git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /*
   2  * Copyright 1998-2001 The OpenLDAP Foundation, All Rights Reserved.
   3  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   4  *
   5  * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
   6  *
   7  * This work has been developed to fulfill the requirements
   8  * of SysNet s.n.c. <http:www.sys-net.it> and it has been donated
   9  * to the OpenLDAP Foundation in the hope that it may be useful
  10  * to the Open Source community, but WITHOUT ANY WARRANTY.
  11  *
  12  * Permission is granted to anyone to use this software for any purpose
  13  * on any computer system, and to alter it and redistribute it, subject
  14  * to the following restrictions:
  15  *
  16  * 1. The author and SysNet s.n.c. are not responsible for the consequences
  17  *    of use of this software, no matter how awful, even if they arise from
  18  *    flaws in it.
  19  *
  20  * 2. The origin of this software must not be misrepresented, either by
  21  *    explicit claim or by omission.  Since few users ever read sources,
  22  *    credits should appear in the documentation.
  23  *
  24  * 3. Altered versions must be plainly marked as such, and must not be
  25  *    misrepresented as being the original software.  Since few users
  26  *    ever read sources, credits should appear in the documentation.
  27  *    SysNet s.n.c. cannot be responsible for the consequences of the
  28  *    alterations.
  29  *
  30  * 4. This notice may not be removed or altered.
  31  *
  32  *
  33  * This software is based on the backend back-ldap, implemented
  34  * by Howard Chu <hyc@highlandsun.com>, and modified by Mark Valence
  35  * <kurash@sassafras.com>, Pierangelo Masarati <ando@sys-net.it> and other
  36  * contributors. The contribution of the original software to the present
  37  * implementation is acknowledged in this copyright statement.
  38  *
  39  * A special acknowledgement goes to Howard for the overall architecture
  40  * (and for borrowing large pieces of code), and to Mark, who implemented
  41  * from scratch the attribute/objectclass mapping.
  42  *
  43  * The original copyright statement follows.
  44  *
  45  * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
  46  *
  47  * Permission is granted to anyone to use this software for any purpose
  48  * on any computer system, and to alter it and redistribute it, subject
  49  * to the following restrictions:
  50  *
  51  * 1. The author is not responsible for the consequences of use of this
  52  *    software, no matter how awful, even if they arise from flaws in it.
  53  *
  54  * 2. The origin of this software must not be misrepresented, either by
  55  *    explicit claim or by omission.  Since few users ever read sources,
  56  *    credits should appear in the documentation.
  57  *
  58  * 3. Altered versions must be plainly marked as such, and must not be
  59  *    misrepresented as being the original software.  Since few users
  60  *    ever read sources, credits should appear in the
  61  *    documentation.
  62  *
  63  * 4. This notice may not be removed or altered.
  64  *
  65  */
  66
  67 #include "portable.h"
  68
  69 #include <stdio.h>
  70
  71 #include <ac/socket.h>
  72 #include <ac/string.h>
  73 #include <ac/time.h>
  74
  75 #include "slap.h"
  76 #include "../back-ldap/back-ldap.h"
  77 #include "back-meta.h"
  78 #include "ldap_pvt.h"
  79
  80 static void
  81 meta_send_entry(
  82                 Backend         *be,
  83                 Operation       *op,
  84                 struct metaconn *lc,
  85                 int             i,
  86                 LDAPMessage     *e,
  87                 AttributeName   *attrs,
  88                 int             attrsonly
  89 );
  90
  91 static int
  92 is_one_level_rdn(
  93                 const char      *rdn,
  94                 int             from
  95 );
  96
  97 int
  98 meta_back_search(
  99                 Backend         *be,
 100                 Connection      *conn,
 101                 Operation       *op,
 102                 struct berval   *base,
 103                 struct berval   *nbase,
 104                 int             scope,
 105                 int             deref,
 106                 int             slimit,
 107                 int             tlimit,
 108                 Filter          *filter,
 109                 const char      *filterstr,
 110                 AttributeName   *attrs,
 111                 int             attrsonly
 112 )
 113 {
 114         struct metainfo *li = ( struct metainfo * )be->be_private;
 115         struct metaconn *lc;
 116         struct metasingleconn **lsc;
 117         struct timeval  tv;
 118         LDAPMessage     *res, *e;
 119         int     count, rc = 0, *msgid, sres = LDAP_NO_SUCH_OBJECT;
 120         char *match = NULL, *err = NULL;
 121         char *mbase = NULL, *mfilter = NULL, *mmatch = NULL,
 122                 *mapped_filter = NULL, **mapped_attrs = NULL;
 123
 124         int i, last = 0, candidates = 0, op_type;
 125         struct slap_limits_set *limit = NULL;
 126         int isroot = 0;
 127
 128         if ( scope == LDAP_SCOPE_BASE ) {
 129                 op_type = META_OP_REQUIRE_SINGLE;
 130         } else {
 131                 op_type = META_OP_ALLOW_MULTIPLE;
 132         }
 133
 134         lc = meta_back_getconn( li, conn, op, op_type, nbase, NULL );
 135         if ( !lc || !meta_back_dobind( lc, op ) ) {
 136                 return -1;
 137         }
 138
 139         /*
 140          * Array of message id of each target
 141          */
 142         msgid = ch_calloc( sizeof( int ), li->ntargets );
 143         if ( msgid == NULL ) {
 144                 send_search_result( conn, op, LDAP_OPERATIONS_ERROR,
 145                                 NULL, NULL, NULL, NULL, 0 );
 146                 return -1;
 147         }
 148
 149         /* if not root, get appropriate limits */
 150         if ( be_isroot( be, &op->o_ndn ) ) {
 151                 isroot = 1;
 152         } else {
 153                 ( void ) get_limits( be, &op->o_ndn, &limit );
 154         }
 155
 156         /* if no time limit requested, rely on remote server limits */
 157         /* if requested limit higher than hard limit, abort */
 158         if ( !isroot && tlimit > limit->lms_t_hard ) {
 159                 /* no hard limit means use soft instead */
 160                 if ( limit->lms_t_hard == 0 ) {
 161                         tlimit = limit->lms_t_soft;
 162
 163                 /* positive hard limit means abort */
 164                 } else if ( limit->lms_t_hard > 0 ) {
 165                         send_search_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 166                                         NULL, NULL, NULL, NULL, 0 );
 167                         rc = 0;
 168                         goto finish;
 169                 }
 170
 171                 /* negative hard limit means no limit */
 172         }
 173
 174         /* if no size limit requested, rely on remote server limits */
 175         /* if requested limit higher than hard limit, abort */
 176         if ( !isroot && slimit > limit->lms_s_hard ) {
 177                 /* no hard limit means use soft instead */
 178                 if ( limit->lms_s_hard == 0 ) {
 179                         slimit = limit->lms_s_soft;
 180
 181                 /* positive hard limit means abort */
 182                 } else if ( limit->lms_s_hard > 0 ) {
 183                         send_search_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 184                                         NULL, NULL, NULL, NULL, 0 );
 185                         rc = 0;
 186                         goto finish;
 187                 }
 188
 189                 /* negative hard limit means no limit */
 190         }
 191
 192         /*
 193          * Inits searches
 194          */
 195         for ( i = 0, lsc = lc->conns; lsc[ 0 ] != NULL; ++i, ++lsc ) {
 196                 char *realbase = ( char * )base->bv_val;
 197                 int realscope = scope;
 198                 int suffixlen;
 199
 200                 if ( lsc[ 0 ]->candidate != META_CANDIDATE ) {
 201                         continue;
 202                 }
 203
 204                 if ( deref != -1 ) {
 205                         ldap_set_option( lsc[ 0 ]->ld, LDAP_OPT_DEREF,
 206                                         ( void * )&deref);
 207                 }
 208                 if ( tlimit != -1 ) {
 209                         ldap_set_option( lsc[ 0 ]->ld, LDAP_OPT_TIMELIMIT,
 210                                         ( void * )&tlimit);
 211                 }
 212                 if ( slimit != -1 ) {
 213                         ldap_set_option( lsc[ 0 ]->ld, LDAP_OPT_SIZELIMIT,
 214                                         ( void * )&slimit);
 215                 }
 216
 217                 /*
 218                  * modifies the base according to the scope, if required
 219                  */
 220                 suffixlen = li->targets[ i ]->suffix.bv_len;
 221                 if ( suffixlen > nbase->bv_len ) {
 222                         switch ( scope ) {
 223                         case LDAP_SCOPE_SUBTREE:
 224                                 /*
 225                                  * make the target suffix the new base
 226                                  * FIXME: this is very forgiving, because
 227                                  * illegal bases may be turned into
 228                                  * the suffix of the target.
 229                                  */
 230                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 231                                                 nbase ) ) {
 232                                         realbase = li->targets[ i ]->suffix.bv_val;
 233                                 } else {
 234                                         /*
 235                                          * this target is no longer candidate
 236                                          */
 237                                         lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
 238                                         continue;
 239                                 }
 240                                 break;
 241
 242                         case LDAP_SCOPE_ONELEVEL:
 243                                 if ( is_one_level_rdn( li->targets[ i ]->suffix.bv_val,
 244                                                 suffixlen - nbase->bv_len - 1 )
 245                         && dnIsSuffix( &li->targets[ i ]->suffix, nbase ) ) {
 246                                         /*
 247                                          * if there is exactly one level,
 248                                          * make the target suffix the new
 249                                          * base, and make scope "base"
 250                                          */
 251                                         realbase = li->targets[ i ]->suffix.bv_val;
 252                                         realscope = LDAP_SCOPE_BASE;
 253                                         break;
 254                                 } /* else continue with the next case */
 255
 256                         case LDAP_SCOPE_BASE:
 257                                 /*
 258                                  * this target is no longer candidate
 259                                  */
 260                                 lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
 261                                 continue;
 262                         }
 263
 264                 }
 265
 266                 /*
 267                  * Rewrite the search base, if required
 268                  */
 269                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 270                                         "searchBase",
 271                                         realbase, conn, &mbase ) ) {
 272                 case REWRITE_REGEXEC_OK:
 273                 if ( mbase == NULL ) {
 274                         mbase = realbase;
 275                 }
 276 #ifdef NEW_LOGGING
 277                 LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 278                                 "[rw] searchBase: \"%s\" -> \"%s\"\n",
 279                                 base->bv_val, mbase ));
 280 #else /* !NEW_LOGGING */
 281                 Debug( LDAP_DEBUG_ARGS, "rw> searchBase: \"%s\" -> \"%s\"\n%s",
 282                                 base->bv_val, mbase, "" );
 283 #endif /* !NEW_LOGGING */
 284                 break;
 285
 286                 case REWRITE_REGEXEC_UNWILLING:
 287                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 288                                         NULL, "Unwilling to perform",
 289                                         NULL, NULL );
 290                         rc = -1;
 291                         goto finish;
 292
 293                 case REWRITE_REGEXEC_ERR:
 294                         send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
 295                                         NULL, "Operations error",
 296                                         NULL, NULL );
 297                         rc = -1;
 298                         goto finish;
 299                 }
 300
 301                 /*
 302                  * Rewrite the search filter, if required
 303                  */
 304                 switch ( rewrite_session( li->targets[ i ]->rwinfo,
 305                                         "searchFilter",
 306                                         filterstr, conn, &mfilter ) ) {
 307                 case REWRITE_REGEXEC_OK:
 308                         if ( mfilter == NULL || mfilter[ 0 ] == '\0') {
 309                                 if ( mfilter != NULL ) {
 310                                         free( mfilter );
 311                                 }
 312                                 mfilter = ( char * )filterstr;
 313                         }
 314 #ifdef NEW_LOGGING
 315                         LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 316                                         "[rw] searchFilter: \"%s\" -> \"%s\"\n",
 317                                         filterstr, mfilter ));
 318 #else /* !NEW_LOGGING */
 319                         Debug( LDAP_DEBUG_ARGS,
 320                                 "rw> searchFilter: \"%s\" -> \"%s\"\n%s",
 321                                 filterstr, mfilter, "" );
 322 #endif /* !NEW_LOGGING */
 323                         break;
 324
 325                 case REWRITE_REGEXEC_UNWILLING:
 326                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 327                                         NULL, NULL, NULL, NULL );
 328                         rc = -1;
 329                         goto finish;
 330
 331                 case REWRITE_REGEXEC_ERR:
 332                         send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
 333                                         NULL, NULL, NULL, NULL );
 334                         rc = -1;
 335                         goto finish;
 336                 }
 337
 338                 /*
 339                  * Maps attributes in filter
 340                  */
 341                 mapped_filter = ldap_back_map_filter( &li->targets[ i ]->at_map,
 342                                 &li->targets[ i ]->oc_map,
 343                                 ( char * )mfilter, 0 );
 344                 if ( mapped_filter == NULL ) {
 345                         mapped_filter = ( char * )mfilter;
 346                 }
 347
 348                 /*
 349                  * Maps required attributes
 350                  */
 351                 mapped_attrs = ldap_back_map_attrs( &li->targets[ i ]->at_map,
 352                                 attrs, 0 );
 353                 if ( mapped_attrs == NULL && attrs) {
 354                         AttributeName *an;
 355                         for ( count=0, an=attrs; an->an_name.bv_val; an++, count++ );
 356                         mapped_attrs = ch_malloc( ( count + 1 ) * sizeof(char *));
 357                         for ( count=0, an=attrs; an->an_name.bv_val; an++, count++ ) {
 358                                 mapped_attrs[ count ] = an->an_name.bv_val;
 359                         }
 360                         mapped_attrs[ count ] = NULL;
 361                 }
 362
 363                 /*
 364                  * Starts the search
 365                  */
 366                 msgid[ i ] = ldap_search( lsc[ 0 ]->ld, mbase, realscope,
 367                                 mapped_filter, mapped_attrs, attrsonly);
 368                 if ( msgid[ i ] == -1 ) {
 369                         lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
 370                         continue;
 371                 }
 372
 373                 if ( mapped_attrs ) {
 374                         free( mapped_attrs );
 375                         mapped_attrs = NULL;
 376                 }
 377                 if ( mapped_filter != mfilter ) {
 378                         free( mapped_filter );
 379                         mapped_filter = NULL;
 380                 }
 381                 if ( mfilter != filterstr ) {
 382                         free( mfilter );
 383                         mfilter = NULL;
 384                 }
 385                 if ( mbase != realbase ) {
 386                         free( mbase );
 387                         mbase = NULL;
 388                 }
 389
 390                 ++candidates;
 391         }
 392
 393         /* We pull apart the ber result, stuff it into a slapd entry, and
 394          * let send_search_entry stuff it back into ber format. Slow & ugly,
 395          * but this is necessary for version matching, and for ACL processing.
 396          */
 397
 398
 399         /*
 400          * In case there are no candidates, no cycle takes place...
 401          */
 402         for ( count = 0, rc = 0; candidates > 0; ) {
 403                 int ab, gotit = 0;
 404
 405                 /* check for abandon */
 406                 ldap_pvt_thread_mutex_lock( &op->o_abandonmutex );
 407                 ab = op->o_abandon;
 408                 ldap_pvt_thread_mutex_unlock( &op->o_abandonmutex );
 409
 410                 for ( i = 0, lsc = lc->conns; lsc[ 0 ] != NULL; lsc++, i++ ) {
 411                         if ( lsc[ 0 ]->candidate != META_CANDIDATE ) {
 412                                 continue;
 413                         }
 414
 415                         if ( ab ) {
 416                                 ldap_abandon( lsc[ 0 ]->ld, msgid[ i ] );
 417                                 rc = 0;
 418                                 break;
 419                         }
 420
 421                         if ( slimit > 0 && count == slimit ) {
 422                                 send_search_result( conn, op,
 423                                                 LDAP_SIZELIMIT_EXCEEDED,
 424                                                 NULL, NULL, NULL, NULL, count );
 425                                 goto finish;
 426                         }
 427
 428                         rc = ldap_result( lsc[ 0 ]->ld, msgid[ i ],
 429                                         0, &tv, &res );
 430
 431                         if ( rc == 0 ) {
 432                                 continue;
 433                         } else if ( rc == -1 ) {
 434                                 /* something REALLY bad happened! */
 435                                 ( void )meta_clear_unused_candidates( li,
 436                                                 lc, -1, 0 );
 437                                 send_search_result( conn, op,
 438                                                 LDAP_OPERATIONS_ERROR,
 439                                                 "", "", NULL, NULL, count );
 440
 441                                 /* anything else needs be done? */
 442                                 goto finish;
 443                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 444                                 e = ldap_first_entry( lsc[ 0 ]->ld,res );
 445                                 meta_send_entry(be, op, lc, i, e, attrs,
 446                                                 attrsonly);
 447                                 count++;
 448                                 ldap_msgfree( res );
 449                                 gotit = 1;
 450                         } else {
 451                                 sres = ldap_result2error( lsc[ 0 ]->ld,
 452                                                 res, 1 );
 453                                 sres = ldap_back_map_result( sres );
 454                                 if ( err != NULL ) {
 455                                         free( err );
 456                                 }
 457                                 ldap_get_option( lsc[ 0 ]->ld,
 458                                                 LDAP_OPT_ERROR_STRING, &err );
 459                                 if ( match != NULL ) {
 460                                         free( match );
 461                                 }
 462                                 ldap_get_option( lsc[ 0 ]->ld,
 463                                                 LDAP_OPT_MATCHED_DN, &match );
 464
 465 #ifdef NEW_LOGGING
 466                                 LDAP_LOG(( "backend", LDAP_LEVEL_ERR,
 467                                                 "meta_back_search [%d]"
 468                                                 " match=\"%s\" err=\"%s\"\n",
 469                                                 i, match, err ));
 470 #else /* !NEW_LOGGING */
 471                                 Debug( LDAP_DEBUG_ANY,
 472         "=>meta_back_search [%d] match=\"%s\" err=\"%s\"\n",
 473                                         i, match, err );
 474 #endif /* !NEW_LOGGING */
 475
 476                                 last = i;
 477                                 rc = 0;
 478
 479                                 /*
 480                                  * When no candidates are left,
 481                                  * the outer cycle finishes
 482                                  */
 483                                 lsc[ 0 ]->candidate = META_NOT_CANDIDATE;
 484                                 --candidates;
 485                         }
 486                 }
 487
 488                 if ( ab ) {
 489                         goto finish;
 490                 }
 491
 492                 if ( gotit == 0 ) {
 493                         tv.tv_sec = 0;
 494                         tv.tv_usec = 100000;
 495                         ldap_pvt_thread_yield();
 496                 } else {
 497                         tv.tv_sec = 0;
 498                         tv.tv_usec = 0;
 499                 }
 500         }
 501
 502         if ( rc == -1 ) {
 503                 /*
 504                  * FIXME: need a strategy to handle errors
 505                  */
 506                 rc = meta_back_op_result( lc, op );
 507                 goto finish;
 508         }
 509
 510         /*
 511          * Rewrite the matched portion of the search base, if required
 512          *
 513          * FIXME: only the last one gets caught!
 514          */
 515         if ( match != NULL ) {
 516                 switch ( rewrite_session( li->targets[ last ]->rwinfo,
 517                                         "matchedDn", match, conn, &mmatch ) ) {
 518                 case REWRITE_REGEXEC_OK:
 519                         if ( mmatch == NULL ) {
 520                                 mmatch = ( char * )match;
 521                         }
 522 #ifdef NEW_LOGGING
 523                         LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 524                                         "[rw] matchedDn: \"%s\" -> \"%s\"\n",
 525                                         match, mmatch ));
 526 #else /* !NEW_LOGGING */
 527                         Debug( LDAP_DEBUG_ARGS, "rw> matchedDn:"
 528                                        " \"%s\" -> \"%s\"\n%s",
 529                                        match, mmatch, "" );
 530 #endif /* !NEW_LOGGING */
 531                         break;
 532
 533                 case REWRITE_REGEXEC_UNWILLING:
 534                         send_ldap_result( conn, op, LDAP_UNWILLING_TO_PERFORM,
 535                                         NULL, NULL, NULL, NULL );
 536                         rc = -1;
 537                         goto finish;
 538
 539                 case REWRITE_REGEXEC_ERR:
 540                         send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
 541                                         NULL, NULL, NULL, NULL );
 542                         rc = -1;
 543                         goto finish;
 544                 }
 545         }
 546
 547         send_search_result( conn, op, sres,
 548                 mmatch, err, NULL, NULL, count );
 549
 550 finish:;
 551         if ( match ) {
 552                 if ( mmatch != match ) {
 553                         free( mmatch );
 554                 }
 555                 free(match);
 556         }
 557
 558         if ( err ) {
 559                 free( err );
 560         }
 561
 562         if ( msgid ) {
 563                 free( msgid );
 564         }
 565
 566         return rc;
 567 }
 568
 569 static void
 570 meta_send_entry(
 571                 Backend         *be,
 572                 Operation       *op,
 573                 struct metaconn *lc,
 574                 int             target,
 575                 LDAPMessage     *e,
 576                 AttributeName   *attrs,
 577                 int             attrsonly
 578 )
 579 {
 580         struct metainfo         *li = ( struct metainfo * )be->be_private;
 581         char                    *a, *mapped;
 582         Entry                   ent;
 583         BerElement              *ber = NULL;
 584         Attribute               *attr, **attrp;
 585         struct berval           *dummy = NULL;
 586         struct berval           *bv;
 587         const char              *text;
 588         char                    *dn, *edn = NULL;
 589         struct berval           tdn;
 590
 591         struct metasingleconn *lsc = lc->conns[ target ];
 592
 593         dn = ldap_get_dn( lsc->ld, e );
 594         if ( dn == NULL ) {
 595                 return;
 596         }
 597
 598         /*
 599          * Rewrite the dn of the result, if needed
 600          */
 601         switch ( rewrite_session( li->targets[ target ]->rwinfo,
 602                                 "searchResult", dn, lc->conn, &edn ) ) {
 603         case REWRITE_REGEXEC_OK:
 604                 if ( edn == NULL ) {
 605                         edn = dn;
 606
 607                 } else {
 608 #ifdef NEW_LOGGING
 609                         LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 610                                         "[rw] searchResult[%d]:"
 611                                         " \"%s\" -> \"%s\"\n",
 612                                         target, dn, edn ));
 613 #else /* !NEW_LOGGING */
 614                         Debug( LDAP_DEBUG_ARGS, "rw> searchResult[%d]: \"%s\""
 615                                         " -> \"%s\"\n", target, dn, edn );
 616 #endif /* !NEW_LOGGING */
 617                         free( dn );
 618                         dn = NULL;
 619                 }
 620                 break;
 621
 622         case REWRITE_REGEXEC_ERR:
 623         case REWRITE_REGEXEC_UNWILLING:
 624                 free( dn );
 625                 return;
 626         }
 627
 628         tdn.bv_val = edn;
 629         tdn.bv_len = strlen( edn );
 630
 631         dnPrettyNormal( NULL, &tdn, &ent.e_name, &ent.e_nname );
 632
 633         /*
 634          * cache dn
 635          */
 636         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 637                 ( void )meta_dncache_update_entry( &li->cache,
 638                                                    ber_bvdup( &ent.e_nname ),
 639                                                    target );
 640         }
 641
 642         ent.e_id = 0;
 643         ent.e_attrs = 0;
 644         ent.e_private = 0;
 645         attrp = &ent.e_attrs;
 646
 647         for ( a = ldap_first_attribute( lsc->ld, e, &ber );
 648                         a != NULL;
 649                         a = ldap_next_attribute( lsc->ld, e, ber ) )
 650         {
 651                 mapped = ldap_back_map( &li->targets[ target ]->at_map, a, 1 );
 652                 if ( mapped == NULL ) {
 653                         continue;
 654                 }
 655                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 656                 if ( attr == NULL ) {
 657                         continue;
 658                 }
 659                 attr->a_next = 0;
 660                 attr->a_desc = NULL;
 661                 if ( slap_str2ad( mapped, &attr->a_desc, &text )
 662                                 != LDAP_SUCCESS) {
 663                         if (slap_str2undef_ad(mapped, &attr->a_desc, &text)
 664                                         != LDAP_SUCCESS) {
 665 #ifdef NEW_LOGGING
 666                                 LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 667                                                 "slap_str2undef_ad(%s): "
 668                                                 "%s\n", mapped, text ));
 669 #else /* !NEW_LOGGING */
 670                                 Debug( LDAP_DEBUG_ANY,
 671                                                 "slap_str2undef_ad(%s): "
 672                                                 "%s\n%s", mapped, text, "" );
 673 #endif /* !NEW_LOGGING */
 674                                 ch_free(attr);
 675                                 continue;
 676                         }
 677                 }
 678                 attr->a_vals = ldap_get_values_len( lsc->ld, e, a );
 679                 if ( !attr->a_vals ) {
 680                         attr->a_vals = &dummy;
 681                 } else if ( strcasecmp( mapped, "objectClass" ) == 0 ) {
 682                         int i, last;
 683                         for ( last = 0; attr->a_vals[ last ]; ++last ) ;
 684                         for ( i = 0; ( bv = attr->a_vals[ i ] ); i++ ) {
 685                                 mapped = ldap_back_map(
 686                                                 &li->targets[ target]->oc_map,
 687                                                 bv->bv_val, 1 );
 688                                 if ( mapped == NULL ) {
 689                                         ber_bvfree( attr->a_vals[ i ] );
 690                                         attr->a_vals[ i ] = NULL;
 691                                         if ( --last < 0 ) {
 692                                                 break;
 693                                         }
 694                                         attr->a_vals[ i ] =
 695                                                 attr->a_vals[ last ];
 696                                         attr->a_vals[ last ] = NULL;
 697                                         --i;
 698                                 } else if ( mapped != bv->bv_val ) {
 699                                         ch_free( bv->bv_val );
 700                                         bv->bv_val = ch_strdup( mapped );
 701                                         bv->bv_len = strlen( mapped );
 702                                 }
 703                         }
 704                 /*
 705                  * It is necessary to try to rewrite attributes with
 706                  * dn syntax because they might be used in ACLs as
 707                  * members of groups; since ACLs are applied to the
 708                  * rewritten stuff, no dn-based subecj clause could
 709                  * be used at the ldap backend side (see
 710                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 711                  * The problem can be overcome by moving the dn-based
 712                  * ACLs to the target directory server, and letting
 713                  * everything pass thru the ldap backend.
 714                  */
 715                 } else if ( strcmp( attr->a_desc->ad_type->sat_syntax->ssyn_oid,
 716                                         SLAPD_DN_SYNTAX ) == 0 ) {
 717                         int i;
 718                         for ( i = 0; ( bv = attr->a_vals[ i ] ); i++ ) {
 719                                 char *newval;
 720
 721                                 switch ( rewrite_session( li->targets[ target ]->rwinfo,
 722                                                         "searchResult",
 723                                                         bv->bv_val,
 724                                                         lc->conn, &newval )) {
 725                                 case REWRITE_REGEXEC_OK:
 726                                         /* left as is */
 727                                         if ( newval == NULL ) {
 728                                                 break;
 729                                         }
 730 #ifdef NEW_LOGGING
 731                                         LDAP_LOG(( "backend",
 732                                                         LDAP_LEVEL_DETAIL1,
 733                                                         "[rw] searchResult on"
 734                                                         " attr=%s:"
 735                                                         " \"%s\" -> \"%s\"\n",
 736                                         attr->a_desc->ad_type->sat_cname.bv_val,
 737                                                         bv->bv_val, newval ));
 738 #else /* !NEW_LOGGING */
 739                                         Debug( LDAP_DEBUG_ARGS,
 740                                                 "rw> searchResult on attr=%s:"
 741                                                 " \"%s\" -> \"%s\"\n",
 742                                         attr->a_desc->ad_type->sat_cname.bv_val,
 743                                                 bv->bv_val, newval );
 744 #endif /* !NEW_LOGGING */
 745
 746                                         free( bv->bv_val );
 747                                         bv->bv_val = newval;
 748                                         bv->bv_len = strlen( newval );
 749
 750                                         break;
 751
 752                                 case REWRITE_REGEXEC_UNWILLING:
 753
 754                                 case REWRITE_REGEXEC_ERR:
 755                                         /*
 756                                          * FIXME: better give up,
 757                                          * skip the attribute
 758                                          * or leave it untouched?
 759                                          */
 760                                         break;
 761                                 }
 762                         }
 763                 }
 764                 *attrp = attr;
 765                 attrp = &attr->a_next;
 766         }
 767         send_search_entry( be, lc->conn, op, &ent, attrs, attrsonly, NULL );
 768         while ( ent.e_attrs ) {
 769                 attr = ent.e_attrs;
 770                 ent.e_attrs = attr->a_next;
 771                 if ( attr->a_vals != &dummy ) {
 772                         ber_bvecfree(attr->a_vals);
 773                 }
 774                 free( attr );
 775         }
 776         if ( ber ) {
 777                 ber_free( ber, 0 );
 778         }
 779
 780         if ( ent.e_dn ) {
 781                 free( ent.e_dn );
 782         }
 783         if ( ent.e_ndn ) {
 784                 free( ent.e_ndn );
 785         }
 786 }
 787
 788 static int
 789 is_one_level_rdn(
 790                 const char      *rdn,
 791                 int             from
 792 )
 793 {
 794         for ( ; from--; ) {
 795                 if ( DN_SEPARATOR( rdn[ from ] )
 796                                 && ! DN_ESCAPE( rdn[ from ] - 1 ) ) {
 797                         return 0;
 798                 }
 799         }
 800
 801         return 1;
 802 }
 803