]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/schema_init.c
Move backend_syncfreq code down into back-ldbm. Creates new configuration
[openldap] / servers / slapd / schema_init.c
index 94827fd4a42f4db7d83f40f2808bcfaeb75252ac..00c4ca9955f793c1824c1aca09f178d8b1a81021 100644 (file)
 
 #include "slap.h"
 #include "ldap_pvt.h"
+
+#define UTF8MATCH 1
+
+#ifdef USE_MD5
 #include "lutil_md5.h"
+/* We should replace MD5 with a faster hash */
+#define HASH_BYTES                             LUTIL_MD5_BYTES
+#define HASH_CONTEXT                   lutil_MD5_CTX
+#define HASH_Init(c)                   lutil_MD5Init(c)
+#define HASH_Update(c,buf,len) lutil_MD5Update(c,buf,len)
+#define HASH_Final(d,c)                        lutil_MD5Final(d,c)
+#else
+#include "lutil_hash.h"
+/* We should replace MD5 with a faster hash */
+#define HASH_BYTES                             LUTIL_HASH_BYTES
+#define HASH_CONTEXT                   lutil_HASH_CTX
+#define HASH_Init(c)                   lutil_HASHInit(c)
+#define HASH_Update(c,buf,len) lutil_HASHUpdate(c,buf,len)
+#define HASH_Final(d,c)                        lutil_HASHFinal(d,c)
+#endif
 
 /* recycled validatation routines */
 #define berValidate                                            blobValidate
 
-/* recycled normalization routines */
-#define faxNumberNormalize                             numericStringNormalize
-#define phoneNumberNormalize                   numericStringNormalize
-#define telexNumberNormalize                   numericStringNormalize
-
 /* unimplemented pretters */
 #define dnPretty                                               NULL
 #define integerPretty                                  NULL
 /* recycled matching routines */
 #define bitStringMatch                                 octetStringMatch
 #define integerMatch                                   caseIgnoreIA5Match
-#define numericStringMatch                             caseIgnoreMatch
-#define objectIdentifierMatch                  numericStringMatch
-#define telephoneNumberMatch                   numericStringMatch
+#define numericStringMatch                             caseIgnoreIA5Match
+#define objectIdentifierMatch                  caseIgnoreIA5Match
+#define telephoneNumberMatch                   caseIgnoreIA5Match
 #define telephoneNumberSubstringsMatch caseIgnoreIA5SubstringsMatch
-#define generalizedTimeMatch                   numericStringMatch
-#define generalizedTimeOrderingMatch   numericStringMatch
+#define generalizedTimeMatch                   caseIgnoreIA5Match
+#define generalizedTimeOrderingMatch   caseIgnoreIA5Match
 #define uniqueMemberMatch                              dnMatch
 
 /* approx matching rules */
 #define directoryStringApproxMatchOID  "1.3.6.1.4.1.4203.666.4.4"
-#define directoryStringApproxMatch             NULL
+#define directoryStringApproxMatch     approxMatch
+#define directoryStringApproxIndexer   approxIndexer
+#define directoryStringApproxFilter    approxFilter
 #define IA5StringApproxMatchOID                        "1.3.6.1.4.1.4203.666.4.5"
-#define IA5StringApproxMatch                   NULL
+#define IA5StringApproxMatch                   approxMatch
+#define IA5StringApproxIndexer                 approxIndexer
+#define IA5StringApproxFilter                  approxFilter
 
 /* orderring matching rules */
 #define caseIgnoreOrderingMatch                        caseIgnoreMatch
@@ -53,7 +71,6 @@
 /* unimplemented matching routines */
 #define caseIgnoreListMatch                            NULL
 #define caseIgnoreListSubstringsMatch  NULL
-#define presentationAddressMatch               NULL
 #define protocolInformationMatch               NULL
 #define integerFirstComponentMatch             NULL
 
 #define integerIndexer                                 caseIgnoreIA5Indexer
 #define integerFilter                                  caseIgnoreIA5Filter
 
+#define telephoneNumberIndexer                 caseIgnoreIA5Indexer
+#define telephoneNumberFilter                  caseIgnoreIA5Filter
+#define telephoneNumberSubstringsIndexer       caseIgnoreIA5SubstringsIndexer
+#define telephoneNumberSubstringsFilter                caseIgnoreIA5SubstringsFilter
+
 static char *strcasechr( const char *str, int c )
 {
        char *lower = strchr( str, TOLOWER(c) );
@@ -114,11 +136,11 @@ int octetStringIndexer(
        int i;
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
        assert( values != NULL && values[0] != NULL );
@@ -133,18 +155,18 @@ int octetStringIndexer(
        mlen = strlen( mr->smr_oid );
 
        for( i=0; values[i] != NULL; i++ ) {
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        values[i]->bv_val, values[i]->bv_len );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
                keys[i] = ber_bvdup( &digest );
        }
@@ -168,30 +190,30 @@ int octetStringFilter(
 {
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value = (struct berval *) assertValue;
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        slen = strlen( syntax->ssyn_oid );
        mlen = strlen( mr->smr_oid );
 
        keys = ch_malloc( sizeof( struct berval * ) * 2 );
 
-       lutil_MD5Init( &MD5context );
+       HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        prefix->bv_val, prefix->bv_len );
        }
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                syntax->ssyn_oid, slen );
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                mr->smr_oid, mlen );
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                value->bv_val, value->bv_len );
-       lutil_MD5Final( MD5digest, &MD5context );
+       HASH_Final( HASHdigest, &HASHcontext );
 
        keys[0] = ber_bvdup( &digest );
        keys[1] = NULL;
@@ -220,21 +242,23 @@ dnValidate(
        return rc;
 }
 
-static int
+int
 dnNormalize(
        Syntax *syntax,
        struct berval *val,
        struct berval **normalized )
 {
-       struct berval *out = ber_bvdup( val );
+       struct berval *out;
 
-       if( out->bv_len != 0 ) {
+       if ( val->bv_len != 0 ) {
                char *dn;
 #ifdef USE_DN_NORMALIZE
-               dn = dn_normalize( out->bv_val );
+               out = ber_bvstr( UTF8normalize( val->bv_val, UTF8_CASEFOLD ) );
 #else
-               dn = dn_validate( out->bv_val );
+               out = ber_bvdup( val );
+               ldap_pvt_str2upper( out->bv_val );
 #endif
+               dn = dn_validate( out->bv_val );
 
                if( dn == NULL ) {
                        ber_bvfree( out );
@@ -243,6 +267,8 @@ dnNormalize(
 
                out->bv_val = dn;
                out->bv_len = strlen( dn );
+       } else {
+               out = ber_bvdup( val );
        }
 
        *normalized = out;
@@ -271,8 +297,15 @@ dnMatch(
 #endif
        }
 
+#ifdef NEW_LOGGING
+       LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
+                  "dnMatch: %d\n    %s\n    %s\n", match,
+                  value->bv_val, asserted->bv_val ));
+#else
        Debug( LDAP_DEBUG_ARGS, "dnMatch %d\n\t\"%s\"\n\t\"%s\"\n",
            match, value->bv_val, asserted->bv_val );
+#endif
+
 
        *matchp = match;
        return LDAP_SUCCESS;
@@ -407,6 +440,7 @@ bitStringValidate(
        if( in->bv_len < 3 ) {
                return LDAP_INVALID_SYNTAX;
        }
+
        if( in->bv_val[0] != 'B' ||
                in->bv_val[1] != '\'' ||
                in->bv_val[in->bv_len-1] != '\'' )
@@ -466,19 +500,26 @@ booleanMatch(
        return LDAP_SUCCESS;
 }
 
-#if 0
+#if UTF8MATCH
+/* case insensitive UTF8 strncmp with offset for second string */
 static int
-UTF8casecmp(
+UTF8oncasecmp(
        struct berval *right,
-       struct berval *left )
+       struct berval *left,
+       ber_len_t len,
+       ber_len_t offset )
 {
        ber_len_t r, l;
-       int rlen, llen;
+       ber_len_t rlen, llen;
+       ber_len_t rslen, lslen;
        ldap_unicode_t ru, lu;
        ldap_unicode_t ruu, luu;
 
-       for( r=0, l=0;
-               r < right->bv_len && l < left->bv_len;
+       rslen = len < right->bv_len ? len : right->bv_len;
+       lslen = len + offset < left->bv_len ? len : left->bv_len;
+
+       for( r = 0, l = offset;
+               r < rslen && l < lslen;
                r+=rlen, l+=llen )
        {
                /*
@@ -508,18 +549,48 @@ UTF8casecmp(
                llen = LDAP_UTF8_CHARLEN( &left->bv_val[l] );
        }
 
-       if( r < right->bv_len ) {
+       if( r < rslen ) {
                /* less left */
                return -1;
        }
 
-       if( l < left->bv_len ) {
+       if( l < lslen ) {
                /* less right */
                return 1;
        }
 
        return 0;
 }
+
+static char *UTF8casechr( const char *str, const char *c )
+{
+       char *p, *lower, *upper;
+       ldap_ucs4_t tch, ch = ldap_utf8_to_ucs4(c);
+
+       tch = uctolower ( ch );
+       for( p = (char *) str; *p != '\0'; LDAP_UTF8_INCR(p) ) {
+               if( ldap_utf8_to_ucs4( p ) == tch ) {
+                       break;
+               } 
+       }
+       lower = *p != '\0' ? p : NULL;
+
+       tch = uctoupper ( ch );
+       for( p = (char *) str; *p != '\0'; LDAP_UTF8_INCR(p) ) {
+               if( ldap_utf8_to_ucs4( p ) == tch ) {
+                       break;
+               } 
+       }
+       upper = *p != '\0' ? p : NULL;
+       
+       if( lower && upper ) {
+               return lower < upper ? lower : upper;
+       } else if ( lower ) {
+               return lower;
+       } else {
+               return upper;
+       }
+}
 #endif
 
 static int
@@ -627,6 +698,299 @@ UTF8StringNormalize(
        return LDAP_SUCCESS;
 }
 
+#if defined(SLAPD_APPROX_MULTISTRING)
+
+#if defined(SLAPD_APPROX_INITIALS)
+#define SLAPD_APPROX_DELIMITER "._ "
+#define SLAPD_APPROX_WORDLEN 2
+#else
+#define SLAPD_APPROX_DELIMITER " "
+#define SLAPD_APPROX_WORDLEN 1
+#endif
+
+static int
+approxMatch(
+       int *matchp,
+       slap_mask_t flags,
+       Syntax *syntax,
+       MatchingRule *mr,
+       struct berval *value,
+       void *assertedValue )
+{
+       char *val, *assertv, **values, **words, *c;
+       int i, count, len, nextchunk=0, nextavail=0;
+
+
+       /* Isolate how many words there are */
+       val = ch_strdup( value->bv_val );
+       for( c=val,count=1; *c; c++ ) {
+               c = strpbrk( c, SLAPD_APPROX_DELIMITER );
+               if ( c == NULL ) break;
+               *c = '\0';
+               count++;
+       }
+
+       /* Get a phonetic copy of each word */
+       words = (char **)ch_malloc( count * sizeof(char *) );
+       values = (char **)ch_malloc( count * sizeof(char *) );
+       for( c=val,i=0;  i<count;  i++,c+=strlen(c)+1 ) {
+               words[i] = c;
+               values[i] = phonetic(c);
+       }
+
+
+       /* Work through the asserted value's words, to see if  at least some
+          of the words are there, in the same order. */
+       assertv = ch_strdup( ((struct berval *)assertedValue)->bv_val );
+       len = 0;
+       while ( nextchunk < ((struct berval *)assertedValue)->bv_len ) {
+               len = strcspn( assertv + nextchunk, SLAPD_APPROX_DELIMITER);
+               if( len == 0 ) {
+                       nextchunk++;
+                       continue;
+               }
+#if defined(SLAPD_APPROX_INITIALS)
+               else if( len == 1 ) {
+                       /* Single letter words need to at least match one word's initial */
+                       for( i=nextavail; i<count; i++ )
+                               if( !strncasecmp( assertv+nextchunk, words[i], 1 )) {
+                                       nextavail=i+1;
+                                       break;
+                               }
+               }
+#endif
+               else {
+                       /* Isolate the next word in the asserted value and phonetic it */
+                       assertv[nextchunk+len] = '\0';
+                       val = phonetic( assertv + nextchunk );
+
+                       /* See if this phonetic chunk is in the remaining words of *value */
+                       for( i=nextavail; i<count; i++ ){
+                               if( !strcmp( val, values[i] ) ){
+                                       nextavail = i+1;
+                                       break;
+                               }
+                       }
+               }
+
+               /* This chunk in the asserted value was NOT within the *value. */
+               if( i >= count ) {
+                       nextavail=-1;
+                       break;
+               }
+
+               /* Go on to the next word in the asserted value */
+               nextchunk += len+1;
+       }
+
+       /* If some of the words were seen, call it a match */
+       if( nextavail > 0 ) {
+               *matchp = 0;
+       }
+       else {
+               *matchp = 1;
+       }
+
+       /* Cleanup allocs */
+       ch_free( assertv );
+       for( i=0; i<count; i++ ) {
+               ch_free( values[i] );
+       }
+       ch_free( values );
+       ch_free( words );
+       ch_free( val );
+
+       return LDAP_SUCCESS;
+}
+
+
+int 
+approxIndexer(
+       slap_mask_t use,
+       slap_mask_t flags,
+       Syntax *syntax,
+       MatchingRule *mr,
+       struct berval *prefix,
+       struct berval **values,
+       struct berval ***keysp )
+{
+       char *val, *c;
+       int i,j, len, wordcount, keycount=0;
+       struct berval **newkeys, **keys=NULL;
+
+
+       for( j=0; values[j] != NULL; j++ ) {
+
+               /* Isolate how many words there are. There will be a key for each */
+               val = ch_strdup( values[j]->bv_val );
+               for( wordcount=0,c=val;  *c;  c++) {
+                       len = strcspn(c, SLAPD_APPROX_DELIMITER);
+                       if( len >= SLAPD_APPROX_WORDLEN ) wordcount++;
+                       c+= len;
+                       if (*c == '\0') break;
+                       *c = '\0';
+               }
+
+               /* Allocate/increase storage to account for new keys */
+               newkeys = (struct berval **)ch_malloc( (keycount + wordcount + 1) 
+                  * sizeof(struct berval *) );
+               memcpy( newkeys, keys, keycount * sizeof(struct berval *) );
+               if( keys ) ch_free( keys );
+               keys = newkeys;
+
+               /* Get a phonetic copy of each word */
+               for( c=val,i=0;  i<wordcount;  c+=len+1  ) {
+                       len = strlen( c );
+                       if( len < SLAPD_APPROX_WORDLEN ) continue;
+                       keys[keycount] = (struct berval *)ch_malloc( sizeof(struct berval) );
+                       keys[keycount]->bv_val = phonetic( c );
+                       keys[keycount]->bv_len = strlen( keys[keycount]->bv_val );
+                       keycount++;
+                       i++;
+               }
+
+               ch_free( val );
+       }
+       keys[keycount] = NULL;
+       *keysp = keys;
+
+       return LDAP_SUCCESS;
+}
+
+
+int 
+approxFilter(
+       slap_mask_t use,
+       slap_mask_t flags,
+       Syntax *syntax,
+       MatchingRule *mr,
+       struct berval *prefix,
+       void * assertValue,
+       struct berval ***keysp )
+{
+       char *val, *c;
+       int i, count, len;
+       struct berval **keys;
+
+
+       /* Isolate how many words there are. There will be a key for each */
+       val = ch_strdup( ((struct berval *)assertValue)->bv_val );
+       for( count=0,c=val;  *c;  c++) {
+               len = strcspn(c, SLAPD_APPROX_DELIMITER);
+               if( len >= SLAPD_APPROX_WORDLEN ) count++;
+               c+= len;
+               if (*c == '\0') break;
+               *c = '\0';
+       }
+
+       /* Allocate storage for new keys */
+       keys = (struct berval **)ch_malloc( (count + 1) * sizeof(struct berval *) );
+
+       /* Get a phonetic copy of each word */
+       for( c=val,i=0;  i<count; c+=len+1 ) {
+               len = strlen(c);
+               if( len < SLAPD_APPROX_WORDLEN ) continue;
+               keys[i] = (struct berval *)ch_malloc( sizeof(struct berval) );
+               keys[i]->bv_val = phonetic( c );
+               keys[i]->bv_len = strlen( keys[i]->bv_val );
+               i++;
+       }
+
+       ch_free( val );
+
+       keys[count] = NULL;
+       *keysp = keys;
+
+       return LDAP_SUCCESS;
+}
+
+
+#else
+/* No other form of Approximate Matching is defined */
+
+static int
+approxMatch(
+       int *matchp,
+       slap_mask_t flags,
+       Syntax *syntax,
+       MatchingRule *mr,
+       struct berval *value,
+       void *assertedValue )
+{
+       char *vapprox, *avapprox;
+
+       vapprox = phonetic( value->bv_val );
+       avapprox = phonetic( ((struct berval *)assertedValue)->bv_val);
+
+       *matchp = strcmp( vapprox, avapprox );
+
+       ch_free( vapprox );
+       ch_free( avapprox );
+
+       return LDAP_SUCCESS;
+}
+
+int 
+approxIndexer(
+       slap_mask_t use,
+       slap_mask_t flags,
+       Syntax *syntax,
+       MatchingRule *mr,
+       struct berval *prefix,
+       struct berval **values,
+       struct berval ***keysp )
+{
+       int i;
+       struct berval **keys;
+
+
+       for( i=0; values[i] != NULL; i++ ) {
+               /* just count them */
+       }
+       assert( i > 0 );
+
+       keys = (struct berval **)ch_malloc( sizeof( struct berval * ) * (i+1) );
+
+       /* Copy each value and run it through phonetic() */
+       for( i=0; values[i] != NULL; i++ ) {
+               keys[i] = ch_malloc( sizeof( struct berval * ) );
+               keys[i]->bv_val = phonetic( values[i]->bv_val );
+               keys[i]->bv_len = strlen( keys[i]->bv_val );
+       }
+       keys[i] = NULL;
+
+       *keysp = keys;
+       return LDAP_SUCCESS;
+}
+
+
+int 
+approxFilter(
+       slap_mask_t use,
+       slap_mask_t flags,
+       Syntax *syntax,
+       MatchingRule *mr,
+       struct berval *prefix,
+       void * assertValue,
+       struct berval ***keysp )
+{
+       struct berval **keys;
+
+
+       keys = (struct berval **)ch_malloc( sizeof( struct berval * ) * 2 );
+
+       /* Copy the value and run it through phonetic() */
+       keys[0] = ch_malloc( sizeof( struct berval * ) );
+       keys[0]->bv_val = phonetic( ((struct berval *)assertValue)->bv_val );
+       keys[0]->bv_len = strlen( keys[0]->bv_val );
+       keys[1] = NULL;
+
+       *keysp = keys;
+       return LDAP_SUCCESS;
+}
+#endif
+
+
 static int
 caseExactMatch(
        int *matchp,
@@ -786,11 +1150,11 @@ int caseExactIndexer(
        int i;
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
        assert( values != NULL && values[0] != NULL );
@@ -805,20 +1169,29 @@ int caseExactIndexer(
        mlen = strlen( mr->smr_oid );
 
        for( i=0; values[i] != NULL; i++ ) {
-               struct berval *value = values[i];
+               struct berval *value;
+#if UTF8MATCH
+               value = ber_bvstr( UTF8normalize( values[i]->bv_val, UTF8_NOCASEFOLD ) );
+#else
+               value = values[i];
+#endif
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        value->bv_val, value->bv_len );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
+
+#if UTF8MATCH
+               ber_bvfree( value );
+#endif
 
                keys[i] = ber_bvdup( &digest );
        }
@@ -840,36 +1213,44 @@ int caseExactFilter(
 {
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        slen = strlen( syntax->ssyn_oid );
        mlen = strlen( mr->smr_oid );
 
+#if UTF8MATCH
+        value = ber_bvstr( UTF8normalize( ((struct berval *) assertValue)->bv_val, UTF8_NOCASEFOLD ) );
+#else
        value = (struct berval *) assertValue;
+#endif 
 
        keys = ch_malloc( sizeof( struct berval * ) * 2 );
 
-       lutil_MD5Init( &MD5context );
+       HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        prefix->bv_val, prefix->bv_len );
        }
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                syntax->ssyn_oid, slen );
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                mr->smr_oid, mlen );
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                value->bv_val, value->bv_len );
-       lutil_MD5Final( MD5digest, &MD5context );
+       HASH_Final( HASHdigest, &HASHcontext );
 
        keys[0] = ber_bvdup( &digest );
        keys[1] = NULL;
 
+#if UTF8MATCH
+       ber_bvfree( value );
+#endif
+
        *keysp = keys;
        return LDAP_SUCCESS;
 }
@@ -887,11 +1268,11 @@ int caseExactSubstringsIndexer(
        ber_len_t i, nkeys;
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
        assert( values != NULL && values[0] != NULL );
@@ -944,8 +1325,13 @@ int caseExactSubstringsIndexer(
                ber_len_t j,max;
                struct berval *value;
 
+               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
+
+#if UTF8MATCH
+                value = ber_bvstr( UTF8normalize( values[i]->bv_val, UTF8_NOCASEFOLD ) );
+#else
                value = values[i];
-               if( value->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
+#endif
 
                if( ( flags & SLAP_INDEX_SUBSTR_ANY ) &&
                        ( value->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) )
@@ -954,22 +1340,22 @@ int caseExactSubstringsIndexer(
                        max = value->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
 
                        for( j=0; j<max; j++ ) {
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
 
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[j],
                                        SLAP_INDEX_SUBSTR_MAXLEN );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
@@ -983,45 +1369,50 @@ int caseExactSubstringsIndexer(
 
                        if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
                                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        value->bv_val, j );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
 
                        if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
                                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[value->bv_len-j], j );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
 
                }
+
+#if UTF8MATCH
+               ber_bvfree( value );
+#endif
+
        }
 
        if( nkeys > 0 ) {
@@ -1049,8 +1440,8 @@ int caseExactSubstringsFilter(
        ber_len_t nkeys = 0;
        size_t slen, mlen, klen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
 
@@ -1082,8 +1473,8 @@ int caseExactSubstringsFilter(
                return LDAP_SUCCESS;
        }
 
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        slen = strlen( syntax->ssyn_oid );
        mlen = strlen( mr->smr_oid );
@@ -1095,26 +1486,33 @@ int caseExactSubstringsFilter(
                sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
+#if UTF8MATCH
+                value = ber_bvstr( UTF8normalize( sa->sa_initial->bv_val, UTF8_NOCASEFOLD ) );
+#else
                value = sa->sa_initial;
+#endif
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &pre, sizeof( pre ) );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        value->bv_val, klen );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
+#if UTF8MATCH
+               ber_bvfree( value );
+#endif
                keys[nkeys++] = ber_bvdup( &digest );
        }
 
@@ -1128,29 +1526,37 @@ int caseExactSubstringsFilter(
                                continue;
                        }
 
+#if UTF8MATCH
+                        value = ber_bvstr( UTF8normalize( sa->sa_any[i]->bv_val, UTF8_NOCASEFOLD ) );
+#else
                        value = sa->sa_any[i];
+#endif
 
                        for(j=0;
                                j <= value->bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
                                j += SLAP_INDEX_SUBSTR_STEP )
                        {
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[j], klen ); 
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
+
+#if UTF8MATCH
+                       ber_bvfree( value );
+#endif
                }
        }
 
@@ -1158,26 +1564,33 @@ int caseExactSubstringsFilter(
                sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
+#if UTF8MATCH
+                value = ber_bvstr( UTF8normalize( sa->sa_final->bv_val, UTF8_NOCASEFOLD ) );
+#else
                value = sa->sa_final;
+#endif
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &pre, sizeof( pre ) );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &value->bv_val[value->bv_len-klen], klen );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
+#if UTF8MATCH
+               ber_bvfree( value );
+#endif
                keys[nkeys++] = ber_bvdup( &digest );
        }
 
@@ -1201,8 +1614,10 @@ caseIgnoreMatch(
        struct berval *value,
        void *assertedValue )
 {
-#if 0
-       *matchp = UTF8casecmp( value, (struct berval *) assertedValue );
+#if UTF8MATCH
+       *matchp = UTF8normcmp( value->bv_val,
+                              ((struct berval *) assertedValue)->bv_val,
+                              UTF8_CASEFOLD );
 #else
        int match = value->bv_len - ((struct berval *) assertedValue)->bv_len;
 
@@ -1251,8 +1666,13 @@ caseIgnoreSubstringsMatch(
                        goto done;
                }
 
+#if UTF8MATCH
+               match = UTF8oncasecmp( sub->sa_initial, &left,
+                                    sub->sa_initial->bv_len, 0 );
+#else          
                match = strncasecmp( sub->sa_initial->bv_val, left.bv_val,
                        sub->sa_initial->bv_len );
+#endif
 
                if( match != 0 ) {
                        goto done;
@@ -1269,9 +1689,15 @@ caseIgnoreSubstringsMatch(
                        goto done;
                }
 
+#if UTF8MATCH
+               match = UTF8oncasecmp( sub->sa_final, &left,
+                                      sub->sa_final->bv_len,
+                                      left.bv_len - sub->sa_final->bv_len );
+#else          
                match = strncasecmp( sub->sa_final->bv_val,
                        &left.bv_val[left.bv_len - sub->sa_final->bv_len],
                        sub->sa_final->bv_len );
+#endif
 
                if( match != 0 ) {
                        goto done;
@@ -1297,7 +1723,11 @@ retry:
                                continue;
                        }
 
+#if UTF8MATCH
+                       p = UTF8casechr( left.bv_val, sub->sa_any[i]->bv_val );
+#else
                        p = strcasechr( left.bv_val, *sub->sa_any[i]->bv_val );
+#endif
 
                        if( p == NULL ) {
                                match = 1;
@@ -1321,6 +1751,17 @@ retry:
                                goto done;
                        }
 
+#if UTF8MATCH
+                       match = UTF8oncasecmp( &left, sub->sa_any[i],
+                                              sub->sa_any[i]->bv_len, 0 );
+
+                       if( match != 0 ) {
+                               int len = LDAP_UTF8_CHARLEN( left.bv_val );
+                               left.bv_val += len;
+                               left.bv_len -= len;
+                               goto retry;
+                       }
+#else                  
                        match = strncasecmp( left.bv_val,
                                sub->sa_any[i]->bv_val,
                                sub->sa_any[i]->bv_len );
@@ -1331,6 +1772,7 @@ retry:
 
                                goto retry;
                        }
+#endif
 
                        left.bv_val += sub->sa_any[i]->bv_len;
                        left.bv_len -= sub->sa_any[i]->bv_len;
@@ -1356,11 +1798,11 @@ int caseIgnoreIndexer(
        int i;
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
        assert( values != NULL && values[0] != NULL );
@@ -1375,21 +1817,25 @@ int caseIgnoreIndexer(
        mlen = strlen( mr->smr_oid );
 
        for( i=0; values[i] != NULL; i++ ) {
-               struct berval *value = ber_bvdup( values[i] );
+               struct berval *value;
+#if UTF8MATCH
+               value = ber_bvstr( UTF8normalize( values[i]->bv_val, UTF8_CASEFOLD ) );
+#else
+               value = ber_bvdup( values[i] );
                ldap_pvt_str2upper( value->bv_val );
-
-               lutil_MD5Init( &MD5context );
+#endif
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        value->bv_val, value->bv_len );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
                ber_bvfree( value );
 
@@ -1413,33 +1859,37 @@ int caseIgnoreFilter(
 {
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        slen = strlen( syntax->ssyn_oid );
        mlen = strlen( mr->smr_oid );
 
+#if UTF8MATCH
+       value = ber_bvstr( UTF8normalize( ((struct berval *) assertValue)->bv_val, UTF8_CASEFOLD ) );
+#else
        value = ber_bvdup( (struct berval *) assertValue );
        ldap_pvt_str2upper( value->bv_val );
+#endif
 
        keys = ch_malloc( sizeof( struct berval * ) * 2 );
 
-       lutil_MD5Init( &MD5context );
+       HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        prefix->bv_val, prefix->bv_len );
        }
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                syntax->ssyn_oid, slen );
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                mr->smr_oid, mlen );
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                value->bv_val, value->bv_len );
-       lutil_MD5Final( MD5digest, &MD5context );
+       HASH_Final( HASHdigest, &HASHcontext );
 
        keys[0] = ber_bvdup( &digest );
        keys[1] = NULL;
@@ -1464,11 +1914,11 @@ int caseIgnoreSubstringsIndexer(
        ber_len_t i, nkeys;
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
        assert( values != NULL && values[0] != NULL );
@@ -1523,8 +1973,12 @@ int caseIgnoreSubstringsIndexer(
 
                if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
 
+#if UTF8MATCH
+               value = ber_bvstr( UTF8normalize( values[i]->bv_val, UTF8_CASEFOLD ) );
+#else
                value = ber_bvdup( values[i] );
                ldap_pvt_str2upper( value->bv_val );
+#endif
 
                if( ( flags & SLAP_INDEX_SUBSTR_ANY ) &&
                        ( value->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) )
@@ -1533,22 +1987,22 @@ int caseIgnoreSubstringsIndexer(
                        max = value->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
 
                        for( j=0; j<max; j++ ) {
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
 
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[j],
                                        SLAP_INDEX_SUBSTR_MAXLEN );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
@@ -1562,40 +2016,40 @@ int caseIgnoreSubstringsIndexer(
 
                        if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
                                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        value->bv_val, j );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
 
                        if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
                                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[value->bv_len-j], j );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
@@ -1630,8 +2084,8 @@ int caseIgnoreSubstringsFilter(
        ber_len_t nkeys = 0;
        size_t slen, mlen, klen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
 
@@ -1663,8 +2117,8 @@ int caseIgnoreSubstringsFilter(
                return LDAP_SUCCESS;
        }
 
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        slen = strlen( syntax->ssyn_oid );
        mlen = strlen( mr->smr_oid );
@@ -1676,26 +2130,30 @@ int caseIgnoreSubstringsFilter(
                sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
+#if UTF8MATCH
+               value = ber_bvstr( UTF8normalize( sa->sa_initial->bv_val, UTF8_CASEFOLD ) );
+#else
                value = ber_bvdup( sa->sa_initial );
                ldap_pvt_str2upper( value->bv_val );
+#endif
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &pre, sizeof( pre ) );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        value->bv_val, klen );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
                ber_bvfree( value );
                keys[nkeys++] = ber_bvdup( &digest );
@@ -1711,27 +2169,31 @@ int caseIgnoreSubstringsFilter(
                                continue;
                        }
 
+#if UTF8MATCH
+                       value = ber_bvstr( UTF8normalize( sa->sa_any[i]->bv_val, UTF8_CASEFOLD ) );
+#else
                        value = ber_bvdup( sa->sa_any[i] );
                        ldap_pvt_str2upper( value->bv_val );
+#endif
 
                        for(j=0;
                                j <= value->bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
                                j += SLAP_INDEX_SUBSTR_STEP )
                        {
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[j], klen );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
@@ -1744,26 +2206,30 @@ int caseIgnoreSubstringsFilter(
                sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
+#if UTF8MATCH
+               value = ber_bvstr( UTF8normalize( sa->sa_final->bv_val, UTF8_CASEFOLD ) );
+#else
                value = ber_bvdup( sa->sa_final );
                ldap_pvt_str2upper( value->bv_val );
+#endif
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &pre, sizeof( pre ) );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &value->bv_val[value->bv_len-klen], klen );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
                ber_bvfree( value );
                keys[nkeys++] = ber_bvdup( &digest );
@@ -1787,7 +2253,10 @@ oidValidate(
 {
        ber_len_t i;
 
-       if( val->bv_len == 0 ) return 0;
+       if( val->bv_len == 0 ) {
+               /* disallow empty strings */
+               return LDAP_INVALID_SYNTAX;
+       }
 
        if( OID_LEADCHAR(val->bv_val[0]) ) {
                int dot = 0;
@@ -1881,6 +2350,23 @@ done:
        return LDAP_SUCCESS;
 }
 
+static int
+countryStringValidate(
+       Syntax *syntax,
+       struct berval *val )
+{
+       if( val->bv_len != 2 ) return LDAP_INVALID_SYNTAX;
+
+       if( !SLAP_PRINTABLE(val->bv_val[0]) ) {
+               return LDAP_INVALID_SYNTAX;
+       }
+       if( !SLAP_PRINTABLE(val->bv_val[1]) ) {
+               return LDAP_INVALID_SYNTAX;
+       }
+
+       return LDAP_SUCCESS;
+}
+
 static int
 printableStringValidate(
        Syntax *syntax,
@@ -1891,7 +2377,27 @@ printableStringValidate(
        if( !val->bv_len ) return LDAP_INVALID_SYNTAX;
 
        for(i=0; i < val->bv_len; i++) {
-               if( !isprint(val->bv_val[i]) ) return LDAP_INVALID_SYNTAX;
+               if( !SLAP_PRINTABLE(val->bv_val[i]) ) {
+                       return LDAP_INVALID_SYNTAX;
+               }
+       }
+
+       return LDAP_SUCCESS;
+}
+
+static int
+printablesStringValidate(
+       Syntax *syntax,
+       struct berval *val )
+{
+       ber_len_t i;
+
+       if( !val->bv_len ) return LDAP_INVALID_SYNTAX;
+
+       for(i=0; i < val->bv_len; i++) {
+               if( !SLAP_PRINTABLES(val->bv_val[i]) ) {
+                       return LDAP_INVALID_SYNTAX;
+               }
        }
 
        return LDAP_SUCCESS;
@@ -2140,11 +2646,11 @@ int caseExactIA5Indexer(
        int i;
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
        assert( values != NULL && values[0] != NULL );
@@ -2161,18 +2667,18 @@ int caseExactIA5Indexer(
        for( i=0; values[i] != NULL; i++ ) {
                struct berval *value = values[i];
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        value->bv_val, value->bv_len );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
                keys[i] = ber_bvdup( &digest );
        }
@@ -2194,12 +2700,12 @@ int caseExactIA5Filter(
 {
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        slen = strlen( syntax->ssyn_oid );
        mlen = strlen( mr->smr_oid );
@@ -2208,18 +2714,18 @@ int caseExactIA5Filter(
 
        keys = ch_malloc( sizeof( struct berval * ) * 2 );
 
-       lutil_MD5Init( &MD5context );
+       HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        prefix->bv_val, prefix->bv_len );
        }
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                syntax->ssyn_oid, slen );
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                mr->smr_oid, mlen );
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                value->bv_val, value->bv_len );
-       lutil_MD5Final( MD5digest, &MD5context );
+       HASH_Final( HASHdigest, &HASHcontext );
 
        keys[0] = ber_bvdup( &digest );
        keys[1] = NULL;
@@ -2241,11 +2747,11 @@ int caseExactIA5SubstringsIndexer(
        ber_len_t i, nkeys;
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
        assert( values != NULL && values[0] != NULL );
@@ -2308,22 +2814,22 @@ int caseExactIA5SubstringsIndexer(
                        max = value->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
 
                        for( j=0; j<max; j++ ) {
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
 
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[j],
                                        SLAP_INDEX_SUBSTR_MAXLEN );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
@@ -2337,40 +2843,40 @@ int caseExactIA5SubstringsIndexer(
 
                        if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
                                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        value->bv_val, j );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
 
                        if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
                                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[value->bv_len-j], j );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
@@ -2403,8 +2909,8 @@ int caseExactIA5SubstringsFilter(
        ber_len_t nkeys = 0;
        size_t slen, mlen, klen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
 
@@ -2436,8 +2942,8 @@ int caseExactIA5SubstringsFilter(
                return LDAP_SUCCESS;
        }
 
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        slen = strlen( syntax->ssyn_oid );
        mlen = strlen( mr->smr_oid );
@@ -2454,20 +2960,20 @@ int caseExactIA5SubstringsFilter(
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &pre, sizeof( pre ) );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        value->bv_val, klen );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
                keys[nkeys++] = ber_bvdup( &digest );
        }
@@ -2488,20 +2994,20 @@ int caseExactIA5SubstringsFilter(
                                j <= value->bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
                                j += SLAP_INDEX_SUBSTR_STEP )
                        {
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[j], klen ); 
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
@@ -2517,20 +3023,20 @@ int caseExactIA5SubstringsFilter(
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &pre, sizeof( pre ) );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &value->bv_val[value->bv_len-klen], klen );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
                keys[nkeys++] = ber_bvdup( &digest );
        }
@@ -2557,7 +3063,7 @@ caseIgnoreIA5Match(
 {
        int match = value->bv_len - ((struct berval *) assertedValue)->bv_len;
 
-       if( match == 0 ) {
+       if( match == 0 && value->bv_len ) {
                match = strncasecmp( value->bv_val,
                        ((struct berval *) assertedValue)->bv_val,
                        value->bv_len );
@@ -2706,11 +3212,11 @@ int caseIgnoreIA5Indexer(
        int i;
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
        assert( values != NULL && values[0] != NULL );
@@ -2728,18 +3234,18 @@ int caseIgnoreIA5Indexer(
                struct berval *value = ber_bvdup( values[i] );
                ldap_pvt_str2upper( value->bv_val );
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        value->bv_val, value->bv_len );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
                ber_bvfree( value );
 
@@ -2763,12 +3269,12 @@ int caseIgnoreIA5Filter(
 {
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        slen = strlen( syntax->ssyn_oid );
        mlen = strlen( mr->smr_oid );
@@ -2778,18 +3284,18 @@ int caseIgnoreIA5Filter(
 
        keys = ch_malloc( sizeof( struct berval * ) * 2 );
 
-       lutil_MD5Init( &MD5context );
+       HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        prefix->bv_val, prefix->bv_len );
        }
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                syntax->ssyn_oid, slen );
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                mr->smr_oid, mlen );
-       lutil_MD5Update( &MD5context,
+       HASH_Update( &HASHcontext,
                value->bv_val, value->bv_len );
-       lutil_MD5Final( MD5digest, &MD5context );
+       HASH_Final( HASHdigest, &HASHcontext );
 
        keys[0] = ber_bvdup( &digest );
        keys[1] = NULL;
@@ -2814,11 +3320,11 @@ int caseIgnoreIA5SubstringsIndexer(
        ber_len_t i, nkeys;
        size_t slen, mlen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
        assert( values != NULL && values[0] != NULL );
@@ -2883,22 +3389,22 @@ int caseIgnoreIA5SubstringsIndexer(
                        max = value->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
 
                        for( j=0; j<max; j++ ) {
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
 
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[j],
                                        SLAP_INDEX_SUBSTR_MAXLEN );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
@@ -2912,40 +3418,40 @@ int caseIgnoreIA5SubstringsIndexer(
 
                        if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
                                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        value->bv_val, j );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
 
                        if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
                                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[value->bv_len-j], j );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
@@ -2980,8 +3486,8 @@ int caseIgnoreIA5SubstringsFilter(
        ber_len_t nkeys = 0;
        size_t slen, mlen, klen;
        struct berval **keys;
-       lutil_MD5_CTX   MD5context;
-       unsigned char   MD5digest[LUTIL_MD5_BYTES];
+       HASH_CONTEXT   HASHcontext;
+       unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
 
@@ -3013,8 +3519,8 @@ int caseIgnoreIA5SubstringsFilter(
                return LDAP_SUCCESS;
        }
 
-       digest.bv_val = MD5digest;
-       digest.bv_len = sizeof(MD5digest);
+       digest.bv_val = HASHdigest;
+       digest.bv_len = sizeof(HASHdigest);
 
        slen = strlen( syntax->ssyn_oid );
        mlen = strlen( mr->smr_oid );
@@ -3032,20 +3538,20 @@ int caseIgnoreIA5SubstringsFilter(
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &pre, sizeof( pre ) );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        value->bv_val, klen );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
                ber_bvfree( value );
                keys[nkeys++] = ber_bvdup( &digest );
@@ -3068,20 +3574,20 @@ int caseIgnoreIA5SubstringsFilter(
                                j <= value->bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
                                j += SLAP_INDEX_SUBSTR_STEP )
                        {
-                               lutil_MD5Init( &MD5context );
+                               HASH_Init( &HASHcontext );
                                if( prefix != NULL && prefix->bv_len > 0 ) {
-                                       lutil_MD5Update( &MD5context,
+                                       HASH_Update( &HASHcontext,
                                                prefix->bv_val, prefix->bv_len );
                                }
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &pre, sizeof( pre ) );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        syntax->ssyn_oid, slen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
-                               lutil_MD5Update( &MD5context,
+                               HASH_Update( &HASHcontext,
                                        &value->bv_val[j], klen );
-                               lutil_MD5Final( MD5digest, &MD5context );
+                               HASH_Final( HASHdigest, &HASHcontext );
 
                                keys[nkeys++] = ber_bvdup( &digest );
                        }
@@ -3100,20 +3606,20 @@ int caseIgnoreIA5SubstringsFilter(
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
 
-               lutil_MD5Init( &MD5context );
+               HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
-                       lutil_MD5Update( &MD5context,
+                       HASH_Update( &HASHcontext,
                                prefix->bv_val, prefix->bv_len );
                }
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &pre, sizeof( pre ) );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        syntax->ssyn_oid, slen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
-               lutil_MD5Update( &MD5context,
+               HASH_Update( &HASHcontext,
                        &value->bv_val[value->bv_len-klen], klen );
-               lutil_MD5Final( MD5digest, &MD5context );
+               HASH_Final( HASHdigest, &HASHcontext );
 
                ber_bvfree( value );
                keys[nkeys++] = ber_bvdup( &digest );
@@ -3130,32 +3636,37 @@ int caseIgnoreIA5SubstringsFilter(
        return LDAP_SUCCESS;
 }
        
+static int
+numericStringValidate(
+       Syntax *syntax,
+       struct berval *in )
+{
+       ber_len_t i;
+
+       for(i=0; i < in->bv_len; i++) {
+               if( !SLAP_NUMERIC(in->bv_val[i]) ) {
+                       return LDAP_INVALID_SYNTAX;
+               }
+       }
+
+       return LDAP_SUCCESS;
+}
+
 static int
 numericStringNormalize(
        Syntax *syntax,
        struct berval *val,
        struct berval **normalized )
 {
-       /* similiar to IA5StringNormalize except removes all spaces */
+       /* removal all spaces */
        struct berval *newval;
        char *p, *q;
 
        newval = ch_malloc( sizeof( struct berval ) );
+       newval->bv_val = ch_malloc( val->bv_len + 1 );
 
        p = val->bv_val;
-
-       /* Ignore initial whitespace */
-       while ( ASCII_SPACE( *p ) ) {
-               p++;
-       }
-
-       if( *p == '\0' ) {
-               ch_free( newval );
-               return LDAP_INVALID_SYNTAX;
-       }
-
-       newval->bv_val = ch_strdup( p );
-       p = q = newval->bv_val;
+       q = newval->bv_val;
 
        while ( *p ) {
                if ( ASCII_SPACE( *p ) ) {
@@ -3166,16 +3677,9 @@ numericStringNormalize(
                }
        }
 
-       assert( *newval->bv_val );
-       assert( newval->bv_val < p );
+       assert( newval->bv_val <= p );
        assert( q <= p );
 
-       /* cannot start with a space */
-       assert( !ASCII_SPACE(*newval->bv_val) );
-
-       /* cannot end with a space */
-       assert( !ASCII_SPACE( q[-1] ) );
-
        /* null terminate */
        *q = '\0';
 
@@ -3264,9 +3768,16 @@ objectIdentifierFirstComponentMatch(
                ch_free( stored );
        }
 
+#ifdef NEW_LOGGING
+       LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
+                  "objectIdentifierFirstComponentMatch: %d\n    %s\n    %s\n",
+                  match, value->bv_val, asserted->bv_val ));
+#else
        Debug( LDAP_DEBUG_ARGS, "objectIdentifierFirstComponentMatch "
                "%d\n\t\"%s\"\n\t\"%s\"\n",
            match, value->bv_val, asserted->bv_val );
+#endif
+
 
        if( rc == LDAP_SUCCESS ) *matchp = match;
        return rc;
@@ -3399,7 +3910,7 @@ check_time_syntax (struct berval *val,
        }
 
        switch ( tzoffset ) {
-       case -1: /* negativ offset to UTC, ie west of Greenwich  */
+       case -1: /* negativ offset to UTC, ie west of Greenwich  */
                parts[4] += parts[7];
                parts[5] += parts[8];
                for (part = 6; --part > 0; ) { /* offset is just hhmm, no seconds */
@@ -3645,7 +4156,6 @@ struct syntax_defs_rec {
 #endif
 };
 
-#define X_HIDE "X-HIDE 'TRUE' "
 #define X_BINARY "X-BINARY-TRANSFER-REQUIRED 'TRUE' "
 #define X_NOT_H_R "X-NOT-HUMAN-READABLE 'TRUE' "
 
@@ -3658,8 +4168,8 @@ struct syntax_defs_rec syntax_defs[] = {
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' " X_NOT_H_R ")",
                SLAP_SYNTAX_BLOB, blobValidate, NULL, NULL},
-       {"( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' " X_BINARY X_NOT_H_R ")",
-               SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL, NULL},
+       {"( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' " X_NOT_H_R ")",
+               SLAP_SYNTAX_BER, berValidate, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )",
                0, bitStringValidate, NULL, NULL },
        {"( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' )",
@@ -3674,7 +4184,7 @@ struct syntax_defs_rec syntax_defs[] = {
                X_BINARY X_NOT_H_R ")",
                SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )",
-               0, NULL, NULL, NULL},
+               0, countryStringValidate, IA5StringNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )",
                0, dnValidate, dnNormalize, dnPretty},
        {"( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' )",
@@ -3694,7 +4204,7 @@ struct syntax_defs_rec syntax_defs[] = {
        {"( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' )",
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone Number' )",
-               0, IA5StringValidate, faxNumberNormalize, NULL},
+               0, printablesStringValidate, IA5StringNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'Fax' " X_NOT_H_R ")",
                SLAP_SYNTAX_BLOB, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' )",
@@ -3722,32 +4232,32 @@ struct syntax_defs_rec syntax_defs[] = {
        {"( 1.3.6.1.4.1.1466.115.121.1.35 DESC 'Name Form Description' )",
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' )",
-               0, IA5StringValidate, numericStringNormalize, NULL},
+               0, numericStringValidate, numericStringNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.37 DESC 'Object Class Description' )",
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' )",
                0, oidValidate, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' )",
-               0, NULL, NULL, NULL},
+               0, IA5StringValidate, IA5StringNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' )",
                0, blobValidate, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' )",
-               0, blobValidate, NULL, NULL},
+               0, UTF8StringValidate, UTF8StringNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' )",
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.43 DESC 'Presentation Address' )",
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )",
-               0, printableStringValidate, NULL, NULL},
+               0, printableStringValidate, IA5StringNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' "
                X_BINARY X_NOT_H_R ")",
                SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone Number' )",
-               0, IA5StringValidate, phoneNumberNormalize, NULL},
+               0, printableStringValidate, IA5StringNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.51 DESC 'Teletex Terminal Identifier' )",
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' )",
-               0, IA5StringValidate, telexNumberNormalize, NULL},
+               0, printableStringValidate, IA5StringNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.53 DESC 'UTC Time' )",
                0, utcTimeValidate, utcTimeNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.54 DESC 'LDAP Syntax Description' )",
@@ -3769,13 +4279,13 @@ struct syntax_defs_rec syntax_defs[] = {
 
        /* OpenLDAP Experimental Syntaxes */
        {"( 1.3.6.1.4.1.4203.666.2.1 DESC 'OpenLDAP Experimental ACI' )",
-               0, IA5StringValidate /* THIS WILL CHANGE FOR NEW ACI SYNTAX */,
+               0, UTF8StringValidate /* THIS WILL CHANGE FOR NEW ACI SYNTAX */,
                NULL, NULL},
        {"( 1.3.6.1.4.1.4203.666.2.2 DESC 'OpenLDAP authPassword' )",
                0, NULL, NULL, NULL},
 
        /* OpenLDAP Void Syntax */
-       {"( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' " X_HIDE ")" ,
+       {"( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' )" ,
                SLAP_SYNTAX_HIDE, inValidate, NULL, NULL},
        {NULL, 0, NULL, NULL, NULL}
 };
@@ -3826,14 +4336,18 @@ struct mrule_defs_rec mrule_defs[] = {
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
                SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
                NULL, NULL,
-               directoryStringApproxMatch, NULL, NULL,
+               directoryStringApproxMatch,
+               directoryStringApproxIndexer, 
+               directoryStringApproxFilter,
                NULL},
 
        {"( " IA5StringApproxMatchOID " NAME 'IA5StringApproxMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
                SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
                NULL, NULL,
-               IA5StringApproxMatch, NULL, NULL,
+               IA5StringApproxMatch,
+               IA5StringApproxIndexer, 
+               IA5StringApproxFilter,
                NULL},
 
        /*
@@ -3904,7 +4418,9 @@ struct mrule_defs_rec mrule_defs[] = {
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )",
                SLAP_MR_EQUALITY | SLAP_MR_EXT,
                NULL, NULL,
-               caseIgnoreIA5Match, NULL, NULL,
+               caseIgnoreIA5Match,
+               caseIgnoreIA5Indexer,
+               caseIgnoreIA5Filter,
                NULL},
 
        {"( 2.5.13.10 NAME 'numericStringSubstringsMatch' "
@@ -3962,21 +4478,25 @@ struct mrule_defs_rec mrule_defs[] = {
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )",
                SLAP_MR_EQUALITY | SLAP_MR_EXT,
                NULL, NULL,
-               telephoneNumberMatch, NULL, NULL,
+               telephoneNumberMatch,
+               telephoneNumberIndexer,
+               telephoneNumberFilter,
                NULL},
 
        {"( 2.5.13.21 NAME 'telephoneNumberSubstringsMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )",
                SLAP_MR_SUBSTR | SLAP_MR_EXT,
                NULL, NULL,
-               telephoneNumberSubstringsMatch, NULL, NULL,
+               telephoneNumberSubstringsMatch,
+               telephoneNumberSubstringsIndexer,
+               telephoneNumberSubstringsFilter,
                NULL},
 
        {"( 2.5.13.22 NAME 'presentationAddressMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.43 )",
                SLAP_MR_EQUALITY | SLAP_MR_EXT,
                NULL, NULL,
-               presentationAddressMatch, NULL, NULL,
+               NULL, NULL, NULL,
                NULL},
 
        {"( 2.5.13.23 NAME 'uniqueMemberMatch' "
@@ -4032,7 +4552,7 @@ struct mrule_defs_rec mrule_defs[] = {
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
                SLAP_MR_EQUALITY | SLAP_MR_EXT,
                NULL, NULL,
-               caseIgnoreIA5Match, caseExactIA5Indexer, caseExactIA5Filter,
+               caseIgnoreIA5Match, caseIgnoreIA5Indexer, caseIgnoreIA5Filter,
                IA5StringApproxMatchOID },
 
        {"( 1.3.6.1.4.1.1466.109.114.3 NAME 'caseIgnoreIA5SubstringsMatch' "