git.sur5r.net Git - openldap/blob - servers/slapd/filter.c

   1 /* filter.c - routines for parsing and dealing with filters */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2006 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/socket.h>
  32 #include <ac/string.h>
  33
  34 #include "slap.h"
  35
  36 static int      get_filter_list(
  37         Operation *op,
  38         BerElement *ber,
  39         Filter **f,
  40         const char **text );
  41
  42 static int      get_ssa(
  43         Operation *op,
  44         BerElement *ber,
  45         Filter *f,
  46         const char **text );
  47
  48 static void simple_vrFilter2bv(
  49         Operation *op,
  50         ValuesReturnFilter *f,
  51         struct berval *fstr );
  52
  53 static int      get_simple_vrFilter(
  54         Operation *op,
  55         BerElement *ber,
  56         ValuesReturnFilter **f,
  57         const char **text );
  58
  59 int
  60 get_filter(
  61         Operation *op,
  62         BerElement *ber,
  63         Filter **filt,
  64         const char **text )
  65 {
  66         ber_tag_t       tag;
  67         ber_len_t       len;
  68         int             err;
  69         Filter          f;
  70
  71         Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
  72         /*
  73          * A filter looks like this coming in:
  74          *      Filter ::= CHOICE {
  75          *              and             [0]     SET OF Filter,
  76          *              or              [1]     SET OF Filter,
  77          *              not             [2]     Filter,
  78          *              equalityMatch   [3]     AttributeValueAssertion,
  79          *              substrings      [4]     SubstringFilter,
  80          *              greaterOrEqual  [5]     AttributeValueAssertion,
  81          *              lessOrEqual     [6]     AttributeValueAssertion,
  82          *              present         [7]     AttributeType,
  83          *              approxMatch     [8]     AttributeValueAssertion,
  84          *              extensibleMatch [9]     MatchingRuleAssertion
  85          *      }
  86          *
  87          *      SubstringFilter ::= SEQUENCE {
  88          *              type               AttributeType,
  89          *              SEQUENCE OF CHOICE {
  90          *                      initial          [0] IA5String,
  91          *                      any              [1] IA5String,
  92          *                      final            [2] IA5String
  93          *              }
  94          *      }
  95          *
  96          *      MatchingRuleAssertion ::= SEQUENCE {
  97          *              matchingRule    [1] MatchingRuleId OPTIONAL,
  98          *              type            [2] AttributeDescription OPTIONAL,
  99          *              matchValue      [3] AssertionValue,
 100          *              dnAttributes    [4] BOOLEAN DEFAULT FALSE
 101          *      }
 102          *
 103          */
 104
 105         tag = ber_peek_tag( ber, &len );
 106
 107         if( tag == LBER_ERROR ) {
 108                 *text = "error decoding filter";
 109                 return SLAPD_DISCONNECT;
 110         }
 111
 112         err = LDAP_SUCCESS;
 113
 114         f.f_next = NULL;
 115         f.f_choice = tag;
 116
 117         switch ( f.f_choice ) {
 118         case LDAP_FILTER_EQUALITY:
 119                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 120                 err = get_ava( op, ber, &f, SLAP_MR_EQUALITY, text );
 121                 if ( err != LDAP_SUCCESS ) {
 122                         break;
 123                 }
 124
 125                 assert( f.f_ava != NULL );
 126                 break;
 127
 128         case LDAP_FILTER_SUBSTRINGS:
 129                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 130                 err = get_ssa( op, ber, &f, text );
 131                 if( err != LDAP_SUCCESS ) {
 132                         break;
 133                 }
 134                 assert( f.f_sub != NULL );
 135                 break;
 136
 137         case LDAP_FILTER_GE:
 138                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 139                 err = get_ava( op, ber, &f, SLAP_MR_ORDERING, text );
 140                 if ( err != LDAP_SUCCESS ) {
 141                         break;
 142                 }
 143                 assert( f.f_ava != NULL );
 144                 break;
 145
 146         case LDAP_FILTER_LE:
 147                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 148                 err = get_ava( op, ber, &f, SLAP_MR_ORDERING, text );
 149                 if ( err != LDAP_SUCCESS ) {
 150                         break;
 151                 }
 152                 assert( f.f_ava != NULL );
 153                 break;
 154
 155         case LDAP_FILTER_PRESENT: {
 156                 struct berval type;
 157
 158                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 159                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 160                         err = SLAPD_DISCONNECT;
 161                         *text = "error decoding filter";
 162                         break;
 163                 }
 164
 165                 f.f_desc = NULL;
 166                 err = slap_bv2ad( &type, &f.f_desc, text );
 167
 168                 if( err != LDAP_SUCCESS ) {
 169                         f.f_choice |= SLAPD_FILTER_UNDEFINED;
 170                         err = slap_bv2undef_ad( &type, &f.f_desc, text, SLAP_AD_PROXIED);
 171                         if ( err != LDAP_SUCCESS ) {
 172                                 /* unrecognized attribute description or other error */
 173                                 Debug( LDAP_DEBUG_ANY,
 174                                         "get_filter: conn %lu unknown attribute "
 175                                         "type=%s (%d)\n",
 176                                         op->o_connid, type.bv_val, err );
 177
 178                                 err = LDAP_SUCCESS;
 179                         }
 180                         *text = NULL;
 181                 }
 182
 183                 assert( f.f_desc != NULL );
 184                 } break;
 185
 186         case LDAP_FILTER_APPROX:
 187                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 188                 err = get_ava( op, ber, &f, SLAP_MR_EQUALITY_APPROX, text );
 189                 if ( err != LDAP_SUCCESS ) {
 190                         break;
 191                 }
 192                 assert( f.f_ava != NULL );
 193                 break;
 194
 195         case LDAP_FILTER_AND:
 196                 Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
 197                 err = get_filter_list( op, ber, &f.f_and, text );
 198                 if ( err != LDAP_SUCCESS ) {
 199                         break;
 200                 }
 201                 if ( f.f_and == NULL ) {
 202                         f.f_choice = SLAPD_FILTER_COMPUTED;
 203                         f.f_result = LDAP_COMPARE_TRUE;
 204                 }
 205                 /* no assert - list could be empty */
 206                 break;
 207
 208         case LDAP_FILTER_OR:
 209                 Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
 210                 err = get_filter_list( op, ber, &f.f_or, text );
 211                 if ( err != LDAP_SUCCESS ) {
 212                         break;
 213                 }
 214                 if ( f.f_or == NULL ) {
 215                         f.f_choice = SLAPD_FILTER_COMPUTED;
 216                         f.f_result = LDAP_COMPARE_FALSE;
 217                 }
 218                 /* no assert - list could be empty */
 219                 break;
 220
 221         case LDAP_FILTER_NOT:
 222                 Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
 223                 (void) ber_skip_tag( ber, &len );
 224                 err = get_filter( op, ber, &f.f_not, text );
 225                 if ( err != LDAP_SUCCESS ) {
 226                         break;
 227                 }
 228
 229                 assert( f.f_not != NULL );
 230                 if ( f.f_not->f_choice == SLAPD_FILTER_COMPUTED ) {
 231                         int fresult = f.f_not->f_result;
 232                         f.f_choice = SLAPD_FILTER_COMPUTED;
 233                         op->o_tmpfree( f.f_not, op->o_tmpmemctx );
 234                         f.f_not = NULL;
 235
 236                         switch( fresult ) {
 237                         case LDAP_COMPARE_TRUE:
 238                                 f.f_result = LDAP_COMPARE_FALSE;
 239                                 break;
 240                         case LDAP_COMPARE_FALSE:
 241                                 f.f_result = LDAP_COMPARE_TRUE;
 242                                 break;
 243                         default: ;
 244                                 /* (!Undefined) is Undefined */
 245                         }
 246                 }
 247                 break;
 248
 249         case LDAP_FILTER_EXT:
 250                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 251
 252                 err = get_mra( op, ber, &f, text );
 253                 if ( err != LDAP_SUCCESS ) {
 254                         break;
 255                 }
 256
 257                 assert( f.f_mra != NULL );
 258                 break;
 259
 260         default:
 261                 (void) ber_scanf( ber, "x" ); /* skip the element */
 262                 Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
 263                         f.f_choice, 0, 0 );
 264                 f.f_choice = SLAPD_FILTER_COMPUTED;
 265                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 266                 break;
 267         }
 268
 269         if( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 270                 /* ignore error */
 271                 *text = NULL;
 272                 f.f_choice = SLAPD_FILTER_COMPUTED;
 273                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 274                 err = LDAP_SUCCESS;
 275         }
 276
 277         if ( err == LDAP_SUCCESS ) {
 278                 *filt = op->o_tmpalloc( sizeof(f), op->o_tmpmemctx );
 279                 **filt = f;
 280         }
 281
 282         Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
 283
 284         return( err );
 285 }
 286
 287 static int
 288 get_filter_list( Operation *op, BerElement *ber,
 289         Filter **f,
 290         const char **text )
 291 {
 292         Filter          **new;
 293         int             err;
 294         ber_tag_t       tag;
 295         ber_len_t       len;
 296         char            *last;
 297
 298         Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
 299         new = f;
 300         for ( tag = ber_first_element( ber, &len, &last );
 301                 tag != LBER_DEFAULT;
 302                 tag = ber_next_element( ber, &len, last ) )
 303         {
 304                 err = get_filter( op, ber, new, text );
 305                 if ( err != LDAP_SUCCESS )
 306                         return( err );
 307                 new = &(*new)->f_next;
 308         }
 309         *new = NULL;
 310
 311         Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
 312         return( LDAP_SUCCESS );
 313 }
 314
 315 static int
 316 get_ssa(
 317         Operation *op,
 318         BerElement      *ber,
 319         Filter          *f,
 320         const char      **text )
 321 {
 322         ber_tag_t       tag;
 323         ber_len_t       len;
 324         ber_tag_t       rc;
 325         struct berval desc, value, nvalue;
 326         char            *last;
 327         SubstringsAssertion ssa;
 328
 329         *text = "error decoding filter";
 330
 331         Debug( LDAP_DEBUG_FILTER, "begin get_ssa\n", 0, 0, 0 );
 332         if ( ber_scanf( ber, "{m" /*}*/, &desc ) == LBER_ERROR ) {
 333                 return SLAPD_DISCONNECT;
 334         }
 335
 336         *text = NULL;
 337
 338         ssa.sa_desc = NULL;
 339         ssa.sa_initial.bv_val = NULL;
 340         ssa.sa_any = NULL;
 341         ssa.sa_final.bv_val = NULL;
 342
 343         rc = slap_bv2ad( &desc, &ssa.sa_desc, text );
 344
 345         if( rc != LDAP_SUCCESS ) {
 346                 f->f_choice |= SLAPD_FILTER_UNDEFINED;
 347                 rc = slap_bv2undef_ad( &desc, &ssa.sa_desc, text, SLAP_AD_PROXIED);
 348                 if( rc != LDAP_SUCCESS ) {
 349                         Debug( LDAP_DEBUG_ANY,
 350                                 "get_ssa: conn %lu unknown attribute type=%s (%ld)\n",
 351                                 op->o_connid, desc.bv_val, (long) rc );
 352
 353                         /* skip over the rest of this filter */
 354                         for ( tag = ber_first_element( ber, &len, &last );
 355                                 tag != LBER_DEFAULT;
 356                                 tag = ber_next_element( ber, &len, last ) ) {
 357                                 ber_scanf( ber, "x" );
 358                         }
 359                         return rc;
 360                 }
 361         }
 362
 363         rc = LDAP_PROTOCOL_ERROR;
 364
 365         for ( tag = ber_first_element( ber, &len, &last );
 366                 tag != LBER_DEFAULT;
 367                 tag = ber_next_element( ber, &len, last ) )
 368         {
 369                 unsigned usage;
 370
 371                 rc = ber_scanf( ber, "m", &value );
 372                 if ( rc == LBER_ERROR ) {
 373                         rc = SLAPD_DISCONNECT;
 374                         goto return_error;
 375                 }
 376
 377                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
 378                         rc = LDAP_INVALID_SYNTAX;
 379                         goto return_error;
 380                 }
 381
 382                 switch ( tag ) {
 383                 case LDAP_SUBSTRING_INITIAL:
 384                         if ( ssa.sa_initial.bv_val != NULL
 385                                 || ssa.sa_any != NULL
 386                                 || ssa.sa_final.bv_val != NULL )
 387                         {
 388                                 rc = LDAP_PROTOCOL_ERROR;
 389                                 goto return_error;
 390                         }
 391                         usage = SLAP_MR_SUBSTR_INITIAL;
 392                         break;
 393
 394                 case LDAP_SUBSTRING_ANY:
 395                         if ( ssa.sa_final.bv_val != NULL ) {
 396                                 rc = LDAP_PROTOCOL_ERROR;
 397                                 goto return_error;
 398                         }
 399                         usage = SLAP_MR_SUBSTR_ANY;
 400                         break;
 401
 402                 case LDAP_SUBSTRING_FINAL:
 403                         if ( ssa.sa_final.bv_val != NULL ) {
 404                                 rc = LDAP_PROTOCOL_ERROR;
 405                                 goto return_error;
 406                         }
 407
 408                         usage = SLAP_MR_SUBSTR_FINAL;
 409                         break;
 410
 411                 default:
 412                         Debug( LDAP_DEBUG_FILTER,
 413                                 "  unknown substring choice=%ld\n",
 414                                 (long) tag, 0, 0 );
 415
 416                         rc = LDAP_PROTOCOL_ERROR;
 417                         goto return_error;
 418                 }
 419
 420                 /* validate/normalize using equality matching rule validator! */
 421                 rc = asserted_value_validate_normalize(
 422                         ssa.sa_desc, ssa.sa_desc->ad_type->sat_equality,
 423                         usage, &value, &nvalue, text, op->o_tmpmemctx );
 424                 if( rc != LDAP_SUCCESS ) goto return_error;
 425
 426                 switch ( tag ) {
 427                 case LDAP_SUBSTRING_INITIAL:
 428                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
 429                         ssa.sa_initial = nvalue;
 430                         break;
 431
 432                 case LDAP_SUBSTRING_ANY:
 433                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
 434                         ber_bvarray_add_x( &ssa.sa_any, &nvalue, op->o_tmpmemctx );
 435                         break;
 436
 437                 case LDAP_SUBSTRING_FINAL:
 438                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
 439                         ssa.sa_final = nvalue;
 440                         break;
 441
 442                 default:
 443                         assert( 0 );
 444                         slap_sl_free( nvalue.bv_val, op->o_tmpmemctx );
 445                         rc = LDAP_PROTOCOL_ERROR;
 446
 447 return_error:
 448                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
 449                                 (long) rc, 0, 0 );
 450                         slap_sl_free( ssa.sa_initial.bv_val, op->o_tmpmemctx );
 451                         ber_bvarray_free_x( ssa.sa_any, op->o_tmpmemctx );
 452                         slap_sl_free( ssa.sa_final.bv_val, op->o_tmpmemctx );
 453                         return rc;
 454                 }
 455
 456                 rc = LDAP_SUCCESS;
 457         }
 458
 459         if( rc == LDAP_SUCCESS ) {
 460                 f->f_sub = op->o_tmpalloc( sizeof( ssa ), op->o_tmpmemctx );
 461                 *f->f_sub = ssa;
 462         }
 463
 464         Debug( LDAP_DEBUG_FILTER, "end get_ssa\n", 0, 0, 0 );
 465         return rc /* LDAP_SUCCESS */ ;
 466 }
 467
 468 void
 469 filter_free_x( Operation *op, Filter *f )
 470 {
 471         Filter  *p, *next;
 472
 473         if ( f == NULL ) {
 474                 return;
 475         }
 476
 477         f->f_choice &= SLAPD_FILTER_MASK;
 478
 479         switch ( f->f_choice ) {
 480         case LDAP_FILTER_PRESENT:
 481                 break;
 482
 483         case LDAP_FILTER_EQUALITY:
 484         case LDAP_FILTER_GE:
 485         case LDAP_FILTER_LE:
 486         case LDAP_FILTER_APPROX:
 487                 ava_free( op, f->f_ava, 1 );
 488                 break;
 489
 490         case LDAP_FILTER_SUBSTRINGS:
 491                 if ( f->f_sub_initial.bv_val != NULL ) {
 492                         op->o_tmpfree( f->f_sub_initial.bv_val, op->o_tmpmemctx );
 493                 }
 494                 ber_bvarray_free_x( f->f_sub_any, op->o_tmpmemctx );
 495                 if ( f->f_sub_final.bv_val != NULL ) {
 496                         op->o_tmpfree( f->f_sub_final.bv_val, op->o_tmpmemctx );
 497                 }
 498                 op->o_tmpfree( f->f_sub, op->o_tmpmemctx );
 499                 break;
 500
 501         case LDAP_FILTER_AND:
 502         case LDAP_FILTER_OR:
 503         case LDAP_FILTER_NOT:
 504                 for ( p = f->f_list; p != NULL; p = next ) {
 505                         next = p->f_next;
 506                         filter_free_x( op, p );
 507                 }
 508                 break;
 509
 510         case LDAP_FILTER_EXT:
 511                 mra_free( op, f->f_mra, 1 );
 512                 break;
 513
 514         case SLAPD_FILTER_COMPUTED:
 515                 break;
 516
 517         default:
 518                 Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
 519                         f->f_choice, 0, 0 );
 520                 break;
 521         }
 522
 523         op->o_tmpfree( f, op->o_tmpmemctx );
 524 }
 525
 526 void
 527 filter_free( Filter *f )
 528 {
 529         Operation op;
 530         Opheader ohdr;
 531
 532         op.o_hdr = &ohdr;
 533         op.o_tmpmemctx = slap_sl_context( f );
 534         op.o_tmpmfuncs = &slap_sl_mfuncs;
 535         filter_free_x( &op, f );
 536 }
 537
 538 void
 539 filter2bv_x( Operation *op, Filter *f, struct berval *fstr )
 540 {
 541         int             i;
 542         Filter          *p;
 543         struct berval   tmp;
 544         static struct berval
 545                         ber_bvfalse = BER_BVC( "(?=false)" ),
 546                         ber_bvtrue = BER_BVC( "(?=true)" ),
 547                         ber_bvundefined = BER_BVC( "(?=undefined)" ),
 548                         ber_bverror = BER_BVC( "(?=error)" ),
 549                         ber_bvunknown = BER_BVC( "(?=unknown)" ),
 550                         ber_bvnone = BER_BVC( "(?=none)" );
 551         ber_len_t       len;
 552         ber_tag_t       choice;
 553         int undef;
 554         char *sign;
 555
 556         if ( f == NULL ) {
 557                 ber_dupbv_x( fstr, &ber_bvnone, op->o_tmpmemctx );
 558                 return;
 559         }
 560
 561         undef = f->f_choice & SLAPD_FILTER_UNDEFINED;
 562         choice = f->f_choice & SLAPD_FILTER_MASK;
 563
 564         switch ( choice ) {
 565         case LDAP_FILTER_EQUALITY:
 566                 fstr->bv_len = STRLENOF("(=)");
 567                 sign = "=";
 568                 goto simple;
 569         case LDAP_FILTER_GE:
 570                 fstr->bv_len = STRLENOF("(>=)");
 571                 sign = ">=";
 572                 goto simple;
 573         case LDAP_FILTER_LE:
 574                 fstr->bv_len = STRLENOF("(<=)");
 575                 sign = "<=";
 576                 goto simple;
 577         case LDAP_FILTER_APPROX:
 578                 fstr->bv_len = STRLENOF("(~=)");
 579                 sign = "~=";
 580
 581 simple:
 582                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 583                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 584                  * since in a Filter values in AVAs are supposed
 585                  * to have been normalized, meaning that an empty value
 586                  * is legal for that attribute's syntax */
 587
 588                 fstr->bv_len += f->f_av_desc->ad_cname.bv_len + tmp.bv_len;
 589                 if ( undef )
 590                         fstr->bv_len++;
 591                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 592
 593                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s)",
 594                         undef ? "?" : "",
 595                         f->f_av_desc->ad_cname.bv_val, sign,
 596                         tmp.bv_len ? tmp.bv_val : "" );
 597
 598                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 599                 break;
 600
 601         case LDAP_FILTER_SUBSTRINGS:
 602                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
 603                         STRLENOF("(=*)");
 604                 if ( undef )
 605                         fstr->bv_len++;
 606                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 607
 608                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s=*)",
 609                         undef ? "?" : "",
 610                         f->f_sub_desc->ad_cname.bv_val );
 611
 612                 if ( f->f_sub_initial.bv_val != NULL ) {
 613                         ber_len_t tmplen;
 614
 615                         len = fstr->bv_len;
 616
 617                         filter_escape_value_x( &f->f_sub_initial, &tmp, op->o_tmpmemctx );
 618                         tmplen = tmp.bv_len ? tmp.bv_len : STRLENOF( "(null)" );
 619
 620                         fstr->bv_len += tmplen;
 621                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 622                                 fstr->bv_len + 1, op->o_tmpmemctx );
 623
 624                         snprintf( &fstr->bv_val[len-2],
 625                                 tmplen + STRLENOF( /*(*/ "*)" ) + 1,
 626                                 /* "(attr=" */ "%s*)",
 627                                 tmp.bv_len ? tmp.bv_val : "(null)");
 628
 629                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 630                 }
 631
 632                 if ( f->f_sub_any != NULL ) {
 633                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
 634                                 ber_len_t tmplen;
 635
 636                                 len = fstr->bv_len;
 637                                 filter_escape_value_x( &f->f_sub_any[i],
 638                                         &tmp, op->o_tmpmemctx );
 639                                 tmplen = tmp.bv_len ? tmp.bv_len : STRLENOF( "(null)" );
 640
 641                                 fstr->bv_len += tmplen + STRLENOF( /*(*/ ")" );
 642                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 643                                         fstr->bv_len + 1, op->o_tmpmemctx );
 644
 645                                 snprintf( &fstr->bv_val[len-1],
 646                                         tmplen + STRLENOF( /*(*/ "*)" ) + 1,
 647                                         /* "(attr=[init]*[any*]" */ "%s*)",
 648                                         tmp.bv_len ? tmp.bv_val : "(null)");
 649                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 650                         }
 651                 }
 652
 653                 if ( f->f_sub_final.bv_val != NULL ) {
 654                         ber_len_t tmplen;
 655
 656                         len = fstr->bv_len;
 657
 658                         filter_escape_value_x( &f->f_sub_final, &tmp, op->o_tmpmemctx );
 659                         tmplen = tmp.bv_len ? tmp.bv_len : STRLENOF( "(null)" );
 660
 661                         fstr->bv_len += tmplen;
 662                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 663                                 fstr->bv_len + 1, op->o_tmpmemctx );
 664
 665                         snprintf( &fstr->bv_val[len-1],
 666                                 tmplen + STRLENOF( /*(*/ ")" ) + 1,
 667                                 /* "(attr=[init*][any*]" */ "%s)",
 668                                 tmp.bv_len ? tmp.bv_val : "(null)");
 669
 670                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 671                 }
 672
 673                 break;
 674
 675         case LDAP_FILTER_PRESENT:
 676                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
 677                         STRLENOF("(=*)");
 678                 if ( undef )
 679                         fstr->bv_len++;
 680
 681                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 682
 683                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s=*)",
 684                         undef ? "?" : "",
 685                         f->f_desc->ad_cname.bv_val );
 686                 break;
 687
 688         case LDAP_FILTER_AND:
 689         case LDAP_FILTER_OR:
 690         case LDAP_FILTER_NOT:
 691                 fstr->bv_len = STRLENOF("(%)");
 692                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 693
 694                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 695                         f->f_choice == LDAP_FILTER_AND ? '&' :
 696                         f->f_choice == LDAP_FILTER_OR ? '|' : '!' );
 697
 698                 for ( p = f->f_list; p != NULL; p = p->f_next ) {
 699                         len = fstr->bv_len;
 700
 701                         filter2bv_x( op, p, &tmp );
 702
 703                         fstr->bv_len += tmp.bv_len;
 704                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 705                                 op->o_tmpmemctx );
 706
 707                         snprintf( &fstr->bv_val[len-1],
 708                                 tmp.bv_len + STRLENOF( /*(*/ ")" ) + 1,
 709                                 /*"("*/ "%s)", tmp.bv_val );
 710
 711                         op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
 712                 }
 713
 714                 break;
 715
 716         case LDAP_FILTER_EXT: {
 717                 struct berval ad;
 718
 719                 filter_escape_value_x( &f->f_mr_value, &tmp, op->o_tmpmemctx );
 720                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 721                  * since in a Filter values in MRAs are supposed
 722                  * to have been normalized, meaning that an empty value
 723                  * is legal for that attribute's syntax */
 724
 725                 if ( f->f_mr_desc ) {
 726                         ad = f->f_mr_desc->ad_cname;
 727                 } else {
 728                         ad.bv_len = 0;
 729                         ad.bv_val = "";
 730                 }
 731
 732                 fstr->bv_len = ad.bv_len +
 733                         ( f->f_mr_dnattrs ? STRLENOF(":dn") : 0 ) +
 734                         ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
 735                         tmp.bv_len + STRLENOF("(:=)");
 736                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 737
 738                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s%s:=%s)",
 739                         undef ? "?" : "",
 740                         ad.bv_val,
 741                         f->f_mr_dnattrs ? ":dn" : "",
 742                         f->f_mr_rule_text.bv_len ? ":" : "",
 743                         f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
 744                         tmp.bv_len ? tmp.bv_val : "" );
 745                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 746                 } break;
 747
 748         case SLAPD_FILTER_COMPUTED:
 749                 switch ( f->f_result ) {
 750                 case LDAP_COMPARE_FALSE:
 751                         tmp = ber_bvfalse;
 752                         break;
 753
 754                 case LDAP_COMPARE_TRUE:
 755                         tmp = ber_bvtrue;
 756                         break;
 757
 758                 case SLAPD_COMPARE_UNDEFINED:
 759                         tmp = ber_bvundefined;
 760                         break;
 761
 762                 default:
 763                         tmp = ber_bverror;
 764                         break;
 765                 }
 766
 767                 ber_dupbv_x( fstr, &tmp, op->o_tmpmemctx );
 768                 break;
 769
 770         default:
 771                 ber_dupbv_x( fstr, &ber_bvunknown, op->o_tmpmemctx );
 772                 break;
 773         }
 774 }
 775
 776 void
 777 filter2bv( Filter *f, struct berval *fstr )
 778 {
 779         Operation op;
 780         Opheader ohdr;
 781
 782         op.o_hdr = &ohdr;
 783         op.o_tmpmemctx = NULL;
 784         op.o_tmpmfuncs = &ch_mfuncs;
 785
 786         filter2bv_x( &op, f, fstr );
 787 }
 788
 789 Filter *
 790 filter_dup( Filter *f, void *memctx )
 791 {
 792         BerMemoryFunctions *mf = &slap_sl_mfuncs;
 793         Filter *n;
 794
 795         if ( !f )
 796                 return NULL;
 797
 798         n = mf->bmf_malloc( sizeof(Filter), memctx );
 799         n->f_choice = f->f_choice;
 800         n->f_next = NULL;
 801
 802         switch( f->f_choice & SLAPD_FILTER_MASK ) {
 803         case SLAPD_FILTER_COMPUTED:
 804                 n->f_result = f->f_result;
 805                 break;
 806         case LDAP_FILTER_PRESENT:
 807                 n->f_desc = f->f_desc;
 808                 break;
 809         case LDAP_FILTER_EQUALITY:
 810         case LDAP_FILTER_GE:
 811         case LDAP_FILTER_LE:
 812         case LDAP_FILTER_APPROX:
 813                 /* Should this be ava_dup() ? */
 814                 n->f_ava = mf->bmf_calloc( 1, sizeof(AttributeAssertion), memctx );
 815                 *n->f_ava = *f->f_ava;
 816                 ber_dupbv_x( &n->f_av_value, &f->f_av_value, memctx );
 817                 break;
 818         case LDAP_FILTER_SUBSTRINGS:
 819                 n->f_sub = mf->bmf_calloc( 1, sizeof(SubstringsAssertion), memctx );
 820                 n->f_sub_desc = f->f_sub_desc;
 821                 if ( !BER_BVISNULL( &f->f_sub_initial ))
 822                         ber_dupbv_x( &n->f_sub_initial, &f->f_sub_initial, memctx );
 823                 if ( f->f_sub_any ) {
 824                         int i;
 825                         for ( i = 0; !BER_BVISNULL( &f->f_sub_any[i] ); i++ );
 826                         n->f_sub_any = mf->bmf_malloc(( i+1 )*sizeof( struct berval ),
 827                                 memctx );
 828                         for ( i = 0; !BER_BVISNULL( &f->f_sub_any[i] ); i++ ) {
 829                                 ber_dupbv_x( &n->f_sub_any[i], &f->f_sub_any[i], memctx );
 830                         }
 831                         BER_BVZERO( &n->f_sub_any[i] );
 832                 }
 833                 if ( !BER_BVISNULL( &f->f_sub_final ))
 834                         ber_dupbv_x( &n->f_sub_final, &f->f_sub_final, memctx );
 835                 break;
 836         case LDAP_FILTER_EXT: {
 837                 /* Should this be mra_dup() ? */
 838                 ber_len_t length;
 839                 length = sizeof(MatchingRuleAssertion);
 840                 if ( !BER_BVISNULL( &f->f_mr_rule_text ))
 841                         length += f->f_mr_rule_text.bv_len + 1;
 842                 n->f_mra = mf->bmf_calloc( 1, length, memctx );
 843                 *n->f_mra = *f->f_mra;
 844                 ber_dupbv_x( &n->f_mr_value, &f->f_mr_value, memctx );
 845                 if ( !BER_BVISNULL( &f->f_mr_rule_text )) {
 846                         n->f_mr_rule_text.bv_val = (char *)(n->f_mra+1);
 847                         AC_MEMCPY(n->f_mr_rule_text.bv_val,
 848                                 f->f_mr_rule_text.bv_val, f->f_mr_rule_text.bv_len );
 849                 }
 850                 } break;
 851         case LDAP_FILTER_AND:
 852         case LDAP_FILTER_OR:
 853         case LDAP_FILTER_NOT: {
 854                 Filter **p;
 855                 for ( p = &n->f_list, f = f->f_list; f; f = f->f_next ) {
 856                         *p = filter_dup( f, memctx );
 857                         p = &(*p)->f_next;
 858                 }
 859                 } break;
 860         }
 861         return n;
 862 }
 863
 864 static int
 865 get_simple_vrFilter(
 866         Operation *op,
 867         BerElement *ber,
 868         ValuesReturnFilter **filt,
 869         const char **text )
 870 {
 871         ber_tag_t       tag;
 872         ber_len_t       len;
 873         int             err;
 874         ValuesReturnFilter vrf;
 875
 876         Debug( LDAP_DEBUG_FILTER, "begin get_simple_vrFilter\n", 0, 0, 0 );
 877
 878         tag = ber_peek_tag( ber, &len );
 879
 880         if( tag == LBER_ERROR ) {
 881                 *text = "error decoding filter";
 882                 return SLAPD_DISCONNECT;
 883         }
 884
 885         vrf.vrf_next = NULL;
 886
 887         err = LDAP_SUCCESS;
 888         vrf.vrf_choice = tag;
 889
 890         switch ( vrf.vrf_choice ) {
 891         case LDAP_FILTER_EQUALITY:
 892                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 893                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_EQUALITY, text );
 894                 if ( err != LDAP_SUCCESS ) {
 895                         break;
 896                 }
 897
 898                 assert( vrf.vrf_ava != NULL );
 899                 break;
 900
 901         case LDAP_FILTER_SUBSTRINGS:
 902                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 903                 err = get_ssa( op, ber, (Filter *)&vrf, text );
 904                 break;
 905
 906         case LDAP_FILTER_GE:
 907                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 908                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_ORDERING, text );
 909                 if ( err != LDAP_SUCCESS ) {
 910                         break;
 911                 }
 912                 break;
 913
 914         case LDAP_FILTER_LE:
 915                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 916                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_ORDERING, text );
 917                 if ( err != LDAP_SUCCESS ) {
 918                         break;
 919                 }
 920                 break;
 921
 922         case LDAP_FILTER_PRESENT: {
 923                 struct berval type;
 924
 925                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 926                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 927                         err = SLAPD_DISCONNECT;
 928                         *text = "error decoding filter";
 929                         break;
 930                 }
 931
 932                 vrf.vrf_desc = NULL;
 933                 err = slap_bv2ad( &type, &vrf.vrf_desc, text );
 934
 935                 if( err != LDAP_SUCCESS ) {
 936                         vrf.vrf_choice |= SLAPD_FILTER_UNDEFINED;
 937                         err = slap_bv2undef_ad( &type, &vrf.vrf_desc, text,
 938                                 SLAP_AD_PROXIED);
 939
 940                         if( err != LDAP_SUCCESS ) {
 941                                 /* unrecognized attribute description or other error */
 942                                 Debug( LDAP_DEBUG_ANY,
 943                                         "get_simple_vrFilter: conn %lu unknown "
 944                                         "attribute type=%s (%d)\n",
 945                                         op->o_connid, type.bv_val, err );
 946
 947                                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 948                                 vrf.vrf_result = LDAP_COMPARE_FALSE;
 949                                 err = LDAP_SUCCESS;
 950                                 break;
 951                         }
 952                 }
 953                 } break;
 954
 955         case LDAP_FILTER_APPROX:
 956                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 957                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_EQUALITY_APPROX, text );
 958                 if ( err != LDAP_SUCCESS ) {
 959                         break;
 960                 }
 961                 break;
 962
 963         case LDAP_FILTER_EXT:
 964                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 965
 966                 err = get_mra( op, ber, (Filter *)&vrf, text );
 967                 if ( err != LDAP_SUCCESS ) {
 968                         break;
 969                 }
 970
 971                 assert( vrf.vrf_mra != NULL );
 972                 break;
 973
 974         default:
 975                 (void) ber_scanf( ber, "x" ); /* skip the element */
 976                 Debug( LDAP_DEBUG_ANY, "get_simple_vrFilter: unknown filter type=%lu\n",
 977                         vrf.vrf_choice, 0, 0 );
 978                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 979                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
 980                 break;
 981         }
 982
 983         if ( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 984                 /* ignore error */
 985                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 986                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
 987                 err = LDAP_SUCCESS;
 988         }
 989
 990         if ( err == LDAP_SUCCESS ) {
 991                 *filt = ch_malloc( sizeof vrf );
 992                 **filt = vrf;
 993         }
 994
 995         Debug( LDAP_DEBUG_FILTER, "end get_simple_vrFilter %d\n", err, 0, 0 );
 996
 997         return err;
 998 }
 999
1000 int
1001 get_vrFilter( Operation *op, BerElement *ber,
1002         ValuesReturnFilter **vrf,
1003         const char **text )
1004 {
1005         /*
1006          * A ValuesReturnFilter looks like this:
1007          *
1008          *      ValuesReturnFilter ::= SEQUENCE OF SimpleFilterItem
1009          *      SimpleFilterItem ::= CHOICE {
1010          *              equalityMatch   [3]     AttributeValueAssertion,
1011          *              substrings      [4]     SubstringFilter,
1012          *              greaterOrEqual  [5]     AttributeValueAssertion,
1013          *              lessOrEqual     [6]     AttributeValueAssertion,
1014          *              present         [7]     AttributeType,
1015          *              approxMatch     [8]     AttributeValueAssertion,
1016          *              extensibleMatch [9]     SimpleMatchingAssertion -- LDAPv3
1017          *      }
1018          *
1019          *      SubstringFilter ::= SEQUENCE {
1020          *              type               AttributeType,
1021          *              SEQUENCE OF CHOICE {
1022          *                      initial          [0] IA5String,
1023          *                      any              [1] IA5String,
1024          *                      final            [2] IA5String
1025          *              }
1026          *      }
1027          *
1028          *      SimpleMatchingAssertion ::= SEQUENCE {  -- LDAPv3
1029          *              matchingRule    [1] MatchingRuleId OPTIONAL,
1030          *              type            [2] AttributeDescription OPTIONAL,
1031          *              matchValue      [3] AssertionValue }
1032          */
1033
1034         ValuesReturnFilter **n;
1035         ber_tag_t       tag;
1036         ber_len_t       len;
1037         char            *last;
1038
1039         Debug( LDAP_DEBUG_FILTER, "begin get_vrFilter\n", 0, 0, 0 );
1040
1041         tag = ber_peek_tag( ber, &len );
1042
1043         if( tag == LBER_ERROR ) {
1044                 *text = "error decoding vrFilter";
1045                 return SLAPD_DISCONNECT;
1046         }
1047
1048         if( tag != LBER_SEQUENCE ) {
1049                 *text = "error decoding vrFilter, expect SEQUENCE tag";
1050                 return SLAPD_DISCONNECT;
1051         }
1052
1053         n = vrf;
1054         for ( tag = ber_first_element( ber, &len, &last );
1055                 tag != LBER_DEFAULT;
1056                 tag = ber_next_element( ber, &len, last ) )
1057         {
1058                 int err = get_simple_vrFilter( op, ber, n, text );
1059
1060                 if ( err != LDAP_SUCCESS ) return( err );
1061
1062                 n = &(*n)->vrf_next;
1063         }
1064         *n = NULL;
1065
1066         Debug( LDAP_DEBUG_FILTER, "end get_vrFilter\n", 0, 0, 0 );
1067         return( LDAP_SUCCESS );
1068 }
1069
1070 void
1071 vrFilter_free( Operation *op, ValuesReturnFilter *vrf )
1072 {
1073         ValuesReturnFilter      *p, *next;
1074
1075         if ( vrf == NULL ) {
1076                 return;
1077         }
1078
1079         for ( p = vrf; p != NULL; p = next ) {
1080                 next = p->vrf_next;
1081
1082                 switch ( vrf->vrf_choice & SLAPD_FILTER_MASK ) {
1083                 case LDAP_FILTER_PRESENT:
1084                         break;
1085
1086                 case LDAP_FILTER_EQUALITY:
1087                 case LDAP_FILTER_GE:
1088                 case LDAP_FILTER_LE:
1089                 case LDAP_FILTER_APPROX:
1090                         ava_free( op, vrf->vrf_ava, 1 );
1091                         break;
1092
1093                 case LDAP_FILTER_SUBSTRINGS:
1094                         if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1095                                 op->o_tmpfree( vrf->vrf_sub_initial.bv_val, op->o_tmpmemctx );
1096                         }
1097                         ber_bvarray_free_x( vrf->vrf_sub_any, op->o_tmpmemctx );
1098                         if ( vrf->vrf_sub_final.bv_val != NULL ) {
1099                                 op->o_tmpfree( vrf->vrf_sub_final.bv_val, op->o_tmpmemctx );
1100                         }
1101                         op->o_tmpfree( vrf->vrf_sub, op->o_tmpmemctx );
1102                         break;
1103
1104                 case LDAP_FILTER_EXT:
1105                         mra_free( op, vrf->vrf_mra, 1 );
1106                         break;
1107
1108                 case SLAPD_FILTER_COMPUTED:
1109                         break;
1110
1111                 default:
1112                         Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
1113                                 vrf->vrf_choice, 0, 0 );
1114                         break;
1115                 }
1116
1117                 op->o_tmpfree( vrf, op->o_tmpmemctx );
1118         }
1119 }
1120
1121 void
1122 vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1123 {
1124         ValuesReturnFilter      *p;
1125         struct berval tmp;
1126         ber_len_t len;
1127
1128         if ( vrf == NULL ) {
1129                 ber_str2bv_x( "No filter!", STRLENOF("No filter!"),
1130                         1, fstr, op->o_tmpmemctx );
1131                 return;
1132         }
1133
1134         fstr->bv_len = STRLENOF("()");
1135         fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1136
1137         snprintf( fstr->bv_val, fstr->bv_len + 1, "()");
1138
1139         for ( p = vrf; p != NULL; p = p->vrf_next ) {
1140                 len = fstr->bv_len;
1141
1142                 simple_vrFilter2bv( op, p, &tmp );
1143
1144                 fstr->bv_len += tmp.bv_len;
1145                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1146                         op->o_tmpmemctx );
1147
1148                 snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
1149                         /*"("*/ "%s)", tmp.bv_val );
1150
1151                 op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
1152         }
1153 }
1154
1155 static void
1156 simple_vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1157 {
1158         struct berval tmp;
1159         ber_len_t len;
1160
1161         if ( vrf == NULL ) {
1162                 ber_str2bv_x( "No filter!", STRLENOF("No filter!"), 1, fstr,
1163                         op->o_tmpmemctx );
1164                 return;
1165         }
1166         int undef = vrf->vrf_choice & SLAPD_FILTER_UNDEFINED;
1167
1168         switch ( vrf->vrf_choice & SLAPD_FILTER_MASK ) {
1169         case LDAP_FILTER_EQUALITY:
1170                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1171
1172                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1173                         tmp.bv_len + STRLENOF("(=)");
1174                 if ( undef ) fstr->bv_len++;
1175                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1176
1177                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
1178                         vrf->vrf_av_desc->ad_cname.bv_val,
1179                         tmp.bv_val );
1180
1181                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1182                 break;
1183
1184         case LDAP_FILTER_GE:
1185                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1186
1187                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1188                         tmp.bv_len + STRLENOF("(>=)");
1189                 if ( undef ) fstr->bv_len++;
1190                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1191
1192                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
1193                         vrf->vrf_av_desc->ad_cname.bv_val,
1194                         tmp.bv_val );
1195
1196                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1197                 break;
1198
1199         case LDAP_FILTER_LE:
1200                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1201
1202                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1203                         tmp.bv_len + STRLENOF("(<=)");
1204                 if ( undef ) fstr->bv_len++;
1205                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1206
1207                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
1208                         vrf->vrf_av_desc->ad_cname.bv_val,
1209                         tmp.bv_val );
1210
1211                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1212                 break;
1213
1214         case LDAP_FILTER_APPROX:
1215                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1216
1217                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1218                         tmp.bv_len + STRLENOF("(~=)");
1219                 if ( undef ) fstr->bv_len++;
1220                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1221
1222                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
1223                         vrf->vrf_av_desc->ad_cname.bv_val,
1224                         tmp.bv_val );
1225                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1226                 break;
1227
1228         case LDAP_FILTER_SUBSTRINGS:
1229                 fstr->bv_len = vrf->vrf_sub_desc->ad_cname.bv_len +
1230                         STRLENOF("(=*)");
1231                 if ( undef ) fstr->bv_len++;
1232                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1233
1234                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1235                         vrf->vrf_sub_desc->ad_cname.bv_val );
1236
1237                 if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1238                         len = fstr->bv_len;
1239
1240                         filter_escape_value_x( &vrf->vrf_sub_initial, &tmp, op->o_tmpmemctx );
1241
1242                         fstr->bv_len += tmp.bv_len;
1243                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1244                                 op->o_tmpmemctx );
1245
1246                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
1247                                 /* "(attr=" */ "%s*)",
1248                                 tmp.bv_val );
1249
1250                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1251                 }
1252
1253                 if ( vrf->vrf_sub_any != NULL ) {
1254                         int i;
1255                         for ( i = 0; vrf->vrf_sub_any[i].bv_val != NULL; i++ ) {
1256                                 len = fstr->bv_len;
1257                                 filter_escape_value_x( &vrf->vrf_sub_any[i], &tmp,
1258                                         op->o_tmpmemctx );
1259
1260                                 fstr->bv_len += tmp.bv_len + 1;
1261                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
1262                                         fstr->bv_len + 1, op->o_tmpmemctx );
1263
1264                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1265                                         /* "(attr=[init]*[any*]" */ "%s*)",
1266                                         tmp.bv_val );
1267                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1268                         }
1269                 }
1270
1271                 if ( vrf->vrf_sub_final.bv_val != NULL ) {
1272                         len = fstr->bv_len;
1273
1274                         filter_escape_value_x( &vrf->vrf_sub_final, &tmp, op->o_tmpmemctx );
1275
1276                         fstr->bv_len += tmp.bv_len;
1277                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1278                                 op->o_tmpmemctx );
1279
1280                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1281                                 /* "(attr=[init*][any*]" */ "%s)",
1282                                 tmp.bv_val );
1283
1284                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1285                 }
1286
1287                 break;
1288
1289         case LDAP_FILTER_PRESENT:
1290                 fstr->bv_len = vrf->vrf_desc->ad_cname.bv_len +
1291                         STRLENOF("(=*)");
1292                 if ( undef ) fstr->bv_len++;
1293                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1294
1295                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1296                         vrf->vrf_desc->ad_cname.bv_val );
1297                 break;
1298
1299         case LDAP_FILTER_EXT: {
1300                 struct berval ad;
1301                 filter_escape_value_x( &vrf->vrf_mr_value, &tmp, op->o_tmpmemctx );
1302
1303                 if ( vrf->vrf_mr_desc ) {
1304                         ad = vrf->vrf_mr_desc->ad_cname;
1305                 } else {
1306                         ad.bv_len = 0;
1307                         ad.bv_val = "";
1308                 }
1309
1310                 fstr->bv_len = ad.bv_len +
1311                         ( vrf->vrf_mr_dnattrs ? STRLENOF(":dn") : 0 ) +
1312                         ( vrf->vrf_mr_rule_text.bv_len
1313                                 ? vrf->vrf_mr_rule_text.bv_len+1 : 0 ) +
1314                         tmp.bv_len + STRLENOF("(:=)");
1315                 if ( undef ) fstr->bv_len++;
1316                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1317
1318                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
1319                         ad.bv_val,
1320                         vrf->vrf_mr_dnattrs ? ":dn" : "",
1321                         vrf->vrf_mr_rule_text.bv_len ? ":" : "",
1322                         vrf->vrf_mr_rule_text.bv_len ? vrf->vrf_mr_rule_text.bv_val : "",
1323                         tmp.bv_val );
1324
1325                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1326                 } break;
1327
1328         case SLAPD_FILTER_COMPUTED:
1329                 ber_str2bv_x(
1330                         vrf->vrf_result == LDAP_COMPARE_FALSE ? "(?=false)" :
1331                         vrf->vrf_result == LDAP_COMPARE_TRUE ? "(?=true)" :
1332                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1333                                 ? "(?=undefined)" : "(?=error)",
1334                         vrf->vrf_result == LDAP_COMPARE_FALSE ? STRLENOF("(?=false)") :
1335                         vrf->vrf_result == LDAP_COMPARE_TRUE ? STRLENOF("(?=true)") :
1336                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1337                                 ? STRLENOF("(?=undefined)") : STRLENOF("(?=error)"),
1338                         1, fstr, op->o_tmpmemctx );
1339                 break;
1340
1341         default:
1342                 ber_str2bv_x( "(?=unknown)", STRLENOF("(?=unknown)"),
1343                         1, fstr, op->o_tmpmemctx );
1344                 break;
1345         }
1346 }