Add ignore-subtree and restrict-subtree settings

Add {nis,schema-compat}-ignore-subtree (subtrees under which we ignore
contents and updates )and {nis,schema-compat}-restrict-subtree (subtrees
out of which we ignore contents and updates, if set) settings, and
default the former to "cn=tasks,cn=config".

This should avoid cases where we're looking through the ldbm backend for
entries which have a dangling reference to a newly-added task (which,
because it's in the DSE, means we acquire an ldbm lock after acquiring
our internal lock) while also updating a compat entry after its source
entry is modified (for example, by the memberOf plugin, which results in
us attempting to acquire our lock while the ldbm lock is already held).

1 files changed, 216 insertions, 15 deletions

diff --git a/src/format.c b/src/format.c
index cfec33e..d5dc7ff 100644
--- a/src/format.c
+++ b/src/format.c
@@ -60,6 +60,8 @@ static int format_expand(struct plugin_state *state,
 			 Slapi_PBlock *pb, Slapi_Entry *e,
 			 const char *group, const char *set,
 			 const char *fmt, const char *disallowed,
+			 const struct slapi_dn **restrict_subtrees,
+			 const struct slapi_dn **ignore_subtrees,
 			 char *outbuf, int outbuf_len,
 			 struct format_choice **outbuf_choices,
 			 char ***rel_attrs, char ***ref_attrs,
@@ -286,8 +288,8 @@ format_add_sdn_list(struct slapi_dn ***list, struct slapi_dn ***list2,
 }
 
 static int
-format_check_entry(Slapi_PBlock *pb, const char *dn, char *filter,
-		   void *identity)
+format_check_entry_exists(Slapi_PBlock *pb, const char *dn, char *filter,
+			  void *identity)
 {
 	Slapi_DN *sdn;
 	Slapi_Entry *entry;
@@ -303,12 +305,62 @@ format_check_entry(Slapi_PBlock *pb, const char *dn, char *filter,
 	}
 }
 
+static int
+format_check_sdn_location(const Slapi_DN *sdn,
+			  const struct slapi_dn **restrict_subtrees,
+			  const struct slapi_dn **ignore_subtrees)
+{
+	int i;
+
+	if (restrict_subtrees != NULL) {
+		for (i = 0; restrict_subtrees[i] != NULL; i++) {
+			if (slapi_sdn_scope_test(sdn,
+						 restrict_subtrees[i],
+						 LDAP_SCOPE_SUBTREE) != 0) {
+				break;
+			}
+		}
+		if (restrict_subtrees[i] == NULL) {
+			/* Non-empty list, but no match. */
+			return ENOENT;
+		}
+	}
+	if (ignore_subtrees != NULL) {
+		for (i = 0; ignore_subtrees[i] != NULL; i++) {
+			if (slapi_sdn_scope_test(sdn,
+						 ignore_subtrees[i],
+						 LDAP_SCOPE_SUBTREE) != 0) {
+				return ENOENT;
+			}
+		}
+	}
+	return 0;
+}
+
+static int
+format_check_dn_location(const char *dn,
+			 const struct slapi_dn **restrict_subtrees,
+			 const struct slapi_dn **ignore_subtrees)
+{
+	int ret = ENOENT;
+	Slapi_DN *sdn;
+
+	sdn = slapi_sdn_new_dn_byref(dn);
+	if (sdn != NULL) {
+		ret = format_check_sdn_location(sdn,
+						restrict_subtrees,
+						ignore_subtrees);
+		slapi_sdn_free(&sdn);
+	}
+	return ret;
+}
+
 static void
-format_add_filtered_sdn_list(Slapi_PBlock *pb,
-			     struct slapi_dn ***list, struct slapi_dn ***list2,
-			     const char *dn, char *filter, void *identity)
+format_maybe_add_sdn_list(Slapi_PBlock *pb,
+			  struct slapi_dn ***list, struct slapi_dn ***list2,
+			  const char *dn, char *filter, void *identity)
 {
-	if (format_check_entry(pb, dn, filter, identity) == 0) {
+	if (format_check_entry_exists(pb, dn, filter, identity) == 0) {
 		format_add_sdn_list(list, list2, dn);
 	}
 }
@@ -918,6 +970,8 @@ static int
 format_first(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *group, const char *set,
 	     const char *args, const char *disallowed,
+	     const struct slapi_dn **restrict_subtrees,
+	     const struct slapi_dn **ignore_subtrees,
 	     char *outbuf, int outbuf_len,
 	     struct format_choice **outbuf_choices,
 	     char ***rel_attrs,
@@ -951,6 +1005,7 @@ format_first(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	ret = -ENOENT;
 	values = format_get_data_set(state, pb, e, group, set,
 				     value_format, disallowed,
+				     restrict_subtrees, ignore_subtrees,
 				     rel_attrs, ref_attrs, inref_attrs,
 				     ref_attr_list, inref_attr_list,
 				     &lengths);
@@ -966,6 +1021,8 @@ format_first(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			i = format_expand(state, pb, e,
 					  group, set,
 					  default_value, NULL,
+					  restrict_subtrees,
+					  ignore_subtrees,
 					  outbuf, outbuf_len,
 					  outbuf_choices,
 					  rel_attrs, ref_attrs, inref_attrs,
@@ -1006,6 +1063,8 @@ format_deref_x(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *fname, const char *group, const char *set,
 	       char *ref_attr, char *target_attr,
 	       char *filter, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs,
@@ -1059,6 +1118,16 @@ format_deref_x(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 					"\"%s\"\n", fname, cref);
 			continue;
 		}
+		if (format_check_sdn_location(refdn,
+					      restrict_subtrees,
+					      ignore_subtrees) != 0) {
+			slapi_log_error(SLAPI_LOG_PLUGIN,
+					state->plugin_desc->spd_id,
+					"%s: entry \"%s\" is in a location "
+					"where we don't look\n", fname, cref);
+			slapi_sdn_free(&refdn);
+			continue;
+		}
 		wrap_search_internal_get_entry(pb, refdn, filter, attrs, &ref,
 					       state->plugin_identity);
 		if (ref == NULL) {
@@ -1115,6 +1184,8 @@ static int
 format_deref(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *group, const char *set,
 	     const char *args, const char *disallowed,
+	     const struct slapi_dn **restrict_subtrees,
+	     const struct slapi_dn **ignore_subtrees,
 	     char *outbuf, int outbuf_len,
 	     struct format_choice **outbuf_choices,
 	     char ***rel_attrs,
@@ -1147,6 +1218,7 @@ format_deref(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	target_attr = argv[1];
 	ret = format_deref_x(state, pb, e, "deref", group, set,
 			     ref_attr, target_attr, NULL, disallowed,
+			     restrict_subtrees, ignore_subtrees,
 			     outbuf, outbuf_len, outbuf_choices,
 			     rel_attrs, ref_attrs, inref_attrs,
 			     ref_attr_list, inref_attr_list);
@@ -1158,6 +1230,8 @@ static int
 format_deref_f(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs, char ***ref_attrs,
@@ -1191,6 +1265,7 @@ format_deref_f(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	target_attr = argv[2];
 	ret = format_deref_x(state, pb, e, "deref_f", group, set,
 			     ref_attr, target_attr, filter, disallowed,
+			     restrict_subtrees, ignore_subtrees,
 			     outbuf, outbuf_len, outbuf_choices,
 			     rel_attrs, ref_attrs, inref_attrs,
 			     ref_attr_list, inref_attr_list);
@@ -1207,6 +1282,8 @@ format_deref_rx(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *fname, const char *group, const char *set,
 		const char **attributes, const char **filters,
 		const char *disallowed,
+	        const struct slapi_dn **restrict_subtrees,
+	        const struct slapi_dn **ignore_subtrees,
 		char *outbuf, int outbuf_len,
 		struct format_choice **outbuf_choices,
 		char ***rel_attrs, char ***ref_attrs,
@@ -1272,6 +1349,18 @@ format_deref_rx(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			format_add_sdn_list(&list->links[i].base_sdn_list,
 					    &list->links[i].base_sdn_list2,
 					    slapi_sdn_get_ndn(parent));
+			/* Check if the referred-to entry is in a location that
+			 * we care about. */
+			if (format_check_sdn_location(these[j],
+						      restrict_subtrees,
+						      ignore_subtrees) != 0) {
+				slapi_log_error(SLAPI_LOG_PLUGIN,
+						state->plugin_desc->spd_id,
+						"%s: entry \"%s\" is in a location "
+						"where we don't look\n", fname,
+						slapi_sdn_get_ndn(these[j]));
+				continue;
+			}
 			/* Pull up the named entry. */
 			wrap_search_internal_get_entry(pb, these[j],
 						       NULL,
@@ -1315,18 +1404,25 @@ format_deref_rx(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 					if (cvalue == NULL) {
 						continue;
 					}
+					/* If it's in an area that we're
+					 * ignoring, then ignore it already. */
+					if (format_check_dn_location(cvalue,
+								     restrict_subtrees,
+								     ignore_subtrees) != 0) {
+						continue;
+					}
 					/* Let's visit the named entry this
 					 * time, in case we're nesting. */
-					format_add_filtered_sdn_list(pb, &these, &these2,
-								     cvalue,
-								     list->links[i + 1].filter_str,
-								     state->plugin_identity);
+					format_maybe_add_sdn_list(pb, &these, &these2,
+								  cvalue,
+								  list->links[i + 1].filter_str,
+								  state->plugin_identity);
 					/* We need to visit the named entry
 					 * next time. */
-					format_add_filtered_sdn_list(pb, &next, &next2,
-								     cvalue,
-								     list->links[i + 1].filter_str,
-								     state->plugin_identity);
+					format_maybe_add_sdn_list(pb, &next, &next2,
+								  cvalue,
+								  list->links[i + 1].filter_str,
+								  state->plugin_identity);
 				} else {
 					/* Get the value. */
 					bval = slapi_value_get_berval(value);
@@ -1373,6 +1469,8 @@ static int
 format_deref_r(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs,
@@ -1405,6 +1503,7 @@ format_deref_r(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			      group, set,
 			      (const char **) argv, NULL,
 			      disallowed,
+			      restrict_subtrees, ignore_subtrees,
 			      outbuf, outbuf_len,
 			      outbuf_choices,
 			      rel_attrs, ref_attrs, inref_attrs,
@@ -1417,6 +1516,8 @@ static int
 format_deref_rf(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *group, const char *set,
 		const char *args, const char *disallowed,
+		const struct slapi_dn **restrict_subtrees,
+		const struct slapi_dn **ignore_subtrees,
 		char *outbuf, int outbuf_len,
 		struct format_choice **outbuf_choices,
 		char ***rel_attrs,
@@ -1475,6 +1576,7 @@ format_deref_rf(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			      group, set,
 			      (const char **) attrs, (const char **) filters,
 			      disallowed,
+			      restrict_subtrees, ignore_subtrees,
 			      outbuf, outbuf_len,
 			      outbuf_choices,
 			      rel_attrs, ref_attrs, inref_attrs,
@@ -1543,6 +1645,8 @@ static int
 format_referred(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *group, const char *set,
 		const char *args, const char *disallowed,
+		const struct slapi_dn **restrict_subtrees,
+		const struct slapi_dn **ignore_subtrees,
 		char *outbuf, int outbuf_len,
 		struct format_choice **outbuf_choices,
 		char ***rel_attrs, char ***ref_attrs,
@@ -1748,6 +1852,8 @@ static int
 format_referred_r(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		  const char *group, const char *set,
 		  const char *args, const char *disallowed,
+		  const struct slapi_dn **restrict_subtrees,
+		  const struct slapi_dn **ignore_subtrees,
 		  char *outbuf, int outbuf_len,
 		  struct format_choice **outbuf_choices,
 		  char ***rel_attrs,
@@ -1989,6 +2095,8 @@ static int
 format_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *group, const char *set,
 	     const char *args, const char *disallowed,
+	     const struct slapi_dn **restrict_subtrees,
+	     const struct slapi_dn **ignore_subtrees,
 	     char *outbuf, int outbuf_len,
 	     struct format_choice **outbuf_choices,
 	     char ***rel_attrs, char ***ref_attrs,
@@ -2021,6 +2129,7 @@ format_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 				"merge: expanding ->%s<-\n", argv[i]);
 		values = format_get_data_set(state, pb, e, group, set,
 					     argv[i], disallowed,
+					     restrict_subtrees, ignore_subtrees,
 					     rel_attrs, ref_attrs, inref_attrs,
 					     ref_attr_list, inref_attr_list,
 					     &lengths);
@@ -2074,6 +2183,8 @@ format_match_generic(struct plugin_state *state,
 		     const char *group, const char *set,
 		     const char *args, int min_args, int default_arg,
 		     const char *disallowed,
+		     const struct slapi_dn **restrict_subtrees,
+		     const struct slapi_dn **ignore_subtrees,
 		     char *outbuf, int outbuf_len,
 		     struct format_choice **outbuf_choices,
 		     char ***rel_attrs,
@@ -2109,6 +2220,7 @@ format_match_generic(struct plugin_state *state,
 	lengths = NULL;
 	values = format_get_data_set(state, pb, e, group, set,
 				     argv[0], disallowed,
+				     restrict_subtrees, ignore_subtrees,
 				     rel_attrs, ref_attrs, inref_attrs,
 				     ref_attr_list, inref_attr_list,
 				     &lengths);
@@ -2164,6 +2276,8 @@ format_match_generic(struct plugin_state *state,
 							group, set,
 							argv[default_arg],
 							disallowed,
+							restrict_subtrees,
+							ignore_subtrees,
 							rel_attrs,
 							ref_attrs,
 							inref_attrs,
@@ -2273,6 +2387,8 @@ format_match(struct plugin_state *state,
 	     Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *group, const char *set,
 	     const char *args, const char *disallowed,
+	     const struct slapi_dn **restrict_subtrees,
+	     const struct slapi_dn **ignore_subtrees,
 	     char *outbuf, int outbuf_len,
 	     struct format_choice **outbuf_choices,
 	     char ***rel_attrs, char ***ref_attrs,
@@ -2282,6 +2398,7 @@ format_match(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, 2,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2292,6 +2409,8 @@ format_mmatch(struct plugin_state *state,
 	      Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *group, const char *set,
 	      const char *args, const char *disallowed,
+	      const struct slapi_dn **restrict_subtrees,
+	      const struct slapi_dn **ignore_subtrees,
 	      char *outbuf, int outbuf_len,
 	      struct format_choice **outbuf_choices,
 	      char ***rel_attrs, char ***ref_attrs,
@@ -2301,6 +2420,7 @@ format_mmatch(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, -1,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2333,6 +2453,8 @@ format_regmatch(struct plugin_state *state,
 		Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *group, const char *set,
 		const char *args, const char *disallowed,
+		const struct slapi_dn **restrict_subtrees,
+		const struct slapi_dn **ignore_subtrees,
 		char *outbuf, int outbuf_len,
 		struct format_choice **outbuf_choices,
 		char ***rel_attrs, char ***ref_attrs,
@@ -2342,6 +2464,7 @@ format_regmatch(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, 2,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2352,6 +2475,8 @@ format_mregmatch(struct plugin_state *state,
 		 Slapi_PBlock *pb, Slapi_Entry *e,
 		 const char *group, const char *set,
 		 const char *args, const char *disallowed,
+		 const struct slapi_dn **restrict_subtrees,
+		 const struct slapi_dn **ignore_subtrees,
 		 char *outbuf, int outbuf_len,
 		 struct format_choice **outbuf_choices,
 		 char ***rel_attrs, char ***ref_attrs,
@@ -2361,6 +2486,7 @@ format_mregmatch(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, -1,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2376,6 +2502,8 @@ format_regmatchi(struct plugin_state *state,
 		 Slapi_PBlock *pb, Slapi_Entry *e,
 		 const char *group, const char *set,
 		 const char *args, const char *disallowed,
+		 const struct slapi_dn **restrict_subtrees,
+		 const struct slapi_dn **ignore_subtrees,
 		 char *outbuf, int outbuf_len,
 		 struct format_choice **outbuf_choices,
 		 char ***rel_attrs, char ***ref_attrs,
@@ -2385,6 +2513,7 @@ format_regmatchi(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, 2,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2395,6 +2524,8 @@ format_mregmatchi(struct plugin_state *state,
 		  Slapi_PBlock *pb, Slapi_Entry *e,
 		  const char *group, const char *set,
 		  const char *args, const char *disallowed,
+		  const struct slapi_dn **restrict_subtrees,
+		  const struct slapi_dn **ignore_subtrees,
 		  char *outbuf, int outbuf_len,
 		  struct format_choice **outbuf_choices,
 		  char ***rel_attrs, char ***ref_attrs,
@@ -2404,6 +2535,7 @@ format_mregmatchi(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, -1,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2529,6 +2661,8 @@ format_regsub(struct plugin_state *state,
 	      Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *group, const char *set,
 	      const char *args, const char *disallowed,
+	      const struct slapi_dn **restrict_subtrees,
+	      const struct slapi_dn **ignore_subtrees,
 	      char *outbuf, int outbuf_len,
 	      struct format_choice **outbuf_choices,
 	      char ***rel_attrs, char ***ref_attrs,
@@ -2538,6 +2672,7 @@ format_regsub(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 3, 3,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2548,6 +2683,8 @@ format_mregsub(struct plugin_state *state,
 	       Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs, char ***ref_attrs,
@@ -2557,6 +2694,7 @@ format_mregsub(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 3, -1,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2572,6 +2710,8 @@ format_regsubi(struct plugin_state *state,
 	       Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs, char ***ref_attrs,
@@ -2581,6 +2721,7 @@ format_regsubi(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 3, 3,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2591,6 +2732,8 @@ format_mregsubi(struct plugin_state *state,
 		Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *group, const char *set,
 		const char *args, const char *disallowed,
+		const struct slapi_dn **restrict_subtrees,
+		const struct slapi_dn **ignore_subtrees,
 		char *outbuf, int outbuf_len,
 		struct format_choice **outbuf_choices,
 		char ***rel_attrs, char ***ref_attrs,
@@ -2600,6 +2743,7 @@ format_mregsubi(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 3, -1,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2615,6 +2759,8 @@ static int
 format_ifeq(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	    const char *group, const char *set,
 	    const char *args, const char *disallowed,
+	    const struct slapi_dn **restrict_subtrees,
+	    const struct slapi_dn **ignore_subtrees,
 	    char *outbuf, int outbuf_len,
 	    struct format_choice **outbuf_choices,
 	    char ***rel_attrs, char ***ref_attrs,
@@ -2657,6 +2803,7 @@ format_ifeq(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	/* Evaluate the value expression to get a list of candidate values. */
 	values = format_get_data_set(state, pb, e, group, set,
 				     argv[1], disallowed,
+				     restrict_subtrees, ignore_subtrees,
 				     rel_attrs, ref_attrs, inref_attrs,
 				     ref_attr_list, inref_attr_list,
 				     &lengths);
@@ -2695,6 +2842,8 @@ format_ifeq(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	 * return its values. */
 	ret = format_expand(state, pb, e, group, set,
 			    argv[matched ? 2 : 3], disallowed,
+			    restrict_subtrees,
+			    ignore_subtrees,
 			    outbuf, outbuf_len,
 			    outbuf_choices,
 			    rel_attrs, ref_attrs, inref_attrs,
@@ -2709,6 +2858,8 @@ static int
 format_default(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs, char ***ref_attrs,
@@ -2737,6 +2888,8 @@ format_default(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	for (i = 0; i < argc; i++) {
 		ret = format_expand(state, pb, e, group, set,
 				    argv[i], disallowed,
+				    restrict_subtrees,
+				    ignore_subtrees,
 				    outbuf, outbuf_len,
 				    outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
@@ -2779,6 +2932,8 @@ static int
 format_sort(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	    const char *group, const char *set,
 	    const char *args, const char *disallowed,
+	    const struct slapi_dn **restrict_subtrees,
+	    const struct slapi_dn **ignore_subtrees,
 	    char *outbuf, int outbuf_len,
 	    struct format_choice **outbuf_choices,
 	    char ***rel_attrs, char ***ref_attrs,
@@ -2821,6 +2976,7 @@ format_sort(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	choices = NULL;
 	values = format_get_data_set(state, pb, e, group, set,
 				     argv[0], disallowed,
+				     restrict_subtrees, ignore_subtrees,
 				     rel_attrs, ref_attrs, inref_attrs,
 				     ref_attr_list, inref_attr_list,
 				     &lengths);
@@ -2884,6 +3040,8 @@ static int
 format_collect(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs, char ***ref_attrs,
@@ -2922,6 +3080,7 @@ format_collect(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		/* Evaluate this argument. */
 		values = format_get_data_set(state, pb, e, group, set,
 					     argv[i], disallowed,
+					     restrict_subtrees, ignore_subtrees,
 					     rel_attrs, ref_attrs, inref_attrs,
 					     ref_attr_list, inref_attr_list,
 					     &lengths);
@@ -2985,6 +3144,8 @@ static int
 format_link(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	    const char *group, const char *set,
 	    const char *args, const char *disallowed,
+	    const struct slapi_dn **restrict_subtrees,
+	    const struct slapi_dn **ignore_subtrees,
 	    char *outbuf, int outbuf_len,
 	    struct format_choice **outbuf_choices,
 	    char ***rel_attrs, char ***ref_attrs,
@@ -3046,6 +3207,8 @@ format_link(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		j = (i / 3) * 2;
 		values[j] = format_get_data_set(state, pb, e, group, set,
 						argv[i], disallowed,
+						restrict_subtrees,
+						ignore_subtrees,
 						rel_attrs,
 						ref_attrs, inref_attrs,
 						ref_attr_list,
@@ -3059,6 +3222,8 @@ format_link(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 				"link: evaluating \"%s\"\n", argv[i + 1]);
 		values[j] = format_get_data_set(state, pb, e, group, set,
 						argv[i + 1], disallowed,
+						restrict_subtrees,
+						ignore_subtrees,
 						rel_attrs,
 						ref_attrs, inref_attrs,
 						ref_attr_list,
@@ -3219,6 +3384,8 @@ static int
 format_unique(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *group, const char *set,
 	      const char *args, const char *disallowed,
+	      const struct slapi_dn **restrict_subtrees,
+	      const struct slapi_dn **ignore_subtrees,
 	      char *outbuf, int outbuf_len,
 	      struct format_choice **outbuf_choices,
 	      char ***rel_attrs,
@@ -3261,6 +3428,7 @@ format_unique(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	ret = -ENOENT;
 	values = format_get_data_set(state, pb, e, group, set,
 				     value_format, disallowed,
+				     restrict_subtrees, ignore_subtrees,
 				     rel_attrs, ref_attrs, inref_attrs,
 				     ref_attr_list, inref_attr_list,
 				     &lengths);
@@ -3276,6 +3444,8 @@ format_unique(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			i = format_expand(state, pb, e,
 					  group, set,
 					  default_value, NULL,
+					  restrict_subtrees,
+					  ignore_subtrees,
 					  outbuf, outbuf_len,
 					  outbuf_choices,
 					  rel_attrs, ref_attrs, inref_attrs,
@@ -3333,6 +3503,8 @@ format_internal_sequence_number(struct plugin_state *state,
 				Slapi_PBlock *pb, Slapi_Entry *e,
 				const char *group, const char *set,
 				const char *args, const char *disallowed,
+				const struct slapi_dn **restrict_subtrees,
+				const struct slapi_dn **ignore_subtrees,
 				char *outbuf, int outbuf_len,
 				struct format_choice **outbuf_choices,
 				char ***rel_attrs,
@@ -3378,6 +3550,8 @@ format_dribble_merge(struct plugin_state *state, Slapi_PBlock *pb,
 		     Slapi_Entry *e,
 		     const char *group, const char *set,
 		     const char *args, const char *disallowed,
+		     const struct slapi_dn **restrict_subtrees,
+		     const struct slapi_dn **ignore_subtrees,
 		     char *outbuf, int outbuf_len,
 		     struct format_choice **outbuf_choices,
 		     char ***rel_attrs,
@@ -3429,6 +3603,7 @@ format_dribble_merge(struct plugin_state *state, Slapi_PBlock *pb,
 				"dribble_merge: expanding ->%s<-\n", argv[i]);
 		values = format_get_data_set(state, pb, e, group, set,
 					     argv[i], disallowed,
+					     restrict_subtrees, ignore_subtrees,
 					     rel_attrs, ref_attrs, inref_attrs,
 					     ref_attr_list, inref_attr_list,
 					     &lengths);
@@ -3538,6 +3713,8 @@ format_lookup_fn(const char *fnname)
 			       Slapi_PBlock *pb, Slapi_Entry *e,
 			       const char *group, const char *set,
 			       const char *args, const char *disallowed,
+			       const struct slapi_dn **restrict_subtrees,
+			       const struct slapi_dn **ignore_subtrees,
 			       char *outbuf, int outbuf_len,
 			       struct format_choice **outbuf_choices,
 			       char ***rel_attrs,
@@ -3883,6 +4060,8 @@ format_expand_simple(struct plugin_state *state,
 		     Slapi_PBlock *pb, Slapi_Entry *e,
 		     const char *group, const char *set,
 		     const char *fmt, const char *disallowed,
+		     const struct slapi_dn **restrict_subtrees,
+		     const struct slapi_dn **ignore_subtrees,
 		     char *outbuf, int outbuf_len,
 		     struct format_choice **outbuf_choices,
 		     char ***rel_attrs,
@@ -3993,6 +4172,8 @@ format_expand_simple(struct plugin_state *state,
 				i = format_expand(state, pb, e,
 						  group, set,
 						  default_value, NULL,
+						  restrict_subtrees,
+						  ignore_subtrees,
 						  outbuf, outbuf_len,
 						  outbuf_choices,
 						  rel_attrs,
@@ -4012,6 +4193,8 @@ format_expand_simple(struct plugin_state *state,
 				i = format_expand(state, pb, e,
 						  group, set,
 						  alternate_value, NULL,
+						  restrict_subtrees,
+						  ignore_subtrees,
 						  outbuf, outbuf_len,
 						  outbuf_choices,
 						  rel_attrs,
@@ -4041,6 +4224,7 @@ format_expand_simple(struct plugin_state *state,
 			/* Supply the alternate value. */
 			i = format_expand(state, pb, e,
 					  group, set, alternate_value, NULL,
+					  restrict_subtrees, ignore_subtrees,
 					  outbuf, outbuf_len, outbuf_choices,
 					  rel_attrs, ref_attrs, inref_attrs,
 					  ref_attr_list, inref_attr_list);
@@ -4079,6 +4263,8 @@ static int
 format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *group, const char *set,
 	      const char *fmt, const char *disallowed,
+	      const struct slapi_dn **restrict_subtrees,
+	      const struct slapi_dn **ignore_subtrees,
 	      char *outbuf, int outbuf_len,
 	      struct format_choice **outbuf_choices,
 	      char ***rel_attrs, char ***ref_attrs,
@@ -4094,6 +4280,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			Slapi_PBlock *pb, Slapi_Entry *e,
 			const char *group, const char *set,
 			const char *args, const char *disallowed,
+			const struct slapi_dn **restrict_subtrees,
+			const struct slapi_dn **ignore_subtrees,
 			char *outbuf, int outbuf_len,
 			struct format_choice **outbuf_choices,
 			char ***rel_attrs,
@@ -4154,6 +4342,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 								    set,
 								    subexp,
 								    disallowed,
+								    restrict_subtrees,
+								    ignore_subtrees,
 								    outbuf + j,
 								    outbuf_len - j,
 								    outbuf_choices,
@@ -4260,6 +4450,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 				used = (*formatfn)(state, pb, e,
 						   group, set,
 						   params, disallowed,
+						   restrict_subtrees,
+						   ignore_subtrees,
 						   outbuf + j, outbuf_len - j,
 						   outbuf_choices,
 						   rel_attrs,
@@ -4321,6 +4513,8 @@ format_format(struct plugin_state *state,
 	      const char *group, const char *set,
 	      const char *fmt, const char *disallowed,
 	      struct format_choice **choices,
+	      const struct slapi_dn **restrict_subtrees,
+	      const struct slapi_dn **ignore_subtrees,
 	      char ***rel_attrs, char ***ref_attrs,
 	      struct format_inref_attr ***inref_attrs,
 	      struct format_ref_attr_list ***ref_attr_list,
@@ -4348,6 +4542,8 @@ format_format(struct plugin_state *state,
 		pb = wrap_pblock_new(parent_pb);
 		i = format_expand(state, pb, e, group, set,
 				  fmt, disallowed,
+				  restrict_subtrees,
+				  ignore_subtrees,
 				  buf, buflen, choices,
 				  rel_attrs, ref_attrs, inref_attrs,
 				  ref_attr_list, inref_attr_list);
@@ -4410,6 +4606,8 @@ format_get_data(struct plugin_state *state,
 		Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *group, const char *set,
 		const char *fmt, const char *disallowed,
+		const struct slapi_dn **restrict_subtrees,
+		const struct slapi_dn **ignore_subtrees,
 		char ***rel_attrs,
 		char ***ref_attrs,
 		struct format_inref_attr ***inref_attrs,
@@ -4420,6 +4618,7 @@ format_get_data(struct plugin_state *state,
 	unsigned int ignored;
 	return format_format(state, pb, e, group, set, fmt,
 			     disallowed, NULL,
+			     restrict_subtrees, ignore_subtrees,
 			     rel_attrs,
 			     ref_attrs, inref_attrs,
 			     ref_attr_list, inref_attr_list,
@@ -4443,6 +4642,8 @@ format_get_data_set(struct plugin_state *state,
 		    Slapi_PBlock *pb, Slapi_Entry *e,
 		    const char *group, const char *set,
 		    const char *fmt, const char *disallowed,
+		    const struct slapi_dn **restrict_subtrees,
+		    const struct slapi_dn **ignore_subtrees,
 		    char ***rel_attrs,
 		    char ***ref_attrs,
 		    struct format_inref_attr ***inref_attrs,
@@ -4457,7 +4658,7 @@ format_get_data_set(struct plugin_state *state,
 	unsigned int template_len;
 	choices = NULL;
 	template = format_format(state, pb, e, group, set, fmt, disallowed,
-				 &choices,
+				 &choices, restrict_subtrees, ignore_subtrees,
 				 rel_attrs, ref_attrs, inref_attrs,
 				 ref_attr_list, inref_attr_list,
 				 &template_len);