]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/back-bdb/search.c
Use EntryInfo navigation for search scope checks
[openldap] / servers / slapd / back-bdb / search.c
index 5ba85e50ca0515b9fd53778367d3f9b452b75d5e..046efa547130539124af21f77278c5736729e190 100644 (file)
@@ -21,18 +21,266 @@ static int base_candidate(
 static int search_candidates(
        Operation *stackop,     /* op with the current threadctx/slab cache */
        Operation *sop,         /* search op */
+       SlapReply *rs,
        Entry *e,
-       ID      *ids );
+       u_int32_t locker,
+       ID      *ids,
+       ID      *scopes );
 static void send_pagerequest_response( 
        Operation *op,
        SlapReply *rs,
        ID  lastid,
-       int tentries );                 
+       int tentries );
+
+/* Dereference aliases for a single alias entry. Return the final
+ * dereferenced entry on success, NULL on any failure.
+ */
+static Entry * deref_base (
+       Operation *op,
+       SlapReply *rs,
+       Entry *e,
+       Entry **matched,
+       u_int32_t locker,
+       DB_LOCK *lock,
+       ID      *tmp,
+       ID      *visited )
+{
+       struct bdb_info *bdb = (struct bdb_info *) op->o_bd->be_private;
+       struct berval ndn;
+       EntryInfo *ei;
+       DB_LOCK lockr;
+
+       rs->sr_err = LDAP_ALIAS_DEREF_PROBLEM;
+       rs->sr_text = "maximum deref depth exceeded";
+
+       while (BDB_IDL_N(tmp) < op->o_bd->be_max_deref_depth) {
+
+               /* Remember the last entry we looked at, so we can
+                * report broken links
+                */
+               *matched = e;
+
+               /* If this is part of a subtree or onelevel search,
+                * have we seen this ID before? If so, quit.
+                */
+               if ( visited && bdb_idl_insert( visited, e->e_id ) ) {
+                       e = NULL;
+                       break;
+               }
+
+               /* If we've seen this ID during this deref iteration,
+                * we've hit a loop.
+                */
+               if ( bdb_idl_insert( tmp, e->e_id ) ) {
+                       rs->sr_err = LDAP_ALIAS_PROBLEM;
+                       rs->sr_text = "circular alias";
+                       e = NULL;
+                       break;
+               }
+
+               /* If there was a problem getting the aliasedObjectName,
+                * get_alias_dn will have set the error status.
+                */
+               if ( get_alias_dn(e, &ndn, &rs->sr_err, &rs->sr_text) ) {
+                       e = NULL;
+                       break;
+               }
+
+               rs->sr_err = bdb_dn2entry( op->o_bd, NULL, &ndn, &ei,
+                       0, locker, &lockr, op->o_tmpmemctx );
+
+               if ( ei ) e = ei->bei_e;
+               else    e = NULL;
+
+               if (!e) {
+                       rs->sr_err = LDAP_ALIAS_PROBLEM;
+                       rs->sr_text = "aliasedObject not found";
+                       break;
+               }
+
+               /* Free the previous entry, continue to work with the
+                * one we just retrieved.
+                */
+               bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache,
+                       *matched, lock);
+               *lock = lockr;
+
+               /* We found a regular entry. Return this to the caller. The
+                * entry is still locked for Read.
+                */
+               if (!is_entry_alias(e)) {
+                       rs->sr_err = LDAP_SUCCESS;
+                       rs->sr_text = NULL;
+                       break;
+               }
+       }
+       return e;
+}
 
+/* Look for and dereference all aliases within the search scope. Adds
+ * the dereferenced entries to the "ids" list. Requires "stack" to be
+ * able to hold 8 levels of DB_SIZE IDLs.
+ */
+static int search_aliases(
+       Operation *op,
+       SlapReply *rs,
+       Entry *e,
+       u_int32_t locker,
+       Filter *sf,
+       ID *ids,
+       ID *scopes,
+       ID *stack
+)
+{
+       struct bdb_info *bdb = (struct bdb_info *) op->o_bd->be_private;
+       ID *aliases, *curscop, *subscop, *visited, *newsubs, *oldsubs, *tmp;
+       ID cursora, ida, cursoro, ido, *subscop2;
+       Entry *matched, *a;
+       EntryInfo *ei;
+       struct berval bv_alias = { sizeof("alias")-1, "alias" };
+       AttributeAssertion aa_alias;
+       Filter  af;
+       DB_LOCK locka, lockr;
+       int first = 1;
+
+
+       aliases = stack;        /* IDL of all aliases in the database */
+       curscop = aliases + BDB_IDL_DB_SIZE;    /* Aliases in the current scope */
+       subscop = curscop + BDB_IDL_DB_SIZE;    /* The current scope */
+       visited = subscop + BDB_IDL_DB_SIZE;    /* IDs we've seen in this search */
+       newsubs = visited + BDB_IDL_DB_SIZE;    /* New subtrees we've added */
+       oldsubs = newsubs + BDB_IDL_DB_SIZE;    /* Subtrees added previously */
+       tmp = oldsubs + BDB_IDL_DB_SIZE;        /* Scratch space for deref_base() */
+
+       /* A copy of subscop, because subscop gets clobbered by
+        * the bdb_idl_union/intersection routines
+        */
+       subscop2 = tmp + BDB_IDL_DB_SIZE;
+
+       af.f_choice = LDAP_FILTER_EQUALITY;
+       af.f_ava = &aa_alias;
+       af.f_av_desc = slap_schema.si_ad_objectClass;
+       af.f_av_value = bv_alias;
+       af.f_next = NULL;
+
+       /* Find all aliases in database */
+       BDB_IDL_ALL( bdb, aliases );
+       rs->sr_err = bdb_filter_candidates( op, &af, aliases,
+               curscop, visited );
+       if (rs->sr_err != LDAP_SUCCESS) {
+               return rs->sr_err;
+       }
+       oldsubs[0] = 1;
+       oldsubs[1] = e->e_id;
+
+       BDB_IDL_ZERO( ids );
+       BDB_IDL_ZERO( visited );
+       BDB_IDL_ZERO( newsubs );
+
+       cursoro = 0;
+       ido = bdb_idl_first( oldsubs, &cursoro );
+
+       for (;;) {
+               /* Set curscop to only the aliases in the current scope. Start with
+                * all the aliases, obtain the IDL for the current scope, and then
+                * get the intersection of these two IDLs. Add the current scope
+                * to the cumulative list of candidates.
+                */
+               BDB_IDL_CPY( curscop, aliases );
+               rs->sr_err = bdb_filter_candidates( op, sf, subscop, NULL, NULL );
+               if (first) {
+                       first = 0;
+               } else {
+                       bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache, e, &locka);
+               }
+               BDB_IDL_CPY(subscop2, subscop);
+               rs->sr_err = bdb_idl_intersection(curscop, subscop);
+               bdb_idl_union( ids, subscop2 );
+
+               /* Dereference all of the aliases in the current scope. */
+               cursora = 0;
+               for (ida = bdb_idl_first(curscop, &cursora); ida != NOID;
+                       ida = bdb_idl_next(curscop, &cursora))
+               {
+                       ei = NULL;
+                       rs->sr_err = bdb_cache_find_entry_id(op->o_bd, NULL,
+                               ida, &ei, 0, locker, &lockr, op->o_tmpmemctx );
+                       if (rs->sr_err != LDAP_SUCCESS) {
+                               continue;
+                       }
+                       a = ei->bei_e;
+
+                       /* This should only happen if the curscop IDL has maxed out and
+                        * turned into a range that spans IDs indiscriminately
+                        */
+                       if (!is_entry_alias(a)) {
+                               bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache,
+                                       a, &lockr);
+                               continue;
+                       }
+
+                       /* Actually dereference the alias */
+                       BDB_IDL_ZERO(tmp);
+                       a = deref_base( op, rs, a, &matched, locker, &lockr,
+                               tmp, visited );
+                       if (a) {
+                               /* If the target was not already in our current candidates,
+                                * make note of it in the newsubs list. Also
+                                * set it in the scopes list so that bdb_search
+                                * can check it.
+                                */
+                               if (bdb_idl_insert(ids, a->e_id) == 0) {
+                                       bdb_idl_insert(newsubs, a->e_id);
+                                       bdb_idl_insert(scopes, a->e_id);
+                               }
+                               bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache,
+                                       a, &lockr);
+
+                       } else if (matched) {
+                               /* Alias could not be dereferenced, or it deref'd to
+                                * an ID we've already seen. Ignore it.
+                                */
+                               bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache,
+                                       matched, &lockr );
+                               rs->sr_text = NULL;
+                       }
+               }
+               /* If this is a OneLevel search, we're done; oldsubs only had one
+                * ID in it. For a Subtree search, oldsubs may be a list of scope IDs.
+                */
+               if (op->ors_scope != LDAP_SCOPE_SUBTREE) break;
+nextido:
+               ido = bdb_idl_next( oldsubs, &cursoro );
+               
+               /* If we're done processing the old scopes, did we add any new
+                * scopes in this iteration? If so, go back and do those now.
+                */
+               if (ido == NOID) {
+                       if (BDB_IDL_IS_ZERO(newsubs)) break;
+                       BDB_IDL_CPY(oldsubs, newsubs);
+                       BDB_IDL_ZERO(newsubs);
+                       cursoro = 0;
+                       ido = bdb_idl_first( oldsubs, &cursoro );
+               }
+
+               /* Find the entry corresponding to the next scope. If it can't
+                * be found, ignore it and move on. This should never happen;
+                * we should never see the ID of an entry that doesn't exist.
+                * Set the name so that the scope's IDL can be retrieved.
+                */
+               ei = NULL;
+               rs->sr_err = bdb_cache_find_entry_id(op->o_bd, NULL, ido, &ei,
+                       0, locker, &locka, op->o_tmpmemctx );
+               if (rs->sr_err != LDAP_SUCCESS) goto nextido;
+               e = ei->bei_e;
+               sf->f_dn = &e->e_nname;
+       }
+       return rs->sr_err;
+}
+       
 #if defined(LDAP_CLIENT_UPDATE) || defined(LDAP_SYNC)
 #define IS_BDB_REPLACE(type) (( type == LDAP_PSEARCH_BY_DELETE ) || \
-                       ( type == LDAP_PSEARCH_BY_SCOPEOUT ))
-
+       ( type == LDAP_PSEARCH_BY_SCOPEOUT ))
 #define IS_PSEARCH (op != sop)
 
 int
@@ -67,13 +315,13 @@ bdb_cancel( Operation *op, SlapReply *rs )
                                LDAP_LIST_REMOVE( ps_list, o_ps_link );
 
 #if 0
-                               bdb_build_sync_done_ctrl( conn, ps_list, ps_list->ctrls, 1, &latest_entrycsn_bv );
-                               send_search_result( conn, ps_list, LDAP_CANCELLED,
-                                               NULL, NULL, NULL, ps_list->ctrls, ps_list->nentries);
+                               bdb_build_sync_done_ctrl( conn, ps_list, ps_list->ctrls,
+                                       1, &latest_entrycsn_bv );
+                               send_ldap_result( conn, ps_list, LDAP_CANCELLED,
+                                       NULL, NULL, NULL, ps_list->ctrls, ps_list->nentries);
 #endif
                                rs->sr_err = LDAP_CANCELLED;
-                               rs->sr_nentries = 0;
-                               send_search_result( ps_list, rs );
+                               send_ldap_result( ps_list, rs );
 
                                slap_op_free ( ps_list );
                                return LDAP_SUCCESS;
@@ -92,22 +340,25 @@ int bdb_search( Operation *op, SlapReply *rs )
  * sop is the persistent search. For regular searches, sop = op.
  */
 int
-bdb_do_search( Operation *op, SlapReply *rs, Operation *sop, Entry *ps_e, int ps_type )
+bdb_do_search( Operation *op, SlapReply *rs, Operation *sop,
+       Entry *ps_e, int ps_type )
 #else
-int bdb_search( Operation *op, SlapReply *rs )
-#define        sop     op
 #define        IS_PSEARCH      0
+#define        sop     op
+int bdb_search( Operation *op, SlapReply *rs )
 #endif
 {
        struct bdb_info *bdb = (struct bdb_info *) op->o_bd->be_private;
        time_t          stoptime;
        ID              id, cursor;
        ID              candidates[BDB_IDL_UM_SIZE];
-       Entry           *e = NULL;
+       ID              scopes[BDB_IDL_DB_SIZE];
+       Entry           *e = NULL, base;
        Entry   *matched = NULL;
+       EntryInfo       *ei;
        struct berval   realbase = { 0, NULL };
        int             manageDSAit;
-       int             nentries = 0, tentries = 0;
+       int             tentries = 0;
        ID              lastid = NOID;
        AttributeName   *attrs;
 
@@ -115,7 +366,9 @@ int bdb_search( Operation *op, SlapReply *rs )
        Filter          cookief, csnfnot, csnfeq, csnfand, csnfge;
        AttributeAssertion aa_ge, aa_eq;
        int             entry_count = 0;
+#if 0
        struct berval   entrycsn_bv = { 0, NULL };
+#endif
        struct berval   latest_entrycsn_bv = { 0, NULL };
        LDAPControl     *ctrls[SLAP_SEARCH_MAX_CTRLS];
        int             num_ctrls = 0;
@@ -133,7 +386,7 @@ int bdb_search( Operation *op, SlapReply *rs )
        DB_LOCK         lock;
 
 #ifdef NEW_LOGGING
-       LDAP_LOG ( OPERATION, ENTRY, "bdb_back_search\n", 0, 0, 0 );
+       LDAP_LOG( OPERATION, ENTRY, "bdb_back_search\n", 0, 0, 0 );
 #else
        Debug( LDAP_DEBUG_TRACE, "=> bdb_back_search\n",
                0, 0, 0);
@@ -161,8 +414,9 @@ int bdb_search( Operation *op, SlapReply *rs )
        null_attr.an_name.bv_val = NULL;
 #endif
 
-       for ( num_ctrls = 0; num_ctrls < SLAP_SEARCH_MAX_CTRLS; num_ctrls++ )
+       for ( num_ctrls = 0; num_ctrls < SLAP_SEARCH_MAX_CTRLS; num_ctrls++ ) {
                ctrls[num_ctrls] = NULL;
+       }
        num_ctrls = 0;
 
        if ( IS_PSEARCH && IS_BDB_REPLACE(ps_type)) {
@@ -193,6 +447,7 @@ int bdb_search( Operation *op, SlapReply *rs )
                }
        }
 #endif
+
        manageDSAit = get_manageDSAit( sop );
 
        rs->sr_err = LOCK_ID (bdb->bi_dbenv, &locker );
@@ -209,30 +464,19 @@ int bdb_search( Operation *op, SlapReply *rs )
                /* DIT root special case */
                e = (Entry *) &slap_entry_root;
                rs->sr_err = 0;
-       } else                                          
-#ifdef BDB_ALIASES
-       /* get entry with reader lock */
-       if ( deref & LDAP_DEREF_FINDING ) {
-               e = deref_dn_r( op->o_bd, &sop->o_req_ndn, &rs->sr_err, &matched, &rs->sr_text );
-
-       } else
-#endif
-       {
+       } else {
 dn2entry_retry:
-               rs->sr_err = bdb_dn2entry_r( op->o_bd, NULL, &sop->o_req_ndn, &e, &matched, 0, locker, &lock );
+               /* get entry with reader lock */
+               rs->sr_err = bdb_dn2entry( op->o_bd, NULL, &sop->o_req_ndn, &ei,
+                       1, locker, &lock, op->o_tmpmemctx );
        }
 
        switch(rs->sr_err) {
        case DB_NOTFOUND:
+               matched = ei->bei_e; break;
        case 0:
-               break;
+               e = ei->bei_e; break;
        case LDAP_BUSY:
-               if (e != NULL) {
-                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
-               }
-               if (matched != NULL) {
-                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
-               }
                send_ldap_error( sop, rs, LDAP_BUSY, "ldap server busy" );
                LOCK_ID_FREE (bdb->bi_dbenv, locker );
                return LDAP_BUSY;
@@ -240,17 +484,17 @@ dn2entry_retry:
        case DB_LOCK_NOTGRANTED:
                goto dn2entry_retry;
        default:
-               if (e != NULL) {
-                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
-               }
-               if (matched != NULL) {
-                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
-               }
                send_ldap_error( sop, rs, LDAP_OTHER, "internal error" );
                LOCK_ID_FREE (bdb->bi_dbenv, locker );
                return rs->sr_err;
        }
 
+       if ( e && (op->ors_deref & LDAP_DEREF_FINDING) && is_entry_alias(e) ) {
+               BDB_IDL_ZERO(candidates);
+               e = deref_base( op, rs, e, &matched, locker, &lock,
+                       candidates, NULL );
+       }
+
        if ( e == NULL ) {
                struct berval matched_dn = { 0, NULL };
 
@@ -262,7 +506,8 @@ dn2entry_retry:
                                ? get_entry_referrals( op, matched )
                                : NULL;
 
-                       bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
+                       bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache,
+                               matched, &lock);
                        matched = NULL;
 
                        if( erefs ) {
@@ -367,7 +612,7 @@ dn2entry_retry:
                        /* positive hard limit means abort */
                        } else if ( limit->lms_t_hard > 0 ) {
                                rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
-                               send_search_result( sop, rs );
+                               send_ldap_result( sop, rs );
                                rs->sr_err = 0;
                                goto done;
                        }
@@ -394,7 +639,7 @@ dn2entry_retry:
                        /* positive hard limit means abort */
                        } else if ( limit->lms_s_hard > 0 ) {
                                rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
-                               send_search_result( sop, rs );
+                               send_ldap_result( sop, rs );
                                rs->sr_err = 0; 
                                goto done;
                        }
@@ -406,13 +651,28 @@ dn2entry_retry:
        /* compute it anyway; root does not use it */
        stoptime = op->o_time + sop->oq_search.rs_tlimit;
 
+       /* need normalized dn below */
+       ber_dupbv( &realbase, &e->e_nname );
+
+       /* Copy info to base, must free entry before accessing the database
+        * in search_candidates, to avoid deadlocks.
+        */
+       base.e_nname = realbase;
+       base.e_id = e->e_id;
+
+       if ( e != &slap_entry_root ) {
+               bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
+       }
+       e = NULL;
+
        /* select candidates */
        if ( sop->oq_search.rs_scope == LDAP_SCOPE_BASE ) {
-               rs->sr_err = base_candidate( op->o_bd, e, candidates );
+               rs->sr_err = base_candidate( op->o_bd, &base, candidates );
 
        } else {
                BDB_IDL_ALL( bdb, candidates );
-               rs->sr_err = search_candidates( op, sop, e, candidates );
+               BDB_IDL_ZERO( scopes );
+               rs->sr_err = search_candidates( op, sop, rs, &base, locker, candidates, scopes );
        }
 
        /* start cursor at beginning of candidates.
@@ -438,14 +698,6 @@ dn2entry_retry:
        }
 #endif
 
-       /* need normalized dn below */
-       ber_dupbv( &realbase, &e->e_nname );
-
-       if ( e != &slap_entry_root ) {
-               bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
-       }
-       e = NULL;
-
        if ( candidates[0] == 0 ) {
 #ifdef NEW_LOGGING
                LDAP_LOG ( OPERATION, RESULTS,
@@ -456,7 +708,7 @@ dn2entry_retry:
 #endif
 
                rs->sr_err = LDAP_SUCCESS;
-               send_search_result( sop, rs );
+               send_ldap_result( sop, rs );
                rs->sr_err = 1;
                goto done;
        }
@@ -465,7 +717,7 @@ dn2entry_retry:
        if ( !isroot && limit->lms_s_unchecked != -1 ) {
                if ( BDB_IDL_N(candidates) > (unsigned) limit->lms_s_unchecked ) {
                        rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
-                       send_search_result( sop, rs );
+                       send_ldap_result( sop, rs );
                        rs->sr_err = 1;
                        goto done;
                }
@@ -483,7 +735,7 @@ dn2entry_retry:
                        if ( sop->o_pagedresults_size == 0 ) {
                                rs->sr_err = LDAP_SUCCESS;
                                rs->sr_text = "search abandoned by pagedResult size=0";
-                               send_search_result( sop, rs );
+                               send_ldap_result( sop, rs );
                                goto done;
                        }
                        for ( id = bdb_idl_first( candidates, &cursor );
@@ -500,7 +752,6 @@ dn2entry_retry:
                                "bdb_search: no paged results candidates\n",
                                0, 0, 0 );
 #endif
-                       rs->sr_nentries = nentries;
                        send_pagerequest_response( sop, rs, lastid, 0 );
 
                        rs->sr_err = 1;
@@ -512,7 +763,8 @@ dn2entry_retry:
 
 #ifdef LDAP_CLIENT_UPDATE
        if ( (sop->o_clientupdate_type & SLAP_LCUP_SYNC) ||
-           (IS_PSEARCH && sop->o_ps_protocol == LDAP_CLIENT_UPDATE )) {
+           (IS_PSEARCH && sop->o_ps_protocol == LDAP_CLIENT_UPDATE ))
+       {
                cookief.f_choice = LDAP_FILTER_AND;
                cookief.f_and = &csnfnot;
                cookief.f_next = NULL;
@@ -542,7 +794,8 @@ dn2entry_retry:
 #endif
 #ifdef LDAP_SYNC
        if ( (sop->o_sync_mode & SLAP_SYNC_REFRESH) ||
-               ( IS_PSEARCH && sop->o_ps_protocol == LDAP_SYNC )) {
+               ( IS_PSEARCH && sop->o_ps_protocol == LDAP_SYNC ))
+       {
                cookief.f_choice = LDAP_FILTER_AND;
                cookief.f_and = &csnfnot;
                cookief.f_next = NULL;
@@ -572,7 +825,6 @@ dn2entry_retry:
                id != NOID;
                id = bdb_idl_next( candidates, &cursor ) )
        {
-
                int             scopeok = 0;
 
 loop_begin:
@@ -586,8 +838,7 @@ loop_begin:
                if ( sop->o_cancel ) {
                        assert( sop->o_cancel == SLAP_CANCEL_REQ );
                        rs->sr_err = LDAP_CANCELLED;
-                       rs->sr_nentries = nentries;
-                       send_search_result( sop, rs );
+                       send_ldap_result( sop, rs );
                        sop->o_cancel = SLAP_CANCEL_ACK;
                        rs->sr_err = 0;
                        goto done;
@@ -598,8 +849,7 @@ loop_begin:
                if ( sop->oq_search.rs_tlimit != -1 && slap_get_time() > stoptime ) {
                        rs->sr_err = LDAP_TIMELIMIT_EXCEEDED;
                        rs->sr_ref = rs->sr_v2ref;
-                       rs->sr_nentries = nentries;
-                       send_search_result( sop, rs );
+                       send_ldap_result( sop, rs );
                        goto done;
                }
 
@@ -609,23 +859,34 @@ loop_begin:
 #endif
 id2entry_retry:
                        /* get the entry with reader lock */
-                       rs->sr_err = bdb_id2entry_r( op->o_bd, NULL, id, &e, locker, &lock );
+                       ei = NULL;
+                       rs->sr_err = bdb_cache_find_entry_id( op->o_bd, NULL,
+                               id, &ei, 0, locker, &lock, op->o_tmpmemctx );
 
                        if (rs->sr_err == LDAP_BUSY) {
                                rs->sr_text = "ldap server busy";
                                send_ldap_result( sop, rs );
                                goto done;
 
-                       } else if ( rs->sr_err == DB_LOCK_DEADLOCK || rs->sr_err == DB_LOCK_NOTGRANTED ) {
+                       } else if ( rs->sr_err == DB_LOCK_DEADLOCK
+                               || rs->sr_err == DB_LOCK_NOTGRANTED )
+                       {
                                goto id2entry_retry;    
                        }
 
+                       if ( ei && rs->sr_err == 0 ) {
+                               e = ei->bei_e;
+                       } else {
+                               e = NULL;
+                       }
+
                        if ( e == NULL ) {
                                if( !BDB_IDL_IS_RANGE(candidates) ) {
                                        /* only complain for non-range IDLs */
 #ifdef NEW_LOGGING
                                        LDAP_LOG ( OPERATION, RESULTS,
-                                               "bdb_search: candidate %ld not found\n", (long) id, 0, 0);
+                                               "bdb_search: candidate %ld not found\n",
+                                               (long) id, 0, 0);
 #else
                                        Debug( LDAP_DEBUG_TRACE,
                                                "bdb_search: candidate %ld not found\n",
@@ -663,101 +924,109 @@ id2entry_retry:
                }
 #endif
 
-#ifdef BDB_ALIASES
-               if ( sop->oq_search.rs_deref & LDAP_DEREF_SEARCHING && is_entry_alias( e ) ) {
-                       Entry *matched;
-                       int err;
-                       const char *text;
-                       
-                       e = deref_entry_r( op->o_bd, e, &rs->sr_err, &matched, &rs->sr_text );
-
-                       if( e == NULL ) {
-                               e = matched;
-                               goto loop_continue;
-                       }
+               /* Does this candidate actually satisfy the search scope?
+                *
+                * Note that we don't lock access to the bei_parent pointer.
+                * Since only leaf nodes can be deleted, the parent of any
+                * node will always be a valid node. Also since we have
+                * a Read lock on the data, it cannot be renamed out of the
+                * scope while we are looking at it, and unless we're using
+                * BDB_HIER, its parents cannot be moved either.
+                */
+               switch( op->ors_scope ) {
+               case LDAP_SCOPE_BASE:
+                       /* This is always true, yes? */
+                       if ( id == base.e_id )
+                               scopeok = 1;
+                       break;
+               case LDAP_SCOPE_ONELEVEL:
+                       if ( ei->bei_parent->bei_id == base.e_id )
+                               scopeok = 1;
+                       break;
+               case LDAP_SCOPE_SUBTREE:
+                       { EntryInfo *tmp;
+                       for ( tmp = BEI(e); tmp->bei_parent;
+                               tmp = tmp->bei_parent ) {
+                               if ( tmp->bei_id == base.e_id ) {
+                                       scopeok = 1;
+                                       break;
+                               }
+                       } }
+                       break;
+               }
 
-                       if( e->e_id == id ) {
-                               /* circular loop */
+#ifdef BDB_ALIASES
+               /* aliases were already dereferenced in candidate list */
+               if ( sop->ors_deref & LDAP_DEREF_SEARCHING ) {
+                       /* but if the search base is an alias, and we didn't
+                        * deref it when finding, return it.
+                        */
+                       if ( is_entry_alias(e) &&
+                               ((sop->ors_deref & LDAP_DEREF_FINDING)
+                                 || !bvmatch(&e->e_nname, &op->o_req_ndn)))
+                       {
                                goto loop_continue;
                        }
 
-                       /* need to skip alias which deref into scope */
-                       if( sop->oq_search.rs_scope & LDAP_SCOPE_ONELEVEL ) {
-                               struct berval   pdn;
-                               
-                               dnParent( &e->e_nname, &pdn ):
-                               if ( ber_bvcmp( pdn, &realbase ) ) {
-                                       goto loop_continue;
+                       /* scopes is only non-empty for onelevel or subtree */
+                       if ( !scopeok && BDB_IDL_N(scopes) ) {
+                               unsigned x;
+                               if ( sop->ors_scope == LDAP_SCOPE_ONELEVEL ) {
+                                       x = bdb_idl_search( scopes,
+                                               e->e_id );
+                                       if ( scopes[x] == e->e_id )
+                                               scopeok = 1;
+                               } else {
+                               /* subtree, walk up the tree */
+                                       EntryInfo *tmp = BEI(e);
+                                       for (;tmp->bei_parent;
+                                               tmp=tmp->bei_parent) {
+                                               x = bdb_idl_search(
+                                                       scopes, tmp->bei_id );
+                                               if ( scopes[x] == tmp->bei_id ) {
+                                                       scopeok = 1;
+                                                       break;
+                                               }
+                                       }
                                }
+                       }
+               }
+#endif
 
-                       } else if ( dnIsSuffix( &e->e_nname, &realbase ) ) {
-                               /* alias is within scope */
+               /* Not in scope, ignore it */
+               if ( !scopeok ) {
 #ifdef NEW_LOGGING
-                               LDAP_LOG ( OPERATION, RESULTS,
-                                       "bdb_search: \"%s\" in subtree\n", e->edn, 0, 0);
+                       LDAP_LOG ( OPERATION, RESULTS,
+                               "bdb_search: %ld scope not okay\n",
+                               (long) id, 0, 0);
 #else
-                               Debug( LDAP_DEBUG_TRACE,
-                                       "bdb_search: \"%s\" in subtree\n",
-                                       e->e_dn, 0, 0 );
+                       Debug( LDAP_DEBUG_TRACE,
+                               "bdb_search: %ld scope not okay\n",
+                               (long) id, 0, 0 );
 #endif
-                               goto loop_continue;
-                       }
-
-                       scopeok = 1;
+                       goto loop_continue;
                }
-#endif
 
                /*
                 * if it's a referral, add it to the list of referrals. only do
                 * this for non-base searches, and don't check the filter
                 * explicitly here since it's only a candidate anyway.
                 */
-               if ( !manageDSAit && sop->oq_search.rs_scope != LDAP_SCOPE_BASE &&
-                       is_entry_referral( e ) )
+               if ( !manageDSAit && sop->oq_search.rs_scope != LDAP_SCOPE_BASE
+                       && is_entry_referral( e ) )
                {
-                       struct berval   dn;
-
-                       /* check scope */
-                       if ( !scopeok && sop->oq_search.rs_scope == LDAP_SCOPE_ONELEVEL ) {
-                               if ( !be_issuffix( op->o_bd, &e->e_nname ) ) {
-                                       dnParent( &e->e_nname, &dn );
-                                       scopeok = dn_match( &dn, &realbase );
-                               } else {
-                                       scopeok = (realbase.bv_len == 0);
-                               }
-
-                       } else if ( !scopeok && sop->oq_search.rs_scope == LDAP_SCOPE_SUBTREE ) {
-                               scopeok = dnIsSuffix( &e->e_nname, &realbase );
-
-                       } else {
-                               scopeok = 1;
-                       }
-
-                       if( scopeok ) {
-                               BerVarray erefs = get_entry_referrals( sop, e );
-                               rs->sr_ref = referral_rewrite( erefs,
-                                       &e->e_name, NULL,
-                                       sop->oq_search.rs_scope == LDAP_SCOPE_SUBTREE
-                                               ? LDAP_SCOPE_SUBTREE
-                                               : LDAP_SCOPE_BASE );
+                       BerVarray erefs = get_entry_referrals( sop, e );
+                       rs->sr_ref = referral_rewrite( erefs,
+                               &e->e_name, NULL,
+                               sop->oq_search.rs_scope == LDAP_SCOPE_SUBTREE
+                                       ? LDAP_SCOPE_SUBTREE
+                                       : LDAP_SCOPE_BASE );
 
-                               send_search_reference( sop, rs );
-
-                               ber_bvarray_free( rs->sr_ref );
-                               ber_bvarray_free( erefs );
-                               rs->sr_ref = NULL;
+                       send_search_reference( sop, rs );
 
-                       } else {
-#ifdef NEW_LOGGING
-                               LDAP_LOG(OPERATION, DETAIL2, 
-                                       "bdb_search: candidate referral %ld scope not okay\n",
-                                       id, 0, 0 );
-#else
-                               Debug( LDAP_DEBUG_TRACE,
-                                       "bdb_search: candidate referral %ld scope not okay\n",
-                                       id, 0, 0 );
-#endif
-                       }
+                       ber_bvarray_free( rs->sr_ref );
+                       ber_bvarray_free( erefs );
+                       rs->sr_ref = NULL;
 
                        goto loop_continue;
                }
@@ -779,7 +1048,8 @@ id2entry_retry:
 #ifdef LDAP_SYNC
                        if ( sop->o_sync_mode & SLAP_SYNC_REFRESH ) {
                                rc_sync = test_filter( sop, rs->sr_entry, &cookief );
-                               rs->sr_err      = test_filter( sop, rs->sr_entry, sop->oq_search.rs_filter );
+                               rs->sr_err = test_filter( sop,
+                                       rs->sr_entry, sop->oq_search.rs_filter );
                                if ( rs->sr_err == LDAP_COMPARE_TRUE ) {
                                        if ( rc_sync == LDAP_COMPARE_TRUE ) {
                                                entry_sync_state = LDAP_SYNC_ADD;
@@ -791,130 +1061,114 @@ id2entry_retry:
 #endif
 #endif
                        {
-                               rs->sr_err = test_filter( sop, rs->sr_entry, sop->oq_search.rs_filter );
+                               rs->sr_err = test_filter( sop,
+                                       rs->sr_entry, sop->oq_search.rs_filter );
                        }
 #if defined(LDAP_CLIENT_UPDATE) || defined(LDAP_SYNC)
                }
 #endif
 
                if ( rs->sr_err == LDAP_COMPARE_TRUE ) {
-                       struct berval   dn;
-
-                       /* check scope */
-                       if ( !scopeok && sop->oq_search.rs_scope == LDAP_SCOPE_ONELEVEL ) {
-                               if ( be_issuffix( op->o_bd, &e->e_nname ) ) {
-                                       scopeok = (realbase.bv_len == 0);
-                               } else {
-                                       dnParent( &e->e_nname, &dn );
-                                       scopeok = dn_match( &dn, &realbase );
-                               }
-
-                       } else if ( !scopeok && sop->oq_search.rs_scope == LDAP_SCOPE_SUBTREE ) {
-                               scopeok = dnIsSuffix( &e->e_nname, &realbase );
-
-                       } else {
-                               scopeok = 1;
-                       }
-
-                       if ( scopeok ) {
-                               /* check size limit */
-                               if ( --sop->oq_search.rs_slimit == -1 ) {
+                       /* check size limit */
+                       if ( --sop->oq_search.rs_slimit == -1 ) {
 #if defined(LDAP_CLIENT_UPDATE) || defined(LDAP_SYNC)
-                                       if (!IS_PSEARCH)
-#endif
-                                       bdb_cache_return_entry_r( bdb->bi_dbenv,
-                                               &bdb->bi_cache, e, &lock );
-                                       e = NULL;
-                                       rs->sr_entry = NULL;
-                                       rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
-                                       rs->sr_ref = rs->sr_v2ref;
-                                       rs->sr_nentries = nentries;
-                                       send_search_result( sop, rs );
-                                       goto done;
-                               }
+                               if (!IS_PSEARCH)
+#endif
+                               bdb_cache_return_entry_r( bdb->bi_dbenv,
+                                       &bdb->bi_cache, e, &lock );
+                               e = NULL;
+                               rs->sr_entry = NULL;
+                               rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
+                               rs->sr_ref = rs->sr_v2ref;
+                               send_ldap_result( sop, rs );
+                               goto done;
+                       }
 
 #ifdef LDAP_CONTROL_PAGEDRESULTS
-                               if ( get_pagedresults(sop) ) {
-                                       if ( nentries >= sop->o_pagedresults_size ) {
-                                               rs->sr_nentries = nentries;
-                                               send_pagerequest_response( sop, rs,
-                                                       lastid, tentries );
-                                               goto done;
-                                       }
-                                       lastid = id;
+                       if ( get_pagedresults(sop) ) {
+                               if ( rs->sr_nentries >= sop->o_pagedresults_size ) {
+                                       send_pagerequest_response( sop, rs,
+                                               lastid, tentries );
+                                       goto done;
                                }
+                               lastid = id;
+                       }
 #endif
 
-                               if (e) {
-                                       int result;
-                                       
+                       if (e) {
+                               /* safe default */
+                               int result = -1;
+                               
 #if 0  /* noop is masked SLAP_CTRL_UPDATE */
-                                       if( op->o_noop ) {
-                                               result = 0;
-                                       } else
+                               if( op->o_noop ) {
+                                       result = 0;
+                               } else
 #endif
 #if defined(LDAP_CLIENT_UPDATE) || defined(LDAP_SYNC)
-                                       if (IS_PSEARCH) {
+                               if (IS_PSEARCH) {
 #ifdef LDAP_SYNC
-                                               int premodify_found = 0;
-                                               int entry_sync_state;
-#endif
-
-                                               if ( ps_type == LDAP_PSEARCH_BY_ADD ||
-                                                        ps_type == LDAP_PSEARCH_BY_DELETE ||
-                                                        ps_type == LDAP_PSEARCH_BY_MODIFY ||
-                                                        ps_type == LDAP_PSEARCH_BY_SCOPEOUT )
-                                               {
-                                                       if ( ps_type == LDAP_PSEARCH_BY_MODIFY ) {
-                                                               struct psid_entry* psid_e;
-                                                               LDAP_LIST_FOREACH( psid_e, &op->o_pm_list, ps_link)
-                                                               {
-                                                                       if( psid_e->ps_op == sop )
-                                                                       {
+                                       int premodify_found = 0;
+                                       int entry_sync_state;
+#endif
+
+                                       if ( ps_type == LDAP_PSEARCH_BY_ADD ||
+                                                ps_type == LDAP_PSEARCH_BY_DELETE ||
+                                                ps_type == LDAP_PSEARCH_BY_MODIFY ||
+                                                ps_type == LDAP_PSEARCH_BY_SCOPEOUT )
+                                       {
+                                               if ( ps_type == LDAP_PSEARCH_BY_MODIFY ) {
+                                                       struct psid_entry* psid_e;
+                                                       LDAP_LIST_FOREACH( psid_e,
+                                                               &op->o_pm_list, ps_link)
+                                                       {
+                                                               if( psid_e->ps_op == sop ) {
 #ifdef LDAP_SYNC
-                                                                               premodify_found = 1;
+                                                                       premodify_found = 1;
 #endif
-                                                                               LDAP_LIST_REMOVE(psid_e, ps_link);
-                                                                               break;
-                                                                       }
+                                                                       LDAP_LIST_REMOVE(psid_e, ps_link);
+                                                                       break;
                                                                }
-                                                               if (psid_e != NULL) free (psid_e);
                                                        }
+                                                       if (psid_e != NULL) free (psid_e);
+                                               }
 #ifdef LDAP_SYNC
-                                                       if ( ps_type == LDAP_PSEARCH_BY_ADD )
+                                               if ( ps_type == LDAP_PSEARCH_BY_ADD ) {
+                                                       entry_sync_state = LDAP_SYNC_ADD;
+                                               } else if ( ps_type == LDAP_PSEARCH_BY_DELETE ) {
+                                                       entry_sync_state = LDAP_SYNC_DELETE;
+                                               } else if ( ps_type == LDAP_PSEARCH_BY_MODIFY ) {
+                                                       if ( premodify_found ) {
+                                                               entry_sync_state = LDAP_SYNC_MODIFY;
+                                                       } else {
                                                                entry_sync_state = LDAP_SYNC_ADD;
-                                                       else if ( ps_type == LDAP_PSEARCH_BY_DELETE )
-                                                               entry_sync_state = LDAP_SYNC_DELETE;
-                                                       else if ( ps_type == LDAP_PSEARCH_BY_MODIFY ) {
-                                                               if ( premodify_found )
-                                                                       entry_sync_state = LDAP_SYNC_MODIFY;
-                                                               else
-                                                                       entry_sync_state = LDAP_SYNC_ADD;
-                                                       } else if ( ps_type == LDAP_PSEARCH_BY_SCOPEOUT )
-                                                               entry_sync_state = LDAP_SYNC_DELETE;
-                                                       else {
-                                                               rs->sr_err = 1;
-                                                               goto done;
                                                        }
+                                               } else if ( ps_type == LDAP_PSEARCH_BY_SCOPEOUT )
+                                                       entry_sync_state = LDAP_SYNC_DELETE;
+                                               else {
+                                                       rs->sr_err = 1;
+                                                       goto done;
+                                               }
 #endif
 
 #ifdef LDAP_CLIENT_UPDATE
                                                if ( sop->o_ps_protocol == LDAP_CLIENT_UPDATE ) {
                                                        int entry_count = ++sop->o_ps_entries;
                                                        if ( IS_BDB_REPLACE(ps_type) ) {
-                                                               rs->sr_err = bdb_build_lcup_update_ctrl( sop, rs, e, entry_count, ctrls,
-                                                                               num_ctrls++, &latest_entrycsn_bv, SLAP_LCUP_ENTRY_DELETED_TRUE );
+                                                               rs->sr_err = bdb_build_lcup_update_ctrl( sop,
+                                                                       rs, e, entry_count, ctrls,
+                                                                       num_ctrls++, &latest_entrycsn_bv,
+                                                                       SLAP_LCUP_ENTRY_DELETED_TRUE );
                                                        } else {
-                                                               rs->sr_err = bdb_build_lcup_update_ctrl( sop, rs, e, entry_count, ctrls,
-                                                                               num_ctrls++, &latest_entrycsn_bv, SLAP_LCUP_ENTRY_DELETED_FALSE );
+                                                               rs->sr_err = bdb_build_lcup_update_ctrl( sop,
+                                                                       rs, e, entry_count, ctrls,
+                                                                       num_ctrls++, &latest_entrycsn_bv,
+                                                                       SLAP_LCUP_ENTRY_DELETED_FALSE );
                                                        }
-                                                       if ( rs->sr_err != LDAP_SUCCESS )
-                                                               goto done;
+                                                       if ( rs->sr_err != LDAP_SUCCESS ) goto done;
                                                        rs->sr_attrs = attrs;
                                                        rs->sr_ctrls = ctrls;
                                                        result = send_search_entry( sop, rs );
-                                                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
-                                                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+                                                       ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
                                                        ch_free( ctrls[--num_ctrls] );
                                                        ctrls[num_ctrls] = NULL;
                                                        rs->sr_ctrls = NULL;
@@ -922,15 +1176,14 @@ id2entry_retry:
 #endif
 #ifdef LDAP_SYNC
                                                if ( sop->o_ps_protocol == LDAP_SYNC ) {
-                                                       rs->sr_err = bdb_build_sync_state_ctrl( sop, rs, e, entry_sync_state, ctrls,
-                                                                                       num_ctrls++, 1, &latest_entrycsn_bv );
-                                                       if ( rs->sr_err != LDAP_SUCCESS )
-                                                               goto done;
+                                                       rs->sr_err = bdb_build_sync_state_ctrl( sop,
+                                                               rs, e, entry_sync_state, ctrls,
+                                                               num_ctrls++, 1, &latest_entrycsn_bv );
+                                                       if ( rs->sr_err != LDAP_SUCCESS ) goto done;
                                                        rs->sr_attrs = attrs;
                                                        rs->sr_ctrls = ctrls;
                                                        result = send_search_entry( sop, rs );
-                                                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
-                                                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+                                                       ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
                                                        ch_free( ctrls[--num_ctrls] );
                                                        ctrls[num_ctrls] = NULL;
                                                        rs->sr_ctrls = NULL;
@@ -946,84 +1199,71 @@ id2entry_retry:
                                                psid_e = (struct psid_entry *) calloc (1,
                                                        sizeof(struct psid_entry));
                                                psid_e->ps_op = sop;
-                                               LDAP_LIST_INSERT_HEAD( &op->o_pm_list, psid_e, ps_link );
+                                               LDAP_LIST_INSERT_HEAD( &op->o_pm_list,
+                                                       psid_e, ps_link );
 
                                        } else {
                                                printf("Error !\n");
                                        }
                                } else {
 #ifdef LDAP_CLIENT_UPDATE
-                                               if ( sop->o_clientupdate_type & SLAP_LCUP_SYNC ) {
-                                                       rs->sr_err = bdb_build_lcup_update_ctrl( sop, rs, e, ++entry_count, ctrls,
-                                                                       num_ctrls++, &latest_entrycsn_bv, SLAP_LCUP_ENTRY_DELETED_FALSE );
-                                                       if ( rs->sr_err != LDAP_SUCCESS )
-                                                               goto done;
-                                                       rs->sr_ctrls = ctrls;
-                                                       rs->sr_attrs = sop->oq_search.rs_attrs;
-                                                       result = send_search_entry( sop, rs );
-
-                                                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
-                                                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
-                                                       ch_free( ctrls[--num_ctrls] );
-                                                       ctrls[num_ctrls] = NULL;
-                                                       rs->sr_ctrls = NULL;
-                                               } else
+                                       if ( sop->o_clientupdate_type & SLAP_LCUP_SYNC ) {
+                                               rs->sr_err = bdb_build_lcup_update_ctrl( sop,
+                                                       rs, e, ++entry_count, ctrls,
+                                                       num_ctrls++, &latest_entrycsn_bv,
+                                                       SLAP_LCUP_ENTRY_DELETED_FALSE );
+                                               if ( rs->sr_err != LDAP_SUCCESS ) goto done;
+                                               rs->sr_ctrls = ctrls;
+                                               rs->sr_attrs = sop->oq_search.rs_attrs;
+                                               result = send_search_entry( sop, rs );
+                                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+                                               ch_free( ctrls[--num_ctrls] );
+                                               ctrls[num_ctrls] = NULL;
+                                               rs->sr_ctrls = NULL;
+                                       } else
 #endif
 #ifdef LDAP_SYNC
-                                               if ( sop->o_sync_mode & SLAP_SYNC_REFRESH ) {
-                                                       rs->sr_err = bdb_build_sync_state_ctrl( sop, rs, e, entry_sync_state, ctrls,
-                                                                       num_ctrls++, 0, &latest_entrycsn_bv );
-                                                       if ( rs->sr_err != LDAP_SUCCESS )
-                                                               goto done;
-
-                                                       rs->sr_ctrls = ctrls;
-                                                       if ( rc_sync == LDAP_COMPARE_TRUE ) { /* ADD */
-                                                               rs->sr_attrs = sop->oq_search.rs_attrs;
-                                                       } else { /* PRESENT */
-                                                               rs->sr_attrs = &null_attr;
-                                                       }
-                                                       result = send_search_entry( sop, rs );
-
-                                                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
-                                                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
-                                                       ch_free( ctrls[--num_ctrls] );
-                                                       ctrls[num_ctrls] = NULL;
-                                                       rs->sr_ctrls = NULL;
-                                               } else
-#endif
-#endif
-                                               {
+                                       if ( sop->o_sync_mode & SLAP_SYNC_REFRESH ) {
+                                               rs->sr_err = bdb_build_sync_state_ctrl( sop,
+                                                       rs, e, entry_sync_state, ctrls,
+                                                       num_ctrls++, 0, &latest_entrycsn_bv );
+                                               if ( rs->sr_err != LDAP_SUCCESS ) goto done;
+
+                                               rs->sr_ctrls = ctrls;
+                                               if ( rc_sync == LDAP_COMPARE_TRUE ) { /* ADD */
                                                        rs->sr_attrs = sop->oq_search.rs_attrs;
-                                                       rs->sr_ctrls = NULL;
-                                                       result = send_search_entry( sop, rs );
+                                               } else { /* PRESENT */
+                                                       rs->sr_attrs = &null_attr;
                                                }
+                                               result = send_search_entry( sop, rs );
+                                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+                                               ch_free( ctrls[--num_ctrls] );
+                                               ctrls[num_ctrls] = NULL;
+                                               rs->sr_ctrls = NULL;
+                                       } else
+#endif
+#endif
+                                       {
+                                               rs->sr_attrs = sop->oq_search.rs_attrs;
+                                               rs->sr_ctrls = NULL;
+                                               result = send_search_entry( sop, rs );
                                        }
+                               }
 
-                                       switch (result) {
-                                       case 0:         /* entry sent ok */
-                                               nentries++;
-                                               break;
-                                       case 1:         /* entry not sent */
-                                               break;
-                                       case -1:        /* connection closed */
-                                               if (!IS_PSEARCH)
-                                               bdb_cache_return_entry_r(bdb->bi_dbenv,
-                                                       &bdb->bi_cache, e, &lock);
-                                               e = NULL;
-                                               rs->sr_entry = NULL;
-                                               rs->sr_err = LDAP_OTHER;
-                                               goto done;
-                                       }
+                               switch (result) {
+                               case 0:         /* entry sent ok */
+                                       break;
+                               case 1:         /* entry not sent */
+                                       break;
+                               case -1:        /* connection closed */
+                                       if (!IS_PSEARCH)
+                                       bdb_cache_return_entry_r(bdb->bi_dbenv,
+                                               &bdb->bi_cache, e, &lock);
+                                       e = NULL;
+                                       rs->sr_entry = NULL;
+                                       rs->sr_err = LDAP_OTHER;
+                                       goto done;
                                }
-                       } else {
-#ifdef NEW_LOGGING
-                               LDAP_LOG ( OPERATION, RESULTS,
-                                       "bdb_search: %ld scope not okay\n", (long) id, 0, 0);
-#else
-                               Debug( LDAP_DEBUG_TRACE,
-                                       "bdb_search: %ld scope not okay\n",
-                                       (long) id, 0, 0 );
-#endif
                        }
                } else {
 #ifdef NEW_LOGGING
@@ -1039,9 +1279,10 @@ id2entry_retry:
 loop_continue:
                if( e != NULL ) {
                        /* free reader lock */
-                       if (!IS_PSEARCH)
-                       bdb_cache_return_entry_r( bdb->bi_dbenv,
-                               &bdb->bi_cache, e , &lock);
+                       if (!IS_PSEARCH) {
+                               bdb_cache_return_entry_r( bdb->bi_dbenv,
+                                       &bdb->bi_cache, e , &lock);
+                       }
                        e = NULL;
                        rs->sr_entry = NULL;
                }
@@ -1052,19 +1293,20 @@ loop_continue:
        if (!IS_PSEARCH) {
 #ifdef LDAP_CLIENT_UPDATE
        if ( sop->o_clientupdate_type & SLAP_LCUP_SYNC ) {
-               bdb_build_lcup_done_ctrl( sop, rs, ctrls, num_ctrls++, &latest_entrycsn_bv );
+               bdb_build_lcup_done_ctrl( sop, rs, ctrls,
+                       num_ctrls++, &latest_entrycsn_bv );
 
                rs->sr_ctrls = ctrls;
                rs->sr_ref = rs->sr_v2ref;
                rs->sr_err = (rs->sr_v2ref == NULL) ? LDAP_SUCCESS : LDAP_REFERRAL;
-               rs->sr_nentries = nentries;
-               send_search_result( sop, rs );
+               send_ldap_result( sop, rs );
 
                ch_free( latest_entrycsn_bv.bv_val );
                latest_entrycsn_bv.bv_val = NULL;
 
-               if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
-                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+               if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL ) {
+                       ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+               }
                ch_free( ctrls[--num_ctrls] );
                ctrls[num_ctrls] = NULL;
        } else
@@ -1080,14 +1322,15 @@ loop_continue:
                                LDAP_SYNC_REFRESH_DONE, &latest_entrycsn_bv );
                } else {
                        /* refreshOnly mode */
-                       bdb_build_sync_done_ctrl( sop, rs, ctrls, num_ctrls++, 1, &latest_entrycsn_bv );
+                       bdb_build_sync_done_ctrl( sop, rs, ctrls,
+                               num_ctrls++, 1, &latest_entrycsn_bv );
                        rs->sr_ctrls = ctrls;
                        rs->sr_ref = rs->sr_v2ref;
                        rs->sr_err = (rs->sr_v2ref == NULL) ? LDAP_SUCCESS : LDAP_REFERRAL;
-                       rs->sr_nentries = nentries;
-                       send_search_result( sop, rs );
-                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
+                       send_ldap_result( sop, rs );
+                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL ) {
                                ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+                       }
                        ch_free( ctrls[--num_ctrls] );
                        ctrls[num_ctrls] = NULL;
                }
@@ -1100,8 +1343,7 @@ loop_continue:
                rs->sr_ctrls = NULL;
                rs->sr_ref = rs->sr_v2ref;
                rs->sr_err = (rs->sr_v2ref == NULL) ? LDAP_SUCCESS : LDAP_REFERRAL;
-               rs->sr_nentries = nentries;
-               send_search_result( sop, rs );
+               send_ldap_result( sop, rs );
        }
        }
 
@@ -1132,10 +1374,11 @@ static int base_candidate(
 {
 #ifdef NEW_LOGGING
        LDAP_LOG ( OPERATION, ENTRY,
-               "base_candidate: base: \"%s\" (0x%08lx)\n", e->e_dn, (long) e->e_id, 0);
+               "base_candidate: base: \"%s\" (0x%08lx)\n",
+               e->e_nname.bv_val, (long) e->e_id, 0);
 #else
        Debug(LDAP_DEBUG_ARGS, "base_candidates: base: \"%s\" (0x%08lx)\n",
-               e->e_dn, (long) e->e_id, 0);
+               e->e_nname.bv_val, (long) e->e_id, 0);
 #endif
 
        ids[0] = 1;
@@ -1197,7 +1440,8 @@ static void *search_stack(
        }
 
        if ( !ret ) {
-               ret = ch_malloc( bdb->bi_search_stack_depth * BDB_IDL_UM_SIZE * sizeof( ID ) );
+               ret = ch_malloc( bdb->bi_search_stack_depth * BDB_IDL_UM_SIZE
+                       * sizeof( ID ) );
                if ( op->o_threadctx ) {
                        ldap_pvt_thread_pool_setkey( op->o_threadctx, search_stack,
                                ret, search_stack_free );
@@ -1211,22 +1455,21 @@ static void *search_stack(
 static int search_candidates(
        Operation *stackop,
        Operation *op,
+       SlapReply *rs,
        Entry *e,
-       ID      *ids )
+       u_int32_t locker,
+       ID      *ids,
+       ID      *scopes )
 {
        struct bdb_info *bdb = (struct bdb_info *) op->o_bd->be_private;
        int rc, depth = 1;
-       Filter          f, scopef, rf, xf;
+       Filter          f, scopef, rf, xf, nf;
        ID              *stack;
        AttributeAssertion aa_ref;
 #ifdef BDB_SUBENTRIES
        Filter  sf;
        AttributeAssertion aa_subentry;
 #endif
-#ifdef BDB_ALIASES
-       Filter  af;
-       AttributeAssertion aa_alias;
-#endif
 
        /*
         * This routine takes as input a filter (user-filter)
@@ -1238,11 +1481,11 @@ static int search_candidates(
 #ifdef NEW_LOGGING
        LDAP_LOG ( OPERATION, ENTRY,
                "search_candidates: base=\"%s\" (0x%08lx) scope=%d\n", 
-               e->e_dn, (long) e->e_id, op->oq_search.rs_scope);
+               e->e_nname.bv_val, (long) e->e_id, op->oq_search.rs_scope);
 #else
        Debug(LDAP_DEBUG_TRACE,
                "search_candidates: base=\"%s\" (0x%08lx) scope=%d\n",
-               e->e_dn, (long) e->e_id, op->oq_search.rs_scope );
+               e->e_nname.bv_val, (long) e->e_id, op->oq_search.rs_scope );
 #endif
 
        xf.f_or = op->oq_search.rs_filter;
@@ -1252,7 +1495,9 @@ static int search_candidates(
        /* If the user's filter uses objectClass=*,
         * these clauses are redundant.
         */
-       if (!oc_filter(op->oq_search.rs_filter, 1, &depth) && !get_subentries_visibility(op) ) {
+       if (!oc_filter(op->oq_search.rs_filter, 1, &depth)
+               && !get_subentries_visibility(op) )
+       {
                if( !get_manageDSAit(op) && !get_domainScope(op) ) {
                        /* match referral objects */
                        struct berval bv_ref = { sizeof("referral")-1, "referral" };
@@ -1262,33 +1507,24 @@ static int search_candidates(
                        rf.f_av_value = bv_ref;
                        rf.f_next = xf.f_or;
                        xf.f_or = &rf;
+                       depth++;
                }
-
-#ifdef BDB_ALIASES
-               if( op->oq_search.rs_deref & LDAP_DEREF_SEARCHING ) {
-                       /* match alias objects */
-                       struct berval bv_alias = { sizeof("alias")-1, "alias" };
-                       af.f_choice = LDAP_FILTER_EQUALITY;
-                       af.f_ava = &aa_alias;
-                       af.f_av_desc = slap_schema.si_ad_objectClass;
-                       af.f_av_value = bv_alias;
-                       af.f_next = xf.f_or;
-                       xf.f_or = &af;
-               }
-#endif
-               /* We added one of these clauses, filter depth increased */
-               if( xf.f_or != op->oq_search.rs_filter ) depth++;
        }
 
-       f.f_next = NULL;
-       f.f_choice = LDAP_FILTER_AND;
-       f.f_and = &scopef;
        scopef.f_choice = op->oq_search.rs_scope == LDAP_SCOPE_SUBTREE
                ? SLAPD_FILTER_DN_SUBTREE
                : SLAPD_FILTER_DN_ONE;
        scopef.f_dn = &e->e_nname;
-       scopef.f_next = xf.f_or == op->oq_search.rs_filter ? op->oq_search.rs_filter : &xf ;
-       /* Filter depth increased again, adding scope clause */
+       scopef.f_next = NULL;
+
+       f.f_next = NULL;
+       f.f_choice = LDAP_FILTER_AND;
+       f.f_and = &nf;
+       /* Dummy; we compute scope separately now */
+       nf.f_choice = LDAP_FILTER_NOT;
+       nf.f_next = xf.f_or == op->oq_search.rs_filter
+               ? op->oq_search.rs_filter : &xf ;
+       /* Filter depth increased again, adding dummy clause */
        depth++;
 
 #ifdef BDB_SUBENTRIES
@@ -1299,7 +1535,7 @@ static int search_candidates(
                sf.f_av_desc = slap_schema.si_ad_objectClass;
                sf.f_av_value = bv_subentry;
                sf.f_next = scopef.f_next;
-               scopef.f_next = &sf;
+               nf.f_next = &sf;
        }
 #endif
 
@@ -1310,7 +1546,17 @@ static int search_candidates(
                stack = search_stack( stackop );
        }
 
-       rc = bdb_filter_candidates( op->o_bd, &f, ids, stack, stack+BDB_IDL_UM_SIZE );
+       if( op->ors_deref & LDAP_DEREF_SEARCHING ) {
+               rc = search_aliases( op, rs, e, locker, &scopef, ids, scopes, stack );
+       } else {
+               rc = bdb_filter_candidates( op, &scopef, ids,
+                       stack, stack+BDB_IDL_UM_SIZE );
+       }
+
+       if ( rc == LDAP_SUCCESS ) {
+               rc = bdb_filter_candidates( op, &f, ids,
+                       stack, stack+BDB_IDL_UM_SIZE );
+       }
 
        if ( depth+1 > bdb->bi_search_stack_depth ) {
                ch_free( stack );
@@ -1394,7 +1640,7 @@ send_pagerequest_response(
 
        rs->sr_ctrls = ctrls;
        rs->sr_err = LDAP_SUCCESS;
-       send_search_result( op, rs );
+       send_ldap_result( op, rs );
 
 done:
        (void) ber_free_buf( ber );
@@ -1416,7 +1662,6 @@ bdb_build_lcup_update_ctrl(
        Attribute* a;
        int ret;
        int res;
-       int rc;
        const char *text = NULL;
 
        char berbuf[LBER_ELEMENT_SIZEOF];
@@ -1460,17 +1705,18 @@ bdb_build_lcup_update_ctrl(
                }
        }
 
-       if ( entry_count % op->o_clientupdate_interval == 0 )
+       if ( entry_count % op->o_clientupdate_interval == 0 ) {
                ber_printf( ber,
                        "{bb{sON}N}",
                        SLAP_LCUP_STATE_UPDATE_FALSE,
                        isdeleted,
                        LDAP_CUP_COOKIE_OID, &entrycsn_bv );
-       else /* Do not send cookie */
+       } else { /* Do not send cookie */
                ber_printf( ber,
                        "{bbN}",
                        SLAP_LCUP_STATE_UPDATE_FALSE,
                        isdeleted );
+       }
 
        ch_free( entrycsn_bv.bv_val );
        entrycsn_bv.bv_val = NULL;
@@ -1506,7 +1752,7 @@ bdb_build_lcup_done_ctrl(
        int             num_ctrls,
        struct berval   *latest_entrycsn_bv     )
 {
-       int ret, rc;
+       int ret;
        char berbuf[LBER_ELEMENT_SIZEOF];
        BerElement *ber = (BerElement *)berbuf;
 
@@ -1514,8 +1760,7 @@ bdb_build_lcup_done_ctrl(
 
        ctrls[num_ctrls] = ch_malloc ( sizeof ( LDAPControl ) );
 
-       ber_printf( ber, "{sO", LDAP_CUP_COOKIE_OID, latest_entrycsn_bv );
-       ber_printf( ber, "N}" );
+       ber_printf( ber, "{sON}", LDAP_CUP_COOKIE_OID, latest_entrycsn_bv );
 
        ctrls[num_ctrls]->ldctl_oid = LDAP_CONTROL_CLIENT_UPDATE_DONE;
        ctrls[num_ctrls]->ldctl_iscritical = op->o_clientupdate;
@@ -1528,7 +1773,8 @@ bdb_build_lcup_done_ctrl(
                LDAP_LOG ( OPERATION, RESULTS, 
                        "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n", 0, 0, 0 );
 #else
-               Debug( LDAP_DEBUG_TRACE, "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
+               Debug( LDAP_DEBUG_TRACE,
+                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
                        0, 0, 0 );
 #endif
                send_ldap_error( op, rs, LDAP_OTHER, "internal error" );
@@ -1554,7 +1800,6 @@ bdb_build_sync_state_ctrl(
        Attribute* a;
        int ret;
        int res;
-       int rc;
        const char *text = NULL;
 
        char berbuf[LBER_ELEMENT_SIZEOF];
@@ -1600,10 +1845,13 @@ bdb_build_sync_state_ctrl(
                }
        }
 
-       if ( send_cookie )
-               ber_printf( ber, "{eOON}", entry_sync_state, &entryuuid_bv, &entrycsn_bv );
-       else
-               ber_printf( ber, "{eON}", entry_sync_state, &entryuuid_bv );
+       if ( send_cookie ) {
+               ber_printf( ber, "{eOON}",
+                       entry_sync_state, &entryuuid_bv, &entrycsn_bv );
+       } else {
+               ber_printf( ber, "{eON}",
+                       entry_sync_state, &entryuuid_bv );
+       }
 
        ch_free( entrycsn_bv.bv_val );
        entrycsn_bv.bv_val = NULL;
@@ -1642,7 +1890,7 @@ bdb_build_sync_done_ctrl(
        int             send_cookie,
        struct berval   *latest_entrycsn_bv     )
 {
-       int ret,rc;
+       int ret;
        char berbuf[LBER_ELEMENT_SIZEOF];
        BerElement *ber = (BerElement *)berbuf;
 
@@ -1665,9 +1913,11 @@ bdb_build_sync_done_ctrl(
        if ( ret < 0 ) {
 #ifdef NEW_LOGGING
                LDAP_LOG ( OPERATION, RESULTS, 
-                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n", 0, 0, 0 );
+                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
+                       0, 0, 0 );
 #else
-               Debug( LDAP_DEBUG_TRACE, "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
+               Debug( LDAP_DEBUG_TRACE,
+                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
                        0, 0, 0 );
 #endif
                send_ldap_error( op, rs, LDAP_OTHER, "internal error" );
@@ -1688,23 +1938,26 @@ bdb_send_ldap_intermediate(
        BerElement *ber = (BerElement *)berbuf;
        struct berval rspdata;
 
-       int ret, rc;
+       int ret;
 
        ber_init2( ber, NULL, LBER_USE_DER );
 
-       if ( cookie == NULL )
+       if ( cookie == NULL ) {
                ber_printf( ber, "{eN}", state );
-       else
+       } else {
                ber_printf( ber, "{eON}", state, cookie );
+       }
 
        ret = ber_flatten2( ber, &rspdata, 0 );
 
        if ( ret < 0 ) {
 #ifdef NEW_LOGGING
                LDAP_LOG ( OPERATION, RESULTS, 
-                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n", 0, 0, 0 );
+                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
+                       0, 0, 0 );
 #else
-               Debug( LDAP_DEBUG_TRACE, "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
+               Debug( LDAP_DEBUG_TRACE,
+                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
                        0, 0, 0 );
 #endif
                send_ldap_error( op, rs, LDAP_OTHER, "internal error" );