/*
 * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
 *
 * The contents of this file are subject to the Netscape Public License
 * Version 1.0 (the "NPL"); you may not use this file except in
 * compliance with the NPL.  You may obtain a copy of the NPL at
 * http://www.mozilla.org/NPL/
 *
 * Software distributed under the NPL is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the NPL
 * for the specific language governing rights and limitations under the
 * NPL.
 *
 * The Initial Developer of this code under the NPL is Netscape
 * Communications Corporation.  Portions created by Netscape are
 * Copyright (C) 1998 Netscape Communications Corporation.  All Rights
 * Reserved.
 */
#include "ldap-int.h"

struct ldaperror {
	int	e_code;
	char	*e_reason;
};

#ifdef _SOLARIS_SDK
#include <synch.h>
static struct ldaperror ldap_errlist[] = {
	{ LDAP_SUCCESS, 			0 },
	{ LDAP_OPERATIONS_ERROR, 		0 },
	{ LDAP_PROTOCOL_ERROR, 			0 },
	{ LDAP_TIMELIMIT_EXCEEDED,		0 },
	{ LDAP_SIZELIMIT_EXCEEDED, 		0 },
	{ LDAP_COMPARE_FALSE, 			0 },
	{ LDAP_COMPARE_TRUE, 			0 },
	{ LDAP_STRONG_AUTH_NOT_SUPPORTED,	0 },
	{ LDAP_STRONG_AUTH_REQUIRED, 		0 },
	{ LDAP_PARTIAL_RESULTS, 		0 },
	{ LDAP_REFERRAL, 			0 },
	{ LDAP_ADMINLIMIT_EXCEEDED,		0 },
	{ LDAP_UNAVAILABLE_CRITICAL_EXTENSION,	0 },
	{ LDAP_CONFIDENTIALITY_REQUIRED,	0 },
	{ LDAP_SASL_BIND_IN_PROGRESS,		0 },

	{ LDAP_NO_SUCH_ATTRIBUTE, 		0 },
	{ LDAP_UNDEFINED_TYPE, 			0 },
	{ LDAP_INAPPROPRIATE_MATCHING, 		0 },
	{ LDAP_CONSTRAINT_VIOLATION, 		0 },
	{ LDAP_TYPE_OR_VALUE_EXISTS, 		0 },
	{ LDAP_INVALID_SYNTAX, 			0 },

	{ LDAP_NO_SUCH_OBJECT, 			0 },
	{ LDAP_ALIAS_PROBLEM, 			0 },
	{ LDAP_INVALID_DN_SYNTAX,		0 },
	{ LDAP_IS_LEAF, 			0 },
	{ LDAP_ALIAS_DEREF_PROBLEM, 		0 },

	{ LDAP_INAPPROPRIATE_AUTH, 		0 },
	{ LDAP_INVALID_CREDENTIALS, 		0 },
	{ LDAP_INSUFFICIENT_ACCESS, 		0 },
	{ LDAP_BUSY, 				0 },
	{ LDAP_UNAVAILABLE, 			0 },
	{ LDAP_UNWILLING_TO_PERFORM, 		0 },
	{ LDAP_LOOP_DETECT, 			0 },
	{ LDAP_SORT_CONTROL_MISSING,    	0 },
	{ LDAP_INDEX_RANGE_ERROR,		0 },

	{ LDAP_NAMING_VIOLATION, 		0 },
	{ LDAP_OBJECT_CLASS_VIOLATION, 		0 },
	{ LDAP_NOT_ALLOWED_ON_NONLEAF, 		0 },
	{ LDAP_NOT_ALLOWED_ON_RDN, 		0 },
	{ LDAP_ALREADY_EXISTS, 			0 },
	{ LDAP_NO_OBJECT_CLASS_MODS, 		0 },
	{ LDAP_RESULTS_TOO_LARGE,		0 },
	{ LDAP_AFFECTS_MULTIPLE_DSAS,		0 },

	{ LDAP_OTHER, 				0 },
	{ LDAP_SERVER_DOWN,			0 },
	{ LDAP_LOCAL_ERROR,			0 },
	{ LDAP_ENCODING_ERROR,			0 },
	{ LDAP_DECODING_ERROR,			0 },
	{ LDAP_TIMEOUT,				0 },
	{ LDAP_AUTH_UNKNOWN,			0 },
	{ LDAP_FILTER_ERROR,			0 },
	{ LDAP_USER_CANCELLED,			0 },
	{ LDAP_PARAM_ERROR,			0 },
	{ LDAP_NO_MEMORY,			0 },
	{ LDAP_CONNECT_ERROR,			0 },
	{ LDAP_NOT_SUPPORTED,			0 },
	{ LDAP_CONTROL_NOT_FOUND,		0 },
	{ LDAP_NO_RESULTS_RETURNED,		0 },
	{ LDAP_MORE_RESULTS_TO_RETURN,		0 },
	{ LDAP_CLIENT_LOOP,			0 },
	{ LDAP_REFERRAL_LIMIT_EXCEEDED,		0 },
	{ -1, 0 }
};
const int last_index = sizeof(ldap_errlist)/sizeof(ldap_errlist[0]) - 2;
#else
static struct ldaperror ldap_errlist[] = {
	{ LDAP_SUCCESS, 			"Success" },
	{ LDAP_OPERATIONS_ERROR, 		"Operations error" },
	{ LDAP_PROTOCOL_ERROR, 			"Protocol error" },
	{ LDAP_TIMELIMIT_EXCEEDED,		"Timelimit exceeded" },
	{ LDAP_SIZELIMIT_EXCEEDED, 		"Sizelimit exceeded" },
	{ LDAP_COMPARE_FALSE, 			"Compare false" },
	{ LDAP_COMPARE_TRUE, 			"Compare true" },
	{ LDAP_STRONG_AUTH_NOT_SUPPORTED,	"Authentication method not supported" },
	{ LDAP_STRONG_AUTH_REQUIRED, 		"Strong authentication required" },
	{ LDAP_PARTIAL_RESULTS, 		"Partial results and referral received" },
	{ LDAP_REFERRAL, 			"Referral received" },
	{ LDAP_ADMINLIMIT_EXCEEDED,		"Administrative limit exceeded" },
	{ LDAP_UNAVAILABLE_CRITICAL_EXTENSION,	"Unavailable critical extension" },
	{ LDAP_CONFIDENTIALITY_REQUIRED,	"Confidentiality required" },
	{ LDAP_SASL_BIND_IN_PROGRESS,		"SASL bind in progress" },

	{ LDAP_NO_SUCH_ATTRIBUTE, 		"No such attribute" },
	{ LDAP_UNDEFINED_TYPE, 			"Undefined attribute type" },
	{ LDAP_INAPPROPRIATE_MATCHING, 		"Inappropriate matching" },
	{ LDAP_CONSTRAINT_VIOLATION, 		"Constraint violation" },
	{ LDAP_TYPE_OR_VALUE_EXISTS, 		"Type or value exists" },
	{ LDAP_INVALID_SYNTAX, 			"Invalid syntax" },

	{ LDAP_NO_SUCH_OBJECT, 			"No such object" },
	{ LDAP_ALIAS_PROBLEM, 			"Alias problem" },
	{ LDAP_INVALID_DN_SYNTAX,		"Invalid DN syntax" },
	{ LDAP_IS_LEAF, 			"Object is a leaf" },
	{ LDAP_ALIAS_DEREF_PROBLEM, 		"Alias dereferencing problem" },

	{ LDAP_INAPPROPRIATE_AUTH, 		"Inappropriate authentication" },
	{ LDAP_INVALID_CREDENTIALS, 		"Invalid credentials" },
	{ LDAP_INSUFFICIENT_ACCESS, 		"Insufficient access" },
	{ LDAP_BUSY, 				"DSA is busy" },
	{ LDAP_UNAVAILABLE, 			"DSA is unavailable" },
	{ LDAP_UNWILLING_TO_PERFORM, 		"DSA is unwilling to perform" },
	{ LDAP_LOOP_DETECT, 			"Loop detected" },
    { LDAP_SORT_CONTROL_MISSING,    "Sort Control is missing"  },
    { LDAP_INDEX_RANGE_ERROR,              "Search results exceed the range specified by the offsets" },

    { LDAP_NAMING_VIOLATION, 		"Naming violation" },
	{ LDAP_OBJECT_CLASS_VIOLATION, 		"Object class violation" },
	{ LDAP_NOT_ALLOWED_ON_NONLEAF, 		"Operation not allowed on nonleaf" },
	{ LDAP_NOT_ALLOWED_ON_RDN, 		"Operation not allowed on RDN" },
	{ LDAP_ALREADY_EXISTS, 			"Already exists" },
	{ LDAP_NO_OBJECT_CLASS_MODS, 		"Cannot modify object class" },
	{ LDAP_RESULTS_TOO_LARGE,		"Results too large" },
	{ LDAP_AFFECTS_MULTIPLE_DSAS,		"Affects multiple servers" },

	{ LDAP_OTHER, 				"Unknown error" },
	{ LDAP_SERVER_DOWN,			"Can't contact LDAP server" },
	{ LDAP_LOCAL_ERROR,			"Local error" },
	{ LDAP_ENCODING_ERROR,			"Encoding error" },
	{ LDAP_DECODING_ERROR,			"Decoding error" },
	{ LDAP_TIMEOUT,				"Timed out" },
	{ LDAP_AUTH_UNKNOWN,			"Unknown authentication method" },
	{ LDAP_FILTER_ERROR,			"Bad search filter" },
	{ LDAP_USER_CANCELLED,			"User cancelled operation" },
	{ LDAP_PARAM_ERROR,			"Bad parameter to an ldap routine" },
	{ LDAP_NO_MEMORY,			"Out of memory" },
	{ LDAP_CONNECT_ERROR,			"Can't connect to the LDAP server" },
	{ LDAP_NOT_SUPPORTED,			"Not supported by this version of the LDAP protocol" },
	{ LDAP_CONTROL_NOT_FOUND,		"Requested LDAP control not found" },
	{ LDAP_NO_RESULTS_RETURNED,		"No results returned" },
	{ LDAP_MORE_RESULTS_TO_RETURN,		"More results to return" },
	{ LDAP_CLIENT_LOOP,			"Client detected loop" },
	{ LDAP_REFERRAL_LIMIT_EXCEEDED,		"Referral hop limit exceeded" },
	{ -1, 0 }
};
#endif

#ifdef _SOLARIS_SDK
static mutex_t		err_mutex = DEFAULTMUTEX;

static void fill_ldap_errlist()
{
	int i=0;
	mutex_lock(&err_mutex);

	LDAPDebug(LDAP_DEBUG_TRACE, "fill_ldap_errlist\n", 0, 0, 0 );

	if (ldap_errlist[last_index].e_reason != NULL) {
		mutex_unlock(&err_mutex);
		return;
	}

	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Success");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Operations error");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Protocol error");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Timelimit exceeded");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Sizelimit exceeded");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Compare false");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Compare true");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Authentication method not supported");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Strong authentication required");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Partial results and referral received");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Referral received");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Administrative limit exceeded");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Unavailable critical extension");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Confidentiality required");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"SASL bind in progress");

	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"No such attribute");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Undefined attribute type");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Inappropriate matching");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Constraint violation");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Type or value exists");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Invalid syntax");

	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "No such object");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Alias problem");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Invalid DN syntax");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Object is a leaf");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Alias dereferencing problem");

	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Inappropriate authentication");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Invalid credentials");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Insufficient access");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "DSA is busy");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"DSA is unavailable");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"DSA is unwilling to perform");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Loop detected");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Sort Control is missing");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
		"Search results exceed the range specified by the offsets");

	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Naming violation");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Object class violation");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Operation not allowed on nonleaf");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Operation not allowed on RDN");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Already exists");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Cannot modify object class");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Results too large");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Affects multiple servers");

	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Unknown error");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Can't contact LDAP server");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Local error");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Encoding error");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Decoding error");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Timed out");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Unknown authentication method");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Bad search filter");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"User cancelled operation");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Bad parameter to an ldap routine");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN, "Out of memory");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Can't connect to the LDAP server");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
			"Not supported by this version of the LDAP protocol");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Requested LDAP control not found");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"No results returned");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"More results to return");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Client detected loop");
	ldap_errlist[i++].e_reason = dgettext(TEXT_DOMAIN,
				"Referral hop limit exceeded");
	mutex_unlock(&err_mutex);
}
#endif

char *
LDAP_CALL
ldap_err2string( int err )
{
	int	i;

	LDAPDebug( LDAP_DEBUG_TRACE, "ldap_err2string\n", 0, 0, 0 );

#ifdef _SOLARIS_SDK
	/* Make sure errlist is initialized before referencing err string */
	if (ldap_errlist[last_index].e_reason == NULL)
		fill_ldap_errlist();
#endif

	for ( i = 0; ldap_errlist[i].e_code != -1; i++ ) {
		if ( err == ldap_errlist[i].e_code )
			return( ldap_errlist[i].e_reason );
	}

	return( dgettext(TEXT_DOMAIN, "Unknown error") );
}


static char *
nsldapi_safe_strerror( int e )
{
	char *s;

	if (( s = strerror( e )) == NULL ) {
		s = dgettext(TEXT_DOMAIN, "unknown error");
	}

	return( s );
}


void
LDAP_CALL
ldap_perror( LDAP *ld, const char *s )
{
	int	i, err;
	char	*matched, *errmsg, *separator;
	char    msg[1024];

	LDAPDebug( LDAP_DEBUG_TRACE, "ldap_perror\n", 0, 0, 0 );

#ifdef _SOLARIS_SDK
	/* Make sure errlist is initialized before referencing err string */
	if (ldap_errlist[last_index].e_reason == NULL)
		fill_ldap_errlist();
#endif

	if ( s == NULL ) {
		s = separator = "";
	} else {
		separator = ": ";
	}

	if ( ld == NULL ) {
		sprintf( msg, "%s%s%s", s, separator,
		    nsldapi_safe_strerror( errno ) );
		ber_err_print( msg );
		return;
	}

	LDAP_MUTEX_LOCK( ld, LDAP_ERR_LOCK );
	err = LDAP_GET_LDERRNO( ld, &matched, &errmsg );
	for ( i = 0; ldap_errlist[i].e_code != -1; i++ ) {
		if ( err == ldap_errlist[i].e_code ) {
			sprintf( msg, "%s%s%s", s, separator,
				    ldap_errlist[i].e_reason );
			ber_err_print( msg );
			if ( err == LDAP_CONNECT_ERROR ) {
				ber_err_print( " - " );
				ber_err_print( nsldapi_safe_strerror(
				    LDAP_GET_ERRNO( ld )));
			}
			ber_err_print( "\n" );
			if ( matched != NULL && *matched != '\0' ) {
				sprintf( msg, dgettext(TEXT_DOMAIN,
					"%s%smatched: %s\n"),
				    s, separator, matched );
				ber_err_print( msg );
			}
			if ( errmsg != NULL && *errmsg != '\0' ) {
				sprintf( msg, dgettext(TEXT_DOMAIN,
					"%s%sadditional info: %s\n"),
				    s, separator, errmsg );
				ber_err_print( msg );
			}
			LDAP_MUTEX_UNLOCK( ld, LDAP_ERR_LOCK );
			return;
		}
	}
	sprintf( msg, dgettext(TEXT_DOMAIN, "%s%sNot an LDAP errno %d\n"),
		s, separator, err );
	ber_err_print( msg );
	LDAP_MUTEX_UNLOCK( ld, LDAP_ERR_LOCK );
}

int
LDAP_CALL
ldap_result2error( LDAP *ld, LDAPMessage *r, int freeit )
{
	int	lderr_parse, lderr;

	lderr_parse = ldap_parse_result( ld, r, &lderr, NULL, NULL, NULL,
	    NULL, freeit );

	if ( lderr_parse != LDAP_SUCCESS ) {
		return( lderr_parse );
	}

	return( lderr );
}

int
LDAP_CALL
ldap_get_lderrno( LDAP *ld, char **m, char **s )
{
	if ( !NSLDAPI_VALID_LDAP_POINTER( ld )) {
		return( LDAP_PARAM_ERROR );	/* punt */
	}

	if ( ld->ld_get_lderrno_fn == NULL ) {
		if ( m != NULL ) {
			*m = ld->ld_matched;
		}
		if ( s != NULL ) {
			*s = ld->ld_error;
		}
		return( ld->ld_errno );
	} else {
		return( ld->ld_get_lderrno_fn( m, s, ld->ld_lderrno_arg ) );
	}
}


/*
 * Note: there is no need for callers of ldap_set_lderrno() to lock the
 * ld mutex.  If applications intend to share an LDAP session handle
 * between threads they *must* perform their own locking around the
 * session handle or they must install a "set lderrno" thread callback
 * function.
 *
 */
int
LDAP_CALL
ldap_set_lderrno( LDAP *ld, int e, char *m, char *s )
{
	if ( !NSLDAPI_VALID_LDAP_POINTER( ld )) {
		return( LDAP_PARAM_ERROR );
	}

	if ( ld->ld_set_lderrno_fn != NULL ) {
		ld->ld_set_lderrno_fn( e, m, s, ld->ld_lderrno_arg );
	} else {
        LDAP_MUTEX_LOCK( ld, LDAP_ERR_LOCK );
		ld->ld_errno = e;
		if ( ld->ld_matched ) {
			NSLDAPI_FREE( ld->ld_matched );
		}
		ld->ld_matched = m;
		if ( ld->ld_error ) {
			NSLDAPI_FREE( ld->ld_error );
		}
		ld->ld_error = s;
        LDAP_MUTEX_UNLOCK( ld, LDAP_ERR_LOCK );
	}

	return( LDAP_SUCCESS );
}


/*
 * Returns an LDAP error that says whether parse succeeded.  The error code
 * from the LDAP result itself is returned in the errcodep result parameter.
 * If any of the result params. (errcodep, matchednp, errmsgp, referralsp,
 * or serverctrlsp) are NULL we don't return that info.
 */
int
LDAP_CALL
ldap_parse_result( LDAP *ld, LDAPMessage *res, int *errcodep, char **matchednp,
	char **errmsgp, char ***referralsp, LDAPControl ***serverctrlsp,
	int freeit )
{
	LDAPMessage		*lm;
	int			err, errcode;
	char			*m, *e;

	LDAPDebug( LDAP_DEBUG_TRACE, "ldap_parse_result\n", 0, 0, 0 );

	if ( !NSLDAPI_VALID_LDAP_POINTER( ld ) ||
	    !NSLDAPI_VALID_LDAPMESSAGE_POINTER( res )) {
		return( LDAP_PARAM_ERROR );
	}

	/* skip over entries and references to find next result in this chain */
	for ( lm = res; lm != NULL; lm = lm->lm_chain ) {
		if ( lm->lm_msgtype != LDAP_RES_SEARCH_ENTRY &&
		    lm->lm_msgtype != LDAP_RES_SEARCH_REFERENCE ) {
			break;
		}
	}

	if ( lm == NULL ) {
		err = LDAP_NO_RESULTS_RETURNED;
		LDAP_SET_LDERRNO( ld, err, NULL, NULL );
		return( err );
	}

	err = nsldapi_parse_result( ld, lm->lm_msgtype, lm->lm_ber, &errcode,
	    &m, &e, referralsp, serverctrlsp );

	if ( err == LDAP_SUCCESS ) {
		if ( errcodep != NULL ) {
			*errcodep = errcode;
		}
		if ( matchednp != NULL ) {
			*matchednp = nsldapi_strdup( m );
		}
		if ( errmsgp != NULL ) {
			*errmsgp = nsldapi_strdup( e );
		}

		/*
		 * if there are more result messages in the chain, arrange to
		 * return the special LDAP_MORE_RESULTS_TO_RETURN "error" code.
		 */
		for ( lm = lm->lm_chain; lm != NULL; lm = lm->lm_chain ) {
			if ( lm->lm_msgtype != LDAP_RES_SEARCH_ENTRY &&
			    lm->lm_msgtype != LDAP_RES_SEARCH_REFERENCE ) {
				err = LDAP_MORE_RESULTS_TO_RETURN;
				break;
			}
		}
	} else {
		m = e = NULL;
	}

	if ( freeit ) {
		ldap_msgfree( res );
	}

	LDAP_SET_LDERRNO( ld, ( err == LDAP_SUCCESS ) ? errcode : err, m, e );

	return( err );
}


/*
 * returns an LDAP error code indicating success or failure of parsing
 * does NOT set any error information inside "ld"
 */
int
nsldapi_parse_result( LDAP *ld, int msgtype, BerElement *rber, int *errcodep,
    char **matchednp, char **errmsgp, char ***referralsp,
    LDAPControl ***serverctrlsp )
{
	BerElement	ber;
	ber_len_t	len;
	int		berrc, err, errcode;
	ber_int_t	along;
	char		*m, *e;

	/*
	 * Parse the result message.  LDAPv3 result messages look like this:
	 *
	 *	LDAPResult ::= SEQUENCE {
	 *		resultCode	ENUMERATED { ... },
	 *		matchedDN	LDAPDN,
	 *		errorMessage	LDAPString,
	 *		referral	[3] Referral OPTIONAL
	 *		opSpecificStuff	OPTIONAL
	 *	}
	 *
	 * all wrapped up in an LDAPMessage sequence which looks like this:
	 *	LDAPMessage ::= SEQUENCE {
	 *		messageID	MessageID,
	 *		LDAPResult	CHOICE { ... },	// message type
	 *		controls	[0] Controls OPTIONAL
	 *	}
	 *
	 * LDAPv2 messages don't include referrals or controls.
	 * LDAPv1 messages don't include matchedDN, referrals, or controls.
	 *
	 * ldap_result() pulls out the message id, so by the time a result
	 * message gets here we are sitting at the start of the LDAPResult.
	 */

	err = LDAP_SUCCESS;	/* optimistic */
	m = e = NULL;
	if ( matchednp != NULL ) {
		*matchednp = NULL;
	}
	if ( errmsgp != NULL ) {
		*errmsgp = NULL;
	}
	if ( referralsp != NULL ) {
		*referralsp = NULL;
	}
	if ( serverctrlsp != NULL ) {
		*serverctrlsp = NULL;
	}
	ber = *rber;		/* struct copy */

	if ( NSLDAPI_LDAP_VERSION( ld ) < LDAP_VERSION2 ) {
		berrc = ber_scanf( &ber, "{ia}", &along, &e );
		errcode = (int)along;	/* XXX lossy cast */
	} else {
		if (( berrc = ber_scanf( &ber, "{iaa", &along, &m, &e ))
		    != LBER_ERROR ) {
			errcode = (int)along;	/* XXX lossy cast */
			/* check for optional referrals */
			if ( ber_peek_tag( &ber, &len ) == LDAP_TAG_REFERRAL ) {
				if ( referralsp == NULL ) {
					/* skip referrals */
					berrc = ber_scanf( &ber, "x" );
				} else {
					/* suck out referrals */
					berrc = ber_scanf( &ber, "v",
					    referralsp );
				}
			} else if ( referralsp != NULL ) {
				*referralsp = NULL;
			}
		}

		if ( berrc != LBER_ERROR ) {
			/*
			 * skip past optional operation-specific elements:
			 *   bind results - serverSASLcreds
			 *   extendedop results -  OID plus value
			 */
			if ( msgtype == LDAP_RES_BIND ) {
				if ( ber_peek_tag( &ber, &len ) ==
				    LDAP_TAG_SASL_RES_CREDS ) {
					berrc = ber_scanf( &ber, "x" );
				}
			} else if ( msgtype == LDAP_RES_EXTENDED ) {
				if ( ber_peek_tag( &ber, &len ) ==
				    LDAP_TAG_EXOP_RES_OID ) {
					berrc = ber_scanf( &ber, "x" );
				}
				if ( berrc != LBER_ERROR &&
				    ber_peek_tag( &ber, &len ) ==
				    LDAP_TAG_EXOP_RES_VALUE ) {
					berrc = ber_scanf( &ber, "x" );
				}
			}
		}

		/* pull out controls (if requested and any are present) */
		if ( berrc != LBER_ERROR && serverctrlsp != NULL &&
		    ( berrc = ber_scanf( &ber, "}" )) != LBER_ERROR ) {
			err = nsldapi_get_controls( &ber, serverctrlsp );
		}
	}

	if ( berrc == LBER_ERROR && err == LDAP_SUCCESS ) {
		err = LDAP_DECODING_ERROR;
	}

	if ( errcodep != NULL ) {
		*errcodep = errcode;
	}
	if ( matchednp != NULL ) {
		*matchednp = m;
	} else if ( m != NULL ) {
		NSLDAPI_FREE( m );
	}
	if ( errmsgp != NULL ) {
		*errmsgp = e;
	} else if ( e != NULL ) {
		NSLDAPI_FREE( e );
	}

	return( err );
}