git.sur5r.net Git - openldap/blob - servers/slapd/filter.c

   1 /* filter.c - routines for parsing and dealing with filters */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2006 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/socket.h>
  32 #include <ac/string.h>
  33
  34 #include "slap.h"
  35
  36 static int      get_filter_list(
  37         Operation *op,
  38         BerElement *ber,
  39         Filter **f,
  40         const char **text );
  41
  42 static int      get_ssa(
  43         Operation *op,
  44         BerElement *ber,
  45         SubstringsAssertion **s,
  46         const char **text );
  47
  48 static void simple_vrFilter2bv(
  49         Operation *op,
  50         ValuesReturnFilter *f,
  51         struct berval *fstr );
  52
  53 static int      get_simple_vrFilter(
  54         Operation *op,
  55         BerElement *ber,
  56         ValuesReturnFilter **f,
  57         const char **text );
  58
  59 int
  60 get_filter(
  61         Operation *op,
  62         BerElement *ber,
  63         Filter **filt,
  64         const char **text )
  65 {
  66         ber_tag_t       tag;
  67         ber_len_t       len;
  68         int             err;
  69         Filter          f;
  70
  71         Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
  72         /*
  73          * A filter looks like this coming in:
  74          *      Filter ::= CHOICE {
  75          *              and             [0]     SET OF Filter,
  76          *              or              [1]     SET OF Filter,
  77          *              not             [2]     Filter,
  78          *              equalityMatch   [3]     AttributeValueAssertion,
  79          *              substrings      [4]     SubstringFilter,
  80          *              greaterOrEqual  [5]     AttributeValueAssertion,
  81          *              lessOrEqual     [6]     AttributeValueAssertion,
  82          *              present         [7]     AttributeType,,
  83          *              approxMatch     [8]     AttributeValueAssertion
  84          *              extensibleMatch [9]     MatchingRuleAssertion
  85          *      }
  86          *
  87          *      SubstringFilter ::= SEQUENCE {
  88          *              type               AttributeType,
  89          *              SEQUENCE OF CHOICE {
  90          *                      initial          [0] IA5String,
  91          *                      any              [1] IA5String,
  92          *                      final            [2] IA5String
  93          *              }
  94          *      }
  95          *
  96          *      MatchingRuleAssertion ::= SEQUENCE {
  97          *              matchingRule    [1] MatchingRuleId OPTIONAL,
  98          *              type            [2] AttributeDescription OPTIONAL,
  99          *              matchValue      [3] AssertionValue,
 100          *              dnAttributes    [4] BOOLEAN DEFAULT FALSE
 101          *      }
 102          *
 103          */
 104
 105         tag = ber_peek_tag( ber, &len );
 106
 107         if( tag == LBER_ERROR ) {
 108                 *text = "error decoding filter";
 109                 return SLAPD_DISCONNECT;
 110         }
 111
 112         err = LDAP_SUCCESS;
 113
 114         f.f_next = NULL;
 115         f.f_choice = tag;
 116
 117         switch ( f.f_choice ) {
 118         case LDAP_FILTER_EQUALITY:
 119                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 120                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_EQUALITY, text );
 121                 if ( err != LDAP_SUCCESS ) {
 122                         break;
 123                 }
 124
 125                 assert( f.f_ava != NULL );
 126                 break;
 127
 128         case LDAP_FILTER_SUBSTRINGS:
 129                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 130                 err = get_ssa( op, ber, &f.f_sub, text );
 131                 if( err != LDAP_SUCCESS ) {
 132                         break;
 133                 }
 134                 assert( f.f_sub != NULL );
 135                 break;
 136
 137         case LDAP_FILTER_GE:
 138                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 139                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_ORDERING, text );
 140                 if ( err != LDAP_SUCCESS ) {
 141                         break;
 142                 }
 143                 assert( f.f_ava != NULL );
 144                 break;
 145
 146         case LDAP_FILTER_LE:
 147                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 148                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_ORDERING, text );
 149                 if ( err != LDAP_SUCCESS ) {
 150                         break;
 151                 }
 152                 assert( f.f_ava != NULL );
 153                 break;
 154
 155         case LDAP_FILTER_PRESENT: {
 156                 struct berval type;
 157
 158                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 159                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 160                         err = SLAPD_DISCONNECT;
 161                         *text = "error decoding filter";
 162                         break;
 163                 }
 164
 165                 f.f_desc = NULL;
 166                 err = slap_bv2ad( &type, &f.f_desc, text );
 167
 168                 if( err != LDAP_SUCCESS ) {
 169                         err = slap_bv2undef_ad( &type, &f.f_desc, text,
 170                                 SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 171
 172                         if ( err != LDAP_SUCCESS ) {
 173                                 /* unrecognized attribute description or other error */
 174                                 Debug( LDAP_DEBUG_ANY,
 175                                         "get_filter: conn %lu unknown attribute "
 176                                         "type=%s (%d)\n",
 177                                         op->o_connid, type.bv_val, err );
 178
 179                                 f.f_choice = SLAPD_FILTER_COMPUTED;
 180                                 f.f_result = LDAP_COMPARE_FALSE;
 181                                 err = LDAP_SUCCESS;
 182                                 *text = NULL;
 183                                 break;
 184                         }
 185                 }
 186
 187                 assert( f.f_desc != NULL );
 188                 } break;
 189
 190         case LDAP_FILTER_APPROX:
 191                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 192                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_EQUALITY_APPROX, text );
 193                 if ( err != LDAP_SUCCESS ) {
 194                         break;
 195                 }
 196                 assert( f.f_ava != NULL );
 197                 break;
 198
 199         case LDAP_FILTER_AND:
 200                 Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
 201                 err = get_filter_list( op, ber, &f.f_and, text );
 202                 if ( err != LDAP_SUCCESS ) {
 203                         break;
 204                 }
 205                 if ( f.f_and == NULL ) {
 206                         f.f_choice = SLAPD_FILTER_COMPUTED;
 207                         f.f_result = LDAP_COMPARE_TRUE;
 208                 }
 209                 /* no assert - list could be empty */
 210                 break;
 211
 212         case LDAP_FILTER_OR:
 213                 Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
 214                 err = get_filter_list( op, ber, &f.f_or, text );
 215                 if ( err != LDAP_SUCCESS ) {
 216                         break;
 217                 }
 218                 if ( f.f_or == NULL ) {
 219                         f.f_choice = SLAPD_FILTER_COMPUTED;
 220                         f.f_result = LDAP_COMPARE_FALSE;
 221                 }
 222                 /* no assert - list could be empty */
 223                 break;
 224
 225         case LDAP_FILTER_NOT:
 226                 Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
 227                 (void) ber_skip_tag( ber, &len );
 228                 err = get_filter( op, ber, &f.f_not, text );
 229                 if ( err != LDAP_SUCCESS ) {
 230                         break;
 231                 }
 232
 233                 assert( f.f_not != NULL );
 234                 if ( f.f_not->f_choice == SLAPD_FILTER_COMPUTED ) {
 235                         int fresult = f.f_not->f_result;
 236                         f.f_choice = SLAPD_FILTER_COMPUTED;
 237                         op->o_tmpfree( f.f_not, op->o_tmpmemctx );
 238                         f.f_not = NULL;
 239
 240                         switch( fresult ) {
 241                         case LDAP_COMPARE_TRUE:
 242                                 f.f_result = LDAP_COMPARE_FALSE;
 243                                 break;
 244                         case LDAP_COMPARE_FALSE:
 245                                 f.f_result = LDAP_COMPARE_TRUE;
 246                                 break;
 247                         default: ;
 248                                 /* (!Undefined) is Undefined */
 249                         }
 250                 }
 251                 break;
 252
 253         case LDAP_FILTER_EXT:
 254                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 255
 256                 err = get_mra( op, ber, &f.f_mra, text );
 257                 if ( err != LDAP_SUCCESS ) {
 258                         break;
 259                 }
 260
 261                 assert( f.f_mra != NULL );
 262                 break;
 263
 264         default:
 265                 (void) ber_scanf( ber, "x" ); /* skip the element */
 266                 Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
 267                         f.f_choice, 0, 0 );
 268                 f.f_choice = SLAPD_FILTER_COMPUTED;
 269                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 270                 break;
 271         }
 272
 273         if( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 274                 /* ignore error */
 275                 *text = NULL;
 276                 f.f_choice = SLAPD_FILTER_COMPUTED;
 277                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 278                 err = LDAP_SUCCESS;
 279         }
 280
 281         if ( err == LDAP_SUCCESS ) {
 282                 *filt = op->o_tmpalloc( sizeof(f), op->o_tmpmemctx );
 283                 **filt = f;
 284         }
 285
 286         Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
 287
 288         return( err );
 289 }
 290
 291 static int
 292 get_filter_list( Operation *op, BerElement *ber,
 293         Filter **f,
 294         const char **text )
 295 {
 296         Filter          **new;
 297         int             err;
 298         ber_tag_t       tag;
 299         ber_len_t       len;
 300         char            *last;
 301
 302         Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
 303         new = f;
 304         for ( tag = ber_first_element( ber, &len, &last );
 305                 tag != LBER_DEFAULT;
 306                 tag = ber_next_element( ber, &len, last ) )
 307         {
 308                 err = get_filter( op, ber, new, text );
 309                 if ( err != LDAP_SUCCESS )
 310                         return( err );
 311                 new = &(*new)->f_next;
 312         }
 313         *new = NULL;
 314
 315         Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
 316         return( LDAP_SUCCESS );
 317 }
 318
 319 static int
 320 get_ssa(
 321         Operation *op,
 322         BerElement      *ber,
 323         SubstringsAssertion     **out,
 324         const char      **text )
 325 {
 326         ber_tag_t       tag;
 327         ber_len_t       len;
 328         ber_tag_t       rc;
 329         struct berval desc, value, nvalue;
 330         char            *last;
 331         SubstringsAssertion ssa;
 332
 333         *text = "error decoding filter";
 334         *out = NULL;
 335
 336         Debug( LDAP_DEBUG_FILTER, "begin get_ssa\n", 0, 0, 0 );
 337         if ( ber_scanf( ber, "{m" /*}*/, &desc ) == LBER_ERROR ) {
 338                 return SLAPD_DISCONNECT;
 339         }
 340
 341         *text = NULL;
 342
 343         ssa.sa_desc = NULL;
 344         ssa.sa_initial.bv_val = NULL;
 345         ssa.sa_any = NULL;
 346         ssa.sa_final.bv_val = NULL;
 347
 348         rc = slap_bv2ad( &desc, &ssa.sa_desc, text );
 349
 350         if( rc != LDAP_SUCCESS ) {
 351                 rc = slap_bv2undef_ad( &desc, &ssa.sa_desc, text,
 352                         SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 353
 354                 if( rc != LDAP_SUCCESS ) {
 355                         Debug( LDAP_DEBUG_ANY,
 356                                 "get_ssa: conn %lu unknown attribute type=%s (%ld)\n",
 357                                 op->o_connid, desc.bv_val, (long) rc );
 358
 359                         /* skip over the rest of this filter */
 360                         for ( tag = ber_first_element( ber, &len, &last );
 361                                 tag != LBER_DEFAULT;
 362                                 tag = ber_next_element( ber, &len, last ) ) {
 363                                 ber_scanf( ber, "x" );
 364                         }
 365                         return rc;
 366                 }
 367         }
 368
 369         rc = LDAP_PROTOCOL_ERROR;
 370
 371         for ( tag = ber_first_element( ber, &len, &last );
 372                 tag != LBER_DEFAULT;
 373                 tag = ber_next_element( ber, &len, last ) )
 374         {
 375                 unsigned usage;
 376
 377                 rc = ber_scanf( ber, "m", &value );
 378                 if ( rc == LBER_ERROR ) {
 379                         rc = SLAPD_DISCONNECT;
 380                         goto return_error;
 381                 }
 382
 383                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
 384                         rc = LDAP_INVALID_SYNTAX;
 385                         goto return_error;
 386                 }
 387
 388                 switch ( tag ) {
 389                 case LDAP_SUBSTRING_INITIAL:
 390                         if ( ssa.sa_initial.bv_val != NULL
 391                                 || ssa.sa_any != NULL
 392                                 || ssa.sa_final.bv_val != NULL )
 393                         {
 394                                 rc = LDAP_PROTOCOL_ERROR;
 395                                 goto return_error;
 396                         }
 397                         usage = SLAP_MR_SUBSTR_INITIAL;
 398                         break;
 399
 400                 case LDAP_SUBSTRING_ANY:
 401                         if ( ssa.sa_final.bv_val != NULL ) {
 402                                 rc = LDAP_PROTOCOL_ERROR;
 403                                 goto return_error;
 404                         }
 405                         usage = SLAP_MR_SUBSTR_ANY;
 406                         break;
 407
 408                 case LDAP_SUBSTRING_FINAL:
 409                         if ( ssa.sa_final.bv_val != NULL ) {
 410                                 rc = LDAP_PROTOCOL_ERROR;
 411                                 goto return_error;
 412                         }
 413
 414                         usage = SLAP_MR_SUBSTR_FINAL;
 415                         break;
 416
 417                 default:
 418                         Debug( LDAP_DEBUG_FILTER,
 419                                 "  unknown substring choice=%ld\n",
 420                                 (long) tag, 0, 0 );
 421
 422                         rc = LDAP_PROTOCOL_ERROR;
 423                         goto return_error;
 424                 }
 425
 426                 /* validate/normalize using equality matching rule validator! */
 427                 rc = asserted_value_validate_normalize(
 428                         ssa.sa_desc, ssa.sa_desc->ad_type->sat_equality,
 429                         usage, &value, &nvalue, text, op->o_tmpmemctx );
 430                 if( rc != LDAP_SUCCESS ) goto return_error;
 431
 432                 switch ( tag ) {
 433                 case LDAP_SUBSTRING_INITIAL:
 434                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
 435                         ssa.sa_initial = nvalue;
 436                         break;
 437
 438                 case LDAP_SUBSTRING_ANY:
 439                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
 440                         ber_bvarray_add_x( &ssa.sa_any, &nvalue, op->o_tmpmemctx );
 441                         break;
 442
 443                 case LDAP_SUBSTRING_FINAL:
 444                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
 445                         ssa.sa_final = nvalue;
 446                         break;
 447
 448                 default:
 449                         assert( 0 );
 450                         slap_sl_free( nvalue.bv_val, op->o_tmpmemctx );
 451                         rc = LDAP_PROTOCOL_ERROR;
 452
 453 return_error:
 454                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
 455                                 (long) rc, 0, 0 );
 456                         slap_sl_free( ssa.sa_initial.bv_val, op->o_tmpmemctx );
 457                         ber_bvarray_free_x( ssa.sa_any, op->o_tmpmemctx );
 458                         slap_sl_free( ssa.sa_final.bv_val, op->o_tmpmemctx );
 459                         return rc;
 460                 }
 461
 462                 rc = LDAP_SUCCESS;
 463         }
 464
 465         if( rc == LDAP_SUCCESS ) {
 466                 *out = op->o_tmpalloc( sizeof( ssa ), op->o_tmpmemctx );
 467                 **out = ssa;
 468         }
 469
 470         Debug( LDAP_DEBUG_FILTER, "end get_ssa\n", 0, 0, 0 );
 471         return rc /* LDAP_SUCCESS */ ;
 472 }
 473
 474 void
 475 filter_free_x( Operation *op, Filter *f )
 476 {
 477         Filter  *p, *next;
 478
 479         if ( f == NULL ) {
 480                 return;
 481         }
 482
 483         switch ( f->f_choice ) {
 484         case LDAP_FILTER_PRESENT:
 485                 break;
 486
 487         case LDAP_FILTER_EQUALITY:
 488         case LDAP_FILTER_GE:
 489         case LDAP_FILTER_LE:
 490         case LDAP_FILTER_APPROX:
 491                 ava_free( op, f->f_ava, 1 );
 492                 break;
 493
 494         case LDAP_FILTER_SUBSTRINGS:
 495                 if ( f->f_sub_initial.bv_val != NULL ) {
 496                         op->o_tmpfree( f->f_sub_initial.bv_val, op->o_tmpmemctx );
 497                 }
 498                 ber_bvarray_free_x( f->f_sub_any, op->o_tmpmemctx );
 499                 if ( f->f_sub_final.bv_val != NULL ) {
 500                         op->o_tmpfree( f->f_sub_final.bv_val, op->o_tmpmemctx );
 501                 }
 502                 op->o_tmpfree( f->f_sub, op->o_tmpmemctx );
 503                 break;
 504
 505         case LDAP_FILTER_AND:
 506         case LDAP_FILTER_OR:
 507         case LDAP_FILTER_NOT:
 508                 for ( p = f->f_list; p != NULL; p = next ) {
 509                         next = p->f_next;
 510                         filter_free_x( op, p );
 511                 }
 512                 break;
 513
 514         case LDAP_FILTER_EXT:
 515                 mra_free( op, f->f_mra, 1 );
 516                 break;
 517
 518         case SLAPD_FILTER_COMPUTED:
 519                 break;
 520
 521         default:
 522                 Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
 523                         f->f_choice, 0, 0 );
 524                 break;
 525         }
 526
 527         op->o_tmpfree( f, op->o_tmpmemctx );
 528 }
 529
 530 void
 531 filter_free( Filter *f )
 532 {
 533         Operation op;
 534         Opheader ohdr;
 535
 536         op.o_hdr = &ohdr;
 537         op.o_tmpmemctx = slap_sl_context( f );
 538         op.o_tmpmfuncs = &slap_sl_mfuncs;
 539         filter_free_x( &op, f );
 540 }
 541
 542 void
 543 filter2bv_x( Operation *op, Filter *f, struct berval *fstr )
 544 {
 545         int             i;
 546         Filter          *p;
 547         struct berval   tmp;
 548         static struct berval
 549                         ber_bvfalse = BER_BVC( "(?=false)" ),
 550                         ber_bvtrue = BER_BVC( "(?=true)" ),
 551                         ber_bvundefined = BER_BVC( "(?=undefined)" ),
 552                         ber_bverror = BER_BVC( "(?=error)" ),
 553                         ber_bvunknown = BER_BVC( "(?=unknown)" ),
 554                         ber_bvnone = BER_BVC( "(?=none)" );
 555         ber_len_t       len;
 556
 557         if ( f == NULL ) {
 558                 ber_dupbv_x( fstr, &ber_bvnone, op->o_tmpmemctx );
 559                 return;
 560         }
 561
 562         switch ( f->f_choice ) {
 563         case LDAP_FILTER_EQUALITY:
 564                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 565                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 566                  * since in a Filter values in AVAs are supposed
 567                  * to have been normalized, meaning that an empty value
 568                  * is legal for that attribute's syntax */
 569
 570                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 571                         tmp.bv_len + STRLENOF("(=)");
 572                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 573
 574                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
 575                         f->f_av_desc->ad_cname.bv_val,
 576                         tmp.bv_len ? tmp.bv_val : "" );
 577
 578                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 579                 break;
 580
 581         case LDAP_FILTER_GE:
 582                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 583                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 584                  * since in a Filter values in AVAs are supposed
 585                  * to have been normalized, meaning that an empty value
 586                  * is legal for that attribute's syntax */
 587
 588                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 589                         tmp.bv_len + STRLENOF("(>=)");
 590                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 591
 592                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
 593                         f->f_av_desc->ad_cname.bv_val,
 594                         tmp.bv_len ? tmp.bv_val : "");
 595
 596                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 597                 break;
 598
 599         case LDAP_FILTER_LE:
 600                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 601                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 602                  * since in a Filter values in AVAs are supposed
 603                  * to have been normalized, meaning that an empty value
 604                  * is legal for that attribute's syntax */
 605
 606                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 607                         tmp.bv_len + STRLENOF("(<=)");
 608                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 609
 610                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
 611                         f->f_av_desc->ad_cname.bv_val,
 612                         tmp.bv_len ? tmp.bv_val : "");
 613
 614                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 615                 break;
 616
 617         case LDAP_FILTER_APPROX:
 618                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 619                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 620                  * since in a Filter values in AVAs are supposed
 621                  * to have been normalized, meaning that an empty value
 622                  * is legal for that attribute's syntax */
 623
 624                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 625                         tmp.bv_len + STRLENOF("(~=)");
 626                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 627
 628                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
 629                         f->f_av_desc->ad_cname.bv_val,
 630                         tmp.bv_len ? tmp.bv_val : "");
 631                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 632                 break;
 633
 634         case LDAP_FILTER_SUBSTRINGS:
 635                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
 636                         STRLENOF("(=*)");
 637                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 638
 639                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 640                         f->f_sub_desc->ad_cname.bv_val );
 641
 642                 if ( f->f_sub_initial.bv_val != NULL ) {
 643                         ber_len_t tmplen;
 644
 645                         len = fstr->bv_len;
 646
 647                         filter_escape_value_x( &f->f_sub_initial, &tmp, op->o_tmpmemctx );
 648                         tmplen = tmp.bv_len ? tmp.bv_len : STRLENOF( "(null)" );
 649
 650                         fstr->bv_len += tmplen;
 651                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 652                                 fstr->bv_len + 1, op->o_tmpmemctx );
 653
 654                         snprintf( &fstr->bv_val[len-2],
 655                                 tmplen + STRLENOF( /*(*/ "*)" ) + 1,
 656                                 /* "(attr=" */ "%s*)",
 657                                 tmp.bv_len ? tmp.bv_val : "(null)");
 658
 659                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 660                 }
 661
 662                 if ( f->f_sub_any != NULL ) {
 663                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
 664                                 ber_len_t tmplen;
 665
 666                                 len = fstr->bv_len;
 667                                 filter_escape_value_x( &f->f_sub_any[i],
 668                                         &tmp, op->o_tmpmemctx );
 669                                 tmplen = tmp.bv_len ? tmp.bv_len : STRLENOF( "(null)" );
 670
 671                                 fstr->bv_len += tmplen + STRLENOF( /*(*/ ")" );
 672                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 673                                         fstr->bv_len + 1, op->o_tmpmemctx );
 674
 675                                 snprintf( &fstr->bv_val[len-1],
 676                                         tmplen + STRLENOF( /*(*/ "*)" ) + 1,
 677                                         /* "(attr=[init]*[any*]" */ "%s*)",
 678                                         tmp.bv_len ? tmp.bv_val : "(null)");
 679                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 680                         }
 681                 }
 682
 683                 if ( f->f_sub_final.bv_val != NULL ) {
 684                         ber_len_t tmplen;
 685
 686                         len = fstr->bv_len;
 687
 688                         filter_escape_value_x( &f->f_sub_final, &tmp, op->o_tmpmemctx );
 689                         tmplen = tmp.bv_len ? tmp.bv_len : STRLENOF( "(null)" );
 690
 691                         fstr->bv_len += tmplen;
 692                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 693                                 fstr->bv_len + 1, op->o_tmpmemctx );
 694
 695                         snprintf( &fstr->bv_val[len-1],
 696                                 tmplen + STRLENOF( /*(*/ ")" ) + 1,
 697                                 /* "(attr=[init*][any*]" */ "%s)",
 698                                 tmp.bv_len ? tmp.bv_val : "(null)");
 699
 700                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 701                 }
 702
 703                 break;
 704
 705         case LDAP_FILTER_PRESENT:
 706                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
 707                         STRLENOF("(=*)");
 708                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 709
 710                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 711                         f->f_desc->ad_cname.bv_val );
 712                 break;
 713
 714         case LDAP_FILTER_AND:
 715         case LDAP_FILTER_OR:
 716         case LDAP_FILTER_NOT:
 717                 fstr->bv_len = STRLENOF("(%)");
 718                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 719
 720                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 721                         f->f_choice == LDAP_FILTER_AND ? '&' :
 722                         f->f_choice == LDAP_FILTER_OR ? '|' : '!' );
 723
 724                 for ( p = f->f_list; p != NULL; p = p->f_next ) {
 725                         len = fstr->bv_len;
 726
 727                         filter2bv_x( op, p, &tmp );
 728
 729                         fstr->bv_len += tmp.bv_len;
 730                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 731                                 op->o_tmpmemctx );
 732
 733                         snprintf( &fstr->bv_val[len-1],
 734                                 tmp.bv_len + STRLENOF( /*(*/ ")" ) + 1,
 735                                 /*"("*/ "%s)", tmp.bv_val );
 736
 737                         op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
 738                 }
 739
 740                 break;
 741
 742         case LDAP_FILTER_EXT: {
 743                 struct berval ad;
 744
 745                 filter_escape_value_x( &f->f_mr_value, &tmp, op->o_tmpmemctx );
 746                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 747                  * since in a Filter values in MRAs are supposed
 748                  * to have been normalized, meaning that an empty value
 749                  * is legal for that attribute's syntax */
 750
 751                 if ( f->f_mr_desc ) {
 752                         ad = f->f_mr_desc->ad_cname;
 753                 } else {
 754                         ad.bv_len = 0;
 755                         ad.bv_val = "";
 756                 }
 757
 758                 fstr->bv_len = ad.bv_len +
 759                         ( f->f_mr_dnattrs ? STRLENOF(":dn") : 0 ) +
 760                         ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
 761                         tmp.bv_len + STRLENOF("(:=)");
 762                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 763
 764                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
 765                         ad.bv_val,
 766                         f->f_mr_dnattrs ? ":dn" : "",
 767                         f->f_mr_rule_text.bv_len ? ":" : "",
 768                         f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
 769                         tmp.bv_len ? tmp.bv_val : "" );
 770                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 771                 } break;
 772
 773         case SLAPD_FILTER_COMPUTED:
 774                 switch ( f->f_result ) {
 775                 case LDAP_COMPARE_FALSE:
 776                         tmp = ber_bvfalse;
 777                         break;
 778
 779                 case LDAP_COMPARE_TRUE:
 780                         tmp = ber_bvtrue;
 781                         break;
 782
 783                 case SLAPD_COMPARE_UNDEFINED:
 784                         tmp = ber_bvundefined;
 785                         break;
 786
 787                 default:
 788                         tmp = ber_bverror;
 789                         break;
 790                 }
 791
 792                 ber_dupbv_x( fstr, &tmp, op->o_tmpmemctx );
 793                 break;
 794
 795         default:
 796                 ber_dupbv_x( fstr, &ber_bvunknown, op->o_tmpmemctx );
 797                 break;
 798         }
 799 }
 800
 801 void
 802 filter2bv( Filter *f, struct berval *fstr )
 803 {
 804         Operation op;
 805         Opheader ohdr;
 806
 807         op.o_hdr = &ohdr;
 808         op.o_tmpmemctx = NULL;
 809         op.o_tmpmfuncs = &ch_mfuncs;
 810
 811         filter2bv_x( &op, f, fstr );
 812 }
 813
 814 Filter *
 815 filter_dup( Filter *f, void *memctx )
 816 {
 817         BerMemoryFunctions *mf = &slap_sl_mfuncs;
 818         Filter *n;
 819
 820         if ( !f )
 821                 return NULL;
 822
 823         n = mf->bmf_malloc( sizeof(Filter), memctx );
 824         n->f_choice = f->f_choice;
 825         n->f_next = NULL;
 826
 827         switch( f->f_choice ) {
 828         case SLAPD_FILTER_COMPUTED:
 829                 n->f_result = f->f_result;
 830                 break;
 831         case LDAP_FILTER_PRESENT:
 832                 n->f_desc = f->f_desc;
 833                 break;
 834         case LDAP_FILTER_EQUALITY:
 835         case LDAP_FILTER_GE:
 836         case LDAP_FILTER_LE:
 837         case LDAP_FILTER_APPROX:
 838                 /* Should this be ava_dup() ? */
 839                 n->f_ava = mf->bmf_calloc( 1, sizeof(AttributeAssertion), memctx );
 840                 *n->f_ava = *f->f_ava;
 841                 ber_dupbv_x( &n->f_av_value, &f->f_av_value, memctx );
 842                 break;
 843         case LDAP_FILTER_SUBSTRINGS:
 844                 n->f_sub = mf->bmf_calloc( 1, sizeof(SubstringsAssertion), memctx );
 845                 n->f_sub_desc = f->f_sub_desc;
 846                 if ( !BER_BVISNULL( &f->f_sub_initial ))
 847                         ber_dupbv_x( &n->f_sub_initial, &f->f_sub_initial, memctx );
 848                 if ( f->f_sub_any ) {
 849                         int i;
 850                         for ( i = 0; !BER_BVISNULL( &f->f_sub_any[i] ); i++ );
 851                         n->f_sub_any = mf->bmf_malloc(( i+1 )*sizeof( struct berval ),
 852                                 memctx );
 853                         for ( i = 0; !BER_BVISNULL( &f->f_sub_any[i] ); i++ ) {
 854                                 ber_dupbv_x( &n->f_sub_any[i], &f->f_sub_any[i], memctx );
 855                         }
 856                         BER_BVZERO( &n->f_sub_any[i] );
 857                 }
 858                 if ( !BER_BVISNULL( &f->f_sub_final ))
 859                         ber_dupbv_x( &n->f_sub_final, &f->f_sub_final, memctx );
 860                 break;
 861         case LDAP_FILTER_EXT: {
 862                 /* Should this be mra_dup() ? */
 863                 ber_len_t length;
 864                 length = sizeof(MatchingRuleAssertion);
 865                 if ( !BER_BVISNULL( &f->f_mr_rule_text ))
 866                         length += f->f_mr_rule_text.bv_len + 1;
 867                 n->f_mra = mf->bmf_calloc( 1, length, memctx );
 868                 *n->f_mra = *f->f_mra;
 869                 ber_dupbv_x( &n->f_mr_value, &f->f_mr_value, memctx );
 870                 if ( !BER_BVISNULL( &f->f_mr_rule_text )) {
 871                         n->f_mr_rule_text.bv_val = (char *)(n->f_mra+1);
 872                         AC_MEMCPY(n->f_mr_rule_text.bv_val,
 873                                 f->f_mr_rule_text.bv_val, f->f_mr_rule_text.bv_len );
 874                 }
 875                 } break;
 876         case LDAP_FILTER_AND:
 877         case LDAP_FILTER_OR:
 878         case LDAP_FILTER_NOT: {
 879                 Filter **p;
 880                 for ( p = &n->f_list, f = f->f_list; f; f = f->f_next ) {
 881                         *p = filter_dup( f, memctx );
 882                         p = &(*p)->f_next;
 883                 }
 884                 } break;
 885         }
 886         return n;
 887 }
 888
 889 static int
 890 get_simple_vrFilter(
 891         Operation *op,
 892         BerElement *ber,
 893         ValuesReturnFilter **filt,
 894         const char **text )
 895 {
 896         ber_tag_t       tag;
 897         ber_len_t       len;
 898         int             err;
 899         ValuesReturnFilter vrf;
 900
 901         Debug( LDAP_DEBUG_FILTER, "begin get_simple_vrFilter\n", 0, 0, 0 );
 902
 903         tag = ber_peek_tag( ber, &len );
 904
 905         if( tag == LBER_ERROR ) {
 906                 *text = "error decoding filter";
 907                 return SLAPD_DISCONNECT;
 908         }
 909
 910         vrf.vrf_next = NULL;
 911
 912         err = LDAP_SUCCESS;
 913         vrf.vrf_choice = tag;
 914
 915         switch ( vrf.vrf_choice ) {
 916         case LDAP_FILTER_EQUALITY:
 917                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 918                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_EQUALITY, text );
 919                 if ( err != LDAP_SUCCESS ) {
 920                         break;
 921                 }
 922
 923                 assert( vrf.vrf_ava != NULL );
 924                 break;
 925
 926         case LDAP_FILTER_SUBSTRINGS:
 927                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 928                 err = get_ssa( op, ber, &vrf.vrf_sub, text );
 929                 break;
 930
 931         case LDAP_FILTER_GE:
 932                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 933                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_ORDERING, text );
 934                 if ( err != LDAP_SUCCESS ) {
 935                         break;
 936                 }
 937                 break;
 938
 939         case LDAP_FILTER_LE:
 940                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 941                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_ORDERING, text );
 942                 if ( err != LDAP_SUCCESS ) {
 943                         break;
 944                 }
 945                 break;
 946
 947         case LDAP_FILTER_PRESENT: {
 948                 struct berval type;
 949
 950                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 951                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 952                         err = SLAPD_DISCONNECT;
 953                         *text = "error decoding filter";
 954                         break;
 955                 }
 956
 957                 vrf.vrf_desc = NULL;
 958                 err = slap_bv2ad( &type, &vrf.vrf_desc, text );
 959
 960                 if( err != LDAP_SUCCESS ) {
 961                         err = slap_bv2undef_ad( &type, &vrf.vrf_desc, text,
 962                                 SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 963
 964                         if( err != LDAP_SUCCESS ) {
 965                                 /* unrecognized attribute description or other error */
 966                                 Debug( LDAP_DEBUG_ANY,
 967                                         "get_simple_vrFilter: conn %lu unknown "
 968                                         "attribute type=%s (%d)\n",
 969                                         op->o_connid, type.bv_val, err );
 970
 971                                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 972                                 vrf.vrf_result = LDAP_COMPARE_FALSE;
 973                                 err = LDAP_SUCCESS;
 974                                 break;
 975                         }
 976                 }
 977                 } break;
 978
 979         case LDAP_FILTER_APPROX:
 980                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 981                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_EQUALITY_APPROX, text );
 982                 if ( err != LDAP_SUCCESS ) {
 983                         break;
 984                 }
 985                 break;
 986
 987         case LDAP_FILTER_EXT:
 988                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 989
 990                 err = get_mra( op, ber, &vrf.vrf_mra, text );
 991                 if ( err != LDAP_SUCCESS ) {
 992                         break;
 993                 }
 994
 995                 assert( vrf.vrf_mra != NULL );
 996                 break;
 997
 998         default:
 999                 (void) ber_scanf( ber, "x" ); /* skip the element */
1000                 Debug( LDAP_DEBUG_ANY, "get_simple_vrFilter: unknown filter type=%lu\n",
1001                         vrf.vrf_choice, 0, 0 );
1002                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
1003                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
1004                 break;
1005         }
1006
1007         if ( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
1008                 /* ignore error */
1009                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
1010                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
1011                 err = LDAP_SUCCESS;
1012         }
1013
1014         if ( err == LDAP_SUCCESS ) {
1015                 *filt = ch_malloc( sizeof vrf );
1016                 **filt = vrf;
1017         }
1018
1019         Debug( LDAP_DEBUG_FILTER, "end get_simple_vrFilter %d\n", err, 0, 0 );
1020
1021         return err;
1022 }
1023
1024 int
1025 get_vrFilter( Operation *op, BerElement *ber,
1026         ValuesReturnFilter **vrf,
1027         const char **text )
1028 {
1029         /*
1030          * A ValuesReturnFilter looks like this:
1031          *
1032          *      ValuesReturnFilter ::= SEQUENCE OF SimpleFilterItem
1033          *      SimpleFilterItem ::= CHOICE {
1034          *              equalityMatch   [3]     AttributeValueAssertion,
1035          *              substrings      [4]     SubstringFilter,
1036          *              greaterOrEqual  [5]     AttributeValueAssertion,
1037          *              lessOrEqual     [6]     AttributeValueAssertion,
1038          *              present         [7]     AttributeType,
1039          *              approxMatch     [8]     AttributeValueAssertion,
1040          *              extensibleMatch [9]     SimpleMatchingAssertion -- LDAPv3
1041          *      }
1042          *
1043          *      SubstringFilter ::= SEQUENCE {
1044          *              type               AttributeType,
1045          *              SEQUENCE OF CHOICE {
1046          *                      initial          [0] IA5String,
1047          *                      any              [1] IA5String,
1048          *                      final            [2] IA5String
1049          *              }
1050          *      }
1051          *
1052          *      SimpleMatchingAssertion ::= SEQUENCE {  -- LDAPv3
1053          *              matchingRule    [1] MatchingRuleId OPTIONAL,
1054          *              type            [2] AttributeDescription OPTIONAL,
1055          *              matchValue      [3] AssertionValue }
1056          */
1057
1058         ValuesReturnFilter **n;
1059         ber_tag_t       tag;
1060         ber_len_t       len;
1061         char            *last;
1062
1063         Debug( LDAP_DEBUG_FILTER, "begin get_vrFilter\n", 0, 0, 0 );
1064
1065         tag = ber_peek_tag( ber, &len );
1066
1067         if( tag == LBER_ERROR ) {
1068                 *text = "error decoding vrFilter";
1069                 return SLAPD_DISCONNECT;
1070         }
1071
1072         if( tag != LBER_SEQUENCE ) {
1073                 *text = "error decoding vrFilter, expect SEQUENCE tag";
1074                 return SLAPD_DISCONNECT;
1075         }
1076
1077         n = vrf;
1078         for ( tag = ber_first_element( ber, &len, &last );
1079                 tag != LBER_DEFAULT;
1080                 tag = ber_next_element( ber, &len, last ) )
1081         {
1082                 int err = get_simple_vrFilter( op, ber, n, text );
1083
1084                 if ( err != LDAP_SUCCESS ) return( err );
1085
1086                 n = &(*n)->vrf_next;
1087         }
1088         *n = NULL;
1089
1090         Debug( LDAP_DEBUG_FILTER, "end get_vrFilter\n", 0, 0, 0 );
1091         return( LDAP_SUCCESS );
1092 }
1093
1094 void
1095 vrFilter_free( Operation *op, ValuesReturnFilter *vrf )
1096 {
1097         ValuesReturnFilter      *p, *next;
1098
1099         if ( vrf == NULL ) {
1100                 return;
1101         }
1102
1103         for ( p = vrf; p != NULL; p = next ) {
1104                 next = p->vrf_next;
1105
1106                 switch ( vrf->vrf_choice ) {
1107                 case LDAP_FILTER_PRESENT:
1108                         break;
1109
1110                 case LDAP_FILTER_EQUALITY:
1111                 case LDAP_FILTER_GE:
1112                 case LDAP_FILTER_LE:
1113                 case LDAP_FILTER_APPROX:
1114                         ava_free( op, vrf->vrf_ava, 1 );
1115                         break;
1116
1117                 case LDAP_FILTER_SUBSTRINGS:
1118                         if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1119                                 op->o_tmpfree( vrf->vrf_sub_initial.bv_val, op->o_tmpmemctx );
1120                         }
1121                         ber_bvarray_free_x( vrf->vrf_sub_any, op->o_tmpmemctx );
1122                         if ( vrf->vrf_sub_final.bv_val != NULL ) {
1123                                 op->o_tmpfree( vrf->vrf_sub_final.bv_val, op->o_tmpmemctx );
1124                         }
1125                         op->o_tmpfree( vrf->vrf_sub, op->o_tmpmemctx );
1126                         break;
1127
1128                 case LDAP_FILTER_EXT:
1129                         mra_free( op, vrf->vrf_mra, 1 );
1130                         break;
1131
1132                 case SLAPD_FILTER_COMPUTED:
1133                         break;
1134
1135                 default:
1136                         Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
1137                                 vrf->vrf_choice, 0, 0 );
1138                         break;
1139                 }
1140
1141                 op->o_tmpfree( vrf, op->o_tmpmemctx );
1142         }
1143 }
1144
1145 void
1146 vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1147 {
1148         ValuesReturnFilter      *p;
1149         struct berval tmp;
1150         ber_len_t len;
1151
1152         if ( vrf == NULL ) {
1153                 ber_str2bv_x( "No filter!", STRLENOF("No filter!"),
1154                         1, fstr, op->o_tmpmemctx );
1155                 return;
1156         }
1157
1158         fstr->bv_len = STRLENOF("()");
1159         fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1160
1161         snprintf( fstr->bv_val, fstr->bv_len + 1, "()");
1162
1163         for ( p = vrf; p != NULL; p = p->vrf_next ) {
1164                 len = fstr->bv_len;
1165
1166                 simple_vrFilter2bv( op, p, &tmp );
1167
1168                 fstr->bv_len += tmp.bv_len;
1169                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1170                         op->o_tmpmemctx );
1171
1172                 snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
1173                         /*"("*/ "%s)", tmp.bv_val );
1174
1175                 op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
1176         }
1177 }
1178
1179 static void
1180 simple_vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1181 {
1182         struct berval tmp;
1183         ber_len_t len;
1184
1185         if ( vrf == NULL ) {
1186                 ber_str2bv_x( "No filter!", STRLENOF("No filter!"), 1, fstr,
1187                         op->o_tmpmemctx );
1188                 return;
1189         }
1190
1191         switch ( vrf->vrf_choice ) {
1192         case LDAP_FILTER_EQUALITY:
1193                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1194
1195                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1196                         tmp.bv_len + STRLENOF("(=)");
1197                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1198
1199                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
1200                         vrf->vrf_av_desc->ad_cname.bv_val,
1201                         tmp.bv_val );
1202
1203                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1204                 break;
1205
1206         case LDAP_FILTER_GE:
1207                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1208
1209                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1210                         tmp.bv_len + STRLENOF("(>=)");
1211                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1212
1213                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
1214                         vrf->vrf_av_desc->ad_cname.bv_val,
1215                         tmp.bv_val );
1216
1217                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1218                 break;
1219
1220         case LDAP_FILTER_LE:
1221                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1222
1223                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1224                         tmp.bv_len + STRLENOF("(<=)");
1225                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1226
1227                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
1228                         vrf->vrf_av_desc->ad_cname.bv_val,
1229                         tmp.bv_val );
1230
1231                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1232                 break;
1233
1234         case LDAP_FILTER_APPROX:
1235                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1236
1237                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1238                         tmp.bv_len + STRLENOF("(~=)");
1239                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1240
1241                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
1242                         vrf->vrf_av_desc->ad_cname.bv_val,
1243                         tmp.bv_val );
1244                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1245                 break;
1246
1247         case LDAP_FILTER_SUBSTRINGS:
1248                 fstr->bv_len = vrf->vrf_sub_desc->ad_cname.bv_len +
1249                         STRLENOF("(=*)");
1250                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1251
1252                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1253                         vrf->vrf_sub_desc->ad_cname.bv_val );
1254
1255                 if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1256                         len = fstr->bv_len;
1257
1258                         filter_escape_value_x( &vrf->vrf_sub_initial, &tmp, op->o_tmpmemctx );
1259
1260                         fstr->bv_len += tmp.bv_len;
1261                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1262                                 op->o_tmpmemctx );
1263
1264                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
1265                                 /* "(attr=" */ "%s*)",
1266                                 tmp.bv_val );
1267
1268                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1269                 }
1270
1271                 if ( vrf->vrf_sub_any != NULL ) {
1272                         int i;
1273                         for ( i = 0; vrf->vrf_sub_any[i].bv_val != NULL; i++ ) {
1274                                 len = fstr->bv_len;
1275                                 filter_escape_value_x( &vrf->vrf_sub_any[i], &tmp,
1276                                         op->o_tmpmemctx );
1277
1278                                 fstr->bv_len += tmp.bv_len + 1;
1279                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
1280                                         fstr->bv_len + 1, op->o_tmpmemctx );
1281
1282                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1283                                         /* "(attr=[init]*[any*]" */ "%s*)",
1284                                         tmp.bv_val );
1285                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1286                         }
1287                 }
1288
1289                 if ( vrf->vrf_sub_final.bv_val != NULL ) {
1290                         len = fstr->bv_len;
1291
1292                         filter_escape_value_x( &vrf->vrf_sub_final, &tmp, op->o_tmpmemctx );
1293
1294                         fstr->bv_len += tmp.bv_len;
1295                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1296                                 op->o_tmpmemctx );
1297
1298                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1299                                 /* "(attr=[init*][any*]" */ "%s)",
1300                                 tmp.bv_val );
1301
1302                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1303                 }
1304
1305                 break;
1306
1307         case LDAP_FILTER_PRESENT:
1308                 fstr->bv_len = vrf->vrf_desc->ad_cname.bv_len +
1309                         STRLENOF("(=*)");
1310                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1311
1312                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1313                         vrf->vrf_desc->ad_cname.bv_val );
1314                 break;
1315
1316         case LDAP_FILTER_EXT: {
1317                 struct berval ad;
1318                 filter_escape_value_x( &vrf->vrf_mr_value, &tmp, op->o_tmpmemctx );
1319
1320                 if ( vrf->vrf_mr_desc ) {
1321                         ad = vrf->vrf_mr_desc->ad_cname;
1322                 } else {
1323                         ad.bv_len = 0;
1324                         ad.bv_val = "";
1325                 }
1326
1327                 fstr->bv_len = ad.bv_len +
1328                         ( vrf->vrf_mr_dnattrs ? STRLENOF(":dn") : 0 ) +
1329                         ( vrf->vrf_mr_rule_text.bv_len
1330                                 ? vrf->vrf_mr_rule_text.bv_len+1 : 0 ) +
1331                         tmp.bv_len + STRLENOF("(:=)");
1332                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1333
1334                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
1335                         ad.bv_val,
1336                         vrf->vrf_mr_dnattrs ? ":dn" : "",
1337                         vrf->vrf_mr_rule_text.bv_len ? ":" : "",
1338                         vrf->vrf_mr_rule_text.bv_len ? vrf->vrf_mr_rule_text.bv_val : "",
1339                         tmp.bv_val );
1340
1341                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1342                 } break;
1343
1344         case SLAPD_FILTER_COMPUTED:
1345                 ber_str2bv_x(
1346                         vrf->vrf_result == LDAP_COMPARE_FALSE ? "(?=false)" :
1347                         vrf->vrf_result == LDAP_COMPARE_TRUE ? "(?=true)" :
1348                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1349                                 ? "(?=undefined)" : "(?=error)",
1350                         vrf->vrf_result == LDAP_COMPARE_FALSE ? STRLENOF("(?=false)") :
1351                         vrf->vrf_result == LDAP_COMPARE_TRUE ? STRLENOF("(?=true)") :
1352                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1353                                 ? STRLENOF("(?=undefined)") : STRLENOF("(?=error)"),
1354                         1, fstr, op->o_tmpmemctx );
1355                 break;
1356
1357         default:
1358                 ber_str2bv_x( "(?=unknown)", STRLENOF("(?=unknown)"),
1359                         1, fstr, op->o_tmpmemctx );
1360                 break;
1361         }
1362 }