git.sur5r.net Git - openldap/blob - servers/slapd/filter.c

   1 /* filter.c - routines for parsing and dealing with filters */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/socket.h>
  13 #include <ac/string.h>
  14
  15 #include "slap.h"
  16
  17 static int      get_filter_list(
  18         Connection *conn,
  19         BerElement *ber,
  20         Filter **f,
  21         const char **text );
  22
  23 static int      get_substring_filter(
  24         Connection *conn,
  25         BerElement *ber,
  26         Filter *f,
  27         const char **text );
  28
  29 static int filter_escape_value(
  30         struct berval *in,
  31         struct berval *out );
  32
  33 static void simple_vrFilter2bv(
  34         ValuesReturnFilter *f,
  35         struct berval *fstr );
  36
  37 static int      get_simple_vrFilter(
  38         Connection *conn,
  39         BerElement *ber,
  40         ValuesReturnFilter **f,
  41         const char **text );
  42
  43
  44 int
  45 get_filter(
  46         Connection *conn,
  47         BerElement *ber,
  48         Filter **filt,
  49         const char **text )
  50 {
  51         ber_tag_t       tag;
  52         ber_len_t       len;
  53         int             err;
  54         Filter          *f;
  55
  56 #ifdef NEW_LOGGING
  57         LDAP_LOG( FILTER, ENTRY, "get_filter: conn %d\n", conn->c_connid, 0, 0 );
  58 #else
  59         Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
  60 #endif
  61         /*
  62          * A filter looks like this coming in:
  63          *      Filter ::= CHOICE {
  64          *              and             [0]     SET OF Filter,
  65          *              or              [1]     SET OF Filter,
  66          *              not             [2]     Filter,
  67          *              equalityMatch   [3]     AttributeValueAssertion,
  68          *              substrings      [4]     SubstringFilter,
  69          *              greaterOrEqual  [5]     AttributeValueAssertion,
  70          *              lessOrEqual     [6]     AttributeValueAssertion,
  71          *              present         [7]     AttributeType,,
  72          *              approxMatch     [8]     AttributeValueAssertion
  73          *              extensibleMatch [9]     MatchingRuleAssertion
  74          *      }
  75          *
  76          *      SubstringFilter ::= SEQUENCE {
  77          *              type               AttributeType,
  78          *              SEQUENCE OF CHOICE {
  79          *                      initial          [0] IA5String,
  80          *                      any              [1] IA5String,
  81          *                      final            [2] IA5String
  82          *              }
  83          *      }
  84          *
  85          *      MatchingRuleAssertion ::= SEQUENCE {
  86          *              matchingRule    [1] MatchingRuleId OPTIONAL,
  87          *              type            [2] AttributeDescription OPTIONAL,
  88          *              matchValue      [3] AssertionValue,
  89          *              dnAttributes    [4] BOOLEAN DEFAULT FALSE
  90          *      }
  91          *
  92          */
  93
  94         tag = ber_peek_tag( ber, &len );
  95
  96         if( tag == LBER_ERROR ) {
  97                 *text = "error decoding filter";
  98                 return SLAPD_DISCONNECT;
  99         }
 100
 101         f = (Filter *) ch_malloc( sizeof(Filter) );
 102         f->f_next = NULL;
 103
 104         err = LDAP_SUCCESS;
 105         f->f_choice = tag;
 106
 107         switch ( f->f_choice ) {
 108         case LDAP_FILTER_EQUALITY:
 109 #ifdef NEW_LOGGING
 110                 LDAP_LOG( FILTER, DETAIL2,
 111                         "get_filter: conn %d  EQUALITY\n", conn->c_connid, 0, 0 );
 112 #else
 113                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 114 #endif
 115                 err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY, text );
 116                 if ( err != LDAP_SUCCESS ) {
 117                         break;
 118                 }
 119
 120                 assert( f->f_ava != NULL );
 121                 break;
 122
 123         case LDAP_FILTER_SUBSTRINGS:
 124 #ifdef NEW_LOGGING
 125                 LDAP_LOG( FILTER, DETAIL1,
 126                         "get_filter: conn %d  SUBSTRINGS\n", conn->c_connid, 0, 0 );
 127 #else
 128                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 129 #endif
 130                 err = get_substring_filter( conn, ber, f, text );
 131                 break;
 132
 133         case LDAP_FILTER_GE:
 134 #ifdef NEW_LOGGING
 135                 LDAP_LOG( FILTER, DETAIL1,
 136                         "get_filter: conn %d  GE\n", conn->c_connid, 0, 0 );
 137 #else
 138                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 139 #endif
 140                 err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
 141                 if ( err != LDAP_SUCCESS ) {
 142                         break;
 143                 }
 144                 break;
 145
 146         case LDAP_FILTER_LE:
 147 #ifdef NEW_LOGGING
 148                 LDAP_LOG( FILTER, DETAIL1,
 149                         "get_filter: conn %d  LE\n", conn->c_connid, 0, 0 );
 150 #else
 151                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 152 #endif
 153                 err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
 154                 if ( err != LDAP_SUCCESS ) {
 155                         break;
 156                 }
 157                 break;
 158
 159         case LDAP_FILTER_PRESENT: {
 160                 struct berval type;
 161
 162 #ifdef NEW_LOGGING
 163                 LDAP_LOG( FILTER, DETAIL1,
 164                         "get_filter: conn %d PRESENT\n", conn->c_connid, 0, 0 );
 165 #else
 166                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 167 #endif
 168                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 169                         err = SLAPD_DISCONNECT;
 170                         *text = "error decoding filter";
 171                         break;
 172                 }
 173
 174                 f->f_desc = NULL;
 175                 err = slap_bv2ad( &type, &f->f_desc, text );
 176
 177                 if( err != LDAP_SUCCESS ) {
 178                         /* unrecognized attribute description or other error */
 179                         f->f_choice = SLAPD_FILTER_COMPUTED;
 180                         f->f_result = LDAP_COMPARE_FALSE;
 181                         err = LDAP_SUCCESS;
 182                         break;
 183                 }
 184                 } break;
 185
 186         case LDAP_FILTER_APPROX:
 187 #ifdef NEW_LOGGING
 188                 LDAP_LOG( FILTER, DETAIL1,
 189                         "get_filter: conn %d  APPROX\n", conn->c_connid, 0, 0 );
 190 #else
 191                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 192 #endif
 193                 err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY_APPROX, text );
 194                 if ( err != LDAP_SUCCESS ) {
 195                         break;
 196                 }
 197                 break;
 198
 199         case LDAP_FILTER_AND:
 200 #ifdef NEW_LOGGING
 201                 LDAP_LOG( FILTER, DETAIL1,
 202                         "get_filter: conn %d  AND\n", conn->c_connid, 0, 0 );
 203 #else
 204                 Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
 205 #endif
 206                 err = get_filter_list( conn, ber, &f->f_and, text );
 207                 if ( err != LDAP_SUCCESS ) {
 208                         break;
 209                 }
 210                 break;
 211
 212         case LDAP_FILTER_OR:
 213 #ifdef NEW_LOGGING
 214                 LDAP_LOG( FILTER, DETAIL1,
 215                         "get_filter: conn %d  OR\n", conn->c_connid, 0, 0  );
 216 #else
 217                 Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
 218 #endif
 219                 err = get_filter_list( conn, ber, &f->f_or, text );
 220                 if ( err != LDAP_SUCCESS ) {
 221                         break;
 222                 }
 223                 break;
 224
 225         case LDAP_FILTER_NOT:
 226 #ifdef NEW_LOGGING
 227                 LDAP_LOG( FILTER, DETAIL1,
 228                         "get_filter: conn %d  NOT\n", conn->c_connid, 0, 0 );
 229 #else
 230                 Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
 231 #endif
 232                 (void) ber_skip_tag( ber, &len );
 233                 err = get_filter( conn, ber, &f->f_not, text );
 234                 if ( err != LDAP_SUCCESS ) {
 235                         break;
 236                 }
 237                 break;
 238
 239         case LDAP_FILTER_EXT:
 240 #ifdef NEW_LOGGING
 241                 LDAP_LOG( FILTER, DETAIL1,
 242                         "get_filter: conn %d  EXTENSIBLE\n", conn->c_connid, 0, 0 );
 243 #else
 244                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 245 #endif
 246
 247                 err = get_mra( ber, &f->f_mra, text );
 248                 if ( err != LDAP_SUCCESS ) {
 249                         break;
 250                 }
 251
 252                 assert( f->f_mra != NULL );
 253                 break;
 254
 255         default:
 256                 (void) ber_scanf( ber, "x" ); /* skip the element */
 257 #ifdef NEW_LOGGING
 258                 LDAP_LOG( FILTER, ERR,
 259                         "get_filter: conn %d unknown filter type=%lu\n",
 260                         conn->c_connid, f->f_choice, 0 );
 261 #else
 262                 Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
 263                         f->f_choice, 0, 0 );
 264 #endif
 265                 f->f_choice = SLAPD_FILTER_COMPUTED;
 266                 f->f_result = SLAPD_COMPARE_UNDEFINED;
 267                 break;
 268         }
 269
 270         if ( err != LDAP_SUCCESS ) {
 271                 if( err != SLAPD_DISCONNECT ) {
 272                         /* ignore error */
 273                         f->f_choice = SLAPD_FILTER_COMPUTED;
 274                         f->f_result = SLAPD_COMPARE_UNDEFINED;
 275                         err = LDAP_SUCCESS;
 276                         *filt = f;
 277
 278                 } else {
 279                         free(f);
 280                 }
 281
 282         } else {
 283                 *filt = f;
 284         }
 285
 286 #ifdef NEW_LOGGING
 287         LDAP_LOG( FILTER, DETAIL2,
 288                 "get_filter: conn %d exit\n", conn->c_connid, 0, 0 );
 289 #else
 290         Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
 291 #endif
 292         return( err );
 293 }
 294
 295 static int
 296 get_filter_list( Connection *conn, BerElement *ber,
 297         Filter **f,
 298         const char **text )
 299 {
 300         Filter          **new;
 301         int             err;
 302         ber_tag_t       tag;
 303         ber_len_t       len;
 304         char            *last;
 305
 306 #ifdef NEW_LOGGING
 307         LDAP_LOG( FILTER, ENTRY,
 308                 "get_filter_list: conn %d start\n", conn->c_connid, 0, 0 );
 309 #else
 310         Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
 311 #endif
 312         new = f;
 313         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
 314                 tag = ber_next_element( ber, &len, last ) )
 315         {
 316                 err = get_filter( conn, ber, new, text );
 317                 if ( err != LDAP_SUCCESS )
 318                         return( err );
 319                 new = &(*new)->f_next;
 320         }
 321         *new = NULL;
 322
 323 #ifdef NEW_LOGGING
 324         LDAP_LOG( FILTER, ENTRY,
 325                 "get_filter_list: conn %d exit\n", conn->c_connid, 0, 0 );
 326 #else
 327         Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
 328 #endif
 329         return( LDAP_SUCCESS );
 330 }
 331
 332 static int
 333 get_substring_filter(
 334         Connection      *conn,
 335         BerElement      *ber,
 336         Filter  *f,
 337         const char      **text )
 338 {
 339         ber_tag_t       tag;
 340         ber_len_t       len;
 341         ber_tag_t       rc;
 342         struct berval value;
 343         char            *last;
 344         struct berval bv;
 345         *text = "error decoding filter";
 346
 347 #ifdef NEW_LOGGING
 348         LDAP_LOG( FILTER, ENTRY,
 349                 "get_substring_filter: conn %d  begin\n", conn->c_connid, 0, 0 );
 350 #else
 351         Debug( LDAP_DEBUG_FILTER, "begin get_substring_filter\n", 0, 0, 0 );
 352 #endif
 353         if ( ber_scanf( ber, "{m" /*}*/, &bv ) == LBER_ERROR ) {
 354                 return SLAPD_DISCONNECT;
 355         }
 356
 357         f->f_sub = ch_calloc( 1, sizeof(SubstringsAssertion) );
 358         f->f_sub_desc = NULL;
 359         rc = slap_bv2ad( &bv, &f->f_sub_desc, text );
 360
 361         if( rc != LDAP_SUCCESS ) {
 362                 text = NULL;
 363                 ch_free( f->f_sub );
 364                 f->f_choice = SLAPD_FILTER_COMPUTED;
 365                 f->f_result = SLAPD_COMPARE_UNDEFINED;
 366                 return LDAP_SUCCESS;
 367         }
 368
 369         f->f_sub_initial.bv_val = NULL;
 370         f->f_sub_any = NULL;
 371         f->f_sub_final.bv_val = NULL;
 372
 373         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
 374                 tag = ber_next_element( ber, &len, last ) )
 375         {
 376                 unsigned usage;
 377
 378                 rc = ber_scanf( ber, "m", &value );
 379                 if ( rc == LBER_ERROR ) {
 380                         rc = SLAPD_DISCONNECT;
 381                         goto return_error;
 382                 }
 383
 384                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
 385                         rc = LDAP_INVALID_SYNTAX;
 386                         goto return_error;
 387                 }
 388
 389                 switch ( tag ) {
 390                 case LDAP_SUBSTRING_INITIAL:
 391                         usage = SLAP_MR_SUBSTR_INITIAL;
 392                         break;
 393
 394                 case LDAP_SUBSTRING_ANY:
 395                         usage = SLAP_MR_SUBSTR_ANY;
 396                         break;
 397
 398                 case LDAP_SUBSTRING_FINAL:
 399                         usage = SLAP_MR_SUBSTR_FINAL;
 400                         break;
 401
 402                 default:
 403                         rc = LDAP_PROTOCOL_ERROR;
 404
 405 #ifdef NEW_LOGGING
 406                         LDAP_LOG( FILTER, ERR,
 407                                 "get_filter_substring: conn %d  unknown substring choice=%ld\n",
 408                                 conn->c_connid, (long)tag, 0 );
 409 #else
 410                         Debug( LDAP_DEBUG_FILTER,
 411                                 "  unknown substring choice=%ld\n",
 412                                 (long) tag, 0, 0 );
 413 #endif
 414                         goto return_error;
 415                 }
 416
 417 #ifdef SLAP_NVALUES
 418                 /* validate/normalize using equality matching rule validator! */
 419                 rc = asserted_value_validate_normalize(
 420                         f->f_sub_desc, f->f_sub_desc->ad_type->sat_equality,
 421                         usage, &value, &bv, text );
 422                 if( rc != LDAP_SUCCESS ) {
 423                         goto return_error;
 424                 }
 425 #else
 426                 /* validate using equality matching rule validator! */
 427                 rc = value_validate( f->f_sub_desc->ad_type->sat_equality,
 428                         &value, text );
 429                 if( rc != LDAP_SUCCESS ) {
 430                         goto return_error;
 431                 }
 432
 433                 rc = value_normalize( f->f_sub_desc, usage,
 434                         &value, &bv, text );
 435                 if( rc != LDAP_SUCCESS ) {
 436                         goto return_error;
 437                 }
 438 #endif
 439
 440                 value = bv;
 441
 442                 rc = LDAP_PROTOCOL_ERROR;
 443
 444                 switch ( tag ) {
 445                 case LDAP_SUBSTRING_INITIAL:
 446 #ifdef NEW_LOGGING
 447                         LDAP_LOG( FILTER, DETAIL1,
 448                                 "get_substring_filter: conn %d  INITIAL\n", conn->c_connid, 0, 0 );
 449 #else
 450                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
 451 #endif
 452
 453                         if ( f->f_sub_initial.bv_val != NULL
 454                                 || f->f_sub_any != NULL
 455                                 || f->f_sub_final.bv_val != NULL )
 456                         {
 457                                 free( value.bv_val );
 458                                 goto return_error;
 459                         }
 460
 461                         f->f_sub_initial = value;
 462                         break;
 463
 464                 case LDAP_SUBSTRING_ANY:
 465 #ifdef NEW_LOGGING
 466                         LDAP_LOG( FILTER, DETAIL1,
 467                                 "get_substring_filter: conn %d  ANY\n", conn->c_connid, 0, 0 );
 468 #else
 469                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
 470 #endif
 471
 472                         if ( f->f_sub_final.bv_val != NULL ) {
 473                                 free( value.bv_val );
 474                                 goto return_error;
 475                         }
 476
 477                         ber_bvarray_add( &f->f_sub_any, &value );
 478                         break;
 479
 480                 case LDAP_SUBSTRING_FINAL:
 481 #ifdef NEW_LOGGING
 482                         LDAP_LOG( FILTER, DETAIL1,
 483                                 "get_substring_filter: conn %d  FINAL\n", conn->c_connid, 0, 0 );
 484 #else
 485                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
 486 #endif
 487
 488                         if ( f->f_sub_final.bv_val != NULL ) {
 489                                 free( value.bv_val );
 490                                 goto return_error;
 491                         }
 492
 493                         f->f_sub_final = value;
 494                         break;
 495
 496                 default:
 497 #ifdef NEW_LOGGING
 498                         LDAP_LOG( FILTER, INFO,
 499                                 "get_substring_filter: conn %d  unknown substring type %ld\n",
 500                                 conn->c_connid, (long)tag, 0 );
 501 #else
 502                         Debug( LDAP_DEBUG_FILTER,
 503                                 "  unknown substring type=%ld\n",
 504                                 (long) tag, 0, 0 );
 505 #endif
 506
 507                         free( value.bv_val );
 508
 509 return_error:
 510 #ifdef NEW_LOGGING
 511                         LDAP_LOG( FILTER, INFO,
 512                                 "get_substring_filter: conn %d  error %ld\n",
 513                                 conn->c_connid, (long)rc, 0 );
 514 #else
 515                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
 516                                 (long) rc, 0, 0 );
 517 #endif
 518                         free( f->f_sub_initial.bv_val );
 519                         ber_bvarray_free( f->f_sub_any );
 520                         free( f->f_sub_final.bv_val );
 521                         ch_free( f->f_sub );
 522                         return rc;
 523                 }
 524         }
 525
 526 #ifdef NEW_LOGGING
 527         LDAP_LOG( FILTER, ENTRY,
 528                 "get_substring_filter: conn %d exit\n", conn->c_connid, 0, 0 );
 529 #else
 530         Debug( LDAP_DEBUG_FILTER, "end get_substring_filter\n", 0, 0, 0 );
 531 #endif
 532         return( LDAP_SUCCESS );
 533 }
 534
 535 void
 536 filter_free( Filter *f )
 537 {
 538         Filter  *p, *next;
 539
 540         if ( f == NULL ) {
 541                 return;
 542         }
 543
 544         switch ( f->f_choice ) {
 545         case LDAP_FILTER_PRESENT:
 546                 break;
 547
 548         case LDAP_FILTER_EQUALITY:
 549         case LDAP_FILTER_GE:
 550         case LDAP_FILTER_LE:
 551         case LDAP_FILTER_APPROX:
 552                 ava_free( f->f_ava, 1 );
 553                 break;
 554
 555         case LDAP_FILTER_SUBSTRINGS:
 556                 if ( f->f_sub_initial.bv_val != NULL ) {
 557                         free( f->f_sub_initial.bv_val );
 558                 }
 559                 ber_bvarray_free( f->f_sub_any );
 560                 if ( f->f_sub_final.bv_val != NULL ) {
 561                         free( f->f_sub_final.bv_val );
 562                 }
 563                 ch_free( f->f_sub );
 564                 break;
 565
 566         case LDAP_FILTER_AND:
 567         case LDAP_FILTER_OR:
 568         case LDAP_FILTER_NOT:
 569                 for ( p = f->f_list; p != NULL; p = next ) {
 570                         next = p->f_next;
 571                         filter_free( p );
 572                 }
 573                 break;
 574
 575         case LDAP_FILTER_EXT:
 576                 mra_free( f->f_mra, 1 );
 577                 break;
 578
 579         case SLAPD_FILTER_COMPUTED:
 580                 break;
 581
 582         default:
 583 #ifdef NEW_LOGGING
 584                 LDAP_LOG( FILTER, ERR,
 585                         "filter_free: unknown filter type %lu\n", f->f_choice, 0, 0 );
 586 #else
 587                 Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
 588                         f->f_choice, 0, 0 );
 589 #endif
 590                 break;
 591         }
 592
 593         free( f );
 594 }
 595
 596 void
 597 filter2bv( Filter *f, struct berval *fstr )
 598 {
 599         int     i;
 600         Filter  *p;
 601         struct berval tmp;
 602         ber_len_t len;
 603
 604         if ( f == NULL ) {
 605                 ber_str2bv( "No filter!", sizeof("No filter!")-1, 1, fstr );
 606                 return;
 607         }
 608
 609         switch ( f->f_choice ) {
 610         case LDAP_FILTER_EQUALITY:
 611                 filter_escape_value( &f->f_av_value, &tmp );
 612
 613                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 614                         tmp.bv_len + ( sizeof("(=)") - 1 );
 615                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 616
 617                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
 618                         f->f_av_desc->ad_cname.bv_val,
 619                         tmp.bv_val );
 620
 621                 ber_memfree( tmp.bv_val );
 622                 break;
 623
 624         case LDAP_FILTER_GE:
 625                 filter_escape_value( &f->f_av_value, &tmp );
 626
 627                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 628                         tmp.bv_len + ( sizeof("(>=)") - 1 );
 629                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 630
 631                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
 632                         f->f_av_desc->ad_cname.bv_val,
 633                         tmp.bv_val );
 634
 635                 ber_memfree( tmp.bv_val );
 636                 break;
 637
 638         case LDAP_FILTER_LE:
 639                 filter_escape_value( &f->f_av_value, &tmp );
 640
 641                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 642                         tmp.bv_len + ( sizeof("(<=)") - 1 );
 643                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 644
 645                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
 646                         f->f_av_desc->ad_cname.bv_val,
 647                         tmp.bv_val );
 648
 649                 ber_memfree( tmp.bv_val );
 650                 break;
 651
 652         case LDAP_FILTER_APPROX:
 653                 filter_escape_value( &f->f_av_value, &tmp );
 654
 655                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 656                         tmp.bv_len + ( sizeof("(~=)") - 1 );
 657                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 658
 659                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
 660                         f->f_av_desc->ad_cname.bv_val,
 661                         tmp.bv_val );
 662                 ber_memfree( tmp.bv_val );
 663                 break;
 664
 665         case LDAP_FILTER_SUBSTRINGS:
 666                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
 667                         ( sizeof("(=*)") - 1 );
 668                 fstr->bv_val = malloc( fstr->bv_len + 128 );
 669
 670                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 671                         f->f_sub_desc->ad_cname.bv_val );
 672
 673                 if ( f->f_sub_initial.bv_val != NULL ) {
 674                         len = fstr->bv_len;
 675
 676                         filter_escape_value( &f->f_sub_initial, &tmp );
 677
 678                         fstr->bv_len += tmp.bv_len;
 679                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 680
 681                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
 682                                 /* "(attr=" */ "%s*)",
 683                                 tmp.bv_val );
 684
 685                         ber_memfree( tmp.bv_val );
 686                 }
 687
 688                 if ( f->f_sub_any != NULL ) {
 689                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
 690                                 len = fstr->bv_len;
 691                                 filter_escape_value( &f->f_sub_any[i], &tmp );
 692
 693                                 fstr->bv_len += tmp.bv_len + 1;
 694                                 fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 695
 696                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 697                                         /* "(attr=[init]*[any*]" */ "%s*)",
 698                                         tmp.bv_val );
 699                                 ber_memfree( tmp.bv_val );
 700                         }
 701                 }
 702
 703                 if ( f->f_sub_final.bv_val != NULL ) {
 704                         len = fstr->bv_len;
 705
 706                         filter_escape_value( &f->f_sub_final, &tmp );
 707
 708                         fstr->bv_len += tmp.bv_len;
 709                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 710
 711                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 712                                 /* "(attr=[init*][any*]" */ "%s)",
 713                                 tmp.bv_val );
 714
 715                         ber_memfree( tmp.bv_val );
 716                 }
 717
 718                 break;
 719
 720         case LDAP_FILTER_PRESENT:
 721                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
 722                         ( sizeof("(=*)") - 1 );
 723                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 724
 725                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 726                         f->f_desc->ad_cname.bv_val );
 727                 break;
 728
 729         case LDAP_FILTER_AND:
 730         case LDAP_FILTER_OR:
 731         case LDAP_FILTER_NOT:
 732                 fstr->bv_len = sizeof("(%)") - 1;
 733                 fstr->bv_val = malloc( fstr->bv_len + 128 );
 734
 735                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 736                         f->f_choice == LDAP_FILTER_AND ? '&' :
 737                         f->f_choice == LDAP_FILTER_OR ? '|' : '!' );
 738
 739                 for ( p = f->f_list; p != NULL; p = p->f_next ) {
 740                         len = fstr->bv_len;
 741
 742                         filter2bv( p, &tmp );
 743
 744                         fstr->bv_len += tmp.bv_len;
 745                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
 746
 747                         snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
 748                                 /*"("*/ "%s)", tmp.bv_val );
 749
 750                         ch_free( tmp.bv_val );
 751                 }
 752
 753                 break;
 754
 755         case LDAP_FILTER_EXT: {
 756                 struct berval ad;
 757                 filter_escape_value( &f->f_mr_value, &tmp );
 758
 759                 if ( f->f_mr_desc ) {
 760                         ad = f->f_mr_desc->ad_cname;
 761                 } else {
 762                         ad.bv_len = 0;
 763                         ad.bv_val = "";
 764                 }
 765
 766                 fstr->bv_len = ad.bv_len +
 767                         ( f->f_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
 768                         ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
 769                         tmp.bv_len + ( sizeof("(:=)") - 1 );
 770                 fstr->bv_val = malloc( fstr->bv_len + 1 );
 771
 772                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
 773                         ad.bv_val,
 774                         f->f_mr_dnattrs ? ":dn" : "",
 775                         f->f_mr_rule_text.bv_len ? ":" : "",
 776                         f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
 777                         tmp.bv_val );
 778                 ber_memfree( tmp.bv_val );
 779                 } break;
 780
 781         case SLAPD_FILTER_COMPUTED:
 782                 ber_str2bv(
 783                         f->f_result == LDAP_COMPARE_FALSE ? "(?=false)" :
 784                         f->f_result == LDAP_COMPARE_TRUE ? "(?=true)" :
 785                         f->f_result == SLAPD_COMPARE_UNDEFINED ? "(?=undefined)" :
 786                         "(?=error)",
 787                         f->f_result == LDAP_COMPARE_FALSE ? sizeof("(?=false)")-1 :
 788                         f->f_result == LDAP_COMPARE_TRUE ? sizeof("(?=true)")-1 :
 789                         f->f_result == SLAPD_COMPARE_UNDEFINED ? sizeof("(?=undefined)")-1 :
 790                         sizeof("(?=error)")-1,
 791                         1, fstr );
 792                 break;
 793
 794         default:
 795                 ber_str2bv( "(?=unknown)", sizeof("(?=unknown)")-1, 1, fstr );
 796                 break;
 797         }
 798 }
 799
 800 static int filter_escape_value(
 801         struct berval *in,
 802         struct berval *out )
 803 {
 804         ber_len_t i;
 805         assert( in );
 806         assert( out );
 807
 808         out->bv_val = (char *) ch_malloc( ( in->bv_len * 3 ) + 1 );
 809         out->bv_len = 0;
 810
 811         for( i=0; i < in->bv_len ; i++ ) {
 812                 if( FILTER_ESCAPE(in->bv_val[i]) ) {
 813                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_CHAR;
 814                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_HI( in->bv_val[i] );
 815                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_LO( in->bv_val[i] );
 816                 } else {
 817                         out->bv_val[out->bv_len++] = in->bv_val[i];
 818                 }
 819         }
 820
 821         out->bv_val[out->bv_len] = '\0';
 822         return LDAP_SUCCESS;
 823 }
 824
 825 static int
 826 get_simple_vrFilter(
 827         Connection *conn,
 828         BerElement *ber,
 829         ValuesReturnFilter **filt,
 830         const char **text )
 831 {
 832         ber_tag_t       tag;
 833         ber_len_t       len;
 834         int             err;
 835         ValuesReturnFilter *vrf;
 836
 837 #ifdef NEW_LOGGING
 838         LDAP_LOG( FILTER, ENTRY,
 839                 "get_simple_vrFilter: conn %d\n", conn->c_connid, 0, 0 );
 840 #else
 841         Debug( LDAP_DEBUG_FILTER, "begin get_simple_vrFilter\n", 0, 0, 0 );
 842 #endif
 843
 844         tag = ber_peek_tag( ber, &len );
 845
 846         if( tag == LBER_ERROR ) {
 847                 *text = "error decoding filter";
 848                 return SLAPD_DISCONNECT;
 849         }
 850
 851         vrf = (ValuesReturnFilter *) ch_malloc( sizeof(ValuesReturnFilter) );
 852         vrf->vrf_next = NULL;
 853
 854         err = LDAP_SUCCESS;
 855         vrf->vrf_choice = tag;
 856
 857         switch ( vrf->vrf_choice ) {
 858         case LDAP_FILTER_EQUALITY:
 859 #ifdef NEW_LOGGING
 860                 LDAP_LOG( FILTER, DETAIL2,
 861                         "get_simple_vrFilter: conn %d  EQUALITY\n", conn->c_connid, 0, 0 );
 862 #else
 863                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 864 #endif
 865                 err = get_ava( ber, &vrf->vrf_ava, SLAP_MR_EQUALITY, text );
 866                 if ( err != LDAP_SUCCESS ) {
 867                         break;
 868                 }
 869
 870                 assert( vrf->vrf_ava != NULL );
 871                 break;
 872
 873         case LDAP_FILTER_SUBSTRINGS:
 874 #ifdef NEW_LOGGING
 875                 LDAP_LOG( FILTER, DETAIL1,
 876                         "get_simple_vrFilter: conn %d  SUBSTRINGS\n", conn->c_connid, 0, 0 );
 877 #else
 878                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 879 #endif
 880                 err = get_substring_filter( conn, ber, (Filter *)vrf, text );
 881                 break;
 882
 883         case LDAP_FILTER_GE:
 884 #ifdef NEW_LOGGING
 885                 LDAP_LOG( FILTER, DETAIL1,
 886                         "get_simple_vrFilter: conn %d  GE\n", conn->c_connid, 0, 0 );
 887 #else
 888                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 889 #endif
 890                 err = get_ava( ber, &vrf->vrf_ava, SLAP_MR_ORDERING, text );
 891                 if ( err != LDAP_SUCCESS ) {
 892                         break;
 893                 }
 894                 break;
 895
 896         case LDAP_FILTER_LE:
 897 #ifdef NEW_LOGGING
 898                 LDAP_LOG( FILTER, DETAIL1,
 899                         "get_simple_vrFilter: conn %d  LE\n", conn->c_connid, 0, 0 );
 900 #else
 901                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 902 #endif
 903                 err = get_ava( ber, &vrf->vrf_ava, SLAP_MR_ORDERING, text );
 904                 if ( err != LDAP_SUCCESS ) {
 905                         break;
 906                 }
 907                 break;
 908
 909         case LDAP_FILTER_PRESENT: {
 910                 struct berval type;
 911
 912 #ifdef NEW_LOGGING
 913                 LDAP_LOG( FILTER, DETAIL1,
 914                         "get_simple_vrFilter: conn %d PRESENT\n", conn->c_connid, 0, 0 );
 915 #else
 916                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 917 #endif
 918                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 919                         err = SLAPD_DISCONNECT;
 920                         *text = "error decoding filter";
 921                         break;
 922                 }
 923
 924                 vrf->vrf_desc = NULL;
 925                 err = slap_bv2ad( &type, &vrf->vrf_desc, text );
 926
 927                 if( err != LDAP_SUCCESS ) {
 928                         /* unrecognized attribute description or other error */
 929                         vrf->vrf_choice = SLAPD_FILTER_COMPUTED;
 930                         vrf->vrf_result = LDAP_COMPARE_FALSE;
 931                         err = LDAP_SUCCESS;
 932                         break;
 933                 }
 934                 } break;
 935
 936         case LDAP_FILTER_APPROX:
 937 #ifdef NEW_LOGGING
 938                 LDAP_LOG( FILTER, DETAIL1,
 939                         "get_simple_vrFilter: conn %d  APPROX\n", conn->c_connid, 0, 0 );
 940 #else
 941                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 942 #endif
 943                 err = get_ava( ber, &vrf->vrf_ava, SLAP_MR_EQUALITY_APPROX, text );
 944                 if ( err != LDAP_SUCCESS ) {
 945                         break;
 946                 }
 947                 break;
 948
 949         case LDAP_FILTER_EXT:
 950 #ifdef NEW_LOGGING
 951                 LDAP_LOG( FILTER, DETAIL1,
 952                         "get_simple_vrFilter: conn %d  EXTENSIBLE\n", conn->c_connid, 0, 0 );
 953 #else
 954                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 955 #endif
 956
 957                 err = get_mra( ber, &vrf->vrf_mra, text );
 958                 if ( err != LDAP_SUCCESS ) {
 959                         break;
 960                 }
 961
 962                 assert( vrf->vrf_mra != NULL );
 963                 break;
 964
 965         default:
 966                 (void) ber_scanf( ber, "x" ); /* skip the element */
 967 #ifdef NEW_LOGGING
 968                 LDAP_LOG( FILTER, ERR,
 969                         "get_simple_vrFilter: conn %d unknown filter type=%lu\n",
 970                         conn->c_connid, vrf->vrf_choice, 0 );
 971 #else
 972                 Debug( LDAP_DEBUG_ANY, "get_simple_vrFilter: unknown filter type=%lu\n",
 973                         vrf->vrf_choice, 0, 0 );
 974 #endif
 975                 vrf->vrf_choice = SLAPD_FILTER_COMPUTED;
 976                 vrf->vrf_result = SLAPD_COMPARE_UNDEFINED;
 977                 break;
 978         }
 979
 980         if ( err != LDAP_SUCCESS ) {
 981                 if( err != SLAPD_DISCONNECT ) {
 982                         /* ignore error */
 983                         vrf->vrf_choice = SLAPD_FILTER_COMPUTED;
 984                         vrf->vrf_result = SLAPD_COMPARE_UNDEFINED;
 985                         err = LDAP_SUCCESS;
 986                         *filt = vrf;
 987
 988                 } else {
 989                         free(vrf);
 990                 }
 991
 992         } else {
 993                 *filt = vrf;
 994         }
 995
 996 #ifdef NEW_LOGGING
 997         LDAP_LOG( FILTER, DETAIL2,
 998                 "get_simple_vrFilter: conn %d exit\n", conn->c_connid, 0, 0 );
 999 #else
1000         Debug( LDAP_DEBUG_FILTER, "end get_simple_vrFilter %d\n", err, 0, 0 );
1001 #endif
1002         return( err );
1003 }
1004
1005 int
1006 get_vrFilter( Connection *conn, BerElement *ber,
1007         ValuesReturnFilter **vrf,
1008         const char **text )
1009 {
1010         /*
1011          * A ValuesReturnFilter looks like this:
1012          *
1013          *      ValuesReturnFilter ::= SEQUENCE OF SimpleFilterItem
1014          *      SimpleFilterItem ::= CHOICE {
1015          *              equalityMatch   [3]     AttributeValueAssertion,
1016          *              substrings      [4]     SubstringFilter,
1017          *              greaterOrEqual  [5]     AttributeValueAssertion,
1018          *              lessOrEqual     [6]     AttributeValueAssertion,
1019          *              present         [7]     AttributeType,
1020          *              approxMatch     [8]     AttributeValueAssertion,
1021          *              extensibleMatch [9]     SimpleMatchingAssertion -- LDAPv3
1022          *      }
1023          *
1024          *      SubstringFilter ::= SEQUENCE {
1025          *              type               AttributeType,
1026          *              SEQUENCE OF CHOICE {
1027          *                      initial          [0] IA5String,
1028          *                      any              [1] IA5String,
1029          *                      final            [2] IA5String
1030          *              }
1031          *      }
1032          *
1033          *      SimpleMatchingAssertion ::= SEQUENCE {  -- LDAPv3
1034          *              matchingRule    [1] MatchingRuleId OPTIONAL,
1035          *              type            [2] AttributeDescription OPTIONAL,
1036          *              matchValue      [3] AssertionValue }
1037          */
1038
1039         ValuesReturnFilter **n;
1040         ber_tag_t       tag;
1041         ber_len_t       len;
1042         char            *last;
1043
1044 #ifdef NEW_LOGGING
1045         LDAP_LOG( FILTER, ENTRY,
1046                 "get_vrFilter: conn %d start\n", conn->c_connid, 0, 0 );
1047 #else
1048         Debug( LDAP_DEBUG_FILTER, "begin get_vrFilter\n", 0, 0, 0 );
1049 #endif
1050
1051         tag = ber_peek_tag( ber, &len );
1052
1053         if( tag == LBER_ERROR ) {
1054                 *text = "error decoding vrFilter";
1055                 return SLAPD_DISCONNECT;
1056         }
1057
1058         if( tag != LBER_SEQUENCE ) {
1059                 *text = "error decoding vrFilter, expect SEQUENCE tag";
1060                 return SLAPD_DISCONNECT;
1061         }
1062
1063         n = vrf;
1064         for ( tag = ber_first_element( ber, &len, &last );
1065                 tag != LBER_DEFAULT;
1066                 tag = ber_next_element( ber, &len, last ) )
1067         {
1068                 int err = get_simple_vrFilter( conn, ber, n, text );
1069                 if ( err != LDAP_SUCCESS )
1070                         return( err );
1071                 n = &(*n)->vrf_next;
1072         }
1073         *n = NULL;
1074
1075 #ifdef NEW_LOGGING
1076         LDAP_LOG( FILTER, ENTRY,
1077                 "get_vrFilter: conn %d exit\n", conn->c_connid, 0, 0 );
1078 #else
1079         Debug( LDAP_DEBUG_FILTER, "end get_vrFilter\n", 0, 0, 0 );
1080 #endif
1081         return( LDAP_SUCCESS );
1082 }
1083
1084 void
1085 vrFilter_free( ValuesReturnFilter *vrf )
1086 {
1087         ValuesReturnFilter      *p, *next;
1088
1089         if ( vrf == NULL ) {
1090                 return;
1091         }
1092
1093         for ( p = vrf; p != NULL; p = next ) {
1094                 next = p->vrf_next;
1095
1096                 switch ( vrf->vrf_choice ) {
1097                 case LDAP_FILTER_PRESENT:
1098                         break;
1099
1100                 case LDAP_FILTER_EQUALITY:
1101                 case LDAP_FILTER_GE:
1102                 case LDAP_FILTER_LE:
1103                 case LDAP_FILTER_APPROX:
1104                         ava_free( vrf->vrf_ava, 1 );
1105                         break;
1106
1107                 case LDAP_FILTER_SUBSTRINGS:
1108                         if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1109                                 free( vrf->vrf_sub_initial.bv_val );
1110                         }
1111                         ber_bvarray_free( vrf->vrf_sub_any );
1112                         if ( vrf->vrf_sub_final.bv_val != NULL ) {
1113                                 free( vrf->vrf_sub_final.bv_val );
1114                         }
1115                         ch_free( vrf->vrf_sub );
1116                         break;
1117
1118                 case LDAP_FILTER_EXT:
1119                         mra_free( vrf->vrf_mra, 1 );
1120                         break;
1121
1122                 case SLAPD_FILTER_COMPUTED:
1123                         break;
1124
1125                 default:
1126 #ifdef NEW_LOGGING
1127                         LDAP_LOG( FILTER, ERR,
1128                                 "filter_free: unknown filter type %lu\n", vrf->vrf_choice, 0, 0 );
1129 #else
1130                         Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
1131                                 vrf->vrf_choice, 0, 0 );
1132 #endif
1133                         break;
1134                 }
1135
1136                 free( vrf );
1137         }
1138 }
1139
1140
1141 void
1142 vrFilter2bv( ValuesReturnFilter *vrf, struct berval *fstr )
1143 {
1144         ValuesReturnFilter      *p;
1145         struct berval tmp;
1146         ber_len_t len;
1147
1148         if ( vrf == NULL ) {
1149                 ber_str2bv( "No filter!", sizeof("No filter!")-1, 1, fstr );
1150                 return;
1151         }
1152
1153         fstr->bv_len = sizeof("()") - 1;
1154         fstr->bv_val = malloc( fstr->bv_len + 128 );
1155
1156         snprintf( fstr->bv_val, fstr->bv_len + 1, "()");
1157
1158         for ( p = vrf; p != NULL; p = p->vrf_next ) {
1159                 len = fstr->bv_len;
1160
1161                 simple_vrFilter2bv( p, &tmp );
1162
1163                 fstr->bv_len += tmp.bv_len;
1164                 fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1165
1166                 snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
1167                         /*"("*/ "%s)", tmp.bv_val );
1168
1169                 ch_free( tmp.bv_val );
1170         }
1171 }
1172
1173 static void
1174 simple_vrFilter2bv( ValuesReturnFilter *vrf, struct berval *fstr )
1175 {
1176         struct berval tmp;
1177         ber_len_t len;
1178
1179         if ( vrf == NULL ) {
1180                 ber_str2bv( "No filter!", sizeof("No filter!")-1, 1, fstr );
1181                 return;
1182         }
1183
1184         switch ( vrf->vrf_choice ) {
1185         case LDAP_FILTER_EQUALITY:
1186                 filter_escape_value( &vrf->vrf_av_value, &tmp );
1187
1188                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1189                         tmp.bv_len + ( sizeof("(=)") - 1 );
1190                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1191
1192                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
1193                         vrf->vrf_av_desc->ad_cname.bv_val,
1194                         tmp.bv_val );
1195
1196                 ber_memfree( tmp.bv_val );
1197                 break;
1198
1199         case LDAP_FILTER_GE:
1200                 filter_escape_value( &vrf->vrf_av_value, &tmp );
1201
1202                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1203                         tmp.bv_len + ( sizeof("(>=)") - 1 );
1204                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1205
1206                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
1207                         vrf->vrf_av_desc->ad_cname.bv_val,
1208                         tmp.bv_val );
1209
1210                 ber_memfree( tmp.bv_val );
1211                 break;
1212
1213         case LDAP_FILTER_LE:
1214                 filter_escape_value( &vrf->vrf_av_value, &tmp );
1215
1216                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1217                         tmp.bv_len + ( sizeof("(<=)") - 1 );
1218                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1219
1220                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
1221                         vrf->vrf_av_desc->ad_cname.bv_val,
1222                         tmp.bv_val );
1223
1224                 ber_memfree( tmp.bv_val );
1225                 break;
1226
1227         case LDAP_FILTER_APPROX:
1228                 filter_escape_value( &vrf->vrf_av_value, &tmp );
1229
1230                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1231                         tmp.bv_len + ( sizeof("(~=)") - 1 );
1232                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1233
1234                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
1235                         vrf->vrf_av_desc->ad_cname.bv_val,
1236                         tmp.bv_val );
1237                 ber_memfree( tmp.bv_val );
1238                 break;
1239
1240         case LDAP_FILTER_SUBSTRINGS:
1241                 fstr->bv_len = vrf->vrf_sub_desc->ad_cname.bv_len +
1242                         ( sizeof("(=*)") - 1 );
1243                 fstr->bv_val = malloc( fstr->bv_len + 128 );
1244
1245                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1246                         vrf->vrf_sub_desc->ad_cname.bv_val );
1247
1248                 if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1249                         len = fstr->bv_len;
1250
1251                         filter_escape_value( &vrf->vrf_sub_initial, &tmp );
1252
1253                         fstr->bv_len += tmp.bv_len;
1254                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1255
1256                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
1257                                 /* "(attr=" */ "%s*)",
1258                                 tmp.bv_val );
1259
1260                         ber_memfree( tmp.bv_val );
1261                 }
1262
1263                 if ( vrf->vrf_sub_any != NULL ) {
1264                         int i;
1265                         for ( i = 0; vrf->vrf_sub_any[i].bv_val != NULL; i++ ) {
1266                                 len = fstr->bv_len;
1267                                 filter_escape_value( &vrf->vrf_sub_any[i], &tmp );
1268
1269                                 fstr->bv_len += tmp.bv_len + 1;
1270                                 fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1271
1272                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1273                                         /* "(attr=[init]*[any*]" */ "%s*)",
1274                                         tmp.bv_val );
1275                                 ber_memfree( tmp.bv_val );
1276                         }
1277                 }
1278
1279                 if ( vrf->vrf_sub_final.bv_val != NULL ) {
1280                         len = fstr->bv_len;
1281
1282                         filter_escape_value( &vrf->vrf_sub_final, &tmp );
1283
1284                         fstr->bv_len += tmp.bv_len;
1285                         fstr->bv_val = ch_realloc( fstr->bv_val, fstr->bv_len + 1 );
1286
1287                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1288                                 /* "(attr=[init*][any*]" */ "%s)",
1289                                 tmp.bv_val );
1290
1291                         ber_memfree( tmp.bv_val );
1292                 }
1293
1294                 break;
1295
1296         case LDAP_FILTER_PRESENT:
1297                 fstr->bv_len = vrf->vrf_desc->ad_cname.bv_len +
1298                         ( sizeof("(=*)") - 1 );
1299                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1300
1301                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1302                         vrf->vrf_desc->ad_cname.bv_val );
1303                 break;
1304
1305         case LDAP_FILTER_EXT: {
1306                 struct berval ad;
1307                 filter_escape_value( &vrf->vrf_mr_value, &tmp );
1308
1309                 if ( vrf->vrf_mr_desc ) {
1310                         ad = vrf->vrf_mr_desc->ad_cname;
1311                 } else {
1312                         ad.bv_len = 0;
1313                         ad.bv_val = "";
1314                 }
1315
1316                 fstr->bv_len = ad.bv_len +
1317                         ( vrf->vrf_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
1318                         ( vrf->vrf_mr_rule_text.bv_len ? vrf->vrf_mr_rule_text.bv_len+1 : 0 ) +
1319                         tmp.bv_len + ( sizeof("(:=)") - 1 );
1320                 fstr->bv_val = malloc( fstr->bv_len + 1 );
1321
1322                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
1323                         ad.bv_val,
1324                         vrf->vrf_mr_dnattrs ? ":dn" : "",
1325                         vrf->vrf_mr_rule_text.bv_len ? ":" : "",
1326                         vrf->vrf_mr_rule_text.bv_len ? vrf->vrf_mr_rule_text.bv_val : "",
1327                         tmp.bv_val );
1328
1329                 ber_memfree( tmp.bv_val );
1330                 } break;
1331
1332         case SLAPD_FILTER_COMPUTED:
1333                 ber_str2bv(
1334                         vrf->vrf_result == LDAP_COMPARE_FALSE ? "(?=false)" :
1335                         vrf->vrf_result == LDAP_COMPARE_TRUE ? "(?=true)" :
1336                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED ? "(?=undefined)" :
1337                         "(?=error)",
1338                         vrf->vrf_result == LDAP_COMPARE_FALSE ? sizeof("(?=false)")-1 :
1339                         vrf->vrf_result == LDAP_COMPARE_TRUE ? sizeof("(?=true)")-1 :
1340                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED ? sizeof("(?=undefined)")-1 :
1341                         sizeof("(?=error)")-1,
1342                         1, fstr );
1343                 break;
1344
1345         default:
1346                 ber_str2bv( "(?=unknown)", sizeof("(?=unknown)")-1, 1, fstr );
1347                 break;
1348         }
1349 }
1350
1351 static int
1352 get_substring_vrFilter(
1353         Connection      *conn,
1354         BerElement      *ber,
1355         ValuesReturnFilter      *vrf,
1356         const char      **text )
1357 {
1358         ber_tag_t       tag;
1359         ber_len_t       len;
1360         ber_tag_t       rc;
1361         struct berval value;
1362         char            *last;
1363         struct berval bv;
1364         *text = "error decoding filter";
1365
1366 #ifdef NEW_LOGGING
1367         LDAP_LOG( FILTER, ENTRY,
1368                 "get_substring_filter: conn %d  begin\n", conn->c_connid, 0, 0 );
1369 #else
1370         Debug( LDAP_DEBUG_FILTER, "begin get_substring_filter\n", 0, 0, 0 );
1371 #endif
1372         if ( ber_scanf( ber, "{m" /*}*/, &bv ) == LBER_ERROR ) {
1373                 return SLAPD_DISCONNECT;
1374         }
1375
1376         vrf->vrf_sub = ch_calloc( 1, sizeof(SubstringsAssertion) );
1377         vrf->vrf_sub_desc = NULL;
1378         rc = slap_bv2ad( &bv, &vrf->vrf_sub_desc, text );
1379
1380         if( rc != LDAP_SUCCESS ) {
1381                 text = NULL;
1382                 ch_free( vrf->vrf_sub );
1383                 vrf->vrf_choice = SLAPD_FILTER_COMPUTED;
1384                 vrf->vrf_result = SLAPD_COMPARE_UNDEFINED;
1385                 return LDAP_SUCCESS;
1386         }
1387
1388         vrf->vrf_sub_initial.bv_val = NULL;
1389         vrf->vrf_sub_any = NULL;
1390         vrf->vrf_sub_final.bv_val = NULL;
1391
1392         for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
1393                 tag = ber_next_element( ber, &len, last ) )
1394         {
1395                 unsigned usage;
1396
1397                 rc = ber_scanf( ber, "m", &value );
1398                 if ( rc == LBER_ERROR ) {
1399                         rc = SLAPD_DISCONNECT;
1400                         goto return_error;
1401                 }
1402
1403                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
1404                         rc = LDAP_INVALID_SYNTAX;
1405                         goto return_error;
1406                 }
1407
1408                 switch ( tag ) {
1409                 case LDAP_SUBSTRING_INITIAL:
1410                         usage = SLAP_MR_SUBSTR_INITIAL;
1411                         break;
1412
1413                 case LDAP_SUBSTRING_ANY:
1414                         usage = SLAP_MR_SUBSTR_ANY;
1415                         break;
1416
1417                 case LDAP_SUBSTRING_FINAL:
1418                         usage = SLAP_MR_SUBSTR_FINAL;
1419                         break;
1420
1421                 default:
1422                         rc = LDAP_PROTOCOL_ERROR;
1423
1424 #ifdef NEW_LOGGING
1425                         LDAP_LOG( FILTER, ERR,
1426                                 "get_filter_substring: conn %d  unknown substring choice=%ld\n",
1427                                 conn->c_connid, (long)tag, 0 );
1428 #else
1429                         Debug( LDAP_DEBUG_FILTER,
1430                                 "  unknown substring choice=%ld\n",
1431                                 (long) tag, 0, 0 );
1432 #endif
1433                         goto return_error;
1434                 }
1435
1436 #ifdef SLAP_NVALUES
1437                 /* validate/normalize using equality matching rule validator! */
1438                 rc = asserted_value_validate_normalize(
1439                         vrf->vrf_sub_desc, vrf->vrf_sub_desc->ad_type->sat_equality,
1440                         usage, &value, &bv, text );
1441                 if( rc != LDAP_SUCCESS ) {
1442                         goto return_error;
1443                 }
1444 #else
1445                 /* valiate using equality matching rule validator! */
1446                 rc = value_validate( vrf->vrf_sub_desc->ad_type->sat_equality,
1447                         &value, text );
1448                 if( rc != LDAP_SUCCESS ) {
1449                         goto return_error;
1450                 }
1451
1452                 rc = value_normalize( vrf->vrf_sub_desc, usage,
1453                         &value, &bv, text );
1454                 if( rc != LDAP_SUCCESS ) {
1455                         goto return_error;
1456                 }
1457 #endif
1458
1459                 value = bv;
1460
1461                 rc = LDAP_PROTOCOL_ERROR;
1462
1463                 switch ( tag ) {
1464                 case LDAP_SUBSTRING_INITIAL:
1465 #ifdef NEW_LOGGING
1466                         LDAP_LOG( FILTER, DETAIL1,
1467                                 "get_substring_filter: conn %d  INITIAL\n",
1468                                 conn->c_connid, 0, 0 );
1469 #else
1470                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
1471 #endif
1472
1473                         if ( vrf->vrf_sub_initial.bv_val != NULL
1474                                 || vrf->vrf_sub_any != NULL
1475                                 || vrf->vrf_sub_final.bv_val != NULL )
1476                         {
1477                                 free( value.bv_val );
1478                                 goto return_error;
1479                         }
1480
1481                         vrf->vrf_sub_initial = value;
1482                         break;
1483
1484                 case LDAP_SUBSTRING_ANY:
1485 #ifdef NEW_LOGGING
1486                         LDAP_LOG( FILTER, DETAIL1,
1487                                 "get_substring_filter: conn %d  ANY\n", conn->c_connid, 0, 0 );
1488 #else
1489                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
1490 #endif
1491
1492                         if ( vrf->vrf_sub_final.bv_val != NULL ) {
1493                                 free( value.bv_val );
1494                                 goto return_error;
1495                         }
1496
1497                         ber_bvarray_add( &vrf->vrf_sub_any, &value );
1498                         break;
1499
1500                 case LDAP_SUBSTRING_FINAL:
1501 #ifdef NEW_LOGGING
1502                         LDAP_LOG( FILTER, DETAIL1,
1503                                 "get_substring_filter: conn %d  FINAL\n", conn->c_connid, 0, 0 );
1504 #else
1505                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
1506 #endif
1507
1508                         if ( vrf->vrf_sub_final.bv_val != NULL ) {
1509                                 free( value.bv_val );
1510                                 goto return_error;
1511                         }
1512
1513                         vrf->vrf_sub_final = value;
1514                         break;
1515
1516                 default:
1517 #ifdef NEW_LOGGING
1518                         LDAP_LOG( FILTER, INFO,
1519                                 "get_substring_filter: conn %d  unknown substring type %ld\n",
1520                                 conn->c_connid, (long)tag, 0 );
1521 #else
1522                         Debug( LDAP_DEBUG_FILTER,
1523                                 "  unknown substring type=%ld\n",
1524                                 (long) tag, 0, 0 );
1525 #endif
1526
1527                         free( value.bv_val );
1528
1529 return_error:
1530 #ifdef NEW_LOGGING
1531                         LDAP_LOG( FILTER, INFO,
1532                                 "get_substring_filter: conn %d  error %ld\n",
1533                                 conn->c_connid, (long)rc, 0 );
1534 #else
1535                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
1536                                 (long) rc, 0, 0 );
1537 #endif
1538                         free( vrf->vrf_sub_initial.bv_val );
1539                         ber_bvarray_free( vrf->vrf_sub_any );
1540                         free( vrf->vrf_sub_final.bv_val );
1541                         ch_free( vrf->vrf_sub );
1542                         return rc;
1543                 }
1544         }
1545
1546 #ifdef NEW_LOGGING
1547         LDAP_LOG( FILTER, ENTRY,
1548                 "get_substring_filter: conn %d exit\n", conn->c_connid, 0, 0 );
1549 #else
1550         Debug( LDAP_DEBUG_FILTER, "end get_substring_filter\n", 0, 0, 0 );
1551 #endif
1552         return( LDAP_SUCCESS );
1553 }
1554