Add ignore-subtree and restrict-subtree settings

Add {nis,schema-compat}-ignore-subtree (subtrees under which we ignore
contents and updates )and {nis,schema-compat}-restrict-subtree (subtrees
out of which we ignore contents and updates, if set) settings, and
default the former to "cn=tasks,cn=config".

This should avoid cases where we're looking through the ldbm backend for
entries which have a dangling reference to a newly-added task (which,
because it's in the DSE, means we acquire an ldbm lock after acquiring
our internal lock) while also updating a compat entry after its source
entry is modified (for example, by the memberOf plugin, which results in
us attempting to acquire our lock while the ldbm lock is already held).

7 files changed, 333 insertions, 74 deletions

diff --git a/src/back-nis.c b/src/back-nis.c
index 8a8f89c..be6bb6a 100644
--- a/src/back-nis.c
+++ b/src/back-nis.c
@@ -87,7 +87,7 @@ backend_free_set_data_contents(void *data)
 		free(set_data->common.group);
 		free(set_data->common.set);
 		backend_shr_free_strlist(set_data->common.bases);
-		backend_shr_free_sdnlist(set_data->common.relevant_subtrees);
+		backend_shr_free_sdnlist(set_data->common.restrict_subtrees);
 		backend_shr_free_sdnlist(set_data->common.ignore_subtrees);
 		format_free_attr_list(set_data->common.rel_attrs);
 		free(set_data->common.rel_attr_list);
@@ -123,7 +123,7 @@ backend_copy_set_data(const struct backend_set_data *data)
 	ret->common.set = strdup(data->common.set);
 	ret->common.bases = backend_shr_dup_strlist(data->common.bases);
 	ret->common.entry_filter = strdup(data->common.entry_filter);
-	ret->common.relevant_subtrees = backend_shr_dup_sdnlist(data->common.relevant_subtrees);
+	ret->common.restrict_subtrees = backend_shr_dup_sdnlist(data->common.restrict_subtrees);
 	ret->common.ignore_subtrees = backend_shr_dup_sdnlist(data->common.ignore_subtrees);
 	ret->common.rel_attrs = data->common.rel_attrs ?
 				format_dup_attr_list(data->common.rel_attrs) :
@@ -199,6 +199,8 @@ backend_gather_data(struct plugin_state *state,
 		    const char *domain, const char *map,
 		    char **single_formats, char **group_formats,
 		    const char *disallowed_chars,
+		    const struct slapi_dn **restrict_subtrees,
+		    const struct slapi_dn **ignore_subtrees,
 		    char ***rel_attrs,
 		    char ***ref_attrs,
 		    struct format_inref_attr ***inref_attrs,
@@ -259,6 +261,8 @@ backend_gather_data(struct plugin_state *state,
 		singles[i] = format_get_data(state, pb, e, domain, map,
 					     single_formats[i],
 					     disallowed_chars,
+					     restrict_subtrees,
+					     ignore_subtrees,
 					     rel_attrs, ref_attrs, inref_attrs,
 					     ref_attr_list, inref_attr_list,
 					     &single_lengths[i]);
@@ -287,6 +291,8 @@ backend_gather_data(struct plugin_state *state,
 		groups[j] = format_get_data_set(state, pb, e, domain, map,
 						group_formats[i],
 						disallowed_chars,
+						restrict_subtrees,
+						ignore_subtrees,
 						rel_attrs, ref_attrs, inref_attrs,
 						ref_attr_list, inref_attr_list,
 						&group_lengths[j]);
@@ -365,6 +371,8 @@ backend_set_entry(Slapi_PBlock *pb, Slapi_Entry *e,
 				       data->key_formats,
 				       data->keys_formats,
 				       data->disallowed_chars,
+				       data->common.restrict_subtrees,
+				       data->common.ignore_subtrees,
 				       &data->common.rel_attrs,
 				       &data->common.ref_attrs,
 				       &data->common.inref_attrs,
@@ -382,6 +390,8 @@ backend_set_entry(Slapi_PBlock *pb, Slapi_Entry *e,
 				         data->value_formats,
 				         data->values_formats,
 				         data->disallowed_chars,
+					 data->common.restrict_subtrees,
+					 data->common.ignore_subtrees,
 				         &data->common.rel_attrs,
 				         &data->common.ref_attrs,
 				         &data->common.inref_attrs,
@@ -517,7 +527,7 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 	char **use_bases, *use_entry_filter;
 	char **use_key_formats, **use_keys_formats;
 	char **use_value_formats, **use_values_formats, *use_disallowed_chars;
-	const Slapi_DN **relevant_subtrees, **ignore_subtrees;
+	const Slapi_DN **restrict_subtrees, **ignore_subtrees;
 	int i, j;
 
 	/* Read the hard-coded defaults for a map with this name. */
@@ -528,10 +538,13 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 	/* Read the values from the configuration entry. */
 	bases = backend_shr_get_vattr_strlist(state, e,
 					      NIS_MAP_CONFIGURATION_BASE_ATTR);
-	relevant_subtrees = backend_shr_get_vattr_sdnlist(state, e,
-							 NIS_MAP_CONFIGURATION_RELEVANT_SUBTREES_ATTR);
+	restrict_subtrees = backend_shr_get_vattr_sdnlist(state, e,
+							 NIS_MAP_CONFIGURATION_RESTRICT_SUBTREES_ATTR);
 	ignore_subtrees = backend_shr_get_vattr_sdnlist(state, e,
 							NIS_MAP_CONFIGURATION_IGNORE_SUBTREES_ATTR);
+	if (ignore_subtrees == NULL) {
+		backend_shr_add_sdnlist(&ignore_subtrees, DEFAULT_IGNORE_SUBTREE);
+	}
 	entry_filter = backend_shr_get_vattr_filter(state, e,
 						    NIS_MAP_CONFIGURATION_FILTER_ATTR);
 	key_formats = backend_shr_get_vattr_strlist(state, e,
@@ -613,7 +626,7 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 	ret.common.group = strdup(domain);
 	ret.common.set = strdup(map);
 	ret.common.bases = use_bases;
-	ret.common.relevant_subtrees = relevant_subtrees;
+	ret.common.restrict_subtrees = restrict_subtrees;
 	ret.common.ignore_subtrees = ignore_subtrees;
 	ret.common.entry_filter = use_entry_filter;
 	ret.common.rel_attrs = NULL;
@@ -716,7 +729,7 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 	free(ret.common.group);
 	free(ret.common.set);
 	backend_shr_free_strlist(ret.common.bases);
-	backend_shr_free_sdnlist(ret.common.relevant_subtrees);
+	backend_shr_free_sdnlist(ret.common.restrict_subtrees);
 	free(ret.disallowed_chars);
 	free(ret.common.entry_filter);
 	backend_shr_free_strlist(ret.key_formats);
diff --git a/src/back-sch.c b/src/back-sch.c
index 3130fbc..e5a6937 100644
--- a/src/back-sch.c
+++ b/src/back-sch.c
@@ -79,7 +79,7 @@ backend_set_config_free_config_contents(void *data)
 		free(set_data->common.group);
 		free(set_data->common.set);
 		free(set_data->common.bases);
-		backend_shr_free_sdnlist(set_data->common.relevant_subtrees);
+		backend_shr_free_sdnlist(set_data->common.restrict_subtrees);
 		backend_shr_free_sdnlist(set_data->common.ignore_subtrees);
 		format_free_attr_list(set_data->common.rel_attrs);
 		free(set_data->common.rel_attr_list);
@@ -112,7 +112,7 @@ backend_copy_set_config(const struct backend_set_data *data)
 	ret->common.group = strdup(data->common.group);
 	ret->common.set = strdup(data->common.set);
 	ret->common.bases = backend_shr_dup_strlist(data->common.bases);
-	ret->common.relevant_subtrees = backend_shr_dup_sdnlist(data->common.relevant_subtrees);
+	ret->common.restrict_subtrees = backend_shr_dup_sdnlist(data->common.restrict_subtrees);
 	ret->common.ignore_subtrees = backend_shr_dup_sdnlist(data->common.ignore_subtrees);
 	ret->common.rel_attrs = data->common.rel_attrs ?
 				format_dup_attr_list(data->common.rel_attrs) :
@@ -164,15 +164,18 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 	bool_t check_access;
 	struct backend_set_data ret;
 	Slapi_DN *tmp_sdn;
-	const Slapi_DN **relevant_subtrees, **ignore_subtrees;
+	const Slapi_DN **restrict_subtrees, **ignore_subtrees;
 
 	/* Read the values from the configuration entry. */
 	bases = backend_shr_get_vattr_strlist(state, e,
 					      SCH_CONTAINER_CONFIGURATION_BASE_ATTR);
-	relevant_subtrees = backend_shr_get_vattr_sdnlist(state, e,
-							 SCH_CONTAINER_CONFIGURATION_RELEVANT_SUBTREES_ATTR);
+	restrict_subtrees = backend_shr_get_vattr_sdnlist(state, e,
+							 SCH_CONTAINER_CONFIGURATION_RESTRICT_SUBTREES_ATTR);
 	ignore_subtrees = backend_shr_get_vattr_sdnlist(state, e,
 							SCH_CONTAINER_CONFIGURATION_IGNORE_SUBTREES_ATTR);
+	if (ignore_subtrees == NULL) {
+		backend_shr_add_sdnlist(&ignore_subtrees, DEFAULT_IGNORE_SUBTREE);
+	}
 	entry_filter = backend_shr_get_vattr_filter(state, e,
 						    SCH_CONTAINER_CONFIGURATION_FILTER_ATTR);
 	rdn_format = backend_shr_get_vattr_str(state, e,
@@ -193,7 +196,7 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 	slapi_sdn_free(&tmp_sdn);
 	ret.common.set = strdup(container);
 	ret.common.bases = bases;
-	ret.common.relevant_subtrees = relevant_subtrees;
+	ret.common.restrict_subtrees = restrict_subtrees;
 	ret.common.ignore_subtrees = ignore_subtrees;
 	ret.common.entry_filter = entry_filter;
 	ret.common.rel_attrs = NULL;
@@ -259,7 +262,7 @@ backend_set_config_read_config(struct plugin_state *state, Slapi_Entry *e,
 	free(ret.common.group);
 	free(ret.common.set);
 	backend_shr_free_strlist(ret.common.bases);
-	backend_shr_free_sdnlist(ret.common.relevant_subtrees);
+	backend_shr_free_sdnlist(ret.common.restrict_subtrees);
 	backend_shr_free_sdnlist(ret.common.ignore_subtrees);
 	free(ret.common.entry_filter);
 	slapi_sdn_free(&ret.container_sdn);
@@ -429,6 +432,8 @@ backend_set_entry_from(Slapi_PBlock *pb, enum backend_entry_source source,
 	rdn = format_get_data(data->common.state, pb, e,
 			      data->common.group, data->common.set,
 			      data->rdn_format, NULL,
+			      data->common.restrict_subtrees,
+			      data->common.ignore_subtrees,
 			      &data->common.rel_attrs,
 			      &data->common.ref_attrs,
 			      &data->common.inref_attrs,
@@ -512,6 +517,8 @@ backend_set_entry_from(Slapi_PBlock *pb, enum backend_entry_source source,
 						  data->common.set,
 						  data->attribute_format[i],
 						  NULL,
+						  data->common.restrict_subtrees,
+						  data->common.ignore_subtrees,
 						  &data->common.rel_attrs,
 						  &data->common.ref_attrs,
 						  &data->common.inref_attrs,
diff --git a/src/back-shr.c b/src/back-shr.c
index 00ca097..63ed700 100644
--- a/src/back-shr.c
+++ b/src/back-shr.c
@@ -284,6 +284,30 @@ backend_shr_set_entry_cb(Slapi_Entry *e, void *callback_data)
 	backend_shr_set_entry(cbdata->pb, e, cbdata->set_data);
 	return 0;
 }
+void
+backend_shr_add_sdnlist(const Slapi_DN ***sdnlist, const char *dn)
+{
+	const Slapi_DN **ret;
+	int i = 0;
+	if (dn == NULL) {
+		return NULL;
+	}
+	if ((sdnlist != NULL) && (*sdnlist != NULL)) {
+		for (i = 0; (*sdnlist)[i] != NULL; i++) {
+			continue;
+		}
+	}
+	ret = calloc(i + 2, sizeof(ret[0]));
+	if (ret != NULL) {
+		if ((sdnlist != NULL) && (*sdnlist != NULL)) {
+			memcpy(ret, *sdnlist, (i + 1) * sizeof(ret[0]));
+			free(*sdnlist);
+		}
+		ret[i] = slapi_sdn_new_dn_byval(dn);
+		ret[i + 1] = NULL;
+		*sdnlist = ret;
+	}
+}
 static const Slapi_DN **
 backend_shr_dup_sdnlist_n(const Slapi_DN **sdnlist, int n)
 {
@@ -791,48 +815,54 @@ static bool_t
 backend_shr_entry_matches_set(struct backend_shr_set_data *set_data,
 			      Slapi_PBlock *pb, Slapi_Entry *e)
 {
-	const Slapi_DN **relevant_subtrees, **ignore_subtrees;
+	const Slapi_DN **restrict_subtrees, **ignore_subtrees;
 	char **set_bases;
 	char *set_filter;
 	int i;
 
-	relevant_subtrees = set_data->relevant_subtrees;
+	restrict_subtrees = set_data->restrict_subtrees;
 	ignore_subtrees = set_data->ignore_subtrees;
 	set_bases = set_data->bases;
 	set_filter = set_data->entry_filter;
 
-	if (ignore_subtrees != NULL) {
-		for (i = 0; ignore_subtrees[i] != NULL; i++) {
-			if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(e),
-						 ignore_subtrees[i],
-						 LDAP_SCOPE_SUBTREE) != 0) {
-				return FALSE;
-			}
-		}
-	}
-	if (relevant_subtrees != NULL) {
-		for (i = 0; relevant_subtrees[i] != NULL; i++) {
-			if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(e),
-						 relevant_subtrees[i],
-						 LDAP_SCOPE_SUBTREE) != 0) {
-				break;
-			}
-		}
-		if (relevant_subtrees[i] == NULL) {
-			/* Non-empty list, but no match. */
-			return FALSE;
-		}
-	}
-
 	if (set_bases != NULL) {
+		/* Check if it's in the map's configured area(s). */
 		for (i = 0; set_bases[i] != NULL; i++) {
 			if (backend_shr_entry_matches(pb, e,
 						      set_bases[i],
 						      LDAP_SCOPE_SUBTREE,
 						      set_filter)) {
-				return TRUE;
+				break;
 			}
 		}
+		if (set_bases[i] != NULL) {
+			/* If it is, then check that it's in the subtrees we're
+			 * restricting updates to... */
+			if (restrict_subtrees != NULL) {
+				for (i = 0; restrict_subtrees[i] != NULL; i++) {
+					if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(e),
+								 restrict_subtrees[i],
+								 LDAP_SCOPE_SUBTREE) != 0) {
+						break;
+					}
+				}
+				if (restrict_subtrees[i] == NULL) {
+					/* Non-empty list, but no match. */
+					return FALSE;
+				}
+			}
+			/* ... and not in one that we intend to ignore. */
+			if (ignore_subtrees != NULL) {
+				for (i = 0; ignore_subtrees[i] != NULL; i++) {
+					if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(e),
+								 ignore_subtrees[i],
+								 LDAP_SCOPE_SUBTREE) != 0) {
+						return FALSE;
+					}
+				}
+			}
+			return TRUE;
+		}
 	}
 
 	return FALSE;
@@ -1015,30 +1045,31 @@ backend_shr_update_references_cb(const char *group, const char *set,
 	cbdata = cbdata_ptr;
 	state = set_data->state;
 
-	/* Check if this entry is in one of the areas we've been specifically
-	 * told to ignore. */
-	if (set_data->ignore_subtrees != NULL) {
-		for (i = 0; set_data->ignore_subtrees[i] != NULL; i++) {
+	/* If it is, then check that it's in one of the subtrees we're
+	 * restricting updates to... */
+	if (set_data->restrict_subtrees != NULL) {
+		for (i = 0; set_data->restrict_subtrees[i] != NULL; i++) {
 			if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(cbdata->e),
-						 set_data->ignore_subtrees[i],
+						 set_data->restrict_subtrees[i],
 						 LDAP_SCOPE_SUBTREE) != 0) {
-				/* Yeah, we're done here. */
-				return TRUE;
+				break;
 			}
 		}
+		if (set_data->restrict_subtrees[i] == NULL) {
+			/* Non-empty list, but no match. */
+			return TRUE;
+		}
 	}
-	if (set_data->relevant_subtrees != NULL) {
-		for (i = 0; set_data->relevant_subtrees[i] != NULL; i++) {
+	/* ... and not in one that we intend to ignore. */
+	if (set_data->ignore_subtrees != NULL) {
+		for (i = 0; set_data->ignore_subtrees[i] != NULL; i++) {
 			if (slapi_sdn_scope_test(slapi_entry_get_sdn_const(cbdata->e),
-						 set_data->relevant_subtrees[i],
+						 set_data->ignore_subtrees[i],
 						 LDAP_SCOPE_SUBTREE) != 0) {
-				break;
+				/* Yeah, we're done here. */
+				return TRUE;
 			}
 		}
-		if (set_data->relevant_subtrees[i] == NULL) {
-			/* Non-empty list, but no match. */
-			return TRUE;
-		}
 	}
 
 	/* If the entry didn't change any attributes which are at all relevant
diff --git a/src/back-shr.h b/src/back-shr.h
index 83c049d..44c25fe 100644
--- a/src/back-shr.h
+++ b/src/back-shr.h
@@ -33,6 +33,7 @@ char **backend_shr_dup_strlist_n(char **strlist, int n);
 char **backend_shr_dup_strlist(char **strlist);
 char **backend_shr_dup_strlist_unless_empty(char **strlist);
 void backend_shr_add_strlist(char ***strlist, const char *item);
+void backend_shr_add_sdnlist(const Slapi_DN ***sdnlist, const char *dn);
 const Slapi_DN **backend_shr_dup_sdnlist(const Slapi_DN **sdnlist);
 void backend_shr_free_sdnlist(const Slapi_DN **sdnlist);
 
diff --git a/src/backend.h b/src/backend.h
index 8c00dd4..7974aae 100644
--- a/src/backend.h
+++ b/src/backend.h
@@ -46,10 +46,12 @@ struct backend_shr_set_data {
 	/* Configuration flag indicating whether or not we try to skip
 	 * recomputing data in this map. */
 	unsigned int skip_uninteresting_updates:1;
-	/* Subtrees under which all of the contents that we care about will be
-	 * stored.  Other locaoins will be silently ignored. */
-	const struct slapi_dn **relevant_subtrees;
-	/* Subtrees under which we ignore contents. */
+	/* Subtrees under which all of the contents that we care about, and
+	 * anything that refers to content that we care about, will be stored.
+	 * Other locations will be silently ignored if this list contains any
+	 * values. */
+	const struct slapi_dn **restrict_subtrees;
+	/* Subtrees under which we ignore contents and updates. */
 	const struct slapi_dn **ignore_subtrees;
 	struct backend_set_data *self;
 };
diff --git a/src/format.c b/src/format.c
index cfec33e..d5dc7ff 100644
--- a/src/format.c
+++ b/src/format.c
@@ -60,6 +60,8 @@ static int format_expand(struct plugin_state *state,
 			 Slapi_PBlock *pb, Slapi_Entry *e,
 			 const char *group, const char *set,
 			 const char *fmt, const char *disallowed,
+			 const struct slapi_dn **restrict_subtrees,
+			 const struct slapi_dn **ignore_subtrees,
 			 char *outbuf, int outbuf_len,
 			 struct format_choice **outbuf_choices,
 			 char ***rel_attrs, char ***ref_attrs,
@@ -286,8 +288,8 @@ format_add_sdn_list(struct slapi_dn ***list, struct slapi_dn ***list2,
 }
 
 static int
-format_check_entry(Slapi_PBlock *pb, const char *dn, char *filter,
-		   void *identity)
+format_check_entry_exists(Slapi_PBlock *pb, const char *dn, char *filter,
+			  void *identity)
 {
 	Slapi_DN *sdn;
 	Slapi_Entry *entry;
@@ -303,12 +305,62 @@ format_check_entry(Slapi_PBlock *pb, const char *dn, char *filter,
 	}
 }
 
+static int
+format_check_sdn_location(const Slapi_DN *sdn,
+			  const struct slapi_dn **restrict_subtrees,
+			  const struct slapi_dn **ignore_subtrees)
+{
+	int i;
+
+	if (restrict_subtrees != NULL) {
+		for (i = 0; restrict_subtrees[i] != NULL; i++) {
+			if (slapi_sdn_scope_test(sdn,
+						 restrict_subtrees[i],
+						 LDAP_SCOPE_SUBTREE) != 0) {
+				break;
+			}
+		}
+		if (restrict_subtrees[i] == NULL) {
+			/* Non-empty list, but no match. */
+			return ENOENT;
+		}
+	}
+	if (ignore_subtrees != NULL) {
+		for (i = 0; ignore_subtrees[i] != NULL; i++) {
+			if (slapi_sdn_scope_test(sdn,
+						 ignore_subtrees[i],
+						 LDAP_SCOPE_SUBTREE) != 0) {
+				return ENOENT;
+			}
+		}
+	}
+	return 0;
+}
+
+static int
+format_check_dn_location(const char *dn,
+			 const struct slapi_dn **restrict_subtrees,
+			 const struct slapi_dn **ignore_subtrees)
+{
+	int ret = ENOENT;
+	Slapi_DN *sdn;
+
+	sdn = slapi_sdn_new_dn_byref(dn);
+	if (sdn != NULL) {
+		ret = format_check_sdn_location(sdn,
+						restrict_subtrees,
+						ignore_subtrees);
+		slapi_sdn_free(&sdn);
+	}
+	return ret;
+}
+
 static void
-format_add_filtered_sdn_list(Slapi_PBlock *pb,
-			     struct slapi_dn ***list, struct slapi_dn ***list2,
-			     const char *dn, char *filter, void *identity)
+format_maybe_add_sdn_list(Slapi_PBlock *pb,
+			  struct slapi_dn ***list, struct slapi_dn ***list2,
+			  const char *dn, char *filter, void *identity)
 {
-	if (format_check_entry(pb, dn, filter, identity) == 0) {
+	if (format_check_entry_exists(pb, dn, filter, identity) == 0) {
 		format_add_sdn_list(list, list2, dn);
 	}
 }
@@ -918,6 +970,8 @@ static int
 format_first(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *group, const char *set,
 	     const char *args, const char *disallowed,
+	     const struct slapi_dn **restrict_subtrees,
+	     const struct slapi_dn **ignore_subtrees,
 	     char *outbuf, int outbuf_len,
 	     struct format_choice **outbuf_choices,
 	     char ***rel_attrs,
@@ -951,6 +1005,7 @@ format_first(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	ret = -ENOENT;
 	values = format_get_data_set(state, pb, e, group, set,
 				     value_format, disallowed,
+				     restrict_subtrees, ignore_subtrees,
 				     rel_attrs, ref_attrs, inref_attrs,
 				     ref_attr_list, inref_attr_list,
 				     &lengths);
@@ -966,6 +1021,8 @@ format_first(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			i = format_expand(state, pb, e,
 					  group, set,
 					  default_value, NULL,
+					  restrict_subtrees,
+					  ignore_subtrees,
 					  outbuf, outbuf_len,
 					  outbuf_choices,
 					  rel_attrs, ref_attrs, inref_attrs,
@@ -1006,6 +1063,8 @@ format_deref_x(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *fname, const char *group, const char *set,
 	       char *ref_attr, char *target_attr,
 	       char *filter, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs,
@@ -1059,6 +1118,16 @@ format_deref_x(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 					"\"%s\"\n", fname, cref);
 			continue;
 		}
+		if (format_check_sdn_location(refdn,
+					      restrict_subtrees,
+					      ignore_subtrees) != 0) {
+			slapi_log_error(SLAPI_LOG_PLUGIN,
+					state->plugin_desc->spd_id,
+					"%s: entry \"%s\" is in a location "
+					"where we don't look\n", fname, cref);
+			slapi_sdn_free(&refdn);
+			continue;
+		}
 		wrap_search_internal_get_entry(pb, refdn, filter, attrs, &ref,
 					       state->plugin_identity);
 		if (ref == NULL) {
@@ -1115,6 +1184,8 @@ static int
 format_deref(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *group, const char *set,
 	     const char *args, const char *disallowed,
+	     const struct slapi_dn **restrict_subtrees,
+	     const struct slapi_dn **ignore_subtrees,
 	     char *outbuf, int outbuf_len,
 	     struct format_choice **outbuf_choices,
 	     char ***rel_attrs,
@@ -1147,6 +1218,7 @@ format_deref(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	target_attr = argv[1];
 	ret = format_deref_x(state, pb, e, "deref", group, set,
 			     ref_attr, target_attr, NULL, disallowed,
+			     restrict_subtrees, ignore_subtrees,
 			     outbuf, outbuf_len, outbuf_choices,
 			     rel_attrs, ref_attrs, inref_attrs,
 			     ref_attr_list, inref_attr_list);
@@ -1158,6 +1230,8 @@ static int
 format_deref_f(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs, char ***ref_attrs,
@@ -1191,6 +1265,7 @@ format_deref_f(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	target_attr = argv[2];
 	ret = format_deref_x(state, pb, e, "deref_f", group, set,
 			     ref_attr, target_attr, filter, disallowed,
+			     restrict_subtrees, ignore_subtrees,
 			     outbuf, outbuf_len, outbuf_choices,
 			     rel_attrs, ref_attrs, inref_attrs,
 			     ref_attr_list, inref_attr_list);
@@ -1207,6 +1282,8 @@ format_deref_rx(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *fname, const char *group, const char *set,
 		const char **attributes, const char **filters,
 		const char *disallowed,
+	        const struct slapi_dn **restrict_subtrees,
+	        const struct slapi_dn **ignore_subtrees,
 		char *outbuf, int outbuf_len,
 		struct format_choice **outbuf_choices,
 		char ***rel_attrs, char ***ref_attrs,
@@ -1272,6 +1349,18 @@ format_deref_rx(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			format_add_sdn_list(&list->links[i].base_sdn_list,
 					    &list->links[i].base_sdn_list2,
 					    slapi_sdn_get_ndn(parent));
+			/* Check if the referred-to entry is in a location that
+			 * we care about. */
+			if (format_check_sdn_location(these[j],
+						      restrict_subtrees,
+						      ignore_subtrees) != 0) {
+				slapi_log_error(SLAPI_LOG_PLUGIN,
+						state->plugin_desc->spd_id,
+						"%s: entry \"%s\" is in a location "
+						"where we don't look\n", fname,
+						slapi_sdn_get_ndn(these[j]));
+				continue;
+			}
 			/* Pull up the named entry. */
 			wrap_search_internal_get_entry(pb, these[j],
 						       NULL,
@@ -1315,18 +1404,25 @@ format_deref_rx(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 					if (cvalue == NULL) {
 						continue;
 					}
+					/* If it's in an area that we're
+					 * ignoring, then ignore it already. */
+					if (format_check_dn_location(cvalue,
+								     restrict_subtrees,
+								     ignore_subtrees) != 0) {
+						continue;
+					}
 					/* Let's visit the named entry this
 					 * time, in case we're nesting. */
-					format_add_filtered_sdn_list(pb, &these, &these2,
-								     cvalue,
-								     list->links[i + 1].filter_str,
-								     state->plugin_identity);
+					format_maybe_add_sdn_list(pb, &these, &these2,
+								  cvalue,
+								  list->links[i + 1].filter_str,
+								  state->plugin_identity);
 					/* We need to visit the named entry
 					 * next time. */
-					format_add_filtered_sdn_list(pb, &next, &next2,
-								     cvalue,
-								     list->links[i + 1].filter_str,
-								     state->plugin_identity);
+					format_maybe_add_sdn_list(pb, &next, &next2,
+								  cvalue,
+								  list->links[i + 1].filter_str,
+								  state->plugin_identity);
 				} else {
 					/* Get the value. */
 					bval = slapi_value_get_berval(value);
@@ -1373,6 +1469,8 @@ static int
 format_deref_r(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs,
@@ -1405,6 +1503,7 @@ format_deref_r(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			      group, set,
 			      (const char **) argv, NULL,
 			      disallowed,
+			      restrict_subtrees, ignore_subtrees,
 			      outbuf, outbuf_len,
 			      outbuf_choices,
 			      rel_attrs, ref_attrs, inref_attrs,
@@ -1417,6 +1516,8 @@ static int
 format_deref_rf(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *group, const char *set,
 		const char *args, const char *disallowed,
+		const struct slapi_dn **restrict_subtrees,
+		const struct slapi_dn **ignore_subtrees,
 		char *outbuf, int outbuf_len,
 		struct format_choice **outbuf_choices,
 		char ***rel_attrs,
@@ -1475,6 +1576,7 @@ format_deref_rf(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			      group, set,
 			      (const char **) attrs, (const char **) filters,
 			      disallowed,
+			      restrict_subtrees, ignore_subtrees,
 			      outbuf, outbuf_len,
 			      outbuf_choices,
 			      rel_attrs, ref_attrs, inref_attrs,
@@ -1543,6 +1645,8 @@ static int
 format_referred(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *group, const char *set,
 		const char *args, const char *disallowed,
+		const struct slapi_dn **restrict_subtrees,
+		const struct slapi_dn **ignore_subtrees,
 		char *outbuf, int outbuf_len,
 		struct format_choice **outbuf_choices,
 		char ***rel_attrs, char ***ref_attrs,
@@ -1748,6 +1852,8 @@ static int
 format_referred_r(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		  const char *group, const char *set,
 		  const char *args, const char *disallowed,
+		  const struct slapi_dn **restrict_subtrees,
+		  const struct slapi_dn **ignore_subtrees,
 		  char *outbuf, int outbuf_len,
 		  struct format_choice **outbuf_choices,
 		  char ***rel_attrs,
@@ -1989,6 +2095,8 @@ static int
 format_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *group, const char *set,
 	     const char *args, const char *disallowed,
+	     const struct slapi_dn **restrict_subtrees,
+	     const struct slapi_dn **ignore_subtrees,
 	     char *outbuf, int outbuf_len,
 	     struct format_choice **outbuf_choices,
 	     char ***rel_attrs, char ***ref_attrs,
@@ -2021,6 +2129,7 @@ format_merge(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 				"merge: expanding ->%s<-\n", argv[i]);
 		values = format_get_data_set(state, pb, e, group, set,
 					     argv[i], disallowed,
+					     restrict_subtrees, ignore_subtrees,
 					     rel_attrs, ref_attrs, inref_attrs,
 					     ref_attr_list, inref_attr_list,
 					     &lengths);
@@ -2074,6 +2183,8 @@ format_match_generic(struct plugin_state *state,
 		     const char *group, const char *set,
 		     const char *args, int min_args, int default_arg,
 		     const char *disallowed,
+		     const struct slapi_dn **restrict_subtrees,
+		     const struct slapi_dn **ignore_subtrees,
 		     char *outbuf, int outbuf_len,
 		     struct format_choice **outbuf_choices,
 		     char ***rel_attrs,
@@ -2109,6 +2220,7 @@ format_match_generic(struct plugin_state *state,
 	lengths = NULL;
 	values = format_get_data_set(state, pb, e, group, set,
 				     argv[0], disallowed,
+				     restrict_subtrees, ignore_subtrees,
 				     rel_attrs, ref_attrs, inref_attrs,
 				     ref_attr_list, inref_attr_list,
 				     &lengths);
@@ -2164,6 +2276,8 @@ format_match_generic(struct plugin_state *state,
 							group, set,
 							argv[default_arg],
 							disallowed,
+							restrict_subtrees,
+							ignore_subtrees,
 							rel_attrs,
 							ref_attrs,
 							inref_attrs,
@@ -2273,6 +2387,8 @@ format_match(struct plugin_state *state,
 	     Slapi_PBlock *pb, Slapi_Entry *e,
 	     const char *group, const char *set,
 	     const char *args, const char *disallowed,
+	     const struct slapi_dn **restrict_subtrees,
+	     const struct slapi_dn **ignore_subtrees,
 	     char *outbuf, int outbuf_len,
 	     struct format_choice **outbuf_choices,
 	     char ***rel_attrs, char ***ref_attrs,
@@ -2282,6 +2398,7 @@ format_match(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, 2,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2292,6 +2409,8 @@ format_mmatch(struct plugin_state *state,
 	      Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *group, const char *set,
 	      const char *args, const char *disallowed,
+	      const struct slapi_dn **restrict_subtrees,
+	      const struct slapi_dn **ignore_subtrees,
 	      char *outbuf, int outbuf_len,
 	      struct format_choice **outbuf_choices,
 	      char ***rel_attrs, char ***ref_attrs,
@@ -2301,6 +2420,7 @@ format_mmatch(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, -1,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2333,6 +2453,8 @@ format_regmatch(struct plugin_state *state,
 		Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *group, const char *set,
 		const char *args, const char *disallowed,
+		const struct slapi_dn **restrict_subtrees,
+		const struct slapi_dn **ignore_subtrees,
 		char *outbuf, int outbuf_len,
 		struct format_choice **outbuf_choices,
 		char ***rel_attrs, char ***ref_attrs,
@@ -2342,6 +2464,7 @@ format_regmatch(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, 2,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2352,6 +2475,8 @@ format_mregmatch(struct plugin_state *state,
 		 Slapi_PBlock *pb, Slapi_Entry *e,
 		 const char *group, const char *set,
 		 const char *args, const char *disallowed,
+		 const struct slapi_dn **restrict_subtrees,
+		 const struct slapi_dn **ignore_subtrees,
 		 char *outbuf, int outbuf_len,
 		 struct format_choice **outbuf_choices,
 		 char ***rel_attrs, char ***ref_attrs,
@@ -2361,6 +2486,7 @@ format_mregmatch(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, -1,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2376,6 +2502,8 @@ format_regmatchi(struct plugin_state *state,
 		 Slapi_PBlock *pb, Slapi_Entry *e,
 		 const char *group, const char *set,
 		 const char *args, const char *disallowed,
+		 const struct slapi_dn **restrict_subtrees,
+		 const struct slapi_dn **ignore_subtrees,
 		 char *outbuf, int outbuf_len,
 		 struct format_choice **outbuf_choices,
 		 char ***rel_attrs, char ***ref_attrs,
@@ -2385,6 +2513,7 @@ format_regmatchi(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, 2,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2395,6 +2524,8 @@ format_mregmatchi(struct plugin_state *state,
 		  Slapi_PBlock *pb, Slapi_Entry *e,
 		  const char *group, const char *set,
 		  const char *args, const char *disallowed,
+		  const struct slapi_dn **restrict_subtrees,
+		  const struct slapi_dn **ignore_subtrees,
 		  char *outbuf, int outbuf_len,
 		  struct format_choice **outbuf_choices,
 		  char ***rel_attrs, char ***ref_attrs,
@@ -2404,6 +2535,7 @@ format_mregmatchi(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 2, -1,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2529,6 +2661,8 @@ format_regsub(struct plugin_state *state,
 	      Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *group, const char *set,
 	      const char *args, const char *disallowed,
+	      const struct slapi_dn **restrict_subtrees,
+	      const struct slapi_dn **ignore_subtrees,
 	      char *outbuf, int outbuf_len,
 	      struct format_choice **outbuf_choices,
 	      char ***rel_attrs, char ***ref_attrs,
@@ -2538,6 +2672,7 @@ format_regsub(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 3, 3,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2548,6 +2683,8 @@ format_mregsub(struct plugin_state *state,
 	       Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs, char ***ref_attrs,
@@ -2557,6 +2694,7 @@ format_mregsub(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 3, -1,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2572,6 +2710,8 @@ format_regsubi(struct plugin_state *state,
 	       Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs, char ***ref_attrs,
@@ -2581,6 +2721,7 @@ format_regsubi(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 3, 3,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2591,6 +2732,8 @@ format_mregsubi(struct plugin_state *state,
 		Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *group, const char *set,
 		const char *args, const char *disallowed,
+		const struct slapi_dn **restrict_subtrees,
+		const struct slapi_dn **ignore_subtrees,
 		char *outbuf, int outbuf_len,
 		struct format_choice **outbuf_choices,
 		char ***rel_attrs, char ***ref_attrs,
@@ -2600,6 +2743,7 @@ format_mregsubi(struct plugin_state *state,
 {
 	return format_match_generic(state, pb, e, group, set, args, 3, -1,
 				    disallowed,
+				    restrict_subtrees, ignore_subtrees,
 				    outbuf, outbuf_len, outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
 				    ref_attr_list, inref_attr_list,
@@ -2615,6 +2759,8 @@ static int
 format_ifeq(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	    const char *group, const char *set,
 	    const char *args, const char *disallowed,
+	    const struct slapi_dn **restrict_subtrees,
+	    const struct slapi_dn **ignore_subtrees,
 	    char *outbuf, int outbuf_len,
 	    struct format_choice **outbuf_choices,
 	    char ***rel_attrs, char ***ref_attrs,
@@ -2657,6 +2803,7 @@ format_ifeq(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	/* Evaluate the value expression to get a list of candidate values. */
 	values = format_get_data_set(state, pb, e, group, set,
 				     argv[1], disallowed,
+				     restrict_subtrees, ignore_subtrees,
 				     rel_attrs, ref_attrs, inref_attrs,
 				     ref_attr_list, inref_attr_list,
 				     &lengths);
@@ -2695,6 +2842,8 @@ format_ifeq(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	 * return its values. */
 	ret = format_expand(state, pb, e, group, set,
 			    argv[matched ? 2 : 3], disallowed,
+			    restrict_subtrees,
+			    ignore_subtrees,
 			    outbuf, outbuf_len,
 			    outbuf_choices,
 			    rel_attrs, ref_attrs, inref_attrs,
@@ -2709,6 +2858,8 @@ static int
 format_default(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs, char ***ref_attrs,
@@ -2737,6 +2888,8 @@ format_default(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	for (i = 0; i < argc; i++) {
 		ret = format_expand(state, pb, e, group, set,
 				    argv[i], disallowed,
+				    restrict_subtrees,
+				    ignore_subtrees,
 				    outbuf, outbuf_len,
 				    outbuf_choices,
 				    rel_attrs, ref_attrs, inref_attrs,
@@ -2779,6 +2932,8 @@ static int
 format_sort(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	    const char *group, const char *set,
 	    const char *args, const char *disallowed,
+	    const struct slapi_dn **restrict_subtrees,
+	    const struct slapi_dn **ignore_subtrees,
 	    char *outbuf, int outbuf_len,
 	    struct format_choice **outbuf_choices,
 	    char ***rel_attrs, char ***ref_attrs,
@@ -2821,6 +2976,7 @@ format_sort(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	choices = NULL;
 	values = format_get_data_set(state, pb, e, group, set,
 				     argv[0], disallowed,
+				     restrict_subtrees, ignore_subtrees,
 				     rel_attrs, ref_attrs, inref_attrs,
 				     ref_attr_list, inref_attr_list,
 				     &lengths);
@@ -2884,6 +3040,8 @@ static int
 format_collect(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	       const char *group, const char *set,
 	       const char *args, const char *disallowed,
+	       const struct slapi_dn **restrict_subtrees,
+	       const struct slapi_dn **ignore_subtrees,
 	       char *outbuf, int outbuf_len,
 	       struct format_choice **outbuf_choices,
 	       char ***rel_attrs, char ***ref_attrs,
@@ -2922,6 +3080,7 @@ format_collect(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		/* Evaluate this argument. */
 		values = format_get_data_set(state, pb, e, group, set,
 					     argv[i], disallowed,
+					     restrict_subtrees, ignore_subtrees,
 					     rel_attrs, ref_attrs, inref_attrs,
 					     ref_attr_list, inref_attr_list,
 					     &lengths);
@@ -2985,6 +3144,8 @@ static int
 format_link(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	    const char *group, const char *set,
 	    const char *args, const char *disallowed,
+	    const struct slapi_dn **restrict_subtrees,
+	    const struct slapi_dn **ignore_subtrees,
 	    char *outbuf, int outbuf_len,
 	    struct format_choice **outbuf_choices,
 	    char ***rel_attrs, char ***ref_attrs,
@@ -3046,6 +3207,8 @@ format_link(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 		j = (i / 3) * 2;
 		values[j] = format_get_data_set(state, pb, e, group, set,
 						argv[i], disallowed,
+						restrict_subtrees,
+						ignore_subtrees,
 						rel_attrs,
 						ref_attrs, inref_attrs,
 						ref_attr_list,
@@ -3059,6 +3222,8 @@ format_link(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 				"link: evaluating \"%s\"\n", argv[i + 1]);
 		values[j] = format_get_data_set(state, pb, e, group, set,
 						argv[i + 1], disallowed,
+						restrict_subtrees,
+						ignore_subtrees,
 						rel_attrs,
 						ref_attrs, inref_attrs,
 						ref_attr_list,
@@ -3219,6 +3384,8 @@ static int
 format_unique(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *group, const char *set,
 	      const char *args, const char *disallowed,
+	      const struct slapi_dn **restrict_subtrees,
+	      const struct slapi_dn **ignore_subtrees,
 	      char *outbuf, int outbuf_len,
 	      struct format_choice **outbuf_choices,
 	      char ***rel_attrs,
@@ -3261,6 +3428,7 @@ format_unique(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	ret = -ENOENT;
 	values = format_get_data_set(state, pb, e, group, set,
 				     value_format, disallowed,
+				     restrict_subtrees, ignore_subtrees,
 				     rel_attrs, ref_attrs, inref_attrs,
 				     ref_attr_list, inref_attr_list,
 				     &lengths);
@@ -3276,6 +3444,8 @@ format_unique(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			i = format_expand(state, pb, e,
 					  group, set,
 					  default_value, NULL,
+					  restrict_subtrees,
+					  ignore_subtrees,
 					  outbuf, outbuf_len,
 					  outbuf_choices,
 					  rel_attrs, ref_attrs, inref_attrs,
@@ -3333,6 +3503,8 @@ format_internal_sequence_number(struct plugin_state *state,
 				Slapi_PBlock *pb, Slapi_Entry *e,
 				const char *group, const char *set,
 				const char *args, const char *disallowed,
+				const struct slapi_dn **restrict_subtrees,
+				const struct slapi_dn **ignore_subtrees,
 				char *outbuf, int outbuf_len,
 				struct format_choice **outbuf_choices,
 				char ***rel_attrs,
@@ -3378,6 +3550,8 @@ format_dribble_merge(struct plugin_state *state, Slapi_PBlock *pb,
 		     Slapi_Entry *e,
 		     const char *group, const char *set,
 		     const char *args, const char *disallowed,
+		     const struct slapi_dn **restrict_subtrees,
+		     const struct slapi_dn **ignore_subtrees,
 		     char *outbuf, int outbuf_len,
 		     struct format_choice **outbuf_choices,
 		     char ***rel_attrs,
@@ -3429,6 +3603,7 @@ format_dribble_merge(struct plugin_state *state, Slapi_PBlock *pb,
 				"dribble_merge: expanding ->%s<-\n", argv[i]);
 		values = format_get_data_set(state, pb, e, group, set,
 					     argv[i], disallowed,
+					     restrict_subtrees, ignore_subtrees,
 					     rel_attrs, ref_attrs, inref_attrs,
 					     ref_attr_list, inref_attr_list,
 					     &lengths);
@@ -3538,6 +3713,8 @@ format_lookup_fn(const char *fnname)
 			       Slapi_PBlock *pb, Slapi_Entry *e,
 			       const char *group, const char *set,
 			       const char *args, const char *disallowed,
+			       const struct slapi_dn **restrict_subtrees,
+			       const struct slapi_dn **ignore_subtrees,
 			       char *outbuf, int outbuf_len,
 			       struct format_choice **outbuf_choices,
 			       char ***rel_attrs,
@@ -3883,6 +4060,8 @@ format_expand_simple(struct plugin_state *state,
 		     Slapi_PBlock *pb, Slapi_Entry *e,
 		     const char *group, const char *set,
 		     const char *fmt, const char *disallowed,
+		     const struct slapi_dn **restrict_subtrees,
+		     const struct slapi_dn **ignore_subtrees,
 		     char *outbuf, int outbuf_len,
 		     struct format_choice **outbuf_choices,
 		     char ***rel_attrs,
@@ -3993,6 +4172,8 @@ format_expand_simple(struct plugin_state *state,
 				i = format_expand(state, pb, e,
 						  group, set,
 						  default_value, NULL,
+						  restrict_subtrees,
+						  ignore_subtrees,
 						  outbuf, outbuf_len,
 						  outbuf_choices,
 						  rel_attrs,
@@ -4012,6 +4193,8 @@ format_expand_simple(struct plugin_state *state,
 				i = format_expand(state, pb, e,
 						  group, set,
 						  alternate_value, NULL,
+						  restrict_subtrees,
+						  ignore_subtrees,
 						  outbuf, outbuf_len,
 						  outbuf_choices,
 						  rel_attrs,
@@ -4041,6 +4224,7 @@ format_expand_simple(struct plugin_state *state,
 			/* Supply the alternate value. */
 			i = format_expand(state, pb, e,
 					  group, set, alternate_value, NULL,
+					  restrict_subtrees, ignore_subtrees,
 					  outbuf, outbuf_len, outbuf_choices,
 					  rel_attrs, ref_attrs, inref_attrs,
 					  ref_attr_list, inref_attr_list);
@@ -4079,6 +4263,8 @@ static int
 format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 	      const char *group, const char *set,
 	      const char *fmt, const char *disallowed,
+	      const struct slapi_dn **restrict_subtrees,
+	      const struct slapi_dn **ignore_subtrees,
 	      char *outbuf, int outbuf_len,
 	      struct format_choice **outbuf_choices,
 	      char ***rel_attrs, char ***ref_attrs,
@@ -4094,6 +4280,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 			Slapi_PBlock *pb, Slapi_Entry *e,
 			const char *group, const char *set,
 			const char *args, const char *disallowed,
+			const struct slapi_dn **restrict_subtrees,
+			const struct slapi_dn **ignore_subtrees,
 			char *outbuf, int outbuf_len,
 			struct format_choice **outbuf_choices,
 			char ***rel_attrs,
@@ -4154,6 +4342,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 								    set,
 								    subexp,
 								    disallowed,
+								    restrict_subtrees,
+								    ignore_subtrees,
 								    outbuf + j,
 								    outbuf_len - j,
 								    outbuf_choices,
@@ -4260,6 +4450,8 @@ format_expand(struct plugin_state *state, Slapi_PBlock *pb, Slapi_Entry *e,
 				used = (*formatfn)(state, pb, e,
 						   group, set,
 						   params, disallowed,
+						   restrict_subtrees,
+						   ignore_subtrees,
 						   outbuf + j, outbuf_len - j,
 						   outbuf_choices,
 						   rel_attrs,
@@ -4321,6 +4513,8 @@ format_format(struct plugin_state *state,
 	      const char *group, const char *set,
 	      const char *fmt, const char *disallowed,
 	      struct format_choice **choices,
+	      const struct slapi_dn **restrict_subtrees,
+	      const struct slapi_dn **ignore_subtrees,
 	      char ***rel_attrs, char ***ref_attrs,
 	      struct format_inref_attr ***inref_attrs,
 	      struct format_ref_attr_list ***ref_attr_list,
@@ -4348,6 +4542,8 @@ format_format(struct plugin_state *state,
 		pb = wrap_pblock_new(parent_pb);
 		i = format_expand(state, pb, e, group, set,
 				  fmt, disallowed,
+				  restrict_subtrees,
+				  ignore_subtrees,
 				  buf, buflen, choices,
 				  rel_attrs, ref_attrs, inref_attrs,
 				  ref_attr_list, inref_attr_list);
@@ -4410,6 +4606,8 @@ format_get_data(struct plugin_state *state,
 		Slapi_PBlock *pb, Slapi_Entry *e,
 		const char *group, const char *set,
 		const char *fmt, const char *disallowed,
+		const struct slapi_dn **restrict_subtrees,
+		const struct slapi_dn **ignore_subtrees,
 		char ***rel_attrs,
 		char ***ref_attrs,
 		struct format_inref_attr ***inref_attrs,
@@ -4420,6 +4618,7 @@ format_get_data(struct plugin_state *state,
 	unsigned int ignored;
 	return format_format(state, pb, e, group, set, fmt,
 			     disallowed, NULL,
+			     restrict_subtrees, ignore_subtrees,
 			     rel_attrs,
 			     ref_attrs, inref_attrs,
 			     ref_attr_list, inref_attr_list,
@@ -4443,6 +4642,8 @@ format_get_data_set(struct plugin_state *state,
 		    Slapi_PBlock *pb, Slapi_Entry *e,
 		    const char *group, const char *set,
 		    const char *fmt, const char *disallowed,
+		    const struct slapi_dn **restrict_subtrees,
+		    const struct slapi_dn **ignore_subtrees,
 		    char ***rel_attrs,
 		    char ***ref_attrs,
 		    struct format_inref_attr ***inref_attrs,
@@ -4457,7 +4658,7 @@ format_get_data_set(struct plugin_state *state,
 	unsigned int template_len;
 	choices = NULL;
 	template = format_format(state, pb, e, group, set, fmt, disallowed,
-				 &choices,
+				 &choices, restrict_subtrees, ignore_subtrees,
 				 rel_attrs, ref_attrs, inref_attrs,
 				 ref_attr_list, inref_attr_list,
 				 &template_len);
diff --git a/src/format.h b/src/format.h
index 0aa7d20..4cde2dc 100644
--- a/src/format.h
+++ b/src/format.h
@@ -59,6 +59,8 @@ char *format_get_data(struct plugin_state *state,
 		      const char *domain, const char *map,
 		      const char *fmt,
 		      const char *disallowed_chars,
+		      const struct slapi_dn **restrict_subtrees,
+		      const struct slapi_dn **ignore_subtrees,
 		      char ***rel_attrs,
 		      char ***ref_attrs,
 		      struct format_inref_attr ***inref_attrs,
@@ -71,6 +73,8 @@ char **format_get_data_set(struct plugin_state *state,
 			   const char *domain, const char *map,
 			   const char *fmt,
 			   const char *disallowed,
+			   const struct slapi_dn **restrict_subtrees,
+			   const struct slapi_dn **ignore_subtrees,
 			   char ***rel_attrs,
 			   char ***ref_attrs,
 			   struct format_inref_attr ***inref_attrs,