Adding upstream version 2.4.57+dfsg.upstream/2.4.57+dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 2792 insertions, 0 deletions

diff --git a/servers/slapd/back-sql/search.c b/servers/slapd/back-sql/search.c
new file mode 100644
index 0000000..bb0f1e2
--- /dev/null
+++ b/servers/slapd/back-sql/search.c
@@ -0,0 +1,2792 @@
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1999-2021 The OpenLDAP Foundation.
+ * Portions Copyright 1999 Dmitry Kovalev.
+ * Portions Copyright 2002 Pierangelo Masarati.
+ * Portions Copyright 2004 Mark Adamson.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* ACKNOWLEDGEMENTS:
+ * This work was initially developed by Dmitry Kovalev for inclusion
+ * by OpenLDAP Software.  Additional significant contributors include
+ * Pierangelo Masarati and Mark Adamson.
+ */
+
+#include "portable.h"
+
+#include <stdio.h>
+#include <sys/types.h>
+#include "ac/string.h"
+#include "ac/ctype.h"
+
+#include "lutil.h"
+#include "slap.h"
+#include "proto-sql.h"
+
+static int backsql_process_filter( backsql_srch_info *bsi, Filter *f );
+static int backsql_process_filter_eq( backsql_srch_info *bsi, 
+		backsql_at_map_rec *at,
+		int casefold, struct berval *filter_value );
+static int backsql_process_filter_like( backsql_srch_info *bsi, 
+		backsql_at_map_rec *at,
+		int casefold, struct berval *filter_value );
+static int backsql_process_filter_attr( backsql_srch_info *bsi, Filter *f, 
+		backsql_at_map_rec *at );
+
+/* For LDAP_CONTROL_PAGEDRESULTS, a 32 bit cookie is available to keep track of
+   the state of paged results. The ldap_entries.id and oc_map_id values of the
+   last entry returned are used as the cookie, so 6 bits are used for the OC id
+   and the other 26 for ldap_entries ID number. If your max(oc_map_id) is more
+   than 63, you will need to steal more bits from ldap_entries ID number and
+   put them into the OC ID part of the cookie. */
+
+/* NOTE: not supported when BACKSQL_ARBITRARY_KEY is defined */
+#ifndef BACKSQL_ARBITRARY_KEY
+#define SQL_TO_PAGECOOKIE(id, oc) (((id) << 6 ) | ((oc) & 0x3F))
+#define PAGECOOKIE_TO_SQL_ID(pc) ((pc) >> 6)
+#define PAGECOOKIE_TO_SQL_OC(pc) ((pc) & 0x3F)
+
+static int parse_paged_cookie( Operation *op, SlapReply *rs );
+
+static void send_paged_response( 
+	Operation *op,
+	SlapReply *rs,
+	ID  *lastid );
+#endif /* ! BACKSQL_ARBITRARY_KEY */
+
+static int
+backsql_attrlist_add( backsql_srch_info *bsi, AttributeDescription *ad )
+{
+	int 		n_attrs = 0;
+	AttributeName	*an = NULL;
+
+	if ( bsi->bsi_attrs == NULL ) {
+		return 1;
+	}
+
+	/*
+	 * clear the list (retrieve all attrs)
+	 */
+	if ( ad == NULL ) {
+		bsi->bsi_op->o_tmpfree( bsi->bsi_attrs, bsi->bsi_op->o_tmpmemctx );
+		bsi->bsi_attrs = NULL;
+		bsi->bsi_flags |= BSQL_SF_ALL_ATTRS;
+		return 1;
+	}
+
+	/* strip ';binary' */
+	if ( slap_ad_is_binary( ad ) ) {
+		ad = ad->ad_type->sat_ad;
+	}
+
+	for ( ; !BER_BVISNULL( &bsi->bsi_attrs[ n_attrs ].an_name ); n_attrs++ ) {
+		an = &bsi->bsi_attrs[ n_attrs ];
+		
+		Debug( LDAP_DEBUG_TRACE, "==>backsql_attrlist_add(): "
+			"attribute \"%s\" is in list\n", 
+			an->an_name.bv_val, 0, 0 );
+		/*
+		 * We can live with strcmp because the attribute 
+		 * list has been normalized before calling be_search
+		 */
+		if ( !BACKSQL_NCMP( &an->an_name, &ad->ad_cname ) ) {
+			return 1;
+		}
+	}
+	
+	Debug( LDAP_DEBUG_TRACE, "==>backsql_attrlist_add(): "
+		"adding \"%s\" to list\n", ad->ad_cname.bv_val, 0, 0 );
+
+	an = (AttributeName *)bsi->bsi_op->o_tmprealloc( bsi->bsi_attrs,
+			sizeof( AttributeName ) * ( n_attrs + 2 ),
+			bsi->bsi_op->o_tmpmemctx );
+	if ( an == NULL ) {
+		return -1;
+	}
+
+	an[ n_attrs ].an_name = ad->ad_cname;
+	an[ n_attrs ].an_desc = ad;
+	BER_BVZERO( &an[ n_attrs + 1 ].an_name );
+
+	bsi->bsi_attrs = an;
+	
+	return 1;
+}
+
+/*
+ * Initializes the search structure.
+ * 
+ * If get_base_id != 0, the field bsi_base_id is filled 
+ * with the entryID of bsi_base_ndn; it must be freed
+ * by backsql_free_entryID() when no longer required.
+ *
+ * NOTE: base must be normalized
+ */
+int
+backsql_init_search(
+	backsql_srch_info 	*bsi, 
+	struct berval		*nbase, 
+	int 			scope, 
+	time_t 			stoptime, 
+	Filter 			*filter, 
+	SQLHDBC 		dbh,
+	Operation 		*op,
+	SlapReply		*rs,
+	AttributeName 		*attrs,
+	unsigned		flags )
+{
+	backsql_info		*bi = (backsql_info *)op->o_bd->be_private;
+	int			rc = LDAP_SUCCESS;
+
+	bsi->bsi_base_ndn = nbase;
+	bsi->bsi_use_subtree_shortcut = 0;
+	BER_BVZERO( &bsi->bsi_base_id.eid_dn );
+	BER_BVZERO( &bsi->bsi_base_id.eid_ndn );
+	bsi->bsi_scope = scope;
+	bsi->bsi_filter = filter;
+	bsi->bsi_dbh = dbh;
+	bsi->bsi_op = op;
+	bsi->bsi_rs = rs;
+	bsi->bsi_flags = BSQL_SF_NONE;
+
+	bsi->bsi_attrs = NULL;
+
+	if ( BACKSQL_FETCH_ALL_ATTRS( bi ) ) {
+		/*
+		 * if requested, simply try to fetch all attributes
+		 */
+		bsi->bsi_flags |= BSQL_SF_ALL_ATTRS;
+
+	} else {
+		if ( BACKSQL_FETCH_ALL_USERATTRS( bi ) ) {
+			bsi->bsi_flags |= BSQL_SF_ALL_USER;
+
+		} else if ( BACKSQL_FETCH_ALL_OPATTRS( bi ) ) {
+			bsi->bsi_flags |= BSQL_SF_ALL_OPER;
+		}
+
+		if ( attrs == NULL ) {
+			/* NULL means all user attributes */
+			bsi->bsi_flags |= BSQL_SF_ALL_USER;
+
+		} else {
+			AttributeName	*p;
+			int		got_oc = 0;
+
+			bsi->bsi_attrs = (AttributeName *)bsi->bsi_op->o_tmpalloc(
+					sizeof( AttributeName ),
+					bsi->bsi_op->o_tmpmemctx );
+			BER_BVZERO( &bsi->bsi_attrs[ 0 ].an_name );
+	
+			for ( p = attrs; !BER_BVISNULL( &p->an_name ); p++ ) {
+				if ( BACKSQL_NCMP( &p->an_name, slap_bv_all_user_attrs ) == 0 ) {
+					/* handle "*" */
+					bsi->bsi_flags |= BSQL_SF_ALL_USER;
+
+					/* if all attrs are requested, there's
+					 * no need to continue */
+					if ( BSQL_ISF_ALL_ATTRS( bsi ) ) {
+						bsi->bsi_op->o_tmpfree( bsi->bsi_attrs,
+								bsi->bsi_op->o_tmpmemctx );
+						bsi->bsi_attrs = NULL;
+						break;
+					}
+					continue;
+
+				} else if ( BACKSQL_NCMP( &p->an_name, slap_bv_all_operational_attrs ) == 0 ) {
+					/* handle "+" */
+					bsi->bsi_flags |= BSQL_SF_ALL_OPER;
+
+					/* if all attrs are requested, there's
+					 * no need to continue */
+					if ( BSQL_ISF_ALL_ATTRS( bsi ) ) {
+						bsi->bsi_op->o_tmpfree( bsi->bsi_attrs,
+								bsi->bsi_op->o_tmpmemctx );
+						bsi->bsi_attrs = NULL;
+						break;
+					}
+					continue;
+
+				} else if ( BACKSQL_NCMP( &p->an_name, slap_bv_no_attrs ) == 0 ) {
+					/* ignore "1.1" */
+					continue;
+
+				} else if ( p->an_desc == slap_schema.si_ad_objectClass ) {
+					got_oc = 1;
+				}
+
+				backsql_attrlist_add( bsi, p->an_desc );
+			}
+
+			if ( got_oc == 0 && !( bsi->bsi_flags & BSQL_SF_ALL_USER ) ) {
+				/* add objectClass if not present,
+				 * because it is required to understand
+				 * if an entry is a referral, an alias 
+				 * or so... */
+				backsql_attrlist_add( bsi, slap_schema.si_ad_objectClass );
+			}
+		}
+
+		if ( !BSQL_ISF_ALL_ATTRS( bsi ) && bi->sql_anlist ) {
+			AttributeName	*p;
+			
+			/* use hints if available */
+			for ( p = bi->sql_anlist; !BER_BVISNULL( &p->an_name ); p++ ) {
+				if ( BACKSQL_NCMP( &p->an_name, slap_bv_all_user_attrs ) == 0 ) {
+					/* handle "*" */
+					bsi->bsi_flags |= BSQL_SF_ALL_USER;
+
+					/* if all attrs are requested, there's
+					 * no need to continue */
+					if ( BSQL_ISF_ALL_ATTRS( bsi ) ) {
+						bsi->bsi_op->o_tmpfree( bsi->bsi_attrs,
+								bsi->bsi_op->o_tmpmemctx );
+						bsi->bsi_attrs = NULL;
+						break;
+					}
+					continue;
+
+				} else if ( BACKSQL_NCMP( &p->an_name, slap_bv_all_operational_attrs ) == 0 ) {
+					/* handle "+" */
+					bsi->bsi_flags |= BSQL_SF_ALL_OPER;
+
+					/* if all attrs are requested, there's
+					 * no need to continue */
+					if ( BSQL_ISF_ALL_ATTRS( bsi ) ) {
+						bsi->bsi_op->o_tmpfree( bsi->bsi_attrs,
+								bsi->bsi_op->o_tmpmemctx );
+						bsi->bsi_attrs = NULL;
+						break;
+					}
+					continue;
+				}
+
+				backsql_attrlist_add( bsi, p->an_desc );
+			}
+
+		}
+	}
+
+	bsi->bsi_id_list = NULL;
+	bsi->bsi_id_listtail = &bsi->bsi_id_list;
+	bsi->bsi_n_candidates = 0;
+	bsi->bsi_stoptime = stoptime;
+	BER_BVZERO( &bsi->bsi_sel.bb_val );
+	bsi->bsi_sel.bb_len = 0;
+	BER_BVZERO( &bsi->bsi_from.bb_val );
+	bsi->bsi_from.bb_len = 0;
+	BER_BVZERO( &bsi->bsi_join_where.bb_val );
+	bsi->bsi_join_where.bb_len = 0;
+	BER_BVZERO( &bsi->bsi_flt_where.bb_val );
+	bsi->bsi_flt_where.bb_len = 0;
+	bsi->bsi_filter_oc = NULL;
+
+	if ( BACKSQL_IS_GET_ID( flags ) ) {
+		int	matched = BACKSQL_IS_MATCHED( flags );
+		int	getentry = BACKSQL_IS_GET_ENTRY( flags );
+		int	gotit = 0;
+
+		assert( op->o_bd->be_private != NULL );
+
+		rc = backsql_dn2id( op, rs, dbh, nbase, &bsi->bsi_base_id,
+				matched, 1 );
+
+		/* the entry is collected either if requested for by getentry
+		 * or if get noSuchObject and requested to climb the tree,
+		 * so that a matchedDN or a referral can be returned */
+		if ( ( rc == LDAP_NO_SUCH_OBJECT && matched ) || getentry ) {
+			if ( !BER_BVISNULL( &bsi->bsi_base_id.eid_ndn ) ) {
+				assert( bsi->bsi_e != NULL );
+				
+				if ( dn_match( nbase, &bsi->bsi_base_id.eid_ndn ) )
+				{
+					gotit = 1;
+				}
+			
+				/*
+				 * let's see if it is a referral and, in case, get it
+				 */
+				backsql_attrlist_add( bsi, slap_schema.si_ad_ref );
+				rc = backsql_id2entry( bsi, &bsi->bsi_base_id );
+				if ( rc == LDAP_SUCCESS ) {
+					if ( is_entry_referral( bsi->bsi_e ) )
+					{
+						BerVarray erefs = get_entry_referrals( op, bsi->bsi_e );
+						if ( erefs ) {
+							rc = rs->sr_err = LDAP_REFERRAL;
+							rs->sr_ref = referral_rewrite( erefs,
+									&bsi->bsi_e->e_nname,
+									&op->o_req_dn,
+									scope );
+							ber_bvarray_free( erefs );
+	
+						} else {
+							rc = rs->sr_err = LDAP_OTHER;
+							rs->sr_text = "bad referral object";
+						}
+
+					} else if ( !gotit ) {
+						rc = rs->sr_err = LDAP_NO_SUCH_OBJECT;
+					}
+				}
+
+			} else {
+				rs->sr_err = rc;
+			}
+		}
+
+		if ( gotit && BACKSQL_IS_GET_OC( flags ) ) {
+			bsi->bsi_base_id.eid_oc = backsql_id2oc( bi,
+				bsi->bsi_base_id.eid_oc_id );
+			if ( bsi->bsi_base_id.eid_oc == NULL ) {
+				/* error? */
+				backsql_free_entryID( &bsi->bsi_base_id, 1,
+					op->o_tmpmemctx );
+				rc = rs->sr_err = LDAP_OTHER;
+			}
+		}
+	}
+
+	bsi->bsi_status = rc;
+
+	switch ( rc ) {
+	case LDAP_SUCCESS:
+	case LDAP_REFERRAL:
+		break;
+
+	default:
+		bsi->bsi_op->o_tmpfree( bsi->bsi_attrs,
+				bsi->bsi_op->o_tmpmemctx );
+		break;
+	}
+
+	return rc;
+}
+
+static int
+backsql_process_filter_list( backsql_srch_info *bsi, Filter *f, int op )
+{
+	int		res;
+
+	if ( !f ) {
+		return 0;
+	}
+
+	backsql_strfcat_x( &bsi->bsi_flt_where,
+			bsi->bsi_op->o_tmpmemctx, "c", '(' /* ) */  );
+
+	while ( 1 ) {
+		res = backsql_process_filter( bsi, f );
+		if ( res < 0 ) {
+			/*
+			 * TimesTen : If the query has no answers,
+			 * don't bother to run the query.
+			 */
+			return -1;
+		}
+ 
+		f = f->f_next;
+		if ( f == NULL ) {
+			break;
+		}
+
+		switch ( op ) {
+		case LDAP_FILTER_AND:
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx, "l",
+					(ber_len_t)STRLENOF( " AND " ), 
+						" AND " );
+			break;
+
+		case LDAP_FILTER_OR:
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx, "l",
+					(ber_len_t)STRLENOF( " OR " ),
+						" OR " );
+			break;
+		}
+	}
+
+	backsql_strfcat_x( &bsi->bsi_flt_where,
+			bsi->bsi_op->o_tmpmemctx, "c", /* ( */ ')' );
+
+	return 1;
+}
+
+static int
+backsql_process_sub_filter( backsql_srch_info *bsi, Filter *f,
+	backsql_at_map_rec *at )
+{
+	backsql_info		*bi = (backsql_info *)bsi->bsi_op->o_bd->be_private;
+	int			i;
+	int			casefold = 0;
+
+	if ( !f ) {
+		return 0;
+	}
+
+	/* always uppercase strings by now */
+#ifdef BACKSQL_UPPERCASE_FILTER
+	if ( f->f_sub_desc->ad_type->sat_substr &&
+			SLAP_MR_ASSOCIATED( f->f_sub_desc->ad_type->sat_substr,
+				bi->sql_caseIgnoreMatch ) )
+#endif /* BACKSQL_UPPERCASE_FILTER */
+	{
+		casefold = 1;
+	}
+
+	if ( f->f_sub_desc->ad_type->sat_substr &&
+			SLAP_MR_ASSOCIATED( f->f_sub_desc->ad_type->sat_substr,
+				bi->sql_telephoneNumberMatch ) )
+	{
+
+		struct berval	bv;
+		ber_len_t	i, s, a;
+
+		/*
+		 * to check for matching telephone numbers
+		 * with intermixed chars, e.g. val='1234'
+		 * use
+		 * 
+		 * val LIKE '%1%2%3%4%'
+		 */
+
+		BER_BVZERO( &bv );
+		if ( f->f_sub_initial.bv_val ) {
+			bv.bv_len += f->f_sub_initial.bv_len;
+		}
+		if ( f->f_sub_any != NULL ) {
+			for ( a = 0; f->f_sub_any[ a ].bv_val != NULL; a++ ) {
+				bv.bv_len += f->f_sub_any[ a ].bv_len;
+			}
+		}
+		if ( f->f_sub_final.bv_val ) {
+			bv.bv_len += f->f_sub_final.bv_len;
+		}
+		bv.bv_len = 2 * bv.bv_len - 1;
+		bv.bv_val = ch_malloc( bv.bv_len + 1 );
+
+		s = 0;
+		if ( !BER_BVISNULL( &f->f_sub_initial ) ) {
+			bv.bv_val[ s ] = f->f_sub_initial.bv_val[ 0 ];
+			for ( i = 1; i < f->f_sub_initial.bv_len; i++ ) {
+				bv.bv_val[ s + 2 * i - 1 ] = '%';
+				bv.bv_val[ s + 2 * i ] = f->f_sub_initial.bv_val[ i ];
+			}
+			bv.bv_val[ s + 2 * i - 1 ] = '%';
+			s += 2 * i;
+		}
+
+		if ( f->f_sub_any != NULL ) {
+			for ( a = 0; !BER_BVISNULL( &f->f_sub_any[ a ] ); a++ ) {
+				bv.bv_val[ s ] = f->f_sub_any[ a ].bv_val[ 0 ];
+				for ( i = 1; i < f->f_sub_any[ a ].bv_len; i++ ) {
+					bv.bv_val[ s + 2 * i - 1 ] = '%';
+					bv.bv_val[ s + 2 * i ] = f->f_sub_any[ a ].bv_val[ i ];
+				}
+				bv.bv_val[ s + 2 * i - 1 ] = '%';
+				s += 2 * i;
+			}
+		}
+
+		if ( !BER_BVISNULL( &f->f_sub_final ) ) {
+			bv.bv_val[ s ] = f->f_sub_final.bv_val[ 0 ];
+			for ( i = 1; i < f->f_sub_final.bv_len; i++ ) {
+				bv.bv_val[ s + 2 * i - 1 ] = '%';
+				bv.bv_val[ s + 2 * i ] = f->f_sub_final.bv_val[ i ];
+			}
+				bv.bv_val[ s + 2 * i - 1 ] = '%';
+			s += 2 * i;
+		}
+
+		bv.bv_val[ s - 1 ] = '\0';
+
+		(void)backsql_process_filter_like( bsi, at, casefold, &bv );
+		ch_free( bv.bv_val );
+
+		return 1;
+	}
+
+	/*
+	 * When dealing with case-sensitive strings 
+	 * we may omit normalization; however, normalized
+	 * SQL filters are more liberal.
+	 */
+
+	backsql_strfcat_x( &bsi->bsi_flt_where,
+			bsi->bsi_op->o_tmpmemctx, "c", '(' /* ) */  );
+
+	/* TimesTen */
+	Debug( LDAP_DEBUG_TRACE, "backsql_process_sub_filter(%s):\n",
+		at->bam_ad->ad_cname.bv_val, 0, 0 );
+	Debug(LDAP_DEBUG_TRACE, "   expr: '%s%s%s'\n", at->bam_sel_expr.bv_val,
+		at->bam_sel_expr_u.bv_val ? "' '" : "",
+		at->bam_sel_expr_u.bv_val ? at->bam_sel_expr_u.bv_val : "" );
+	if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
+		/*
+		 * If a pre-upper-cased version of the column 
+		 * or a precompiled upper function exists, use it
+		 */
+		backsql_strfcat_x( &bsi->bsi_flt_where, 
+				bsi->bsi_op->o_tmpmemctx,
+				"bl",
+				&at->bam_sel_expr_u,
+				(ber_len_t)STRLENOF( " LIKE '" ),
+					" LIKE '" );
+
+	} else {
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"bl",
+				&at->bam_sel_expr,
+				(ber_len_t)STRLENOF( " LIKE '" ), " LIKE '" );
+	}
+ 
+	if ( !BER_BVISNULL( &f->f_sub_initial ) ) {
+		ber_len_t	start;
+
+#ifdef BACKSQL_TRACE
+		Debug( LDAP_DEBUG_TRACE, 
+			"==>backsql_process_sub_filter(%s): "
+			"sub_initial=\"%s\"\n", at->bam_ad->ad_cname.bv_val,
+			f->f_sub_initial.bv_val, 0 );
+#endif /* BACKSQL_TRACE */
+
+		start = bsi->bsi_flt_where.bb_val.bv_len;
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"b",
+				&f->f_sub_initial );
+		if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
+			ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
+		}
+	}
+
+	backsql_strfcat_x( &bsi->bsi_flt_where,
+			bsi->bsi_op->o_tmpmemctx,
+			"c", '%' );
+
+	if ( f->f_sub_any != NULL ) {
+		for ( i = 0; !BER_BVISNULL( &f->f_sub_any[ i ] ); i++ ) {
+			ber_len_t	start;
+
+#ifdef BACKSQL_TRACE
+			Debug( LDAP_DEBUG_TRACE, 
+				"==>backsql_process_sub_filter(%s): "
+				"sub_any[%d]=\"%s\"\n", at->bam_ad->ad_cname.bv_val, 
+				i, f->f_sub_any[ i ].bv_val );
+#endif /* BACKSQL_TRACE */
+
+			start = bsi->bsi_flt_where.bb_val.bv_len;
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"bc",
+					&f->f_sub_any[ i ],
+					'%' );
+			if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
+				/*
+				 * Note: toupper('%') = '%'
+				 */
+				ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
+			}
+		}
+	}
+
+	if ( !BER_BVISNULL( &f->f_sub_final ) ) {
+		ber_len_t	start;
+
+#ifdef BACKSQL_TRACE
+		Debug( LDAP_DEBUG_TRACE, 
+			"==>backsql_process_sub_filter(%s): "
+			"sub_final=\"%s\"\n", at->bam_ad->ad_cname.bv_val,
+			f->f_sub_final.bv_val, 0 );
+#endif /* BACKSQL_TRACE */
+
+		start = bsi->bsi_flt_where.bb_val.bv_len;
+    		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"b",
+				&f->f_sub_final );
+  		if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
+			ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
+		}
+	}
+
+	backsql_strfcat_x( &bsi->bsi_flt_where,
+			bsi->bsi_op->o_tmpmemctx,
+			"l", 
+			(ber_len_t)STRLENOF( /* (' */ "')" ), /* (' */ "')" );
+ 
+	return 1;
+}
+
+static int
+backsql_merge_from_tbls( backsql_srch_info *bsi, struct berval *from_tbls )
+{
+	if ( BER_BVISNULL( from_tbls ) ) {
+		return LDAP_SUCCESS;
+	}
+
+	if ( !BER_BVISNULL( &bsi->bsi_from.bb_val ) ) {
+		char		*start, *end;
+		struct berval	tmp;
+
+		ber_dupbv_x( &tmp, from_tbls, bsi->bsi_op->o_tmpmemctx );
+
+		for ( start = tmp.bv_val, end = strchr( start, ',' ); start; ) {
+			if ( end ) {
+				end[0] = '\0';
+			}
+
+			if ( strstr( bsi->bsi_from.bb_val.bv_val, start) == NULL )
+			{
+				backsql_strfcat_x( &bsi->bsi_from,
+						bsi->bsi_op->o_tmpmemctx,
+						"cs", ',', start );
+			}
+
+			if ( end ) {
+				/* in case there are spaces after the comma... */
+				for ( start = &end[1]; isspace( start[0] ); start++ );
+				if ( start[0] ) {
+					end = strchr( start, ',' );
+				} else {
+					start = NULL;
+				}
+			} else {
+				start = NULL;
+			}
+		}
+
+		bsi->bsi_op->o_tmpfree( tmp.bv_val, bsi->bsi_op->o_tmpmemctx );
+
+	} else {
+		backsql_strfcat_x( &bsi->bsi_from,
+				bsi->bsi_op->o_tmpmemctx,
+				"b", from_tbls );
+	}
+
+	return LDAP_SUCCESS;
+}
+
+static int
+backsql_process_filter( backsql_srch_info *bsi, Filter *f )
+{
+	backsql_at_map_rec	**vat = NULL;
+	AttributeDescription	*ad = NULL;
+	unsigned		i;
+	int 			done = 0;
+	int			rc = 0;
+
+	Debug( LDAP_DEBUG_TRACE, "==>backsql_process_filter()\n", 0, 0, 0 );
+	if ( f->f_choice == SLAPD_FILTER_COMPUTED ) {
+		struct berval	flt;
+		char		*msg = NULL;
+
+		switch ( f->f_result ) {
+		case LDAP_COMPARE_TRUE:
+			BER_BVSTR( &flt, "10=10" );
+			msg = "TRUE";
+			break;
+
+		case LDAP_COMPARE_FALSE:
+			BER_BVSTR( &flt, "11=0" );
+			msg = "FALSE";
+			break;
+
+		case SLAPD_COMPARE_UNDEFINED:
+			BER_BVSTR( &flt, "12=0" );
+			msg = "UNDEFINED";
+			break;
+
+		default:
+			rc = -1;
+			goto done;
+		}
+
+		Debug( LDAP_DEBUG_TRACE, "backsql_process_filter(): "
+			"filter computed (%s)\n", msg, 0, 0 );
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx, "b", &flt );
+		rc = 1;
+		goto done;
+	}
+
+	if ( f->f_choice & SLAPD_FILTER_UNDEFINED ) {
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+			bsi->bsi_op->o_tmpmemctx,
+			"l",
+			(ber_len_t)STRLENOF( "1=0" ), "1=0" );
+		done = 1;
+		rc = 1;
+		goto done;
+	}
+
+	switch( f->f_choice ) {
+	case LDAP_FILTER_OR:
+		rc = backsql_process_filter_list( bsi, f->f_or, 
+				LDAP_FILTER_OR );
+		done = 1;
+		break;
+		
+	case LDAP_FILTER_AND:
+		rc = backsql_process_filter_list( bsi, f->f_and,
+				LDAP_FILTER_AND );
+		done = 1;
+		break;
+
+	case LDAP_FILTER_NOT:
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"l",
+				(ber_len_t)STRLENOF( "NOT (" /* ) */ ),
+					"NOT (" /* ) */ );
+		rc = backsql_process_filter( bsi, f->f_not );
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"c", /* ( */ ')' );
+		done = 1;
+		break;
+
+	case LDAP_FILTER_PRESENT:
+		ad = f->f_desc;
+		break;
+		
+	case LDAP_FILTER_EXT:
+		ad = f->f_mra->ma_desc;
+		if ( f->f_mr_dnattrs ) {
+			/*
+			 * if dn attrs filtering is requested, better return 
+			 * success and let test_filter() deal with candidate
+			 * selection; otherwise we'd need to set conditions
+			 * on the contents of the DN, e.g. "SELECT ... FROM
+			 * ldap_entries AS attributeName WHERE attributeName.dn
+			 * like '%attributeName=value%'"
+			 */
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"l",
+					(ber_len_t)STRLENOF( "1=1" ), "1=1" );
+			bsi->bsi_status = LDAP_SUCCESS;
+			rc = 1;
+			goto done;
+		}
+		break;
+		
+	default:
+		ad = f->f_av_desc;
+		break;
+	}
+
+	if ( rc == -1 ) {
+		goto done;
+	}
+ 
+	if ( done ) {
+		rc = 1;
+		goto done;
+	}
+
+	/*
+	 * Turn structuralObjectClass into objectClass
+	 */
+	if ( ad == slap_schema.si_ad_objectClass 
+			|| ad == slap_schema.si_ad_structuralObjectClass )
+	{
+		/*
+		 * If the filter is LDAP_FILTER_PRESENT, then it's done;
+		 * otherwise, let's see if we are lucky: filtering
+		 * for "structural" objectclass or ancestor...
+		 */
+		switch ( f->f_choice ) {
+		case LDAP_FILTER_EQUALITY:
+		{
+			ObjectClass	*oc = oc_bvfind( &f->f_av_value );
+
+			if ( oc == NULL ) {
+				Debug( LDAP_DEBUG_TRACE,
+						"backsql_process_filter(): "
+						"unknown objectClass \"%s\" "
+						"in filter\n",
+						f->f_av_value.bv_val, 0, 0 );
+				bsi->bsi_status = LDAP_OTHER;
+				rc = -1;
+				goto done;
+			}
+
+			/*
+			 * "structural" objectClass inheritance:
+			 * - a search for "person" will also return 
+			 *   "inetOrgPerson"
+			 * - a search for "top" will return everything
+			 */
+			if ( is_object_subclass( oc, bsi->bsi_oc->bom_oc ) ) {
+				static struct berval ldap_entry_objclasses = BER_BVC( "ldap_entry_objclasses" );
+
+				backsql_merge_from_tbls( bsi, &ldap_entry_objclasses );
+
+				backsql_strfcat_x( &bsi->bsi_flt_where,
+						bsi->bsi_op->o_tmpmemctx,
+						"lbl",
+						(ber_len_t)STRLENOF( "(2=2 OR (ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entry_objclasses.oc_name='" /* ')) */ ),
+							"(2=2 OR (ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entry_objclasses.oc_name='" /* ')) */,
+						&bsi->bsi_oc->bom_oc->soc_cname,
+						(ber_len_t)STRLENOF( /* ((' */ "'))" ),
+							/* ((' */ "'))" );
+				bsi->bsi_status = LDAP_SUCCESS;
+				rc = 1;
+				goto done;
+			}
+
+			break;
+		}
+
+		case LDAP_FILTER_PRESENT:
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"l",
+					(ber_len_t)STRLENOF( "3=3" ), "3=3" );
+			bsi->bsi_status = LDAP_SUCCESS;
+			rc = 1;
+			goto done;
+
+			/* FIXME: LDAP_FILTER_EXT? */
+			
+		default:
+			Debug( LDAP_DEBUG_TRACE,
+					"backsql_process_filter(): "
+					"illegal/unhandled filter "
+					"on objectClass attribute",
+					0, 0, 0 );
+			bsi->bsi_status = LDAP_OTHER;
+			rc = -1;
+			goto done;
+		}
+
+	} else if ( ad == slap_schema.si_ad_entryUUID ) {
+		unsigned long	oc_id;
+#ifdef BACKSQL_ARBITRARY_KEY
+		struct berval	keyval;
+#else /* ! BACKSQL_ARBITRARY_KEY */
+		unsigned long	keyval;
+		char		keyvalbuf[LDAP_PVT_INTTYPE_CHARS(unsigned long)];
+#endif /* ! BACKSQL_ARBITRARY_KEY */
+
+		switch ( f->f_choice ) {
+		case LDAP_FILTER_EQUALITY:
+			backsql_entryUUID_decode( &f->f_av_value, &oc_id, &keyval );
+
+			if ( oc_id != bsi->bsi_oc->bom_id ) {
+				bsi->bsi_status = LDAP_SUCCESS;
+				rc = -1;
+				goto done;
+			}
+
+#ifdef BACKSQL_ARBITRARY_KEY
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"bcblbc",
+					&bsi->bsi_oc->bom_keytbl, '.',
+					&bsi->bsi_oc->bom_keycol,
+					STRLENOF( " LIKE '" ), " LIKE '",
+					&keyval, '\'' );
+#else /* ! BACKSQL_ARBITRARY_KEY */
+			snprintf( keyvalbuf, sizeof( keyvalbuf ), "%lu", keyval );
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"bcbcs",
+					&bsi->bsi_oc->bom_keytbl, '.',
+					&bsi->bsi_oc->bom_keycol, '=', keyvalbuf );
+#endif /* ! BACKSQL_ARBITRARY_KEY */
+			break;
+
+		case LDAP_FILTER_PRESENT:
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"l",
+					(ber_len_t)STRLENOF( "4=4" ), "4=4" );
+			break;
+
+		default:
+			rc = -1;
+			goto done;
+		}
+
+		bsi->bsi_flags |= BSQL_SF_FILTER_ENTRYUUID;
+		rc = 1;
+		goto done;
+
+#ifdef BACKSQL_SYNCPROV
+	} else if ( ad == slap_schema.si_ad_entryCSN ) {
+		/*
+		 * support for syncrepl as provider...
+		 */
+#if 0
+		if ( !bsi->bsi_op->o_sync ) {
+			/* unsupported at present... */
+			bsi->bsi_status = LDAP_OTHER;
+			rc = -1;
+			goto done;
+		}
+#endif
+
+		bsi->bsi_flags |= ( BSQL_SF_FILTER_ENTRYCSN | BSQL_SF_RETURN_ENTRYUUID);
+
+		/* if doing a syncrepl, try to return as much as possible,
+		 * and always match the filter */
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"l",
+				(ber_len_t)STRLENOF( "5=5" ), "5=5" );
+
+		/* save for later use in operational attributes */
+		/* FIXME: saves only the first occurrence, because 
+		 * the filter during updates is written as
+		 * "(&(entryCSN<={contextCSN})(entryCSN>={oldContextCSN})({filter}))"
+		 * so we want our fake entryCSN to match the greatest
+		 * value
+		 */
+		if ( bsi->bsi_op->o_private == NULL ) {
+			bsi->bsi_op->o_private = &f->f_av_value;
+		}
+		bsi->bsi_status = LDAP_SUCCESS;
+
+		rc = 1;
+		goto done;
+#endif /* BACKSQL_SYNCPROV */
+
+	} else if ( ad == slap_schema.si_ad_hasSubordinates || ad == NULL ) {
+		/*
+		 * FIXME: this is not robust; e.g. a filter
+		 * '(!(hasSubordinates=TRUE))' fails because
+		 * in SQL it would read 'NOT (1=1)' instead 
+		 * of no condition.  
+		 * Note however that hasSubordinates is boolean, 
+		 * so a more appropriate filter would be 
+		 * '(hasSubordinates=FALSE)'
+		 *
+		 * A more robust search for hasSubordinates
+		 * would * require joining the ldap_entries table
+		 * selecting if there are descendants of the
+		 * candidate.
+		 */
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"l",
+				(ber_len_t)STRLENOF( "6=6" ), "6=6" );
+		if ( ad == slap_schema.si_ad_hasSubordinates ) {
+			/*
+			 * instruct candidate selection algorithm
+			 * and attribute list to try to detect
+			 * if an entry has subordinates
+			 */
+			bsi->bsi_flags |= BSQL_SF_FILTER_HASSUBORDINATE;
+
+		} else {
+			/*
+			 * clear attributes to fetch, to require ALL
+			 * and try extended match on all attributes
+			 */
+			backsql_attrlist_add( bsi, NULL );
+		}
+		rc = 1;
+		goto done;
+	}
+
+	/*
+	 * attribute inheritance:
+	 */
+	if ( backsql_supad2at( bsi->bsi_oc, ad, &vat ) ) {
+		bsi->bsi_status = LDAP_OTHER;
+		rc = -1;
+		goto done;
+	}
+
+	if ( vat == NULL ) {
+		/* search anyway; other parts of the filter
+		 * may succeeed */
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"l",
+				(ber_len_t)STRLENOF( "7=7" ), "7=7" );
+		bsi->bsi_status = LDAP_SUCCESS;
+		rc = 1;
+		goto done;
+	}
+
+	/* if required, open extra level of parens */
+	done = 0;
+	if ( vat[0]->bam_next || vat[1] ) {
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"c", '(' );
+		done = 1;
+	}
+
+	i = 0;
+next:;
+	/* apply attr */
+	if ( backsql_process_filter_attr( bsi, f, vat[i] ) == -1 ) {
+		return -1;
+	}
+
+	/* if more definitions of the same attr, apply */
+	if ( vat[i]->bam_next ) {
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"l",
+			STRLENOF( " OR " ), " OR " );
+		vat[i] = vat[i]->bam_next;
+		goto next;
+	}
+
+	/* if more descendants of the same attr, apply */
+	i++;
+	if ( vat[i] ) {
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"l",
+			STRLENOF( " OR " ), " OR " );
+		goto next;
+	}
+
+	/* if needed, close extra level of parens */
+	if ( done ) {
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"c", ')' );
+	}
+
+	rc = 1;
+
+done:;
+	if ( vat ) {
+		ch_free( vat );
+	}
+
+	Debug( LDAP_DEBUG_TRACE,
+			"<==backsql_process_filter() %s\n",
+			rc == 1 ? "succeeded" : "failed", 0, 0);
+
+	return rc;
+}
+
+static int
+backsql_process_filter_eq( backsql_srch_info *bsi, backsql_at_map_rec *at,
+		int casefold, struct berval *filter_value )
+{
+	/*
+	 * maybe we should check type of at->sel_expr here somehow,
+	 * to know whether upper_func is applicable, but for now
+	 * upper_func stuff is made for Oracle, where UPPER is
+	 * safely applicable to NUMBER etc.
+	 */
+	if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
+		ber_len_t	start;
+
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"cbl",
+				'(', /* ) */
+				&at->bam_sel_expr_u, 
+				(ber_len_t)STRLENOF( "='" ),
+					"='" );
+
+		start = bsi->bsi_flt_where.bb_val.bv_len;
+
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"bl",
+				filter_value, 
+				(ber_len_t)STRLENOF( /* (' */ "')" ),
+					/* (' */ "')" );
+
+		ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
+
+	} else {
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"cblbl",
+				'(', /* ) */
+				&at->bam_sel_expr,
+				(ber_len_t)STRLENOF( "='" ), "='",
+				filter_value,
+				(ber_len_t)STRLENOF( /* (' */ "')" ),
+					/* (' */ "')" );
+	}
+
+	return 1;
+}
+	
+static int
+backsql_process_filter_like( backsql_srch_info *bsi, backsql_at_map_rec *at,
+		int casefold, struct berval *filter_value )
+{
+	/*
+	 * maybe we should check type of at->sel_expr here somehow,
+	 * to know whether upper_func is applicable, but for now
+	 * upper_func stuff is made for Oracle, where UPPER is
+	 * safely applicable to NUMBER etc.
+	 */
+	if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
+		ber_len_t	start;
+
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"cbl",
+				'(', /* ) */
+				&at->bam_sel_expr_u, 
+				(ber_len_t)STRLENOF( " LIKE '%" ),
+					" LIKE '%" );
+
+		start = bsi->bsi_flt_where.bb_val.bv_len;
+
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"bl",
+				filter_value, 
+				(ber_len_t)STRLENOF( /* (' */ "%')" ),
+					/* (' */ "%')" );
+
+		ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
+
+	} else {
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"cblbl",
+				'(', /* ) */
+				&at->bam_sel_expr,
+				(ber_len_t)STRLENOF( " LIKE '%" ),
+					" LIKE '%",
+				filter_value,
+				(ber_len_t)STRLENOF( /* (' */ "%')" ),
+					/* (' */ "%')" );
+	}
+
+	return 1;
+}
+
+static int
+backsql_process_filter_attr( backsql_srch_info *bsi, Filter *f, backsql_at_map_rec *at )
+{
+	backsql_info		*bi = (backsql_info *)bsi->bsi_op->o_bd->be_private;
+	int			casefold = 0;
+	struct berval		*filter_value = NULL;
+	MatchingRule		*matching_rule = NULL;
+	struct berval		ordering = BER_BVC("<=");
+
+	Debug( LDAP_DEBUG_TRACE, "==>backsql_process_filter_attr(%s)\n",
+		at->bam_ad->ad_cname.bv_val, 0, 0 );
+
+	/*
+	 * need to add this attribute to list of attrs to load,
+	 * so that we can do test_filter() later
+	 */
+	backsql_attrlist_add( bsi, at->bam_ad );
+
+	backsql_merge_from_tbls( bsi, &at->bam_from_tbls );
+
+	if ( !BER_BVISNULL( &at->bam_join_where )
+			&& strstr( bsi->bsi_join_where.bb_val.bv_val,
+				at->bam_join_where.bv_val ) == NULL )
+	{
+	       	backsql_strfcat_x( &bsi->bsi_join_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"lb",
+				(ber_len_t)STRLENOF( " AND " ), " AND ",
+				&at->bam_join_where );
+	}
+
+	if ( f->f_choice & SLAPD_FILTER_UNDEFINED ) {
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+			bsi->bsi_op->o_tmpmemctx,
+			"l",
+			(ber_len_t)STRLENOF( "1=0" ), "1=0" );
+		return 1;
+	}
+
+	switch ( f->f_choice ) {
+	case LDAP_FILTER_EQUALITY:
+		filter_value = &f->f_av_value;
+		matching_rule = at->bam_ad->ad_type->sat_equality;
+
+		goto equality_match;
+
+		/* fail over into next case */
+		
+	case LDAP_FILTER_EXT:
+		filter_value = &f->f_mra->ma_value;
+		matching_rule = f->f_mr_rule;
+
+equality_match:;
+		/* always uppercase strings by now */
+#ifdef BACKSQL_UPPERCASE_FILTER
+		if ( SLAP_MR_ASSOCIATED( matching_rule,
+					bi->sql_caseIgnoreMatch ) )
+#endif /* BACKSQL_UPPERCASE_FILTER */
+		{
+			casefold = 1;
+		}
+
+		/* FIXME: directoryString filtering should use a similar
+		 * approach to deal with non-prettified values like
+		 * " A  non    prettified   value  ", by using a LIKE
+		 * filter with all whitespaces collapsed to a single '%' */
+		if ( SLAP_MR_ASSOCIATED( matching_rule,
+					bi->sql_telephoneNumberMatch ) )
+		{
+			struct berval	bv;
+			ber_len_t	i;
+
+			/*
+			 * to check for matching telephone numbers
+			 * with intermized chars, e.g. val='1234'
+			 * use
+			 * 
+			 * val LIKE '%1%2%3%4%'
+			 */
+
+			bv.bv_len = 2 * filter_value->bv_len - 1;
+			bv.bv_val = ch_malloc( bv.bv_len + 1 );
+
+			bv.bv_val[ 0 ] = filter_value->bv_val[ 0 ];
+			for ( i = 1; i < filter_value->bv_len; i++ ) {
+				bv.bv_val[ 2 * i - 1 ] = '%';
+				bv.bv_val[ 2 * i ] = filter_value->bv_val[ i ];
+			}
+			bv.bv_val[ 2 * i - 1 ] = '\0';
+
+			(void)backsql_process_filter_like( bsi, at, casefold, &bv );
+			ch_free( bv.bv_val );
+
+			break;
+		}
+
+		/* NOTE: this is required by objectClass inheritance 
+		 * and auxiliary objectClass use in filters for slightly
+		 * more efficient candidate selection. */
+		/* FIXME: a bit too many specializations to deal with
+		 * very specific cases... */
+		if ( at->bam_ad == slap_schema.si_ad_objectClass
+				|| at->bam_ad == slap_schema.si_ad_structuralObjectClass )
+		{
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"lbl",
+					(ber_len_t)STRLENOF( "(ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entry_objclasses.oc_name='" /* ') */ ),
+						"(ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entry_objclasses.oc_name='" /* ') */,
+					filter_value,
+					(ber_len_t)STRLENOF( /* (' */ "')" ),
+						/* (' */ "')" );
+			break;
+		}
+
+		/*
+		 * maybe we should check type of at->sel_expr here somehow,
+		 * to know whether upper_func is applicable, but for now
+		 * upper_func stuff is made for Oracle, where UPPER is
+		 * safely applicable to NUMBER etc.
+		 */
+		(void)backsql_process_filter_eq( bsi, at, casefold, filter_value );
+		break;
+
+	case LDAP_FILTER_GE:
+		ordering.bv_val = ">=";
+
+		/* fall thru to next case */
+		
+	case LDAP_FILTER_LE:
+		filter_value = &f->f_av_value;
+		
+		/* always uppercase strings by now */
+#ifdef BACKSQL_UPPERCASE_FILTER
+		if ( at->bam_ad->ad_type->sat_ordering &&
+				SLAP_MR_ASSOCIATED( at->bam_ad->ad_type->sat_ordering,
+					bi->sql_caseIgnoreMatch ) )
+#endif /* BACKSQL_UPPERCASE_FILTER */
+		{
+			casefold = 1;
+		}
+
+		/*
+		 * FIXME: should we uppercase the operands?
+		 */
+		if ( casefold && BACKSQL_AT_CANUPPERCASE( at ) ) {
+			ber_len_t	start;
+
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"cbbc",
+					'(', /* ) */
+					&at->bam_sel_expr_u, 
+					&ordering,
+					'\'' );
+
+			start = bsi->bsi_flt_where.bb_val.bv_len;
+
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"bl",
+					filter_value, 
+					(ber_len_t)STRLENOF( /* (' */ "')" ),
+						/* (' */ "')" );
+
+			ldap_pvt_str2upper( &bsi->bsi_flt_where.bb_val.bv_val[ start ] );
+		
+		} else {
+			backsql_strfcat_x( &bsi->bsi_flt_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"cbbcbl",
+					'(' /* ) */ ,
+					&at->bam_sel_expr,
+					&ordering,
+					'\'',
+					&f->f_av_value,
+					(ber_len_t)STRLENOF( /* (' */ "')" ),
+						/* ( */ "')" );
+		}
+		break;
+
+	case LDAP_FILTER_PRESENT:
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"lbl",
+				(ber_len_t)STRLENOF( "NOT (" /* ) */),
+					"NOT (", /* ) */
+				&at->bam_sel_expr, 
+				(ber_len_t)STRLENOF( /* ( */ " IS NULL)" ),
+					/* ( */ " IS NULL)" );
+		break;
+
+	case LDAP_FILTER_SUBSTRINGS:
+		backsql_process_sub_filter( bsi, f, at );
+		break;
+
+	case LDAP_FILTER_APPROX:
+		/* we do our best */
+
+		/*
+		 * maybe we should check type of at->sel_expr here somehow,
+		 * to know whether upper_func is applicable, but for now
+		 * upper_func stuff is made for Oracle, where UPPER is
+		 * safely applicable to NUMBER etc.
+		 */
+		(void)backsql_process_filter_like( bsi, at, 1, &f->f_av_value );
+		break;
+
+	default:
+		/* unhandled filter type; should not happen */
+		assert( 0 );
+		backsql_strfcat_x( &bsi->bsi_flt_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"l",
+				(ber_len_t)STRLENOF( "8=8" ), "8=8" );
+		break;
+
+	}
+
+	Debug( LDAP_DEBUG_TRACE, "<==backsql_process_filter_attr(%s)\n",
+		at->bam_ad->ad_cname.bv_val, 0, 0 );
+
+	return 1;
+}
+
+static int
+backsql_srch_query( backsql_srch_info *bsi, struct berval *query )
+{
+	backsql_info		*bi = (backsql_info *)bsi->bsi_op->o_bd->be_private;
+	int			rc;
+
+	assert( query != NULL );
+	BER_BVZERO( query );
+
+	bsi->bsi_use_subtree_shortcut = 0;
+
+	Debug( LDAP_DEBUG_TRACE, "==>backsql_srch_query()\n", 0, 0, 0 );
+	BER_BVZERO( &bsi->bsi_sel.bb_val );
+	BER_BVZERO( &bsi->bsi_sel.bb_val );
+	bsi->bsi_sel.bb_len = 0;
+	BER_BVZERO( &bsi->bsi_from.bb_val );
+	bsi->bsi_from.bb_len = 0;
+	BER_BVZERO( &bsi->bsi_join_where.bb_val );
+	bsi->bsi_join_where.bb_len = 0;
+	BER_BVZERO( &bsi->bsi_flt_where.bb_val );
+	bsi->bsi_flt_where.bb_len = 0;
+
+	backsql_strfcat_x( &bsi->bsi_sel,
+			bsi->bsi_op->o_tmpmemctx,
+			"lbcbc",
+			(ber_len_t)STRLENOF( "SELECT DISTINCT ldap_entries.id," ),
+				"SELECT DISTINCT ldap_entries.id,", 
+			&bsi->bsi_oc->bom_keytbl, 
+			'.', 
+			&bsi->bsi_oc->bom_keycol, 
+			',' );
+
+	if ( !BER_BVISNULL( &bi->sql_strcast_func ) ) {
+		backsql_strfcat_x( &bsi->bsi_sel,
+				bsi->bsi_op->o_tmpmemctx,
+				"blbl",
+				&bi->sql_strcast_func, 
+				(ber_len_t)STRLENOF( "('" /* ') */ ),
+					"('" /* ') */ ,
+				&bsi->bsi_oc->bom_oc->soc_cname,
+				(ber_len_t)STRLENOF( /* (' */ "')" ),
+					/* (' */ "')" );
+	} else {
+		backsql_strfcat_x( &bsi->bsi_sel,
+				bsi->bsi_op->o_tmpmemctx,
+				"cbc",
+				'\'',
+				&bsi->bsi_oc->bom_oc->soc_cname,
+				'\'' );
+	}
+
+	backsql_strfcat_x( &bsi->bsi_sel,
+			bsi->bsi_op->o_tmpmemctx,
+			"b",
+			&bi->sql_dn_oc_aliasing );
+	backsql_strfcat_x( &bsi->bsi_from,
+			bsi->bsi_op->o_tmpmemctx,
+			"lb",
+			(ber_len_t)STRLENOF( " FROM ldap_entries," ),
+				" FROM ldap_entries,",
+			&bsi->bsi_oc->bom_keytbl );
+
+	backsql_strfcat_x( &bsi->bsi_join_where,
+			bsi->bsi_op->o_tmpmemctx,
+			"lbcbl",
+			(ber_len_t)STRLENOF( " WHERE " ), " WHERE ",
+			&bsi->bsi_oc->bom_keytbl,
+			'.',
+			&bsi->bsi_oc->bom_keycol,
+			(ber_len_t)STRLENOF( "=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND " ),
+				"=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND " );
+
+	switch ( bsi->bsi_scope ) {
+	case LDAP_SCOPE_BASE:
+		if ( BACKSQL_CANUPPERCASE( bi ) ) {
+			backsql_strfcat_x( &bsi->bsi_join_where,
+					bsi->bsi_op->o_tmpmemctx, 
+					"bl",
+					&bi->sql_upper_func,
+					(ber_len_t)STRLENOF( "(ldap_entries.dn)=?" ),
+						"(ldap_entries.dn)=?" );
+		} else {
+			backsql_strfcat_x( &bsi->bsi_join_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"l",
+					(ber_len_t)STRLENOF( "ldap_entries.dn=?" ),
+						"ldap_entries.dn=?" );
+		}
+		break;
+		
+	case BACKSQL_SCOPE_BASE_LIKE:
+		if ( BACKSQL_CANUPPERCASE( bi ) ) {
+			backsql_strfcat_x( &bsi->bsi_join_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"bl",
+					&bi->sql_upper_func,
+					(ber_len_t)STRLENOF( "(ldap_entries.dn) LIKE ?" ),
+						"(ldap_entries.dn) LIKE ?" );
+		} else {
+			backsql_strfcat_x( &bsi->bsi_join_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"l",
+					(ber_len_t)STRLENOF( "ldap_entries.dn LIKE ?" ),
+						"ldap_entries.dn LIKE ?" );
+		}
+		break;
+		
+	case LDAP_SCOPE_ONELEVEL:
+		backsql_strfcat_x( &bsi->bsi_join_where,
+				bsi->bsi_op->o_tmpmemctx,
+				"l",
+				(ber_len_t)STRLENOF( "ldap_entries.parent=?" ),
+					"ldap_entries.parent=?" );
+		break;
+
+	case LDAP_SCOPE_SUBORDINATE:
+	case LDAP_SCOPE_SUBTREE:
+		if ( BACKSQL_USE_SUBTREE_SHORTCUT( bi ) ) {
+			int		i;
+			BackendDB	*bd = bsi->bsi_op->o_bd;
+
+			assert( bd->be_nsuffix != NULL );
+
+			for ( i = 0; !BER_BVISNULL( &bd->be_nsuffix[ i ] ); i++ )
+			{
+				if ( dn_match( &bd->be_nsuffix[ i ],
+							bsi->bsi_base_ndn ) )
+				{
+					/* pass this to the candidate selection
+					 * routine so that the DN is not bound
+					 * to the select statement */
+					bsi->bsi_use_subtree_shortcut = 1;
+					break;
+				}
+			}
+		}
+
+		if ( bsi->bsi_use_subtree_shortcut ) {
+			/* Skip the base DN filter, as every entry will match it */
+			backsql_strfcat_x( &bsi->bsi_join_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"l",
+					(ber_len_t)STRLENOF( "9=9"), "9=9");
+
+		} else if ( !BER_BVISNULL( &bi->sql_subtree_cond ) ) {
+			/* This should always be true... */
+			backsql_strfcat_x( &bsi->bsi_join_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"b",
+					&bi->sql_subtree_cond );
+
+		} else if ( BACKSQL_CANUPPERCASE( bi ) ) {
+			backsql_strfcat_x( &bsi->bsi_join_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"bl",
+					&bi->sql_upper_func,
+					(ber_len_t)STRLENOF( "(ldap_entries.dn) LIKE ?" ),
+						"(ldap_entries.dn) LIKE ?"  );
+
+		} else {
+			backsql_strfcat_x( &bsi->bsi_join_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"l",
+					(ber_len_t)STRLENOF( "ldap_entries.dn LIKE ?" ),
+						"ldap_entries.dn LIKE ?" );
+		}
+
+		break;
+
+	default:
+		assert( 0 );
+	}
+
+#ifndef BACKSQL_ARBITRARY_KEY
+	/* If paged results are in effect, ignore low ldap_entries.id numbers */
+	if ( get_pagedresults(bsi->bsi_op) > SLAP_CONTROL_IGNORED ) {
+		unsigned long lowid = 0;
+
+		/* Pick up the previous ldap_entries.id if the previous page ended in this objectClass */
+		if ( bsi->bsi_oc->bom_id == PAGECOOKIE_TO_SQL_OC( ((PagedResultsState *)bsi->bsi_op->o_pagedresults_state)->ps_cookie ) )
+		{
+			lowid = PAGECOOKIE_TO_SQL_ID( ((PagedResultsState *)bsi->bsi_op->o_pagedresults_state)->ps_cookie );
+		}
+
+		if ( lowid ) {
+			char lowidstring[48];
+			int  lowidlen;
+
+			lowidlen = snprintf( lowidstring, sizeof( lowidstring ),
+				" AND ldap_entries.id>%lu", lowid );
+			backsql_strfcat_x( &bsi->bsi_join_where,
+					bsi->bsi_op->o_tmpmemctx,
+					"l",
+					(ber_len_t)lowidlen,
+					lowidstring );
+		}
+	}
+#endif /* ! BACKSQL_ARBITRARY_KEY */
+
+	rc = backsql_process_filter( bsi, bsi->bsi_filter );
+	if ( rc > 0 ) {
+		struct berbuf	bb = BB_NULL;
+
+		backsql_strfcat_x( &bb,
+				bsi->bsi_op->o_tmpmemctx,
+				"bbblb",
+				&bsi->bsi_sel.bb_val,
+				&bsi->bsi_from.bb_val, 
+				&bsi->bsi_join_where.bb_val,
+				(ber_len_t)STRLENOF( " AND " ), " AND ",
+				&bsi->bsi_flt_where.bb_val );
+
+		*query = bb.bb_val;
+
+	} else if ( rc < 0 ) {
+		/* 
+		 * Indicates that there's no possible way the filter matches
+		 * anything.  No need to issue the query
+		 */
+		free( query->bv_val );
+		BER_BVZERO( query );
+	}
+ 
+	bsi->bsi_op->o_tmpfree( bsi->bsi_sel.bb_val.bv_val, bsi->bsi_op->o_tmpmemctx );
+	BER_BVZERO( &bsi->bsi_sel.bb_val );
+	bsi->bsi_sel.bb_len = 0;
+	bsi->bsi_op->o_tmpfree( bsi->bsi_from.bb_val.bv_val, bsi->bsi_op->o_tmpmemctx );
+	BER_BVZERO( &bsi->bsi_from.bb_val );
+	bsi->bsi_from.bb_len = 0;
+	bsi->bsi_op->o_tmpfree( bsi->bsi_join_where.bb_val.bv_val, bsi->bsi_op->o_tmpmemctx );
+	BER_BVZERO( &bsi->bsi_join_where.bb_val );
+	bsi->bsi_join_where.bb_len = 0;
+	bsi->bsi_op->o_tmpfree( bsi->bsi_flt_where.bb_val.bv_val, bsi->bsi_op->o_tmpmemctx );
+	BER_BVZERO( &bsi->bsi_flt_where.bb_val );
+	bsi->bsi_flt_where.bb_len = 0;
+	
+	Debug( LDAP_DEBUG_TRACE, "<==backsql_srch_query() returns %s\n",
+		query->bv_val ? query->bv_val : "NULL", 0, 0 );
+	
+	return ( rc <= 0 ? 1 : 0 );
+}
+
+static int
+backsql_oc_get_candidates( void *v_oc, void *v_bsi )
+{
+	backsql_oc_map_rec	*oc = v_oc;
+	backsql_srch_info	*bsi = v_bsi;
+	Operation		*op = bsi->bsi_op;
+	backsql_info		*bi = (backsql_info *)bsi->bsi_op->o_bd->be_private;
+	struct berval		query;
+	SQLHSTMT		sth = SQL_NULL_HSTMT;
+	RETCODE			rc;
+	int			res;
+	BACKSQL_ROW_NTS		row;
+	int			i;
+	int			j;
+	int			n_candidates = bsi->bsi_n_candidates;
+
+	/* 
+	 * + 1 because we need room for '%';
+	 * + 1 because we need room for ',' for LDAP_SCOPE_SUBORDINATE;
+	 * this makes a subtree
+	 * search for a DN BACKSQL_MAX_DN_LEN long legal 
+	 * if it returns that DN only
+	 */
+	char			tmp_base_ndn[ BACKSQL_MAX_DN_LEN + 1 + 1 ];
+
+	bsi->bsi_status = LDAP_SUCCESS;
+ 
+	Debug( LDAP_DEBUG_TRACE, "==>backsql_oc_get_candidates(): oc=\"%s\"\n",
+			BACKSQL_OC_NAME( oc ), 0, 0 );
+
+	/* check for abandon */
+	if ( op->o_abandon ) {
+		bsi->bsi_status = SLAPD_ABANDON;
+		return BACKSQL_AVL_STOP;
+	}
+
+#ifndef BACKSQL_ARBITRARY_KEY
+	/* If paged results have already completed this objectClass, skip it */
+	if ( get_pagedresults(op) > SLAP_CONTROL_IGNORED ) {
+		if ( oc->bom_id < PAGECOOKIE_TO_SQL_OC( ((PagedResultsState *)op->o_pagedresults_state)->ps_cookie ) )
+		{
+			return BACKSQL_AVL_CONTINUE;
+		}
+	}
+#endif /* ! BACKSQL_ARBITRARY_KEY */
+
+	if ( bsi->bsi_n_candidates == -1 ) {
+		Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
+			"unchecked limit has been overcome\n", 0, 0, 0 );
+		/* should never get here */
+		assert( 0 );
+		bsi->bsi_status = LDAP_ADMINLIMIT_EXCEEDED;
+		return BACKSQL_AVL_STOP;
+	}
+	
+	bsi->bsi_oc = oc;
+	res = backsql_srch_query( bsi, &query );
+	if ( res ) {
+		Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
+			"error while constructing query for objectclass \"%s\"\n",
+			oc->bom_oc->soc_cname.bv_val, 0, 0 );
+		/*
+		 * FIXME: need to separate errors from legally
+		 * impossible filters
+		 */
+		switch ( bsi->bsi_status ) {
+		case LDAP_SUCCESS:
+		case LDAP_UNDEFINED_TYPE:
+		case LDAP_NO_SUCH_OBJECT:
+			/* we are conservative... */
+		default:
+			bsi->bsi_status = LDAP_SUCCESS;
+			/* try next */
+			return BACKSQL_AVL_CONTINUE;
+
+		case LDAP_ADMINLIMIT_EXCEEDED:
+		case LDAP_OTHER:
+			/* don't try any more */
+			return BACKSQL_AVL_STOP;
+		}
+	}
+
+	if ( BER_BVISNULL( &query ) ) {
+		Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
+			"could not construct query for objectclass \"%s\"\n",
+			oc->bom_oc->soc_cname.bv_val, 0, 0 );
+		bsi->bsi_status = LDAP_SUCCESS;
+		return BACKSQL_AVL_CONTINUE;
+	}
+
+	Debug( LDAP_DEBUG_TRACE, "Constructed query: %s\n", 
+			query.bv_val, 0, 0 );
+
+	rc = backsql_Prepare( bsi->bsi_dbh, &sth, query.bv_val, 0 );
+	bsi->bsi_op->o_tmpfree( query.bv_val, bsi->bsi_op->o_tmpmemctx );
+	BER_BVZERO( &query );
+	if ( rc != SQL_SUCCESS ) {
+		Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
+			"error preparing query\n", 0, 0, 0 );
+		backsql_PrintErrors( bi->sql_db_env, bsi->bsi_dbh, sth, rc );
+		bsi->bsi_status = LDAP_OTHER;
+		return BACKSQL_AVL_CONTINUE;
+	}
+	
+	Debug( LDAP_DEBUG_TRACE, "id: '" BACKSQL_IDNUMFMT "'\n",
+		bsi->bsi_oc->bom_id, 0, 0 );
+
+	rc = backsql_BindParamNumID( sth, 1, SQL_PARAM_INPUT,
+			&bsi->bsi_oc->bom_id );
+	if ( rc != SQL_SUCCESS ) {
+		Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
+			"error binding objectclass id parameter\n", 0, 0, 0 );
+		bsi->bsi_status = LDAP_OTHER;
+		return BACKSQL_AVL_CONTINUE;
+	}
+
+	switch ( bsi->bsi_scope ) {
+	case LDAP_SCOPE_BASE:
+	case BACKSQL_SCOPE_BASE_LIKE:
+		/*
+		 * We do not accept DNs longer than BACKSQL_MAX_DN_LEN;
+		 * however this should be handled earlier
+		 */
+		if ( bsi->bsi_base_ndn->bv_len > BACKSQL_MAX_DN_LEN ) {
+			bsi->bsi_status = LDAP_OTHER;
+			return BACKSQL_AVL_CONTINUE;
+		}
+
+		AC_MEMCPY( tmp_base_ndn, bsi->bsi_base_ndn->bv_val,
+				bsi->bsi_base_ndn->bv_len + 1 );
+
+		/* uppercase DN only if the stored DN can be uppercased
+		 * for comparison */
+		if ( BACKSQL_CANUPPERCASE( bi ) ) {
+			ldap_pvt_str2upper( tmp_base_ndn );
+		}
+
+		Debug( LDAP_DEBUG_TRACE, "(base)dn: \"%s\"\n",
+				tmp_base_ndn, 0, 0 );
+
+		rc = backsql_BindParamStr( sth, 2, SQL_PARAM_INPUT,
+				tmp_base_ndn, BACKSQL_MAX_DN_LEN );
+		if ( rc != SQL_SUCCESS ) {
+         		Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
+				"error binding base_ndn parameter\n", 0, 0, 0 );
+			backsql_PrintErrors( bi->sql_db_env, bsi->bsi_dbh, 
+					sth, rc );
+			bsi->bsi_status = LDAP_OTHER;
+			return BACKSQL_AVL_CONTINUE;
+		}
+		break;
+
+	case LDAP_SCOPE_SUBORDINATE:
+	case LDAP_SCOPE_SUBTREE:
+	{
+		/* if short-cutting the search base,
+		 * don't bind any parameter */
+		if ( bsi->bsi_use_subtree_shortcut ) {
+			break;
+		}
+		
+		/*
+		 * We do not accept DNs longer than BACKSQL_MAX_DN_LEN;
+		 * however this should be handled earlier
+		 */
+		if ( bsi->bsi_base_ndn->bv_len > BACKSQL_MAX_DN_LEN ) {
+			bsi->bsi_status = LDAP_OTHER;
+			return BACKSQL_AVL_CONTINUE;
+		}
+
+		/* 
+		 * Sets the parameters for the SQL built earlier
+		 * NOTE that all the databases could actually use 
+		 * the TimesTen version, which would be cleaner 
+		 * and would also eliminate the need for the
+		 * subtree_cond line in the configuration file.  
+		 * For now, I'm leaving it the way it is, 
+		 * so non-TimesTen databases use the original code.
+		 * But at some point this should get cleaned up.
+		 *
+		 * If "dn" is being used, do a suffix search.
+		 * If "dn_ru" is being used, do a prefix search.
+		 */
+		if ( BACKSQL_HAS_LDAPINFO_DN_RU( bi ) ) {
+			tmp_base_ndn[ 0 ] = '\0';
+
+			for ( i = 0, j = bsi->bsi_base_ndn->bv_len - 1;
+					j >= 0; i++, j--) {
+				tmp_base_ndn[ i ] = bsi->bsi_base_ndn->bv_val[ j ];
+			}
+
+			if ( bsi->bsi_scope == LDAP_SCOPE_SUBORDINATE ) {
+				tmp_base_ndn[ i++ ] = ',';
+			}
+
+			tmp_base_ndn[ i ] = '%';
+			tmp_base_ndn[ i + 1 ] = '\0';
+
+		} else {
+			i = 0;
+
+			tmp_base_ndn[ i++ ] = '%';
+
+			if ( bsi->bsi_scope == LDAP_SCOPE_SUBORDINATE ) {
+				tmp_base_ndn[ i++ ] = ',';
+			}
+
+			AC_MEMCPY( &tmp_base_ndn[ i ], bsi->bsi_base_ndn->bv_val,
+				bsi->bsi_base_ndn->bv_len + 1 );
+		}
+
+		/* uppercase DN only if the stored DN can be uppercased
+		 * for comparison */
+		if ( BACKSQL_CANUPPERCASE( bi ) ) {
+			ldap_pvt_str2upper( tmp_base_ndn );
+		}
+
+		if ( bsi->bsi_scope == LDAP_SCOPE_SUBORDINATE ) {
+			Debug( LDAP_DEBUG_TRACE, "(children)dn: \"%s\"\n",
+				tmp_base_ndn, 0, 0 );
+		} else {
+			Debug( LDAP_DEBUG_TRACE, "(sub)dn: \"%s\"\n",
+				tmp_base_ndn, 0, 0 );
+		}
+
+		rc = backsql_BindParamStr( sth, 2, SQL_PARAM_INPUT,
+				tmp_base_ndn, BACKSQL_MAX_DN_LEN );
+		if ( rc != SQL_SUCCESS ) {
+			Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
+				"error binding base_ndn parameter (2)\n",
+				0, 0, 0 );
+			backsql_PrintErrors( bi->sql_db_env, bsi->bsi_dbh, 
+					sth, rc );
+			bsi->bsi_status = LDAP_OTHER;
+			return BACKSQL_AVL_CONTINUE;
+		}
+		break;
+	}
+
+ 	case LDAP_SCOPE_ONELEVEL:
+		assert( !BER_BVISNULL( &bsi->bsi_base_id.eid_ndn ) );
+
+		Debug( LDAP_DEBUG_TRACE, "(one)id=" BACKSQL_IDFMT "\n",
+			BACKSQL_IDARG(bsi->bsi_base_id.eid_id), 0, 0 );
+		rc = backsql_BindParamID( sth, 2, SQL_PARAM_INPUT,
+				&bsi->bsi_base_id.eid_id );
+		if ( rc != SQL_SUCCESS ) {
+			Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
+				"error binding base id parameter\n", 0, 0, 0 );
+			bsi->bsi_status = LDAP_OTHER;
+			return BACKSQL_AVL_CONTINUE;
+		}
+		break;
+	}
+	
+	rc = SQLExecute( sth );
+	if ( !BACKSQL_SUCCESS( rc ) ) {
+		Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
+			"error executing query\n", 0, 0, 0 );
+		backsql_PrintErrors( bi->sql_db_env, bsi->bsi_dbh, sth, rc );
+		SQLFreeStmt( sth, SQL_DROP );
+		bsi->bsi_status = LDAP_OTHER;
+		return BACKSQL_AVL_CONTINUE;
+	}
+
+	backsql_BindRowAsStrings_x( sth, &row, bsi->bsi_op->o_tmpmemctx );
+	rc = SQLFetch( sth );
+	for ( ; BACKSQL_SUCCESS( rc ); rc = SQLFetch( sth ) ) {
+		struct berval		dn, pdn, ndn;
+		backsql_entryID		*c_id = NULL;
+		int			ret;
+
+		ber_str2bv( row.cols[ 3 ], 0, 0, &dn );
+
+		if ( backsql_api_odbc2dn( bsi->bsi_op, bsi->bsi_rs, &dn ) ) {
+			continue;
+		}
+
+		ret = dnPrettyNormal( NULL, &dn, &pdn, &ndn, op->o_tmpmemctx );
+		if ( dn.bv_val != row.cols[ 3 ] ) {
+			free( dn.bv_val );
+		}
+
+		if ( ret != LDAP_SUCCESS ) {
+			continue;
+		}
+
+		if ( bi->sql_baseObject && dn_match( &ndn, &bi->sql_baseObject->e_nname ) ) {
+			goto cleanup;
+		}
+
+		c_id = (backsql_entryID *)op->o_tmpcalloc( 1, 
+				sizeof( backsql_entryID ), op->o_tmpmemctx );
+#ifdef BACKSQL_ARBITRARY_KEY
+		ber_str2bv_x( row.cols[ 0 ], 0, 1, &c_id->eid_id,
+				op->o_tmpmemctx );
+		ber_str2bv_x( row.cols[ 1 ], 0, 1, &c_id->eid_keyval,
+				op->o_tmpmemctx );
+#else /* ! BACKSQL_ARBITRARY_KEY */
+		if ( BACKSQL_STR2ID( &c_id->eid_id, row.cols[ 0 ], 0 ) != 0 ) {
+			goto cleanup;
+		}
+		if ( BACKSQL_STR2ID( &c_id->eid_keyval, row.cols[ 1 ], 0 ) != 0 ) {
+			goto cleanup;
+		}
+#endif /* ! BACKSQL_ARBITRARY_KEY */
+		c_id->eid_oc = bsi->bsi_oc;
+		c_id->eid_oc_id = bsi->bsi_oc->bom_id;
+
+		c_id->eid_dn = pdn;
+		c_id->eid_ndn = ndn;
+
+		/* append at end of list ... */
+		c_id->eid_next = NULL;
+		*bsi->bsi_id_listtail = c_id;
+		bsi->bsi_id_listtail = &c_id->eid_next;
+
+		Debug( LDAP_DEBUG_TRACE, "backsql_oc_get_candidates(): "
+			"added entry id=" BACKSQL_IDFMT " keyval=" BACKSQL_IDFMT " dn=\"%s\"\n",
+			BACKSQL_IDARG(c_id->eid_id),
+			BACKSQL_IDARG(c_id->eid_keyval),
+			row.cols[ 3 ] );
+
+		/* count candidates, for unchecked limit */
+		bsi->bsi_n_candidates--;
+		if ( bsi->bsi_n_candidates == -1 ) {
+			break;
+		}
+		continue;
+
+cleanup:;
+		if ( !BER_BVISNULL( &pdn ) ) {
+			op->o_tmpfree( pdn.bv_val, op->o_tmpmemctx );
+		}
+		if ( !BER_BVISNULL( &ndn ) ) {
+			op->o_tmpfree( ndn.bv_val, op->o_tmpmemctx );
+		}
+		if ( c_id != NULL ) {
+			ch_free( c_id );
+		}
+	}
+	backsql_FreeRow_x( &row, bsi->bsi_op->o_tmpmemctx );
+	SQLFreeStmt( sth, SQL_DROP );
+
+	Debug( LDAP_DEBUG_TRACE, "<==backsql_oc_get_candidates(): %d\n",
+			n_candidates - bsi->bsi_n_candidates, 0, 0 );
+
+	return ( bsi->bsi_n_candidates == -1 ? BACKSQL_AVL_STOP : BACKSQL_AVL_CONTINUE );
+}
+
+int
+backsql_search( Operation *op, SlapReply *rs )
+{
+	backsql_info		*bi = (backsql_info *)op->o_bd->be_private;
+	SQLHDBC			dbh = SQL_NULL_HDBC;
+	int			sres;
+	Entry			user_entry = { 0 },
+				base_entry = { 0 };
+	int			manageDSAit = get_manageDSAit( op );
+	time_t			stoptime = 0;
+	backsql_srch_info	bsi = { 0 };
+	backsql_entryID		*eid = NULL;
+	struct berval		nbase = BER_BVNULL;
+#ifndef BACKSQL_ARBITRARY_KEY
+	ID			lastid = 0;
+#endif /* ! BACKSQL_ARBITRARY_KEY */
+
+	Debug( LDAP_DEBUG_TRACE, "==>backsql_search(): "
+		"base=\"%s\", filter=\"%s\", scope=%d,", 
+		op->o_req_ndn.bv_val,
+		op->ors_filterstr.bv_val,
+		op->ors_scope );
+	Debug( LDAP_DEBUG_TRACE, " deref=%d, attrsonly=%d, "
+		"attributes to load: %s\n",
+		op->ors_deref,
+		op->ors_attrsonly,
+		op->ors_attrs == NULL ? "all" : "custom list" );
+
+	if ( op->o_req_ndn.bv_len > BACKSQL_MAX_DN_LEN ) {
+		Debug( LDAP_DEBUG_TRACE, "backsql_search(): "
+			"search base length (%ld) exceeds max length (%d)\n", 
+			op->o_req_ndn.bv_len, BACKSQL_MAX_DN_LEN, 0 );
+		/*
+		 * FIXME: a LDAP_NO_SUCH_OBJECT could be appropriate
+		 * since it is impossible that such a long DN exists
+		 * in the backend
+		 */
+		rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
+		send_ldap_result( op, rs );
+		return 1;
+	}
+
+	sres = backsql_get_db_conn( op, &dbh );
+	if ( sres != LDAP_SUCCESS ) {
+		Debug( LDAP_DEBUG_TRACE, "backsql_search(): "
+			"could not get connection handle - exiting\n", 
+			0, 0, 0 );
+		rs->sr_err = sres;
+		rs->sr_text = sres == LDAP_OTHER ?  "SQL-backend error" : NULL;
+		send_ldap_result( op, rs );
+		return 1;
+	}
+
+	/* compute it anyway; root does not use it */
+	stoptime = op->o_time + op->ors_tlimit;
+
+	/* init search */
+	bsi.bsi_e = &base_entry;
+	rs->sr_err = backsql_init_search( &bsi, &op->o_req_ndn,
+			op->ors_scope,
+			stoptime, op->ors_filter,
+			dbh, op, rs, op->ors_attrs,
+			( BACKSQL_ISF_MATCHED | BACKSQL_ISF_GET_ENTRY ) );
+	switch ( rs->sr_err ) {
+	case LDAP_SUCCESS:
+		break;
+
+	case LDAP_REFERRAL:
+		if ( manageDSAit && !BER_BVISNULL( &bsi.bsi_e->e_nname ) &&
+				dn_match( &op->o_req_ndn, &bsi.bsi_e->e_nname ) )
+		{
+			rs->sr_err = LDAP_SUCCESS;
+			rs->sr_text = NULL;
+			rs->sr_matched = NULL;
+			if ( rs->sr_ref ) {
+				ber_bvarray_free( rs->sr_ref );
+				rs->sr_ref = NULL;
+			}
+			break;
+		}
+
+		/* an entry was created; free it */
+		entry_clean( bsi.bsi_e );
+
+		/* fall thru */
+
+	default:
+		if ( !BER_BVISNULL( &base_entry.e_nname )
+				&& !access_allowed( op, &base_entry,
+					slap_schema.si_ad_entry, NULL,
+					ACL_DISCLOSE, NULL ) )
+		{
+			rs->sr_err = LDAP_NO_SUCH_OBJECT;
+			if ( rs->sr_ref ) {
+				ber_bvarray_free( rs->sr_ref );
+				rs->sr_ref = NULL;
+			}
+			rs->sr_matched = NULL;
+			rs->sr_text = NULL;
+		}
+
+		send_ldap_result( op, rs );
+
+		if ( rs->sr_ref ) {
+			ber_bvarray_free( rs->sr_ref );
+			rs->sr_ref = NULL;
+		}
+
+		if ( !BER_BVISNULL( &base_entry.e_nname ) ) {
+			entry_clean( &base_entry );
+		}
+
+		goto done;
+	}
+	/* NOTE: __NEW__ "search" access is required
+	 * on searchBase object */
+	{
+		slap_mask_t	mask;
+		
+		if ( get_assert( op ) &&
+				( test_filter( op, &base_entry, get_assertion( op ) )
+				  != LDAP_COMPARE_TRUE ) )
+		{
+			rs->sr_err = LDAP_ASSERTION_FAILED;
+			
+		}
+		if ( ! access_allowed_mask( op, &base_entry,
+					slap_schema.si_ad_entry,
+					NULL, ACL_SEARCH, NULL, &mask ) )
+		{
+			if ( rs->sr_err == LDAP_SUCCESS ) {
+				rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
+			}
+		}
+
+		if ( rs->sr_err != LDAP_SUCCESS ) {
+			if ( !ACL_GRANT( mask, ACL_DISCLOSE ) ) {
+				rs->sr_err = LDAP_NO_SUCH_OBJECT;
+				rs->sr_text = NULL;
+			}
+			send_ldap_result( op, rs );
+			goto done;
+		}
+	}
+
+	bsi.bsi_e = NULL;
+
+	bsi.bsi_n_candidates =
+		( op->ors_limit == NULL	/* isroot == TRUE */ ? -2 : 
+		( op->ors_limit->lms_s_unchecked == -1 ? -2 :
+		( op->ors_limit->lms_s_unchecked ) ) );
+
+#ifndef BACKSQL_ARBITRARY_KEY
+	/* If paged results are in effect, check the paging cookie */
+	if ( get_pagedresults( op ) > SLAP_CONTROL_IGNORED ) {
+		rs->sr_err = parse_paged_cookie( op, rs );
+		if ( rs->sr_err != LDAP_SUCCESS ) {
+			send_ldap_result( op, rs );
+			goto done;
+		}
+	}
+#endif /* ! BACKSQL_ARBITRARY_KEY */
+
+	switch ( bsi.bsi_scope ) {
+	case LDAP_SCOPE_BASE:
+	case BACKSQL_SCOPE_BASE_LIKE:
+		/*
+		 * probably already found...
+		 */
+		bsi.bsi_id_list = &bsi.bsi_base_id;
+		bsi.bsi_id_listtail = &bsi.bsi_base_id.eid_next;
+		break;
+
+	case LDAP_SCOPE_SUBTREE:
+		/*
+		 * if baseObject is defined, and if it is the root 
+		 * of the search, add it to the candidate list
+		 */
+		if ( bi->sql_baseObject && BACKSQL_IS_BASEOBJECT_ID( &bsi.bsi_base_id.eid_id ) )
+		{
+			bsi.bsi_id_list = &bsi.bsi_base_id;
+			bsi.bsi_id_listtail = &bsi.bsi_base_id.eid_next;
+		}
+
+		/* FALLTHRU */
+	default:
+
+		/*
+		 * for each objectclass we try to construct query which gets IDs
+		 * of entries matching LDAP query filter and scope (or at least 
+		 * candidates), and get the IDs. Do this in ID order for paging.
+		 */
+		avl_apply( bi->sql_oc_by_id, backsql_oc_get_candidates,
+				&bsi, BACKSQL_AVL_STOP, AVL_INORDER );
+
+		/* check for abandon */
+		if ( op->o_abandon ) {
+			eid = bsi.bsi_id_list;
+			rs->sr_err = SLAPD_ABANDON;
+			goto send_results;
+		}
+	}
+
+	if ( op->ors_limit != NULL	/* isroot == FALSE */
+			&& op->ors_limit->lms_s_unchecked != -1
+			&& bsi.bsi_n_candidates == -1 )
+	{
+		rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
+		send_ldap_result( op, rs );
+		goto done;
+	}
+
+	/*
+	 * now we load candidate entries (only those attributes 
+	 * mentioned in attrs and filter), test it against full filter 
+	 * and then send to client; don't free entry_id if baseObject...
+	 */
+	for ( eid = bsi.bsi_id_list;
+		eid != NULL; 
+		eid = backsql_free_entryID( 
+			eid, eid == &bsi.bsi_base_id ? 0 : 1, op->o_tmpmemctx ) )
+	{
+		int		rc;
+		Attribute	*a_hasSubordinate = NULL,
+				*a_entryUUID = NULL,
+				*a_entryCSN = NULL,
+				**ap = NULL;
+		Entry		*e = NULL;
+
+		/* check for abandon */
+		if ( op->o_abandon ) {
+			rs->sr_err = SLAPD_ABANDON;
+			goto send_results;
+		}
+
+		/* check time limit */
+		if ( op->ors_tlimit != SLAP_NO_LIMIT
+				&& slap_get_time() > stoptime )
+		{
+			rs->sr_err = LDAP_TIMELIMIT_EXCEEDED;
+			rs->sr_ctrls = NULL;
+			rs->sr_ref = rs->sr_v2ref;
+			goto send_results;
+		}
+
+		Debug(LDAP_DEBUG_TRACE, "backsql_search(): loading data "
+			"for entry id=" BACKSQL_IDFMT " oc_id=" BACKSQL_IDNUMFMT ", keyval=" BACKSQL_IDFMT "\n",
+			BACKSQL_IDARG(eid->eid_id),
+			eid->eid_oc_id,
+			BACKSQL_IDARG(eid->eid_keyval) );
+
+		/* check scope */
+		switch ( op->ors_scope ) {
+		case LDAP_SCOPE_BASE:
+		case BACKSQL_SCOPE_BASE_LIKE:
+			if ( !dn_match( &eid->eid_ndn, &op->o_req_ndn ) ) {
+				goto next_entry2;
+			}
+			break;
+
+		case LDAP_SCOPE_ONE:
+		{
+			struct berval	rdn = eid->eid_ndn;
+
+			rdn.bv_len -= op->o_req_ndn.bv_len + STRLENOF( "," );
+			if ( !dnIsOneLevelRDN( &rdn ) ) {
+				goto next_entry2;
+			}
+			/* fall thru */
+		}
+
+		case LDAP_SCOPE_SUBORDINATE:
+			/* discard the baseObject entry */
+			if ( dn_match( &eid->eid_ndn, &op->o_req_ndn ) ) {
+				goto next_entry2;
+			}
+			/* FALLTHRU */
+		case LDAP_SCOPE_SUBTREE:
+			/* FIXME: this should never fail... */
+			if ( !dnIsSuffix( &eid->eid_ndn, &op->o_req_ndn ) ) {
+				goto next_entry2;
+			}
+			break;
+		}
+
+		if ( BACKSQL_IS_BASEOBJECT_ID( &eid->eid_id ) ) {
+			/* don't recollect baseObject... */
+			e = bi->sql_baseObject;
+
+		} else if ( eid == &bsi.bsi_base_id ) {
+			/* don't recollect searchBase object... */
+			e = &base_entry;
+
+		} else {
+			bsi.bsi_e = &user_entry;
+			rc = backsql_id2entry( &bsi, eid );
+			if ( rc != LDAP_SUCCESS ) {
+				Debug( LDAP_DEBUG_TRACE, "backsql_search(): "
+					"error %d in backsql_id2entry() "
+					"- skipping\n", rc, 0, 0 );
+				continue;
+			}
+			e = &user_entry;
+		}
+
+		if ( !manageDSAit &&
+				op->ors_scope != LDAP_SCOPE_BASE &&
+				op->ors_scope != BACKSQL_SCOPE_BASE_LIKE &&
+				is_entry_referral( e ) )
+		{
+			BerVarray refs;
+
+			refs = get_entry_referrals( op, e );
+			if ( !refs ) {
+				backsql_srch_info	bsi2 = { 0 };
+				Entry			user_entry2 = { 0 };
+
+				/* retry with the full entry... */
+				bsi2.bsi_e = &user_entry2;
+				rc = backsql_init_search( &bsi2,
+						&e->e_nname,
+						LDAP_SCOPE_BASE, 
+						(time_t)(-1), NULL,
+						dbh, op, rs, NULL,
+						BACKSQL_ISF_GET_ENTRY );
+				if ( rc == LDAP_SUCCESS ) {
+					if ( is_entry_referral( &user_entry2 ) )
+					{
+						refs = get_entry_referrals( op,
+								&user_entry2 );
+					} else {
+						rs->sr_err = LDAP_OTHER;
+					}
+					backsql_entry_clean( op, &user_entry2 );
+				}
+				if ( bsi2.bsi_attrs != NULL ) {
+					op->o_tmpfree( bsi2.bsi_attrs,
+							op->o_tmpmemctx );
+				}
+			}
+
+			if ( refs ) {
+				rs->sr_ref = referral_rewrite( refs,
+						&e->e_name,
+						&op->o_req_dn,
+						op->ors_scope );
+				ber_bvarray_free( refs );
+			}
+
+			if ( rs->sr_ref ) {
+				rs->sr_err = LDAP_REFERRAL;
+
+			} else {
+				rs->sr_text = "bad referral object";
+			}
+
+			rs->sr_entry = e;
+			rs->sr_matched = user_entry.e_name.bv_val;
+			send_search_reference( op, rs );
+
+			ber_bvarray_free( rs->sr_ref );
+			rs->sr_ref = NULL;
+			rs->sr_matched = NULL;
+			rs->sr_entry = NULL;
+			if ( rs->sr_err == LDAP_REFERRAL ) {
+				rs->sr_err = LDAP_SUCCESS;
+			}
+
+			goto next_entry;
+		}
+
+		/*
+		 * We use this flag since we need to parse the filter
+		 * anyway; we should have used the frontend API function
+		 * filter_has_subordinates()
+		 */
+		if ( bsi.bsi_flags & BSQL_SF_FILTER_HASSUBORDINATE ) {
+			rc = backsql_has_children( op, dbh, &e->e_nname );
+
+			switch ( rc ) {
+			case LDAP_COMPARE_TRUE:
+			case LDAP_COMPARE_FALSE:
+				a_hasSubordinate = slap_operational_hasSubordinate( rc == LDAP_COMPARE_TRUE );
+				if ( a_hasSubordinate != NULL ) {
+					for ( ap = &user_entry.e_attrs; 
+							*ap; 
+							ap = &(*ap)->a_next );
+
+					*ap = a_hasSubordinate;
+				}
+				rc = 0;
+				break;
+
+			default:
+				Debug(LDAP_DEBUG_TRACE, 
+					"backsql_search(): "
+					"has_children failed( %d)\n", 
+					rc, 0, 0 );
+				rc = 1;
+				goto next_entry;
+			}
+		}
+
+		if ( bsi.bsi_flags & BSQL_SF_FILTER_ENTRYUUID ) {
+			a_entryUUID = backsql_operational_entryUUID( bi, eid );
+			if ( a_entryUUID != NULL ) {
+				if ( ap == NULL ) {
+					ap = &user_entry.e_attrs;
+				}
+
+				for ( ; *ap; ap = &(*ap)->a_next );
+
+				*ap = a_entryUUID;
+			}
+		}
+
+#ifdef BACKSQL_SYNCPROV
+		if ( bsi.bsi_flags & BSQL_SF_FILTER_ENTRYCSN ) {
+			a_entryCSN = backsql_operational_entryCSN( op );
+			if ( a_entryCSN != NULL ) {
+				if ( ap == NULL ) {
+					ap = &user_entry.e_attrs;
+				}
+
+				for ( ; *ap; ap = &(*ap)->a_next );
+
+				*ap = a_entryCSN;
+			}
+		}
+#endif /* BACKSQL_SYNCPROV */
+
+		if ( test_filter( op, e, op->ors_filter ) == LDAP_COMPARE_TRUE )
+		{
+#ifndef BACKSQL_ARBITRARY_KEY
+			/* If paged results are in effect, see if the page limit was exceeded */
+			if ( get_pagedresults(op) > SLAP_CONTROL_IGNORED ) {
+				if ( rs->sr_nentries >= ((PagedResultsState *)op->o_pagedresults_state)->ps_size )
+				{
+					e = NULL;
+					send_paged_response( op, rs, &lastid );
+					goto done;
+				}
+				lastid = SQL_TO_PAGECOOKIE( eid->eid_id, eid->eid_oc_id );
+			}
+#endif /* ! BACKSQL_ARBITRARY_KEY */
+			rs->sr_attrs = op->ors_attrs;
+			rs->sr_operational_attrs = NULL;
+			rs->sr_entry = e;
+			e->e_private = (void *)eid;
+			rs->sr_flags = ( e == &user_entry ) ? REP_ENTRY_MODIFIABLE : 0;
+			/* FIXME: need the whole entry (ITS#3480) */
+			rs->sr_err = send_search_entry( op, rs );
+			e->e_private = NULL;
+			rs->sr_entry = NULL;
+			rs->sr_attrs = NULL;
+			rs->sr_operational_attrs = NULL;
+
+			switch ( rs->sr_err ) {
+			case LDAP_UNAVAILABLE:
+				/*
+				 * FIXME: send_search_entry failed;
+				 * better stop
+				 */
+				Debug( LDAP_DEBUG_TRACE, "backsql_search(): "
+					"connection lost\n", 0, 0, 0 );
+				goto end_of_search;
+
+			case LDAP_SIZELIMIT_EXCEEDED:
+			case LDAP_BUSY:
+				goto send_results;
+			}
+		}
+
+next_entry:;
+		if ( e == &user_entry ) {
+			backsql_entry_clean( op, &user_entry );
+		}
+
+next_entry2:;
+	}
+
+end_of_search:;
+	if ( rs->sr_nentries > 0 ) {
+		rs->sr_ref = rs->sr_v2ref;
+		rs->sr_err = (rs->sr_v2ref == NULL) ? LDAP_SUCCESS
+			: LDAP_REFERRAL;
+
+	} else {
+		rs->sr_err = bsi.bsi_status;
+	}
+
+send_results:;
+	if ( rs->sr_err != SLAPD_ABANDON ) {
+#ifndef BACKSQL_ARBITRARY_KEY
+		if ( get_pagedresults(op) > SLAP_CONTROL_IGNORED ) {
+			send_paged_response( op, rs, NULL );
+		} else
+#endif /* ! BACKSQL_ARBITRARY_KEY */
+		{
+			send_ldap_result( op, rs );
+		}
+	}
+
+	/* cleanup in case of abandon */
+	for ( ; eid != NULL; 
+		eid = backsql_free_entryID(
+			eid, eid == &bsi.bsi_base_id ? 0 : 1, op->o_tmpmemctx ) )
+		;
+
+	backsql_entry_clean( op, &base_entry );
+
+	/* in case we got here accidentally */
+	backsql_entry_clean( op, &user_entry );
+
+	if ( rs->sr_v2ref ) {
+		ber_bvarray_free( rs->sr_v2ref );
+		rs->sr_v2ref = NULL;
+	}
+
+#ifdef BACKSQL_SYNCPROV
+	if ( op->o_sync ) {
+		Operation	op2 = *op;
+		SlapReply	rs2 = { REP_RESULT };
+		Entry		*e = entry_alloc();
+		slap_callback	cb = { 0 };
+
+		op2.o_tag = LDAP_REQ_ADD;
+		op2.o_bd = select_backend( &op->o_bd->be_nsuffix[0], 0 );
+		op2.ora_e = e;
+		op2.o_callback = &cb;
+
+		ber_dupbv( &e->e_name, op->o_bd->be_suffix );
+		ber_dupbv( &e->e_nname, op->o_bd->be_nsuffix );
+
+		cb.sc_response = slap_null_cb;
+
+		op2.o_bd->be_add( &op2, &rs2 );
+
+		if ( op2.ora_e == e )
+			entry_free( e );
+	}
+#endif /* BACKSQL_SYNCPROV */
+
+done:;
+	(void)backsql_free_entryID( &bsi.bsi_base_id, 0, op->o_tmpmemctx );
+
+	if ( bsi.bsi_attrs != NULL ) {
+		op->o_tmpfree( bsi.bsi_attrs, op->o_tmpmemctx );
+	}
+
+	if ( !BER_BVISNULL( &nbase )
+			&& nbase.bv_val != op->o_req_ndn.bv_val )
+	{
+		ch_free( nbase.bv_val );
+	}
+
+	/* restore scope ... FIXME: this should be done before ANY
+	 * frontend call that uses op */
+	if ( op->ors_scope == BACKSQL_SCOPE_BASE_LIKE ) {
+		op->ors_scope = LDAP_SCOPE_BASE;
+	}
+
+	Debug( LDAP_DEBUG_TRACE, "<==backsql_search()\n", 0, 0, 0 );
+
+	return rs->sr_err;
+}
+
+/* return LDAP_SUCCESS IFF we can retrieve the specified entry.
+ */
+int
+backsql_entry_get(
+		Operation		*op,
+		struct berval		*ndn,
+		ObjectClass		*oc,
+		AttributeDescription	*at,
+		int			rw,
+		Entry			**ent )
+{
+	backsql_srch_info	bsi = { 0 };
+	SQLHDBC			dbh = SQL_NULL_HDBC;
+	int			rc;
+	SlapReply		rs = { 0 };
+	AttributeName		anlist[ 2 ];
+
+	*ent = NULL;
+
+	rc = backsql_get_db_conn( op, &dbh );
+	if ( rc != LDAP_SUCCESS ) {
+		return rc;
+	}
+
+	if ( at ) {
+		anlist[ 0 ].an_name = at->ad_cname;
+		anlist[ 0 ].an_desc = at;
+		BER_BVZERO( &anlist[ 1 ].an_name );
+	}
+
+	bsi.bsi_e = entry_alloc();
+	rc = backsql_init_search( &bsi,
+			ndn,
+			LDAP_SCOPE_BASE, 
+			(time_t)(-1), NULL,
+			dbh, op, &rs, at ? anlist : NULL,
+			BACKSQL_ISF_GET_ENTRY );
+
+	if ( !BER_BVISNULL( &bsi.bsi_base_id.eid_ndn ) ) {
+		(void)backsql_free_entryID( &bsi.bsi_base_id, 0, op->o_tmpmemctx );
+	}
+
+	if ( rc == LDAP_SUCCESS ) {
+
+#if 0 /* not supported at present */
+		/* find attribute values */
+		if ( is_entry_alias( bsi.bsi_e ) ) {
+			Debug( LDAP_DEBUG_ACL,
+				"<= backsql_entry_get: entry is an alias\n",
+				0, 0, 0 );
+			rc = LDAP_ALIAS_PROBLEM;
+			goto return_results;
+		}
+#endif
+
+		if ( is_entry_referral( bsi.bsi_e ) ) {
+			Debug( LDAP_DEBUG_ACL,
+				"<= backsql_entry_get: entry is a referral\n",
+				0, 0, 0 );
+			rc = LDAP_REFERRAL;
+			goto return_results;
+		}
+
+		if ( oc && !is_entry_objectclass( bsi.bsi_e, oc, 0 ) ) {
+			Debug( LDAP_DEBUG_ACL,
+					"<= backsql_entry_get: "
+					"failed to find objectClass\n",
+					0, 0, 0 ); 
+			rc = LDAP_NO_SUCH_ATTRIBUTE;
+			goto return_results;
+		}
+
+		*ent = bsi.bsi_e;
+	}
+
+return_results:;
+	if ( bsi.bsi_attrs != NULL ) {
+		op->o_tmpfree( bsi.bsi_attrs, op->o_tmpmemctx );
+	}
+
+	if ( rc != LDAP_SUCCESS ) {
+		if ( bsi.bsi_e ) {
+			entry_free( bsi.bsi_e );
+		}
+	}
+
+	return rc;
+}
+
+void
+backsql_entry_clean(
+		Operation	*op,
+		Entry		*e )
+{
+	void *ctx;
+
+	ctx = ldap_pvt_thread_pool_context();
+
+	if ( ctx == NULL || ctx != op->o_tmpmemctx ) {
+		if ( !BER_BVISNULL( &e->e_name ) ) {
+			op->o_tmpfree( e->e_name.bv_val, op->o_tmpmemctx );
+			BER_BVZERO( &e->e_name );
+		}
+
+		if ( !BER_BVISNULL( &e->e_nname ) ) {
+			op->o_tmpfree( e->e_nname.bv_val, op->o_tmpmemctx );
+			BER_BVZERO( &e->e_nname );
+		}
+	}
+
+	entry_clean( e );
+}
+
+int
+backsql_entry_release(
+		Operation	*op,
+		Entry		*e,
+		int		rw )
+{
+	backsql_entry_clean( op, e );
+
+	entry_free( e );
+
+	return 0;
+}
+
+#ifndef BACKSQL_ARBITRARY_KEY
+/* This function is copied verbatim from back-bdb/search.c */
+static int
+parse_paged_cookie( Operation *op, SlapReply *rs )
+{
+	int		rc = LDAP_SUCCESS;
+	PagedResultsState *ps = op->o_pagedresults_state;
+
+	/* this function must be invoked only if the pagedResults
+	 * control has been detected, parsed and partially checked
+	 * by the frontend */
+	assert( get_pagedresults( op ) > SLAP_CONTROL_IGNORED );
+
+	/* cookie decoding/checks deferred to backend... */
+	if ( ps->ps_cookieval.bv_len ) {
+		PagedResultsCookie reqcookie;
+		if( ps->ps_cookieval.bv_len != sizeof( reqcookie ) ) {
+			/* bad cookie */
+			rs->sr_text = "paged results cookie is invalid";
+			rc = LDAP_PROTOCOL_ERROR;
+			goto done;
+		}
+
+		AC_MEMCPY( &reqcookie, ps->ps_cookieval.bv_val, sizeof( reqcookie ));
+
+		if ( reqcookie > ps->ps_cookie ) {
+			/* bad cookie */
+			rs->sr_text = "paged results cookie is invalid";
+			rc = LDAP_PROTOCOL_ERROR;
+			goto done;
+
+		} else if ( reqcookie < ps->ps_cookie ) {
+			rs->sr_text = "paged results cookie is invalid or old";
+			rc = LDAP_UNWILLING_TO_PERFORM;
+			goto done;
+		}
+
+	} else {
+		/* Initial request.  Initialize state. */
+		ps->ps_cookie = 0;
+		ps->ps_count = 0;
+	}
+
+done:;
+
+	return rc;
+}
+
+/* This function is copied nearly verbatim from back-bdb/search.c */
+static void
+send_paged_response( 
+	Operation	*op,
+	SlapReply	*rs,
+	ID		*lastid )
+{
+	LDAPControl	ctrl, *ctrls[2];
+	BerElementBuffer berbuf;
+	BerElement	*ber = (BerElement *)&berbuf;
+	PagedResultsCookie respcookie;
+	struct berval cookie;
+
+	Debug(LDAP_DEBUG_ARGS,
+		"send_paged_response: lastid=0x%08lx nentries=%d\n", 
+		lastid ? *lastid : 0, rs->sr_nentries, NULL );
+
+	BER_BVZERO( &ctrl.ldctl_value );
+	ctrls[0] = &ctrl;
+	ctrls[1] = NULL;
+
+	ber_init2( ber, NULL, LBER_USE_DER );
+
+	if ( lastid ) {
+		respcookie = ( PagedResultsCookie )(*lastid);
+		cookie.bv_len = sizeof( respcookie );
+		cookie.bv_val = (char *)&respcookie;
+
+	} else {
+		respcookie = ( PagedResultsCookie )0;
+		BER_BVSTR( &cookie, "" );
+	}
+
+	op->o_conn->c_pagedresults_state.ps_cookie = respcookie;
+	op->o_conn->c_pagedresults_state.ps_count =
+		((PagedResultsState *)op->o_pagedresults_state)->ps_count +
+		rs->sr_nentries;
+
+	/* return size of 0 -- no estimate */
+	ber_printf( ber, "{iO}", 0, &cookie ); 
+
+	if ( ber_flatten2( ber, &ctrls[0]->ldctl_value, 0 ) == -1 ) {
+		goto done;
+	}
+
+	ctrls[0]->ldctl_oid = LDAP_CONTROL_PAGEDRESULTS;
+	ctrls[0]->ldctl_iscritical = 0;
+
+	rs->sr_ctrls = ctrls;
+	rs->sr_err = LDAP_SUCCESS;
+	send_ldap_result( op, rs );
+	rs->sr_ctrls = NULL;
+
+done:
+	(void) ber_free_buf( ber );
+}
+#endif /* ! BACKSQL_ARBITRARY_KEY */