]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/slapi/slapi_ops.c
improve usability of global ovrlays for write operations; may need to anticipate...
[openldap] / servers / slapd / slapi / slapi_ops.c
index bf815e1f949d2e8341271967be4b59c5d603c949..6a0f9ec04f88f3294dca9efc1144efd0fbf278f0 100644 (file)
@@ -1,24 +1,32 @@
-/*
- * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
- * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
- */
-/*
- *  Copyright IBM Corp. 1997,2002
- *  Use of this source code is subject to the terms of The OpenLDAP Public 
- *  License (version 2.7 or later).
- *  No trademarks of the IBM Corporation are to be used to identify, endorse 
- *  or promote  any products derived from this code without the prior 
- *  written consent of IBM 
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 2002-2004 The OpenLDAP Foundation.
+ * Portions Copyright 1997,2002-2003 IBM Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
  */
-/*
- * Portions (C) Copyright PADL Software Pty Ltd. 2003
- * Redistribution and use in source and binary form are permitted
- * provided that this notice is preserved and that due credit is 
- * given to PADL Software Pty Ltd. This software is provided ``as is'' 
- * without express or implied warranty.
+/* ACKNOWLEDGEMENTS:
+ * This work was initially developed by IBM Corporation for use in
+ * IBM products and subsequently ported to OpenLDAP Software by
+ * Steve Omrani.  Additional significant contributors include:
+ *   Luke Howard
  */
 
 #include "portable.h"
+
+#include <ac/string.h>
+#include <ac/stdarg.h>
+#include <ac/ctype.h>
+#include <ac/unistd.h>
+
 #include <slap.h>
 #include <lber_pvt.h>
 #include <slapi.h>
  * so it can be used in ACLs
  */
 static struct slap_listener slap_unknown_listener = {
-       BER_BVC("unknown"),     /* FIXME: use a URI form? */
+       BER_BVC("unknown"),     /* FIXME: use a URI form? (e.g. slapi://) */
        BER_BVC("UNKNOWN")
 };
 
-int bvptr2obj( struct berval **bvptr, struct berval **bvobj );
-
 static void
 internal_result_v3(
        Operation       *op, 
@@ -55,12 +61,12 @@ internal_search_entry(
        Operation       *op,
        SlapReply       *rs )
 {
-       char *ent2str = NULL;
        int nentries = 0, len = 0, i = 0;
        Slapi_Entry **head = NULL, **tp;
-       
-       ent2str = slapi_entry2str( rs->sr_entry, &len );
-       if ( ent2str == NULL ) {
+       Slapi_Entry *entry;
+
+       entry = slapi_entry_dup( rs->sr_entry );
+       if ( entry == NULL ) {
                return 1;
        }
 
@@ -73,24 +79,19 @@ internal_search_entry(
        if ( nentries == 0 ) {
                tp = (Slapi_Entry **)slapi_ch_malloc( 2 * sizeof(Slapi_Entry *) );
                if ( tp == NULL ) {
+                       slapi_entry_free( entry );
                        return 1;
                }
 
-               tp[ 0 ] = (Slapi_Entry *)str2entry( ent2str );
-               if ( tp[ 0 ] == NULL ) { 
-                       return 1;
-               }
-
+               tp[ 0 ] = entry;
        } else {
                tp = (Slapi_Entry **)slapi_ch_realloc( (char *)head,
                                sizeof(Slapi_Entry *) * ( i + 1 ) );
                if ( tp == NULL ) {
+                       slapi_entry_free( entry );
                        return 1;
                }
-               tp[ i - 1 ] = (Slapi_Entry *)str2entry( ent2str );
-               if ( tp[ i - 1 ] == NULL ) { 
-                       return 1;
-               }
+               tp[ i - 1 ] = entry;
        }
        tp[ i ] = NULL;
                  
@@ -118,12 +119,12 @@ internal_search_reference(
        return LDAP_SUCCESS;
 }
 
-static Connection *
-slapiConnectionInit(
+Connection *
+slapi_int_init_connection(
        char *DN, 
        int OpType ) 
 { 
-       Connection *pConn, *c;
+       Connection *pConn;
        ber_len_t max = sockbuf_max_incoming;
 
        pConn = (Connection *) slapi_ch_calloc(1, sizeof(Connection));
@@ -148,84 +149,92 @@ slapiConnectionInit(
                return (Connection *)NULL;
        }
 
-       c = pConn;
-
-       /* operation object */
-       c->c_pending_ops.stqh_first->o_tag = OpType;
-       c->c_pending_ops.stqh_first->o_protocol = LDAP_VERSION3; 
-       c->c_pending_ops.stqh_first->o_authmech.bv_val = NULL; 
-       c->c_pending_ops.stqh_first->o_authmech.bv_len = 0; 
-       c->c_pending_ops.stqh_first->o_time = slap_get_time();
-       c->c_pending_ops.stqh_first->o_do_not_cache = 1;
-       c->c_pending_ops.stqh_first->o_threadctx = ldap_pvt_thread_pool_context();
-       c->c_pending_ops.stqh_first->o_tmpmemctx = NULL;
-       c->c_pending_ops.stqh_first->o_tmpmfuncs = &ch_mfuncs;
-       c->c_pending_ops.stqh_first->o_conn = c;
-
        /* connection object */
-       c->c_authmech.bv_val = NULL;
-       c->c_authmech.bv_len = 0;
-       c->c_dn.bv_val = NULL;
-       c->c_dn.bv_len = 0;
-       c->c_ndn.bv_val = NULL;
-       c->c_ndn.bv_len = 0;
-       c->c_groups = NULL;
+       pConn->c_authmech.bv_val = NULL;
+       pConn->c_authmech.bv_len = 0;
+       pConn->c_dn.bv_val = NULL;
+       pConn->c_dn.bv_len = 0;
+       pConn->c_ndn.bv_val = NULL;
+       pConn->c_ndn.bv_len = 0;
 
-       c->c_listener = &slap_unknown_listener;
-       ber_dupbv( &c->c_peer_domain, (struct berval *)&slap_unknown_bv );
-       ber_dupbv( &c->c_peer_name, (struct berval *)&slap_unknown_bv );
+       pConn->c_listener = &slap_unknown_listener;
+       ber_dupbv( &pConn->c_peer_domain, (struct berval *)&slap_unknown_bv );
+       ber_dupbv( &pConn->c_peer_name, (struct berval *)&slap_unknown_bv );
 
-       LDAP_STAILQ_INIT( &c->c_ops );
+       LDAP_STAILQ_INIT( &pConn->c_ops );
 
-       c->c_sasl_bind_mech.bv_val = NULL;
-       c->c_sasl_bind_mech.bv_len = 0;
-       c->c_sasl_authctx = NULL;
-       c->c_sasl_sockctx = NULL;
-       c->c_sasl_extra = NULL;
+       pConn->c_sasl_bind_mech.bv_val = NULL;
+       pConn->c_sasl_bind_mech.bv_len = 0;
+       pConn->c_sasl_authctx = NULL;
+       pConn->c_sasl_sockctx = NULL;
+       pConn->c_sasl_extra = NULL;
 
-       c->c_sb = ber_sockbuf_alloc( );
+       pConn->c_sb = ber_sockbuf_alloc( );
 
-       ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_SET_MAX_INCOMING, &max );
+       ber_sockbuf_ctrl( pConn->c_sb, LBER_SB_OPT_SET_MAX_INCOMING, &max );
 
-       c->c_currentber = NULL;
+       pConn->c_currentber = NULL;
 
        /* should check status of thread calls */
-       ldap_pvt_thread_mutex_init( &c->c_mutex );
-       ldap_pvt_thread_mutex_init( &c->c_write_mutex );
-       ldap_pvt_thread_cond_init( &c->c_write_cv );
+       ldap_pvt_thread_mutex_init( &pConn->c_mutex );
+       ldap_pvt_thread_mutex_init( &pConn->c_write_mutex );
+       ldap_pvt_thread_cond_init( &pConn->c_write_cv );
 
-       c->c_n_ops_received = 0;
-       c->c_n_ops_executing = 0;
-       c->c_n_ops_pending = 0;
-       c->c_n_ops_completed = 0;
+       ldap_pvt_thread_mutex_lock( &pConn->c_mutex );
 
-       c->c_n_get = 0;
-       c->c_n_read = 0;
-       c->c_n_write = 0;
+       pConn->c_n_ops_received = 0;
+       pConn->c_n_ops_executing = 0;
+       pConn->c_n_ops_pending = 0;
+       pConn->c_n_ops_completed = 0;
 
-       c->c_protocol = LDAP_VERSION3; 
+       pConn->c_n_get = 0;
+       pConn->c_n_read = 0;
+       pConn->c_n_write = 0;
 
-       c->c_activitytime = c->c_starttime = slap_get_time();
+       pConn->c_protocol = LDAP_VERSION3; 
 
-       c->c_connid = 0;
+       pConn->c_activitytime = pConn->c_starttime = slap_get_time();
 
-       c->c_conn_state  = 0x01;        /* SLAP_C_ACTIVE */
-       c->c_struct_state = 0x02;       /* SLAP_C_USED */
+       /*
+        * A real connection ID is required, because syncrepl associates
+        * pending CSNs with unique ( connection, operation ) tuples.
+        * Setting a fake connection ID will cause slap_get_commit_csn()
+        * to return a stale value.
+        */
+       connection_assign_nextid( pConn );
 
-       c->c_ssf = c->c_transport_ssf = 0;
-       c->c_tls_ssf = 0;
+       pConn->c_conn_state  = 0x01;    /* SLAP_C_ACTIVE */
+       pConn->c_struct_state = 0x02;   /* SLAP_C_USED */
 
-       backend_connection_init( c );
+       pConn->c_ssf = pConn->c_transport_ssf = 0;
+       pConn->c_tls_ssf = 0;
+
+       backend_connection_init( pConn );
 
        pConn->c_send_ldap_result = internal_result_v3;
        pConn->c_send_search_entry = internal_search_entry;
        pConn->c_send_ldap_extended = internal_result_ext;
        pConn->c_send_search_reference = internal_search_reference;
 
+       /* operation object */
+       pConn->c_pending_ops.stqh_first->o_tag = OpType;
+       pConn->c_pending_ops.stqh_first->o_protocol = LDAP_VERSION3; 
+       pConn->c_pending_ops.stqh_first->o_authmech.bv_val = NULL; 
+       pConn->c_pending_ops.stqh_first->o_authmech.bv_len = 0; 
+       pConn->c_pending_ops.stqh_first->o_time = slap_get_time();
+       pConn->c_pending_ops.stqh_first->o_do_not_cache = 1;
+       pConn->c_pending_ops.stqh_first->o_threadctx = ldap_pvt_thread_pool_context();
+       pConn->c_pending_ops.stqh_first->o_tmpmemctx = NULL;
+       pConn->c_pending_ops.stqh_first->o_tmpmfuncs = &ch_mfuncs;
+       pConn->c_pending_ops.stqh_first->o_conn = pConn;
+       pConn->c_pending_ops.stqh_first->o_connid = pConn->c_connid;
+
+       ldap_pvt_thread_mutex_unlock( &pConn->c_mutex );
+
        return pConn;
 }
 
-static void slapiConnectionDestroy( Connection **pConn )
+void slapi_int_connection_destroy( Connection **pConn )
 {
        Connection *conn = *pConn;
        Operation *op;
@@ -236,6 +245,8 @@ static void slapiConnectionDestroy( Connection **pConn )
 
        op = (Operation *)conn->c_pending_ops.stqh_first;
 
+       slap_graduate_commit_csn( op );
+
        if ( op->o_req_dn.bv_val != NULL ) {
                slapi_ch_free( (void **)&op->o_req_dn.bv_val );
        }
@@ -258,9 +269,9 @@ static void slapiConnectionDestroy( Connection **pConn )
  * the strings.
  */
 static int
-values2obj(
+values2obj_copy(
        char **ppValue,
-       BerVarray *bvobj)
+       BerVarray *bvobj )
 {
        int i;
        BerVarray tmpberval;
@@ -271,15 +282,18 @@ values2obj(
        }
 
        for ( i = 0; ppValue[i] != NULL; i++ )
-               ;
+               ; /* EMPTY */
 
        tmpberval = (BerVarray)slapi_ch_malloc( (i+1) * (sizeof(struct berval)) );
        if ( tmpberval == NULL ) {
                return LDAP_NO_MEMORY;
        }
        for ( i = 0; ppValue[i] != NULL; i++ ) {
-               tmpberval[i].bv_val = ppValue[i];
-               tmpberval[i].bv_len = strlen( ppValue[i] );
+               size_t len = strlen( ppValue[i] );
+
+               tmpberval[i].bv_val = slapi_ch_malloc( len + 1 );
+               AC_MEMCPY( tmpberval[i].bv_val, ppValue[i], len + 1 );
+               tmpberval[i].bv_len = len;
        }
        tmpberval[i].bv_val = NULL;
        tmpberval[i].bv_len = 0;
@@ -289,39 +303,56 @@ values2obj(
        return LDAP_SUCCESS;
 }
 
-static void
-freeMods( Modifications *ml )
+static int
+bvptr2obj_copy(
+       struct berval   **bvptr, 
+       BerVarray       *bvobj )
 {
-       /*
-        * Free a modification list whose values have been 
-        * set with bvptr2obj() or values2obj() (ie. they
-        * do not own the pointer to the underlying values)
-        */
-       Modifications *next;
+       int             i;
+       BerVarray       tmpberval;
 
-       for ( ; ml != NULL; ml = next ) {
-               next = ml->sml_next;
+       if ( bvptr == NULL ) {
+               *bvobj = NULL;
+               return LDAP_SUCCESS;
+       }
 
-               slapi_ch_free( (void **)&ml->sml_bvalues );
-               slapi_ch_free( (void **)&ml->sml_nvalues );
-               slapi_ch_free( (void **)&ml );
+       for ( i = 0; bvptr[i] != NULL; i++ )
+               ; /* EMPTY */
+
+       tmpberval = (BerVarray)slapi_ch_malloc( (i + 1) * sizeof(struct berval));
+       if ( tmpberval == NULL ) {
+               return LDAP_NO_MEMORY;
+       } 
+
+       for ( i = 0; bvptr[i] != NULL; i++ ) {
+               tmpberval[i].bv_val = slapi_ch_malloc( bvptr[i]->bv_len );
+               tmpberval[i].bv_len = bvptr[i]->bv_len;
+               AC_MEMCPY( tmpberval[i].bv_val, bvptr[i]->bv_val, bvptr[i]->bv_len );
        }
+
+       tmpberval[i].bv_val = NULL;
+       tmpberval[i].bv_len = 0;
+
+       *bvobj = tmpberval;
+
+       return LDAP_SUCCESS;
 }
 
 /*
- * Function : LDAPModToEntry 
+ * Function : slapi_int_ldapmod_to_entry 
  * convert a dn plus an array of LDAPMod struct ptrs to an entry structure
  * with a link list of the correspondent attributes.
  * Return value : LDAP_SUCCESS
  *                LDAP_NO_MEMORY
  *                LDAP_OTHER
 */
-Entry *
-LDAPModToEntry(
+static Entry *
+slapi_int_ldapmod_to_entry(
+       Connection *pConn,
        char *ldn, 
        LDAPMod **mods )
 {
-       struct berval           dn = { 0, NULL };
+       struct berval           dn = BER_BVNULL;
        Entry                   *pEntry=NULL;
        LDAPMod                 *pMod;
        struct berval           *bv;
@@ -336,13 +367,7 @@ LDAPModToEntry(
 
        const char              *text = NULL;
 
-
-       op = (Operation *) slapi_ch_calloc(1, sizeof(Operation));
-       if ( pEntry == NULL) {
-               rc = LDAP_NO_MEMORY;
-               goto cleanup;
-       }  
-       op->o_tag = LDAP_REQ_ADD;
+       op = (Operation *)pConn->c_pending_ops.stqh_first;
 
        pEntry = (Entry *) ch_calloc( 1, sizeof(Entry) );
        if ( pEntry == NULL) {
@@ -354,20 +379,28 @@ LDAPModToEntry(
        dn.bv_len = strlen(ldn);
 
        rc = dnPrettyNormal( NULL, &dn, &pEntry->e_name, &pEntry->e_nname, NULL );
-       if ( rc != LDAP_SUCCESS )
+       if ( rc != LDAP_SUCCESS ) {
                goto cleanup;
+       }
 
        if ( rc == LDAP_SUCCESS ) {
-               for ( i=0, pMod=mods[0]; rc == LDAP_SUCCESS && pMod != NULL; pMod=mods[++i]) {
+               for ( i = 0, pMod = mods[0]; rc == LDAP_SUCCESS && pMod != NULL; pMod = mods[++i]) {
                        Modifications *mod;
+
                        if ( (pMod->mod_op & LDAP_MOD_BVALUES) != 0 ) {
-                               /* attr values are in berval format */
-                               /* convert an array of pointers to bervals to an array of bervals */
-                               rc = bvptr2obj(pMod->mod_bvalues, &bv);
-                               if (rc != LDAP_SUCCESS) goto cleanup;
+                               /*
+                                * Convert an array of pointers to bervals to
+                                * an array of bervals. Note that we need to copy the
+                                * values too, as the slap_mods_check() will free the
+                                * original values after prettying; the modifications
+                                * being passed in may not have been allocated on the
+                                * heap.
+                                */
+                               rc = bvptr2obj_copy( pMod->mod_bvalues, &bv );
+                               if ( rc != LDAP_SUCCESS ) goto cleanup;
                                tmp.sml_type.bv_val = pMod->mod_type;
                                tmp.sml_type.bv_len = strlen( pMod->mod_type );
-                               tmp.sml_bvalues = bv;
+                               tmp.sml_values = bv;
                                tmp.sml_nvalues = NULL;
                
                                mod  = (Modifications *) ch_malloc( sizeof(Modifications) );
@@ -376,7 +409,7 @@ LDAPModToEntry(
                                mod->sml_next = NULL;
                                mod->sml_desc = NULL;
                                mod->sml_type = tmp.sml_type;
-                               mod->sml_bvalues = tmp.sml_bvalues;
+                               mod->sml_values = tmp.sml_values;
                                mod->sml_nvalues = tmp.sml_nvalues;
 
                                *modtail = mod;
@@ -388,11 +421,11 @@ LDAPModToEntry(
                                if ( pMod->mod_values == NULL ) {
                                        rc = LDAP_OTHER;
                                } else {
-                                       rc = values2obj( pMod->mod_values, &bv );
-                                       if (rc != LDAP_SUCCESS) goto cleanup;
+                                       rc = values2obj_copy( pMod->mod_values, &bv );
+                                       if ( rc != LDAP_SUCCESS ) goto cleanup;
                                        tmp.sml_type.bv_val = pMod->mod_type;
                                        tmp.sml_type.bv_len = strlen( pMod->mod_type );
-                                       tmp.sml_bvalues = bv;
+                                       tmp.sml_values = bv;
                                        tmp.sml_nvalues = NULL;
                
                                        mod  = (Modifications *) ch_malloc( sizeof(Modifications) );
@@ -401,7 +434,7 @@ LDAPModToEntry(
                                        mod->sml_next = NULL;
                                        mod->sml_desc = NULL;
                                        mod->sml_type = tmp.sml_type;
-                                       mod->sml_bvalues = tmp.sml_bvalues;
+                                       mod->sml_values = tmp.sml_values;
                                        mod->sml_nvalues = tmp.sml_nvalues;
 
                                        *modtail = mod;
@@ -415,33 +448,37 @@ LDAPModToEntry(
        if ( op->o_bd == NULL ) {
                rc = LDAP_PARTIAL_RESULTS;
        } else {
-               int repl_user = be_isupdate( op->o_bd, &op->o_bd->be_rootdn );
+               int repl_user = be_isupdate_dn( op->o_bd, &op->o_bd->be_rootdn );
                if ( !op->o_bd->be_update_ndn.bv_len || repl_user ) {
-                       int update = op->o_bd->be_update_ndn.bv_len;
-                       char textbuf[SLAP_TEXT_BUFLEN];
-                       size_t textlen = sizeof textbuf;
+                       int     update = !BER_BVISNULL( &op->o_bd->be_update_ndn );
+                       char    textbuf[ SLAP_TEXT_BUFLEN ];
+                       size_t  textlen = sizeof( textbuf );
 
-                       rc = slap_mods_check( modlist, update, &text, 
+                       rc = slap_mods_check( modlist, &text, 
                                        textbuf, textlen, NULL );
                        if ( rc != LDAP_SUCCESS) {
                                goto cleanup;
                        }
 
+                       if ( !update ) {
+                               rc = slap_mods_no_update_check( modlist,
+                                               &text, textbuf, textlen );
+                               if ( rc != LDAP_SUCCESS) {
+                                       goto cleanup;
+                               }
+                       }
+
                        if ( !repl_user ) {
                                rc = slap_mods_opattrs( op,
                                                modlist, modtail, &text, 
-                                               textbuf, textlen );
+                                               textbuf, textlen, 1 );
                                if ( rc != LDAP_SUCCESS) {
                                        goto cleanup;
                                }
                        }
 
-                       /*
-                        * FIXME: slap_mods2entry is declared static 
-                        * in servers/slapd/add.c
-                        */
                        rc = slap_mods2entry( modlist, &pEntry, repl_user,
-                                       &text, textbuf, textlen );
+                                             0, &text, textbuf, textlen );
                        if (rc != LDAP_SUCCESS) {
                                goto cleanup;
                        }
@@ -455,10 +492,8 @@ cleanup:
 
        if ( dn.bv_val )
                slapi_ch_free( (void **)&dn.bv_val );
-       if ( op )
-               slapi_ch_free( (void **)&op );
        if ( modlist != NULL )
-               freeMods( modlist );
+               slap_mods_free( modlist );
        if ( rc != LDAP_SUCCESS ) {
                if ( pEntry != NULL ) {
                        slapi_entry_free( pEntry );
@@ -489,11 +524,10 @@ slapi_delete_internal(
        Connection              *pConn = NULL;
        Operation               *op = NULL;
        Slapi_PBlock            *pPB = NULL;
-       Slapi_PBlock            *pSavePB = NULL;
        SlapReply               rs = { REP_RESULT };
-       struct berval           dn = { 0, NULL };
+       struct berval           dn = BER_BVNULL;
 
-       int                     manageDsaIt = 0;
+       int                     manageDsaIt = SLAP_CONTROL_NONE;
        int                     isCritical;
 
        if ( ldn == NULL ) {
@@ -501,7 +535,7 @@ slapi_delete_internal(
                goto cleanup;
        }
 
-       pConn = slapiConnectionInit( NULL, LDAP_REQ_DELETE );
+       pConn = slapi_int_init_connection( NULL, LDAP_REQ_DELETE );
        if (pConn == NULL) {
                rs.sr_err = LDAP_NO_MEMORY;
                goto cleanup;
@@ -519,10 +553,10 @@ slapi_delete_internal(
 
        if ( slapi_control_present( controls, 
                        SLAPI_CONTROL_MANAGEDSAIT_OID, NULL, &isCritical) ) {
-               manageDsaIt = 1
+               manageDsaIt = isCritical ? SLAP_CONTROL_CRITICAL : SLAP_CONTROL_NONCRITICAL
        }
 
-       op->o_bd = select_backend( &op->o_req_ndn, manageDsaIt, 0 );
+       op->o_bd = select_backend( &op->o_req_ndn, manageDsaIt, 1 );
        if ( op->o_bd == NULL ) {
                rs.sr_err = LDAP_PARTIAL_RESULTS;
                goto cleanup;
@@ -532,13 +566,11 @@ slapi_delete_internal(
        op->o_ndn = pConn->c_ndn = op->o_bd->be_rootndn;
 
        if ( op->o_bd->be_delete ) {
-               int repl_user = be_isupdate( op->o_bd, &op->o_ndn );
+               int repl_user = be_isupdate( op );
                if ( !op->o_bd->be_update_ndn.bv_len || repl_user ) {
-                       if ( (*op->o_bd->be_delete)( op, &rs ) == 0 ) {
-                               if ( log_change ) {
-                                       replog( op );
-                               }
-                       } else {
+                       slap_callback cb = { NULL, slap_replog_cb, NULL, NULL };
+                       if ( log_change ) op->o_callback = &cb;
+                       if ( (*op->o_bd->be_delete)( op, &rs ) ) {
                                rs.sr_err = LDAP_OTHER;
                        }
                } else {
@@ -555,54 +587,45 @@ cleanup:
        if ( dn.bv_val ) {
                slapi_ch_free( (void **)&dn.bv_val );
        }
-       if ( pConn != NULL ) {
-               pSavePB = pPB;
-       }
 
-       slapiConnectionDestroy( &pConn );
+       slapi_int_connection_destroy( &pConn );
 
-       return (pSavePB);
+       return pPB;
 #else
        return NULL;
 #endif /* LDAP_SLAPI */
 }
 
-Slapi_PBlock * 
-slapi_add_entry_internal(
-       Slapi_Entry *e, 
+#ifdef LDAP_SLAPI
+static Slapi_PBlock * 
+slapi_int_add_entry_locked(
+       Connection *pConn,
+       Slapi_Entry **e, 
        LDAPControl **controls, 
        int log_changes ) 
 {
-#ifdef LDAP_SLAPI
-       Connection              *pConn = NULL;
        Operation               *op = NULL;
-       Slapi_PBlock            *pPB = NULL, *pSavePB = NULL;
+       Slapi_PBlock            *pPB = NULL;
 
-       int                     manageDsaIt = 0;
+       int                     manageDsaIt = SLAP_CONTROL_NONE;
        int                     isCritical;
        SlapReply               rs = { REP_RESULT };
 
-       if ( e == NULL ) {
+       if ( *e == NULL ) {
                rs.sr_err = LDAP_PARAM_ERROR;
                goto cleanup;
        }
-       
-       pConn = slapiConnectionInit( NULL, LDAP_REQ_ADD );
-       if ( pConn == NULL ) {
-               rs.sr_err = LDAP_NO_MEMORY;
-               goto cleanup;
-       }
 
        if ( slapi_control_present( controls, LDAP_CONTROL_MANAGEDSAIT,
                                NULL, &isCritical ) ) {
-               manageDsaIt = 1
+               manageDsaIt = isCritical ? SLAP_CONTROL_CRITICAL : SLAP_CONTROL_NONCRITICAL
        }
 
        op = (Operation *)pConn->c_pending_ops.stqh_first;
        pPB = (Slapi_PBlock *)op->o_pb;
        op->o_ctrls = controls;
 
-       op->o_bd = select_backend( &e->e_nname, manageDsaIt, 0 );
+       op->o_bd = select_backend( &((*e)->e_nname), manageDsaIt, 1 );
        if ( op->o_bd == NULL ) {
                rs.sr_err = LDAP_PARTIAL_RESULTS;
                goto cleanup;
@@ -610,15 +633,16 @@ slapi_add_entry_internal(
 
        op->o_dn = pConn->c_dn = op->o_bd->be_rootdn;
        op->o_ndn = pConn->c_ndn = op->o_bd->be_rootndn;
-       op->oq_add.rs_e = e;
+       op->oq_add.rs_e = *e;
 
        if ( op->o_bd->be_add ) {
-               int repl_user = be_isupdate( op->o_bd, &op->o_ndn );
-               if ( !op->o_bd->be_update_ndn.bv_len || repl_user ){
+               int repl_user = be_isupdate( op );
+               if ( !op->o_bd->be_update_ndn.bv_len || repl_user ) {
+                       slap_callback cb = { NULL, slap_replog_cb, NULL, NULL };
+                       if ( log_changes ) op->o_callback = &cb;
                        if ( (*op->o_bd->be_add)( op, &rs ) == 0 ) {
-                               if ( log_changes ) {
-                                       replog( op );
-                               }
+                               be_entry_release_w( op, *e );
+                               *e = NULL;
                        }
                } else {
                        rs.sr_err = LDAP_REFERRAL;
@@ -628,24 +652,48 @@ slapi_add_entry_internal(
        }
 
 cleanup:
-
        if ( pPB != NULL ) {
                slapi_pblock_set( pPB, SLAPI_PLUGIN_INTOP_RESULT, (void *)rs.sr_err );
        }
 
-       if ( pConn != NULL ) {
-               pSavePB = pPB;
+       return( pPB );
+}
+#endif /* LDAP_SLAPI */
+
+Slapi_PBlock * 
+slapi_add_entry_internal(
+       Slapi_Entry *e, 
+       LDAPControl **controls, 
+       int log_changes ) 
+{
+#ifdef LDAP_SLAPI
+       Slapi_PBlock            *pb = NULL;
+       Slapi_Entry             *entry = NULL;
+       Connection              *pConn = NULL;
+
+       pConn = slapi_int_init_connection( NULL, LDAP_REQ_ADD );
+       if ( pConn == NULL ) {
+               return NULL;
+       }
+
+       /*
+        * We make a copy to avoid an entry that may be freed later
+        * by the caller being placed in the cache.
+        */
+       entry = slapi_entry_dup( e );
+       pb = slapi_int_add_entry_locked( pConn, &entry, controls, log_changes );
+       if ( entry != NULL ) {
+               slapi_entry_free( entry );
        }
 
-       slapiConnectionDestroy( &pConn );
+       slapi_int_connection_destroy( &pConn );
 
-       return( pSavePB );
+       return pb;
 #else
        return NULL;
-#endif /* LDAP_SLAPI */
+#endif
 }
 
-
 Slapi_PBlock *
 slapi_add_internal(
        char *dn, 
@@ -655,6 +703,7 @@ slapi_add_internal(
 {
 #ifdef LDAP_SLAPI
        LDAPMod                 *pMod = NULL;
+       Connection              *pConn = NULL;
        Slapi_PBlock            *pb = NULL;
        Entry                   *pEntry = NULL;
        int                     i, rc = LDAP_SUCCESS;
@@ -665,7 +714,7 @@ slapi_add_internal(
 
        if ( rc == LDAP_SUCCESS ) {
                for ( i = 0, pMod = mods[0]; pMod != NULL; pMod = mods[++i] ) {
-                       if ( (pMod->mod_op & ~LDAP_MOD_BVALUES) != LDAP_MOD_ADD ) {
+                       if ( (pMod->mod_op & LDAP_MOD_OP ) != LDAP_MOD_ADD ) {
                                rc = LDAP_OTHER;
                                break;
                        }
@@ -673,8 +722,12 @@ slapi_add_internal(
        }
 
        if ( rc == LDAP_SUCCESS ) {
-               if((pEntry = LDAPModToEntry( dn, mods )) == NULL) {
-                       rc = LDAP_OTHER;
+               pConn = slapi_int_init_connection( NULL, LDAP_REQ_ADD );
+               if ( pConn != NULL ) {
+                       pEntry = slapi_int_ldapmod_to_entry( pConn, dn, mods );
+                       if ( pEntry == NULL ) {
+                               rc = LDAP_OTHER;
+                       }
                }
        }
 
@@ -682,14 +735,16 @@ slapi_add_internal(
                pb = slapi_pblock_new();
                slapi_pblock_set( pb, SLAPI_PLUGIN_INTOP_RESULT, (void *)rc );
        } else {
-               pb = slapi_add_entry_internal( pEntry, controls, log_changes );
+               pb = slapi_int_add_entry_locked( pConn, &pEntry, controls, log_changes );
        }
 
-       if ( pEntry ) {
-               slapi_entry_free(pEntry);
+       if ( pEntry != NULL ) {
+               slapi_entry_free( pEntry );
        }
 
-       return(pb);
+       slapi_int_connection_destroy( &pConn );
+
+       return pb;
 #else
        return NULL;
 #endif /* LDAP_SLAPI */
@@ -716,17 +771,16 @@ slapi_modrdn_internal(
        int log_change )
 {
 #ifdef LDAP_SLAPI
-       struct berval           dn = { 0, NULL };
-       struct berval           newrdn = { 0, NULL };
+       struct berval           dn = BER_BVNULL;
+       struct berval           newrdn = BER_BVNULL;
        Connection              *pConn = NULL;
        Operation               *op = NULL;
        Slapi_PBlock            *pPB = NULL;
-       Slapi_PBlock            *pSavePB = NULL;
-       int                     manageDsaIt = 0;
+       int                     manageDsaIt = SLAP_CONTROL_NONE;
        int                     isCritical;
        SlapReply               rs = { REP_RESULT };
 
-       pConn = slapiConnectionInit( NULL,  LDAP_REQ_MODRDN);
+       pConn = slapi_int_init_connection( NULL,  LDAP_REQ_MODRDN );
        if ( pConn == NULL) {
                rs.sr_err = LDAP_NO_MEMORY;
                goto cleanup;
@@ -738,10 +792,10 @@ slapi_modrdn_internal(
 
        if ( slapi_control_present( controls, 
                        SLAPI_CONTROL_MANAGEDSAIT_OID, NULL, &isCritical ) ) {
-               manageDsaIt = 1;
+               manageDsaIt = isCritical ? SLAP_CONTROL_CRITICAL : SLAP_CONTROL_NONCRITICAL;
        }
 
-       op->o_bd = select_backend( &op->o_req_ndn, manageDsaIt, 0 );
+       op->o_bd = select_backend( &op->o_req_ndn, manageDsaIt, 1 );
        if ( op->o_bd == NULL ) {
                rs.sr_err =  LDAP_PARTIAL_RESULTS;
                goto cleanup;
@@ -771,7 +825,7 @@ slapi_modrdn_internal(
                goto cleanup;
        }
 
-       if ( rdnValidate( &op->oq_modrdn.rs_nnewrdn ) != LDAP_SUCCESS ) {
+       if ( rdn_validate( &op->oq_modrdn.rs_nnewrdn ) != LDAP_SUCCESS ) {
                goto cleanup;
        }
 
@@ -780,13 +834,11 @@ slapi_modrdn_internal(
        op->oq_modrdn.rs_deleteoldrdn = deloldrdn;
 
        if ( op->o_bd->be_modrdn ) {
-               int repl_user = be_isupdate( op->o_bd, &op->o_ndn );
+               int repl_user = be_isupdate( op );
                if ( !op->o_bd->be_update_ndn.bv_len || repl_user ) {
-                       if ( (*op->o_bd->be_modrdn)( op, &rs ) == 0 ) {
-                               if ( log_change ) {
-                                       replog( op );
-                               }
-                       } else {
+                       slap_callback cb = { NULL, slap_replog_cb, NULL, NULL };
+                       if ( log_change ) op->o_callback = &cb;
+                       if ( (*op->o_bd->be_modrdn)( op, &rs ) ) {
                                rs.sr_err = LDAP_OTHER;
                        }
                } else {
@@ -812,13 +864,9 @@ cleanup:
        if ( op->oq_modrdn.rs_nnewrdn.bv_val )
                slapi_ch_free( (void **)&op->oq_modrdn.rs_nnewrdn.bv_val );
 
-       if ( pConn != NULL ) {
-               pSavePB = pPB;
-       }
-
-       slapiConnectionDestroy( &pConn );
+       slapi_int_connection_destroy( &pConn );
 
-       return( pSavePB );
+       return pPB;
 #else
        return NULL;
 #endif /* LDAP_SLAPI */
@@ -846,11 +894,10 @@ slapi_modify_internal(
        Connection              *pConn = NULL;
        Operation               *op = NULL;
        Slapi_PBlock            *pPB = NULL;
-       Slapi_PBlock            *pSavePB = NULL;
 
-       struct berval dn = { 0, NULL };
+       struct berval dn = BER_BVNULL;
 
-       int                     manageDsaIt = 0;
+       int                     manageDsaIt = SLAP_CONTROL_NONE;
        int                     isCritical;
        struct berval           *bv;
        LDAPMod                 *pMod;
@@ -866,7 +913,7 @@ slapi_modify_internal(
                goto cleanup;
        }
 
-       pConn = slapiConnectionInit( NULL,  LDAP_REQ_MODIFY );
+       pConn = slapi_int_init_connection( NULL,  LDAP_REQ_MODIFY );
        if ( pConn == NULL ) {
                rs.sr_err = LDAP_NO_MEMORY;
                goto cleanup;
@@ -885,10 +932,10 @@ slapi_modify_internal(
 
        if ( slapi_control_present( controls, 
                        SLAPI_CONTROL_MANAGEDSAIT_OID, NULL, &isCritical ) ) {
-               manageDsaIt = 1;
+               manageDsaIt = isCritical ? SLAP_CONTROL_CRITICAL : SLAP_CONTROL_NONCRITICAL;
        }
 
-       op->o_bd = select_backend( &op->o_req_ndn, manageDsaIt, 0 );
+       op->o_bd = select_backend( &op->o_req_ndn, manageDsaIt, 1 );
        if ( op->o_bd == NULL ) {
                rs.sr_err = LDAP_PARTIAL_RESULTS;
                goto cleanup;
@@ -909,46 +956,46 @@ slapi_modify_internal(
                         * convert an array of pointers to bervals
                         * to an array of bervals
                         */
-                       rs.sr_err = bvptr2obj( pMod->mod_bvalues, &bv );
+                       rs.sr_err = bvptr2obj_copy( pMod->mod_bvalues, &bv );
                        if ( rs.sr_err != LDAP_SUCCESS )
                                goto cleanup;
                        tmp.sml_type.bv_val = pMod->mod_type;
                        tmp.sml_type.bv_len = strlen( pMod->mod_type );
-                       tmp.sml_bvalues = bv;
+                       tmp.sml_values = bv;
                        tmp.sml_nvalues = NULL;
 
                        mod  = (Modifications *)ch_malloc( sizeof(Modifications) );
 
-                       mod->sml_op = pMod->mod_op;
+                       mod->sml_op = pMod->mod_op & LDAP_MOD_OP;
                        mod->sml_next = NULL;
                        mod->sml_desc = NULL;
                        mod->sml_type = tmp.sml_type;
-                       mod->sml_bvalues = tmp.sml_bvalues;
+                       mod->sml_values = tmp.sml_values;
                        mod->sml_nvalues = tmp.sml_nvalues;
                } else { 
-                       rs.sr_err = values2obj( pMod->mod_values, &bv );
+                       rs.sr_err = values2obj_copy( pMod->mod_values, &bv );
                        if ( rs.sr_err != LDAP_SUCCESS )
                                goto cleanup;
                        tmp.sml_type.bv_val = pMod->mod_type;
                        tmp.sml_type.bv_len = strlen( pMod->mod_type );
-                       tmp.sml_bvalues = bv;
+                       tmp.sml_values = bv;
                        tmp.sml_nvalues = NULL;
 
                        mod  = (Modifications *) ch_malloc( sizeof(Modifications) );
 
-                       mod->sml_op = pMod->mod_op;
+                       mod->sml_op = pMod->mod_op & LDAP_MOD_OP;
                        mod->sml_next = NULL;
                        mod->sml_desc = NULL;
                        mod->sml_type = tmp.sml_type;
-                       mod->sml_bvalues = tmp.sml_bvalues;
+                       mod->sml_values = tmp.sml_values;
                        mod->sml_nvalues = tmp.sml_nvalues;
                }
                *modtail = mod;
                modtail = &mod->sml_next;
 
-               switch( pMod->mod_op ) {
+               switch( pMod->mod_op & LDAP_MOD_OP ) {
                case LDAP_MOD_ADD:
-               if ( mod->sml_bvalues == NULL ) {
+               if ( mod->sml_values == NULL ) {
                        rs.sr_err = LDAP_PROTOCOL_ERROR;
                        goto cleanup;
                }
@@ -973,32 +1020,38 @@ slapi_modify_internal(
        op->oq_modify.rs_modlist = modlist;
 
        if ( op->o_bd->be_modify ) {
-               int repl_user = be_isupdate( op->o_bd, &op->o_ndn );
+               int repl_user = be_isupdate( op );
                if ( !op->o_bd->be_update_ndn.bv_len || repl_user ) {
-                       int update = op->o_bd->be_update_ndn.bv_len;
-                       const char *text = NULL;
-                       char textbuf[SLAP_TEXT_BUFLEN];
-                       size_t textlen = sizeof( textbuf );
+                       int             update = !BER_BVISEMPTY( &op->o_bd->be_update_ndn );
+                       const char      *text = NULL;
+                       char            textbuf[ SLAP_TEXT_BUFLEN ];
+                       size_t          textlen = sizeof( textbuf );
+                       slap_callback   cb = { NULL, slap_replog_cb, NULL, NULL };
 
-                       rs.sr_err = slap_mods_check( modlist, update,
+                       rs.sr_err = slap_mods_check( modlist,
                                        &text, textbuf, textlen, NULL );
                        if ( rs.sr_err != LDAP_SUCCESS ) {
                                goto cleanup;
                        }
 
+                       if ( !update ) {
+                               rs.sr_err = slap_mods_no_update_check( modlist,
+                                               &text, textbuf, textlen );
+                               if ( rs.sr_err != LDAP_SUCCESS ) {
+                                       goto cleanup;
+                               }
+                       }
+
                        if ( !repl_user ) {
                                rs.sr_err = slap_mods_opattrs( op, modlist,
                                                modtail, &text, textbuf, 
-                                               textlen );
+                                               textlen, 1 );
                                if ( rs.sr_err != LDAP_SUCCESS ) {
                                        goto cleanup;
                                }
                        }
-                       if ( (*op->o_bd->be_modify)( op, &rs ) == 0 ) {
-                               if ( log_change ) {
-                                       replog( op );
-                               }
-                       } else {
+                       if ( log_change ) op->o_callback = &cb;
+                       if ( (*op->o_bd->be_modify)( op, &rs ) ) {
                                rs.sr_err = LDAP_OTHER;
                        }
                } else {
@@ -1017,23 +1070,18 @@ cleanup:
                slapi_ch_free( (void **)&dn.bv_val );
 
        if ( modlist != NULL )
-               freeMods( modlist );
-
-       if ( pConn != NULL ) {
-               pSavePB = pPB;
-       }
+               slap_mods_free( modlist );
 
-       slapiConnectionDestroy( &pConn );
+       slapi_int_connection_destroy( &pConn );
 
-       return ( pSavePB );
+       return pPB;
 #else
        return NULL;
 #endif /* LDAP_SLAPI */
 }
 
 Slapi_PBlock *
-slapi_search_internal_bind(
-       char *bindDN, 
+slapi_search_internal(
        char *ldn, 
        int scope, 
        char *filStr, 
@@ -1044,28 +1092,27 @@ slapi_search_internal_bind(
 #ifdef LDAP_SLAPI
        Connection              *c;
        Operation               *op = NULL;
-       Slapi_PBlock            *ptr = NULL;            
-       Slapi_PBlock            *pSavePB = NULL;                
-       struct berval           dn = { 0, NULL };
+       Slapi_PBlock            *pPB = NULL;            
+       struct berval           dn = BER_BVNULL;
        Filter                  *filter=NULL;
-       struct berval           fstr = { 0, NULL };
+       struct berval           fstr = BER_BVNULL;
        AttributeName           *an = NULL;
        const char              *text = NULL;
 
-       int                     manageDsaIt = 0
+       int                     manageDsaIt = SLAP_CONTROL_NONE
        int                     isCritical;
        int                     i;
 
        SlapReply               rs = { REP_RESULT };
 
-       c = slapiConnectionInit( NULL, LDAP_REQ_SEARCH );
+       c = slapi_int_init_connection( NULL, LDAP_REQ_SEARCH );
        if ( c == NULL ) {
                rs.sr_err = LDAP_NO_MEMORY;
                goto cleanup;
        }
 
        op = (Operation *)c->c_pending_ops.stqh_first;
-       ptr = (Slapi_PBlock *)op->o_pb;
+       pPB = (Slapi_PBlock *)op->o_pb;
        op->o_ctrls = controls;
 
        if ( ldn != NULL ) {
@@ -1102,6 +1149,7 @@ slapi_search_internal_bind(
                for (i = 0; attrs[i] != 0; i++) {
                        an[i].an_desc = NULL;
                        an[i].an_oc = NULL;
+                       an[i].an_oc_exclude = 0;
                        an[i].an_name.bv_val = slapi_ch_strdup(attrs[i]);
                        an[i].an_name.bv_len = strlen(attrs[i]);
                        slap_bv2ad( &an[i].an_name, &an[i].an_desc, &text );
@@ -1131,6 +1179,8 @@ slapi_search_internal_bind(
                                rs.sr_type = REP_SEARCH;
                                rs.sr_err = LDAP_SUCCESS;
                                rs.sr_attrs = an;
+                               rs.sr_operational_attrs = NULL;
+                               rs.sr_flags = REP_ENTRY_MODIFIABLE;
 
                                send_search_entry( op, &rs );
                        }
@@ -1156,12 +1206,12 @@ slapi_search_internal_bind(
 
        if ( slapi_control_present( controls,
                        LDAP_CONTROL_MANAGEDSAIT, NULL, &isCritical ) ) {
-               manageDsaIt = 1;
+               manageDsaIt = isCritical ? SLAP_CONTROL_CRITICAL : SLAP_CONTROL_NONCRITICAL;
        }
 
-       op->o_bd = select_backend( &op->o_req_ndn, manageDsaIt, 0 );
+       op->o_bd = select_backend( &op->o_req_ndn, manageDsaIt, 1 );
        if ( op->o_bd == NULL ) {
-               if ( manageDsaIt == 1 ) {
+               if ( manageDsaIt > SLAP_CONTROL_NONE  ) {
                        rs.sr_err = LDAP_NO_SUCH_OBJECT;
                } else {
                        rs.sr_err = LDAP_PARTIAL_RESULTS;
@@ -1174,8 +1224,8 @@ slapi_search_internal_bind(
 
        op->oq_search.rs_scope = scope;
        op->oq_search.rs_deref = 0;
-       op->oq_search.rs_slimit = LDAP_NO_LIMIT;
-       op->oq_search.rs_tlimit = LDAP_NO_LIMIT;
+       op->oq_search.rs_slimit = SLAP_NO_LIMIT;
+       op->oq_search.rs_tlimit = SLAP_NO_LIMIT;
        op->oq_search.rs_attrsonly = attrsonly;
        op->oq_search.rs_attrs = an;
        op->oq_search.rs_filter = filter;
@@ -1191,8 +1241,8 @@ slapi_search_internal_bind(
 
 cleanup:
 
-       if ( ptr != NULL )
-               slapi_pblock_set( ptr, SLAPI_PLUGIN_INTOP_RESULT, (void *)rs.sr_err );
+       if ( pPB != NULL )
+               slapi_pblock_set( pPB, SLAPI_PLUGIN_INTOP_RESULT, (void *)rs.sr_err );
 
        if ( dn.bv_val )
                slapi_ch_free( (void **)&dn.bv_val );
@@ -1203,30 +1253,9 @@ cleanup:
        if ( an != NULL )
                slapi_ch_free( (void **)&an );
 
-       if ( c != NULL ) {
-               pSavePB = ptr;
-       }
-
-       slapiConnectionDestroy( &c );
-
-       return( pSavePB );
-#else
-       return NULL;
-#endif /* LDAP_SLAPI */
-}
+       slapi_int_connection_destroy( &c );
 
-Slapi_PBlock * 
-slapi_search_internal(
-       char *base,
-       int scope,
-       char *filStr, 
-       LDAPControl **controls,
-       char **attrs,
-       int attrsonly ) 
-{
-#ifdef LDAP_SLAPI
-       return slapi_search_internal_bind( NULL, base, scope, filStr,
-                       controls, attrs, attrsonly );
+       return pPB;
 #else
        return NULL;
 #endif /* LDAP_SLAPI */