git.sur5r.net Git - openldap/blob - servers/slapd/filter.c

   1 /* filter.c - routines for parsing and dealing with filters */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2007 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/socket.h>
  32 #include <ac/string.h>
  33
  34 #include "slap.h"
  35
  36 static int      get_filter_list(
  37         Operation *op,
  38         BerElement *ber,
  39         Filter **f,
  40         const char **text );
  41
  42 static int      get_ssa(
  43         Operation *op,
  44         BerElement *ber,
  45         Filter *f,
  46         const char **text );
  47
  48 static void simple_vrFilter2bv(
  49         Operation *op,
  50         ValuesReturnFilter *f,
  51         struct berval *fstr );
  52
  53 static int      get_simple_vrFilter(
  54         Operation *op,
  55         BerElement *ber,
  56         ValuesReturnFilter **f,
  57         const char **text );
  58
  59 int
  60 get_filter(
  61         Operation *op,
  62         BerElement *ber,
  63         Filter **filt,
  64         const char **text )
  65 {
  66         ber_tag_t       tag;
  67         ber_len_t       len;
  68         int             err;
  69         Filter          f;
  70
  71         Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
  72         /*
  73          * A filter looks like this coming in:
  74          *      Filter ::= CHOICE {
  75          *              and             [0]     SET OF Filter,
  76          *              or              [1]     SET OF Filter,
  77          *              not             [2]     Filter,
  78          *              equalityMatch   [3]     AttributeValueAssertion,
  79          *              substrings      [4]     SubstringFilter,
  80          *              greaterOrEqual  [5]     AttributeValueAssertion,
  81          *              lessOrEqual     [6]     AttributeValueAssertion,
  82          *              present         [7]     AttributeType,
  83          *              approxMatch     [8]     AttributeValueAssertion,
  84          *              extensibleMatch [9]     MatchingRuleAssertion
  85          *      }
  86          *
  87          *      SubstringFilter ::= SEQUENCE {
  88          *              type               AttributeType,
  89          *              SEQUENCE OF CHOICE {
  90          *                      initial          [0] IA5String,
  91          *                      any              [1] IA5String,
  92          *                      final            [2] IA5String
  93          *              }
  94          *      }
  95          *
  96          *      MatchingRuleAssertion ::= SEQUENCE {
  97          *              matchingRule    [1] MatchingRuleId OPTIONAL,
  98          *              type            [2] AttributeDescription OPTIONAL,
  99          *              matchValue      [3] AssertionValue,
 100          *              dnAttributes    [4] BOOLEAN DEFAULT FALSE
 101          *      }
 102          *
 103          */
 104
 105         tag = ber_peek_tag( ber, &len );
 106
 107         if( tag == LBER_ERROR ) {
 108                 *text = "error decoding filter";
 109                 return SLAPD_DISCONNECT;
 110         }
 111
 112         err = LDAP_SUCCESS;
 113
 114         f.f_next = NULL;
 115         f.f_choice = tag;
 116
 117         switch ( f.f_choice ) {
 118         case LDAP_FILTER_EQUALITY:
 119                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 120                 err = get_ava( op, ber, &f, SLAP_MR_EQUALITY, text );
 121                 if ( err != LDAP_SUCCESS ) {
 122                         break;
 123                 }
 124
 125                 assert( f.f_ava != NULL );
 126                 break;
 127
 128         case LDAP_FILTER_SUBSTRINGS:
 129                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 130                 err = get_ssa( op, ber, &f, text );
 131                 if( err != LDAP_SUCCESS ) {
 132                         break;
 133                 }
 134                 assert( f.f_sub != NULL );
 135                 break;
 136
 137         case LDAP_FILTER_GE:
 138                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 139                 err = get_ava( op, ber, &f, SLAP_MR_ORDERING, text );
 140                 if ( err != LDAP_SUCCESS ) {
 141                         break;
 142                 }
 143                 assert( f.f_ava != NULL );
 144                 break;
 145
 146         case LDAP_FILTER_LE:
 147                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 148                 err = get_ava( op, ber, &f, SLAP_MR_ORDERING, text );
 149                 if ( err != LDAP_SUCCESS ) {
 150                         break;
 151                 }
 152                 assert( f.f_ava != NULL );
 153                 break;
 154
 155         case LDAP_FILTER_PRESENT: {
 156                 struct berval type;
 157
 158                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 159                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 160                         err = SLAPD_DISCONNECT;
 161                         *text = "error decoding filter";
 162                         break;
 163                 }
 164
 165                 f.f_desc = NULL;
 166                 err = slap_bv2ad( &type, &f.f_desc, text );
 167
 168                 if( err != LDAP_SUCCESS ) {
 169                         f.f_choice |= SLAPD_FILTER_UNDEFINED;
 170                         err = slap_bv2undef_ad( &type, &f.f_desc, text,
 171                                 SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 172
 173                         if ( err != LDAP_SUCCESS ) {
 174                                 /* unrecognized attribute description or other error */
 175                                 Debug( LDAP_DEBUG_ANY,
 176                                         "get_filter: conn %lu unknown attribute "
 177                                         "type=%s (%d)\n",
 178                                         op->o_connid, type.bv_val, err );
 179
 180                                 err = LDAP_SUCCESS;
 181                                 f.f_desc = slap_bv2tmp_ad( &type, op->o_tmpmemctx );
 182                         }
 183                         *text = NULL;
 184                 }
 185
 186                 assert( f.f_desc != NULL );
 187                 } break;
 188
 189         case LDAP_FILTER_APPROX:
 190                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 191                 err = get_ava( op, ber, &f, SLAP_MR_EQUALITY_APPROX, text );
 192                 if ( err != LDAP_SUCCESS ) {
 193                         break;
 194                 }
 195                 assert( f.f_ava != NULL );
 196                 break;
 197
 198         case LDAP_FILTER_AND:
 199                 Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
 200                 err = get_filter_list( op, ber, &f.f_and, text );
 201                 if ( err != LDAP_SUCCESS ) {
 202                         break;
 203                 }
 204                 if ( f.f_and == NULL ) {
 205                         f.f_choice = SLAPD_FILTER_COMPUTED;
 206                         f.f_result = LDAP_COMPARE_TRUE;
 207                 }
 208                 /* no assert - list could be empty */
 209                 break;
 210
 211         case LDAP_FILTER_OR:
 212                 Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
 213                 err = get_filter_list( op, ber, &f.f_or, text );
 214                 if ( err != LDAP_SUCCESS ) {
 215                         break;
 216                 }
 217                 if ( f.f_or == NULL ) {
 218                         f.f_choice = SLAPD_FILTER_COMPUTED;
 219                         f.f_result = LDAP_COMPARE_FALSE;
 220                 }
 221                 /* no assert - list could be empty */
 222                 break;
 223
 224         case LDAP_FILTER_NOT:
 225                 Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
 226                 (void) ber_skip_tag( ber, &len );
 227                 err = get_filter( op, ber, &f.f_not, text );
 228                 if ( err != LDAP_SUCCESS ) {
 229                         break;
 230                 }
 231
 232                 assert( f.f_not != NULL );
 233                 if ( f.f_not->f_choice == SLAPD_FILTER_COMPUTED ) {
 234                         int fresult = f.f_not->f_result;
 235                         f.f_choice = SLAPD_FILTER_COMPUTED;
 236                         op->o_tmpfree( f.f_not, op->o_tmpmemctx );
 237                         f.f_not = NULL;
 238
 239                         switch( fresult ) {
 240                         case LDAP_COMPARE_TRUE:
 241                                 f.f_result = LDAP_COMPARE_FALSE;
 242                                 break;
 243                         case LDAP_COMPARE_FALSE:
 244                                 f.f_result = LDAP_COMPARE_TRUE;
 245                                 break;
 246                         default: ;
 247                                 /* (!Undefined) is Undefined */
 248                         }
 249                 }
 250                 break;
 251
 252         case LDAP_FILTER_EXT:
 253                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 254
 255                 err = get_mra( op, ber, &f, text );
 256                 if ( err != LDAP_SUCCESS ) {
 257                         break;
 258                 }
 259
 260                 assert( f.f_mra != NULL );
 261                 break;
 262
 263         default:
 264                 (void) ber_scanf( ber, "x" ); /* skip the element */
 265                 Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
 266                         f.f_choice, 0, 0 );
 267                 f.f_choice = SLAPD_FILTER_COMPUTED;
 268                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 269                 break;
 270         }
 271
 272         if( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 273                 /* ignore error */
 274                 *text = NULL;
 275                 f.f_choice = SLAPD_FILTER_COMPUTED;
 276                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 277                 err = LDAP_SUCCESS;
 278         }
 279
 280         if ( err == LDAP_SUCCESS ) {
 281                 *filt = op->o_tmpalloc( sizeof(f), op->o_tmpmemctx );
 282                 **filt = f;
 283         }
 284
 285         Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
 286
 287         return( err );
 288 }
 289
 290 static int
 291 get_filter_list( Operation *op, BerElement *ber,
 292         Filter **f,
 293         const char **text )
 294 {
 295         Filter          **new;
 296         int             err;
 297         ber_tag_t       tag;
 298         ber_len_t       len;
 299         char            *last;
 300
 301         Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
 302         new = f;
 303         for ( tag = ber_first_element( ber, &len, &last );
 304                 tag != LBER_DEFAULT;
 305                 tag = ber_next_element( ber, &len, last ) )
 306         {
 307                 err = get_filter( op, ber, new, text );
 308                 if ( err != LDAP_SUCCESS )
 309                         return( err );
 310                 new = &(*new)->f_next;
 311         }
 312         *new = NULL;
 313
 314         Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
 315         return( LDAP_SUCCESS );
 316 }
 317
 318 static int
 319 get_ssa(
 320         Operation *op,
 321         BerElement      *ber,
 322         Filter          *f,
 323         const char      **text )
 324 {
 325         ber_tag_t       tag;
 326         ber_len_t       len;
 327         ber_tag_t       rc;
 328         struct berval desc, value, nvalue;
 329         char            *last;
 330         SubstringsAssertion ssa;
 331
 332         *text = "error decoding filter";
 333
 334         Debug( LDAP_DEBUG_FILTER, "begin get_ssa\n", 0, 0, 0 );
 335         if ( ber_scanf( ber, "{m" /*}*/, &desc ) == LBER_ERROR ) {
 336                 return SLAPD_DISCONNECT;
 337         }
 338
 339         *text = NULL;
 340
 341         ssa.sa_desc = NULL;
 342         ssa.sa_initial.bv_val = NULL;
 343         ssa.sa_any = NULL;
 344         ssa.sa_final.bv_val = NULL;
 345
 346         rc = slap_bv2ad( &desc, &ssa.sa_desc, text );
 347
 348         if( rc != LDAP_SUCCESS ) {
 349                 f->f_choice |= SLAPD_FILTER_UNDEFINED;
 350                 rc = slap_bv2undef_ad( &desc, &ssa.sa_desc, text,
 351                         SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 352
 353                 if( rc != LDAP_SUCCESS ) {
 354                         Debug( LDAP_DEBUG_ANY,
 355                                 "get_ssa: conn %lu unknown attribute type=%s (%ld)\n",
 356                                 op->o_connid, desc.bv_val, (long) rc );
 357
 358                         ssa.sa_desc = slap_bv2tmp_ad( &desc, op->o_tmpmemctx );
 359                 }
 360         }
 361
 362         rc = LDAP_PROTOCOL_ERROR;
 363
 364         for ( tag = ber_first_element( ber, &len, &last );
 365                 tag != LBER_DEFAULT;
 366                 tag = ber_next_element( ber, &len, last ) )
 367         {
 368                 unsigned usage;
 369
 370                 rc = ber_scanf( ber, "m", &value );
 371                 if ( rc == LBER_ERROR ) {
 372                         rc = SLAPD_DISCONNECT;
 373                         goto return_error;
 374                 }
 375
 376                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
 377                         rc = LDAP_INVALID_SYNTAX;
 378                         goto return_error;
 379                 }
 380
 381                 switch ( tag ) {
 382                 case LDAP_SUBSTRING_INITIAL:
 383                         if ( ssa.sa_initial.bv_val != NULL
 384                                 || ssa.sa_any != NULL
 385                                 || ssa.sa_final.bv_val != NULL )
 386                         {
 387                                 rc = LDAP_PROTOCOL_ERROR;
 388                                 goto return_error;
 389                         }
 390                         usage = SLAP_MR_SUBSTR_INITIAL;
 391                         break;
 392
 393                 case LDAP_SUBSTRING_ANY:
 394                         if ( ssa.sa_final.bv_val != NULL ) {
 395                                 rc = LDAP_PROTOCOL_ERROR;
 396                                 goto return_error;
 397                         }
 398                         usage = SLAP_MR_SUBSTR_ANY;
 399                         break;
 400
 401                 case LDAP_SUBSTRING_FINAL:
 402                         if ( ssa.sa_final.bv_val != NULL ) {
 403                                 rc = LDAP_PROTOCOL_ERROR;
 404                                 goto return_error;
 405                         }
 406
 407                         usage = SLAP_MR_SUBSTR_FINAL;
 408                         break;
 409
 410                 default:
 411                         Debug( LDAP_DEBUG_FILTER,
 412                                 "  unknown substring choice=%ld\n",
 413                                 (long) tag, 0, 0 );
 414
 415                         rc = LDAP_PROTOCOL_ERROR;
 416                         goto return_error;
 417                 }
 418
 419                 /* validate/normalize using equality matching rule validator! */
 420                 rc = asserted_value_validate_normalize(
 421                         ssa.sa_desc, ssa.sa_desc->ad_type->sat_equality,
 422                         usage, &value, &nvalue, text, op->o_tmpmemctx );
 423                 if( rc != LDAP_SUCCESS ) goto return_error;
 424
 425                 switch ( tag ) {
 426                 case LDAP_SUBSTRING_INITIAL:
 427                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
 428                         ssa.sa_initial = nvalue;
 429                         break;
 430
 431                 case LDAP_SUBSTRING_ANY:
 432                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
 433                         ber_bvarray_add_x( &ssa.sa_any, &nvalue, op->o_tmpmemctx );
 434                         break;
 435
 436                 case LDAP_SUBSTRING_FINAL:
 437                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
 438                         ssa.sa_final = nvalue;
 439                         break;
 440
 441                 default:
 442                         assert( 0 );
 443                         slap_sl_free( nvalue.bv_val, op->o_tmpmemctx );
 444                         rc = LDAP_PROTOCOL_ERROR;
 445
 446 return_error:
 447                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
 448                                 (long) rc, 0, 0 );
 449                         slap_sl_free( ssa.sa_initial.bv_val, op->o_tmpmemctx );
 450                         ber_bvarray_free_x( ssa.sa_any, op->o_tmpmemctx );
 451                         if ( ssa.sa_desc->ad_flags & SLAP_DESC_TEMPORARY )
 452                                 op->o_tmpfree( ssa.sa_desc, op->o_tmpmemctx );
 453                         slap_sl_free( ssa.sa_final.bv_val, op->o_tmpmemctx );
 454                         return rc;
 455                 }
 456
 457                 rc = LDAP_SUCCESS;
 458         }
 459
 460         if( rc == LDAP_SUCCESS ) {
 461                 f->f_sub = op->o_tmpalloc( sizeof( ssa ), op->o_tmpmemctx );
 462                 *f->f_sub = ssa;
 463         }
 464
 465         Debug( LDAP_DEBUG_FILTER, "end get_ssa\n", 0, 0, 0 );
 466         return rc /* LDAP_SUCCESS */ ;
 467 }
 468
 469 void
 470 filter_free_x( Operation *op, Filter *f )
 471 {
 472         Filter  *p, *next;
 473
 474         if ( f == NULL ) {
 475                 return;
 476         }
 477
 478         f->f_choice &= SLAPD_FILTER_MASK;
 479
 480         switch ( f->f_choice ) {
 481         case LDAP_FILTER_PRESENT:
 482                 break;
 483
 484         case LDAP_FILTER_EQUALITY:
 485         case LDAP_FILTER_GE:
 486         case LDAP_FILTER_LE:
 487         case LDAP_FILTER_APPROX:
 488                 ava_free( op, f->f_ava, 1 );
 489                 break;
 490
 491         case LDAP_FILTER_SUBSTRINGS:
 492                 if ( f->f_sub_initial.bv_val != NULL ) {
 493                         op->o_tmpfree( f->f_sub_initial.bv_val, op->o_tmpmemctx );
 494                 }
 495                 ber_bvarray_free_x( f->f_sub_any, op->o_tmpmemctx );
 496                 if ( f->f_sub_final.bv_val != NULL ) {
 497                         op->o_tmpfree( f->f_sub_final.bv_val, op->o_tmpmemctx );
 498                 }
 499                 if ( f->f_sub->sa_desc->ad_flags & SLAP_DESC_TEMPORARY )
 500                         op->o_tmpfree( f->f_sub->sa_desc, op->o_tmpmemctx );
 501                 op->o_tmpfree( f->f_sub, op->o_tmpmemctx );
 502                 break;
 503
 504         case LDAP_FILTER_AND:
 505         case LDAP_FILTER_OR:
 506         case LDAP_FILTER_NOT:
 507                 for ( p = f->f_list; p != NULL; p = next ) {
 508                         next = p->f_next;
 509                         filter_free_x( op, p );
 510                 }
 511                 break;
 512
 513         case LDAP_FILTER_EXT:
 514                 mra_free( op, f->f_mra, 1 );
 515                 break;
 516
 517         case SLAPD_FILTER_COMPUTED:
 518                 break;
 519
 520         default:
 521                 Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
 522                         f->f_choice, 0, 0 );
 523                 break;
 524         }
 525
 526         op->o_tmpfree( f, op->o_tmpmemctx );
 527 }
 528
 529 void
 530 filter_free( Filter *f )
 531 {
 532         Operation op;
 533         Opheader ohdr;
 534
 535         op.o_hdr = &ohdr;
 536         op.o_tmpmemctx = slap_sl_context( f );
 537         op.o_tmpmfuncs = &slap_sl_mfuncs;
 538         filter_free_x( &op, f );
 539 }
 540
 541 void
 542 filter2bv_x( Operation *op, Filter *f, struct berval *fstr )
 543 {
 544         int             i;
 545         Filter          *p;
 546         struct berval   tmp;
 547         static struct berval
 548                         ber_bvfalse = BER_BVC( "(?=false)" ),
 549                         ber_bvtrue = BER_BVC( "(?=true)" ),
 550                         ber_bvundefined = BER_BVC( "(?=undefined)" ),
 551                         ber_bverror = BER_BVC( "(?=error)" ),
 552                         ber_bvunknown = BER_BVC( "(?=unknown)" ),
 553                         ber_bvnone = BER_BVC( "(?=none)" );
 554         ber_len_t       len;
 555         ber_tag_t       choice;
 556         int undef;
 557         char *sign;
 558
 559         if ( f == NULL ) {
 560                 ber_dupbv_x( fstr, &ber_bvnone, op->o_tmpmemctx );
 561                 return;
 562         }
 563
 564         undef = f->f_choice & SLAPD_FILTER_UNDEFINED;
 565         choice = f->f_choice & SLAPD_FILTER_MASK;
 566
 567         switch ( choice ) {
 568         case LDAP_FILTER_EQUALITY:
 569                 fstr->bv_len = STRLENOF("(=)");
 570                 sign = "=";
 571                 goto simple;
 572         case LDAP_FILTER_GE:
 573                 fstr->bv_len = STRLENOF("(>=)");
 574                 sign = ">=";
 575                 goto simple;
 576         case LDAP_FILTER_LE:
 577                 fstr->bv_len = STRLENOF("(<=)");
 578                 sign = "<=";
 579                 goto simple;
 580         case LDAP_FILTER_APPROX:
 581                 fstr->bv_len = STRLENOF("(~=)");
 582                 sign = "~=";
 583
 584 simple:
 585                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 586                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 587                  * since in a Filter values in AVAs are supposed
 588                  * to have been normalized, meaning that an empty value
 589                  * is legal for that attribute's syntax */
 590
 591                 fstr->bv_len += f->f_av_desc->ad_cname.bv_len + tmp.bv_len;
 592                 if ( undef )
 593                         fstr->bv_len++;
 594                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 595
 596                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s)",
 597                         undef ? "?" : "",
 598                         f->f_av_desc->ad_cname.bv_val, sign,
 599                         tmp.bv_len ? tmp.bv_val : "" );
 600
 601                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 602                 break;
 603
 604         case LDAP_FILTER_SUBSTRINGS:
 605                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
 606                         STRLENOF("(=*)");
 607                 if ( undef )
 608                         fstr->bv_len++;
 609                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 610
 611                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s=*)",
 612                         undef ? "?" : "",
 613                         f->f_sub_desc->ad_cname.bv_val );
 614
 615                 if ( f->f_sub_initial.bv_val != NULL ) {
 616                         ber_len_t tmplen;
 617
 618                         len = fstr->bv_len;
 619
 620                         filter_escape_value_x( &f->f_sub_initial, &tmp, op->o_tmpmemctx );
 621                         tmplen = tmp.bv_len;
 622
 623                         fstr->bv_len += tmplen;
 624                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 625                                 fstr->bv_len + 1, op->o_tmpmemctx );
 626
 627                         snprintf( &fstr->bv_val[len - 2],
 628                                 tmplen + STRLENOF( /*(*/ "*)" ) + 1,
 629                                 /* "(attr=" */ "%s*)",
 630                                 tmp.bv_len ? tmp.bv_val : "");
 631
 632                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 633                 }
 634
 635                 if ( f->f_sub_any != NULL ) {
 636                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
 637                                 ber_len_t tmplen;
 638
 639                                 len = fstr->bv_len;
 640                                 filter_escape_value_x( &f->f_sub_any[i],
 641                                         &tmp, op->o_tmpmemctx );
 642                                 tmplen = tmp.bv_len;
 643
 644                                 fstr->bv_len += tmplen + STRLENOF( /*(*/ ")" );
 645                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 646                                         fstr->bv_len + 1, op->o_tmpmemctx );
 647
 648                                 snprintf( &fstr->bv_val[len - 1],
 649                                         tmplen + STRLENOF( /*(*/ "*)" ) + 1,
 650                                         /* "(attr=[init]*[any*]" */ "%s*)",
 651                                         tmp.bv_len ? tmp.bv_val : "");
 652                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 653                         }
 654                 }
 655
 656                 if ( f->f_sub_final.bv_val != NULL ) {
 657                         ber_len_t tmplen;
 658
 659                         len = fstr->bv_len;
 660
 661                         filter_escape_value_x( &f->f_sub_final, &tmp, op->o_tmpmemctx );
 662                         tmplen = tmp.bv_len;
 663
 664                         fstr->bv_len += tmplen;
 665                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 666                                 fstr->bv_len + 1, op->o_tmpmemctx );
 667
 668                         snprintf( &fstr->bv_val[len - 1],
 669                                 tmplen + STRLENOF( /*(*/ ")" ) + 1,
 670                                 /* "(attr=[init*][any*]" */ "%s)",
 671                                 tmp.bv_len ? tmp.bv_val : "");
 672
 673                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 674                 }
 675
 676                 break;
 677
 678         case LDAP_FILTER_PRESENT:
 679                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
 680                         STRLENOF("(=*)");
 681                 if ( undef )
 682                         fstr->bv_len++;
 683
 684                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 685
 686                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s=*)",
 687                         undef ? "?" : "",
 688                         f->f_desc->ad_cname.bv_val );
 689                 break;
 690
 691         case LDAP_FILTER_AND:
 692         case LDAP_FILTER_OR:
 693         case LDAP_FILTER_NOT:
 694                 fstr->bv_len = STRLENOF("(%)");
 695                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 696
 697                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 698                         f->f_choice == LDAP_FILTER_AND ? '&' :
 699                         f->f_choice == LDAP_FILTER_OR ? '|' : '!' );
 700
 701                 for ( p = f->f_list; p != NULL; p = p->f_next ) {
 702                         len = fstr->bv_len;
 703
 704                         filter2bv_x( op, p, &tmp );
 705
 706                         fstr->bv_len += tmp.bv_len;
 707                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 708                                 op->o_tmpmemctx );
 709
 710                         snprintf( &fstr->bv_val[len-1],
 711                                 tmp.bv_len + STRLENOF( /*(*/ ")" ) + 1,
 712                                 /*"("*/ "%s)", tmp.bv_val );
 713
 714                         op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
 715                 }
 716
 717                 break;
 718
 719         case LDAP_FILTER_EXT: {
 720                 struct berval ad;
 721
 722                 filter_escape_value_x( &f->f_mr_value, &tmp, op->o_tmpmemctx );
 723                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 724                  * since in a Filter values in MRAs are supposed
 725                  * to have been normalized, meaning that an empty value
 726                  * is legal for that attribute's syntax */
 727
 728                 if ( f->f_mr_desc ) {
 729                         ad = f->f_mr_desc->ad_cname;
 730                 } else {
 731                         ad.bv_len = 0;
 732                         ad.bv_val = "";
 733                 }
 734
 735                 fstr->bv_len = ad.bv_len +
 736                         ( f->f_mr_dnattrs ? STRLENOF(":dn") : 0 ) +
 737                         ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
 738                         tmp.bv_len + STRLENOF("(:=)");
 739                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 740
 741                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s%s:=%s)",
 742                         undef ? "?" : "",
 743                         ad.bv_val,
 744                         f->f_mr_dnattrs ? ":dn" : "",
 745                         f->f_mr_rule_text.bv_len ? ":" : "",
 746                         f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
 747                         tmp.bv_len ? tmp.bv_val : "" );
 748                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 749                 } break;
 750
 751         case SLAPD_FILTER_COMPUTED:
 752                 switch ( f->f_result ) {
 753                 case LDAP_COMPARE_FALSE:
 754                         tmp = ber_bvfalse;
 755                         break;
 756
 757                 case LDAP_COMPARE_TRUE:
 758                         tmp = ber_bvtrue;
 759                         break;
 760
 761                 case SLAPD_COMPARE_UNDEFINED:
 762                         tmp = ber_bvundefined;
 763                         break;
 764
 765                 default:
 766                         tmp = ber_bverror;
 767                         break;
 768                 }
 769
 770                 ber_dupbv_x( fstr, &tmp, op->o_tmpmemctx );
 771                 break;
 772
 773         default:
 774                 ber_dupbv_x( fstr, &ber_bvunknown, op->o_tmpmemctx );
 775                 break;
 776         }
 777 }
 778
 779 void
 780 filter2bv( Filter *f, struct berval *fstr )
 781 {
 782         Operation op;
 783         Opheader ohdr;
 784
 785         op.o_hdr = &ohdr;
 786         op.o_tmpmemctx = NULL;
 787         op.o_tmpmfuncs = &ch_mfuncs;
 788
 789         filter2bv_x( &op, f, fstr );
 790 }
 791
 792 Filter *
 793 filter_dup( Filter *f, void *memctx )
 794 {
 795         BerMemoryFunctions *mf = &slap_sl_mfuncs;
 796         Filter *n;
 797
 798         if ( !f )
 799                 return NULL;
 800
 801         n = mf->bmf_malloc( sizeof(Filter), memctx );
 802         n->f_choice = f->f_choice;
 803         n->f_next = NULL;
 804
 805         switch( f->f_choice & SLAPD_FILTER_MASK ) {
 806         case SLAPD_FILTER_COMPUTED:
 807                 n->f_result = f->f_result;
 808                 break;
 809         case LDAP_FILTER_PRESENT:
 810                 if ( f->f_desc->ad_flags & SLAP_DESC_TEMPORARY )
 811                         n->f_desc = slap_bv2tmp_ad( &f->f_desc->ad_cname, memctx );
 812                 else
 813                         n->f_desc = f->f_desc;
 814                 break;
 815         case LDAP_FILTER_EQUALITY:
 816         case LDAP_FILTER_GE:
 817         case LDAP_FILTER_LE:
 818         case LDAP_FILTER_APPROX:
 819                 /* Should this be ava_dup() ? */
 820                 n->f_ava = mf->bmf_calloc( 1, sizeof(AttributeAssertion), memctx );
 821                 *n->f_ava = *f->f_ava;
 822                 if ( f->f_av_desc->ad_flags & SLAP_DESC_TEMPORARY )
 823                         n->f_av_desc = slap_bv2tmp_ad( &f->f_av_desc->ad_cname, memctx );
 824                 ber_dupbv_x( &n->f_av_value, &f->f_av_value, memctx );
 825                 break;
 826         case LDAP_FILTER_SUBSTRINGS:
 827                 n->f_sub = mf->bmf_calloc( 1, sizeof(SubstringsAssertion), memctx );
 828                 if ( f->f_sub_desc->ad_flags & SLAP_DESC_TEMPORARY )
 829                         n->f_sub_desc = slap_bv2tmp_ad( &f->f_sub_desc->ad_cname, memctx );
 830                 else
 831                         n->f_sub_desc = f->f_sub_desc;
 832                 if ( !BER_BVISNULL( &f->f_sub_initial ))
 833                         ber_dupbv_x( &n->f_sub_initial, &f->f_sub_initial, memctx );
 834                 if ( f->f_sub_any ) {
 835                         int i;
 836                         for ( i = 0; !BER_BVISNULL( &f->f_sub_any[i] ); i++ );
 837                         n->f_sub_any = mf->bmf_malloc(( i+1 )*sizeof( struct berval ),
 838                                 memctx );
 839                         for ( i = 0; !BER_BVISNULL( &f->f_sub_any[i] ); i++ ) {
 840                                 ber_dupbv_x( &n->f_sub_any[i], &f->f_sub_any[i], memctx );
 841                         }
 842                         BER_BVZERO( &n->f_sub_any[i] );
 843                 }
 844                 if ( !BER_BVISNULL( &f->f_sub_final ))
 845                         ber_dupbv_x( &n->f_sub_final, &f->f_sub_final, memctx );
 846                 break;
 847         case LDAP_FILTER_EXT: {
 848                 /* Should this be mra_dup() ? */
 849                 ber_len_t length;
 850                 length = sizeof(MatchingRuleAssertion);
 851                 if ( !BER_BVISNULL( &f->f_mr_rule_text ))
 852                         length += f->f_mr_rule_text.bv_len + 1;
 853                 n->f_mra = mf->bmf_calloc( 1, length, memctx );
 854                 *n->f_mra = *f->f_mra;
 855                 if ( f->f_mr_desc && ( f->f_sub_desc->ad_flags & SLAP_DESC_TEMPORARY ))
 856                         n->f_mr_desc = slap_bv2tmp_ad( &f->f_mr_desc->ad_cname, memctx );
 857                 ber_dupbv_x( &n->f_mr_value, &f->f_mr_value, memctx );
 858                 if ( !BER_BVISNULL( &f->f_mr_rule_text )) {
 859                         n->f_mr_rule_text.bv_val = (char *)(n->f_mra+1);
 860                         AC_MEMCPY(n->f_mr_rule_text.bv_val,
 861                                 f->f_mr_rule_text.bv_val, f->f_mr_rule_text.bv_len );
 862                 }
 863                 } break;
 864         case LDAP_FILTER_AND:
 865         case LDAP_FILTER_OR:
 866         case LDAP_FILTER_NOT: {
 867                 Filter **p;
 868                 for ( p = &n->f_list, f = f->f_list; f; f = f->f_next ) {
 869                         *p = filter_dup( f, memctx );
 870                         p = &(*p)->f_next;
 871                 }
 872                 } break;
 873         }
 874         return n;
 875 }
 876
 877 static int
 878 get_simple_vrFilter(
 879         Operation *op,
 880         BerElement *ber,
 881         ValuesReturnFilter **filt,
 882         const char **text )
 883 {
 884         ber_tag_t       tag;
 885         ber_len_t       len;
 886         int             err;
 887         ValuesReturnFilter vrf;
 888
 889         Debug( LDAP_DEBUG_FILTER, "begin get_simple_vrFilter\n", 0, 0, 0 );
 890
 891         tag = ber_peek_tag( ber, &len );
 892
 893         if( tag == LBER_ERROR ) {
 894                 *text = "error decoding filter";
 895                 return SLAPD_DISCONNECT;
 896         }
 897
 898         vrf.vrf_next = NULL;
 899
 900         err = LDAP_SUCCESS;
 901         vrf.vrf_choice = tag;
 902
 903         switch ( vrf.vrf_choice ) {
 904         case LDAP_FILTER_EQUALITY:
 905                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 906                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_EQUALITY, text );
 907                 if ( err != LDAP_SUCCESS ) {
 908                         break;
 909                 }
 910
 911                 assert( vrf.vrf_ava != NULL );
 912                 break;
 913
 914         case LDAP_FILTER_SUBSTRINGS:
 915                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 916                 err = get_ssa( op, ber, (Filter *)&vrf, text );
 917                 break;
 918
 919         case LDAP_FILTER_GE:
 920                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 921                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_ORDERING, text );
 922                 if ( err != LDAP_SUCCESS ) {
 923                         break;
 924                 }
 925                 break;
 926
 927         case LDAP_FILTER_LE:
 928                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 929                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_ORDERING, text );
 930                 if ( err != LDAP_SUCCESS ) {
 931                         break;
 932                 }
 933                 break;
 934
 935         case LDAP_FILTER_PRESENT: {
 936                 struct berval type;
 937
 938                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 939                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 940                         err = SLAPD_DISCONNECT;
 941                         *text = "error decoding filter";
 942                         break;
 943                 }
 944
 945                 vrf.vrf_desc = NULL;
 946                 err = slap_bv2ad( &type, &vrf.vrf_desc, text );
 947
 948                 if( err != LDAP_SUCCESS ) {
 949                         vrf.vrf_choice |= SLAPD_FILTER_UNDEFINED;
 950                         err = slap_bv2undef_ad( &type, &vrf.vrf_desc, text,
 951                                 SLAP_AD_PROXIED);
 952
 953                         if( err != LDAP_SUCCESS ) {
 954                                 /* unrecognized attribute description or other error */
 955                                 Debug( LDAP_DEBUG_ANY,
 956                                         "get_simple_vrFilter: conn %lu unknown "
 957                                         "attribute type=%s (%d)\n",
 958                                         op->o_connid, type.bv_val, err );
 959
 960                                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 961                                 vrf.vrf_result = LDAP_COMPARE_FALSE;
 962                                 err = LDAP_SUCCESS;
 963                                 break;
 964                         }
 965                 }
 966                 } break;
 967
 968         case LDAP_FILTER_APPROX:
 969                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 970                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_EQUALITY_APPROX, text );
 971                 if ( err != LDAP_SUCCESS ) {
 972                         break;
 973                 }
 974                 break;
 975
 976         case LDAP_FILTER_EXT:
 977                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 978
 979                 err = get_mra( op, ber, (Filter *)&vrf, text );
 980                 if ( err != LDAP_SUCCESS ) {
 981                         break;
 982                 }
 983
 984                 assert( vrf.vrf_mra != NULL );
 985                 break;
 986
 987         default:
 988                 (void) ber_scanf( ber, "x" ); /* skip the element */
 989                 Debug( LDAP_DEBUG_ANY, "get_simple_vrFilter: unknown filter type=%lu\n",
 990                         vrf.vrf_choice, 0, 0 );
 991                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 992                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
 993                 break;
 994         }
 995
 996         if ( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 997                 /* ignore error */
 998                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 999                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
1000                 err = LDAP_SUCCESS;
1001         }
1002
1003         if ( err == LDAP_SUCCESS ) {
1004                 *filt = op->o_tmpalloc( sizeof vrf, op->o_tmpmemctx );
1005                 **filt = vrf;
1006         }
1007
1008         Debug( LDAP_DEBUG_FILTER, "end get_simple_vrFilter %d\n", err, 0, 0 );
1009
1010         return err;
1011 }
1012
1013 int
1014 get_vrFilter( Operation *op, BerElement *ber,
1015         ValuesReturnFilter **vrf,
1016         const char **text )
1017 {
1018         /*
1019          * A ValuesReturnFilter looks like this:
1020          *
1021          *      ValuesReturnFilter ::= SEQUENCE OF SimpleFilterItem
1022          *      SimpleFilterItem ::= CHOICE {
1023          *              equalityMatch   [3]     AttributeValueAssertion,
1024          *              substrings      [4]     SubstringFilter,
1025          *              greaterOrEqual  [5]     AttributeValueAssertion,
1026          *              lessOrEqual     [6]     AttributeValueAssertion,
1027          *              present         [7]     AttributeType,
1028          *              approxMatch     [8]     AttributeValueAssertion,
1029          *              extensibleMatch [9]     SimpleMatchingAssertion -- LDAPv3
1030          *      }
1031          *
1032          *      SubstringFilter ::= SEQUENCE {
1033          *              type               AttributeType,
1034          *              SEQUENCE OF CHOICE {
1035          *                      initial          [0] IA5String,
1036          *                      any              [1] IA5String,
1037          *                      final            [2] IA5String
1038          *              }
1039          *      }
1040          *
1041          *      SimpleMatchingAssertion ::= SEQUENCE {  -- LDAPv3
1042          *              matchingRule    [1] MatchingRuleId OPTIONAL,
1043          *              type            [2] AttributeDescription OPTIONAL,
1044          *              matchValue      [3] AssertionValue }
1045          */
1046
1047         ValuesReturnFilter **n;
1048         ber_tag_t       tag;
1049         ber_len_t       len;
1050         char            *last;
1051
1052         Debug( LDAP_DEBUG_FILTER, "begin get_vrFilter\n", 0, 0, 0 );
1053
1054         tag = ber_peek_tag( ber, &len );
1055
1056         if( tag == LBER_ERROR ) {
1057                 *text = "error decoding vrFilter";
1058                 return SLAPD_DISCONNECT;
1059         }
1060
1061         if( tag != LBER_SEQUENCE ) {
1062                 *text = "error decoding vrFilter, expect SEQUENCE tag";
1063                 return SLAPD_DISCONNECT;
1064         }
1065
1066         n = vrf;
1067         for ( tag = ber_first_element( ber, &len, &last );
1068                 tag != LBER_DEFAULT;
1069                 tag = ber_next_element( ber, &len, last ) )
1070         {
1071                 int err = get_simple_vrFilter( op, ber, n, text );
1072
1073                 if ( err != LDAP_SUCCESS ) return( err );
1074
1075                 n = &(*n)->vrf_next;
1076         }
1077         *n = NULL;
1078
1079         Debug( LDAP_DEBUG_FILTER, "end get_vrFilter\n", 0, 0, 0 );
1080         return( LDAP_SUCCESS );
1081 }
1082
1083 void
1084 vrFilter_free( Operation *op, ValuesReturnFilter *vrf )
1085 {
1086         ValuesReturnFilter      *p, *next;
1087
1088         if ( vrf == NULL ) {
1089                 return;
1090         }
1091
1092         for ( p = vrf; p != NULL; p = next ) {
1093                 next = p->vrf_next;
1094
1095                 switch ( vrf->vrf_choice & SLAPD_FILTER_MASK ) {
1096                 case LDAP_FILTER_PRESENT:
1097                         break;
1098
1099                 case LDAP_FILTER_EQUALITY:
1100                 case LDAP_FILTER_GE:
1101                 case LDAP_FILTER_LE:
1102                 case LDAP_FILTER_APPROX:
1103                         ava_free( op, vrf->vrf_ava, 1 );
1104                         break;
1105
1106                 case LDAP_FILTER_SUBSTRINGS:
1107                         if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1108                                 op->o_tmpfree( vrf->vrf_sub_initial.bv_val, op->o_tmpmemctx );
1109                         }
1110                         ber_bvarray_free_x( vrf->vrf_sub_any, op->o_tmpmemctx );
1111                         if ( vrf->vrf_sub_final.bv_val != NULL ) {
1112                                 op->o_tmpfree( vrf->vrf_sub_final.bv_val, op->o_tmpmemctx );
1113                         }
1114                         op->o_tmpfree( vrf->vrf_sub, op->o_tmpmemctx );
1115                         break;
1116
1117                 case LDAP_FILTER_EXT:
1118                         mra_free( op, vrf->vrf_mra, 1 );
1119                         break;
1120
1121                 case SLAPD_FILTER_COMPUTED:
1122                         break;
1123
1124                 default:
1125                         Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
1126                                 vrf->vrf_choice, 0, 0 );
1127                         break;
1128                 }
1129
1130                 op->o_tmpfree( vrf, op->o_tmpmemctx );
1131         }
1132 }
1133
1134 void
1135 vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1136 {
1137         ValuesReturnFilter      *p;
1138         struct berval tmp;
1139         ber_len_t len;
1140
1141         if ( vrf == NULL ) {
1142                 ber_str2bv_x( "No filter!", STRLENOF("No filter!"),
1143                         1, fstr, op->o_tmpmemctx );
1144                 return;
1145         }
1146
1147         fstr->bv_len = STRLENOF("()");
1148         fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1149
1150         snprintf( fstr->bv_val, fstr->bv_len + 1, "()");
1151
1152         for ( p = vrf; p != NULL; p = p->vrf_next ) {
1153                 len = fstr->bv_len;
1154
1155                 simple_vrFilter2bv( op, p, &tmp );
1156
1157                 fstr->bv_len += tmp.bv_len;
1158                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1159                         op->o_tmpmemctx );
1160
1161                 snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
1162                         /*"("*/ "%s)", tmp.bv_val );
1163
1164                 op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
1165         }
1166 }
1167
1168 static void
1169 simple_vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1170 {
1171         struct berval tmp;
1172         ber_len_t len;
1173         int undef;
1174
1175         if ( vrf == NULL ) {
1176                 ber_str2bv_x( "No filter!", STRLENOF("No filter!"), 1, fstr,
1177                         op->o_tmpmemctx );
1178                 return;
1179         }
1180         undef = vrf->vrf_choice & SLAPD_FILTER_UNDEFINED;
1181
1182         switch ( vrf->vrf_choice & SLAPD_FILTER_MASK ) {
1183         case LDAP_FILTER_EQUALITY:
1184                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1185
1186                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1187                         tmp.bv_len + STRLENOF("(=)");
1188                 if ( undef ) fstr->bv_len++;
1189                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1190
1191                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
1192                         vrf->vrf_av_desc->ad_cname.bv_val,
1193                         tmp.bv_val );
1194
1195                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1196                 break;
1197
1198         case LDAP_FILTER_GE:
1199                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1200
1201                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1202                         tmp.bv_len + STRLENOF("(>=)");
1203                 if ( undef ) fstr->bv_len++;
1204                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1205
1206                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
1207                         vrf->vrf_av_desc->ad_cname.bv_val,
1208                         tmp.bv_val );
1209
1210                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1211                 break;
1212
1213         case LDAP_FILTER_LE:
1214                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1215
1216                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1217                         tmp.bv_len + STRLENOF("(<=)");
1218                 if ( undef ) fstr->bv_len++;
1219                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1220
1221                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
1222                         vrf->vrf_av_desc->ad_cname.bv_val,
1223                         tmp.bv_val );
1224
1225                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1226                 break;
1227
1228         case LDAP_FILTER_APPROX:
1229                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1230
1231                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1232                         tmp.bv_len + STRLENOF("(~=)");
1233                 if ( undef ) fstr->bv_len++;
1234                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1235
1236                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
1237                         vrf->vrf_av_desc->ad_cname.bv_val,
1238                         tmp.bv_val );
1239                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1240                 break;
1241
1242         case LDAP_FILTER_SUBSTRINGS:
1243                 fstr->bv_len = vrf->vrf_sub_desc->ad_cname.bv_len +
1244                         STRLENOF("(=*)");
1245                 if ( undef ) fstr->bv_len++;
1246                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1247
1248                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1249                         vrf->vrf_sub_desc->ad_cname.bv_val );
1250
1251                 if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1252                         len = fstr->bv_len;
1253
1254                         filter_escape_value_x( &vrf->vrf_sub_initial, &tmp, op->o_tmpmemctx );
1255
1256                         fstr->bv_len += tmp.bv_len;
1257                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1258                                 op->o_tmpmemctx );
1259
1260                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
1261                                 /* "(attr=" */ "%s*)",
1262                                 tmp.bv_val );
1263
1264                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1265                 }
1266
1267                 if ( vrf->vrf_sub_any != NULL ) {
1268                         int i;
1269                         for ( i = 0; vrf->vrf_sub_any[i].bv_val != NULL; i++ ) {
1270                                 len = fstr->bv_len;
1271                                 filter_escape_value_x( &vrf->vrf_sub_any[i], &tmp,
1272                                         op->o_tmpmemctx );
1273
1274                                 fstr->bv_len += tmp.bv_len + 1;
1275                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
1276                                         fstr->bv_len + 1, op->o_tmpmemctx );
1277
1278                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1279                                         /* "(attr=[init]*[any*]" */ "%s*)",
1280                                         tmp.bv_val );
1281                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1282                         }
1283                 }
1284
1285                 if ( vrf->vrf_sub_final.bv_val != NULL ) {
1286                         len = fstr->bv_len;
1287
1288                         filter_escape_value_x( &vrf->vrf_sub_final, &tmp, op->o_tmpmemctx );
1289
1290                         fstr->bv_len += tmp.bv_len;
1291                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1292                                 op->o_tmpmemctx );
1293
1294                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1295                                 /* "(attr=[init*][any*]" */ "%s)",
1296                                 tmp.bv_val );
1297
1298                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1299                 }
1300
1301                 break;
1302
1303         case LDAP_FILTER_PRESENT:
1304                 fstr->bv_len = vrf->vrf_desc->ad_cname.bv_len +
1305                         STRLENOF("(=*)");
1306                 if ( undef ) fstr->bv_len++;
1307                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1308
1309                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1310                         vrf->vrf_desc->ad_cname.bv_val );
1311                 break;
1312
1313         case LDAP_FILTER_EXT: {
1314                 struct berval ad;
1315                 filter_escape_value_x( &vrf->vrf_mr_value, &tmp, op->o_tmpmemctx );
1316
1317                 if ( vrf->vrf_mr_desc ) {
1318                         ad = vrf->vrf_mr_desc->ad_cname;
1319                 } else {
1320                         ad.bv_len = 0;
1321                         ad.bv_val = "";
1322                 }
1323
1324                 fstr->bv_len = ad.bv_len +
1325                         ( vrf->vrf_mr_dnattrs ? STRLENOF(":dn") : 0 ) +
1326                         ( vrf->vrf_mr_rule_text.bv_len
1327                                 ? vrf->vrf_mr_rule_text.bv_len+1 : 0 ) +
1328                         tmp.bv_len + STRLENOF("(:=)");
1329                 if ( undef ) fstr->bv_len++;
1330                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1331
1332                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
1333                         ad.bv_val,
1334                         vrf->vrf_mr_dnattrs ? ":dn" : "",
1335                         vrf->vrf_mr_rule_text.bv_len ? ":" : "",
1336                         vrf->vrf_mr_rule_text.bv_len ? vrf->vrf_mr_rule_text.bv_val : "",
1337                         tmp.bv_val );
1338
1339                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1340                 } break;
1341
1342         case SLAPD_FILTER_COMPUTED:
1343                 ber_str2bv_x(
1344                         vrf->vrf_result == LDAP_COMPARE_FALSE ? "(?=false)" :
1345                         vrf->vrf_result == LDAP_COMPARE_TRUE ? "(?=true)" :
1346                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1347                                 ? "(?=undefined)" : "(?=error)",
1348                         vrf->vrf_result == LDAP_COMPARE_FALSE ? STRLENOF("(?=false)") :
1349                         vrf->vrf_result == LDAP_COMPARE_TRUE ? STRLENOF("(?=true)") :
1350                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1351                                 ? STRLENOF("(?=undefined)") : STRLENOF("(?=error)"),
1352                         1, fstr, op->o_tmpmemctx );
1353                 break;
1354
1355         default:
1356                 ber_str2bv_x( "(?=unknown)", STRLENOF("(?=unknown)"),
1357                         1, fstr, op->o_tmpmemctx );
1358                 break;
1359         }
1360 }