git.sur5r.net Git - openldap/blob - servers/slapd/filter.c

   1 /* filter.c - routines for parsing and dealing with filters */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/socket.h>
  13 #include <ac/string.h>
  14
  15 #include "slap.h"
  16
  17 static int      get_filter_list(
  18         Connection *conn,
  19         BerElement *ber,
  20         Filter **f,
  21         const char **text );
  22
  23 static int      get_substring_filter(
  24         Connection *conn,
  25         BerElement *ber,
  26         Filter *f,
  27         const char **text );
  28
  29 static int filter_escape_value(
  30         struct berval *in,
  31         struct berval *out );
  32
  33 static void simple_vrFilter2bv(
  34         ValuesReturnFilter *f,
  35         struct berval *fstr );
  36
  37 static int      get_simple_vrFilter(
  38         Connection *conn,
  39         BerElement *ber,
  40         ValuesReturnFilter **f,
  41         const char **text );
  42
  43
  44 int
  45 get_filter(
  46         Connection *conn,
  47         BerElement *ber,
  48         Filter **filt,
  49         const char **text )
  50 {
  51         ber_tag_t       tag;
  52         ber_len_t       len;
  53         int             err;
  54         Filter          *f;
  55
  56 #ifdef NEW_LOGGING
  57         LDAP_LOG( FILTER, ENTRY, "get_filter: conn %d\n", conn->c_connid, 0, 0 );
  58 #else
  59         Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
  60 #endif
  61         /*
  62          * A filter looks like this coming in:
  63          *      Filter ::= CHOICE {
  64          *              and             [0]     SET OF Filter,
  65          *              or              [1]     SET OF Filter,
  66          *              not             [2]     Filter,
  67          *              equalityMatch   [3]     AttributeValueAssertion,
  68          *              substrings      [4]     SubstringFilter,
  69          *              greaterOrEqual  [5]     AttributeValueAssertion,
  70          *              lessOrEqual     [6]     AttributeValueAssertion,
  71          *              present         [7]     AttributeType,,
  72          *              approxMatch     [8]     AttributeValueAssertion
  73          *              extensibleMatch [9] MatchingRuleAssertion
  74          *      }
  75          *
  76          *      SubstringFilter ::= SEQUENCE {
  77          *              type               AttributeType,
  78          *              SEQUENCE OF CHOICE {
  79          *                      initial          [0] IA5String,
  80          *                      any              [1] IA5String,
  81          *                      final            [2] IA5String
  82          *              }
  83          *      }
  84          *
  85          *      MatchingRuleAssertion ::= SEQUENCE {
  86          *              matchingRule    [1] MatchingRuleId OPTIONAL,
  87          *              type            [2] AttributeDescription OPTIONAL,
  88          *              matchValue      [3] AssertionValue,
  89          *              dnAttributes    [4] BOOLEAN DEFAULT FALSE
  90          *      }
  91          *
  92          */
  93
  94         tag = ber_peek_tag( ber, &len );
  95
  96         if( tag == LBER_ERROR ) {
  97                 *text = "error decoding filter";
  98                 return SLAPD_DISCONNECT;
  99         }
 100
 101         f = (Filter *) ch_malloc( sizeof(Filter) );
 102         f->f_next = NULL;
 103
 104         err = LDAP_SUCCESS;
 105         f->f_choice = tag;
 106
 107         switch ( f->f_choice ) {
 108         case LDAP_FILTER_EQUALITY:
 109 #ifdef NEW_LOGGING
 110                 LDAP_LOG( FILTER, DETAIL2,
 111                         "get_filter: conn %d  EQUALITY\n", conn->c_connid, 0, 0 );
 112 #else
 113                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 114 #endif
 115                 err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY, text );
 116                 if ( err != LDAP_SUCCESS ) {
 117                         break;
 118                 }
 119
 120                 assert( f->f_ava != NULL );
 121                 break;
 122
 123         case LDAP_FILTER_SUBSTRINGS:
 124 #ifdef NEW_LOGGING
 125                 LDAP_LOG( FILTER, DETAIL1,
 126                         "get_filter: conn %d  SUBSTRINGS\n", conn->c_connid, 0, 0 );
 127 #else
 128                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 129 #endif
 130                 err = get_substring_filter( conn, ber, f, text );
 131                 break;
 132
 133         case LDAP_FILTER_GE:
 134 #ifdef NEW_LOGGING
 135                 LDAP_LOG( FILTER, DETAIL1,
 136                         "get_filter: conn %d  GE\n", conn->c_connid, 0, 0 );
 137 #else
 138                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 139 #endif
 140                 err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
 141                 if ( err != LDAP_SUCCESS ) {
 142                         break;
 143                 }
 144                 break;
 145
 146         case LDAP_FILTER_LE:
 147 #ifdef NEW_LOGGING
 148                 LDAP_LOG( FILTER, DETAIL1,
 149                         "get_filter: conn %d  LE\n", conn->c_connid, 0, 0 );
 150 #else
 151                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 152 #endif
 153                 err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
 154                 if ( err != LDAP_SUCCESS ) {
 155                         break;
 156                 }
 157                 break;
 158
 159         case LDAP_FILTER_PRESENT: {
 160                 struct berval type;
 161
 162 #ifdef NEW_LOGGING
 163                 LDAP_LOG( FILTER, DETAIL1,
 164                         "get_filter: conn %d PRESENT\n", conn->c_connid, 0, 0 );
 165 #else
 166                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 167 #endif
 168                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 169                         err = SLAPD_DISCONNECT;
 170                         *text = "error decoding filter";
 171                         break;
 172                 }
 173
 174                 f->f_desc = NULL;
 175                 err = slap_bv2ad( &type, &f->f_desc, text );
 176
 177                 if( err != LDAP_SUCCESS ) {
 178                         /* unrecognized attribute description or other error */
 179                         f->f_choice = SLAPD_FILTER_COMPUTED;
 180                         f->f_result = LDAP_COMPARE_FALSE;
 181                         err = LDAP_SUCCESS;
 182                         break;
 183                 }
 184                 } break;
 185
 186         case LDAP_FILTER_APPROX:
 187 #ifdef NEW_LOGGING
 188                 LDAP_LOG( FILTER, DETAIL1,
 189                         "get_filter: conn %d  APPROX\n", conn->c_connid, 0, 0 );
 190 #else
 191                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 192 #endif
 193                 err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY_APPROX, text );
 194                 if ( err != LDAP_SUCCESS ) {
 195                         break;
 196                 }
 197                 break;
 198
 199         case LDAP_FILTER_AND:
 200 #ifdef NEW_LOGGING
 201                 LDAP_LOG( FILTER, DETAIL1,
 202                         "get_filter: conn %d  AND\n", conn->c_connid, 0, 0 );
 203 #else
 204                 Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
 205 #endif
 206                 err = get_filter_list( conn, ber, &f->f_and, text );
 207                 if ( err != LDAP_SUCCESS ) {
 208                         break;
 209                 }
 210                 break;
 211
 212         case LDAP_FILTER_OR:
 213 #ifdef NEW_LOGGING
 214                 LDAP_LOG( FILTER, DETAIL1,
 215                         "get_filter: conn %d  OR\n", conn->c_connid, 0, 0  );
 216 #else
 217                 Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
 218 #endif
 219                 err = get_filter_list( conn, ber, &f->f_or, text );
 220                 if ( err != LDAP_SUCCESS ) {
 221                         break;
 222                 }
 223                 break;
 224
 225         case LDAP_FILTER_NOT:
 226 #ifdef NEW_LOGGING
 227                 LDAP_LOG( FILTER, DETAIL1,
 228                         "get_filter: conn %d  NOT\n", conn->c_connid, 0, 0 );
 229 #else
 230                 Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
 231 #endif
 232                 (void) ber_skip_tag( ber, &len );
 233                 err = get_filter( conn, ber, &f->f_not, text );
 234                 if ( err != LDAP_SUCCESS ) {
 235                         break;
 236                 }
 237                 break;
 238
 239         case LDAP_FILTER_EXT:
 240 #ifdef NEW_LOGGING
 241                 LDAP_LOG( FILTER, DETAIL1,
 242                         "get_filter: conn %d  EXTENSIBLE\n", conn->c_connid, 0, 0 );
 243 #else
 244                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 245 #endif
 246
 247                 err = get_mra( ber, &f->f_mra, text );
 248                 if ( err != LDAP_SUCCESS ) {
 249                         break;
 250                 }
 251
 252                 assert( f->f_mra != NULL );
 253                 break;
 254
 255         default:
 256                 (void) ber_scanf( ber, "x" ); /* skip the element */
 257 #ifdef NEW_LOGGING
 258                 LDAP_LOG( FILTER, ERR,
 259                         "get_filter: conn %d unknown filter type=%lu\n",
 260                         conn->c_connid, f->f_choice, 0 );
 261 #else
 262                 Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
 263                         f->f_choice, 0, 0 );
 264 #endif
 265                 f->f_choice = SLAPD_FILTER_COMPUTED;
 266                 f->f_result = SLAPD_COMPARE_UNDEFINED;
 267                 break;
 268         }
 269
 270         if ( err != LDAP_SUCCESS ) {
 271                 if( err != SLAPD_DISCONNECT ) {
 272                         /* ignore error */
 273                         f->f_choice = SLAPD_FILTER_COMPUTED;
 274                         f->f_result = SLAPD_COMPARE_UNDEFINED;
 275                         err = LDAP_SUCCESS;
 276                         *filt = f;
 277
 278                 } else {
 279                         free(f);
 280                 }
 281
 282         } else {
 283                 *filt = f;
 284         }
 285
 286 #ifdef NEW_LOGGING
 287         LDAP_LOG( FILTER, DETAIL2,
 288                 "get_filter: conn %d exit\n", conn->c_connid, 0, 0 );
 289 #else
 290         Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
 291 #endif
 292         return( err );
 293 }
 294
 295 static int
 296 get_filter_list( Connection *conn, BerElement *ber,
 297         Filter **f,
 298         const char **text )
 299 {
 300         Filter          **new;
 301         int             err;
 302         ber_tag_t       tag;
 303         ber_len_t       len;
 304         char            *last;
 305
 306 #ifdef NEW_LOGGING
 307         LDAP_LOG( FILTER, ENTRY,
 308                 "get_filter_list: conn %d start\n", conn->c_connid, 0, 0 );
 309 #else
 310         Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
 311 #endif
 312         new = f;
 313         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
 314                 tag = ber_next_element( ber, &len, last ) )
 315         {
 316                 err = get_filter( conn, ber, new, text );
 317                 if ( err != LDAP_SUCCESS )
 318                         return( err );
 319                 new = &(*new)->f_next;
 320         }
 321         *new = NULL;
 322
 323 #ifdef NEW_LOGGING
 324         LDAP_LOG( FILTER, ENTRY,
 325                 "get_filter_list: conn %d exit\n", conn->c_connid, 0, 0 );
 326 #else
 327         Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
 328 #endif
 329         return( LDAP_SUCCESS );
 330 }
 331
 332 static int
 333 get_substring_filter(
 334         Connection      *conn,
 335         BerElement      *ber,
 336         Filter  *f,
 337         const char      **text )
 338 {
 339         ber_tag_t       tag;
 340         ber_len_t       len;
 341         ber_tag_t       rc;
 342         struct berval value;
 343         char            *last;
 344         struct berval bv;
 345         *text = "error decoding filter";
 346
 347 #ifdef NEW_LOGGING
 348         LDAP_LOG( FILTER, ENTRY,
 349                 "get_substring_filter: conn %d  begin\n", conn->c_connid, 0, 0 );
 350 #else
 351         Debug( LDAP_DEBUG_FILTER, "begin get_substring_filter\n", 0, 0, 0 );
 352 #endif
 353         if ( ber_scanf( ber, "{m" /*}*/, &bv ) == LBER_ERROR ) {
 354                 return SLAPD_DISCONNECT;
 355         }
 356
 357         f->f_sub = ch_calloc( 1, sizeof(SubstringsAssertion) );
 358         f->f_sub_desc = NULL;
 359         rc = slap_bv2ad( &bv, &f->f_sub_desc, text );
 360
 361         if( rc != LDAP_SUCCESS ) {
 362                 text = NULL;
 363                 ch_free( f->f_sub );
 364                 f->f_choice = SLAPD_FILTER_COMPUTED;
 365                 f->f_result = SLAPD_COMPARE_UNDEFINED;
 366                 return LDAP_SUCCESS;
 367         }
 368
 369         f->f_sub_initial.bv_val = NULL;
 370         f->f_sub_any = NULL;
 371         f->f_sub_final.bv_val = NULL;
 372
 373         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
 374                 tag = ber_next_element( ber, &len, last ) )
 375         {
 376                 unsigned usage;
 377
 378                 rc = ber_scanf( ber, "m", &value );
 379                 if ( rc == LBER_ERROR ) {
 380                         rc = SLAPD_DISCONNECT;
 381                         goto return_error;
 382                 }
 383
 384                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
 385                         rc = LDAP_INVALID_SYNTAX;
 386                         goto return_error;
 387                 }
 388
 389                 switch ( tag ) {
 390                 case LDAP_SUBSTRING_INITIAL:
 391                         usage = SLAP_MR_SUBSTR_INITIAL;
 392                         break;
 393
 394                 case LDAP_SUBSTRING_ANY:
 395                         usage = SLAP_MR_SUBSTR_ANY;
 396                         break;
 397
 398                 case LDAP_SUBSTRING_FINAL:
 399                         usage = SLAP_MR_SUBSTR_FINAL;
 400                         break;
 401
 402                 default:
 403                         rc = LDAP_PROTOCOL_ERROR;
 404
 405 #ifdef NEW_LOGGING
 406                         LDAP_LOG( FILTER, ERR,
 407                                 "get_filter_substring: conn %d  unknown substring choice=%ld\n",
 408                                 conn->c_connid, (long)tag, 0 );
 409 #else
 410                         Debug( LDAP_DEBUG_FILTER,
 411                                 "  unknown substring choice=%ld\n",
 412                                 (long) tag, 0, 0 );
 413 #endif
 414                         goto return_error;
 415                 }
 416
 417                 /* valiate using equality matching rule validator! */
 418                 rc = value_validate( f->f_sub_desc->ad_type->sat_equality,
 419                         &value, text );
 420                 if( rc != LDAP_SUCCESS ) {
 421                         goto return_error;
 422                 }
 423
 424                 rc = value_normalize( f->f_sub_desc, usage,
 425                         &value, &bv, text );
 426                 if( rc != LDAP_SUCCESS ) {
 427                         goto return_error;
 428                 }
 429
 430                 value = bv;
 431
 432                 rc = LDAP_PROTOCOL_ERROR;
 433
 434                 switch ( tag ) {
 435                 case LDAP_SUBSTRING_INITIAL:
 436 #ifdef NEW_LOGGING
 437                         LDAP_LOG( FILTER, DETAIL1,
 438                                 "get_substring_filter: conn %d  INITIAL\n", conn->c_connid, 0, 0 );
 439 #else
 440                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
 441 #endif
 442
 443                         if ( f->f_sub_initial.bv_val != NULL
 444                                 || f->f_sub_any != NULL
 445                                 || f->f_sub_final.bv_val != NULL )
 446                         {
 447                                 free( value.bv_val );
 448                                 goto return_error;
 449                         }
 450
 451                         f->f_sub_initial = value;
 452                         break;
 453
 454                 case LDAP_SUBSTRING_ANY:
 455 #ifdef NEW_LOGGING
 456                         LDAP_LOG( FILTER, DETAIL1,
 457                                 "get_substring_filter: conn %d  ANY\n", conn->c_connid, 0, 0 );
 458 #else
 459                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
 460 #endif
 461
 462                         if ( f->f_sub_final.bv_val != NULL ) {
 463                                 free( value.bv_val );
 464                                 goto return_error;
 465                         }
 466
 467                         ber_bvarray_add( &f->f_sub_any, &value );
 468                         break;
 469
 470                 case LDAP_SUBSTRING_FINAL:
 471 #ifdef NEW_LOGGING
 472                         LDAP_LOG( FILTER, DETAIL1,
 473                                 "get_substring_filter: conn %d  FINAL\n", conn->c_connid, 0, 0 );
 474 #else
 475                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
 476 #endif
 477
 478                         if ( f->f_sub_final.bv_val != NULL ) {
 479                                 free( value.bv_val );
 480                                 goto return_error;
 481                         }
 482
 483                         f->f_sub_final = value;
 484                         break;
 485
 486                 default:
 487 #ifdef NEW_LOGGING
 488                         LDAP_LOG( FILTER, INFO,
 489                                 "get_substring_filter: conn %d  unknown substring type %ld\n",
 490                                 conn->c_connid, (long)tag, 0 );
 491 #else
 492                         Debug( LDAP_DEBUG_FILTER,
 493                                 "  unknown substring type=%ld\n",
 494                                 (long) tag, 0, 0 );
 495 #endif
 496
 497                         free( value.bv_val );
 498
 499 return_error:
 500 #ifdef NEW_LOGGING
 501                         LDAP_LOG( FILTER, INFO,
 502                                 "get_substring_filter: conn %d  error %ld\n",
 503                                 conn->c_connid, (long)rc, 0 );
 504 #else
 505                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
 506                                 (long) rc, 0, 0 );
 507 #endif
 508                         free( f->f_sub_initial.bv_val );
 509                         ber_bvarray_free( f->f_sub_any );
 510                         free( f->f_sub_final.bv_val );
 511                         ch_free( f->f_sub );
 512                         return rc;
 513                 }
 514         }
 515
 516 #ifdef NEW_LOGGING
 517         LDAP_LOG( FILTER, ENTRY,
 518                 "get_substring_filter: conn %d exit\n", conn->c_connid, 0, 0 );
 519 #else
 520         Debug( LDAP_DEBUG_FILTER, "end get_substring_filter\n", 0, 0, 0 );
 521 #endif
 522         return( LDAP_SUCCESS );
 523 }
 524
 525 void
 526 filter_free( Filter *f )
 527 {
 528         Filter  *p, *next;
 529
 530         if ( f == NULL ) {
 531                 return;
 532         }
 533
 534         switch ( f->f_choice ) {
 535         case LDAP_FILTER_PRESENT:
 536                 break;
 537
 538         case LDAP_FILTER_EQUALITY:
 539         case LDAP_FILTER_GE:
 540         case LDAP_FILTER_LE:
 541         case LDAP_FILTER_APPROX:
 542                 ava_free( f->f_ava, 1 );
 543                 break;
 544
 545         case LDAP_FILTER_SUBSTRINGS:
 546                 if ( f->f_sub_initial.bv_val != NULL ) {
 547                         free( f->f_sub_initial.bv_val );
 548                 }
 549                 ber_bvarray_free( f->f_sub_any );
 550                 if ( f->f_sub_final.bv_val != NULL ) {
 551                         free( f->f_sub_final.bv_val );
 552                 }
 553                 ch_free( f->f_sub );
 554                 break;
 555
 556         case LDAP_FILTER_AND:
 557         case LDAP_FILTER_OR:
 558         case LDAP_FILTER_NOT:
 559                 for ( p = f->f_list; p != NULL; p = next ) {
 560                         next = p->f_next;
 561                         filter_free( p );
 562                 }
 563                 break;
 564
 565         case LDAP_FILTER_EXT:
 566                 mra_free( f->f_mra, 1 );
 567                 break;
 568
 569         case SLAPD_FILTER_COMPUTED:
 570                 break;
 571
 572         default:
 573 #ifdef NEW_LOGGING
 574                 LDAP_LOG( FILTER, ERR,
 575                         "filter_free: unknown filter type %lu\n", f->f_choice, 0, 0 );
 576 #else
 577                 Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
 578                         f->f_choice, 0, 0 );
 579 #endif
 580                 break;
 581         }
 582
 583         free( f );
 584 }
 585
 586 void
 587 filter2bv( Filter *f, struct berval *fstr )
 588 {
 589         int     i;
 590         Filter  *p;
 591         struct berval tmp;
 592         ber_len_t len;
 593
 594         if ( f == NULL ) {
 595                 ber_str2bv( "No filter!", sizeof("No filter!")-1, 1, fstr );
 596                 return;
 597         }
 598
 599         switch ( f->f_choice ) {
 600         case LDAP_FILTER_EQUALITY:
 601                 filter_escape_value( &f->f_av_value, &tmp );
 602
 603                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 604                         tmp.bv_len + ( sizeof("(=)") - 1 );
 605                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 606
 607                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
 608                         f->f_av_desc->ad_cname.bv_val,
 609                         tmp.bv_val );
 610
 611                 ber_memfree( tmp.bv_val );
 612                 break;
 613
 614         case LDAP_FILTER_GE:
 615                 filter_escape_value( &f->f_av_value, &tmp );
 616
 617                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 618                         tmp.bv_len + ( sizeof("(>=)") - 1 );
 619                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 620
 621                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
 622                         f->f_av_desc->ad_cname.bv_val,
 623                         tmp.bv_val );
 624
 625                 ber_memfree( tmp.bv_val );
 626                 break;
 627
 628         case LDAP_FILTER_LE:
 629                 filter_escape_value( &f->f_av_value, &tmp );
 630
 631                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 632                         tmp.bv_len + ( sizeof("(<=)") - 1 );
 633                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 634
 635                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
 636                         f->f_av_desc->ad_cname.bv_val,
 637                         tmp.bv_val );
 638
 639                 ber_memfree( tmp.bv_val );
 640                 break;
 641
 642         case LDAP_FILTER_APPROX:
 643                 filter_escape_value( &f->f_av_value, &tmp );
 644
 645                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 646                         tmp.bv_len + ( sizeof("(~=)") - 1 );
 647                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 648
 649                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
 650                         f->f_av_desc->ad_cname.bv_val,
 651                         tmp.bv_val );
 652                 ber_memfree( tmp.bv_val );
 653                 break;
 654
 655         case LDAP_FILTER_SUBSTRINGS:
 656                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
 657                         ( sizeof("(=*)") - 1 );
 658                 fstr->bv_val = malloc( fstr->bv_len + 128 );
 659
 660                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 661                         f->f_sub_desc->ad_cname.bv_val );
 662
 663                 if ( f->f_sub_initial.bv_val != NULL ) {
 664                         len = fstr->bv_len;
 665
 666                         filter_escape_value( &f->f_sub_initial, &tmp );
 667
 668                         fstr->bv_len += tmp.bv_len;
 669                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 670
 671                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
 672                                 /* "(attr=" */ "%s*)",
 673                                 tmp.bv_val );
 674
 675                         ber_memfree( tmp.bv_val );
 676                 }
 677
 678                 if ( f->f_sub_any != NULL ) {
 679                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
 680                                 len = fstr->bv_len;
 681                                 filter_escape_value( &f->f_sub_any[i], &tmp );
 682
 683                                 fstr->bv_len += tmp.bv_len + 1;
 684                                 fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 685
 686                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 687                                         /* "(attr=[init]*[any*]" */ "%s*)",
 688                                         tmp.bv_val );
 689                                 ber_memfree( tmp.bv_val );
 690                         }
 691                 }
 692
 693                 if ( f->f_sub_final.bv_val != NULL ) {
 694                         len = fstr->bv_len;
 695
 696                         filter_escape_value( &f->f_sub_final, &tmp );
 697
 698                         fstr->bv_len += tmp.bv_len;
 699                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 700
 701                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 702                                 /* "(attr=[init*][any*]" */ "%s)",
 703                                 tmp.bv_val );
 704
 705                         ber_memfree( tmp.bv_val );
 706                 }
 707
 708                 break;
 709
 710         case LDAP_FILTER_PRESENT:
 711                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
 712                         ( sizeof("(=*)") - 1 );
 713                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 714
 715                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 716                         f->f_desc->ad_cname.bv_val );
 717                 break;
 718
 719         case LDAP_FILTER_AND:
 720         case LDAP_FILTER_OR:
 721         case LDAP_FILTER_NOT:
 722                 fstr->bv_len = sizeof("(%)") - 1;
 723                 fstr->bv_val = malloc( fstr->bv_len + 128 );
 724
 725                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 726                         f->f_choice == LDAP_FILTER_AND ? '&' :
 727                         f->f_choice == LDAP_FILTER_OR ? '|' : '!' );
 728
 729                 for ( p = f->f_list; p != NULL; p = p->f_next ) {
 730                         len = fstr->bv_len;
 731
 732                         filter2bv( p, &tmp );
 733
 734                         fstr->bv_len += tmp.bv_len;
 735                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 736
 737                         snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
 738                                 /*"("*/ "%s)", tmp.bv_val );
 739
 740                         ch_free( tmp.bv_val );
 741                 }
 742
 743                 break;
 744
 745         case LDAP_FILTER_EXT:
 746                 filter_escape_value( &f->f_mr_value, &tmp );
 747
 748                 fstr->bv_len = f->f_mr_desc->ad_cname.bv_len +
 749                         ( f->f_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
 750                         ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
 751                         tmp.bv_len + ( sizeof("(:=)") - 1 );
 752                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 753
 754                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
 755                         f->f_mr_desc->ad_cname.bv_val,
 756                         f->f_mr_dnattrs ? ":dn" : "",
 757                         f->f_mr_rule_text.bv_len ? ":" : "",
 758                         f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
 759                         tmp.bv_val );
 760                 ber_memfree( tmp.bv_val );
 761                 break;
 762
 763         case SLAPD_FILTER_COMPUTED:
 764                 ber_str2bv(
 765                         f->f_result == LDAP_COMPARE_FALSE ? "(?=false)" :
 766                         f->f_result == LDAP_COMPARE_TRUE ? "(?=true)" :
 767                         f->f_result == SLAPD_COMPARE_UNDEFINED ? "(?=undefined)" :
 768                         "(?=error)",
 769                         f->f_result == LDAP_COMPARE_FALSE ? sizeof("(?=false)")-1 :
 770                         f->f_result == LDAP_COMPARE_TRUE ? sizeof("(?=true)")-1 :
 771                         f->f_result == SLAPD_COMPARE_UNDEFINED ? sizeof("(?=undefined)")-1 :
 772                         sizeof("(?=error)")-1,
 773                         1, fstr );
 774                 break;
 775
 776         default:
 777                 ber_str2bv( "(?=unknown)", sizeof("(?=unknown)")-1, 1, fstr );
 778                 break;
 779         }
 780 }
 781
 782 static int filter_escape_value(
 783         struct berval *in,
 784         struct berval *out )
 785 {
 786         ber_len_t i;
 787         assert( in );
 788         assert( out );
 789
 790         out->bv_val = (char *) ch_malloc( ( in->bv_len * 3 ) + 1 );
 791         out->bv_len = 0;
 792
 793         for( i=0; i < in->bv_len ; i++ ) {
 794                 if( FILTER_ESCAPE(in->bv_val[i]) ) {
 795                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_CHAR;
 796                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_HI( in->bv_val[i] );
 797                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_LO( in->bv_val[i] );
 798                 } else {
 799                         out->bv_val[out->bv_len++] = in->bv_val[i];
 800                 }
 801         }
 802
 803         out->bv_val[out->bv_len] = '\0';
 804         return LDAP_SUCCESS;
 805 }
 806
 807 static int
 808 get_simple_vrFilter(
 809         Connection *conn,
 810         BerElement *ber,
 811         ValuesReturnFilter **filt,
 812         const char **text )
 813 {
 814         ber_tag_t       tag;
 815         ber_len_t       len;
 816         int             err;
 817         ValuesReturnFilter *f;
 818
 819 #ifdef NEW_LOGGING
 820         LDAP_LOG( FILTER, ENTRY,
 821                 "get_simple_vrFilter: conn %d\n", conn->c_connid, 0, 0 );
 822 #else
 823         Debug( LDAP_DEBUG_FILTER, "begin get_simple_vrFilter\n", 0, 0, 0 );
 824 #endif
 825
 826         tag = ber_peek_tag( ber, &len );
 827
 828         if( tag == LBER_ERROR ) {
 829                 *text = "error decoding filter";
 830                 return SLAPD_DISCONNECT;
 831         }
 832
 833         f = (ValuesReturnFilter *) ch_malloc( sizeof(ValuesReturnFilter) );
 834         f->f_next = NULL;
 835
 836         err = LDAP_SUCCESS;
 837         f->f_choice = tag;
 838
 839         switch ( f->f_choice ) {
 840         case LDAP_FILTER_EQUALITY:
 841 #ifdef NEW_LOGGING
 842                 LDAP_LOG( FILTER, DETAIL2,
 843                         "get_simple_vrFilter: conn %d  EQUALITY\n", conn->c_connid, 0, 0 );
 844 #else
 845                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 846 #endif
 847                 err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY, text );
 848                 if ( err != LDAP_SUCCESS ) {
 849                         break;
 850                 }
 851
 852                 assert( f->f_ava != NULL );
 853                 break;
 854
 855         case LDAP_FILTER_SUBSTRINGS:
 856 #ifdef NEW_LOGGING
 857                 LDAP_LOG( FILTER, DETAIL1,
 858                         "get_simple_vrFilter: conn %d  SUBSTRINGS\n", conn->c_connid, 0, 0 );
 859 #else
 860                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 861 #endif
 862                 err = get_substring_filter( conn, ber, (Filter *)f, text );
 863                 break;
 864
 865         case LDAP_FILTER_GE:
 866 #ifdef NEW_LOGGING
 867                 LDAP_LOG( FILTER, DETAIL1,
 868                         "get_simple_vrFilter: conn %d  GE\n", conn->c_connid, 0, 0 );
 869 #else
 870                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 871 #endif
 872                 err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
 873                 if ( err != LDAP_SUCCESS ) {
 874                         break;
 875                 }
 876                 break;
 877
 878         case LDAP_FILTER_LE:
 879 #ifdef NEW_LOGGING
 880                 LDAP_LOG( FILTER, DETAIL1,
 881                         "get_simple_vrFilter: conn %d  LE\n", conn->c_connid, 0, 0 );
 882 #else
 883                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 884 #endif
 885                 err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
 886                 if ( err != LDAP_SUCCESS ) {
 887                         break;
 888                 }
 889                 break;
 890
 891         case LDAP_FILTER_PRESENT: {
 892                 struct berval type;
 893
 894 #ifdef NEW_LOGGING
 895                 LDAP_LOG( FILTER, DETAIL1,
 896                         "get_simple_vrFilter: conn %d PRESENT\n", conn->c_connid, 0, 0 );
 897 #else
 898                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 899 #endif
 900                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 901                         err = SLAPD_DISCONNECT;
 902                         *text = "error decoding filter";
 903                         break;
 904                 }
 905
 906                 f->f_desc = NULL;
 907                 err = slap_bv2ad( &type, &f->f_desc, text );
 908
 909                 if( err != LDAP_SUCCESS ) {
 910                         /* unrecognized attribute description or other error */
 911                         f->f_choice = SLAPD_FILTER_COMPUTED;
 912                         f->f_result = LDAP_COMPARE_FALSE;
 913                         err = LDAP_SUCCESS;
 914                         break;
 915                 }
 916                 } break;
 917
 918         case LDAP_FILTER_APPROX:
 919 #ifdef NEW_LOGGING
 920                 LDAP_LOG( FILTER, DETAIL1,
 921                         "get_simple_vrFilter: conn %d  APPROX\n", conn->c_connid, 0, 0 );
 922 #else
 923                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 924 #endif
 925                 err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY_APPROX, text );
 926                 if ( err != LDAP_SUCCESS ) {
 927                         break;
 928                 }
 929                 break;
 930
 931         case LDAP_FILTER_EXT:
 932 #ifdef NEW_LOGGING
 933                 LDAP_LOG( FILTER, DETAIL1,
 934                         "get_simple_vrFilter: conn %d  EXTENSIBLE\n", conn->c_connid, 0, 0 );
 935 #else
 936                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 937 #endif
 938
 939                 err = get_mra( ber, &f->f_mra, text );
 940                 if ( err != LDAP_SUCCESS ) {
 941                         break;
 942                 }
 943
 944                 assert( f->f_mra != NULL );
 945                 break;
 946
 947         default:
 948                 (void) ber_scanf( ber, "x" ); /* skip the element */
 949 #ifdef NEW_LOGGING
 950                 LDAP_LOG( FILTER, ERR,
 951                         "get_simple_vrFilter: conn %d unknown filter type=%lu\n",
 952                         conn->c_connid, f->f_choice, 0 );
 953 #else
 954                 Debug( LDAP_DEBUG_ANY, "get_simple_vrFilter: unknown filter type=%lu\n",
 955                         f->f_choice, 0, 0 );
 956 #endif
 957                 f->f_choice = SLAPD_FILTER_COMPUTED;
 958                 f->f_result = SLAPD_COMPARE_UNDEFINED;
 959                 break;
 960         }
 961
 962         if ( err != LDAP_SUCCESS ) {
 963                 if( err != SLAPD_DISCONNECT ) {
 964                         /* ignore error */
 965                         f->f_choice = SLAPD_FILTER_COMPUTED;
 966                         f->f_result = SLAPD_COMPARE_UNDEFINED;
 967                         err = LDAP_SUCCESS;
 968                         *filt = f;
 969
 970                 } else {
 971                         free(f);
 972                 }
 973
 974         } else {
 975                 *filt = f;
 976         }
 977
 978 #ifdef NEW_LOGGING
 979         LDAP_LOG( FILTER, DETAIL2,
 980                 "get_simple_vrFilter: conn %d exit\n", conn->c_connid, 0, 0 );
 981 #else
 982         Debug( LDAP_DEBUG_FILTER, "end get_simple_vrFilter %d\n", err, 0, 0 );
 983 #endif
 984         return( err );
 985 }
 986
 987 int
 988 get_vrFilter( Connection *conn, BerElement *ber,
 989         ValuesReturnFilter **f,
 990         const char **text )
 991 {
 992         /*
 993          * A ValuesReturnFilter looks like this:
 994          *
 995          *      ValuesReturnFilter ::= SEQUENCE OF SimpleFilterItem
 996          *      SimpleFilterItem ::= CHOICE {
 997          *              equalityMatch   [3]     AttributeValueAssertion,
 998          *              substrings      [4]     SubstringFilter,
 999          *              greaterOrEqual  [5]     AttributeValueAssertion,
1000          *              lessOrEqual     [6]     AttributeValueAssertion,
1001          *              present         [7]     AttributeType,
1002          *              approxMatch     [8]     AttributeValueAssertion,
1003          *              extensibleMatch [9]     SimpleMatchingAssertion -- LDAPv3
1004          *      }
1005          *
1006          *      SubstringFilter ::= SEQUENCE {
1007          *              type               AttributeType,
1008          *              SEQUENCE OF CHOICE {
1009          *                      initial          [0] IA5String,
1010          *                      any              [1] IA5String,
1011          *                      final            [2] IA5String
1012          *              }
1013          *      }
1014          *
1015          *      SimpleMatchingAssertion ::= SEQUENCE {  -- LDAPv3
1016          *              matchingRule    [1] MatchingRuleId OPTIONAL,
1017          *              type            [2] AttributeDescription OPTIONAL,
1018          *              matchValue      [3] AssertionValue }
1019          */
1020
1021         ValuesReturnFilter **new;
1022         ber_tag_t       tag;
1023         ber_len_t       len;
1024         char            *last;
1025
1026 #ifdef NEW_LOGGING
1027         LDAP_LOG( FILTER, ENTRY,
1028                 "get_vrFilter: conn %d start\n", conn->c_connid, 0, 0 );
1029 #else
1030         Debug( LDAP_DEBUG_FILTER, "begin get_vrFilter\n", 0, 0, 0 );
1031 #endif
1032
1033         tag = ber_peek_tag( ber, &len );
1034
1035         if( tag == LBER_ERROR ) {
1036                 *text = "error decoding vrFilter";
1037                 return SLAPD_DISCONNECT;
1038         }
1039
1040         if( tag != LBER_SEQUENCE ) {
1041                 *text = "error decoding vrFilter, expect SEQUENCE tag";
1042                 return SLAPD_DISCONNECT;
1043         }
1044
1045         new = f;
1046         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
1047                 tag = ber_next_element( ber, &len, last ) )
1048         {
1049                 int err = get_simple_vrFilter( conn, ber, new, text );
1050                 if ( err != LDAP_SUCCESS )
1051                         return( err );
1052                 new = &(*new)->f_next;
1053         }
1054         *new = NULL;
1055
1056 #ifdef NEW_LOGGING
1057         LDAP_LOG( FILTER, ENTRY,
1058                 "get_vrFilter: conn %d exit\n", conn->c_connid, 0, 0 );
1059 #else
1060         Debug( LDAP_DEBUG_FILTER, "end get_vrFilter\n", 0, 0, 0 );
1061 #endif
1062         return( LDAP_SUCCESS );
1063 }
1064
1065 void
1066 vrFilter_free( ValuesReturnFilter *f )
1067 {
1068         ValuesReturnFilter      *p, *next;
1069
1070         if ( f == NULL ) {
1071                 return;
1072         }
1073
1074         for ( p = f; p != NULL; p = next ) {
1075                 next = p->f_next;
1076
1077                 switch ( f->f_choice ) {
1078                 case LDAP_FILTER_PRESENT:
1079                         break;
1080
1081                 case LDAP_FILTER_EQUALITY:
1082                 case LDAP_FILTER_GE:
1083                 case LDAP_FILTER_LE:
1084                 case LDAP_FILTER_APPROX:
1085                         ava_free( f->f_ava, 1 );
1086                         break;
1087
1088                 case LDAP_FILTER_SUBSTRINGS:
1089                         if ( f->f_sub_initial.bv_val != NULL ) {
1090                                 free( f->f_sub_initial.bv_val );
1091                         }
1092                         ber_bvarray_free( f->f_sub_any );
1093                         if ( f->f_sub_final.bv_val != NULL ) {
1094                                 free( f->f_sub_final.bv_val );
1095                         }
1096                         ch_free( f->f_sub );
1097                         break;
1098
1099                 case LDAP_FILTER_EXT:
1100                         mra_free( f->f_mra, 1 );
1101                         break;
1102
1103                 case SLAPD_FILTER_COMPUTED:
1104                         break;
1105
1106                 default:
1107 #ifdef NEW_LOGGING
1108                         LDAP_LOG( FILTER, ERR,
1109                                 "filter_free: unknown filter type %lu\n", f->f_choice, 0, 0 );
1110 #else
1111                         Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
1112                                 f->f_choice, 0, 0 );
1113 #endif
1114                         break;
1115                 }
1116
1117                 free( f );
1118         }
1119 }
1120
1121
1122 void
1123 vrFilter2bv( ValuesReturnFilter *f, struct berval *fstr )
1124 {
1125         ValuesReturnFilter      *p;
1126         struct berval tmp;
1127         ber_len_t len;
1128
1129         if ( f == NULL ) {
1130                 ber_str2bv( "No filter!", sizeof("No filter!")-1, 1, fstr );
1131                 return;
1132         }
1133
1134         fstr->bv_len = sizeof("()") - 1;
1135         fstr->bv_val = malloc( fstr->bv_len + 128 );
1136
1137         snprintf( fstr->bv_val, fstr->bv_len + 1, "()");
1138
1139         for ( p = f; p != NULL; p = p->f_next ) {
1140                 len = fstr->bv_len;
1141
1142                 simple_vrFilter2bv( p, &tmp );
1143
1144                 fstr->bv_len += tmp.bv_len;
1145                 fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1146
1147                 snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
1148                         /*"("*/ "%s)", tmp.bv_val );
1149
1150                 ch_free( tmp.bv_val );
1151         }
1152 }
1153
1154 static void
1155 simple_vrFilter2bv( ValuesReturnFilter *f, struct berval *fstr )
1156 {
1157         struct berval tmp;
1158         ber_len_t len;
1159
1160         if ( f == NULL ) {
1161                 ber_str2bv( "No filter!", sizeof("No filter!")-1, 1, fstr );
1162                 return;
1163         }
1164
1165         switch ( f->f_choice ) {
1166         case LDAP_FILTER_EQUALITY:
1167                 filter_escape_value( &f->f_av_value, &tmp );
1168
1169                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
1170                         tmp.bv_len + ( sizeof("(=)") - 1 );
1171                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1172
1173                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
1174                         f->f_av_desc->ad_cname.bv_val,
1175                         tmp.bv_val );
1176
1177                 ber_memfree( tmp.bv_val );
1178                 break;
1179
1180         case LDAP_FILTER_GE:
1181                 filter_escape_value( &f->f_av_value, &tmp );
1182
1183                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
1184                         tmp.bv_len + ( sizeof("(>=)") - 1 );
1185                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1186
1187                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
1188                         f->f_av_desc->ad_cname.bv_val,
1189                         tmp.bv_val );
1190
1191                 ber_memfree( tmp.bv_val );
1192                 break;
1193
1194         case LDAP_FILTER_LE:
1195                 filter_escape_value( &f->f_av_value, &tmp );
1196
1197                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
1198                         tmp.bv_len + ( sizeof("(<=)") - 1 );
1199                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1200
1201                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
1202                         f->f_av_desc->ad_cname.bv_val,
1203                         tmp.bv_val );
1204
1205                 ber_memfree( tmp.bv_val );
1206                 break;
1207
1208         case LDAP_FILTER_APPROX:
1209                 filter_escape_value( &f->f_av_value, &tmp );
1210
1211                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
1212                         tmp.bv_len + ( sizeof("(~=)") - 1 );
1213                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1214
1215                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
1216                         f->f_av_desc->ad_cname.bv_val,
1217                         tmp.bv_val );
1218                 ber_memfree( tmp.bv_val );
1219                 break;
1220
1221         case LDAP_FILTER_SUBSTRINGS:
1222                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
1223                         ( sizeof("(=*)") - 1 );
1224                 fstr->bv_val = malloc( fstr->bv_len + 128 );
1225
1226                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1227                         f->f_sub_desc->ad_cname.bv_val );
1228
1229                 if ( f->f_sub_initial.bv_val != NULL ) {
1230                         len = fstr->bv_len;
1231
1232                         filter_escape_value( &f->f_sub_initial, &tmp );
1233
1234                         fstr->bv_len += tmp.bv_len;
1235                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1236
1237                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
1238                                 /* "(attr=" */ "%s*)",
1239                                 tmp.bv_val );
1240
1241                         ber_memfree( tmp.bv_val );
1242                 }
1243
1244                 if ( f->f_sub_any != NULL ) {
1245                         int i;
1246                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
1247                                 len = fstr->bv_len;
1248                                 filter_escape_value( &f->f_sub_any[i], &tmp );
1249
1250                                 fstr->bv_len += tmp.bv_len + 1;
1251                                 fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1252
1253                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1254                                         /* "(attr=[init]*[any*]" */ "%s*)",
1255                                         tmp.bv_val );
1256                                 ber_memfree( tmp.bv_val );
1257                         }
1258                 }
1259
1260                 if ( f->f_sub_final.bv_val != NULL ) {
1261                         len = fstr->bv_len;
1262
1263                         filter_escape_value( &f->f_sub_final, &tmp );
1264
1265                         fstr->bv_len += tmp.bv_len;
1266                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1267
1268                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1269                                 /* "(attr=[init*][any*]" */ "%s)",
1270                                 tmp.bv_val );
1271
1272                         ber_memfree( tmp.bv_val );
1273                 }
1274
1275                 break;
1276
1277         case LDAP_FILTER_PRESENT:
1278                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
1279                         ( sizeof("(=*)") - 1 );
1280                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1281
1282                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1283                         f->f_desc->ad_cname.bv_val );
1284                 break;
1285
1286         case LDAP_FILTER_EXT:
1287                 filter_escape_value( &f->f_mr_value, &tmp );
1288
1289                 fstr->bv_len = f->f_mr_desc->ad_cname.bv_len +
1290                         ( f->f_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
1291                         ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
1292                         tmp.bv_len + ( sizeof("(:=)") - 1 );
1293                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1294
1295                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
1296                         f->f_mr_desc->ad_cname.bv_val,
1297                         f->f_mr_dnattrs ? ":dn" : "",
1298                         f->f_mr_rule_text.bv_len ? ":" : "",
1299                         f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
1300                         tmp.bv_val );
1301                 ber_memfree( tmp.bv_val );
1302                 break;
1303
1304         case SLAPD_FILTER_COMPUTED:
1305                 ber_str2bv(
1306                         f->f_result == LDAP_COMPARE_FALSE ? "(?=false)" :
1307                         f->f_result == LDAP_COMPARE_TRUE ? "(?=true)" :
1308                         f->f_result == SLAPD_COMPARE_UNDEFINED ? "(?=undefined)" :
1309                         "(?=error)",
1310                         f->f_result == LDAP_COMPARE_FALSE ? sizeof("(?=false)")-1 :
1311                         f->f_result == LDAP_COMPARE_TRUE ? sizeof("(?=true)")-1 :
1312                         f->f_result == SLAPD_COMPARE_UNDEFINED ? sizeof("(?=undefined)")-1 :
1313                         sizeof("(?=error)")-1,
1314                         1, fstr );
1315                 break;
1316
1317         default:
1318                 ber_str2bv( "(?=unknown)", sizeof("(?=unknown)")-1, 1, fstr );
1319                 break;
1320         }
1321 }
1322
1323 static int
1324 get_substring_vrFilter(
1325         Connection      *conn,
1326         BerElement      *ber,
1327         ValuesReturnFilter      *f,
1328         const char      **text )
1329 {
1330         ber_tag_t       tag;
1331         ber_len_t       len;
1332         ber_tag_t       rc;
1333         struct berval value;
1334         char            *last;
1335         struct berval bv;
1336         *text = "error decoding filter";
1337
1338 #ifdef NEW_LOGGING
1339         LDAP_LOG( FILTER, ENTRY,
1340                 "get_substring_filter: conn %d  begin\n", conn->c_connid, 0, 0 );
1341 #else
1342         Debug( LDAP_DEBUG_FILTER, "begin get_substring_filter\n", 0, 0, 0 );
1343 #endif
1344         if ( ber_scanf( ber, "{m" /*}*/, &bv ) == LBER_ERROR ) {
1345                 return SLAPD_DISCONNECT;
1346         }
1347
1348         f->f_sub = ch_calloc( 1, sizeof(SubstringsAssertion) );
1349         f->f_sub_desc = NULL;
1350         rc = slap_bv2ad( &bv, &f->f_sub_desc, text );
1351
1352         if( rc != LDAP_SUCCESS ) {
1353                 text = NULL;
1354                 ch_free( f->f_sub );
1355                 f->f_choice = SLAPD_FILTER_COMPUTED;
1356                 f->f_result = SLAPD_COMPARE_UNDEFINED;
1357                 return LDAP_SUCCESS;
1358         }
1359
1360         f->f_sub_initial.bv_val = NULL;
1361         f->f_sub_any = NULL;
1362         f->f_sub_final.bv_val = NULL;
1363
1364         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
1365                 tag = ber_next_element( ber, &len, last ) )
1366         {
1367                 unsigned usage;
1368
1369                 rc = ber_scanf( ber, "m", &value );
1370                 if ( rc == LBER_ERROR ) {
1371                         rc = SLAPD_DISCONNECT;
1372                         goto return_error;
1373                 }
1374
1375                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
1376                         rc = LDAP_INVALID_SYNTAX;
1377                         goto return_error;
1378                 }
1379
1380                 switch ( tag ) {
1381                 case LDAP_SUBSTRING_INITIAL:
1382                         usage = SLAP_MR_SUBSTR_INITIAL;
1383                         break;
1384
1385                 case LDAP_SUBSTRING_ANY:
1386                         usage = SLAP_MR_SUBSTR_ANY;
1387                         break;
1388
1389                 case LDAP_SUBSTRING_FINAL:
1390                         usage = SLAP_MR_SUBSTR_FINAL;
1391                         break;
1392
1393                 default:
1394                         rc = LDAP_PROTOCOL_ERROR;
1395
1396 #ifdef NEW_LOGGING
1397                         LDAP_LOG( FILTER, ERR,
1398                                 "get_filter_substring: conn %d  unknown substring choice=%ld\n",
1399                                 conn->c_connid, (long)tag, 0 );
1400 #else
1401                         Debug( LDAP_DEBUG_FILTER,
1402                                 "  unknown substring choice=%ld\n",
1403                                 (long) tag, 0, 0 );
1404 #endif
1405                         goto return_error;
1406                 }
1407
1408                 /* valiate using equality matching rule validator! */
1409                 rc = value_validate( f->f_sub_desc->ad_type->sat_equality,
1410                         &value, text );
1411                 if( rc != LDAP_SUCCESS ) {
1412                         goto return_error;
1413                 }
1414
1415                 rc = value_normalize( f->f_sub_desc, usage,
1416                         &value, &bv, text );
1417                 if( rc != LDAP_SUCCESS ) {
1418                         goto return_error;
1419                 }
1420
1421                 value = bv;
1422
1423                 rc = LDAP_PROTOCOL_ERROR;
1424
1425                 switch ( tag ) {
1426                 case LDAP_SUBSTRING_INITIAL:
1427 #ifdef NEW_LOGGING
1428                         LDAP_LOG( FILTER, DETAIL1,
1429                                 "get_substring_filter: conn %d  INITIAL\n",
1430                                 conn->c_connid, 0, 0 );
1431 #else
1432                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
1433 #endif
1434
1435                         if ( f->f_sub_initial.bv_val != NULL
1436                                 || f->f_sub_any != NULL
1437                                 || f->f_sub_final.bv_val != NULL )
1438                         {
1439                                 free( value.bv_val );
1440                                 goto return_error;
1441                         }
1442
1443                         f->f_sub_initial = value;
1444                         break;
1445
1446                 case LDAP_SUBSTRING_ANY:
1447 #ifdef NEW_LOGGING
1448                         LDAP_LOG( FILTER, DETAIL1,
1449                                 "get_substring_filter: conn %d  ANY\n", conn->c_connid, 0, 0 );
1450 #else
1451                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
1452 #endif
1453
1454                         if ( f->f_sub_final.bv_val != NULL ) {
1455                                 free( value.bv_val );
1456                                 goto return_error;
1457                         }
1458
1459                         ber_bvarray_add( &f->f_sub_any, &value );
1460                         break;
1461
1462                 case LDAP_SUBSTRING_FINAL:
1463 #ifdef NEW_LOGGING
1464                         LDAP_LOG( FILTER, DETAIL1,
1465                                 "get_substring_filter: conn %d  FINAL\n", conn->c_connid, 0, 0 );
1466 #else
1467                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
1468 #endif
1469
1470                         if ( f->f_sub_final.bv_val != NULL ) {
1471                                 free( value.bv_val );
1472                                 goto return_error;
1473                         }
1474
1475                         f->f_sub_final = value;
1476                         break;
1477
1478                 default:
1479 #ifdef NEW_LOGGING
1480                         LDAP_LOG( FILTER, INFO,
1481                                 "get_substring_filter: conn %d  unknown substring type %ld\n",
1482                                 conn->c_connid, (long)tag, 0 );
1483 #else
1484                         Debug( LDAP_DEBUG_FILTER,
1485                                 "  unknown substring type=%ld\n",
1486                                 (long) tag, 0, 0 );
1487 #endif
1488
1489                         free( value.bv_val );
1490
1491 return_error:
1492 #ifdef NEW_LOGGING
1493                         LDAP_LOG( FILTER, INFO,
1494                                 "get_substring_filter: conn %d  error %ld\n",
1495                                 conn->c_connid, (long)rc, 0 );
1496 #else
1497                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
1498                                 (long) rc, 0, 0 );
1499 #endif
1500                         free( f->f_sub_initial.bv_val );
1501                         ber_bvarray_free( f->f_sub_any );
1502                         free( f->f_sub_final.bv_val );
1503                         ch_free( f->f_sub );
1504                         return rc;
1505                 }
1506         }
1507
1508 #ifdef NEW_LOGGING
1509         LDAP_LOG( FILTER, ENTRY,
1510                 "get_substring_filter: conn %d exit\n", conn->c_connid, 0, 0 );
1511 #else
1512         Debug( LDAP_DEBUG_FILTER, "end get_substring_filter\n", 0, 0, 0 );
1513 #endif
1514         return( LDAP_SUCCESS );
1515 }
1516