lib/libnisdb/ldap_val.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2001-2003 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <lber.h>
#include <ldap.h>
#include <strings.h>
#include <errno.h>

#include "nisdb_mt.h"

#include "ldap_util.h"
#include "ldap_op.h"
#include "ldap_ruleval.h"
#include "ldap_attr.h"
#include "ldap_val.h"
#include "ldap_nisplus.h"
#include "ldap_ldap.h"

extern int yp2ldap;


__nis_mapping_format_t *
cloneMappingFormat(__nis_mapping_format_t *m) {
	__nis_mapping_format_t	*new;
	int			i, nf, err;
	char			*myself = "cloneMappingFormat";

	if (m == 0)
		return (0);

	for (nf = 0; m[nf].type != mmt_end; nf++);
	nf++;

	new = am(myself, nf * sizeof (new[0]));
	if (new == 0)
		return (0);

	/* Copy the whole array */
	memcpy(new, m, nf * sizeof (new[0]));

	/* Make copies of allocated stuff */
	for (i = 0, err = 0; i < nf; i++) {
		switch (m[i].type) {
		case mmt_string:
			new[i].match.string = sdup(myself, T,
							m[i].match.string);
			if (new[i].match.string == 0 && m[i].match.string != 0)
				err++;
			break;
		case mmt_single:
			new[i].match.single.lo =
				am(myself, m[i].match.single.numRange *
					sizeof (new[i].match.single.lo[0]));
			new[i].match.single.hi =
				am(myself, m[i].match.single.numRange *
					sizeof (new[i].match.single.hi[0]));
			if (new[i].match.single.lo != 0)
				memcpy(new[i].match.single.lo,
					m[i].match.single.lo,
					m[i].match.single.numRange);
			else if (m[i].match.single.lo != 0)
				err++;
			if (new[i].match.single.hi != 0)
				memcpy(new[i].match.single.hi,
					m[i].match.single.hi,
					m[i].match.single.numRange);
			else if (m[i].match.single.hi != 0)
				err++;
			break;
		case mmt_berstring:
			new[i].match.berString = sdup(myself, T,
							m[i].match.berString);
			if (new[i].match.berString == 0 &&
					m[i].match.berString != 0)
				err++;
			break;
		case mmt_item:
		case mmt_limit:
		case mmt_any:
		case mmt_begin:
		case mmt_end:
		default:
			break;
		}
	}

	/* If there were memory allocation errors, free the copy */
	if (err > 0) {
		freeMappingFormat(new);
		new = 0;
	}

	return (new);
}

void
freeMappingFormat(__nis_mapping_format_t *m) {
	int	i;

	if (m == 0)
		return;

	for (i = 0; m[i].type != mmt_end; i++) {
		switch (m[i].type) {
		case mmt_string:
			sfree(m[i].match.string);
			break;
		case mmt_single:
			sfree(m[i].match.single.lo);
			sfree(m[i].match.single.hi);
			break;
		case mmt_berstring:
			sfree(m[i].match.berString);
			break;
		case mmt_item:
		case mmt_limit:
		case mmt_any:
		case mmt_begin:
		case mmt_end:
		default:
			break;
		}
	}

	free(m);
}


void
copyIndex(__nis_index_t *old, __nis_index_t *new, int *err) {
	int	i;
	char	*myself = "copyIndex";

	if (old == 0 || new == 0) {
		*err = EINVAL;
		return;
	}

	for (i = 0; i < old->numIndexes; i++) {
		new->name[i] = sdup(myself, T, old->name[i]);
		if (new->name[i] == 0 && old->name[i] != 0) {
			*err = ENOMEM;
			return;
		}
		new->value[i] = cloneMappingFormat(old->value[i]);
		if (new->value[i] == 0 && old->value[i] != 0) {
			*err = ENOMEM;
			return;
		}
	}

	new->numIndexes = old->numIndexes;
}

__nis_index_t *
cloneIndex(__nis_index_t *old) {
	char		*myself = "cloneIndex";
	int		err = 0;
	__nis_index_t	*new = am(myself, sizeof (*new));

	if (old == 0)
		return (0);

	if (new != 0) {
		copyIndex(old, new, &err);
		if (err != 0) {
			freeIndex(new, 1);
			new = 0;
		}
	}

	return (new);
}

void
freeIndex(__nis_index_t *old, bool_t doFree) {
	int	i;

	if (old == 0)
		return;

	for (i = 0; i < old->numIndexes; i++) {
		sfree(old->name[i]);
		freeMappingFormat(old->value[i]);
	}

	if (doFree)
		free(old);
}

char **
cloneName(char **name, int numNames) {
	char	**new;
	int	i;
	char	*myself = "cloneName";

	if (name == 0 || numNames <= 0)
		return (0);

	new = am(myself, numNames * sizeof (new[0]));
	if (new == 0)
		return (0);

	for (i = 0; i < numNames; i++) {
		if (name[i] != 0) {
			new[i] = sdup(myself, T, name[i]);
			if (new[i] == 0) {
				for (i--; i >= 0; i--) {
					sfree(new[i]);
				}
				sfree(new);
				return (0);
			}
		} else {
			new[i] = 0;
		}
	}

	return (new);
}

void
freeValue(__nis_value_t *val, int count) {
	int	c, i;

	if (val == 0)
		return;

	for (c = 0; c < count; c++) {
		if (val[c].val != 0) {
			for (i = 0; i < val[c].numVals; i++) {
				sfree(val[c].val[i].value);
			}
			free(val[c].val);
		}
	}

	free(val);
}

__nis_value_t *
cloneValue(__nis_value_t *val, int count) {
	__nis_value_t	*n;
	int		c, i;
	char		*myself = "cloneValue";

	if (count <= 0 || val == 0)
		return (0);

	n = am(myself, count * sizeof (*n));
	if (n == 0)
		return (0);

	for (c = 0; c < count; c++) {
		n[c].type = val[c].type;
		n[c].repeat = val[c].repeat;
		n[c].numVals = val[c].numVals;
		if (n[c].numVals > 0) {
			n[c].val = am(myself, n[c].numVals *
						sizeof (n[c].val[0]));
			if (n[c].val == 0) {
				freeValue(n, c);
				return (0);
			}
		} else {
			n[c].val = 0;
		}
		for (i = 0; i < n[c].numVals; i++) {
			int	amlen = val[c].val[i].length;

			/*
			 * The functions that create string values try to
			 * make sure that there's a NUL at the end. However,
			 * both NIS+ and LDAP have a tendency to store strings
			 * without a NUL, so the value length may not include
			 * the NUL (even though it's there). In order to
			 * preserve that NUL, we add a byte to the length if
			 * the type is vt_string, and there isn't already a
			 * NUL at the end. The memory allocation function
			 * (am()) will take care of actually putting the NUL
			 * in place, since it allocates zero-initialized
			 * memory.
			 */
			n[c].val[i].length = val[c].val[i].length;
			if (n[c].type == vt_string && amlen > 0 &&
				((char *)val[c].val[i].value)[amlen-1] !=
					'\0') {
				amlen++;
			}
			n[c].val[i].value = am(myself, amlen);
			if (amlen > 0 && n[c].val[i].value == 0) {
				freeValue(n, c);
				return (0);
			}
			memcpy(n[c].val[i].value, val[c].val[i].value,
				n[c].val[i].length);
		}
	}

	return (n);
}

/* Define LBER_USE_DER per ber_decode(3LDAP) */
#ifndef	LBER_USE_DER
#define	LBER_USE_DER	0x01
#endif	/* LBER_USE_DER */

/*
 * Return a copy of 'valIn' where each value has been replaced by the
 * BER encoded equivalent specified by 'berstring'. 'valIn' is unchanged.
 */
__nis_value_t *
berEncode(__nis_value_t *valIn, char *berstring) {
	char		*myself = "berEncode";
	__nis_value_t	*val;
	int		i;

	if (valIn == 0 || berstring == 0)
		return (0);

	val = cloneValue(valIn, 1);
	if (val == 0)
		return (0);

	for (i = 0; i < val->numVals; i++) {
		BerElement	*ber = ber_alloc();
		struct berval	*bv = 0;
		int		ret;

		if (ber == 0) {
			logmsg(MSG_NOMEM, LOG_ERR, "%s: ber_alloc() => NULL",
				myself);
			freeValue(val, 1);
			return (0);
		}

		if ((strcmp("b", berstring) == 0 ||
				strcmp("i", berstring) == 0)) {
			if (val->val[i].length >= sizeof (int)) {
				ret = ber_printf(ber, berstring,
					*((int *)(val->val[i].value)));
			} else {
				ret = -1;
			}
		} else if (strcmp("B", berstring) == 0) {
			ret = ber_printf(ber, berstring,
				val->val[i].value,
				val->val[i].length * 8);
		} else if (strcmp("n", berstring) == 0) {
			ret = ber_printf(ber, berstring);
		} else if (strcmp("o", berstring) == 0) {
			ret = ber_printf(ber, berstring,
				val->val[i].value, val->val[i].length);
		} else if (strcmp("s", berstring) == 0) {
			char	*str = am(myself, val->val[i].length + 1);

			if (str != 0) {
				ret = ber_printf(ber, berstring, str);
				free(str);
			} else {
				ret = -1;
			}
		} else {
			ret = -1;
		}

		if (ret == -1) {
			reportError(NPL_BERENCODE, "%s: BER encoding error",
					myself);
			ber_free(ber, 1);
			freeValue(val, 1);
			return (0);
		}

		if (ber_flatten(ber, &bv) != 0 || bv == 0) {
			reportError(NPL_BERENCODE, "%s: ber_flatten() error",
					myself);
			ber_free(ber, 1);
			freeValue(val, 1);
			return (0);
		}

		sfree(val->val[i].value);
		val->val[i].length = bv->bv_len;
		val->val[i].value = bv->bv_val;

		ber_free(ber, 1);
	}

	val->type = vt_ber;

	return (val);
}

__nis_value_t *
berDecode(__nis_value_t *valIn, char *berstring) {
	__nis_value_t	*val;
	int		i;
	char		*myself = "berDecode";

	if (valIn == 0 || berstring == 0)
		return (0);

	val = cloneValue(valIn, 1);
	if (val == 0)
		return (0);

	for (i = 0; i < val->numVals; i++) {
		void		*v = 0;
		int		ret, len = 0;
		struct berval	bv;
		BerElement	*ber;

		if (val->val[i].value == 0 || val->val[i].length <= 0)
			continue;

		bv.bv_val = val->val[i].value;
		bv.bv_len = val->val[i].length;
		ber = ber_init(&bv);
		if (ber == 0) {
			reportError(NPL_BERDECODE, "%s: ber_init() error",
				myself);
			freeValue(val, 1);
			return (0);
		}

		if ((strcmp("b", berstring) == 0 ||
				strcmp("i", berstring) == 0)) {
			len = sizeof (int);
			v = am(myself, len);
			if (v != 0) {
				ret = ber_scanf(ber, berstring, v);
			} else {
				ret = -1;
			}
		} else if (strcmp("B", berstring) == 0) {
			long	llen;

			ret = ber_scanf(ber, berstring, &v, &llen);
			if (ret != -1) {
				len = llen/8;
			}
		} else if (strcmp("n", berstring) == 0) {
			ret = 0;
		} else if (strcmp("o", berstring) == 0) {
			struct berval	*bv = am(myself, sizeof (*bv));

			if (bv != 0) {
				ret = ber_scanf(ber, "O", &bv);
				if (ret != -1 && bv != 0) {
					v = bv->bv_val;
					len = bv->bv_len;
				} else {
					ret = -1;
				}
				/* Only free 'bv' itself */
				free(bv);
			} else {
				ret = -1;
			}
		} else if (strcmp("s", berstring) == 0) {
			ret = ber_scanf(ber, "a", &v);
			if (ret != -1) {
				len = slen(v);
			}
		} else {
			ret = -1;
		}

		if (ret == -1) {
			reportError(NPL_BERDECODE, "%s: BER decoding error",
					myself);
			freeValue(val, 1);
			return (0);
		}

		/* Free the old value, and replace it with the decoded one */
		sfree(val->val[i].value);
		val->val[i].value = v;
		val->val[i].length = len;
	}

	return (val);
}

/*
 * Return the value of the specified item.
 */
__nis_value_t *
getMappingItemVal(__nis_mapping_item_t *item, __nis_mapping_item_type_t native,
		__nis_rule_value_t *rv, char *berstring, int *np_ldap_stat) {
	__nis_value_t				*val = 0, *nameVal, *exVal = 0;
	int					numName, caseInsens, cmp;
	int					i, j, k;
	char					**name;
	enum {rvOnly, rvThenLookup, lookupOnly}	check;
	unsigned char				fromldap = '\0';

	if (item == 0)
		return (0);

	/*
	 * First, we decide if we should look for the value in 'rv',
	 * directly from NIS+/LDAP, or both.
	 */
	switch (item->type) {
	case mit_nisplus:
		/* Do we have a valid index/object spec ? */
		if (item->searchSpec.obj.index.numIndexes <= 0 &&
				item->searchSpec.obj.name == 0) {
			/*
			 * No valid index/object. If we have a rule-value,
			 * use it. Otherwise, return error.
			 */
			if (rv != 0) {
				name = rv->colName;
				nameVal = rv->colVal;
				numName = rv->numColumns;
				caseInsens = 0;
				check = rvOnly;
			} else {
				return (0);
			}
		} else {
			/*
			 * Valid index, so skip the rule-value and do
			 * a direct NIS+ lookup.
			 */
			check = lookupOnly;
		}
		break;
	case mit_ldap:
		if (rv != 0) {
			name = rv->attrName;
			nameVal = rv->attrVal;
			numName = rv->numAttrs;
			caseInsens = 1;
			fromldap = '1';
		}
		/* Do we have a valid triple ? */
		if (item->searchSpec.triple.scope == LDAP_SCOPE_UNKNOWN) {
			/*
			 * No valid triple. If we have a rule-value, use it.
			 * Otherwise, return error.
			 */
			if (rv != 0) {
				check = rvOnly;
			} else {
				return (0);
			}
		} else if (item->searchSpec.triple.base == 0 &&
				item->searchSpec.triple.scope ==
					LDAP_SCOPE_ONELEVEL &&
				item->searchSpec.triple.attrs == 0 &&
				item->searchSpec.triple.element == 0) {
			/*
			 * We have a valid triple, but it points to the
			 * current LDAP container. Thus, first look in
			 * the rule-value; if that fails, perform a direct
			 * LDAP lookup.
			 */
			if (rv != 0) {
				check = rvThenLookup;
			} else {
				check = lookupOnly;
			}
		} else {
			/*
			 * Valid triple, and it's not the current container
			 * (at least not in the trivial sense). Hence, do
			 * a direct LDAP lookup.
			 */
			check = lookupOnly;
		}
		break;
	default:
		return (0);
	}

	/* Check the rule-value */
	if (check == rvOnly || check == rvThenLookup) {
		for (i = 0; i < numName; i++) {
			if (caseInsens)
				cmp = strcasecmp(item->name, name[i]);
			else
				cmp = strcmp(item->name, name[i]);
			if (cmp == 0) {
				if (nameVal[i].numVals <= 0)
					break;
				if (berstring == 0) {
					val = cloneValue(&nameVal[i], 1);
				} else if (yp2ldap && berstring[0] == 'a') {
					val = cloneValue(&nameVal[i], 1);
				} else {
					val = berDecode(&nameVal[i],
						berstring);
				}
				if (val != 0) {
					val->repeat = item->repeat;
					/*
					 * If value for nis+ column is
					 * passed with value, val is
					 * manipulated in cloneValue().
					 * To decide whether there are
					 * enough nis+ column values
					 * for rule to produce a value,
					 * we need nis+ column values
					 * as well as nis_mapping_element
					 * from the rule. If we are here,
					 * it indicates that the 'val has
					 * an valid value for the column
					 * item-> name. So set
					 * NP_LDAP_MAP_SUCCESS
					 * to np_ldap-stat.
					 */

					if (np_ldap_stat != NULL)
						*np_ldap_stat =
							NP_LDAP_MAP_SUCCESS;
				}
				break;
			}
		}
	}

	/* Do a direct lookup ? */
	if (val == 0 && (check == rvThenLookup || check == lookupOnly)) {
		if (item->type == mit_nisplus) {
			val = lookupNisPlus(&item->searchSpec.obj, item->name,
						rv);
		} else if (item->type == mit_ldap) {
			int	err = 0;
			__nis_search_triple_t	triple;
			char			*baseDN;

			/*
			 * If item->searchSpec.triple.base is NULL, or ends
			 * in a comma, append the current search base from
			 * the TSD (put there by an upper layer).
			 *
			 * Special case for N2L mode:
			 * if item->searchSpec.triple.base ends in a comma,
			 * the current domain Context is used.
			 */
			if (yp2ldap && item->searchSpec.triple.base &&
				strlen(item->searchSpec.triple.base) > 0) {
				baseDN = __nisdb_get_tsd()->domainContext;
			} else {
				baseDN = __nisdb_get_tsd()->searchBase;
			}
			triple.base = appendBase(item->searchSpec.triple.base,
				baseDN, &err, 0);
			if (err == 0) {
				triple.scope = item->searchSpec.triple.scope;
				triple.attrs = item->searchSpec.triple.attrs;
				triple.element =
					item->searchSpec.triple.element;
				val = lookupLDAP(&triple, item->name, rv, 0,
					np_ldap_stat);
				fromldap = '1';
			} else {
				val = 0;
			}
			sfree(triple.base);
		}
	}


	/* Special processing for NIS to LDAP mode */
	if (yp2ldap && val != 0) {

		/*
		 * Escape special chars from dn before sending to DIT,
		 * provided val is not ldap-based
		 */
		if (fromldap == '\0' && __nisdb_get_tsd()->escapeFlag == '1') {
			if (escapeSpecialChars(val) < 0) {
				freeValue(val, 1);
				return (0);
			}
		} else if (__nisdb_get_tsd()->escapeFlag == '2') {
			/* Remove escape chars from data received from DIT */
			(void) removeEscapeChars(val);
		}

		/*
		 * Remove from 'val', any values obtained using
		 * the 'removespec' syntax
		 */

		/* Obtain exVal */
		if (item->exItem)
			exVal = getMappingItemVal(item->exItem, native, rv,
			    berstring, NULL);

		/* delete */
		if (exVal != 0) {
			for (i = 0; i < val->numVals; ) {
				for (j = 0; j < exVal->numVals; j++) {
					if (sstrncmp(val->val[i].value,
							exVal->val[j].value,
							MAX(val->val[i].length,
							exVal->val[j].length))
							== 0)
						break;
				}
				if (j < exVal->numVals) {
					sfree(val->val[i].value);
					val->val[i].value = 0;
					val->val[i].length = 0;
					for (k = i; k < val->numVals - 1; k++) {
						val->val[k] = val->val[k + 1];
						val->val[k + 1].value = 0;
						val->val[k + 1].length = 0;
					}
					val->numVals--;
				} else
					i++;
			}

			freeValue(exVal, 1);

			/*
			 * If val->numVals <= 0, then we have no val to
			 * return. So free up stuff.
			 */
			if (val->numVals <= 0) {
				free(val->val);
				val->val = 0;
				free(val);
				return (0);
			}
		}
	}

	return (val);
}

__nis_value_t *
getMappingFormat(__nis_mapping_format_t *f, __nis_rule_value_t *rv,
			__nis_format_arg_t at, void *a, int *numArg) {
	char		*myself = "getMappingFormat";
	__nis_value_t	*val = 0;
	__nis_buffer_t	b = {0, 0};
	int		i;

	if (f == 0)
		return (0);

	if (rv == 0) {
		val = am(myself, sizeof (*val));
		if (val == 0)
			return (0);

		switch (f->type) {
		case mmt_item:
			bp2buf(myself, &b, "%%s");
			break;
		case mmt_string:
			bp2buf(myself, &b, "%s", NIL(f->match.string));
			break;
		case mmt_single:
			bp2buf(myself, &b, "[");
			for (i = 0; i < f->match.single.numRange; i++) {
				if (f->match.single.lo[i] ==
						f->match.single.hi[i])
					bp2buf(myself, &b, "%c",
						f->match.single.lo[i]);
				else
					bp2buf(myself, &b, "%c-%c",
						f->match.single.lo[i],
						f->match.single.hi[i]);
			}
			bp2buf(myself, &b, "]");
			break;
		case mmt_limit:
			break;
		case mmt_any:
			bp2buf(myself, &b, "*");
			break;
		case mmt_berstring:
			bp2buf(myself, &b, "%s", NIL(f->match.berString));
			break;
		case mmt_begin:
		case mmt_end:
			bp2buf(myself, &b, "\"");
			break;
		default:
			bp2buf(myself, &b, "<unknown>");
		}
		val->type = vt_string;
		val->numVals = 1;
		val->val = am(myself, sizeof (val->val[0]));
		if (val->val == 0) {
			sfree(val);
			return (0);
		}
		val->val[0].value = b.buf;
		val->val[0].length = b.len;
	} else {
		switch (f->type) {
		case mmt_item:
		case mmt_berstring:
			if (a != 0) {
				if (at == fa_item) {
					val = getMappingItemVal(
						(__nis_mapping_item_t *)a,
						mit_any, rv,
		(f->type == mmt_berstring) ? f->match.berString : 0, NULL);
					if (numArg != 0)
						(*numArg)++;
				} else {
					val = cloneValue(
						(__nis_value_t *)a, 1);
					if (numArg != 0)
						(*numArg)++;
				}
			}
			break;
		case mmt_string:
			val = am(myself, sizeof (*val));
			if (val == 0)
				return (0);
			val->type = vt_string;
			val->numVals = 1;
			val->val = am(myself, sizeof (val->val[0]));
			if (val->val == 0) {
				sfree(val);
				return (0);
			}
			val->val[0].value = sdup(myself, T, f->match.string);
			val->val[0].length = strlen(val->val[0].value);
			break;
		case mmt_single:
		case mmt_limit:
		case mmt_any:
		case mmt_begin:
		case mmt_end:
			/* Not an error, so return an empty value */
			val = am(myself, sizeof (*val));
			if (val == 0)
				return (0);
			val->type = vt_string;
			val->numVals = 0;
			val->val = 0;
			break;
		default:
			/* Do nothing */
			val = 0;
			break;
		}
	}
	return (val);
}

/*
 * Used when evaluating an expression. Typically, the value of the
 * expression so far will be kept in 'v1', and 'v2' is the value
 * of the current component of the expression. In the general case,
 * both will be multi-valued, and the result is an "explosion"
 * resulting in N*M new values (if 'v1' had N values, and 'v2'
 * M ditto).
 *
 * For example, if v1 = {"ab", "cd", "ef"}, and v2 = {"gh", "ij", "kl"},
 * the result will be {"abgh", "abij", "abkl", "cdgh", "cdij", "cdkl",
 * "efgh", "efij", "efkl"}.
 *
 * There are special cases when v1->repeat and/or v2->repeat are set.
 * Repeat mostly makes sense with single values; for example, if
 * v1 = {"x="} with repeat on, and v2 = {"1", "2", "3"}, the result
 * is {"x=1", "x=2", "x=3"}.
 *
 * The result if v2 also had repeat on would be {"x=1x=2x=3"}. It's
 * not clear if there's a useful application for this, but the code's
 * there for the sake of orthogonality.
 */
__nis_value_t *
explodeValues(__nis_value_t *v1, __nis_value_t *v2) {
	int		i1, i2, n, nv;
	__nis_value_t	*v;
	__nis_buffer_t	b = {0, 0};
	char		*myself = "explodeValues";

	if (v1 == 0 || v1->numVals <= 0)
		return (cloneValue(v2, 1));
	if (v2 == 0 || v2->numVals <= 0)
		return (cloneValue(v1, 1));

	/*
	 * XXX What should we do if (v1->type != v2->type) ?
	 * Policy: Just explode anyway, even though the result is
	 * unlikely to be very useful.
	 */

	v = am(myself, sizeof (*v));
	if (v == 0)
		return (0);

	if (!v1->repeat && !v2->repeat)
		nv = v1->numVals * v2->numVals;
	else if (v1->repeat && !v2->repeat)
		nv = v2->numVals;
	else if (!v1->repeat && v2->repeat)
		nv = v1->numVals;
	else /* v1->repeat && v2->repeat */
		nv = 1;

	v->val = am(myself, nv * sizeof (v->val[0]));
	if (v->val == 0) {
		free(v);
		return (0);
	}

	/*
	 * Four different cases, depending on the 'repeat' flags.
	 */
	if (!v1->repeat && !v2->repeat) {
		for (i1 = 0, n = 0; i1 < v1->numVals; i1++) {
			for (i2 = 0; i2 < v2->numVals; i2++) {
				if (v1->type == vt_string)
					sbc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				else
					bc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				if (v2->type == vt_string)
					sbc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
				else
					bc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
				v->val[n].value = b.buf;
				v->val[n].length = b.len;
				n++;
				b.buf = 0;
				b.len = 0;
			}
		}
	} else if (v1->repeat && !v2->repeat) {
		for (i2 = 0; i2 < v2->numVals; i2++) {
			for (i1 = 0, n = 0; i1 < v1->numVals; i1++) {
				if (v1->type == vt_string)
					sbc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				else
					bc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				if (v2->type == vt_string)
					sbc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
				else
					bc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
			}
			v->val[n].value = b.buf;
			v->val[n].length = b.len;
			n++;
			b.buf = 0;
			b.len = 0;
		}
	} else if (!v1->repeat && v2->repeat) {
		for (i1 = 0, n = 0; i1 < v1->numVals; i1++) {
			for (i2 = 0; i2 < v2->numVals; i2++) {
				if (v1->type == vt_string)
					sbc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				else
					bc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				if (v2->type == vt_string)
					sbc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
				else
					bc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
			}
			v->val[n].value = b.buf;
			v->val[n].length = b.len;
			n++;
			b.buf = 0;
			b.len = 0;
		}
	} else { /* v1->repeat && v2->repeat */
		for (i1 = 0, n = 0; i1 < v1->numVals; i1++) {
			for (i2 = 0; i2 < v2->numVals; i2++) {
				if (v1->type == vt_string)
					sbc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				else
					bc2buf(myself, v1->val[i1].value,
						v1->val[i1].length,
						&b);
				if (v2->type == vt_string)
					sbc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
				else
					bc2buf(myself, v2->val[i2].value,
						v2->val[i2].length,
						&b);
			}
		}
		v->val[n].value = b.buf;
		v->val[n].length = b.len;
		n++;
		b.buf = 0;
		b.len = 0;
	}

#ifdef	NISDB_LDAP_DEBUG
	/* Sanity check */
	if (n != nv)
		abort();
#endif	/* NISD__LDAP_DEBUG */

	v->type = (v1->type == vt_string) ?
			((v2->type == vt_string) ?
				vt_string : vt_ber) : vt_ber;
	v->repeat = 0;
	v->numVals = n;

	return (v);
}

__nis_value_t *
getMappingFormatArray(__nis_mapping_format_t *a, __nis_rule_value_t *rv,
			__nis_format_arg_t at, int numArgs, void *arg) {
	int			i, ia = 0;
	__nis_value_t		*val, *v = 0;
	bool_t			moreFormat = (a != 0);
	bool_t			moreArgs = (numArgs > 0);

	while (moreFormat && (arg == 0 || ia < numArgs)) {
		for (i = 0; moreFormat; i++) {
			moreFormat = (a[i].type != mmt_end);
			if (at == fa_item) {
				__nis_mapping_item_t *item = arg;
				val = getMappingFormat(&a[i], rv, at,
					((item != 0) ? &item[ia] : 0), &ia);
			} else {
				__nis_value_t **ival = arg;
				val = getMappingFormat(&a[i], rv, at,
					((ival != 0) ? ival[ia] : 0), &ia);
			}
			if (val != 0) {
				__nis_value_t	*new = explodeValues(v, val);

				freeValue(v, 1);
				freeValue(val, 1);
				if (new == 0)
					return (0);

				v = new;
			} else {
				freeValue(v, 1);
				return (0);
			}
			/*
			 * If we run out of arguments, but still have format
			 * remaining, repeat the last argument. Keep track of
			 * the fact that we've really consumed all arguments.
			 */
			if (moreFormat &&