git.sur5r.net Git - openldap/blob - servers/slapd/back-meta/search.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2005 The OpenLDAP Foundation.
   5  * Portions Copyright 2001-2003 Pierangelo Masarati.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted only as authorized by the OpenLDAP
  11  * Public License.
  12  *
  13  * A copy of this license is available in the file LICENSE in the
  14  * top-level directory of the distribution or, alternatively, at
  15  * <http://www.OpenLDAP.org/license.html>.
  16  */
  17 /* ACKNOWLEDGEMENTS:
  18  * This work was initially developed by the Howard Chu for inclusion
  19  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  20  * Masarati.
  21  */
  22
  23 #include "portable.h"
  24
  25 #include <stdio.h>
  26
  27 #include <ac/socket.h>
  28 #include <ac/string.h>
  29 #include <ac/time.h>
  30
  31 #include "slap.h"
  32 #include "../back-ldap/back-ldap.h"
  33 #include "back-meta.h"
  34 #undef ldap_debug       /* silence a warning in ldap-int.h */
  35 #include "ldap_log.h"
  36 #include "../../../libraries/libldap/ldap-int.h"
  37
  38 static int
  39 meta_send_entry(
  40                 Operation       *op,
  41                 SlapReply       *rs,
  42                 struct metaconn *lc,
  43                 int             i,
  44                 LDAPMessage     *e
  45 );
  46
  47 int
  48 meta_back_search( Operation *op, SlapReply *rs )
  49 {
  50         struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
  51         struct metaconn *lc;
  52         struct metasingleconn *lsc;
  53         struct timeval  tv = { 0, 0 };
  54         LDAPMessage     *res = NULL, *e;
  55         int     rc = 0, *msgid, sres = LDAP_SUCCESS;
  56         char *err = NULL;
  57         struct berval match = BER_BVNULL, mmatch = BER_BVNULL;
  58         BerVarray v2refs = NULL;
  59
  60         int i, last = 0, candidates = 0, initial_candidates = 0,
  61                         candidate_match = 0;
  62         dncookie dc;
  63
  64         int     is_scope = 0,
  65                 is_filter = 0;
  66
  67         /*
  68          * controls are set in ldap_back_dobind()
  69          *
  70          * FIXME: in case of values return filter, we might want
  71          * to map attrs and maybe rewrite value
  72          */
  73         lc = meta_back_getconn( op, rs, META_OP_ALLOW_MULTIPLE,
  74                         &op->o_req_ndn, NULL );
  75         if ( !lc ) {
  76                 send_ldap_result( op, rs );
  77                 return -1;
  78         }
  79
  80         if ( !meta_back_dobind( lc, op ) ) {
  81                 rs->sr_err = LDAP_OTHER;
  82                 send_ldap_result( op, rs );
  83                 return -1;
  84         }
  85
  86         /*
  87          * Array of message id of each target
  88          */
  89         msgid = ch_calloc( sizeof( int ), li->ntargets );
  90         if ( msgid == NULL ) {
  91                 rs->sr_err = LDAP_OTHER;
  92                 send_ldap_result( op, rs );
  93                 return -1;
  94         }
  95
  96         dc.conn = op->o_conn;
  97         dc.rs = rs;
  98
  99         /*
 100          * Inits searches
 101          */
 102         for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
 103                 struct berval   realbase = op->o_req_dn;
 104                 int             realscope = op->ors_scope;
 105                 ber_len_t       suffixlen = 0;
 106                 struct berval   mbase = BER_BVNULL;
 107                 struct berval   mfilter = BER_BVNULL;
 108                 char            **mapped_attrs = NULL;
 109
 110                 if ( lsc->candidate != META_CANDIDATE ) {
 111                         msgid[ i ] = -1;
 112                         continue;
 113                 }
 114
 115                 /* should we check return values? */
 116                 if ( op->ors_deref != -1 ) {
 117                         ldap_set_option( lsc->ld, LDAP_OPT_DEREF,
 118                                         ( void * )&op->ors_deref);
 119                 }
 120                 if ( op->ors_tlimit != SLAP_NO_LIMIT ) {
 121                         ldap_set_option( lsc->ld, LDAP_OPT_TIMELIMIT,
 122                                         ( void * )&op->ors_tlimit);
 123                 }
 124                 if ( op->ors_slimit != SLAP_NO_LIMIT ) {
 125                         ldap_set_option( lsc->ld, LDAP_OPT_SIZELIMIT,
 126                                         ( void * )&op->ors_slimit);
 127                 }
 128
 129                 dc.rwmap = &li->targets[ i ]->rwmap;
 130
 131                 /*
 132                  * modifies the base according to the scope, if required
 133                  */
 134                 suffixlen = li->targets[ i ]->suffix.bv_len;
 135                 if ( suffixlen > op->o_req_ndn.bv_len ) {
 136                         switch ( op->ors_scope ) {
 137                         case LDAP_SCOPE_SUBTREE:
 138                                 /*
 139                                  * make the target suffix the new base
 140                                  * FIXME: this is very forgiving, because
 141                                  * illegal bases may be turned into
 142                                  * the suffix of the target.
 143                                  */
 144                                 if ( dnIsSuffix( &li->targets[ i ]->suffix,
 145                                                 &op->o_req_ndn ) ) {
 146                                         realbase = li->targets[ i ]->suffix;
 147                                         is_scope++;
 148
 149                                 } else {
 150                                         /*
 151                                          * this target is no longer candidate
 152                                          */
 153                                         msgid[ i ] = -1;
 154                                         goto new_candidate;
 155                                 }
 156                                 break;
 157
 158                         case LDAP_SCOPE_ONELEVEL:
 159                         {
 160                                 struct berval   rdn = li->targets[ i ]->suffix;
 161                                 rdn.bv_len -= op->o_req_ndn.bv_len + STRLENOF( "," );
 162                                 if ( dnIsOneLevelRDN( &rdn )
 163                                                 && dnIsSuffix( &li->targets[ i ]->suffix, &op->o_req_ndn ) )
 164                                 {
 165                                         /*
 166                                          * if there is exactly one level,
 167                                          * make the target suffix the new
 168                                          * base, and make scope "base"
 169                                          */
 170                                         realbase = li->targets[ i ]->suffix;
 171                                         realscope = LDAP_SCOPE_BASE;
 172                                         is_scope++;
 173                                         break;
 174                                 } /* else continue with the next case */
 175                         }
 176
 177                         case LDAP_SCOPE_BASE:
 178                                 /*
 179                                  * this target is no longer candidate
 180                                  */
 181                                 msgid[ i ] = -1;
 182                                 goto new_candidate;
 183                         }
 184
 185                 } else {
 186                         is_scope++;
 187                 }
 188
 189                 /*
 190                  * Rewrite the search base, if required
 191                  */
 192                 dc.ctx = "searchBase";
 193                 switch ( ldap_back_dn_massage( &dc, &realbase, &mbase ) ) {
 194                 default:
 195                         break;
 196
 197                 case REWRITE_REGEXEC_UNWILLING:
 198                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 199                         rs->sr_text = "Operation not allowed";
 200                         send_ldap_result( op, rs );
 201                         rc = -1;
 202                         goto finish;
 203
 204                 case REWRITE_REGEXEC_ERR:
 205 #if 0
 206                         rs->sr_err = LDAP_OTHER;
 207                         rs->sr_text = "Rewrite error";
 208                         send_ldap_result( op, rs );
 209                         rc = -1;
 210                         goto finish;
 211 #endif
 212
 213                         /*
 214                          * this target is no longer candidate
 215                          */
 216                         msgid[ i ] = -1;
 217                         goto new_candidate;
 218                 }
 219
 220                 /*
 221                  * Maps filter
 222                  */
 223                 rc = ldap_back_filter_map_rewrite( &dc,
 224                                 op->ors_filter,
 225                                 &mfilter, BACKLDAP_MAP );
 226                 switch ( rc ) {
 227                 case LDAP_SUCCESS:
 228                         is_filter++;
 229                         break;
 230
 231                 case LDAP_COMPARE_FALSE:
 232                         rc = 0;
 233
 234                 default:
 235                         /*
 236                          * this target is no longer candidate
 237                          */
 238                         msgid[ i ] = -1;
 239                         goto new_candidate;
 240                 }
 241
 242                 /*
 243                  * Maps required attributes
 244                  */
 245                 rc = ldap_back_map_attrs( &li->targets[ i ]->rwmap.rwm_at,
 246                                 op->ors_attrs, BACKLDAP_MAP,
 247                                 &mapped_attrs );
 248                 if ( rc != LDAP_SUCCESS ) {
 249                         /*
 250                          * this target is no longer candidate
 251                          */
 252                         msgid[ i ] = -1;
 253                         goto new_candidate;
 254                 }
 255
 256                 /*
 257                  * Starts the search
 258                  */
 259                 msgid[ i ] = ldap_search( lsc->ld, mbase.bv_val, realscope,
 260                                 mfilter.bv_val, mapped_attrs,
 261                                 op->ors_attrsonly );
 262                 if ( mapped_attrs ) {
 263                         free( mapped_attrs );
 264                         mapped_attrs = NULL;
 265                 }
 266                 if ( mfilter.bv_val != op->ors_filterstr.bv_val ) {
 267                         free( mfilter.bv_val );
 268                         mfilter.bv_val = NULL;
 269                 }
 270                 if ( mbase.bv_val != realbase.bv_val ) {
 271                         free( mbase.bv_val );
 272                         mbase.bv_val = NULL;
 273                 }
 274
 275                 if ( msgid[ i ] == -1 ) {
 276                         continue;
 277                 }
 278
 279                 ++candidates;
 280
 281 new_candidate:;
 282         }
 283
 284         initial_candidates = candidates;
 285
 286         /* We pull apart the ber result, stuff it into a slapd entry, and
 287          * let send_search_entry stuff it back into ber format. Slow & ugly,
 288          * but this is necessary for version matching, and for ACL processing.
 289          */
 290
 291
 292         /*
 293          * In case there are no candidates, no cycle takes place...
 294          *
 295          * FIXME: we might use a queue, to balance the load
 296          * among the candidates
 297          */
 298         for ( rc = 0; candidates > 0; ) {
 299                 int ab, gotit = 0;
 300
 301                 /* check for abandon */
 302                 ab = op->o_abandon;
 303
 304                 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); lsc++, i++ ) {
 305                         if ( msgid[ i ] == -1 ) {
 306                                 continue;
 307                         }
 308
 309                         if ( ab ) {
 310                                 ldap_abandon( lsc->ld, msgid[ i ] );
 311                                 rc = 0;
 312                                 break;
 313                         }
 314
 315                         if ( op->ors_slimit > 0
 316                                         && rs->sr_nentries == op->ors_slimit ) {
 317                                 rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
 318                                 rs->sr_v2ref = v2refs;
 319                                 send_ldap_result( op, rs );
 320                                 goto finish;
 321                         }
 322
 323                         /*
 324                          * FIXME: handle time limit as well?
 325                          * Note that target servers are likely
 326                          * to handle it, so at some time we'll
 327                          * get a LDAP_TIMELIMIT_EXCEEDED from
 328                          * one of them ...
 329                          */
 330                         rc = ldap_result( lsc->ld, msgid[ i ],
 331                                         0, &tv, &res );
 332
 333                         if ( rc == 0 ) {
 334                                 /* timeout exceeded */
 335
 336                                 /* FIXME: res should not need to be freed */
 337                                 assert( res == NULL );
 338
 339                                 continue;
 340
 341                         } else if ( rc == -1 ) {
 342                                 /* something REALLY bad happened! */
 343                                 ( void )meta_clear_unused_candidates( li,
 344                                                 lc, -1, 0 );
 345                                 rs->sr_err = LDAP_OTHER;
 346                                 rs->sr_v2ref = v2refs;
 347                                 send_ldap_result( op, rs );
 348
 349                                 /* anything else needs be done? */
 350
 351                                 /* FIXME: res should not need to be freed */
 352                                 assert( res == NULL );
 353
 354                                 goto finish;
 355
 356                         } else if ( rc == LDAP_RES_SEARCH_ENTRY ) {
 357                                 e = ldap_first_entry( lsc->ld, res );
 358                                 meta_send_entry( op, rs, lc, i, e );
 359
 360                                 ldap_msgfree( res );
 361                                 res = NULL;
 362
 363                                 /*
 364                                  * If scope is BASE, we need to jump out
 365                                  * as soon as one entry is found; if
 366                                  * the target pool is properly crafted,
 367                                  * this should correspond to the sole
 368                                  * entry that has the base DN
 369                                  */
 370                                 if ( op->ors_scope == LDAP_SCOPE_BASE
 371                                                 && rs->sr_nentries > 0 ) {
 372                                         candidates = 0;
 373                                         sres = LDAP_SUCCESS;
 374                                         break;
 375                                 }
 376
 377                                 gotit = 1;
 378
 379                         } else if ( rc == LDAP_RES_SEARCH_REFERENCE ) {
 380                                 char            **references = NULL;
 381                                 int             cnt;
 382
 383                                 rc = ldap_parse_reference( lsc->ld, res,
 384                                                 &references, &rs->sr_ctrls, 1 );
 385                                 res = NULL;
 386
 387                                 if ( rc != LDAP_SUCCESS ) {
 388                                         continue;
 389                                 }
 390
 391                                 if ( references == NULL ) {
 392                                         continue;
 393                                 }
 394
 395 #ifdef ENABLE_REWRITE
 396                                 dc.ctx = "referralDN";
 397 #else /* ! ENABLE_REWRITE */
 398                                 dc.tofrom = 0;
 399                                 dc.normalized = 0;
 400 #endif /* ! ENABLE_REWRITE */
 401                                 for ( cnt = 0; references[ cnt ]; cnt++ )
 402                                         ;
 403
 404                                 rs->sr_ref = ch_calloc( sizeof( struct berval ), cnt + 1 );
 405
 406                                 for ( cnt = 0; references[ cnt ]; cnt++ ) {
 407                                         ber_str2bv( references[ cnt ], 0, 1, &rs->sr_ref[ cnt ] );
 408                                 }
 409                                 BER_BVZERO( &rs->sr_ref[ cnt ] );
 410
 411                                 ( void )ldap_back_referral_result_rewrite( &dc, rs->sr_ref );
 412
 413                                 if ( rs->sr_ref != NULL && !BER_BVISNULL( &rs->sr_ref[ 0 ] ) ) {
 414                                         /* ignore return value by now */
 415                                         ( void )send_search_reference( op, rs );
 416
 417                                         ber_bvarray_free( rs->sr_ref );
 418                                         rs->sr_ref = NULL;
 419                                 }
 420
 421                                 /* cleanup */
 422                                 if ( references ) {
 423                                         ldap_value_free( references );
 424                                 }
 425
 426                                 if ( rs->sr_ctrls ) {
 427                                         ldap_controls_free( rs->sr_ctrls );
 428                                         rs->sr_ctrls = NULL;
 429                                 }
 430
 431                         } else {
 432                                 rs->sr_err = ldap_result2error( lsc->ld,
 433                                                 res, 1 );
 434                                 res = NULL;
 435
 436                                 sres = slap_map_api2result( rs );
 437                                 if ( err != NULL ) {
 438                                         free( err );
 439                                 }
 440                                 ldap_get_option( lsc->ld,
 441                                                 LDAP_OPT_ERROR_STRING, &err );
 442                                 if ( match.bv_val != NULL ) {
 443                                         free( match.bv_val );
 444                                 }
 445                                 ldap_get_option( lsc->ld,
 446                                                 LDAP_OPT_MATCHED_DN, &match.bv_val );
 447
 448                                 Debug( LDAP_DEBUG_ANY,
 449                                         "=>meta_back_search [%d] "
 450                                         "match=\"%s\" err=\"%s\"\n",
 451                                         i, match.bv_val, err );
 452                                 candidate_match++;
 453                                 last = i;
 454                                 rc = 0;
 455
 456                                 /*
 457                                  * When no candidates are left,
 458                                  * the outer cycle finishes
 459                                  */
 460                                 msgid[ i ] = -1;
 461                                 --candidates;
 462                         }
 463                 }
 464
 465                 if ( ab ) {
 466                         goto finish;
 467                 }
 468
 469                 if ( gotit == 0 ) {
 470                         tv.tv_sec = 0;
 471                         tv.tv_usec = 100000;
 472                         ldap_pvt_thread_yield();
 473                 } else {
 474                         tv.tv_sec = 0;
 475                         tv.tv_usec = 0;
 476                 }
 477         }
 478
 479         if ( rc == -1 ) {
 480                 /*
 481                  * FIXME: need a strategy to handle errors
 482                  */
 483                 rc = meta_back_op_result( lc, op, rs );
 484                 goto finish;
 485         }
 486
 487         /*
 488          * Rewrite the matched portion of the search base, if required
 489          *
 490          * FIXME: only the last one gets caught!
 491          */
 492         if ( candidate_match == initial_candidates
 493                         && match.bv_val != NULL && *match.bv_val ) {
 494                 dc.ctx = "matchedDN";
 495                 dc.rwmap = &li->targets[ last ]->rwmap;
 496
 497                 if ( ldap_back_dn_massage( &dc, &match, &mmatch ) ) {
 498                         mmatch.bv_val = NULL;
 499                 }
 500         }
 501
 502         /*
 503          * In case we returned at least one entry, we return LDAP_SUCCESS
 504          * otherwise, the latter error code we got
 505          *
 506          * FIXME: we should handle error codes and return the more
 507          * important/reasonable
 508          */
 509         if ( is_scope == 0 ) {
 510                 sres = LDAP_NO_SUCH_OBJECT;
 511         }
 512
 513         if ( sres == LDAP_SUCCESS && v2refs ) {
 514                 sres = LDAP_REFERRAL;
 515         }
 516         rs->sr_err = sres;
 517         rs->sr_matched = mmatch.bv_val;
 518         rs->sr_v2ref = v2refs;
 519         send_ldap_result( op, rs );
 520         rs->sr_matched = NULL;
 521         rs->sr_v2ref = NULL;
 522
 523
 524 finish:;
 525         if ( match.bv_val ) {
 526                 if ( mmatch.bv_val != match.bv_val ) {
 527                         free( mmatch.bv_val );
 528                 }
 529                 free( match.bv_val );
 530         }
 531
 532         if ( err ) {
 533                 free( err );
 534         }
 535
 536         if ( msgid ) {
 537                 ch_free( msgid );
 538         }
 539
 540         return rc;
 541 }
 542
 543 static int
 544 meta_send_entry(
 545                 Operation       *op,
 546                 SlapReply       *rs,
 547                 struct metaconn *lc,
 548                 int             target,
 549                 LDAPMessage     *e
 550 )
 551 {
 552         struct metainfo         *li = ( struct metainfo * )op->o_bd->be_private;
 553         struct berval           a, mapped;
 554         Entry                   ent = {0};
 555         BerElement              ber = *e->lm_ber;
 556         Attribute               *attr, **attrp;
 557         struct berval           *bv, bdn;
 558         const char              *text;
 559         dncookie                dc;
 560
 561         if ( ber_scanf( &ber, "{m{", &bdn ) == LBER_ERROR ) {
 562                 return LDAP_DECODING_ERROR;
 563         }
 564
 565         /*
 566          * Rewrite the dn of the result, if needed
 567          */
 568         dc.rwmap = &li->targets[ target ]->rwmap;
 569         dc.conn = op->o_conn;
 570         dc.rs = rs;
 571         dc.ctx = "searchResult";
 572
 573         rs->sr_err = ldap_back_dn_massage( &dc, &bdn, &ent.e_name );
 574         if ( rs->sr_err != LDAP_SUCCESS) {
 575                 return rs->sr_err;
 576         }
 577
 578         /*
 579          * Note: this may fail if the target host(s) schema differs
 580          * from the one known to the meta, and a DN with unknown
 581          * attributes is returned.
 582          *
 583          * FIXME: should we log anything, or delegate to dnNormalize?
 584          */
 585         if ( dnNormalize( 0, NULL, NULL, &ent.e_name, &ent.e_nname,
 586                 op->o_tmpmemctx ) != LDAP_SUCCESS )
 587         {
 588                 return LDAP_INVALID_DN_SYNTAX;
 589         }
 590
 591         /*
 592          * cache dn
 593          */
 594         if ( li->cache.ttl != META_DNCACHE_DISABLED ) {
 595                 ( void )meta_dncache_update_entry( &li->cache,
 596                                 &ent.e_nname, target );
 597         }
 598
 599         attrp = &ent.e_attrs;
 600
 601         dc.ctx = "searchAttrDN";
 602         while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
 603                 int             last = 0;
 604
 605                 ldap_back_map( &li->targets[ target ]->rwmap.rwm_at,
 606                                 &a, &mapped, BACKLDAP_REMAP );
 607                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0' ) {
 608                         continue;
 609                 }
 610                 attr = ( Attribute * )ch_malloc( sizeof( Attribute ) );
 611                 if ( attr == NULL ) {
 612                         continue;
 613                 }
 614                 attr->a_flags = 0;
 615                 attr->a_next = 0;
 616                 attr->a_desc = NULL;
 617                 if ( slap_bv2ad( &mapped, &attr->a_desc, &text )
 618                                 != LDAP_SUCCESS) {
 619                         if ( slap_bv2undef_ad( &mapped, &attr->a_desc, &text )
 620                                         != LDAP_SUCCESS) {
 621                                 Debug( LDAP_DEBUG_ANY,
 622                                                 "slap_bv2undef_ad(%s): "
 623                                                 "%s\n%s", mapped.bv_val, text, "" );
 624                                 ch_free( attr );
 625                                 continue;
 626                         }
 627                 }
 628
 629                 /* no subschemaSubentry */
 630                 if ( attr->a_desc == slap_schema.si_ad_subschemaSubentry ) {
 631
 632                         /*
 633                          * We eat target's subschemaSubentry because
 634                          * a search for this value is likely not
 635                          * to resolve to the appropriate backend;
 636                          * later, the local subschemaSubentry is
 637                          * added.
 638                          */
 639                         ( void )ber_scanf( &ber, "x" /* [W] */ );
 640
 641                         ch_free(attr);
 642                         continue;
 643                 }
 644
 645                 if ( ber_scanf( &ber, "[W]", &attr->a_vals ) == LBER_ERROR
 646                                 || attr->a_vals == NULL ) {
 647                         attr->a_vals = &slap_dummy_bv;
 648
 649                 } else if ( attr->a_desc == slap_schema.si_ad_objectClass
 650                                 || attr->a_desc == slap_schema.si_ad_structuralObjectClass ) {
 651
 652                         for ( last = 0; attr->a_vals[ last ].bv_val; ++last );
 653
 654                         for ( bv = attr->a_vals; bv->bv_val; bv++ ) {
 655                                 ldap_back_map( &li->targets[ target ]->rwmap.rwm_oc,
 656                                                 bv, &mapped, BACKLDAP_REMAP );
 657                                 if ( mapped.bv_val == NULL || mapped.bv_val[0] == '\0') {
 658                                         free( bv->bv_val );
 659                                         bv->bv_val = NULL;
 660                                         if ( --last < 0 ) {
 661                                                 break;
 662                                         }
 663                                         *bv = attr->a_vals[ last ];
 664                                         attr->a_vals[ last ].bv_val = NULL;
 665                                         bv--;
 666
 667                                 } else if ( mapped.bv_val != bv->bv_val ) {
 668                                         free( bv->bv_val );
 669                                         ber_dupbv( bv, &mapped );
 670                                 }
 671                         }
 672                 /*
 673                  * It is necessary to try to rewrite attributes with
 674                  * dn syntax because they might be used in ACLs as
 675                  * members of groups; since ACLs are applied to the
 676                  * rewritten stuff, no dn-based subecj clause could
 677                  * be used at the ldap backend side (see
 678                  * http://www.OpenLDAP.org/faq/data/cache/452.html)
 679                  * The problem can be overcome by moving the dn-based
 680                  * ACLs to the target directory server, and letting
 681                  * everything pass thru the ldap backend.
 682                  */
 683                 } else if ( attr->a_desc->ad_type->sat_syntax ==
 684                                 slap_schema.si_syn_distinguishedName ) {
 685                         ldap_dnattr_result_rewrite( &dc, attr->a_vals );
 686
 687                 } else if ( attr->a_desc == slap_schema.si_ad_ref ) {
 688                         ldap_back_referral_result_rewrite( &dc, attr->a_vals );
 689                 }
 690
 691                 if ( last && attr->a_desc->ad_type->sat_equality &&
 692                         attr->a_desc->ad_type->sat_equality->smr_normalize ) {
 693                         int i;
 694
 695                         attr->a_nvals = ch_malloc((last + 1)*sizeof(struct berval));
 696                         for ( i = 0; i<last; i++ ) {
 697                                 attr->a_desc->ad_type->sat_equality->smr_normalize(
 698                                         SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
 699                                         attr->a_desc->ad_type->sat_syntax,
 700                                         attr->a_desc->ad_type->sat_equality,
 701                                         &attr->a_vals[i], &attr->a_nvals[i],
 702                                         NULL );
 703                         }
 704                         attr->a_nvals[i].bv_val = NULL;
 705                         attr->a_nvals[i].bv_len = 0;
 706                 } else {
 707                         attr->a_nvals = attr->a_vals;
 708                 }
 709
 710                 *attrp = attr;
 711                 attrp = &attr->a_next;
 712         }
 713         rs->sr_entry = &ent;
 714         rs->sr_attrs = op->ors_attrs;
 715         rs->sr_flags = 0;
 716         send_search_entry( op, rs );
 717         rs->sr_entry = NULL;
 718         rs->sr_attrs = NULL;
 719         while ( ent.e_attrs ) {
 720                 attr = ent.e_attrs;
 721                 ent.e_attrs = attr->a_next;
 722                 if ( attr->a_vals != &slap_dummy_bv ) {
 723                         ber_bvarray_free( attr->a_vals );
 724                 }
 725                 free( attr );
 726         }
 727
 728         if ( ent.e_dn && ent.e_dn != bdn.bv_val ) {
 729                 free( ent.e_dn );
 730         }
 731         if ( ent.e_ndn ) {
 732                 free( ent.e_ndn );
 733         }
 734
 735         return LDAP_SUCCESS;
 736 }
 737
 738