git.sur5r.net Git - openldap/blob - servers/slapd/filter.c

   1 /* filter.c - routines for parsing and dealing with filters */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2004 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/socket.h>
  32 #include <ac/string.h>
  33
  34 #include "slap.h"
  35
  36 static int      get_filter_list(
  37         Operation *op,
  38         BerElement *ber,
  39         Filter **f,
  40         const char **text );
  41
  42 static int      get_ssa(
  43         Operation *op,
  44         BerElement *ber,
  45         SubstringsAssertion **s,
  46         const char **text );
  47
  48 static int filter_escape_value_x(
  49         struct berval *in,
  50         struct berval *out,
  51         void *ctx );
  52
  53 static void simple_vrFilter2bv(
  54         Operation *op,
  55         ValuesReturnFilter *f,
  56         struct berval *fstr );
  57
  58 static int      get_simple_vrFilter(
  59         Operation *op,
  60         BerElement *ber,
  61         ValuesReturnFilter **f,
  62         const char **text );
  63
  64 int
  65 get_filter(
  66         Operation *op,
  67         BerElement *ber,
  68         Filter **filt,
  69         const char **text )
  70 {
  71         ber_tag_t       tag;
  72         ber_len_t       len;
  73         int             err;
  74         Filter          f;
  75
  76         Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
  77         /*
  78          * A filter looks like this coming in:
  79          *      Filter ::= CHOICE {
  80          *              and             [0]     SET OF Filter,
  81          *              or              [1]     SET OF Filter,
  82          *              not             [2]     Filter,
  83          *              equalityMatch   [3]     AttributeValueAssertion,
  84          *              substrings      [4]     SubstringFilter,
  85          *              greaterOrEqual  [5]     AttributeValueAssertion,
  86          *              lessOrEqual     [6]     AttributeValueAssertion,
  87          *              present         [7]     AttributeType,,
  88          *              approxMatch     [8]     AttributeValueAssertion
  89          *              extensibleMatch [9]     MatchingRuleAssertion
  90          *      }
  91          *
  92          *      SubstringFilter ::= SEQUENCE {
  93          *              type               AttributeType,
  94          *              SEQUENCE OF CHOICE {
  95          *                      initial          [0] IA5String,
  96          *                      any              [1] IA5String,
  97          *                      final            [2] IA5String
  98          *              }
  99          *      }
 100          *
 101          *      MatchingRuleAssertion ::= SEQUENCE {
 102          *              matchingRule    [1] MatchingRuleId OPTIONAL,
 103          *              type            [2] AttributeDescription OPTIONAL,
 104          *              matchValue      [3] AssertionValue,
 105          *              dnAttributes    [4] BOOLEAN DEFAULT FALSE
 106          *      }
 107          *
 108          */
 109
 110         tag = ber_peek_tag( ber, &len );
 111
 112         if( tag == LBER_ERROR ) {
 113                 *text = "error decoding filter";
 114                 return SLAPD_DISCONNECT;
 115         }
 116
 117         err = LDAP_SUCCESS;
 118
 119         f.f_next = NULL;
 120         f.f_choice = tag;
 121
 122         switch ( f.f_choice ) {
 123         case LDAP_FILTER_EQUALITY:
 124                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 125                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_EQUALITY, text );
 126                 if ( err != LDAP_SUCCESS ) {
 127                         break;
 128                 }
 129
 130                 assert( f.f_ava != NULL );
 131                 break;
 132
 133         case LDAP_FILTER_SUBSTRINGS:
 134                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 135                 err = get_ssa( op, ber, &f.f_sub, text );
 136                 if( err != LDAP_SUCCESS ) {
 137                         break;
 138                 }
 139                 assert( f.f_sub != NULL );
 140                 break;
 141
 142         case LDAP_FILTER_GE:
 143                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 144                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_ORDERING, text );
 145                 if ( err != LDAP_SUCCESS ) {
 146                         break;
 147                 }
 148                 assert( f.f_ava != NULL );
 149                 break;
 150
 151         case LDAP_FILTER_LE:
 152                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 153                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_ORDERING, text );
 154                 if ( err != LDAP_SUCCESS ) {
 155                         break;
 156                 }
 157                 assert( f.f_ava != NULL );
 158                 break;
 159
 160         case LDAP_FILTER_PRESENT: {
 161                 struct berval type;
 162
 163                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 164                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 165                         err = SLAPD_DISCONNECT;
 166                         *text = "error decoding filter";
 167                         break;
 168                 }
 169
 170                 f.f_desc = NULL;
 171                 err = slap_bv2ad( &type, &f.f_desc, text );
 172
 173                 if( err != LDAP_SUCCESS ) {
 174                         /* unrecognized attribute description or other error */
 175                         Debug( LDAP_DEBUG_ANY,
 176                                 "get_filter: conn %d unknown attribute "
 177                                 "type=%s (%d)\n",
 178                                 op->o_connid, type.bv_val, err );
 179
 180                         f.f_choice = SLAPD_FILTER_COMPUTED;
 181                         f.f_result = LDAP_COMPARE_FALSE;
 182                         err = LDAP_SUCCESS;
 183                         *text = NULL;
 184                         break;
 185                 }
 186
 187                 assert( f.f_desc != NULL );
 188                 } break;
 189
 190         case LDAP_FILTER_APPROX:
 191                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 192                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_EQUALITY_APPROX, text );
 193                 if ( err != LDAP_SUCCESS ) {
 194                         break;
 195                 }
 196                 assert( f.f_ava != NULL );
 197                 break;
 198
 199         case LDAP_FILTER_AND:
 200                 Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
 201                 err = get_filter_list( op, ber, &f.f_and, text );
 202                 if ( err != LDAP_SUCCESS ) {
 203                         break;
 204                 }
 205                 if ( f.f_and == NULL ) {
 206                         f.f_choice = SLAPD_FILTER_COMPUTED;
 207                         f.f_result = LDAP_COMPARE_TRUE;
 208                 }
 209                 /* no assert - list could be empty */
 210                 break;
 211
 212         case LDAP_FILTER_OR:
 213                 Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
 214                 err = get_filter_list( op, ber, &f.f_or, text );
 215                 if ( err != LDAP_SUCCESS ) {
 216                         break;
 217                 }
 218                 if ( f.f_or == NULL ) {
 219                         f.f_choice = SLAPD_FILTER_COMPUTED;
 220                         f.f_result = LDAP_COMPARE_FALSE;
 221                 }
 222                 /* no assert - list could be empty */
 223                 break;
 224
 225         case LDAP_FILTER_NOT:
 226                 Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
 227                 (void) ber_skip_tag( ber, &len );
 228                 err = get_filter( op, ber, &f.f_not, text );
 229                 if ( err != LDAP_SUCCESS ) {
 230                         break;
 231                 }
 232
 233                 assert( f.f_not != NULL );
 234                 if ( f.f_not->f_choice == SLAPD_FILTER_COMPUTED ) {
 235                         int fresult = f.f_not->f_result;
 236                         f.f_choice = SLAPD_FILTER_COMPUTED;
 237                         op->o_tmpfree( f.f_not, op->o_tmpmemctx );
 238                         f.f_not = NULL;
 239
 240                         switch( fresult ) {
 241                         case LDAP_COMPARE_TRUE:
 242                                 f.f_result = LDAP_COMPARE_FALSE;
 243                                 break;
 244                         case LDAP_COMPARE_FALSE:
 245                                 f.f_result = LDAP_COMPARE_TRUE;
 246                                 break;
 247                         default: ;
 248                                 /* (!Undefined) is Undefined */
 249                         }
 250                 }
 251                 break;
 252
 253         case LDAP_FILTER_EXT:
 254                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 255
 256                 err = get_mra( op, ber, &f.f_mra, text );
 257                 if ( err != LDAP_SUCCESS ) {
 258                         break;
 259                 }
 260
 261                 assert( f.f_mra != NULL );
 262                 break;
 263
 264         default:
 265                 (void) ber_scanf( ber, "x" ); /* skip the element */
 266                 Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
 267                         f.f_choice, 0, 0 );
 268                 f.f_choice = SLAPD_FILTER_COMPUTED;
 269                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 270                 break;
 271         }
 272
 273         if( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 274                 /* ignore error */
 275                 *text = NULL;
 276                 f.f_choice = SLAPD_FILTER_COMPUTED;
 277                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 278                 err = LDAP_SUCCESS;
 279         }
 280
 281         if ( err == LDAP_SUCCESS ) {
 282                 *filt = op->o_tmpalloc( sizeof(f), op->o_tmpmemctx );
 283                 **filt = f;
 284         }
 285
 286         Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
 287
 288         return( err );
 289 }
 290
 291 static int
 292 get_filter_list( Operation *op, BerElement *ber,
 293         Filter **f,
 294         const char **text )
 295 {
 296         Filter          **new;
 297         int             err;
 298         ber_tag_t       tag;
 299         ber_len_t       len;
 300         char            *last;
 301
 302         Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
 303         new = f;
 304         for ( tag = ber_first_element( ber, &len, &last );
 305                 tag != LBER_DEFAULT;
 306                 tag = ber_next_element( ber, &len, last ) )
 307         {
 308                 err = get_filter( op, ber, new, text );
 309                 if ( err != LDAP_SUCCESS )
 310                         return( err );
 311                 new = &(*new)->f_next;
 312         }
 313         *new = NULL;
 314
 315         Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
 316         return( LDAP_SUCCESS );
 317 }
 318
 319 static int
 320 get_ssa(
 321         Operation *op,
 322         BerElement      *ber,
 323         SubstringsAssertion     **out,
 324         const char      **text )
 325 {
 326         ber_tag_t       tag;
 327         ber_len_t       len;
 328         ber_tag_t       rc;
 329         struct berval desc, value, nvalue;
 330         char            *last;
 331         SubstringsAssertion ssa;
 332
 333         *text = "error decoding filter";
 334         *out = NULL;
 335
 336         Debug( LDAP_DEBUG_FILTER, "begin get_ssa\n", 0, 0, 0 );
 337         if ( ber_scanf( ber, "{m" /*}*/, &desc ) == LBER_ERROR ) {
 338                 return SLAPD_DISCONNECT;
 339         }
 340
 341         *text = NULL;
 342
 343         ssa.sa_desc = NULL;
 344         ssa.sa_initial.bv_val = NULL;
 345         ssa.sa_any = NULL;
 346         ssa.sa_final.bv_val = NULL;
 347
 348         rc = slap_bv2ad( &desc, &ssa.sa_desc, text );
 349
 350         if( rc != LDAP_SUCCESS ) {
 351                 Debug( LDAP_DEBUG_ANY,
 352                         "get_ssa: conn %d unknown attribute type=%s (%d)\n",
 353                         op->o_connid, desc.bv_val, rc );
 354
 355                 /* skip over the rest of this filter */
 356                 for ( tag = ber_first_element( ber, &len, &last );
 357                         tag != LBER_DEFAULT;
 358                         tag = ber_next_element( ber, &len, last ) ) {
 359                         ber_scanf( ber, "x" );
 360                 }
 361                 return rc;
 362         }
 363
 364         rc = LDAP_PROTOCOL_ERROR;
 365
 366         for ( tag = ber_first_element( ber, &len, &last );
 367                 tag != LBER_DEFAULT;
 368                 tag = ber_next_element( ber, &len, last ) )
 369         {
 370                 unsigned usage;
 371
 372                 rc = ber_scanf( ber, "m", &value );
 373                 if ( rc == LBER_ERROR ) {
 374                         rc = SLAPD_DISCONNECT;
 375                         goto return_error;
 376                 }
 377
 378                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
 379                         rc = LDAP_INVALID_SYNTAX;
 380                         goto return_error;
 381                 }
 382
 383                 switch ( tag ) {
 384                 case LDAP_SUBSTRING_INITIAL:
 385                         usage = SLAP_MR_SUBSTR_INITIAL;
 386                         break;
 387
 388                 case LDAP_SUBSTRING_ANY:
 389                         usage = SLAP_MR_SUBSTR_ANY;
 390                         break;
 391
 392                 case LDAP_SUBSTRING_FINAL:
 393                         usage = SLAP_MR_SUBSTR_FINAL;
 394                         break;
 395
 396                 default:
 397                         rc = LDAP_PROTOCOL_ERROR;
 398
 399                         Debug( LDAP_DEBUG_FILTER,
 400                                 "  unknown substring choice=%ld\n",
 401                                 (long) tag, 0, 0 );
 402
 403                         goto return_error;
 404                 }
 405
 406                 /* validate/normalize using equality matching rule validator! */
 407                 rc = asserted_value_validate_normalize(
 408                         ssa.sa_desc, ssa.sa_desc->ad_type->sat_equality,
 409                         usage, &value, &nvalue, text, op->o_tmpmemctx );
 410
 411                 if( rc != LDAP_SUCCESS ) {
 412                         goto return_error;
 413                 }
 414
 415                 rc = LDAP_PROTOCOL_ERROR;
 416
 417                 switch ( tag ) {
 418                 case LDAP_SUBSTRING_INITIAL:
 419                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
 420
 421                         if ( ssa.sa_initial.bv_val != NULL
 422                                 || ssa.sa_any != NULL
 423                                 || ssa.sa_final.bv_val != NULL )
 424                         {
 425                                 slap_sl_free( nvalue.bv_val, op->o_tmpmemctx );
 426                                 goto return_error;
 427                         }
 428
 429                         ssa.sa_initial = nvalue;
 430                         break;
 431
 432                 case LDAP_SUBSTRING_ANY:
 433                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
 434
 435                         if ( ssa.sa_final.bv_val != NULL ) {
 436                                 slap_sl_free( nvalue.bv_val, op->o_tmpmemctx );
 437                                 goto return_error;
 438                         }
 439
 440                         ber_bvarray_add_x( &ssa.sa_any, &nvalue, op->o_tmpmemctx );
 441                         break;
 442
 443                 case LDAP_SUBSTRING_FINAL:
 444                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
 445
 446                         if ( ssa.sa_final.bv_val != NULL ) {
 447                                 slap_sl_free( nvalue.bv_val, op->o_tmpmemctx );
 448                                 goto return_error;
 449                         }
 450
 451                         ssa.sa_final = nvalue;
 452                         break;
 453
 454                 default:
 455                         Debug( LDAP_DEBUG_FILTER,
 456                                 "  unknown substring type=%ld\n",
 457                                 (long) tag, 0, 0 );
 458
 459                         assert( 0 );
 460                         slap_sl_free( nvalue.bv_val, op->o_tmpmemctx );
 461
 462 return_error:
 463                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
 464                                 (long) rc, 0, 0 );
 465                         slap_sl_free( ssa.sa_initial.bv_val, op->o_tmpmemctx );
 466                         ber_bvarray_free_x( ssa.sa_any, op->o_tmpmemctx );
 467                         slap_sl_free( ssa.sa_final.bv_val, op->o_tmpmemctx );
 468                         return rc;
 469                 }
 470
 471                 rc = LDAP_SUCCESS;
 472         }
 473
 474         if( rc == LDAP_SUCCESS ) {
 475                 *out = op->o_tmpalloc( sizeof( ssa ), op->o_tmpmemctx );
 476                 **out = ssa;
 477         }
 478
 479         Debug( LDAP_DEBUG_FILTER, "end get_ssa\n", 0, 0, 0 );
 480
 481         return rc /* LDAP_SUCCESS */ ;
 482 }
 483
 484 void
 485 filter_free_x( Operation *op, Filter *f )
 486 {
 487         Filter  *p, *next;
 488
 489         if ( f == NULL ) {
 490                 return;
 491         }
 492
 493         switch ( f->f_choice ) {
 494         case LDAP_FILTER_PRESENT:
 495                 break;
 496
 497         case LDAP_FILTER_EQUALITY:
 498         case LDAP_FILTER_GE:
 499         case LDAP_FILTER_LE:
 500         case LDAP_FILTER_APPROX:
 501                 ava_free( op, f->f_ava, 1 );
 502                 break;
 503
 504         case LDAP_FILTER_SUBSTRINGS:
 505                 if ( f->f_sub_initial.bv_val != NULL ) {
 506                         op->o_tmpfree( f->f_sub_initial.bv_val, op->o_tmpmemctx );
 507                 }
 508                 ber_bvarray_free_x( f->f_sub_any, op->o_tmpmemctx );
 509                 if ( f->f_sub_final.bv_val != NULL ) {
 510                         op->o_tmpfree( f->f_sub_final.bv_val, op->o_tmpmemctx );
 511                 }
 512                 op->o_tmpfree( f->f_sub, op->o_tmpmemctx );
 513                 break;
 514
 515         case LDAP_FILTER_AND:
 516         case LDAP_FILTER_OR:
 517         case LDAP_FILTER_NOT:
 518                 for ( p = f->f_list; p != NULL; p = next ) {
 519                         next = p->f_next;
 520                         filter_free_x( op, p );
 521                 }
 522                 break;
 523
 524         case LDAP_FILTER_EXT:
 525                 mra_free( op, f->f_mra, 1 );
 526                 break;
 527
 528         case SLAPD_FILTER_COMPUTED:
 529                 break;
 530
 531         default:
 532                 Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
 533                         f->f_choice, 0, 0 );
 534                 break;
 535         }
 536
 537         op->o_tmpfree( f, op->o_tmpmemctx );
 538 }
 539
 540 void
 541 filter_free( Filter *f )
 542 {
 543         Operation op;
 544
 545         op.o_tmpmemctx = slap_sl_context( f );
 546         op.o_tmpmfuncs = &slap_sl_mfuncs;
 547         filter_free_x( &op, f );
 548 }
 549
 550 void
 551 filter2bv_x( Operation *op, Filter *f, struct berval *fstr )
 552 {
 553         int             i;
 554         Filter          *p;
 555         struct berval   tmp;
 556         static struct berval
 557                         ber_bvfalse = BER_BVC( "(?=false)" ),
 558                         ber_bvtrue = BER_BVC( "(?=true)" ),
 559                         ber_bvundefined = BER_BVC( "(?=undefined)" ),
 560                         ber_bverror = BER_BVC( "(?=error)" ),
 561                         ber_bvunknown = BER_BVC( "(?=unknown)" ),
 562                         ber_bvnone = BER_BVC( "(?=none)" );
 563         ber_len_t       len;
 564
 565         if ( f == NULL ) {
 566                 ber_dupbv_x( fstr, &ber_bvnone, op->o_tmpmemctx );
 567                 return;
 568         }
 569
 570         switch ( f->f_choice ) {
 571         case LDAP_FILTER_EQUALITY:
 572                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 573
 574                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 575                         tmp.bv_len + ( sizeof("(=)") - 1 );
 576                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 577
 578                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
 579                         f->f_av_desc->ad_cname.bv_val,
 580                         tmp.bv_val );
 581
 582                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 583                 break;
 584
 585         case LDAP_FILTER_GE:
 586                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 587
 588                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 589                         tmp.bv_len + ( sizeof("(>=)") - 1 );
 590                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 591
 592                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
 593                         f->f_av_desc->ad_cname.bv_val,
 594                         tmp.bv_val );
 595
 596                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 597                 break;
 598
 599         case LDAP_FILTER_LE:
 600                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 601
 602                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 603                         tmp.bv_len + ( sizeof("(<=)") - 1 );
 604                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 605
 606                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
 607                         f->f_av_desc->ad_cname.bv_val,
 608                         tmp.bv_val );
 609
 610                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 611                 break;
 612
 613         case LDAP_FILTER_APPROX:
 614                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 615
 616                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 617                         tmp.bv_len + ( sizeof("(~=)") - 1 );
 618                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 619
 620                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
 621                         f->f_av_desc->ad_cname.bv_val,
 622                         tmp.bv_val );
 623                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 624                 break;
 625
 626         case LDAP_FILTER_SUBSTRINGS:
 627                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
 628                         ( sizeof("(=*)") - 1 );
 629                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 630
 631                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 632                         f->f_sub_desc->ad_cname.bv_val );
 633
 634                 if ( f->f_sub_initial.bv_val != NULL ) {
 635                         len = fstr->bv_len;
 636
 637                         filter_escape_value_x( &f->f_sub_initial, &tmp, op->o_tmpmemctx );
 638
 639                         fstr->bv_len += tmp.bv_len;
 640                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 641                                 op->o_tmpmemctx );
 642
 643                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
 644                                 /* "(attr=" */ "%s*)",
 645                                 tmp.bv_val );
 646
 647                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 648                 }
 649
 650                 if ( f->f_sub_any != NULL ) {
 651                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
 652                                 len = fstr->bv_len;
 653                                 filter_escape_value_x( &f->f_sub_any[i],
 654                                         &tmp, op->o_tmpmemctx );
 655
 656                                 fstr->bv_len += tmp.bv_len + 1;
 657                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 658                                         op->o_tmpmemctx );
 659
 660                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 661                                         /* "(attr=[init]*[any*]" */ "%s*)",
 662                                         tmp.bv_val );
 663                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 664                         }
 665                 }
 666
 667                 if ( f->f_sub_final.bv_val != NULL ) {
 668                         len = fstr->bv_len;
 669
 670                         filter_escape_value_x( &f->f_sub_final, &tmp, op->o_tmpmemctx );
 671
 672                         fstr->bv_len += tmp.bv_len;
 673                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 674                                 op->o_tmpmemctx );
 675
 676                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 677                                 /* "(attr=[init*][any*]" */ "%s)",
 678                                 tmp.bv_val );
 679
 680                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 681                 }
 682
 683                 break;
 684
 685         case LDAP_FILTER_PRESENT:
 686                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
 687                         ( sizeof("(=*)") - 1 );
 688                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 689
 690                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 691                         f->f_desc->ad_cname.bv_val );
 692                 break;
 693
 694         case LDAP_FILTER_AND:
 695         case LDAP_FILTER_OR:
 696         case LDAP_FILTER_NOT:
 697                 fstr->bv_len = sizeof("(%)") - 1;
 698                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 699
 700                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 701                         f->f_choice == LDAP_FILTER_AND ? '&' :
 702                         f->f_choice == LDAP_FILTER_OR ? '|' : '!' );
 703
 704                 for ( p = f->f_list; p != NULL; p = p->f_next ) {
 705                         len = fstr->bv_len;
 706
 707                         filter2bv_x( op, p, &tmp );
 708
 709                         fstr->bv_len += tmp.bv_len;
 710                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 711                                 op->o_tmpmemctx );
 712
 713                         snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
 714                                 /*"("*/ "%s)", tmp.bv_val );
 715
 716                         op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
 717                 }
 718
 719                 break;
 720
 721         case LDAP_FILTER_EXT: {
 722                         struct berval ad;
 723                         filter_escape_value_x( &f->f_mr_value, &tmp, op->o_tmpmemctx );
 724
 725                         if ( f->f_mr_desc ) {
 726                                 ad = f->f_mr_desc->ad_cname;
 727                         } else {
 728                                 ad.bv_len = 0;
 729                                 ad.bv_val = "";
 730                         }
 731
 732                         fstr->bv_len = ad.bv_len +
 733                                 ( f->f_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
 734                                 ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
 735                                 tmp.bv_len + ( sizeof("(:=)") - 1 );
 736                         fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 737
 738                         snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
 739                                 ad.bv_val,
 740                                 f->f_mr_dnattrs ? ":dn" : "",
 741                                 f->f_mr_rule_text.bv_len ? ":" : "",
 742                                 f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
 743                                 tmp.bv_val );
 744                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 745                 } break;
 746
 747         case SLAPD_FILTER_COMPUTED:
 748                 switch ( f->f_result ) {
 749                 case LDAP_COMPARE_FALSE:
 750                         tmp = ber_bvfalse;
 751                         break;
 752
 753                 case LDAP_COMPARE_TRUE:
 754                         tmp = ber_bvtrue;
 755                         break;
 756
 757                 case SLAPD_COMPARE_UNDEFINED:
 758                         tmp = ber_bvundefined;
 759                         break;
 760
 761                 default:
 762                         tmp = ber_bverror;
 763                         break;
 764                 }
 765
 766                 ber_dupbv_x( fstr, &tmp, op->o_tmpmemctx );
 767                 break;
 768
 769         default:
 770                 ber_dupbv_x( fstr, &ber_bvunknown, op->o_tmpmemctx );
 771                 break;
 772         }
 773 }
 774
 775 void
 776 filter2bv( Filter *f, struct berval *fstr )
 777 {
 778         Operation op;
 779         op.o_tmpmemctx = NULL;
 780         op.o_tmpmfuncs = &ch_mfuncs;
 781
 782         filter2bv_x( &op, f, fstr );
 783 }
 784
 785 static int
 786 filter_escape_value_x(
 787         struct berval *in,
 788         struct berval *out,
 789         void *ctx )
 790 {
 791         ber_len_t i;
 792         assert( in );
 793         assert( out );
 794
 795         i = in->bv_len * 3 + 1;
 796         out->bv_val = ctx ? slap_sl_malloc( i, ctx ) : ch_malloc( i );
 797         out->bv_len = 0;
 798
 799         for( i=0; i < in->bv_len ; i++ ) {
 800                 if( FILTER_ESCAPE(in->bv_val[i]) ) {
 801                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_CHAR;
 802                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_HI( in->bv_val[i] );
 803                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_LO( in->bv_val[i] );
 804                 } else {
 805                         out->bv_val[out->bv_len++] = in->bv_val[i];
 806                 }
 807         }
 808
 809         out->bv_val[out->bv_len] = '\0';
 810         return LDAP_SUCCESS;
 811 }
 812
 813 int
 814 filter_escape_value(
 815         struct berval *in,
 816         struct berval *out )
 817 {
 818         return filter_escape_value_x( in, out, NULL );
 819 }
 820
 821 static int
 822 get_simple_vrFilter(
 823         Operation *op,
 824         BerElement *ber,
 825         ValuesReturnFilter **filt,
 826         const char **text )
 827 {
 828         ber_tag_t       tag;
 829         ber_len_t       len;
 830         int             err;
 831         ValuesReturnFilter vrf;
 832
 833         Debug( LDAP_DEBUG_FILTER, "begin get_simple_vrFilter\n", 0, 0, 0 );
 834
 835         tag = ber_peek_tag( ber, &len );
 836
 837         if( tag == LBER_ERROR ) {
 838                 *text = "error decoding filter";
 839                 return SLAPD_DISCONNECT;
 840         }
 841
 842         vrf.vrf_next = NULL;
 843
 844         err = LDAP_SUCCESS;
 845         vrf.vrf_choice = tag;
 846
 847         switch ( vrf.vrf_choice ) {
 848         case LDAP_FILTER_EQUALITY:
 849                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 850                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_EQUALITY, text );
 851                 if ( err != LDAP_SUCCESS ) {
 852                         break;
 853                 }
 854
 855                 assert( vrf.vrf_ava != NULL );
 856                 break;
 857
 858         case LDAP_FILTER_SUBSTRINGS:
 859                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 860                 err = get_ssa( op, ber, &vrf.vrf_sub, text );
 861                 break;
 862
 863         case LDAP_FILTER_GE:
 864                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 865                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_ORDERING, text );
 866                 if ( err != LDAP_SUCCESS ) {
 867                         break;
 868                 }
 869                 break;
 870
 871         case LDAP_FILTER_LE:
 872                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 873                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_ORDERING, text );
 874                 if ( err != LDAP_SUCCESS ) {
 875                         break;
 876                 }
 877                 break;
 878
 879         case LDAP_FILTER_PRESENT: {
 880                 struct berval type;
 881
 882                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 883                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 884                         err = SLAPD_DISCONNECT;
 885                         *text = "error decoding filter";
 886                         break;
 887                 }
 888
 889                 vrf.vrf_desc = NULL;
 890                 err = slap_bv2ad( &type, &vrf.vrf_desc, text );
 891
 892                 if( err != LDAP_SUCCESS ) {
 893                         /* unrecognized attribute description or other error */
 894                         Debug( LDAP_DEBUG_ANY,
 895                                 "get_simple_vrFilter: conn %d unknown "
 896                                 "attribute type=%s (%d)\n",
 897                                 op->o_connid, type.bv_val, err );
 898
 899                         vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 900                         vrf.vrf_result = LDAP_COMPARE_FALSE;
 901                         err = LDAP_SUCCESS;
 902                         break;
 903                 }
 904                 } break;
 905
 906         case LDAP_FILTER_APPROX:
 907                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 908                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_EQUALITY_APPROX, text );
 909                 if ( err != LDAP_SUCCESS ) {
 910                         break;
 911                 }
 912                 break;
 913
 914         case LDAP_FILTER_EXT:
 915                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 916
 917                 err = get_mra( op, ber, &vrf.vrf_mra, text );
 918                 if ( err != LDAP_SUCCESS ) {
 919                         break;
 920                 }
 921
 922                 assert( vrf.vrf_mra != NULL );
 923                 break;
 924
 925         default:
 926                 (void) ber_scanf( ber, "x" ); /* skip the element */
 927                 Debug( LDAP_DEBUG_ANY, "get_simple_vrFilter: unknown filter type=%lu\n",
 928                         vrf.vrf_choice, 0, 0 );
 929                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 930                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
 931                 break;
 932         }
 933
 934         if ( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 935                 /* ignore error */
 936                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 937                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
 938                 err = LDAP_SUCCESS;
 939         }
 940
 941         if ( err == LDAP_SUCCESS ) {
 942                 *filt = ch_malloc( sizeof vrf );
 943                 **filt = vrf;
 944         }
 945
 946         Debug( LDAP_DEBUG_FILTER, "end get_simple_vrFilter %d\n", err, 0, 0 );
 947
 948         return err;
 949 }
 950
 951 int
 952 get_vrFilter( Operation *op, BerElement *ber,
 953         ValuesReturnFilter **vrf,
 954         const char **text )
 955 {
 956         /*
 957          * A ValuesReturnFilter looks like this:
 958          *
 959          *      ValuesReturnFilter ::= SEQUENCE OF SimpleFilterItem
 960          *      SimpleFilterItem ::= CHOICE {
 961          *              equalityMatch   [3]     AttributeValueAssertion,
 962          *              substrings      [4]     SubstringFilter,
 963          *              greaterOrEqual  [5]     AttributeValueAssertion,
 964          *              lessOrEqual     [6]     AttributeValueAssertion,
 965          *              present         [7]     AttributeType,
 966          *              approxMatch     [8]     AttributeValueAssertion,
 967          *              extensibleMatch [9]     SimpleMatchingAssertion -- LDAPv3
 968          *      }
 969          *
 970          *      SubstringFilter ::= SEQUENCE {
 971          *              type               AttributeType,
 972          *              SEQUENCE OF CHOICE {
 973          *                      initial          [0] IA5String,
 974          *                      any              [1] IA5String,
 975          *                      final            [2] IA5String
 976          *              }
 977          *      }
 978          *
 979          *      SimpleMatchingAssertion ::= SEQUENCE {  -- LDAPv3
 980          *              matchingRule    [1] MatchingRuleId OPTIONAL,
 981          *              type            [2] AttributeDescription OPTIONAL,
 982          *              matchValue      [3] AssertionValue }
 983          */
 984
 985         ValuesReturnFilter **n;
 986         ber_tag_t       tag;
 987         ber_len_t       len;
 988         char            *last;
 989
 990         Debug( LDAP_DEBUG_FILTER, "begin get_vrFilter\n", 0, 0, 0 );
 991
 992         tag = ber_peek_tag( ber, &len );
 993
 994         if( tag == LBER_ERROR ) {
 995                 *text = "error decoding vrFilter";
 996                 return SLAPD_DISCONNECT;
 997         }
 998
 999         if( tag != LBER_SEQUENCE ) {
1000                 *text = "error decoding vrFilter, expect SEQUENCE tag";
1001                 return SLAPD_DISCONNECT;
1002         }
1003
1004         n = vrf;
1005         for ( tag = ber_first_element( ber, &len, &last );
1006                 tag != LBER_DEFAULT;
1007                 tag = ber_next_element( ber, &len, last ) )
1008         {
1009                 int err = get_simple_vrFilter( op, ber, n, text );
1010
1011                 if ( err != LDAP_SUCCESS ) return( err );
1012
1013                 n = &(*n)->vrf_next;
1014         }
1015         *n = NULL;
1016
1017         Debug( LDAP_DEBUG_FILTER, "end get_vrFilter\n", 0, 0, 0 );
1018         return( LDAP_SUCCESS );
1019 }
1020
1021 void
1022 vrFilter_free( Operation *op, ValuesReturnFilter *vrf )
1023 {
1024         ValuesReturnFilter      *p, *next;
1025
1026         if ( vrf == NULL ) {
1027                 return;
1028         }
1029
1030         for ( p = vrf; p != NULL; p = next ) {
1031                 next = p->vrf_next;
1032
1033                 switch ( vrf->vrf_choice ) {
1034                 case LDAP_FILTER_PRESENT:
1035                         break;
1036
1037                 case LDAP_FILTER_EQUALITY:
1038                 case LDAP_FILTER_GE:
1039                 case LDAP_FILTER_LE:
1040                 case LDAP_FILTER_APPROX:
1041                         ava_free( op, vrf->vrf_ava, 1 );
1042                         break;
1043
1044                 case LDAP_FILTER_SUBSTRINGS:
1045                         if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1046                                 op->o_tmpfree( vrf->vrf_sub_initial.bv_val, op->o_tmpmemctx );
1047                         }
1048                         ber_bvarray_free_x( vrf->vrf_sub_any, op->o_tmpmemctx );
1049                         if ( vrf->vrf_sub_final.bv_val != NULL ) {
1050                                 op->o_tmpfree( vrf->vrf_sub_final.bv_val, op->o_tmpmemctx );
1051                         }
1052                         op->o_tmpfree( vrf->vrf_sub, op->o_tmpmemctx );
1053                         break;
1054
1055                 case LDAP_FILTER_EXT:
1056                         mra_free( op, vrf->vrf_mra, 1 );
1057                         break;
1058
1059                 case SLAPD_FILTER_COMPUTED:
1060                         break;
1061
1062                 default:
1063                         Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
1064                                 vrf->vrf_choice, 0, 0 );
1065                         break;
1066                 }
1067
1068                 op->o_tmpfree( vrf, op->o_tmpmemctx );
1069         }
1070 }
1071
1072 void
1073 vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1074 {
1075         ValuesReturnFilter      *p;
1076         struct berval tmp;
1077         ber_len_t len;
1078
1079         if ( vrf == NULL ) {
1080                 ber_str2bv_x( "No filter!", sizeof("No filter!")-1,
1081                         1, fstr, op->o_tmpmemctx );
1082                 return;
1083         }
1084
1085         fstr->bv_len = sizeof("()") - 1;
1086         fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1087
1088         snprintf( fstr->bv_val, fstr->bv_len + 1, "()");
1089
1090         for ( p = vrf; p != NULL; p = p->vrf_next ) {
1091                 len = fstr->bv_len;
1092
1093                 simple_vrFilter2bv( op, p, &tmp );
1094
1095                 fstr->bv_len += tmp.bv_len;
1096                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1097                         op->o_tmpmemctx );
1098
1099                 snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
1100                         /*"("*/ "%s)", tmp.bv_val );
1101
1102                 op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
1103         }
1104 }
1105
1106 static void
1107 simple_vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1108 {
1109         struct berval tmp;
1110         ber_len_t len;
1111
1112         if ( vrf == NULL ) {
1113                 ber_str2bv_x( "No filter!", sizeof("No filter!")-1, 1, fstr,
1114                         op->o_tmpmemctx );
1115                 return;
1116         }
1117
1118         switch ( vrf->vrf_choice ) {
1119         case LDAP_FILTER_EQUALITY:
1120                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1121
1122                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1123                         tmp.bv_len + ( sizeof("(=)") - 1 );
1124                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1125
1126                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
1127                         vrf->vrf_av_desc->ad_cname.bv_val,
1128                         tmp.bv_val );
1129
1130                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1131                 break;
1132
1133         case LDAP_FILTER_GE:
1134                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1135
1136                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1137                         tmp.bv_len + ( sizeof("(>=)") - 1 );
1138                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1139
1140                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
1141                         vrf->vrf_av_desc->ad_cname.bv_val,
1142                         tmp.bv_val );
1143
1144                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1145                 break;
1146
1147         case LDAP_FILTER_LE:
1148                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1149
1150                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1151                         tmp.bv_len + ( sizeof("(<=)") - 1 );
1152                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1153
1154                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
1155                         vrf->vrf_av_desc->ad_cname.bv_val,
1156                         tmp.bv_val );
1157
1158                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1159                 break;
1160
1161         case LDAP_FILTER_APPROX:
1162                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1163
1164                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1165                         tmp.bv_len + ( sizeof("(~=)") - 1 );
1166                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1167
1168                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
1169                         vrf->vrf_av_desc->ad_cname.bv_val,
1170                         tmp.bv_val );
1171                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1172                 break;
1173
1174         case LDAP_FILTER_SUBSTRINGS:
1175                 fstr->bv_len = vrf->vrf_sub_desc->ad_cname.bv_len +
1176                         ( sizeof("(=*)") - 1 );
1177                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1178
1179                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1180                         vrf->vrf_sub_desc->ad_cname.bv_val );
1181
1182                 if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1183                         len = fstr->bv_len;
1184
1185                         filter_escape_value_x( &vrf->vrf_sub_initial, &tmp, op->o_tmpmemctx );
1186
1187                         fstr->bv_len += tmp.bv_len;
1188                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1189                                 op->o_tmpmemctx );
1190
1191                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
1192                                 /* "(attr=" */ "%s*)",
1193                                 tmp.bv_val );
1194
1195                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1196                 }
1197
1198                 if ( vrf->vrf_sub_any != NULL ) {
1199                         int i;
1200                         for ( i = 0; vrf->vrf_sub_any[i].bv_val != NULL; i++ ) {
1201                                 len = fstr->bv_len;
1202                                 filter_escape_value_x( &vrf->vrf_sub_any[i], &tmp,
1203                                         op->o_tmpmemctx );
1204
1205                                 fstr->bv_len += tmp.bv_len + 1;
1206                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
1207                                         fstr->bv_len + 1, op->o_tmpmemctx );
1208
1209                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1210                                         /* "(attr=[init]*[any*]" */ "%s*)",
1211                                         tmp.bv_val );
1212                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1213                         }
1214                 }
1215
1216                 if ( vrf->vrf_sub_final.bv_val != NULL ) {
1217                         len = fstr->bv_len;
1218
1219                         filter_escape_value_x( &vrf->vrf_sub_final, &tmp, op->o_tmpmemctx );
1220
1221                         fstr->bv_len += tmp.bv_len;
1222                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1223                                 op->o_tmpmemctx );
1224
1225                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1226                                 /* "(attr=[init*][any*]" */ "%s)",
1227                                 tmp.bv_val );
1228
1229                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1230                 }
1231
1232                 break;
1233
1234         case LDAP_FILTER_PRESENT:
1235                 fstr->bv_len = vrf->vrf_desc->ad_cname.bv_len +
1236                         ( sizeof("(=*)") - 1 );
1237                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1238
1239                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1240                         vrf->vrf_desc->ad_cname.bv_val );
1241                 break;
1242
1243         case LDAP_FILTER_EXT: {
1244                 struct berval ad;
1245                 filter_escape_value_x( &vrf->vrf_mr_value, &tmp, op->o_tmpmemctx );
1246
1247                 if ( vrf->vrf_mr_desc ) {
1248                         ad = vrf->vrf_mr_desc->ad_cname;
1249                 } else {
1250                         ad.bv_len = 0;
1251                         ad.bv_val = "";
1252                 }
1253
1254                 fstr->bv_len = ad.bv_len +
1255                         ( vrf->vrf_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
1256                         ( vrf->vrf_mr_rule_text.bv_len
1257                                 ? vrf->vrf_mr_rule_text.bv_len+1 : 0 ) +
1258                         tmp.bv_len + ( sizeof("(:=)") - 1 );
1259                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1260
1261                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
1262                         ad.bv_val,
1263                         vrf->vrf_mr_dnattrs ? ":dn" : "",
1264                         vrf->vrf_mr_rule_text.bv_len ? ":" : "",
1265                         vrf->vrf_mr_rule_text.bv_len ? vrf->vrf_mr_rule_text.bv_val : "",
1266                         tmp.bv_val );
1267
1268                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1269                 } break;
1270
1271         case SLAPD_FILTER_COMPUTED:
1272                 ber_str2bv_x(
1273                         vrf->vrf_result == LDAP_COMPARE_FALSE ? "(?=false)" :
1274                         vrf->vrf_result == LDAP_COMPARE_TRUE ? "(?=true)" :
1275                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1276                                 ? "(?=undefined)" : "(?=error)",
1277                         vrf->vrf_result == LDAP_COMPARE_FALSE ? sizeof("(?=false)")-1 :
1278                         vrf->vrf_result == LDAP_COMPARE_TRUE ? sizeof("(?=true)")-1 :
1279                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1280                                 ? sizeof("(?=undefined)")-1 : sizeof("(?=error)")-1,
1281                         1, fstr, op->o_tmpmemctx );
1282                 break;
1283
1284         default:
1285                 ber_str2bv_x( "(?=unknown)", sizeof("(?=unknown)")-1,
1286                         1, fstr, op->o_tmpmemctx );
1287                 break;
1288         }
1289 }