lib/libnisdb/ldap_val.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2015 Gary Mills
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */


#include <lber.h>
#include <ldap.h>
#include <strings.h>
#include <errno.h>

#include "nisdb_mt.h"

#include "ldap_util.h"
#include "ldap_op.h"
#include "ldap_ruleval.h"
#include "ldap_attr.h"
#include "ldap_val.h"
#include "ldap_ldap.h"

extern int yp2ldap;


__nis_mapping_format_t *
cloneMappingFormat(__nis_mapping_format_t *m) {
	__nis_mapping_format_t	*new;
	int			i, nf, err;
	char			*myself = "cloneMappingFormat";

	if (m == 0)
		return (0);

	for (nf = 0; m[nf].type != mmt_end; nf++);
	nf++;

	new = am(myself, nf * sizeof (new[0]));
	if (new == 0)
		return (0);

	/* Copy the whole array */
	memcpy(new, m, nf * sizeof (new[0]));

	/* Make copies of allocated stuff */
	for (i = 0, err = 0; i < nf; i++) {
		switch (m[i].type) {
		case mmt_string:
			new[i].match.string = sdup(myself, T,
							m[i].match.string);
			if (new[i].match.string == 0 && m[i].match.string != 0)
				err++;
			break;
		case mmt_single:
			new[i].match.single.lo =
				am(myself, m[i].match.single.numRange *
					sizeof (new[i].match.single.lo[0]));
			new[i].match.single.hi =
				am(myself, m[i].match.single.numRange *
					sizeof (new[i].match.single.hi[0]));
			if (new[i].match.single.lo != 0)
				memcpy(new[i].match.single.lo,
					m[i].match.single.lo,
					m[i].match.single.numRange);
			else if (m[i].match.single.lo != 0)
				err++;
			if (new[i].match.single.hi != 0)
				memcpy(new[i].match.single.hi,
					m[i].match.single.hi,
					m[i].match.single.numRange);
			else if (m[i].match.single.hi != 0)
				err++;
			break;
		case mmt_berstring:
			new[i].match.berString = sdup(myself, T,
							m[i].match.berString);
			if (new[i].match.berString == 0 &&
					m[i].match.berString != 0)
				err++;
			break;
		case mmt_item:
		case mmt_limit:
		case mmt_any:
		case mmt_begin:
		case mmt_end:
		default:
			break;
		}
	}

	/* If there were memory allocation errors, free the copy */
	if (err > 0) {
		freeMappingFormat(new);
		new = 0;
	}

	return (new);
}

void
freeMappingFormat(__nis_mapping_format_t *m) {
	int	i;

	if (m == 0)
		return;

	for (i = 0; m[i].type != mmt_end; i++) {
		switch (m[i].type) {
		case mmt_string:
			sfree(m[i].match.string);
			break;
		case mmt_single:
			sfree(m[i].match.single.lo);
			sfree(m[i].match.single.hi);
			break;
		case mmt_berstring:
			sfree(m[i].match.berString);
			break;
		case mmt_item:
		case mmt_limit:
		case mmt_any:
		case mmt_begin:
		case mmt_end:
		default:
			break;
		}
	}

	free(m);
}


void
copyIndex(__nis_index_t *old, __nis_index_t *new, int *err) {
	int	i;
	char	*myself = "copyIndex";

	if (old == 0 || new == 0) {
		*err = EINVAL;
		return;
	}

	for (i = 0; i < old->numIndexes; i++) {
		new->name[i] = sdup(myself, T, old->name[i]);
		if (new->name[i] == 0 && old->name[i] != 0) {
			*err = ENOMEM;
			return;
		}
		new->value[i] = cloneMappingFormat(old->value[i]);
		if (new->value[i] == 0 && old->value[i] != 0) {
			*err = ENOMEM;
			return;
		}
	}

	new->numIndexes = old->numIndexes;
}

__nis_index_t *
cloneIndex(__nis_index_t *old) {
	char		*myself = "cloneIndex";
	int		err = 0;
	__nis_index_t	*new = am(myself, sizeof (*new));

	if (old == 0)
		return (0);

	if (new != 0) {
		copyIndex(old, new, &err);
		if (err != 0) {
			freeIndex(new, 1);
			new = 0;
		}
	}

	return (new);
}

void
freeIndex(__nis_index_t *old, bool_t doFree) {
	int	i;

	if (old == 0)
		return;

	for (i = 0; i < old->numIndexes; i++) {
		sfree(old->name[i]);
		freeMappingFormat(old->value[i]);
	}

	if (doFree)
		free(old);
}

char **
cloneName(char **name, int numNames) {
	char	**new;
	int	i;
	char	*myself = "cloneName";

	if (name == 0 || numNames <= 0)
		return (0);

	new = am(myself, numNames * sizeof (new[0]));
	if (new == 0)
		return (0);

	for (i = 0; i < numNames; i++) {
		if (name[i] != 0) {
			new[i] = sdup(myself, T, name[i]);
			if (new[i] == 0) {
				for (i--; i >= 0; i--) {
					sfree(new[i]);
				}
				sfree(new);
				return (0);
			}
		} else {
			new[i] = 0;
		}
	}

	return (new);
}

void
freeValue(__nis_value_t *val, int count) {
	int	c, i;

	if (val == 0)
		return;

	for (c = 0; c < count; c++) {
		if (val[c].val != 0) {
			for (i = 0; i < val[c].numVals; i++) {
				sfree(val[c].val[i].value);
			}
			free(val[c].val);
		}
	}

	free(val);
}

__nis_value_t *
cloneValue(__nis_value_t *val, int count) {
	__nis_value_t	*n;
	int		c, i;
	char		*myself = "cloneValue";

	if (count <= 0 || val == 0)
		return (0);

	n = am(myself, count * sizeof (*n));
	if (n == 0)
		return (0);

	for (c = 0; c < count; c++) {
		n[c].type = val[c].type;
		n[c].repeat = val[c].repeat;
		n[c].numVals = val[c].numVals;
		if (n[c].numVals > 0) {
			n[c].val = am(myself, n[c].numVals *
						sizeof (n[c].val[0]));
			if (n[c].val == 0) {
				freeValue(n, c);
				return (0);
			}
		} else {
			n[c].val = 0;
		}
		for (i = 0; i < n[c].numVals; i++) {
			int	amlen = val[c].val[i].length;

			/*
			 * The functions that create string values try to
			 * make sure that there's a NUL at the end. However,
			 * both NIS+ and LDAP have a tendency to store strings
			 * without a NUL, so the value length may not include
			 * the NUL (even though it's there). In order to
			 * preserve that NUL, we add a byte to the length if
			 * the type is vt_string, and there isn't already a
			 * NUL at the end. The memory allocation function
			 * (am()) will take care of actually putting the NUL
			 * in place, since it allocates zero-initialized
			 * memory.
			 */
			n[c].val[i].length = val[c].val[i].length;
			if (n[c].type == vt_string && amlen > 0 &&
				((char *)val[c].val[i].value)[amlen-1] !=
					'\0') {
				amlen++;
			}
			n[c].val[i].value = am(myself, amlen);
			if (amlen > 0 && n[c].val[i].value == 0) {
				freeValue(n, c);
				return (0);
			}
			memcpy(n[c].val[i].value, val[c].val[i].value,
				n[c].val[i].length);
		}
	}

	return (n);
}

/* Define LBER_USE_DER per ber_decode(3LDAP) */
#ifndef	LBER_USE_DER
#define	LBER_USE_DER	0x01
#endif	/* LBER_USE_DER */

/*
 * Return a copy of 'valIn' where each value has been replaced by the
 * BER encoded equivalent specified by 'berstring'. 'valIn' is unchanged.
 */
__nis_value_t *
berEncode(__nis_value_t *valIn, char *berstring) {
	char		*myself = "berEncode";
	__nis_value_t	*val;
	int		i;

	if (valIn == 0 || berstring == 0)
		return (0);

	val = cloneValue(valIn, 1);
	if (val == 0)
		return (0);

	for (i = 0; i < val->numVals; i++) {
		BerElement	*ber = ber_alloc();
		struct berval	*bv = 0;
		int		ret;

		if (ber == 0) {
			logmsg(MSG_NOMEM, LOG_ERR, "%s: ber_alloc() => NULL",
				myself);
			freeValue(val, 1);
			return (0);
		}

		if ((strcmp("b", berstring) == 0 ||
				strcmp("i", berstring) == 0)) {
			if (val->val[i].length >= sizeof (int)) {
				ret = ber_printf(ber, berstring,
					*((int *)(val->val[i].value)));
			} else {
				ret = -1;
			}
		} else if (strcmp("B", berstring) == 0) {
			ret = ber_printf(ber, berstring,
				val->val[i].value,
				val->val[i].length * 8);
		} else if (strcmp("n", berstring) == 0) {
			ret = ber_printf(ber, berstring);
		} else if (strcmp("o", berstring) == 0) {
			ret = ber_printf(ber, berstring,
				val->val[i].value, val->val[i].length);
		} else if (strcmp("s", berstring) == 0) {
			char	*str = am(myself, val->val[i].length + 1);

			if (str != 0) {
				ret = ber_printf(ber, berstring, str);
				free(str);
			} else {
				ret = -1;
			}
		} else {
			ret = -1;
		}

		if (ret == -1) {
			reportError(NPL_BERENCODE, "%s: BER encoding error",
					myself);
			ber_free(ber, 1);
			freeValue(val, 1);
			return (0);
		}

		if (ber_flatten(ber, &bv) != 0 || bv == 0) {
			reportError(NPL_BERENCODE, "%s: ber_flatten() error",
					myself);
			ber_free(ber, 1);
			freeValue(val, 1);
			return (0);
		}

		sfree(val->val[i].value);
		val->val[i].length = bv->bv_len;
		val->val[i].value = bv->bv_val;

		ber_free(ber, 1);
	}

	val->type = vt_ber;

	return (val);
}

__nis_value_t *
berDecode(__nis_value_t *valIn, char *berstring) {
	__nis_value_t	*val;
	int		i;
	char		*myself = "berDecode";

	if (valIn == 0 || berstring == 0)
		return (0);

	val = cloneValue(valIn, 1);
	if (val == 0)
		return (0);

	for (i = 0; i < val->numVals; i++) {
		void		*v = 0;
		int		ret, len = 0;
		struct berval	bv;
		BerElement	*ber;

		if (val->val[i].value == 0 || val->val[i].length <= 0)
			continue;

		bv.bv_val = val->val[i].value;
		bv.bv_len = val->val[i].length;
		ber = ber_init(&bv);
		if (ber == 0) {
			reportError(NPL_BERDECODE, "%s: ber_init() error",
				myself);
			freeValue(val, 1);
			return (0);
		}

		if ((strcmp("b", berstring) == 0 ||
				strcmp("i", berstring) == 0)) {
			len = sizeof (int);
			v = am(myself, len);
			if (v != 0) {
				ret = ber_scanf(ber, berstring, v);
			} else {
				ret = -1;
			}
		} else if (strcmp("B", berstring) == 0) {
			long	llen;

			ret = ber_scanf(ber, berstring, &v, &llen);
			if (ret != -1) {
				len = llen/8;
			}
		} else if (strcmp("n", berstring) == 0) {
			ret = 0;
		} else if (strcmp("o", berstring) == 0) {
			struct berval	*bv = am(myself, sizeof (*bv));

			if (bv != 0) {
				ret = ber_scanf(ber, "O", &bv);
				if (ret != -1 && bv != 0) {
					v = bv->bv_val;
					len = bv->bv_len;
				} else {
					ret = -1;
				}
				/* Only free 'bv' itself */
				free(bv);
			} else {
				ret = -1;
			}
		} else if (strcmp("s", berstring) == 0) {
			ret = ber_scanf(ber, "a", &v);
			if (ret != -1) {
				len = slen(v);
			}
		} else {
			ret = -1;
		}

		if (ret == -1) {
			reportError(NPL_BERDECODE, "%s: BER decoding error",
					myself);
			freeValue(val, 1);
			return (0);
		}

		/* Free the old value, and replace it with the decoded one */
		sfree(val->val[i].value);
		val->val[i].value = v;
		val->val[i].length = len;
	}

	return (val);
}

/*
 * Return the value of the specified item.
 */
__nis_value_t *
getMappingItemVal(__nis_mapping_item_t *item, __nis_mapping_item_type_t native,
		__nis_rule_value_t *rv, char *berstring, int *np_ldap_stat) {
	__nis_value_t				*val = 0, *nameVal, *exVal = 0;
	int					numName, caseInsens, cmp;
	int					i, j, k;
	char					**name;
	enum {rvOnly, rvThenLookup, lookupOnly}	check;
	unsigned char				fromldap = '\0';

	if (item == 0)
		return (0);

	/*
	 * First, we decide if we should look for the value in 'rv',
	 * directly from NIS+/LDAP, or both.
	 */
	switch (item->type) {
	case mit_nisplus:
		/* Do we have a valid index/object spec ? */
		if (item->searchSpec.obj.index.numIndexes <= 0 &&
				item->searchSpec.obj.name == 0) {
			/*
			 * No valid index/object. If we have a rule-value,
			 * use it. Otherwise, return error.
			 */
			if (rv != 0) {
				name = rv->colName;
				nameVal = rv->colVal;
				numName = rv->numColumns;
				caseInsens = 0;
				check = rvOnly;
			} else {
				return (0);
			}
		} else {
			/*
			 * Valid index, so skip the rule-value and do
			 * a direct NIS+ lookup.
			 */
			check = lookupOnly;
		}
		break;
	case mit_ldap:
		if (rv != 0) {
			name = rv->attrName;
			nameVal = rv->attrVal;
			numName = rv->numAttrs;
			caseInsens = 1;
			fromldap = '1';
		}
		/* Do we have a valid triple ? */
		if (item->searchSpec.triple.scope == LDAP_SCOPE_UNKNOWN) {
			/*
			 * No valid triple. If we have a rule-value, use it.
			 * Otherwise, return error.
			 */
			if (rv != 0) {
				check = rvOnly;
			} else {
				return (0);
			}
		} else if (item->searchSpec.triple.base == 0 &&
				item->searchSpec.triple.scope ==
					LDAP_SCOPE_ONELEVEL &&
				item->searchSpec.triple.attrs == 0 &&
				item->searchSpec.triple.element == 0) {
			/*
			 * We have a valid triple, but it points to the
			 * current LDAP container. Thus, first look in
			 * the rule-value; if that fails, perform a direct
			 * LDAP lookup.
			 */
			if (rv != 0) {
				check = rvThenLookup;
			} else {
				check = lookupOnly;
			}
		} else {
			/*
			 * Valid triple, and it's not the current container
			 * (at least not in the trivial sense). Hence, do
			 * a direct LDAP lookup.
			 */
			check = lookupOnly;
		}
		break;
	default:
		return (0);
	}

	/* Check the rule-value */
	if (check == rvOnly || check == rvThenLookup) {
		for (i = 0; i < numName; i++) {
			if (caseInsens)
				cmp = strcasecmp(item->name, name[i]);
			else
				cmp = strcmp(item->name, name[i]);
			if (cmp == 0) {
				if (nameVal[i].numVals <= 0)
					break;
				if (berstring == 0) {
					val = cloneValue(&nameVal[i], 1);
				} else if (yp2ldap && berstring[0] == 'a') {
					val = cloneValue(&nameVal[i], 1);
				} else {
					val = berDecode(&nameVal[i],
						berstring);
				}
				if (val != 0) {
					val->repeat = item->repeat;
					/*
					 * If value for nis+ column is
					 * passed with value, val is
					 * manipulated in cloneValue().
					 * To decide whether there are
					 * enough nis+ column values
					 * for rule to produce a value,
					 * we need nis+ column values
					 * as well as nis_mapping_element
					 * from the rule. If we are here,
					 * it indicates that the 'val has
					 * an valid value for the column
					 * item-> name. So set
					 * NP_LDAP_MAP_SUCCESS
					 * to np_ldap-stat.
					 */

					if (np_ldap_stat != NULL)
						*np_ldap_stat =
							NP_LDAP_MAP_SUCCESS;
				}
				break;
			}
		}
	}

	/* Do a direct lookup ? */
	if (val == 0 && (check == rvThenLookup || check == lookupOnly)) {
		if (item->type == mit_ldap) {
			int	err = 0;
			__nis_search_triple_t	triple;
			char			*baseDN;

			/*
			 * If item->searchSpec.triple.base is NULL, or ends
			 * in a comma, append the current search base from
			 * the TSD (put there by an upper layer).
			 *
			 * Special case for N2L mode:
			 * if item->searchSpec.triple.base ends in a comma,
			 * the current domain Context is used.
			 */
			if (yp2ldap && item->searchSpec.triple.base &&
				strlen(item->searchSpec.triple.base) > 0) {
				baseDN = __nisdb_get_tsd()->domainContext;
			} else {
				baseDN = __nisdb_get_tsd()->searchBase;
			}
			triple.base = appendBase(item->searchSpec.triple.base,
				baseDN, &err, 0);
			if (err == 0) {
				triple.scope = item->searchSpec.triple.scope;
				triple.attrs = item->searchSpec.triple.attrs;
				triple.element =
					item->searchSpec.triple.element;
				val = lookupLDAP(&triple, item->name, rv, 0,
					np_ldap_stat);
				fromldap = '1';
			} else {
				val = 0;
			}
			sfree(triple.base);
		}
	}


	/* Special processing for NIS to LDAP mode */
	if (yp2ldap && val != 0) {

		/*
		 * Escape special chars from dn before sending to DIT,
		 * provided val is not ldap-based
		 */
		if (fromldap == '\0' && __nisdb_get_tsd()->escapeFlag == '1') {
			if (escapeSpecialChars(val) < 0) {
				freeValue(val, 1);
				return (0);
			}
		} else if (__nisdb_get_tsd()->escapeFlag == '2') {
			/* Remove escape chars from data received from DIT */
			(void) removeEscapeChars(val);
		}

		/*
		 * Remove from 'val', any values obtained using
		 * the 'removespec' syntax
		 */

		/* Obtain exVal */
		if (item->exItem)
			exVal = getMappingItemVal(item->exItem, native, rv,
			    berstring, NULL);

		/* delete */
		if (exVal != 0) {
			for (i = 0; i < val->numVals; ) {
				for (j = 0; j < exVal->numVals; j++) {
					if (sstrncmp(val->val[i].value,
							exVal->val[j].value,
							MAX(val->val[i].length,
							exVal->val[j].length))
							== 0)
						break;
				}
				if (j < exVal->numVals) {
					sfree(val->val[i].value);
					val->val[i].value = 0;
					val->val[i].length = 0;
					for (k = i; k < val->numVals - 1; k++) {
						val->val[k] = val->val[k + 1];
						val->val[k + 1].value = 0;
						val->val[k + 1].length = 0;
					}
					val->numVals--;
				} else
					i++;
			}

			freeValue(exVal, 1);

			/*
			 * If val->numVals <= 0, then we have no val to
			 * return. So free up stuff.
			 */
			if (val->numVals <= 0) {
				free(val->val);
				val->val = 0;
				free(val);
				return (0);
			}
		}
	}

	return (val);
}

__nis_value_t *
getMappingFormat(__nis_mapping_format_t *f, __nis_rule_value_t *rv,
			__nis_format_arg_t at, void *a, int *numArg) {
	char		*myself = "getMappingFormat";
	__nis_value_t	*val = 0;
	__nis_buffer_t	b = {0, 0};
	int		i;

	if (f == 0)
		return (0);

	if (rv == 0) {
		val = am(myself, sizeof (*val));
		if (val == 0)
			return (0);

		switch (f->type) {
		case mmt_item:
			bp2buf(myself, &b, "%%s");
			break;
		case mmt_string:
			bp2buf(myself, &b, "%s", NIL(f->match.string));
			break;
		case mmt_single:
			bp2buf(myself, &b, "[");
			for (i = 0; i < f->match.single.numRange; i++) {
				if (f->match.single.lo[i] ==
						f->match.single.hi[i])
					bp2buf(myself, &b, "%c",
						f->match.single.lo[i]);
				else
					bp2buf(myself, &b, "%c-%c",
						f->match.single.lo[i],
						f->match.single.hi[i]);
			}
			bp2buf(myself, &b, "]");
			break;
		case mmt_limit:
			break;
		case mmt_any:
			bp2buf(myself, &b, "*");
			break;
		case mmt_berstring:
			bp2buf(myself, &b, "%s", NIL(f->match.berString));
			break;
		case mmt_begin:
		case mmt_end:
			bp2buf(myself, &b, "\"");
			break;
		default:
			bp2buf(myself, &b, "<unknown>");
		}
		val->type = vt_string;
		val->numVals = 1;
		val->val = am(myself, sizeof (val->val[0]));
		if (val->val == 0) {
			sfree(val);
			return (0);
		}
		val->val[0].value = b.buf;
		val->val[0].length = b.len;
	} else {
		switch (f->type) {
		case mmt_item:
		case mmt_berstring:
			if (a != 0) {
				if (at == fa_item) {
					val = getMappingItemVal(
						(__nis_mapping_item_t *)a,
						mit_any, rv,
		(f->type == mmt_berstring) ? f->match.berString : 0, NULL);
					if (numArg != 0)
						(*numArg)++;
				} else {
					val = cloneValue(
						(__nis_value_t *)a, 1);
					if (numArg != 0)
						(*numArg)++;
				}
			}
			break;
		case mmt_string:
			val = am(myself, sizeof (*val));
			if (val == 0)
				return (0);
			val->type = vt_string;
			val->numVals = 1;
			val->val = am(myself, sizeof (val->val[0]));
			if (val->val == 0) {
				sfree(val);
				return (0);
			}
			val->val[0].value = sdup(myself, T, f->match.string);
			val->val[0].length = strlen(val->val[0].value);
			break;
		case mmt_single:
		case mmt_limit:
		case mmt_any:
		case mmt_begin:
		case mmt_end:
			/* Not an error, so return an empty value */
			val = am(myself, sizeof (*val));
			if (val == 0)
				return (0);
			val->type = vt_string;
			val->numVals = 0;
			val->val = 0;
			break;
		default:
			/* Do nothing */
			val = 0;
			break;
		}
	}
	return (val);
}

/*
 * Used when evaluating an expression. Typically, the value of the
 * expression so far will be kept in 'v1', and 'v2' is the value
 * of the current component of the expression. In the general case,
 * both will be multi-valued, and the result is an "explosion"
 * resulting in N*M new values (if 'v1' had N values, and 'v2'
 * M ditto).
 *
 * For example, if v1 = {"ab", "cd", "ef"}, and v2 = {"gh", "ij", "kl"},
 * the result will be {"abgh", "abij", "abkl", "cdgh", "cdij", "cdkl",
 * "efgh", "efij", "efkl"}.
 *
 * There are special cases when v1->repeat and/or v2->repeat are set.
 * Repeat mostly makes sense with single values; for example, if
 * v1 = {"x="} with repeat on, and v2 = {"1", "2", "3"}, the result
 * is {"x=1", "x=2", "x=3"}.
 *
 * The result if v2 also had repeat on would be {"x=1x=2x=3"}. It's
 * not clear if there's a useful application for this, but the code's
 * there for the sake of orthogonality.
 */
__nis_value_t *
explodeValues(__nis_value_t *v1, __nis_value_t *v2) {
	int		i1, i2, n, nv;
	__nis_value_t	*v;
	__nis_buffer_t	b = {0, 0};
	char		*myself = "explodeValues";

	if (v1 == 0 || v1->numVals <= 0)
		return (cloneValue(v2, 1));
	if (v2 == 0 || v2->numVals <= 0)
		return (cloneValue(v1, 1));

	/*
	 * XXX What should we do if (v1->type != v2->type) ?
	 * Policy: Just explode anyway, even though the result is
	 * unlikely to be very useful.
	 */

	v = am(myself, sizeof (*v));
	if (v == 0)
		return (0);

	if (!v1->repeat && !v2->repeat)
		nv = v1->numVals * v2->numVals;
	else if (v1->repeat && !v2->repeat)
		nv = v2->numVals;
	else if (!v1->repeat && v2->repeat)
		nv = v1->numVals;
	else /* v1->repeat && v2->repeat */
		nv = 1;

	v->val = am(myself, nv * sizeof (v->val[0]));
	if (v->val == 0) {
		free(v);
		return (0);
	}

	/*
	 * Four different cases, depending on the 'repeat' flags.
	 */
	if (!v1->repeat && !v2->repeat) {
		for (i1 = 0, n = 0; i1 < v1->numVals; i1++) {
			for (i2 = 0; i2 < v2->numVals; i2++) {
				if (v1->type == vt_string)
					sbc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				else
					bc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				if (v2->type == vt_string)
					sbc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
				else
					bc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
				v->val[n].value = b.buf;
				v->val[n].length = b.len;
				n++;
				b.buf = 0;
				b.len = 0;
			}
		}
	} else if (v1->repeat && !v2->repeat) {
		for (i2 = 0; i2 < v2->numVals; i2++) {
			for (i1 = 0, n = 0; i1 < v1->numVals; i1++) {
				if (v1->type == vt_string)
					sbc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				else
					bc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				if (v2->type == vt_string)
					sbc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
				else
					bc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
			}
			v->val[n].value = b.buf;
			v->val[n].length = b.len;
			n++;
			b.buf = 0;
			b.len = 0;
		}
	} else if (!v1->repeat && v2->repeat) {
		for (i1 = 0, n = 0; i1 < v1->numVals; i1++) {
			for (i2 = 0; i2 < v2->numVals; i2++) {
				if (v1->type == vt_string)
					sbc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				else
					bc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				if (v2->type == vt_string)
					sbc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
				else
					bc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
			}
			v->val[n].value = b.buf;
			v->val[n].length = b.len;
			n++;
			b.buf = 0;
			b.len = 0;
		}
	} else { /* v1->repeat && v2->repeat */
		for (i1 = 0, n = 0; i1 < v1->numVals; i1++) {
			for (i2 = 0; i2 < v2->numVals; i2++) {
				if (v1->type == vt_string)
					sbc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				else
					bc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				if (v2->type == vt_string)
					sbc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
				else
					bc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
			}
		}
		v->val[n].value = b.buf;
		v->val[n].length = b.len;
		n++;
		b.buf = 0;
		b.len = 0;
	}

#ifdef	NISDB_LDAP_DEBUG
	/* Sanity check */
	if (n != nv)
		abort();
#endif	/* NISD__LDAP_DEBUG */

	v->type = (v1->type == vt_string) ?
			((v2->type == vt_string) ?
				vt_string : vt_ber) : vt_ber;
	v->repeat = 0;
	v->numVals = n;

	return (v);
}

__nis_value_t *
getMappingFormatArray(__nis_mapping_format_t *a, __nis_rule_value_t *rv,
			__nis_format_arg_t at, int numArgs, void *arg) {
	int			i, ia = 0;
	__nis_value_t		*val, *v = 0;
	bool_t			moreFormat = (a != 0);
	bool_t			moreArgs = (numArgs > 0);

	while (moreFormat && (arg == 0 || ia < numArgs)) {
		for (i = 0; moreFormat; i++) {
			moreFormat = (a[i].type != mmt_end);
			if (at == fa_item) {
				__nis_mapping_item_t *item = arg;
				val = getMappingFormat(&a[i], rv, at,
					((item != 0) ? &item[ia] : 0), &ia);
			} else {
				__nis_value_t **ival = arg;
				val = getMappingFormat(&a[i], rv, at,
					((ival != 0) ? ival[ia] : 0), &ia);
			}
			if (val != 0) {
				__nis_value_t	*new = explodeValues(v, val);

				freeValue(v, 1);
				freeValue(val, 1);
				if (new == 0)
					return (0);

				v = new;
			} else {
				freeValue(v, 1);
				return (0);
			}
			/*
			 * If we run out of arguments, but still have format
			 * remaining, repeat the last argument. Keep track of
			 * the fact that we've really consumed all arguments.
			 */
			if (moreFormat && ia >= numArgs) {
				ia = (numArgs > 0) ? numArgs - 1 : 0;
				moreArgs = FALSE;
			}
		}
		/*
		 * We've run out of format, so if we still have arguments
		 * left, start over on the format.
		 */
		if (ia < numArgs && moreArgs) {
			/*
			 * However, if we didn't consume any arguments going
			 * through the format once, abort to avoid an infinite
			 * loop.
			 */
			if (numArgs > 0 && ia <= 0) {
				freeValue(v, 1);
				return (0);
			}
			moreFormat = 1;
		}
	}

	return (v);
}

/*
 * Returns a string representation (such as "[name=foo, value=bar]")
 * of a nis_index_t.
 */
char *
getIndex(__nis_index_t *i, int *len) {
	int		n;
	__nis_buffer_t	b = {0, 0};
	char		*myself = "getIndex";

	if (i == 0)
		return (0);

	if (i->numIndexes > 0) {
		bp2buf(myself, &b, "[");
		for (n = 0; n < i->numIndexes; n++) {
			__nis_value_t	*val;
			int		j;

			val = getMappingFormatArray(i->value[n],
						0, fa_any, 0, 0);
			if (n > 0)
				bp2buf(myself, &b, ", ");
			bp2buf(myself, &b, "%s=", i->name[n]);
			if (val != 0) {
				for (j = 0; j < val->numVals; j++) {
					bc2buf(myself, val->val[j].value,
						val->val[j].length, &b);
				}
			} else {
				bp2buf(myself, &b, "<no-vals>");
			}
			freeValue(val, 1);
		}
		bp2buf(myself, &b, "]");
	}
	if (len != 0)
		*len = b.len;
	return (b.buf);
}

char *
getObjSpec(__nis_obj_spec_t *o, int *len) {
	__nis_buffer_t	b = {0, 0};
	char		*myself = "getObjSpec";

	if (o == 0)
		return (0);

	b.buf = getIndex(&o->index, &b.len);
	sbc2buf(myself, o->name, slen(o->name), &b);
	if (len != 0)
		*len = b.len;
	return (b.buf);
}

/*
 * Returns a string representation of the LDAP scope. Note that the
 * returned value is a static entity, and must be copied by the
 * caller (but, obviously, must not be freed).
 */
char *
getScope(int scope) {
	switch (scope) {
	case LDAP_SCOPE_BASE:
		return ("base");
	case LDAP_SCOPE_ONELEVEL:
		return ("one");
	case LDAP_SCOPE_SUBTREE:
		return ("sub");
	default:
		return ("one");
	}
}

/*
 * Return a string representation of an LDAP search triple (such as
 * "ou=Hosts,dc=eng,dc=sun,dc=com?one?cn=xyzzy").
 */
char *
getSearchTriple(__nis_search_triple_t *s, int *len) {
	__nis_buffer_t	b = {0, 0};
	char		*a;
	int		l;
	char		*myself = "getSearchTriple";

	/* If the scope is LDAP_SCOPE_UNKNOWN, the search triple is unused */
	if (s == 0 || s->scope == LDAP_SCOPE_UNKNOWN) {
		if (len != 0)
			*len = 0;
		return (0);
	}

	if (s->base != 0)
		sbc2buf(myself, s->base, slen(s->base), &b);
	if (!(s->scope == LDAP_SCOPE_ONELEVEL &&
			(s->base == 0 || s->base[0] == '\0'))) {
		bp2buf(myself, &b, "?%s?", getScope(s->scope));
	}
	if ((l = slen(s->attrs)) > 0) {
		/*
		 * Remove white space from the filter/attribute list.
		 * The parser usually keeps any white space from the
		 * config file (or LDAP/command line), but we don't
		 * want it.
		 */
		a = am(myself, l+1);
		if (a != 0) {
			int	i, la;

			for (i = 0, la = 0; i < l; i++) {
				if (s->attrs[i] != ' ' &&
						s->attrs[i] != '\t')
					a[la++] = s->attrs[i];
			}
			sbc2buf(myself, a, la, &b);
			sfree(a);
		} else {
			sbc2buf(myself, s->attrs, slen(s->attrs), &b);
		}
	}

	if (len != 0)
		*len = b.len;
	return (b.buf);
}

__nis_value_t *
getMappingItem(__nis_mapping_item_t *i, __nis_mapping_item_type_t native,
		__nis_rule_value_t *rv, char *berstring, int *np_ldap_stat) {
	char		*myself = "getMappingItem";
	__nis_value_t	*val = 0;
	__nis_buffer_t	b = {0, 0};
	int		len = 0;
	char		*buf;

	if (i == 0)
		return (0);

	if (rv != 0)
		return (getMappingItemVal(i, native, rv, berstring,
			np_ldap_stat));

	val = am(myself, sizeof (*val));
	if (val == 0)
		return (0);

	switch (i->type) {
	case mit_nisplus:
		if (native != mit_nisplus)
			bp2buf(myself, &b, "nis+:");
		bp2buf(myself, &b, "%s", NIL(i->name));
		buf = getObjSpec(&i->searchSpec.obj, &len);
		if (buf != 0 && len > 0) {
			bc2buf(myself, ":", 1, &b);
			sbc2buf(myself, buf, len, &b);
		}
		sfree(buf);
		val->type = vt_string;
		val->repeat = i->repeat;
		val->numVals = 1;
		val->val = am(myself, sizeof (val->val[0]));
		if (val->val == 0) {
			sfree(b.buf);
			free(val);
			return (0);
		}
		val->val[0].value = b.buf;
		val->val[0].length = b.len;
		break;
	case mit_ldap:
		if (native != mit_ldap)
			bp2buf(myself, &b, "ldap:");
		bp2buf(myself, &b, "%s", NIL(i->name));
		buf = getSearchTriple(&i->searchSpec.triple, &len);
		if (buf != 0 && len > 0) {
			bc2buf(myself, ":", 1, &b);
			sbc2buf(myself, buf, len, &b);
		}
		sfree(buf);
		val->type = vt_string;
		val->repeat = i->repeat;
		val->numVals = 1;
		val->val = am(myself, sizeof (val->val[0]));
		if (val->val == 0) {
			sfree(b.buf);
			free(val);
			return (0);
		}
		val->val[0].value = b.buf;
		val->val[0].length = b.len;
		break;
	default:
		p2buf(myself, "<unknown>:");
		p2buf(myself, "%s", NIL(i->name));
		break;
	}

	return (val);
}

void
copyObjSpec(__nis_obj_spec_t *old, __nis_obj_spec_t *new, int *err) {
	char	*myself = "copyObjSpec";

	if (old == 0 || new == 0) {
		*err = EINVAL;
		return;
	}

	if (new->index.name == 0) {
		new->index.name = am(myself, old->index.numIndexes *
						sizeof (new->index.name[0]));
		if (old->index.numIndexes > 0 && new->index.name == 0) {
			*err = ENOMEM;
			return;
		}
		new->index.value = am(myself, old->index.numIndexes *
						sizeof (new->index.value[0]));
		if (old->index.numIndexes > 0 && new->index.value == 0) {
			*err = ENOMEM;
			return;
		}
	}
	new->name = sdup(myself, T, old->name);
	if (new->name == 0 && old->name != 0) {
		*err = ENOMEM;
		return;
	}
	copyIndex(&old->index, &new->index, err);
}

__nis_obj_spec_t *
cloneObjSpec(__nis_obj_spec_t *old) {
	char			*myself = "cloneObjSpec";
	int			err = 0;
	__nis_obj_spec_t	*new = am(myself, sizeof (*new));

	if (new != 0) {
		copyObjSpec(old, new, &err);
		if (err != 0) {
			freeObjSpec(new, 1);
			new = 0;
		}
	}

	return (new);
}

void
freeObjSpec(__nis_obj_spec_t *old, bool_t doFree) {

	if (old == 0)
		return;

	sfree(old->name);
	freeIndex(&old->index, FALSE);
	if (doFree)
		free(old);
}

void
copySearchTriple(__nis_search_triple_t *old, __nis_search_triple_t *new,
		int *err) {
	char			*myself = "copySearchTriple";

	*err = 0;

	if (old == 0 || new == 0) {
		*err = EINVAL;
		return;
	}

	if (old->base != NULL)
		new->base = sdup(myself, T, old->base);
	else
		new->base = NULL;
	if (old->attrs != NULL)
		new->attrs = sdup(myself, T, old->attrs);
	else
		new->attrs = NULL;
	if ((new->base == 0 && old->base != 0) ||
			(new->attrs == 0 && old->attrs != 0)) {
		sfree(new->base);
		new->base = 0;
		sfree(new->attrs);
		new->attrs = 0;
		*err = ENOMEM;
		return;
	}
	new->scope = old->scope;
	/*
	 * XXX Really should have a cloneMappingElement() function.
	 * However, since whatever the 'element' field points to
	 * is allocated at parse time, and never is freed or modified,
	 * it's sufficient to copy the pointer value.
	 */
	new->element = old->element;
}

__nis_search_triple_t *
cloneSearchTriple(__nis_search_triple_t *old) {
	char			*myself = "cloneSearchTriple";
	int			err = 0;
	__nis_search_triple_t	*new = am(myself, sizeof (*new));

	if (new != 0) {
		copySearchTriple(old, new, &err);
		if (err != 0) {
			freeSearchTriple(new, 1);
			new = 0;
		}
	}

	return (new);
}

void
freeSearchTriple(__nis_search_triple_t *old, bool_t doFree) {

	if (old == 0)
		return;

	sfree(old->base);
	sfree(old->attrs);
	/*
	 * Since we only copied the element pointer when this structure
	 * was created, we don't free old->element.
	 */
	if (doFree)
		free(old);
}

void
copyTripleOrObj(__nis_mapping_item_type_t type,
		__nis_triple_or_obj_t *old, __nis_triple_or_obj_t *new,
		int *err) {

	*err = 0;

	if (old == 0 || new == 0) {
		*err = EINVAL;
		return;
	}

	if (type == mit_nisplus) {
		copyObjSpec(&old->obj, &new->obj, err);
	} else if (type == mit_ldap) {
		copySearchTriple(&old->triple, &new->triple, err);
	}
}

__nis_triple_or_obj_t *
cloneTripleOrObj(__nis_mapping_item_type_t type, __nis_triple_or_obj_t *old) {
	char			*myself = "cloneTripleOrObj";
	int			err = 0;
	__nis_triple_or_obj_t	*new = am(myself, sizeof (*new));

	if (new != 0) {
		copyTripleOrObj(type, old, new, &err);
		if (err != 0) {
			freeTripleOrObj(type, new, 1);
			new = 0;
		}
	}

	return (new);
}

void
freeTripleOrObj(__nis_mapping_item_type_t type, __nis_triple_or_obj_t *old,
		bool_t doFree) {

	if (old == 0)
		return;

	if (type == mit_nisplus)
		freeObjSpec(&old->obj, doFree);
	else if (type == mit_ldap)
		freeSearchTriple(&old->triple, doFree);

	if (doFree)
		free(old);
}

void
copyItem(__nis_mapping_item_t *old, __nis_mapping_item_t *new, int *err) {

	*err = 0;

	if (old == 0 || new == 0) {
		*err = EINVAL;
		return;
	}

	new->type = old->type;
	new->repeat = old->repeat;
	if (old->name != 0) {
		new->name = strdup(old->name);
		if (new->name == 0) {
			*err = ENOMEM;
			return;
		}
	} else {
		new->name = 0;
	}
	if (old->type == mit_nisplus || old->type == mit_ldap)
		copyTripleOrObj(old->type, &old->searchSpec, &new->searchSpec,
				err);
	else
		memset(&new->searchSpec, 0, sizeof (new->searchSpec));
}

__nis_mapping_item_t *
cloneItem(__nis_mapping_item_t *old) {
	__nis_mapping_item_t	*new;
	int			err = 0;
	char			*myself = "cloneItem";

	if (old == 0)
		return (0);

	new = am(myself, sizeof (*new));
	if (new == 0)
		return (0);

	copyItem(old, new, &err);
	if (err != 0) {
		freeMappingItem(new, 1);
		return (0);
	}

	return (new);
}

void
freeMappingItem(__nis_mapping_item_t *item, int numItems) {
	int	i;

	if (item == 0)
		return;

	for (i = 0; i < numItems; i++) {
		sfree(item[i].name);
		freeTripleOrObj(item[i].type, &item[i].searchSpec, FALSE);
	}
	sfree(item);
}

__nis_mapping_item_t *
concatenateMappingItem(__nis_mapping_item_t *old, int numItems,
		__nis_mapping_item_t *cat) {
	__nis_mapping_item_t	*new;
	int			i, err = 0;
	char			*myself = "concatenateMappingItem";

	if (old == 0 || numItems < 1)
		return (cloneItem(cat));

	new = am(myself, (numItems + 1) * sizeof (*new));
	if (new == 0)
		return (0);

	for (i = 0; i < numItems; i++) {
		copyItem(&old[i], &new[i], &err);
		if (err != 0) {
			freeMappingItem(new, i);
			return (0);
		}
	}
	copyItem(cat, &new[numItems], &err);
	if (err != 0) {
		freeMappingItem(new, numItems);
		new = 0;
	}

	return (new);
}

__nis_value_t *
concatenateValues(__nis_value_t *v1, __nis_value_t *v2) {
	int		i, n, a;
	__nis_value_t	*v;
	char		*myself = "concatenateValues";

	if (v1 == 0 || v1->numVals <= 0)
		return (cloneValue(v2, 1));
	if (v2 == 0 || v2->numVals <= 0)
		return (cloneValue(v1, 1));

	if (v1->type != v2->type)
		return (0);

	n = v1->numVals + v2->numVals;
	v = am(myself, sizeof (*v));
	if (v == 0)
		return (0);
	v->val = am(myself, n * sizeof (v->val[0]));
	if (v->val == 0) {
		free(v);
		return (0);
	}
	v->type = v1->type;
	v->numVals = 0;

	for (a = 0; a < 2; a++) {
		__nis_single_value_t	*val = (a == 0) ? v1->val : v2->val;
		int			numv = (a == 0) ? v1->numVals :
							v2->numVals;
		for (i = 0; i < numv; i++) {
			int	clen, alen = val[i].length;

			clen = alen;

			/*
			 * Make sure there's a NUL at the end of a string,
			 * but avoid adding to the allocated length if there's
			 * already a NUL at the end.
			 */
			if (alen > 0 && v->type == vt_string &&
					((char *)val[i].value)[alen-1] != '\0')
				alen += 1;
			v->val[v->numVals].value = am(myself, alen);
			if (v->val[v->numVals].value == 0) {
				freeValue(v, 1);
				return (0);
			}
			memcpy(v->val[v->numVals].value, val[i].value, clen);
			v->val[v->numVals].length = val[i].length;
			v->numVals++;
		}
	}

	return (v);
}

__nis_value_t *
splitMappingItem(__nis_mapping_item_t *item, char delim,
		__nis_rule_value_t *rv) {
	__nis_value_t		*val = getMappingItem(item, mit_any,
			rv, 0, NULL);
	__nis_single_value_t	*nval;
	int			i, n, nv;

	if (val == 0)
		return (0);
	else if (delim == 0 || val->val == 0 || val->numVals <= 0 ||
			val->type != vt_string) {
		freeValue(val, 1);
		return (0);
	}

	nval = val->val;
	nv = val->numVals;
	val->repeat = FALSE;
	val->val = 0;
	val->numVals = 0;

	/* In N2L, space and tab delimiters are treated the same */
	if (yp2ldap && delim == '\t')
		delim = ' ';

	/* If the item has multiple values, we split each one independently */
	for (i = 0; i < nv; i++) {
		char			*str;
		int			s, e;
		char			*newstr;
		__nis_single_value_t	*newval;

		if (yp2ldap && delim == ' ')
			nval[i].value = trimWhiteSpaces(nval[i].value,
							&nval[i].length, 1);

		str = nval[i].value;

		if (nval[i].value == 0)
			continue;

		for (s = 0; s < nval[i].length; s = e+1) {
			/* Find the next delimiter, or end-of-string */
			for (e = s; str[e] != '\0' && str[e] != delim; e++);
			/*
			 * 'str[e]' is either a delimiter, or the concluding
			 * NUL. Make sure it's NUL.
			 */
			str[e] = '\0';
			/* Add to val->val */
			newstr = strdup(&str[s]);
			newval = realloc(val->val,
					(val->numVals+1) *
						sizeof (val->val[0]));
			if (newval != 0)
				val->val = newval;
			if (newstr == 0 || newval == 0) {
				freeValue(val, 1);
				for (n = i; n < nv; n++) {
					sfree(nval[n].value);
				}
				free(nval);
				sfree(newstr);
				return (0);
			}
			val->val[val->numVals].value = newstr;
			val->val[val->numVals].length = strlen(newstr) + 1;
			val->numVals++;
		}
		free(nval[i].value);
		nval[i].value = 0;
	}
	/* Already freed the nval[i].value's as we traversed nval */
	free(nval);

	return (val);
}

/*
 * Match the format spec 'f[curf]' to the input value string 'str'.
 *
 * If successful, returns the updated position in the value string 'str'.
 * Otherwise, NULL is returned.
 *
 * curf		Current index (i.e., the one we should look at) in 'f'
 * nf		Number of elements in 'f', including 'mmt_end'
 * str		The value string we're scanning
 * val		Pointer to where an item value (if any) should be returned
 *		Set to NULL if not an 'mmt_item'.
 * fmtstart	If non-zero on entry, skip characters in 'str' until we find
 *		the f[curf].type data, if doing so makes any sense. On exit,
 *		set to the start of the fmt element data (which will be 'str',
 *		unless we did skip characters)
 * sepset	List of separators
 */
char *
scanMappingFormat(__nis_mapping_format_t *f, int curf, int nf, char *str,
		char **val, char **fmtstart, char *sepset) {
	char	*mstr, *next, *start = 0, *tmpstr;
	int	i, len;
	bool_t	match;
	char	*myself = "scanMappingFormat";
	/* N2L variables */
	int	af, skipspaces = 0;
	bool_t	ipaddr = FALSE;
	char	*spacestr = " ", *emptystr = "";


	if (f == 0 || curf < 0 || nf <= 0 || str == 0)
		return (0);

	/*
	 * If separator list is NULL (which will be the case for
	 * nis+2ldap), then simply use empty string
	 */
	if (sepset == 0)
		sepset = emptystr;

	if (curf >= nf) {
		/* OK if the string also is exhausted */
		if (strchr(sepset, *str) != 0)
			return (str);
		else
			return (0);
	}

	switch (f[curf].type) {
	case mmt_berstring:
		if (f[curf].match.berString[0] != 'a') {
			/* Not a matchable element */
			return (0);
		}

		/*
		 * If here, it means it's an IP address (N2L case)
		 * So continue processing as if it was mmt_item
		 */
		ipaddr = TRUE;
		/* FALLTHROUGH */
	case mmt_item:
		/*
		 * In order to find the end of the item value, we must look
		 * ahead and determine the start of the next formatting element.
		 * If successful, 'next' will be the start of the fmt element
		 * after the next one; we don't care about that, other than to
		 * check for error.
		 *
		 * Since an item match is somewhat like an any match, in that
		 * we don't know a priori if the first occurence of the next
		 * element really is the one we want, we have to scan ahead
		 * until we've reached the end.
		 */
		tmpstr = str;
		while ((next = scanMappingFormat(f, curf+1, nf, tmpstr, 0,
				&start, sepset)) != 0) {
			char	*tmp = next;
			int	cf;

			for (cf = curf+2; cf < nf; cf++) {
				tmp = scanMappingFormat(f, cf, nf, tmp, 0,
					0, sepset);
				if (tmp == 0)
					break;
			}
			if (tmp == 0) {
				tmpstr = next;
			} else if (strchr(sepset, *tmp) != 0) {
				break;
			} else {
				return (0);
			}

		}
		if (next == 0 || start == 0)
			return (0);

		if (val != 0) {
			len = (int)((long)start - (long)str);
			*val = am(myself, len + 1);
			if (*val == 0)
				return (0);
			memcpy(*val, str, len);
			(*val)[len] = '\0';

			if (ipaddr == TRUE) {
				/*
				 * In N2L, we need to check if *val is truly an
				 * IP address
				 */
				af = checkIPaddress(*val, len, &tmpstr);

				if (af == -2) {
					logmsg(MSG_NOTIMECHECK, LOG_WARNING,
						"%s:Internal error while "
						"processing IPaddress %s",
						myself, *val);
					sfree(*val);
					return (0);
				} else if (af == -1) {
					logmsg(MSG_NOTIMECHECK, LOG_WARNING,
						"%s:%s is not an IP address",
						myself, *val);
					sfree(*val);
					return (0);
				} else if (af == 0) {
					logmsg(MSG_NOTIMECHECK, LOG_WARNING,
						"%s:IP address %s is not "
						"supported by rfc2307bis",
						myself, *val);
					sfree(*val);
					return (0);
				} else if (sstrncmp(*val, tmpstr, len) != 0) {
					logmsg(MSG_NOTIMECHECK, LOG_WARNING,
						"%s:IPaddress %s converted "
						"to %s", myself, *val, tmpstr);
				}

				sfree(*val);
				*val = tmpstr;
			}
		}

		if (fmtstart != 0)
			*fmtstart = str;

		return (start);

	case mmt_string:
		if ((mstr = f[curf].match.string) == 0 || *mstr == '\0') {
			/*
			 * Count this as a successful match of an empty
			 * string.
			 */
			if (fmtstart != 0)
				*fmtstart = str;
			return (str);
		}

		/*
		 * In N2L, if the format string 'mstr' contains only
		 * whitespaces (spaces and tabs), then it should
		 * match one or more whitespaces from the input
		 * string 'str'.
		 */
		if (yp2ldap && strspn(mstr, " \t") == strlen(mstr)) {
				mstr = spacestr;
				skipspaces = 1;
				next = str + strcspn(str, " \t");
				/*
				 * Even if there is no whitespace in 'str',
				 * it's OK. This is to allow formats like
				 * "%s %s %s" to match inputs like "foo bar".
				 */
				if (*next == '\0')
					mstr = emptystr;
		} else {
			/* No match string in 'str' => failure */
			if ((next = strstr(str, mstr)) == 0)
				return (0);
		}

		/* If 'fmtstart' == 0, we require 'next' == 'str' */
		if (fmtstart == 0 && next != str)
			return (0);
		/* Success; save start of match string if requested */
		if (fmtstart != 0)
			*fmtstart = next;
		/* Update position in the value string */
		str = (char *)((long)next + (long)strlen(mstr));

		/* Skip whitespaces for N2L */
		if (skipspaces == 1)
			for (; *str == ' ' || *str == '\t'; str++);

		return (str);

	case mmt_single:
		if (fmtstart != 0) {
			match = FALSE;
			/* Skip ahead until we match */
			for (next = str; *next != '\0'; next++) {
				unsigned char	*lo = f[curf].match.single.lo;
				unsigned char	*hi = f[curf].match.single.hi;

				for (i = 0; i < f[curf].match.single.numRange;
						i++) {
					if (*next >= lo[i] && *next <= hi[i]) {
						match = TRUE;
						break;
					}
				}
				if (match)
					break;
			}
			if (!match)
				return (0);
			*fmtstart = next;
			str = next;
		} else {
			match = FALSE;
			for (i = 0; i < f[curf].match.single.numRange; i++) {
				if (*str >= f[curf].match.single.lo[i] &&
					*str <= f[curf].match.single.hi[i]) {
					match = TRUE;
					break;
				}
			}
			if (!match)
				return (0);
		}
		/* Step over the matched character */
		str++;
		return (str);

	case mmt_any:
		/*
		 * Look ahead to find the beginning of the next element.
		 * Because a wildcard-match isn't necessarily uniquely
		 * determined until we've reached the end, we then continue
		 * to scan ahead.
		 */
		while ((next = scanMappingFormat(f, curf+1, nf, str, 0,
						&start, sepset)) != 0) {
			char	*tmp = next;
			int	cf;

			for (cf = curf+2; cf < nf; cf++) {
				tmp = scanMappingFormat(f, cf, nf, tmp, 0,
					0, sepset);
				if (tmp == 0)
					break;
			}
			if (tmp == 0) {
				str = next;
			} else if (*tmp == '\0') {
				break;
			} else {
				return (0);
			}
		}
		if (next == 0 || start == 0)
			return (0);

		if (fmtstart != 0)
			*fmtstart = str;

		return (start);

	case mmt_limit:
		if (f[curf].match.limit == eos) {
			if (fmtstart != 0) {
				/* Skip to the end */
				str = str + strcspn(str, sepset);
				*fmtstart = str;
			} else if (strchr(sepset, *str) == 0) {
				return (0);
			}
		}
		return (str);

	case mmt_begin:
		if (fmtstart != 0)
			*fmtstart = str;
		return (str);

	case mmt_end:
		if (fmtstart != 0) {
			/* Skip to the end */
			str = str + strcspn(str, sepset);
			*fmtstart = str;
			return (str);
		}
		/* No skipping, so we must be at the end of the value */
		if (strchr(sepset, *str) == 0)
			return (0);
		return (str);

	default:
		break;
	}

	return (0);
}

/*
 * Verify that the string 'str' matches the mapping format array 'f'.
 * Returns 1 in case of a match, 0 otherwise.
 */
int
verifyMappingMatch(__nis_mapping_format_t *f, char *str) {
	int			n, nf;
	__nis_mapping_format_t	*ftmp;

	/* Count the number of format elements in the format */
	for (nf = 0, ftmp = f; ftmp->type != mmt_end; ftmp++) {
		nf++;
	}
	/* Count the mmt_end as well */
	nf++;

	for (n = 0; n < nf; n++) {
		str = scanMappingFormat(f, n, nf, str, 0, 0, 0);
		if (str == 0)
			break;
	}

	return ((str != 0) ? 1 : 0);
}

/*
 * Perform a match operation. For example, given the rule
 *	("{%s}%s", auth_name, public_data)=nisPublicKey
 * and assuming that 'nisPublicKey' has the value "{dh640-0}abcdef12345",
 * assign "dh640-0" to 'auth_name' and "abcdef12345" to 'public_data'.
 *
 * Note that this function doesn't perform the actual assignment. Rather,
 * it returns an array of __nis_value_t's, with element zero of the value
 * array being the new value of the first matched item, element one the
 * value of the second matched item, etc. In the example above, we'd
 * return a value array with two elements.
 *
 * If there is more than one input value (inVal->numVals > 1), the
 * output array elements will also be multi-valued.
 *
 * f		The match format
 * inVal	Input value(s)
 * numVal	Number of elements in the output value array
 * sepset	List of separators
 * outstr	Points to the updated position upto which the
 *		input string has been matched
 */
__nis_value_t **
matchMappingItem(__nis_mapping_format_t *f, __nis_value_t *inVal,
		int *numVals, char *sepset, char **outstr) {
	__nis_value_t		**v = 0;
	int			i, n, ni, numItems, nf;
	char			*str, *valstr;
	__nis_mapping_format_t	*ftmp;
	char			*myself = "matchMappingItem";

	if (f == 0 ||
		inVal == 0 || inVal->numVals < 1 || inVal->type != vt_string)
		return (0);

	/* Count the number of format elements and items in the format */
	for (nf = numItems = 0, ftmp = f; ftmp->type != mmt_end; ftmp++) {
		nf++;

		/*
		 * Count mmt_item and mmt_berstring (used by N2L to
		 * represent address %a)
		 */
		if (ftmp->type == mmt_item)
				numItems++;
		else if (ftmp->type == mmt_berstring && ftmp->match.berString &&
				ftmp->match.berString[0] == 'a')
				numItems++;
	}
	/* Count the mmt_end as well */
	nf++;

	/*
	 * If no items, there will be no values. This isn't exactly an error
	 * from the limited point of view of this function, so we return a
	 * __nis_value_t with zero values.
	 */
	if (numItems <= 0) {
		v = am(myself, sizeof (v[0]));
		if (v == 0)
			return (0);
		v[0] = am(myself, sizeof (*v[0]));
		if (v[0] == 0) {
			sfree(v);
			return (0);
		}
		v[0]->type = vt_string;
		v[0]->numVals = 0;
		v[0]->val = 0;
		if (numVals != 0)
			*numVals = 1;
		return (v);
	}

	/* Allocate and initialize the return array */
	v = am(myself, numItems * sizeof (v[0]));
	if (v == 0)
		return (0);
	for (n = 0; n < numItems; n++) {
		v[n] = am(myself, sizeof (*v[n]));
		if (v[n] == 0) {
			int	j;

			for (j = 0; j < n; j++)
				freeValue(v[j], 1);
			sfree(v);
			return (0);
		}
		v[n]->type = vt_string;
		v[n]->numVals = 0;
		v[n]->val = am(myself, inVal->numVals * sizeof (v[n]->val[0]));
		if (v[n]->val == 0) {
			int	j;

			for (j = 0; j < n; j++)
				freeValue(v[j], 1);
			sfree(v);
			return (0);
		}
		for (i = 0; i < inVal->numVals; i++) {
			v[n]->val[i].length = 0;
			v[n]->val[i].value = 0;
		}
	}

	/* For each input value, perform the match operation */
	for (i = 0; i < inVal->numVals; i++) {
		str = inVal->val[i].value;
		if (str == 0)
			continue;
		for (n = 0, ni = 0; n < nf; n++) {
			valstr = 0;
			str = scanMappingFormat(f, n, nf, str, &valstr,
				0, sepset);
			if (str == 0)
				break;
			if (valstr != 0 && ni < numItems &&
					v[ni]->numVals < inVal->numVals) {
				v[ni]->val[v[ni]->numVals].value = valstr;
				v[ni]->val[v[ni]->numVals].length =
							strlen(valstr) + 1;
				v[ni]->numVals++;
				ni++;
			} else if (valstr != 0) {
				sfree(valstr);
			}
		}
		if (str == 0) {
			for (n = 0; n < numItems; n++)
				freeValue(v[n], 1);
			sfree(v);
			return (0);
		}
	}

	if (numVals != 0)
		*numVals = numItems;

	/*
	 * Update the return string upto the point it has been matched
	 * This string will be used by the N2L code in its next call
	 * to this function
	 */
	if (outstr != 0)
		*outstr = str;

	return (v);
}

/*
 * Perform an extract operation. For example, given the expression
 *	(name, "%s.*")
 * and assuming 'name' is an item with the value "some.thing", the
 * value returned by the extract is "some".
 */
__nis_value_t *
extractMappingItem(__nis_mapping_item_t *item, __nis_mapping_format_t *f,
		__nis_rule_value_t *rv, int *stat) {
	__nis_value_t		*val = getMappingItem(item, mit_any,
			rv, 0, stat);
	__nis_single_value_t	*nval;
	int			i, n, nv, nf;
	__nis_mapping_format_t	*ftmp;

	if (val == 0)
		return (0);
	else if (f == 0 || rv == 0 || val->val == 0 ||
			val->numVals <= 0 || val->type != vt_string) {
		freeValue(val, 1);
		return (0);
	}

	/* Sanity check the format; it must have one and only one mmt_item */
	{
		int	numitem;

		for (nf = numitem = 0, ftmp = f; ftmp->type != mmt_end;
				ftmp++) {
			nf++;
			if (ftmp->type == mmt_item)
				numitem++;
		}
		/* Count the mmt_end as well */
		nf++;
		if (numitem != 1) {
			freeValue(val, 1);
			return (0);
		}
	}

	nval = val->val;
	nv = val->numVals;
	val->repeat = FALSE;
	val->val = 0;
	val->numVals = 0;

	/* If the item has multiple values, we extract each one independently */
	for (i = 0; i < nv; i++) {
		char			*str = nval[i].value;
		char			*newstr = 0;
		__nis_single_value_t	*newval;

		if (nval[i].value == 0)
			continue;

		/*
		 * We match the whole string, even if we find a value for
		 * the item before exhausting all format elements. By doing
		 * this, we ensure that the string really matches the complete
		 * format specification.
		 */
		for (n = 0; n < nf; n++) {
			str = scanMappingFormat(f, n, nf, str, &newstr, 0, 0);
			if (str == 0)
				break;
		}

		/*
		 * *str should now be NUL, meaning we've reached the end of
		 * the string (value), and it completely matched the format.
		 * If 'str' is NULL, there was an error, and if 'newstr' is
		 * 0, we somehow failed to obtain a value.
		 */
		if (str == 0 || *str != '\0' || newstr == 0 ||
				(newval = realloc(val->val,
					(val->numVals+1) *
					sizeof (val->val[0]))) == 0) {
			freeValue(val, 1);
			for (n = 0; n < nv; n++) {
				sfree(nval[n].value);
			}
			free(nval);
			sfree(newstr);
			return (0);
		}

		val->val = newval;
		val->val[val->numVals].value = newstr;
		val->val[val->numVals].length = strlen(newstr) + 1;
		val->numVals++;

		free(nval[i].value);
		nval[i].value = 0;
	}
	free(nval);

	return (val);
}

/*
 * For each value in 'val', remove the last character, provided that
 * it matches 'elide'.
 */
void
stringElide(__nis_value_t *val, char elide) {

	if (val != 0 && val->type == vt_string) {
		int	i;

		for (i = 0; i < val->numVals; i++) {
			int	end = val->val[i].length;
			char	*str = val->val[i].value;

			if (str == 0 || end <= 0)
				continue;

			/*
			 * If the NUL was counted in the length, step back
			 * over it.
			 */
			if (str[end-1] == '\0')
				end--;
			if (end > 0 && str[end-1] == elide) {
				str[end-1] = '\0';
				val->val[i].length--;
			}
		}
	}
}

/*
 * Obtain the value for the mapping sub-element 'e', given the input
 * rule-value 'rv'.
 */
__nis_value_t *
getMappingSubElement(__nis_mapping_sub_element_t *e,
	__nis_rule_value_t *rv, int *np_ldap_stat) {
	__nis_value_t	*val;

	if (e == 0)
		return (0);

	switch (e->type) {
	case me_item:
		val = getMappingItem(&e->element.item, mit_any, rv, 0,
			np_ldap_stat);
		break;
	case me_print:
		val = getMappingFormatArray(e->element.print.fmt, rv,
						fa_item,
						e->element.print.numItems,
						e->element.print.item);
		if (e->element.print.doElide)
			stringElide(val, e->element.print.elide);
		break;
	case me_split:
		val = splitMappingItem(&e->element.split.item,
					e->element.split.delim,
					rv);
		break;
	case me_extract:
		val = extractMappingItem(&e->element.extract.item,
					e->element.extract.fmt,
					rv, np_ldap_stat);
		break;
	case me_match:
	default:
		val = 0;
		break;
	}

	return (val);
}

/*
 * Obtain the value of the mapping element 'e', given the input rule-
 * value 'rv'. The 'native' mapping type is used when 'rv' is NULL,
 * and the result is a string representation of the mapping element;
 * in that case, items of the 'native' type are printed without their
 * type designation ("nis+" or "ldap").
 */
__nis_value_t *
getMappingElement(__nis_mapping_element_t *e, __nis_mapping_item_type_t native,
		__nis_rule_value_t *rv, int *stat) {
	__nis_value_t	*val, **tv;
	int		i, success = 0, novalue = 0;
	int *np_ldap_stat;
	char		*myself = "getMappingElement";

	switch (e->type) {
	case me_item:
		val = getMappingItem(&e->element.item, native, rv, 0, NULL);
		break;
	case me_print:
		tv = am(myself, e->element.print.numSubElements *
			sizeof (tv[0]));
		np_ldap_stat = am(myself,
			e->element.print.numSubElements * sizeof (int));
		if ((e->element.print.numSubElements > 0) &&
				(tv == 0 || np_ldap_stat == 0)) {
			val = 0;
			sfree(tv);
			sfree(np_ldap_stat);
			break;
		}
		for (i = 0; i < e->element.print.numSubElements; i++) {
			np_ldap_stat[i] = 0;
			tv[i] = getMappingSubElement(
				&e->element.print.subElement[i],
				rv, &np_ldap_stat[i]);
		}
		/*
		 * if we get NP_LDAP_NO_VALUE to any of the subelement
		 * and we get NP_LDAP_MAP_SUCCESS to all other subelement
		 * then we had enough nis+ column values which can
		 * produce value for this rule, but didn't. So return
		 * NP_LDAP_RULES_NO_VALUE to indicate to proceed to
		 * next database id.
		 */
		for (i = 0; i < e->element.print.numSubElements; i++) {
			if (np_ldap_stat[i] == NP_LDAP_MAP_SUCCESS)
				success++;
			if (np_ldap_stat[i] == NP_LDAP_NO_VALUE)
				novalue++;
		}
		if (stat != NULL && novalue > 0 &&
				((novalue+success) ==
					e->element.print.numSubElements))
					    *stat = NP_LDAP_RULES_NO_VALUE;
		val = getMappingFormatArray(e->element.print.fmt, rv,
						fa_value,
						e->element.print.numSubElements,
						tv);
		for (i = 0; i < e->element.print.numSubElements; i++) {
			freeValue(tv[i], 1);
		}
		sfree(tv);
		sfree(np_ldap_stat);
		if (e->element.print.doElide)
			stringElide(val, e->element.print.elide);
		break;
	case me_split:
		val = splitMappingItem(&e->element.split.item,
					e->element.split.delim,
					rv);
		break;
	case me_match:
		/*
		 * A match doesn't produce an assignable value per se,
		 * so we shouldn't get one here.
		 */
		val = 0;
		break;
	case me_extract:
		val = extractMappingItem(&e->element.extract.item,
					e->element.extract.fmt,
					rv, NULL);
		break;
	default:
		val = 0;
		break;
	}

	return (val);
}