git.sur5r.net Git - openldap/blob - servers/slapd/filter.c

   1 /* filter.c - routines for parsing and dealing with filters */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/socket.h>
  13 #include <ac/string.h>
  14
  15 #include "slap.h"
  16
  17 static int      get_filter_list(
  18         Operation *op,
  19         BerElement *ber,
  20         Filter **f,
  21         const char **text );
  22
  23 static int      get_ssa(
  24         Operation *op,
  25         BerElement *ber,
  26         SubstringsAssertion **s,
  27         const char **text );
  28
  29 static void simple_vrFilter2bv(
  30         Operation *op,
  31         ValuesReturnFilter *f,
  32         struct berval *fstr );
  33
  34 static int      get_simple_vrFilter(
  35         Operation *op,
  36         BerElement *ber,
  37         ValuesReturnFilter **f,
  38         const char **text );
  39
  40 int
  41 get_filter(
  42         Operation *op,
  43         BerElement *ber,
  44         Filter **filt,
  45         const char **text )
  46 {
  47         ber_tag_t       tag;
  48         ber_len_t       len;
  49         int             err;
  50         Filter          f;
  51
  52 #ifdef NEW_LOGGING
  53         LDAP_LOG( FILTER, ENTRY, "get_filter: conn %d\n", op->o_connid, 0, 0 );
  54 #else
  55         Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
  56 #endif
  57         /*
  58          * A filter looks like this coming in:
  59          *      Filter ::= CHOICE {
  60          *              and             [0]     SET OF Filter,
  61          *              or              [1]     SET OF Filter,
  62          *              not             [2]     Filter,
  63          *              equalityMatch   [3]     AttributeValueAssertion,
  64          *              substrings      [4]     SubstringFilter,
  65          *              greaterOrEqual  [5]     AttributeValueAssertion,
  66          *              lessOrEqual     [6]     AttributeValueAssertion,
  67          *              present         [7]     AttributeType,,
  68          *              approxMatch     [8]     AttributeValueAssertion
  69          *              extensibleMatch [9]     MatchingRuleAssertion
  70          *      }
  71          *
  72          *      SubstringFilter ::= SEQUENCE {
  73          *              type               AttributeType,
  74          *              SEQUENCE OF CHOICE {
  75          *                      initial          [0] IA5String,
  76          *                      any              [1] IA5String,
  77          *                      final            [2] IA5String
  78          *              }
  79          *      }
  80          *
  81          *      MatchingRuleAssertion ::= SEQUENCE {
  82          *              matchingRule    [1] MatchingRuleId OPTIONAL,
  83          *              type            [2] AttributeDescription OPTIONAL,
  84          *              matchValue      [3] AssertionValue,
  85          *              dnAttributes    [4] BOOLEAN DEFAULT FALSE
  86          *      }
  87          *
  88          */
  89
  90         tag = ber_peek_tag( ber, &len );
  91
  92         if( tag == LBER_ERROR ) {
  93                 *text = "error decoding filter";
  94                 return SLAPD_DISCONNECT;
  95         }
  96
  97         err = LDAP_SUCCESS;
  98
  99         f.f_next = NULL;
 100         f.f_choice = tag;
 101
 102         switch ( f.f_choice ) {
 103         case LDAP_FILTER_EQUALITY:
 104 #ifdef NEW_LOGGING
 105                 LDAP_LOG( FILTER, DETAIL2,
 106                         "get_filter: conn %d  EQUALITY\n", op->o_connid, 0, 0 );
 107 #else
 108                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 109 #endif
 110                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_EQUALITY, text );
 111                 if ( err != LDAP_SUCCESS ) {
 112                         break;
 113                 }
 114
 115                 assert( f.f_ava != NULL );
 116                 break;
 117
 118         case LDAP_FILTER_SUBSTRINGS:
 119 #ifdef NEW_LOGGING
 120                 LDAP_LOG( FILTER, DETAIL1,
 121                         "get_filter: conn %d  SUBSTRINGS\n", op->o_connid, 0, 0 );
 122 #else
 123                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 124 #endif
 125                 err = get_ssa( op, ber, &f.f_sub, text );
 126                 if( err != LDAP_SUCCESS ) {
 127                         break;
 128                 }
 129                 assert( f.f_sub != NULL );
 130                 break;
 131
 132         case LDAP_FILTER_GE:
 133 #ifdef NEW_LOGGING
 134                 LDAP_LOG( FILTER, DETAIL1,
 135                         "get_filter: conn %d  GE\n", op->o_connid, 0, 0 );
 136 #else
 137                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 138 #endif
 139                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_ORDERING, text );
 140                 if ( err != LDAP_SUCCESS ) {
 141                         break;
 142                 }
 143                 assert( f.f_ava != NULL );
 144                 break;
 145
 146         case LDAP_FILTER_LE:
 147 #ifdef NEW_LOGGING
 148                 LDAP_LOG( FILTER, DETAIL1,
 149                         "get_filter: conn %d  LE\n", op->o_connid, 0, 0 );
 150 #else
 151                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 152 #endif
 153                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_ORDERING, text );
 154                 if ( err != LDAP_SUCCESS ) {
 155                         break;
 156                 }
 157                 assert( f.f_ava != NULL );
 158                 break;
 159
 160         case LDAP_FILTER_PRESENT: {
 161                 struct berval type;
 162
 163 #ifdef NEW_LOGGING
 164                 LDAP_LOG( FILTER, DETAIL1,
 165                         "get_filter: conn %d PRESENT\n", op->o_connid, 0, 0 );
 166 #else
 167                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 168 #endif
 169                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 170                         err = SLAPD_DISCONNECT;
 171                         *text = "error decoding filter";
 172                         break;
 173                 }
 174
 175                 f.f_desc = NULL;
 176                 err = slap_bv2ad( &type, &f.f_desc, text );
 177
 178                 if( err != LDAP_SUCCESS ) {
 179                         /* unrecognized attribute description or other error */
 180                         f.f_choice = SLAPD_FILTER_COMPUTED;
 181                         f.f_result = LDAP_COMPARE_FALSE;
 182                         err = LDAP_SUCCESS;
 183                         *text = NULL;
 184                         break;
 185                 }
 186
 187                 assert( f.f_desc != NULL );
 188                 } break;
 189
 190         case LDAP_FILTER_APPROX:
 191 #ifdef NEW_LOGGING
 192                 LDAP_LOG( FILTER, DETAIL1,
 193                         "get_filter: conn %d  APPROX\n", op->o_connid, 0, 0 );
 194 #else
 195                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 196 #endif
 197                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_EQUALITY_APPROX, text );
 198                 if ( err != LDAP_SUCCESS ) {
 199                         break;
 200                 }
 201                 assert( f.f_ava != NULL );
 202                 break;
 203
 204         case LDAP_FILTER_AND:
 205 #ifdef NEW_LOGGING
 206                 LDAP_LOG( FILTER, DETAIL1,
 207                         "get_filter: conn %d  AND\n", op->o_connid, 0, 0 );
 208 #else
 209                 Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
 210 #endif
 211                 err = get_filter_list( op, ber, &f.f_and, text );
 212                 if ( err != LDAP_SUCCESS ) {
 213                         break;
 214                 }
 215                 if ( f.f_and == NULL ) {
 216                         f.f_choice = SLAPD_FILTER_COMPUTED;
 217                         f.f_result = LDAP_COMPARE_TRUE;
 218                 }
 219                 /* no assert - list could be empty */
 220                 break;
 221
 222         case LDAP_FILTER_OR:
 223 #ifdef NEW_LOGGING
 224                 LDAP_LOG( FILTER, DETAIL1,
 225                         "get_filter: conn %d  OR\n", op->o_connid, 0, 0  );
 226 #else
 227                 Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
 228 #endif
 229                 err = get_filter_list( op, ber, &f.f_or, text );
 230                 if ( err != LDAP_SUCCESS ) {
 231                         break;
 232                 }
 233                 if ( f.f_or == NULL ) {
 234                         f.f_choice = SLAPD_FILTER_COMPUTED;
 235                         f.f_result = LDAP_COMPARE_FALSE;
 236                 }
 237                 /* no assert - list could be empty */
 238                 break;
 239
 240         case LDAP_FILTER_NOT:
 241 #ifdef NEW_LOGGING
 242                 LDAP_LOG( FILTER, DETAIL1,
 243                         "get_filter: conn %d  NOT\n", op->o_connid, 0, 0 );
 244 #else
 245                 Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
 246 #endif
 247                 (void) ber_skip_tag( ber, &len );
 248                 err = get_filter( op, ber, &f.f_not, text );
 249                 if ( err != LDAP_SUCCESS ) {
 250                         break;
 251                 }
 252
 253                 assert( f.f_not != NULL );
 254                 if ( f.f_not->f_choice == SLAPD_FILTER_COMPUTED ) {
 255                         int fresult = f.f_not->f_result;
 256                         f.f_choice = SLAPD_FILTER_COMPUTED;
 257                         op->o_tmpfree( f.f_not, op->o_tmpmemctx );
 258                         f.f_not = NULL;
 259
 260                         switch( fresult ) {
 261                         case LDAP_COMPARE_TRUE:
 262                                 f.f_result = LDAP_COMPARE_FALSE;
 263                                 break;
 264                         case LDAP_COMPARE_FALSE:
 265                                 f.f_result = LDAP_COMPARE_TRUE;
 266                                 break;
 267                         default: ;
 268                                 /* (!Undefined) is Undefined */
 269                         }
 270                 }
 271                 break;
 272
 273         case LDAP_FILTER_EXT:
 274 #ifdef NEW_LOGGING
 275                 LDAP_LOG( FILTER, DETAIL1,
 276                         "get_filter: conn %d  EXTENSIBLE\n", op->o_connid, 0, 0 );
 277 #else
 278                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 279 #endif
 280
 281                 err = get_mra( op, ber, &f.f_mra, text );
 282                 if ( err != LDAP_SUCCESS ) {
 283                         break;
 284                 }
 285
 286                 assert( f.f_mra != NULL );
 287                 break;
 288
 289         default:
 290                 (void) ber_scanf( ber, "x" ); /* skip the element */
 291 #ifdef NEW_LOGGING
 292                 LDAP_LOG( FILTER, ERR,
 293                         "get_filter: conn %d unknown filter type=%lu\n",
 294                         op->o_connid, f.f_choice, 0 );
 295 #else
 296                 Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
 297                         f.f_choice, 0, 0 );
 298 #endif
 299                 f.f_choice = SLAPD_FILTER_COMPUTED;
 300                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 301                 break;
 302         }
 303
 304         if( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 305                 /* ignore error */
 306                 *text = NULL;
 307                 f.f_choice = SLAPD_FILTER_COMPUTED;
 308                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 309                 err = LDAP_SUCCESS;
 310         }
 311
 312         if ( err == LDAP_SUCCESS ) {
 313                 *filt = op->o_tmpalloc( sizeof(f), op->o_tmpmemctx );
 314                 **filt = f;
 315         }
 316
 317 #ifdef NEW_LOGGING
 318         LDAP_LOG( FILTER, DETAIL2,
 319                 "get_filter: conn %d exit\n", op->o_connid, 0, 0 );
 320 #else
 321         Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
 322 #endif
 323
 324         return( err );
 325 }
 326
 327 static int
 328 get_filter_list( Operation *op, BerElement *ber,
 329         Filter **f,
 330         const char **text )
 331 {
 332         Filter          **new;
 333         int             err;
 334         ber_tag_t       tag;
 335         ber_len_t       len;
 336         char            *last;
 337
 338 #ifdef NEW_LOGGING
 339         LDAP_LOG( FILTER, ENTRY,
 340                 "get_filter_list: conn %d start\n", op->o_connid, 0, 0 );
 341 #else
 342         Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
 343 #endif
 344         new = f;
 345         for ( tag = ber_first_element( ber, &len, &last );
 346                 tag != LBER_DEFAULT;
 347                 tag = ber_next_element( ber, &len, last ) )
 348         {
 349                 err = get_filter( op, ber, new, text );
 350                 if ( err != LDAP_SUCCESS )
 351                         return( err );
 352                 new = &(*new)->f_next;
 353         }
 354         *new = NULL;
 355
 356 #ifdef NEW_LOGGING
 357         LDAP_LOG( FILTER, ENTRY,
 358                 "get_filter_list: conn %d exit\n", op->o_connid, 0, 0 );
 359 #else
 360         Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
 361 #endif
 362         return( LDAP_SUCCESS );
 363 }
 364
 365 static int
 366 get_ssa(
 367         Operation *op,
 368         BerElement      *ber,
 369         SubstringsAssertion     **out,
 370         const char      **text )
 371 {
 372         ber_tag_t       tag;
 373         ber_len_t       len;
 374         ber_tag_t       rc;
 375         struct berval desc, value, nvalue;
 376         char            *last;
 377         SubstringsAssertion ssa;
 378
 379         *text = "error decoding filter";
 380
 381 #ifdef NEW_LOGGING
 382         LDAP_LOG( FILTER, ENTRY,
 383                 "get_ssa: conn %d  begin\n", op->o_connid, 0, 0 );
 384 #else
 385         Debug( LDAP_DEBUG_FILTER, "begin get_ssa\n", 0, 0, 0 );
 386 #endif
 387         if ( ber_scanf( ber, "{m" /*}*/, &desc ) == LBER_ERROR ) {
 388                 return SLAPD_DISCONNECT;
 389         }
 390
 391         *text = NULL;
 392
 393         ssa.sa_desc = NULL;
 394         ssa.sa_initial.bv_val = NULL;
 395         ssa.sa_any = NULL;
 396         ssa.sa_final.bv_val = NULL;
 397
 398         rc = slap_bv2ad( &desc, &ssa.sa_desc, text );
 399
 400         if( rc != LDAP_SUCCESS ) {
 401                 /* skip over the rest of this filter */
 402                 for ( tag = ber_first_element( ber, &len, &last );
 403                         tag != LBER_DEFAULT;
 404                         tag = ber_next_element( ber, &len, last ) ) {
 405                         ber_scanf( ber, "x" );
 406                 }
 407                 return rc;
 408         }
 409
 410         rc = LDAP_PROTOCOL_ERROR;
 411
 412         for ( tag = ber_first_element( ber, &len, &last );
 413                 tag != LBER_DEFAULT;
 414                 tag = ber_next_element( ber, &len, last ) )
 415         {
 416                 unsigned usage;
 417
 418                 rc = ber_scanf( ber, "m", &value );
 419                 if ( rc == LBER_ERROR ) {
 420                         rc = SLAPD_DISCONNECT;
 421                         goto return_error;
 422                 }
 423
 424                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
 425                         rc = LDAP_INVALID_SYNTAX;
 426                         goto return_error;
 427                 }
 428
 429                 switch ( tag ) {
 430                 case LDAP_SUBSTRING_INITIAL:
 431                         usage = SLAP_MR_SUBSTR_INITIAL;
 432                         break;
 433
 434                 case LDAP_SUBSTRING_ANY:
 435                         usage = SLAP_MR_SUBSTR_ANY;
 436                         break;
 437
 438                 case LDAP_SUBSTRING_FINAL:
 439                         usage = SLAP_MR_SUBSTR_FINAL;
 440                         break;
 441
 442                 default:
 443                         rc = LDAP_PROTOCOL_ERROR;
 444
 445 #ifdef NEW_LOGGING
 446                         LDAP_LOG( FILTER, ERR,
 447                                 "get_filter_substring: conn %d  unknown substring choice=%ld\n",
 448                                 op->o_connid, (long)tag, 0 );
 449 #else
 450                         Debug( LDAP_DEBUG_FILTER,
 451                                 "  unknown substring choice=%ld\n",
 452                                 (long) tag, 0, 0 );
 453 #endif
 454
 455                         goto return_error;
 456                 }
 457
 458                 /* validate/normalize using equality matching rule validator! */
 459                 rc = asserted_value_validate_normalize(
 460                         ssa.sa_desc, ssa.sa_desc->ad_type->sat_equality,
 461                         usage, &value, &nvalue, text, op->o_tmpmemctx );
 462
 463                 if( rc != LDAP_SUCCESS ) {
 464                         goto return_error;
 465                 }
 466
 467                 rc = LDAP_PROTOCOL_ERROR;
 468
 469                 switch ( tag ) {
 470                 case LDAP_SUBSTRING_INITIAL:
 471 #ifdef NEW_LOGGING
 472                         LDAP_LOG( FILTER, DETAIL1,
 473                                 "get_ssa: conn %d  INITIAL\n",
 474                                 op->o_connid, 0, 0 );
 475 #else
 476                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
 477 #endif
 478
 479                         if ( ssa.sa_initial.bv_val != NULL
 480                                 || ssa.sa_any != NULL
 481                                 || ssa.sa_final.bv_val != NULL )
 482                         {
 483                                 sl_free( nvalue.bv_val, op->o_tmpmemctx );
 484                                 goto return_error;
 485                         }
 486
 487                         ssa.sa_initial = nvalue;
 488                         break;
 489
 490                 case LDAP_SUBSTRING_ANY:
 491 #ifdef NEW_LOGGING
 492                         LDAP_LOG( FILTER, DETAIL1,
 493                                 "get_ssa: conn %d  ANY\n",
 494                                 op->o_connid, 0, 0 );
 495 #else
 496                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
 497 #endif
 498
 499                         if ( ssa.sa_final.bv_val != NULL ) {
 500                                 sl_free( nvalue.bv_val, op->o_tmpmemctx );
 501                                 goto return_error;
 502                         }
 503
 504                         ber_bvarray_add_x( &ssa.sa_any, &nvalue, op->o_tmpmemctx );
 505                         break;
 506
 507                 case LDAP_SUBSTRING_FINAL:
 508 #ifdef NEW_LOGGING
 509                         LDAP_LOG( FILTER, DETAIL1,
 510                                 "get_ssa: conn %d  FINAL\n",
 511                                 op->o_connid, 0, 0 );
 512 #else
 513                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
 514 #endif
 515
 516                         if ( ssa.sa_final.bv_val != NULL ) {
 517                                 sl_free( nvalue.bv_val, op->o_tmpmemctx );
 518                                 goto return_error;
 519                         }
 520
 521                         ssa.sa_final = nvalue;
 522                         break;
 523
 524                 default:
 525 #ifdef NEW_LOGGING
 526                         LDAP_LOG( FILTER, INFO,
 527                                 "get_ssa: conn %d  unknown substring type %ld\n",
 528                                 op->o_connid, (long)tag, 0 );
 529 #else
 530                         Debug( LDAP_DEBUG_FILTER,
 531                                 "  unknown substring type=%ld\n",
 532                                 (long) tag, 0, 0 );
 533 #endif
 534
 535                         assert( 0 );
 536                         sl_free( nvalue.bv_val, op->o_tmpmemctx );
 537
 538 return_error:
 539 #ifdef NEW_LOGGING
 540                         LDAP_LOG( FILTER, INFO,
 541                                 "get_ssa: conn %d  error %ld\n",
 542                                 op->o_connid, (long)rc, 0 );
 543 #else
 544                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
 545                                 (long) rc, 0, 0 );
 546 #endif
 547                         sl_free( ssa.sa_initial.bv_val, op->o_tmpmemctx );
 548                         ber_bvarray_free_x( ssa.sa_any, op->o_tmpmemctx );
 549                         sl_free( ssa.sa_final.bv_val, op->o_tmpmemctx );
 550                         return rc;
 551                 }
 552
 553                 rc = LDAP_SUCCESS;
 554         }
 555
 556         if( rc == LDAP_SUCCESS ) {
 557                 *out = op->o_tmpalloc( sizeof( ssa ), op->o_tmpmemctx );
 558                 **out = ssa;
 559         }
 560
 561 #ifdef NEW_LOGGING
 562         LDAP_LOG( FILTER, ENTRY,
 563                 "get_ssa: conn %d exit\n", op->o_connid, 0, 0 );
 564 #else
 565         Debug( LDAP_DEBUG_FILTER, "end get_ssa\n", 0, 0, 0 );
 566 #endif
 567
 568         return LDAP_SUCCESS;
 569 }
 570
 571 void
 572 filter_free_x( Operation *op, Filter *f )
 573 {
 574         Filter  *p, *next;
 575
 576         if ( f == NULL ) {
 577                 return;
 578         }
 579
 580         switch ( f->f_choice ) {
 581         case LDAP_FILTER_PRESENT:
 582                 break;
 583
 584         case LDAP_FILTER_EQUALITY:
 585         case LDAP_FILTER_GE:
 586         case LDAP_FILTER_LE:
 587         case LDAP_FILTER_APPROX:
 588                 ava_free( op, f->f_ava, 1 );
 589                 break;
 590
 591         case LDAP_FILTER_SUBSTRINGS:
 592                 if ( f->f_sub_initial.bv_val != NULL ) {
 593                         op->o_tmpfree( f->f_sub_initial.bv_val, op->o_tmpmemctx );
 594                 }
 595                 ber_bvarray_free_x( f->f_sub_any, op->o_tmpmemctx );
 596                 if ( f->f_sub_final.bv_val != NULL ) {
 597                         op->o_tmpfree( f->f_sub_final.bv_val, op->o_tmpmemctx );
 598                 }
 599                 op->o_tmpfree( f->f_sub, op->o_tmpmemctx );
 600                 break;
 601
 602         case LDAP_FILTER_AND:
 603         case LDAP_FILTER_OR:
 604         case LDAP_FILTER_NOT:
 605                 for ( p = f->f_list; p != NULL; p = next ) {
 606                         next = p->f_next;
 607                         filter_free_x( op, p );
 608                 }
 609                 break;
 610
 611         case LDAP_FILTER_EXT:
 612                 mra_free( op, f->f_mra, 1 );
 613                 break;
 614
 615         case SLAPD_FILTER_COMPUTED:
 616                 break;
 617
 618         default:
 619 #ifdef NEW_LOGGING
 620                 LDAP_LOG( FILTER, ERR,
 621                         "filter_free: unknown filter type %lu\n", f->f_choice, 0, 0 );
 622 #else
 623                 Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
 624                         f->f_choice, 0, 0 );
 625 #endif
 626                 break;
 627         }
 628
 629         op->o_tmpfree( f, op->o_tmpmemctx );
 630 }
 631
 632 void
 633 filter_free( Filter *f )
 634 {
 635         Operation op;
 636
 637         op.o_tmpmemctx = sl_context( f );
 638         op.o_tmpmfuncs = &sl_mfuncs;
 639         filter_free_x( &op, f );
 640 }
 641
 642 void
 643 filter2bv_x( Operation *op, Filter *f, struct berval *fstr )
 644 {
 645         int     i;
 646         Filter  *p;
 647         struct berval tmp;
 648         ber_len_t len;
 649
 650         if ( f == NULL ) {
 651                 ber_str2bv_x( "No filter!", sizeof("No filter!")-1, 1, fstr, op->o_tmpmemctx );
 652                 return;
 653         }
 654
 655         switch ( f->f_choice ) {
 656         case LDAP_FILTER_EQUALITY:
 657                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 658
 659                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 660                         tmp.bv_len + ( sizeof("(=)") - 1 );
 661                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 662
 663                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
 664                         f->f_av_desc->ad_cname.bv_val,
 665                         tmp.bv_val );
 666
 667                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 668                 break;
 669
 670         case LDAP_FILTER_GE:
 671                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 672
 673                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 674                         tmp.bv_len + ( sizeof("(>=)") - 1 );
 675                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 676
 677                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
 678                         f->f_av_desc->ad_cname.bv_val,
 679                         tmp.bv_val );
 680
 681                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 682                 break;
 683
 684         case LDAP_FILTER_LE:
 685                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 686
 687                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 688                         tmp.bv_len + ( sizeof("(<=)") - 1 );
 689                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 690
 691                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
 692                         f->f_av_desc->ad_cname.bv_val,
 693                         tmp.bv_val );
 694
 695                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 696                 break;
 697
 698         case LDAP_FILTER_APPROX:
 699                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 700
 701                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 702                         tmp.bv_len + ( sizeof("(~=)") - 1 );
 703                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 704
 705                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
 706                         f->f_av_desc->ad_cname.bv_val,
 707                         tmp.bv_val );
 708                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 709                 break;
 710
 711         case LDAP_FILTER_SUBSTRINGS:
 712                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
 713                         ( sizeof("(=*)") - 1 );
 714                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 715
 716                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 717                         f->f_sub_desc->ad_cname.bv_val );
 718
 719                 if ( f->f_sub_initial.bv_val != NULL ) {
 720                         len = fstr->bv_len;
 721
 722                         filter_escape_value_x( &f->f_sub_initial, &tmp, op->o_tmpmemctx );
 723
 724                         fstr->bv_len += tmp.bv_len;
 725                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1, op->o_tmpmemctx );
 726
 727                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
 728                                 /* "(attr=" */ "%s*)",
 729                                 tmp.bv_val );
 730
 731                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 732                 }
 733
 734                 if ( f->f_sub_any != NULL ) {
 735                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
 736                                 len = fstr->bv_len;
 737                                 filter_escape_value_x( &f->f_sub_any[i], &tmp, op->o_tmpmemctx );
 738
 739                                 fstr->bv_len += tmp.bv_len + 1;
 740                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1, op->o_tmpmemctx );
 741
 742                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 743                                         /* "(attr=[init]*[any*]" */ "%s*)",
 744                                         tmp.bv_val );
 745                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 746                         }
 747                 }
 748
 749                 if ( f->f_sub_final.bv_val != NULL ) {
 750                         len = fstr->bv_len;
 751
 752                         filter_escape_value_x( &f->f_sub_final, &tmp, op->o_tmpmemctx );
 753
 754                         fstr->bv_len += tmp.bv_len;
 755                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1, op->o_tmpmemctx );
 756
 757                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 758                                 /* "(attr=[init*][any*]" */ "%s)",
 759                                 tmp.bv_val );
 760
 761                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 762                 }
 763
 764                 break;
 765
 766         case LDAP_FILTER_PRESENT:
 767                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
 768                         ( sizeof("(=*)") - 1 );
 769                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 770
 771                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 772                         f->f_desc->ad_cname.bv_val );
 773                 break;
 774
 775         case LDAP_FILTER_AND:
 776         case LDAP_FILTER_OR:
 777         case LDAP_FILTER_NOT:
 778                 fstr->bv_len = sizeof("(%)") - 1;
 779                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 780
 781                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 782                         f->f_choice == LDAP_FILTER_AND ? '&' :
 783                         f->f_choice == LDAP_FILTER_OR ? '|' : '!' );
 784
 785                 for ( p = f->f_list; p != NULL; p = p->f_next ) {
 786                         len = fstr->bv_len;
 787
 788                         filter2bv_x( op, p, &tmp );
 789
 790                         fstr->bv_len += tmp.bv_len;
 791                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1, op->o_tmpmemctx );
 792
 793                         snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
 794                                 /*"("*/ "%s)", tmp.bv_val );
 795
 796                         op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
 797                 }
 798
 799                 break;
 800
 801         case LDAP_FILTER_EXT: {
 802                 struct berval ad;
 803                 filter_escape_value_x( &f->f_mr_value, &tmp, op->o_tmpmemctx );
 804
 805                 if ( f->f_mr_desc ) {
 806                         ad = f->f_mr_desc->ad_cname;
 807                 } else {
 808                         ad.bv_len = 0;
 809                         ad.bv_val = "";
 810                 }
 811
 812                 fstr->bv_len = ad.bv_len +
 813                         ( f->f_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
 814                         ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
 815                         tmp.bv_len + ( sizeof("(:=)") - 1 );
 816                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 817
 818                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
 819                         ad.bv_val,
 820                         f->f_mr_dnattrs ? ":dn" : "",
 821                         f->f_mr_rule_text.bv_len ? ":" : "",
 822                         f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
 823                         tmp.bv_val );
 824                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 825                 } break;
 826
 827         case SLAPD_FILTER_COMPUTED:
 828                 ber_str2bv_x(
 829                         f->f_result == LDAP_COMPARE_FALSE ? "(?=false)" :
 830                         f->f_result == LDAP_COMPARE_TRUE ? "(?=true)" :
 831                         f->f_result == SLAPD_COMPARE_UNDEFINED ? "(?=undefined)" :
 832                         "(?=error)",
 833                         f->f_result == LDAP_COMPARE_FALSE ? sizeof("(?=false)")-1 :
 834                         f->f_result == LDAP_COMPARE_TRUE ? sizeof("(?=true)")-1 :
 835                         f->f_result == SLAPD_COMPARE_UNDEFINED ? sizeof("(?=undefined)")-1 :
 836                         sizeof("(?=error)")-1,
 837                         1, fstr, op->o_tmpmemctx );
 838                 break;
 839
 840         default:
 841                 ber_str2bv_x( "(?=unknown)", sizeof("(?=unknown)")-1,
 842                         1, fstr, op->o_tmpmemctx );
 843                 break;
 844         }
 845 }
 846
 847 void
 848 filter2bv( Filter *f, struct berval *fstr )
 849 {
 850         Operation op;
 851         op.o_tmpmemctx = NULL;
 852         op.o_tmpmfuncs = &ch_mfuncs;
 853
 854         filter2bv_x( &op, f, fstr );
 855 }
 856
 857 int
 858 filter_escape_value_x(
 859         struct berval *in,
 860         struct berval *out,
 861         void *ctx )
 862 {
 863         ber_len_t i;
 864         assert( in );
 865         assert( out );
 866
 867         i = in->bv_len * 3 + 1;
 868         out->bv_val = ctx ? sl_malloc( i, ctx ) : ch_malloc( i );
 869         out->bv_len = 0;
 870
 871         for( i=0; i < in->bv_len ; i++ ) {
 872                 if( FILTER_ESCAPE(in->bv_val[i]) ) {
 873                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_CHAR;
 874                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_HI( in->bv_val[i] );
 875                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_LO( in->bv_val[i] );
 876                 } else {
 877                         out->bv_val[out->bv_len++] = in->bv_val[i];
 878                 }
 879         }
 880
 881         out->bv_val[out->bv_len] = '\0';
 882         return LDAP_SUCCESS;
 883 }
 884
 885 int
 886 filter_escape_value(
 887         struct berval *in,
 888         struct berval *out )
 889 {
 890         return filter_escape_value_x( in, out, NULL );
 891 }
 892
 893 static int
 894 get_simple_vrFilter(
 895         Operation *op,
 896         BerElement *ber,
 897         ValuesReturnFilter **filt,
 898         const char **text )
 899 {
 900         ber_tag_t       tag;
 901         ber_len_t       len;
 902         int             err;
 903         ValuesReturnFilter vrf;
 904
 905 #ifdef NEW_LOGGING
 906         LDAP_LOG( FILTER, ENTRY,
 907                 "get_simple_vrFilter: conn %d\n", op->o_connid, 0, 0 );
 908 #else
 909         Debug( LDAP_DEBUG_FILTER, "begin get_simple_vrFilter\n", 0, 0, 0 );
 910 #endif
 911
 912         tag = ber_peek_tag( ber, &len );
 913
 914         if( tag == LBER_ERROR ) {
 915                 *text = "error decoding filter";
 916                 return SLAPD_DISCONNECT;
 917         }
 918
 919         vrf.vrf_next = NULL;
 920
 921         err = LDAP_SUCCESS;
 922         vrf.vrf_choice = tag;
 923
 924         switch ( vrf.vrf_choice ) {
 925         case LDAP_FILTER_EQUALITY:
 926 #ifdef NEW_LOGGING
 927                 LDAP_LOG( FILTER, DETAIL2,
 928                         "get_simple_vrFilter: conn %d  EQUALITY\n", op->o_connid, 0, 0 );
 929 #else
 930                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 931 #endif
 932                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_EQUALITY, text );
 933                 if ( err != LDAP_SUCCESS ) {
 934                         break;
 935                 }
 936
 937                 assert( vrf.vrf_ava != NULL );
 938                 break;
 939
 940         case LDAP_FILTER_SUBSTRINGS:
 941 #ifdef NEW_LOGGING
 942                 LDAP_LOG( FILTER, DETAIL1,
 943                         "get_simple_vrFilter: conn %d  SUBSTRINGS\n", op->o_connid, 0, 0 );
 944 #else
 945                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 946 #endif
 947                 err = get_ssa( op, ber, &vrf.vrf_sub, text );
 948                 break;
 949
 950         case LDAP_FILTER_GE:
 951 #ifdef NEW_LOGGING
 952                 LDAP_LOG( FILTER, DETAIL1,
 953                         "get_simple_vrFilter: conn %d  GE\n", op->o_connid, 0, 0 );
 954 #else
 955                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 956 #endif
 957                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_ORDERING, text );
 958                 if ( err != LDAP_SUCCESS ) {
 959                         break;
 960                 }
 961                 break;
 962
 963         case LDAP_FILTER_LE:
 964 #ifdef NEW_LOGGING
 965                 LDAP_LOG( FILTER, DETAIL1,
 966                         "get_simple_vrFilter: conn %d  LE\n", op->o_connid, 0, 0 );
 967 #else
 968                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 969 #endif
 970                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_ORDERING, text );
 971                 if ( err != LDAP_SUCCESS ) {
 972                         break;
 973                 }
 974                 break;
 975
 976         case LDAP_FILTER_PRESENT: {
 977                 struct berval type;
 978
 979 #ifdef NEW_LOGGING
 980                 LDAP_LOG( FILTER, DETAIL1,
 981                         "get_simple_vrFilter: conn %d PRESENT\n", op->o_connid, 0, 0 );
 982 #else
 983                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 984 #endif
 985                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 986                         err = SLAPD_DISCONNECT;
 987                         *text = "error decoding filter";
 988                         break;
 989                 }
 990
 991                 vrf.vrf_desc = NULL;
 992                 err = slap_bv2ad( &type, &vrf.vrf_desc, text );
 993
 994                 if( err != LDAP_SUCCESS ) {
 995                         /* unrecognized attribute description or other error */
 996                         vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 997                         vrf.vrf_result = LDAP_COMPARE_FALSE;
 998                         err = LDAP_SUCCESS;
 999                         break;
1000                 }
1001                 } break;
1002
1003         case LDAP_FILTER_APPROX:
1004 #ifdef NEW_LOGGING
1005                 LDAP_LOG( FILTER, DETAIL1,
1006                         "get_simple_vrFilter: conn %d  APPROX\n", op->o_connid, 0, 0 );
1007 #else
1008                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
1009 #endif
1010                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_EQUALITY_APPROX, text );
1011                 if ( err != LDAP_SUCCESS ) {
1012                         break;
1013                 }
1014                 break;
1015
1016         case LDAP_FILTER_EXT:
1017 #ifdef NEW_LOGGING
1018                 LDAP_LOG( FILTER, DETAIL1,
1019                         "get_simple_vrFilter: conn %d  EXTENSIBLE\n", op->o_connid, 0, 0 );
1020 #else
1021                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
1022 #endif
1023
1024                 err = get_mra( op, ber, &vrf.vrf_mra, text );
1025                 if ( err != LDAP_SUCCESS ) {
1026                         break;
1027                 }
1028
1029                 assert( vrf.vrf_mra != NULL );
1030                 break;
1031
1032         default:
1033                 (void) ber_scanf( ber, "x" ); /* skip the element */
1034 #ifdef NEW_LOGGING
1035                 LDAP_LOG( FILTER, ERR,
1036                         "get_simple_vrFilter: conn %d unknown filter type=%lu\n",
1037                         op->o_connid, vrf.vrf_choice, 0 );
1038 #else
1039                 Debug( LDAP_DEBUG_ANY, "get_simple_vrFilter: unknown filter type=%lu\n",
1040                         vrf.vrf_choice, 0, 0 );
1041 #endif
1042                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
1043                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
1044                 break;
1045         }
1046
1047         if ( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
1048                 /* ignore error */
1049                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
1050                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
1051                 err = LDAP_SUCCESS;
1052         }
1053
1054         if ( err == LDAP_SUCCESS ) {
1055                 *filt = ch_malloc( sizeof vrf );
1056                 **filt = vrf;
1057         }
1058
1059 #ifdef NEW_LOGGING
1060         LDAP_LOG( FILTER, DETAIL2,
1061                 "get_simple_vrFilter: conn %d exit\n", op->o_connid, 0, 0 );
1062 #else
1063         Debug( LDAP_DEBUG_FILTER, "end get_simple_vrFilter %d\n", err, 0, 0 );
1064 #endif
1065
1066         return err;
1067 }
1068
1069 int
1070 get_vrFilter( Operation *op, BerElement *ber,
1071         ValuesReturnFilter **vrf,
1072         const char **text )
1073 {
1074         /*
1075          * A ValuesReturnFilter looks like this:
1076          *
1077          *      ValuesReturnFilter ::= SEQUENCE OF SimpleFilterItem
1078          *      SimpleFilterItem ::= CHOICE {
1079          *              equalityMatch   [3]     AttributeValueAssertion,
1080          *              substrings      [4]     SubstringFilter,
1081          *              greaterOrEqual  [5]     AttributeValueAssertion,
1082          *              lessOrEqual     [6]     AttributeValueAssertion,
1083          *              present         [7]     AttributeType,
1084          *              approxMatch     [8]     AttributeValueAssertion,
1085          *              extensibleMatch [9]     SimpleMatchingAssertion -- LDAPv3
1086          *      }
1087          *
1088          *      SubstringFilter ::= SEQUENCE {
1089          *              type               AttributeType,
1090          *              SEQUENCE OF CHOICE {
1091          *                      initial          [0] IA5String,
1092          *                      any              [1] IA5String,
1093          *                      final            [2] IA5String
1094          *              }
1095          *      }
1096          *
1097          *      SimpleMatchingAssertion ::= SEQUENCE {  -- LDAPv3
1098          *              matchingRule    [1] MatchingRuleId OPTIONAL,
1099          *              type            [2] AttributeDescription OPTIONAL,
1100          *              matchValue      [3] AssertionValue }
1101          */
1102
1103         ValuesReturnFilter **n;
1104         ber_tag_t       tag;
1105         ber_len_t       len;
1106         char            *last;
1107
1108 #ifdef NEW_LOGGING
1109         LDAP_LOG( FILTER, ENTRY,
1110                 "get_vrFilter: conn %d start\n", op->o_connid, 0, 0 );
1111 #else
1112         Debug( LDAP_DEBUG_FILTER, "begin get_vrFilter\n", 0, 0, 0 );
1113 #endif
1114
1115         tag = ber_peek_tag( ber, &len );
1116
1117         if( tag == LBER_ERROR ) {
1118                 *text = "error decoding vrFilter";
1119                 return SLAPD_DISCONNECT;
1120         }
1121
1122         if( tag != LBER_SEQUENCE ) {
1123                 *text = "error decoding vrFilter, expect SEQUENCE tag";
1124                 return SLAPD_DISCONNECT;
1125         }
1126
1127         n = vrf;
1128         for ( tag = ber_first_element( ber, &len, &last );
1129                 tag != LBER_DEFAULT;
1130                 tag = ber_next_element( ber, &len, last ) )
1131         {
1132                 int err = get_simple_vrFilter( op, ber, n, text );
1133
1134                 if ( err != LDAP_SUCCESS ) return( err );
1135
1136                 n = &(*n)->vrf_next;
1137         }
1138         *n = NULL;
1139
1140 #ifdef NEW_LOGGING
1141         LDAP_LOG( FILTER, ENTRY,
1142                 "get_vrFilter: conn %d exit\n", op->o_connid, 0, 0 );
1143 #else
1144         Debug( LDAP_DEBUG_FILTER, "end get_vrFilter\n", 0, 0, 0 );
1145 #endif
1146         return( LDAP_SUCCESS );
1147 }
1148
1149 void
1150 vrFilter_free( Operation *op, ValuesReturnFilter *vrf )
1151 {
1152         ValuesReturnFilter      *p, *next;
1153
1154         if ( vrf == NULL ) {
1155                 return;
1156         }
1157
1158         for ( p = vrf; p != NULL; p = next ) {
1159                 next = p->vrf_next;
1160
1161                 switch ( vrf->vrf_choice ) {
1162                 case LDAP_FILTER_PRESENT:
1163                         break;
1164
1165                 case LDAP_FILTER_EQUALITY:
1166                 case LDAP_FILTER_GE:
1167                 case LDAP_FILTER_LE:
1168                 case LDAP_FILTER_APPROX:
1169                         ava_free( op, vrf->vrf_ava, 1 );
1170                         break;
1171
1172                 case LDAP_FILTER_SUBSTRINGS:
1173                         if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1174                                 op->o_tmpfree( vrf->vrf_sub_initial.bv_val, op->o_tmpmemctx );
1175                         }
1176                         ber_bvarray_free_x( vrf->vrf_sub_any, op->o_tmpmemctx );
1177                         if ( vrf->vrf_sub_final.bv_val != NULL ) {
1178                                 op->o_tmpfree( vrf->vrf_sub_final.bv_val, op->o_tmpmemctx );
1179                         }
1180                         op->o_tmpfree( vrf->vrf_sub, op->o_tmpmemctx );
1181                         break;
1182
1183                 case LDAP_FILTER_EXT:
1184                         mra_free( op, vrf->vrf_mra, 1 );
1185                         break;
1186
1187                 case SLAPD_FILTER_COMPUTED:
1188                         break;
1189
1190                 default:
1191 #ifdef NEW_LOGGING
1192                         LDAP_LOG( FILTER, ERR,
1193                                 "filter_free: unknown filter type %lu\n", vrf->vrf_choice, 0, 0 );
1194 #else
1195                         Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
1196                                 vrf->vrf_choice, 0, 0 );
1197 #endif
1198                         break;
1199                 }
1200
1201                 op->o_tmpfree( vrf, op->o_tmpmemctx );
1202         }
1203 }
1204
1205 void
1206 vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1207 {
1208         ValuesReturnFilter      *p;
1209         struct berval tmp;
1210         ber_len_t len;
1211
1212         if ( vrf == NULL ) {
1213                 ber_str2bv_x( "No filter!", sizeof("No filter!")-1,
1214                         1, fstr, op->o_tmpmemctx );
1215                 return;
1216         }
1217
1218         fstr->bv_len = sizeof("()") - 1;
1219         fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1220
1221         snprintf( fstr->bv_val, fstr->bv_len + 1, "()");
1222
1223         for ( p = vrf; p != NULL; p = p->vrf_next ) {
1224                 len = fstr->bv_len;
1225
1226                 simple_vrFilter2bv( op, p, &tmp );
1227
1228                 fstr->bv_len += tmp.bv_len;
1229                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1, op->o_tmpmemctx );
1230
1231                 snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
1232                         /*"("*/ "%s)", tmp.bv_val );
1233
1234                 op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
1235         }
1236 }
1237
1238 static void
1239 simple_vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1240 {
1241         struct berval tmp;
1242         ber_len_t len;
1243
1244         if ( vrf == NULL ) {
1245                 ber_str2bv_x( "No filter!", sizeof("No filter!")-1, 1, fstr, op->o_tmpmemctx );
1246                 return;
1247         }
1248
1249         switch ( vrf->vrf_choice ) {
1250         case LDAP_FILTER_EQUALITY:
1251                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1252
1253                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1254                         tmp.bv_len + ( sizeof("(=)") - 1 );
1255                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1256
1257                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
1258                         vrf->vrf_av_desc->ad_cname.bv_val,
1259                         tmp.bv_val );
1260
1261                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1262                 break;
1263
1264         case LDAP_FILTER_GE:
1265                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1266
1267                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1268                         tmp.bv_len + ( sizeof("(>=)") - 1 );
1269                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1270
1271                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
1272                         vrf->vrf_av_desc->ad_cname.bv_val,
1273                         tmp.bv_val );
1274
1275                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1276                 break;
1277
1278         case LDAP_FILTER_LE:
1279                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1280
1281                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1282                         tmp.bv_len + ( sizeof("(<=)") - 1 );
1283                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1284
1285                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
1286                         vrf->vrf_av_desc->ad_cname.bv_val,
1287                         tmp.bv_val );
1288
1289                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1290                 break;
1291
1292         case LDAP_FILTER_APPROX:
1293                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1294
1295                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1296                         tmp.bv_len + ( sizeof("(~=)") - 1 );
1297                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1298
1299                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
1300                         vrf->vrf_av_desc->ad_cname.bv_val,
1301                         tmp.bv_val );
1302                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1303                 break;
1304
1305         case LDAP_FILTER_SUBSTRINGS:
1306                 fstr->bv_len = vrf->vrf_sub_desc->ad_cname.bv_len +
1307                         ( sizeof("(=*)") - 1 );
1308                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1309
1310                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1311                         vrf->vrf_sub_desc->ad_cname.bv_val );
1312
1313                 if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1314                         len = fstr->bv_len;
1315
1316                         filter_escape_value_x( &vrf->vrf_sub_initial, &tmp, op->o_tmpmemctx );
1317
1318                         fstr->bv_len += tmp.bv_len;
1319                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1, op->o_tmpmemctx );
1320
1321                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
1322                                 /* "(attr=" */ "%s*)",
1323                                 tmp.bv_val );
1324
1325                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1326                 }
1327
1328                 if ( vrf->vrf_sub_any != NULL ) {
1329                         int i;
1330                         for ( i = 0; vrf->vrf_sub_any[i].bv_val != NULL; i++ ) {
1331                                 len = fstr->bv_len;
1332                                 filter_escape_value_x( &vrf->vrf_sub_any[i], &tmp, op->o_tmpmemctx );
1333
1334                                 fstr->bv_len += tmp.bv_len + 1;
1335                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1, op->o_tmpmemctx );
1336
1337                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1338                                         /* "(attr=[init]*[any*]" */ "%s*)",
1339                                         tmp.bv_val );
1340                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1341                         }
1342                 }
1343
1344                 if ( vrf->vrf_sub_final.bv_val != NULL ) {
1345                         len = fstr->bv_len;
1346
1347                         filter_escape_value_x( &vrf->vrf_sub_final, &tmp, op->o_tmpmemctx );
1348
1349                         fstr->bv_len += tmp.bv_len;
1350                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1, op->o_tmpmemctx );
1351
1352                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1353                                 /* "(attr=[init*][any*]" */ "%s)",
1354                                 tmp.bv_val );
1355
1356                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1357                 }
1358
1359                 break;
1360
1361         case LDAP_FILTER_PRESENT:
1362                 fstr->bv_len = vrf->vrf_desc->ad_cname.bv_len +
1363                         ( sizeof("(=*)") - 1 );
1364                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1365
1366                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1367                         vrf->vrf_desc->ad_cname.bv_val );
1368                 break;
1369
1370         case LDAP_FILTER_EXT: {
1371                 struct berval ad;
1372                 filter_escape_value_x( &vrf->vrf_mr_value, &tmp, op->o_tmpmemctx );
1373
1374                 if ( vrf->vrf_mr_desc ) {
1375                         ad = vrf->vrf_mr_desc->ad_cname;
1376                 } else {
1377                         ad.bv_len = 0;
1378                         ad.bv_val = "";
1379                 }
1380
1381                 fstr->bv_len = ad.bv_len +
1382                         ( vrf->vrf_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
1383                         ( vrf->vrf_mr_rule_text.bv_len ? vrf->vrf_mr_rule_text.bv_len+1 : 0 ) +
1384                         tmp.bv_len + ( sizeof("(:=)") - 1 );
1385                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1386
1387                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
1388                         ad.bv_val,
1389                         vrf->vrf_mr_dnattrs ? ":dn" : "",
1390                         vrf->vrf_mr_rule_text.bv_len ? ":" : "",
1391                         vrf->vrf_mr_rule_text.bv_len ? vrf->vrf_mr_rule_text.bv_val : "",
1392                         tmp.bv_val );
1393
1394                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1395                 } break;
1396
1397         case SLAPD_FILTER_COMPUTED:
1398                 ber_str2bv_x(
1399                         vrf->vrf_result == LDAP_COMPARE_FALSE ? "(?=false)" :
1400                         vrf->vrf_result == LDAP_COMPARE_TRUE ? "(?=true)" :
1401                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED ? "(?=undefined)" :
1402                         "(?=error)",
1403                         vrf->vrf_result == LDAP_COMPARE_FALSE ? sizeof("(?=false)")-1 :
1404                         vrf->vrf_result == LDAP_COMPARE_TRUE ? sizeof("(?=true)")-1 :
1405                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED ? sizeof("(?=undefined)")-1 :
1406                         sizeof("(?=error)")-1,
1407                         1, fstr, op->o_tmpmemctx );
1408                 break;
1409
1410         default:
1411                 ber_str2bv_x( "(?=unknown)", sizeof("(?=unknown)")-1,
1412                         1, fstr, op->o_tmpmemctx );
1413                 break;
1414         }
1415 }