git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /*
   2  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   3  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   4  *
   5  * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
   6  *
   7  * This work has been developed to fulfill the requirements
   8  * of SysNet s.n.c. <http:www.sys-net.it> and it has been donated
   9  * to the OpenLDAP Foundation in the hope that it may be useful
  10  * to the Open Source community, but WITHOUT ANY WARRANTY.
  11  *
  12  * Permission is granted to anyone to use this software for any purpose
  13  * on any computer system, and to alter it and redistribute it, subject
  14  * to the following restrictions:
  15  *
  16  * 1. The author and SysNet s.n.c. are not responsible for the consequences
  17  *    of use of this software, no matter how awful, even if they arise from
  18  *    flaws in it.
  19  *
  20  * 2. The origin of this software must not be misrepresented, either by
  21  *    explicit claim or by omission.  Since few users ever read sources,
  22  *    credits should appear in the documentation.
  23  *
  24  * 3. Altered versions must be plainly marked as such, and must not be
  25  *    misrepresented as being the original software.  Since few users
  26  *    ever read sources, credits should appear in the documentation.
  27  *    SysNet s.n.c. cannot be responsible for the consequences of the
  28  *    alterations.
  29  *
  30  * 4. This notice may not be removed or altered.
  31  *
  32  *
  33  * This software is based on the backend back-ldap, implemented
  34  * by Howard Chu <hyc@highlandsun.com>, and modified by Mark Valence
  35  * <kurash@sassafras.com>, Pierangelo Masarati <ando@sys-net.it> and other
  36  * contributors. The contribution of the original software to the present
  37  * implementation is acknowledged in this copyright statement.
  38  *
  39  * A special acknowledgement goes to Howard for the overall architecture
  40  * (and for borrowing large pieces of code), and to Mark, who implemented
  41  * from scratch the attribute/objectclass mapping.
  42  *
  43  * The original copyright statement follows.
  44  *
  45  * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
  46  *
  47  * Permission is granted to anyone to use this software for any purpose
  48  * on any computer system, and to alter it and redistribute it, subject
  49  * to the following restrictions:
  50  *
  51  * 1. The author is not responsible for the consequences of use of this
  52  *    software, no matter how awful, even if they arise from flaws in it.
  53  *
  54  * 2. The origin of this software must not be misrepresented, either by
  55  *    explicit claim or by omission.  Since few users ever read sources,
  56  *    credits should appear in the documentation.
  57  *
  58  * 3. Altered versions must be plainly marked as such, and must not be
  59  *    misrepresented as being the original software.  Since few users
  60  *    ever read sources, credits should appear in the
  61  *    documentation.
  62  *
  63  * 4. This notice may not be removed or altered.
  64  *
  65  */
  66
  67 #include "portable.h"
  68
  69 #include <stdio.h>
  70
  71 #include <ac/socket.h>
  72 #include <ac/string.h>
  73 #include <ac/time.h>
  74
  75 #include "slap.h"
  76 #include "../back-ldap/back-ldap.h"
  77 #include "back-meta.h"
  78 #include "ldap_pvt.h"
  79 #undef ldap_debug       /* silence a warning in ldap-int.h */
  80 #include "ldap_log.h"
  81 #include "../../../libraries/libldap/ldap-int.h"
  82
  83 static int
  84 meta_send_entry(
  85                 Operation       *op,
  86                 SlapReply       *rs,
  87                 struct metaconn *lc,
  88                 int             i,
  89                 LDAPMessage     *e
  90 );
  91
  92 static int
  93 is_one_level_rdn(
  94                 const char      *rdn,
  95                 int             from
  96 );
  97
  98 int
  99 meta_back_search( Operation *op, SlapReply *rs )
 100 {
 101         struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
 102         struct metaconn *lc;
 103         struct metasingleconn *lsc;
 104         struct timeval  tv = { 0, 0 };
 105         LDAPMessage     *res, *e;
 106         int     rc = 0, *msgid, sres = LDAP_NO_SUCH_OBJECT;
 107         char *match = NULL, *err = NULL;
 108         char *mmatch = NULL;
 109         BerVarray v2refs = NULL;
 110
 111         int i, last = 0, candidates = 0;
 112         struct slap_limits_set *limit = NULL;
 113         int isroot = 0;
 114
 115 #ifdef LDAP_CACHING
 116         cache_manager*  cm = li->cm;
 117
 118         if (cm->caching) {
 119                 return meta_back_cache_search(op->o_bd, op->o_conn, op,
 120                                 &op->o_req_dn, &op->o_req_ndn,
 121                                 op->oq_search.rs_scope,
 122                                 op->oq_search.rs_deref,
 123                                 op->oq_search.rs_slimit,
 124                                 op->oq_search.rs_tlimit,
 125                                 op->oq_search.rs_filter,
 126                                 &op->oq_search.rs_filterstr,
 127                                 op->oq_search.rs_attrs,
 128                                 op->oq_search.rs_attrsonly);
 129         }
 130 #endif /* LDAP_CACHING */
 131
 132         /*
 133          * controls are set in ldap_back_dobind()
 134          *
 135          * FIXME: in case of values return filter, we might want
 136          * to map attrs and maybe rewrite value
 137          */
 138         lc = meta_back_getconn( op, rs, META_OP_ALLOW_MULTIPLE,
 139                         &op->o_req_ndn, NULL );
 140         if ( !lc ) {
 141                 send_ldap_result( op, rs );
 142                 return -1;
 143         }
 144
 145         if ( !meta_back_dobind( lc, op ) ) {
 146                 rs->sr_err = LDAP_OTHER;
 147                 send_ldap_result( op, rs );
 148                 return -1;
 149         }
 150
 151         /*
 152          * Array of message id of each target
 153          */
 154         msgid = ch_calloc( sizeof( int ), li->ntargets );
 155         if ( msgid == NULL ) {
 156                 rs->sr_err = LDAP_OTHER;
 157                 send_ldap_result( op, rs );
 158                 return -1;
 159         }
 160
 161         /* if not root, get appropriate limits */
 162         if ( be_isroot( op->o_bd, &op->o_ndn ) ) {
 163                 isroot = 1;
 164         } else {
 165                 ( void ) get_limits( op->o_bd, &op->o_ndn, &limit );
 166         }
 167
 168         /* if no time limit requested, rely on remote server limits */
 169         /* if requested limit higher than hard limit, abort */
 170         if ( !isroot && op->oq_search.rs_tlimit > limit->lms_t_hard ) {
 171                 /* no hard limit means use soft instead */
 172                 if ( limit->lms_t_hard == 0
 173                                 && limit->lms_t_soft > -1
 174                                 && op->oq_search.rs_tlimit > limit->lms_t_soft ) {
 175                         op->oq_search.rs_tlimit = limit->lms_t_soft;
 176
 177                 /* positive hard limit means abort */
 178                 } else if ( limit->lms_t_hard > 0 ) {
 179                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 180                         send_ldap_result( op, rs );
 181                         rc = 0;
 182                         goto finish;
 183                 }
 184
 185                 /* negative hard limit means no limit */
 186         }
 187
 188         /* if no size limit requested, rely on remote server limits */
 189         /* if requested limit higher than hard limit, abort */
 190         if ( !isroot && op->oq_search.rs_slimit > limit->lms_s_hard ) {
 191                 /* no hard limit means use soft instead */
 192                 if ( limit->lms_s_hard == 0
 193                                 && limit->lms_s_soft > -1
 194                                 && op->oq_search.rs_slimit > limit->lms_s_soft ) {
 195                         op->oq_search.rs_slimit = limit->lms_s_soft;
 196
 197                 /* positive hard limit means abort */
 198                 } else if ( limit->lms_s_hard > 0 ) {
 199                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 200                         send_ldap_result( op, rs );
 201                         rc = 0;
 202                         goto finish;
 203                 }
 204
 205                 /* negative hard limit means no limit */
 206         }
 207
 208         /*
 209          * Inits searches
 210          */
 211         for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
 212                 char            *realbase = ( char * )op->o_req_dn.bv_val;
 213                 int             realscope = op->oq_search.rs_scope;
 214                 ber_len_t       suffixlen = 0;
 215                 char            *mbase = NULL;
 216                 struct berval   mfilter = { 0L, NULL };
 217                 char            **mapped_attrs = NULL;
 218
 219                 if ( lsc->candidate != META_CANDIDATE ) {
 220                         msgid[ i ] = -1;
 221                         continue;
 222                 }
 223
 224                 /* should we check return values? */
 225                 if ( op->oq_search.rs_deref != -1 ) {
 226                         ldap_set_option( lsc->ld, LDAP_OPT_DEREF,
 227                                         ( void * )&op->oq_search.rs_deref);
 228                 }
 229                 if ( op->oq_search.rs_tlimit != -1 ) {
 230                         ldap_set_option( lsc->ld, LDAP_OPT_TIMELIMIT,
 231                                         ( void * )&op->oq_search.rs_tlimit);
 232                 }
 233                 if ( op->oq_search.rs_slimit != -1 ) {
 234                         ldap_set_option( lsc->ld, LDAP_OPT_SIZELIMIT,
 235                                         ( void * )&op->oq_search.rs_slimit);
 236                 }
 237
 238                 /*
 239                  * modifies the base according to the scope, if required
 240                  */
 241                 suffixlen = li->targets[ i ]->suffix.bv_len;
 242                 if ( suffixlen > op->o_req_ndn.bv_len ) {
 243                         switch ( op->oq_search.rs_scope ) {
 244                         case LDAP_SCOPE_SUBTREE:
 245                                 /*
 246                                  * make the target suffix the new base
 247                                  * FIXME: this is very forgiving, because
 248                                  * illegal bases may be turned into
 249                                  * the suffix of the target.
 250                                  */
 251                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 252                                                 &op->o_req_ndn ) ) {
 253                                         realbase = li->targets[ i ]->suffix.bv_val;
 254                                 } else {
 255                                         /*
 256                                          * this target is no longer candidate
 257                                          */
 258                                         msgid[ i ] = -1;
 259                                         goto new_candidate;
 260                                 }
 261                                 break;
 262
 263                         case LDAP_SCOPE_ONELEVEL:
 264                                 if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 265                                                 suffixlen - op->o_req_ndn.bv_len - 1 )
 266                         && dnIsSuffix( &li->targets[ i ]->suffix, &op->o_req_ndn ) ) {
 267                                         /*
 268                                          * if there is exactly one level,
 269                                          * make the target suffix the new
 270                                          * base, and make scope "base"
 271                                          */
 272                                         realbase = li->targets[ i ]->suffix.bv_val;
 273                                         realscope = LDAP_SCOPE_BASE;
 274                                         break;
 275                                 } /* else continue with the next case */
 276
 277                         case LDAP_SCOPE_BASE:
 278                                 /*
 279                                  * this target is no longer candidate
 280                                  */
 281                                 msgid[ i ] = -1;
 282                                 goto new_candidate;
 283                         }
 284
 285                 }
 286
 287                 /*
 288                  * Rewrite the search base, if required
 289                  */
 290                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 291                                         "searchBase",
 292                                         realbase, op->o_conn, &mbase ) ) {
 293                 case REWRITE_REGEXEC_OK:
 294                 if ( mbase == NULL ) {
 295                         mbase = realbase;
 296                 }
 297 #ifdef NEW_LOGGING
 298                 LDAP_LOG( BACK_META, DETAIL1,
 299                         "[rw] searchBase [%d]: \"%s\" -> \"%s\"\n",
 300                         i, op->o_req_dn.bv_val, mbase );
 301 #else /* !NEW_LOGGING */
 302                 Debug( LDAP_DEBUG_ARGS,
 303                         "rw> searchBase [%d]: \"%s\" -> \"%s\"\n",
 304                                 i, op->o_req_dn.bv_val, mbase );
 305 #endif /* !NEW_LOGGING */
 306                 break;
 307
 308                 case REWRITE_REGEXEC_UNWILLING:
 309                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 310                         rs->sr_text = "Operation not allowed";
 311                         send_ldap_result( op, rs );
 312                         rc = -1;
 313                         goto finish;
 314
 315                 case REWRITE_REGEXEC_ERR:
 316 #if 0
 317                         rs->sr_err = LDAP_OTHER;
 318                         rs->sr_text = "Rewrite error";
 319                         send_ldap_result( op, rs );
 320                         rc = -1;
 321                         goto finish;
 322 #endif
 323
 324                         /*
 325                          * this target is no longer candidate
 326                          */
 327                         msgid[ i ] = -1;
 328                         goto new_candidate;
 329                 }
 330
 331                 /*
 332                  * Maps filter
 333                  */
 334                 rc = ldap_back_filter_map_rewrite_( li->targets[ i ]->rwinfo,
 335                                 op->o_conn,
 336                                 &li->targets[ i ]->at_map,
 337                                 &li->targets[ i ]->oc_map,
 338                                 op->oq_search.rs_filter,
 339                                 &mfilter, BACKLDAP_MAP );
 340                 if ( rc != 0 ) {
 341                         /*
 342                          * this target is no longer candidate
 343                          */
 344                         msgid[ i ] = -1;
 345                         goto new_candidate;
 346                 }
 347
 348                 /*
 349                  * Maps required attributes
 350                  */
 351                 rc = ldap_back_map_attrs( &li->targets[ i ]->at_map,
 352                                 op->oq_search.rs_attrs, BACKLDAP_MAP,
 353                                 &mapped_attrs );
 354                 if ( rc != LDAP_SUCCESS ) {
 355                         /*
 356                          * this target is no longer candidate
 357                          */
 358                         msgid[ i ] = -1;
 359                         goto new_candidate;
 360                 }
 361
 362 #if 0
 363                 if ( mapped_attrs == NULL && op->oq_search.rs_attrs) {
 364                         int     count;
 365                         for ( count = 0; op->oq_search.rs_attrs[ count ].an_name.bv_val; count++ );
 366                         mapped_attrs = ch_malloc( ( count + 1 ) * sizeof(char *));
 367                         for ( count = 0; op->oq_search.rs_attrs[ count ].an_name.bv_val; count++ ) {
 368                                 mapped_attrs[ count ] = op->oq_search.rs_attrs[ count ].an_name.bv_val;
 369                         }
 370                         mapped_attrs[ count ] = NULL;
 371                 }
 372 #endif
 373
 374                 /*
 375                  * Starts the search
 376                  */
 377                 msgid[ i ] = ldap_search( lsc->ld, mbase, realscope,
 378                                 mfilter.bv_val, mapped_attrs,
 379                                 op->oq_search.rs_attrsonly );
 380                 if ( mapped_attrs ) {
 381                         free( mapped_attrs );
 382                         mapped_attrs = NULL;
 383                 }
 384                 if ( mfilter.bv_val != op->oq_search.rs_filterstr.bv_val ) {
 385                         free( mfilter.bv_val );
 386                         mfilter.bv_val = NULL;
 387                 }
 388                 if ( mbase != realbase ) {
 389                         free( mbase );
 390                         mbase = NULL;
 391                 }
 392
 393                 if ( msgid[ i ] == -1 ) {
 394                         continue;
 395                 }
 396
 397                 ++candidates;
 398
 399 new_candidate:;
 400         }
 401
 402         /* We pull apart the ber result, stuff it into a slapd entry, and
 403          * let send_search_entry stuff it back into ber format. Slow & ugly,
 404          * but this is necessary for version matching, and for ACL processing.
 405          */
 406
 407
 408         /*
 409          * In case there are no candidates, no cycle takes place...
 410          *
 411          * FIXME: we might use a queue, to balance the load
 412          * among the candidates
 413          */
 414         for ( rc = 0; candidates > 0; ) {
 415                 int ab, gotit = 0;
 416
 417                 /* check for abandon */
 418                 ab = op->o_abandon;
 419
 420                 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); lsc++, i++ ) {
 421                         if ( msgid[ i ] == -1 ) {
 422                                 continue;
 423                         }
 424
 425                         if ( ab ) {
 426                                 ldap_abandon( lsc->ld, msgid[ i ] );
 427                                 rc = 0;
 428                                 break;
 429                         }
 430
 431                         if ( op->oq_search.rs_slimit > 0
 432                                         && rs->sr_nentries == op->oq_search.rs_slimit ) {
 433                                 rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
 434                                 rs->sr_v2ref = v2refs;
 435                                 send_ldap_result( op, rs );
 436                                 goto finish;
 437                         }
 438
 439                         /*
 440                          * FIXME: handle time limit as well?
 441                          * Note that target servers are likely
 442                          * to handle it, so at some time we'll
 443                          * get a LDAP_TIMELIMIT_EXCEEDED from
 444                          * one of them ...
 445                          */
 446                         rc = ldap_result( lsc->ld, msgid[ i ],
 447                                         0, &tv, &res );
 448
 449                         if ( rc == 0 ) {
 450                                 continue;
 451
 452                         } else if ( rc == -1 ) {
 453                                 /* something REALLY bad happened! */
 454                                 ( void )meta_clear_unused_candidates( li,
 455                                                 lc, -1, 0 );
 456                                 rs->sr_err = LDAP_OTHER;
 457                                 rs->sr_v2ref = v2refs;
 458                                 send_ldap_result( op, rs );
 459
 460                                 /* anything else needs be done? */
 461                                 goto finish;
 462
 463                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 464                                 e = ldap_first_entry( lsc->ld, res );
 465                                 meta_send_entry( op, rs, lc, i, e );
 466
 467                                 /*
 468                                  * If scope is BASE, we need to jump out
 469                                  * as soon as one entry is found; if
 470                                  * the target pool is properly crafted,
 471                                  * this should correspond to the sole
 472                                  * entry that has the base DN
 473                                  */
 474                                 if ( op->oq_search.rs_scope == LDAP_SCOPE_BASE
 475                                                 && rs->sr_nentries > 0 ) {
 476                                         candidates = 0;
 477                                         sres = LDAP_SUCCESS;
 478                                         break;
 479                                 }
 480                                 ldap_msgfree( res );
 481                                 gotit = 1;
 482
 483                         } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 484                                 char            **references = NULL;
 485                                 int             cnt;
 486
 487                                 /*
 488                                  * FIXME: should we collect references
 489                                  * and send them alltogether at the end?
 490                                  */
 491
 492                                 rc = ldap_parse_reference( lsc->ld, res,
 493                                                 &references, &rs->sr_ctrls, 1 );
 494
 495                                 if ( rc != LDAP_SUCCESS ) {
 496                                         continue;
 497                                 }
 498
 499                                 if ( references == NULL ) {
 500                                         continue;
 501                                 }
 502
 503                                 for ( cnt = 0; references[ cnt ]; cnt++ )
 504                                         /* NO OP */ ;
 505
 506                                 rs->sr_ref = ch_calloc( cnt + 1, sizeof( struct berval ) );
 507
 508                                 for ( cnt = 0; references[ cnt ]; cnt++ ) {
 509                                         rs->sr_ref[ cnt ].bv_val = references[ cnt ];
 510                                         rs->sr_ref[ cnt ].bv_len = strlen( references[ cnt ] );
 511                                 }
 512
 513                                 /* ignore return value by now */
 514                                 ( void )send_search_reference( op, rs );
 515
 516                                 /* cleanup */
 517                                 if ( references ) {
 518                                         ldap_value_free( references );
 519                                         ch_free( rs->sr_ref );
 520                                         rs->sr_ref = NULL;
 521                                 }
 522
 523                                 if ( rs->sr_ctrls ) {
 524                                         ldap_controls_free( rs->sr_ctrls );
 525                                         rs->sr_ctrls = NULL;
 526                                 }
 527
 528                         } else {
 529                                 rs->sr_err = ldap_result2error( lsc->ld,
 530                                                 res, 1 );
 531                                 sres = ldap_back_map_result( rs );
 532                                 if ( err != NULL ) {
 533                                         free( err );
 534                                 }
 535                                 ldap_get_option( lsc->ld,
 536                                                 LDAP_OPT_ERROR_STRING, &err );
 537                                 if ( match != NULL ) {
 538                                         free( match );
 539                                 }
 540                                 ldap_get_option( lsc->ld,
 541                                                 LDAP_OPT_MATCHED_DN, &match );
 542
 543 #ifdef NEW_LOGGING
 544                                 LDAP_LOG( BACK_META, ERR,
 545                                         "meta_back_search [%d] "
 546                                         "match=\"%s\" err=\"%s\"\n",
 547                                         i, match, err );
 548 #else /* !NEW_LOGGING */
 549                                 Debug( LDAP_DEBUG_ANY,
 550                                         "=>meta_back_search [%d] "
 551                                         "match=\"%s\" err=\"%s\"\n",
 552                                         i, match, err );
 553 #endif /* !NEW_LOGGING */
 554
 555                                 last = i;
 556                                 rc = 0;
 557
 558                                 /*
 559                                  * When no candidates are left,
 560                                  * the outer cycle finishes
 561                                  */
 562                                 msgid[ i ] = -1;
 563                                 --candidates;
 564                         }
 565                 }
 566
 567                 if ( ab ) {
 568                         goto finish;
 569                 }
 570
 571                 if ( gotit == 0 ) {
 572                         tv.tv_sec = 0;
 573                         tv.tv_usec = 100000;
 574                         ldap_pvt_thread_yield();
 575                 } else {
 576                         tv.tv_sec = 0;
 577                         tv.tv_usec = 0;
 578                 }
 579         }
 580
 581         if ( rc == -1 ) {
 582                 /*
 583                  * FIXME: need a strategy to handle errors
 584                  */
 585                 rc = meta_back_op_result( lc, op, rs );
 586                 goto finish;
 587         }
 588
 589         /*
 590          * Rewrite the matched portion of the search base, if required
 591          *
 592          * FIXME: only the last one gets caught!
 593          */
 594         if ( match != NULL ) {
 595                 switch ( rewrite_session( li->targets[ last ]->rwinfo,
 596                                         "matchedDn", match, op->o_conn,
 597                                         &mmatch ) ) {
 598                 case REWRITE_REGEXEC_OK:
 599                         if ( mmatch == NULL ) {
 600                                 mmatch = ( char * )match;
 601                         }
 602 #ifdef NEW_LOGGING
 603                         LDAP_LOG( BACK_META, DETAIL1,
 604                                 "[rw] matchedDn: \"%s\" -> \"%s\"\n",
 605                                 match, mmatch, 0 );
 606 #else /* !NEW_LOGGING */
 607                         Debug( LDAP_DEBUG_ARGS,
 608                                 "rw> matchedDn: \"%s\" -> \"%s\"\n",
 609                                 match, mmatch, 0 );
 610 #endif /* !NEW_LOGGING */
 611                         break;
 612
 613                 case REWRITE_REGEXEC_UNWILLING:
 614
 615                 case REWRITE_REGEXEC_ERR:
 616                         /* FIXME: no error, but no matched ... */
 617                         mmatch = NULL;
 618                         break;
 619                 }
 620         }
 621
 622         /*
 623          * In case we returned at least one entry, we return LDAP_SUCCESS
 624          * otherwise, the latter error code we got
 625          *
 626          * FIXME: we should handle error codes and return the more
 627          * important/reasonable
 628          */
 629         if ( sres == LDAP_SUCCESS && v2refs ) {
 630                 sres = LDAP_REFERRAL;
 631         }
 632         rs->sr_err = sres;
 633         rs->sr_matched = mmatch;
 634         rs->sr_v2ref = v2refs;
 635         send_ldap_result( op, rs );
 636         rs->sr_matched = NULL;
 637         rs->sr_v2ref = NULL;
 638
 639
 640 finish:;
 641         if ( match ) {
 642                 if ( mmatch != match ) {
 643                         free( mmatch );
 644                 }
 645                 free(match);
 646         }
 647
 648         if ( err ) {
 649                 free( err );
 650         }
 651
 652         if ( msgid ) {
 653                 ch_free( msgid );
 654         }
 655
 656         return rc;
 657 }
 658
 659 static int
 660 meta_send_entry(
 661                 Operation       *op,
 662                 SlapReply       *rs,
 663                 struct metaconn *lc,
 664                 int             target,
 665                 LDAPMessage     *e
 666 )
 667 {
 668         struct metainfo         *li = ( struct metainfo * )op->o_bd->be_private;
 669         struct berval           a, mapped;
 670         Entry                   ent;
 671         BerElement              ber = *e->lm_ber;
 672         Attribute               *attr, **attrp;
 673         struct berval           dummy = { 0, NULL };
 674         struct berval           *bv, bdn;
 675         const char              *text;
 676
 677         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 678                 return LDAP_DECODING_ERROR;
 679         }
 680
 681         /*
 682          * Rewrite the dn of the result, if needed
 683          */
 684         switch ( rewrite_session( li->targets[ target ]->rwinfo,
 685                                 "searchResult", bdn.bv_val, lc->conn,
 686                                 &ent.e_name.bv_val ) ) {
 687         case REWRITE_REGEXEC_OK:
 688                 if ( ent.e_name.bv_val == NULL ) {
 689                         ent.e_name = bdn;
 690
 691                 } else {
 692 #ifdef NEW_LOGGING
 693                         LDAP_LOG( BACK_META, DETAIL1,
 694                                 "[rw] searchResult[%d]: \"%s\" -> \"%s\"\n",
 695                                 target, bdn.bv_val, ent.e_name.bv_val );
 696 #else /* !NEW_LOGGING */
 697                         Debug( LDAP_DEBUG_ARGS, "rw> searchResult[%d]: \"%s\""
 698                                         " -> \"%s\"\n", target, bdn.bv_val,
 699                                         ent.e_name.bv_val );
 700 #endif /* !NEW_LOGGING */
 701                         ent.e_name.bv_len = strlen( ent.e_name.bv_val );
 702                 }
 703                 break;
 704
 705         case REWRITE_REGEXEC_UNWILLING:
 706                 return LDAP_UNWILLING_TO_PERFORM;
 707
 708         case REWRITE_REGEXEC_ERR:
 709                 return LDAP_OTHER;
 710         }
 711
 712         /*
 713          * Note: this may fail if the target host(s) schema differs
 714          * from the one known to the meta, and a DN with unknown
 715          * attributes is returned.
 716          *
 717          * FIXME: should we log anything, or delegate to dnNormalize2?
 718          */
 719         if ( dnNormalize2( NULL, &ent.e_name, &ent.e_nname ) != LDAP_SUCCESS ) {
 720                 return LDAP_INVALID_DN_SYNTAX;
 721         }
 722
 723         /*
 724          * cache dn
 725          */
 726         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 727                 ( void )meta_dncache_update_entry( &li->cache,
 728                                                    &ent.e_nname,
 729                                                    target );
 730         }
 731
 732         ent.e_id = 0;
 733         ent.e_attrs = 0;
 734         ent.e_private = 0;
 735         attrp = &ent.e_attrs;
 736
 737         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 738                 ldap_back_map( &li->targets[ target ]->at_map,
 739                                 &a, &mapped, BACKLDAP_REMAP );
 740                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0' ) {
 741                         continue;
 742                 }
 743                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 744                 if ( attr == NULL ) {
 745                         continue;
 746                 }
 747                 attr->a_flags = 0;
 748                 attr->a_next = 0;
 749                 attr->a_desc = NULL;
 750                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 751                                 != LDAP_SUCCESS) {
 752                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 753                                         != LDAP_SUCCESS) {
 754 #ifdef NEW_LOGGING
 755                                 LDAP_LOG( BACK_META, DETAIL1,
 756                                         "slap_bv2undef_ad(%s): %s\n", mapped.bv_val, text, 0 );
 757 #else /* !NEW_LOGGING */
 758                                 Debug( LDAP_DEBUG_ANY,
 759                                                 "slap_bv2undef_ad(%s): "
 760                                                 "%s\n%s", mapped.bv_val, text, "" );
 761 #endif /* !NEW_LOGGING */
 762                                 ch_free( attr );
 763                                 continue;
 764                         }
 765                 }
 766
 767                 /* no subschemaSubentry */
 768                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 769                         ch_free(attr);
 770                         continue;
 771                 }
 772
 773                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 774                                 || attr->a_vals == NULL ) {
 775                         attr->a_vals = &dummy;
 776
 777                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 778                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 779                         int             last;
 780
 781                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 782
 783                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 784                                 ldap_back_map( &li->targets[ target]->oc_map,
 785                                                 bv, &mapped, BACKLDAP_REMAP );
 786                                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 787                                         free( bv->bv_val );
 788                                         bv->bv_val = NULL;
 789                                         if ( --last < 0 ) {
 790                                                 break;
 791                                         }
 792                                         *bv = attr->a_vals[ last ];
 793                                         attr->a_vals[ last ].bv_val = NULL;
 794                                         bv--;
 795
 796                                 } else if ( mapped.bv_val != bv->bv_val ) {
 797                                         free( bv->bv_val );
 798                                         ber_dupbv( bv, &mapped );
 799                                 }
 800                         }
 801                 /*
 802                  * It is necessary to try to rewrite attributes with
 803                  * dn syntax because they might be used in ACLs as
 804                  * members of groups; since ACLs are applied to the
 805                  * rewritten stuff, no dn-based subecj clause could
 806                  * be used at the ldap backend side (see
 807                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 808                  * The problem can be overcome by moving the dn-based
 809                  * ACLs to the target directory server, and letting
 810                  * everything pass thru the ldap backend.
 811                  */
 812                 } else if ( strcmp( attr->a_desc->ad_type->sat_syntax->ssyn_oid,
 813                                         SLAPD_DN_SYNTAX ) == 0 ) {
 814                         int             last;
 815
 816                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 817
 818                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 819                                 char *newval;
 820
 821                                 switch ( rewrite_session( li->targets[ target ]->rwinfo,
 822                                                         "searchResult",
 823                                                         bv->bv_val,
 824                                                         lc->conn, &newval )) {
 825                                 case REWRITE_REGEXEC_OK:
 826                                         /* left as is */
 827                                         if ( newval == NULL ) {
 828                                                 break;
 829                                         }
 830 #ifdef NEW_LOGGING
 831                                         LDAP_LOG( BACK_META, DETAIL1,
 832                                                 "[rw] searchResult on attr=%s: \"%s\" -> \"%s\"\n",
 833                                                 attr->a_desc->ad_type->sat_cname.bv_val,
 834                                                 bv->bv_val, newval );
 835 #else /* !NEW_LOGGING */
 836                                         Debug( LDAP_DEBUG_ARGS,
 837                                                 "rw> searchResult on attr=%s:"
 838                                                 " \"%s\" -> \"%s\"\n",
 839                                         attr->a_desc->ad_type->sat_cname.bv_val,
 840                                                 bv->bv_val, newval );
 841 #endif /* !NEW_LOGGING */
 842                                         free( bv->bv_val );
 843                                         bv->bv_val = newval;
 844                                         bv->bv_len = strlen( newval );
 845
 846                                         break;
 847
 848                                 case REWRITE_REGEXEC_UNWILLING:
 849                                         LBER_FREE(bv->bv_val);
 850                                         bv->bv_val = NULL;
 851                                         if (--last < 0)
 852                                                 goto next_attr;
 853                                         *bv = attr->a_vals[last];
 854                                         attr->a_vals[last].bv_val = NULL;
 855                                         bv--;
 856                                         break;
 857
 858                                 case REWRITE_REGEXEC_ERR:
 859                                         /*
 860                                          * FIXME: better give up,
 861                                          * skip the attribute
 862                                          * or leave it untouched?
 863                                          */
 864                                         break;
 865                                 }
 866                         }
 867                 }
 868 next_attr:;
 869
 870                 *attrp = attr;
 871                 attrp = &attr->a_next;
 872         }
 873         rs->sr_entry = &ent;
 874         rs->sr_attrs = op->oq_search.rs_attrs;
 875         send_search_entry( op, rs );
 876         rs->sr_entry = NULL;
 877         rs->sr_attrs = NULL;
 878         while ( ent.e_attrs ) {
 879                 attr = ent.e_attrs;
 880                 ent.e_attrs = attr->a_next;
 881                 if ( attr->a_vals != &dummy ) {
 882                         ber_bvarray_free( attr->a_vals );
 883                 }
 884                 free( attr );
 885         }
 886
 887         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 888                 free( ent.e_dn );
 889         }
 890         if ( ent.e_ndn ) {
 891                 free( ent.e_ndn );
 892         }
 893
 894         return LDAP_SUCCESS;
 895 }
 896
 897 static int
 898 is_one_level_rdn(
 899                 const char      *rdn,
 900                 int             from
 901 )
 902 {
 903         for ( ; from--; ) {
 904                 if ( DN_SEPARATOR( rdn[ from ] ) ) {
 905                         return 0;
 906                 }
 907         }
 908
 909         return 1;
 910 }
 911