git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2005 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/socket.h>
  28 #include <ac/string.h>
  29 #include <ac/time.h>
  30
  31 #include "slap.h"
  32 #include "../back-ldap/back-ldap.h"
  33 #include "back-meta.h"
  34 #undef ldap_debug       /* silence a warning in ldap-int.h */
  35 #include "ldap_log.h"
  36 #include "../../../libraries/libldap/ldap-int.h"
  37
  38 static int
  39 meta_send_entry(
  40                 Operation       *op,
  41                 SlapReply       *rs,
  42                 struct metaconn *lc,
  43                 int             i,
  44                 LDAPMessage     *e
  45 );
  46
  47 int
  48 meta_back_search( Operation *op, SlapReply *rs )
  49 {
  50         struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
  51         struct metaconn *lc;
  52         struct metasingleconn *lsc;
  53         struct timeval  tv = { 0, 0 };
  54         LDAPMessage     *res = NULL, *e;
  55         int     rc = 0, *msgid, sres = LDAP_SUCCESS;
  56         char *err = NULL;
  57         struct berval match = BER_BVNULL, mmatch = BER_BVNULL;
  58         BerVarray v2refs = NULL;
  59
  60         int i, last = 0, candidates = 0, initial_candidates = 0,
  61                         candidate_match = 0;
  62         dncookie dc;
  63
  64         int     is_scope = 0,
  65                 is_filter = 0;
  66
  67         /*
  68          * controls are set in ldap_back_dobind()
  69          *
  70          * FIXME: in case of values return filter, we might want
  71          * to map attrs and maybe rewrite value
  72          */
  73         lc = meta_back_getconn( op, rs, META_OP_ALLOW_MULTIPLE,
  74                         &op->o_req_ndn, NULL );
  75         if ( !lc ) {
  76                 send_ldap_result( op, rs );
  77                 return -1;
  78         }
  79
  80         if ( !meta_back_dobind( lc, op ) ) {
  81                 rs->sr_err = LDAP_UNAVAILABLE;
  82                 send_ldap_result( op, rs );
  83                 return -1;
  84         }
  85
  86         /*
  87          * Array of message id of each target
  88          */
  89         msgid = ch_calloc( sizeof( int ), li->ntargets );
  90         if ( msgid == NULL ) {
  91                 rs->sr_err = LDAP_OTHER;
  92                 send_ldap_result( op, rs );
  93                 return -1;
  94         }
  95
  96         dc.conn = op->o_conn;
  97         dc.rs = rs;
  98
  99         /*
 100          * Inits searches
 101          */
 102         for ( i = 0, lsc = lc->mc_conns; !META_LAST( lsc ); ++i, ++lsc ) {
 103                 struct berval   realbase = op->o_req_dn;
 104                 int             realscope = op->ors_scope;
 105                 ber_len_t       suffixlen = 0;
 106                 struct berval   mbase = BER_BVNULL;
 107                 struct berval   mfilter = BER_BVNULL;
 108                 char            **mapped_attrs = NULL;
 109
 110                 if ( lsc->msc_candidate != META_CANDIDATE ) {
 111                         msgid[ i ] = -1;
 112                         continue;
 113                 }
 114
 115                 /* should we check return values? */
 116                 if ( op->ors_deref != -1 ) {
 117                         ldap_set_option( lsc->msc_ld, LDAP_OPT_DEREF,
 118                                         ( void * )&op->ors_deref);
 119                 }
 120                 if ( op->ors_tlimit != SLAP_NO_LIMIT ) {
 121                         ldap_set_option( lsc->msc_ld, LDAP_OPT_TIMELIMIT,
 122                                         ( void * )&op->ors_tlimit);
 123                 }
 124                 if ( op->ors_slimit != SLAP_NO_LIMIT ) {
 125                         ldap_set_option( lsc->msc_ld, LDAP_OPT_SIZELIMIT,
 126                                         ( void * )&op->ors_slimit);
 127                 }
 128
 129                 dc.rwmap = &li->targets[ i ]->mt_rwmap;
 130
 131                 /*
 132                  * modifies the base according to the scope, if required
 133                  */
 134                 suffixlen = li->targets[ i ]->mt_nsuffix.bv_len;
 135                 if ( suffixlen > op->o_req_ndn.bv_len ) {
 136                         switch ( op->ors_scope ) {
 137                         case LDAP_SCOPE_SUBTREE:
 138                                 /*
 139                                  * make the target suffix the new base
 140                                  * FIXME: this is very forgiving, because
 141                                  * illegal bases may be turned into
 142                                  * the suffix of the target.
 143                                  */
 144                                 if ( dnIsSuffix( &li->targets[ i ]->mt_nsuffix,
 145                                                 &op->o_req_ndn ) ) {
 146                                         realbase = li->targets[ i ]->mt_nsuffix;
 147                                         is_scope++;
 148
 149                                 } else {
 150                                         /*
 151                                          * this target is no longer candidate
 152                                          */
 153                                         msgid[ i ] = -1;
 154                                         goto new_candidate;
 155                                 }
 156                                 break;
 157
 158                         case LDAP_SCOPE_ONELEVEL:
 159                         {
 160                                 struct berval   rdn = li->targets[ i ]->mt_nsuffix;
 161                                 rdn.bv_len -= op->o_req_ndn.bv_len + STRLENOF( "," );
 162                                 if ( dnIsOneLevelRDN( &rdn )
 163                                                 && dnIsSuffix( &li->targets[ i ]->mt_nsuffix, &op->o_req_ndn ) )
 164                                 {
 165                                         /*
 166                                          * if there is exactly one level,
 167                                          * make the target suffix the new
 168                                          * base, and make scope "base"
 169                                          */
 170                                         realbase = li->targets[ i ]->mt_nsuffix;
 171                                         realscope = LDAP_SCOPE_BASE;
 172                                         is_scope++;
 173                                         break;
 174                                 } /* else continue with the next case */
 175                         }
 176
 177                         case LDAP_SCOPE_BASE:
 178                                 /*
 179                                  * this target is no longer candidate
 180                                  */
 181                                 msgid[ i ] = -1;
 182                                 goto new_candidate;
 183                         }
 184
 185                 } else {
 186                         is_scope++;
 187                 }
 188
 189                 /*
 190                  * Rewrite the search base, if required
 191                  */
 192                 dc.ctx = "searchBase";
 193                 switch ( ldap_back_dn_massage( &dc, &realbase, &mbase ) ) {
 194                 default:
 195                         break;
 196
 197                 case REWRITE_REGEXEC_UNWILLING:
 198                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 199                         rs->sr_text = "Operation not allowed";
 200                         send_ldap_result( op, rs );
 201                         rc = -1;
 202                         goto finish;
 203
 204                 case REWRITE_REGEXEC_ERR:
 205 #if 0
 206                         rs->sr_err = LDAP_OTHER;
 207                         rs->sr_text = "Rewrite error";
 208                         send_ldap_result( op, rs );
 209                         rc = -1;
 210                         goto finish;
 211 #endif
 212
 213                         /*
 214                          * this target is no longer candidate
 215                          */
 216                         msgid[ i ] = -1;
 217                         goto new_candidate;
 218                 }
 219
 220                 /*
 221                  * Maps filter
 222                  */
 223                 rc = ldap_back_filter_map_rewrite( &dc,
 224                                 op->ors_filter,
 225                                 &mfilter, BACKLDAP_MAP );
 226                 switch ( rc ) {
 227                 case LDAP_SUCCESS:
 228                         is_filter++;
 229                         break;
 230
 231                 case LDAP_COMPARE_FALSE:
 232                         rc = 0;
 233
 234                 default:
 235                         /*
 236                          * this target is no longer candidate
 237                          */
 238                         msgid[ i ] = -1;
 239                         goto new_candidate;
 240                 }
 241
 242                 /*
 243                  * Maps required attributes
 244                  */
 245                 rc = ldap_back_map_attrs( &li->targets[ i ]->mt_rwmap.rwm_at,
 246                                 op->ors_attrs, BACKLDAP_MAP,
 247                                 &mapped_attrs );
 248                 if ( rc != LDAP_SUCCESS ) {
 249                         /*
 250                          * this target is no longer candidate
 251                          */
 252                         msgid[ i ] = -1;
 253                         goto new_candidate;
 254                 }
 255
 256                 /*
 257                  * Starts the search
 258                  */
 259                 rc = ldap_search_ext( lsc->msc_ld,
 260                                 mbase.bv_val, realscope, mfilter.bv_val,
 261                                 mapped_attrs, op->ors_attrsonly,
 262                                 op->o_ctrls, NULL,
 263                                 NULL, op->ors_slimit, &msgid[ i ] );
 264                 if ( mapped_attrs ) {
 265                         free( mapped_attrs );
 266                         mapped_attrs = NULL;
 267                 }
 268                 if ( mfilter.bv_val != op->ors_filterstr.bv_val ) {
 269                         free( mfilter.bv_val );
 270                         BER_BVZERO( &mfilter );
 271                 }
 272                 if ( mbase.bv_val != realbase.bv_val ) {
 273                         free( mbase.bv_val );
 274                         BER_BVZERO( &mbase );
 275                 }
 276
 277                 if ( rc != LDAP_SUCCESS ) {
 278                         continue;
 279                 }
 280
 281                 ++candidates;
 282
 283 new_candidate:;
 284         }
 285
 286         initial_candidates = candidates;
 287
 288         /* We pull apart the ber result, stuff it into a slapd entry, and
 289          * let send_search_entry stuff it back into ber format. Slow & ugly,
 290          * but this is necessary for version matching, and for ACL processing.
 291          */
 292
 293
 294         /*
 295          * In case there are no candidates, no cycle takes place...
 296          *
 297          * FIXME: we might use a queue, to balance the load
 298          * among the candidates
 299          */
 300         for ( rc = 0; candidates > 0; ) {
 301                 int ab, gotit = 0;
 302
 303                 /* check for abandon */
 304                 ab = op->o_abandon;
 305
 306                 for ( i = 0, lsc = lc->mc_conns; !META_LAST( lsc ); lsc++, i++ ) {
 307                         if ( msgid[ i ] == -1 ) {
 308                                 continue;
 309                         }
 310
 311                         if ( ab ) {
 312                                 ldap_abandon_ext( lsc->msc_ld, msgid[ i ], NULL, NULL );
 313                                 rc = 0;
 314                                 break;
 315                         }
 316
 317                         if ( op->ors_slimit > 0
 318                                         && rs->sr_nentries == op->ors_slimit ) {
 319                                 rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
 320                                 rs->sr_v2ref = v2refs;
 321                                 send_ldap_result( op, rs );
 322                                 goto finish;
 323                         }
 324
 325                         /*
 326                          * FIXME: handle time limit as well?
 327                          * Note that target servers are likely
 328                          * to handle it, so at some time we'll
 329                          * get a LDAP_TIMELIMIT_EXCEEDED from
 330                          * one of them ...
 331                          */
 332                         rc = ldap_result( lsc->msc_ld, msgid[ i ],
 333                                         0, &tv, &res );
 334
 335                         if ( rc == 0 ) {
 336                                 /* timeout exceeded */
 337
 338                                 /* FIXME: res should not need to be freed */
 339                                 assert( res == NULL );
 340
 341                                 continue;
 342
 343                         } else if ( rc == -1 ) {
 344 really_bad:;
 345                                 /* something REALLY bad happened! */
 346                                 ( void )meta_clear_unused_candidates( li,
 347                                                 lc, -1, 0 );
 348                                 rs->sr_err = LDAP_OTHER;
 349                                 rs->sr_v2ref = v2refs;
 350                                 send_ldap_result( op, rs );
 351
 352                                 /* anything else needs be done? */
 353
 354                                 /* FIXME: res should not need to be freed */
 355                                 assert( res == NULL );
 356
 357                                 goto finish;
 358
 359                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 360                                 e = ldap_first_entry( lsc->msc_ld, res );
 361                                 meta_send_entry( op, rs, lc, i, e );
 362
 363                                 ldap_msgfree( res );
 364                                 res = NULL;
 365
 366                                 /*
 367                                  * If scope is BASE, we need to jump out
 368                                  * as soon as one entry is found; if
 369                                  * the target pool is properly crafted,
 370                                  * this should correspond to the sole
 371                                  * entry that has the base DN
 372                                  */
 373                                 if ( op->ors_scope == LDAP_SCOPE_BASE
 374                                                 && rs->sr_nentries > 0 ) {
 375                                         candidates = 0;
 376                                         sres = LDAP_SUCCESS;
 377                                         break;
 378                                 }
 379
 380                                 gotit = 1;
 381
 382                         } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 383                                 char            **references = NULL;
 384                                 int             cnt;
 385
 386                                 rc = ldap_parse_reference( lsc->msc_ld, res,
 387                                                 &references, &rs->sr_ctrls, 1 );
 388                                 res = NULL;
 389
 390                                 if ( rc != LDAP_SUCCESS ) {
 391                                         continue;
 392                                 }
 393
 394                                 if ( references == NULL ) {
 395                                         continue;
 396                                 }
 397
 398 #ifdef ENABLE_REWRITE
 399                                 dc.ctx = "referralDN";
 400 #else /* ! ENABLE_REWRITE */
 401                                 dc.tofrom = 0;
 402                                 dc.normalized = 0;
 403 #endif /* ! ENABLE_REWRITE */
 404                                 for ( cnt = 0; references[ cnt ]; cnt++ )
 405                                         ;
 406
 407                                 rs->sr_ref = ch_calloc( sizeof( struct berval ), cnt + 1 );
 408
 409                                 for ( cnt = 0; references[ cnt ]; cnt++ ) {
 410                                         ber_str2bv( references[ cnt ], 0, 1, &rs->sr_ref[ cnt ] );
 411                                 }
 412                                 BER_BVZERO( &rs->sr_ref[ cnt ] );
 413
 414                                 ( void )ldap_back_referral_result_rewrite( &dc, rs->sr_ref );
 415
 416                                 if ( rs->sr_ref != NULL && !BER_BVISNULL( &rs->sr_ref[ 0 ] ) ) {
 417                                         /* ignore return value by now */
 418                                         ( void )send_search_reference( op, rs );
 419
 420                                         ber_bvarray_free( rs->sr_ref );
 421                                         rs->sr_ref = NULL;
 422                                 }
 423
 424                                 /* cleanup */
 425                                 if ( references ) {
 426                                         ldap_value_free( references );
 427                                 }
 428
 429                                 if ( rs->sr_ctrls ) {
 430                                         ldap_controls_free( rs->sr_ctrls );
 431                                         rs->sr_ctrls = NULL;
 432                                 }
 433
 434                         } else {
 435                                 if ( ldap_parse_result( lsc->msc_ld, res,
 436                                                         &rs->sr_err,
 437                                                         NULL, NULL, NULL, NULL, 1 ) )
 438                                 {
 439                                         res = NULL;
 440                                         goto really_bad;
 441                                 }
 442                                 res = NULL;
 443
 444                                 sres = slap_map_api2result( rs );
 445                                 if ( err != NULL ) {
 446                                         free( err );
 447                                 }
 448                                 ldap_get_option( lsc->msc_ld,
 449                                                 LDAP_OPT_ERROR_STRING, &err );
 450                                 if ( match.bv_val != NULL ) {
 451                                         free( match.bv_val );
 452                                 }
 453                                 ldap_get_option( lsc->msc_ld,
 454                                                 LDAP_OPT_MATCHED_DN, &match.bv_val );
 455
 456                                 Debug( LDAP_DEBUG_ANY,
 457                                         "=>meta_back_search [%d] "
 458                                         "match=\"%s\" err=\"%s\"\n",
 459                                         i, match.bv_val, err );
 460                                 candidate_match++;
 461                                 last = i;
 462                                 rc = 0;
 463
 464                                 /*
 465                                  * When no candidates are left,
 466                                  * the outer cycle finishes
 467                                  */
 468                                 msgid[ i ] = -1;
 469                                 --candidates;
 470                         }
 471                 }
 472
 473                 if ( ab ) {
 474                         goto finish;
 475                 }
 476
 477                 if ( gotit == 0 ) {
 478                         tv.tv_sec = 0;
 479                         tv.tv_usec = 100000;    /* 0.1 s */
 480                         ldap_pvt_thread_yield();
 481
 482                 } else {
 483                         tv.tv_sec = 0;
 484                         tv.tv_usec = 0;
 485                 }
 486         }
 487
 488         if ( rc == -1 ) {
 489                 /*
 490                  * FIXME: need a strategy to handle errors
 491                  */
 492                 rc = meta_back_op_result( lc, op, rs );
 493                 goto finish;
 494         }
 495
 496         /*
 497          * Rewrite the matched portion of the search base, if required
 498          *
 499          * FIXME: only the last one gets caught!
 500          */
 501         if ( candidate_match == initial_candidates
 502                         && match.bv_val != NULL && *match.bv_val ) {
 503                 dc.ctx = "matchedDN";
 504                 dc.rwmap = &li->targets[ last ]->mt_rwmap;
 505
 506                 if ( ldap_back_dn_massage( &dc, &match, &mmatch ) ) {
 507                         mmatch.bv_val = NULL;
 508                 }
 509         }
 510
 511         /*
 512          * In case we returned at least one entry, we return LDAP_SUCCESS
 513          * otherwise, the latter error code we got
 514          *
 515          * FIXME: we should handle error codes and return the more
 516          * important/reasonable
 517          */
 518         if ( is_scope == 0 ) {
 519                 sres = LDAP_NO_SUCH_OBJECT;
 520         }
 521
 522         if ( sres == LDAP_SUCCESS && v2refs ) {
 523                 sres = LDAP_REFERRAL;
 524         }
 525         rs->sr_err = sres;
 526         rs->sr_matched = mmatch.bv_val;
 527         rs->sr_v2ref = v2refs;
 528         send_ldap_result( op, rs );
 529         rs->sr_matched = NULL;
 530         rs->sr_v2ref = NULL;
 531
 532
 533 finish:;
 534         if ( match.bv_val ) {
 535                 if ( mmatch.bv_val != match.bv_val ) {
 536                         free( mmatch.bv_val );
 537                 }
 538                 free( match.bv_val );
 539         }
 540
 541         if ( err ) {
 542                 free( err );
 543         }
 544
 545         if ( msgid ) {
 546                 ch_free( msgid );
 547         }
 548
 549         return rc;
 550 }
 551
 552 static int
 553 meta_send_entry(
 554                 Operation       *op,
 555                 SlapReply       *rs,
 556                 struct metaconn *lc,
 557                 int             target,
 558                 LDAPMessage     *e
 559 )
 560 {
 561         struct metainfo         *li = ( struct metainfo * )op->o_bd->be_private;
 562         struct berval           a, mapped;
 563         Entry                   ent = {0};
 564         BerElement              ber = *e->lm_ber;
 565         Attribute               *attr, **attrp;
 566         struct berval           *bv, bdn;
 567         const char              *text;
 568         dncookie                dc;
 569
 570         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 571                 return LDAP_DECODING_ERROR;
 572         }
 573
 574         /*
 575          * Rewrite the dn of the result, if needed
 576          */
 577         dc.rwmap = &li->targets[ target ]->mt_rwmap;
 578         dc.conn = op->o_conn;
 579         dc.rs = rs;
 580         dc.ctx = "searchResult";
 581
 582         rs->sr_err = ldap_back_dn_massage( &dc, &bdn, &ent.e_name );
 583         if ( rs->sr_err != LDAP_SUCCESS) {
 584                 return rs->sr_err;
 585         }
 586
 587         /*
 588          * Note: this may fail if the target host(s) schema differs
 589          * from the one known to the meta, and a DN with unknown
 590          * attributes is returned.
 591          *
 592          * FIXME: should we log anything, or delegate to dnNormalize?
 593          */
 594         if ( dnNormalize( 0, NULL, NULL, &ent.e_name, &ent.e_nname,
 595                 op->o_tmpmemctx ) != LDAP_SUCCESS )
 596         {
 597                 return LDAP_INVALID_DN_SYNTAX;
 598         }
 599
 600         /*
 601          * cache dn
 602          */
 603         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 604                 ( void )meta_dncache_update_entry( &li->cache,
 605                                 &ent.e_nname, target );
 606         }
 607
 608         attrp = &ent.e_attrs;
 609
 610         dc.ctx = "searchAttrDN";
 611         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 612                 int             last = 0;
 613
 614                 ldap_back_map( &li->targets[ target ]->mt_rwmap.rwm_at,
 615                                 &a, &mapped, BACKLDAP_REMAP );
 616                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0' ) {
 617                         continue;
 618                 }
 619                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 620                 if ( attr == NULL ) {
 621                         continue;
 622                 }
 623                 attr->a_flags = 0;
 624                 attr->a_next = 0;
 625                 attr->a_desc = NULL;
 626                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 627                                 != LDAP_SUCCESS) {
 628                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 629                                         != LDAP_SUCCESS) {
 630                                 Debug( LDAP_DEBUG_ANY,
 631                                                 "slap_bv2undef_ad(%s): "
 632                                                 "%s\n%s", mapped.bv_val, text, "" );
 633                                 ch_free( attr );
 634                                 continue;
 635                         }
 636                 }
 637
 638                 /* no subschemaSubentry */
 639                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 640
 641                         /*
 642                          * We eat target's subschemaSubentry because
 643                          * a search for this value is likely not
 644                          * to resolve to the appropriate backend;
 645                          * later, the local subschemaSubentry is
 646                          * added.
 647                          */
 648                         ( void )ber_scanf( &ber, "x" /* [W] */ );
 649
 650                         ch_free(attr);
 651                         continue;
 652                 }
 653
 654                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 655                                 || attr->a_vals == NULL ) {
 656                         attr->a_vals = (struct berval *)&slap_dummy_bv;
 657
 658                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 659                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 660
 661                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 662
 663                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 664                                 ldap_back_map( &li->targets[ target ]->mt_rwmap.rwm_oc,
 665                                                 bv, &mapped, BACKLDAP_REMAP );
 666                                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 667                                         free( bv->bv_val );
 668                                         bv->bv_val = NULL;
 669                                         if ( --last < 0 ) {
 670                                                 break;
 671                                         }
 672                                         *bv = attr->a_vals[ last ];
 673                                         attr->a_vals[ last ].bv_val = NULL;
 674                                         bv--;
 675
 676                                 } else if ( mapped.bv_val != bv->bv_val ) {
 677                                         free( bv->bv_val );
 678                                         ber_dupbv( bv, &mapped );
 679                                 }
 680                         }
 681                 /*
 682                  * It is necessary to try to rewrite attributes with
 683                  * dn syntax because they might be used in ACLs as
 684                  * members of groups; since ACLs are applied to the
 685                  * rewritten stuff, no dn-based subecj clause could
 686                  * be used at the ldap backend side (see
 687                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 688                  * The problem can be overcome by moving the dn-based
 689                  * ACLs to the target directory server, and letting
 690                  * everything pass thru the ldap backend.
 691                  */
 692                 } else if ( attr->a_desc->ad_type->sat_syntax ==
 693                                 slap_schema.si_syn_distinguishedName )
 694                 {
 695                         ldap_dnattr_result_rewrite( &dc, attr->a_vals );
 696
 697                 } else if ( attr->a_desc == slap_schema.si_ad_ref ) {
 698                         ldap_back_referral_result_rewrite( &dc, attr->a_vals );
 699                 }
 700
 701                 if ( last && attr->a_desc->ad_type->sat_equality &&
 702                         attr->a_desc->ad_type->sat_equality->smr_normalize ) {
 703                         int i;
 704
 705                         attr->a_nvals = ch_malloc((last + 1)*sizeof(struct berval));
 706                         for ( i = 0; i<last; i++ ) {
 707                                 attr->a_desc->ad_type->sat_equality->smr_normalize(
 708                                         SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
 709                                         attr->a_desc->ad_type->sat_syntax,
 710                                         attr->a_desc->ad_type->sat_equality,
 711                                         &attr->a_vals[i], &attr->a_nvals[i],
 712                                         NULL );
 713                         }
 714                         attr->a_nvals[i].bv_val = NULL;
 715                         attr->a_nvals[i].bv_len = 0;
 716                 } else {
 717                         attr->a_nvals = attr->a_vals;
 718                 }
 719
 720                 *attrp = attr;
 721                 attrp = &attr->a_next;
 722         }
 723         rs->sr_entry = &ent;
 724         rs->sr_attrs = op->ors_attrs;
 725         rs->sr_flags = 0;
 726         send_search_entry( op, rs );
 727         rs->sr_entry = NULL;
 728         rs->sr_attrs = NULL;
 729         while ( ent.e_attrs ) {
 730                 attr = ent.e_attrs;
 731                 ent.e_attrs = attr->a_next;
 732                 if ( attr->a_vals != &slap_dummy_bv ) {
 733                         ber_bvarray_free( attr->a_vals );
 734                 }
 735                 free( attr );
 736         }
 737
 738         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 739                 free( ent.e_dn );
 740         }
 741         if ( ent.e_ndn ) {
 742                 free( ent.e_ndn );
 743         }
 744
 745         return LDAP_SUCCESS;
 746 }
 747
 748