git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /*
   2  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   3  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   4  *
   5  * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
   6  *
   7  * This work has been developed to fulfill the requirements
   8  * of SysNet s.n.c. <http:www.sys-net.it> and it has been donated
   9  * to the OpenLDAP Foundation in the hope that it may be useful
  10  * to the Open Source community, but WITHOUT ANY WARRANTY.
  11  *
  12  * Permission is granted to anyone to use this software for any purpose
  13  * on any computer system, and to alter it and redistribute it, subject
  14  * to the following restrictions:
  15  *
  16  * 1. The author and SysNet s.n.c. are not responsible for the consequences
  17  *    of use of this software, no matter how awful, even if they arise from
  18  *    flaws in it.
  19  *
  20  * 2. The origin of this software must not be misrepresented, either by
  21  *    explicit claim or by omission.  Since few users ever read sources,
  22  *    credits should appear in the documentation.
  23  *
  24  * 3. Altered versions must be plainly marked as such, and must not be
  25  *    misrepresented as being the original software.  Since few users
  26  *    ever read sources, credits should appear in the documentation.
  27  *    SysNet s.n.c. cannot be responsible for the consequences of the
  28  *    alterations.
  29  *
  30  * 4. This notice may not be removed or altered.
  31  *
  32  *
  33  * This software is based on the backend back-ldap, implemented
  34  * by Howard Chu <hyc@highlandsun.com>, and modified by Mark Valence
  35  * <kurash@sassafras.com>, Pierangelo Masarati <ando@sys-net.it> and other
  36  * contributors. The contribution of the original software to the present
  37  * implementation is acknowledged in this copyright statement.
  38  *
  39  * A special acknowledgement goes to Howard for the overall architecture
  40  * (and for borrowing large pieces of code), and to Mark, who implemented
  41  * from scratch the attribute/objectclass mapping.
  42  *
  43  * The original copyright statement follows.
  44  *
  45  * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
  46  *
  47  * Permission is granted to anyone to use this software for any purpose
  48  * on any computer system, and to alter it and redistribute it, subject
  49  * to the following restrictions:
  50  *
  51  * 1. The author is not responsible for the consequences of use of this
  52  *    software, no matter how awful, even if they arise from flaws in it.
  53  *
  54  * 2. The origin of this software must not be misrepresented, either by
  55  *    explicit claim or by omission.  Since few users ever read sources,
  56  *    credits should appear in the documentation.
  57  *
  58  * 3. Altered versions must be plainly marked as such, and must not be
  59  *    misrepresented as being the original software.  Since few users
  60  *    ever read sources, credits should appear in the
  61  *    documentation.
  62  *
  63  * 4. This notice may not be removed or altered.
  64  *
  65  */
  66
  67 #include "portable.h"
  68
  69 #include <stdio.h>
  70
  71 #include <ac/socket.h>
  72 #include <ac/string.h>
  73 #include <ac/time.h>
  74
  75 #include "slap.h"
  76 #include "../back-ldap/back-ldap.h"
  77 #include "back-meta.h"
  78 #include "ldap_pvt.h"
  79 #undef ldap_debug       /* silence a warning in ldap-int.h */
  80 #include "ldap_log.h"
  81 #include "../../../libraries/libldap/ldap-int.h"
  82
  83 static int
  84 meta_send_entry(
  85                 Operation       *op,
  86                 SlapReply       *rs,
  87                 struct metaconn *lc,
  88                 int             i,
  89                 LDAPMessage     *e
  90 );
  91
  92 static int
  93 is_one_level_rdn(
  94                 const char      *rdn,
  95                 int             from
  96 );
  97
  98 int
  99 meta_back_search( Operation *op, SlapReply *rs )
 100 {
 101         struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
 102         struct metaconn *lc;
 103         struct metasingleconn *lsc;
 104         struct timeval  tv = { 0, 0 };
 105         LDAPMessage     *res, *e;
 106         int     count, rc = 0, *msgid, sres = LDAP_NO_SUCH_OBJECT;
 107         char *match = NULL, *err = NULL;
 108         char *mbase = NULL, *mmatch = NULL;
 109         struct berval mfilter;
 110         BerVarray v2refs = NULL;
 111
 112         int i, last = 0, candidates = 0;
 113         struct slap_limits_set *limit = NULL;
 114         int isroot = 0;
 115
 116 #ifdef LDAP_CACHING
 117         cache_manager*  cm = li->cm;
 118
 119         if (cm->caching) {
 120                 return meta_back_cache_search(op->o_bd, op->o_conn, op,
 121                                 &op->o_req_dn, &op->o_req_ndn,
 122                                 op->oq_search.rs_scope,
 123                                 op->oq_search.rs_deref,
 124                                 op->oq_search.rs_slimit,
 125                                 op->oq_search.rs_tlimit,
 126                                 op->oq_search.rs_filter,
 127                                 &op->oq_search.rs_filterstr,
 128                                 op->oq_search.rs_attrs,
 129                                 op->oq_search.rs_attrsonly);
 130         }
 131 #endif /* LDAP_CACHING */
 132
 133         /*
 134          * controls are set in ldap_back_dobind()
 135          *
 136          * FIXME: in case of values return filter, we might want
 137          * to map attrs and maybe rewrite value
 138          */
 139         lc = meta_back_getconn( li, op, rs, META_OP_ALLOW_MULTIPLE,
 140                         &op->o_req_ndn, NULL );
 141         if ( !lc ) {
 142                 send_ldap_result( op, rs );
 143                 return -1;
 144         }
 145
 146         if ( !meta_back_dobind( lc, op ) ) {
 147                 rs->sr_err = LDAP_OTHER;
 148                 send_ldap_result( op, rs );
 149                 return -1;
 150         }
 151
 152         /*
 153          * Array of message id of each target
 154          */
 155         msgid = ch_calloc( sizeof( int ), li->ntargets );
 156         if ( msgid == NULL ) {
 157                 rs->sr_err = LDAP_OTHER;
 158                 send_ldap_result( op, rs );
 159                 return -1;
 160         }
 161
 162         /* if not root, get appropriate limits */
 163         if ( be_isroot( op->o_bd, &op->o_ndn ) ) {
 164                 isroot = 1;
 165         } else {
 166                 ( void ) get_limits( op->o_bd, &op->o_ndn, &limit );
 167         }
 168
 169         /* if no time limit requested, rely on remote server limits */
 170         /* if requested limit higher than hard limit, abort */
 171         if ( !isroot && op->oq_search.rs_tlimit > limit->lms_t_hard ) {
 172                 /* no hard limit means use soft instead */
 173                 if ( limit->lms_t_hard == 0
 174                                 && limit->lms_t_soft > -1
 175                                 && op->oq_search.rs_tlimit > limit->lms_t_soft ) {
 176                         op->oq_search.rs_tlimit = limit->lms_t_soft;
 177
 178                 /* positive hard limit means abort */
 179                 } else if ( limit->lms_t_hard > 0 ) {
 180                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 181                         send_ldap_result( op, rs );
 182                         rc = 0;
 183                         goto finish;
 184                 }
 185
 186                 /* negative hard limit means no limit */
 187         }
 188
 189         /* if no size limit requested, rely on remote server limits */
 190         /* if requested limit higher than hard limit, abort */
 191         if ( !isroot && op->oq_search.rs_slimit > limit->lms_s_hard ) {
 192                 /* no hard limit means use soft instead */
 193                 if ( limit->lms_s_hard == 0
 194                                 && limit->lms_s_soft > -1
 195                                 && op->oq_search.rs_slimit > limit->lms_s_soft ) {
 196                         op->oq_search.rs_slimit = limit->lms_s_soft;
 197
 198                 /* positive hard limit means abort */
 199                 } else if ( limit->lms_s_hard > 0 ) {
 200                         rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
 201                         send_ldap_result( op, rs );
 202                         rc = 0;
 203                         goto finish;
 204                 }
 205
 206                 /* negative hard limit means no limit */
 207         }
 208
 209         /*
 210          * Inits searches
 211          */
 212         for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
 213                 char    *realbase = ( char * )op->o_req_dn.bv_val;
 214                 int     realscope = op->oq_search.rs_scope;
 215                 ber_len_t suffixlen;
 216                 char    **mapped_attrs;
 217
 218                 if ( lsc->candidate != META_CANDIDATE ) {
 219                         msgid[ i ] = -1;
 220                         continue;
 221                 }
 222
 223                 /* should we check return values? */
 224                 if ( op->oq_search.rs_deref != -1 ) {
 225                         ldap_set_option( lsc->ld, LDAP_OPT_DEREF,
 226                                         ( void * )&op->oq_search.rs_deref);
 227                 }
 228                 if ( op->oq_search.rs_tlimit != -1 ) {
 229                         ldap_set_option( lsc->ld, LDAP_OPT_TIMELIMIT,
 230                                         ( void * )&op->oq_search.rs_tlimit);
 231                 }
 232                 if ( op->oq_search.rs_slimit != -1 ) {
 233                         ldap_set_option( lsc->ld, LDAP_OPT_SIZELIMIT,
 234                                         ( void * )&op->oq_search.rs_slimit);
 235                 }
 236
 237                 /*
 238                  * modifies the base according to the scope, if required
 239                  */
 240                 suffixlen = li->targets[ i ]->suffix.bv_len;
 241                 if ( suffixlen > op->o_req_ndn.bv_len ) {
 242                         switch ( op->oq_search.rs_scope ) {
 243                         case LDAP_SCOPE_SUBTREE:
 244                                 /*
 245                                  * make the target suffix the new base
 246                                  * FIXME: this is very forgiving, because
 247                                  * illegal bases may be turned into
 248                                  * the suffix of the target.
 249                                  */
 250                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 251                                                 &op->o_req_ndn ) ) {
 252                                         realbase = li->targets[ i ]->suffix.bv_val;
 253                                 } else {
 254                                         /*
 255                                          * this target is no longer candidate
 256                                          */
 257                                         msgid[ i ] = -1;
 258                                         goto new_candidate;
 259                                 }
 260                                 break;
 261
 262                         case LDAP_SCOPE_ONELEVEL:
 263                                 if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 264                                                 suffixlen - op->o_req_ndn.bv_len - 1 )
 265                         && dnIsSuffix( &li->targets[ i ]->suffix, &op->o_req_ndn ) ) {
 266                                         /*
 267                                          * if there is exactly one level,
 268                                          * make the target suffix the new
 269                                          * base, and make scope "base"
 270                                          */
 271                                         realbase = li->targets[ i ]->suffix.bv_val;
 272                                         realscope = LDAP_SCOPE_BASE;
 273                                         break;
 274                                 } /* else continue with the next case */
 275
 276                         case LDAP_SCOPE_BASE:
 277                                 /*
 278                                  * this target is no longer candidate
 279                                  */
 280                                 msgid[ i ] = -1;
 281                                 goto new_candidate;
 282                         }
 283
 284                 }
 285
 286                 /*
 287                  * Rewrite the search base, if required
 288                  */
 289                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 290                                         "searchBase",
 291                                         realbase, op->o_conn, &mbase ) ) {
 292                 case REWRITE_REGEXEC_OK:
 293                 if ( mbase == NULL ) {
 294                         mbase = realbase;
 295                 }
 296 #ifdef NEW_LOGGING
 297                 LDAP_LOG( BACK_META, DETAIL1,
 298                         "[rw] searchBase [%d]: \"%s\" -> \"%s\"\n",
 299                         i, op->o_req_dn.bv_val, mbase );
 300 #else /* !NEW_LOGGING */
 301                 Debug( LDAP_DEBUG_ARGS,
 302                         "rw> searchBase [%d]: \"%s\" -> \"%s\"\n",
 303                                 i, op->o_req_dn.bv_val, mbase );
 304 #endif /* !NEW_LOGGING */
 305                 break;
 306
 307                 case REWRITE_REGEXEC_UNWILLING:
 308                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 309                         rs->sr_text = "Operation not allowed";
 310                         send_ldap_result( op, rs );
 311                         rc = -1;
 312                         goto finish;
 313
 314                 case REWRITE_REGEXEC_ERR:
 315                         rs->sr_err = LDAP_OTHER;
 316                         rs->sr_text = "rewrite error";
 317                         send_ldap_result( op, rs );
 318                         rc = -1;
 319                         goto finish;
 320                 }
 321
 322 #if 0
 323                 /*
 324                  * Rewrite the search filter, if required
 325                  */
 326                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 327                                         "searchFilter",
 328                                         filterstr->bv_val, conn, &mfilter.bv_val ) ) {
 329                 case REWRITE_REGEXEC_OK:
 330                         if ( mfilter.bv_val != NULL && mfilter.bv_val[ 0 ] != '\0') {
 331                                 mfilter.bv_len = strlen( mfilter.bv_val );
 332                         } else {
 333                                 if ( mfilter.bv_val != NULL ) {
 334                                         free( mfilter.bv_val );
 335                                 }
 336                                 mfilter = *filterstr;
 337                         }
 338 #ifdef NEW_LOGGING
 339                         LDAP_LOG( BACK_META, DETAIL1,
 340                                 "[rw] searchFilter [%d]: \"%s\" -> \"%s\"\n",
 341                                 i, filterstr->bv_val, mfilter.bv_val );
 342 #else /* !NEW_LOGGING */
 343                         Debug( LDAP_DEBUG_ARGS,
 344                                 "rw> searchFilter [%d]: \"%s\" -> \"%s\"\n",
 345                                 i, filterstr->bv_val, mfilter.bv_val );
 346 #endif /* !NEW_LOGGING */
 347                         break;
 348
 349                 case REWRITE_REGEXEC_UNWILLING:
 350                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 351                                         NULL, "Operation not allowed",
 352                                         NULL, NULL );
 353                         rc = -1;
 354                         goto finish;
 355
 356                 case REWRITE_REGEXEC_ERR:
 357                         send_ldap_result( conn, op, LDAP_OTHER,
 358                                         NULL, "Rewrite error", NULL, NULL );
 359                         rc = -1;
 360                         goto finish;
 361                 }
 362
 363                 /*
 364                  * Maps attributes in filter
 365                  */
 366                 mapped_filter = ldap_back_map_filter( &li->targets[ i ]->at_map,
 367                                 &li->targets[ i ]->oc_map, &mfilter,
 368                                 BACKLDAP_MAP );
 369                 if ( mapped_filter == NULL ) {
 370                         mapped_filter = ( char * )mfilter.bv_val;
 371                 } else {
 372                         if ( mfilter.bv_val != filterstr->bv_val ) {
 373                                 free( mfilter.bv_val );
 374                         }
 375                 }
 376                 mfilter.bv_val = NULL;
 377                 mfilter.bv_len = 0;
 378 #endif
 379
 380                 rc = ldap_back_filter_map_rewrite_( li->targets[ i ]->rwinfo,
 381                                 op->o_conn,
 382                                 &li->targets[ i ]->at_map,
 383                                 &li->targets[ i ]->oc_map,
 384                                 op->oq_search.rs_filter,
 385                                 &mfilter, BACKLDAP_MAP );
 386
 387                 /*
 388                  * Maps required attributes
 389                  */
 390                 mapped_attrs = ldap_back_map_attrs( &li->targets[ i ]->at_map,
 391                                 op->oq_search.rs_attrs, BACKLDAP_MAP );
 392                 if ( mapped_attrs == NULL && op->oq_search.rs_attrs) {
 393                         for ( count = 0; op->oq_search.rs_attrs[ count ].an_name.bv_val; count++ );
 394                         mapped_attrs = ch_malloc( ( count + 1 ) * sizeof(char *));
 395                         for ( count = 0; op->oq_search.rs_attrs[ count ].an_name.bv_val; count++ ) {
 396                                 mapped_attrs[ count ] = op->oq_search.rs_attrs[ count ].an_name.bv_val;
 397                         }
 398                         mapped_attrs[ count ] = NULL;
 399                 }
 400
 401                 /*
 402                  * Starts the search
 403                  */
 404                 msgid[ i ] = ldap_search( lsc->ld, mbase, realscope,
 405                                 mfilter.bv_val, mapped_attrs,
 406                                 op->oq_search.rs_attrsonly );
 407                 if ( mapped_attrs ) {
 408                         free( mapped_attrs );
 409                         mapped_attrs = NULL;
 410                 }
 411                 if ( mfilter.bv_val != op->oq_search.rs_filterstr.bv_val ) {
 412                         free( mfilter.bv_val );
 413                         mfilter.bv_val = NULL;
 414                 }
 415                 if ( mbase != realbase ) {
 416                         free( mbase );
 417                         mbase = NULL;
 418                 }
 419
 420                 if ( msgid[ i ] == -1 ) {
 421                         continue;
 422                 }
 423
 424                 ++candidates;
 425
 426 new_candidate:;
 427         }
 428
 429         /* We pull apart the ber result, stuff it into a slapd entry, and
 430          * let send_search_entry stuff it back into ber format. Slow & ugly,
 431          * but this is necessary for version matching, and for ACL processing.
 432          */
 433
 434
 435         /*
 436          * In case there are no candidates, no cycle takes place...
 437          *
 438          * FIXME: we might use a queue, to balance the load
 439          * among the candidates
 440          */
 441         for ( rc = 0; candidates > 0; ) {
 442                 int ab, gotit = 0;
 443
 444                 /* check for abandon */
 445                 ab = op->o_abandon;
 446
 447                 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); lsc++, i++ ) {
 448                         if ( msgid[ i ] == -1 ) {
 449                                 continue;
 450                         }
 451
 452                         if ( ab ) {
 453                                 ldap_abandon( lsc->ld, msgid[ i ] );
 454                                 rc = 0;
 455                                 break;
 456                         }
 457
 458                         if ( op->oq_search.rs_slimit > 0
 459                                         && rs->sr_nentries == op->oq_search.rs_slimit ) {
 460                                 rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
 461                                 rs->sr_v2ref = v2refs;
 462                                 send_ldap_result( op, rs );
 463                                 goto finish;
 464                         }
 465
 466                         /*
 467                          * FIXME: handle time limit as well?
 468                          * Note that target servers are likely
 469                          * to handle it, so at some time we'll
 470                          * get a LDAP_TIMELIMIT_EXCEEDED from
 471                          * one of them ...
 472                          */
 473                         rc = ldap_result( lsc->ld, msgid[ i ],
 474                                         0, &tv, &res );
 475
 476                         if ( rc == 0 ) {
 477                                 continue;
 478
 479                         } else if ( rc == -1 ) {
 480                                 /* something REALLY bad happened! */
 481                                 ( void )meta_clear_unused_candidates( li,
 482                                                 lc, -1, 0 );
 483                                 rs->sr_err = LDAP_OTHER;
 484                                 rs->sr_v2ref = v2refs;
 485                                 send_ldap_result( op, rs );
 486
 487                                 /* anything else needs be done? */
 488                                 goto finish;
 489
 490                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 491                                 e = ldap_first_entry( lsc->ld, res );
 492                                 meta_send_entry( op, rs, lc, i, e );
 493
 494                                 /*
 495                                  * If scope is BASE, we need to jump out
 496                                  * as soon as one entry is found; if
 497                                  * the target pool is properly crafted,
 498                                  * this should correspond to the sole
 499                                  * entry that has the base DN
 500                                  */
 501                                 if ( op->oq_search.rs_scope == LDAP_SCOPE_BASE
 502                                                 && rs->sr_nentries > 0 ) {
 503                                         candidates = 0;
 504                                         sres = LDAP_SUCCESS;
 505                                         break;
 506                                 }
 507                                 ldap_msgfree( res );
 508                                 gotit = 1;
 509
 510                         } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 511                                 char            **references = NULL;
 512                                 int             cnt;
 513
 514                                 /*
 515                                  * FIXME: should we collect references
 516                                  * and send them alltogether at the end?
 517                                  */
 518
 519                                 rc = ldap_parse_reference( lsc->ld, res,
 520                                                 &references, &rs->sr_ctrls, 1 );
 521
 522                                 if ( rc != LDAP_SUCCESS ) {
 523                                         continue;
 524                                 }
 525
 526                                 if ( references == NULL ) {
 527                                         continue;
 528                                 }
 529
 530                                 for ( cnt = 0; references[ cnt ]; cnt++ )
 531                                         /* NO OP */ ;
 532
 533                                 rs->sr_ref = ch_calloc( cnt + 1, sizeof( struct berval ) );
 534
 535                                 for ( cnt = 0; references[ cnt ]; cnt++ ) {
 536                                         rs->sr_ref[ cnt ].bv_val = references[ cnt ];
 537                                         rs->sr_ref[ cnt ].bv_len = strlen( references[ cnt ] );
 538                                 }
 539
 540                                 /* ignore return value by now */
 541                                 ( void )send_search_reference( op, rs );
 542
 543                                 /* cleanup */
 544                                 if ( references ) {
 545                                         ldap_value_free( references );
 546                                         ch_free( rs->sr_ref );
 547                                         rs->sr_ref = NULL;
 548                                 }
 549
 550                                 if ( rs->sr_ctrls ) {
 551                                         ldap_controls_free( rs->sr_ctrls );
 552                                         rs->sr_ctrls = NULL;
 553                                 }
 554
 555                         } else {
 556                                 sres = ldap_result2error( lsc->ld,
 557                                                 res, 1 );
 558                                 sres = ldap_back_map_result( sres );
 559                                 if ( err != NULL ) {
 560                                         free( err );
 561                                 }
 562                                 ldap_get_option( lsc->ld,
 563                                                 LDAP_OPT_ERROR_STRING, &err );
 564                                 if ( match != NULL ) {
 565                                         free( match );
 566                                 }
 567                                 ldap_get_option( lsc->ld,
 568                                                 LDAP_OPT_MATCHED_DN, &match );
 569
 570 #ifdef NEW_LOGGING
 571                                 LDAP_LOG( BACK_META, ERR,
 572                                         "meta_back_search [%d] "
 573                                         "match=\"%s\" err=\"%s\"\n",
 574                                         i, match, err );
 575 #else /* !NEW_LOGGING */
 576                                 Debug( LDAP_DEBUG_ANY,
 577                                         "=>meta_back_search [%d] "
 578                                         "match=\"%s\" err=\"%s\"\n",
 579                                         i, match, err );
 580 #endif /* !NEW_LOGGING */
 581
 582                                 last = i;
 583                                 rc = 0;
 584
 585                                 /*
 586                                  * When no candidates are left,
 587                                  * the outer cycle finishes
 588                                  */
 589                                 msgid[ i ] = -1;
 590                                 --candidates;
 591                         }
 592                 }
 593
 594                 if ( ab ) {
 595                         goto finish;
 596                 }
 597
 598                 if ( gotit == 0 ) {
 599                         tv.tv_sec = 0;
 600                         tv.tv_usec = 100000;
 601                         ldap_pvt_thread_yield();
 602                 } else {
 603                         tv.tv_sec = 0;
 604                         tv.tv_usec = 0;
 605                 }
 606         }
 607
 608         if ( rc == -1 ) {
 609                 /*
 610                  * FIXME: need a strategy to handle errors
 611                  */
 612                 rc = meta_back_op_result( lc, op, rs );
 613                 goto finish;
 614         }
 615
 616         /*
 617          * Rewrite the matched portion of the search base, if required
 618          *
 619          * FIXME: only the last one gets caught!
 620          */
 621         if ( match != NULL ) {
 622                 switch ( rewrite_session( li->targets[ last ]->rwinfo,
 623                                         "matchedDn", match, op->o_conn,
 624                                         &mmatch ) ) {
 625                 case REWRITE_REGEXEC_OK:
 626                         if ( mmatch == NULL ) {
 627                                 mmatch = ( char * )match;
 628                         }
 629 #ifdef NEW_LOGGING
 630                         LDAP_LOG( BACK_META, DETAIL1,
 631                                 "[rw] matchedDn: \"%s\" -> \"%s\"\n",
 632                                 match, mmatch, 0 );
 633 #else /* !NEW_LOGGING */
 634                         Debug( LDAP_DEBUG_ARGS,
 635                                 "rw> matchedDn: \"%s\" -> \"%s\"\n",
 636                                 match, mmatch, 0 );
 637 #endif /* !NEW_LOGGING */
 638                         break;
 639
 640                 case REWRITE_REGEXEC_UNWILLING:
 641
 642                 case REWRITE_REGEXEC_ERR:
 643                         /* FIXME: no error, but no matched ... */
 644                         mmatch = NULL;
 645                         break;
 646                 }
 647         }
 648
 649         /*
 650          * In case we returned at least one entry, we return LDAP_SUCCESS
 651          * otherwise, the latter error code we got
 652          *
 653          * FIXME: we should handle error codes and return the more
 654          * important/reasonable
 655          */
 656         if ( sres == LDAP_SUCCESS && v2refs ) {
 657                 sres = LDAP_REFERRAL;
 658         }
 659         rs->sr_err = sres;
 660         rs->sr_matched = mmatch;
 661         rs->sr_v2ref = v2refs;
 662         send_ldap_result( op, rs );
 663         rs->sr_matched = NULL;
 664         rs->sr_v2ref = NULL;
 665
 666
 667 finish:;
 668         if ( match ) {
 669                 if ( mmatch != match ) {
 670                         free( mmatch );
 671                 }
 672                 free(match);
 673         }
 674
 675         if ( err ) {
 676                 free( err );
 677         }
 678
 679         if ( msgid ) {
 680                 ch_free( msgid );
 681         }
 682
 683         return rc;
 684 }
 685
 686 static int
 687 meta_send_entry(
 688                 Operation       *op,
 689                 SlapReply       *rs,
 690                 struct metaconn *lc,
 691                 int             target,
 692                 LDAPMessage     *e
 693 )
 694 {
 695         struct metainfo         *li = ( struct metainfo * )op->o_bd->be_private;
 696         struct berval           a, mapped;
 697         Entry                   ent;
 698         BerElement              ber = *e->lm_ber;
 699         Attribute               *attr, **attrp;
 700         struct berval           dummy = { 0, NULL };
 701         struct berval           *bv, bdn;
 702         const char              *text;
 703
 704         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 705                 return LDAP_DECODING_ERROR;
 706         }
 707
 708         /*
 709          * Rewrite the dn of the result, if needed
 710          */
 711         switch ( rewrite_session( li->targets[ target ]->rwinfo,
 712                                 "searchResult", bdn.bv_val, lc->conn,
 713                                 &ent.e_name.bv_val ) ) {
 714         case REWRITE_REGEXEC_OK:
 715                 if ( ent.e_name.bv_val == NULL ) {
 716                         ent.e_name = bdn;
 717
 718                 } else {
 719 #ifdef NEW_LOGGING
 720                         LDAP_LOG( BACK_META, DETAIL1,
 721                                 "[rw] searchResult[%d]: \"%s\" -> \"%s\"\n",
 722                                 target, bdn.bv_val, ent.e_name.bv_val );
 723 #else /* !NEW_LOGGING */
 724                         Debug( LDAP_DEBUG_ARGS, "rw> searchResult[%d]: \"%s\""
 725                                         " -> \"%s\"\n", target, bdn.bv_val,
 726                                         ent.e_name.bv_val );
 727 #endif /* !NEW_LOGGING */
 728                         ent.e_name.bv_len = strlen( ent.e_name.bv_val );
 729                 }
 730                 break;
 731
 732         case REWRITE_REGEXEC_UNWILLING:
 733                 return LDAP_UNWILLING_TO_PERFORM;
 734
 735         case REWRITE_REGEXEC_ERR:
 736                 return LDAP_OTHER;
 737         }
 738
 739         /*
 740          * Note: this may fail if the target host(s) schema differs
 741          * from the one known to the meta, and a DN with unknown
 742          * attributes is returned.
 743          *
 744          * FIXME: should we log anything, or delegate to dnNormalize2?
 745          */
 746         if ( dnNormalize2( NULL, &ent.e_name, &ent.e_nname ) != LDAP_SUCCESS ) {
 747                 return LDAP_INVALID_DN_SYNTAX;
 748         }
 749
 750         /*
 751          * cache dn
 752          */
 753         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 754                 ( void )meta_dncache_update_entry( &li->cache,
 755                                                    &ent.e_nname,
 756                                                    target );
 757         }
 758
 759         ent.e_id = 0;
 760         ent.e_attrs = 0;
 761         ent.e_private = 0;
 762         attrp = &ent.e_attrs;
 763
 764         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 765                 ldap_back_map( &li->targets[ target ]->at_map,
 766                                 &a, &mapped, BACKLDAP_REMAP );
 767                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0' ) {
 768                         continue;
 769                 }
 770                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 771                 if ( attr == NULL ) {
 772                         continue;
 773                 }
 774                 attr->a_flags = 0;
 775                 attr->a_next = 0;
 776                 attr->a_desc = NULL;
 777                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 778                                 != LDAP_SUCCESS) {
 779                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 780                                         != LDAP_SUCCESS) {
 781 #ifdef NEW_LOGGING
 782                                 LDAP_LOG( BACK_META, DETAIL1,
 783                                         "slap_bv2undef_ad(%s): %s\n", mapped.bv_val, text, 0 );
 784 #else /* !NEW_LOGGING */
 785                                 Debug( LDAP_DEBUG_ANY,
 786                                                 "slap_bv2undef_ad(%s): "
 787                                                 "%s\n%s", mapped.bv_val, text, "" );
 788 #endif /* !NEW_LOGGING */
 789                                 ch_free( attr );
 790                                 continue;
 791                         }
 792                 }
 793
 794                 /* no subschemaSubentry */
 795                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 796                         ch_free(attr);
 797                         continue;
 798                 }
 799
 800                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 801                                 || attr->a_vals == NULL ) {
 802                         attr->a_vals = &dummy;
 803
 804                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 805                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 806                         int             last;
 807
 808                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 809
 810                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 811                                 ldap_back_map( &li->targets[ target]->oc_map,
 812                                                 bv, &mapped, BACKLDAP_REMAP );
 813                                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 814                                         free( bv->bv_val );
 815                                         bv->bv_val = NULL;
 816                                         if ( --last < 0 ) {
 817                                                 break;
 818                                         }
 819                                         *bv = attr->a_vals[ last ];
 820                                         attr->a_vals[ last ].bv_val = NULL;
 821                                         bv--;
 822
 823                                 } else if ( mapped.bv_val != bv->bv_val ) {
 824                                         free( bv->bv_val );
 825                                         ber_dupbv( bv, &mapped );
 826                                 }
 827                         }
 828                 /*
 829                  * It is necessary to try to rewrite attributes with
 830                  * dn syntax because they might be used in ACLs as
 831                  * members of groups; since ACLs are applied to the
 832                  * rewritten stuff, no dn-based subecj clause could
 833                  * be used at the ldap backend side (see
 834                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 835                  * The problem can be overcome by moving the dn-based
 836                  * ACLs to the target directory server, and letting
 837                  * everything pass thru the ldap backend.
 838                  */
 839                 } else if ( strcmp( attr->a_desc->ad_type->sat_syntax->ssyn_oid,
 840                                         SLAPD_DN_SYNTAX ) == 0 ) {
 841                         int             last;
 842
 843                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 844
 845                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 846                                 char *newval;
 847
 848                                 switch ( rewrite_session( li->targets[ target ]->rwinfo,
 849                                                         "searchResult",
 850                                                         bv->bv_val,
 851                                                         lc->conn, &newval )) {
 852                                 case REWRITE_REGEXEC_OK:
 853                                         /* left as is */
 854                                         if ( newval == NULL ) {
 855                                                 break;
 856                                         }
 857 #ifdef NEW_LOGGING
 858                                         LDAP_LOG( BACK_META, DETAIL1,
 859                                                 "[rw] searchResult on attr=%s: \"%s\" -> \"%s\"\n",
 860                                                 attr->a_desc->ad_type->sat_cname.bv_val,
 861                                                 bv->bv_val, newval );
 862 #else /* !NEW_LOGGING */
 863                                         Debug( LDAP_DEBUG_ARGS,
 864                                                 "rw> searchResult on attr=%s:"
 865                                                 " \"%s\" -> \"%s\"\n",
 866                                         attr->a_desc->ad_type->sat_cname.bv_val,
 867                                                 bv->bv_val, newval );
 868 #endif /* !NEW_LOGGING */
 869                                         free( bv->bv_val );
 870                                         bv->bv_val = newval;
 871                                         bv->bv_len = strlen( newval );
 872
 873                                         break;
 874
 875                                 case REWRITE_REGEXEC_UNWILLING:
 876                                         LBER_FREE(bv->bv_val);
 877                                         bv->bv_val = NULL;
 878                                         if (--last < 0)
 879                                                 goto next_attr;
 880                                         *bv = attr->a_vals[last];
 881                                         attr->a_vals[last].bv_val = NULL;
 882                                         bv--;
 883                                         break;
 884
 885                                 case REWRITE_REGEXEC_ERR:
 886                                         /*
 887                                          * FIXME: better give up,
 888                                          * skip the attribute
 889                                          * or leave it untouched?
 890                                          */
 891                                         break;
 892                                 }
 893                         }
 894                 }
 895 next_attr:;
 896
 897                 *attrp = attr;
 898                 attrp = &attr->a_next;
 899         }
 900         rs->sr_entry = &ent;
 901         rs->sr_attrs = op->oq_search.rs_attrs;
 902         send_search_entry( op, rs );
 903         rs->sr_entry = NULL;
 904         rs->sr_attrs = NULL;
 905         while ( ent.e_attrs ) {
 906                 attr = ent.e_attrs;
 907                 ent.e_attrs = attr->a_next;
 908                 if ( attr->a_vals != &dummy ) {
 909                         ber_bvarray_free( attr->a_vals );
 910                 }
 911                 free( attr );
 912         }
 913
 914         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 915                 free( ent.e_dn );
 916         }
 917         if ( ent.e_ndn ) {
 918                 free( ent.e_ndn );
 919         }
 920
 921         return LDAP_SUCCESS;
 922 }
 923
 924 static int
 925 is_one_level_rdn(
 926                 const char      *rdn,
 927                 int             from
 928 )
 929 {
 930         for ( ; from--; ) {
 931                 if ( DN_SEPARATOR( rdn[ from ] ) ) {
 932                         return 0;
 933                 }
 934         }
 935
 936         return 1;
 937 }
 938