X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fback-bdb%2Fsearch.c;h=3bea37794c7c29de6cfcd5e97767fc7a143e7632;hb=c5b6a86502dc0c16027cd87e3d9544e9078083db;hp=de33175dad0ffd7f8079fdebdd7a61cecf388c5e;hpb=d0add35348c51d8a3807c6ffb9f14f0bb3009a36;p=openldap

diff --git a/servers/slapd/back-bdb/search.c b/servers/slapd/back-bdb/search.c
index de33175dad..3bea37794c 100644
--- a/servers/slapd/back-bdb/search.c
+++ b/servers/slapd/back-bdb/search.c
@@ -1,7 +1,7 @@
 /* search.c - search operation */
 /* $OpenLDAP$ */
 /*
- * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 
@@ -20,11 +20,11 @@ static int base_candidate(
 	ID		*ids );
 static int search_candidates(
 	BackendDB *be,
+	Operation *op,
 	Entry *e,
 	Filter *filter,
 	int scope,
 	int deref,
-	int manageDSAit,
 	ID	*ids );
 
 int
@@ -32,40 +32,48 @@ bdb_search(
 	BackendDB	*be,
 	Connection	*conn,
 	Operation	*op,
-	const char	*base,
-	const char	*nbase,
+	struct berval	*base,
+	struct berval	*nbase,
 	int		scope,
 	int		deref,
 	int		slimit,
 	int		tlimit,
 	Filter	*filter,
-	const char	*filterstr,
-	struct berval	**attrs,
+	struct berval	*filterstr,
+	AttributeName	*attrs,
 	int		attrsonly )
 {
 	struct bdb_info *bdb = (struct bdb_info *) be->be_private;
-	int		 abandon;
 	int		rc;
 	const char *text = NULL;
 	time_t		stoptime;
 	ID		id, cursor;
 	ID		candidates[BDB_IDL_UM_SIZE];
 	Entry		*e = NULL;
-	struct berval **v2refs = NULL;
+	BerVarray v2refs = NULL;
 	Entry	*matched = NULL;
-	char	*realbase = NULL;
+	struct berval	realbase = { 0, NULL };
 	int		nentries = 0;
 	int		manageDSAit;
 
 	struct slap_limits_set *limit = NULL;
 	int isroot = 0;
 
+	u_int32_t	locker;
+	DB_LOCK		lock;
+
+#ifdef NEW_LOGGING
+	LDAP_LOG ( OPERATION, ENTRY, "bdb_back_search\n", 0, 0, 0 );
+#else
 	Debug( LDAP_DEBUG_TRACE, "=> bdb_back_search\n",
 		0, 0, 0);
+#endif
 
 	manageDSAit = get_manageDSAit( op );
 
-	if ( *nbase == '\0' ) {
+	LOCK_ID (bdb->bi_dbenv, &locker );
+
+	if ( nbase->bv_len == 0 ) {
 		/* DIT root special case */
 		e = (Entry *) &slap_entry_root;
 		rc = 0;
@@ -73,44 +81,65 @@ bdb_search(
 #ifdef BDB_ALIASES
 	/* get entry with reader lock */
 	if ( deref & LDAP_DEREF_FINDING ) {
-		e = deref_dn_r( be, nbase, &err, &matched, &text );
+		e = deref_dn_r( be, nbase-, &err, &matched, &text );
 
 	} else
 #endif
 	{
-		rc = bdb_dn2entry( be, NULL, nbase, &e, &matched, 0 );
+dn2entry_retry:
+		rc = bdb_dn2entry_r( be, NULL, nbase, &e, &matched, 0, locker, &lock );
 	}
 
 	switch(rc) {
 	case DB_NOTFOUND:
 	case 0:
 		break;
+	case LDAP_BUSY:
+		if (e != NULL) {
+			bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
+		}
+		if (matched != NULL) {
+			bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
+		}
+		send_ldap_result( conn, op, LDAP_BUSY,
+			NULL, "ldap server busy", NULL, NULL );
+		LOCK_ID_FREE (bdb->bi_dbenv, locker );
+		return LDAP_BUSY;
+	case DB_LOCK_DEADLOCK:
+	case DB_LOCK_NOTGRANTED:
+		goto dn2entry_retry;
 	default:
+		if (e != NULL) {
+			bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
+		}
+		if (matched != NULL) {
+			bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
+		}
 		send_ldap_result( conn, op, rc=LDAP_OTHER,
 			NULL, "internal error", NULL, NULL );
+		LOCK_ID_FREE (bdb->bi_dbenv, locker );
 		return rc;
 	}
 
 	if ( e == NULL ) {
-		char *matched_dn = NULL;
-		struct berval **refs = NULL;
+		struct berval matched_dn = { 0, NULL };
+		BerVarray refs = NULL;
 
 		if ( matched != NULL ) {
-			struct berval **erefs;
-			matched_dn = ch_strdup( matched->e_dn );
+			BerVarray erefs;
+			ber_dupbv( &matched_dn, &matched->e_name );
 
 			erefs = is_entry_referral( matched )
-				? get_entry_referrals( be, conn, op, matched,
-					base, scope )
+				? get_entry_referrals( be, conn, op, matched )
 				: NULL;
 
-			bdb_entry_return( be, matched );
+			bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache, matched, &lock);
 			matched = NULL;
 
 			if( erefs ) {
-				refs = referral_rewrite( erefs, matched_dn,
+				refs = referral_rewrite( erefs, &matched_dn,
 					base, scope );
-				ber_bvecfree( erefs );
+				ber_bvarray_free( erefs );
 			}
 
 		} else {
@@ -119,40 +148,48 @@ bdb_search(
 		}
 
 		send_ldap_result( conn, op,	rc=LDAP_REFERRAL ,
-			matched_dn, text, refs, NULL );
-
-		ber_bvecfree( refs );
-		free( matched_dn );
+			matched_dn.bv_val, text, refs, NULL );
 
+		LOCK_ID_FREE (bdb->bi_dbenv, locker );
+		if ( refs ) ber_bvarray_free( refs );
+		if ( matched_dn.bv_val ) ber_memfree( matched_dn.bv_val );
 		return rc;
 	}
 
 	if (!manageDSAit && e != &slap_entry_root && is_entry_referral( e ) ) {
 		/* entry is a referral, don't allow add */
-		char *matched_dn = ch_strdup( e->e_dn );
-		struct berval **erefs = get_entry_referrals( be,
-			conn, op, e, base, scope );
-		struct berval **refs = NULL;
+		struct berval matched_dn;
+		BerVarray erefs, refs;
+		
+		ber_dupbv( &matched_dn, &e->e_name );
+		erefs = get_entry_referrals( be, conn, op, e );
+		refs = NULL;
 
-		bdb_entry_return( be, e );
+		bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache, e, &lock );
 		e = NULL;
 
 		if( erefs ) {
-			refs = referral_rewrite( erefs, matched_dn,
+			refs = referral_rewrite( erefs, &matched_dn,
 				base, scope );
-			ber_bvecfree( erefs );
+			ber_bvarray_free( erefs );
 		}
 
+#ifdef NEW_LOGGING
+		LDAP_LOG ( OPERATION, RESULTS, 
+			"bdb_search: entry is referral\n", 0, 0, 0 );
+#else
 		Debug( LDAP_DEBUG_TRACE, "bdb_search: entry is referral\n",
 			0, 0, 0 );
+#endif
 
 		send_ldap_result( conn, op, LDAP_REFERRAL,
-			matched_dn, refs ? NULL : "bad referral object",
+			matched_dn.bv_val,
+			refs ? NULL : "bad referral object",
 			refs, NULL );
 
-		ber_bvecfree( refs );
-		free( matched_dn );
-
+		LOCK_ID_FREE (bdb->bi_dbenv, locker );
+		ber_bvarray_free( refs );
+		ber_memfree( matched_dn.bv_val );
 		return 1;
 	}
 
@@ -185,7 +222,7 @@ bdb_search(
 		/* if requested limit higher than hard limit, abort */
 		} else if ( tlimit > limit->lms_t_hard ) {
 			/* no hard limit means use soft instead */
-			if ( limit->lms_t_hard == 0 ) {
+			if ( limit->lms_t_hard == 0 && tlimit > limit->lms_t_soft ) {
 				tlimit = limit->lms_t_soft;
 
 			/* positive hard limit means abort */
@@ -207,7 +244,7 @@ bdb_search(
 		/* if requested limit higher than hard limit, abort */
 		} else if ( slimit > limit->lms_s_hard ) {
 			/* no hard limit means use soft instead */
-			if ( limit->lms_s_hard == 0 ) {
+			if ( limit->lms_s_hard == 0 && slimit > limit->lms_s_soft ) {
 				slimit = limit->lms_s_soft;
 
 			/* positive hard limit means abort */
@@ -232,25 +269,31 @@ bdb_search(
 
 	} else {
 		BDB_IDL_ALL( bdb, candidates );
-		rc = search_candidates( be, e, filter,
-			scope, deref, manageDSAit, candidates );
+		rc = search_candidates( be, op, e, filter,
+			scope, deref, candidates );
 	}
 
 	/* need normalized dn below */
-	realbase = ch_strdup( e->e_ndn );
+	ber_dupbv( &realbase, &e->e_nname );
 
 	/* start cursor at base entry's id 
-	 * FIXME: hack to make "" base work */
+	 * FIXME: hack to make "" base work
+	 * FIXME: moddn needs to assign new ID for this to work
+	 */
 	cursor = e->e_id == NOID ? 1 : e->e_id;
 
 	if ( e != &slap_entry_root ) {
-		bdb_entry_return( be, e );
+		bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
 	}
 	e = NULL;
 
 	if ( candidates[0] == 0 ) {
+#ifdef NEW_LOGGING
+	LDAP_LOG ( OPERATION, RESULTS, "bdb_search: no candidates\n", 0, 0, 0 );
+#else
 		Debug( LDAP_DEBUG_TRACE, "bdb_search: no candidates\n",
 			0, 0, 0 );
+#endif
 
 		send_search_result( conn, op,
 			LDAP_SUCCESS,
@@ -264,7 +307,7 @@ bdb_search(
 	if ( !isroot && limit->lms_s_unchecked != -1 ) {
 		if ( BDB_IDL_N(candidates) > (unsigned) limit->lms_s_unchecked ) {
 			send_search_result( conn, op, 
-					LDAP_UNWILLING_TO_PERFORM,
+					LDAP_ADMINLIMIT_EXCEEDED,
 					NULL, NULL, NULL, NULL, 0 );
 			rc = 1;
 			goto done;
@@ -278,11 +321,7 @@ bdb_search(
 		int		scopeok = 0;
 
 		/* check for abandon */
-		ldap_pvt_thread_mutex_lock( &op->o_abandonmutex );
-		abandon = op->o_abandon;
-		ldap_pvt_thread_mutex_unlock( &op->o_abandonmutex );
-
-		if ( abandon ) {
+		if ( op->o_abandon ) {
 			rc = 0;
 			goto done;
 		}
@@ -294,19 +333,55 @@ bdb_search(
 			goto done;
 		}
 
+id2entry_retry:
 		/* get the entry with reader lock */
-		rc = bdb_id2entry( be, NULL, id, &e );
+		rc = bdb_id2entry_r( be, NULL, id, &e, locker, &lock );
+
+		if (rc == LDAP_BUSY) {
+			send_ldap_result( conn, op, rc=LDAP_BUSY,
+				NULL, "ldap server busy", NULL, NULL );
+			goto done;
+
+		} else if ( rc == DB_LOCK_DEADLOCK || rc == DB_LOCK_NOTGRANTED ) {
+			goto id2entry_retry;	
+		}
 
 		if ( e == NULL ) {
 			if( !BDB_IDL_IS_RANGE(candidates) ) {
 				/* only complain for non-range IDLs */
+#ifdef NEW_LOGGING
+				LDAP_LOG ( OPERATION, RESULTS,
+					"bdb_search: candidate %ld not found\n", (long) id, 0, 0);
+#else
 				Debug( LDAP_DEBUG_TRACE,
 					"bdb_search: candidate %ld not found\n",
 					(long) id, 0, 0 );
+#endif
+			}
+
+			goto loop_continue;
+		}
+
+#ifdef BDB_SUBENTRIES
+		if ( is_entry_subentry( e ) ) {
+			if( scope != LDAP_SCOPE_BASE ) {
+				if(!get_subentries_visibility( op )) {
+					/* only subentries are visible */
+					goto loop_continue;
+				}
+
+			} else if ( get_subentries( op ) &&
+				!get_subentries_visibility( op ))
+			{
+				/* only subentries are visible */
+				goto loop_continue;
 			}
 
+		} else if ( get_subentries_visibility( op )) {
+			/* only subentries are visible */
 			goto loop_continue;
 		}
+#endif
 
 #ifdef BDB_ALIASES
 		if ( deref & LDAP_DEREF_SEARCHING && is_entry_alias( e ) ) {
@@ -328,18 +403,23 @@ bdb_search(
 
 			/* need to skip alias which deref into scope */
 			if( scope & LDAP_SCOPE_ONELEVEL ) {
-				char *pdn = dn_parent( NULL, e->e_ndn );
-				if ( pdn != NULL ) {
-					if( strcmp( pdn, realbase ) ) {
-						goto loop_continue;
-					}
+				struct berval	pdn;
+				
+				dnParent( &e->e_nname, &pdn ):
+				if ( ber_bvcmp( pdn, &realbase ) ) {
+					goto loop_continue;
 				}
 
-			} else if ( dn_issuffix( e->e_ndn, realbase ) ) {
+			} else if ( dnIsSuffix( &e->e_nname, &realbase ) ) {
 				/* alias is within scope */
+#ifdef NEW_LOGGING
+				LDAP_LOG ( OPERATION, RESULTS,
+					"bdb_search: \"%s\" in subtree\n", e->edn, 0, 0);
+#else
 				Debug( LDAP_DEBUG_TRACE,
 					"bdb_search: \"%s\" in subtree\n",
 					e->e_dn, 0, 0 );
+#endif
 				goto loop_continue;
 			}
 
@@ -355,17 +435,49 @@ bdb_search(
 		if ( !manageDSAit && scope != LDAP_SCOPE_BASE &&
 			is_entry_referral( e ) )
 		{
-			struct berval **erefs = get_entry_referrals(
-				be, conn, op, e, NULL, scope );
-			struct berval **refs = referral_rewrite( erefs, e->e_dn, NULL,
-				scope == LDAP_SCOPE_SUBTREE 
-					? LDAP_SCOPE_SUBTREE
-					: LDAP_SCOPE_BASE );
+			struct berval	dn;
+
+			/* check scope */
+			if ( !scopeok && scope == LDAP_SCOPE_ONELEVEL ) {
+				if ( !be_issuffix( be, &e->e_nname ) ) {
+					dnParent( &e->e_nname, &dn );
+					scopeok = dn_match( &dn, &realbase );
+				} else {
+					scopeok = (realbase.bv_len == 0);
+				}
 
-			send_search_reference( be, conn, op,
-				e, refs, NULL, &v2refs );
+			} else if ( !scopeok && scope == LDAP_SCOPE_SUBTREE ) {
+				scopeok = dnIsSuffix( &e->e_nname, &realbase );
+
+			} else {
+				scopeok = 1;
+			}
 
-			ber_bvecfree( refs );
+			if( scopeok ) {
+				BerVarray erefs = get_entry_referrals(
+					be, conn, op, e );
+				BerVarray refs = referral_rewrite( erefs,
+					&e->e_name, NULL,
+					scope == LDAP_SCOPE_SUBTREE
+						? LDAP_SCOPE_SUBTREE
+						: LDAP_SCOPE_BASE );
+
+				send_search_reference( be, conn, op,
+					e, refs, NULL, &v2refs );
+
+				ber_bvarray_free( refs );
+
+			} else {
+#ifdef NEW_LOGGING
+				LDAP_LOG(OPERATION, DETAIL2, 
+					"bdb_search: candidate referral %ld scope not okay\n",
+					id, 0, 0 );
+#else
+				Debug( LDAP_DEBUG_TRACE,
+					"bdb_search: candidate referral %ld scope not okay\n",
+					id, 0, 0 );
+#endif
+			}
 
 			goto loop_continue;
 		}
@@ -373,22 +485,19 @@ bdb_search(
 		/* if it matches the filter and scope, send it */
 		rc = test_filter( be, conn, op, e, filter );
 		if ( rc == LDAP_COMPARE_TRUE ) {
-			char	*dn;
+			struct berval	dn;
 
 			/* check scope */
 			if ( !scopeok && scope == LDAP_SCOPE_ONELEVEL ) {
-				if ( (dn = dn_parent( be, e->e_ndn )) != NULL ) {
-					scopeok = (dn == realbase)
-						? 1
-						: (strcmp( dn, realbase ) ? 0 : 1 );
+				if ( be_issuffix( be, &e->e_nname ) ) {
+					scopeok = (realbase.bv_len == 0);
 				} else {
-					scopeok = (realbase == NULL || *realbase == '\0');
+					dnParent( &e->e_nname, &dn );
+					scopeok = dn_match( &dn, &realbase );
 				}
 
 			} else if ( !scopeok && scope == LDAP_SCOPE_SUBTREE ) {
-				dn = ch_strdup( e->e_ndn );
-				scopeok = dn_issuffix( dn, realbase );
-				free( dn );
+				scopeok = dnIsSuffix( &e->e_nname, &realbase );
 
 			} else {
 				scopeok = 1;
@@ -397,7 +506,7 @@ bdb_search(
 			if ( scopeok ) {
 				/* check size limit */
 				if ( --slimit == -1 ) {
-					bdb_entry_return( be, e );
+					bdb_cache_return_entry_r (bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
 					e = NULL;
 					send_search_result( conn, op,
 						rc = LDAP_SIZELIMIT_EXCEEDED, NULL, NULL,
@@ -406,8 +515,14 @@ bdb_search(
 				}
 
 				if (e) {
-					int result = send_search_entry( be, conn, op,
-						e, attrs, attrsonly, NULL);
+					int result;
+					
+					if( op->o_noop ) {
+						result = 0;
+					} else {
+						result = send_search_entry( be, conn, op,
+							e, attrs, attrsonly, NULL);
+					}
 
 					switch (result) {
 					case 0:		/* entry sent ok */
@@ -416,27 +531,38 @@ bdb_search(
 					case 1:		/* entry not sent */
 						break;
 					case -1:	/* connection closed */
-						bdb_entry_return( be, e );
+						bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
 						e = NULL;
 						rc = LDAP_OTHER;
 						goto done;
 					}
 				}
 			} else {
+#ifdef NEW_LOGGING
+				LDAP_LOG ( OPERATION, RESULTS,
+					"bdb_search: %ld scope not okay\n", (long) id, 0, 0);
+#else
 				Debug( LDAP_DEBUG_TRACE,
 					"bdb_search: %ld scope not okay\n",
 					(long) id, 0, 0 );
+#endif
 			}
 		} else {
+#ifdef NEW_LOGGING
+				LDAP_LOG ( OPERATION, RESULTS,
+					"bdb_search: %ld does match filter\n", (long) id, 0, 0);
+#else
 			Debug( LDAP_DEBUG_TRACE,
 				"bdb_search: %ld does match filter\n",
 				(long) id, 0, 0 );
+#endif
 		}
 
 loop_continue:
 		if( e != NULL ) {
 			/* free reader lock */
-			bdb_entry_return( be, e );
+                        bdb_cache_return_entry_r ( bdb->bi_dbenv, &bdb->bi_cache, e , &lock);
+                        e = NULL;
 		}
 
 		ldap_pvt_thread_yield();
@@ -448,8 +574,15 @@ loop_continue:
 	rc = 0;
 
 done:
-	ber_bvecfree( v2refs );
-	if( realbase ) ch_free( realbase );
+	if( e != NULL ) {
+		/* free reader lock */
+		bdb_cache_return_entry_r ( bdb->bi_dbenv, &bdb->bi_cache, e, &lock );
+	}
+
+	LOCK_ID_FREE (bdb->bi_dbenv, locker );
+
+	if( v2refs ) ber_bvarray_free( v2refs );
+	if( realbase.bv_val ) ch_free( realbase.bv_val );
 
 	return rc;
 }
@@ -460,8 +593,13 @@ static int base_candidate(
 	Entry	*e,
 	ID		*ids )
 {
+#ifdef NEW_LOGGING
+	LDAP_LOG ( OPERATION, ENTRY,
+		"base_candidate: base: \"%s\" (0x%08lx)\n", e->e_dn, (long) e->e_id, 0);
+#else
 	Debug(LDAP_DEBUG_ARGS, "base_candidates: base: \"%s\" (0x%08lx)\n",
 		e->e_dn, (long) e->e_id, 0);
+#endif
 
 	ids[0] = 1;
 	ids[1] = e->e_id;
@@ -469,14 +607,19 @@ static int base_candidate(
 }
 
 /* Is "objectClass=xx" mentioned anywhere in this filter? Presence
- * doesn't count, we're looking for explicit values.
+ * doesn't count, we're looking for explicit values. Also count depth
+ * of filter tree while we're at it.
  */
 static int oc_filter(
-	Filter *f
+	Filter *f,
+	int cur,
+	int *max
 )
 {
 	int rc = 0;
 
+	if( cur > *max ) *max = cur;
+
 	switch(f->f_choice) {
 	case LDAP_FILTER_EQUALITY:
 	case LDAP_FILTER_APPROX:
@@ -491,8 +634,9 @@ static int oc_filter(
 
 	case LDAP_FILTER_AND:
 	case LDAP_FILTER_OR:
+		cur++;
 		for (f=f->f_and; f; f=f->f_next)
-			if ((rc = oc_filter(f)))
+			if ((rc = oc_filter(f, cur, max)))
 				break;
 		break;
 	default:
@@ -503,26 +647,42 @@ static int oc_filter(
 
 static int search_candidates(
 	BackendDB *be,
+	Operation *op,
 	Entry *e,
 	Filter *filter,
 	int scope,
 	int deref,
-	int manageDSAit,
 	ID	*ids )
 {
-	int rc;
-	Filter		f, fand, rf, xf;
-	ID		tmp[BDB_IDL_UM_SIZE];
+	int rc, depth = 1;
+	Filter		f, scopef, rf, xf;
+	ID		*stack;
 	AttributeAssertion aa_ref;
-	struct bdb_info *bdb = (struct bdb_info *) be->be_private;
+#ifdef BDB_SUBENTRIES
+	Filter	sf;
+	AttributeAssertion aa_subentry;
+#endif
 #ifdef BDB_ALIASES
 	Filter	af;
 	AttributeAssertion aa_alias;
 #endif
 
+	/*
+	 * This routine takes as input a filter (user-filter)
+	 * and rewrites it as follows:
+	 *	(&(scope=DN)[(objectClass=subentry)]
+	 *		(|[(objectClass=referral)(objectClass=alias)](user-filter))
+	 */
+
+#ifdef NEW_LOGGING
+	LDAP_LOG ( OPERATION, ENTRY,
+		"search_candidates: base=\"%s\" (0x%08lx) scope=%d\n", 
+		e->e_dn, (long) e->e_id, scope);
+#else
 	Debug(LDAP_DEBUG_TRACE,
 		"search_candidates: base=\"%s\" (0x%08lx) scope=%d\n",
 		e->e_dn, (long) e->e_id, scope );
+#endif
 
 	xf.f_or = filter;
 	xf.f_choice = LDAP_FILTER_OR;
@@ -531,56 +691,86 @@ static int search_candidates(
 	/* If the user's filter doesn't mention objectClass, or if
 	 * it just uses objectClass=*, these clauses are redundant.
 	 */
-	if (oc_filter(filter)) {
-		if( !manageDSAit ) { /* match referrals */
-			static struct berval bv_ref = { sizeof("REFERRAL")-1, "REFERRAL" };
+	if (oc_filter(filter, 1, &depth) && !get_subentries_visibility(op) ) {
+		if( !get_manageDSAit(op) ) { /* match referrals */
+			struct berval bv_ref = { sizeof("REFERRAL")-1, "REFERRAL" };
 			rf.f_choice = LDAP_FILTER_EQUALITY;
 			rf.f_ava = &aa_ref;
 			rf.f_av_desc = slap_schema.si_ad_objectClass;
-			rf.f_av_value = &bv_ref;
+			rf.f_av_value = bv_ref;
 			rf.f_next = xf.f_or;
 			xf.f_or = &rf;
 		}
 
 #ifdef BDB_ALIASES
 		if( deref & LDAP_DEREF_SEARCHING ) { /* match aliases */
-			static struct berval bv_alias = { sizeof("ALIAS")-1, "ALIAS" };
+			struct berval bv_alias = { sizeof("ALIAS")-1, "ALIAS" };
 			af.f_choice = LDAP_FILTER_EQUALITY;
 			af.f_ava = &aa_alias;
 			af.f_av_desc = slap_schema.si_ad_objectClass;
-			af.f_av_value = &bv_alias;
+			af.f_av_value = bv_alias;
 			af.f_next = xf.f_or;
 			xf.f_or = ⁡
 		}
 #endif
+		/* We added one of these clauses, filter depth increased */
+		if( xf.f_or != filter ) depth++;
 	}
 
 	f.f_next = NULL;
 	f.f_choice = LDAP_FILTER_AND;
-	f.f_and = &fand;
-	fand.f_choice = scope == LDAP_SCOPE_SUBTREE
+	f.f_and = &scopef;
+	scopef.f_choice = scope == LDAP_SCOPE_SUBTREE
 		? SLAPD_FILTER_DN_SUBTREE
 		: SLAPD_FILTER_DN_ONE;
-	fand.f_dn = e->e_ndn;
-	fand.f_next = xf.f_or == filter ? filter : &xf ;
+	scopef.f_dn = &e->e_nname;
+	scopef.f_next = xf.f_or == filter ? filter : &xf ;
+	/* Filter depth increased again, adding scope clause */
+	depth++;
+
+#ifdef BDB_SUBENTRIES
+	if( get_subentries_visibility( op ) ) {
+		struct berval bv_subentry = { sizeof("SUBENTRY")-1, "SUBENTRY" };
+		sf.f_choice = LDAP_FILTER_EQUALITY;
+		sf.f_ava = &aa_subentry;
+		sf.f_av_desc = slap_schema.si_ad_objectClass;
+		sf.f_av_value = bv_subentry;
+		sf.f_next = scopef.f_next;
+		scopef.f_next = &sf;
+	}
+#endif
+
+	/* Allocate IDL stack, plus 1 more for former tmp */
+	stack = ch_malloc( (depth + 1) * BDB_IDL_UM_SIZE * sizeof( ID ) );
 
+	rc = bdb_filter_candidates( be, &f, ids, stack, stack+BDB_IDL_UM_SIZE );
 
-#ifdef BDB_FILTER_INDICES
-	rc = bdb_filter_candidates( be, &f, ids, tmp );
+	ch_free( stack );
+
+	if( rc ) {
+#ifdef NEW_LOGGING
+		LDAP_LOG ( OPERATION, DETAIL1,
+			"bdb_search_candidates: failed (rc=%d)\n", rc, 0, 0  );
 #else
-	/* FIXME: Original code:
-	BDB_IDL_ID( bdb, ids, e->e_id );
-	* this is a hack to make "" base work; when bdb_filter_candidates
-	* is used this should not be needed any more */
-	BDB_IDL_ID( bdb, ids, (e->e_id == NOID ? 1 : e->e_id) );
-	rc = 0;
+		Debug(LDAP_DEBUG_TRACE,
+			"bdb_search_candidates: failed (rc=%d)\n",
+			rc, NULL, NULL );
 #endif
 
-	Debug(LDAP_DEBUG_TRACE,
-		"bdb_search_candidates: id=%ld first=%ld last=%ld\n",
-		(long) ids[0],
-		(long) BDB_IDL_FIRST(ids),
-		(long) BDB_IDL_LAST(ids) );
+	} else {
+#ifdef NEW_LOGGING
+		LDAP_LOG ( OPERATION, DETAIL1,
+			"bdb_search_candidates: id=%ld first=%ld last=%ld\n",
+			(long) ids[0], (long) BDB_IDL_FIRST(ids), 
+			(long) BDB_IDL_LAST(ids));
+#else
+		Debug(LDAP_DEBUG_TRACE,
+			"bdb_search_candidates: id=%ld first=%ld last=%ld\n",
+			(long) ids[0],
+			(long) BDB_IDL_FIRST(ids),
+			(long) BDB_IDL_LAST(ids) );
+#endif
+	}
 
 	return rc;
 }