git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /*
   2  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   3  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   4  *
   5  * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
   6  *
   7  * This work has been developed to fulfill the requirements
   8  * of SysNet s.n.c. <http:www.sys-net.it> and it has been donated
   9  * to the OpenLDAP Foundation in the hope that it may be useful
  10  * to the Open Source community, but WITHOUT ANY WARRANTY.
  11  *
  12  * Permission is granted to anyone to use this software for any purpose
  13  * on any computer system, and to alter it and redistribute it, subject
  14  * to the following restrictions:
  15  *
  16  * 1. The author and SysNet s.n.c. are not responsible for the consequences
  17  *    of use of this software, no matter how awful, even if they arise from
  18  *    flaws in it.
  19  *
  20  * 2. The origin of this software must not be misrepresented, either by
  21  *    explicit claim or by omission.  Since few users ever read sources,
  22  *    credits should appear in the documentation.
  23  *
  24  * 3. Altered versions must be plainly marked as such, and must not be
  25  *    misrepresented as being the original software.  Since few users
  26  *    ever read sources, credits should appear in the documentation.
  27  *    SysNet s.n.c. cannot be responsible for the consequences of the
  28  *    alterations.
  29  *
  30  * 4. This notice may not be removed or altered.
  31  *
  32  *
  33  * This software is based on the backend back-ldap, implemented
  34  * by Howard Chu <hyc@highlandsun.com>, and modified by Mark Valence
  35  * <kurash@sassafras.com>, Pierangelo Masarati <ando@sys-net.it> and other
  36  * contributors. The contribution of the original software to the present
  37  * implementation is acknowledged in this copyright statement.
  38  *
  39  * A special acknowledgement goes to Howard for the overall architecture
  40  * (and for borrowing large pieces of code), and to Mark, who implemented
  41  * from scratch the attribute/objectclass mapping.
  42  *
  43  * The original copyright statement follows.
  44  *
  45  * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
  46  *
  47  * Permission is granted to anyone to use this software for any purpose
  48  * on any computer system, and to alter it and redistribute it, subject
  49  * to the following restrictions:
  50  *
  51  * 1. The author is not responsible for the consequences of use of this
  52  *    software, no matter how awful, even if they arise from flaws in it.
  53  *
  54  * 2. The origin of this software must not be misrepresented, either by
  55  *    explicit claim or by omission.  Since few users ever read sources,
  56  *    credits should appear in the documentation.
  57  *
  58  * 3. Altered versions must be plainly marked as such, and must not be
  59  *    misrepresented as being the original software.  Since few users
  60  *    ever read sources, credits should appear in the
  61  *    documentation.
  62  *
  63  * 4. This notice may not be removed or altered.
  64  *
  65  */
  66
  67 #include "portable.h"
  68
  69 #include <stdio.h>
  70
  71 #include <ac/socket.h>
  72 #include <ac/string.h>
  73 #include <ac/time.h>
  74
  75 #include "slap.h"
  76 #include "../back-ldap/back-ldap.h"
  77 #include "back-meta.h"
  78 #include "ldap_pvt.h"
  79 #undef ldap_debug       /* silence a warning in ldap-int.h */
  80 #include "ldap_log.h"
  81 #include "../../../libraries/libldap/ldap-int.h"
  82
  83 static int
  84 meta_send_entry(
  85                 Operation       *op,
  86                 SlapReply       *rs,
  87                 struct metaconn *lc,
  88                 int             i,
  89                 LDAPMessage     *e
  90 );
  91
  92 static int
  93 is_one_level_rdn(
  94                 const char      *rdn,
  95                 int             from
  96 );
  97
  98 int
  99 meta_back_search( Operation *op, SlapReply *rs )
 100 {
 101         struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
 102         struct metaconn *lc;
 103         struct metasingleconn *lsc;
 104         struct timeval  tv = { 0, 0 };
 105         LDAPMessage     *res, *e;
 106         int     rc = 0, *msgid, sres = LDAP_NO_SUCH_OBJECT;
 107         char *err = NULL;
 108         struct berval match = { 0, NULL }, mmatch = { 0, NULL };
 109         BerVarray v2refs = NULL;
 110
 111         int i, last = 0, candidates = 0, initial_candidates = 0,
 112                         candidate_match = 0;
 113         struct slap_limits_set *limit = NULL;
 114         int isroot = 0;
 115         dncookie dc;
 116
 117 #ifdef LDAP_CACHING
 118         cache_manager*  cm = li->cm;
 119
 120         if (cm->caching) {
 121                 return meta_back_cache_search(op->o_bd, op->o_conn, op,
 122                                 &op->o_req_dn, &op->o_req_ndn,
 123                                 op->oq_search.rs_scope,
 124                                 op->oq_search.rs_deref,
 125                                 op->oq_search.rs_slimit,
 126                                 op->oq_search.rs_tlimit,
 127                                 op->oq_search.rs_filter,
 128                                 &op->oq_search.rs_filterstr,
 129                                 op->oq_search.rs_attrs,
 130                                 op->oq_search.rs_attrsonly);
 131         }
 132 #endif /* LDAP_CACHING */
 133
 134         /*
 135          * controls are set in ldap_back_dobind()
 136          *
 137          * FIXME: in case of values return filter, we might want
 138          * to map attrs and maybe rewrite value
 139          */
 140         lc = meta_back_getconn( op, rs, META_OP_ALLOW_MULTIPLE,
 141                         &op->o_req_ndn, NULL );
 142         if ( !lc ) {
 143                 send_ldap_result( op, rs );
 144                 return -1;
 145         }
 146
 147         if ( !meta_back_dobind( lc, op ) ) {
 148                 rs->sr_err = LDAP_OTHER;
 149                 send_ldap_result( op, rs );
 150                 return -1;
 151         }
 152
 153         /*
 154          * Array of message id of each target
 155          */
 156         msgid = ch_calloc( sizeof( int ), li->ntargets );
 157         if ( msgid == NULL ) {
 158                 rs->sr_err = LDAP_OTHER;
 159                 send_ldap_result( op, rs );
 160                 return -1;
 161         }
 162
 163         /* if not root, get appropriate limits */
 164         if ( be_isroot( op->o_bd, &op->o_ndn ) ) {
 165                 isroot = 1;
 166         } else {
 167                 ( void ) get_limits( op->o_bd, &op->o_ndn, &limit );
 168         }
 169
 170         /* if no time limit requested, rely on remote server limits */
 171         /* if requested limit higher than hard limit, abort */
 172         if ( !isroot && op->oq_search.rs_tlimit > limit->lms_t_hard ) {
 173                 /* no hard limit means use soft instead */
 174                 if ( limit->lms_t_hard == 0
 175                                 && limit->lms_t_soft > -1
 176                                 && op->oq_search.rs_tlimit > limit->lms_t_soft ) {
 177                         op->oq_search.rs_tlimit = limit->lms_t_soft;
 178
 179                 /* positive hard limit means abort */
 180                 } else if ( limit->lms_t_hard > 0 ) {
 181                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 182                         send_ldap_result( op, rs );
 183                         rc = 0;
 184                         goto finish;
 185                 }
 186
 187                 /* negative hard limit means no limit */
 188         }
 189
 190         /* if no size limit requested, rely on remote server limits */
 191         /* if requested limit higher than hard limit, abort */
 192         if ( !isroot && op->oq_search.rs_slimit > limit->lms_s_hard ) {
 193                 /* no hard limit means use soft instead */
 194                 if ( limit->lms_s_hard == 0
 195                                 && limit->lms_s_soft > -1
 196                                 && op->oq_search.rs_slimit > limit->lms_s_soft ) {
 197                         op->oq_search.rs_slimit = limit->lms_s_soft;
 198
 199                 /* positive hard limit means abort */
 200                 } else if ( limit->lms_s_hard > 0 ) {
 201                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 202                         send_ldap_result( op, rs );
 203                         rc = 0;
 204                         goto finish;
 205                 }
 206
 207                 /* negative hard limit means no limit */
 208         }
 209
 210
 211         dc.conn = op->o_conn;
 212         dc.rs = rs;
 213
 214         /*
 215          * Inits searches
 216          */
 217         for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
 218                 struct berval   realbase = op->o_req_dn;
 219                 int             realscope = op->oq_search.rs_scope;
 220                 ber_len_t       suffixlen = 0;
 221                 struct berval   mbase = { 0, NULL };
 222                 struct berval   mfilter = { 0, NULL };
 223                 char            **mapped_attrs = NULL;
 224
 225                 if ( lsc->candidate != META_CANDIDATE ) {
 226                         msgid[ i ] = -1;
 227                         continue;
 228                 }
 229
 230                 /* should we check return values? */
 231                 if ( op->oq_search.rs_deref != -1 ) {
 232                         ldap_set_option( lsc->ld, LDAP_OPT_DEREF,
 233                                         ( void * )&op->oq_search.rs_deref);
 234                 }
 235                 if ( op->oq_search.rs_tlimit != -1 ) {
 236                         ldap_set_option( lsc->ld, LDAP_OPT_TIMELIMIT,
 237                                         ( void * )&op->oq_search.rs_tlimit);
 238                 }
 239                 if ( op->oq_search.rs_slimit != -1 ) {
 240                         ldap_set_option( lsc->ld, LDAP_OPT_SIZELIMIT,
 241                                         ( void * )&op->oq_search.rs_slimit);
 242                 }
 243
 244                 dc.rwmap = &li->targets[ i ]->rwmap;
 245
 246                 /*
 247                  * modifies the base according to the scope, if required
 248                  */
 249                 suffixlen = li->targets[ i ]->suffix.bv_len;
 250                 if ( suffixlen > op->o_req_ndn.bv_len ) {
 251                         switch ( op->oq_search.rs_scope ) {
 252                         case LDAP_SCOPE_SUBTREE:
 253                                 /*
 254                                  * make the target suffix the new base
 255                                  * FIXME: this is very forgiving, because
 256                                  * illegal bases may be turned into
 257                                  * the suffix of the target.
 258                                  */
 259                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 260                                                 &op->o_req_ndn ) ) {
 261                                         realbase = li->targets[ i ]->suffix;
 262                                 } else {
 263                                         /*
 264                                          * this target is no longer candidate
 265                                          */
 266                                         msgid[ i ] = -1;
 267                                         goto new_candidate;
 268                                 }
 269                                 break;
 270
 271                         case LDAP_SCOPE_ONELEVEL:
 272                                 if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 273                                                 suffixlen - op->o_req_ndn.bv_len - 1 )
 274                         && dnIsSuffix( &li->targets[ i ]->suffix, &op->o_req_ndn ) ) {
 275                                         /*
 276                                          * if there is exactly one level,
 277                                          * make the target suffix the new
 278                                          * base, and make scope "base"
 279                                          */
 280                                         realbase = li->targets[ i ]->suffix;
 281                                         realscope = LDAP_SCOPE_BASE;
 282                                         break;
 283                                 } /* else continue with the next case */
 284
 285                         case LDAP_SCOPE_BASE:
 286                                 /*
 287                                  * this target is no longer candidate
 288                                  */
 289                                 msgid[ i ] = -1;
 290                                 goto new_candidate;
 291                         }
 292
 293                 }
 294
 295                 /*
 296                  * Rewrite the search base, if required
 297                  */
 298                 dc.ctx = "searchBase";
 299                 switch ( ldap_back_dn_massage( &dc, &realbase, &mbase ) ) {
 300                 default:
 301                         break;
 302
 303                 case REWRITE_REGEXEC_UNWILLING:
 304                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 305                         rs->sr_text = "Operation not allowed";
 306                         send_ldap_result( op, rs );
 307                         rc = -1;
 308                         goto finish;
 309
 310                 case REWRITE_REGEXEC_ERR:
 311 #if 0
 312                         rs->sr_err = LDAP_OTHER;
 313                         rs->sr_text = "Rewrite error";
 314                         send_ldap_result( op, rs );
 315                         rc = -1;
 316                         goto finish;
 317 #endif
 318
 319                         /*
 320                          * this target is no longer candidate
 321                          */
 322                         msgid[ i ] = -1;
 323                         goto new_candidate;
 324                 }
 325
 326                 /*
 327                  * Maps filter
 328                  */
 329                 rc = ldap_back_filter_map_rewrite( &dc,
 330                                 op->oq_search.rs_filter,
 331                                 &mfilter, BACKLDAP_MAP );
 332                 if ( rc != 0 ) {
 333                         /*
 334                          * this target is no longer candidate
 335                          */
 336                         msgid[ i ] = -1;
 337                         goto new_candidate;
 338                 }
 339
 340                 /*
 341                  * Maps required attributes
 342                  */
 343                 rc = ldap_back_map_attrs( &li->targets[ i ]->rwmap.rwm_at,
 344                                 op->oq_search.rs_attrs, BACKLDAP_MAP,
 345                                 &mapped_attrs );
 346                 if ( rc != LDAP_SUCCESS ) {
 347                         /*
 348                          * this target is no longer candidate
 349                          */
 350                         msgid[ i ] = -1;
 351                         goto new_candidate;
 352                 }
 353
 354                 /*
 355                  * Starts the search
 356                  */
 357                 msgid[ i ] = ldap_search( lsc->ld, mbase.bv_val, realscope,
 358                                 mfilter.bv_val, mapped_attrs,
 359                                 op->oq_search.rs_attrsonly );
 360                 if ( mapped_attrs ) {
 361                         free( mapped_attrs );
 362                         mapped_attrs = NULL;
 363                 }
 364                 if ( mfilter.bv_val != op->oq_search.rs_filterstr.bv_val ) {
 365                         free( mfilter.bv_val );
 366                         mfilter.bv_val = NULL;
 367                 }
 368                 if ( mbase.bv_val != realbase.bv_val ) {
 369                         free( mbase.bv_val );
 370                         mbase.bv_val = NULL;
 371                 }
 372
 373                 if ( msgid[ i ] == -1 ) {
 374                         continue;
 375                 }
 376
 377                 ++candidates;
 378
 379 new_candidate:;
 380         }
 381
 382         initial_candidates = candidates;
 383
 384         /* We pull apart the ber result, stuff it into a slapd entry, and
 385          * let send_search_entry stuff it back into ber format. Slow & ugly,
 386          * but this is necessary for version matching, and for ACL processing.
 387          */
 388
 389
 390         /*
 391          * In case there are no candidates, no cycle takes place...
 392          *
 393          * FIXME: we might use a queue, to balance the load
 394          * among the candidates
 395          */
 396         for ( rc = 0; candidates > 0; ) {
 397                 int ab, gotit = 0;
 398
 399                 /* check for abandon */
 400                 ab = op->o_abandon;
 401
 402                 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); lsc++, i++ ) {
 403                         if ( msgid[ i ] == -1 ) {
 404                                 continue;
 405                         }
 406
 407                         if ( ab ) {
 408                                 ldap_abandon( lsc->ld, msgid[ i ] );
 409                                 rc = 0;
 410                                 break;
 411                         }
 412
 413                         if ( op->oq_search.rs_slimit > 0
 414                                         && rs->sr_nentries == op->oq_search.rs_slimit ) {
 415                                 rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
 416                                 rs->sr_v2ref = v2refs;
 417                                 send_ldap_result( op, rs );
 418                                 goto finish;
 419                         }
 420
 421                         /*
 422                          * FIXME: handle time limit as well?
 423                          * Note that target servers are likely
 424                          * to handle it, so at some time we'll
 425                          * get a LDAP_TIMELIMIT_EXCEEDED from
 426                          * one of them ...
 427                          */
 428                         rc = ldap_result( lsc->ld, msgid[ i ],
 429                                         0, &tv, &res );
 430
 431                         if ( rc == 0 ) {
 432                                 continue;
 433
 434                         } else if ( rc == -1 ) {
 435                                 /* something REALLY bad happened! */
 436                                 ( void )meta_clear_unused_candidates( li,
 437                                                 lc, -1, 0 );
 438                                 rs->sr_err = LDAP_OTHER;
 439                                 rs->sr_v2ref = v2refs;
 440                                 send_ldap_result( op, rs );
 441
 442                                 /* anything else needs be done? */
 443                                 goto finish;
 444
 445                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 446                                 e = ldap_first_entry( lsc->ld, res );
 447                                 meta_send_entry( op, rs, lc, i, e );
 448
 449                                 /*
 450                                  * If scope is BASE, we need to jump out
 451                                  * as soon as one entry is found; if
 452                                  * the target pool is properly crafted,
 453                                  * this should correspond to the sole
 454                                  * entry that has the base DN
 455                                  */
 456                                 if ( op->oq_search.rs_scope == LDAP_SCOPE_BASE
 457                                                 && rs->sr_nentries > 0 ) {
 458                                         candidates = 0;
 459                                         sres = LDAP_SUCCESS;
 460                                         break;
 461                                 }
 462                                 ldap_msgfree( res );
 463                                 gotit = 1;
 464
 465                         } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 466                                 char            **references = NULL;
 467                                 int             cnt;
 468
 469                                 /*
 470                                  * FIXME: should we collect references
 471                                  * and send them alltogether at the end?
 472                                  */
 473
 474                                 rc = ldap_parse_reference( lsc->ld, res,
 475                                                 &references, &rs->sr_ctrls, 1 );
 476
 477                                 if ( rc != LDAP_SUCCESS ) {
 478                                         continue;
 479                                 }
 480
 481                                 if ( references == NULL ) {
 482                                         continue;
 483                                 }
 484
 485                                 for ( cnt = 0; references[ cnt ]; cnt++ )
 486                                         /* NO OP */ ;
 487
 488                                 rs->sr_ref = ch_calloc( cnt + 1, sizeof( struct berval ) );
 489
 490                                 for ( cnt = 0; references[ cnt ]; cnt++ ) {
 491                                         rs->sr_ref[ cnt ].bv_val = references[ cnt ];
 492                                         rs->sr_ref[ cnt ].bv_len = strlen( references[ cnt ] );
 493                                 }
 494
 495                                 /* ignore return value by now */
 496                                 ( void )send_search_reference( op, rs );
 497
 498                                 /* cleanup */
 499                                 if ( references ) {
 500                                         ldap_value_free( references );
 501                                         ch_free( rs->sr_ref );
 502                                         rs->sr_ref = NULL;
 503                                 }
 504
 505                                 if ( rs->sr_ctrls ) {
 506                                         ldap_controls_free( rs->sr_ctrls );
 507                                         rs->sr_ctrls = NULL;
 508                                 }
 509
 510                         } else {
 511                                 rs->sr_err = ldap_result2error( lsc->ld,
 512                                                 res, 1 );
 513                                 sres = ldap_back_map_result( rs );
 514                                 if ( err != NULL ) {
 515                                         free( err );
 516                                 }
 517                                 ldap_get_option( lsc->ld,
 518                                                 LDAP_OPT_ERROR_STRING, &err );
 519                                 if ( match.bv_val != NULL ) {
 520                                         free( match.bv_val );
 521                                 }
 522                                 ldap_get_option( lsc->ld,
 523                                                 LDAP_OPT_MATCHED_DN, &match.bv_val );
 524
 525 #ifdef NEW_LOGGING
 526                                 LDAP_LOG( BACK_META, ERR,
 527                                         "meta_back_search [%d] "
 528                                         "match=\"%s\" err=\"%s\"\n",
 529                                         i, match.bv_val, err );
 530 #else /* !NEW_LOGGING */
 531                                 Debug( LDAP_DEBUG_ANY,
 532                                         "=>meta_back_search [%d] "
 533                                         "match=\"%s\" err=\"%s\"\n",
 534                                         i, match.bv_val, err );
 535 #endif /* !NEW_LOGGING */
 536                                 candidate_match++;
 537                                 last = i;
 538                                 rc = 0;
 539
 540                                 /*
 541                                  * When no candidates are left,
 542                                  * the outer cycle finishes
 543                                  */
 544                                 msgid[ i ] = -1;
 545                                 --candidates;
 546                         }
 547                 }
 548
 549                 if ( ab ) {
 550                         goto finish;
 551                 }
 552
 553                 if ( gotit == 0 ) {
 554                         tv.tv_sec = 0;
 555                         tv.tv_usec = 100000;
 556                         ldap_pvt_thread_yield();
 557                 } else {
 558                         tv.tv_sec = 0;
 559                         tv.tv_usec = 0;
 560                 }
 561         }
 562
 563         if ( rc == -1 ) {
 564                 /*
 565                  * FIXME: need a strategy to handle errors
 566                  */
 567                 rc = meta_back_op_result( lc, op, rs );
 568                 goto finish;
 569         }
 570
 571         /*
 572          * Rewrite the matched portion of the search base, if required
 573          *
 574          * FIXME: only the last one gets caught!
 575          */
 576         if ( candidate_match == initial_candidates
 577                         && match.bv_val != NULL && *match.bv_val ) {
 578                 dc.ctx = "matchedDn";
 579                 dc.rwmap = &li->targets[ last ]->rwmap;
 580
 581                 if ( ldap_back_dn_massage( &dc, &match, &mmatch ) ) {
 582                         mmatch.bv_val = NULL;
 583                 }
 584         }
 585
 586         /*
 587          * In case we returned at least one entry, we return LDAP_SUCCESS
 588          * otherwise, the latter error code we got
 589          *
 590          * FIXME: we should handle error codes and return the more
 591          * important/reasonable
 592          */
 593         if ( sres == LDAP_SUCCESS && v2refs ) {
 594                 sres = LDAP_REFERRAL;
 595         }
 596         rs->sr_err = sres;
 597         rs->sr_matched = mmatch.bv_val;
 598         rs->sr_v2ref = v2refs;
 599         send_ldap_result( op, rs );
 600         rs->sr_matched = NULL;
 601         rs->sr_v2ref = NULL;
 602
 603
 604 finish:;
 605         if ( match.bv_val ) {
 606                 if ( mmatch.bv_val != match.bv_val ) {
 607                         free( mmatch.bv_val );
 608                 }
 609                 free( match.bv_val );
 610         }
 611
 612         if ( err ) {
 613                 free( err );
 614         }
 615
 616         if ( msgid ) {
 617                 ch_free( msgid );
 618         }
 619
 620         return rc;
 621 }
 622
 623 static int
 624 meta_send_entry(
 625                 Operation       *op,
 626                 SlapReply       *rs,
 627                 struct metaconn *lc,
 628                 int             target,
 629                 LDAPMessage     *e
 630 )
 631 {
 632         struct metainfo         *li = ( struct metainfo * )op->o_bd->be_private;
 633         struct berval           a, mapped;
 634         Entry                   ent;
 635         BerElement              ber = *e->lm_ber;
 636         Attribute               *attr, **attrp;
 637         struct berval           dummy = { 0, NULL };
 638         struct berval           *bv, bdn;
 639         const char              *text;
 640         dncookie                dc;
 641
 642         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 643                 return LDAP_DECODING_ERROR;
 644         }
 645
 646         /*
 647          * Rewrite the dn of the result, if needed
 648          */
 649         dc.rwmap = &li->targets[ target ]->rwmap;
 650         dc.conn = op->o_conn;
 651         dc.rs = rs;
 652         dc.ctx = "searchResult";
 653
 654         rs->sr_err = ldap_back_dn_massage( &dc, &bdn, &ent.e_name );
 655         if ( rs->sr_err != LDAP_SUCCESS) {
 656                 return rs->sr_err;
 657         }
 658
 659         /*
 660          * Note: this may fail if the target host(s) schema differs
 661          * from the one known to the meta, and a DN with unknown
 662          * attributes is returned.
 663          *
 664          * FIXME: should we log anything, or delegate to dnNormalize?
 665          */
 666         if ( dnNormalize( 0, NULL, NULL, &ent.e_name, &ent.e_nname,
 667                 &op->o_tmpmemctx ) != LDAP_SUCCESS )
 668         {
 669                 return LDAP_INVALID_DN_SYNTAX;
 670         }
 671
 672         /*
 673          * cache dn
 674          */
 675         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 676                 ( void )meta_dncache_update_entry( &li->cache,
 677                                 &ent.e_nname, target );
 678         }
 679
 680         ent.e_id = 0;
 681         ent.e_attrs = 0;
 682         ent.e_private = 0;
 683         attrp = &ent.e_attrs;
 684
 685         dc.ctx = "searchAttrDN";
 686         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 687                 ldap_back_map( &li->targets[ target ]->rwmap.rwm_at,
 688                                 &a, &mapped, BACKLDAP_REMAP );
 689                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0' ) {
 690                         continue;
 691                 }
 692                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 693                 if ( attr == NULL ) {
 694                         continue;
 695                 }
 696                 attr->a_flags = 0;
 697                 attr->a_next = 0;
 698                 attr->a_desc = NULL;
 699                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 700                                 != LDAP_SUCCESS) {
 701                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 702                                         != LDAP_SUCCESS) {
 703 #ifdef NEW_LOGGING
 704                                 LDAP_LOG( BACK_META, DETAIL1,
 705                                         "slap_bv2undef_ad(%s): %s\n", mapped.bv_val, text, 0 );
 706 #else /* !NEW_LOGGING */
 707                                 Debug( LDAP_DEBUG_ANY,
 708                                                 "slap_bv2undef_ad(%s): "
 709                                                 "%s\n%s", mapped.bv_val, text, "" );
 710 #endif /* !NEW_LOGGING */
 711                                 ch_free( attr );
 712                                 continue;
 713                         }
 714                 }
 715
 716                 /* no subschemaSubentry */
 717                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 718
 719                         /*
 720                          * We eat target's subschemaSubentry because
 721                          * a search for this value is likely not
 722                          * to resolve to the appropriate backend;
 723                          * later, the local subschemaSubentry is
 724                          * added.
 725                          */
 726                         ( void )ber_scanf( &ber, "x" /* [W] */ );
 727
 728                         ch_free(attr);
 729                         continue;
 730                 }
 731
 732                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 733                                 || attr->a_vals == NULL ) {
 734                         attr->a_vals = &dummy;
 735
 736                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 737                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 738                         int             last;
 739
 740                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 741
 742                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 743                                 ldap_back_map( &li->targets[ target ]->rwmap.rwm_oc,
 744                                                 bv, &mapped, BACKLDAP_REMAP );
 745                                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 746                                         free( bv->bv_val );
 747                                         bv->bv_val = NULL;
 748                                         if ( --last < 0 ) {
 749                                                 break;
 750                                         }
 751                                         *bv = attr->a_vals[ last ];
 752                                         attr->a_vals[ last ].bv_val = NULL;
 753                                         bv--;
 754
 755                                 } else if ( mapped.bv_val != bv->bv_val ) {
 756                                         free( bv->bv_val );
 757                                         ber_dupbv( bv, &mapped );
 758                                 }
 759                         }
 760                 /*
 761                  * It is necessary to try to rewrite attributes with
 762                  * dn syntax because they might be used in ACLs as
 763                  * members of groups; since ACLs are applied to the
 764                  * rewritten stuff, no dn-based subecj clause could
 765                  * be used at the ldap backend side (see
 766                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 767                  * The problem can be overcome by moving the dn-based
 768                  * ACLs to the target directory server, and letting
 769                  * everything pass thru the ldap backend.
 770                  */
 771                 } else if ( attr->a_desc->ad_type->sat_syntax ==
 772                                 slap_schema.si_syn_distinguishedName ) {
 773                         ldap_dnattr_result_rewrite( &dc, attr->a_vals );
 774                 }
 775
 776                 *attrp = attr;
 777                 attrp = &attr->a_next;
 778         }
 779         rs->sr_entry = &ent;
 780         rs->sr_attrs = op->oq_search.rs_attrs;
 781         send_search_entry( op, rs );
 782         rs->sr_entry = NULL;
 783         rs->sr_attrs = NULL;
 784         while ( ent.e_attrs ) {
 785                 attr = ent.e_attrs;
 786                 ent.e_attrs = attr->a_next;
 787                 if ( attr->a_vals != &dummy ) {
 788                         ber_bvarray_free( attr->a_vals );
 789                 }
 790                 free( attr );
 791         }
 792
 793         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 794                 free( ent.e_dn );
 795         }
 796         if ( ent.e_ndn ) {
 797                 free( ent.e_ndn );
 798         }
 799
 800         return LDAP_SUCCESS;
 801 }
 802
 803 static int
 804 is_one_level_rdn(
 805                 const char      *rdn,
 806                 int             from
 807 )
 808 {
 809         for ( ; from--; ) {
 810                 if ( DN_SEPARATOR( rdn[ from ] ) ) {
 811                         return 0;
 812                 }
 813         }
 814
 815         return 1;
 816 }
 817