git.sur5r.net Git - openldap/blob - servers/slapd/filter.c

   1 /* filter.c - routines for parsing and dealing with filters */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2005 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/socket.h>
  32 #include <ac/string.h>
  33
  34 #include "slap.h"
  35
  36 static int      get_filter_list(
  37         Operation *op,
  38         BerElement *ber,
  39         Filter **f,
  40         const char **text );
  41
  42 static int      get_ssa(
  43         Operation *op,
  44         BerElement *ber,
  45         SubstringsAssertion **s,
  46         const char **text );
  47
  48 static int filter_escape_value_x(
  49         struct berval *in,
  50         struct berval *out,
  51         void *ctx );
  52
  53 static void simple_vrFilter2bv(
  54         Operation *op,
  55         ValuesReturnFilter *f,
  56         struct berval *fstr );
  57
  58 static int      get_simple_vrFilter(
  59         Operation *op,
  60         BerElement *ber,
  61         ValuesReturnFilter **f,
  62         const char **text );
  63
  64 int
  65 get_filter(
  66         Operation *op,
  67         BerElement *ber,
  68         Filter **filt,
  69         const char **text )
  70 {
  71         ber_tag_t       tag;
  72         ber_len_t       len;
  73         int             err;
  74         Filter          f;
  75
  76         Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
  77         /*
  78          * A filter looks like this coming in:
  79          *      Filter ::= CHOICE {
  80          *              and             [0]     SET OF Filter,
  81          *              or              [1]     SET OF Filter,
  82          *              not             [2]     Filter,
  83          *              equalityMatch   [3]     AttributeValueAssertion,
  84          *              substrings      [4]     SubstringFilter,
  85          *              greaterOrEqual  [5]     AttributeValueAssertion,
  86          *              lessOrEqual     [6]     AttributeValueAssertion,
  87          *              present         [7]     AttributeType,,
  88          *              approxMatch     [8]     AttributeValueAssertion
  89          *              extensibleMatch [9]     MatchingRuleAssertion
  90          *      }
  91          *
  92          *      SubstringFilter ::= SEQUENCE {
  93          *              type               AttributeType,
  94          *              SEQUENCE OF CHOICE {
  95          *                      initial          [0] IA5String,
  96          *                      any              [1] IA5String,
  97          *                      final            [2] IA5String
  98          *              }
  99          *      }
 100          *
 101          *      MatchingRuleAssertion ::= SEQUENCE {
 102          *              matchingRule    [1] MatchingRuleId OPTIONAL,
 103          *              type            [2] AttributeDescription OPTIONAL,
 104          *              matchValue      [3] AssertionValue,
 105          *              dnAttributes    [4] BOOLEAN DEFAULT FALSE
 106          *      }
 107          *
 108          */
 109
 110         tag = ber_peek_tag( ber, &len );
 111
 112         if( tag == LBER_ERROR ) {
 113                 *text = "error decoding filter";
 114                 return SLAPD_DISCONNECT;
 115         }
 116
 117         err = LDAP_SUCCESS;
 118
 119         f.f_next = NULL;
 120         f.f_choice = tag;
 121
 122         switch ( f.f_choice ) {
 123         case LDAP_FILTER_EQUALITY:
 124                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 125                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_EQUALITY, text );
 126                 if ( err != LDAP_SUCCESS ) {
 127                         break;
 128                 }
 129
 130                 assert( f.f_ava != NULL );
 131                 break;
 132
 133         case LDAP_FILTER_SUBSTRINGS:
 134                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 135                 err = get_ssa( op, ber, &f.f_sub, text );
 136                 if( err != LDAP_SUCCESS ) {
 137                         break;
 138                 }
 139                 assert( f.f_sub != NULL );
 140                 break;
 141
 142         case LDAP_FILTER_GE:
 143                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 144                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_ORDERING, text );
 145                 if ( err != LDAP_SUCCESS ) {
 146                         break;
 147                 }
 148                 assert( f.f_ava != NULL );
 149                 break;
 150
 151         case LDAP_FILTER_LE:
 152                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 153                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_ORDERING, text );
 154                 if ( err != LDAP_SUCCESS ) {
 155                         break;
 156                 }
 157                 assert( f.f_ava != NULL );
 158                 break;
 159
 160         case LDAP_FILTER_PRESENT: {
 161                 struct berval type;
 162
 163                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 164                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 165                         err = SLAPD_DISCONNECT;
 166                         *text = "error decoding filter";
 167                         break;
 168                 }
 169
 170                 f.f_desc = NULL;
 171                 err = slap_bv2ad( &type, &f.f_desc, text );
 172
 173                 if( err != LDAP_SUCCESS ) {
 174                         err = slap_bv2undef_ad( &type, &f.f_desc, text,
 175                                 SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 176
 177                         if ( err != LDAP_SUCCESS ) {
 178                                 /* unrecognized attribute description or other error */
 179                                 Debug( LDAP_DEBUG_ANY,
 180                                         "get_filter: conn %lu unknown attribute "
 181                                         "type=%s (%d)\n",
 182                                         op->o_connid, type.bv_val, err );
 183
 184                                 f.f_choice = SLAPD_FILTER_COMPUTED;
 185                                 f.f_result = LDAP_COMPARE_FALSE;
 186                                 err = LDAP_SUCCESS;
 187                                 *text = NULL;
 188                                 break;
 189                         }
 190                 }
 191
 192                 assert( f.f_desc != NULL );
 193                 } break;
 194
 195         case LDAP_FILTER_APPROX:
 196                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 197                 err = get_ava( op, ber, &f.f_ava, SLAP_MR_EQUALITY_APPROX, text );
 198                 if ( err != LDAP_SUCCESS ) {
 199                         break;
 200                 }
 201                 assert( f.f_ava != NULL );
 202                 break;
 203
 204         case LDAP_FILTER_AND:
 205                 Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
 206                 err = get_filter_list( op, ber, &f.f_and, text );
 207                 if ( err != LDAP_SUCCESS ) {
 208                         break;
 209                 }
 210                 if ( f.f_and == NULL ) {
 211                         f.f_choice = SLAPD_FILTER_COMPUTED;
 212                         f.f_result = LDAP_COMPARE_TRUE;
 213                 }
 214                 /* no assert - list could be empty */
 215                 break;
 216
 217         case LDAP_FILTER_OR:
 218                 Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
 219                 err = get_filter_list( op, ber, &f.f_or, text );
 220                 if ( err != LDAP_SUCCESS ) {
 221                         break;
 222                 }
 223                 if ( f.f_or == NULL ) {
 224                         f.f_choice = SLAPD_FILTER_COMPUTED;
 225                         f.f_result = LDAP_COMPARE_FALSE;
 226                 }
 227                 /* no assert - list could be empty */
 228                 break;
 229
 230         case LDAP_FILTER_NOT:
 231                 Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
 232                 (void) ber_skip_tag( ber, &len );
 233                 err = get_filter( op, ber, &f.f_not, text );
 234                 if ( err != LDAP_SUCCESS ) {
 235                         break;
 236                 }
 237
 238                 assert( f.f_not != NULL );
 239                 if ( f.f_not->f_choice == SLAPD_FILTER_COMPUTED ) {
 240                         int fresult = f.f_not->f_result;
 241                         f.f_choice = SLAPD_FILTER_COMPUTED;
 242                         op->o_tmpfree( f.f_not, op->o_tmpmemctx );
 243                         f.f_not = NULL;
 244
 245                         switch( fresult ) {
 246                         case LDAP_COMPARE_TRUE:
 247                                 f.f_result = LDAP_COMPARE_FALSE;
 248                                 break;
 249                         case LDAP_COMPARE_FALSE:
 250                                 f.f_result = LDAP_COMPARE_TRUE;
 251                                 break;
 252                         default: ;
 253                                 /* (!Undefined) is Undefined */
 254                         }
 255                 }
 256                 break;
 257
 258         case LDAP_FILTER_EXT:
 259                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 260
 261                 err = get_mra( op, ber, &f.f_mra, text );
 262                 if ( err != LDAP_SUCCESS ) {
 263                         break;
 264                 }
 265
 266                 assert( f.f_mra != NULL );
 267                 break;
 268
 269         default:
 270                 (void) ber_scanf( ber, "x" ); /* skip the element */
 271                 Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
 272                         f.f_choice, 0, 0 );
 273                 f.f_choice = SLAPD_FILTER_COMPUTED;
 274                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 275                 break;
 276         }
 277
 278         if( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 279                 /* ignore error */
 280                 *text = NULL;
 281                 f.f_choice = SLAPD_FILTER_COMPUTED;
 282                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 283                 err = LDAP_SUCCESS;
 284         }
 285
 286         if ( err == LDAP_SUCCESS ) {
 287                 *filt = op->o_tmpalloc( sizeof(f), op->o_tmpmemctx );
 288                 **filt = f;
 289         }
 290
 291         Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
 292
 293         return( err );
 294 }
 295
 296 static int
 297 get_filter_list( Operation *op, BerElement *ber,
 298         Filter **f,
 299         const char **text )
 300 {
 301         Filter          **new;
 302         int             err;
 303         ber_tag_t       tag;
 304         ber_len_t       len;
 305         char            *last;
 306
 307         Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
 308         new = f;
 309         for ( tag = ber_first_element( ber, &len, &last );
 310                 tag != LBER_DEFAULT;
 311                 tag = ber_next_element( ber, &len, last ) )
 312         {
 313                 err = get_filter( op, ber, new, text );
 314                 if ( err != LDAP_SUCCESS )
 315                         return( err );
 316                 new = &(*new)->f_next;
 317         }
 318         *new = NULL;
 319
 320         Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
 321         return( LDAP_SUCCESS );
 322 }
 323
 324 static int
 325 get_ssa(
 326         Operation *op,
 327         BerElement      *ber,
 328         SubstringsAssertion     **out,
 329         const char      **text )
 330 {
 331         ber_tag_t       tag;
 332         ber_len_t       len;
 333         ber_tag_t       rc;
 334         struct berval desc, value, nvalue;
 335         char            *last;
 336         SubstringsAssertion ssa;
 337
 338         *text = "error decoding filter";
 339         *out = NULL;
 340
 341         Debug( LDAP_DEBUG_FILTER, "begin get_ssa\n", 0, 0, 0 );
 342         if ( ber_scanf( ber, "{m" /*}*/, &desc ) == LBER_ERROR ) {
 343                 return SLAPD_DISCONNECT;
 344         }
 345
 346         *text = NULL;
 347
 348         ssa.sa_desc = NULL;
 349         ssa.sa_initial.bv_val = NULL;
 350         ssa.sa_any = NULL;
 351         ssa.sa_final.bv_val = NULL;
 352
 353         rc = slap_bv2ad( &desc, &ssa.sa_desc, text );
 354
 355         if( rc != LDAP_SUCCESS ) {
 356                 rc = slap_bv2undef_ad( &desc, &ssa.sa_desc, text,
 357                         SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 358
 359                 if( rc != LDAP_SUCCESS ) {
 360                         Debug( LDAP_DEBUG_ANY,
 361                                 "get_ssa: conn %lu unknown attribute type=%s (%ld)\n",
 362                                 op->o_connid, desc.bv_val, (long) rc );
 363
 364                         /* skip over the rest of this filter */
 365                         for ( tag = ber_first_element( ber, &len, &last );
 366                                 tag != LBER_DEFAULT;
 367                                 tag = ber_next_element( ber, &len, last ) ) {
 368                                 ber_scanf( ber, "x" );
 369                         }
 370                         return rc;
 371                 }
 372         }
 373
 374         rc = LDAP_PROTOCOL_ERROR;
 375
 376         for ( tag = ber_first_element( ber, &len, &last );
 377                 tag != LBER_DEFAULT;
 378                 tag = ber_next_element( ber, &len, last ) )
 379         {
 380                 unsigned usage;
 381
 382                 rc = ber_scanf( ber, "m", &value );
 383                 if ( rc == LBER_ERROR ) {
 384                         rc = SLAPD_DISCONNECT;
 385                         goto return_error;
 386                 }
 387
 388                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
 389                         rc = LDAP_INVALID_SYNTAX;
 390                         goto return_error;
 391                 }
 392
 393                 switch ( tag ) {
 394                 case LDAP_SUBSTRING_INITIAL:
 395                         if ( ssa.sa_initial.bv_val != NULL
 396                                 || ssa.sa_any != NULL
 397                                 || ssa.sa_final.bv_val != NULL )
 398                         {
 399                                 rc = LDAP_PROTOCOL_ERROR;
 400                                 goto return_error;
 401                         }
 402                         usage = SLAP_MR_SUBSTR_INITIAL;
 403                         break;
 404
 405                 case LDAP_SUBSTRING_ANY:
 406                         if ( ssa.sa_final.bv_val != NULL ) {
 407                                 rc = LDAP_PROTOCOL_ERROR;
 408                                 goto return_error;
 409                         }
 410                         usage = SLAP_MR_SUBSTR_ANY;
 411                         break;
 412
 413                 case LDAP_SUBSTRING_FINAL:
 414                         if ( ssa.sa_final.bv_val != NULL ) {
 415                                 rc = LDAP_PROTOCOL_ERROR;
 416                                 goto return_error;
 417                         }
 418
 419                         usage = SLAP_MR_SUBSTR_FINAL;
 420                         break;
 421
 422                 default:
 423                         Debug( LDAP_DEBUG_FILTER,
 424                                 "  unknown substring choice=%ld\n",
 425                                 (long) tag, 0, 0 );
 426
 427                         rc = LDAP_PROTOCOL_ERROR;
 428                         goto return_error;
 429                 }
 430
 431                 /* validate/normalize using equality matching rule validator! */
 432                 rc = asserted_value_validate_normalize(
 433                         ssa.sa_desc, ssa.sa_desc->ad_type->sat_equality,
 434                         usage, &value, &nvalue, text, op->o_tmpmemctx );
 435                 if( rc != LDAP_SUCCESS ) goto return_error;
 436
 437                 switch ( tag ) {
 438                 case LDAP_SUBSTRING_INITIAL:
 439                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
 440                         ssa.sa_initial = nvalue;
 441                         break;
 442
 443                 case LDAP_SUBSTRING_ANY:
 444                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
 445                         ber_bvarray_add_x( &ssa.sa_any, &nvalue, op->o_tmpmemctx );
 446                         break;
 447
 448                 case LDAP_SUBSTRING_FINAL:
 449                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
 450                         ssa.sa_final = nvalue;
 451                         break;
 452
 453                 default:
 454                         assert( 0 );
 455                         slap_sl_free( nvalue.bv_val, op->o_tmpmemctx );
 456                         rc = LDAP_PROTOCOL_ERROR;
 457
 458 return_error:
 459                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
 460                                 (long) rc, 0, 0 );
 461                         slap_sl_free( ssa.sa_initial.bv_val, op->o_tmpmemctx );
 462                         ber_bvarray_free_x( ssa.sa_any, op->o_tmpmemctx );
 463                         slap_sl_free( ssa.sa_final.bv_val, op->o_tmpmemctx );
 464                         return rc;
 465                 }
 466
 467                 rc = LDAP_SUCCESS;
 468         }
 469
 470         if( rc == LDAP_SUCCESS ) {
 471                 *out = op->o_tmpalloc( sizeof( ssa ), op->o_tmpmemctx );
 472                 **out = ssa;
 473         }
 474
 475         Debug( LDAP_DEBUG_FILTER, "end get_ssa\n", 0, 0, 0 );
 476         return rc /* LDAP_SUCCESS */ ;
 477 }
 478
 479 void
 480 filter_free_x( Operation *op, Filter *f )
 481 {
 482         Filter  *p, *next;
 483
 484         if ( f == NULL ) {
 485                 return;
 486         }
 487
 488         switch ( f->f_choice ) {
 489         case LDAP_FILTER_PRESENT:
 490                 break;
 491
 492         case LDAP_FILTER_EQUALITY:
 493         case LDAP_FILTER_GE:
 494         case LDAP_FILTER_LE:
 495         case LDAP_FILTER_APPROX:
 496                 ava_free( op, f->f_ava, 1 );
 497                 break;
 498
 499         case LDAP_FILTER_SUBSTRINGS:
 500                 if ( f->f_sub_initial.bv_val != NULL ) {
 501                         op->o_tmpfree( f->f_sub_initial.bv_val, op->o_tmpmemctx );
 502                 }
 503                 ber_bvarray_free_x( f->f_sub_any, op->o_tmpmemctx );
 504                 if ( f->f_sub_final.bv_val != NULL ) {
 505                         op->o_tmpfree( f->f_sub_final.bv_val, op->o_tmpmemctx );
 506                 }
 507                 op->o_tmpfree( f->f_sub, op->o_tmpmemctx );
 508                 break;
 509
 510         case LDAP_FILTER_AND:
 511         case LDAP_FILTER_OR:
 512         case LDAP_FILTER_NOT:
 513                 for ( p = f->f_list; p != NULL; p = next ) {
 514                         next = p->f_next;
 515                         filter_free_x( op, p );
 516                 }
 517                 break;
 518
 519         case LDAP_FILTER_EXT:
 520                 mra_free( op, f->f_mra, 1 );
 521                 break;
 522
 523         case SLAPD_FILTER_COMPUTED:
 524                 break;
 525
 526         default:
 527                 Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
 528                         f->f_choice, 0, 0 );
 529                 break;
 530         }
 531
 532         op->o_tmpfree( f, op->o_tmpmemctx );
 533 }
 534
 535 void
 536 filter_free( Filter *f )
 537 {
 538         Operation op;
 539         Opheader ohdr;
 540
 541         op.o_hdr = &ohdr;
 542         op.o_tmpmemctx = slap_sl_context( f );
 543         op.o_tmpmfuncs = &slap_sl_mfuncs;
 544         filter_free_x( &op, f );
 545 }
 546
 547 void
 548 filter2bv_x( Operation *op, Filter *f, struct berval *fstr )
 549 {
 550         int             i;
 551         Filter          *p;
 552         struct berval   tmp;
 553         static struct berval
 554                         ber_bvfalse = BER_BVC( "(?=false)" ),
 555                         ber_bvtrue = BER_BVC( "(?=true)" ),
 556                         ber_bvundefined = BER_BVC( "(?=undefined)" ),
 557                         ber_bverror = BER_BVC( "(?=error)" ),
 558                         ber_bvunknown = BER_BVC( "(?=unknown)" ),
 559                         ber_bvnone = BER_BVC( "(?=none)" );
 560         ber_len_t       len;
 561
 562         if ( f == NULL ) {
 563                 ber_dupbv_x( fstr, &ber_bvnone, op->o_tmpmemctx );
 564                 return;
 565         }
 566
 567         switch ( f->f_choice ) {
 568         case LDAP_FILTER_EQUALITY:
 569                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 570
 571                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 572                         tmp.bv_len + ( sizeof("(=)") - 1 );
 573                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 574
 575                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
 576                         f->f_av_desc->ad_cname.bv_val,
 577                         tmp.bv_val );
 578
 579                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 580                 break;
 581
 582         case LDAP_FILTER_GE:
 583                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 584
 585                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 586                         tmp.bv_len + ( sizeof("(>=)") - 1 );
 587                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 588
 589                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
 590                         f->f_av_desc->ad_cname.bv_val,
 591                         tmp.bv_val );
 592
 593                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 594                 break;
 595
 596         case LDAP_FILTER_LE:
 597                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 598
 599                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 600                         tmp.bv_len + ( sizeof("(<=)") - 1 );
 601                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 602
 603                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
 604                         f->f_av_desc->ad_cname.bv_val,
 605                         tmp.bv_val );
 606
 607                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 608                 break;
 609
 610         case LDAP_FILTER_APPROX:
 611                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 612
 613                 fstr->bv_len = f->f_av_desc->ad_cname.bv_len +
 614                         tmp.bv_len + ( sizeof("(~=)") - 1 );
 615                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 616
 617                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
 618                         f->f_av_desc->ad_cname.bv_val,
 619                         tmp.bv_val );
 620                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 621                 break;
 622
 623         case LDAP_FILTER_SUBSTRINGS:
 624                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
 625                         ( sizeof("(=*)") - 1 );
 626                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 627
 628                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 629                         f->f_sub_desc->ad_cname.bv_val );
 630
 631                 if ( f->f_sub_initial.bv_val != NULL ) {
 632                         len = fstr->bv_len;
 633
 634                         filter_escape_value_x( &f->f_sub_initial, &tmp, op->o_tmpmemctx );
 635
 636                         fstr->bv_len += tmp.bv_len;
 637                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 638                                 op->o_tmpmemctx );
 639
 640                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
 641                                 /* "(attr=" */ "%s*)",
 642                                 tmp.bv_val );
 643
 644                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 645                 }
 646
 647                 if ( f->f_sub_any != NULL ) {
 648                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
 649                                 len = fstr->bv_len;
 650                                 filter_escape_value_x( &f->f_sub_any[i],
 651                                         &tmp, op->o_tmpmemctx );
 652
 653                                 fstr->bv_len += tmp.bv_len + 1;
 654                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 655                                         op->o_tmpmemctx );
 656
 657                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 658                                         /* "(attr=[init]*[any*]" */ "%s*)",
 659                                         tmp.bv_val );
 660                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 661                         }
 662                 }
 663
 664                 if ( f->f_sub_final.bv_val != NULL ) {
 665                         len = fstr->bv_len;
 666
 667                         filter_escape_value_x( &f->f_sub_final, &tmp, op->o_tmpmemctx );
 668
 669                         fstr->bv_len += tmp.bv_len;
 670                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 671                                 op->o_tmpmemctx );
 672
 673                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
 674                                 /* "(attr=[init*][any*]" */ "%s)",
 675                                 tmp.bv_val );
 676
 677                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 678                 }
 679
 680                 break;
 681
 682         case LDAP_FILTER_PRESENT:
 683                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
 684                         ( sizeof("(=*)") - 1 );
 685                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 686
 687                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
 688                         f->f_desc->ad_cname.bv_val );
 689                 break;
 690
 691         case LDAP_FILTER_AND:
 692         case LDAP_FILTER_OR:
 693         case LDAP_FILTER_NOT:
 694                 fstr->bv_len = sizeof("(%)") - 1;
 695                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 696
 697                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 698                         f->f_choice == LDAP_FILTER_AND ? '&' :
 699                         f->f_choice == LDAP_FILTER_OR ? '|' : '!' );
 700
 701                 for ( p = f->f_list; p != NULL; p = p->f_next ) {
 702                         len = fstr->bv_len;
 703
 704                         filter2bv_x( op, p, &tmp );
 705
 706                         fstr->bv_len += tmp.bv_len;
 707                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 708                                 op->o_tmpmemctx );
 709
 710                         snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
 711                                 /*"("*/ "%s)", tmp.bv_val );
 712
 713                         op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
 714                 }
 715
 716                 break;
 717
 718         case LDAP_FILTER_EXT: {
 719                         struct berval ad;
 720                         filter_escape_value_x( &f->f_mr_value, &tmp, op->o_tmpmemctx );
 721
 722                         if ( f->f_mr_desc ) {
 723                                 ad = f->f_mr_desc->ad_cname;
 724                         } else {
 725                                 ad.bv_len = 0;
 726                                 ad.bv_val = "";
 727                         }
 728
 729                         fstr->bv_len = ad.bv_len +
 730                                 ( f->f_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
 731                                 ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
 732                                 tmp.bv_len + ( sizeof("(:=)") - 1 );
 733                         fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 734
 735                         snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
 736                                 ad.bv_val,
 737                                 f->f_mr_dnattrs ? ":dn" : "",
 738                                 f->f_mr_rule_text.bv_len ? ":" : "",
 739                                 f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
 740                                 tmp.bv_val );
 741                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 742                 } break;
 743
 744         case SLAPD_FILTER_COMPUTED:
 745                 switch ( f->f_result ) {
 746                 case LDAP_COMPARE_FALSE:
 747                         tmp = ber_bvfalse;
 748                         break;
 749
 750                 case LDAP_COMPARE_TRUE:
 751                         tmp = ber_bvtrue;
 752                         break;
 753
 754                 case SLAPD_COMPARE_UNDEFINED:
 755                         tmp = ber_bvundefined;
 756                         break;
 757
 758                 default:
 759                         tmp = ber_bverror;
 760                         break;
 761                 }
 762
 763                 ber_dupbv_x( fstr, &tmp, op->o_tmpmemctx );
 764                 break;
 765
 766         default:
 767                 ber_dupbv_x( fstr, &ber_bvunknown, op->o_tmpmemctx );
 768                 break;
 769         }
 770 }
 771
 772 void
 773 filter2bv( Filter *f, struct berval *fstr )
 774 {
 775         Operation op;
 776         Opheader ohdr;
 777
 778         op.o_hdr = &ohdr;
 779         op.o_tmpmemctx = NULL;
 780         op.o_tmpmfuncs = &ch_mfuncs;
 781
 782         filter2bv_x( &op, f, fstr );
 783 }
 784
 785 static int
 786 filter_escape_value_x(
 787         struct berval *in,
 788         struct berval *out,
 789         void *ctx )
 790 {
 791         ber_len_t i;
 792         assert( in != NULL );
 793         assert( out != NULL );
 794
 795         i = in->bv_len * 3 + 1;
 796         out->bv_val = ctx ? slap_sl_malloc( i, ctx ) : ch_malloc( i );
 797         out->bv_len = 0;
 798
 799         for( i=0; i < in->bv_len ; i++ ) {
 800                 if( FILTER_ESCAPE(in->bv_val[i]) ) {
 801                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_CHAR;
 802                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_HI( in->bv_val[i] );
 803                         out->bv_val[out->bv_len++] = SLAP_ESCAPE_LO( in->bv_val[i] );
 804                 } else {
 805                         out->bv_val[out->bv_len++] = in->bv_val[i];
 806                 }
 807         }
 808
 809         out->bv_val[out->bv_len] = '\0';
 810         return LDAP_SUCCESS;
 811 }
 812
 813 int
 814 filter_escape_value(
 815         struct berval *in,
 816         struct berval *out )
 817 {
 818         return filter_escape_value_x( in, out, NULL );
 819 }
 820
 821 static int
 822 get_simple_vrFilter(
 823         Operation *op,
 824         BerElement *ber,
 825         ValuesReturnFilter **filt,
 826         const char **text )
 827 {
 828         ber_tag_t       tag;
 829         ber_len_t       len;
 830         int             err;
 831         ValuesReturnFilter vrf;
 832
 833         Debug( LDAP_DEBUG_FILTER, "begin get_simple_vrFilter\n", 0, 0, 0 );
 834
 835         tag = ber_peek_tag( ber, &len );
 836
 837         if( tag == LBER_ERROR ) {
 838                 *text = "error decoding filter";
 839                 return SLAPD_DISCONNECT;
 840         }
 841
 842         vrf.vrf_next = NULL;
 843
 844         err = LDAP_SUCCESS;
 845         vrf.vrf_choice = tag;
 846
 847         switch ( vrf.vrf_choice ) {
 848         case LDAP_FILTER_EQUALITY:
 849                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 850                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_EQUALITY, text );
 851                 if ( err != LDAP_SUCCESS ) {
 852                         break;
 853                 }
 854
 855                 assert( vrf.vrf_ava != NULL );
 856                 break;
 857
 858         case LDAP_FILTER_SUBSTRINGS:
 859                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 860                 err = get_ssa( op, ber, &vrf.vrf_sub, text );
 861                 break;
 862
 863         case LDAP_FILTER_GE:
 864                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 865                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_ORDERING, text );
 866                 if ( err != LDAP_SUCCESS ) {
 867                         break;
 868                 }
 869                 break;
 870
 871         case LDAP_FILTER_LE:
 872                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 873                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_ORDERING, text );
 874                 if ( err != LDAP_SUCCESS ) {
 875                         break;
 876                 }
 877                 break;
 878
 879         case LDAP_FILTER_PRESENT: {
 880                 struct berval type;
 881
 882                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 883                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 884                         err = SLAPD_DISCONNECT;
 885                         *text = "error decoding filter";
 886                         break;
 887                 }
 888
 889                 vrf.vrf_desc = NULL;
 890                 err = slap_bv2ad( &type, &vrf.vrf_desc, text );
 891
 892                 if( err != LDAP_SUCCESS ) {
 893                         err = slap_bv2undef_ad( &type, &vrf.vrf_desc, text,
 894                                 SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 895
 896                         if( err != LDAP_SUCCESS ) {
 897                                 /* unrecognized attribute description or other error */
 898                                 Debug( LDAP_DEBUG_ANY,
 899                                         "get_simple_vrFilter: conn %lu unknown "
 900                                         "attribute type=%s (%d)\n",
 901                                         op->o_connid, type.bv_val, err );
 902
 903                                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 904                                 vrf.vrf_result = LDAP_COMPARE_FALSE;
 905                                 err = LDAP_SUCCESS;
 906                                 break;
 907                         }
 908                 }
 909                 } break;
 910
 911         case LDAP_FILTER_APPROX:
 912                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 913                 err = get_ava( op, ber, &vrf.vrf_ava, SLAP_MR_EQUALITY_APPROX, text );
 914                 if ( err != LDAP_SUCCESS ) {
 915                         break;
 916                 }
 917                 break;
 918
 919         case LDAP_FILTER_EXT:
 920                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 921
 922                 err = get_mra( op, ber, &vrf.vrf_mra, text );
 923                 if ( err != LDAP_SUCCESS ) {
 924                         break;
 925                 }
 926
 927                 assert( vrf.vrf_mra != NULL );
 928                 break;
 929
 930         default:
 931                 (void) ber_scanf( ber, "x" ); /* skip the element */
 932                 Debug( LDAP_DEBUG_ANY, "get_simple_vrFilter: unknown filter type=%lu\n",
 933                         vrf.vrf_choice, 0, 0 );
 934                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 935                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
 936                 break;
 937         }
 938
 939         if ( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 940                 /* ignore error */
 941                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 942                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
 943                 err = LDAP_SUCCESS;
 944         }
 945
 946         if ( err == LDAP_SUCCESS ) {
 947                 *filt = ch_malloc( sizeof vrf );
 948                 **filt = vrf;
 949         }
 950
 951         Debug( LDAP_DEBUG_FILTER, "end get_simple_vrFilter %d\n", err, 0, 0 );
 952
 953         return err;
 954 }
 955
 956 int
 957 get_vrFilter( Operation *op, BerElement *ber,
 958         ValuesReturnFilter **vrf,
 959         const char **text )
 960 {
 961         /*
 962          * A ValuesReturnFilter looks like this:
 963          *
 964          *      ValuesReturnFilter ::= SEQUENCE OF SimpleFilterItem
 965          *      SimpleFilterItem ::= CHOICE {
 966          *              equalityMatch   [3]     AttributeValueAssertion,
 967          *              substrings      [4]     SubstringFilter,
 968          *              greaterOrEqual  [5]     AttributeValueAssertion,
 969          *              lessOrEqual     [6]     AttributeValueAssertion,
 970          *              present         [7]     AttributeType,
 971          *              approxMatch     [8]     AttributeValueAssertion,
 972          *              extensibleMatch [9]     SimpleMatchingAssertion -- LDAPv3
 973          *      }
 974          *
 975          *      SubstringFilter ::= SEQUENCE {
 976          *              type               AttributeType,
 977          *              SEQUENCE OF CHOICE {
 978          *                      initial          [0] IA5String,
 979          *                      any              [1] IA5String,
 980          *                      final            [2] IA5String
 981          *              }
 982          *      }
 983          *
 984          *      SimpleMatchingAssertion ::= SEQUENCE {  -- LDAPv3
 985          *              matchingRule    [1] MatchingRuleId OPTIONAL,
 986          *              type            [2] AttributeDescription OPTIONAL,
 987          *              matchValue      [3] AssertionValue }
 988          */
 989
 990         ValuesReturnFilter **n;
 991         ber_tag_t       tag;
 992         ber_len_t       len;
 993         char            *last;
 994
 995         Debug( LDAP_DEBUG_FILTER, "begin get_vrFilter\n", 0, 0, 0 );
 996
 997         tag = ber_peek_tag( ber, &len );
 998
 999         if( tag == LBER_ERROR ) {
1000                 *text = "error decoding vrFilter";
1001                 return SLAPD_DISCONNECT;
1002         }
1003
1004         if( tag != LBER_SEQUENCE ) {
1005                 *text = "error decoding vrFilter, expect SEQUENCE tag";
1006                 return SLAPD_DISCONNECT;
1007         }
1008
1009         n = vrf;
1010         for ( tag = ber_first_element( ber, &len, &last );
1011                 tag != LBER_DEFAULT;
1012                 tag = ber_next_element( ber, &len, last ) )
1013         {
1014                 int err = get_simple_vrFilter( op, ber, n, text );
1015
1016                 if ( err != LDAP_SUCCESS ) return( err );
1017
1018                 n = &(*n)->vrf_next;
1019         }
1020         *n = NULL;
1021
1022         Debug( LDAP_DEBUG_FILTER, "end get_vrFilter\n", 0, 0, 0 );
1023         return( LDAP_SUCCESS );
1024 }
1025
1026 void
1027 vrFilter_free( Operation *op, ValuesReturnFilter *vrf )
1028 {
1029         ValuesReturnFilter      *p, *next;
1030
1031         if ( vrf == NULL ) {
1032                 return;
1033         }
1034
1035         for ( p = vrf; p != NULL; p = next ) {
1036                 next = p->vrf_next;
1037
1038                 switch ( vrf->vrf_choice ) {
1039                 case LDAP_FILTER_PRESENT:
1040                         break;
1041
1042                 case LDAP_FILTER_EQUALITY:
1043                 case LDAP_FILTER_GE:
1044                 case LDAP_FILTER_LE:
1045                 case LDAP_FILTER_APPROX:
1046                         ava_free( op, vrf->vrf_ava, 1 );
1047                         break;
1048
1049                 case LDAP_FILTER_SUBSTRINGS:
1050                         if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1051                                 op->o_tmpfree( vrf->vrf_sub_initial.bv_val, op->o_tmpmemctx );
1052                         }
1053                         ber_bvarray_free_x( vrf->vrf_sub_any, op->o_tmpmemctx );
1054                         if ( vrf->vrf_sub_final.bv_val != NULL ) {
1055                                 op->o_tmpfree( vrf->vrf_sub_final.bv_val, op->o_tmpmemctx );
1056                         }
1057                         op->o_tmpfree( vrf->vrf_sub, op->o_tmpmemctx );
1058                         break;
1059
1060                 case LDAP_FILTER_EXT:
1061                         mra_free( op, vrf->vrf_mra, 1 );
1062                         break;
1063
1064                 case SLAPD_FILTER_COMPUTED:
1065                         break;
1066
1067                 default:
1068                         Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
1069                                 vrf->vrf_choice, 0, 0 );
1070                         break;
1071                 }
1072
1073                 op->o_tmpfree( vrf, op->o_tmpmemctx );
1074         }
1075 }
1076
1077 void
1078 vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1079 {
1080         ValuesReturnFilter      *p;
1081         struct berval tmp;
1082         ber_len_t len;
1083
1084         if ( vrf == NULL ) {
1085                 ber_str2bv_x( "No filter!", sizeof("No filter!")-1,
1086                         1, fstr, op->o_tmpmemctx );
1087                 return;
1088         }
1089
1090         fstr->bv_len = sizeof("()") - 1;
1091         fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1092
1093         snprintf( fstr->bv_val, fstr->bv_len + 1, "()");
1094
1095         for ( p = vrf; p != NULL; p = p->vrf_next ) {
1096                 len = fstr->bv_len;
1097
1098                 simple_vrFilter2bv( op, p, &tmp );
1099
1100                 fstr->bv_len += tmp.bv_len;
1101                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1102                         op->o_tmpmemctx );
1103
1104                 snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
1105                         /*"("*/ "%s)", tmp.bv_val );
1106
1107                 op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
1108         }
1109 }
1110
1111 static void
1112 simple_vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1113 {
1114         struct berval tmp;
1115         ber_len_t len;
1116
1117         if ( vrf == NULL ) {
1118                 ber_str2bv_x( "No filter!", sizeof("No filter!")-1, 1, fstr,
1119                         op->o_tmpmemctx );
1120                 return;
1121         }
1122
1123         switch ( vrf->vrf_choice ) {
1124         case LDAP_FILTER_EQUALITY:
1125                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1126
1127                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1128                         tmp.bv_len + ( sizeof("(=)") - 1 );
1129                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1130
1131                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
1132                         vrf->vrf_av_desc->ad_cname.bv_val,
1133                         tmp.bv_val );
1134
1135                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1136                 break;
1137
1138         case LDAP_FILTER_GE:
1139                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1140
1141                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1142                         tmp.bv_len + ( sizeof("(>=)") - 1 );
1143                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1144
1145                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
1146                         vrf->vrf_av_desc->ad_cname.bv_val,
1147                         tmp.bv_val );
1148
1149                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1150                 break;
1151
1152         case LDAP_FILTER_LE:
1153                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1154
1155                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1156                         tmp.bv_len + ( sizeof("(<=)") - 1 );
1157                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1158
1159                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
1160                         vrf->vrf_av_desc->ad_cname.bv_val,
1161                         tmp.bv_val );
1162
1163                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1164                 break;
1165
1166         case LDAP_FILTER_APPROX:
1167                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1168
1169                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1170                         tmp.bv_len + ( sizeof("(~=)") - 1 );
1171                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1172
1173                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
1174                         vrf->vrf_av_desc->ad_cname.bv_val,
1175                         tmp.bv_val );
1176                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1177                 break;
1178
1179         case LDAP_FILTER_SUBSTRINGS:
1180                 fstr->bv_len = vrf->vrf_sub_desc->ad_cname.bv_len +
1181                         ( sizeof("(=*)") - 1 );
1182                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1183
1184                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1185                         vrf->vrf_sub_desc->ad_cname.bv_val );
1186
1187                 if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1188                         len = fstr->bv_len;
1189
1190                         filter_escape_value_x( &vrf->vrf_sub_initial, &tmp, op->o_tmpmemctx );
1191
1192                         fstr->bv_len += tmp.bv_len;
1193                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1194                                 op->o_tmpmemctx );
1195
1196                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
1197                                 /* "(attr=" */ "%s*)",
1198                                 tmp.bv_val );
1199
1200                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1201                 }
1202
1203                 if ( vrf->vrf_sub_any != NULL ) {
1204                         int i;
1205                         for ( i = 0; vrf->vrf_sub_any[i].bv_val != NULL; i++ ) {
1206                                 len = fstr->bv_len;
1207                                 filter_escape_value_x( &vrf->vrf_sub_any[i], &tmp,
1208                                         op->o_tmpmemctx );
1209
1210                                 fstr->bv_len += tmp.bv_len + 1;
1211                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
1212                                         fstr->bv_len + 1, op->o_tmpmemctx );
1213
1214                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1215                                         /* "(attr=[init]*[any*]" */ "%s*)",
1216                                         tmp.bv_val );
1217                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1218                         }
1219                 }
1220
1221                 if ( vrf->vrf_sub_final.bv_val != NULL ) {
1222                         len = fstr->bv_len;
1223
1224                         filter_escape_value_x( &vrf->vrf_sub_final, &tmp, op->o_tmpmemctx );
1225
1226                         fstr->bv_len += tmp.bv_len;
1227                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1228                                 op->o_tmpmemctx );
1229
1230                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1231                                 /* "(attr=[init*][any*]" */ "%s)",
1232                                 tmp.bv_val );
1233
1234                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1235                 }
1236
1237                 break;
1238
1239         case LDAP_FILTER_PRESENT:
1240                 fstr->bv_len = vrf->vrf_desc->ad_cname.bv_len +
1241                         ( sizeof("(=*)") - 1 );
1242                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1243
1244                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1245                         vrf->vrf_desc->ad_cname.bv_val );
1246                 break;
1247
1248         case LDAP_FILTER_EXT: {
1249                 struct berval ad;
1250                 filter_escape_value_x( &vrf->vrf_mr_value, &tmp, op->o_tmpmemctx );
1251
1252                 if ( vrf->vrf_mr_desc ) {
1253                         ad = vrf->vrf_mr_desc->ad_cname;
1254                 } else {
1255                         ad.bv_len = 0;
1256                         ad.bv_val = "";
1257                 }
1258
1259                 fstr->bv_len = ad.bv_len +
1260                         ( vrf->vrf_mr_dnattrs ? sizeof(":dn")-1 : 0 ) +
1261                         ( vrf->vrf_mr_rule_text.bv_len
1262                                 ? vrf->vrf_mr_rule_text.bv_len+1 : 0 ) +
1263                         tmp.bv_len + ( sizeof("(:=)") - 1 );
1264                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1265
1266                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
1267                         ad.bv_val,
1268                         vrf->vrf_mr_dnattrs ? ":dn" : "",
1269                         vrf->vrf_mr_rule_text.bv_len ? ":" : "",
1270                         vrf->vrf_mr_rule_text.bv_len ? vrf->vrf_mr_rule_text.bv_val : "",
1271                         tmp.bv_val );
1272
1273                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1274                 } break;
1275
1276         case SLAPD_FILTER_COMPUTED:
1277                 ber_str2bv_x(
1278                         vrf->vrf_result == LDAP_COMPARE_FALSE ? "(?=false)" :
1279                         vrf->vrf_result == LDAP_COMPARE_TRUE ? "(?=true)" :
1280                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1281                                 ? "(?=undefined)" : "(?=error)",
1282                         vrf->vrf_result == LDAP_COMPARE_FALSE ? sizeof("(?=false)")-1 :
1283                         vrf->vrf_result == LDAP_COMPARE_TRUE ? sizeof("(?=true)")-1 :
1284                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1285                                 ? sizeof("(?=undefined)")-1 : sizeof("(?=error)")-1,
1286                         1, fstr, op->o_tmpmemctx );
1287                 break;
1288
1289         default:
1290                 ber_str2bv_x( "(?=unknown)", sizeof("(?=unknown)")-1,
1291                         1, fstr, op->o_tmpmemctx );
1292                 break;
1293         }
1294 }