git.sur5r.net Git - openldap/blob - servers/slapd/back-sql/search.c

   1 /* $OpenLDAP$ */
   2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   3  *
   4  * Copyright 1999-2004 The OpenLDAP Foundation.
   5  * Portions Copyright 1999 Dmitry Kovalev.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* ACKNOWLEDGEMENTS:
  17  * This work was initially developed by Dmitry Kovalev for inclusion
  18  * by OpenLDAP Software.
  19  */
  20
  21 #include "portable.h"
  22
  23 #include <stdio.h>
  24 #include <sys/types.h>
  25 #include "ac/string.h"
  26 #include "ac/ctype.h"
  27
  28 #include "slap.h"
  29 #include "proto-sql.h"
  30
  31 static int backsql_process_filter( backsql_srch_info *bsi, Filter *f );
  32 static int backsql_process_filter_eq( backsql_srch_info *bsi,
  33                 backsql_at_map_rec *at,
  34                 int casefold, struct berval *filter_value );
  35 static int backsql_process_filter_like( backsql_srch_info *bsi,
  36                 backsql_at_map_rec *at,
  37                 int casefold, struct berval *filter_value );
  38 static int backsql_process_filter_attr( backsql_srch_info *bsi, Filter *f,
  39                 backsql_at_map_rec *at );
  40
  41 static int
  42 backsql_attrlist_add( backsql_srch_info *bsi, AttributeDescription *ad )
  43 {
  44         int             n_attrs = 0;
  45         AttributeName   *an = NULL;
  46
  47         if ( bsi->bsi_attrs == NULL ) {
  48                 return 1;
  49         }
  50
  51         /*
  52          * clear the list (retrieve all attrs)
  53          */
  54         if ( ad == NULL ) {
  55                 ch_free( bsi->bsi_attrs );
  56                 bsi->bsi_attrs = NULL;
  57                 return 1;
  58         }
  59
  60         for ( ; !BER_BVISNULL( &bsi->bsi_attrs[ n_attrs ].an_name ); n_attrs++ ) {
  61                 an = &bsi->bsi_attrs[ n_attrs ];
  62
  63                 Debug( LDAP_DEBUG_TRACE, "==>backsql_attrlist_add(): "
  64                         "attribute \"%s\" is in list\n",
  65                         an->an_name.bv_val, 0, 0 );
  66                 /*
  67                  * We can live with strcmp because the attribute
  68                  * list has been normalized before calling be_search
  69                  */
  70                 if ( !BACKSQL_NCMP( &an->an_name, &ad->ad_cname ) ) {
  71                         return 1;
  72                 }
  73         }
  74
  75         Debug( LDAP_DEBUG_TRACE, "==>backsql_attrlist_add(): "
  76                 "adding \"%s\" to list\n", ad->ad_cname.bv_val, 0, 0 );
  77
  78         an = (AttributeName *)ch_realloc( bsi->bsi_attrs,
  79                         sizeof( AttributeName ) * ( n_attrs + 2 ) );
  80         if ( an == NULL ) {
  81                 return -1;
  82         }
  83
  84         an[ n_attrs ].an_name = ad->ad_cname;
  85         an[ n_attrs ].an_desc = ad;
  86         BER_BVZERO( &an[ n_attrs + 1 ].an_name );
  87
  88         bsi->bsi_attrs = an;
  89
  90         return 1;
  91 }
  92
  93 /*
  94  * Initializes the search structure.
  95  *
  96  * If get_base_id != 0, the field bsi_base_id is filled
  97  * with the entryID of bsi_base_ndn; it must be freed
  98  * by backsql_free_entryID() when no longer required.
  99  *
 100  * NOTE: base must be normalized
 101  */
 102 int
 103 backsql_init_search(
 104         backsql_srch_info       *bsi,
 105         struct berval           *nbase,
 106         int                     scope,
 107         int                     slimit,
 108         int                     tlimit,
 109         time_t                  stoptime,
 110         Filter                  *filter,
 111         SQLHDBC                 dbh,
 112         Operation               *op,
 113         SlapReply               *rs,
 114         AttributeName           *attrs,
 115         int                     get_base_id )
 116 {
 117         AttributeName           *p;
 118         int                     rc = LDAP_SUCCESS;
 119
 120         bsi->bsi_base_ndn = nbase;
 121         BER_BVZERO( &bsi->bsi_base_id.eid_dn );
 122         BER_BVZERO( &bsi->bsi_base_id.eid_ndn );
 123         bsi->bsi_scope = scope;
 124         bsi->bsi_slimit = slimit;
 125         bsi->bsi_tlimit = tlimit;
 126         bsi->bsi_filter = filter;
 127         bsi->bsi_dbh = dbh;
 128         bsi->bsi_op = op;
 129         bsi->bsi_rs = rs;
 130         bsi->bsi_flags = 0;
 131
 132         /*
 133          * handle "*"
 134          */
 135         if ( attrs == NULL || an_find( attrs, &AllUser ) ) {
 136                 bsi->bsi_attrs = NULL;
 137
 138         } else {
 139                 int     got_oc = 0;
 140
 141                 bsi->bsi_attrs = (AttributeName *)ch_calloc( 1,
 142                                 sizeof( AttributeName ) );
 143                 BER_BVZERO( &bsi->bsi_attrs[ 0 ].an_name );
 144
 145                 for ( p = attrs; !BER_BVISNULL( &p->an_name ); p++ ) {
 146                         /*
 147                          * ignore "1.1"; handle "+"
 148                          */
 149                         if ( BACKSQL_NCMP( &p->an_name, &AllOper ) == 0 ) {
 150                                 bsi->bsi_flags |= BSQL_SF_ALL_OPER;
 151                                 continue;
 152
 153                         } else if ( BACKSQL_NCMP( &p->an_name, &NoAttrs ) == 0 ) {
 154                                 continue;
 155
 156                         } else if ( p->an_desc == slap_schema.si_ad_objectClass ) {
 157                                 got_oc = 1;
 158                         }
 159
 160                         backsql_attrlist_add( bsi, p->an_desc );
 161                 }
 162
 163                 if ( got_oc == 0 ) {
 164                         /* add objectClass if not present,
 165                          * because it is required to understand
 166                          * if an entry is a referral, an alias
 167                          * or so... */
 168                         backsql_attrlist_add( bsi, slap_schema.si_ad_objectClass );
 169                 }
 170         }
 171
 172         bsi->bsi_abandon = 0;
 173         bsi->bsi_id_list = NULL;
 174         bsi->bsi_id_listtail = &bsi->bsi_id_list;
 175         bsi->bsi_n_candidates = 0;
 176         bsi->bsi_stoptime = stoptime;
 177         BER_BVZERO( &bsi->bsi_sel.bb_val );
 178         bsi->bsi_sel.bb_len = 0;
 179         BER_BVZERO( &bsi->bsi_from.bb_val );
 180         bsi->bsi_from.bb_len = 0;
 181         BER_BVZERO( &bsi->bsi_join_where.bb_val );
 182         bsi->bsi_join_where.bb_len = 0;
 183         BER_BVZERO( &bsi->bsi_flt_where.bb_val );
 184         bsi->bsi_flt_where.bb_len = 0;
 185         bsi->bsi_filter_oc = NULL;
 186
 187         if ( get_base_id ) {
 188                 assert( op->o_bd->be_private );
 189
 190                 rc = backsql_dn2id( (backsql_info *)op->o_bd->be_private,
 191                                 &bsi->bsi_base_id, dbh, nbase );
 192         }
 193
 194         return ( bsi->bsi_status = rc );
 195 }
 196
 197 static int
 198 backsql_process_filter_list( backsql_srch_info *bsi, Filter *f, int op )
 199 {
 200         int             res;
 201
 202         if ( !f ) {
 203                 return 0;
 204         }
 205
 206         backsql_strfcat( &bsi->bsi_flt_where, "c", '(' /* ) */  );
 207
 208         while ( 1 ) {
 209                 res = backsql_process_filter( bsi, f );
 210                 if ( res < 0 ) {
 211                         /*
 212                          * TimesTen : If the query has no answers,
 213                          * don't bother to run the query.
 214                          */
 215                         return -1;
 216                 }
 217
 218                 f = f->f_next;
 219                 if ( f == NULL ) {
 220                         break;
 221                 }
 222
 223                 switch ( op ) {
 224                 case LDAP_FILTER_AND:
 225                         backsql_strfcat( &bsi->bsi_flt_where, "l",
 226                                         (ber_len_t)STRLENOF( " AND " ),
 227                                                 " AND " );
 228                         break;
 229
 230                 case LDAP_FILTER_OR:
 231                         backsql_strfcat( &bsi->bsi_flt_where, "l",
 232                                         (ber_len_t)STRLENOF( " OR " ),
 233                                                 " OR " );
 234                         break;
 235                 }
 236         }
 237
 238         backsql_strfcat( &bsi->bsi_flt_where, "c", /* ( */ ')' );
 239
 240         return 1;
 241 }
 242
 243 static int
 244 backsql_process_sub_filter( backsql_srch_info *bsi, Filter *f,
 245         backsql_at_map_rec *at )
 246 {
 247         backsql_info            *bi = (backsql_info *)bsi->bsi_op->o_bd->be_private;
 248         int                     i;
 249         int                     casefold = 0;
 250
 251         if ( !f ) {
 252                 return 0;
 253         }
 254
 255         /* always uppercase strings by now */
 256 #ifdef BACKSQL_UPPERCASE_FILTER
 257         if ( SLAP_MR_ASSOCIATED( f->f_sub_desc->ad_type->sat_substr,
 258                         bi->sql_caseIgnoreMatch ) )
 259 #endif /* BACKSQL_UPPERCASE_FILTER */
 260         {
 261                 casefold = 1;
 262         }
 263
 264         if ( SLAP_MR_ASSOCIATED( f->f_sub_desc->ad_type->sat_substr,
 265                         bi->sql_telephoneNumberMatch ) )
 266         {
 267
 268                 struct berval   bv;
 269                 ber_len_t       i, s, a;
 270
 271                 /*
 272                  * to check for matching telephone numbers
 273                  * with intermixed chars, e.g. val='1234'
 274                  * use
 275                  *
 276                  * val LIKE '%1%2%3%4%'
 277                  */
 278
 279                 BER_BVZERO( &bv );
 280                 if ( f->f_sub_initial.bv_val ) {
 281                         bv.bv_len += f->f_sub_initial.bv_len;
 282                 }
 283                 if ( f->f_sub_any != NULL ) {
 284                         for ( a = 0; f->f_sub_any[ a ].bv_val != NULL; a++ ) {
 285                                 bv.bv_len += f->f_sub_any[ a ].bv_len;
 286                         }
 287                 }
 288                 if ( f->f_sub_final.bv_val ) {
 289                         bv.bv_len += f->f_sub_final.bv_len;
 290                 }
 291                 bv.bv_len = 2 * bv.bv_len - 1;
 292                 bv.bv_val = ch_malloc( bv.bv_len + 1 );
 293
 294                 s = 0;
 295                 if ( !BER_BVISNULL( &f->f_sub_initial ) ) {
 296                         bv.bv_val[ s ] = f->f_sub_initial.bv_val[ 0 ];
 297                         for ( i = 1; i < f->f_sub_initial.bv_len; i++ ) {
 298                                 bv.bv_val[ s + 2 * i - 1 ] = '%';
 299                                 bv.bv_val[ s + 2 * i ] = f->f_sub_initial.bv_val[ i ];
 300                         }
 301                         bv.bv_val[ s + 2 * i - 1 ] = '%';
 302                         s += 2 * i;
 303                 }
 304
 305                 if ( f->f_sub_any != NULL ) {
 306                         for ( a = 0; !BER_BVISNULL( &f->f_sub_any[ a ] ); a++ ) {
 307                                 bv.bv_val[ s ] = f->f_sub_any[ a ].bv_val[ 0 ];
 308                                 for ( i = 1; i < f->f_sub_any[ a ].bv_len; i++ ) {
 309                                         bv.bv_val[ s + 2 * i - 1 ] = '%';
 310                                         bv.bv_val[ s + 2 * i ] = f->f_sub_any[ a ].bv_val[ i ];
 311                                 }
 312                                 bv.bv_val[ s + 2 * i - 1 ] = '%';
 313                                 s += 2 * i;
 314                         }
 315                 }
 316
 317                 if ( !BER_BVISNULL( &f->f_sub_final ) ) {
 318                         bv.bv_val[ s ] = f->f_sub_final.bv_val[ 0 ];
 319                         for ( i = 1; i < f->f_sub_final.bv_len; i++ ) {
 320                                 bv.bv_val[ s + 2 * i - 1 ] = '%';
 321                                 bv.bv_val[ s + 2 * i ] = f->f_sub_final.bv_val[ i ];
 322                         }
 323                                 bv.bv_val[ s + 2 * i - 1 ] = '%';
 324                         s += 2 * i;
 325                 }
 326
 327                 bv.bv_val[ s - 1 ] = '\0';
 328
 329                 (void)backsql_process_filter_like( bsi, at, casefold, &bv );
 330                 ch_free( bv.bv_val );
 331
 332                 return 1;
 333         }
 334
 335         /*
 336          * When dealing with case-sensitive strings
 337          * we may omit normalization; however, normalized
 338          * SQL filters are more liberal.
 339          */
 340
 341         backsql_strfcat( &bsi->bsi_flt_where, "c", '(' /* ) */  );
 342
 343         /* TimesTen */
 344         Debug( LDAP_DEBUG_TRACE, "backsql_process_sub_filter(%s):\n",
 345                 at->bam_ad->ad_cname.bv_val, 0, 0 );
 346         Debug(LDAP_DEBUG_TRACE, "   expr: '%s%s%s'\n", at->bam_sel_expr.bv_val,
 347                 at->bam_sel_expr_u.bv_val ? "' '" : "",
 348                 at->bam_sel_expr_u.bv_val ? at->bam_sel_expr_u.bv_val : "" );
 349         if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
 350                 /*
 351                  * If a pre-upper-cased version of the column
 352                  * or a precompiled upper function exists, use it
 353                  */
 354                 backsql_strfcat( &bsi->bsi_flt_where,
 355                                 "bl",
 356                                 &at->bam_sel_expr_u,
 357                                 (ber_len_t)STRLENOF( " LIKE '" ),
 358                                         " LIKE '" );
 359
 360         } else {
 361                 backsql_strfcat( &bsi->bsi_flt_where, "bl",
 362                                 &at->bam_sel_expr,
 363                                 (ber_len_t)STRLENOF( " LIKE '" ), " LIKE '" );
 364         }
 365
 366         if ( !BER_BVISNULL( &f->f_sub_initial ) ) {
 367                 ber_len_t       start;
 368
 369 #ifdef BACKSQL_TRACE
 370                 Debug( LDAP_DEBUG_TRACE,
 371                         "==>backsql_process_sub_filter(%s): "
 372                         "sub_initial=\"%s\"\n", at->bam_ad->ad_cname.bv_val,
 373                         f->f_sub_initial.bv_val, 0 );
 374 #endif /* BACKSQL_TRACE */
 375
 376                 start = bsi->bsi_flt_where.bb_val.bv_len;
 377                 backsql_strfcat( &bsi->bsi_flt_where, "b",
 378                                 &f->f_sub_initial );
 379                 if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
 380                         ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
 381                 }
 382         }
 383
 384         backsql_strfcat( &bsi->bsi_flt_where, "c", '%' );
 385
 386         if ( f->f_sub_any != NULL ) {
 387                 for ( i = 0; !BER_BVISNULL( &f->f_sub_any[ i ] ); i++ ) {
 388                         ber_len_t       start;
 389
 390 #ifdef BACKSQL_TRACE
 391                         Debug( LDAP_DEBUG_TRACE,
 392                                 "==>backsql_process_sub_filter(%s): "
 393                                 "sub_any[%d]=\"%s\"\n", at->bam_ad->ad_cname.bv_val,
 394                                 i, f->f_sub_any[ i ].bv_val );
 395 #endif /* BACKSQL_TRACE */
 396
 397                         start = bsi->bsi_flt_where.bb_val.bv_len;
 398                         backsql_strfcat( &bsi->bsi_flt_where,
 399                                         "bc",
 400                                         &f->f_sub_any[ i ],
 401                                         '%' );
 402                         if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
 403                                 /*
 404                                  * Note: toupper('%') = '%'
 405                                  */
 406                                 ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
 407                         }
 408                 }
 409         }
 410
 411         if ( !BER_BVISNULL( &f->f_sub_final ) ) {
 412                 ber_len_t       start;
 413
 414 #ifdef BACKSQL_TRACE
 415                 Debug( LDAP_DEBUG_TRACE,
 416                         "==>backsql_process_sub_filter(%s): "
 417                         "sub_final=\"%s\"\n", at->bam_ad->ad_cname.bv_val,
 418                         f->f_sub_final.bv_val, 0 );
 419 #endif /* BACKSQL_TRACE */
 420
 421                 start = bsi->bsi_flt_where.bb_val.bv_len;
 422                 backsql_strfcat( &bsi->bsi_flt_where, "b",
 423                                 &f->f_sub_final );
 424                 if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
 425                         ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
 426                 }
 427         }
 428
 429         backsql_strfcat( &bsi->bsi_flt_where, "l",
 430                         (ber_len_t)STRLENOF( /* (' */ "')" ), /* (' */ "')" );
 431
 432         return 1;
 433 }
 434
 435 static int
 436 backsql_merge_from_tbls( backsql_srch_info *bsi, struct berval *from_tbls )
 437 {
 438         if ( BER_BVISNULL( from_tbls ) ) {
 439                 return LDAP_SUCCESS;
 440         }
 441
 442         if ( !BER_BVISNULL( &bsi->bsi_from.bb_val ) ) {
 443                 char    *start, *end, *tmp;
 444
 445                 tmp = ch_strdup( from_tbls->bv_val );
 446
 447                 for ( start = tmp, end = strchr( start, ',' ); start; ) {
 448                         if ( end ) {
 449                                 end[0] = '\0';
 450                         }
 451
 452                         if ( strstr( bsi->bsi_from.bb_val.bv_val, start) == NULL )
 453                         {
 454                                 backsql_strfcat( &bsi->bsi_from, "cs", ',', start );
 455                         }
 456
 457                         if ( end ) {
 458                                 /* in case there are spaces after the comma... */
 459                                 for ( start = &end[1]; isspace( start[0] ); start++ );
 460                                 if ( start[0] ) {
 461                                         end = strchr( start, ',' );
 462                                 } else {
 463                                         start = NULL;
 464                                 }
 465                         } else {
 466                                 start = NULL;
 467                         }
 468                 }
 469
 470                 ch_free( tmp );
 471
 472         } else {
 473                 backsql_strfcat( &bsi->bsi_from, "b", from_tbls );
 474         }
 475
 476         return LDAP_SUCCESS;
 477 }
 478
 479 static int
 480 backsql_process_filter( backsql_srch_info *bsi, Filter *f )
 481 {
 482         backsql_at_map_rec      **vat = NULL;
 483         AttributeDescription    *ad = NULL;
 484         unsigned                i;
 485         int                     done = 0;
 486         int                     rc = 0;
 487
 488         Debug( LDAP_DEBUG_TRACE, "==>backsql_process_filter()\n", 0, 0, 0 );
 489         if ( f->f_choice == SLAPD_FILTER_COMPUTED ) {
 490                 Debug( LDAP_DEBUG_TRACE, "backsql_process_filter(): "
 491                         "invalid filter\n", 0, 0, 0 );
 492                 rc = -1;
 493                 goto done;
 494         }
 495
 496         switch( f->f_choice ) {
 497         case LDAP_FILTER_OR:
 498                 rc = backsql_process_filter_list( bsi, f->f_or,
 499                                 LDAP_FILTER_OR );
 500                 done = 1;
 501                 break;
 502
 503         case LDAP_FILTER_AND:
 504                 rc = backsql_process_filter_list( bsi, f->f_and,
 505                                 LDAP_FILTER_AND );
 506                 done = 1;
 507                 break;
 508
 509         case LDAP_FILTER_NOT:
 510                 backsql_strfcat( &bsi->bsi_flt_where, "l",
 511                                 (ber_len_t)STRLENOF( "NOT (" /* ) */ ),
 512                                         "NOT (" /* ) */ );
 513                 rc = backsql_process_filter( bsi, f->f_not );
 514                 backsql_strfcat( &bsi->bsi_flt_where, "c", /* ( */ ')' );
 515                 done = 1;
 516                 break;
 517
 518         case LDAP_FILTER_PRESENT:
 519                 ad = f->f_desc;
 520                 break;
 521
 522         case LDAP_FILTER_EXT:
 523                 ad = f->f_mra->ma_desc;
 524                 if ( f->f_mr_dnattrs ) {
 525                         /*
 526                          * if dn attrs filtering is requested, better return
 527                          * success and let test_filter() deal with candidate
 528                          * selection; otherwise we'd need to set conditions
 529                          * on the contents of the DN, e.g. "SELECT ... FROM
 530                          * ldap_entries AS attributeName WHERE attributeName.dn
 531                          * like '%attributeName=value%'"
 532                          */
 533                         backsql_strfcat( &bsi->bsi_flt_where, "l",
 534                                         (ber_len_t)STRLENOF( "1=1" ), "1=1" );
 535                         bsi->bsi_status = LDAP_SUCCESS;
 536                         rc = 1;
 537                         goto done;
 538                 }
 539                 break;
 540
 541         default:
 542                 ad = f->f_av_desc;
 543                 break;
 544         }
 545
 546         if ( rc == -1 ) {
 547                 goto done;
 548         }
 549
 550         if ( done ) {
 551                 rc = 1;
 552                 goto done;
 553         }
 554
 555         /*
 556          * Turn structuralObjectClass into objectClass
 557          */
 558         if ( ad == slap_schema.si_ad_objectClass
 559                         || ad == slap_schema.si_ad_structuralObjectClass )
 560         {
 561                 /*
 562                  * If the filter is LDAP_FILTER_PRESENT, then it's done;
 563                  * otherwise, let's see if we are lucky: filtering
 564                  * for "structural" objectclass or ancestor...
 565                  */
 566                 switch ( f->f_choice ) {
 567                 case LDAP_FILTER_EQUALITY:
 568                 {
 569                         ObjectClass     *oc = oc_bvfind( &f->f_av_value );
 570
 571                         if ( oc == NULL ) {
 572                                 Debug( LDAP_DEBUG_TRACE,
 573                                                 "backsql_process_filter(): "
 574                                                 "unknown objectClass \"%s\" "
 575                                                 "in filter\n",
 576                                                 f->f_av_value.bv_val, 0, 0 );
 577                                 bsi->bsi_status = LDAP_OTHER;
 578                                 rc = -1;
 579                                 goto done;
 580                         }
 581
 582                         /*
 583                          * "structural" objectClass inheritance:
 584                          * - a search for "person" will also return
 585                          *   "inetOrgPerson"
 586                          * - a search for "top" will return everything
 587                          */
 588                         if ( is_object_subclass( oc, bsi->bsi_oc->bom_oc ) ) {
 589                                 static struct berval ldap_entry_objclasses = BER_BVC( "ldap_entry_objclasses" );
 590
 591                                 backsql_merge_from_tbls( bsi, &ldap_entry_objclasses );
 592
 593                                 backsql_strfcat( &bsi->bsi_flt_where, "lbl",
 594                                                 (ber_len_t)STRLENOF( "1=1 OR (ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entry_objclasses.oc_name='" /* ') */ ),
 595                                                         "1=1 OR (ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entry_objclasses.oc_name='" /* ') */,
 596                                                 &bsi->bsi_oc->bom_oc->soc_cname,
 597                                                 (ber_len_t)STRLENOF( /* (' */ "')" ),
 598                                                         /* (' */ "')" );
 599                                 bsi->bsi_status = LDAP_SUCCESS;
 600                                 rc = 1;
 601                                 goto done;
 602                         }
 603
 604                         break;
 605                 }
 606
 607                 case LDAP_FILTER_PRESENT:
 608                         backsql_strfcat( &bsi->bsi_flt_where, "l",
 609                                         (ber_len_t)STRLENOF( "1=1" ), "1=1" );
 610                         bsi->bsi_status = LDAP_SUCCESS;
 611                         rc = 1;
 612                         goto done;
 613
 614                         /* FIXME: LDAP_FILTER_EXT? */
 615
 616                 default:
 617                         Debug( LDAP_DEBUG_TRACE,
 618                                         "backsql_process_filter(): "
 619                                         "illegal/unhandled filter "
 620                                         "on objectClass attribute",
 621                                         0, 0, 0 );
 622                         bsi->bsi_status = LDAP_OTHER;
 623                         rc = -1;
 624                         goto done;
 625                 }
 626
 627         } else if ( ad == slap_schema.si_ad_entryUUID ) {
 628                 unsigned long   oc_id;
 629 #ifdef BACKSQL_ARBITRARY_KEY
 630                 struct berval   keyval;
 631 #else /* ! BACKSQL_ARBITRARY_KEY */
 632                 unsigned long   keyval;
 633                 char            keyvalbuf[] = "18446744073709551615";
 634 #endif /* ! BACKSQL_ARBITRARY_KEY */
 635
 636                 switch ( f->f_choice ) {
 637                 case LDAP_FILTER_EQUALITY:
 638                         backsql_entryUUID_decode( &f->f_av_value, &oc_id, &keyval );
 639
 640                         if ( oc_id != bsi->bsi_oc->bom_id ) {
 641                                 bsi->bsi_status = LDAP_SUCCESS;
 642                                 rc = -1;
 643                                 goto done;
 644                         }
 645
 646 #ifdef BACKSQL_ARBITRARY_KEY
 647                         backsql_strfcat( &bsi->bsi_flt_where, "bcblbc",
 648                                         &bsi->bsi_oc->bom_keytbl, '.',
 649                                         &bsi->bsi_oc->bom_keycol,
 650                                         STRLENOF( " LIKE '" ), " LIKE '",
 651                                         &keyval, '\'' );
 652 #else /* ! BACKSQL_ARBITRARY_KEY */
 653                         snprintf( keyvalbuf, sizeof( keyvalbuf ), "%lu", keyval );
 654                         backsql_strfcat( &bsi->bsi_flt_where, "bcbcs",
 655                                         &bsi->bsi_oc->bom_keytbl, '.',
 656                                         &bsi->bsi_oc->bom_keycol, '=', keyvalbuf );
 657 #endif /* ! BACKSQL_ARBITRARY_KEY */
 658                         break;
 659
 660                 case LDAP_FILTER_PRESENT:
 661                         backsql_strfcat( &bsi->bsi_flt_where, "l",
 662                                         (ber_len_t)STRLENOF( "1=1" ), "1=1" );
 663                         break;
 664
 665                 default:
 666                         rc = -1;
 667                         goto done;
 668                 }
 669
 670                 bsi->bsi_flags |= BSQL_SF_FILTER_ENTRYUUID;
 671                 rc = 1;
 672                 goto done;
 673
 674         } else if ( ad == slap_schema.si_ad_entryCSN ) {
 675                 /*
 676                  * TODO: introduce appropriate entryCSN filtering
 677                  * to support syncrepl as producer...
 678                  */
 679 #if 0 /* wait until syncprov.c freezes */
 680                 if ( bsi->bsi_op->o_sync_mode & SLAP_SYNC_PERSIST ) {
 681                         /* unsupported at present... */
 682                         bsi->bsi_status = LDAP_OTHER;
 683                         rc = -1;
 684                         goto done;
 685                 }
 686 #endif
 687
 688
 689         } else if ( ad == slap_schema.si_ad_hasSubordinates || ad == NULL ) {
 690                 /*
 691                  * FIXME: this is not robust; e.g. a filter
 692                  * '(!(hasSubordinates=TRUE))' fails because
 693                  * in SQL it would read 'NOT (1=1)' instead
 694                  * of no condition.
 695                  * Note however that hasSubordinates is boolean,
 696                  * so a more appropriate filter would be
 697                  * '(hasSubordinates=FALSE)'
 698                  *
 699                  * A more robust search for hasSubordinates
 700                  * would * require joining the ldap_entries table
 701                  * selecting if there are descendants of the
 702                  * candidate.
 703                  */
 704                 backsql_strfcat( &bsi->bsi_flt_where, "l",
 705                                 (ber_len_t)STRLENOF( "1=1" ), "1=1" );
 706                 if ( ad == slap_schema.si_ad_hasSubordinates ) {
 707                         /*
 708                          * instruct candidate selection algorithm
 709                          * and attribute list to try to detect
 710                          * if an entry has subordinates
 711                          */
 712                         bsi->bsi_flags |= BSQL_SF_FILTER_HASSUBORDINATE;
 713
 714                 } else {
 715                         /*
 716                          * clear attributes to fetch, to require ALL
 717                          * and try extended match on all attributes
 718                          */
 719                         backsql_attrlist_add( bsi, NULL );
 720                 }
 721                 rc = 1;
 722                 goto done;
 723         }
 724
 725         /*
 726          * attribute inheritance:
 727          */
 728         if ( backsql_supad2at( bsi->bsi_oc, ad, &vat ) ) {
 729                 bsi->bsi_status = LDAP_OTHER;
 730                 rc = -1;
 731                 goto done;
 732         }
 733
 734         if ( vat == NULL ) {
 735                 /* search anyway; other parts of the filter
 736                  * may succeeed */
 737                 backsql_strfcat( &bsi->bsi_flt_where, "l",
 738                                 (ber_len_t)STRLENOF( "1=1" ), "1=1" );
 739                 bsi->bsi_status = LDAP_SUCCESS;
 740                 rc = 1;
 741                 goto done;
 742         }
 743
 744         /* if required, open extra level of parens */
 745         done = 0;
 746         if ( vat[0]->bam_next || vat[1] ) {
 747                 backsql_strfcat( &bsi->bsi_flt_where, "c", '(' );
 748                 done = 1;
 749         }
 750
 751         i = 0;
 752 next:;
 753         /* apply attr */
 754         if ( backsql_process_filter_attr( bsi, f, vat[i] ) == -1 ) {
 755                 return -1;
 756         }
 757
 758         /* if more definitions of the same attr, apply */
 759         if ( vat[i]->bam_next ) {
 760                 backsql_strfcat( &bsi->bsi_flt_where, "l",
 761                         STRLENOF( " OR " ), " OR " );
 762                 vat[i] = vat[i]->bam_next;
 763                 goto next;
 764         }
 765
 766         /* if more descendants of the same attr, apply */
 767         i++;
 768         if ( vat[i] ) {
 769                 backsql_strfcat( &bsi->bsi_flt_where, "l",
 770                         STRLENOF( " OR " ), " OR " );
 771                 goto next;
 772         }
 773
 774         /* if needed, close extra level of parens */
 775         if ( done ) {
 776                 backsql_strfcat( &bsi->bsi_flt_where, "c", ')' );
 777         }
 778
 779         rc = 1;
 780
 781 done:;
 782         if ( vat ) {
 783                 ch_free( vat );
 784         }
 785
 786         Debug( LDAP_DEBUG_TRACE,
 787                         "<==backsql_process_filter() %s\n",
 788                         rc == 1 ? "succeeded" : "failed", 0, 0);
 789
 790         return rc;
 791 }
 792
 793 static int
 794 backsql_process_filter_eq( backsql_srch_info *bsi, backsql_at_map_rec *at,
 795                 int casefold, struct berval *filter_value )
 796 {
 797         /*
 798          * maybe we should check type of at->sel_expr here somehow,
 799          * to know whether upper_func is applicable, but for now
 800          * upper_func stuff is made for Oracle, where UPPER is
 801          * safely applicable to NUMBER etc.
 802          */
 803         if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
 804                 ber_len_t       start;
 805
 806                 backsql_strfcat( &bsi->bsi_flt_where, "cbl",
 807                                 '(', /* ) */
 808                                 &at->bam_sel_expr_u,
 809                                 (ber_len_t)STRLENOF( "='" ),
 810                                         "='" );
 811
 812                 start = bsi->bsi_flt_where.bb_val.bv_len;
 813
 814                 backsql_strfcat( &bsi->bsi_flt_where, "bl",
 815                                 filter_value,
 816                                 (ber_len_t)STRLENOF( /* (' */ "')" ),
 817                                         /* (' */ "')" );
 818
 819                 ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
 820
 821         } else {
 822                 backsql_strfcat( &bsi->bsi_flt_where, "cblbl",
 823                                 '(', /* ) */
 824                                 &at->bam_sel_expr,
 825                                 (ber_len_t)STRLENOF( "='" ), "='",
 826                                 filter_value,
 827                                 (ber_len_t)STRLENOF( /* (' */ "')" ),
 828                                         /* (' */ "')" );
 829         }
 830
 831         return 1;
 832 }
 833
 834 static int
 835 backsql_process_filter_like( backsql_srch_info *bsi, backsql_at_map_rec *at,
 836                 int casefold, struct berval *filter_value )
 837 {
 838         /*
 839          * maybe we should check type of at->sel_expr here somehow,
 840          * to know whether upper_func is applicable, but for now
 841          * upper_func stuff is made for Oracle, where UPPER is
 842          * safely applicable to NUMBER etc.
 843          */
 844         if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
 845                 ber_len_t       start;
 846
 847                 backsql_strfcat( &bsi->bsi_flt_where, "cbl",
 848                                 '(', /* ) */
 849                                 &at->bam_sel_expr_u,
 850                                 (ber_len_t)STRLENOF( " LIKE '%" ),
 851                                         " LIKE '%" );
 852
 853                 start = bsi->bsi_flt_where.bb_val.bv_len;
 854
 855                 backsql_strfcat( &bsi->bsi_flt_where, "bl",
 856                                 filter_value,
 857                                 (ber_len_t)STRLENOF( /* (' */ "%')" ),
 858                                         /* (' */ "%')" );
 859
 860                 ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
 861
 862         } else {
 863                 backsql_strfcat( &bsi->bsi_flt_where, "cblbl",
 864                                 '(', /* ) */
 865                                 &at->bam_sel_expr,
 866                                 (ber_len_t)STRLENOF( " LIKE '%" ),
 867                                         " LIKE '%",
 868                                 filter_value,
 869                                 (ber_len_t)STRLENOF( /* (' */ "%')" ),
 870                                         /* (' */ "%')" );
 871         }
 872
 873         return 1;
 874 }
 875
 876 static int
 877 backsql_process_filter_attr( backsql_srch_info *bsi, Filter *f, backsql_at_map_rec *at )
 878 {
 879         backsql_info            *bi = (backsql_info *)bsi->bsi_op->o_bd->be_private;
 880         int                     casefold = 0;
 881         struct berval           *filter_value = NULL;
 882         MatchingRule            *matching_rule = NULL;
 883         struct berval           ordering = BER_BVC("<=");
 884
 885         Debug( LDAP_DEBUG_TRACE, "==>backsql_process_filter_attr(%s)\n",
 886                 at->bam_ad->ad_cname.bv_val, 0, 0 );
 887
 888         /*
 889          * need to add this attribute to list of attrs to load,
 890          * so that we can do test_filter() later
 891          */
 892         backsql_attrlist_add( bsi, at->bam_ad );
 893
 894         backsql_merge_from_tbls( bsi, &at->bam_from_tbls );
 895
 896         if ( !BER_BVISNULL( &at->bam_join_where )
 897                         && strstr( bsi->bsi_join_where.bb_val.bv_val,
 898                                 at->bam_join_where.bv_val ) == NULL )
 899         {
 900                 backsql_strfcat( &bsi->bsi_join_where, "lb",
 901                                 (ber_len_t)STRLENOF( " AND " ), " AND ",
 902                                 &at->bam_join_where );
 903         }
 904
 905         switch ( f->f_choice ) {
 906         case LDAP_FILTER_EQUALITY:
 907                 filter_value = &f->f_av_value;
 908                 matching_rule = at->bam_ad->ad_type->sat_equality;
 909
 910                 goto equality_match;
 911
 912                 /* fail over into next case */
 913
 914         case LDAP_FILTER_EXT:
 915                 filter_value = &f->f_mra->ma_value;
 916                 matching_rule = f->f_mr_rule;
 917
 918 equality_match:;
 919                 /* always uppercase strings by now */
 920 #ifdef BACKSQL_UPPERCASE_FILTER
 921                 if ( SLAP_MR_ASSOCIATED( matching_rule,
 922                                         bi->sql_caseIgnoreMatch ) )
 923 #endif /* BACKSQL_UPPERCASE_FILTER */
 924                 {
 925                         casefold = 1;
 926                 }
 927
 928                 if ( SLAP_MR_ASSOCIATED( matching_rule,
 929                                         bi->sql_telephoneNumberMatch ) )
 930                 {
 931                         struct berval   bv;
 932                         ber_len_t       i;
 933
 934                         /*
 935                          * to check for matching telephone numbers
 936                          * with intermized chars, e.g. val='1234'
 937                          * use
 938                          *
 939                          * val LIKE '%1%2%3%4%'
 940                          */
 941
 942                         bv.bv_len = 2 * filter_value->bv_len - 1;
 943                         bv.bv_val = ch_malloc( bv.bv_len + 1 );
 944
 945                         bv.bv_val[ 0 ] = filter_value->bv_val[ 0 ];
 946                         for ( i = 1; i < filter_value->bv_len; i++ ) {
 947                                 bv.bv_val[ 2 * i - 1 ] = '%';
 948                                 bv.bv_val[ 2 * i ] = filter_value->bv_val[ i ];
 949                         }
 950                         bv.bv_val[ 2 * i - 1 ] = '\0';
 951
 952                         (void)backsql_process_filter_like( bsi, at, casefold, &bv );
 953                         ch_free( bv.bv_val );
 954
 955                         break;
 956                 }
 957
 958                 /* NOTE: this is required by objectClass inheritance
 959                  * and auxiliary objectClass use in filters for slightly
 960                  * more efficient candidate selection. */
 961                 /* FIXME: a bit too many specializations to deal with
 962                  * very specific cases... */
 963                 if ( at->bam_ad == slap_schema.si_ad_objectClass
 964                                 || at->bam_ad == slap_schema.si_ad_structuralObjectClass )
 965                 {
 966                         backsql_strfcat( &bsi->bsi_flt_where, "lbl",
 967                                         (ber_len_t)STRLENOF( "(ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entry_objclasses.oc_name='" /* ') */ ),
 968                                                 "(ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entry_objclasses.oc_name='" /* ') */,
 969                                         filter_value,
 970                                         (ber_len_t)STRLENOF( /* (' */ "')" ),
 971                                                 /* (' */ "')" );
 972                         break;
 973                 }
 974
 975                 /*
 976                  * maybe we should check type of at->sel_expr here somehow,
 977                  * to know whether upper_func is applicable, but for now
 978                  * upper_func stuff is made for Oracle, where UPPER is
 979                  * safely applicable to NUMBER etc.
 980                  */
 981                 (void)backsql_process_filter_eq( bsi, at, casefold, filter_value );
 982                 break;
 983
 984         case LDAP_FILTER_GE:
 985                 ordering.bv_val = ">=";
 986
 987                 /* fall thru to next case */
 988
 989         case LDAP_FILTER_LE:
 990                 /* always uppercase strings by now */
 991 #ifdef BACKSQL_UPPERCASE_FILTER
 992                 if ( SLAP_MR_ASSOCIATED( at->bam_ad->ad_type->sat_ordering,
 993                                 bi->sql_caseIgnoreMatch ) )
 994 #endif /* BACKSQL_UPPERCASE_FILTER */
 995                 {
 996                         casefold = 1;
 997                 }
 998
 999                 /*
1000                  * FIXME: should we uppercase the operands?
1001                  */
1002                 if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
1003                         ber_len_t       start;
1004
1005                         backsql_strfcat( &bsi->bsi_flt_where, "cbbc",
1006                                         '(', /* ) */
1007                                         &at->bam_sel_expr_u,
1008                                         &ordering,
1009                                         '\'' );
1010
1011                         start = bsi->bsi_flt_where.bb_val.bv_len;
1012
1013                         backsql_strfcat( &bsi->bsi_flt_where, "bl",
1014                                         filter_value,
1015                                         (ber_len_t)STRLENOF( /* (' */ "')" ),
1016                                                 /* (' */ "')" );
1017
1018                         ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
1019
1020                 } else {
1021                         backsql_strfcat( &bsi->bsi_flt_where, "cbbcbl",
1022                                         '(' /* ) */ ,
1023                                         &at->bam_sel_expr,
1024                                         &ordering,
1025                                         '\'',
1026                                         &f->f_av_value,
1027                                         (ber_len_t)STRLENOF( /* (' */ "')" ),
1028                                                 /* ( */ "')" );
1029                 }
1030                 break;
1031
1032         case LDAP_FILTER_PRESENT:
1033                 backsql_strfcat( &bsi->bsi_flt_where, "lbl",
1034                                 (ber_len_t)STRLENOF( "NOT (" /* ) */),
1035                                         "NOT (", /* ) */
1036                                 &at->bam_sel_expr,
1037                                 (ber_len_t)STRLENOF( /* ( */ " IS NULL)" ),
1038                                         /* ( */ " IS NULL)" );
1039                 break;
1040
1041         case LDAP_FILTER_SUBSTRINGS:
1042                 backsql_process_sub_filter( bsi, f, at );
1043                 break;
1044
1045         case LDAP_FILTER_APPROX:
1046                 /* we do our best */
1047
1048                 /*
1049                  * maybe we should check type of at->sel_expr here somehow,
1050                  * to know whether upper_func is applicable, but for now
1051                  * upper_func stuff is made for Oracle, where UPPER is
1052                  * safely applicable to NUMBER etc.
1053                  */
1054                 (void)backsql_process_filter_like( bsi, at, 1, &f->f_av_value );
1055                 break;
1056
1057         default:
1058                 /* unhandled filter type; should not happen */
1059                 assert( 0 );
1060                 backsql_strfcat( &bsi->bsi_flt_where, "l",
1061                                 (ber_len_t)STRLENOF( "1=1" ), "1=1" );
1062                 break;
1063
1064         }
1065
1066         Debug( LDAP_DEBUG_TRACE, "<==backsql_process_filter_attr(%s)\n",
1067                 at->bam_ad->ad_cname.bv_val, 0, 0 );
1068
1069         return 1;
1070 }
1071
1072 static int
1073 backsql_srch_query( backsql_srch_info *bsi, struct berval *query )
1074 {
1075         backsql_info    *bi = (backsql_info *)bsi->bsi_op->o_bd->be_private;
1076         int             rc;
1077
1078         assert( query );
1079         BER_BVZERO( query );
1080
1081         Debug( LDAP_DEBUG_TRACE, "==>backsql_srch_query()\n", 0, 0, 0 );
1082         BER_BVZERO( &bsi->bsi_sel.bb_val );
1083         BER_BVZERO( &bsi->bsi_sel.bb_val );
1084         bsi->bsi_sel.bb_len = 0;
1085         BER_BVZERO( &bsi->bsi_from.bb_val );
1086         bsi->bsi_from.bb_len = 0;
1087         BER_BVZERO( &bsi->bsi_join_where.bb_val );
1088         bsi->bsi_join_where.bb_len = 0;
1089         BER_BVZERO( &bsi->bsi_flt_where.bb_val );
1090         bsi->bsi_flt_where.bb_len = 0;
1091
1092         backsql_strfcat( &bsi->bsi_sel, "lbcbc",
1093                         (ber_len_t)STRLENOF( "SELECT DISTINCT ldap_entries.id," ),
1094                                 "SELECT DISTINCT ldap_entries.id,",
1095                         &bsi->bsi_oc->bom_keytbl,
1096                         '.',
1097                         &bsi->bsi_oc->bom_keycol,
1098                         ',' );
1099
1100         if ( !BER_BVISNULL( &bi->sql_strcast_func ) ) {
1101                 backsql_strfcat( &bsi->bsi_sel, "blbl",
1102                                 &bi->sql_strcast_func,
1103                                 (ber_len_t)STRLENOF( "('" /* ') */ ),
1104                                         "('" /* ') */ ,
1105                                 &bsi->bsi_oc->bom_oc->soc_cname,
1106                                 (ber_len_t)STRLENOF( /* (' */ "')" ),
1107                                         /* (' */ "')" );
1108         } else {
1109                 backsql_strfcat( &bsi->bsi_sel, "cbc",
1110                                 '\'',
1111                                 &bsi->bsi_oc->bom_oc->soc_cname,
1112                                 '\'' );
1113         }
1114 #ifdef BACKSQL_ALIASING_QUOTE
1115         backsql_strfcat( &bsi->bsi_sel, "lclcl",
1116                         (ber_len_t)STRLENOF( " " BACKSQL_ALIASING ),
1117                                 " " BACKSQL_ALIASING,
1118                         BACKSQL_ALIASING_QUOTE,
1119                         (ber_len_t)STRLENOF( "objectClass" ),
1120                                 "objectClass",
1121                         BACKSQL_ALIASING_QUOTE,
1122                         (ber_len_t)STRLENOF( ",ldap_entries.dn " BACKSQL_ALIASING "dn" ),
1123                                 ",ldap_entries.dn " BACKSQL_ALIASING "dn" );
1124 #else /* ! BACKSQL_ALIASING_QUOTE */
1125         backsql_strfcat( &bsi->bsi_sel, "l",
1126                         (ber_len_t)STRLENOF( " " BACKSQL_ALIASING "objectClass,ldap_entries.dn " BACKSQL_ALIASING "dn" ),
1127                                 " " BACKSQL_ALIASING "objectClass,ldap_entries.dn " BACKSQL_ALIASING "dn" );
1128 #endif /* ! BACKSQL_ALIASING_QUOTE */
1129
1130         backsql_strfcat( &bsi->bsi_from, "lb",
1131                         (ber_len_t)STRLENOF( " FROM ldap_entries," ),
1132                                 " FROM ldap_entries,",
1133                         &bsi->bsi_oc->bom_keytbl );
1134
1135         backsql_strfcat( &bsi->bsi_join_where, "lbcbl",
1136                         (ber_len_t)STRLENOF( " WHERE " ), " WHERE ",
1137                         &bsi->bsi_oc->bom_keytbl,
1138                         '.',
1139                         &bsi->bsi_oc->bom_keycol,
1140                         (ber_len_t)STRLENOF( "=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND " ),
1141                                 "=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND " );
1142
1143         switch ( bsi->bsi_scope ) {
1144         case LDAP_SCOPE_BASE:
1145                 if ( BACKSQL_CANUPPERCASE( bi ) ) {
1146                         backsql_strfcat( &bsi->bsi_join_where, "bl",
1147                                         &bi->sql_upper_func,
1148                                         (ber_len_t)STRLENOF( "(ldap_entries.dn)=?" ),
1149                                                 "(ldap_entries.dn)=?" );
1150                 } else {
1151                         backsql_strfcat( &bsi->bsi_join_where, "l",
1152                                         (ber_len_t)STRLENOF( "ldap_entries.dn=?" ),
1153                                                 "ldap_entries.dn=?" );
1154                 }
1155                 break;
1156
1157         case BACKSQL_SCOPE_BASE_LIKE:
1158                 if ( BACKSQL_CANUPPERCASE( bi ) ) {
1159                         backsql_strfcat( &bsi->bsi_join_where, "bl",
1160                                         &bi->sql_upper_func,
1161                                         (ber_len_t)STRLENOF( "(ldap_entries.dn) LIKE ?" ),
1162                                                 "(ldap_entries.dn) LIKE ?" );
1163                 } else {
1164                         backsql_strfcat( &bsi->bsi_join_where, "l",
1165                                         (ber_len_t)STRLENOF( "ldap_entries.dn LIKE ?" ),
1166                                                 "ldap_entries.dn LIKE ?" );
1167                 }
1168                 break;
1169
1170         case LDAP_SCOPE_ONELEVEL:
1171                 backsql_strfcat( &bsi->bsi_join_where, "l",
1172                                 (ber_len_t)STRLENOF( "ldap_entries.parent=?" ),
1173                                         "ldap_entries.parent=?" );
1174                 break;
1175
1176 #ifdef LDAP_SCOPE_SUBORDINATE
1177         case LDAP_SCOPE_SUBORDINATE:
1178 #endif /* LDAP_SCOPE_SUBORDINATE */
1179         case LDAP_SCOPE_SUBTREE:
1180                 if ( BACKSQL_CANUPPERCASE( bi ) ) {
1181                         backsql_strfcat( &bsi->bsi_join_where, "bl",
1182                                         &bi->sql_upper_func,
1183                                         (ber_len_t)STRLENOF( "(ldap_entries.dn) LIKE ?" ),
1184                                                 "(ldap_entries.dn) LIKE ?"  );
1185                 } else {
1186                         backsql_strfcat( &bsi->bsi_join_where, "l",
1187                                         (ber_len_t)STRLENOF( "ldap_entries.dn LIKE ?" ),
1188                                                 "ldap_entries.dn LIKE ?" );
1189                 }
1190
1191                 break;
1192
1193         default:
1194                 assert( 0 );
1195         }
1196
1197         rc = backsql_process_filter( bsi, bsi->bsi_filter );
1198         if ( rc > 0 ) {
1199                 struct berbuf   bb = BB_NULL;
1200
1201                 backsql_strfcat( &bb, "bbblb",
1202                                 &bsi->bsi_sel.bb_val,
1203                                 &bsi->bsi_from.bb_val,
1204                                 &bsi->bsi_join_where.bb_val,
1205                                 (ber_len_t)STRLENOF( " AND " ), " AND ",
1206                                 &bsi->bsi_flt_where.bb_val );
1207
1208                 *query = bb.bb_val;
1209
1210         } else if ( rc < 0 ) {
1211                 /*
1212                  * Indicates that there's no possible way the filter matches
1213                  * anything.  No need to issue the query
1214                  */
1215                 free( query->bv_val );
1216                 BER_BVZERO( query );
1217         }
1218
1219         free( bsi->bsi_sel.bb_val.bv_val );
1220         BER_BVZERO( &bsi->bsi_sel.bb_val );
1221         bsi->bsi_sel.bb_len = 0;
1222         free( bsi->bsi_from.bb_val.bv_val );
1223         BER_BVZERO( &bsi->bsi_from.bb_val );
1224         bsi->bsi_from.bb_len = 0;
1225         free( bsi->bsi_join_where.bb_val.bv_val );
1226         BER_BVZERO( &bsi->bsi_join_where.bb_val );
1227         bsi->bsi_join_where.bb_len = 0;
1228         free( bsi->bsi_flt_where.bb_val.bv_val );
1229         BER_BVZERO( &bsi->bsi_flt_where.bb_val );
1230         bsi->bsi_flt_where.bb_len = 0;
1231
1232         Debug( LDAP_DEBUG_TRACE, "<==backsql_srch_query() returns %s\n",
1233                 query->bv_val ? query->bv_val : "NULL", 0, 0 );
1234
1235         return ( rc <= 0 ? 1 : 0 );
1236 }
1237
1238 static int
1239 backsql_oc_get_candidates( void *v_oc, void *v_bsi )
1240 {
1241         backsql_oc_map_rec      *oc = v_oc;
1242         backsql_srch_info       *bsi = v_bsi;
1243         backsql_info            *bi = (backsql_info *)bsi->bsi_op->o_bd->be_private;
1244         struct berval           query;
1245         SQLHSTMT                sth;
1246         RETCODE                 rc;
1247         int                     res;
1248         BACKSQL_ROW_NTS         row;
1249         int                     i;
1250         int                     j;
1251         int                     n_candidates = bsi->bsi_n_candidates;
1252
1253         /*
1254          * + 1 because we need room for '%';
1255          * + 1 because we need room for ',' for LDAP_SCOPE_SUBORDINATE;
1256          * this makes a subtree
1257          * search for a DN BACKSQL_MAX_DN_LEN long legal
1258          * if it returns that DN only
1259          */
1260         char                    tmp_base_ndn[ BACKSQL_MAX_DN_LEN + 1 + 1 ];
1261
1262         bsi->bsi_status = LDAP_SUCCESS;
1263
1264         Debug( LDAP_DEBUG_TRACE, "==>backsql_oc_get_candidates(): oc=\"%s\"\n",
1265                         BACKSQL_OC_NAME( oc ), 0, 0 );
1266
1267         if ( bsi->bsi_n_candidates == -1 ) {
1268                 Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1269                         "unchecked limit has been overcome\n", 0, 0, 0 );
1270                 /* should never get here */
1271                 assert( 0 );
1272                 bsi->bsi_status = LDAP_ADMINLIMIT_EXCEEDED;
1273                 return BACKSQL_AVL_STOP;
1274         }
1275
1276         bsi->bsi_oc = oc;
1277         res = backsql_srch_query( bsi, &query );
1278         if ( res ) {
1279                 Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1280                         "error while constructing query for objectclass \"%s\"\n",
1281                         oc->bom_oc->soc_cname.bv_val, 0, 0 );
1282                 /*
1283                  * FIXME: need to separate errors from legally
1284                  * impossible filters
1285                  */
1286                 switch ( bsi->bsi_status ) {
1287                 case LDAP_SUCCESS:
1288                 case LDAP_UNDEFINED_TYPE:
1289                 case LDAP_NO_SUCH_OBJECT:
1290                         /* we are conservative... */
1291                 default:
1292                         bsi->bsi_status = LDAP_SUCCESS;
1293                         /* try next */
1294                         return BACKSQL_AVL_CONTINUE;
1295
1296                 case LDAP_ADMINLIMIT_EXCEEDED:
1297                 case LDAP_OTHER:
1298                         /* don't try any more */
1299                         return BACKSQL_AVL_STOP;
1300                 }
1301         }
1302
1303         if ( BER_BVISNULL( &query ) ) {
1304                 Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1305                         "could not construct query for objectclass \"%s\"\n",
1306                         oc->bom_oc->soc_cname.bv_val, 0, 0 );
1307                 bsi->bsi_status = LDAP_SUCCESS;
1308                 return BACKSQL_AVL_CONTINUE;
1309         }
1310
1311         Debug( LDAP_DEBUG_TRACE, "Constructed query: %s\n",
1312                         query.bv_val, 0, 0 );
1313
1314         rc = backsql_Prepare( bsi->bsi_dbh, &sth, query.bv_val, 0 );
1315         free( query.bv_val );
1316         BER_BVZERO( &query );
1317         if ( rc != SQL_SUCCESS ) {
1318                 Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1319                         "error preparing query\n", 0, 0, 0 );
1320                 backsql_PrintErrors( bi->sql_db_env, bsi->bsi_dbh, sth, rc );
1321                 bsi->bsi_status = LDAP_OTHER;
1322                 return BACKSQL_AVL_CONTINUE;
1323         }
1324
1325         Debug( LDAP_DEBUG_TRACE, "id: '%ld'\n", bsi->bsi_oc->bom_id, 0, 0 );
1326
1327         rc = backsql_BindParamInt( sth, 1, SQL_PARAM_INPUT,
1328                         &bsi->bsi_oc->bom_id );
1329         if ( rc != SQL_SUCCESS ) {
1330                 Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1331                         "error binding objectclass id parameter\n", 0, 0, 0 );
1332                 bsi->bsi_status = LDAP_OTHER;
1333                 return BACKSQL_AVL_CONTINUE;
1334         }
1335
1336         switch ( bsi->bsi_scope ) {
1337         case LDAP_SCOPE_BASE:
1338         case BACKSQL_SCOPE_BASE_LIKE:
1339                 /*
1340                  * We do not accept DNs longer than BACKSQL_MAX_DN_LEN;
1341                  * however this should be handled earlier
1342                  */
1343                 if ( bsi->bsi_base_ndn->bv_len > BACKSQL_MAX_DN_LEN ) {
1344                         bsi->bsi_status = LDAP_OTHER;
1345                         return BACKSQL_AVL_CONTINUE;
1346                 }
1347
1348                 AC_MEMCPY( tmp_base_ndn, bsi->bsi_base_ndn->bv_val,
1349                                 bsi->bsi_base_ndn->bv_len + 1 );
1350
1351                 /* uppercase DN only if the stored DN can be uppercased
1352                  * for comparison */
1353                 if ( BACKSQL_CANUPPERCASE( bi ) ) {
1354                         ldap_pvt_str2upper( tmp_base_ndn );
1355                 }
1356
1357                 Debug( LDAP_DEBUG_TRACE, "(base)dn: \"%s\"\n",
1358                                 tmp_base_ndn, 0, 0 );
1359
1360                 rc = backsql_BindParamStr( sth, 2, SQL_PARAM_INPUT,
1361                                 tmp_base_ndn, BACKSQL_MAX_DN_LEN );
1362                 if ( rc != SQL_SUCCESS ) {
1363                         Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1364                                 "error binding base_ndn parameter\n", 0, 0, 0 );
1365                         backsql_PrintErrors( bi->sql_db_env, bsi->bsi_dbh,
1366                                         sth, rc );
1367                         bsi->bsi_status = LDAP_OTHER;
1368                         return BACKSQL_AVL_CONTINUE;
1369                 }
1370                 break;
1371
1372 #ifdef LDAP_SCOPE_SUBORDINATE
1373         case LDAP_SCOPE_SUBORDINATE:
1374 #endif /* LDAP_SCOPE_SUBORDINATE */
1375         case LDAP_SCOPE_SUBTREE:
1376         {
1377                 /*
1378                  * We do not accept DNs longer than BACKSQL_MAX_DN_LEN;
1379                  * however this should be handled earlier
1380                  */
1381                 if ( bsi->bsi_base_ndn->bv_len > BACKSQL_MAX_DN_LEN ) {
1382                         bsi->bsi_status = LDAP_OTHER;
1383                         return BACKSQL_AVL_CONTINUE;
1384                 }
1385
1386                 /*
1387                  * Sets the parameters for the SQL built earlier
1388                  * NOTE that all the databases could actually use
1389                  * the TimesTen version, which would be cleaner
1390                  * and would also eliminate the need for the
1391                  * subtree_cond line in the configuration file.
1392                  * For now, I'm leaving it the way it is,
1393                  * so non-TimesTen databases use the original code.
1394                  * But at some point this should get cleaned up.
1395                  *
1396                  * If "dn" is being used, do a suffix search.
1397                  * If "dn_ru" is being used, do a prefix search.
1398                  */
1399                 if ( BACKSQL_HAS_LDAPINFO_DN_RU( bi ) ) {
1400                         tmp_base_ndn[ 0 ] = '\0';
1401
1402                         for ( i = 0, j = bsi->bsi_base_ndn->bv_len - 1;
1403                                         j >= 0; i++, j--) {
1404                                 tmp_base_ndn[ i ] = bsi->bsi_base_ndn->bv_val[ j ];
1405                         }
1406
1407 #ifdef LDAP_SCOPE_SUBORDINATE
1408                         if ( bsi->bsi_scope == LDAP_SCOPE_SUBORDINATE ) {
1409                                 tmp_base_ndn[ i++ ] = ',';
1410                         }
1411 #endif /* LDAP_SCOPE_SUBORDINATE */
1412
1413                         tmp_base_ndn[ i ] = '%';
1414                         tmp_base_ndn[ i + 1 ] = '\0';
1415
1416                 } else {
1417                         i = 0;
1418
1419                         tmp_base_ndn[ i++ ] = '%';
1420
1421 #ifdef LDAP_SCOPE_SUBORDINATE
1422                         if ( bsi->bsi_scope == LDAP_SCOPE_SUBORDINATE ) {
1423                                 tmp_base_ndn[ i++ ] = ',';
1424                         }
1425 #endif /* LDAP_SCOPE_SUBORDINATE */
1426
1427                         AC_MEMCPY( &tmp_base_ndn[ i ], bsi->bsi_base_ndn->bv_val,
1428                                 bsi->bsi_base_ndn->bv_len + 1 );
1429                 }
1430
1431                 /* uppercase DN only if the stored DN can be uppercased
1432                  * for comparison */
1433                 if ( BACKSQL_CANUPPERCASE( bi ) ) {
1434                         ldap_pvt_str2upper( tmp_base_ndn );
1435                 }
1436
1437 #ifdef LDAP_SCOPE_SUBORDINATE
1438                 if ( bsi->bsi_scope == LDAP_SCOPE_SUBORDINATE ) {
1439                         Debug( LDAP_DEBUG_TRACE, "(children)dn: \"%s\"\n",
1440                                 tmp_base_ndn, 0, 0 );
1441                 } else
1442 #endif /* LDAP_SCOPE_SUBORDINATE */
1443                 {
1444                         Debug( LDAP_DEBUG_TRACE, "(sub)dn: \"%s\"\n",
1445                                 tmp_base_ndn, 0, 0 );
1446                 }
1447
1448                 rc = backsql_BindParamStr( sth, 2, SQL_PARAM_INPUT,
1449                                 tmp_base_ndn, BACKSQL_MAX_DN_LEN );
1450                 if ( rc != SQL_SUCCESS ) {
1451                         Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1452                                 "error binding base_ndn parameter (2)\n",
1453                                 0, 0, 0 );
1454                         backsql_PrintErrors( bi->sql_db_env, bsi->bsi_dbh,
1455                                         sth, rc );
1456                         bsi->bsi_status = LDAP_OTHER;
1457                         return BACKSQL_AVL_CONTINUE;
1458                 }
1459                 break;
1460         }
1461
1462         case LDAP_SCOPE_ONELEVEL:
1463                 assert( !BER_BVISNULL( &bsi->bsi_base_id.eid_ndn ) );
1464
1465 #ifdef BACKSQL_ARBITRARY_KEY
1466                 Debug( LDAP_DEBUG_TRACE, "(one)id: \"%s\"\n",
1467                                 bsi->bsi_base_id.eid_id.bv_val, 0, 0 );
1468 #else /* ! BACKSQL_ARBITRARY_KEY */
1469                 Debug( LDAP_DEBUG_TRACE, "(one)id: '%lu'\n",
1470                                 bsi->bsi_base_id.eid_id, 0, 0 );
1471 #endif /* ! BACKSQL_ARBITRARY_KEY */
1472                 rc = backsql_BindParamID( sth, 2, SQL_PARAM_INPUT,
1473                                 &bsi->bsi_base_id.eid_id );
1474                 if ( rc != SQL_SUCCESS ) {
1475                         Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1476                                 "error binding base id parameter\n", 0, 0, 0 );
1477                         bsi->bsi_status = LDAP_OTHER;
1478                         return BACKSQL_AVL_CONTINUE;
1479                 }
1480                 break;
1481         }
1482
1483         rc = SQLExecute( sth );
1484         if ( !BACKSQL_SUCCESS( rc ) ) {
1485                 Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1486                         "error executing query\n", 0, 0, 0 );
1487                 backsql_PrintErrors( bi->sql_db_env, bsi->bsi_dbh, sth, rc );
1488                 SQLFreeStmt( sth, SQL_DROP );
1489                 bsi->bsi_status = LDAP_OTHER;
1490                 return BACKSQL_AVL_CONTINUE;
1491         }
1492
1493         backsql_BindRowAsStrings( sth, &row );
1494         rc = SQLFetch( sth );
1495         for ( ; BACKSQL_SUCCESS( rc ); rc = SQLFetch( sth ) ) {
1496                 struct berval           dn, pdn, ndn;
1497                 backsql_entryID         *c_id = NULL;
1498                 int                     ret;
1499
1500                 ber_str2bv( row.cols[ 3 ], 0, 0, &dn );
1501
1502                 if ( backsql_api_odbc2dn( bsi->bsi_op, bsi->bsi_rs, &dn ) ) {
1503                         continue;
1504                 }
1505
1506                 ret = dnPrettyNormal( NULL, &dn, &pdn, &ndn, NULL );
1507                 if ( dn.bv_val != row.cols[ 3 ] ) {
1508                         free( dn.bv_val );
1509                 }
1510
1511                 if ( ret != LDAP_SUCCESS ) {
1512                         continue;
1513                 }
1514
1515                 if ( bi->sql_baseObject && dn_match( &ndn, &bi->sql_baseObject->e_nname ) ) {
1516                         free( pdn.bv_val );
1517                         free( ndn.bv_val );
1518                         continue;
1519                 }
1520
1521                 c_id = (backsql_entryID *)ch_calloc( 1,
1522                                 sizeof( backsql_entryID ) );
1523 #ifdef BACKSQL_ARBITRARY_KEY
1524                 ber_str2bv( row.cols[ 0 ], 0, 1, &c_id->eid_id );
1525                 ber_str2bv( row.cols[ 1 ], 0, 1, &c_id->eid_keyval );
1526 #else /* ! BACKSQL_ARBITRARY_KEY */
1527                 c_id->eid_id = strtol( row.cols[ 0 ], NULL, 0 );
1528                 c_id->eid_keyval = strtol( row.cols[ 1 ], NULL, 0 );
1529 #endif /* ! BACKSQL_ARBITRARY_KEY */
1530                 c_id->eid_oc_id = bsi->bsi_oc->bom_id;
1531
1532                 c_id->eid_dn = pdn;
1533                 c_id->eid_ndn = ndn;
1534
1535                 /* append at end of list ... */
1536                 c_id->eid_next = NULL;
1537                 *bsi->bsi_id_listtail = c_id;
1538                 bsi->bsi_id_listtail = &c_id->eid_next;
1539
1540 #ifdef BACKSQL_ARBITRARY_KEY
1541                 Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1542                         "added entry id=%s, keyval=%s dn=\"%s\"\n",
1543                         c_id->eid_id.bv_val, c_id->eid_keyval.bv_val,
1544                         row.cols[ 3 ] );
1545 #else /* ! BACKSQL_ARBITRARY_KEY */
1546                 Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
1547                         "added entry id=%ld, keyval=%ld dn=\"%s\"\n",
1548                         c_id->eid_id, c_id->eid_keyval, row.cols[ 3 ] );
1549 #endif /* ! BACKSQL_ARBITRARY_KEY */
1550
1551                 /* count candidates, for unchecked limit */
1552                 bsi->bsi_n_candidates--;
1553                 if ( bsi->bsi_n_candidates == -1 ) {
1554                         break;
1555                 }
1556         }
1557         backsql_FreeRow( &row );
1558         SQLFreeStmt( sth, SQL_DROP );
1559
1560         Debug( LDAP_DEBUG_TRACE, "<==backsql_oc_get_candidates(): %d\n",
1561                         n_candidates - bsi->bsi_n_candidates, 0, 0 );
1562
1563         return ( bsi->bsi_n_candidates == -1 ? BACKSQL_AVL_STOP : BACKSQL_AVL_CONTINUE );
1564 }
1565
1566 int
1567 backsql_search( Operation *op, SlapReply *rs )
1568 {
1569         backsql_info            *bi = (backsql_info *)op->o_bd->be_private;
1570         SQLHDBC                 dbh;
1571         int                     sres;
1572         Entry                   user_entry = { 0 };
1573         int                     manageDSAit;
1574         time_t                  stoptime = 0;
1575         backsql_srch_info       bsi;
1576         backsql_entryID         *eid = NULL;
1577         struct berval           nbase = BER_BVNULL;
1578
1579         manageDSAit = get_manageDSAit( op );
1580
1581         Debug( LDAP_DEBUG_TRACE, "==>backsql_search(): "
1582                 "base=\"%s\", filter=\"%s\", scope=%d,",
1583                 op->o_req_ndn.bv_val,
1584                 op->ors_filterstr.bv_val,
1585                 op->ors_scope );
1586         Debug( LDAP_DEBUG_TRACE, " deref=%d, attrsonly=%d, "
1587                 "attributes to load: %s\n",
1588                 op->ors_deref,
1589                 op->ors_attrsonly,
1590                 op->ors_attrs == NULL ? "all" : "custom list" );
1591
1592         if ( op->o_req_ndn.bv_len > BACKSQL_MAX_DN_LEN ) {
1593                 Debug( LDAP_DEBUG_TRACE, "backsql_search(): "
1594                         "search base length (%ld) exceeds max length (%d)\n",
1595                         op->o_req_ndn.bv_len, BACKSQL_MAX_DN_LEN, 0 );
1596                 /*
1597                  * FIXME: a LDAP_NO_SUCH_OBJECT could be appropriate
1598                  * since it is impossible that such a long DN exists
1599                  * in the backend
1600                  */
1601                 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
1602                 send_ldap_result( op, rs );
1603                 return 1;
1604         }
1605
1606         sres = backsql_get_db_conn( op, &dbh );
1607         if ( sres != LDAP_SUCCESS ) {
1608                 Debug( LDAP_DEBUG_TRACE, "backsql_search(): "
1609                         "could not get connection handle - exiting\n",
1610                         0, 0, 0 );
1611                 rs->sr_err = sres;
1612                 rs->sr_text = sres == LDAP_OTHER ?  "SQL-backend error" : NULL;
1613                 send_ldap_result( op, rs );
1614                 return 1;
1615         }
1616
1617         /* compute it anyway; root does not use it */
1618         stoptime = op->o_time + op->ors_tlimit;
1619
1620         nbase = op->o_req_ndn;
1621         if ( backsql_api_dn2odbc( op, rs, &nbase ) ) {
1622                 Debug( LDAP_DEBUG_TRACE, "backsql_search(): "
1623                         "backsql_api_dn2odbc failed\n",
1624                         0, 0, 0 );
1625                 rs->sr_err = LDAP_OTHER;
1626                 rs->sr_text = "SQL-backend error";
1627                 send_ldap_result( op, rs );
1628                 goto done;
1629         }
1630
1631         /* init search */
1632         rs->sr_err = backsql_init_search( &bsi, &nbase,
1633                         op->ors_scope,
1634                         op->ors_slimit, op->ors_tlimit,
1635                         stoptime, op->ors_filter,
1636                         dbh, op, rs, op->ors_attrs, 1 );
1637         if ( rs->sr_err != LDAP_SUCCESS ) {
1638                 send_ldap_result( op, rs );
1639                 goto done;
1640         }
1641
1642         bsi.bsi_n_candidates =
1643                 ( op->ors_limit == NULL /* isroot == TRUE */ ? -2 :
1644                 ( op->ors_limit->lms_s_unchecked == -1 ? -2 :
1645                 ( op->ors_limit->lms_s_unchecked ) ) );
1646
1647         switch ( bsi.bsi_scope ) {
1648         case LDAP_SCOPE_BASE:
1649         case BACKSQL_SCOPE_BASE_LIKE:
1650                 /*
1651                  * probably already found...
1652                  */
1653                 bsi.bsi_id_list = &bsi.bsi_base_id;
1654                 bsi.bsi_id_listtail = &bsi.bsi_base_id.eid_next;
1655                 break;
1656
1657         case LDAP_SCOPE_SUBTREE:
1658                 /*
1659                  * if baseObject is defined, and if it is the root
1660                  * of the search, add it to the candidate list
1661                  */
1662                 if ( bi->sql_baseObject && BACKSQL_IS_BASEOBJECT_ID( &bsi.bsi_base_id.eid_id ) )
1663                 {
1664                         bsi.bsi_id_list = &bsi.bsi_base_id;
1665                         bsi.bsi_id_listtail = &bsi.bsi_base_id.eid_next;
1666                 }
1667
1668                 /* FALLTHRU */
1669         default:
1670
1671                 /*
1672                  * for each objectclass we try to construct query which gets IDs
1673                  * of entries matching LDAP query filter and scope (or at least
1674                  * candidates), and get the IDs
1675                  */
1676                 avl_apply( bi->sql_oc_by_oc, backsql_oc_get_candidates,
1677                                 &bsi, BACKSQL_AVL_STOP, AVL_INORDER );
1678         }
1679
1680         if ( op->ors_limit != NULL      /* isroot == FALSE */
1681                         && op->ors_limit->lms_s_unchecked != -1
1682                         && bsi.bsi_n_candidates == -1 )
1683         {
1684                 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
1685                 send_ldap_result( op, rs );
1686                 goto done;
1687         }
1688
1689         /*
1690          * now we load candidate entries (only those attributes
1691          * mentioned in attrs and filter), test it against full filter
1692          * and then send to client; don't free entry_id if baseObject...
1693          */
1694         for ( eid = bsi.bsi_id_list;
1695                         eid != NULL;
1696                         eid = backsql_free_entryID( eid, eid == &bsi.bsi_base_id ? 0 : 1 ) )
1697         {
1698                 int             rc;
1699                 Attribute       *a_hasSubordinate = NULL,
1700                                 *a_entryUUID = NULL,
1701                                 *a = NULL;
1702                 Entry           *e = NULL;
1703
1704                 /* check for abandon */
1705                 if ( op->o_abandon ) {
1706                         break;
1707                 }
1708
1709                 /* check time limit */
1710                 if ( op->ors_tlimit != SLAP_NO_LIMIT
1711                                 && slap_get_time() > stoptime )
1712                 {
1713                         rs->sr_err = LDAP_TIMELIMIT_EXCEEDED;
1714                         rs->sr_ctrls = NULL;
1715                         rs->sr_ref = rs->sr_v2ref;
1716                         rs->sr_err = (rs->sr_v2ref == NULL) ? LDAP_SUCCESS
1717                                 : LDAP_REFERRAL;
1718                         send_ldap_result( op, rs );
1719                         goto end_of_search;
1720                 }
1721
1722 #ifdef BACKSQL_ARBITRARY_KEY
1723                 Debug(LDAP_DEBUG_TRACE, "backsql_search(): loading data "
1724                         "for entry id=%s, oc_id=%ld, keyval=%s\n",
1725                         eid->eid_id.bv_val, eid->eid_oc_id,
1726                         eid->eid_keyval.bv_val );
1727 #else /* ! BACKSQL_ARBITRARY_KEY */
1728                 Debug(LDAP_DEBUG_TRACE, "backsql_search(): loading data "
1729                         "for entry id=%ld, oc_id=%ld, keyval=%ld\n",
1730                         eid->eid_id, eid->eid_oc_id, eid->eid_keyval );
1731 #endif /* ! BACKSQL_ARBITRARY_KEY */
1732
1733                 /* don't recollect baseObject ... */
1734                 if ( BACKSQL_IS_BASEOBJECT_ID( &eid->eid_id ) ) {
1735                         e = bi->sql_baseObject;
1736
1737                 } else {
1738                         bsi.bsi_e = &user_entry;
1739                         rc = backsql_id2entry( &bsi, eid );
1740                         if ( rc != LDAP_SUCCESS ) {
1741                                 Debug( LDAP_DEBUG_TRACE, "backsql_search(): "
1742                                         "error %d in backsql_id2entry() "
1743                                         "- skipping\n", rc, 0, 0 );
1744                                 continue;
1745                         }
1746
1747                         e = &user_entry;
1748                 }
1749
1750                 /* check scope */
1751                 switch ( op->ors_scope ) {
1752                 case LDAP_SCOPE_BASE:
1753                 case BACKSQL_SCOPE_BASE_LIKE:
1754                         if ( !dn_match( &e->e_nname, &op->o_req_ndn ) ) {
1755                                 goto next_entry;
1756                         }
1757                         break;
1758
1759                 case LDAP_SCOPE_ONE:
1760                 {
1761                         struct berval   rdn = user_entry.e_nname;
1762
1763                         rdn.bv_len -= op->o_req_ndn.bv_len + STRLENOF( "," );
1764                         if ( !dnIsOneLevelRDN( &rdn ) ) {
1765                                 goto next_entry;
1766                         }
1767                         /* fall thru */
1768                 }
1769
1770 #ifdef LDAP_SCOPE_SUBORDINATE
1771                 case LDAP_SCOPE_SUBORDINATE:
1772                         /* discard the baseObject entry */
1773                         if ( dn_match( &e->e_nname, &op->o_req_ndn ) ) {
1774                                 goto next_entry;
1775                         }
1776                 /* FALLTHRU */
1777 #endif /* LDAP_SCOPE_SUBORDINATE */
1778
1779                 case LDAP_SCOPE_SUBTREE:
1780                         /* FIXME: this should never fail... */
1781                         if ( !dnIsSuffix( &e->e_nname, &op->o_req_ndn ) ) {
1782                                 goto next_entry;
1783                         }
1784                         break;
1785                 }
1786
1787                 if ( !manageDSAit &&
1788                                 op->ors_scope != LDAP_SCOPE_BASE &&
1789                                 op->ors_scope != BACKSQL_SCOPE_BASE_LIKE &&
1790                                 is_entry_referral( e ) )
1791                 {
1792                         BerVarray refs;
1793
1794                         refs = get_entry_referrals( op, e );
1795                         if ( !refs ) {
1796                                 backsql_srch_info       bsi2 = { 0 };
1797                                 Entry                   user_entry2 = { 0 };
1798
1799                                 /* retry with the full entry... */
1800                                 (void)backsql_init_search( &bsi2,
1801                                                 &e->e_nname,
1802                                                 LDAP_SCOPE_BASE,
1803                                                 -1, -1, -1, NULL,
1804                                                 dbh, op, rs, NULL, 0 );
1805                                 bsi2.bsi_e = &user_entry2;
1806                                 rc = backsql_id2entry( &bsi2, eid );
1807                                 if ( rc == LDAP_SUCCESS ) {
1808                                         if ( is_entry_referral( &user_entry2 ) )
1809                                         {
1810                                                 refs = get_entry_referrals( op,
1811                                                                 &user_entry2 );
1812                                         } /* else: FIXME: inconsistency! */
1813                                         entry_clean( &user_entry2 );
1814                                 }
1815                         }
1816
1817                         if ( refs ) {
1818                                 rs->sr_ref = referral_rewrite( refs,
1819                                                 &e->e_name,
1820                                                 &op->o_req_dn,
1821                                                 op->ors_scope );
1822                                 ber_bvarray_free( refs );
1823                         }
1824
1825                         if ( !rs->sr_ref ) {
1826                                 rs->sr_text = "bad_referral object";
1827                         }
1828
1829                         rs->sr_err = LDAP_REFERRAL;
1830                         rs->sr_matched = user_entry.e_name.bv_val;
1831                         send_search_reference( op, rs );
1832
1833                         ber_bvarray_free( rs->sr_ref );
1834                         rs->sr_ref = NULL;
1835                         rs->sr_matched = NULL;
1836
1837                         goto next_entry;
1838                 }
1839
1840                 /*
1841                  * We use this flag since we need to parse the filter
1842                  * anyway; we should have used the frontend API function
1843                  * filter_has_subordinates()
1844                  */
1845                 if ( bsi.bsi_flags & BSQL_SF_FILTER_HASSUBORDINATE ) {
1846                         rc = backsql_has_children( bi, dbh, &e->e_nname );
1847
1848                         switch ( rc ) {
1849                         case LDAP_COMPARE_TRUE:
1850                         case LDAP_COMPARE_FALSE:
1851                                 a_hasSubordinate = slap_operational_hasSubordinate( rc == LDAP_COMPARE_TRUE );
1852                                 if ( a_hasSubordinate != NULL ) {
1853                                         for ( a = user_entry.e_attrs;
1854                                                         a && a->a_next;
1855                                                         a = a->a_next );
1856
1857                                         a->a_next = a_hasSubordinate;
1858                                 }
1859                                 rc = 0;
1860                                 break;
1861
1862                         default:
1863                                 Debug(LDAP_DEBUG_TRACE,
1864                                         "backsql_search(): "
1865                                         "has_children failed( %d)\n",
1866                                         rc, 0, 0 );
1867                                 rc = 1;
1868                                 goto next_entry;
1869                         }
1870                 }
1871
1872                 if ( bsi.bsi_flags & BSQL_SF_FILTER_ENTRYUUID ) {
1873                         a_entryUUID = backsql_operational_entryUUID( bi, eid );
1874                         if ( a_entryUUID != NULL ) {
1875                                 for ( a = user_entry.e_attrs;
1876                                                 a && a->a_next;
1877                                                 a = a->a_next );
1878
1879                                 a->a_next = a_entryUUID;
1880                         }
1881                 }
1882
1883                 if ( test_filter( op, e, op->ors_filter ) == LDAP_COMPARE_TRUE )
1884                 {
1885 #if 0
1886                         if ( a_hasSubordinate && !( bsi.bsi_flags & BSQL_SF_ALL_OPER )
1887                                         && !ad_inlist( slap_schema.si_ad_hasSubordinates, op->ors_attrs ) )
1888                         {
1889                                 a->a_next = NULL;
1890                                 attr_free( a_hasSubordinate );
1891                                 a_hasSubordinate = NULL;
1892                         }
1893
1894                         if ( a_entryUUID && !( bsi.bsi_flags & BSQL_SF_ALL_OPER )
1895                                         && !ad_inlist( slap_schema.si_ad_entryUUID, op->ors_attrs ) )
1896                         {
1897                                 a->a_next = NULL;
1898                                 attr_free( a_hasSubordinate );
1899                                 a_hasSubordinate = NULL;
1900                         }
1901 #endif
1902
1903                         rs->sr_attrs = op->ors_attrs;
1904                         rs->sr_operational_attrs = NULL;
1905                         rs->sr_entry = e;
1906                         if ( e == &user_entry ) {
1907                                 rs->sr_flags = REP_ENTRY_MODIFIABLE;
1908                         }
1909                         sres = send_search_entry( op, rs );
1910                         rs->sr_entry = NULL;
1911                         rs->sr_attrs = NULL;
1912                         rs->sr_operational_attrs = NULL;
1913
1914                         switch ( sres ) {
1915                         case 0:
1916                                 break;
1917
1918                         default:
1919                                 /*
1920                                  * FIXME: send_search_entry failed;
1921                                  * better stop
1922                                  */
1923                         case -1:
1924                                 Debug( LDAP_DEBUG_TRACE, "backsql_search(): "
1925                                         "connection lost\n", 0, 0, 0 );
1926                                 goto end_of_search;
1927                         }
1928                 }
1929
1930 next_entry:;
1931                 entry_clean( &user_entry );
1932
1933                 if ( op->ors_slimit != SLAP_NO_LIMIT
1934                                 && rs->sr_nentries >= op->ors_slimit )
1935                 {
1936                         rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
1937                         send_ldap_result( op, rs );
1938                         goto end_of_search;
1939                 }
1940         }
1941
1942 end_of_search:;
1943         /* in case we got here accidentally */
1944         entry_clean( &user_entry );
1945
1946         if ( rs->sr_nentries > 0 ) {
1947                 rs->sr_ref = rs->sr_v2ref;
1948                 rs->sr_err = (rs->sr_v2ref == NULL) ? LDAP_SUCCESS
1949                         : LDAP_REFERRAL;
1950
1951         } else {
1952                 rs->sr_err = bsi.bsi_status;
1953         }
1954         send_ldap_result( op, rs );
1955
1956         if ( rs->sr_v2ref ) {
1957                 ber_bvarray_free( rs->sr_v2ref );
1958                 rs->sr_v2ref = NULL;
1959         }
1960
1961 done:;
1962         if ( !BER_BVISNULL( &bsi.bsi_base_id.eid_ndn ) ) {
1963                 (void)backsql_free_entryID( &bsi.bsi_base_id, 0 );
1964         }
1965
1966         if ( bsi.bsi_attrs ) {
1967                 ch_free( bsi.bsi_attrs );
1968         }
1969
1970         if ( !BER_BVISNULL( &nbase )
1971                         && nbase.bv_val != op->o_req_ndn.bv_val )
1972         {
1973                 ch_free( nbase.bv_val );
1974         }
1975
1976         /* restore scope ... FIXME: this should be done before ANY
1977          * frontend call that uses op */
1978         if ( op->ors_scope == BACKSQL_SCOPE_BASE_LIKE ) {
1979                 op->ors_scope = LDAP_SCOPE_BASE;
1980         }
1981
1982         Debug( LDAP_DEBUG_TRACE, "<==backsql_search()\n", 0, 0, 0 );
1983         return 0;
1984 }
1985