]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/back-bdb/search.c
Fix IRIX sc_mask conflict
[openldap] / servers / slapd / back-bdb / search.c
index 143d75240b1939c76e3bf622754d6b134af193fa..3bea37794c7c29de6cfcd5e97767fc7a143e7632 100644 (file)
@@ -1,7 +1,7 @@
 /* search.c - search operation */
 /* $OpenLDAP$ */
 /*
- * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 
@@ -20,11 +20,11 @@ static int base_candidate(
        ID              *ids );
 static int search_candidates(
        BackendDB *be,
+       Operation *op,
        Entry *e,
        Filter *filter,
        int scope,
        int deref,
-       int manageDSAit,
        ID      *ids );
 
 int
@@ -32,40 +32,48 @@ bdb_search(
        BackendDB       *be,
        Connection      *conn,
        Operation       *op,
-       const char      *base,
-       const char      *nbase,
+       struct berval   *base,
+       struct berval   *nbase,
        int             scope,
        int             deref,
        int             slimit,
        int             tlimit,
        Filter  *filter,
-       const char      *filterstr,
-       char    **attrs,
+       struct berval   *filterstr,
+       AttributeName   *attrs,
        int             attrsonly )
 {
        struct bdb_info *bdb = (struct bdb_info *) be->be_private;
-       int              abandon;
        int             rc;
        const char *text = NULL;
        time_t          stoptime;
        ID              id, cursor;
        ID              candidates[BDB_IDL_UM_SIZE];
        Entry           *e = NULL;
-       struct berval **v2refs = NULL;
+       BerVarray v2refs = NULL;
        Entry   *matched = NULL;
-       char    *realbase = NULL;
+       struct berval   realbase = { 0, NULL };
        int             nentries = 0;
        int             manageDSAit;
 
        struct slap_limits_set *limit = NULL;
        int isroot = 0;
 
+       u_int32_t       locker;
+       DB_LOCK         lock;
+
+#ifdef NEW_LOGGING
+       LDAP_LOG ( OPERATION, ENTRY, "bdb_back_search\n", 0, 0, 0 );
+#else
        Debug( LDAP_DEBUG_TRACE, "=> bdb_back_search\n",
                0, 0, 0);
+#endif
 
        manageDSAit = get_manageDSAit( op );
 
-       if ( *nbase == '\0' ) {
+       LOCK_ID (bdb->bi_dbenv, &locker );
+
+       if ( nbase->bv_len == 0 ) {
                /* DIT root special case */
                e = (Entry *) &slap_entry_root;
                rc = 0;
@@ -73,44 +81,65 @@ bdb_search(
 #ifdef BDB_ALIASES
        /* get entry with reader lock */
        if ( deref & LDAP_DEREF_FINDING ) {
-               e = deref_dn_r( be, nbase, &err, &matched, &text );
+               e = deref_dn_r( be, nbase-, &err, &matched, &text );
 
        } else
 #endif
        {
-               rc = bdb_dn2entry( be, NULL, nbase, &e, &matched, 0 );
+dn2entry_retry:
+               rc = bdb_dn2entry_r( be, NULL, nbase, &e, &matched, 0, locker, &lock );
        }
 
        switch(rc) {
        case DB_NOTFOUND:
        case 0:
                break;
+       case LDAP_BUSY:
+               if (e != NULL) {
+                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
+               }
+               if (matched != NULL) {
+                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
+               }
+               send_ldap_result( conn, op, LDAP_BUSY,
+                       NULL, "ldap server busy", NULL, NULL );
+               LOCK_ID_FREE (bdb->bi_dbenv, locker );
+               return LDAP_BUSY;
+       case DB_LOCK_DEADLOCK:
+       case DB_LOCK_NOTGRANTED:
+               goto dn2entry_retry;
        default:
+               if (e != NULL) {
+                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
+               }
+               if (matched != NULL) {
+                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
+               }
                send_ldap_result( conn, op, rc=LDAP_OTHER,
                        NULL, "internal error", NULL, NULL );
+               LOCK_ID_FREE (bdb->bi_dbenv, locker );
                return rc;
        }
 
        if ( e == NULL ) {
-               char *matched_dn = NULL;
-               struct berval **refs = NULL;
+               struct berval matched_dn = { 0, NULL };
+               BerVarray refs = NULL;
 
                if ( matched != NULL ) {
-                       struct berval **erefs;
-                       matched_dn = ch_strdup( matched->e_dn );
+                       BerVarray erefs;
+                       ber_dupbv( &matched_dn, &matched->e_name );
 
                        erefs = is_entry_referral( matched )
-                               ? get_entry_referrals( be, conn, op, matched,
-                                       base, scope )
+                               ? get_entry_referrals( be, conn, op, matched )
                                : NULL;
 
-                       bdb_entry_return( be, matched );
+                       bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
                        matched = NULL;
 
                        if( erefs ) {
-                               refs = referral_rewrite( erefs, matched_dn,
+                               refs = referral_rewrite( erefs, &matched_dn,
                                        base, scope );
-                               ber_bvecfree( erefs );
+                               ber_bvarray_free( erefs );
                        }
 
                } else {
@@ -119,48 +148,56 @@ bdb_search(
                }
 
                send_ldap_result( conn, op,     rc=LDAP_REFERRAL ,
-                       matched_dn, text, refs, NULL );
-
-               ber_bvecfree( refs );
-               free( matched_dn );
+                       matched_dn.bv_val, text, refs, NULL );
 
+               LOCK_ID_FREE (bdb->bi_dbenv, locker );
+               if ( refs ) ber_bvarray_free( refs );
+               if ( matched_dn.bv_val ) ber_memfree( matched_dn.bv_val );
                return rc;
        }
 
        if (!manageDSAit && e != &slap_entry_root && is_entry_referral( e ) ) {
                /* entry is a referral, don't allow add */
-               char *matched_dn = ch_strdup( e->e_dn );
-               struct berval **erefs = get_entry_referrals( be,
-                       conn, op, e, base, scope );
-               struct berval **refs = NULL;
+               struct berval matched_dn;
+               BerVarray erefs, refs;
+               
+               ber_dupbv( &matched_dn, &e->e_name );
+               erefs = get_entry_referrals( be, conn, op, e );
+               refs = NULL;
 
-               bdb_entry_return( be, e );
+               bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache, e, &lock );
                e = NULL;
 
                if( erefs ) {
-                       refs = referral_rewrite( erefs, matched_dn,
+                       refs = referral_rewrite( erefs, &matched_dn,
                                base, scope );
-                       ber_bvecfree( erefs );
+                       ber_bvarray_free( erefs );
                }
 
+#ifdef NEW_LOGGING
+               LDAP_LOG ( OPERATION, RESULTS, 
+                       "bdb_search: entry is referral\n", 0, 0, 0 );
+#else
                Debug( LDAP_DEBUG_TRACE, "bdb_search: entry is referral\n",
                        0, 0, 0 );
+#endif
 
                send_ldap_result( conn, op, LDAP_REFERRAL,
-                       matched_dn, refs ? NULL : "bad referral object",
+                       matched_dn.bv_val,
+                       refs ? NULL : "bad referral object",
                        refs, NULL );
 
-               ber_bvecfree( refs );
-               free( matched_dn );
-
+               LOCK_ID_FREE (bdb->bi_dbenv, locker );
+               ber_bvarray_free( refs );
+               ber_memfree( matched_dn.bv_val );
                return 1;
        }
 
        /* if not root, get appropriate limits */
-       if ( be_isroot( be, op->o_ndn ) ) {
+       if ( be_isroot( be, &op->o_ndn ) ) {
                isroot = 1;
        } else {
-               ( void ) get_limits( be, op->o_ndn, &limit );
+               ( void ) get_limits( be, &op->o_ndn, &limit );
        }
 
        /* The time/size limits come first because they require very little
@@ -185,7 +222,7 @@ bdb_search(
                /* if requested limit higher than hard limit, abort */
                } else if ( tlimit > limit->lms_t_hard ) {
                        /* no hard limit means use soft instead */
-                       if ( limit->lms_t_hard == 0 ) {
+                       if ( limit->lms_t_hard == 0 && tlimit > limit->lms_t_soft ) {
                                tlimit = limit->lms_t_soft;
 
                        /* positive hard limit means abort */
@@ -207,7 +244,7 @@ bdb_search(
                /* if requested limit higher than hard limit, abort */
                } else if ( slimit > limit->lms_s_hard ) {
                        /* no hard limit means use soft instead */
-                       if ( limit->lms_s_hard == 0 ) {
+                       if ( limit->lms_s_hard == 0 && slimit > limit->lms_s_soft ) {
                                slimit = limit->lms_s_soft;
 
                        /* positive hard limit means abort */
@@ -232,25 +269,31 @@ bdb_search(
 
        } else {
                BDB_IDL_ALL( bdb, candidates );
-               rc = search_candidates( be, e, filter,
-                       scope, deref, manageDSAit, candidates );
+               rc = search_candidates( be, op, e, filter,
+                       scope, deref, candidates );
        }
 
        /* need normalized dn below */
-       realbase = ch_strdup( e->e_ndn );
+       ber_dupbv( &realbase, &e->e_nname );
 
        /* start cursor at base entry's id 
-        * FIXME: hack to make "" base work */
+        * FIXME: hack to make "" base work
+        * FIXME: moddn needs to assign new ID for this to work
+        */
        cursor = e->e_id == NOID ? 1 : e->e_id;
 
        if ( e != &slap_entry_root ) {
-               bdb_entry_return( be, e );
+               bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
        }
        e = NULL;
 
        if ( candidates[0] == 0 ) {
+#ifdef NEW_LOGGING
+       LDAP_LOG ( OPERATION, RESULTS, "bdb_search: no candidates\n", 0, 0, 0 );
+#else
                Debug( LDAP_DEBUG_TRACE, "bdb_search: no candidates\n",
                        0, 0, 0 );
+#endif
 
                send_search_result( conn, op,
                        LDAP_SUCCESS,
@@ -264,7 +307,7 @@ bdb_search(
        if ( !isroot && limit->lms_s_unchecked != -1 ) {
                if ( BDB_IDL_N(candidates) > (unsigned) limit->lms_s_unchecked ) {
                        send_search_result( conn, op, 
-                                       LDAP_UNWILLING_TO_PERFORM,
+                                       LDAP_ADMINLIMIT_EXCEEDED,
                                        NULL, NULL, NULL, NULL, 0 );
                        rc = 1;
                        goto done;
@@ -278,11 +321,7 @@ bdb_search(
                int             scopeok = 0;
 
                /* check for abandon */
-               ldap_pvt_thread_mutex_lock( &op->o_abandonmutex );
-               abandon = op->o_abandon;
-               ldap_pvt_thread_mutex_unlock( &op->o_abandonmutex );
-
-               if ( abandon ) {
+               if ( op->o_abandon ) {
                        rc = 0;
                        goto done;
                }
@@ -294,19 +333,55 @@ bdb_search(
                        goto done;
                }
 
+id2entry_retry:
                /* get the entry with reader lock */
-               rc = bdb_id2entry( be, NULL, id, &e );
+               rc = bdb_id2entry_r( be, NULL, id, &e, locker, &lock );
+
+               if (rc == LDAP_BUSY) {
+                       send_ldap_result( conn, op, rc=LDAP_BUSY,
+                               NULL, "ldap server busy", NULL, NULL );
+                       goto done;
+
+               } else if ( rc == DB_LOCK_DEADLOCK || rc == DB_LOCK_NOTGRANTED ) {
+                       goto id2entry_retry;    
+               }
 
                if ( e == NULL ) {
                        if( !BDB_IDL_IS_RANGE(candidates) ) {
                                /* only complain for non-range IDLs */
+#ifdef NEW_LOGGING
+                               LDAP_LOG ( OPERATION, RESULTS,
+                                       "bdb_search: candidate %ld not found\n", (long) id, 0, 0);
+#else
                                Debug( LDAP_DEBUG_TRACE,
                                        "bdb_search: candidate %ld not found\n",
                                        (long) id, 0, 0 );
+#endif
+                       }
+
+                       goto loop_continue;
+               }
+
+#ifdef BDB_SUBENTRIES
+               if ( is_entry_subentry( e ) ) {
+                       if( scope != LDAP_SCOPE_BASE ) {
+                               if(!get_subentries_visibility( op )) {
+                                       /* only subentries are visible */
+                                       goto loop_continue;
+                               }
+
+                       } else if ( get_subentries( op ) &&
+                               !get_subentries_visibility( op ))
+                       {
+                               /* only subentries are visible */
+                               goto loop_continue;
                        }
 
+               } else if ( get_subentries_visibility( op )) {
+                       /* only subentries are visible */
                        goto loop_continue;
                }
+#endif
 
 #ifdef BDB_ALIASES
                if ( deref & LDAP_DEREF_SEARCHING && is_entry_alias( e ) ) {
@@ -328,18 +403,23 @@ bdb_search(
 
                        /* need to skip alias which deref into scope */
                        if( scope & LDAP_SCOPE_ONELEVEL ) {
-                               char *pdn = dn_parent( NULL, e->e_ndn );
-                               if ( pdn != NULL ) {
-                                       if( strcmp( pdn, realbase ) ) {
-                                               goto loop_continue;
-                                       }
+                               struct berval   pdn;
+                               
+                               dnParent( &e->e_nname, &pdn ):
+                               if ( ber_bvcmp( pdn, &realbase ) ) {
+                                       goto loop_continue;
                                }
 
-                       } else if ( dn_issuffix( e->e_ndn, realbase ) ) {
+                       } else if ( dnIsSuffix( &e->e_nname, &realbase ) ) {
                                /* alias is within scope */
+#ifdef NEW_LOGGING
+                               LDAP_LOG ( OPERATION, RESULTS,
+                                       "bdb_search: \"%s\" in subtree\n", e->edn, 0, 0);
+#else
                                Debug( LDAP_DEBUG_TRACE,
                                        "bdb_search: \"%s\" in subtree\n",
                                        e->e_dn, 0, 0 );
+#endif
                                goto loop_continue;
                        }
 
@@ -355,17 +435,49 @@ bdb_search(
                if ( !manageDSAit && scope != LDAP_SCOPE_BASE &&
                        is_entry_referral( e ) )
                {
-                       struct berval **erefs = get_entry_referrals(
-                               be, conn, op, e, NULL, scope );
-                       struct berval **refs = referral_rewrite( erefs, e->e_dn, NULL,
-                               scope == LDAP_SCOPE_SUBTREE 
-                                       ? LDAP_SCOPE_SUBTREE
-                                       : LDAP_SCOPE_BASE );
+                       struct berval   dn;
+
+                       /* check scope */
+                       if ( !scopeok && scope == LDAP_SCOPE_ONELEVEL ) {
+                               if ( !be_issuffix( be, &e->e_nname ) ) {
+                                       dnParent( &e->e_nname, &dn );
+                                       scopeok = dn_match( &dn, &realbase );
+                               } else {
+                                       scopeok = (realbase.bv_len == 0);
+                               }
 
-                       send_search_reference( be, conn, op,
-                               e, refs, NULL, &v2refs );
+                       } else if ( !scopeok && scope == LDAP_SCOPE_SUBTREE ) {
+                               scopeok = dnIsSuffix( &e->e_nname, &realbase );
+
+                       } else {
+                               scopeok = 1;
+                       }
 
-                       ber_bvecfree( refs );
+                       if( scopeok ) {
+                               BerVarray erefs = get_entry_referrals(
+                                       be, conn, op, e );
+                               BerVarray refs = referral_rewrite( erefs,
+                                       &e->e_name, NULL,
+                                       scope == LDAP_SCOPE_SUBTREE
+                                               ? LDAP_SCOPE_SUBTREE
+                                               : LDAP_SCOPE_BASE );
+
+                               send_search_reference( be, conn, op,
+                                       e, refs, NULL, &v2refs );
+
+                               ber_bvarray_free( refs );
+
+                       } else {
+#ifdef NEW_LOGGING
+                               LDAP_LOG(OPERATION, DETAIL2, 
+                                       "bdb_search: candidate referral %ld scope not okay\n",
+                                       id, 0, 0 );
+#else
+                               Debug( LDAP_DEBUG_TRACE,
+                                       "bdb_search: candidate referral %ld scope not okay\n",
+                                       id, 0, 0 );
+#endif
+                       }
 
                        goto loop_continue;
                }
@@ -373,22 +485,19 @@ bdb_search(
                /* if it matches the filter and scope, send it */
                rc = test_filter( be, conn, op, e, filter );
                if ( rc == LDAP_COMPARE_TRUE ) {
-                       char    *dn;
+                       struct berval   dn;
 
                        /* check scope */
                        if ( !scopeok && scope == LDAP_SCOPE_ONELEVEL ) {
-                               if ( (dn = dn_parent( be, e->e_ndn )) != NULL ) {
-                                       scopeok = (dn == realbase)
-                                               ? 1
-                                               : (strcmp( dn, realbase ) ? 0 : 1 );
+                               if ( be_issuffix( be, &e->e_nname ) ) {
+                                       scopeok = (realbase.bv_len == 0);
                                } else {
-                                       scopeok = (realbase == NULL || *realbase == '\0');
+                                       dnParent( &e->e_nname, &dn );
+                                       scopeok = dn_match( &dn, &realbase );
                                }
 
                        } else if ( !scopeok && scope == LDAP_SCOPE_SUBTREE ) {
-                               dn = ch_strdup( e->e_ndn );
-                               scopeok = dn_issuffix( dn, realbase );
-                               free( dn );
+                               scopeok = dnIsSuffix( &e->e_nname, &realbase );
 
                        } else {
                                scopeok = 1;
@@ -397,7 +506,7 @@ bdb_search(
                        if ( scopeok ) {
                                /* check size limit */
                                if ( --slimit == -1 ) {
-                                       bdb_entry_return( be, e );
+                                       bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
                                        e = NULL;
                                        send_search_result( conn, op,
                                                rc = LDAP_SIZELIMIT_EXCEEDED, NULL, NULL,
@@ -406,8 +515,14 @@ bdb_search(
                                }
 
                                if (e) {
-                                       int result = send_search_entry( be, conn, op,
-                                               e, attrs, attrsonly, NULL);
+                                       int result;
+                                       
+                                       if( op->o_noop ) {
+                                               result = 0;
+                                       } else {
+                                               result = send_search_entry( be, conn, op,
+                                                       e, attrs, attrsonly, NULL);
+                                       }
 
                                        switch (result) {
                                        case 0:         /* entry sent ok */
@@ -416,27 +531,38 @@ bdb_search(
                                        case 1:         /* entry not sent */
                                                break;
                                        case -1:        /* connection closed */
-                                               bdb_entry_return( be, e );
+                                               bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
                                                e = NULL;
                                                rc = LDAP_OTHER;
                                                goto done;
                                        }
                                }
                        } else {
+#ifdef NEW_LOGGING
+                               LDAP_LOG ( OPERATION, RESULTS,
+                                       "bdb_search: %ld scope not okay\n", (long) id, 0, 0);
+#else
                                Debug( LDAP_DEBUG_TRACE,
                                        "bdb_search: %ld scope not okay\n",
                                        (long) id, 0, 0 );
+#endif
                        }
                } else {
+#ifdef NEW_LOGGING
+                               LDAP_LOG ( OPERATION, RESULTS,
+                                       "bdb_search: %ld does match filter\n", (long) id, 0, 0);
+#else
                        Debug( LDAP_DEBUG_TRACE,
                                "bdb_search: %ld does match filter\n",
                                (long) id, 0, 0 );
+#endif
                }
 
 loop_continue:
                if( e != NULL ) {
                        /* free reader lock */
-                       bdb_entry_return( be, e );
+                        bdb_cache_return_entry_r ( bdb->bi_dbenv, &bdb->bi_cache, e , &lock);
+                        e = NULL;
                }
 
                ldap_pvt_thread_yield();
@@ -448,8 +574,15 @@ loop_continue:
        rc = 0;
 
 done:
-       ber_bvecfree( v2refs );
-       if( realbase ) ch_free( realbase );
+       if( e != NULL ) {
+               /* free reader lock */
+               bdb_cache_return_entry_r ( bdb->bi_dbenv, &bdb->bi_cache, e, &lock );
+       }
+
+       LOCK_ID_FREE (bdb->bi_dbenv, locker );
+
+       if( v2refs ) ber_bvarray_free( v2refs );
+       if( realbase.bv_val ) ch_free( realbase.bv_val );
 
        return rc;
 }
@@ -460,8 +593,13 @@ static int base_candidate(
        Entry   *e,
        ID              *ids )
 {
+#ifdef NEW_LOGGING
+       LDAP_LOG ( OPERATION, ENTRY,
+               "base_candidate: base: \"%s\" (0x%08lx)\n", e->e_dn, (long) e->e_id, 0);
+#else
        Debug(LDAP_DEBUG_ARGS, "base_candidates: base: \"%s\" (0x%08lx)\n",
                e->e_dn, (long) e->e_id, 0);
+#endif
 
        ids[0] = 1;
        ids[1] = e->e_id;
@@ -469,14 +607,19 @@ static int base_candidate(
 }
 
 /* Is "objectClass=xx" mentioned anywhere in this filter? Presence
- * doesn't count, we're looking for explicit values.
+ * doesn't count, we're looking for explicit values. Also count depth
+ * of filter tree while we're at it.
  */
 static int oc_filter(
-       Filter *f
+       Filter *f,
+       int cur,
+       int *max
 )
 {
        int rc = 0;
 
+       if( cur > *max ) *max = cur;
+
        switch(f->f_choice) {
        case LDAP_FILTER_EQUALITY:
        case LDAP_FILTER_APPROX:
@@ -491,8 +634,9 @@ static int oc_filter(
 
        case LDAP_FILTER_AND:
        case LDAP_FILTER_OR:
+               cur++;
                for (f=f->f_and; f; f=f->f_next)
-                       if ((rc = oc_filter(f)))
+                       if ((rc = oc_filter(f, cur, max)))
                                break;
                break;
        default:
@@ -503,26 +647,42 @@ static int oc_filter(
 
 static int search_candidates(
        BackendDB *be,
+       Operation *op,
        Entry *e,
        Filter *filter,
        int scope,
        int deref,
-       int manageDSAit,
        ID      *ids )
 {
-       int rc;
-       Filter          f, fand, rf, xf;
-       ID              tmp[BDB_IDL_UM_SIZE];
+       int rc, depth = 1;
+       Filter          f, scopef, rf, xf;
+       ID              *stack;
        AttributeAssertion aa_ref;
-       struct bdb_info *bdb = (struct bdb_info *) be->be_private;
+#ifdef BDB_SUBENTRIES
+       Filter  sf;
+       AttributeAssertion aa_subentry;
+#endif
 #ifdef BDB_ALIASES
        Filter  af;
        AttributeAssertion aa_alias;
 #endif
 
+       /*
+        * This routine takes as input a filter (user-filter)
+        * and rewrites it as follows:
+        *      (&(scope=DN)[(objectClass=subentry)]
+        *              (|[(objectClass=referral)(objectClass=alias)](user-filter))
+        */
+
+#ifdef NEW_LOGGING
+       LDAP_LOG ( OPERATION, ENTRY,
+               "search_candidates: base=\"%s\" (0x%08lx) scope=%d\n", 
+               e->e_dn, (long) e->e_id, scope);
+#else
        Debug(LDAP_DEBUG_TRACE,
                "search_candidates: base=\"%s\" (0x%08lx) scope=%d\n",
                e->e_dn, (long) e->e_id, scope );
+#endif
 
        xf.f_or = filter;
        xf.f_choice = LDAP_FILTER_OR;
@@ -531,56 +691,86 @@ static int search_candidates(
        /* If the user's filter doesn't mention objectClass, or if
         * it just uses objectClass=*, these clauses are redundant.
         */
-       if (oc_filter(filter)) {
-               if( !manageDSAit ) { /* match referrals */
-                       static struct berval bv_ref = { sizeof("REFERRAL")-1, "REFERRAL" };
+       if (oc_filter(filter, 1, &depth) && !get_subentries_visibility(op) ) {
+               if( !get_manageDSAit(op) ) { /* match referrals */
+                       struct berval bv_ref = { sizeof("REFERRAL")-1, "REFERRAL" };
                        rf.f_choice = LDAP_FILTER_EQUALITY;
                        rf.f_ava = &aa_ref;
                        rf.f_av_desc = slap_schema.si_ad_objectClass;
-                       rf.f_av_value = &bv_ref;
+                       rf.f_av_value = bv_ref;
                        rf.f_next = xf.f_or;
                        xf.f_or = &rf;
                }
 
 #ifdef BDB_ALIASES
                if( deref & LDAP_DEREF_SEARCHING ) { /* match aliases */
-                       static struct berval bv_alias = { sizeof("ALIAS")-1, "ALIAS" };
+                       struct berval bv_alias = { sizeof("ALIAS")-1, "ALIAS" };
                        af.f_choice = LDAP_FILTER_EQUALITY;
                        af.f_ava = &aa_alias;
                        af.f_av_desc = slap_schema.si_ad_objectClass;
-                       af.f_av_value = &bv_alias;
+                       af.f_av_value = bv_alias;
                        af.f_next = xf.f_or;
                        xf.f_or = ⁡
                }
 #endif
+               /* We added one of these clauses, filter depth increased */
+               if( xf.f_or != filter ) depth++;
        }
 
        f.f_next = NULL;
        f.f_choice = LDAP_FILTER_AND;
-       f.f_and = &fand;
-       fand.f_choice = scope == LDAP_SCOPE_SUBTREE
+       f.f_and = &scopef;
+       scopef.f_choice = scope == LDAP_SCOPE_SUBTREE
                ? SLAPD_FILTER_DN_SUBTREE
                : SLAPD_FILTER_DN_ONE;
-       fand.f_dn = e->e_ndn;
-       fand.f_next = xf.f_or == filter ? filter : &xf ;
+       scopef.f_dn = &e->e_nname;
+       scopef.f_next = xf.f_or == filter ? filter : &xf ;
+       /* Filter depth increased again, adding scope clause */
+       depth++;
+
+#ifdef BDB_SUBENTRIES
+       if( get_subentries_visibility( op ) ) {
+               struct berval bv_subentry = { sizeof("SUBENTRY")-1, "SUBENTRY" };
+               sf.f_choice = LDAP_FILTER_EQUALITY;
+               sf.f_ava = &aa_subentry;
+               sf.f_av_desc = slap_schema.si_ad_objectClass;
+               sf.f_av_value = bv_subentry;
+               sf.f_next = scopef.f_next;
+               scopef.f_next = &sf;
+       }
+#endif
+
+       /* Allocate IDL stack, plus 1 more for former tmp */
+       stack = ch_malloc( (depth + 1) * BDB_IDL_UM_SIZE * sizeof( ID ) );
 
+       rc = bdb_filter_candidates( be, &f, ids, stack, stack+BDB_IDL_UM_SIZE );
 
-#ifdef BDB_FILTER_INDICES
-       rc = bdb_filter_candidates( be, &f, ids, tmp );
+       ch_free( stack );
+
+       if( rc ) {
+#ifdef NEW_LOGGING
+               LDAP_LOG ( OPERATION, DETAIL1,
+                       "bdb_search_candidates: failed (rc=%d)\n", rc, 0, 0  );
 #else
-       /* FIXME: Original code:
-       BDB_IDL_ID( bdb, ids, e->e_id );
-       * this is a hack to make "" base work; when bdb_filter_candidates
-       * is used this should not be needed any more */
-       BDB_IDL_ID( bdb, ids, (e->e_id == NOID ? 1 : e->e_id) );
-       rc = 0;
+               Debug(LDAP_DEBUG_TRACE,
+                       "bdb_search_candidates: failed (rc=%d)\n",
+                       rc, NULL, NULL );
 #endif
 
-       Debug(LDAP_DEBUG_TRACE,
-               "bdb_search_candidates: id=%ld first=%ld last=%ld\n",
-               (long) ids[0],
-               (long) BDB_IDL_FIRST(ids),
-               (long) BDB_IDL_LAST(ids) );
+       } else {
+#ifdef NEW_LOGGING
+               LDAP_LOG ( OPERATION, DETAIL1,
+                       "bdb_search_candidates: id=%ld first=%ld last=%ld\n",
+                       (long) ids[0], (long) BDB_IDL_FIRST(ids), 
+                       (long) BDB_IDL_LAST(ids));
+#else
+               Debug(LDAP_DEBUG_TRACE,
+                       "bdb_search_candidates: id=%ld first=%ld last=%ld\n",
+                       (long) ids[0],
+                       (long) BDB_IDL_FIRST(ids),
+                       (long) BDB_IDL_LAST(ids) );
+#endif
+       }
 
        return rc;
 }