]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/filter.c
Add BDB_INDEX error handling
[openldap] / servers / slapd / filter.c
index c2726057df759e7591c8364c097f095bd2b7b6a1..70aa4b5e28389ab03a2a44e277c05a6a44f4d762 100644 (file)
@@ -28,6 +28,10 @@ static int   get_substring_filter(
        char **fstr,
        const char **text );
 
+static int filter_escape_value(
+       struct berval *in,
+       struct berval *out );
+
 int
 get_filter(
        Connection *conn,
@@ -41,9 +45,14 @@ get_filter(
        int             err;
        Filter          *f;
        char            *ftmp = NULL;
+       struct berval escaped;
 
+#ifdef NEW_LOGGING
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY, "get_filter: conn %d\n",
+                  conn->c_connid ));
+#else
        Debug( LDAP_DEBUG_FILTER, "begin get_filter\n", 0, 0, 0 );
-
+#endif
        /*
         * A filter looks like this coming in:
         *      Filter ::= CHOICE {
@@ -60,19 +69,19 @@ get_filter(
         *      }
         *
         *      SubstringFilter ::= SEQUENCE {
-        *              type               AttributeType,
+        *              type               AttributeType,
         *              SEQUENCE OF CHOICE {
-        *                      initial          [0] IA5String,
-        *                      any              [1] IA5String,
-        *                      final            [2] IA5String
+        *                      initial          [0] IA5String,
+        *                      any              [1] IA5String,
+        *                      final            [2] IA5String
         *              }
         *      }
         *
-     *  MatchingRuleAssertion ::= SEQUENCE {
-     *          matchingRule    [1] MatchingRuleId OPTIONAL,
-     *          type            [2] AttributeDescription OPTIONAL,
-     *          matchValue      [3] AssertionValue,
-     *          dnAttributes    [4] BOOLEAN DEFAULT FALSE
+     * MatchingRuleAssertion ::= SEQUENCE {
+     *         matchingRule    [1] MatchingRuleId OPTIONAL,
+     *         type            [2] AttributeDescription OPTIONAL,
+     *         matchValue      [3] AssertionValue,
+     *         dnAttributes    [4] BOOLEAN DEFAULT FALSE
         *      }
         *
         */
@@ -93,115 +102,108 @@ get_filter(
 
        switch ( f->f_choice ) {
        case LDAP_FILTER_EQUALITY:
-               Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
-
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-               err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY, text );
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL2,
+                          "get_filter: conn %d  EQUALITY\n", conn->c_connid ));
 #else
-               err = get_ava( ber, &f->f_ava, text );
+               Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 #endif
+               err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY, text );
                if ( err != LDAP_SUCCESS ) {
                        break;
                }
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
                assert( f->f_ava != NULL );
 
+               filter_escape_value( f->f_av_value, &escaped );
+
                *fstr = ch_malloc( sizeof("(=)")
                        + f->f_av_desc->ad_cname->bv_len
-                       + f->f_av_value->bv_len );
+                       + escaped.bv_len );
 
                sprintf( *fstr, "(%s=%s)",
                        f->f_av_desc->ad_cname->bv_val,
-                   f->f_av_value->bv_val );
+                   escaped.bv_val );
 
-#else
-               *fstr = ch_malloc( sizeof("(=)")
-                       + strlen( f->f_avtype )
-                       + f->f_avvalue.bv_len);
-               sprintf( *fstr, "(%s=%s)", f->f_avtype,
-                   f->f_avvalue.bv_val );
-#endif
+               ber_memfree( escaped.bv_val );
                break;
 
        case LDAP_FILTER_SUBSTRINGS:
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "get_filter: conn %d  SUBSTRINGS\n", conn->c_connid ));
+#else
                Debug( LDAP_DEBUG_FILTER, "SUBSTRINGS\n", 0, 0, 0 );
+#endif
                err = get_substring_filter( conn, ber, f, fstr, text );
                break;
 
        case LDAP_FILTER_GE:
-               Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
-
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-               err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "get_filter: conn %d  GE\n", conn->c_connid ));
 #else
-               err = get_ava( ber, &f->f_ava, text );
+               Debug( LDAP_DEBUG_FILTER, "GE\n", 0, 0, 0 );
 #endif
+               err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
                if ( err != LDAP_SUCCESS ) {
                        break;
                }
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
+               filter_escape_value( f->f_av_value, &escaped );
+
                *fstr = ch_malloc( sizeof("(>=)")
                        + f->f_av_desc->ad_cname->bv_len
-                       + f->f_av_value->bv_len );
+                       + escaped.bv_len );
 
                sprintf( *fstr, "(%s>=%s)",
                        f->f_av_desc->ad_cname->bv_val,
-                   f->f_av_value->bv_val );
+                   escaped.bv_val );
 
-#else
-               *fstr = ch_malloc( sizeof("(>=)")
-                       + strlen( f->f_avtype )
-                       + f->f_avvalue.bv_len);
-               sprintf( *fstr, "(%s>=%s)", f->f_avtype,
-                   f->f_avvalue.bv_val );
-#endif
+               ber_memfree( escaped.bv_val );
                break;
 
        case LDAP_FILTER_LE:
-               Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
-
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-               err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "get_filter: conn %d  LE\n", conn->c_connid ));
 #else
-               err = get_ava( ber, &f->f_ava, text );
+               Debug( LDAP_DEBUG_FILTER, "LE\n", 0, 0, 0 );
 #endif
+               err = get_ava( ber, &f->f_ava, SLAP_MR_ORDERING, text );
                if ( err != LDAP_SUCCESS ) {
                        break;
                }
 
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
+               filter_escape_value( f->f_av_value, &escaped );
+
                *fstr = ch_malloc( sizeof("(<=)")
                        + f->f_av_desc->ad_cname->bv_len
-                       + f->f_av_value->bv_len );
+                       + escaped.bv_len );
 
                sprintf( *fstr, "(%s<=%s)",
                        f->f_av_desc->ad_cname->bv_val,
-                   f->f_av_value->bv_val );
+                   escaped.bv_val );
 
-#else
-               *fstr = ch_malloc( sizeof("(<=)")
-                       + strlen( f->f_avtype )
-                       + f->f_avvalue.bv_len);
-               sprintf( *fstr, "(%s<=%s)", f->f_avtype,
-                   f->f_avvalue.bv_val );
-#endif
+               ber_memfree( escaped.bv_val );
                break;
 
        case LDAP_FILTER_PRESENT: {
                struct berval type;
 
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "get_filter: conn %d PRESENT\n", conn->c_connid ));
+#else
                Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
-
+#endif
                if ( ber_scanf( ber, "o", &type ) == LBER_ERROR ) {
                        err = SLAPD_DISCONNECT;
                        *text = "error decoding filter";
                        break;
                }
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
                f->f_desc = NULL;
                err = slap_bv2ad( &type, &f->f_desc, text );
 
@@ -217,48 +219,40 @@ get_filter(
                sprintf( *fstr, "(%s=*)",
                        f->f_desc->ad_cname->bv_val );
 
-#else
-               f->f_type = type.bv_val;
-               err = LDAP_SUCCESS;
-               attr_normalize( f->f_type );
-               *fstr = ch_malloc( sizeof("(=*)")
-                       + strlen( f->f_type ) );
-               sprintf( *fstr, "(%s=*)", f->f_type );
-#endif
                } break;
 
        case LDAP_FILTER_APPROX:
-               Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
-
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
-               err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY_APPROX, text );
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "get_filter: conn %d  APPROX\n", conn->c_connid ));
 #else
-               err = get_ava( ber, &f->f_ava, text );
+               Debug( LDAP_DEBUG_FILTER, "APPROX\n", 0, 0, 0 );
 #endif
+               err = get_ava( ber, &f->f_ava, SLAP_MR_EQUALITY_APPROX, text );
                if ( err != LDAP_SUCCESS ) {
                        break;
                }
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
+               filter_escape_value( f->f_av_value, &escaped );
+
                *fstr = ch_malloc( sizeof("(~=)")
                        + f->f_av_desc->ad_cname->bv_len
-                       + f->f_av_value->bv_len );
+                       + escaped.bv_len );
 
                sprintf( *fstr, "(%s~=%s)",
                        f->f_av_desc->ad_cname->bv_val,
-                   f->f_av_value->bv_val );
+                   escaped.bv_val );
 
-#else
-               *fstr = ch_malloc( sizeof("(~=)")
-                       + strlen( f->f_avtype )
-                       + f->f_avvalue.bv_len);
-               sprintf( *fstr, "(%s~=%s)", f->f_avtype,
-                   f->f_avvalue.bv_val );
-#endif
+               ber_memfree( escaped.bv_val );
                break;
 
        case LDAP_FILTER_AND:
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "get_filter: conn %d  AND\n", conn->c_connid ));
+#else
                Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );
+#endif
                err = get_filter_list( conn, ber, &f->f_and, &ftmp, text );
                if ( err != LDAP_SUCCESS ) {
                        break;
@@ -270,7 +264,12 @@ get_filter(
                break;
 
        case LDAP_FILTER_OR:
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "get_filter: conn %d  OR\n", conn->c_connid  ));
+#else
                Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );
+#endif
                err = get_filter_list( conn, ber, &f->f_and, &ftmp, text );
                if ( err != LDAP_SUCCESS ) {
                        break;
@@ -282,7 +281,12 @@ get_filter(
                break;
 
        case LDAP_FILTER_NOT:
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "get_filter: conn %d  NOT\n", conn->c_connid ));
+#else
                Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );
+#endif
                (void) ber_skip_tag( ber, &len );
                err = get_filter( conn, ber, &f->f_not, &ftmp, text );
                if ( err != LDAP_SUCCESS ) {
@@ -295,17 +299,47 @@ get_filter(
                break;
 
        case LDAP_FILTER_EXT:
-               /* not yet implemented */
-               Debug( LDAP_DEBUG_ANY, "extensible match not yet implemented.\n",
-                      f->f_choice, 0, 0 );
-               f->f_choice = SLAPD_FILTER_COMPUTED;
-               f->f_result = SLAPD_COMPARE_UNDEFINED;
-               *fstr = ch_strdup( "(extended)" );
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "get_filter: conn %d  EXTENSIBLE\n", conn->c_connid ));
+#else
+               Debug( LDAP_DEBUG_FILTER, "EXTENSIBLE\n", 0, 0, 0 );
+#endif
+
+               err = get_mra( ber, &f->f_mra, text );
+               if ( err != LDAP_SUCCESS ) {
+                       break;
+               }
+
+               assert( f->f_mra != NULL );
+
+               filter_escape_value( f->f_mr_value, &escaped );
+
+               *fstr = ch_malloc( sizeof("(:dn::=)")
+                       + (f->f_mr_desc ? f->f_mr_desc->ad_cname->bv_len : 0)
+                       + (f->f_mr_rule_text ? strlen(f->f_mr_rule_text) : 0)
+                       + escaped.bv_len );
+
+               sprintf( *fstr, "(%s%s%s%s:=%s)",
+                        (f->f_mr_desc ? f->f_mr_desc->ad_cname->bv_val : ""),
+                        (f->f_mr_dnattrs ? ":dn" : ""),
+                        (f->f_mr_rule_text ? ":" : ""),
+                        (f->f_mr_rule_text ? f->f_mr_rule_text : ""),
+                        escaped.bv_val );
+
+               ber_memfree( escaped.bv_val );
                break;
 
        default:
+               (void) ber_scanf( ber, "x" ); /* skip the element */
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_ERR,
+                          "get_filter: conn %d unknown filter type=%lu\n",
+                          conn->c_connid, f->f_choice ));
+#else
                Debug( LDAP_DEBUG_ANY, "get_filter: unknown filter type=%lu\n",
                       f->f_choice, 0, 0 );
+#endif
                f->f_choice = SLAPD_FILTER_COMPUTED;
                f->f_result = SLAPD_COMPARE_UNDEFINED;
                *fstr = ch_strdup( "(undefined)" );
@@ -334,7 +368,12 @@ get_filter(
                *filt = f;
        }
 
+#ifdef NEW_LOGGING
+       LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL2,
+                  "get_filter: conn %d  exit\n", conn->c_connid ));
+#else
        Debug( LDAP_DEBUG_FILTER, "end get_filter %d\n", err, 0, 0 );
+#endif
        return( err );
 }
 
@@ -349,8 +388,12 @@ get_filter_list( Connection *conn, BerElement *ber,
        ber_len_t       len;
        char            *last, *ftmp;
 
+#ifdef NEW_LOGGING
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "get_filter_list: conn %d start\n", conn->c_connid ));
+#else
        Debug( LDAP_DEBUG_FILTER, "begin get_filter_list\n", 0, 0, 0 );
-
+#endif
        *fstr = NULL;
        new = f;
        for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
@@ -372,7 +415,12 @@ get_filter_list( Connection *conn, BerElement *ber,
        }
        *new = NULL;
 
+#ifdef NEW_LOGGING
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "get_filter_list: conn %d exit\n", conn->c_connid ));
+#else
        Debug( LDAP_DEBUG_FILTER, "end get_filter_list\n", 0, 0, 0 );
+#endif
        return( LDAP_SUCCESS );
 }
 
@@ -389,22 +437,23 @@ get_substring_filter(
        ber_len_t       len;
        ber_tag_t       rc;
        struct berval *value;
+       struct berval escaped;
        char            *last;
        struct berval type;
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
        struct berval *nvalue;
-#else
-       int             syntax;
-#endif
        *text = "error decoding filter";
 
+#ifdef NEW_LOGGING
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "get_substring_filter: conn %d  begin\n", conn->c_connid ));
+#else
        Debug( LDAP_DEBUG_FILTER, "begin get_substring_filter\n", 0, 0, 0 );
-
+#endif
        if ( ber_scanf( ber, "{o" /*}*/, &type ) == LBER_ERROR ) {
                return SLAPD_DISCONNECT;
        }
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
+       f->f_sub = ch_calloc( 1, sizeof(SubstringsAssertion) );
        f->f_sub_desc = NULL;
        rc = slap_bv2ad( &type, &f->f_sub_desc, text );
 
@@ -412,42 +461,27 @@ get_substring_filter(
 
        if( rc != LDAP_SUCCESS ) {
                text = NULL;
+               ch_free( f->f_sub );
                f->f_choice = SLAPD_FILTER_COMPUTED;
                f->f_result = SLAPD_COMPARE_UNDEFINED;
                *fstr = ch_strdup( "(undefined)" );
                return LDAP_SUCCESS;
        }
-#else
-       f->f_sub_type = type.bv_val;
-       attr_normalize( f->f_sub_type );
-
-       /* should get real syntax and see if we have a substring matching rule */
-       syntax = attr_syntax( f->f_sub_type );
-#endif
 
        f->f_sub_initial = NULL;
        f->f_sub_any = NULL;
        f->f_sub_final = NULL;
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
        if( fstr ) {
                *fstr = ch_malloc( sizeof("(=" /*)*/) +
                        f->f_sub_desc->ad_cname->bv_len );
                sprintf( *fstr, "(%s=" /*)*/, f->f_sub_desc->ad_cname->bv_val );
        }
-#else
-       if( fstr ) {
-               *fstr = ch_malloc( strlen( f->f_sub_type ) + 3 );
-               sprintf( *fstr, "(%s=" /*)*/, f->f_sub_type );
-       }
-#endif
 
        for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
            tag = ber_next_element( ber, &len, last ) )
        {
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
                unsigned usage;
-#endif
 
                rc = ber_scanf( ber, "O", &value );
                if ( rc == LBER_ERROR ) {
@@ -461,7 +495,6 @@ get_substring_filter(
                        goto return_error;
                } 
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
                switch ( tag ) {
                case LDAP_SUBSTRING_INITIAL:
                        usage = SLAP_MR_SUBSTR_INITIAL;
@@ -478,10 +511,15 @@ get_substring_filter(
                default:
                        rc = LDAP_PROTOCOL_ERROR;
 
+#ifdef NEW_LOGGING
+                       LDAP_LOG(( "filter", LDAP_LEVEL_ERR,
+                                  "get_filter_substring: conn %d  unknown substring choice=%ld\n",
+                                  conn->c_connid, (long)tag ));
+#else
                        Debug( LDAP_DEBUG_FILTER,
                                "  unknown substring choice=%ld\n",
                                (long) tag, 0, 0 );
-
+#endif
                        ber_bvfree( value );
                        goto return_error;
                }
@@ -494,20 +532,23 @@ get_substring_filter(
                }
 
                value = nvalue;
-#else
-
-               /* we should call a substring syntax normalization routine */
-               value_normalize( value->bv_val, syntax );
-               /* this is bogus, value_normalize should take a berval */
-               value->bv_len = strlen( value->bv_val );
-#endif
 
                rc = LDAP_PROTOCOL_ERROR;
 
                switch ( tag ) {
                case LDAP_SUBSTRING_INITIAL:
+#ifdef NEW_LOGGING
+                       LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                                  "get_substring_filter: conn %d  INITIAL\n",
+                                  conn->c_connid ));
+#else
                        Debug( LDAP_DEBUG_FILTER, "  INITIAL\n", 0, 0, 0 );
-                       if ( f->f_sub_initial != NULL ) {
+#endif
+
+                       if ( f->f_sub_initial != NULL
+                               || f->f_sub_any != NULL 
+                               || f->f_sub_final != NULL )
+                       {
                                ber_bvfree( value );
                                goto return_error;
                        }
@@ -515,67 +556,101 @@ get_substring_filter(
                        f->f_sub_initial = value;
 
                        if( fstr ) {
+                               filter_escape_value( value, &escaped );
                                *fstr = ch_realloc( *fstr,
-                                       strlen( *fstr ) + value->bv_len + 1 );
-                               strcat( *fstr, value->bv_val );
+                                       strlen( *fstr ) + escaped.bv_len + 1 );
+                               strcat( *fstr, escaped.bv_val );
+                               ber_memfree( escaped.bv_val );
                        }
                        break;
 
                case LDAP_SUBSTRING_ANY:
+#ifdef NEW_LOGGING
+                       LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                                  "get_substring_filter: conn %d  ANY\n",
+                                  conn->c_connid ));
+#else
                        Debug( LDAP_DEBUG_FILTER, "  ANY\n", 0, 0, 0 );
+#endif
+
+                       if ( f->f_sub_final != NULL ) {
+                               ber_bvfree( value );
+                               goto return_error;
+                       }
+
                        if( ber_bvecadd( &f->f_sub_any, value ) < 0 ) {
                                ber_bvfree( value );
                                goto return_error;
                        }
 
                        if( fstr ) {
+                               filter_escape_value( value, &escaped );
                                *fstr = ch_realloc( *fstr,
-                                       strlen( *fstr ) + value->bv_len + 2 );
+                                       strlen( *fstr ) + escaped.bv_len + 2 );
                                strcat( *fstr, "*" );
-                               strcat( *fstr, value->bv_val );
+                               strcat( *fstr, escaped.bv_val );
+                               ber_memfree( escaped.bv_val );
                        }
                        break;
 
                case LDAP_SUBSTRING_FINAL:
+#ifdef NEW_LOGGING
+                       LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                                  "get_substring_filter: conn %d  FINAL\n",
+                                  conn->c_connid ));
+#else
                        Debug( LDAP_DEBUG_FILTER, "  FINAL\n", 0, 0, 0 );
+#endif
+
                        if ( f->f_sub_final != NULL ) {
                                ber_bvfree( value );
                                goto return_error;
                        }
+
                        f->f_sub_final = value;
 
                        if( fstr ) {
+                               filter_escape_value( value, &escaped );
                                *fstr = ch_realloc( *fstr,
-                                       strlen( *fstr ) + value->bv_len + 2 );
+                                       strlen( *fstr ) + escaped.bv_len + 2 );
                                strcat( *fstr, "*" );
-                               strcat( *fstr, value->bv_val );
+                               strcat( *fstr, escaped.bv_val );
+                               ber_memfree( escaped.bv_val );
                        }
                        break;
 
                default:
+#ifdef NEW_LOGGING
+                       LDAP_LOG(( "filter", LDAP_LEVEL_INFO,
+                                  "get_substring_filter: conn %d  unknown substring type %ld\n",
+                                  conn->c_connid, (long)tag ));
+#else
                        Debug( LDAP_DEBUG_FILTER,
                                "  unknown substring type=%ld\n",
                                (long) tag, 0, 0 );
+#endif
 
                        ber_bvfree( value );
 
 return_error:
+#ifdef NEW_LOGGING
+                       LDAP_LOG(( "filter", LDAP_LEVEL_INFO,
+                                  "get_substring_filter: conn %d  error %ld\n",
+                                  conn->c_connid, (long)rc ));
+#else
                        Debug( LDAP_DEBUG_FILTER, "  error=%ld\n",
                                (long) rc, 0, 0 );
-
+#endif
                        if( fstr ) {
                                free( *fstr );
                                *fstr = NULL;
                        }
 
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
                        ad_free( f->f_sub_desc, 1 );
-#else
-                       ch_free( f->f_sub_type );
-#endif
                        ber_bvfree( f->f_sub_initial );
                        ber_bvecfree( f->f_sub_any );
                        ber_bvfree( f->f_sub_final );
+                       ch_free( f->f_sub );
                        return rc;
                }
        }
@@ -588,7 +663,12 @@ return_error:
                strcat( *fstr, /*(*/ ")" );
        }
 
+#ifdef NEW_LOGGING
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "get_substring_filter: conn %d exit\n", conn->c_connid ));
+#else
        Debug( LDAP_DEBUG_FILTER, "end get_substring_filter\n", 0, 0, 0 );
+#endif
        return( LDAP_SUCCESS );
 }
 
@@ -603,28 +683,17 @@ filter_free( Filter *f )
 
        switch ( f->f_choice ) {
        case LDAP_FILTER_PRESENT:
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
                ad_free( f->f_desc, 1 );
-#else
-               if ( f->f_type != NULL ) {
-                       free( f->f_type );
-               }
-#endif
                break;
 
        case LDAP_FILTER_EQUALITY:
        case LDAP_FILTER_GE:
        case LDAP_FILTER_LE:
        case LDAP_FILTER_APPROX:
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
                ava_free( f->f_ava, 1 );
-#else
-               ava_free( &f->f_ava, 0 );
-#endif
                break;
 
        case LDAP_FILTER_SUBSTRINGS:
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
                ad_free( f->f_sub_desc, 1 );
                if ( f->f_sub_initial != NULL ) {
                        ber_bvfree( f->f_sub_initial );
@@ -633,18 +702,7 @@ filter_free( Filter *f )
                if ( f->f_sub_final != NULL ) {
                        ber_bvfree( f->f_sub_final );
                }
-#else
-               if ( f->f_sub_type != NULL ) {
-                       free( f->f_sub_type );
-               }
-               if ( f->f_sub_initial != NULL ) {
-                       ber_bvfree( f->f_sub_initial );
-               }
-               ber_bvecfree( f->f_sub_any );
-               if ( f->f_sub_final != NULL ) {
-                       ber_bvfree( f->f_sub_final );
-               }
-#endif
+               ch_free( f->f_sub );
                break;
 
        case LDAP_FILTER_AND:
@@ -660,8 +718,13 @@ filter_free( Filter *f )
                break;
 
        default:
+#ifdef NEW_LOGGING
+               LDAP_LOG(( "filter", LDAP_LEVEL_ERR,
+                          "filter_free: unknown filter type %lu\n", f->f_choice ));
+#else
                Debug( LDAP_DEBUG_ANY, "filter_free: unknown filter type=%lu\n",
                       f->f_choice, 0, 0 );
+#endif
                break;
        }
 
@@ -669,12 +732,12 @@ filter_free( Filter *f )
 }
 
 #ifdef LDAP_DEBUG
-
 void
 filter_print( Filter *f )
 {
        int     i;
        Filter  *p;
+       struct berval escaped;
 
        if ( f == NULL ) {
                fprintf( stderr, "No filter!" );
@@ -682,86 +745,66 @@ filter_print( Filter *f )
 
        switch ( f->f_choice ) {
        case LDAP_FILTER_EQUALITY:
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
+               filter_escape_value( f->f_av_value, &escaped );
                fprintf( stderr, "(%s=%s)",
                        f->f_av_desc->ad_cname->bv_val,
-                   f->f_av_value->bv_val );
-#else
-               fprintf( stderr, "(%s=%s)",
-                       f->f_ava.ava_type,
-                   f->f_ava.ava_value.bv_val );
-#endif
+                   escaped.bv_val );
+               ber_memfree( escaped.bv_val );
                break;
 
        case LDAP_FILTER_GE:
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
+               filter_escape_value( f->f_av_value, &escaped );
                fprintf( stderr, "(%s>=%s)",
                        f->f_av_desc->ad_cname->bv_val,
-                   f->f_av_value->bv_val );
-#else
-               fprintf( stderr, "(%s>=%s)",
-                       f->f_ava.ava_type,
-                   f->f_ava.ava_value.bv_val );
-#endif
+                   escaped.bv_val );
+               ber_memfree( escaped.bv_val );
                break;
 
        case LDAP_FILTER_LE:
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
+               filter_escape_value( f->f_av_value, &escaped );
                fprintf( stderr, "(%s<=%s)",
                        f->f_ava->aa_desc->ad_cname->bv_val,
-                   f->f_ava->aa_value->bv_val );
-#else
-               fprintf( stderr, "(%s<=%s)",
-                       f->f_ava.ava_type,
-                   f->f_ava.ava_value.bv_val );
-#endif
+                   escaped.bv_val );
+               ber_memfree( escaped.bv_val );
                break;
 
        case LDAP_FILTER_APPROX:
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
+               filter_escape_value( f->f_av_value, &escaped );
                fprintf( stderr, "(%s~=%s)",
                        f->f_ava->aa_desc->ad_cname->bv_val,
-                   f->f_ava->aa_value->bv_val );
-#else
-               fprintf( stderr, "(%s~=%s)",
-                       f->f_ava.ava_type,
-                   f->f_ava.ava_value.bv_val );
-#endif
+                   escaped.bv_val );
+               ber_memfree( escaped.bv_val );
                break;
 
        case LDAP_FILTER_SUBSTRINGS:
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
                fprintf( stderr, "(%s=" /*)*/,
                        f->f_sub_desc->ad_cname->bv_val );
-#else
-               fprintf( stderr, "(%s=" /*)*/,
-                       f->f_sub_type );
-#endif
                if ( f->f_sub_initial != NULL ) {
+                       filter_escape_value( f->f_sub_initial, &escaped );
                        fprintf( stderr, "%s",
-                               f->f_sub_initial->bv_val );
+                               escaped.bv_val );
+                       ber_memfree( escaped.bv_val );
                }
                if ( f->f_sub_any != NULL ) {
                        for ( i = 0; f->f_sub_any[i] != NULL; i++ ) {
+                               filter_escape_value( f->f_sub_any[i], &escaped );
                                fprintf( stderr, "*%s",
-                                       f->f_sub_any[i]->bv_val );
+                                       escaped.bv_val );
+                               ber_memfree( escaped.bv_val );
                        }
                }
                if ( f->f_sub_final != NULL ) {
+                       filter_escape_value( f->f_sub_final, &escaped );
                        fprintf( stderr,
-                               "*%s", f->f_sub_final->bv_val );
+                               "*%s", escaped.bv_val );
+                       ber_memfree( escaped.bv_val );
                }
                fprintf( stderr, /*(*/ ")" );
                break;
 
        case LDAP_FILTER_PRESENT:
-#ifdef SLAPD_SCHEMA_NOT_COMPAT
                fprintf( stderr, "(%s=*)",
                        f->f_desc->ad_cname->bv_val );
-#else
-               fprintf( stderr, "(%s=*)",
-                       f->f_type );
-#endif
                break;
 
        case LDAP_FILTER_AND:
@@ -791,3 +834,28 @@ filter_print( Filter *f )
 }
 
 #endif /* ldap_debug */
+
+int filter_escape_value(
+       struct berval *in,
+       struct berval *out )
+{
+       ber_len_t i;
+       assert( in );
+       assert( out );
+
+       out->bv_val = (char *) ch_malloc( ( in->bv_len * 3 ) + 1 );
+       out->bv_len = 0;
+
+       for( i=0; i < in->bv_len ; i++ ) {
+               if( FILTER_ESCAPE(in->bv_val[i]) ) {
+                       out->bv_val[out->bv_len++] = SLAP_ESCAPE_CHAR;
+                       out->bv_val[out->bv_len++] = SLAP_ESCAPE_HI( in->bv_val[i] );
+                       out->bv_val[out->bv_len++] = SLAP_ESCAPE_LO( in->bv_val[i] );
+               } else {
+                       out->bv_val[out->bv_len++] = in->bv_val[i];
+               }
+       }
+
+       out->bv_val[out->bv_len] = '\0';
+       return LDAP_SUCCESS;
+}