static metasubtree_t *
meta_subtree_match( metatarget_t *mt, struct berval *ndn, int scope )
{
	metasubtree_t *ms = mt->mt_subtree;

	for ( ms = mt->mt_subtree; ms; ms = ms->ms_next ) {
		switch ( ms->ms_type ) {
		case META_ST_SUBTREE:
			if ( dnIsSuffix( ndn, &ms->ms_dn ) ) {
				return ms;
			}
			break;

		case META_ST_SUBORDINATE:
			if ( dnIsSuffix( ndn, &ms->ms_dn ) &&
				( ndn->bv_len > ms->ms_dn.bv_len || scope != LDAP_SCOPE_BASE ) )
			{
				return ms;
			}
			break;

		case META_ST_REGEX:
			/* NOTE: cannot handle scope */
			if ( regexec( &ms->ms_regex, ndn->bv_val, 0, NULL, 0 ) == 0 ) {
				return ms;
			}
			break;
		}
	}

	return NULL;
}

int slapi_sdn_issuffix( const Slapi_DN *sdn, const Slapi_DN *suffix_sdn )
{
	slapi_sdn_get_ndn( sdn );
	slapi_sdn_get_ndn( suffix_sdn );

	return dnIsSuffix( &sdn->ndn, &suffix_sdn->ndn );
}

/*
 * If the entry exists in cache, it is returned in locked status;
 * otherwise, if the parent exists, if it may generate volatile 
 * descendants an attempt to generate the required entry is
 * performed and, if successful, the entry is returned
 */
int
monitor_cache_dn2entry(
	Operation		*op,
	SlapReply		*rs,
	struct berval		*ndn,
	Entry			**ep,
	Entry			**matched )
{
	monitor_info_t *mi = (monitor_info_t *)op->o_bd->be_private;
	int 			rc;
	struct berval		p_ndn = BER_BVNULL;
	Entry 			*e_parent;
	monitor_entry_t 	*mp;
		
	assert( mi != NULL );
	assert( ndn != NULL );
	assert( ep != NULL );
	assert( matched != NULL );

	*matched = NULL;

	if ( !dnIsSuffix( ndn, &op->o_bd->be_nsuffix[ 0 ] ) ) {
		return( -1 );
	}

	rc = monitor_cache_get( mi, ndn, ep );
       	if ( !rc && *ep != NULL ) {
		return( 0 );
	}

	/* try with parent/ancestors */
	if ( BER_BVISNULL( ndn ) ) {
		BER_BVSTR( &p_ndn, "" );

	} else {
		dnParent( ndn, &p_ndn );
	}

	rc = monitor_cache_dn2entry( op, rs, &p_ndn, &e_parent, matched );
	if ( rc || e_parent == NULL ) {
		return( -1 );
	}

	mp = ( monitor_entry_t * )e_parent->e_private;
	rc = -1;
	if ( mp->mp_flags & MONITOR_F_VOLATILE_CH ) {
		/* parent entry generates volatile children */
		rc = monitor_entry_create( op, rs, ndn, e_parent, ep );
	}

	if ( !rc ) {
		monitor_cache_lock( *ep );
		monitor_cache_release( mi, e_parent );

	} else {
		*matched = e_parent;
	}
	
	return( rc );
}

/*
** When adding a group, we first strip any existing members,
** and add all which match the filters ourselfs.
*/
static int
autogroup_add_entry( Operation *op, SlapReply *rs)
{
		slap_overinst		*on = (slap_overinst *)op->o_bd->bd_info;
	autogroup_info_t		*agi = (autogroup_info_t *)on->on_bi.bi_private;
	autogroup_def_t		*agd = agi->agi_def;
	autogroup_entry_t	*age = agi->agi_entry;
	autogroup_filter_t	*agf;
	int			rc = 0;

	Debug( LDAP_DEBUG_TRACE, "==> autogroup_add_entry <%s>\n", 
		op->ora_e->e_name.bv_val, 0, 0);

	ldap_pvt_thread_mutex_lock( &agi->agi_mutex );		

	/* Check if it's a group. */
	for ( ; agd ; agd = agd->agd_next ) {
		if ( is_entry_objectclass_or_sub( op->ora_e, agd->agd_oc ) ) {
			Modification		mod;
			const char		*text = NULL;
			char			textbuf[1024];

			mod.sm_op = LDAP_MOD_DELETE;
			mod.sm_desc = agd->agd_member_ad;
			mod.sm_type = agd->agd_member_ad->ad_cname;
			mod.sm_values = NULL;
			mod.sm_nvalues = NULL;

			/* We don't want any member attributes added by the user. */
			modify_delete_values( op->ora_e, &mod, /* permissive */ 1, &text, textbuf, sizeof( textbuf ) );

			autogroup_add_group( op, agi, agd, op->ora_e, NULL, 1 , 0);
			ldap_pvt_thread_mutex_unlock( &agi->agi_mutex );		
			return SLAP_CB_CONTINUE;
		}
	}

	for ( ; age ; age = age->age_next ) {
		ldap_pvt_thread_mutex_lock( &age->age_mutex );		

		/* Check if any of the filters are the suffix to the entry DN. 
		   If yes, we can test that filter against the entry. */

		for ( agf = age->age_filter; agf ; agf = agf->agf_next ) {
			if ( dnIsSuffix( &op->o_req_ndn, &agf->agf_ndn ) ) {
				rc = test_filter( op, op->ora_e, agf->agf_filter );
				if ( rc == LDAP_COMPARE_TRUE ) {
				autogroup_add_member_to_group( op, &op->ora_e->e_name, &op->ora_e->e_nname, age );
					break;
				}
			}
		}
		ldap_pvt_thread_mutex_unlock( &age->age_mutex );		
	}

	ldap_pvt_thread_mutex_unlock( &agi->agi_mutex );		

	return SLAP_CB_CONTINUE;
}

static int
collect_response( Operation *op, SlapReply *rs )
{
	slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
	collect_info *ci = on->on_bi.bi_private;

	/* If we've been configured and the current response is
	 * a search entry
	 */
	if ( ci && rs->sr_type == REP_SEARCH ) {
		int rc;

		op->o_bd->bd_info = (BackendInfo *)on->on_info;

		for (; ci; ci=ci->ci_next ) {
			int idx=0;

			/* Is this entry an ancestor of this collectinfo ? */
			if (!dnIsSuffix(&rs->sr_entry->e_nname, &ci->ci_dn)) {
				/* collectinfo does not match */
				continue;
			}

			/* Is this entry the same as the template DN ? */
			if ( dn_match(&rs->sr_entry->e_nname, &ci->ci_dn)) {
				/* dont apply change to parent */
				continue;
			}

			/* The current entry may live in a cache, so
			* don't modify it directly. Make a copy and
			* work with that instead.
			*/
			rs_entry2modifiable( op, rs, on );

			/* Loop for each attribute in this collectinfo */
			for(idx=0; idx<ci->ci_ad_num; idx++) {
				BerVarray vals = NULL;

				/* Extract the values of the desired attribute from
			 	 * the ancestor entry */
				rc = backend_attribute( op, NULL, &ci->ci_dn, 
					ci->ci_ad[idx], &vals, ACL_READ );

				/* If there are any values, merge them into the
			 	 * current search result
			 	 */
				if ( vals ) {
					attr_merge( rs->sr_entry, ci->ci_ad[idx], 
						vals, NULL );
					ber_bvarray_free_x( vals, op->o_tmpmemctx );
				}
			}
		}
	}

	/* Default is to just fall through to the normal processing */
	return SLAP_CB_CONTINUE;
}

/*
 * In place; assumes:
 * - ndn is normalized
 * - nbase is normalized
 * - LDAP_SCOPE_DEFAULT == LDAP_SCOPE_SUBTREE
 */
int
dnIsSuffixScope( struct berval *ndn, struct berval *nbase, int scope )
{
	if ( !dnIsSuffix( ndn, nbase ) ) {
		return 0;
	}

	return dnIsWithinScope( ndn, nbase, scope );
}

static int
constraint_check_restrict( Operation *op, constraint *c, Entry *e )
{
	assert( c->restrict_lud != NULL );

	if ( c->restrict_lud->lud_dn != NULL ) {
		int diff = e->e_nname.bv_len - c->restrict_ndn.bv_len;

		if ( diff < 0 ) {
			return 0;
		}

		if ( c->restrict_lud->lud_scope == LDAP_SCOPE_BASE ) {
			return bvmatch( &e->e_nname, &c->restrict_ndn );
		}

		if ( !dnIsSuffix( &e->e_nname, &c->restrict_ndn ) ) {
			return 0;
		}

		if ( c->restrict_lud->lud_scope != LDAP_SCOPE_SUBTREE ) {
			struct berval pdn;

			if ( diff == 0 ) {
				return 0;
			}

			dnParent( &e->e_nname, &pdn );

			if ( c->restrict_lud->lud_scope == LDAP_SCOPE_ONELEVEL
				&& pdn.bv_len != c->restrict_ndn.bv_len )
			{
				return 0;
			}
		}
	}

	if ( c->restrict_filter != NULL ) {
		int rc;
		struct berval save_dn = op->o_dn, save_ndn = op->o_ndn;

		op->o_dn = op->o_bd->be_rootdn;
		op->o_ndn = op->o_bd->be_rootndn;
		rc = test_filter( op, e, c->restrict_filter );
		op->o_dn = save_dn;
		op->o_ndn = save_ndn;

		if ( rc != LDAP_COMPARE_TRUE ) {
			return 0;
		}
	}

	return 1;
}

static int
valsort_modify( Operation *op, SlapReply *rs )
{
	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
	valsort_info *vi = on->on_bi.bi_private;

	Modifications *ml;
	int i;
	char *ptr, *end;

	/* See if any weighted sorting applies to this entry */
	for ( ;vi;vi=vi->vi_next ) {
		if ( !dnIsSuffix( &op->o_req_ndn, &vi->vi_dn ))
			continue;
		if ( !(vi->vi_sort & VALSORT_WEIGHTED ))
			continue;
		for (ml = op->orm_modlist; ml; ml=ml->sml_next ) {
			/* Must be a Delete Attr op, so no values to consider */
			if ( !ml->sml_values )
				continue;
			if ( ml->sml_desc == vi->vi_ad )
				break;
		}
		if ( !ml )
			continue;
		for (i=0; !BER_BVISNULL( &ml->sml_values[i] ); i++) {
			ptr = ber_bvchr(&ml->sml_values[i], '{' );
			if ( !ptr ) {
				Debug(LDAP_DEBUG_TRACE, "weight missing from attribute %s\n",
					vi->vi_ad->ad_cname.bv_val, 0, 0);
				send_ldap_error( op, rs, LDAP_CONSTRAINT_VIOLATION,
					"weight missing from attribute" );
				return rs->sr_err;
			}
			strtol( ptr+1, &end, 0 );
			if ( *end != '}' ) {
				Debug(LDAP_DEBUG_TRACE, "weight is misformatted in %s\n",
					vi->vi_ad->ad_cname.bv_val, 0, 0);
				send_ldap_error( op, rs, LDAP_CONSTRAINT_VIOLATION,
					"weight is misformatted" );
				return rs->sr_err;
			}
		}
	}
	return SLAP_CB_CONTINUE;
}

/* Just like select_backend, but only for our backends */
static BackendDB *
glue_back_select (
	BackendDB *be,
	const char *dn
)
{
	glueinfo *gi = (glueinfo *) be->bd_info;
	struct berval bv;
	int i;

	bv.bv_len = strlen(dn);
	bv.bv_val = (char *) dn;

	for (i = 0; i<gi->nodes; i++) {
		if (dnIsSuffix(&bv, &gi->n[i].be->be_nsuffix[0])) {
			return gi->n[i].be;
		}
	}
	return NULL;
}

static int
collect_modify( Operation *op, SlapReply *rs)
{
	slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
	collect_info *ci = on->on_bi.bi_private;
	Modifications *ml;
	char errMsg[100];
	int idx;

	for ( ml = op->orm_modlist; ml != NULL; ml = ml->sml_next) {
		for (; ci; ci=ci->ci_next ) {
			/* Is this entry an ancestor of this collectinfo ? */
			if (!dnIsSuffix(&op->o_req_ndn, &ci->ci_dn)) {
				/* this collectinfo does not match */
				continue;
			}

			/* Is this entry the same as the template DN ? */
			if ( dn_match(&op->o_req_ndn, &ci->ci_dn)) {
				/* all changes in this ci are allowed */
				continue;
			}

			/* check for collect attributes - disallow modify if present */
			for(idx=0; idx<ci->ci_ad_num; idx++) {
				if (ml->sml_desc == ci->ci_ad[idx]) {
					rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
					snprintf( errMsg, sizeof( errMsg ), 
						"cannot change virtual attribute '%s'",
						ci->ci_ad[idx]->ad_cname.bv_val);
					rs->sr_text = errMsg;
					send_ldap_result( op, rs );
					return rs->sr_err;
				}
			}
		}

	}

	return SLAP_CB_CONTINUE;
}

static int
valsort_add( Operation *op, SlapReply *rs )
{
	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
	valsort_info *vi = on->on_bi.bi_private;

	Attribute *a;
	int i;
	char *ptr, *end;

	/* See if any weighted sorting applies to this entry */
	for ( ;vi;vi=vi->vi_next ) {
		if ( !dnIsSuffix( &op->o_req_ndn, &vi->vi_dn ))
			continue;
		if ( !(vi->vi_sort & VALSORT_WEIGHTED ))
			continue;
		a = attr_find( op->ora_e->e_attrs, vi->vi_ad );
		if ( !a )
			continue;
		for (i=0; !BER_BVISNULL( &a->a_vals[i] ); i++) {
			ptr = ber_bvchr(&a->a_vals[i], '{' );
			if ( !ptr ) {
				Debug(LDAP_DEBUG_TRACE, "weight missing from attribute %s\n",
					vi->vi_ad->ad_cname.bv_val, 0, 0);
				send_ldap_error( op, rs, LDAP_CONSTRAINT_VIOLATION,
					"weight missing from attribute" );
				return rs->sr_err;
			}
			strtol( ptr+1, &end, 0 );
			if ( *end != '}' ) {
				Debug(LDAP_DEBUG_TRACE, "weight is misformatted in %s\n",
					vi->vi_ad->ad_cname.bv_val, 0, 0);
				send_ldap_error( op, rs, LDAP_CONSTRAINT_VIOLATION,
					"weight is misformatted" );
				return rs->sr_err;
			}
		}
	}
	return SLAP_CB_CONTINUE;
}

int
fe_op_modrdn( Operation *op, SlapReply *rs )
{
	struct berval	dest_ndn = BER_BVNULL, dest_pndn, pdn = BER_BVNULL;
	BackendDB	*op_be, *bd = op->o_bd;
	ber_slen_t	diff;
	
	if( op->o_req_ndn.bv_len == 0 ) {
		Debug( LDAP_DEBUG_ANY, "%s do_modrdn: root dse!\n",
			op->o_log_prefix, 0, 0 );
		send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
			"cannot rename the root DSE" );
		goto cleanup;

	} else if ( bvmatch( &op->o_req_ndn, &frontendDB->be_schemandn ) ) {
		Debug( LDAP_DEBUG_ANY, "%s do_modrdn: subschema subentry: %s (%ld)\n",
			op->o_log_prefix, frontendDB->be_schemandn.bv_val, (long)frontendDB->be_schemandn.bv_len );

		send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
			"cannot rename subschema subentry" );
		goto cleanup;
	}

	if( op->orr_nnewSup ) {
		dest_pndn = *op->orr_nnewSup;
	} else {
		dnParent( &op->o_req_ndn, &dest_pndn );
	}
	build_new_dn( &dest_ndn, &dest_pndn, &op->orr_nnewrdn, op->o_tmpmemctx );

	diff = (ber_slen_t) dest_ndn.bv_len - (ber_slen_t) op->o_req_ndn.bv_len;
	if ( diff > 0 ? dnIsSuffix( &dest_ndn, &op->o_req_ndn )
		: diff < 0 && dnIsSuffix( &op->o_req_ndn, &dest_ndn ) )
	{
		send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
			diff > 0 ? "cannot place an entry below itself"
			: "cannot place an entry above itself" );
		goto cleanup;
	}

	/*
	 * We could be serving multiple database backends.  Select the
	 * appropriate one, or send a referral to our "referral server"
	 * if we don't hold it.
	 */
	op->o_bd = select_backend( &op->o_req_ndn, 1 );
	if ( op->o_bd == NULL ) {
		op->o_bd = bd;
		rs->sr_ref = referral_rewrite( default_referral,
			NULL, &op->o_req_dn, LDAP_SCOPE_DEFAULT );
		if (!rs->sr_ref) rs->sr_ref = default_referral;

		if ( rs->sr_ref != NULL ) {
			rs->sr_err = LDAP_REFERRAL;
			send_ldap_result( op, rs );

			if (rs->sr_ref != default_referral) ber_bvarray_free( rs->sr_ref );
		} else {
			send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
				"no global superior knowledge" );
		}
		goto cleanup;
	}

	/* If we've got a glued backend, check the real backend */
	op_be = op->o_bd;
	if ( SLAP_GLUE_INSTANCE( op->o_bd )) {
		op->o_bd = select_backend( &op->o_req_ndn, 0 );
	}

	/* check restrictions */
	if( backend_check_restrictions( op, rs, NULL ) != LDAP_SUCCESS ) {
		send_ldap_result( op, rs );
		goto cleanup;
	}

	/* check for referrals */
	if ( backend_check_referrals( op, rs ) != LDAP_SUCCESS ) {
		goto cleanup;
	}

	/* check that destination DN is in the same backend as source DN */
	if ( select_backend( &dest_ndn, 0 ) != op->o_bd ) {
			send_ldap_error( op, rs, LDAP_AFFECTS_MULTIPLE_DSAS,
				"cannot rename between DSAs" );
			goto cleanup;
	}

	/*
	 * do the modrdn if 1 && (2 || 3)
	 * 1) there is a modrdn function implemented in this backend;
	 * 2) this backend is master for what it holds;
	 * 3) it's a replica and the dn supplied is the update_ndn.
	 */
	if ( op->o_bd->be_modrdn ) {
		/* do the update here */
		int repl_user = be_isupdate( op );
		if ( !SLAP_SINGLE_SHADOW(op->o_bd) || repl_user )
		{
			op->o_bd = op_be;
//.........这里部分代码省略.........

static dynlist_info_t *
dynlist_is_dynlist_next( Operation *op, SlapReply *rs, dynlist_info_t *old_dli )
{
	slap_overinst	*on = (slap_overinst *)op->o_bd->bd_info;
	dynlist_info_t	*dli;

	Attribute	*a;

	if ( old_dli == NULL ) {
		dli = (dynlist_info_t *)on->on_bi.bi_private;

	} else {
		dli = old_dli->dli_next;
	}

	a = attrs_find( rs->sr_entry->e_attrs, slap_schema.si_ad_objectClass );
	if ( a == NULL ) {
		/* FIXME: objectClass must be present; for non-storage
		 * backends, like back-ldap, it needs to be added
		 * to the requested attributes */
		return NULL;
	}

	for ( ; dli; dli = dli->dli_next ) {
		if ( dli->dli_lud != NULL ) {
			/* check base and scope */
			if ( !BER_BVISNULL( &dli->dli_uri_nbase ) ) {
				int d = rs->sr_entry->e_nname.bv_len - dli->dli_uri_nbase.bv_len;

				if ( d < 0 ) {
					continue;
				}

				if ( !dnIsSuffix( &rs->sr_entry->e_nname, &dli->dli_uri_nbase ) ) {
					continue;
				}

				switch ( dli->dli_lud->lud_scope ) {
				case LDAP_SCOPE_BASE:
					if ( d != 0 ) {
						continue;
					}
					break;

				case LDAP_SCOPE_ONELEVEL: {
					struct berval pdn;

					dnParent( &rs->sr_entry->e_nname, &pdn );
					if ( pdn.bv_len != dli->dli_uri_nbase.bv_len ) {
						continue;
					}
					} break;

				case LDAP_SCOPE_SUBORDINATE:
					if ( d == 0 ) {
						continue;
					}
					break;

				case LDAP_SCOPE_SUBTREE:
				case LDAP_SCOPE_DEFAULT:
					break;

				default:
					continue;
				}
			}

			/* check filter */
			if ( dli->dli_uri_filter && test_filter( op, rs->sr_entry, dli->dli_uri_filter ) != LDAP_COMPARE_TRUE ) {
				continue;
			}
		}

		if ( attr_valfind( a,
				SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
				SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
				&dli->dli_oc->soc_cname, NULL,
				op->o_tmpmemctx ) == 0 )
		{
			return dli;
		}
	}

	return NULL;
}

static int
valsort_response( Operation *op, SlapReply *rs )
{
	slap_overinst *on;
	valsort_info *vi;
	Attribute *a;

	/* If this is not a search response, or it is a syncrepl response,
	 * or the valsort control wants raw results, pass thru unmodified.
	 */
	if ( rs->sr_type != REP_SEARCH ||
		( _SCM(op->o_sync) > SLAP_CONTROL_IGNORED ) ||
		( op->o_ctrlflag[valsort_cid] & SLAP_CONTROL_DATA0))
		return SLAP_CB_CONTINUE;
		
	on = (slap_overinst *) op->o_bd->bd_info;
	vi = on->on_bi.bi_private;

	/* And we must have something configured */
	if ( !vi ) return SLAP_CB_CONTINUE;

	/* Find a rule whose baseDN matches this entry */
	for (; vi; vi = vi->vi_next ) {
		int i, n;

		if ( !dnIsSuffix( &rs->sr_entry->e_nname, &vi->vi_dn ))
			continue;

		/* Find attr that this rule affects */
		a = attr_find( rs->sr_entry->e_attrs, vi->vi_ad );
		if ( !a ) continue;

		if (( rs->sr_flags & ( REP_ENTRY_MODIFIABLE|REP_ENTRY_MUSTBEFREED ) ) !=
			( REP_ENTRY_MODIFIABLE|REP_ENTRY_MUSTBEFREED ) )
		{
			Entry *e;

			e = entry_dup( rs->sr_entry );
			if ( rs->sr_flags & REP_ENTRY_MUSTRELEASE ) {
				overlay_entry_release_ov( op, rs->sr_entry, 0, on );
				rs->sr_flags &= ~REP_ENTRY_MUSTRELEASE;
			} else if ( rs->sr_flags & REP_ENTRY_MUSTBEFREED ) {
				entry_free( rs->sr_entry );
			}
			rs->sr_entry = e;
			rs->sr_flags |= REP_ENTRY_MODIFIABLE|REP_ENTRY_MUSTBEFREED;
			a = attr_find( rs->sr_entry->e_attrs, vi->vi_ad );
		}

		n = a->a_numvals;
		if ( vi->vi_sort & VALSORT_WEIGHTED ) {
			int j, gotnvals;
			long *index = op->o_tmpalloc( n * sizeof(long), op->o_tmpmemctx );

			gotnvals = (a->a_vals != a->a_nvals );

			for (i=0; i<n; i++) {
				char *ptr = ber_bvchr( &a->a_nvals[i], '{' );
				char *end = NULL;
				if ( !ptr ) {
					Debug(LDAP_DEBUG_TRACE, "weights missing from attr %s "
						"in entry %s\n", vi->vi_ad->ad_cname.bv_val,
						rs->sr_entry->e_name.bv_val, 0 );
					break;
				}
				index[i] = strtol( ptr+1, &end, 0 );
				if ( *end != '}' ) {
					Debug(LDAP_DEBUG_TRACE, "weights misformatted "
						"in entry %s\n", 
						rs->sr_entry->e_name.bv_val, 0, 0 );
					break;
				}
				/* Strip out weights */
				ptr = a->a_nvals[i].bv_val;
				end++;
				for (;*end;)
					*ptr++ = *end++;
				*ptr = '\0';
				a->a_nvals[i].bv_len = ptr - a->a_nvals[i].bv_val;

				if ( a->a_vals != a->a_nvals ) {
					ptr = a->a_vals[i].bv_val;
					end = ber_bvchr( &a->a_vals[i], '}' );
					assert( end != NULL );
					end++;
					for (;*end;)
						*ptr++ = *end++;
					*ptr = '\0';
					a->a_vals[i].bv_len = ptr - a->a_vals[i].bv_val;
				}
			}
			/* An attr was missing weights here, ignore it */
			if ( i<n ) {
				op->o_tmpfree( index, op->o_tmpmemctx );
				continue;
			}
			/* Insertion sort */
			for ( i=1; i<n; i++) {
				long idx = index[i];
				struct berval tmp = a->a_vals[i], ntmp;
//.........这里部分代码省略.........

//.........这里部分代码省略.........
				rc = value_add_one( &c->rvalue_vals, &ai->ai_localdn );
			} else {
				rc = 1;
			}
			break;
		}
		break;
	case LDAP_MOD_DELETE:
		switch( c->type ) {
		case ACA_USRCLASS:
			ai->ai_usrclass = NULL;
			break;
		case ACA_SRVCLASS:
			ai->ai_srvclass = NULL;
			break;
		case ACA_LOCALDN:
			if ( ai->ai_localdn.bv_val ) {
				ch_free( ai->ai_localdn.bv_val );
				ch_free( ai->ai_localndn.bv_val );
				BER_BVZERO( &ai->ai_localdn );
				BER_BVZERO( &ai->ai_localndn );
			}
			break;
		/* single-valued attrs, all no-ops */
		}
		break;
	case SLAP_CONFIG_ADD:
	case LDAP_MOD_ADD:
		switch( c->type ) {
		case ACA_USRCLASS:
			{
				ObjectClass *oc = oc_find( c->value_string );
				if ( oc )
					ai->ai_usrclass = oc;
				else
					rc = 1;
			}
			break;
		case ACA_SRVCLASS:
			{
				ObjectClass *oc = oc_find( c->value_string );
				if ( oc )
					ai->ai_srvclass = oc;
				else
					rc = 1;
			}
		case ACA_USRKEYBITS:
			if ( c->value_int < MIN_KEYBITS )
				rc = 1;
			else
				ai->ai_usrkeybits = c->value_int;
			break;
		case ACA_SRVKEYBITS:
			if ( c->value_int < MIN_KEYBITS )
				rc = 1;
			else
				ai->ai_srvkeybits = c->value_int;
			break;
		case ACA_CAKEYBITS:
			if ( c->value_int < MIN_KEYBITS )
				rc = 1;
			else
				ai->ai_cakeybits = c->value_int;
			break;
		case ACA_USRDAYS:
			ai->ai_usrdays = c->value_int;
			break;
		case ACA_SRVDAYS:
			ai->ai_srvdays = c->value_int;
			break;
		case ACA_CADAYS:
			ai->ai_cadays = c->value_int;
			break;
		case ACA_LOCALDN:
			if ( c->be->be_nsuffix == NULL ) {
				snprintf( c->cr_msg, sizeof( c->cr_msg ),
					"suffix must be set" );
				Debug( LDAP_DEBUG_CONFIG, "autoca_config: %s\n",
					c->cr_msg, NULL, NULL );
				rc = ARG_BAD_CONF;
				break;
			}
			if ( !dnIsSuffix( &c->value_ndn, c->be->be_nsuffix )) {
				snprintf( c->cr_msg, sizeof( c->cr_msg ),
					"DN is not a subordinate of backend" );
				Debug( LDAP_DEBUG_CONFIG, "autoca_config: %s\n",
					c->cr_msg, NULL, NULL );
				rc = ARG_BAD_CONF;
				break;
			}
			if ( ai->ai_localdn.bv_val ) {
				ch_free( ai->ai_localdn.bv_val );
				ch_free( ai->ai_localndn.bv_val );
			}
			ai->ai_localdn = c->value_dn;
			ai->ai_localndn = c->value_ndn;
		}
	}
	return rc;
}

//.........这里部分代码省略.........
							ldap_memvfree((void *)ap.restrict_lud->lud_attrs);
							ap.restrict_lud->lud_attrs = NULL;
						}

						if (ap.restrict_lud->lud_dn != NULL) {
							if (ap.restrict_lud->lud_dn[0] == '\0') {
								ldap_memfree(ap.restrict_lud->lud_dn);
								ap.restrict_lud->lud_dn = NULL;

							} else {
								struct berval dn, ndn;
								int j;

								ber_str2bv(ap.restrict_lud->lud_dn, 0, 0, &dn);
								if (dnNormalize(0, NULL, NULL, &dn, &ndn, NULL)) {
									/* cleanup */
									snprintf( c->cr_msg, sizeof( c->cr_msg ),
										"%s %s: restrict URI %s DN normalization failed",
										c->argv[0], c->argv[1], arg );
									rc = ARG_BAD_CONF;
									goto done;
								}

								assert(c->be != NULL);
								if (c->be->be_nsuffix == NULL) {
									snprintf( c->cr_msg, sizeof( c->cr_msg ),
										"%s %s: restrict URI requires suffix",
										c->argv[0], c->argv[1] );
									rc = ARG_BAD_CONF;
									goto done;
								}

								for ( j = 0; !BER_BVISNULL(&c->be->be_nsuffix[j]); j++) {
									if (dnIsSuffix(&ndn, &c->be->be_nsuffix[j])) break;
								}

								if (BER_BVISNULL(&c->be->be_nsuffix[j])) {
									/* error */
									snprintf( c->cr_msg, sizeof( c->cr_msg ),
										"%s %s: restrict URI DN %s not within database naming context(s)",
										c->argv[0], c->argv[1], dn.bv_val );
									rc = ARG_BAD_CONF;
									goto done;
								}

								ap.restrict_ndn = ndn;
							}
						}

						if (ap.restrict_lud->lud_filter != NULL) {
							ap.restrict_filter = str2filter(ap.restrict_lud->lud_filter);
							if (ap.restrict_filter == NULL) {
								/* error */
								snprintf( c->cr_msg, sizeof( c->cr_msg ),
									"%s %s: restrict URI filter %s invalid",
									c->argv[0], c->argv[1], ap.restrict_lud->lud_filter );
								rc = ARG_BAD_CONF;
								goto done;
							}
						}

						ber_str2bv(c->argv[argidx], 0, 1, &ap.restrict_val);

					} else {
						/* cleanup */
						snprintf( c->cr_msg, sizeof( c->cr_msg ),

/*
 * returns 1 if suffix is candidate for dn, otherwise 0
 *
 * Note: this function should never be called if dn is the <suffix>.
 */
int 
meta_back_is_candidate(
	metatarget_t	*mt,
	struct berval	*ndn,
	int		scope )
{
	struct berval rdn;
	int d = ndn->bv_len - mt->mt_nsuffix.bv_len;

	if ( d >= 0 ) {
		if ( !dnIsSuffix( ndn, &mt->mt_nsuffix ) ) {
			return META_NOT_CANDIDATE;
		}

		/*
		 * |  match  | exclude |
		 * +---------+---------+-------------------+
		 * |    T    |    T    | not candidate     |
		 * |    F    |    T    | continue checking |
		 * +---------+---------+-------------------+
		 * |    T    |    F    | candidate         |
		 * |    F    |    F    | not candidate     |
		 * +---------+---------+-------------------+
		 */
			
		if ( mt->mt_subtree ) {
			int match = ( meta_subtree_match( mt, ndn, scope ) != NULL );

			if ( !mt->mt_subtree_exclude ) {
				return match ? META_CANDIDATE : META_NOT_CANDIDATE;
			}

			if ( match /* && mt->mt_subtree_exclude */ ) {
				return META_NOT_CANDIDATE;
			}
		}

		switch ( mt->mt_scope ) {
		case LDAP_SCOPE_SUBTREE:
		default:
			return META_CANDIDATE;

		case LDAP_SCOPE_SUBORDINATE:
			if ( d > 0 ) {
				return META_CANDIDATE;
			}
			break;

		/* nearly useless; not allowed by config */
		case LDAP_SCOPE_ONELEVEL:
			if ( d > 0 ) {
				rdn.bv_val = ndn->bv_val;
				rdn.bv_len = (ber_len_t)d - STRLENOF( "," );
				if ( dnIsOneLevelRDN( &rdn ) ) {
					return META_CANDIDATE;
				}
			}
			break;

		/* nearly useless; not allowed by config */
		case LDAP_SCOPE_BASE:
			if ( d == 0 ) {
				return META_CANDIDATE;
			}
			break;
		}

	} else /* if ( d < 0 ) */ {
		if ( !dnIsSuffix( &mt->mt_nsuffix, ndn ) ) {
			return META_NOT_CANDIDATE;
		}

		switch ( scope ) {
		case LDAP_SCOPE_SUBTREE:
		case LDAP_SCOPE_SUBORDINATE:
			/*
			 * suffix longer than dn, but common part matches
			 */
			return META_CANDIDATE;

		case LDAP_SCOPE_ONELEVEL:
			rdn.bv_val = mt->mt_nsuffix.bv_val;
			rdn.bv_len = (ber_len_t)(-d) - STRLENOF( "," );
			if ( dnIsOneLevelRDN( &rdn ) ) {
				return META_CANDIDATE;
			}
			break;
		}
	}

	return META_NOT_CANDIDATE;
}

//.........这里部分代码省略.........
				is_newdn = 0;


				ldap_pvt_thread_mutex_lock( &age->age_mutex );

				if ( overlay_entry_get_ov( op, &age->age_ndn, NULL, NULL, 0, &group, on ) !=
					LDAP_SUCCESS || group == NULL ) {
					Debug( LDAP_DEBUG_TRACE, "autogroup_response MODRDN cannot get group entry <%s>\n", age->age_dn.bv_val, 0, 0);

					op->o_tmpfree( new_dn.bv_val, op->o_tmpmemctx );
					op->o_tmpfree( new_ndn.bv_val, op->o_tmpmemctx );

					ldap_pvt_thread_mutex_unlock( &age->age_mutex );
					ldap_pvt_thread_mutex_unlock( &agi->agi_mutex );
					return SLAP_CB_CONTINUE;
				}

				a = attrs_find( group->e_attrs, age->age_def->agd_member_ad );

				if ( a != NULL ) {
					if ( value_find_ex( age->age_def->agd_member_ad,
							SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
							SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
							a->a_nvals, &op->o_req_ndn, op->o_tmpmemctx ) == 0 ) 
					{
						is_olddn = 1;
					}

				}

				overlay_entry_release_ov( op, group, 0, on );

				for ( agf = age->age_filter ; agf ; agf = agf->agf_next ) {
					if ( dnIsSuffix( &new_ndn, &agf->agf_ndn ) ) {
						is_newdn = 1;
						break;
					}
				}


				if ( is_olddn == 1 && is_newdn == 0 ) {
					autogroup_delete_member_from_group( op, &op->o_req_dn, &op->o_req_ndn, age );
				} else
				if ( is_olddn == 0 && is_newdn == 1 ) {
					for ( agf = age->age_filter; agf; agf = agf->agf_next ) {
						if ( test_filter( op, e, agf->agf_filter ) == LDAP_COMPARE_TRUE ) {
							autogroup_add_member_to_group( op, &new_dn, &new_ndn, age );
							break;
						}
					}
				} else
				if ( is_olddn == 1 && is_newdn == 1 && dn_equal != 0 ) {
					autogroup_delete_member_from_group( op, &op->o_req_dn, &op->o_req_ndn, age );
					autogroup_add_member_to_group( op, &new_dn, &new_ndn, age );
				}

				ldap_pvt_thread_mutex_unlock( &age->age_mutex );
			}

			op->o_tmpfree( new_dn.bv_val, op->o_tmpmemctx );
			op->o_tmpfree( new_ndn.bv_val, op->o_tmpmemctx );

			ldap_pvt_thread_mutex_unlock( &agi->agi_mutex );			
		}
	}

//.........这里部分代码省略.........
		Debug( LDAP_DEBUG_TRACE, "no access to parent\n", 0,
			0, 0 );
		rs->sr_text = "no write access to old parent's children";
		goto return_results;
	}

	Debug( LDAP_DEBUG_TRACE,
		LDAP_XSTRING(ndb_back_modrdn) ": wr to children "
		"of entry %s OK\n", e2.e_name.bv_val, 0, 0 );
	
	if ( op->oq_modrdn.rs_newSup != NULL ) {
		Debug( LDAP_DEBUG_TRACE, 
			LDAP_XSTRING(ndb_back_modrdn)
			": new parent \"%s\" requested...\n",
			op->oq_modrdn.rs_newSup->bv_val, 0, 0 );

		/*  newSuperior == oldParent? */
		if( dn_match( &e2.e_nname, op->oq_modrdn.rs_nnewSup ) ) {
			Debug( LDAP_DEBUG_TRACE, "bdb_back_modrdn: "
				"new parent \"%s\" same as the old parent \"%s\"\n",
				op->oq_modrdn.rs_newSup->bv_val, e2.e_name.bv_val, 0 );
			op->oq_modrdn.rs_newSup = NULL; /* ignore newSuperior */
		}
	}

	if ( op->oq_modrdn.rs_newSup != NULL ) {
		if ( op->oq_modrdn.rs_newSup->bv_len ) {
			rdn2.nr_num = 0;
			np_dn = op->oq_modrdn.rs_newSup;
			np_ndn = op->oq_modrdn.rs_nnewSup;

			/* newSuperior == oldParent? - checked above */
			/* newSuperior == entry being moved?, if so ==> ERROR */
			if ( dnIsSuffix( np_ndn, &e.e_nname )) {
				rs->sr_err = LDAP_NO_SUCH_OBJECT;
				rs->sr_text = "new superior not found";
				goto return_results;
			}
			/* Get Entry with dn=newSuperior. Does newSuperior exist? */

			e2.e_name = *np_dn;
			e2.e_nname = *np_ndn;
			rs->sr_err = ndb_entry_get_info( op, &NA2, 1, NULL );
			switch( rs->sr_err ) {
			case 0:
				break;
			case LDAP_NO_SUCH_OBJECT:
				Debug( LDAP_DEBUG_TRACE,
					LDAP_XSTRING(ndb_back_modrdn)
					": newSup(ndn=%s) not here!\n",
					np_ndn->bv_val, 0, 0);
				rs->sr_text = "new superior not found";
				goto return_results;
#if 0
			case DB_LOCK_DEADLOCK:
			case DB_LOCK_NOTGRANTED:
				goto retry;
#endif
			case LDAP_BUSY:
				rs->sr_text = "ldap server busy";
				goto return_results;
			default:
				rs->sr_err = LDAP_OTHER;
				rs->sr_text = "internal error";
				goto return_results;
			}

//.........这里部分代码省略.........
	new_parent_dn = &p_dn;	/* New Parent unless newSuperior given */

	if ( op->oq_modrdn.rs_newSup != NULL ) {
		Debug( LDAP_DEBUG_TRACE, 
			LDAP_XSTRING(bdb_modrdn)
			": new parent \"%s\" requested...\n",
			op->oq_modrdn.rs_newSup->bv_val, 0, 0 );

		/*  newSuperior == oldParent? */
		if( dn_match( &p_ndn, op->oq_modrdn.rs_nnewSup ) ) {
			Debug( LDAP_DEBUG_TRACE, "bdb_back_modrdn: "
				"new parent \"%s\" same as the old parent \"%s\"\n",
				op->oq_modrdn.rs_newSup->bv_val, p_dn.bv_val, 0 );
			op->oq_modrdn.rs_newSup = NULL; /* ignore newSuperior */
		}
	}

	/* There's a BDB_MULTIPLE_SUFFIXES case here that this code doesn't
	 * support. E.g., two suffixes dc=foo,dc=com and dc=bar,dc=net.
	 * We do not allow modDN
	 *   dc=foo,dc=com
	 *    newrdn dc=bar
	 *    newsup dc=net
	 * and we probably should. But since MULTIPLE_SUFFIXES is deprecated
	 * I'm ignoring this problem for now.
	 */
	if ( op->oq_modrdn.rs_newSup != NULL ) {
		if ( op->oq_modrdn.rs_newSup->bv_len ) {
			np_dn = op->oq_modrdn.rs_newSup;
			np_ndn = op->oq_modrdn.rs_nnewSup;

			/* newSuperior == oldParent? - checked above */
			/* newSuperior == entry being moved?, if so ==> ERROR */
			if ( dnIsSuffix( np_ndn, &e->e_nname )) {
				rs->sr_err = LDAP_NO_SUCH_OBJECT;
				rs->sr_text = "new superior not found";
				goto return_results;
			}
			/* Get Entry with dn=newSuperior. Does newSuperior exist? */

			rs->sr_err = bdb_dn2entry( op, ltid, np_ndn,
				&neip, 0, &nplock );

			switch( rs->sr_err ) {
			case 0: np = neip->bei_e;
			case DB_NOTFOUND:
				break;
			case DB_LOCK_DEADLOCK:
			case DB_LOCK_NOTGRANTED:
				goto retry;
			case LDAP_BUSY:
				rs->sr_text = "ldap server busy";
				goto return_results;
			default:
				rs->sr_err = LDAP_OTHER;
				rs->sr_text = "internal error";
				goto return_results;
			}

			if( np == NULL) {
				Debug( LDAP_DEBUG_TRACE,
					LDAP_XSTRING(bdb_modrdn)
					": newSup(ndn=%s) not here!\n",
					np_ndn->bv_val, 0, 0);
				rs->sr_text = "new superior not found";
				rs->sr_err = LDAP_NO_SUCH_OBJECT;