]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/schema_init.c
More system schema checks
[openldap] / servers / slapd / schema_init.c
index c89c5fb253fe01d2ec126a80db42ab2bd3080c5c..cfd141b2fcba882a814eb77db8dc1ce76c30d46d 100644 (file)
@@ -1,7 +1,7 @@
 /* schema_init.c - init builtin schema */
 /* $OpenLDAP$ */
 /*
- * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 
@@ -21,7 +21,6 @@
 #include "ldap_utf8.h"
 
 #include "lutil_hash.h"
-/* We should replace MD5 with a faster hash */
 #define HASH_BYTES                             LUTIL_HASH_BYTES
 #define HASH_CONTEXT                   lutil_HASH_CTX
 #define HASH_Init(c)                   lutil_HASHInit(c)
@@ -32,9 +31,6 @@
 #define berValidate                                            blobValidate
 
 /* unimplemented pretters */
-#ifndef USE_LDAP_DN_PARSING
-#define dnPretty                                               NULL
-#endif /* !USE_LDAP_DN_PARSING */
 #define integerPretty                                  NULL
 
 /* recycled matching routines */
@@ -121,37 +117,37 @@ octetStringMatch(
 }
 
 /* Index generation function */
-int octetStringIndexer(
+static int octetStringIndexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* just count them */
        }
 
        /* we should have at least one value at this point */
        assert( i > 0 );
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
                        HASH_Update( &HASHcontext,
@@ -162,13 +158,13 @@ int octetStringIndexer(
                HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
                HASH_Update( &HASHcontext,
-                       values[i]->bv_val, values[i]->bv_len );
+                       values[i].bv_val, values[i].bv_len );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[i] = ber_bvdup( &digest );
+               ber_dupbv( &keys[i], &digest );
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
 
        *keysp = keys;
 
@@ -176,17 +172,17 @@ int octetStringIndexer(
 }
 
 /* Index generation function */
-int octetStringFilter(
+static int octetStringFilter(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value = (struct berval *) assertValue;
@@ -194,10 +190,10 @@ int octetStringFilter(
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
 
        HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -212,436 +208,52 @@ int octetStringFilter(
                value->bv_val, value->bv_len );
        HASH_Final( HASHdigest, &HASHcontext );
 
-       keys[0] = ber_bvdup( &digest );
-       keys[1] = NULL;
+       ber_dupbv( keys, &digest );
+       keys[1].bv_val = NULL;
 
        *keysp = keys;
 
        return LDAP_SUCCESS;
 }
 
-#ifdef USE_LDAP_DN_PARSING
-static int
-dnValidate(
-       Syntax *syntax,
-       struct berval *in )
-{
-       int             rc;
-       LDAPDN          *dn = NULL;
-
-       if ( in->bv_len == 0 ) {
-               return( LDAP_SUCCESS );
-       }
-
-       rc = ldap_str2dn( in->bv_val, &dn, LDAP_DN_FORMAT_LDAPV3 );
-       ldapava_free_dn( dn );
-       
-       if ( rc != LDAP_SUCCESS ) {
-               return( LDAP_INVALID_SYNTAX );
-       }
-
-       return( LDAP_SUCCESS );
-}
-
-static void
-AVA_Sort( LDAPRDN *rdn, int iAVA )
-{
-       int             i;
-       LDAPAVA         *ava_in = rdn[ iAVA ][ 0 ];
-       
-       for ( i = 0; i < iAVA; i++ ) {
-               LDAPAVA         *ava = rdn[ i ][ 0 ];
-               int             a, j;
-
-               a = strcmp( ava_in->la_attr->bv_val, ava->la_attr->bv_val );
-
-               if ( a > 0 ) {
-                       break;
-               }
-
-               while ( a == 0 ) {
-                       int             v, d;
-
-                       d = ava_in->la_value->bv_len - ava->la_value->bv_len;
-
-                       v = memcmp( ava_in->la_value->bv_val, 
-                                       ava->la_value->bv_val,
-                                       d <= 0 ? ava_in->la_value->bv_len 
-                                               : ava->la_value->bv_len );
-
-                       if ( v == 0 && d != 0 ) {
-                               v = d;
-                       }
-
-                       if ( v <= 0 ) {
-                               /* 
-                                * got it!
-                                */
-                               break;
-                       }
-
-                       if ( ++i == iAVA ) {
-                               /*
-                                * already sorted
-                                */
-                               return;
-                       }
-
-                       ava = rdn[ i ][ 0 ];
-                       a = strcmp( ava_in->la_value->bv_val, 
-                                       ava->la_value->bv_val );
-               }
-
-               /*
-                * move ahead
-                */
-               for ( j = iAVA; j > i; j-- ) {
-                       rdn[ j ][ 0 ] = rdn[ j - 1 ][ 0 ];
-               }
-               rdn[ i ][ 0 ] = ava_in;
-
-               return;
-       }
-}
-
-/*
- * In-place normalization of the structural representation 
- * of a distinguished name
- */
-static int
-DN_Normalize( LDAPDN *dn )
-{
-       int             iRDN;
-       int             rc;
-
-       assert( dn );
-
-       for ( iRDN = 0; dn[ iRDN ]; iRDN++ ) {
-               LDAPRDN         *rdn = dn[ iRDN ][ 0 ];
-               int             iAVA;
-
-               for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) {
-                       LDAPAVA                 *ava = rdn[ iAVA ][ 0 ];
-                       AttributeDescription    *ad = NULL;
-                       const char              *text = NULL;
-                       slap_syntax_transform_func *nf = NULL;
-                       struct berval           *bv = NULL;
-
-                       rc = slap_bv2ad( ava->la_attr, &ad, &text );
-                       if ( rc != LDAP_SUCCESS ) {
-                               return( LDAP_INVALID_SYNTAX );
-                       }
-
-                       /* 
-                        * FIXME: is this required? 
-                        */
-                       ber_bvfree( ava->la_attr );
-                       ava->la_attr = ber_bvdup( &ad->ad_cname );
-                               
-                       /*
-                        * FIXME: What is this intended for?
-                        */
-                       nf = ad->ad_type->sat_syntax->ssyn_normalize;
-                       if ( !nf ) {
-                               break;
-                       }
-                               
-                       rc = ( *nf )( ad->ad_type->sat_syntax,
-                                ava->la_value, &bv );
-                       
-                       if ( rc != LDAP_SUCCESS ) {
-                               return( LDAP_INVALID_SYNTAX );
-                       }
-
-                       /*
-                        * FIXME: shouldn't this happen inside 
-                        * ssyn_normalize if the syntax is case 
-                        * insensitive?
-                        */
-                       if ( !( ava->la_flags & LDAP_AVA_BINARY ) ) {
-                               struct berval *s = bv;
-                               
-                               bv = ber_bvstr( UTF8normalize( bv, 
-                                               UTF8_CASEFOLD ) );
-                               ber_bvfree( s );
-                       }
-
-                       ber_bvfree( ava->la_value );
-                       ava->la_value = bv;
-
-                       AVA_Sort( rdn, iAVA );
-               }
-       }
-
-       return( LDAP_SUCCESS );
-}
-
-int
-dnNormalize(
-       Syntax *syntax,
-       struct berval *val,
-       struct berval **normalized )
-{
-       struct berval *out = NULL;
-
-       Debug( LDAP_DEBUG_TRACE, ">>> dnNormalize: %s\n", val->bv_val, 0, 0 );
-
-       if ( val->bv_len != 0 ) {
-               LDAPDN          *dn = NULL;
-               char            *dn_out = NULL;
-               int             rc;
-
-               /*
-                * Go to structural representation
-                */
-               rc = ldap_str2dn( val->bv_val, &dn, LDAP_DN_FORMAT_LDAPV3 );
-               if ( rc != LDAP_SUCCESS ) {
-                       return( LDAP_INVALID_SYNTAX );
-               }
-
-               /*
-                * Add schema-aware normalization stuff
-                */
-               if ( DN_Normalize( dn ) != LDAP_SUCCESS ) {
-                       goto error_return;
-               }
-
-               /*
-                * Back to string representation
-                */
-               rc = ldap_dn2str( dn, &dn_out, LDAP_DN_FORMAT_LDAPV3 );
-
-               if ( rc != LDAP_SUCCESS ) {
-error_return:;
-                       ldapava_free_dn( dn );
-                       return( LDAP_INVALID_SYNTAX );
-               }
-
-               ldapava_free_dn( dn );
-
-               out = ber_bvstr( dn_out );
-
-       } else {
-               out = ber_bvdup( val );
-       }
-
-       Debug( LDAP_DEBUG_TRACE, "<<< dnNormalize: %s\n", out->bv_val, 0, 0 );
-
-       *normalized = out;
-
-       return( LDAP_SUCCESS );
-}
-
-int
-dnPretty(
-       Syntax *syntax,
-       struct berval *val,
-       struct berval **normalized)
-{
-       struct berval *out = NULL;
-
-       if ( val->bv_len != 0 ) {
-               LDAPDN          *dn = NULL;
-               char            *dn_out = NULL;
-               unsigned        flags = LDAP_DN_FORMAT_LDAPV3;
-               int             rc;
-
-               rc = ldap_str2dn( val->bv_val, &dn, flags );
-               if ( rc != LDAP_SUCCESS ) {
-                       return( LDAP_INVALID_SYNTAX );
-               }
-
-               flags |= LDAP_DN_PRETTY;
-
-               rc = ldap_dn2str( dn, &dn_out, flags );
-               ldapava_free_dn( dn );
-
-               if ( rc != LDAP_SUCCESS ) {
-                       return( LDAP_INVALID_SYNTAX );
-               }
-
-               out = ber_bvstr( dn_out );
-
-       } else {
-               out = ber_bvdup( val );
-       }
-
-       *normalized = out;
-
-       return( LDAP_SUCCESS );
-}
-
-int
-dnMatch(
-       int *matchp,
-       slap_mask_t flags,
-       Syntax *syntax,
-       MatchingRule *mr,
-       struct berval *value,
-       void *assertedValue )
-{
-       int match;
-       struct berval *asserted = (struct berval *) assertedValue;
-       
-       match = value->bv_len - asserted->bv_len;
-
-       if ( match == 0 ) {
-#ifdef USE_DN_NORMALIZE
-               match = strcmp( value->bv_val, asserted->bv_val );
-               fprintf(stderr, "USE_DN_NORMALIZE :(\n");
-#else
-               match = strcasecmp( value->bv_val, asserted->bv_val );
-               fprintf(stderr, "!USE_DN_NORMALIZE :)\n");
-#endif
-       }
-
-#ifdef NEW_LOGGING
-       LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
-               "dnMatch: %d\n    %s\n    %s\n", match,
-               value->bv_val, asserted->bv_val ));
-#else
-       Debug( LDAP_DEBUG_ARGS, "dnMatch %d\n\t\"%s\"\n\t\"%s\"\n",
-               match, value->bv_val, asserted->bv_val );
-#endif
-
-       *matchp = match;
-       return( LDAP_SUCCESS );
-}
-
-#else /* !USE_LDAP_DN_PARSING */
-
-static int
-dnValidate(
-       Syntax *syntax,
-       struct berval *in )
-{
-       int rc;
-       char *dn;
-
-       if( in->bv_len == 0 ) return LDAP_SUCCESS;
-
-       dn = ch_strdup( in->bv_val );
-
-       if( dn == NULL ) {
-               return LDAP_INVALID_SYNTAX;
-
-       } else if ( strlen( in->bv_val ) != in->bv_len ) {
-               rc = LDAP_INVALID_SYNTAX;
-
-       } else if ( dn_validate( dn ) == NULL ) {
-               rc = LDAP_INVALID_SYNTAX;
-
-       } else {
-               rc = LDAP_SUCCESS;
-       }
-
-       ch_free( dn );
-       return rc;
-}
-
-int
-dnNormalize(
-       Syntax *syntax,
-       struct berval *val,
-       struct berval **normalized )
-{
-       struct berval *out;
-
-       if ( val->bv_len != 0 ) {
-               char *dn;
-               out = ber_bvstr( UTF8normalize( val, UTF8_CASEFOLD ) );
-
-               dn = dn_validate( out->bv_val );
-
-               if( dn == NULL ) {
-                       ber_bvfree( out );
-                       return LDAP_INVALID_SYNTAX;
-               }
-
-               out->bv_val = dn;
-               out->bv_len = strlen( dn );
-       } else {
-               out = ber_bvdup( val );
-       }
-
-       *normalized = out;
-       return LDAP_SUCCESS;
-}
-
-int
-dnMatch(
-       int *matchp,
-       slap_mask_t flags,
-       Syntax *syntax,
-       MatchingRule *mr,
-       struct berval *value,
-       void *assertedValue )
-{
-       int match;
-       struct berval *asserted = (struct berval *) assertedValue;
-       
-       match = value->bv_len - asserted->bv_len;
-
-       if( match == 0 ) {
-#ifdef USE_DN_NORMALIZE
-               match = strcmp( value->bv_val, asserted->bv_val );
-#else
-               match = strcasecmp( value->bv_val, asserted->bv_val );
-#endif
-       }
-
-#ifdef NEW_LOGGING
-       LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
-               "dnMatch: %d\n    %s\n    %s\n", match,
-               value->bv_val, asserted->bv_val ));
-#else
-       Debug( LDAP_DEBUG_ARGS, "dnMatch %d\n\t\"%s\"\n\t\"%s\"\n",
-               match, value->bv_val, asserted->bv_val );
-#endif
-
-
-       *matchp = match;
-       return LDAP_SUCCESS;
-}
-
-#endif /* !USE_LDAP_DN_PARSING */
-
 static int
 nameUIDValidate(
        Syntax *syntax,
        struct berval *in )
 {
        int rc;
-       struct berval *dn;
+       struct berval dn;
 
        if( in->bv_len == 0 ) return LDAP_SUCCESS;
 
-       dn = ber_bvdup( in );
+       ber_dupbv( &dn, in );
+       if( !dn.bv_val ) return LDAP_OTHER;
 
-       if( dn->bv_val[dn->bv_len-1] == '\'' ) {
+       if( dn.bv_val[dn.bv_len-1] == 'B'
+               && dn.bv_val[dn.bv_len-2] == '\'' )
+       {
                /* assume presence of optional UID */
                ber_len_t i;
 
-               for(i=dn->bv_len-2; i>2; i--) {
-                       if( dn->bv_val[i] != '0' &&     dn->bv_val[i] != '1' ) {
+               for(i=dn.bv_len-3; i>1; i--) {
+                       if( dn.bv_val[i] != '0' &&      dn.bv_val[i] != '1' ) {
                                break;
                        }
                }
-               if( dn->bv_val[i] != '\'' ||
-                   dn->bv_val[i-1] != 'B' ||
-                   dn->bv_val[i-2] != '#' ) {
-                       ber_bvfree( dn );
+               if( dn.bv_val[i] != '\'' ||
+                   dn.bv_val[i-1] != '#' ) {
+                       ber_memfree( dn.bv_val );
                        return LDAP_INVALID_SYNTAX;
                }
 
-               /* trim the UID to allow use of dn_validate */
-               dn->bv_val[i-2] = '\0';
+               /* trim the UID to allow use of dnValidate */
+               dn.bv_val[i-1] = '\0';
+               dn.bv_len = i-1;
        }
 
-       rc = dn_validate( dn->bv_val ) == NULL
-               ? LDAP_INVALID_SYNTAX : LDAP_SUCCESS;
+       rc = dnValidate( NULL, &dn );
 
-       ber_bvfree( dn );
+       ber_memfree( &dn );
        return rc;
 }
 
@@ -649,55 +261,62 @@ static int
 nameUIDNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
-       struct berval *out = ber_bvdup( val );
+       struct berval out;
+       int rc;
 
-       if( out->bv_len != 0 ) {
-               char *dn;
+       ber_dupbv( &out, val );
+       if( out.bv_len != 0 ) {
                ber_len_t dnlen;
                char *uid = NULL;
                ber_len_t uidlen = 0;
 
-               if( out->bv_val[out->bv_len-1] == '\'' ) {
+               if( out.bv_val[out.bv_len-1] == '\'' ) {
                        /* assume presence of optional UID */
-                       uid = strrchr( out->bv_val, '#' );
+                       uid = strrchr( out.bv_val, '#' );
 
                        if( uid == NULL ) {
-                               ber_bvfree( out );
+                               free( out.bv_val );
                                return LDAP_INVALID_SYNTAX;
                        }
 
-                       uidlen = out->bv_len - (out->bv_val - uid);
+                       uidlen = out.bv_len - (uid - out.bv_val);
                        /* temporarily trim the UID */
                        *uid = '\0';
+                       out.bv_len -= uidlen;
                }
 
 #ifdef USE_DN_NORMALIZE
-               dn = dn_normalize( out->bv_val );
+               rc = dnNormalize2( NULL, &out, normalized );
 #else
-               dn = dn_validate( out->bv_val );
+               rc = dnPretty2( NULL, &out, normalized );
 #endif
 
-               if( dn == NULL ) {
-                       ber_bvfree( out );
+               if( rc != LDAP_SUCCESS ) {
+                       free( out.bv_val );
                        return LDAP_INVALID_SYNTAX;
                }
 
-               dnlen = strlen(dn);
+               dnlen = normalized->bv_len;
 
                if( uidlen ) {
+                       struct berval b2;
+                       b2.bv_val = ch_malloc(dnlen + uidlen + 1);
+                       AC_MEMCPY( b2.bv_val, normalized->bv_val, dnlen );
+
                        /* restore the separator */
                        *uid = '#';
                        /* shift the UID */
-                       SAFEMEMCPY( &dn[dnlen], uid, uidlen );
+                       AC_MEMCPY( normalized->bv_val+dnlen, uid, uidlen );
+                       b2.bv_len = dnlen + uidlen;
+                       normalized->bv_val[dnlen+uidlen] = '\0';
+                       free(normalized->bv_val);
+                       *normalized = b2;
                }
-
-               out->bv_val = dn;
-               out->bv_len = dnlen + uidlen;
+               free( out.bv_val );
        }
 
-       *normalized = out;
        return LDAP_SUCCESS;
 }
 
@@ -760,14 +379,13 @@ static int
 bitStringNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
        /*
-     * A normalized bitString is has no extaneous (leading) zero bits.
+        * A normalized bitString is has no extaneous (leading) zero bits.
         * That is, '00010'B is normalized to '10'B
         * However, as a special case, '0'B requires no normalization.
-     */
-       struct berval *newval;
+        */
        char *p;
 
        /* start at the first bit */
@@ -776,28 +394,24 @@ bitStringNormalize(
        /* Find the first non-zero bit */
        while ( *p == '0' ) p++;
 
-       newval = (struct berval *) ch_malloc( sizeof(struct berval) );
-
        if( *p == '\'' ) {
                /* no non-zero bits */
-               newval->bv_val = ch_strdup("\'0\'B");
-               newval->bv_len = sizeof("\'0\'B") - 1;
+               ber_str2bv( "\'0\'B", sizeof("\'0\'B") - 1, 1, normalized );
                goto done;
        }
 
-       newval->bv_val = ch_malloc( val->bv_len + 1 );
+       normalized->bv_val = ch_malloc( val->bv_len + 1 );
 
-       newval->bv_val[0] = '\'';
-       newval->bv_len = 1;
+       normalized->bv_val[0] = '\'';
+       normalized->bv_len = 1;
 
        for( ; *p != '\0'; p++ ) {
-               newval->bv_val[newval->bv_len++] = *p;
+               normalized->bv_val[normalized->bv_len++] = *p;
        }
 
-       newval->bv_val[newval->bv_len] = '\0';
+       normalized->bv_val[normalized->bv_len] = '\0';
 
 done:
-       *normalized = newval;
        return LDAP_SUCCESS;
 }
 
@@ -876,56 +490,53 @@ static int
 UTF8StringNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
-       struct berval *newval;
        char *p, *q, *s;
-
-       newval = ch_malloc( sizeof( struct berval ) );
+       int len = 0;
 
        p = val->bv_val;
 
        /* Ignore initial whitespace */
-       while ( ldap_utf8_isspace( p ) ) {
-               LDAP_UTF8_INCR( p );
+       /* All space is ASCII. All ASCII is 1 byte */
+       while ( ASCII_SPACE( *p ) ) {
+               p++;
        }
 
        if( *p == '\0' ) {
-               ch_free( newval );
                return LDAP_INVALID_SYNTAX;
        }
 
-       newval->bv_val = ch_strdup( p );
-       p = q = newval->bv_val;
+       ber_str2bv( p, val->bv_len - (p - val->bv_val), 1, normalized );
+
+       assert( normalized->bv_val );
+
+       p = q = normalized->bv_val;
        s = NULL;
 
        while ( *p ) {
-               int len;
-
-               if ( ldap_utf8_isspace( p ) ) {
-                       len = LDAP_UTF8_COPY(q,p);
-                       s=q;
-                       p+=len;
-                       q+=len;
+               q += len;
+               if ( ASCII_SPACE( *p ) ) {
+                       s = q - len;
+                       len = 1;
+                       *q = *p++;
 
                        /* Ignore the extra whitespace */
-                       while ( ldap_utf8_isspace( p ) ) {
-                               LDAP_UTF8_INCR( p );
+                       while ( ASCII_SPACE( *p ) ) {
+                               p++;
                        }
                } else {
                        len = LDAP_UTF8_COPY(q,p);
                        s=NULL;
                        p+=len;
-                       q+=len;
                }
        }
 
-       assert( *newval->bv_val );
-       assert( newval->bv_val < p );
-       assert( q <= p );
+       assert( normalized->bv_val < p );
+       assert( q+len <= p );
 
        /* cannot start with a space */
-       assert( !ldap_utf8_isspace(newval->bv_val) );
+       assert( !ASCII_SPACE(normalized->bv_val[0]) );
 
        /*
         * If the string ended in space, backup the pointer one
@@ -934,27 +545,29 @@ UTF8StringNormalize(
         */
 
        if ( s != NULL ) {
+               len = q - s;
                q = s;
        }
 
        /* cannot end with a space */
-       assert( !ldap_utf8_isspace( LDAP_UTF8_PREV(q) ) );
+       assert( !ASCII_SPACE( *q ) );
+
+       q += len;
 
        /* null terminate */
        *q = '\0';
 
-       newval->bv_len = q - newval->bv_val;
-       *normalized = newval;
+       normalized->bv_len = q - normalized->bv_val;
 
        return LDAP_SUCCESS;
 }
 
-/* Returns Unicode cannonically normalized copy of a substring assertion
+/* Returns Unicode canonically normalized copy of a substring assertion
  * Skipping attribute description */
-SubstringsAssertion *
+static SubstringsAssertion *
 UTF8SubstringsassertionNormalize(
        SubstringsAssertion *sa,
-       char casefold )
+       unsigned casefold )
 {
        SubstringsAssertion *nsa;
        int i;
@@ -964,30 +577,33 @@ UTF8SubstringsassertionNormalize(
                return NULL;
        }
 
-       if( sa->sa_initial != NULL ) {
-               nsa->sa_initial = ber_bvstr( UTF8normalize( sa->sa_initial, casefold ) );
-               if( nsa->sa_initial == NULL ) {
+       if( sa->sa_initial.bv_val != NULL ) {
+               ber_str2bv( UTF8normalize( &sa->sa_initial, casefold ), 0,
+                       0, &nsa->sa_initial );
+               if( nsa->sa_initial.bv_val == NULL ) {
                        goto err;
                }
        }
 
        if( sa->sa_any != NULL ) {
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
                        /* empty */
                }
-               nsa->sa_any = (struct berval **)ch_malloc( (i + 1) * sizeof(struct berval *) );
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       nsa->sa_any[i] = ber_bvstr( UTF8normalize( sa->sa_any[i], casefold ) );
-                       if( nsa->sa_any[i] == NULL ) {
+               nsa->sa_any = (struct berval *)ch_malloc( (i + 1) * sizeof(struct berval) );
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       ber_str2bv( UTF8normalize( &sa->sa_any[i], casefold ),
+                               0, 0, &nsa->sa_any[i] );
+                       if( nsa->sa_any[i].bv_val == NULL ) {
                                goto err;
                        }
                }
-               nsa->sa_any[i] = NULL;
+               nsa->sa_any[i].bv_val = NULL;
        }
 
-       if( sa->sa_final != NULL ) {
-               nsa->sa_final = ber_bvstr( UTF8normalize( sa->sa_final, casefold ) );
-               if( nsa->sa_final == NULL ) {
+       if( sa->sa_final.bv_val != NULL ) {
+               ber_str2bv( UTF8normalize( &sa->sa_final, casefold ), 0,
+                       0, &nsa->sa_final );
+               if( nsa->sa_final.bv_val == NULL ) {
                        goto err;
                }
        }
@@ -995,15 +611,15 @@ UTF8SubstringsassertionNormalize(
        return nsa;
 
 err:
-       ber_bvfree( nsa->sa_final );
-       ber_bvecfree( nsa->sa_any );
-       ber_bvfree( nsa->sa_initial );
+       if ( nsa->sa_final.bv_val ) free( nsa->sa_final.bv_val );
+       if ( nsa->sa_any )bvarray_free( nsa->sa_any );
+       if ( nsa->sa_initial.bv_val ) free( nsa->sa_initial.bv_val );
        ch_free( nsa );
        return NULL;
 }
 
 /* Strip characters with the 8th bit set */
-char *
+static char *
 strip8bitChars(
        char *in )      
 {
@@ -1018,7 +634,7 @@ strip8bitChars(
                        while( *++q & 0x80 ) {
                                /* empty */
                        }
-                       p = memmove(p, q, strlen(q) + 1);
+                       p = AC_MEMCPY(p, q, strlen(q) + 1);
                } else {
                        p++;
                }
@@ -1050,7 +666,7 @@ approxMatch(
        size_t avlen;
 
        /* Yes, this is necessary */
-       nval = UTF8normalize( value, UTF8_NOCASEFOLD );
+       nval = UTF8normalize( value, LDAP_UTF8_NOCASEFOLD );
        if( nval == NULL ) {
                *matchp = 1;
                return LDAP_SUCCESS;
@@ -1059,7 +675,7 @@ approxMatch(
 
        /* Yes, this is necessary */
        assertv = UTF8normalize( ((struct berval *)assertedValue),
-                                UTF8_NOCASEFOLD );
+               LDAP_UTF8_NOCASEFOLD );
        if( assertv == NULL ) {
                ch_free( nval );
                *matchp = 1;
@@ -1087,7 +703,7 @@ approxMatch(
        /* Work through the asserted value's words, to see if at least some
           of the words are there, in the same order. */
        len = 0;
-       while ( nextchunk < avlen ) {
+       while ( (size_t) nextchunk < avlen ) {
                len = strcspn( assertv + nextchunk, SLAPD_APPROX_DELIMITER);
                if( len == 0 ) {
                        nextchunk++;
@@ -1148,23 +764,24 @@ approxMatch(
        return LDAP_SUCCESS;
 }
 
-int 
+static int 
 approxIndexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        char *val, *c;
        int i,j, len, wordcount, keycount=0;
-       struct berval **newkeys, **keys=NULL;
+       struct berval *newkeys;
+       BVarray keys=NULL;
 
-       for( j=0; values[j] != NULL; j++ ) {
+       for( j=0; values[j].bv_val != NULL; j++ ) {
                /* Yes, this is necessary */
-               val = UTF8normalize( values[j], UTF8_NOCASEFOLD );
+               val = UTF8normalize( &values[j], LDAP_UTF8_NOCASEFOLD );
                strip8bitChars( val );
 
                /* Isolate how many words there are. There will be a key for each */
@@ -1177,9 +794,9 @@ approxIndexer(
                }
 
                /* Allocate/increase storage to account for new keys */
-               newkeys = (struct berval **)ch_malloc( (keycount + wordcount + 1) 
-                       * sizeof(struct berval *) );
-               memcpy( newkeys, keys, keycount * sizeof(struct berval *) );
+               newkeys = (struct berval *)ch_malloc( (keycount + wordcount + 1) 
+                       * sizeof(struct berval) );
+               AC_MEMCPY( newkeys, keys, keycount * sizeof(struct berval) );
                if( keys ) ch_free( keys );
                keys = newkeys;
 
@@ -1187,22 +804,20 @@ approxIndexer(
                for( c=val,i=0;  i<wordcount;  c+=len+1  ) {
                        len = strlen( c );
                        if( len < SLAPD_APPROX_WORDLEN ) continue;
-                       keys[keycount] = (struct berval *)ch_malloc( sizeof(struct berval) );
-                       keys[keycount]->bv_val = phonetic( c );
-                       keys[keycount]->bv_len = strlen( keys[keycount]->bv_val );
+                       ber_str2bv( phonetic( c ), 0, 0, &keys[keycount] );
                        keycount++;
                        i++;
                }
 
                free( val );
        }
-       keys[keycount] = NULL;
+       keys[keycount].bv_val = NULL;
        *keysp = keys;
 
        return LDAP_SUCCESS;
 }
 
-int 
+static int 
 approxFilter(
        slap_mask_t use,
        slap_mask_t flags,
@@ -1210,18 +825,18 @@ approxFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        char *val, *c;
        int i, count, len;
-       struct berval **keys;
+       BVarray keys;
 
        /* Yes, this is necessary */
        val = UTF8normalize( ((struct berval *)assertValue),
-                            UTF8_NOCASEFOLD );
+               LDAP_UTF8_NOCASEFOLD );
        if( val == NULL ) {
-               keys = (struct berval **)ch_malloc( sizeof(struct berval *) );
-               keys[0] = NULL;
+               keys = (struct berval *)ch_malloc( sizeof(struct berval) );
+               keys[0].bv_val = NULL;
                *keysp = keys;
                return LDAP_SUCCESS;
        }
@@ -1237,19 +852,19 @@ approxFilter(
        }
 
        /* Allocate storage for new keys */
-       keys = (struct berval **)ch_malloc( (count + 1) * sizeof(struct berval *) );
+       keys = (struct berval *)ch_malloc( (count + 1) * sizeof(struct berval) );
 
        /* Get a phonetic copy of each word */
        for( c=val,i=0;  i<count; c+=len+1 ) {
                len = strlen(c);
                if( len < SLAPD_APPROX_WORDLEN ) continue;
-               keys[i] = ber_bvstr( phonetic( c ) );
+               ber_str2bv( phonetic( c ), 0, 0, &keys[i] );
                i++;
        }
 
        free( val );
 
-       keys[count] = NULL;
+       keys[count].bv_val = NULL;
        *keysp = keys;
 
        return LDAP_SUCCESS;
@@ -1301,46 +916,46 @@ approxMatch(
        return LDAP_SUCCESS;
 }
 
-int 
+static int 
 approxIndexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
-       struct berval **keys;
+       BVarray *keys;
        char *s;
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty - just count them */
        }
 
        /* we should have at least one value at this point */
        assert( i > 0 );
 
-       keys = (struct berval **)ch_malloc( sizeof( struct berval * ) * (i+1) );
+       keys = (struct berval *)ch_malloc( sizeof( struct berval ) * (i+1) );
 
        /* Copy each value and run it through phonetic() */
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* Yes, this is necessary */
-               s = UTF8normalize( values[i], UTF8_NOCASEFOLD );
+               s = UTF8normalize( &values[i], UTF8_NOCASEFOLD );
 
                /* strip 8-bit chars and run through phonetic() */
-               keys[i] = ber_bvstr( phonetic( strip8bitChars( s ) ) );
+               ber_str2bv( phonetic( strip8bitChars( s ) ), 0, 0, &keys[i] );
                free( s );
        }
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
 
        *keysp = keys;
        return LDAP_SUCCESS;
 }
 
 
-int 
+static int 
 approxFilter(
        slap_mask_t use,
        slap_mask_t flags,
@@ -1348,12 +963,12 @@ approxFilter(
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
-       struct berval **keys;
+       BVarray keys;
        char *s;
 
-       keys = (struct berval **)ch_malloc( sizeof( struct berval * ) * 2 );
+       keys = (struct berval *)ch_malloc( sizeof( struct berval * ) * 2 );
 
        /* Yes, this is necessary */
        s = UTF8normalize( ((struct berval *)assertValue),
@@ -1384,7 +999,7 @@ caseExactMatch(
 {
        *matchp = UTF8normcmp( value->bv_val,
                ((struct berval *) assertedValue)->bv_val,
-               UTF8_NOCASEFOLD );
+               LDAP_UTF8_NOCASEFOLD );
        return LDAP_SUCCESS;
 }
 
@@ -1402,10 +1017,11 @@ caseExactIgnoreSubstringsMatch(
        struct berval left;
        int i;
        ber_len_t inlen=0;
-       char *nav, casefold;
+       char *nav;
+       unsigned casefold;
 
        casefold = strcmp( mr->smr_oid, caseExactSubstringsMatchOID )
-               ? UTF8_CASEFOLD : UTF8_NOCASEFOLD;
+               ? LDAP_UTF8_CASEFOLD : LDAP_UTF8_NOCASEFOLD;
 
        nav = UTF8normalize( value, casefold );
        if( nav == NULL ) {
@@ -1422,56 +1038,56 @@ caseExactIgnoreSubstringsMatch(
        }
 
        /* Add up asserted input length */
-       if( sub->sa_initial ) {
-               inlen += sub->sa_initial->bv_len;
+       if( sub->sa_initial.bv_val ) {
+               inlen += sub->sa_initial.bv_len;
        }
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i] != NULL; i++) {
-                       inlen += sub->sa_any[i]->bv_len;
+               for(i=0; sub->sa_any[i].bv_val != NULL; i++) {
+                       inlen += sub->sa_any[i].bv_len;
                }
        }
-       if( sub->sa_final ) {
-               inlen += sub->sa_final->bv_len;
+       if( sub->sa_final.bv_val ) {
+               inlen += sub->sa_final.bv_len;
        }
 
-       if( sub->sa_initial ) {
+       if( sub->sa_initial.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncmp( sub->sa_initial->bv_val, left.bv_val,
-                       sub->sa_initial->bv_len );
+               match = strncmp( sub->sa_initial.bv_val, left.bv_val,
+                       sub->sa_initial.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_val += sub->sa_initial->bv_len;
-               left.bv_len -= sub->sa_initial->bv_len;
-               inlen -= sub->sa_initial->bv_len;
+               left.bv_val += sub->sa_initial.bv_len;
+               left.bv_len -= sub->sa_initial.bv_len;
+               inlen -= sub->sa_initial.bv_len;
        }
 
-       if( sub->sa_final ) {
+       if( sub->sa_final.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncmp( sub->sa_final->bv_val,
-                       &left.bv_val[left.bv_len - sub->sa_final->bv_len],
-                       sub->sa_final->bv_len );
+               match = strncmp( sub->sa_final.bv_val,
+                       &left.bv_val[left.bv_len - sub->sa_final.bv_len],
+                       sub->sa_final.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_len -= sub->sa_final->bv_len;
-               inlen -= sub->sa_final->bv_len;
+               left.bv_len -= sub->sa_final.bv_len;
+               inlen -= sub->sa_final.bv_len;
        }
 
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i]; i++) {
+               for(i=0; sub->sa_any[i].bv_val; i++) {
                        ber_len_t idx;
                        char *p;
 
@@ -1482,11 +1098,11 @@ retry:
                                goto done;
                        }
 
-                       if( sub->sa_any[i]->bv_len == 0 ) {
+                       if( sub->sa_any[i].bv_len == 0 ) {
                                continue;
                        }
 
-                       p = strchr( left.bv_val, *sub->sa_any[i]->bv_val );
+                       p = strchr( left.bv_val, *sub->sa_any[i].bv_val );
 
                        if( p == NULL ) {
                                match = 1;
@@ -1499,9 +1115,12 @@ retry:
                        if( idx >= left.bv_len ) {
                                /* this shouldn't happen */
                                free( nav );
-                               ch_free( sub->sa_final );
-                               ber_bvecfree( sub->sa_any );
-                               ch_free( sub->sa_initial );
+                               if ( sub->sa_final.bv_val )
+                                       ch_free( sub->sa_final.bv_val );
+                               if ( sub->sa_any )
+                                       bvarray_free( sub->sa_any );
+                               if ( sub->sa_initial.bv_val )
+                                       ch_free( sub->sa_initial.bv_val );
                                ch_free( sub );
                                return LDAP_OTHER;
                        }
@@ -1509,15 +1128,15 @@ retry:
                        left.bv_val = p;
                        left.bv_len -= idx;
 
-                       if( sub->sa_any[i]->bv_len > left.bv_len ) {
+                       if( sub->sa_any[i].bv_len > left.bv_len ) {
                                /* not enough left */
                                match = 1;
                                goto done;
                        }
 
                        match = strncmp( left.bv_val,
-                               sub->sa_any[i]->bv_val,
-                               sub->sa_any[i]->bv_len );
+                               sub->sa_any[i].bv_val,
+                               sub->sa_any[i].bv_len );
 
                        if( match != 0 ) {
                                left.bv_val++;
@@ -1525,18 +1144,18 @@ retry:
                                goto retry;
                        }
 
-                       left.bv_val += sub->sa_any[i]->bv_len;
-                       left.bv_len -= sub->sa_any[i]->bv_len;
-                       inlen -= sub->sa_any[i]->bv_len;
+                       left.bv_val += sub->sa_any[i].bv_len;
+                       left.bv_len -= sub->sa_any[i].bv_len;
+                       inlen -= sub->sa_any[i].bv_len;
                }
        }
 
 done:
        free( nav );
        if( sub != NULL ) {
-               ber_bvfree( sub->sa_final );
-               ber_bvecfree( sub->sa_any );
-               ber_bvfree( sub->sa_initial );
+               if ( sub->sa_final.bv_val ) free( sub->sa_final.bv_val );
+               if ( sub->sa_any ) bvarray_free( sub->sa_any );
+               if ( sub->sa_initial.bv_val ) free( sub->sa_initial.bv_val );
                ch_free( sub );
        }
        *matchp = match;
@@ -1544,44 +1163,44 @@ done:
 }
 
 /* Index generation function */
-int caseExactIgnoreIndexer(
+static int caseExactIgnoreIndexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
-       char casefold;
+       unsigned casefold;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty - just count them */
        }
 
        /* we should have at least one value at this point */
        assert( i > 0 );
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        casefold = strcmp( mr->smr_oid, caseExactMatchOID )
-               ? UTF8_CASEFOLD : UTF8_NOCASEFOLD;
+               ? LDAP_UTF8_CASEFOLD : LDAP_UTF8_NOCASEFOLD;
 
-       for( i=0; values[i] != NULL; i++ ) {
-               struct berval *value;
-               value = ber_bvstr( UTF8normalize( values[i],
-                       casefold ) );
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               struct berval value;
+               ber_str2bv( UTF8normalize( &values[i], casefold ), 0, 0,
+                       &value );
 
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -1593,55 +1212,55 @@ int caseExactIgnoreIndexer(
                HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
                HASH_Update( &HASHcontext,
-                       value->bv_val, value->bv_len );
+                       value.bv_val, value.bv_len );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               ber_bvfree( value );
+               free( value.bv_val );
 
-               keys[i] = ber_bvdup( &digest );
+               ber_dupbv( &keys[i], &digest );
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
        *keysp = keys;
        return LDAP_SUCCESS;
 }
 
 /* Index generation function */
-int caseExactIgnoreFilter(
+static int caseExactIgnoreFilter(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
-       char casefold;
+       unsigned casefold;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
-       struct berval *value;
+       struct berval value;
        struct berval digest;
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        casefold = strcmp( mr->smr_oid, caseExactMatchOID )
-               ? UTF8_CASEFOLD : UTF8_NOCASEFOLD;
+               ? LDAP_UTF8_CASEFOLD : LDAP_UTF8_NOCASEFOLD;
 
-       value = ber_bvstr( UTF8normalize( ((struct berval *) assertValue),
-               casefold ) );
+       ber_str2bv( UTF8normalize( ((struct berval *) assertValue), casefold ),
+               0, 0, &value );
        /* This usually happens if filter contains bad UTF8 */
-       if( value == NULL ) {
-               keys = ch_malloc( sizeof( struct berval ) );
-               keys[0] = NULL;
+       if( value.bv_val == NULL ) {
+               keys = ch_malloc( sizeof( struct berval ) );
+               keys[0].bv_val = NULL;
                return LDAP_SUCCESS;
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
 
        HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -1653,33 +1272,33 @@ int caseExactIgnoreFilter(
        HASH_Update( &HASHcontext,
                mr->smr_oid, mlen );
        HASH_Update( &HASHcontext,
-               value->bv_val, value->bv_len );
+               value.bv_val, value.bv_len );
        HASH_Final( HASHdigest, &HASHcontext );
 
-       keys[0] = ber_bvdup( &digest );
-       keys[1] = NULL;
+       ber_dupbv( keys, &digest );
+       keys[1].bv_val = NULL;
 
-       ber_bvfree( value );
+       free( value.bv_val );
 
        *keysp = keys;
        return LDAP_SUCCESS;
 }
 
 /* Substrings Index generation function */
-int caseExactIgnoreSubstringsIndexer(
+static int caseExactIgnoreSubstringsIndexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
-       char casefold;
+       unsigned casefold;
        ber_len_t i, nkeys;
        size_t slen, mlen;
-       struct berval **keys;
-       struct berval **nvalues;
+       BVarray keys;
+       BVarray nvalues;
 
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
@@ -1689,7 +1308,7 @@ int caseExactIgnoreSubstringsIndexer(
 
        nkeys=0;
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty - just count them */
        }
 
@@ -1697,43 +1316,43 @@ int caseExactIgnoreSubstringsIndexer(
        assert( i > 0 );
 
        casefold = strcmp( mr->smr_oid, caseExactSubstringsMatchOID )
-               ? UTF8_CASEFOLD : UTF8_NOCASEFOLD;
+               ? LDAP_UTF8_CASEFOLD : LDAP_UTF8_NOCASEFOLD;
 
-       nvalues = ch_malloc( sizeof( struct berval ) * (i+1) );
-       for( i=0; values[i] != NULL; i++ ) {
-               nvalues[i] = ber_bvstr( UTF8normalize( values[i],
-                       casefold ) );
+       nvalues = ch_malloc( sizeof( struct berval ) * (i+1) );
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               ber_str2bv( UTF8normalize( &values[i], casefold ),
+                       0, 0, &nvalues[i] );
        }
-       nvalues[i] = NULL;
+       nvalues[i].bv_val = NULL;
        values = nvalues;
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* count number of indices to generate */
-               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
+               if( values[i].bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
                        continue;
                }
 
                if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_ANY ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
        }
@@ -1741,29 +1360,26 @@ int caseExactIgnoreSubstringsIndexer(
        if( nkeys == 0 ) {
                /* no keys to generate */
                *keysp = NULL;
-               ber_bvecfree( nvalues );
+               bvarray_free( nvalues );
                return LDAP_SUCCESS;
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        nkeys=0;
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                ber_len_t j,max;
-               struct berval *value;
-
-               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
 
-               value = values[i];
+               if( values[i].bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
 
                if( ( flags & SLAP_INDEX_SUBSTR_ANY ) &&
-                       ( value->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) )
+                       ( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) )
                {
                        char pre = SLAP_INDEX_SUBSTR_PREFIX;
-                       max = value->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
+                       max = values[i].bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
 
                        for( j=0; j<max; j++ ) {
                                HASH_Init( &HASHcontext );
@@ -1779,16 +1395,16 @@ int caseExactIgnoreSubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       &value->bv_val[j],
+                                       &values[i].bv_val[j],
                                        SLAP_INDEX_SUBSTR_MAXLEN );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
                }
 
-               max = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
-                       ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
+               max = SLAP_INDEX_SUBSTR_MAXLEN < values[i].bv_len
+                       ? SLAP_INDEX_SUBSTR_MAXLEN : values[i].bv_len;
 
                for( j=SLAP_INDEX_SUBSTR_MINLEN; j<=max; j++ ) {
                        char pre;
@@ -1807,10 +1423,10 @@ int caseExactIgnoreSubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       value->bv_val, j );
+                                       values[i].bv_val, j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                        if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
@@ -1827,10 +1443,10 @@ int caseExactIgnoreSubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       &value->bv_val[value->bv_len-j], j );
+                                       &values[i].bv_val[values[i].bv_len-j], j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                }
@@ -1838,39 +1454,40 @@ int caseExactIgnoreSubstringsIndexer(
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
                *keysp = NULL;
        }
 
-       ber_bvecfree( nvalues );
+       bvarray_free( nvalues );
 
        return LDAP_SUCCESS;
 }
 
-int caseExactIgnoreSubstringsFilter(
+static int caseExactIgnoreSubstringsFilter(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        SubstringsAssertion *sa;
-       char pre, casefold;
+       char pre;
+       unsigned casefold;
        ber_len_t nkeys = 0;
        size_t slen, mlen, klen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
 
        casefold = strcmp( mr->smr_oid, caseExactSubstringsMatchOID )
-               ? UTF8_CASEFOLD : UTF8_NOCASEFOLD;
+               ? LDAP_UTF8_CASEFOLD : LDAP_UTF8_NOCASEFOLD;
 
        sa = UTF8SubstringsassertionNormalize( assertValue, casefold );
        if( sa == NULL ) {
@@ -1878,33 +1495,33 @@ int caseExactIgnoreSubstringsFilter(
                return LDAP_SUCCESS;
        }
 
-       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
 
        if( flags & SLAP_INDEX_SUBSTR_ANY && sa->sa_any != NULL ) {
                ber_len_t i;
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                /* don't bother accounting for stepping */
-                               nkeys += sa->sa_any[i]->bv_len -
+                               nkeys += sa->sa_any[i].bv_len -
                                        ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
        }
 
-       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
 
        if( nkeys == 0 ) {
-               ber_bvfree( sa->sa_final );
-               ber_bvecfree( sa->sa_any );
-               ber_bvfree( sa->sa_initial );
+               if ( sa->sa_final.bv_val ) free( sa->sa_final.bv_val );
+               if ( sa->sa_any ) bvarray_free( sa->sa_any );
+               if ( sa->sa_initial.bv_val ) free( sa->sa_initial.bv_val );
                ch_free( sa );
                *keysp = NULL;
                return LDAP_SUCCESS;
@@ -1913,17 +1530,17 @@ int caseExactIgnoreSubstringsFilter(
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
        nkeys = 0;
 
-       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
-               value = sa->sa_initial;
+               value = &sa->sa_initial;
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
@@ -1943,7 +1560,7 @@ int caseExactIgnoreSubstringsFilter(
                        value->bv_val, klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[nkeys++] = ber_bvdup( &digest );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if( flags & SLAP_INDEX_SUBSTR_ANY && sa->sa_any != NULL ) {
@@ -1951,12 +1568,12 @@ int caseExactIgnoreSubstringsFilter(
                pre = SLAP_INDEX_SUBSTR_PREFIX;
                klen = SLAP_INDEX_SUBSTR_MAXLEN;
 
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
                                continue;
                        }
 
-                       value = sa->sa_any[i];
+                       value = &sa->sa_any[i];
 
                        for(j=0;
                                j <= value->bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
@@ -1977,17 +1594,17 @@ int caseExactIgnoreSubstringsFilter(
                                        &value->bv_val[j], klen ); 
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                }
        }
 
-       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
-               value = sa->sa_final;
+               value = &sa->sa_final;
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
@@ -2007,19 +1624,19 @@ int caseExactIgnoreSubstringsFilter(
                        &value->bv_val[value->bv_len-klen], klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[nkeys++] = ber_bvdup( &digest );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
                *keysp = NULL;
        }
-       ber_bvfree( sa->sa_final );
-       ber_bvecfree( sa->sa_any );
-       ber_bvfree( sa->sa_initial );
+       if ( sa->sa_final.bv_val ) free( sa->sa_final.bv_val );
+       if ( sa->sa_any ) bvarray_free( sa->sa_any );
+       if ( sa->sa_initial.bv_val ) free( sa->sa_initial.bv_val );
        ch_free( sa );
 
        return LDAP_SUCCESS;
@@ -2036,7 +1653,7 @@ caseIgnoreMatch(
 {
        *matchp = UTF8normcmp( value->bv_val,
                ((struct berval *) assertedValue)->bv_val,
-               UTF8_CASEFOLD );
+               LDAP_UTF8_CASEFOLD );
        return LDAP_SUCCESS;
 }
        
@@ -2197,11 +1814,10 @@ static int
 integerNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
        char *p;
        int negative=0;
-       struct berval *newval;
        ber_len_t len;
 
 
@@ -2229,73 +1845,70 @@ integerNormalize(
                len--;
        }
 
-       newval = (struct berval *) ch_malloc( sizeof(struct berval) );
-
        /* If there are no non-zero digits left, the number is zero, otherwise
           allocate space for the number and copy it into the buffer */
        if( len == 0 ) {
-               newval->bv_val = ch_strdup("0");
-               newval->bv_len = 1;
+               normalized->bv_val = ch_strdup("0");
+               normalized->bv_len = 1;
        }
        else {
-               newval->bv_len = len+negative;
-               newval->bv_val = ch_malloc( newval->bv_len );
+               normalized->bv_len = len+negative;
+               normalized->bv_val = ch_malloc( normalized->bv_len );
                if( negative ) {
-                       newval->bv_val[0] = '-';
+                       normalized->bv_val[0] = '-';
                }
-               memcpy( newval->bv_val + negative, p, len );
+               AC_MEMCPY( normalized->bv_val + negative, p, len );
        }
 
-       *normalized = newval;
        return LDAP_SUCCESS;
 }
 
 /* Index generation function */
-int integerIndexer(
+static int integerIndexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
-       struct berval **keys;
+       BVarray keys;
 
        /* we should have at least one value at this point */
-       assert( values != NULL && values[0] != NULL );
+       assert( values != NULL && values[0].bv_val != NULL );
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty -- just count them */
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       for( i=0; values[i] != NULL; i++ ) {
-               integerNormalize( syntax, values[i], &keys[i] );
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               integerNormalize( syntax, &values[i], &keys[i] );
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
        *keysp = keys;
        return LDAP_SUCCESS;
 }
 
 /* Index generation function */
-int integerFilter(
+static int integerFilter(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
-       struct berval **keys;
+       BVarray keys;
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
        integerNormalize( syntax, assertValue, &keys[0] );
-       keys[1] = NULL;
+       keys[1].bv_val = NULL;
        *keysp = keys;
 
        return LDAP_SUCCESS;
@@ -2326,8 +1939,6 @@ printableStringValidate(
 {
        ber_len_t i;
 
-       if( !val->bv_len ) return LDAP_INVALID_SYNTAX;
-
        for(i=0; i < val->bv_len; i++) {
                if( !SLAP_PRINTABLE(val->bv_val[i]) ) {
                        return LDAP_INVALID_SYNTAX;
@@ -2344,8 +1955,6 @@ printablesStringValidate(
 {
        ber_len_t i;
 
-       if( !val->bv_len ) return LDAP_INVALID_SYNTAX;
-
        for(i=0; i < val->bv_len; i++) {
                if( !SLAP_PRINTABLES(val->bv_val[i]) ) {
                        return LDAP_INVALID_SYNTAX;
@@ -2362,10 +1971,10 @@ IA5StringValidate(
 {
        ber_len_t i;
 
-       if( !val->bv_len ) return LDAP_INVALID_SYNTAX;
-
        for(i=0; i < val->bv_len; i++) {
-               if( !isascii(val->bv_val[i]) ) return LDAP_INVALID_SYNTAX;
+               if( !LDAP_ASCII(val->bv_val[i]) ) {
+                       return LDAP_INVALID_SYNTAX;
+               }
        }
 
        return LDAP_SUCCESS;
@@ -2375,13 +1984,10 @@ static int
 IA5StringNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
-       struct berval *newval;
        char *p, *q;
 
-       newval = ch_malloc( sizeof( struct berval ) );
-
        p = val->bv_val;
 
        /* Ignore initial whitespace */
@@ -2389,13 +1995,8 @@ IA5StringNormalize(
                p++;
        }
 
-       if( *p == '\0' ) {
-               ch_free( newval );
-               return LDAP_INVALID_SYNTAX;
-       }
-
-       newval->bv_val = ch_strdup( p );
-       p = q = newval->bv_val;
+       normalized->bv_val = ch_strdup( p );
+       p = q = normalized->bv_val;
 
        while ( *p ) {
                if ( ASCII_SPACE( *p ) ) {
@@ -2410,13 +2011,9 @@ IA5StringNormalize(
                }
        }
 
-       assert( *newval->bv_val );
-       assert( newval->bv_val < p );
+       assert( normalized->bv_val <= p );
        assert( q <= p );
 
-       /* cannot start with a space */
-       assert( !ASCII_SPACE(*newval->bv_val) );
-
        /*
         * If the string ended in space, backup the pointer one
         * position.  One is enough because the above loop collapsed
@@ -2427,14 +2024,10 @@ IA5StringNormalize(
                --q;
        }
 
-       /* cannot end with a space */
-       assert( !ASCII_SPACE( q[-1] ) );
-
        /* null terminate */
        *q = '\0';
 
-       newval->bv_len = q - newval->bv_val;
-       *normalized = newval;
+       normalized->bv_len = q - normalized->bv_val;
 
        return LDAP_SUCCESS;
 }
@@ -2476,56 +2069,56 @@ caseExactIA5SubstringsMatch(
        ber_len_t inlen=0;
 
        /* Add up asserted input length */
-       if( sub->sa_initial ) {
-               inlen += sub->sa_initial->bv_len;
+       if( sub->sa_initial.bv_val ) {
+               inlen += sub->sa_initial.bv_len;
        }
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i] != NULL; i++) {
-                       inlen += sub->sa_any[i]->bv_len;
+               for(i=0; sub->sa_any[i].bv_val != NULL; i++) {
+                       inlen += sub->sa_any[i].bv_len;
                }
        }
-       if( sub->sa_final ) {
-               inlen += sub->sa_final->bv_len;
+       if( sub->sa_final.bv_val ) {
+               inlen += sub->sa_final.bv_len;
        }
 
-       if( sub->sa_initial ) {
+       if( sub->sa_initial.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncmp( sub->sa_initial->bv_val, left.bv_val,
-                       sub->sa_initial->bv_len );
+               match = strncmp( sub->sa_initial.bv_val, left.bv_val,
+                       sub->sa_initial.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_val += sub->sa_initial->bv_len;
-               left.bv_len -= sub->sa_initial->bv_len;
-               inlen -= sub->sa_initial->bv_len;
+               left.bv_val += sub->sa_initial.bv_len;
+               left.bv_len -= sub->sa_initial.bv_len;
+               inlen -= sub->sa_initial.bv_len;
        }
 
-       if( sub->sa_final ) {
+       if( sub->sa_final.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncmp( sub->sa_final->bv_val,
-                       &left.bv_val[left.bv_len - sub->sa_final->bv_len],
-                       sub->sa_final->bv_len );
+               match = strncmp( sub->sa_final.bv_val,
+                       &left.bv_val[left.bv_len - sub->sa_final.bv_len],
+                       sub->sa_final.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_len -= sub->sa_final->bv_len;
-               inlen -= sub->sa_final->bv_len;
+               left.bv_len -= sub->sa_final.bv_len;
+               inlen -= sub->sa_final.bv_len;
        }
 
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i]; i++) {
+               for(i=0; sub->sa_any[i].bv_val; i++) {
                        ber_len_t idx;
                        char *p;
 
@@ -2536,11 +2129,11 @@ retry:
                                goto done;
                        }
 
-                       if( sub->sa_any[i]->bv_len == 0 ) {
+                       if( sub->sa_any[i].bv_len == 0 ) {
                                continue;
                        }
 
-                       p = strchr( left.bv_val, *sub->sa_any[i]->bv_val );
+                       p = strchr( left.bv_val, *sub->sa_any[i].bv_val );
 
                        if( p == NULL ) {
                                match = 1;
@@ -2558,15 +2151,15 @@ retry:
                        left.bv_val = p;
                        left.bv_len -= idx;
 
-                       if( sub->sa_any[i]->bv_len > left.bv_len ) {
+                       if( sub->sa_any[i].bv_len > left.bv_len ) {
                                /* not enough left */
                                match = 1;
                                goto done;
                        }
 
                        match = strncmp( left.bv_val,
-                               sub->sa_any[i]->bv_val,
-                               sub->sa_any[i]->bv_len );
+                               sub->sa_any[i].bv_val,
+                               sub->sa_any[i].bv_len );
 
                        if( match != 0 ) {
                                left.bv_val++;
@@ -2574,9 +2167,9 @@ retry:
                                goto retry;
                        }
 
-                       left.bv_val += sub->sa_any[i]->bv_len;
-                       left.bv_len -= sub->sa_any[i]->bv_len;
-                       inlen -= sub->sa_any[i]->bv_len;
+                       left.bv_val += sub->sa_any[i].bv_len;
+                       left.bv_len -= sub->sa_any[i].bv_len;
+                       inlen -= sub->sa_any[i].bv_len;
                }
        }
 
@@ -2586,38 +2179,38 @@ done:
 }
 
 /* Index generation function */
-int caseExactIA5Indexer(
+static int caseExactIA5Indexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty - just count them */
        }
 
        /* we should have at least one value at this point */
        assert( i > 0 );
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       for( i=0; values[i] != NULL; i++ ) {
-               struct berval *value = values[i];
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               struct berval *value = &values[i];
 
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -2632,26 +2225,26 @@ int caseExactIA5Indexer(
                        value->bv_val, value->bv_len );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[i] = ber_bvdup( &digest );
+               ber_dupbv( &keys[i], &digest );
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
        *keysp = keys;
        return LDAP_SUCCESS;
 }
 
 /* Index generation function */
-int caseExactIA5Filter(
+static int caseExactIA5Filter(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
@@ -2659,12 +2252,12 @@ int caseExactIA5Filter(
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        value = (struct berval *) assertValue;
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
 
        HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -2679,26 +2272,26 @@ int caseExactIA5Filter(
                value->bv_val, value->bv_len );
        HASH_Final( HASHdigest, &HASHcontext );
 
-       keys[0] = ber_bvdup( &digest );
-       keys[1] = NULL;
+       ber_dupbv( &keys[0], &digest );
+       keys[1].bv_val = NULL;
 
        *keysp = keys;
        return LDAP_SUCCESS;
 }
 
 /* Substrings Index generation function */
-int caseExactIA5SubstringsIndexer(
+static int caseExactIA5SubstringsIndexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        ber_len_t i, nkeys;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
@@ -2706,36 +2299,36 @@ int caseExactIA5SubstringsIndexer(
        digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
-       assert( values != NULL && values[0] != NULL );
+       assert( values != NULL && values[0].bv_val != NULL );
 
        nkeys=0;
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* count number of indices to generate */
-               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
+               if( values[i].bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
                        continue;
                }
 
                if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_ANY ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
        }
@@ -2746,17 +2339,17 @@ int caseExactIA5SubstringsIndexer(
                return LDAP_SUCCESS;
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        nkeys=0;
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                ber_len_t j,max;
                struct berval *value;
 
-               value = values[i];
+               value = &values[i];
                if( value->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
 
                if( ( flags & SLAP_INDEX_SUBSTR_ANY ) &&
@@ -2783,7 +2376,7 @@ int caseExactIA5SubstringsIndexer(
                                        SLAP_INDEX_SUBSTR_MAXLEN );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
                }
 
@@ -2810,7 +2403,7 @@ int caseExactIA5SubstringsIndexer(
                                        value->bv_val, j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                        if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
@@ -2830,14 +2423,14 @@ int caseExactIA5SubstringsIndexer(
                                        &value->bv_val[value->bv_len-j], j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                }
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
@@ -2847,44 +2440,44 @@ int caseExactIA5SubstringsIndexer(
        return LDAP_SUCCESS;
 }
 
-int caseExactIA5SubstringsFilter(
+static int caseExactIA5SubstringsFilter(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        SubstringsAssertion *sa = assertValue;
        char pre;
        ber_len_t nkeys = 0;
        size_t slen, mlen, klen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval *value;
        struct berval digest;
 
-       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
 
        if( flags & SLAP_INDEX_SUBSTR_ANY && sa->sa_any != NULL ) {
                ber_len_t i;
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                /* don't bother accounting for stepping */
-                               nkeys += sa->sa_any[i]->bv_len -
+                               nkeys += sa->sa_any[i].bv_len -
                                        ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
        }
 
-       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
@@ -2897,17 +2490,17 @@ int caseExactIA5SubstringsFilter(
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
        nkeys = 0;
 
-       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_INITIAL && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
-               value = sa->sa_initial;
+               value = &sa->sa_initial;
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
@@ -2927,7 +2520,7 @@ int caseExactIA5SubstringsFilter(
                        value->bv_val, klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[nkeys++] = ber_bvdup( &digest );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if( flags & SLAP_INDEX_SUBSTR_ANY && sa->sa_any != NULL ) {
@@ -2935,12 +2528,12 @@ int caseExactIA5SubstringsFilter(
                pre = SLAP_INDEX_SUBSTR_PREFIX;
                klen = SLAP_INDEX_SUBSTR_MAXLEN;
 
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
                                continue;
                        }
 
-                       value = sa->sa_any[i];
+                       value = &sa->sa_any[i];
 
                        for(j=0;
                                j <= value->bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
@@ -2961,16 +2554,16 @@ int caseExactIA5SubstringsFilter(
                                        &value->bv_val[j], klen ); 
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
                }
        }
 
-       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if( flags & SLAP_INDEX_SUBSTR_FINAL && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
-               value = sa->sa_final;
+               value = &sa->sa_final;
 
                klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
                        ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
@@ -2990,11 +2583,11 @@ int caseExactIA5SubstringsFilter(
                        &value->bv_val[value->bv_len-klen], klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               keys[nkeys++] = ber_bvdup( &digest );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
@@ -3041,56 +2634,56 @@ caseIgnoreIA5SubstringsMatch(
        ber_len_t inlen=0;
 
        /* Add up asserted input length */
-       if( sub->sa_initial ) {
-               inlen += sub->sa_initial->bv_len;
+       if( sub->sa_initial.bv_val ) {
+               inlen += sub->sa_initial.bv_len;
        }
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i] != NULL; i++) {
-                       inlen += sub->sa_any[i]->bv_len;
+               for(i=0; sub->sa_any[i].bv_val != NULL; i++) {
+                       inlen += sub->sa_any[i].bv_len;
                }
        }
-       if( sub->sa_final ) {
-               inlen += sub->sa_final->bv_len;
+       if( sub->sa_final.bv_val ) {
+               inlen += sub->sa_final.bv_len;
        }
 
-       if( sub->sa_initial ) {
+       if( sub->sa_initial.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncasecmp( sub->sa_initial->bv_val, left.bv_val,
-                       sub->sa_initial->bv_len );
+               match = strncasecmp( sub->sa_initial.bv_val, left.bv_val,
+                       sub->sa_initial.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_val += sub->sa_initial->bv_len;
-               left.bv_len -= sub->sa_initial->bv_len;
-               inlen -= sub->sa_initial->bv_len;
+               left.bv_val += sub->sa_initial.bv_len;
+               left.bv_len -= sub->sa_initial.bv_len;
+               inlen -= sub->sa_initial.bv_len;
        }
 
-       if( sub->sa_final ) {
+       if( sub->sa_final.bv_val ) {
                if( inlen > left.bv_len ) {
                        match = 1;
                        goto done;
                }
 
-               match = strncasecmp( sub->sa_final->bv_val,
-                       &left.bv_val[left.bv_len - sub->sa_final->bv_len],
-                       sub->sa_final->bv_len );
+               match = strncasecmp( sub->sa_final.bv_val,
+                       &left.bv_val[left.bv_len - sub->sa_final.bv_len],
+                       sub->sa_final.bv_len );
 
                if( match != 0 ) {
                        goto done;
                }
 
-               left.bv_len -= sub->sa_final->bv_len;
-               inlen -= sub->sa_final->bv_len;
+               left.bv_len -= sub->sa_final.bv_len;
+               inlen -= sub->sa_final.bv_len;
        }
 
        if( sub->sa_any ) {
-               for(i=0; sub->sa_any[i]; i++) {
+               for(i=0; sub->sa_any[i].bv_val; i++) {
                        ber_len_t idx;
                        char *p;
 
@@ -3101,11 +2694,11 @@ retry:
                                goto done;
                        }
 
-                       if( sub->sa_any[i]->bv_len == 0 ) {
+                       if( sub->sa_any[i].bv_len == 0 ) {
                                continue;
                        }
 
-                       p = strcasechr( left.bv_val, *sub->sa_any[i]->bv_val );
+                       p = strcasechr( left.bv_val, *sub->sa_any[i].bv_val );
 
                        if( p == NULL ) {
                                match = 1;
@@ -3123,15 +2716,15 @@ retry:
                        left.bv_val = p;
                        left.bv_len -= idx;
 
-                       if( sub->sa_any[i]->bv_len > left.bv_len ) {
+                       if( sub->sa_any[i].bv_len > left.bv_len ) {
                                /* not enough left */
                                match = 1;
                                goto done;
                        }
 
                        match = strncasecmp( left.bv_val,
-                               sub->sa_any[i]->bv_val,
-                               sub->sa_any[i]->bv_len );
+                               sub->sa_any[i].bv_val,
+                               sub->sa_any[i].bv_len );
 
                        if( match != 0 ) {
                                left.bv_val++;
@@ -3140,9 +2733,9 @@ retry:
                                goto retry;
                        }
 
-                       left.bv_val += sub->sa_any[i]->bv_len;
-                       left.bv_len -= sub->sa_any[i]->bv_len;
-                       inlen -= sub->sa_any[i]->bv_len;
+                       left.bv_val += sub->sa_any[i].bv_len;
+                       left.bv_len -= sub->sa_any[i].bv_len;
+                       inlen -= sub->sa_any[i].bv_len;
                }
        }
 
@@ -3152,18 +2745,18 @@ done:
 }
 
 /* Index generation function */
-int caseIgnoreIA5Indexer(
+static int caseIgnoreIA5Indexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
@@ -3171,20 +2764,21 @@ int caseIgnoreIA5Indexer(
        digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
-       assert( values != NULL && values[0] != NULL );
+       assert( values != NULL && values[0].bv_val != NULL );
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* just count them */
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       for( i=0; values[i] != NULL; i++ ) {
-               struct berval *value = ber_bvdup( values[i] );
-               ldap_pvt_str2upper( value->bv_val );
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               struct berval value;
+               ber_dupbv( &value, &values[i] );
+               ldap_pvt_str2upper( value.bv_val );
 
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -3196,45 +2790,45 @@ int caseIgnoreIA5Indexer(
                HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
                HASH_Update( &HASHcontext,
-                       value->bv_val, value->bv_len );
+                       value.bv_val, value.bv_len );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               ber_bvfree( value );
+               free( value.bv_val );
 
-               keys[i] = ber_bvdup( &digest );
+               ber_dupbv( &keys[i], &digest );
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
        *keysp = keys;
        return LDAP_SUCCESS;
 }
 
 /* Index generation function */
-int caseIgnoreIA5Filter(
+static int caseIgnoreIA5Filter(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
-       struct berval *value;
+       struct berval value;
        struct berval digest;
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       value = ber_bvdup( (struct berval *) assertValue );
-       ldap_pvt_str2upper( value->bv_val );
+       ber_dupbv( &value, (struct berval *) assertValue );
+       ldap_pvt_str2upper( value.bv_val );
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
 
        HASH_Init( &HASHcontext );
        if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -3246,13 +2840,13 @@ int caseIgnoreIA5Filter(
        HASH_Update( &HASHcontext,
                mr->smr_oid, mlen );
        HASH_Update( &HASHcontext,
-               value->bv_val, value->bv_len );
+               value.bv_val, value.bv_len );
        HASH_Final( HASHdigest, &HASHcontext );
 
-       keys[0] = ber_bvdup( &digest );
-       keys[1] = NULL;
+       ber_dupbv( &keys[0], &digest );
+       keys[1].bv_val = NULL;
 
-       ber_bvfree( value );
+       free( value.bv_val );
 
        *keysp = keys;
 
@@ -3260,18 +2854,18 @@ int caseIgnoreIA5Filter(
 }
 
 /* Substrings Index generation function */
-int caseIgnoreIA5SubstringsIndexer(
+static int caseIgnoreIA5SubstringsIndexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        ber_len_t i, nkeys;
        size_t slen, mlen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
        struct berval digest;
@@ -3279,36 +2873,36 @@ int caseIgnoreIA5SubstringsIndexer(
        digest.bv_len = sizeof(HASHdigest);
 
        /* we should have at least one value at this point */
-       assert( values != NULL && values[0] != NULL );
+       assert( values != NULL && values[0].bv_val != NULL );
 
        nkeys=0;
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* count number of indices to generate */
-               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
+               if( values[i].bv_len < SLAP_INDEX_SUBSTR_MINLEN ) {
                        continue;
                }
 
                if( flags & SLAP_INDEX_SUBSTR_INITIAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_ANY ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
 
                if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
-                       if( values[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+                       if( values[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                nkeys += SLAP_INDEX_SUBSTR_MAXLEN -
                                        ( SLAP_INDEX_SUBSTR_MINLEN - 1);
                        } else {
-                               nkeys += values[i]->bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
+                               nkeys += values[i].bv_len - ( SLAP_INDEX_SUBSTR_MINLEN - 1 );
                        }
                }
        }
@@ -3319,26 +2913,26 @@ int caseIgnoreIA5SubstringsIndexer(
                return LDAP_SUCCESS;
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
        nkeys=0;
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                int j,max;
-               struct berval *value;
+               struct berval value;
 
-               if( values[i]->bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
+               if( values[i].bv_len < SLAP_INDEX_SUBSTR_MINLEN ) continue;
 
-               value = ber_bvdup( values[i] );
-               ldap_pvt_str2upper( value->bv_val );
+               ber_dupbv( &value, &values[i] );
+               ldap_pvt_str2upper( value.bv_val );
 
                if( ( flags & SLAP_INDEX_SUBSTR_ANY ) &&
-                       ( value->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) )
+                       ( value.bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) )
                {
                        char pre = SLAP_INDEX_SUBSTR_PREFIX;
-                       max = value->bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
+                       max = value.bv_len - ( SLAP_INDEX_SUBSTR_MAXLEN - 1);
 
                        for( j=0; j<max; j++ ) {
                                HASH_Init( &HASHcontext );
@@ -3354,16 +2948,16 @@ int caseIgnoreIA5SubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       &value->bv_val[j],
+                                       &value.bv_val[j],
                                        SLAP_INDEX_SUBSTR_MAXLEN );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
                }
 
-               max = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
-                       ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
+               max = SLAP_INDEX_SUBSTR_MAXLEN < value.bv_len
+                       ? SLAP_INDEX_SUBSTR_MAXLEN : value.bv_len;
 
                for( j=SLAP_INDEX_SUBSTR_MINLEN; j<=max; j++ ) {
                        char pre;
@@ -3382,10 +2976,10 @@ int caseIgnoreIA5SubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       value->bv_val, j );
+                                       value.bv_val, j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                        if( flags & SLAP_INDEX_SUBSTR_FINAL ) {
@@ -3402,19 +2996,19 @@ int caseIgnoreIA5SubstringsIndexer(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       &value->bv_val[value->bv_len-j], j );
+                                       &value.bv_val[value.bv_len-j], j );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
                }
 
-               ber_bvfree( value );
+               free( value.bv_val );
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
@@ -3424,44 +3018,44 @@ int caseIgnoreIA5SubstringsIndexer(
        return LDAP_SUCCESS;
 }
 
-int caseIgnoreIA5SubstringsFilter(
+static int caseIgnoreIA5SubstringsFilter(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
        SubstringsAssertion *sa = assertValue;
        char pre;
        ber_len_t nkeys = 0;
        size_t slen, mlen, klen;
-       struct berval **keys;
+       BVarray keys;
        HASH_CONTEXT   HASHcontext;
        unsigned char   HASHdigest[HASH_BYTES];
-       struct berval *value;
+       struct berval value;
        struct berval digest;
 
-       if((flags & SLAP_INDEX_SUBSTR_INITIAL) && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if((flags & SLAP_INDEX_SUBSTR_INITIAL) && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
 
        if((flags & SLAP_INDEX_SUBSTR_ANY) && sa->sa_any != NULL ) {
                ber_len_t i;
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len >= SLAP_INDEX_SUBSTR_MAXLEN ) {
                                /* don't bother accounting for stepping */
-                               nkeys += sa->sa_any[i]->bv_len -
+                               nkeys += sa->sa_any[i].bv_len -
                                        ( SLAP_INDEX_SUBSTR_MAXLEN - 1 );
                        }
                }
        }
 
-       if((flags & SLAP_INDEX_SUBSTR_FINAL) && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if((flags & SLAP_INDEX_SUBSTR_FINAL) && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                nkeys++;
        }
@@ -3474,21 +3068,21 @@ int caseIgnoreIA5SubstringsFilter(
        digest.bv_val = HASHdigest;
        digest.bv_len = sizeof(HASHdigest);
 
-       slen = strlen( syntax->ssyn_oid );
-       mlen = strlen( mr->smr_oid );
+       slen = syntax->ssyn_oidlen;
+       mlen = mr->smr_oidlen;
 
-       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (nkeys+1) );
        nkeys = 0;
 
-       if((flags & SLAP_INDEX_SUBSTR_INITIAL) && sa->sa_initial != NULL &&
-               sa->sa_initial->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if((flags & SLAP_INDEX_SUBSTR_INITIAL) && sa->sa_initial.bv_val != NULL &&
+               sa->sa_initial.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_INITIAL_PREFIX;
-               value = ber_bvdup( sa->sa_initial );
-               ldap_pvt_str2upper( value->bv_val );
+               ber_dupbv( &value, &sa->sa_initial );
+               ldap_pvt_str2upper( value.bv_val );
 
-               klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
-                       ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
+               klen = SLAP_INDEX_SUBSTR_MAXLEN < value.bv_len
+                       ? SLAP_INDEX_SUBSTR_MAXLEN : value.bv_len;
 
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -3502,11 +3096,11 @@ int caseIgnoreIA5SubstringsFilter(
                HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
                HASH_Update( &HASHcontext,
-                       value->bv_val, klen );
+                       value.bv_val, klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               ber_bvfree( value );
-               keys[nkeys++] = ber_bvdup( &digest );
+               free( value.bv_val );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if((flags & SLAP_INDEX_SUBSTR_ANY) && sa->sa_any != NULL ) {
@@ -3514,16 +3108,16 @@ int caseIgnoreIA5SubstringsFilter(
                pre = SLAP_INDEX_SUBSTR_PREFIX;
                klen = SLAP_INDEX_SUBSTR_MAXLEN;
 
-               for( i=0; sa->sa_any[i] != NULL; i++ ) {
-                       if( sa->sa_any[i]->bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
+               for( i=0; sa->sa_any[i].bv_val != NULL; i++ ) {
+                       if( sa->sa_any[i].bv_len < SLAP_INDEX_SUBSTR_MAXLEN ) {
                                continue;
                        }
 
-                       value = ber_bvdup( sa->sa_any[i] );
-                       ldap_pvt_str2upper( value->bv_val );
+                       ber_dupbv( &value, &sa->sa_any[i] );
+                       ldap_pvt_str2upper( value.bv_val );
 
                        for(j=0;
-                               j <= value->bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
+                               j <= value.bv_len - SLAP_INDEX_SUBSTR_MAXLEN;
                                j += SLAP_INDEX_SUBSTR_STEP )
                        {
                                HASH_Init( &HASHcontext );
@@ -3538,25 +3132,25 @@ int caseIgnoreIA5SubstringsFilter(
                                HASH_Update( &HASHcontext,
                                        mr->smr_oid, mlen );
                                HASH_Update( &HASHcontext,
-                                       &value->bv_val[j], klen );
+                                       &value.bv_val[j], klen );
                                HASH_Final( HASHdigest, &HASHcontext );
 
-                               keys[nkeys++] = ber_bvdup( &digest );
+                               ber_dupbv( &keys[nkeys++], &digest );
                        }
 
-                       ber_bvfree( value );
+                       free( value.bv_val );
                }
        }
 
-       if((flags & SLAP_INDEX_SUBSTR_FINAL) && sa->sa_final != NULL &&
-               sa->sa_final->bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
+       if((flags & SLAP_INDEX_SUBSTR_FINAL) && sa->sa_final.bv_val != NULL &&
+               sa->sa_final.bv_len >= SLAP_INDEX_SUBSTR_MINLEN )
        {
                pre = SLAP_INDEX_SUBSTR_FINAL_PREFIX;
-               value = ber_bvdup( sa->sa_final );
-               ldap_pvt_str2upper( value->bv_val );
+               ber_dupbv( &value, &sa->sa_final );
+               ldap_pvt_str2upper( value.bv_val );
 
-               klen = SLAP_INDEX_SUBSTR_MAXLEN < value->bv_len
-                       ? SLAP_INDEX_SUBSTR_MAXLEN : value->bv_len;
+               klen = SLAP_INDEX_SUBSTR_MAXLEN < value.bv_len
+                       ? SLAP_INDEX_SUBSTR_MAXLEN : value.bv_len;
 
                HASH_Init( &HASHcontext );
                if( prefix != NULL && prefix->bv_len > 0 ) {
@@ -3570,15 +3164,15 @@ int caseIgnoreIA5SubstringsFilter(
                HASH_Update( &HASHcontext,
                        mr->smr_oid, mlen );
                HASH_Update( &HASHcontext,
-                       &value->bv_val[value->bv_len-klen], klen );
+                       &value.bv_val[value.bv_len-klen], klen );
                HASH_Final( HASHdigest, &HASHcontext );
 
-               ber_bvfree( value );
-               keys[nkeys++] = ber_bvdup( &digest );
+               free( value.bv_val );
+               ber_dupbv( &keys[nkeys++], &digest );
        }
 
        if( nkeys > 0 ) {
-               keys[nkeys] = NULL;
+               keys[nkeys].bv_val = NULL;
                *keysp = keys;
        } else {
                ch_free( keys );
@@ -3608,17 +3202,15 @@ static int
 numericStringNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
        /* removal all spaces */
-       struct berval *newval;
        char *p, *q;
 
-       newval = ch_malloc( sizeof( struct berval ) );
-       newval->bv_val = ch_malloc( val->bv_len + 1 );
+       normalized->bv_val = ch_malloc( val->bv_len + 1 );
 
        p = val->bv_val;
-       q = newval->bv_val;
+       q = normalized->bv_val;
 
        while ( *p ) {
                if ( ASCII_SPACE( *p ) ) {
@@ -3630,13 +3222,12 @@ numericStringNormalize(
        }
 
        /* we should have copied no more then is in val */
-       assert( (q - newval->bv_val) <= (p - val->bv_val) );
+       assert( (q - normalized->bv_val) <= (p - val->bv_val) );
 
        /* null terminate */
        *q = '\0';
 
-       newval->bv_len = q - newval->bv_val;
-       *normalized = newval;
+       normalized->bv_len = q - normalized->bv_val;
 
        return LDAP_SUCCESS;
 }
@@ -3678,13 +3269,9 @@ objectIdentifierFirstComponentMatch(
                rc = objectIdentifierMatch( &match, flags, syntax, mr, &oid, asserted );
 
        } else {
-               char *stored = ch_malloc( oid.bv_len + 1 );
-               AC_MEMCPY( stored, oid.bv_val, oid.bv_len );
-               stored[oid.bv_len] = '\0';
-
                if ( !strcmp( syntax->ssyn_oid, SLAP_SYNTAX_MATCHINGRULES_OID ) ) {
-                       MatchingRule *asserted_mr = mr_find( asserted->bv_val );
-                       MatchingRule *stored_mr = mr_find( stored );
+                       MatchingRule *asserted_mr = mr_bvfind( asserted );
+                       MatchingRule *stored_mr = mr_bvfind( &oid );
 
                        if( asserted_mr == NULL ) {
                                rc = SLAPD_COMPARE_UNDEFINED;
@@ -3695,8 +3282,8 @@ objectIdentifierFirstComponentMatch(
                } else if ( !strcmp( syntax->ssyn_oid,
                        SLAP_SYNTAX_ATTRIBUTETYPES_OID ) )
                {
-                       AttributeType *asserted_at = at_find( asserted->bv_val );
-                       AttributeType *stored_at = at_find( stored );
+                       AttributeType *asserted_at = at_bvfind( asserted );
+                       AttributeType *stored_at = at_bvfind( &oid );
 
                        if( asserted_at == NULL ) {
                                rc = SLAPD_COMPARE_UNDEFINED;
@@ -3707,8 +3294,8 @@ objectIdentifierFirstComponentMatch(
                } else if ( !strcmp( syntax->ssyn_oid,
                        SLAP_SYNTAX_OBJECTCLASSES_OID ) )
                {
-                       ObjectClass *asserted_oc = oc_find( asserted->bv_val );
-                       ObjectClass *stored_oc = oc_find( stored );
+                       ObjectClass *asserted_oc = oc_bvfind( asserted );
+                       ObjectClass *stored_oc = oc_bvfind( &oid );
 
                        if( asserted_oc == NULL ) {
                                rc = SLAPD_COMPARE_UNDEFINED;
@@ -3716,8 +3303,6 @@ objectIdentifierFirstComponentMatch(
                                match = asserted_oc != stored_oc;
                        }
                }
-
-               ch_free( stored );
        }
 
 #ifdef NEW_LOGGING
@@ -3888,7 +3473,7 @@ dn_openssl2ldap(X509_NAME *name)
 static int
 certificateExactConvert(
        struct berval * in,
-       struct berval ** out )
+       struct berval * out )
 {
        X509 *xcert;
        unsigned char *p = in->bv_val;
@@ -3934,13 +3519,12 @@ certificateExactConvert(
 
        X509_free(xcert);
 
-       *out = ch_malloc(sizeof(struct berval));
-       (*out)->bv_len = serial->bv_len + 3 + issuer_dn->bv_len + 1;
-       (*out)->bv_val = ch_malloc((*out)->bv_len);
-       p = (*out)->bv_val;
+       out->bv_len = serial->bv_len + issuer_dn->bv_len + sizeof(" $ ");
+       out->bv_val = ch_malloc(out->bv_len);
+       p = out->bv_val;
        AC_MEMCPY(p, serial->bv_val, serial->bv_len);
        p += serial->bv_len;
-       AC_MEMCPY(p, " $ ", 3);
+       AC_MEMCPY(p, " $ ", sizeof(" $ ")-1);
        p += 3;
        AC_MEMCPY(p, issuer_dn->bv_val, issuer_dn->bv_len);
        p += issuer_dn->bv_len;
@@ -3949,11 +3533,11 @@ certificateExactConvert(
 #ifdef NEW_LOGGING
        LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
                   "certificateExactConvert: \n %s\n",
-                  (*out)->bv_val));
+                  out->bv_val));
 #else
        Debug( LDAP_DEBUG_ARGS, "certificateExactConvert "
                "\n\t\"%s\"\n",
-               (*out)->bv_val, NULL, NULL );
+               out->bv_val, NULL, NULL );
 #endif
 
        ber_bvfree(serial);
@@ -3972,7 +3556,7 @@ serial_and_issuer_parse(
        char *begin;
        char *end;
        char *p;
-       char *q;
+       struct berval bv;
 
        begin = assertion->bv_val;
        end = assertion->bv_val+assertion->bv_len-1;
@@ -3989,10 +3573,9 @@ serial_and_issuer_parse(
        while (ASCII_SPACE(*end))
                end--;
 
-       q = ch_malloc( (end-begin+1)+1 );
-       AC_MEMCPY( q, begin, end-begin+1 );
-       q[end-begin+1] = '\0';
-       *serial = ber_bvstr(q);
+       bv.bv_len = end-begin+1;
+       bv.bv_val = begin;
+       *serial = ber_dupbv(NULL, &bv);
 
        /* now extract the issuer, remember p was at the dollar sign */
        begin = p+1;
@@ -4001,10 +3584,9 @@ serial_and_issuer_parse(
                begin++;
        /* should we trim spaces at the end too? is it safe always? */
 
-       q = ch_malloc( (end-begin+1)+1 );
-       AC_MEMCPY( q, begin, end-begin+1 );
-       q[end-begin+1] = '\0';
-       *issuer_dn = ber_bvstr(dn_normalize(q));
+       bv.bv_len = end-begin+1;
+       bv.bv_val = begin;
+       dnNormalize( NULL, &bv, issuer_dn );
 
        return LDAP_SUCCESS;
 }
@@ -4096,33 +3678,33 @@ certificateExactMatch(
  * We just index the serials, in most scenarios the issuer DN is one of
  * a very small set of values.
  */
-int certificateExactIndexer(
+static int certificateExactIndexer(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
-       struct berval **values,
-       struct berval ***keysp )
+       BVarray values,
+       BVarray *keysp )
 {
        int i;
-       struct berval **keys;
+       BVarray keys;
        X509 *xcert;
        unsigned char *p;
        struct berval * serial;
 
        /* we should have at least one value at this point */
-       assert( values != NULL && values[0] != NULL );
+       assert( values != NULL && values[0].bv_val != NULL );
 
-       for( i=0; values[i] != NULL; i++ ) {
+       for( i=0; values[i].bv_val != NULL; i++ ) {
                /* empty -- just count them */
        }
 
-       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
+       keys = ch_malloc( sizeof( struct berval ) * (i+1) );
 
-       for( i=0; values[i] != NULL; i++ ) {
-               p = values[i]->bv_val;
-               xcert = d2i_X509(NULL, &p, values[i]->bv_len);
+       for( i=0; values[i].bv_val != NULL; i++ ) {
+               p = values[i].bv_val;
+               xcert = d2i_X509(NULL, &p, values[i].bv_len);
                if ( !xcert ) {
 #ifdef NEW_LOGGING
                        LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
@@ -4147,32 +3729,32 @@ int certificateExactIndexer(
 #ifdef NEW_LOGGING
                LDAP_LOG(( "schema", LDAP_LEVEL_ENTRY,
                           "certificateExactIndexer: returning: %s\n",
-                          keys[i]->bv_val));
+                          keys[i].bv_val));
 #else
                Debug( LDAP_DEBUG_ARGS, "certificateExactIndexer: "
                       "returning: %s\n",
-                      keys[i]->bv_val,
+                      keys[i].bv_val,
                       NULL, NULL );
 #endif
        }
 
-       keys[i] = NULL;
+       keys[i].bv_val = NULL;
        *keysp = keys;
        return LDAP_SUCCESS;
 }
 
 /* Index generation function */
 /* We think this is always called with a value in matching rule syntax */
-int certificateExactFilter(
+static int certificateExactFilter(
        slap_mask_t use,
        slap_mask_t flags,
        Syntax *syntax,
        MatchingRule *mr,
        struct berval *prefix,
        void * assertValue,
-       struct berval ***keysp )
+       BVarray *keysp )
 {
-       struct berval **keys;
+       BVarray keys;
        struct berval *asserted_serial;
        struct berval *asserted_issuer_dn;
 
@@ -4180,9 +3762,9 @@ int certificateExactFilter(
                                &asserted_serial,
                                &asserted_issuer_dn);
 
-       keys = ch_malloc( sizeof( struct berval ) * 2 );
+       keys = ch_malloc( sizeof( struct berval ) * 2 );
        integerNormalize( syntax, asserted_serial, &keys[0] );
-       keys[1] = NULL;
+       keys[1].bv_val = NULL;
        *keysp = keys;
 
        ber_bvfree(asserted_serial);
@@ -4360,9 +3942,8 @@ static int
 utcTimeNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
-       struct berval *out;
        int parts[9], rc;
 
        rc = check_time_syntax(val, 1, parts);
@@ -4370,23 +3951,15 @@ utcTimeNormalize(
                return rc;
        }
 
-       *normalized = NULL;
-       out = ch_malloc( sizeof(struct berval) );
-       if( out == NULL ) {
+       normalized->bv_val = ch_malloc( 14 );
+       if ( normalized->bv_val == NULL ) {
                return LBER_ERROR_MEMORY;
        }
 
-       out->bv_val = ch_malloc( 14 );
-       if ( out->bv_val == NULL ) {
-               ch_free( out );
-               return LBER_ERROR_MEMORY;
-       }
-
-       sprintf( out->bv_val, "%02d%02d%02d%02d%02d%02dZ",
+       sprintf( normalized->bv_val, "%02d%02d%02d%02d%02d%02dZ",
                parts[1], parts[2] + 1, parts[3] + 1,
                parts[4], parts[5], parts[6] );
-       out->bv_len = 13;
-       *normalized = out;
+       normalized->bv_len = 13;
 
        return LDAP_SUCCESS;
 }
@@ -4415,9 +3988,8 @@ static int
 generalizedTimeNormalize(
        Syntax *syntax,
        struct berval *val,
-       struct berval **normalized )
+       struct berval *normalized )
 {
-       struct berval *out;
        int parts[9], rc;
 
        rc = check_time_syntax(val, 0, parts);
@@ -4425,23 +3997,15 @@ generalizedTimeNormalize(
                return rc;
        }
 
-       *normalized = NULL;
-       out = ch_malloc( sizeof(struct berval) );
-       if( out == NULL ) {
+       normalized->bv_val = ch_malloc( 16 );
+       if ( normalized->bv_val == NULL ) {
                return LBER_ERROR_MEMORY;
        }
 
-       out->bv_val = ch_malloc( 16 );
-       if ( out->bv_val == NULL ) {
-               ch_free( out );
-               return LBER_ERROR_MEMORY;
-       }
-
-       sprintf( out->bv_val, "%02d%02d%02d%02d%02d%02d%02dZ",
+       sprintf( normalized->bv_val, "%02d%02d%02d%02d%02d%02d%02dZ",
                parts[0], parts[1], parts[2] + 1, parts[3] + 1,
                parts[4], parts[5], parts[6] );
-       out->bv_len = 15;
-       *normalized = out;
+       normalized->bv_len = 15;
 
        return LDAP_SUCCESS;
 }
@@ -4465,7 +4029,7 @@ nisNetgroupTripleValidate(
                return LDAP_INVALID_SYNTAX;
        }
 
-       for ( p++; ( p < e ) && ( *p != ')' ); p++ ) {
+       for ( p++; ( p < e ) && ( *p != /*'('*/ ')' ); p++ ) {
                if ( *p == ',' ) {
                        commas++;
                        if ( commas > 2 ) {
@@ -4536,8 +4100,10 @@ bootParameterValidate(
        return LDAP_SUCCESS;
 }
 
-struct syntax_defs_rec {
+static struct syntax_defs_rec {
        char *sd_desc;
+#define X_BINARY "X-BINARY-TRANSFER-REQUIRED 'TRUE' "
+#define X_NOT_H_R "X-NOT-HUMAN-READABLE 'TRUE' "
        int sd_flags;
        slap_syntax_validate_func *sd_validate;
        slap_syntax_transform_func *sd_normalize;
@@ -4546,21 +4112,19 @@ struct syntax_defs_rec {
        slap_syntax_transform_func *sd_ber2str;
        slap_syntax_transform_func *sd_str2ber;
 #endif
-};
-
-#define X_BINARY "X-BINARY-TRANSFER-REQUIRED 'TRUE' "
-#define X_NOT_H_R "X-NOT-HUMAN-READABLE 'TRUE' "
-
-struct syntax_defs_rec syntax_defs[] = {
-       {"( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' " X_BINARY X_NOT_H_R ")",
+} syntax_defs[] = {
+       {"( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' "
+               X_BINARY X_NOT_H_R ")",
                SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.2 DESC 'Access Point' " X_NOT_H_R ")",
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.3 DESC 'Attribute Type Description' )",
                0, NULL, NULL, NULL},
-       {"( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' " X_NOT_H_R ")",
+       {"( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' "
+               X_NOT_H_R ")",
                SLAP_SYNTAX_BLOB, blobValidate, NULL, NULL},
-       {"( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' " X_NOT_H_R ")",
+       {"( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' "
+               X_NOT_H_R ")",
                SLAP_SYNTAX_BER, berValidate, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )",
                0, bitStringValidate, bitStringNormalize, NULL },
@@ -4578,7 +4142,7 @@ struct syntax_defs_rec syntax_defs[] = {
        {"( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )",
                0, countryStringValidate, IA5StringNormalize, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )",
-               0, dnValidate, dnNormalize, dnPretty},
+               0, dnValidate, dnNormalize2, dnPretty2},
        {"( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' )",
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )",
@@ -4641,6 +4205,9 @@ struct syntax_defs_rec syntax_defs[] = {
                0, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )",
                0, printableStringValidate, IA5StringNormalize, NULL},
+       {"( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' "
+               X_BINARY X_NOT_H_R ")",
+               SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, NULL, NULL, NULL},
        {"( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' "
                X_BINARY X_NOT_H_R ")",
                SLAP_SYNTAX_BINARY|SLAP_SYNTAX_BER, berValidate, NULL, NULL},
@@ -4685,9 +4252,11 @@ struct syntax_defs_rec syntax_defs[] = {
                UTF8StringValidate /* THIS WILL CHANGE FOR NEW ACI SYNTAX */,
                NULL, NULL},
 
+#ifdef SLAPD_AUTHPASSWD
        /* needs updating */
        {"( 1.3.6.1.4.1.4203.666.2.2 DESC 'OpenLDAP authPassword' )",
                SLAP_SYNTAX_HIDE, NULL, NULL, NULL},
+#endif
 
        /* OpenLDAP Void Syntax */
        {"( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' )" ,
@@ -4695,18 +4264,6 @@ struct syntax_defs_rec syntax_defs[] = {
        {NULL, 0, NULL, NULL, NULL}
 };
 
-struct mrule_defs_rec {
-       char *                                          mrd_desc;
-       slap_mask_t                                     mrd_usage;
-       slap_mr_convert_func *          mrd_convert;
-       slap_mr_normalize_func *        mrd_normalize;
-       slap_mr_match_func *            mrd_match;
-       slap_mr_indexer_func *          mrd_indexer;
-       slap_mr_filter_func *           mrd_filter;
-
-       char *                                          mrd_associated;
-};
-
 /*
  * Other matching rules in X.520 that we do not use (yet):
  *
@@ -4730,15 +4287,24 @@ struct mrule_defs_rec {
  * 2.5.13.43   readerAndKeyIDMatch
  * 2.5.13.44   attributeIntegrityMatch
  */
+static struct mrule_defs_rec {
+       char *                                          mrd_desc;
+       slap_mask_t                                     mrd_usage;
+       slap_mr_convert_func *          mrd_convert;
+       slap_mr_normalize_func *        mrd_normalize;
+       slap_mr_match_func *            mrd_match;
+       slap_mr_indexer_func *          mrd_indexer;
+       slap_mr_filter_func *           mrd_filter;
 
-struct mrule_defs_rec mrule_defs[] = {
+       char *                                          mrd_associated;
+} mrule_defs[] = {
        /*
         * EQUALITY matching rules must be listed after associated APPROX
         * matching rules.  So, we list all APPROX matching rules first.
         */
        {"( " directoryStringApproxMatchOID " NAME 'directoryStringApproxMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
-               SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
+               SLAP_MR_HIDE | SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
                NULL, NULL,
                directoryStringApproxMatch,
                directoryStringApproxIndexer, 
@@ -4747,7 +4313,7 @@ struct mrule_defs_rec mrule_defs[] = {
 
        {"( " IA5StringApproxMatchOID " NAME 'IA5StringApproxMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
-               SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
+               SLAP_MR_HIDE | SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
                NULL, NULL,
                IA5StringApproxMatch,
                IA5StringApproxIndexer, 
@@ -4774,7 +4340,7 @@ struct mrule_defs_rec mrule_defs[] = {
 
        {"( 2.5.13.2 NAME 'caseIgnoreMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD,
                NULL, NULL,
                caseIgnoreMatch, caseExactIgnoreIndexer, caseExactIgnoreFilter,
                directoryStringApproxMatchOID },
@@ -4820,7 +4386,7 @@ struct mrule_defs_rec mrule_defs[] = {
 
        {"( 2.5.13.8 NAME 'numericStringMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD,
                NULL, NULL,
                caseIgnoreIA5Match,
                caseIgnoreIA5Indexer,
@@ -4838,7 +4404,7 @@ struct mrule_defs_rec mrule_defs[] = {
 
        {"( 2.5.13.11 NAME 'caseIgnoreListMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD,
                NULL, NULL,
                caseIgnoreListMatch, NULL, NULL,
                NULL},
@@ -4880,7 +4446,7 @@ struct mrule_defs_rec mrule_defs[] = {
 
        {"( 2.5.13.20 NAME 'telephoneNumberMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD,
                NULL, NULL,
                telephoneNumberMatch,
                telephoneNumberIndexer,
@@ -4964,7 +4530,7 @@ struct mrule_defs_rec mrule_defs[] = {
 
        {"( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD,
                NULL, NULL,
                caseIgnoreIA5Match, caseIgnoreIA5Indexer, caseIgnoreIA5Filter,
                IA5StringApproxMatchOID },
@@ -4987,6 +4553,7 @@ struct mrule_defs_rec mrule_defs[] = {
                caseExactIA5SubstringsFilter,
                NULL},
 
+#ifdef SLAPD_AUTHPASSWD
        /* needs updating */
        {"( 1.3.6.1.4.1.4203.666.4.1 NAME 'authPasswordMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )",
@@ -4994,6 +4561,7 @@ struct mrule_defs_rec mrule_defs[] = {
                NULL, NULL,
                authPasswordMatch, NULL, NULL,
                NULL},
+#endif
 
        {"( 1.3.6.1.4.1.4203.666.4.2 NAME 'OpenLDAPaciMatch' "
                "SYNTAX 1.3.6.1.4.1.4203.666.2.1 )",
@@ -5020,7 +4588,7 @@ struct mrule_defs_rec mrule_defs[] = {
 };
 
 int
-schema_init( void )
+slap_schema_init( void )
 {
        int             res;
        int             i;
@@ -5042,7 +4610,7 @@ schema_init( void )
                );
 
                if ( res ) {
-                       fprintf( stderr, "schema_init: Error registering syntax %s\n",
+                       fprintf( stderr, "slap_schema_init: Error registering syntax %s\n",
                                 syntax_defs[i].sd_desc );
                        return LDAP_OTHER;
                }
@@ -5051,7 +4619,7 @@ schema_init( void )
        for ( i=0; mrule_defs[i].mrd_desc != NULL; i++ ) {
                if( mrule_defs[i].mrd_usage == SLAP_MR_NONE ) {
                        fprintf( stderr,
-                               "schema_init: Ingoring unusable matching rule %s\n",
+                               "slap_schema_init: Ingoring unusable matching rule %s\n",
                                 mrule_defs[i].mrd_desc );
                        continue;
                }
@@ -5068,18 +4636,21 @@ schema_init( void )
 
                if ( res ) {
                        fprintf( stderr,
-                               "schema_init: Error registering matching rule %s\n",
+                               "slap_schema_init: Error registering matching rule %s\n",
                                 mrule_defs[i].mrd_desc );
                        return LDAP_OTHER;
                }
        }
+
+       res = slap_schema_load();
        schema_init_done = 1;
-       return LDAP_SUCCESS;
+       return res;
 }
 
 void
 schema_destroy( void )
 {
+       oidm_destroy();
        oc_destroy();
        at_destroy();
        mr_destroy();