git.sur5r.net Git - openldap/blob - servers/slapd/filter.c

   1 /* filter.c - routines for parsing and dealing with filters */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2007 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/socket.h>
  32 #include <ac/string.h>
  33
  34 #include "slap.h"
  35 #include "lutil.h"
  36
  37 const Filter *slap_filter_objectClass_pres;
  38 const struct berval *slap_filterstr_objectClass_pres;
  39
  40 static int      get_filter_list(
  41         Operation *op,
  42         BerElement *ber,
  43         Filter **f,
  44         const char **text );
  45
  46 static int      get_ssa(
  47         Operation *op,
  48         BerElement *ber,
  49         Filter *f,
  50         const char **text );
  51
  52 static void simple_vrFilter2bv(
  53         Operation *op,
  54         ValuesReturnFilter *f,
  55         struct berval *fstr );
  56
  57 static int      get_simple_vrFilter(
  58         Operation *op,
  59         BerElement *ber,
  60         ValuesReturnFilter **f,
  61         const char **text );
  62
  63 int
  64 filter_init( void )
  65 {
  66         static Filter filter_objectClass_pres = { LDAP_FILTER_PRESENT };
  67         static struct berval filterstr_objectClass_pres = BER_BVC("(objectClass=*)");
  68
  69         filter_objectClass_pres.f_desc = slap_schema.si_ad_objectClass;
  70
  71         slap_filter_objectClass_pres = &filter_objectClass_pres;
  72         slap_filterstr_objectClass_pres = &filterstr_objectClass_pres;
  73
  74         return 0;
  75 }
  76
  77 void
  78 filter_destroy( void )
  79 {
  80         return;
  81 }
  82
  83 int
  84 get_filter(
  85         Operation *op,
  86         BerElement *ber,
  87         Filter **filt,
  88         const char **text )
  89 {
  90         ber_tag_t       tag;
  91         ber_len_t       len;
  92         int             err;
  93         Filter          f;
  94
  95         Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
  96         /*
  97          * A filter looks like this coming in:
  98          *      Filter ::= CHOICE {
  99          *              and             [0]     SET OF Filter,
 100          *              or              [1]     SET OF Filter,
 101          *              not             [2]     Filter,
 102          *              equalityMatch   [3]     AttributeValueAssertion,
 103          *              substrings      [4]     SubstringFilter,
 104          *              greaterOrEqual  [5]     AttributeValueAssertion,
 105          *              lessOrEqual     [6]     AttributeValueAssertion,
 106          *              present         [7]     AttributeType,
 107          *              approxMatch     [8]     AttributeValueAssertion,
 108          *              extensibleMatch [9]     MatchingRuleAssertion
 109          *      }
 110          *
 111          *      SubstringFilter ::= SEQUENCE {
 112          *              type               AttributeType,
 113          *              SEQUENCE OF CHOICE {
 114          *                      initial          [0] IA5String,
 115          *                      any              [1] IA5String,
 116          *                      final            [2] IA5String
 117          *              }
 118          *      }
 119          *
 120          *      MatchingRuleAssertion ::= SEQUENCE {
 121          *              matchingRule    [1] MatchingRuleId OPTIONAL,
 122          *              type            [2] AttributeDescription OPTIONAL,
 123          *              matchValue      [3] AssertionValue,
 124          *              dnAttributes    [4] BOOLEAN DEFAULT FALSE
 125          *      }
 126          *
 127          */
 128
 129         tag = ber_peek_tag( ber, &len );
 130
 131         if( tag == LBER_ERROR ) {
 132                 *text = "error decoding filter";
 133                 return SLAPD_DISCONNECT;
 134         }
 135
 136         err = LDAP_SUCCESS;
 137
 138         f.f_next = NULL;
 139         f.f_choice = tag;
 140
 141         switch ( f.f_choice ) {
 142         case LDAP_FILTER_EQUALITY:
 143                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 144                 err = get_ava( op, ber, &f, SLAP_MR_EQUALITY, text );
 145                 if ( err != LDAP_SUCCESS ) {
 146                         break;
 147                 }
 148
 149                 assert( f.f_ava != NULL );
 150                 break;
 151
 152         case LDAP_FILTER_SUBSTRINGS:
 153                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 154                 err = get_ssa( op, ber, &f, text );
 155                 if( err != LDAP_SUCCESS ) {
 156                         break;
 157                 }
 158                 assert( f.f_sub != NULL );
 159                 break;
 160
 161         case LDAP_FILTER_GE:
 162                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 163                 err = get_ava( op, ber, &f, SLAP_MR_ORDERING, text );
 164                 if ( err != LDAP_SUCCESS ) {
 165                         break;
 166                 }
 167                 assert( f.f_ava != NULL );
 168                 break;
 169
 170         case LDAP_FILTER_LE:
 171                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 172                 err = get_ava( op, ber, &f, SLAP_MR_ORDERING, text );
 173                 if ( err != LDAP_SUCCESS ) {
 174                         break;
 175                 }
 176                 assert( f.f_ava != NULL );
 177                 break;
 178
 179         case LDAP_FILTER_PRESENT: {
 180                 struct berval type;
 181
 182                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 183                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 184                         err = SLAPD_DISCONNECT;
 185                         *text = "error decoding filter";
 186                         break;
 187                 }
 188
 189                 f.f_desc = NULL;
 190                 err = slap_bv2ad( &type, &f.f_desc, text );
 191
 192                 if( err != LDAP_SUCCESS ) {
 193                         f.f_choice |= SLAPD_FILTER_UNDEFINED;
 194                         err = slap_bv2undef_ad( &type, &f.f_desc, text,
 195                                 SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 196
 197                         if ( err != LDAP_SUCCESS ) {
 198                                 /* unrecognized attribute description or other error */
 199                                 Debug( LDAP_DEBUG_ANY,
 200                                         "get_filter: conn %lu unknown attribute "
 201                                         "type=%s (%d)\n",
 202                                         op->o_connid, type.bv_val, err );
 203
 204                                 err = LDAP_SUCCESS;
 205                                 f.f_desc = slap_bv2tmp_ad( &type, op->o_tmpmemctx );
 206                         }
 207                         *text = NULL;
 208                 }
 209
 210                 assert( f.f_desc != NULL );
 211                 } break;
 212
 213         case LDAP_FILTER_APPROX:
 214                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 215                 err = get_ava( op, ber, &f, SLAP_MR_EQUALITY_APPROX, text );
 216                 if ( err != LDAP_SUCCESS ) {
 217                         break;
 218                 }
 219                 assert( f.f_ava != NULL );
 220                 break;
 221
 222         case LDAP_FILTER_AND:
 223                 Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
 224                 err = get_filter_list( op, ber, &f.f_and, text );
 225                 if ( err != LDAP_SUCCESS ) {
 226                         break;
 227                 }
 228                 if ( f.f_and == NULL ) {
 229                         f.f_choice = SLAPD_FILTER_COMPUTED;
 230                         f.f_result = LDAP_COMPARE_TRUE;
 231                 }
 232                 /* no assert - list could be empty */
 233                 break;
 234
 235         case LDAP_FILTER_OR:
 236                 Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
 237                 err = get_filter_list( op, ber, &f.f_or, text );
 238                 if ( err != LDAP_SUCCESS ) {
 239                         break;
 240                 }
 241                 if ( f.f_or == NULL ) {
 242                         f.f_choice = SLAPD_FILTER_COMPUTED;
 243                         f.f_result = LDAP_COMPARE_FALSE;
 244                 }
 245                 /* no assert - list could be empty */
 246                 break;
 247
 248         case LDAP_FILTER_NOT:
 249                 Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
 250                 (void) ber_skip_tag( ber, &len );
 251                 err = get_filter( op, ber, &f.f_not, text );
 252                 if ( err != LDAP_SUCCESS ) {
 253                         break;
 254                 }
 255
 256                 assert( f.f_not != NULL );
 257                 if ( f.f_not->f_choice == SLAPD_FILTER_COMPUTED ) {
 258                         int fresult = f.f_not->f_result;
 259                         f.f_choice = SLAPD_FILTER_COMPUTED;
 260                         op->o_tmpfree( f.f_not, op->o_tmpmemctx );
 261                         f.f_not = NULL;
 262
 263                         switch( fresult ) {
 264                         case LDAP_COMPARE_TRUE:
 265                                 f.f_result = LDAP_COMPARE_FALSE;
 266                                 break;
 267                         case LDAP_COMPARE_FALSE:
 268                                 f.f_result = LDAP_COMPARE_TRUE;
 269                                 break;
 270                         default: ;
 271                                 /* (!Undefined) is Undefined */
 272                         }
 273                 }
 274                 break;
 275
 276         case LDAP_FILTER_EXT:
 277                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
 278
 279                 err = get_mra( op, ber, &f, text );
 280                 if ( err != LDAP_SUCCESS ) {
 281                         break;
 282                 }
 283
 284                 assert( f.f_mra != NULL );
 285                 break;
 286
 287         default:
 288                 (void) ber_scanf( ber, "x" ); /* skip the element */
 289                 Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
 290                         f.f_choice, 0, 0 );
 291                 f.f_choice = SLAPD_FILTER_COMPUTED;
 292                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 293                 break;
 294         }
 295
 296         if( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
 297                 /* ignore error */
 298                 *text = NULL;
 299                 f.f_choice = SLAPD_FILTER_COMPUTED;
 300                 f.f_result = SLAPD_COMPARE_UNDEFINED;
 301                 err = LDAP_SUCCESS;
 302         }
 303
 304         if ( err == LDAP_SUCCESS ) {
 305                 *filt = op->o_tmpalloc( sizeof(f), op->o_tmpmemctx );
 306                 **filt = f;
 307         }
 308
 309         Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
 310
 311         return( err );
 312 }
 313
 314 static int
 315 get_filter_list( Operation *op, BerElement *ber,
 316         Filter **f,
 317         const char **text )
 318 {
 319         Filter          **new;
 320         int             err;
 321         ber_tag_t       tag;
 322         ber_len_t       len;
 323         char            *last;
 324
 325         Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
 326         new = f;
 327         for ( tag = ber_first_element( ber, &len, &last );
 328                 tag != LBER_DEFAULT;
 329                 tag = ber_next_element( ber, &len, last ) )
 330         {
 331                 err = get_filter( op, ber, new, text );
 332                 if ( err != LDAP_SUCCESS )
 333                         return( err );
 334                 new = &(*new)->f_next;
 335         }
 336         *new = NULL;
 337
 338         Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
 339         return( LDAP_SUCCESS );
 340 }
 341
 342 static int
 343 get_ssa(
 344         Operation *op,
 345         BerElement      *ber,
 346         Filter          *f,
 347         const char      **text )
 348 {
 349         ber_tag_t       tag;
 350         ber_len_t       len;
 351         ber_tag_t       rc;
 352         struct berval desc, value, nvalue;
 353         char            *last;
 354         SubstringsAssertion ssa;
 355
 356         *text = "error decoding filter";
 357
 358         Debug( LDAP_DEBUG_FILTER, "begin get_ssa\n", 0, 0, 0 );
 359         if ( ber_scanf( ber, "{m" /*}*/, &desc ) == LBER_ERROR ) {
 360                 return SLAPD_DISCONNECT;
 361         }
 362
 363         *text = NULL;
 364
 365         ssa.sa_desc = NULL;
 366         ssa.sa_initial.bv_val = NULL;
 367         ssa.sa_any = NULL;
 368         ssa.sa_final.bv_val = NULL;
 369
 370         rc = slap_bv2ad( &desc, &ssa.sa_desc, text );
 371
 372         if( rc != LDAP_SUCCESS ) {
 373                 f->f_choice |= SLAPD_FILTER_UNDEFINED;
 374                 rc = slap_bv2undef_ad( &desc, &ssa.sa_desc, text,
 375                         SLAP_AD_PROXIED|SLAP_AD_NOINSERT );
 376
 377                 if( rc != LDAP_SUCCESS ) {
 378                         Debug( LDAP_DEBUG_ANY,
 379                                 "get_ssa: conn %lu unknown attribute type=%s (%ld)\n",
 380                                 op->o_connid, desc.bv_val, (long) rc );
 381
 382                         ssa.sa_desc = slap_bv2tmp_ad( &desc, op->o_tmpmemctx );
 383                 }
 384         }
 385
 386         rc = LDAP_PROTOCOL_ERROR;
 387
 388         for ( tag = ber_first_element( ber, &len, &last );
 389                 tag != LBER_DEFAULT;
 390                 tag = ber_next_element( ber, &len, last ) )
 391         {
 392                 unsigned usage;
 393
 394                 rc = ber_scanf( ber, "m", &value );
 395                 if ( rc == LBER_ERROR ) {
 396                         rc = SLAPD_DISCONNECT;
 397                         goto return_error;
 398                 }
 399
 400                 if ( value.bv_val == NULL || value.bv_len == 0 ) {
 401                         rc = LDAP_INVALID_SYNTAX;
 402                         goto return_error;
 403                 }
 404
 405                 switch ( tag ) {
 406                 case LDAP_SUBSTRING_INITIAL:
 407                         if ( ssa.sa_initial.bv_val != NULL
 408                                 || ssa.sa_any != NULL
 409                                 || ssa.sa_final.bv_val != NULL )
 410                         {
 411                                 rc = LDAP_PROTOCOL_ERROR;
 412                                 goto return_error;
 413                         }
 414                         usage = SLAP_MR_SUBSTR_INITIAL;
 415                         break;
 416
 417                 case LDAP_SUBSTRING_ANY:
 418                         if ( ssa.sa_final.bv_val != NULL ) {
 419                                 rc = LDAP_PROTOCOL_ERROR;
 420                                 goto return_error;
 421                         }
 422                         usage = SLAP_MR_SUBSTR_ANY;
 423                         break;
 424
 425                 case LDAP_SUBSTRING_FINAL:
 426                         if ( ssa.sa_final.bv_val != NULL ) {
 427                                 rc = LDAP_PROTOCOL_ERROR;
 428                                 goto return_error;
 429                         }
 430
 431                         usage = SLAP_MR_SUBSTR_FINAL;
 432                         break;
 433
 434                 default:
 435                         Debug( LDAP_DEBUG_FILTER,
 436                                 "  unknown substring choice=%ld\n",
 437                                 (long) tag, 0, 0 );
 438
 439                         rc = LDAP_PROTOCOL_ERROR;
 440                         goto return_error;
 441                 }
 442
 443                 /* validate/normalize using equality matching rule validator! */
 444                 rc = asserted_value_validate_normalize(
 445                         ssa.sa_desc, ssa.sa_desc->ad_type->sat_equality,
 446                         usage, &value, &nvalue, text, op->o_tmpmemctx );
 447                 if( rc != LDAP_SUCCESS ) goto return_error;
 448
 449                 switch ( tag ) {
 450                 case LDAP_SUBSTRING_INITIAL:
 451                         Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
 452                         ssa.sa_initial = nvalue;
 453                         break;
 454
 455                 case LDAP_SUBSTRING_ANY:
 456                         Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
 457                         ber_bvarray_add_x( &ssa.sa_any, &nvalue, op->o_tmpmemctx );
 458                         break;
 459
 460                 case LDAP_SUBSTRING_FINAL:
 461                         Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
 462                         ssa.sa_final = nvalue;
 463                         break;
 464
 465                 default:
 466                         assert( 0 );
 467                         slap_sl_free( nvalue.bv_val, op->o_tmpmemctx );
 468                         rc = LDAP_PROTOCOL_ERROR;
 469
 470 return_error:
 471                         Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
 472                                 (long) rc, 0, 0 );
 473                         slap_sl_free( ssa.sa_initial.bv_val, op->o_tmpmemctx );
 474                         ber_bvarray_free_x( ssa.sa_any, op->o_tmpmemctx );
 475                         if ( ssa.sa_desc->ad_flags & SLAP_DESC_TEMPORARY )
 476                                 op->o_tmpfree( ssa.sa_desc, op->o_tmpmemctx );
 477                         slap_sl_free( ssa.sa_final.bv_val, op->o_tmpmemctx );
 478                         return rc;
 479                 }
 480
 481                 rc = LDAP_SUCCESS;
 482         }
 483
 484         if( rc == LDAP_SUCCESS ) {
 485                 f->f_sub = op->o_tmpalloc( sizeof( ssa ), op->o_tmpmemctx );
 486                 *f->f_sub = ssa;
 487         }
 488
 489         Debug( LDAP_DEBUG_FILTER, "end get_ssa\n", 0, 0, 0 );
 490         return rc /* LDAP_SUCCESS */ ;
 491 }
 492
 493 void
 494 filter_free_x( Operation *op, Filter *f )
 495 {
 496         Filter  *p, *next;
 497
 498         if ( f == NULL ) {
 499                 return;
 500         }
 501
 502         f->f_choice &= SLAPD_FILTER_MASK;
 503
 504         switch ( f->f_choice ) {
 505         case LDAP_FILTER_PRESENT:
 506                 break;
 507
 508         case LDAP_FILTER_EQUALITY:
 509         case LDAP_FILTER_GE:
 510         case LDAP_FILTER_LE:
 511         case LDAP_FILTER_APPROX:
 512                 ava_free( op, f->f_ava, 1 );
 513                 break;
 514
 515         case LDAP_FILTER_SUBSTRINGS:
 516                 if ( f->f_sub_initial.bv_val != NULL ) {
 517                         op->o_tmpfree( f->f_sub_initial.bv_val, op->o_tmpmemctx );
 518                 }
 519                 ber_bvarray_free_x( f->f_sub_any, op->o_tmpmemctx );
 520                 if ( f->f_sub_final.bv_val != NULL ) {
 521                         op->o_tmpfree( f->f_sub_final.bv_val, op->o_tmpmemctx );
 522                 }
 523                 if ( f->f_sub->sa_desc->ad_flags & SLAP_DESC_TEMPORARY )
 524                         op->o_tmpfree( f->f_sub->sa_desc, op->o_tmpmemctx );
 525                 op->o_tmpfree( f->f_sub, op->o_tmpmemctx );
 526                 break;
 527
 528         case LDAP_FILTER_AND:
 529         case LDAP_FILTER_OR:
 530         case LDAP_FILTER_NOT:
 531                 for ( p = f->f_list; p != NULL; p = next ) {
 532                         next = p->f_next;
 533                         filter_free_x( op, p );
 534                 }
 535                 break;
 536
 537         case LDAP_FILTER_EXT:
 538                 mra_free( op, f->f_mra, 1 );
 539                 break;
 540
 541         case SLAPD_FILTER_COMPUTED:
 542                 break;
 543
 544         default:
 545                 Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
 546                         f->f_choice, 0, 0 );
 547                 break;
 548         }
 549
 550         op->o_tmpfree( f, op->o_tmpmemctx );
 551 }
 552
 553 void
 554 filter_free( Filter *f )
 555 {
 556         Operation op;
 557         Opheader ohdr;
 558
 559         op.o_hdr = &ohdr;
 560         op.o_tmpmemctx = slap_sl_context( f );
 561         op.o_tmpmfuncs = &slap_sl_mfuncs;
 562         filter_free_x( &op, f );
 563 }
 564
 565 void
 566 filter2bv_x( Operation *op, Filter *f, struct berval *fstr )
 567 {
 568         int             i;
 569         Filter          *p;
 570         struct berval   tmp;
 571         static struct berval
 572                         ber_bvfalse = BER_BVC( "(?=false)" ),
 573                         ber_bvtrue = BER_BVC( "(?=true)" ),
 574                         ber_bvundefined = BER_BVC( "(?=undefined)" ),
 575                         ber_bverror = BER_BVC( "(?=error)" ),
 576                         ber_bvunknown = BER_BVC( "(?=unknown)" ),
 577                         ber_bvnone = BER_BVC( "(?=none)" );
 578         ber_len_t       len;
 579         ber_tag_t       choice;
 580         int undef;
 581         char *sign;
 582
 583         if ( f == NULL ) {
 584                 ber_dupbv_x( fstr, &ber_bvnone, op->o_tmpmemctx );
 585                 return;
 586         }
 587
 588         undef = f->f_choice & SLAPD_FILTER_UNDEFINED;
 589         choice = f->f_choice & SLAPD_FILTER_MASK;
 590
 591         switch ( choice ) {
 592         case LDAP_FILTER_EQUALITY:
 593                 fstr->bv_len = STRLENOF("(=)");
 594                 sign = "=";
 595                 if ( f->f_av_desc->ad_type->sat_syntax == slap_schema.si_ad_entryUUID->ad_type->sat_syntax ) {
 596                         tmp.bv_val = op->o_tmpalloc( LDAP_LUTIL_UUIDSTR_BUFSIZE, op->o_tmpmemctx );
 597                         tmp.bv_len = lutil_uuidstr_from_normalized( f->f_av_value.bv_val,
 598                                 f->f_av_value.bv_len, tmp.bv_val, LDAP_LUTIL_UUIDSTR_BUFSIZE );
 599                         assert( tmp.bv_len > 0 );
 600                         goto escaped;
 601                 }
 602                 goto simple;
 603         case LDAP_FILTER_GE:
 604                 fstr->bv_len = STRLENOF("(>=)");
 605                 sign = ">=";
 606                 goto simple;
 607         case LDAP_FILTER_LE:
 608                 fstr->bv_len = STRLENOF("(<=)");
 609                 sign = "<=";
 610                 goto simple;
 611         case LDAP_FILTER_APPROX:
 612                 fstr->bv_len = STRLENOF("(~=)");
 613                 sign = "~=";
 614
 615 simple:
 616                 filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
 617                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 618                  * since in a Filter values in AVAs are supposed
 619                  * to have been normalized, meaning that an empty value
 620                  * is legal for that attribute's syntax */
 621
 622 escaped:
 623                 fstr->bv_len += f->f_av_desc->ad_cname.bv_len + tmp.bv_len;
 624                 if ( undef )
 625                         fstr->bv_len++;
 626                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 627
 628                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s)",
 629                         undef ? "?" : "",
 630                         f->f_av_desc->ad_cname.bv_val, sign,
 631                         tmp.bv_len ? tmp.bv_val : "" );
 632
 633                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 634                 break;
 635
 636         case LDAP_FILTER_SUBSTRINGS:
 637                 fstr->bv_len = f->f_sub_desc->ad_cname.bv_len +
 638                         STRLENOF("(=*)");
 639                 if ( undef )
 640                         fstr->bv_len++;
 641                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 642
 643                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s=*)",
 644                         undef ? "?" : "",
 645                         f->f_sub_desc->ad_cname.bv_val );
 646
 647                 if ( f->f_sub_initial.bv_val != NULL ) {
 648                         ber_len_t tmplen;
 649
 650                         len = fstr->bv_len;
 651
 652                         filter_escape_value_x( &f->f_sub_initial, &tmp, op->o_tmpmemctx );
 653                         tmplen = tmp.bv_len;
 654
 655                         fstr->bv_len += tmplen;
 656                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 657                                 fstr->bv_len + 1, op->o_tmpmemctx );
 658
 659                         snprintf( &fstr->bv_val[len - 2],
 660                                 tmplen + STRLENOF( /*(*/ "*)" ) + 1,
 661                                 /* "(attr=" */ "%s*)",
 662                                 tmp.bv_len ? tmp.bv_val : "");
 663
 664                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 665                 }
 666
 667                 if ( f->f_sub_any != NULL ) {
 668                         for ( i = 0; f->f_sub_any[i].bv_val != NULL; i++ ) {
 669                                 ber_len_t tmplen;
 670
 671                                 len = fstr->bv_len;
 672                                 filter_escape_value_x( &f->f_sub_any[i],
 673                                         &tmp, op->o_tmpmemctx );
 674                                 tmplen = tmp.bv_len;
 675
 676                                 fstr->bv_len += tmplen + STRLENOF( /*(*/ ")" );
 677                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 678                                         fstr->bv_len + 1, op->o_tmpmemctx );
 679
 680                                 snprintf( &fstr->bv_val[len - 1],
 681                                         tmplen + STRLENOF( /*(*/ "*)" ) + 1,
 682                                         /* "(attr=[init]*[any*]" */ "%s*)",
 683                                         tmp.bv_len ? tmp.bv_val : "");
 684                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 685                         }
 686                 }
 687
 688                 if ( f->f_sub_final.bv_val != NULL ) {
 689                         ber_len_t tmplen;
 690
 691                         len = fstr->bv_len;
 692
 693                         filter_escape_value_x( &f->f_sub_final, &tmp, op->o_tmpmemctx );
 694                         tmplen = tmp.bv_len;
 695
 696                         fstr->bv_len += tmplen;
 697                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
 698                                 fstr->bv_len + 1, op->o_tmpmemctx );
 699
 700                         snprintf( &fstr->bv_val[len - 1],
 701                                 tmplen + STRLENOF( /*(*/ ")" ) + 1,
 702                                 /* "(attr=[init*][any*]" */ "%s)",
 703                                 tmp.bv_len ? tmp.bv_val : "");
 704
 705                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 706                 }
 707
 708                 break;
 709
 710         case LDAP_FILTER_PRESENT:
 711                 fstr->bv_len = f->f_desc->ad_cname.bv_len +
 712                         STRLENOF("(=*)");
 713                 if ( undef )
 714                         fstr->bv_len++;
 715
 716                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 717
 718                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s=*)",
 719                         undef ? "?" : "",
 720                         f->f_desc->ad_cname.bv_val );
 721                 break;
 722
 723         case LDAP_FILTER_AND:
 724         case LDAP_FILTER_OR:
 725         case LDAP_FILTER_NOT:
 726                 fstr->bv_len = STRLENOF("(%)");
 727                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
 728
 729                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%c)",
 730                         f->f_choice == LDAP_FILTER_AND ? '&' :
 731                         f->f_choice == LDAP_FILTER_OR ? '|' : '!' );
 732
 733                 for ( p = f->f_list; p != NULL; p = p->f_next ) {
 734                         len = fstr->bv_len;
 735
 736                         filter2bv_x( op, p, &tmp );
 737
 738                         fstr->bv_len += tmp.bv_len;
 739                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
 740                                 op->o_tmpmemctx );
 741
 742                         snprintf( &fstr->bv_val[len-1],
 743                                 tmp.bv_len + STRLENOF( /*(*/ ")" ) + 1,
 744                                 /*"("*/ "%s)", tmp.bv_val );
 745
 746                         op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
 747                 }
 748
 749                 break;
 750
 751         case LDAP_FILTER_EXT: {
 752                 struct berval ad;
 753
 754                 filter_escape_value_x( &f->f_mr_value, &tmp, op->o_tmpmemctx );
 755                 /* NOTE: tmp can legitimately be NULL (meaning empty)
 756                  * since in a Filter values in MRAs are supposed
 757                  * to have been normalized, meaning that an empty value
 758                  * is legal for that attribute's syntax */
 759
 760                 if ( f->f_mr_desc ) {
 761                         ad = f->f_mr_desc->ad_cname;
 762                 } else {
 763                         ad.bv_len = 0;
 764                         ad.bv_val = "";
 765                 }
 766
 767                 fstr->bv_len = ad.bv_len +
 768                         ( f->f_mr_dnattrs ? STRLENOF(":dn") : 0 ) +
 769                         ( f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_len+1 : 0 ) +
 770                         tmp.bv_len + STRLENOF("(:=)");
 771                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
 772
 773                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s%s:=%s)",
 774                         undef ? "?" : "",
 775                         ad.bv_val,
 776                         f->f_mr_dnattrs ? ":dn" : "",
 777                         f->f_mr_rule_text.bv_len ? ":" : "",
 778                         f->f_mr_rule_text.bv_len ? f->f_mr_rule_text.bv_val : "",
 779                         tmp.bv_len ? tmp.bv_val : "" );
 780                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 781                 } break;
 782
 783         case SLAPD_FILTER_COMPUTED:
 784                 switch ( f->f_result ) {
 785                 case LDAP_COMPARE_FALSE:
 786                         tmp = ber_bvfalse;
 787                         break;
 788
 789                 case LDAP_COMPARE_TRUE:
 790                         tmp = ber_bvtrue;
 791                         break;
 792
 793                 case SLAPD_COMPARE_UNDEFINED:
 794                         tmp = ber_bvundefined;
 795                         break;
 796
 797                 default:
 798                         tmp = ber_bverror;
 799                         break;
 800                 }
 801
 802                 ber_dupbv_x( fstr, &tmp, op->o_tmpmemctx );
 803                 break;
 804
 805         default:
 806                 ber_dupbv_x( fstr, &ber_bvunknown, op->o_tmpmemctx );
 807                 break;
 808         }
 809 }
 810
 811 void
 812 filter2bv( Filter *f, struct berval *fstr )
 813 {
 814         Operation op;
 815         Opheader ohdr;
 816
 817         op.o_hdr = &ohdr;
 818         op.o_tmpmemctx = NULL;
 819         op.o_tmpmfuncs = &ch_mfuncs;
 820
 821         filter2bv_x( &op, f, fstr );
 822 }
 823
 824 Filter *
 825 filter_dup( Filter *f, void *memctx )
 826 {
 827         BerMemoryFunctions *mf = &slap_sl_mfuncs;
 828         Filter *n;
 829
 830         if ( !f )
 831                 return NULL;
 832
 833         n = mf->bmf_malloc( sizeof(Filter), memctx );
 834         n->f_choice = f->f_choice;
 835         n->f_next = NULL;
 836
 837         switch( f->f_choice & SLAPD_FILTER_MASK ) {
 838         case SLAPD_FILTER_COMPUTED:
 839                 n->f_result = f->f_result;
 840                 break;
 841         case LDAP_FILTER_PRESENT:
 842                 if ( f->f_desc->ad_flags & SLAP_DESC_TEMPORARY )
 843                         n->f_desc = slap_bv2tmp_ad( &f->f_desc->ad_cname, memctx );
 844                 else
 845                         n->f_desc = f->f_desc;
 846                 break;
 847         case LDAP_FILTER_EQUALITY:
 848         case LDAP_FILTER_GE:
 849         case LDAP_FILTER_LE:
 850         case LDAP_FILTER_APPROX:
 851                 /* Should this be ava_dup() ? */
 852                 n->f_ava = mf->bmf_calloc( 1, sizeof(AttributeAssertion), memctx );
 853                 *n->f_ava = *f->f_ava;
 854                 if ( f->f_av_desc->ad_flags & SLAP_DESC_TEMPORARY )
 855                         n->f_av_desc = slap_bv2tmp_ad( &f->f_av_desc->ad_cname, memctx );
 856                 ber_dupbv_x( &n->f_av_value, &f->f_av_value, memctx );
 857                 break;
 858         case LDAP_FILTER_SUBSTRINGS:
 859                 n->f_sub = mf->bmf_calloc( 1, sizeof(SubstringsAssertion), memctx );
 860                 if ( f->f_sub_desc->ad_flags & SLAP_DESC_TEMPORARY )
 861                         n->f_sub_desc = slap_bv2tmp_ad( &f->f_sub_desc->ad_cname, memctx );
 862                 else
 863                         n->f_sub_desc = f->f_sub_desc;
 864                 if ( !BER_BVISNULL( &f->f_sub_initial ))
 865                         ber_dupbv_x( &n->f_sub_initial, &f->f_sub_initial, memctx );
 866                 if ( f->f_sub_any ) {
 867                         int i;
 868                         for ( i = 0; !BER_BVISNULL( &f->f_sub_any[i] ); i++ );
 869                         n->f_sub_any = mf->bmf_malloc(( i+1 )*sizeof( struct berval ),
 870                                 memctx );
 871                         for ( i = 0; !BER_BVISNULL( &f->f_sub_any[i] ); i++ ) {
 872                                 ber_dupbv_x( &n->f_sub_any[i], &f->f_sub_any[i], memctx );
 873                         }
 874                         BER_BVZERO( &n->f_sub_any[i] );
 875                 }
 876                 if ( !BER_BVISNULL( &f->f_sub_final ))
 877                         ber_dupbv_x( &n->f_sub_final, &f->f_sub_final, memctx );
 878                 break;
 879         case LDAP_FILTER_EXT: {
 880                 /* Should this be mra_dup() ? */
 881                 ber_len_t length;
 882                 length = sizeof(MatchingRuleAssertion);
 883                 if ( !BER_BVISNULL( &f->f_mr_rule_text ))
 884                         length += f->f_mr_rule_text.bv_len + 1;
 885                 n->f_mra = mf->bmf_calloc( 1, length, memctx );
 886                 *n->f_mra = *f->f_mra;
 887                 if ( f->f_mr_desc && ( f->f_sub_desc->ad_flags & SLAP_DESC_TEMPORARY ))
 888                         n->f_mr_desc = slap_bv2tmp_ad( &f->f_mr_desc->ad_cname, memctx );
 889                 ber_dupbv_x( &n->f_mr_value, &f->f_mr_value, memctx );
 890                 if ( !BER_BVISNULL( &f->f_mr_rule_text )) {
 891                         n->f_mr_rule_text.bv_val = (char *)(n->f_mra+1);
 892                         AC_MEMCPY(n->f_mr_rule_text.bv_val,
 893                                 f->f_mr_rule_text.bv_val, f->f_mr_rule_text.bv_len );
 894                 }
 895                 } break;
 896         case LDAP_FILTER_AND:
 897         case LDAP_FILTER_OR:
 898         case LDAP_FILTER_NOT: {
 899                 Filter **p;
 900                 for ( p = &n->f_list, f = f->f_list; f; f = f->f_next ) {
 901                         *p = filter_dup( f, memctx );
 902                         p = &(*p)->f_next;
 903                 }
 904                 } break;
 905         }
 906         return n;
 907 }
 908
 909 static int
 910 get_simple_vrFilter(
 911         Operation *op,
 912         BerElement *ber,
 913         ValuesReturnFilter **filt,
 914         const char **text )
 915 {
 916         ber_tag_t       tag;
 917         ber_len_t       len;
 918         int             err;
 919         ValuesReturnFilter vrf;
 920
 921         Debug( LDAP_DEBUG_FILTER, "begin get_simple_vrFilter\n", 0, 0, 0 );
 922
 923         tag = ber_peek_tag( ber, &len );
 924
 925         if( tag == LBER_ERROR ) {
 926                 *text = "error decoding filter";
 927                 return SLAPD_DISCONNECT;
 928         }
 929
 930         vrf.vrf_next = NULL;
 931
 932         err = LDAP_SUCCESS;
 933         vrf.vrf_choice = tag;
 934
 935         switch ( vrf.vrf_choice ) {
 936         case LDAP_FILTER_EQUALITY:
 937                 Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 938                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_EQUALITY, text );
 939                 if ( err != LDAP_SUCCESS ) {
 940                         break;
 941                 }
 942
 943                 assert( vrf.vrf_ava != NULL );
 944                 break;
 945
 946         case LDAP_FILTER_SUBSTRINGS:
 947                 Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
 948                 err = get_ssa( op, ber, (Filter *)&vrf, text );
 949                 break;
 950
 951         case LDAP_FILTER_GE:
 952                 Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 953                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_ORDERING, text );
 954                 if ( err != LDAP_SUCCESS ) {
 955                         break;
 956                 }
 957                 break;
 958
 959         case LDAP_FILTER_LE:
 960                 Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 961                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_ORDERING, text );
 962                 if ( err != LDAP_SUCCESS ) {
 963                         break;
 964                 }
 965                 break;
 966
 967         case LDAP_FILTER_PRESENT: {
 968                 struct berval type;
 969
 970                 Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 971                 if ( ber_scanf( ber, "m", &type ) == LBER_ERROR ) {
 972                         err = SLAPD_DISCONNECT;
 973                         *text = "error decoding filter";
 974                         break;
 975                 }
 976
 977                 vrf.vrf_desc = NULL;
 978                 err = slap_bv2ad( &type, &vrf.vrf_desc, text );
 979
 980                 if( err != LDAP_SUCCESS ) {
 981                         vrf.vrf_choice |= SLAPD_FILTER_UNDEFINED;
 982                         err = slap_bv2undef_ad( &type, &vrf.vrf_desc, text,
 983                                 SLAP_AD_PROXIED);
 984
 985                         if( err != LDAP_SUCCESS ) {
 986                                 /* unrecognized attribute description or other error */
 987                                 Debug( LDAP_DEBUG_ANY,
 988                                         "get_simple_vrFilter: conn %lu unknown "
 989                                         "attribute type=%s (%d)\n",
 990                                         op->o_connid, type.bv_val, err );
 991
 992                                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
 993                                 vrf.vrf_result = LDAP_COMPARE_FALSE;
 994                                 err = LDAP_SUCCESS;
 995                                 break;
 996                         }
 997                 }
 998                 } break;
 999
1000         case LDAP_FILTER_APPROX:
1001                 Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
1002                 err = get_ava( op, ber, (Filter *)&vrf, SLAP_MR_EQUALITY_APPROX, text );
1003                 if ( err != LDAP_SUCCESS ) {
1004                         break;
1005                 }
1006                 break;
1007
1008         case LDAP_FILTER_EXT:
1009                 Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
1010
1011                 err = get_mra( op, ber, (Filter *)&vrf, text );
1012                 if ( err != LDAP_SUCCESS ) {
1013                         break;
1014                 }
1015
1016                 assert( vrf.vrf_mra != NULL );
1017                 break;
1018
1019         default:
1020                 (void) ber_scanf( ber, "x" ); /* skip the element */
1021                 Debug( LDAP_DEBUG_ANY, "get_simple_vrFilter: unknown filter type=%lu\n",
1022                         vrf.vrf_choice, 0, 0 );
1023                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
1024                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
1025                 break;
1026         }
1027
1028         if ( err != LDAP_SUCCESS && err != SLAPD_DISCONNECT ) {
1029                 /* ignore error */
1030                 vrf.vrf_choice = SLAPD_FILTER_COMPUTED;
1031                 vrf.vrf_result = SLAPD_COMPARE_UNDEFINED;
1032                 err = LDAP_SUCCESS;
1033         }
1034
1035         if ( err == LDAP_SUCCESS ) {
1036                 *filt = op->o_tmpalloc( sizeof vrf, op->o_tmpmemctx );
1037                 **filt = vrf;
1038         }
1039
1040         Debug( LDAP_DEBUG_FILTER, "end get_simple_vrFilter %d\n", err, 0, 0 );
1041
1042         return err;
1043 }
1044
1045 int
1046 get_vrFilter( Operation *op, BerElement *ber,
1047         ValuesReturnFilter **vrf,
1048         const char **text )
1049 {
1050         /*
1051          * A ValuesReturnFilter looks like this:
1052          *
1053          *      ValuesReturnFilter ::= SEQUENCE OF SimpleFilterItem
1054          *      SimpleFilterItem ::= CHOICE {
1055          *              equalityMatch   [3]     AttributeValueAssertion,
1056          *              substrings      [4]     SubstringFilter,
1057          *              greaterOrEqual  [5]     AttributeValueAssertion,
1058          *              lessOrEqual     [6]     AttributeValueAssertion,
1059          *              present         [7]     AttributeType,
1060          *              approxMatch     [8]     AttributeValueAssertion,
1061          *              extensibleMatch [9]     SimpleMatchingAssertion -- LDAPv3
1062          *      }
1063          *
1064          *      SubstringFilter ::= SEQUENCE {
1065          *              type               AttributeType,
1066          *              SEQUENCE OF CHOICE {
1067          *                      initial          [0] IA5String,
1068          *                      any              [1] IA5String,
1069          *                      final            [2] IA5String
1070          *              }
1071          *      }
1072          *
1073          *      SimpleMatchingAssertion ::= SEQUENCE {  -- LDAPv3
1074          *              matchingRule    [1] MatchingRuleId OPTIONAL,
1075          *              type            [2] AttributeDescription OPTIONAL,
1076          *              matchValue      [3] AssertionValue }
1077          */
1078
1079         ValuesReturnFilter **n;
1080         ber_tag_t       tag;
1081         ber_len_t       len;
1082         char            *last;
1083
1084         Debug( LDAP_DEBUG_FILTER, "begin get_vrFilter\n", 0, 0, 0 );
1085
1086         tag = ber_peek_tag( ber, &len );
1087
1088         if( tag == LBER_ERROR ) {
1089                 *text = "error decoding vrFilter";
1090                 return SLAPD_DISCONNECT;
1091         }
1092
1093         if( tag != LBER_SEQUENCE ) {
1094                 *text = "error decoding vrFilter, expect SEQUENCE tag";
1095                 return SLAPD_DISCONNECT;
1096         }
1097
1098         n = vrf;
1099         for ( tag = ber_first_element( ber, &len, &last );
1100                 tag != LBER_DEFAULT;
1101                 tag = ber_next_element( ber, &len, last ) )
1102         {
1103                 int err = get_simple_vrFilter( op, ber, n, text );
1104
1105                 if ( err != LDAP_SUCCESS ) return( err );
1106
1107                 n = &(*n)->vrf_next;
1108         }
1109         *n = NULL;
1110
1111         Debug( LDAP_DEBUG_FILTER, "end get_vrFilter\n", 0, 0, 0 );
1112         return( LDAP_SUCCESS );
1113 }
1114
1115 void
1116 vrFilter_free( Operation *op, ValuesReturnFilter *vrf )
1117 {
1118         ValuesReturnFilter      *p, *next;
1119
1120         if ( vrf == NULL ) {
1121                 return;
1122         }
1123
1124         for ( p = vrf; p != NULL; p = next ) {
1125                 next = p->vrf_next;
1126
1127                 switch ( vrf->vrf_choice & SLAPD_FILTER_MASK ) {
1128                 case LDAP_FILTER_PRESENT:
1129                         break;
1130
1131                 case LDAP_FILTER_EQUALITY:
1132                 case LDAP_FILTER_GE:
1133                 case LDAP_FILTER_LE:
1134                 case LDAP_FILTER_APPROX:
1135                         ava_free( op, vrf->vrf_ava, 1 );
1136                         break;
1137
1138                 case LDAP_FILTER_SUBSTRINGS:
1139                         if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1140                                 op->o_tmpfree( vrf->vrf_sub_initial.bv_val, op->o_tmpmemctx );
1141                         }
1142                         ber_bvarray_free_x( vrf->vrf_sub_any, op->o_tmpmemctx );
1143                         if ( vrf->vrf_sub_final.bv_val != NULL ) {
1144                                 op->o_tmpfree( vrf->vrf_sub_final.bv_val, op->o_tmpmemctx );
1145                         }
1146                         op->o_tmpfree( vrf->vrf_sub, op->o_tmpmemctx );
1147                         break;
1148
1149                 case LDAP_FILTER_EXT:
1150                         mra_free( op, vrf->vrf_mra, 1 );
1151                         break;
1152
1153                 case SLAPD_FILTER_COMPUTED:
1154                         break;
1155
1156                 default:
1157                         Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
1158                                 vrf->vrf_choice, 0, 0 );
1159                         break;
1160                 }
1161
1162                 op->o_tmpfree( vrf, op->o_tmpmemctx );
1163         }
1164 }
1165
1166 void
1167 vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1168 {
1169         ValuesReturnFilter      *p;
1170         struct berval tmp;
1171         ber_len_t len;
1172
1173         if ( vrf == NULL ) {
1174                 ber_str2bv_x( "No filter!", STRLENOF("No filter!"),
1175                         1, fstr, op->o_tmpmemctx );
1176                 return;
1177         }
1178
1179         fstr->bv_len = STRLENOF("()");
1180         fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1181
1182         snprintf( fstr->bv_val, fstr->bv_len + 1, "()");
1183
1184         for ( p = vrf; p != NULL; p = p->vrf_next ) {
1185                 len = fstr->bv_len;
1186
1187                 simple_vrFilter2bv( op, p, &tmp );
1188
1189                 fstr->bv_len += tmp.bv_len;
1190                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1191                         op->o_tmpmemctx );
1192
1193                 snprintf( &fstr->bv_val[len-1], tmp.bv_len + 2,
1194                         /*"("*/ "%s)", tmp.bv_val );
1195
1196                 op->o_tmpfree( tmp.bv_val, op->o_tmpmemctx );
1197         }
1198 }
1199
1200 static void
1201 simple_vrFilter2bv( Operation *op, ValuesReturnFilter *vrf, struct berval *fstr )
1202 {
1203         struct berval tmp;
1204         ber_len_t len;
1205         int undef;
1206
1207         if ( vrf == NULL ) {
1208                 ber_str2bv_x( "No filter!", STRLENOF("No filter!"), 1, fstr,
1209                         op->o_tmpmemctx );
1210                 return;
1211         }
1212         undef = vrf->vrf_choice & SLAPD_FILTER_UNDEFINED;
1213
1214         switch ( vrf->vrf_choice & SLAPD_FILTER_MASK ) {
1215         case LDAP_FILTER_EQUALITY:
1216                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1217
1218                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1219                         tmp.bv_len + STRLENOF("(=)");
1220                 if ( undef ) fstr->bv_len++;
1221                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1222
1223                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=%s)",
1224                         vrf->vrf_av_desc->ad_cname.bv_val,
1225                         tmp.bv_val );
1226
1227                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1228                 break;
1229
1230         case LDAP_FILTER_GE:
1231                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1232
1233                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1234                         tmp.bv_len + STRLENOF("(>=)");
1235                 if ( undef ) fstr->bv_len++;
1236                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1237
1238                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s>=%s)",
1239                         vrf->vrf_av_desc->ad_cname.bv_val,
1240                         tmp.bv_val );
1241
1242                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1243                 break;
1244
1245         case LDAP_FILTER_LE:
1246                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1247
1248                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1249                         tmp.bv_len + STRLENOF("(<=)");
1250                 if ( undef ) fstr->bv_len++;
1251                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1252
1253                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s<=%s)",
1254                         vrf->vrf_av_desc->ad_cname.bv_val,
1255                         tmp.bv_val );
1256
1257                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1258                 break;
1259
1260         case LDAP_FILTER_APPROX:
1261                 filter_escape_value_x( &vrf->vrf_av_value, &tmp, op->o_tmpmemctx );
1262
1263                 fstr->bv_len = vrf->vrf_av_desc->ad_cname.bv_len +
1264                         tmp.bv_len + STRLENOF("(~=)");
1265                 if ( undef ) fstr->bv_len++;
1266                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1267
1268                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s~=%s)",
1269                         vrf->vrf_av_desc->ad_cname.bv_val,
1270                         tmp.bv_val );
1271                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1272                 break;
1273
1274         case LDAP_FILTER_SUBSTRINGS:
1275                 fstr->bv_len = vrf->vrf_sub_desc->ad_cname.bv_len +
1276                         STRLENOF("(=*)");
1277                 if ( undef ) fstr->bv_len++;
1278                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 128, op->o_tmpmemctx );
1279
1280                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1281                         vrf->vrf_sub_desc->ad_cname.bv_val );
1282
1283                 if ( vrf->vrf_sub_initial.bv_val != NULL ) {
1284                         len = fstr->bv_len;
1285
1286                         filter_escape_value_x( &vrf->vrf_sub_initial, &tmp, op->o_tmpmemctx );
1287
1288                         fstr->bv_len += tmp.bv_len;
1289                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1290                                 op->o_tmpmemctx );
1291
1292                         snprintf( &fstr->bv_val[len-2], tmp.bv_len+3,
1293                                 /* "(attr=" */ "%s*)",
1294                                 tmp.bv_val );
1295
1296                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1297                 }
1298
1299                 if ( vrf->vrf_sub_any != NULL ) {
1300                         int i;
1301                         for ( i = 0; vrf->vrf_sub_any[i].bv_val != NULL; i++ ) {
1302                                 len = fstr->bv_len;
1303                                 filter_escape_value_x( &vrf->vrf_sub_any[i], &tmp,
1304                                         op->o_tmpmemctx );
1305
1306                                 fstr->bv_len += tmp.bv_len + 1;
1307                                 fstr->bv_val = op->o_tmprealloc( fstr->bv_val,
1308                                         fstr->bv_len + 1, op->o_tmpmemctx );
1309
1310                                 snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1311                                         /* "(attr=[init]*[any*]" */ "%s*)",
1312                                         tmp.bv_val );
1313                                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1314                         }
1315                 }
1316
1317                 if ( vrf->vrf_sub_final.bv_val != NULL ) {
1318                         len = fstr->bv_len;
1319
1320                         filter_escape_value_x( &vrf->vrf_sub_final, &tmp, op->o_tmpmemctx );
1321
1322                         fstr->bv_len += tmp.bv_len;
1323                         fstr->bv_val = op->o_tmprealloc( fstr->bv_val, fstr->bv_len + 1,
1324                                 op->o_tmpmemctx );
1325
1326                         snprintf( &fstr->bv_val[len-1], tmp.bv_len+3,
1327                                 /* "(attr=[init*][any*]" */ "%s)",
1328                                 tmp.bv_val );
1329
1330                         ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1331                 }
1332
1333                 break;
1334
1335         case LDAP_FILTER_PRESENT:
1336                 fstr->bv_len = vrf->vrf_desc->ad_cname.bv_len +
1337                         STRLENOF("(=*)");
1338                 if ( undef ) fstr->bv_len++;
1339                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1340
1341                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s=*)",
1342                         vrf->vrf_desc->ad_cname.bv_val );
1343                 break;
1344
1345         case LDAP_FILTER_EXT: {
1346                 struct berval ad;
1347                 filter_escape_value_x( &vrf->vrf_mr_value, &tmp, op->o_tmpmemctx );
1348
1349                 if ( vrf->vrf_mr_desc ) {
1350                         ad = vrf->vrf_mr_desc->ad_cname;
1351                 } else {
1352                         ad.bv_len = 0;
1353                         ad.bv_val = "";
1354                 }
1355
1356                 fstr->bv_len = ad.bv_len +
1357                         ( vrf->vrf_mr_dnattrs ? STRLENOF(":dn") : 0 ) +
1358                         ( vrf->vrf_mr_rule_text.bv_len
1359                                 ? vrf->vrf_mr_rule_text.bv_len+1 : 0 ) +
1360                         tmp.bv_len + STRLENOF("(:=)");
1361                 if ( undef ) fstr->bv_len++;
1362                 fstr->bv_val = op->o_tmpalloc( fstr->bv_len + 1, op->o_tmpmemctx );
1363
1364                 snprintf( fstr->bv_val, fstr->bv_len + 1, "(%s%s%s%s:=%s)",
1365                         ad.bv_val,
1366                         vrf->vrf_mr_dnattrs ? ":dn" : "",
1367                         vrf->vrf_mr_rule_text.bv_len ? ":" : "",
1368                         vrf->vrf_mr_rule_text.bv_len ? vrf->vrf_mr_rule_text.bv_val : "",
1369                         tmp.bv_val );
1370
1371                 ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
1372                 } break;
1373
1374         case SLAPD_FILTER_COMPUTED:
1375                 ber_str2bv_x(
1376                         vrf->vrf_result == LDAP_COMPARE_FALSE ? "(?=false)" :
1377                         vrf->vrf_result == LDAP_COMPARE_TRUE ? "(?=true)" :
1378                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1379                                 ? "(?=undefined)" : "(?=error)",
1380                         vrf->vrf_result == LDAP_COMPARE_FALSE ? STRLENOF("(?=false)") :
1381                         vrf->vrf_result == LDAP_COMPARE_TRUE ? STRLENOF("(?=true)") :
1382                         vrf->vrf_result == SLAPD_COMPARE_UNDEFINED
1383                                 ? STRLENOF("(?=undefined)") : STRLENOF("(?=error)"),
1384                         1, fstr, op->o_tmpmemctx );
1385                 break;
1386
1387         default:
1388                 ber_str2bv_x( "(?=unknown)", STRLENOF("(?=unknown)"),
1389                         1, fstr, op->o_tmpmemctx );
1390                 break;
1391         }
1392 }