 517
 518 finish:;
 519         if ( match.bv_val ) {
 520                 if ( mmatch.bv_val != match.bv_val ) {
 521                         free( mmatch.bv_val );
 522                 }
 523                 free( match.bv_val );
 524         }
 525
 526         if ( err ) {
 527                 free( err );
 528         }
 529
 530         if ( msgid ) {
 531                 ch_free( msgid );
 532         }
 533
 534         return rc;
 535 }
 536
 537 static int
 538 meta_send_entry(
 539                 Operation       *op,
 540                 SlapReply       *rs,
 541                 struct metaconn *lc,
 542                 int             target,
 543                 LDAPMessage     *e
 544 )
 545 {
 546         struct metainfo         *li = ( struct metainfo * )op->o_bd->be_private;
 547         struct berval           a, mapped;
 548         Entry                   ent = {0};
 549         BerElement              ber = *e->lm_ber;
 550         Attribute               *attr, **attrp;
 551         struct berval           *bv, bdn;
 552         const char              *text;
 553         dncookie                dc;
 554
 555         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 556                 return LDAP_DECODING_ERROR;
 557         }
 558
 559         /*
 560          * Rewrite the dn of the result, if needed
 561          */
 562         dc.rwmap = &li->targets[ target ]->rwmap;
 563         dc.conn = op->o_conn;
 564         dc.rs = rs;
 565         dc.ctx = "searchResult";
 566
 567         rs->sr_err = ldap_back_dn_massage( &dc, &bdn, &ent.e_name );
 568         if ( rs->sr_err != LDAP_SUCCESS) {
 569                 return rs->sr_err;
 570         }
 571
 572         /*
 573          * Note: this may fail if the target host(s) schema differs
 574          * from the one known to the meta, and a DN with unknown
 575          * attributes is returned.
 576          *
 577          * FIXME: should we log anything, or delegate to dnNormalize?
 578          */
 579         if ( dnNormalize( 0, NULL, NULL, &ent.e_name, &ent.e_nname,
 580                 &op->o_tmpmemctx ) != LDAP_SUCCESS )
 581         {
 582                 return LDAP_INVALID_DN_SYNTAX;
 583         }
 584
 585         /*
 586          * cache dn
 587          */
 588         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 589                 ( void )meta_dncache_update_entry( &li->cache,
 590                                 &ent.e_nname, target );
 591         }
 592
 593         attrp = &ent.e_attrs;
 594
 595         dc.ctx = "searchAttrDN";
 596         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 597                 int             last = 0;
 598
 599                 ldap_back_map( &li->targets[ target ]->rwmap.rwm_at,
 600                                 &a, &mapped, BACKLDAP_REMAP );
 601                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0' ) {
 602                         continue;
 603                 }
 604                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 605                 if ( attr == NULL ) {
 606                         continue;
 607                 }
 608                 attr->a_flags = 0;
 609                 attr->a_next = 0;
 610                 attr->a_desc = NULL;
 611                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 612                                 != LDAP_SUCCESS) {
 613                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 614                                         != LDAP_SUCCESS) {
 615                                 Debug( LDAP_DEBUG_ANY,
 616                                                 "slap_bv2undef_ad(%s): "
 617                                                 "%s\n%s", mapped.bv_val, text, "" );
 618                                 ch_free( attr );
 619                                 continue;
 620                         }
 621                 }
 622
 623                 /* no subschemaSubentry */
 624                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 625
 626                         /*
 627                          * We eat target's subschemaSubentry because
 628                          * a search for this value is likely not
 629                          * to resolve to the appropriate backend;
 630                          * later, the local subschemaSubentry is
 631                          * added.
 632                          */
 633                         ( void )ber_scanf( &ber, "x" /* [W] */ );
 634
 635                         ch_free(attr);
 636                         continue;
 637                 }
 638
 639                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 640                                 || attr->a_vals == NULL ) {
 641                         attr->a_vals = &slap_dummy_bv;
 642
 643                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 644                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 645
 646                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 647
 648                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 649                                 ldap_back_map( &li->targets[ target ]->rwmap.rwm_oc,
 650                                                 bv, &mapped, BACKLDAP_REMAP );
 651                                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 652                                         free( bv->bv_val );
 653                                         bv->bv_val = NULL;
 654                                         if ( --last < 0 ) {
 655                                                 break;
 656                                         }
 657                                         *bv = attr->a_vals[ last ];
 658                                         attr->a_vals[ last ].bv_val = NULL;
 659                                         bv--;
 660
 661                                 } else if ( mapped.bv_val != bv->bv_val ) {
 662                                         free( bv->bv_val );
 663                                         ber_dupbv( bv, &mapped );
 664                                 }
 665                         }
 666                 /*
 667                  * It is necessary to try to rewrite attributes with
 668                  * dn syntax because they might be used in ACLs as
 669                  * members of groups; since ACLs are applied to the
 670                  * rewritten stuff, no dn-based subecj clause could
 671                  * be used at the ldap backend side (see
 672                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 673                  * The problem can be overcome by moving the dn-based
 674                  * ACLs to the target directory server, and letting
 675                  * everything pass thru the ldap backend.
 676                  */
 677                 } else if ( attr->a_desc->ad_type->sat_syntax ==
 678                                 slap_schema.si_syn_distinguishedName ) {
 679                         ldap_dnattr_result_rewrite( &dc, attr->a_vals );
 680                 }
 681
 682                 if ( last && attr->a_desc->ad_type->sat_equality &&
 683                         attr->a_desc->ad_type->sat_equality->smr_normalize ) {
 684                         int i;
 685
 686                         attr->a_nvals = ch_malloc((last + 1)*sizeof(struct berval));
 687                         for ( i = 0; i<last; i++ ) {
 688                                 attr->a_desc->ad_type->sat_equality->smr_normalize(
 689                                         SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
 690                                         attr->a_desc->ad_type->sat_syntax,
 691                                         attr->a_desc->ad_type->sat_equality,
 692                                         &attr->a_vals[i], &attr->a_nvals[i],
 693                                         op->o_tmpmemctx );
 694                         }
 695                         attr->a_nvals[i].bv_val = NULL;
 696                         attr->a_nvals[i].bv_len = 0;
 697                 } else {
 698                         attr->a_nvals = attr->a_vals;
 699                 }
 700
 701                 *attrp = attr;
 702                 attrp = &attr->a_next;
 703         }
 704         rs->sr_entry = &ent;
 705         rs->sr_attrs = op->ors_attrs;
 706         rs->sr_flags = 0;
 707         send_search_entry( op, rs );
 708         rs->sr_entry = NULL;
 709         rs->sr_attrs = NULL;
 710         while ( ent.e_attrs ) {
 711                 attr = ent.e_attrs;
 712                 ent.e_attrs = attr->a_next;
 713                 if ( attr->a_vals != &slap_dummy_bv ) {
 714                         ber_bvarray_free( attr->a_vals );
 715                 }
 716                 free( attr );
 717         }
 718
 719         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 720                 free( ent.e_dn );
 721         }
 722         if ( ent.e_ndn ) {
 723                 free( ent.e_ndn );
 724         }
 725
 726         return LDAP_SUCCESS;
 727 }
 728
 729