git.sur5r.net Git - openldap/blob - servers/slapd/filter.c

   1 /* filter.c - routines for parsing and dealing with filters */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/socket.h>
  13 #include <ac/string.h>
  14
  15 #include "slap.h"
  16
  17 static int      get_filter_list(
  18         Connection *conn,
  19         BerElement *ber,
  20         Filter **f,
  21         const char **text );
  22
  23 static int      get_substring_filter(
  24         Connection *conn,
  25         BerElement *ber,
  26         Filter *f,
  27         const char **text );
  28
  29 static int filter_escape_value(
  30         struct berval *in,
  31         struct berval *out );
  32
  33 static void simple_vrFilter2bv(
  34         ValuesReturnFilter *f,
  35         struct berval *fstr );
  36
  37 static int      get_simple_vrFilter(
  38         Connection *conn,
  39         BerElement *ber,
  40         ValuesReturnFilter **f,
  41         const char **text );
  42
  43
  44 int
  45 get_filter(
  46         Connection *conn,
  47         BerElement *ber,
  48         Filter **filt,
  49         const char **text )
  50 {
  51         ber_tag_t       tag;
  52         ber_len_t       len;
  53         int             err;
  54         Filter          *f;
  55
  56 #ifdef NEW_LOGGING
  57         LDAP_LOG( FILTER, ENTRY, "get_filter: conn %d\n", conn->c_connid, 0, 0 );
  58 #else
  59         Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
  60 #endif
  61         /*
  62          * A filter looks like this coming in:
  63          *      Filter ::= CHOICE {
  64          *              and             [0]     SET OF Filter,
  65          *              or              [1]     SET OF Filter,
  66          *              not             [2]     Filter,
  67          *              equalityMatch   [3]     AttributeValueAssertion,
  68          *              substrings      [4]     SubstringFilter,
  69          *              greaterOrEqual  [5]     AttributeValueAssertion,
  70          *              lessOrEqual     [6]     AttributeValueAssertion,
  71          *              present         [7]     AttributeType,,
  72          *              approxMatch     [8]     AttributeValueAssertion
  73          *              extensibleMatch [9]     MatchingRuleAssertion
  74          *      }
  75          *
  76          *      SubstringFilter ::= SEQUENCE {
  77          *              type               AttributeType,
  78          *              SEQUENCE OF CHOICE {
  79          *                      initial          [0] IA5String,
  80          *                      any              [1] IA5String,
  81          *                      final            [2] IA5String
  82          *              }
  83          *      }
  84          *
  85          *      MatchingRuleAssertion ::= SEQUENCE {
  86          *              matchingRule    [1] MatchingRuleId OPTIONAL,
  87          *              type            [2] AttributeDescription OPTIONAL,
  88          *              matchValue      [3] AssertionValue,
  89          *              dnAttributes    [4] BOOLEAN DEFAULT FALSE
  90          *      }
  91          *
  92          */
  93
  94         tag = ber_peek_tag( ber, &len );
  95
  96         if( tag == LBER_ERROR ) {
  97                 *text = "error decoding filter";
  98                 return SLAPD_DISCONNECT;
  99         }
 100
 101         f = (Filter *) ch_malloc( sizeof(Filter) );
 102         f->f_next = NULL;
 103
 104         err = LDAP_SUCCESS;
 105         f->f_choice = tag;
 106
 107         switch ( f->f_choice ) {
 108         case LDAP_FILTER_EQUALITY:
 109 #ifdef NEW_LOGGING
 110                 LDAP_LOG( FILTER, DETAIL2,
 111                         "get_filter: conn %d  EQUALITY\n", conn->c_connid, 0, 0 );
 112 #else
 113                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 114 #endif
 115                 err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY, text );
 116                 if ( err != LDAP_SUCCESS ) {
 117                         break;
 118                 }
 119
 120                 assert( f->f_ava != NULL );
 121                 break;
 122
 123         case LDAP_FILTER_SUBSTRINGS:
 124 #ifdef NEW_LOGGING
 125                 LDAP_LOG( FILTER, DETAIL1,
 126                         "get_filter: conn %d  SUBSTRINGS\n", conn->c_connid, 0, 0 );
 127 #else
 128                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 129 #endif
 130                 err = get_substring_filter( conn, ber, f, text );
 131                 break;
 132
 133         case LDAP_FILTER_GE:
 134 #ifdef NEW_LOGGING
 135                 LDAP_LOG( FILTER, DETAIL1,
 136                         "get_filter: conn %d  GE\n", conn->c_connid, 0, 0 );
 137 #else
 138                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 139 #endif
 140                 err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
 141                 if ( err != LDAP_SUCCESS ) {
 142                         break;
 143                 }
 144                 break;
 145
 146         case LDAP_FILTER_LE:
 147 #ifdef NEW_LOGGING
 148                 LDAP_LOG( FILTER, DETAIL1,
 149                         "get_filter: conn %d  LE\n", conn->c_connid, 0, 0 );
 150 #else
 151                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 152 #endif
 153                 err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
 154                 if ( err != LDAP_SUCCESS ) {
 155                         break;
 156                 }
 157                 break;
 158
 159         case LDAP_FILTER_PRESENT: {
 160                 struct berval type;
 161
 162 #ifdef NEW_LOGGING
 163                 LDAP_LOG( FILTER, DETAIL1,
 164                         "get_filter: conn %d PRESENT\n", conn->c_connid, 0, 0 );
 165 #else
 166                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 167 #endif
 168                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 169                         err = SLAPD_DISCONNECT;
 170                         *text = "error decoding filter";
 171                         break;
 172                 }
 173
 174                 f->f_desc = NULL;
 175                 err = slap_bv2ad( &type, &f->f_desc, text );
 176
 177                 if( err != LDAP_SUCCESS ) {
 178                         /* unrecognized attribute description or other error */
 179                         f->f_choice = SLAPD_FILTER_COMPUTED;
 180                         f->f_result = LDAP_COMPARE_FALSE;
 181                         err = LDAP_SUCCESS;
 182                         break;
 183                 }
 184                 } break;
 185
 186         case LDAP_FILTER_APPROX:
 187 #ifdef NEW_LOGGING
 188                 LDAP_LOG( FILTER, DETAIL1,
 189                         "get_filter: conn %d  APPROX\n", conn->c_connid, 0, 0 );
 190 #else
 191                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 192 #endif
 193                 err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY_APPROX, text );
 194                 if ( err != LDAP_SUCCESS ) {
 195                         break;
 196                 }
 197                 break;
 198
 199         case LDAP_FILTER_AND:
 200 #ifdef NEW_LOGGING
 201                 LDAP_LOG( FILTER, DETAIL1,
 202                         "get_filter: conn %d  AND\n", conn->c_connid, 0, 0 );
 203 #else
 204                 Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
 205 #endif
 206                 err = get_filter_list( conn, ber, &f->f_and, text );
 207                 if ( err != LDAP_SUCCESS ) {
 208                         break;
 209                 }
 210                 break;
 211
 212         case LDAP_FILTER_OR:
 213 #ifdef NEW_LOGGING
 214                 LDAP_LOG( FILTER, DETAIL1,
 215                         "get_filter: conn %d  OR\n", conn->c_connid, 0, 0  );
 216 #else
 217                 Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
 218 #endif
 219                 err = get_filter_list( conn, ber, &f->f_or, text );
 220                 if ( err != LDAP_SUCCESS ) {
 221                         break;
 222                 }
 223                 break;
 224
 225         case LDAP_FILTER_NOT:
 226 #ifdef NEW_LOGGING
 227                 LDAP_LOG( FILTER, DETAIL1,
 228                         "get_filter: conn %d  NOT\n", conn->c_connid, 0, 0 );
 229 #else
 230                 Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
 231 #endif
 232                 (void) ber_skip_tag( ber, &len );
 233                 err = get_filter( conn, ber, &f->f_not, text );
 234                 if ( err != LDAP_SUCCESS ) {
 235                         break;
 236                 }
 237                 break;
 238
 239         case LDAP_FILTER_EXT:
 240 #ifdef NEW_LOGGING
 241                 LDAP_LOG( FILTER, DETAIL1,
 242                         "get_filter: conn %d  EXTENSIBLE\n", conn->c_connid, 0, 0 );
 243 #else
 244                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 245 #endif
 246
 247                 err = get_mra( ber, &f->f_mra, text );
 248                 if ( err != LDAP_SUCCESS ) {
 249                         break;
 250                 }
 251
 252                 assert( f->f_mra != NULL );
 253                 break;
 254
 255         default:
 256                 (void) ber_scanf( ber, "x" ); /* skip the element */
 257 #ifdef NEW_LOGGING
 258                 LDAP_LOG( FILTER, ERR,
 259                         "get_filter: conn %d unknown filter type=%lu\n",
 260                         conn->c_connid, f->f_choice, 0 );
 261 #else
 262                 Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
 263                         f->f_choice, 0, 0 );
 264 #endif
 265                 f->f_choice = SLAPD_FILTER_COMPUTED;
 266                 f->f_result = SLAPD_COMPARE_UNDEFINED;
 267                 break;
 268         }
 269
 270         if ( err != LDAP_SUCCESS ) {
 271                 if( err != SLAPD_DISCONNECT ) {
 272                         /* ignore error */
 273                         f->f_choice = SLAPD_FILTER_COMPUTED;
 274                         f->f_result = SLAPD_COMPARE_UNDEFINED;
 275                         err = LDAP_SUCCESS;
 276                         *filt = f;
 277
 278                 } else {
 279                         free(f);
 280                 }
 281
 282         } else {
 283                 *filt = f;
 284         }
 285
 286 #ifdef NEW_LOGGING
 287         LDAP_LOG( FILTER, DETAIL2,
 288                 "get_filter: conn %d exit\n", conn->c_connid, 0, 0 );
 289 #else
 290         Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
 291 #endif
 292         return( err );
 293 }
 294
 295 static int
 296 get_filter_list( Connection *conn, BerElement *ber,
 297         Filter **f,
 298         const char **text )
 299 {
 300         Filter          **new;
 301         int             err;
 302         ber_tag_t       tag;
 303         ber_len_t       len;
 304         char            *last;
 305
 306 #ifdef NEW_LOGGING
 307         LDAP_LOG( FILTER, ENTRY,
 308                 "get_filter_list: conn %d start\n", conn->c_connid, 0, 0 );
 309 #else
 310         Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
 311 #endif
 312         new = f;
 313         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
 314                 tag = ber_next_element( ber, &len, last ) )
 315         {
 316                 err = get_filter( conn, ber, new, text );
 317                 if ( err != LDAP_SUCCESS )
 318                         return( err );
 319                 new = &(*new)->f_next;
 320         }
 321         *new = NULL;
 322
 323 #ifdef NEW_LOGGING
 324         LDAP_LOG( FILTER, ENTRY,
 325                 "get_filter_list: conn %d exit\n", conn->c_connid, 0, 0 );
 326 #else
 327         Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
 328 #endif
 329         return( LDAP_SUCCESS );
 330 }
 331
 332 static int
 333 get_substring_filter(
 334         Connection      *conn,
 335         BerElement      *ber,
 336         Filter  *f,
 337         const char      **text )
 338 {
 339         ber_tag_t       tag;
 340         ber_len_t       len;
 341         ber_tag_t       rc;
 342         struct berval value;
 343         char            *last;
 344         struct berval bv;
 345         *text = "error decoding filter";
 346
 347 #ifdef NEW_LOGGING
 348         LDAP_LOG( FILTER, ENTRY,
 349                 "get_substring_filter: conn %d  begin\n", conn->c_connid, 0, 0 );
 350 #else
 351         Debug( LDAP_DEBUG_FILTER, "begin get_substring_filter\n", 0, 0, 0 );
 352 #endif
 353         if ( ber_scanf( ber, "{m" /*}*/, &bv ) == LBER_ERROR ) {
 354                 return SLAPD_DISCONNECT;
 355         }
 356
 357         f->f_sub = ch_calloc( 1, sizeof(SubstringsAssertion) );
 358         f->f_sub_desc = NULL;
 359         rc = slap_bv2ad( &bv, &f->f_sub_desc, text );
 360
 361         if( rc != LDAP_SUCCESS ) {
 362                 text = NULL;
 363                 ch_free( f->f_sub );
 364                 f->f_choice = SLAPD_FILTER_COMPUTED;
 365                 f->f_result = SLAPD_COMPARE_UNDEFINED;
 366                 return LDAP_SUCCESS;
 367         }
 368
 369         f->f_sub_initial.bv_val = NULL;
 370         f->f_sub_any = NULL;
 371         f->f_sub_final.bv_val = NULL;
 372
 373         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
 374                 tag = ber_next_element( ber, &len, last ) )
 375         {
 376                 unsigned usage;
 377
 378                 rc = ber_scanf( ber, "m", &value );
 379                 if ( rc == LBER_ERROR ) {
 380                         rc = SLAPD_DISCONNECT;
 381                         goto return_error;
 382                 }
 383
 384                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
 385                         rc = LDAP_INVALID_SYNTAX;
 386                         goto return_error;
 387                 }
 388
 389                 switch ( tag ) {
 390                 case LDAP_SUBSTRING_INITIAL:
 391                         usage = SLAP_MR_SUBSTR_INITIAL;
 392                         break;
 393
 394                 case LDAP_SUBSTRING_ANY:
 395                         usage = SLAP_MR_SUBSTR_ANY;
 396                         break;
 397
 398                 case LDAP_SUBSTRING_FINAL:
 399                         usage = SLAP_MR_SUBSTR_FINAL;
 400                         break;
 401
 402                 default:
 403                         rc = LDAP_PROTOCOL_ERROR;
 404
 405 #ifdef NEW_LOGGING
 406                         LDAP_LOG( FILTER, ERR,
 407                                 "get_filter_substring: conn %d  unknown substring choice=%ld\n",
 408                                 conn->c_connid, (long)tag, 0 );
 409 #else
 410                         Debug( LDAP_DEBUG_FILTER,
 411                                 "  unknown substring choice=%ld\n",
 412                                 (long) tag, 0, 0 );
 413 #endif
 414                         goto return_error;
 415                 }
 416
 417                 /* validate using equality matching rule validator! */
 418                 rc = value_validate( f->f_sub_desc->ad_type->sat_equality,
 419                         &value, text );
 420                 if( rc != LDAP_SUCCESS ) {
 421                         goto return_error;
 422                 }
 423
 424                 rc = value_normalize( f->f_sub_desc, usage,
 425                         &value, &bv, text );
 426                 if( rc != LDAP_SUCCESS ) {
 427                         goto return_error;
 428                 }
 429
 430                 value = bv;
 431
 432                 rc = LDAP_PROTOCOL_ERROR;
 433
 434                 switch ( tag ) {
 435                 case LDAP_SUBSTRING_INITIAL:
 436 #ifdef NEW_LOGGING
 437                         LDAP_LOG( FILTER, DETAIL1,
 438                                 "get_substring_filter: conn %d  INITIAL\n", conn->c_connid, 0, 0 );
 439 #else
 440                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
 441 #endif
 442
 443                         if ( f->f_sub_initial.bv_val != NULL
 444                                 || f->f_sub_any != NULL
 445                                 || f->f_sub_final.bv_val != NULL )
 446                         {
 447                                 free( value.bv_val );
 448                                 goto return_error;
 449                         }
 450
 451                         f->f_sub_initial = value;
 452                         break;
 453
 454                 case LDAP_SUBSTRING_ANY:
 455 #ifdef NEW_LOGGING
 456                         LDAP_LOG( FILTER, DETAIL1,
 457                                 "get_substring_filter: conn %d  ANY\n", conn->c_connid, 0, 0 );
 458 #else
 459                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
 460 #endif
 461
 462                         if ( f->f_sub_final.bv_val != NULL ) {
 463                                 free( value.bv_val );
 464                                 goto return_error;
 465                         }
 466
 467                         ber_bvarray_add( &f->f_sub_any, &value );
 468                         break;
 469
 470                 case LDAP_SUBSTRING_FINAL:
 471 #ifdef NEW_LOGGING
 472                         LDAP_LOG( FILTER, DETAIL1,
 473                                 "get_substring_filter: conn %d  FINAL\n", conn->c_connid, 0, 0 );
 474 #else
 475                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
 476 #endif
 477
 478                         if ( f->f_sub_final.bv_val != NULL ) {
 479                                 free( value.bv_val );
 480                                 goto return_error;
 481                         }
 482
 483                         f->f_sub_final = value;
 484                         break;
 485
 486                 default:
 487 #ifdef NEW_LOGGING
 488                         LDAP_LOG( FILTER, INFO,
 489                                 "get_substring_filter: conn %d  unknown substring type %ld\n",
 490                                 conn->c_connid, (long)tag, 0 );
 491 #else
 492                         Debug( LDAP_DEBUG_FILTER,
 493                                 "  unknown substring type=%ld\n",
 494                                 (long) tag, 0, 0 );
 495 #endif
 496
 497                         free( value.bv_val );
 498
 499 return_error:
 500 #ifdef NEW_LOGGING
 501                         LDAP_LOG( FILTER, INFO,
 502                                 "get_substring_filter: conn %d  error %ld\n",
 503                                 conn->c_connid, (long)rc, 0 );
 504 #else
 505                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
 506                                 (long) rc, 0, 0 );
 507 #endif
 508                         free( f->f_sub_initial.bv_val );
 509                         ber_bvarray_free( f->f_sub_any );
 510                         free( f->f_sub_final.bv_val );
 511                         ch_free( f->f_sub );
 512                         return rc;
 513                 }
 514         }
 515
 516 #ifdef NEW_LOGGING
 517         LDAP_LOG( FILTER, ENTRY,
 518                 "get_substring_filter: conn %d exit\n", conn->c_connid, 0, 0 );
 519 #else
 520         Debug( LDAP_DEBUG_FILTER, "end get_substring_filter\n", 0, 0, 0 );
 521 #endif
 522         return( LDAP_SUCCESS );
 523 }
 524
 525 void
 526 filter_free( Filter *f )
 527 {
 528         Filter  *p, *next;
 529
 530         if ( f == NULL ) {
 531                 return;
 532         }
 533
 534         switch ( f->f_choice ) {
 535         case LDAP_FILTER_PRESENT:
 536                 break;
 537
 538         case LDAP_FILTER_EQUALITY:
 539         case LDAP_FILTER_GE:
 540         case LDAP_FILTER_LE:
 541         case LDAP_FILTER_APPROX:
 542                 ava_free( f->f_ava, 1 );
 543                 break;
 544
 545         case LDAP_FILTER_SUBSTRINGS:
 546                 if ( f->f_sub_initial.bv_val != NULL ) {
 547                         free( f->f_sub_initial.bv_val );
 548                 }
 549                 ber_bvarray_free( f->f_sub_any );
 550                 if ( f->f_sub_final.bv_val != NULL ) {
 551                         free( f->f_sub_final.bv_val );
 552                 }
 553                 ch_free( f->f_sub );
 554                 break;
 555
 556         case LDAP_FILTER_AND:
 557         case LDAP_FILTER_OR:
 558         case LDAP_FILTER_NOT:
 559                 for ( p = f->f_list; p != NULL; p = next ) {
 560                         next = p->f_next;
 561                         filter_free( p );
 562                 }
 563                 break;
 564
 565         case LDAP_FILTER_EXT:
 566                 mra_free( f->f_mra, 1 );
 567                 break;
 568
 569         case SLAPD_FILTER_COMPUTED:
 570                 break;
 571
 572         default:
 573 #ifdef NEW_LOGGING
 574                 LDAP_LOG( FILTER, ERR,
 575                         "filter_free: unknown filter type %lu\n", f->f_choice, 0, 0 );
 576 #else
 577                 Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
 578                         f->f_choice, 0, 0 );
 579 #endif
 580                 break;
 581         }
 582
 583         free( f );
 584 }
 585
 586 void
 587 filter2bv( Filter *f, struct berval *fstr )
 588 {
 589         int     i;
 590         Filter  *p;
 591         struct berval tmp;
 592         ber_len_t len;
 593
 594         if ( f == NULL ) {
 595                 ber_str2bv( "No filter!", sizeof("No filter!")-1, 1, fstr );
 596                 return;
 597         }
 598
 599         switch ( f->f_choice ) {
 600         case LDAP_FILTER_EQUALITY:
 601                 filter_escape_value( &f->f_av_value, &tmp );
 602
 603                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 604                         tmp.bv_len + ( sizeof("(=)") - 1 );
 605                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 606
 607                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
 608                         f->f_av_desc->ad_cname.bv_val,
 609                         tmp.bv_val );
 610
 611                 ber_memfree( tmp.bv_val );
 612                 break;
 613
 614         case LDAP_FILTER_GE:
 615                 filter_escape_value( &f->f_av_value, &tmp );
 616
 617                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 618                         tmp.bv_len + ( sizeof("(>=)") - 1 );
 619                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 620
 621                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
 622                         f->f_av_desc->ad_cname.bv_val,
 623                         tmp.bv_val );
 624
 625                 ber_memfree( tmp.bv_val );
 626                 break;
 627
 628         case LDAP_FILTER_LE:
 629                 filter_escape_value( &f->f_av_value, &tmp );
 630
 631                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 632                         tmp.bv_len + ( sizeof("(<=)") - 1 );
 633                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 634
 635                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
 636                         f->f_av_desc->ad_cname.bv_val,
 637                         tmp.bv_val );
 638
 639                 ber_memfree( tmp.bv_val );
 640                 break;
 641
 642         case LDAP_FILTER_APPROX:
 643                 filter_escape_value( &f->f_av_value, &tmp );
 644
 645                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 646                         tmp.bv_len + ( sizeof("(~=)") - 1 );
 647                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 648
 649                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
 650                         f->f_av_desc->ad_cname.bv_val,
 651                         tmp.bv_val );
 652                 ber_memfree( tmp.bv_val );
 653                 break;
 654
 655         case LDAP_FILTER_SUBSTRINGS:
 656                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
 657                         ( sizeof("(=*)") - 1 );
 658                 fstr->bv_val = malloc( fstr->bv_len + 128 );
 659
 660                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 661                         f->f_sub_desc->ad_cname.bv_val );
 662
 663                 if ( f->f_sub_initial.bv_val != NULL ) {
 664                         len = fstr->bv_len;
 665
 666                         filter_escape_value( &f->f_sub_initial, &tmp );
 667
 668                         fstr->bv_len += tmp.bv_len;
 669                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 670
 671                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
 672                                 /* "(attr=" */ "%s*)",
 673                                 tmp.bv_val );
 674
 675                         ber_memfree( tmp.bv_val );
 676                 }
 677
 678                 if ( f->f_sub_any != NULL ) {
 679                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
 680                                 len = fstr->bv_len;
 681                                 filter_escape_value( &f->f_sub_any[i], &tmp );
 682
 683                                 fstr->bv_len += tmp.bv_len + 1;
 684                                 fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 685
 686                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 687                                         /* "(attr=[init]*[any*]" */ "%s*)",
 688                                         tmp.bv_val );
 689                                 ber_memfree( tmp.bv_val );
 690                         }
 691                 }
 692
 693                 if ( f->f_sub_final.bv_val != NULL ) {
 694                         len = fstr->bv_len;
 695
 696                         filter_escape_value( &f->f_sub_final, &tmp );
 697
 698                         fstr->bv_len += tmp.bv_len;
 699                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 700
 701                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 702                                 /* "(attr=[init*][any*]" */ "%s)",
 703                                 tmp.bv_val );
 704
 705                         ber_memfree( tmp.bv_val );
 706                 }
 707
 708                 break;
 709
 710         case LDAP_FILTER_PRESENT:
 711                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
 712                         ( sizeof("(=*)") - 1 );
 713                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 714
 715                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 716                         f->f_desc->ad_cname.bv_val );
 717                 break;
 718
 719         case LDAP_FILTER_AND:
 720         case LDAP_FILTER_OR:
 721         case LDAP_FILTER_NOT:
 722                 fstr->bv_len = sizeof("(%)") - 1;
 723                 fstr->bv_val = malloc( fstr->bv_len + 128 );
 724
 725                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 726                         f->f_choice == LDAP_FILTER_AND ? '&' :
 727                         f->f_choice == LDAP_FILTER_OR ? '|' : '!' );
 728
 729                 for ( p = f->f_list; p != NULL; p = p->f_next ) {
 730                         len = fstr->bv_len;
 731
 732                         filter2bv( p, &tmp );
 733
 734                         fstr->bv_len += tmp.bv_len;
 735                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 736
 737                         snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
 738                                 /*"("*/ "%s)", tmp.bv_val );
 739
 740                         ch_free( tmp.bv_val );
 741                 }
 742
 743                 break;
 744
 745         case LDAP_FILTER_EXT: {
 746                 struct berval ad;
 747                 filter_escape_value( &f->f_mr_value, &tmp );
 748
 749                 if ( f->f_mr_desc ) {
 750                         ad = f->f_mr_desc->ad_cname;
 751                 } else {
 752                         ad.bv_len = 0;
 753                         ad.bv_val = "";
 754                 }
 755
 756                 fstr->bv_len = ad.bv_len +
 757                         ( f->f_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
 758                         ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
 759                         tmp.bv_len + ( sizeof("(:=)") - 1 );
 760                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 761
 762                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
 763                         ad.bv_val,
 764                         f->f_mr_dnattrs ? ":dn" : "",
 765                         f->f_mr_rule_text.bv_len ? ":" : "",
 766                         f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
 767                         tmp.bv_val );
 768                 ber_memfree( tmp.bv_val );
 769                 } break;
 770
 771         case SLAPD_FILTER_COMPUTED:
 772                 ber_str2bv(
 773                         f->f_result == LDAP_COMPARE_FALSE ? "(?=false)" :
 774                         f->f_result == LDAP_COMPARE_TRUE ? "(?=true)" :
 775                         f->f_result == SLAPD_COMPARE_UNDEFINED ? "(?=undefined)" :
 776                         "(?=error)",
 777                         f->f_result == LDAP_COMPARE_FALSE ? sizeof("(?=false)")-1 :
 778                         f->f_result == LDAP_COMPARE_TRUE ? sizeof("(?=true)")-1 :
 779                         f->f_result == SLAPD_COMPARE_UNDEFINED ? sizeof("(?=undefined)")-1 :
 780                         sizeof("(?=error)")-1,
 781                         1, fstr );
 782                 break;
 783
 784         default:
 785                 ber_str2bv( "(?=unknown)", sizeof("(?=unknown)")-1, 1, fstr );
 786                 break;
 787         }
 788 }
 789
 790 static int filter_escape_value(
 791         struct berval *in,
 792         struct berval *out )
 793 {
 794         ber_len_t i;
 795         assert( in );
 796         assert( out );
 797
 798         out->bv_val = (char *) ch_malloc( ( in->bv_len * 3 ) + 1 );
 799         out->bv_len = 0;
 800
 801         for( i=0; i < in->bv_len ; i++ ) {
 802                 if( FILTER_ESCAPE(in->bv_val[i]) ) {
 803                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_CHAR;
 804                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_HI( in->bv_val[i] );
 805                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_LO( in->bv_val[i] );
 806                 } else {
 807                         out->bv_val[out->bv_len++] = in->bv_val[i];
 808                 }
 809         }
 810
 811         out->bv_val[out->bv_len] = '\0';
 812         return LDAP_SUCCESS;
 813 }
 814
 815 static int
 816 get_simple_vrFilter(
 817         Connection *conn,
 818         BerElement *ber,
 819         ValuesReturnFilter **filt,
 820         const char **text )
 821 {
 822         ber_tag_t       tag;
 823         ber_len_t       len;
 824         int             err;
 825         ValuesReturnFilter *f;
 826
 827 #ifdef NEW_LOGGING
 828         LDAP_LOG( FILTER, ENTRY,
 829                 "get_simple_vrFilter: conn %d\n", conn->c_connid, 0, 0 );
 830 #else
 831         Debug( LDAP_DEBUG_FILTER, "begin get_simple_vrFilter\n", 0, 0, 0 );
 832 #endif
 833
 834         tag = ber_peek_tag( ber, &len );
 835
 836         if( tag == LBER_ERROR ) {
 837                 *text = "error decoding filter";
 838                 return SLAPD_DISCONNECT;
 839         }
 840
 841         f = (ValuesReturnFilter *) ch_malloc( sizeof(ValuesReturnFilter) );
 842         f->f_next = NULL;
 843
 844         err = LDAP_SUCCESS;
 845         f->f_choice = tag;
 846
 847         switch ( f->f_choice ) {
 848         case LDAP_FILTER_EQUALITY:
 849 #ifdef NEW_LOGGING
 850                 LDAP_LOG( FILTER, DETAIL2,
 851                         "get_simple_vrFilter: conn %d  EQUALITY\n", conn->c_connid, 0, 0 );
 852 #else
 853                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 854 #endif
 855                 err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY, text );
 856                 if ( err != LDAP_SUCCESS ) {
 857                         break;
 858                 }
 859
 860                 assert( f->f_ava != NULL );
 861                 break;
 862
 863         case LDAP_FILTER_SUBSTRINGS:
 864 #ifdef NEW_LOGGING
 865                 LDAP_LOG( FILTER, DETAIL1,
 866                         "get_simple_vrFilter: conn %d  SUBSTRINGS\n", conn->c_connid, 0, 0 );
 867 #else
 868                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 869 #endif
 870                 err = get_substring_filter( conn, ber, (Filter *)f, text );
 871                 break;
 872
 873         case LDAP_FILTER_GE:
 874 #ifdef NEW_LOGGING
 875                 LDAP_LOG( FILTER, DETAIL1,
 876                         "get_simple_vrFilter: conn %d  GE\n", conn->c_connid, 0, 0 );
 877 #else
 878                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 879 #endif
 880                 err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
 881                 if ( err != LDAP_SUCCESS ) {
 882                         break;
 883                 }
 884                 break;
 885
 886         case LDAP_FILTER_LE:
 887 #ifdef NEW_LOGGING
 888                 LDAP_LOG( FILTER, DETAIL1,
 889                         "get_simple_vrFilter: conn %d  LE\n", conn->c_connid, 0, 0 );
 890 #else
 891                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 892 #endif
 893                 err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
 894                 if ( err != LDAP_SUCCESS ) {
 895                         break;
 896                 }
 897                 break;
 898
 899         case LDAP_FILTER_PRESENT: {
 900                 struct berval type;
 901
 902 #ifdef NEW_LOGGING
 903                 LDAP_LOG( FILTER, DETAIL1,
 904                         "get_simple_vrFilter: conn %d PRESENT\n", conn->c_connid, 0, 0 );
 905 #else
 906                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 907 #endif
 908                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 909                         err = SLAPD_DISCONNECT;
 910                         *text = "error decoding filter";
 911                         break;
 912                 }
 913
 914                 f->f_desc = NULL;
 915                 err = slap_bv2ad( &type, &f->f_desc, text );
 916
 917                 if( err != LDAP_SUCCESS ) {
 918                         /* unrecognized attribute description or other error */
 919                         f->f_choice = SLAPD_FILTER_COMPUTED;
 920                         f->f_result = LDAP_COMPARE_FALSE;
 921                         err = LDAP_SUCCESS;
 922                         break;
 923                 }
 924                 } break;
 925
 926         case LDAP_FILTER_APPROX:
 927 #ifdef NEW_LOGGING
 928                 LDAP_LOG( FILTER, DETAIL1,
 929                         "get_simple_vrFilter: conn %d  APPROX\n", conn->c_connid, 0, 0 );
 930 #else
 931                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 932 #endif
 933                 err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY_APPROX, text );
 934                 if ( err != LDAP_SUCCESS ) {
 935                         break;
 936                 }
 937                 break;
 938
 939         case LDAP_FILTER_EXT:
 940 #ifdef NEW_LOGGING
 941                 LDAP_LOG( FILTER, DETAIL1,
 942                         "get_simple_vrFilter: conn %d  EXTENSIBLE\n", conn->c_connid, 0, 0 );
 943 #else
 944                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 945 #endif
 946
 947                 err = get_mra( ber, &f->f_mra, text );
 948                 if ( err != LDAP_SUCCESS ) {
 949                         break;
 950                 }
 951
 952                 assert( f->f_mra != NULL );
 953                 break;
 954
 955         default:
 956                 (void) ber_scanf( ber, "x" ); /* skip the element */
 957 #ifdef NEW_LOGGING
 958                 LDAP_LOG( FILTER, ERR,
 959                         "get_simple_vrFilter: conn %d unknown filter type=%lu\n",
 960                         conn->c_connid, f->f_choice, 0 );
 961 #else
 962                 Debug( LDAP_DEBUG_ANY, "get_simple_vrFilter: unknown filter type=%lu\n",
 963                         f->f_choice, 0, 0 );
 964 #endif
 965                 f->f_choice = SLAPD_FILTER_COMPUTED;
 966                 f->f_result = SLAPD_COMPARE_UNDEFINED;
 967                 break;
 968         }
 969
 970         if ( err != LDAP_SUCCESS ) {
 971                 if( err != SLAPD_DISCONNECT ) {
 972                         /* ignore error */
 973                         f->f_choice = SLAPD_FILTER_COMPUTED;
 974                         f->f_result = SLAPD_COMPARE_UNDEFINED;
 975                         err = LDAP_SUCCESS;
 976                         *filt = f;
 977
 978                 } else {
 979                         free(f);
 980                 }
 981
 982         } else {
 983                 *filt = f;
 984         }
 985
 986 #ifdef NEW_LOGGING
 987         LDAP_LOG( FILTER, DETAIL2,
 988                 "get_simple_vrFilter: conn %d exit\n", conn->c_connid, 0, 0 );
 989 #else
 990         Debug( LDAP_DEBUG_FILTER, "end get_simple_vrFilter %d\n", err, 0, 0 );
 991 #endif
 992         return( err );
 993 }
 994
 995 int
 996 get_vrFilter( Connection *conn, BerElement *ber,
 997         ValuesReturnFilter **f,
 998         const char **text )
 999 {
1000         /*
1001          * A ValuesReturnFilter looks like this:
1002          *
1003          *      ValuesReturnFilter ::= SEQUENCE OF SimpleFilterItem
1004          *      SimpleFilterItem ::= CHOICE {
1005          *              equalityMatch   [3]     AttributeValueAssertion,
1006          *              substrings      [4]     SubstringFilter,
1007          *              greaterOrEqual  [5]     AttributeValueAssertion,
1008          *              lessOrEqual     [6]     AttributeValueAssertion,
1009          *              present         [7]     AttributeType,
1010          *              approxMatch     [8]     AttributeValueAssertion,
1011          *              extensibleMatch [9]     SimpleMatchingAssertion -- LDAPv3
1012          *      }
1013          *
1014          *      SubstringFilter ::= SEQUENCE {
1015          *              type               AttributeType,
1016          *              SEQUENCE OF CHOICE {
1017          *                      initial          [0] IA5String,
1018          *                      any              [1] IA5String,
1019          *                      final            [2] IA5String
1020          *              }
1021          *      }
1022          *
1023          *      SimpleMatchingAssertion ::= SEQUENCE {  -- LDAPv3
1024          *              matchingRule    [1] MatchingRuleId OPTIONAL,
1025          *              type            [2] AttributeDescription OPTIONAL,
1026          *              matchValue      [3] AssertionValue }
1027          */
1028
1029         ValuesReturnFilter **new;
1030         ber_tag_t       tag;
1031         ber_len_t       len;
1032         char            *last;
1033
1034 #ifdef NEW_LOGGING
1035         LDAP_LOG( FILTER, ENTRY,
1036                 "get_vrFilter: conn %d start\n", conn->c_connid, 0, 0 );
1037 #else
1038         Debug( LDAP_DEBUG_FILTER, "begin get_vrFilter\n", 0, 0, 0 );
1039 #endif
1040
1041         tag = ber_peek_tag( ber, &len );
1042
1043         if( tag == LBER_ERROR ) {
1044                 *text = "error decoding vrFilter";
1045                 return SLAPD_DISCONNECT;
1046         }
1047
1048         if( tag != LBER_SEQUENCE ) {
1049                 *text = "error decoding vrFilter, expect SEQUENCE tag";
1050                 return SLAPD_DISCONNECT;
1051         }
1052
1053         new = f;
1054         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
1055                 tag = ber_next_element( ber, &len, last ) )
1056         {
1057                 int err = get_simple_vrFilter( conn, ber, new, text );
1058                 if ( err != LDAP_SUCCESS )
1059                         return( err );
1060                 new = &(*new)->f_next;
1061         }
1062         *new = NULL;
1063
1064 #ifdef NEW_LOGGING
1065         LDAP_LOG( FILTER, ENTRY,
1066                 "get_vrFilter: conn %d exit\n", conn->c_connid, 0, 0 );
1067 #else
1068         Debug( LDAP_DEBUG_FILTER, "end get_vrFilter\n", 0, 0, 0 );
1069 #endif
1070         return( LDAP_SUCCESS );
1071 }
1072
1073 void
1074 vrFilter_free( ValuesReturnFilter *f )
1075 {
1076         ValuesReturnFilter      *p, *next;
1077
1078         if ( f == NULL ) {
1079                 return;
1080         }
1081
1082         for ( p = f; p != NULL; p = next ) {
1083                 next = p->f_next;
1084
1085                 switch ( f->f_choice ) {
1086                 case LDAP_FILTER_PRESENT:
1087                         break;
1088
1089                 case LDAP_FILTER_EQUALITY:
1090                 case LDAP_FILTER_GE:
1091                 case LDAP_FILTER_LE:
1092                 case LDAP_FILTER_APPROX:
1093                         ava_free( f->f_ava, 1 );
1094                         break;
1095
1096                 case LDAP_FILTER_SUBSTRINGS:
1097                         if ( f->f_sub_initial.bv_val != NULL ) {
1098                                 free( f->f_sub_initial.bv_val );
1099                         }
1100                         ber_bvarray_free( f->f_sub_any );
1101                         if ( f->f_sub_final.bv_val != NULL ) {
1102                                 free( f->f_sub_final.bv_val );
1103                         }
1104                         ch_free( f->f_sub );
1105                         break;
1106
1107                 case LDAP_FILTER_EXT:
1108                         mra_free( f->f_mra, 1 );
1109                         break;
1110
1111                 case SLAPD_FILTER_COMPUTED:
1112                         break;
1113
1114                 default:
1115 #ifdef NEW_LOGGING
1116                         LDAP_LOG( FILTER, ERR,
1117                                 "filter_free: unknown filter type %lu\n", f->f_choice, 0, 0 );
1118 #else
1119                         Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
1120                                 f->f_choice, 0, 0 );
1121 #endif
1122                         break;
1123                 }
1124
1125                 free( f );
1126         }
1127 }
1128
1129
1130 void
1131 vrFilter2bv( ValuesReturnFilter *f, struct berval *fstr )
1132 {
1133         ValuesReturnFilter      *p;
1134         struct berval tmp;
1135         ber_len_t len;
1136
1137         if ( f == NULL ) {
1138                 ber_str2bv( "No filter!", sizeof("No filter!")-1, 1, fstr );
1139                 return;
1140         }
1141
1142         fstr->bv_len = sizeof("()") - 1;
1143         fstr->bv_val = malloc( fstr->bv_len + 128 );
1144
1145         snprintf( fstr->bv_val, fstr->bv_len + 1, "()");
1146
1147         for ( p = f; p != NULL; p = p->f_next ) {
1148                 len = fstr->bv_len;
1149
1150                 simple_vrFilter2bv( p, &tmp );
1151
1152                 fstr->bv_len += tmp.bv_len;
1153                 fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1154
1155                 snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
1156                         /*"("*/ "%s)", tmp.bv_val );
1157
1158                 ch_free( tmp.bv_val );
1159         }
1160 }
1161
1162 static void
1163 simple_vrFilter2bv( ValuesReturnFilter *f, struct berval *fstr )
1164 {
1165         struct berval tmp;
1166         ber_len_t len;
1167
1168         if ( f == NULL ) {
1169                 ber_str2bv( "No filter!", sizeof("No filter!")-1, 1, fstr );
1170                 return;
1171         }
1172
1173         switch ( f->f_choice ) {
1174         case LDAP_FILTER_EQUALITY:
1175                 filter_escape_value( &f->f_av_value, &tmp );
1176
1177                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
1178                         tmp.bv_len + ( sizeof("(=)") - 1 );
1179                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1180
1181                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
1182                         f->f_av_desc->ad_cname.bv_val,
1183                         tmp.bv_val );
1184
1185                 ber_memfree( tmp.bv_val );
1186                 break;
1187
1188         case LDAP_FILTER_GE:
1189                 filter_escape_value( &f->f_av_value, &tmp );
1190
1191                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
1192                         tmp.bv_len + ( sizeof("(>=)") - 1 );
1193                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1194
1195                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
1196                         f->f_av_desc->ad_cname.bv_val,
1197                         tmp.bv_val );
1198
1199                 ber_memfree( tmp.bv_val );
1200                 break;
1201
1202         case LDAP_FILTER_LE:
1203                 filter_escape_value( &f->f_av_value, &tmp );
1204
1205                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
1206                         tmp.bv_len + ( sizeof("(<=)") - 1 );
1207                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1208
1209                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
1210                         f->f_av_desc->ad_cname.bv_val,
1211                         tmp.bv_val );
1212
1213                 ber_memfree( tmp.bv_val );
1214                 break;
1215
1216         case LDAP_FILTER_APPROX:
1217                 filter_escape_value( &f->f_av_value, &tmp );
1218
1219                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
1220                         tmp.bv_len + ( sizeof("(~=)") - 1 );
1221                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1222
1223                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
1224                         f->f_av_desc->ad_cname.bv_val,
1225                         tmp.bv_val );
1226                 ber_memfree( tmp.bv_val );
1227                 break;
1228
1229         case LDAP_FILTER_SUBSTRINGS:
1230                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
1231                         ( sizeof("(=*)") - 1 );
1232                 fstr->bv_val = malloc( fstr->bv_len + 128 );
1233
1234                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1235                         f->f_sub_desc->ad_cname.bv_val );
1236
1237                 if ( f->f_sub_initial.bv_val != NULL ) {
1238                         len = fstr->bv_len;
1239
1240                         filter_escape_value( &f->f_sub_initial, &tmp );
1241
1242                         fstr->bv_len += tmp.bv_len;
1243                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1244
1245                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
1246                                 /* "(attr=" */ "%s*)",
1247                                 tmp.bv_val );
1248
1249                         ber_memfree( tmp.bv_val );
1250                 }
1251
1252                 if ( f->f_sub_any != NULL ) {
1253                         int i;
1254                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
1255                                 len = fstr->bv_len;
1256                                 filter_escape_value( &f->f_sub_any[i], &tmp );
1257
1258                                 fstr->bv_len += tmp.bv_len + 1;
1259                                 fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1260
1261                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1262                                         /* "(attr=[init]*[any*]" */ "%s*)",
1263                                         tmp.bv_val );
1264                                 ber_memfree( tmp.bv_val );
1265                         }
1266                 }
1267
1268                 if ( f->f_sub_final.bv_val != NULL ) {
1269                         len = fstr->bv_len;
1270
1271                         filter_escape_value( &f->f_sub_final, &tmp );
1272
1273                         fstr->bv_len += tmp.bv_len;
1274                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1275
1276                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1277                                 /* "(attr=[init*][any*]" */ "%s)",
1278                                 tmp.bv_val );
1279
1280                         ber_memfree( tmp.bv_val );
1281                 }
1282
1283                 break;
1284
1285         case LDAP_FILTER_PRESENT:
1286                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
1287                         ( sizeof("(=*)") - 1 );
1288                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1289
1290                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1291                         f->f_desc->ad_cname.bv_val );
1292                 break;
1293
1294         case LDAP_FILTER_EXT: {
1295                 struct berval ad;
1296                 filter_escape_value( &f->f_mr_value, &tmp );
1297
1298                 if ( f->f_mr_desc ) {
1299                         ad = f->f_mr_desc->ad_cname;
1300                 } else {
1301                         ad.bv_len = 0;
1302                         ad.bv_val = "";
1303                 }
1304
1305                 fstr->bv_len = ad.bv_len +
1306                         ( f->f_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
1307                         ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
1308                         tmp.bv_len + ( sizeof("(:=)") - 1 );
1309                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1310
1311                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
1312                         ad.bv_val,
1313                         f->f_mr_dnattrs ? ":dn" : "",
1314                         f->f_mr_rule_text.bv_len ? ":" : "",
1315                         f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
1316                         tmp.bv_val );
1317
1318                 ber_memfree( tmp.bv_val );
1319                 } break;
1320
1321         case SLAPD_FILTER_COMPUTED:
1322                 ber_str2bv(
1323                         f->f_result == LDAP_COMPARE_FALSE ? "(?=false)" :
1324                         f->f_result == LDAP_COMPARE_TRUE ? "(?=true)" :
1325                         f->f_result == SLAPD_COMPARE_UNDEFINED ? "(?=undefined)" :
1326                         "(?=error)",
1327                         f->f_result == LDAP_COMPARE_FALSE ? sizeof("(?=false)")-1 :
1328                         f->f_result == LDAP_COMPARE_TRUE ? sizeof("(?=true)")-1 :
1329                         f->f_result == SLAPD_COMPARE_UNDEFINED ? sizeof("(?=undefined)")-1 :
1330                         sizeof("(?=error)")-1,
1331                         1, fstr );
1332                 break;
1333
1334         default:
1335                 ber_str2bv( "(?=unknown)", sizeof("(?=unknown)")-1, 1, fstr );
1336                 break;
1337         }
1338 }
1339
1340 static int
1341 get_substring_vrFilter(
1342         Connection      *conn,
1343         BerElement      *ber,
1344         ValuesReturnFilter      *f,
1345         const char      **text )
1346 {
1347         ber_tag_t       tag;
1348         ber_len_t       len;
1349         ber_tag_t       rc;
1350         struct berval value;
1351         char            *last;
1352         struct berval bv;
1353         *text = "error decoding filter";
1354
1355 #ifdef NEW_LOGGING
1356         LDAP_LOG( FILTER, ENTRY,
1357                 "get_substring_filter: conn %d  begin\n", conn->c_connid, 0, 0 );
1358 #else
1359         Debug( LDAP_DEBUG_FILTER, "begin get_substring_filter\n", 0, 0, 0 );
1360 #endif
1361         if ( ber_scanf( ber, "{m" /*}*/, &bv ) == LBER_ERROR ) {
1362                 return SLAPD_DISCONNECT;
1363         }
1364
1365         f->f_sub = ch_calloc( 1, sizeof(SubstringsAssertion) );
1366         f->f_sub_desc = NULL;
1367         rc = slap_bv2ad( &bv, &f->f_sub_desc, text );
1368
1369         if( rc != LDAP_SUCCESS ) {
1370                 text = NULL;
1371                 ch_free( f->f_sub );
1372                 f->f_choice = SLAPD_FILTER_COMPUTED;
1373                 f->f_result = SLAPD_COMPARE_UNDEFINED;
1374                 return LDAP_SUCCESS;
1375         }
1376
1377         f->f_sub_initial.bv_val = NULL;
1378         f->f_sub_any = NULL;
1379         f->f_sub_final.bv_val = NULL;
1380
1381         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
1382                 tag = ber_next_element( ber, &len, last ) )
1383         {
1384                 unsigned usage;
1385
1386                 rc = ber_scanf( ber, "m", &value );
1387                 if ( rc == LBER_ERROR ) {
1388                         rc = SLAPD_DISCONNECT;
1389                         goto return_error;
1390                 }
1391
1392                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
1393                         rc = LDAP_INVALID_SYNTAX;
1394                         goto return_error;
1395                 }
1396
1397                 switch ( tag ) {
1398                 case LDAP_SUBSTRING_INITIAL:
1399                         usage = SLAP_MR_SUBSTR_INITIAL;
1400                         break;
1401
1402                 case LDAP_SUBSTRING_ANY:
1403                         usage = SLAP_MR_SUBSTR_ANY;
1404                         break;
1405
1406                 case LDAP_SUBSTRING_FINAL:
1407                         usage = SLAP_MR_SUBSTR_FINAL;
1408                         break;
1409
1410                 default:
1411                         rc = LDAP_PROTOCOL_ERROR;
1412
1413 #ifdef NEW_LOGGING
1414                         LDAP_LOG( FILTER, ERR,
1415                                 "get_filter_substring: conn %d  unknown substring choice=%ld\n",
1416                                 conn->c_connid, (long)tag, 0 );
1417 #else
1418                         Debug( LDAP_DEBUG_FILTER,
1419                                 "  unknown substring choice=%ld\n",
1420                                 (long) tag, 0, 0 );
1421 #endif
1422                         goto return_error;
1423                 }
1424
1425                 /* valiate using equality matching rule validator! */
1426                 rc = value_validate( f->f_sub_desc->ad_type->sat_equality,
1427                         &value, text );
1428                 if( rc != LDAP_SUCCESS ) {
1429                         goto return_error;
1430                 }
1431
1432                 rc = value_normalize( f->f_sub_desc, usage,
1433                         &value, &bv, text );
1434                 if( rc != LDAP_SUCCESS ) {
1435                         goto return_error;
1436                 }
1437
1438                 value = bv;
1439
1440                 rc = LDAP_PROTOCOL_ERROR;
1441
1442                 switch ( tag ) {
1443                 case LDAP_SUBSTRING_INITIAL:
1444 #ifdef NEW_LOGGING
1445                         LDAP_LOG( FILTER, DETAIL1,
1446                                 "get_substring_filter: conn %d  INITIAL\n",
1447                                 conn->c_connid, 0, 0 );
1448 #else
1449                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
1450 #endif
1451
1452                         if ( f->f_sub_initial.bv_val != NULL
1453                                 || f->f_sub_any != NULL
1454                                 || f->f_sub_final.bv_val != NULL )
1455                         {
1456                                 free( value.bv_val );
1457                                 goto return_error;
1458                         }
1459
1460                         f->f_sub_initial = value;
1461                         break;
1462
1463                 case LDAP_SUBSTRING_ANY:
1464 #ifdef NEW_LOGGING
1465                         LDAP_LOG( FILTER, DETAIL1,
1466                                 "get_substring_filter: conn %d  ANY\n", conn->c_connid, 0, 0 );
1467 #else
1468                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
1469 #endif
1470
1471                         if ( f->f_sub_final.bv_val != NULL ) {
1472                                 free( value.bv_val );
1473                                 goto return_error;
1474                         }
1475
1476                         ber_bvarray_add( &f->f_sub_any, &value );
1477                         break;
1478
1479                 case LDAP_SUBSTRING_FINAL:
1480 #ifdef NEW_LOGGING
1481                         LDAP_LOG( FILTER, DETAIL1,
1482                                 "get_substring_filter: conn %d  FINAL\n", conn->c_connid, 0, 0 );
1483 #else
1484                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
1485 #endif
1486
1487                         if ( f->f_sub_final.bv_val != NULL ) {
1488                                 free( value.bv_val );
1489                                 goto return_error;
1490                         }
1491
1492                         f->f_sub_final = value;
1493                         break;
1494
1495                 default:
1496 #ifdef NEW_LOGGING
1497                         LDAP_LOG( FILTER, INFO,
1498                                 "get_substring_filter: conn %d  unknown substring type %ld\n",
1499                                 conn->c_connid, (long)tag, 0 );
1500 #else
1501                         Debug( LDAP_DEBUG_FILTER,
1502                                 "  unknown substring type=%ld\n",
1503                                 (long) tag, 0, 0 );
1504 #endif
1505
1506                         free( value.bv_val );
1507
1508 return_error:
1509 #ifdef NEW_LOGGING
1510                         LDAP_LOG( FILTER, INFO,
1511                                 "get_substring_filter: conn %d  error %ld\n",
1512                                 conn->c_connid, (long)rc, 0 );
1513 #else
1514                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
1515                                 (long) rc, 0, 0 );
1516 #endif
1517                         free( f->f_sub_initial.bv_val );
1518                         ber_bvarray_free( f->f_sub_any );
1519                         free( f->f_sub_final.bv_val );
1520                         ch_free( f->f_sub );
1521                         return rc;
1522                 }
1523         }
1524
1525 #ifdef NEW_LOGGING
1526         LDAP_LOG( FILTER, ENTRY,
1527                 "get_substring_filter: conn %d exit\n", conn->c_connid, 0, 0 );
1528 #else
1529         Debug( LDAP_DEBUG_FILTER, "end get_substring_filter\n", 0, 0, 0 );
1530 #endif
1531         return( LDAP_SUCCESS );
1532 }
1533