]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/back-bdb/search.c
Memory context tweaks for other ops
[openldap] / servers / slapd / back-bdb / search.c
index 5ba85e50ca0515b9fd53778367d3f9b452b75d5e..595a65b0f616ff72ef6a882524265c2ef43ca515 100644 (file)
@@ -21,18 +21,252 @@ static int base_candidate(
 static int search_candidates(
        Operation *stackop,     /* op with the current threadctx/slab cache */
        Operation *sop,         /* search op */
+       SlapReply *rs,
        Entry *e,
+       u_int32_t locker,
        ID      *ids );
 static void send_pagerequest_response( 
        Operation *op,
        SlapReply *rs,
        ID  lastid,
-       int tentries );                 
+       int tentries );
+
+/* Dereference aliases for a single alias entry. Return the final
+ * dereferenced entry on success, NULL on any failure.
+ */
+static Entry * deref_base (
+       BackendDB *be,
+       SlapReply *rs,
+       Entry *e,
+       Entry **matched,
+       u_int32_t locker,
+       DB_LOCK *lock,
+       ID      *tmp,
+       ID      *visited )
+{
+       struct bdb_info *bdb = (struct bdb_info *) be->be_private;
+       struct berval ndn;
+       DB_LOCK lockr;
+
+       rs->sr_err = LDAP_ALIAS_DEREF_PROBLEM;
+       rs->sr_text = "maximum deref depth exceeded";
+
+       while (BDB_IDL_N(tmp) < be->be_max_deref_depth) {
+
+               /* Remember the last entry we looked at, so we can
+                * report broken links
+                */
+               *matched = e;
+
+               /* If this is part of a subtree or onelevel search,
+                * have we seen this ID before? If so, quit.
+                */
+               if ( visited && bdb_idl_insert( visited, e->e_id ) ) {
+                       e = NULL;
+                       break;
+               }
+
+               /* If we've seen this ID during this deref iteration,
+                * we've hit a loop.
+                */
+               if ( bdb_idl_insert( tmp, e->e_id ) ) {
+                       rs->sr_err = LDAP_ALIAS_PROBLEM;
+                       rs->sr_text = "circular alias";
+                       e = NULL;
+                       break;
+               }
+
+               /* If there was a problem getting the aliasedObjectName,
+                * get_alias_dn will have set the error status.
+                */
+               if ( get_alias_dn(e, &ndn, &rs->sr_err, &rs->sr_text) ) {
+                       e = NULL;
+                       break;
+               }
+
+               rs->sr_err = bdb_dn2entry_r( be, NULL, &ndn, &e,
+                       NULL, 0, locker, &lockr );
+               if (!e) {
+                       rs->sr_err = LDAP_ALIAS_PROBLEM;
+                       rs->sr_text = "aliasedObject not found";
+                       break;
+               }
+
+               /* Free the previous entry, continue to work with the
+                * one we just retrieved.
+                */
+               bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache,
+                       *matched, lock);
+               *lock = lockr;
+
+               /* We found a regular entry. Return this to the caller. The
+                * entry is still locked for Read.
+                */
+               if (!is_entry_alias(e)) {
+                       rs->sr_err = LDAP_SUCCESS;
+                       rs->sr_text = NULL;
+                       break;
+               }
+       }
+       return e;
+}
+
+/* Look for and dereference all aliases within the search scope. Adds
+ * the dereferenced entries to the "ids" list. Requires "stack" to be
+ * able to hold 8 levels of IDLs.
+ */
+static int search_aliases(
+       Operation *op,
+       SlapReply *rs,
+       Entry *e,
+       u_int32_t locker,
+       Filter *sf,
+       ID *ids,
+       ID *stack
+)
+{
+       struct bdb_info *bdb = (struct bdb_info *) op->o_bd->be_private;
+       ID *aliases, *curscop, *subscop, *visited, *newsubs, *oldsubs, *tmp;
+       ID cursora, ida, cursoro, ido, *subscop2;
+       Entry *matched, *a;
+       struct berval bv_alias = { sizeof("alias")-1, "alias" };
+       AttributeAssertion aa_alias;
+       Filter  af;
+       DB_LOCK locka, lockr;
+       int first = 1;
 
+
+       aliases = stack;        /* IDL of all aliases in the database */
+       curscop = aliases + BDB_IDL_UM_SIZE;    /* Aliases in the current scope */
+       subscop = curscop + BDB_IDL_UM_SIZE;    /* The current scope */
+       visited = subscop + BDB_IDL_UM_SIZE;    /* IDs we've seen in this search */
+       newsubs = visited + BDB_IDL_UM_SIZE;    /* New subtrees we've added */
+       oldsubs = newsubs + BDB_IDL_UM_SIZE;    /* Subtrees added previously */
+       tmp = oldsubs + BDB_IDL_UM_SIZE;        /* Scratch space for deref_base() */
+
+       /* A copy of subscop, because subscop gets clobbered by
+        * the bdb_idl_union/intersection routines
+        */
+       subscop2 = tmp + BDB_IDL_UM_SIZE;
+
+       af.f_choice = LDAP_FILTER_EQUALITY;
+       af.f_ava = &aa_alias;
+       af.f_av_desc = slap_schema.si_ad_objectClass;
+       af.f_av_value = bv_alias;
+       af.f_next = NULL;
+
+       /* Find all aliases in database */
+       BDB_IDL_ALL( bdb, aliases );
+       rs->sr_err = bdb_filter_candidates( op, &af, aliases,
+               curscop, visited );
+       if (rs->sr_err != LDAP_SUCCESS) {
+               return rs->sr_err;
+       }
+       oldsubs[0] = 1;
+       oldsubs[1] = e->e_id;
+
+       BDB_IDL_ZERO( ids );
+       BDB_IDL_ZERO( visited );
+       BDB_IDL_ZERO( newsubs );
+
+       cursoro = 0;
+       ido = bdb_idl_first( oldsubs, &cursoro );
+
+       for (;;) {
+               /* Set curscop to only the aliases in the current scope. Start with
+                * all the aliases, obtain the IDL for the current scope, and then
+                * get the intersection of these two IDLs. Add the current scope
+                * to the cumulative list of candidates.
+                */
+               BDB_IDL_CPY( curscop, aliases );
+               rs->sr_err = bdb_filter_candidates( op, sf, subscop, NULL, NULL );
+               if (first) {
+                       first = 0;
+               } else {
+                       bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache, e, &locka);
+               }
+               BDB_IDL_CPY(subscop2, subscop);
+               rs->sr_err = bdb_idl_intersection(curscop, subscop);
+               bdb_idl_union( ids, subscop2 );
+
+               /* Dereference all of the aliases in the current scope. */
+               cursora = 0;
+               for (ida = bdb_idl_first(curscop, &cursora); ida != NOID;
+                       ida = bdb_idl_next(curscop, &cursora))
+               {
+                       rs->sr_err = bdb_id2entry_r(op->o_bd, NULL, ida, &a,
+                               locker, &lockr);
+                       if (rs->sr_err != LDAP_SUCCESS) {
+                               continue;
+                       }
+
+                       /* This should only happen if the curscop IDL has maxed out and
+                        * turned into a range that spans IDs indiscriminately
+                        */
+                       if (!is_entry_alias(a)) {
+                               bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache,
+                                       a, &lockr);
+                               continue;
+                       }
+
+                       /* Actually dereference the alias */
+                       BDB_IDL_ZERO(tmp);
+                       a = deref_base( op->o_bd, rs, a, &matched, locker, &lockr,
+                               tmp, visited );
+                       if (a) {
+                               /* If the target was not already in our current candidates,
+                                * make note of it in the newsubs list.
+                                * FIXME: Somehow we have to propagate these new scopes back
+                                * up to bdb_search.
+                                */
+                               if (bdb_idl_insert(ids, a->e_id) == 0) {
+                                       bdb_idl_insert(newsubs, a->e_id);
+                               }
+                               bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache,
+                                       a, &lockr);
+
+                       } else if (matched) {
+                               /* Alias could not be dereferenced, or it deref'd to
+                                * an ID we've already seen. Ignore it.
+                                */
+                               bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache,
+                                       matched, &lockr );
+                               rs->sr_text = NULL;
+                       }
+               }
+               /* If this is a OneLevel search, we're done; oldsubs only had one
+                * ID in it. For a Subtree search, oldsubs may be a list of scope IDs.
+                */
+               if (op->ors_scope != LDAP_SCOPE_SUBTREE) break;
+nextido:
+               ido = bdb_idl_next( oldsubs, &cursoro );
+               
+               /* If we're done processing the old scopes, did we add any new
+                * scopes in this iteration? If so, go back and do those now.
+                */
+               if (ido == NOID) {
+                       if (BDB_IDL_IS_ZERO(newsubs)) break;
+                       BDB_IDL_CPY(oldsubs, newsubs);
+                       BDB_IDL_ZERO(newsubs);
+                       cursoro = 0;
+                       ido = bdb_idl_first( oldsubs, &cursoro );
+               }
+
+               /* Find the entry corresponding to the next scope. If it can't
+                * be found, ignore it and move on. This should never happen;
+                * we should never see the ID of an entry that doesn't exist.
+                * Set the name so that the scope's IDL can be retrieved.
+                */
+               rs->sr_err = bdb_id2entry_r(op->o_bd, NULL, ido, &e, locker, &locka);
+               if (rs->sr_err != LDAP_SUCCESS) goto nextido;
+               sf->f_dn = &e->e_nname;
+       }
+       return rs->sr_err;
+}
+       
 #if defined(LDAP_CLIENT_UPDATE) || defined(LDAP_SYNC)
 #define IS_BDB_REPLACE(type) (( type == LDAP_PSEARCH_BY_DELETE ) || \
-                       ( type == LDAP_PSEARCH_BY_SCOPEOUT ))
-
+       ( type == LDAP_PSEARCH_BY_SCOPEOUT ))
 #define IS_PSEARCH (op != sop)
 
 int
@@ -67,13 +301,13 @@ bdb_cancel( Operation *op, SlapReply *rs )
                                LDAP_LIST_REMOVE( ps_list, o_ps_link );
 
 #if 0
-                               bdb_build_sync_done_ctrl( conn, ps_list, ps_list->ctrls, 1, &latest_entrycsn_bv );
-                               send_search_result( conn, ps_list, LDAP_CANCELLED,
-                                               NULL, NULL, NULL, ps_list->ctrls, ps_list->nentries);
+                               bdb_build_sync_done_ctrl( conn, ps_list, ps_list->ctrls,
+                                       1, &latest_entrycsn_bv );
+                               send_ldap_result( conn, ps_list, LDAP_CANCELLED,
+                                       NULL, NULL, NULL, ps_list->ctrls, ps_list->nentries);
 #endif
                                rs->sr_err = LDAP_CANCELLED;
-                               rs->sr_nentries = 0;
-                               send_search_result( ps_list, rs );
+                               send_ldap_result( ps_list, rs );
 
                                slap_op_free ( ps_list );
                                return LDAP_SUCCESS;
@@ -92,11 +326,12 @@ int bdb_search( Operation *op, SlapReply *rs )
  * sop is the persistent search. For regular searches, sop = op.
  */
 int
-bdb_do_search( Operation *op, SlapReply *rs, Operation *sop, Entry *ps_e, int ps_type )
+bdb_do_search( Operation *op, SlapReply *rs, Operation *sop,
+       Entry *ps_e, int ps_type )
 #else
-int bdb_search( Operation *op, SlapReply *rs )
-#define        sop     op
 #define        IS_PSEARCH      0
+#define        sop     op
+int bdb_search( Operation *op, SlapReply *rs )
 #endif
 {
        struct bdb_info *bdb = (struct bdb_info *) op->o_bd->be_private;
@@ -107,7 +342,7 @@ int bdb_search( Operation *op, SlapReply *rs )
        Entry   *matched = NULL;
        struct berval   realbase = { 0, NULL };
        int             manageDSAit;
-       int             nentries = 0, tentries = 0;
+       int             tentries = 0;
        ID              lastid = NOID;
        AttributeName   *attrs;
 
@@ -115,7 +350,9 @@ int bdb_search( Operation *op, SlapReply *rs )
        Filter          cookief, csnfnot, csnfeq, csnfand, csnfge;
        AttributeAssertion aa_ge, aa_eq;
        int             entry_count = 0;
+#if 0
        struct berval   entrycsn_bv = { 0, NULL };
+#endif
        struct berval   latest_entrycsn_bv = { 0, NULL };
        LDAPControl     *ctrls[SLAP_SEARCH_MAX_CTRLS];
        int             num_ctrls = 0;
@@ -133,7 +370,7 @@ int bdb_search( Operation *op, SlapReply *rs )
        DB_LOCK         lock;
 
 #ifdef NEW_LOGGING
-       LDAP_LOG ( OPERATION, ENTRY, "bdb_back_search\n", 0, 0, 0 );
+       LDAP_LOG( OPERATION, ENTRY, "bdb_back_search\n", 0, 0, 0 );
 #else
        Debug( LDAP_DEBUG_TRACE, "=> bdb_back_search\n",
                0, 0, 0);
@@ -161,8 +398,9 @@ int bdb_search( Operation *op, SlapReply *rs )
        null_attr.an_name.bv_val = NULL;
 #endif
 
-       for ( num_ctrls = 0; num_ctrls < SLAP_SEARCH_MAX_CTRLS; num_ctrls++ )
+       for ( num_ctrls = 0; num_ctrls < SLAP_SEARCH_MAX_CTRLS; num_ctrls++ ) {
                ctrls[num_ctrls] = NULL;
+       }
        num_ctrls = 0;
 
        if ( IS_PSEARCH && IS_BDB_REPLACE(ps_type)) {
@@ -193,6 +431,7 @@ int bdb_search( Operation *op, SlapReply *rs )
                }
        }
 #endif
+
        manageDSAit = get_manageDSAit( sop );
 
        rs->sr_err = LOCK_ID (bdb->bi_dbenv, &locker );
@@ -209,17 +448,11 @@ int bdb_search( Operation *op, SlapReply *rs )
                /* DIT root special case */
                e = (Entry *) &slap_entry_root;
                rs->sr_err = 0;
-       } else                                          
-#ifdef BDB_ALIASES
-       /* get entry with reader lock */
-       if ( deref & LDAP_DEREF_FINDING ) {
-               e = deref_dn_r( op->o_bd, &sop->o_req_ndn, &rs->sr_err, &matched, &rs->sr_text );
-
-       } else
-#endif
-       {
+       } else {
 dn2entry_retry:
-               rs->sr_err = bdb_dn2entry_r( op->o_bd, NULL, &sop->o_req_ndn, &e, &matched, 0, locker, &lock );
+               /* get entry with reader lock */
+               rs->sr_err = bdb_dn2entry_r( op->o_bd, NULL, &sop->o_req_ndn, &e,
+                       &matched, 0, locker, &lock );
        }
 
        switch(rs->sr_err) {
@@ -231,7 +464,8 @@ dn2entry_retry:
                        bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
                }
                if (matched != NULL) {
-                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
+                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache,
+                               matched, &lock);
                }
                send_ldap_error( sop, rs, LDAP_BUSY, "ldap server busy" );
                LOCK_ID_FREE (bdb->bi_dbenv, locker );
@@ -244,13 +478,20 @@ dn2entry_retry:
                        bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
                }
                if (matched != NULL) {
-                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
+                       bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache,
+                               matched, &lock);
                }
                send_ldap_error( sop, rs, LDAP_OTHER, "internal error" );
                LOCK_ID_FREE (bdb->bi_dbenv, locker );
                return rs->sr_err;
        }
 
+       if ( e && (op->ors_deref & LDAP_DEREF_FINDING) && is_entry_alias(e) ) {
+               BDB_IDL_ZERO(candidates);
+               e = deref_base( op->o_bd, rs, e, &matched, locker, &lock,
+                       candidates, NULL );
+       }
+
        if ( e == NULL ) {
                struct berval matched_dn = { 0, NULL };
 
@@ -262,7 +503,8 @@ dn2entry_retry:
                                ? get_entry_referrals( op, matched )
                                : NULL;
 
-                       bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
+                       bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache,
+                               matched, &lock);
                        matched = NULL;
 
                        if( erefs ) {
@@ -367,7 +609,7 @@ dn2entry_retry:
                        /* positive hard limit means abort */
                        } else if ( limit->lms_t_hard > 0 ) {
                                rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
-                               send_search_result( sop, rs );
+                               send_ldap_result( sop, rs );
                                rs->sr_err = 0;
                                goto done;
                        }
@@ -394,7 +636,7 @@ dn2entry_retry:
                        /* positive hard limit means abort */
                        } else if ( limit->lms_s_hard > 0 ) {
                                rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
-                               send_search_result( sop, rs );
+                               send_ldap_result( sop, rs );
                                rs->sr_err = 0; 
                                goto done;
                        }
@@ -412,7 +654,7 @@ dn2entry_retry:
 
        } else {
                BDB_IDL_ALL( bdb, candidates );
-               rs->sr_err = search_candidates( op, sop, e, candidates );
+               rs->sr_err = search_candidates( op, sop, rs, e, locker, candidates );
        }
 
        /* start cursor at beginning of candidates.
@@ -456,7 +698,7 @@ dn2entry_retry:
 #endif
 
                rs->sr_err = LDAP_SUCCESS;
-               send_search_result( sop, rs );
+               send_ldap_result( sop, rs );
                rs->sr_err = 1;
                goto done;
        }
@@ -465,7 +707,7 @@ dn2entry_retry:
        if ( !isroot && limit->lms_s_unchecked != -1 ) {
                if ( BDB_IDL_N(candidates) > (unsigned) limit->lms_s_unchecked ) {
                        rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
-                       send_search_result( sop, rs );
+                       send_ldap_result( sop, rs );
                        rs->sr_err = 1;
                        goto done;
                }
@@ -483,7 +725,7 @@ dn2entry_retry:
                        if ( sop->o_pagedresults_size == 0 ) {
                                rs->sr_err = LDAP_SUCCESS;
                                rs->sr_text = "search abandoned by pagedResult size=0";
-                               send_search_result( sop, rs );
+                               send_ldap_result( sop, rs );
                                goto done;
                        }
                        for ( id = bdb_idl_first( candidates, &cursor );
@@ -500,7 +742,6 @@ dn2entry_retry:
                                "bdb_search: no paged results candidates\n",
                                0, 0, 0 );
 #endif
-                       rs->sr_nentries = nentries;
                        send_pagerequest_response( sop, rs, lastid, 0 );
 
                        rs->sr_err = 1;
@@ -512,7 +753,8 @@ dn2entry_retry:
 
 #ifdef LDAP_CLIENT_UPDATE
        if ( (sop->o_clientupdate_type & SLAP_LCUP_SYNC) ||
-           (IS_PSEARCH && sop->o_ps_protocol == LDAP_CLIENT_UPDATE )) {
+           (IS_PSEARCH && sop->o_ps_protocol == LDAP_CLIENT_UPDATE ))
+       {
                cookief.f_choice = LDAP_FILTER_AND;
                cookief.f_and = &csnfnot;
                cookief.f_next = NULL;
@@ -542,7 +784,8 @@ dn2entry_retry:
 #endif
 #ifdef LDAP_SYNC
        if ( (sop->o_sync_mode & SLAP_SYNC_REFRESH) ||
-               ( IS_PSEARCH && sop->o_ps_protocol == LDAP_SYNC )) {
+               ( IS_PSEARCH && sop->o_ps_protocol == LDAP_SYNC ))
+       {
                cookief.f_choice = LDAP_FILTER_AND;
                cookief.f_and = &csnfnot;
                cookief.f_next = NULL;
@@ -572,7 +815,6 @@ dn2entry_retry:
                id != NOID;
                id = bdb_idl_next( candidates, &cursor ) )
        {
-
                int             scopeok = 0;
 
 loop_begin:
@@ -586,8 +828,7 @@ loop_begin:
                if ( sop->o_cancel ) {
                        assert( sop->o_cancel == SLAP_CANCEL_REQ );
                        rs->sr_err = LDAP_CANCELLED;
-                       rs->sr_nentries = nentries;
-                       send_search_result( sop, rs );
+                       send_ldap_result( sop, rs );
                        sop->o_cancel = SLAP_CANCEL_ACK;
                        rs->sr_err = 0;
                        goto done;
@@ -598,8 +839,7 @@ loop_begin:
                if ( sop->oq_search.rs_tlimit != -1 && slap_get_time() > stoptime ) {
                        rs->sr_err = LDAP_TIMELIMIT_EXCEEDED;
                        rs->sr_ref = rs->sr_v2ref;
-                       rs->sr_nentries = nentries;
-                       send_search_result( sop, rs );
+                       send_ldap_result( sop, rs );
                        goto done;
                }
 
@@ -609,14 +849,17 @@ loop_begin:
 #endif
 id2entry_retry:
                        /* get the entry with reader lock */
-                       rs->sr_err = bdb_id2entry_r( op->o_bd, NULL, id, &e, locker, &lock );
+                       rs->sr_err = bdb_id2entry_r( op->o_bd, NULL, id,
+                               &e, locker, &lock );
 
                        if (rs->sr_err == LDAP_BUSY) {
                                rs->sr_text = "ldap server busy";
                                send_ldap_result( sop, rs );
                                goto done;
 
-                       } else if ( rs->sr_err == DB_LOCK_DEADLOCK || rs->sr_err == DB_LOCK_NOTGRANTED ) {
+                       } else if ( rs->sr_err == DB_LOCK_DEADLOCK
+                               || rs->sr_err == DB_LOCK_NOTGRANTED )
+                       {
                                goto id2entry_retry;    
                        }
 
@@ -625,7 +868,8 @@ id2entry_retry:
                                        /* only complain for non-range IDLs */
 #ifdef NEW_LOGGING
                                        LDAP_LOG ( OPERATION, RESULTS,
-                                               "bdb_search: candidate %ld not found\n", (long) id, 0, 0);
+                                               "bdb_search: candidate %ld not found\n",
+                                               (long) id, 0, 0);
 #else
                                        Debug( LDAP_DEBUG_TRACE,
                                                "bdb_search: candidate %ld not found\n",
@@ -664,49 +908,18 @@ id2entry_retry:
 #endif
 
 #ifdef BDB_ALIASES
-               if ( sop->oq_search.rs_deref & LDAP_DEREF_SEARCHING && is_entry_alias( e ) ) {
-                       Entry *matched;
-                       int err;
-                       const char *text;
-                       
-                       e = deref_entry_r( op->o_bd, e, &rs->sr_err, &matched, &rs->sr_text );
-
-                       if( e == NULL ) {
-                               e = matched;
-                               goto loop_continue;
-                       }
-
-                       if( e->e_id == id ) {
-                               /* circular loop */
-                               goto loop_continue;
-                       }
-
-                       /* need to skip alias which deref into scope */
-                       if( sop->oq_search.rs_scope & LDAP_SCOPE_ONELEVEL ) {
-                               struct berval   pdn;
-                               
-                               dnParent( &e->e_nname, &pdn ):
-                               if ( ber_bvcmp( pdn, &realbase ) ) {
-                                       goto loop_continue;
-                               }
-
-                       } else if ( dnIsSuffix( &e->e_nname, &realbase ) ) {
-                               /* alias is within scope */
-#ifdef NEW_LOGGING
-                               LDAP_LOG ( OPERATION, RESULTS,
-                                       "bdb_search: \"%s\" in subtree\n", e->edn, 0, 0);
-#else
-                               Debug( LDAP_DEBUG_TRACE,
-                                       "bdb_search: \"%s\" in subtree\n",
-                                       e->e_dn, 0, 0 );
-#endif
+               /* aliases were already dereferenced in candidate list */
+               if ( (sop->ors_deref & LDAP_DEREF_SEARCHING) && is_entry_alias(e)) {
+                       /* but if the search base is an alias, and we didn't
+                        * deref it when finding, return it.
+                        */
+                       if ( (sop->ors_deref & LDAP_DEREF_FINDING)
+                               || !bvmatch(&e->e_nname, &op->o_req_ndn))
+                       {
                                goto loop_continue;
                        }
-
-                       scopeok = 1;
                }
 #endif
-
                /*
                 * if it's a referral, add it to the list of referrals. only do
                 * this for non-base searches, and don't check the filter
@@ -726,7 +939,9 @@ id2entry_retry:
                                        scopeok = (realbase.bv_len == 0);
                                }
 
-                       } else if ( !scopeok && sop->oq_search.rs_scope == LDAP_SCOPE_SUBTREE ) {
+                       } else if ( !scopeok
+                               && sop->oq_search.rs_scope == LDAP_SCOPE_SUBTREE )
+                       {
                                scopeok = dnIsSuffix( &e->e_nname, &realbase );
 
                        } else {
@@ -779,7 +994,8 @@ id2entry_retry:
 #ifdef LDAP_SYNC
                        if ( sop->o_sync_mode & SLAP_SYNC_REFRESH ) {
                                rc_sync = test_filter( sop, rs->sr_entry, &cookief );
-                               rs->sr_err      = test_filter( sop, rs->sr_entry, sop->oq_search.rs_filter );
+                               rs->sr_err = test_filter( sop,
+                                       rs->sr_entry, sop->oq_search.rs_filter );
                                if ( rs->sr_err == LDAP_COMPARE_TRUE ) {
                                        if ( rc_sync == LDAP_COMPARE_TRUE ) {
                                                entry_sync_state = LDAP_SYNC_ADD;
@@ -791,7 +1007,8 @@ id2entry_retry:
 #endif
 #endif
                        {
-                               rs->sr_err = test_filter( sop, rs->sr_entry, sop->oq_search.rs_filter );
+                               rs->sr_err = test_filter( sop,
+                                       rs->sr_entry, sop->oq_search.rs_filter );
                        }
 #if defined(LDAP_CLIENT_UPDATE) || defined(LDAP_SYNC)
                }
@@ -809,7 +1026,9 @@ id2entry_retry:
                                        scopeok = dn_match( &dn, &realbase );
                                }
 
-                       } else if ( !scopeok && sop->oq_search.rs_scope == LDAP_SCOPE_SUBTREE ) {
+                       } else if ( !scopeok &&
+                               sop->oq_search.rs_scope == LDAP_SCOPE_SUBTREE )
+                       {
                                scopeok = dnIsSuffix( &e->e_nname, &realbase );
 
                        } else {
@@ -828,15 +1047,13 @@ id2entry_retry:
                                        rs->sr_entry = NULL;
                                        rs->sr_err = LDAP_SIZELIMIT_EXCEEDED;
                                        rs->sr_ref = rs->sr_v2ref;
-                                       rs->sr_nentries = nentries;
-                                       send_search_result( sop, rs );
+                                       send_ldap_result( sop, rs );
                                        goto done;
                                }
 
 #ifdef LDAP_CONTROL_PAGEDRESULTS
                                if ( get_pagedresults(sop) ) {
-                                       if ( nentries >= sop->o_pagedresults_size ) {
-                                               rs->sr_nentries = nentries;
+                                       if ( rs->sr_nentries >= sop->o_pagedresults_size ) {
                                                send_pagerequest_response( sop, rs,
                                                        lastid, tentries );
                                                goto done;
@@ -846,7 +1063,8 @@ id2entry_retry:
 #endif
 
                                if (e) {
-                                       int result;
+                                       /* safe default */
+                                       int result = -1;
                                        
 #if 0  /* noop is masked SLAP_CTRL_UPDATE */
                                        if( op->o_noop ) {
@@ -867,10 +1085,10 @@ id2entry_retry:
                                                {
                                                        if ( ps_type == LDAP_PSEARCH_BY_MODIFY ) {
                                                                struct psid_entry* psid_e;
-                                                               LDAP_LIST_FOREACH( psid_e, &op->o_pm_list, ps_link)
+                                                               LDAP_LIST_FOREACH( psid_e,
+                                                                       &op->o_pm_list, ps_link)
                                                                {
-                                                                       if( psid_e->ps_op == sop )
-                                                                       {
+                                                                       if( psid_e->ps_op == sop ) {
 #ifdef LDAP_SYNC
                                                                                premodify_found = 1;
 #endif
@@ -881,15 +1099,16 @@ id2entry_retry:
                                                                if (psid_e != NULL) free (psid_e);
                                                        }
 #ifdef LDAP_SYNC
-                                                       if ( ps_type == LDAP_PSEARCH_BY_ADD )
+                                                       if ( ps_type == LDAP_PSEARCH_BY_ADD ) {
                                                                entry_sync_state = LDAP_SYNC_ADD;
-                                                       else if ( ps_type == LDAP_PSEARCH_BY_DELETE )
+                                                       } else if ( ps_type == LDAP_PSEARCH_BY_DELETE ) {
                                                                entry_sync_state = LDAP_SYNC_DELETE;
-                                                       else if ( ps_type == LDAP_PSEARCH_BY_MODIFY ) {
-                                                               if ( premodify_found )
+                                                       else if ( ps_type == LDAP_PSEARCH_BY_MODIFY ) {
+                                                               if ( premodify_found ) {
                                                                        entry_sync_state = LDAP_SYNC_MODIFY;
-                                                               else
+                                                               } else {
                                                                        entry_sync_state = LDAP_SYNC_ADD;
+                                                               }
                                                        } else if ( ps_type == LDAP_PSEARCH_BY_SCOPEOUT )
                                                                entry_sync_state = LDAP_SYNC_DELETE;
                                                        else {
@@ -902,19 +1121,21 @@ id2entry_retry:
                                                if ( sop->o_ps_protocol == LDAP_CLIENT_UPDATE ) {
                                                        int entry_count = ++sop->o_ps_entries;
                                                        if ( IS_BDB_REPLACE(ps_type) ) {
-                                                               rs->sr_err = bdb_build_lcup_update_ctrl( sop, rs, e, entry_count, ctrls,
-                                                                               num_ctrls++, &latest_entrycsn_bv, SLAP_LCUP_ENTRY_DELETED_TRUE );
+                                                               rs->sr_err = bdb_build_lcup_update_ctrl( sop,
+                                                                       rs, e, entry_count, ctrls,
+                                                                       num_ctrls++, &latest_entrycsn_bv,
+                                                                       SLAP_LCUP_ENTRY_DELETED_TRUE );
                                                        } else {
-                                                               rs->sr_err = bdb_build_lcup_update_ctrl( sop, rs, e, entry_count, ctrls,
-                                                                               num_ctrls++, &latest_entrycsn_bv, SLAP_LCUP_ENTRY_DELETED_FALSE );
+                                                               rs->sr_err = bdb_build_lcup_update_ctrl( sop,
+                                                                       rs, e, entry_count, ctrls,
+                                                                       num_ctrls++, &latest_entrycsn_bv,
+                                                                       SLAP_LCUP_ENTRY_DELETED_FALSE );
                                                        }
-                                                       if ( rs->sr_err != LDAP_SUCCESS )
-                                                               goto done;
+                                                       if ( rs->sr_err != LDAP_SUCCESS ) goto done;
                                                        rs->sr_attrs = attrs;
                                                        rs->sr_ctrls = ctrls;
                                                        result = send_search_entry( sop, rs );
-                                                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
-                                                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+                                                       ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
                                                        ch_free( ctrls[--num_ctrls] );
                                                        ctrls[num_ctrls] = NULL;
                                                        rs->sr_ctrls = NULL;
@@ -922,15 +1143,14 @@ id2entry_retry:
 #endif
 #ifdef LDAP_SYNC
                                                if ( sop->o_ps_protocol == LDAP_SYNC ) {
-                                                       rs->sr_err = bdb_build_sync_state_ctrl( sop, rs, e, entry_sync_state, ctrls,
-                                                                                       num_ctrls++, 1, &latest_entrycsn_bv );
-                                                       if ( rs->sr_err != LDAP_SUCCESS )
-                                                               goto done;
+                                                       rs->sr_err = bdb_build_sync_state_ctrl( sop,
+                                                               rs, e, entry_sync_state, ctrls,
+                                                               num_ctrls++, 1, &latest_entrycsn_bv );
+                                                       if ( rs->sr_err != LDAP_SUCCESS ) goto done;
                                                        rs->sr_attrs = attrs;
                                                        rs->sr_ctrls = ctrls;
                                                        result = send_search_entry( sop, rs );
-                                                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
-                                                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+                                                       ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
                                                        ch_free( ctrls[--num_ctrls] );
                                                        ctrls[num_ctrls] = NULL;
                                                        rs->sr_ctrls = NULL;
@@ -946,7 +1166,8 @@ id2entry_retry:
                                                psid_e = (struct psid_entry *) calloc (1,
                                                        sizeof(struct psid_entry));
                                                psid_e->ps_op = sop;
-                                               LDAP_LIST_INSERT_HEAD( &op->o_pm_list, psid_e, ps_link );
+                                               LDAP_LIST_INSERT_HEAD( &op->o_pm_list,
+                                                       psid_e, ps_link );
 
                                        } else {
                                                printf("Error !\n");
@@ -954,16 +1175,15 @@ id2entry_retry:
                                } else {
 #ifdef LDAP_CLIENT_UPDATE
                                                if ( sop->o_clientupdate_type & SLAP_LCUP_SYNC ) {
-                                                       rs->sr_err = bdb_build_lcup_update_ctrl( sop, rs, e, ++entry_count, ctrls,
-                                                                       num_ctrls++, &latest_entrycsn_bv, SLAP_LCUP_ENTRY_DELETED_FALSE );
-                                                       if ( rs->sr_err != LDAP_SUCCESS )
-                                                               goto done;
+                                                       rs->sr_err = bdb_build_lcup_update_ctrl( sop,
+                                                               rs, e, ++entry_count, ctrls,
+                                                               num_ctrls++, &latest_entrycsn_bv,
+                                                               SLAP_LCUP_ENTRY_DELETED_FALSE );
+                                                       if ( rs->sr_err != LDAP_SUCCESS ) goto done;
                                                        rs->sr_ctrls = ctrls;
                                                        rs->sr_attrs = sop->oq_search.rs_attrs;
                                                        result = send_search_entry( sop, rs );
-
-                                                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
-                                                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+                                                       ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
                                                        ch_free( ctrls[--num_ctrls] );
                                                        ctrls[num_ctrls] = NULL;
                                                        rs->sr_ctrls = NULL;
@@ -971,10 +1191,10 @@ id2entry_retry:
 #endif
 #ifdef LDAP_SYNC
                                                if ( sop->o_sync_mode & SLAP_SYNC_REFRESH ) {
-                                                       rs->sr_err = bdb_build_sync_state_ctrl( sop, rs, e, entry_sync_state, ctrls,
-                                                                       num_ctrls++, 0, &latest_entrycsn_bv );
-                                                       if ( rs->sr_err != LDAP_SUCCESS )
-                                                               goto done;
+                                                       rs->sr_err = bdb_build_sync_state_ctrl( sop,
+                                                               rs, e, entry_sync_state, ctrls,
+                                                               num_ctrls++, 0, &latest_entrycsn_bv );
+                                                       if ( rs->sr_err != LDAP_SUCCESS ) goto done;
 
                                                        rs->sr_ctrls = ctrls;
                                                        if ( rc_sync == LDAP_COMPARE_TRUE ) { /* ADD */
@@ -983,9 +1203,7 @@ id2entry_retry:
                                                                rs->sr_attrs = &null_attr;
                                                        }
                                                        result = send_search_entry( sop, rs );
-
-                                                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
-                                                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+                                                       ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
                                                        ch_free( ctrls[--num_ctrls] );
                                                        ctrls[num_ctrls] = NULL;
                                                        rs->sr_ctrls = NULL;
@@ -1001,7 +1219,6 @@ id2entry_retry:
 
                                        switch (result) {
                                        case 0:         /* entry sent ok */
-                                               nentries++;
                                                break;
                                        case 1:         /* entry not sent */
                                                break;
@@ -1039,9 +1256,10 @@ id2entry_retry:
 loop_continue:
                if( e != NULL ) {
                        /* free reader lock */
-                       if (!IS_PSEARCH)
-                       bdb_cache_return_entry_r( bdb->bi_dbenv,
-                               &bdb->bi_cache, e , &lock);
+                       if (!IS_PSEARCH) {
+                               bdb_cache_return_entry_r( bdb->bi_dbenv,
+                                       &bdb->bi_cache, e , &lock);
+                       }
                        e = NULL;
                        rs->sr_entry = NULL;
                }
@@ -1052,19 +1270,20 @@ loop_continue:
        if (!IS_PSEARCH) {
 #ifdef LDAP_CLIENT_UPDATE
        if ( sop->o_clientupdate_type & SLAP_LCUP_SYNC ) {
-               bdb_build_lcup_done_ctrl( sop, rs, ctrls, num_ctrls++, &latest_entrycsn_bv );
+               bdb_build_lcup_done_ctrl( sop, rs, ctrls,
+                       num_ctrls++, &latest_entrycsn_bv );
 
                rs->sr_ctrls = ctrls;
                rs->sr_ref = rs->sr_v2ref;
                rs->sr_err = (rs->sr_v2ref == NULL) ? LDAP_SUCCESS : LDAP_REFERRAL;
-               rs->sr_nentries = nentries;
-               send_search_result( sop, rs );
+               send_ldap_result( sop, rs );
 
                ch_free( latest_entrycsn_bv.bv_val );
                latest_entrycsn_bv.bv_val = NULL;
 
-               if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
-                               ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+               if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL ) {
+                       ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+               }
                ch_free( ctrls[--num_ctrls] );
                ctrls[num_ctrls] = NULL;
        } else
@@ -1080,14 +1299,15 @@ loop_continue:
                                LDAP_SYNC_REFRESH_DONE, &latest_entrycsn_bv );
                } else {
                        /* refreshOnly mode */
-                       bdb_build_sync_done_ctrl( sop, rs, ctrls, num_ctrls++, 1, &latest_entrycsn_bv );
+                       bdb_build_sync_done_ctrl( sop, rs, ctrls,
+                               num_ctrls++, 1, &latest_entrycsn_bv );
                        rs->sr_ctrls = ctrls;
                        rs->sr_ref = rs->sr_v2ref;
                        rs->sr_err = (rs->sr_v2ref == NULL) ? LDAP_SUCCESS : LDAP_REFERRAL;
-                       rs->sr_nentries = nentries;
-                       send_search_result( sop, rs );
-                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL )
+                       send_ldap_result( sop, rs );
+                       if ( ctrls[num_ctrls-1]->ldctl_value.bv_val != NULL ) {
                                ch_free( ctrls[num_ctrls-1]->ldctl_value.bv_val );
+                       }
                        ch_free( ctrls[--num_ctrls] );
                        ctrls[num_ctrls] = NULL;
                }
@@ -1100,8 +1320,7 @@ loop_continue:
                rs->sr_ctrls = NULL;
                rs->sr_ref = rs->sr_v2ref;
                rs->sr_err = (rs->sr_v2ref == NULL) ? LDAP_SUCCESS : LDAP_REFERRAL;
-               rs->sr_nentries = nentries;
-               send_search_result( sop, rs );
+               send_ldap_result( sop, rs );
        }
        }
 
@@ -1132,7 +1351,8 @@ static int base_candidate(
 {
 #ifdef NEW_LOGGING
        LDAP_LOG ( OPERATION, ENTRY,
-               "base_candidate: base: \"%s\" (0x%08lx)\n", e->e_dn, (long) e->e_id, 0);
+               "base_candidate: base: \"%s\" (0x%08lx)\n",
+               e->e_dn, (long) e->e_id, 0);
 #else
        Debug(LDAP_DEBUG_ARGS, "base_candidates: base: \"%s\" (0x%08lx)\n",
                e->e_dn, (long) e->e_id, 0);
@@ -1197,7 +1417,8 @@ static void *search_stack(
        }
 
        if ( !ret ) {
-               ret = ch_malloc( bdb->bi_search_stack_depth * BDB_IDL_UM_SIZE * sizeof( ID ) );
+               ret = ch_malloc( bdb->bi_search_stack_depth * BDB_IDL_UM_SIZE
+                       * sizeof( ID ) );
                if ( op->o_threadctx ) {
                        ldap_pvt_thread_pool_setkey( op->o_threadctx, search_stack,
                                ret, search_stack_free );
@@ -1211,22 +1432,20 @@ static void *search_stack(
 static int search_candidates(
        Operation *stackop,
        Operation *op,
+       SlapReply *rs,
        Entry *e,
+       u_int32_t locker,
        ID      *ids )
 {
        struct bdb_info *bdb = (struct bdb_info *) op->o_bd->be_private;
        int rc, depth = 1;
-       Filter          f, scopef, rf, xf;
+       Filter          f, scopef, rf, xf, nf;
        ID              *stack;
        AttributeAssertion aa_ref;
 #ifdef BDB_SUBENTRIES
        Filter  sf;
        AttributeAssertion aa_subentry;
 #endif
-#ifdef BDB_ALIASES
-       Filter  af;
-       AttributeAssertion aa_alias;
-#endif
 
        /*
         * This routine takes as input a filter (user-filter)
@@ -1252,7 +1471,9 @@ static int search_candidates(
        /* If the user's filter uses objectClass=*,
         * these clauses are redundant.
         */
-       if (!oc_filter(op->oq_search.rs_filter, 1, &depth) && !get_subentries_visibility(op) ) {
+       if (!oc_filter(op->oq_search.rs_filter, 1, &depth)
+               && !get_subentries_visibility(op) )
+       {
                if( !get_manageDSAit(op) && !get_domainScope(op) ) {
                        /* match referral objects */
                        struct berval bv_ref = { sizeof("referral")-1, "referral" };
@@ -1262,33 +1483,24 @@ static int search_candidates(
                        rf.f_av_value = bv_ref;
                        rf.f_next = xf.f_or;
                        xf.f_or = &rf;
+                       depth++;
                }
-
-#ifdef BDB_ALIASES
-               if( op->oq_search.rs_deref & LDAP_DEREF_SEARCHING ) {
-                       /* match alias objects */
-                       struct berval bv_alias = { sizeof("alias")-1, "alias" };
-                       af.f_choice = LDAP_FILTER_EQUALITY;
-                       af.f_ava = &aa_alias;
-                       af.f_av_desc = slap_schema.si_ad_objectClass;
-                       af.f_av_value = bv_alias;
-                       af.f_next = xf.f_or;
-                       xf.f_or = &af;
-               }
-#endif
-               /* We added one of these clauses, filter depth increased */
-               if( xf.f_or != op->oq_search.rs_filter ) depth++;
        }
 
-       f.f_next = NULL;
-       f.f_choice = LDAP_FILTER_AND;
-       f.f_and = &scopef;
        scopef.f_choice = op->oq_search.rs_scope == LDAP_SCOPE_SUBTREE
                ? SLAPD_FILTER_DN_SUBTREE
                : SLAPD_FILTER_DN_ONE;
        scopef.f_dn = &e->e_nname;
-       scopef.f_next = xf.f_or == op->oq_search.rs_filter ? op->oq_search.rs_filter : &xf ;
-       /* Filter depth increased again, adding scope clause */
+       scopef.f_next = NULL;
+
+       f.f_next = NULL;
+       f.f_choice = LDAP_FILTER_AND;
+       f.f_and = &nf;
+       /* Dummy; we compute scope separately now */
+       nf.f_choice = LDAP_FILTER_NOT;
+       nf.f_next = xf.f_or == op->oq_search.rs_filter
+               ? op->oq_search.rs_filter : &xf ;
+       /* Filter depth increased again, adding dummy clause */
        depth++;
 
 #ifdef BDB_SUBENTRIES
@@ -1299,7 +1511,7 @@ static int search_candidates(
                sf.f_av_desc = slap_schema.si_ad_objectClass;
                sf.f_av_value = bv_subentry;
                sf.f_next = scopef.f_next;
-               scopef.f_next = &sf;
+               nf.f_next = &sf;
        }
 #endif
 
@@ -1310,7 +1522,17 @@ static int search_candidates(
                stack = search_stack( stackop );
        }
 
-       rc = bdb_filter_candidates( op->o_bd, &f, ids, stack, stack+BDB_IDL_UM_SIZE );
+       if( op->ors_deref & LDAP_DEREF_SEARCHING ) {
+               rc = search_aliases( op, rs, e, locker, &scopef, ids, stack );
+       } else {
+               rc = bdb_filter_candidates( op, &scopef, ids,
+                       stack, stack+BDB_IDL_UM_SIZE );
+       }
+
+       if ( rc == LDAP_SUCCESS ) {
+               rc = bdb_filter_candidates( op, &f, ids,
+                       stack, stack+BDB_IDL_UM_SIZE );
+       }
 
        if ( depth+1 > bdb->bi_search_stack_depth ) {
                ch_free( stack );
@@ -1394,7 +1616,7 @@ send_pagerequest_response(
 
        rs->sr_ctrls = ctrls;
        rs->sr_err = LDAP_SUCCESS;
-       send_search_result( op, rs );
+       send_ldap_result( op, rs );
 
 done:
        (void) ber_free_buf( ber );
@@ -1416,7 +1638,6 @@ bdb_build_lcup_update_ctrl(
        Attribute* a;
        int ret;
        int res;
-       int rc;
        const char *text = NULL;
 
        char berbuf[LBER_ELEMENT_SIZEOF];
@@ -1460,17 +1681,18 @@ bdb_build_lcup_update_ctrl(
                }
        }
 
-       if ( entry_count % op->o_clientupdate_interval == 0 )
+       if ( entry_count % op->o_clientupdate_interval == 0 ) {
                ber_printf( ber,
                        "{bb{sON}N}",
                        SLAP_LCUP_STATE_UPDATE_FALSE,
                        isdeleted,
                        LDAP_CUP_COOKIE_OID, &entrycsn_bv );
-       else /* Do not send cookie */
+       } else { /* Do not send cookie */
                ber_printf( ber,
                        "{bbN}",
                        SLAP_LCUP_STATE_UPDATE_FALSE,
                        isdeleted );
+       }
 
        ch_free( entrycsn_bv.bv_val );
        entrycsn_bv.bv_val = NULL;
@@ -1506,7 +1728,7 @@ bdb_build_lcup_done_ctrl(
        int             num_ctrls,
        struct berval   *latest_entrycsn_bv     )
 {
-       int ret, rc;
+       int ret;
        char berbuf[LBER_ELEMENT_SIZEOF];
        BerElement *ber = (BerElement *)berbuf;
 
@@ -1514,8 +1736,7 @@ bdb_build_lcup_done_ctrl(
 
        ctrls[num_ctrls] = ch_malloc ( sizeof ( LDAPControl ) );
 
-       ber_printf( ber, "{sO", LDAP_CUP_COOKIE_OID, latest_entrycsn_bv );
-       ber_printf( ber, "N}" );
+       ber_printf( ber, "{sON}", LDAP_CUP_COOKIE_OID, latest_entrycsn_bv );
 
        ctrls[num_ctrls]->ldctl_oid = LDAP_CONTROL_CLIENT_UPDATE_DONE;
        ctrls[num_ctrls]->ldctl_iscritical = op->o_clientupdate;
@@ -1528,7 +1749,8 @@ bdb_build_lcup_done_ctrl(
                LDAP_LOG ( OPERATION, RESULTS, 
                        "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n", 0, 0, 0 );
 #else
-               Debug( LDAP_DEBUG_TRACE, "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
+               Debug( LDAP_DEBUG_TRACE,
+                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
                        0, 0, 0 );
 #endif
                send_ldap_error( op, rs, LDAP_OTHER, "internal error" );
@@ -1554,7 +1776,6 @@ bdb_build_sync_state_ctrl(
        Attribute* a;
        int ret;
        int res;
-       int rc;
        const char *text = NULL;
 
        char berbuf[LBER_ELEMENT_SIZEOF];
@@ -1600,10 +1821,13 @@ bdb_build_sync_state_ctrl(
                }
        }
 
-       if ( send_cookie )
-               ber_printf( ber, "{eOON}", entry_sync_state, &entryuuid_bv, &entrycsn_bv );
-       else
-               ber_printf( ber, "{eON}", entry_sync_state, &entryuuid_bv );
+       if ( send_cookie ) {
+               ber_printf( ber, "{eOON}",
+                       entry_sync_state, &entryuuid_bv, &entrycsn_bv );
+       } else {
+               ber_printf( ber, "{eON}",
+                       entry_sync_state, &entryuuid_bv );
+       }
 
        ch_free( entrycsn_bv.bv_val );
        entrycsn_bv.bv_val = NULL;
@@ -1642,7 +1866,7 @@ bdb_build_sync_done_ctrl(
        int             send_cookie,
        struct berval   *latest_entrycsn_bv     )
 {
-       int ret,rc;
+       int ret;
        char berbuf[LBER_ELEMENT_SIZEOF];
        BerElement *ber = (BerElement *)berbuf;
 
@@ -1665,9 +1889,11 @@ bdb_build_sync_done_ctrl(
        if ( ret < 0 ) {
 #ifdef NEW_LOGGING
                LDAP_LOG ( OPERATION, RESULTS, 
-                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n", 0, 0, 0 );
+                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
+                       0, 0, 0 );
 #else
-               Debug( LDAP_DEBUG_TRACE, "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
+               Debug( LDAP_DEBUG_TRACE,
+                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
                        0, 0, 0 );
 #endif
                send_ldap_error( op, rs, LDAP_OTHER, "internal error" );
@@ -1688,23 +1914,26 @@ bdb_send_ldap_intermediate(
        BerElement *ber = (BerElement *)berbuf;
        struct berval rspdata;
 
-       int ret, rc;
+       int ret;
 
        ber_init2( ber, NULL, LBER_USE_DER );
 
-       if ( cookie == NULL )
+       if ( cookie == NULL ) {
                ber_printf( ber, "{eN}", state );
-       else
+       } else {
                ber_printf( ber, "{eON}", state, cookie );
+       }
 
        ret = ber_flatten2( ber, &rspdata, 0 );
 
        if ( ret < 0 ) {
 #ifdef NEW_LOGGING
                LDAP_LOG ( OPERATION, RESULTS, 
-                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n", 0, 0, 0 );
+                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
+                       0, 0, 0 );
 #else
-               Debug( LDAP_DEBUG_TRACE, "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
+               Debug( LDAP_DEBUG_TRACE,
+                       "bdb_build_lcup_done_ctrl: ber_flatten2 failed\n",
                        0, 0, 0 );
 #endif
                send_ldap_error( op, rs, LDAP_OTHER, "internal error" );