]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/result.c
Experimental cruft to propagate valid Operation to SASL callbacks.
[openldap] / servers / slapd / result.c
index 83906f6418c7538558df630128cc334b8479e640..ccc1de308336c816201a3ada61da4c65b11bc830 100644 (file)
@@ -133,9 +133,9 @@ static long send_ldap_ber(
                 */
 
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                          "send_ldap_ber: conn %lu  ber_flush failed err=%d (%s)\n",
-                          conn ? conn->c_connid : 0, err, sock_errstr(err) ));
+               LDAP_LOG( OPERATION, ERR, 
+                       "send_ldap_ber: conn %lu  ber_flush failed err=%d (%s)\n",
+                       conn ? conn->c_connid : 0, err, sock_errstr(err) );
 #else
                Debug( LDAP_DEBUG_CONNS, "ber_flush failed errno=%d reason=\"%s\"\n",
                    err, sock_errstr(err), 0 );
@@ -165,6 +165,38 @@ static long send_ldap_ber(
        return bytes;
 }
 
+static int
+send_ldap_controls( BerElement *ber, LDAPControl **c )
+{
+       int rc;
+       if( c == NULL ) return 0;
+
+       rc = ber_printf( ber, "t{"/*}*/, LDAP_TAG_CONTROLS );
+       if( rc == -1 ) return rc;
+
+       for( ; *c != NULL; c++) {
+               rc = ber_printf( ber, "{s" /*}*/, (*c)->ldctl_oid );
+
+               if( (*c)->ldctl_iscritical ) {
+                       rc = ber_printf( ber, "b",
+                               (ber_int_t) (*c)->ldctl_iscritical ) ;
+                       if( rc == -1 ) return rc;
+               }
+
+               if( (*c)->ldctl_value.bv_val != NULL ) {
+                       rc = ber_printf( ber, "O", &((*c)->ldctl_value)); 
+                       if( rc == -1 ) return rc;
+               }
+
+               rc = ber_printf( ber, /*{*/"N}" );
+               if( rc == -1 ) return rc;
+       }
+
+       rc = ber_printf( ber, /*{*/"N}" );
+
+       return rc;
+}
+
 static void
 send_ldap_response(
     Connection *conn,
@@ -197,9 +229,9 @@ send_ldap_response(
        ber_init_w_nullc( ber, LBER_USE_DER );
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-                  "send_ldap_response: conn %lu         msgid=%d tag=%lu err=%d\n",
-                  conn ? conn->c_connid : 0, msgid, tag, err ));
+       LDAP_LOG( OPERATION, ENTRY, 
+               "send_ldap_response:  msgid=%d tag=%lu err=%d\n",
+               msgid, tag, err );
 #else
        Debug( LDAP_DEBUG_TRACE,
                "send_ldap_response: msgid=%d tag=%lu err=%d\n",
@@ -208,16 +240,15 @@ send_ldap_response(
 
        if( ref ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ARGS,
-                          "send_ldap_response: conn %lu  ref=\"%s\"\n",
-                          conn ? conn->c_connid : 0,
-                          ref[0].bv_val ? ref[0].bv_val : "NULL" ));
+               LDAP_LOG( OPERATION, ARGS, 
+                       "send_ldap_response: conn %lu  ref=\"%s\"\n",
+                       conn ? conn->c_connid : 0, 
+                       ref[0].bv_val ? ref[0].bv_val : "NULL" , 0 );
 #else
                Debug( LDAP_DEBUG_ARGS, "send_ldap_response: ref=\"%s\"\n",
                        ref[0].bv_val ? ref[0].bv_val : "NULL",
                        NULL, NULL );
 #endif
-
        }
 
 #ifdef LDAP_CONNECTIONLESS
@@ -225,9 +256,9 @@ send_ldap_response(
            rc = ber_write(ber, (char *)&op->o_peeraddr, sizeof(struct sockaddr), 0);
            if (rc != sizeof(struct sockaddr)) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                          "send_ldap_response: conn %lu  ber_write failed\n",
-                          conn ? conn->c_connid : 0 ));
+               LDAP_LOG( OPERATION, ERR, 
+                       "send_ldap_response: conn %lu  ber_write failed\n",
+                       conn ? conn->c_connid : 0 , 0, 0);
 #else
                Debug( LDAP_DEBUG_ANY, "ber_write failed\n", 0, 0, 0 );
 #endif
@@ -236,14 +267,14 @@ send_ldap_response(
            }
        }
        if (conn->c_is_udp && op->o_protocol == LDAP_VERSION2) {
-           rc = ber_printf( ber, "{is{t{ess",
+           rc = ber_printf( ber, "{is{t{ess" /*"}}}"*/,
                msgid, "", tag, err,
                matched == NULL ? "" : matched,
                text == NULL ? "" : text );
        } else
 #endif
        {
-           rc = ber_printf( ber, "{it{ess",
+           rc = ber_printf( ber, "{it{ess" /*"}}"*/,
                msgid, tag, err,
                matched == NULL ? "" : matched,
                text == NULL ? "" : text );
@@ -275,19 +306,28 @@ send_ldap_response(
        }
 
        if( rc != -1 ) {
-               rc = ber_printf( ber, "N}N}" );
+               rc = ber_printf( ber, /*"{"*/ "N}" );
+       }
+
+       if( rc != -1 && ctrls != NULL ) {
+               rc = send_ldap_controls( ber, ctrls );
+       }
+
+       if( rc != -1 ) {
+               rc = ber_printf( ber, /*"{"*/ "N}" );
        }
+
 #ifdef LDAP_CONNECTIONLESS
        if( conn->c_is_udp && op->o_protocol == LDAP_VERSION2 && rc != -1 ) {
-               rc = ber_printf( ber, "N}" );
+               rc = ber_printf( ber, /*"{"*/ "N}" );
        }
 #endif
 
        if ( rc == -1 ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                          "send_ldap_response: conn %lu  ber_printf failed\n",
-                          conn ? conn->c_connid : 0 ));
+               LDAP_LOG( OPERATION, ERR, 
+                       "send_ldap_response: conn %lu  ber_printf failed\n",
+                       conn ? conn->c_connid : 0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
 #endif
@@ -302,9 +342,9 @@ send_ldap_response(
 
        if ( bytes < 0 ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                          "send_ldap_response: conn %lu ber write failed\n",
-                          conn ? conn->c_connid : 0 ));
+               LDAP_LOG( OPERATION, ERR, 
+                       "send_ldap_response: conn %lu ber write failed\n",
+                       conn ? conn->c_connid : 0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY,
                        "send_ldap_response: ber write failed\n",
@@ -342,9 +382,9 @@ send_ldap_disconnect(
        assert( LDAP_UNSOLICITED_ERROR( err ) );
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-                  "send_ldap_disconnect: conn %lu  %d:%s\n",
-                  conn ? conn->c_connid : 0, err, text ? text : "" ));
+       LDAP_LOG( OPERATION, ENTRY, 
+               "send_ldap_disconnect: conn %lu  %d:%s\n",
+               conn ? conn->c_connid : 0, err, text ? text : "" );
 #else
        Debug( LDAP_DEBUG_TRACE,
                "send_ldap_disconnect %d:%s\n",
@@ -390,9 +430,9 @@ send_ldap_result(
        assert( !LDAP_API_ERROR( err ) );
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-                  "send_ldap_result : conn %lu   op=%lu p=%d\n",
-                  op->o_connid, op->o_opid, op->o_protocol ));
+       LDAP_LOG( OPERATION, ENTRY, 
+               "send_ldap_result : conn %lu      op=%lu p=%d\n",
+               op->o_connid, op->o_opid, op->o_protocol );
 #else
        Debug( LDAP_DEBUG_TRACE,
                "send_ldap_result: conn=%lu op=%lu p=%d\n",
@@ -400,9 +440,9 @@ send_ldap_result(
 #endif
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ARGS,
-                  "send_ldap_result: conn=%lu err=%d matched=\"%s\" text=\"%s\"\n",
-                  op->o_connid, err, matched ? matched : "", text ? text : "" ));
+       LDAP_LOG( OPERATION, ARGS, 
+               "send_ldap_result: err=%d matched=\"%s\" text=\"%s\"\n",
+               err, matched ? matched : "", text ? text : "" );
 #else
        Debug( LDAP_DEBUG_ARGS,
                "send_ldap_result: err=%d matched=\"%s\" text=\"%s\"\n",
@@ -412,9 +452,9 @@ send_ldap_result(
 
        if( ref ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ARGS,
+               LDAP_LOG( OPERATION, ARGS, 
                        "send_ldap_result: referral=\"%s\"\n",
-                       ref[0].bv_val ? ref[0].bv_val : "NULL" ));
+                       ref[0].bv_val ? ref[0].bv_val : "NULL", 0, 0 );
 #else
                Debug( LDAP_DEBUG_ARGS,
                        "send_ldap_result: referral=\"%s\"\n",
@@ -471,9 +511,9 @@ send_ldap_sasl(
        ber_int_t msgid;
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-                  "send_ldap_sasl: conn %lu err=%d len=%lu\n",
-                  op->o_connid, err, cred ? cred->bv_len : -1 ));
+       LDAP_LOG( OPERATION, ENTRY, 
+               "send_ldap_sasl: conn %lu err=%d len=%lu\n",
+               op->o_connid, err, cred ? cred->bv_len : -1 );
 #else
        Debug( LDAP_DEBUG_TRACE, "send_ldap_sasl: err=%d len=%ld\n",
                err, cred ? (long) cred->bv_len : -1, NULL );
@@ -505,10 +545,10 @@ send_ldap_extended(
        ber_int_t msgid;
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-                  "send_ldap_extended: conn %lu         err=%d oid=%s len=%ld\n",
-                  op->o_connid, err, rspoid ? rspoid : "",
-                  rspdata != NULL ? rspdata->bv_len : 0 ));
+       LDAP_LOG( OPERATION, ENTRY, 
+               "send_ldap_extended: err=%d oid=%s len=%ld\n",
+               err, rspoid ? rspoid : "",
+               rspdata != NULL ? rspdata->bv_len : 0 );
 #else
        Debug( LDAP_DEBUG_TRACE,
                "send_ldap_extended err=%d oid=%s len=%ld\n",
@@ -552,11 +592,9 @@ send_search_result(
        }
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-                  "send_search_result: conn %lu err=%d "
-                  "matched=\"%s\" text=\"%s\"\n",
-                  op->o_connid, err, matched ? matched : "",
-                  text ? text : "" ));
+       LDAP_LOG( OPERATION, ENTRY, 
+               "send_search_result: err=%d matched=\"%s\" text=\"%s\"\n",
+               err, matched ? matched : "", text ? text : "" );
 #else
        Debug( LDAP_DEBUG_TRACE,
                "send_search_result: err=%d matched=\"%s\" text=\"%s\"\n",
@@ -595,7 +633,7 @@ send_search_result(
 
        {
        char nbuf[64];
-       sprintf( nbuf, "%d nentries=%d", err, nentries );
+       snprintf( nbuf, sizeof nbuf, "%d nentries=%d", err, nentries );
 
        Statslog( LDAP_DEBUG_STATS,
            "conn=%lu op=%lu SEARCH RESULT tag=%lu err=%s text=%s\n",
@@ -607,11 +645,6 @@ send_search_result(
        }
 }
 
-static struct berval AllUser = { sizeof(LDAP_ALL_USER_ATTRIBUTES)-1,
-       LDAP_ALL_USER_ATTRIBUTES };
-static struct berval AllOper = { sizeof(LDAP_ALL_OPERATIONAL_ATTRIBUTES)-1,
-       LDAP_ALL_OPERATIONAL_ATTRIBUTES };
-
 int
 send_search_entry(
     Backend    *be,
@@ -639,7 +672,7 @@ send_search_entry(
         *          returned or filtered out
         * e_flags: array of a_flags
         */
-       char *a_flags, **e_flags;
+       char **e_flags = NULL;
 
        if (op->o_callback && op->o_callback->sc_sendentry) {
                return op->o_callback->sc_sendentry( be, conn, op, e, attrs,
@@ -647,10 +680,9 @@ send_search_entry(
        }
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-                  "send_search_entry: conn %lu dn=\"%s\"%s\n",
-                  op->o_connid, e->e_dn,
-                  attrsonly ? " (attrsOnly)" : "" ));
+       LDAP_LOG( OPERATION, ENTRY, 
+               "send_search_entry: conn %lu    dn=\"%s\"%s\n",
+               op->o_connid, e->e_dn, attrsonly ? " (attrsOnly)" : "" );
 #else
        Debug( LDAP_DEBUG_TRACE,
                "=> send_search_entry: dn=\"%s\"%s\n",
@@ -661,10 +693,9 @@ send_search_entry(
                ad_entry, NULL, ACL_READ, NULL ) )
        {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "acl", LDAP_LEVEL_INFO,
-                          "send_search_entry: conn %lu access "
-                          "to entry (%s) not allowed\n",
-                          op->o_connid, e->e_dn ));
+               LDAP_LOG( ACL, INFO, 
+                       "send_search_entry: conn %lu access to entry (%s) not allowed\n", 
+                       op->o_connid, e->e_dn, 0 );
 #else
                Debug( LDAP_DEBUG_ACL,
                        "send_search_entry: access to entry not allowed\n",
@@ -683,14 +714,14 @@ send_search_entry(
            rc = ber_write(ber, (char *)&op->o_peeraddr, sizeof(struct sockaddr), 0);
            if (rc != sizeof(struct sockaddr)) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                          "send_search_entry: conn %lu  ber_printf failed\n",
-                          conn ? conn->c_connid : 0 ));
+               LDAP_LOG( OPERATION, ERR, 
+                       "send_search_entry: conn %lu  ber_printf failed\n",
+                       conn ? conn->c_connid : 0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
 #endif
                ber_free_buf( ber );
-               return;
+               return( 1 );
            }
        }
        if (conn->c_is_udp && op->o_protocol == LDAP_VERSION2) {
@@ -705,9 +736,9 @@ send_search_entry(
 
        if ( rc == -1 ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                          "send_search_entry: conn %lu  ber_printf failed\n",
-                          op->o_connid ));
+               LDAP_LOG( OPERATION, ERR, 
+                       "send_search_entry: conn %lu  ber_printf failed\n", 
+                       op->o_connid, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
 #endif
@@ -727,45 +758,36 @@ send_search_entry(
                : an_find( attrs, &AllOper );
 
        /* create an array of arrays of flags. Each flag corresponds
-        * to particular value of attribute an equals 1 if value matches
+        * to particular value of attribute and equals 1 if value matches
         * to ValuesReturnFilter or 0 if not
         */     
-       for ( a = e->e_attrs, i=0; a != NULL; a = a->a_next ) i++;
-       e_flags = ch_malloc ( i * sizeof(a_flags) );
-       
-       for ( a = e->e_attrs, i=0; a != NULL; a = a->a_next, i++ ) {
-               for ( j = 0; a->a_vals[j].bv_val != NULL; j++ );
+       if ( op->vrFilter != NULL ) {
+               int k = 0;
+               char *a_flags;
 
-               a_flags = ch_calloc ( j, sizeof(char) );
-               /* If no ValuesReturnFilter control return everything */
-               if ( op->vrFilter == NULL ){
-                   memset(a_flags, 1, j);
+               for ( a = e->e_attrs, i=0; a != NULL; a = a->a_next, i++ ) {
+                       for ( j = 0; a->a_vals[j].bv_val != NULL; j++ ) k++;
+               }
+               e_flags = ch_calloc ( 1, i * sizeof(char *) + k );
+               a_flags = (char *)(e_flags + i);
+               for ( a = e->e_attrs, i=0; a != NULL; a = a->a_next, i++ ) {
+                       for ( j = 0; a->a_vals[j].bv_val != NULL; j++ );
+                       e_flags[i] = a_flags;
+                       a_flags += j;
                }
-               e_flags[i] = a_flags; 
-       }
-
-       if ( op->vrFilter != NULL ){
 
-               rc = filter_matched_values(be, conn, op, e, &e_flags) ; 
-           
+               rc = filter_matched_values(be, conn, op, e->e_attrs, &e_flags) ; 
                if ( rc == -1 ) {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                               "send_search_entry: conn %lu "
-                               "matched values filtering failed\n",
-                               conn ? conn->c_connid : 0 ));
+                       LDAP_LOG( OPERATION, ERR, 
+                               "send_search_entry: conn %lu matched values filtering failed\n",
+                               conn ? conn->c_connid : 0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY,
                                "matched values filtering failed\n", 0, 0, 0 );
 #endif
                        ber_free( ber, 1 );
 
-                       /* free e_flags */
-                       for ( a = e->e_attrs, i=0; a != NULL; a = a->a_next, i++ ) {
-                               free( e_flags[i] );
-                       }
-                       free( e_flags );
-
                        send_ldap_result( conn, op, LDAP_OTHER,
                                NULL, "matched values filtering error", 
                                NULL, NULL );
@@ -802,10 +824,9 @@ send_search_entry(
                        ACL_READ, &acl_state ) )
                {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "acl", LDAP_LEVEL_INFO, "send_search_entry: "
-                               "conn %lu  access to attribute %s "
-                               "not allowed\n",
-                               op->o_connid, desc->ad_cname.bv_val ));
+                       LDAP_LOG( ACL, INFO, 
+                               "send_search_entry: conn %lu  access to attribute %s not "
+                               "allowed\n", op->o_connid, desc->ad_cname.bv_val, 0 );
 #else
                        Debug( LDAP_DEBUG_ACL, "acl: "
                                "access to attribute %s not allowed\n",
@@ -816,20 +837,14 @@ send_search_entry(
 
                if (( rc = ber_printf( ber, "{O[" /*]}*/ , &desc->ad_cname )) == -1 ) {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                               "send_search_entry: "
-                               "conn %lu  ber_printf failed\n",
-                               op->o_connid ));
+                       LDAP_LOG( OPERATION, ERR, 
+                               "send_search_entry: conn %lu  ber_printf failed\n", 
+                               op->o_connid, 0, 0 );
 #else
                        Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
 #endif
 
                        ber_free_buf( ber );
-                       /* free e_flags */
-                       for ( a = e->e_attrs, i=0; a != NULL; a = a->a_next, i++ ) {
-                               free( e_flags[i] );
-                       }
-                       free( e_flags );
                        send_ldap_result( conn, op, LDAP_OTHER,
                            NULL, "encoding description error", NULL, NULL );
                        goto error_return;
@@ -841,12 +856,10 @@ send_search_entry(
                                        desc, &a->a_vals[i], ACL_READ, &acl_state ) )
                                {
 #ifdef NEW_LOGGING
-                                       LDAP_LOG(( "acl", LDAP_LEVEL_INFO,
+                                       LDAP_LOG( ACL, INFO, 
                                                "send_search_entry: conn %lu "
-                                               "access to attribute %s, "
-                                               "value %d not allowed\n",
-                                               op->o_connid, 
-                                               desc->ad_cname.bv_val, i ));
+                                               "access to attribute %s, value %d not allowed\n",
+                                               op->o_connid, desc->ad_cname.bv_val, i );
 #else
                                        Debug( LDAP_DEBUG_ACL,
                                                "acl: access to attribute %s, "
@@ -857,27 +870,21 @@ send_search_entry(
                                        continue;
                                }
 
-                               if ( e_flags[j][i] == 0 ){
+                               if ( op->vrFilter && e_flags[j][i] == 0 ){
                                        continue;
                                }
 
                                if (( rc = ber_printf( ber, "O", &a->a_vals[i] )) == -1 ) {
 #ifdef NEW_LOGGING
-                                       LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
+                                       LDAP_LOG( OPERATION, ERR, 
                                                "send_search_entry: conn %lu  "
-                                               "ber_printf failed.\n",
-                                               op->o_connid ));
+                                               "ber_printf failed.\n", op->o_connid, 0, 0 );
 #else
                                        Debug( LDAP_DEBUG_ANY,
                                            "ber_printf failed\n", 0, 0, 0 );
 #endif
 
                                        ber_free_buf( ber );
-                                       /* free e_flags */
-                                       for ( a = e->e_attrs, i=0; a != NULL; a = a->a_next, i++ ) {
-                                               free( e_flags[i] );
-                                       }
-                                       free( e_flags );
                                        send_ldap_result( conn, op, LDAP_OTHER,
                                                NULL, "encoding values error",
                                                NULL, NULL );
@@ -888,20 +895,14 @@ send_search_entry(
 
                if (( rc = ber_printf( ber, /*{[*/ "]N}" )) == -1 ) {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                               "send_search_entry: conn %lu  "
-                               "ber_printf failed\n",
-                               op->o_connid ));
+                       LDAP_LOG( OPERATION, ERR, 
+                               "send_search_entry: conn %lu ber_printf failed\n", 
+                               op->o_connid, 0, 0 );
 #else
                        Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
 #endif
 
                        ber_free_buf( ber );
-                       /* free e_flags */
-                       for ( a = e->e_attrs, i=0; a != NULL; a = a->a_next, i++ ) {
-                               free( e_flags[i] );
-                       }
-                       free( e_flags );
                        send_ldap_result( conn, op, LDAP_OTHER,
                            NULL, "encode end error", NULL, NULL );
                        goto error_return;
@@ -909,16 +910,51 @@ send_search_entry(
        }
 
        /* free e_flags */
-       for ( a = e->e_attrs, i=0; a != NULL; a = a->a_next, i++ ) {
-               free( e_flags[i] );
+       if ( e_flags ) {
+               free( e_flags );
+               e_flags = NULL;
        }
-       free( e_flags );
 
        /* eventually will loop through generated operational attributes */
        /* only have subschemaSubentry implemented */
        aa = backend_operational( be, conn, op, e, attrs, opattrs );
-       
-       for (a = aa ; a != NULL; a = a->a_next ) {
+
+       if ( aa != NULL && op->vrFilter != NULL ) {
+               int k = 0;
+               char *a_flags;
+
+               for ( a = aa, i=0; a != NULL; a = a->a_next, i++ ) {
+                       for ( j = 0; a->a_vals[j].bv_val != NULL; j++ ) k++;
+               }
+               e_flags = ch_calloc ( 1, i * sizeof(char *) + k );
+               a_flags = (char *)(e_flags + i);
+               for ( a = e->e_attrs, i=0; a != NULL; a = a->a_next, i++ ) {
+                       for ( j = 0; a->a_vals[j].bv_val != NULL; j++ );
+                       e_flags[i] = a_flags;
+                       a_flags += j;
+               }
+               rc = filter_matched_values(be, conn, op, aa, &e_flags) ; 
+           
+               if ( rc == -1 ) {
+#ifdef NEW_LOGGING
+                       LDAP_LOG( OPERATION, ERR, 
+                               "send_search_entry: conn %lu "
+                               "matched values filtering failed\n", 
+                               conn ? conn->c_connid : 0, 0, 0);
+#else
+               Debug( LDAP_DEBUG_ANY,
+                               "matched values filtering failed\n", 0, 0, 0 );
+#endif
+                       ber_free( ber, 1 );
+
+                       send_ldap_result( conn, op, LDAP_OTHER,
+                               NULL, "matched values filtering error", 
+                               NULL, NULL );
+                       goto error_return;
+               }
+       }
+
+       for (a = aa, j=0; a != NULL; a = a->a_next, j++ ) {
                AttributeDescription *desc = a->a_desc;
 
                if ( attrs == NULL ) {
@@ -947,10 +983,10 @@ send_search_entry(
                        ACL_READ, &acl_state ) )
                {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "acl", LDAP_LEVEL_INFO,
+                       LDAP_LOG( ACL, INFO, 
                                "send_search_entry: conn %lu "
                                "access to attribute %s not allowed\n",
-                               op->o_connid, desc->ad_cname.bv_val ));
+                               op->o_connid, desc->ad_cname.bv_val, 0 );
 #else
                        Debug( LDAP_DEBUG_ACL, "acl: access to attribute %s "
                                        "not allowed\n",
@@ -963,10 +999,9 @@ send_search_entry(
                rc = ber_printf( ber, "{O[" /*]}*/ , &desc->ad_cname );
                if ( rc == -1 ) {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
+                       LDAP_LOG( OPERATION, ERR, 
                                "send_search_entry: conn %lu  "
-                               "ber_printf failed\n",
-                               op->o_connid ));
+                               "ber_printf failed\n", op->o_connid, 0, 0 );
 #else
                        Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
 #endif
@@ -974,6 +1009,7 @@ send_search_entry(
                        ber_free_buf( ber );
                        send_ldap_result( conn, op, LDAP_OTHER,
                            NULL, "encoding description error", NULL, NULL );
+
                        attrs_free( aa );
                        goto error_return;
                }
@@ -984,12 +1020,10 @@ send_search_entry(
                                        desc, &a->a_vals[i], ACL_READ, &acl_state ) )
                                {
 #ifdef NEW_LOGGING
-                                       LDAP_LOG(( "acl", LDAP_LEVEL_INFO,
+                                       LDAP_LOG( ACL, INFO, 
                                                "send_search_entry: conn %lu "
-                                               "access to %s, value %d "
-                                               "not allowed\n",
-                                               op->o_connid, 
-                                               desc->ad_cname.bv_val, i ));
+                                               "access to %s, value %d not allowed\n",
+                                               op->o_connid, desc->ad_cname.bv_val, i );
 #else
                                        Debug( LDAP_DEBUG_ACL,
                                                "acl: access to attribute %s, "
@@ -1000,13 +1034,15 @@ send_search_entry(
                                        continue;
                                }
 
+                               if ( op->vrFilter && e_flags[j][i] == 0 ){
+                                       continue;
+                               }
+
                                if (( rc = ber_printf( ber, "O", &a->a_vals[i] )) == -1 ) {
 #ifdef NEW_LOGGING
-                                       LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                                                  "send_search_entry: "
-                                                  "conn %lu  ber_printf "
-                                                  "failed\n",
-                                                  op->o_connid ));
+                                       LDAP_LOG( OPERATION, ERR, 
+                                               "send_search_entry: conn %lu  ber_printf failed\n", 
+                                               op->o_connid, 0, 0 );
 #else
                                        Debug( LDAP_DEBUG_ANY,
                                            "ber_printf failed\n", 0, 0, 0 );
@@ -1016,6 +1052,7 @@ send_search_entry(
                                        send_ldap_result( conn, op, LDAP_OTHER,
                                                NULL, "encoding values error", 
                                                NULL, NULL );
+
                                        attrs_free( aa );
                                        goto error_return;
                                }
@@ -1024,10 +1061,9 @@ send_search_entry(
 
                if (( rc = ber_printf( ber, /*{[*/ "]N}" )) == -1 ) {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                                  "send_search_entry: conn %lu  "
-                                  "ber_printf failed\n",
-                                  op->o_connid ));
+                       LDAP_LOG( OPERATION, ERR, 
+                               "send_search_entry: conn %lu  ber_printf failed\n",
+                               op->o_connid, 0, 0 );
 #else
                        Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
 #endif
@@ -1035,14 +1071,28 @@ send_search_entry(
                        ber_free_buf( ber );
                        send_ldap_result( conn, op, LDAP_OTHER,
                            NULL, "encode end error", NULL, NULL );
+
                        attrs_free( aa );
                        goto error_return;
                }
        }
 
+       /* free e_flags */
+       if ( e_flags ) {
+               free( e_flags );
+               e_flags = NULL;
+       }
+
        attrs_free( aa );
+       rc = ber_printf( ber, /*{{*/ "}N}" );
+
+       if( rc != -1 && ctrls != NULL ) {
+               rc = send_ldap_controls( ber, ctrls );
+       }
 
-       rc = ber_printf( ber, /*{{{*/ "}N}N}" );
+       if( rc != -1 ) {
+               rc = ber_printf( ber, /*{*/ "N}" );
+       }
 
 #ifdef LDAP_CONNECTIONLESS
        if (conn->c_is_udp && op->o_protocol == LDAP_VERSION2 && rc != -1)
@@ -1050,9 +1100,9 @@ send_search_entry(
 #endif
        if ( rc == -1 ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                          "send_search_entry: conn %lu ber_printf failed\n",
-                          op->o_connid ));
+               LDAP_LOG( OPERATION, ERR, 
+                       "send_search_entry: conn %lu ber_printf failed\n", 
+                       op->o_connid, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
 #endif
@@ -1068,12 +1118,12 @@ send_search_entry(
 
        if ( bytes < 0 ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
-                          "send_ldap_response: conn %lu  ber write failed.\n",
-                          op->o_connid ));
+               LDAP_LOG( OPERATION, ERR, 
+                          "send_search_entry: conn %lu  ber write failed.\n", 
+                          op->o_connid, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY,
-                       "send_ldap_response: ber write failed\n",
+                       "send_search_entry: ber write failed\n",
                        0, 0, 0 );
 #endif
 
@@ -1090,9 +1140,8 @@ send_search_entry(
            conn->c_connid, op->o_opid, e->e_dn, 0, 0 );
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-                  "send_search_entry: conn %lu exit.\n",
-                  op->o_connid ));
+       LDAP_LOG( OPERATION, ENTRY, 
+               "send_search_entry: conn %lu exit.\n", op->o_connid, 0, 0 );
 #else
        Debug( LDAP_DEBUG_TRACE, "<= send_search_entry\n", 0, 0, 0 );
 #endif
@@ -1100,6 +1149,7 @@ send_search_entry(
        rc = 0;
 
 error_return:;
+       if ( e_flags ) free( e_flags );
        return( rc );
 }
 
@@ -1123,9 +1173,9 @@ send_search_reference(
        AttributeDescription *ad_entry = slap_schema.si_ad_entry;
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-               "send_search_reference: conn %lu  dn=\"%s\"\n",
-               op->o_connid, e->e_dn ));
+       LDAP_LOG( OPERATION, ENTRY, 
+               "send_search_reference: conn %lu  dn=\"%s\"\n", 
+               op->o_connid, e->e_dn, 0 );
 #else
        Debug( LDAP_DEBUG_TRACE,
                "=> send_search_reference: dn=\"%s\"\n",
@@ -1137,10 +1187,9 @@ send_search_reference(
                ad_entry, NULL, ACL_READ, NULL ) )
        {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "acl", LDAP_LEVEL_INFO,
+               LDAP_LOG( ACL, INFO, 
                        "send_search_reference: conn %lu        "
-                       "access to entry %s not allowed\n",
-                       op->o_connid, e->e_dn ));
+                       "access to entry %s not allowed\n", op->o_connid, e->e_dn, 0 );
 #else
                Debug( LDAP_DEBUG_ACL,
                        "send_search_reference: access to entry not allowed\n",
@@ -1154,10 +1203,9 @@ send_search_reference(
                ad_ref, NULL, ACL_READ, NULL ) )
        {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "acl", LDAP_LEVEL_INFO,
+               LDAP_LOG( ACL, INFO, 
                        "send_search_reference: conn %lu access "
-                       "to reference not allowed.\n",
-                       op->o_connid ));
+                       "to reference not allowed.\n", op->o_connid, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ACL,
                        "send_search_reference: access "
@@ -1170,9 +1218,9 @@ send_search_reference(
 
        if( refs == NULL ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
+               LDAP_LOG( OPERATION, ERR, 
                        "send_search_reference: conn %lu null ref in (%s).\n",
-                       op->o_connid, e->e_dn ));
+                       op->o_connid, e->e_dn, 0 );
 #else
                Debug( LDAP_DEBUG_ANY,
                        "send_search_reference: null ref in (%s)\n", 
@@ -1192,15 +1240,23 @@ send_search_reference(
 
        ber_init_w_nullc( ber, LBER_USE_DER );
 
-       rc = ber_printf( ber, "{it{W}N}", op->o_msgid,
+       rc = ber_printf( ber, "{it{W}" /*"}"*/ , op->o_msgid,
                LDAP_RES_SEARCH_REFERENCE, refs );
 
+       if( rc != -1 && ctrls != NULL ) {
+               rc = send_ldap_controls( ber, ctrls );
+       }
+
+       if( rc != -1 ) {
+               rc = ber_printf( ber, /*"{"*/ "N}", op->o_msgid,
+                       LDAP_RES_SEARCH_REFERENCE, refs );
+       }
+
        if ( rc == -1 ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
+               LDAP_LOG( OPERATION, ERR, 
                        "send_search_reference: conn %lu        "
-                       "ber_printf failed.\n",
-                       op->o_connid ));
+                       "ber_printf failed.\n", op->o_connid, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY,
                        "send_search_reference: ber_printf failed\n", 0, 0, 0 );
@@ -1225,8 +1281,8 @@ send_search_reference(
                conn->c_connid, op->o_opid, e->e_dn, 0, 0 );
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
-               "send_search_reference: conn %lu exit.\n", op->o_connid ));
+       LDAP_LOG( OPERATION, ENTRY, 
+               "send_search_reference: conn %lu exit.\n", op->o_connid, 0, 0 );
 #else
        Debug( LDAP_DEBUG_TRACE, "<= send_search_reference\n", 0, 0, 0 );
 #endif
@@ -1252,14 +1308,13 @@ str2result(
 
        if ( strncasecmp( s, "RESULT", 6 ) != 0 ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
-                          "str2result: (%s), expecting \"RESULT\"\n", s ));
+               LDAP_LOG( OPERATION, INFO, 
+                       "str2result: (%s), expecting \"RESULT\"\n", s, 0, 0 );
 #else
                Debug( LDAP_DEBUG_ANY, "str2result (%s) expecting \"RESULT\"\n",
                    s, 0, 0 );
 #endif
 
-
                return( -1 );
        }
 
@@ -1287,8 +1342,7 @@ str2result(
                        }
                } else {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "operation", LDAP_LEVEL_INFO,
-                               "str2result: (%s) unknown.\n", s ));
+                       LDAP_LOG( OPERATION, INFO, "str2result: (%s) unknown.\n", s, 0, 0 );
 #else
                        Debug( LDAP_DEBUG_ANY, "str2result (%s) unknown\n",
                            s, 0, 0 );