X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;ds=sidebyside;f=servers%2Fslapd%2Ffilterentry.c;h=86a2db459dfcb135928fb68383a85d16df8713ae;hb=25c672a844c7752634c59118b53e3e4b48445ccb;hp=f65c8472a80ff7fc1ec022d76715f3e9ae5f71c2;hpb=2d2719123dc05d1b5327f03acdd6f39e9465d294;p=openldap diff --git a/servers/slapd/filterentry.c b/servers/slapd/filterentry.c index f65c8472a8..86a2db459d 100644 --- a/servers/slapd/filterentry.c +++ b/servers/slapd/filterentry.c @@ -1,7 +1,27 @@ /* filterentry.c - apply a filter to an entry */ -/* - * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved. - * COPYING RESTRICTIONS APPLY, see COPYRIGHT file +/* $OpenLDAP$ */ +/* This work is part of OpenLDAP Software . + * + * Copyright 1998-2004 The OpenLDAP Foundation. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. + * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . + */ +/* Portions Copyright (c) 1995 Regents of the University of Michigan. + * All rights reserved. + * + * Redistribution and use in source and binary forms are permitted + * provided that this notice is preserved and that due credit is given + * to the University of Michigan at Ann Arbor. The name of the University + * may not be used to endorse or promote products derived from this + * software without specific prior written permission. This software + * is provided ``as is'' without express or implied warranty. */ #include "portable.h" @@ -10,428 +30,659 @@ #include #include -#include + #include "slap.h" -static int test_filter_list(Backend *be, Connection *conn, Operation *op, Entry *e, Filter *flist, int ftype); -static int test_substring_filter(Backend *be, Connection *conn, Operation *op, Entry *e, Filter *f); -static int test_ava_filter(Backend *be, Connection *conn, Operation *op, Entry *e, Ava *ava, int type); -static int test_approx_filter(Backend *be, Connection *conn, Operation *op, Entry *e, Ava *ava); -static int test_presence_filter(Backend *be, Connection *conn, Operation *op, Entry *e, char *type); +static int test_filter_and( Operation *op, Entry *e, Filter *flist ); +static int test_filter_or( Operation *op, Entry *e, Filter *flist ); +static int test_substrings_filter( Operation *op, Entry *e, Filter *f); +static int test_ava_filter( Operation *op, Entry *e, AttributeAssertion *ava, int type ); +static int test_mra_filter( Operation *op, Entry *e, MatchingRuleAssertion *mra ); +static int test_presence_filter( Operation *op, Entry *e, AttributeDescription *desc ); + /* * test_filter - test a filter against a single entry. - * returns 0 filter matched - * -1 filter did not match - * >0 an ldap error code + * returns: + * LDAP_COMPARE_TRUE filter matched + * LDAP_COMPARE_FALSE filter did not match + * SLAPD_COMPARE_UNDEFINED filter is undefined + * or an ldap result code indicating error */ int test_filter( - Backend *be, - Connection *conn, Operation *op, Entry *e, Filter *f ) { int rc; - +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, ENTRY, "test_filter: begin\n", 0, 0, 0 ); +#else Debug( LDAP_DEBUG_FILTER, "=> test_filter\n", 0, 0, 0 ); +#endif switch ( f->f_choice ) { + case SLAPD_FILTER_COMPUTED: +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, DETAIL1, + "test_filter: COMPUTED %s (%d)\n", + f->f_result == LDAP_COMPARE_FALSE ? "false" : + f->f_result == LDAP_COMPARE_TRUE ? "true" : + f->f_result == SLAPD_COMPARE_UNDEFINED ? "undefined" : + "error", f->f_result, 0 ); +#else + Debug( LDAP_DEBUG_FILTER, " COMPUTED %s (%d)\n", + f->f_result == LDAP_COMPARE_FALSE ? "false" : + f->f_result == LDAP_COMPARE_TRUE ? "true" : + f->f_result == SLAPD_COMPARE_UNDEFINED ? "undefined" : "error", + f->f_result, 0 ); +#endif + + rc = f->f_result; + break; + case LDAP_FILTER_EQUALITY: +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, DETAIL1, "test_filter: EQUALITY\n", 0, 0, 0 ); +#else Debug( LDAP_DEBUG_FILTER, " EQUALITY\n", 0, 0, 0 ); - rc = test_ava_filter( be, conn, op, e, &f->f_ava, +#endif + + rc = test_ava_filter( op, e, f->f_ava, LDAP_FILTER_EQUALITY ); break; case LDAP_FILTER_SUBSTRINGS: +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, DETAIL1, "test_filter SUBSTRINGS\n", 0, 0, 0 ); +#else Debug( LDAP_DEBUG_FILTER, " SUBSTRINGS\n", 0, 0, 0 ); - rc = test_substring_filter( be, conn, op, e, f ); +#endif + + rc = test_substrings_filter( op, e, f ); break; case LDAP_FILTER_GE: - Debug( LDAP_DEBUG_FILTER, " GE\n", 0, 0, 0 ); - rc = test_ava_filter( be, conn, op, e, &f->f_ava, + rc = test_ava_filter( op, e, f->f_ava, LDAP_FILTER_GE ); break; case LDAP_FILTER_LE: - Debug( LDAP_DEBUG_FILTER, " LE\n", 0, 0, 0 ); - rc = test_ava_filter( be, conn, op, e, &f->f_ava, + rc = test_ava_filter( op, e, f->f_ava, LDAP_FILTER_LE ); break; case LDAP_FILTER_PRESENT: +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, DETAIL1, "test_filter: PRESENT\n", 0, 0, 0 ); +#else Debug( LDAP_DEBUG_FILTER, " PRESENT\n", 0, 0, 0 ); - rc = test_presence_filter( be, conn, op, e, f->f_type ); +#endif + + rc = test_presence_filter( op, e, f->f_desc ); break; case LDAP_FILTER_APPROX: +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, DETAIL1, "test_filter: APPROX\n", 0, 0, 0 ); +#else Debug( LDAP_DEBUG_FILTER, " APPROX\n", 0, 0, 0 ); - rc = test_approx_filter( be, conn, op, e, &f->f_ava ); +#endif + rc = test_ava_filter( op, e, f->f_ava, + LDAP_FILTER_APPROX ); break; case LDAP_FILTER_AND: +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, DETAIL1, "test_filter: AND\n", 0, 0, 0 ); +#else Debug( LDAP_DEBUG_FILTER, " AND\n", 0, 0, 0 ); - rc = test_filter_list( be, conn, op, e, f->f_and, - LDAP_FILTER_AND ); +#endif + + rc = test_filter_and( op, e, f->f_and ); break; case LDAP_FILTER_OR: +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, DETAIL1, "test_filter: OR\n", 0, 0, 0 ); +#else Debug( LDAP_DEBUG_FILTER, " OR\n", 0, 0, 0 ); - rc = test_filter_list( be, conn, op, e, f->f_or, - LDAP_FILTER_OR ); +#endif + + rc = test_filter_or( op, e, f->f_or ); break; case LDAP_FILTER_NOT: +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, DETAIL1, "test_filter: NOT\n", 0, 0, 0 ); +#else Debug( LDAP_DEBUG_FILTER, " NOT\n", 0, 0, 0 ); - rc = (! test_filter( be, conn, op, e, f->f_not ) ); +#endif + + rc = test_filter( op, e, f->f_not ); + + /* Flip true to false and false to true + * but leave Undefined alone. + */ + switch( rc ) { + case LDAP_COMPARE_TRUE: + rc = LDAP_COMPARE_FALSE; + break; + case LDAP_COMPARE_FALSE: + rc = LDAP_COMPARE_TRUE; + break; + } + break; + + case LDAP_FILTER_EXT: +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, DETAIL1, "test_filter: EXT\n", 0, 0, 0 ); +#else + Debug( LDAP_DEBUG_FILTER, " EXT\n", 0, 0, 0 ); +#endif + + rc = test_mra_filter( op, e, f->f_mra ); break; default: +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, INFO, + "test_filter: unknown filter type %lu\n", f->f_choice, 0, 0 ); +#else Debug( LDAP_DEBUG_ANY, " unknown filter type %lu\n", f->f_choice, 0, 0 ); - rc = -1; +#endif + + rc = LDAP_PROTOCOL_ERROR; } +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, RESULTS, "test_filter: return=%d\n", rc, 0, 0 ); +#else Debug( LDAP_DEBUG_FILTER, "<= test_filter %d\n", rc, 0, 0 ); +#endif + return( rc ); } -static int -test_ava_filter( - Backend *be, - Connection *conn, - Operation *op, - Entry *e, - Ava *ava, - int type -) +static int test_mra_filter( + Operation *op, + Entry *e, + MatchingRuleAssertion *mra ) { - int i, rc; Attribute *a; + void *memctx = op ? op->o_tmpmemctx : NULL; - if ( be != NULL && ! access_allowed( be, conn, op, e, - ava->ava_type, &ava->ava_value, ACL_SEARCH ) ) - { - return( -2 ); - } + if ( mra->ma_desc ) { + /* + * if ma_desc is available, then we're filtering for + * one attribute, and SEARCH permissions can be checked + * directly. + */ + if( !access_allowed( op, e, + mra->ma_desc, &mra->ma_value, ACL_SEARCH, NULL ) ) + { + return LDAP_INSUFFICIENT_ACCESS; + } - if ( (a = attr_find( e->e_attrs, ava->ava_type )) == NULL ) { - return( -1 ); - } + for(a = attrs_find( e->e_attrs, mra->ma_desc ); + a != NULL; + a = attrs_find( a->a_next, mra->ma_desc ) ) + { + struct berval *bv; + /* If ma_rule is not the same as the attribute's + * normal rule, then we can't use the a_nvals. + */ + if (mra->ma_rule == a->a_desc->ad_type->sat_equality) { + bv = a->a_nvals; + } else { + bv = a->a_vals; + } - if ( a->a_syntax == 0 ) { - a->a_syntax = attr_syntax( ava->ava_type ); - } - for ( i = 0; a->a_vals[i] != NULL; i++ ) { - rc = value_cmp( a->a_vals[i], &ava->ava_value, a->a_syntax, - 3 ); + for ( ; bv->bv_val != NULL; bv++ ) { + int ret; + int rc; + const char *text; + + rc = value_match( &ret, a->a_desc, mra->ma_rule, 0, + bv, &mra->ma_value, &text ); + + if( rc != LDAP_SUCCESS ) { + return rc; + } + + if ( ret == 0 ) { + return LDAP_COMPARE_TRUE; + } + } + } + } else { - switch ( type ) { - case LDAP_FILTER_EQUALITY: - if ( rc == 0 ) { - return( 0 ); + /* + * No attribute description: test all + */ + for ( a = e->e_attrs; a != NULL; a = a->a_next ) { + struct berval *bv, value; + const char *text = NULL; + int rc; + + /* check if matching is appropriate */ + if ( !mr_usable_with_at( mra->ma_rule, a->a_desc->ad_type )) { + continue; } - break; - case LDAP_FILTER_GE: - if ( rc >= 0 ) { - return( 0 ); + /* normalize for equality */ + rc = asserted_value_validate_normalize( a->a_desc, mra->ma_rule, + SLAP_MR_EXT|SLAP_MR_VALUE_OF_ASSERTION_SYNTAX, + &mra->ma_value, &value, &text, memctx ); + if ( rc != LDAP_SUCCESS ) { + continue; } - break; - case LDAP_FILTER_LE: - if ( rc <= 0 ) { - return( 0 ); + /* check search access */ + if ( !access_allowed( op, e, + a->a_desc, &value, ACL_SEARCH, NULL ) ) { + continue; + } + + /* check match */ + if (mra->ma_rule == a->a_desc->ad_type->sat_equality) + bv = a->a_nvals; + else + bv = a->a_vals; + for ( ; bv->bv_val != NULL; bv++ ) + { + int ret; + int rc; + + rc = value_match( &ret, a->a_desc, mra->ma_rule, 0, + bv, &value, &text ); + + if( rc != LDAP_SUCCESS ) { + return rc; + } + + if ( ret == 0 ) { + return LDAP_COMPARE_TRUE; + } } - break; } } - return( 1 ); -} + /* check attrs in DN AVAs if required */ + if ( mra->ma_dnattrs ) { + LDAPDN dn = NULL; + int iRDN, iAVA; + int rc; -static int -test_presence_filter( - Backend *be, - Connection *conn, - Operation *op, - Entry *e, - char *type -) -{ - if ( be != NULL && ! access_allowed( be, conn, op, e, - type, NULL, ACL_SEARCH ) ) - { - return( -2 ); + /* parse and pretty the dn */ + rc = dnPrettyDN( NULL, &e->e_name, &dn, memctx ); + if ( rc != LDAP_SUCCESS ) { + return LDAP_INVALID_SYNTAX; + } + + /* for each AVA of each RDN ... */ + for ( iRDN = 0; dn[ iRDN ]; iRDN++ ) { + LDAPRDN rdn = dn[ iRDN ]; + + for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) { + LDAPAVA *ava = rdn[ iAVA ]; + struct berval *bv = &ava->la_value, value; + AttributeDescription *ad = (AttributeDescription *)ava->la_private; + int ret; + int rc; + const char *text; + + assert( ad ); + + if ( mra->ma_desc ) { + /* have a mra type? check for subtype */ + if ( !is_ad_subtype( ad, mra->ma_desc ) ) { + continue; + } + value = mra->ma_value; + + } else { + const char *text = NULL; + + /* check if matching is appropriate */ + if ( !mr_usable_with_at( mra->ma_rule, ad->ad_type )) { + continue; + } + + /* normalize for equality */ + rc = asserted_value_validate_normalize( ad, + mra->ma_rule, + SLAP_MR_EXT|SLAP_MR_VALUE_OF_ASSERTION_SYNTAX, + &mra->ma_value, &value, &text, memctx ); + if ( rc != LDAP_SUCCESS ) { + continue; + } + + /* check search access */ + if ( !access_allowed( op, e, + ad, &value, ACL_SEARCH, NULL ) ) { + continue; + } + } + + /* check match */ + rc = value_match( &ret, ad, mra->ma_rule, 0, + bv, &value, &text ); + + if( rc != LDAP_SUCCESS ) { + ldap_dnfree_x( dn, memctx ); + return rc; + } + + if ( ret == 0 ) { + ldap_dnfree_x( dn, memctx ); + return LDAP_COMPARE_TRUE; + } + } + } } - return( attr_find( e->e_attrs, type ) != NULL ? 0 : -1 ); + return LDAP_COMPARE_FALSE; } static int -test_approx_filter( - Backend *be, - Connection *conn, - Operation *op, - Entry *e, - Ava *ava +test_ava_filter( + Operation *op, + Entry *e, + AttributeAssertion *ava, + int type ) { - char *w1, *w2, *c1, *c2; - int i; Attribute *a; - if ( be != NULL && ! access_allowed( be, conn, op, e, - ava->ava_type, NULL, ACL_SEARCH ) ) + if ( !access_allowed( op, e, + ava->aa_desc, &ava->aa_value, ACL_SEARCH, NULL ) ) { - return( -2 ); + return LDAP_INSUFFICIENT_ACCESS; } - if ( (a = attr_find( e->e_attrs, ava->ava_type )) == NULL ) { - return( -1 ); - } + for(a = attrs_find( e->e_attrs, ava->aa_desc ); + a != NULL; + a = attrs_find( a->a_next, ava->aa_desc ) ) + { + MatchingRule *mr; + struct berval *bv; - /* for each value in the attribute */ - for ( i = 0; a->a_vals[i] != NULL; i++ ) { - /* - * try to match words in the filter value in order - * in the attribute value. - */ + switch ( type ) { + case LDAP_FILTER_APPROX: + mr = a->a_desc->ad_type->sat_approx; + if( mr != NULL ) break; - w2 = a->a_vals[i]->bv_val; - /* for each word in the filter value */ - for ( w1 = first_word( ava->ava_value.bv_val ); w1 != NULL; - w1 = next_word( w1 ) ) { - if ( (c1 = phonetic( w1 )) == NULL ) { - break; + /* use EQUALITY matching rule if no APPROX rule */ + + case LDAP_FILTER_EQUALITY: + mr = a->a_desc->ad_type->sat_equality; + break; + + case LDAP_FILTER_GE: + case LDAP_FILTER_LE: + mr = a->a_desc->ad_type->sat_ordering; + break; + + default: + mr = NULL; + } + + if( mr == NULL ) { + continue; + } + + for ( bv = a->a_nvals; bv->bv_val != NULL; bv++ ) + { + int ret; + int rc; + const char *text; + + rc = value_match( &ret, a->a_desc, mr, 0, + bv, &ava->aa_value, &text ); + + if( rc != LDAP_SUCCESS ) { + return rc; } - /* - * for each word in the attribute value from - * where we left off... - */ - for ( w2 = first_word( w2 ); w2 != NULL; - w2 = next_word( w2 ) ) { - c2 = phonetic( w2 ); - if ( strcmp( c1, c2 ) == 0 ) { - free( c2 ); - break; + switch ( type ) { + case LDAP_FILTER_EQUALITY: + case LDAP_FILTER_APPROX: + if ( ret == 0 ) { + return LDAP_COMPARE_TRUE; } - free( c2 ); - } - free( c1 ); + break; - /* - * if we stopped because we ran out of words - * before making a match, go on to the next - * value. otherwise try to keep matching - * words in this value from where we left off. - */ - if ( w2 == NULL ) { + case LDAP_FILTER_GE: + if ( ret >= 0 ) { + return LDAP_COMPARE_TRUE; + } + break; + + case LDAP_FILTER_LE: + if ( ret <= 0 ) { + return LDAP_COMPARE_TRUE; + } break; - } else { - w2 = next_word( w2 ); } } + } + + if ( ava->aa_desc == slap_schema.si_ad_hasSubordinates + && op && op->o_bd && op->o_bd->be_has_subordinates ) { + int hasSubordinates; + struct berval hs; + /* - * if we stopped because we ran out of words we - * have a match. + * No other match should be allowed ... */ - if ( w1 == NULL ) { - return( 0 ); + assert( type == LDAP_FILTER_EQUALITY ); + + if (op->o_bd->be_has_subordinates( op, e, &hasSubordinates ) != LDAP_SUCCESS) { + return LDAP_OTHER; + } + + if ( hasSubordinates == LDAP_COMPARE_TRUE ) { + hs = slap_true_bv; + + } else if ( hasSubordinates == LDAP_COMPARE_FALSE ) { + hs = slap_false_bv; + + } else { + return LDAP_OTHER; + } + + if ( bvmatch( &ava->aa_value, &hs ) ) { + return LDAP_COMPARE_TRUE; } + + return LDAP_COMPARE_FALSE; } - return( 1 ); + return( LDAP_COMPARE_FALSE ); } + static int -test_filter_list( - Backend *be, - Connection *conn, - Operation *op, - Entry *e, - Filter *flist, - int ftype +test_presence_filter( + Operation *op, + Entry *e, + AttributeDescription *desc ) { - int nomatch; - Filter *f; + Attribute *a; - Debug( LDAP_DEBUG_FILTER, "=> test_filter_list\n", 0, 0, 0 ); + if ( !access_allowed( op, e, desc, NULL, ACL_SEARCH, NULL ) ) + { + return LDAP_INSUFFICIENT_ACCESS; + } - nomatch = 1; - for ( f = flist; f != NULL; f = f->f_next ) { - if ( test_filter( be, conn, op, e, f ) != 0 ) { - if ( ftype == LDAP_FILTER_AND ) { - Debug( LDAP_DEBUG_FILTER, - "<= test_filter_list 1\n", 0, 0, 0 ); - return( 1 ); - } - } else { - nomatch = 0; + a = attrs_find( e->e_attrs, desc ); + + if ( a == NULL && desc == slap_schema.si_ad_hasSubordinates ) { + + /* + * XXX: fairly optimistic: if the function is defined, + * then PRESENCE must succeed, because hasSubordinate + * is boolean-valued; I think we may live with this + * simplification by now + */ + if ( op && op->o_bd && op->o_bd->be_has_subordinates ) { + return LDAP_COMPARE_TRUE; } + + return LDAP_COMPARE_FALSE; } - Debug( LDAP_DEBUG_FILTER, "<= test_filter_list %d\n", nomatch, 0, 0 ); - return( nomatch ); + return a != NULL ? LDAP_COMPARE_TRUE : LDAP_COMPARE_FALSE; } -static void -strcpy_regex( char *d, char *s ) + +static int +test_filter_and( + Operation *op, + Entry *e, + Filter *flist +) { - for ( ; *s; s++ ) { - switch ( *s ) { - case '^': - case '.': - case '[': - case ']': /* ? */ - case '$': - case '(': - case ')': /* ? */ - case '|': - case '*': - case '+': - case '?': - case '{': - case '}': /* ? */ - case '\\': - *d++ = '\\'; - /* FALL */ - default: - *d++ = *s; + Filter *f; + int rtn = LDAP_COMPARE_TRUE; /* True if empty */ + +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, ENTRY, "test_filter_and: begin\n", 0, 0, 0 ); +#else + Debug( LDAP_DEBUG_FILTER, "=> test_filter_and\n", 0, 0, 0 ); +#endif + + + for ( f = flist; f != NULL; f = f->f_next ) { + int rc = test_filter( op, e, f ); + + if ( rc == LDAP_COMPARE_FALSE ) { + /* filter is False */ + rtn = rc; + break; + } + + if ( rc != LDAP_COMPARE_TRUE ) { + /* filter is Undefined unless later elements are False */ + rtn = rc; } } - *d = '\0'; + +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, RESULTS, "test_filter_and: rc=%d\n", rtn, 0, 0 ); +#else + Debug( LDAP_DEBUG_FILTER, "<= test_filter_and %d\n", rtn, 0, 0 ); +#endif + + return rtn; } static int -test_substring_filter( - Backend *be, - Connection *conn, - Operation *op, - Entry *e, - Filter *f +test_filter_or( + Operation *op, + Entry *e, + Filter *flist ) { - Attribute *a; - int i, rc; - char *p, *end, *realval, *tmp; - char pat[BUFSIZ]; - char buf[BUFSIZ]; - struct berval *val; - regex_t re; + Filter *f; + int rtn = LDAP_COMPARE_FALSE; /* False if empty */ - Debug( LDAP_DEBUG_FILTER, "begin test_substring_filter\n", 0, 0, 0 ); +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, ENTRY, "test_filter_or: begin\n", 0, 0, 0 ); +#else + Debug( LDAP_DEBUG_FILTER, "=> test_filter_or\n", 0, 0, 0 ); +#endif - if ( be != NULL && ! access_allowed( be, conn, op, e, - f->f_sub_type, NULL, ACL_SEARCH ) ) - { - return( -2 ); - } - if ( (a = attr_find( e->e_attrs, f->f_sub_type )) == NULL ) { - return( -1 ); - } - - if ( a->a_syntax & SYNTAX_BIN ) { - Debug( LDAP_DEBUG_FILTER, "test_substring_filter bin attr\n", - 0, 0, 0 ); - return( -1 ); - } + for ( f = flist; f != NULL; f = f->f_next ) { + int rc = test_filter( op, e, f ); - /* - * construct a regular expression corresponding to the - * filter and let regex do the work - */ - - pat[0] = '\0'; - p = pat; - end = pat + sizeof(pat) - 2; /* leave room for null */ - if ( f->f_sub_initial != NULL ) { - strcpy( p, "^" ); - p = strchr( p, '\0' ); - /* 2 * in case every char is special */ - if ( p + 2 * strlen( f->f_sub_initial ) > end ) { - Debug( LDAP_DEBUG_ANY, "not enough pattern space\n", - 0, 0, 0 ); - return( -1 ); - } - strcpy_regex( p, f->f_sub_initial ); - p = strchr( p, '\0' ); - } - if ( f->f_sub_any != NULL ) { - for ( i = 0; f->f_sub_any[i] != NULL; i++ ) { - /* ".*" + value */ - if ( p + 2 * strlen( f->f_sub_any[i] ) + 2 > end ) { - Debug( LDAP_DEBUG_ANY, - "not enough pattern space\n", 0, 0, 0 ); - return( -1 ); - } - strcpy( p, ".*" ); - p = strchr( p, '\0' ); - strcpy_regex( p, f->f_sub_any[i] ); - p = strchr( p, '\0' ); + if ( rc == LDAP_COMPARE_TRUE ) { + /* filter is True */ + rtn = rc; + break; } - } - if ( f->f_sub_final != NULL ) { - /* ".*" + value */ - if ( p + 2 * strlen( f->f_sub_final ) + 2 > end ) { - Debug( LDAP_DEBUG_ANY, "not enough pattern space\n", - 0, 0, 0 ); - return( -1 ); + + if ( rc != LDAP_COMPARE_FALSE ) { + /* filter is Undefined unless later elements are True */ + rtn = rc; } - strcpy( p, ".*" ); - p = strchr( p, '\0' ); - strcpy_regex( p, f->f_sub_final ); - p = strchr( p, '\0' ); - strcpy( p, "$" ); } - /* compile the regex */ - Debug( LDAP_DEBUG_FILTER, "test_substring_filter: regcomp pat: %s\n", - pat, 0, 0 ); - if ((rc = regcomp(&re, pat, REG_EXTENDED))) { - char error[512]; +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, ENTRY, "test_filter_or: result=%d\n", rtn, 0, 0 ); +#else + Debug( LDAP_DEBUG_FILTER, "<= test_filter_or %d\n", rtn, 0, 0 ); +#endif + + return rtn; +} + + +static int +test_substrings_filter( + Operation *op, + Entry *e, + Filter *f +) +{ + Attribute *a; - regerror(rc, &re, error, sizeof(error)); - Debug( LDAP_DEBUG_ANY, "regcomp failed (%s) %s\n", - p, error, 0 ); - return( -1 ); +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, ENTRY, "test_substrings_filter: begin\n", 0, 0, 0 ); +#else + Debug( LDAP_DEBUG_FILTER, "begin test_substrings_filter\n", 0, 0, 0 ); +#endif + + + if ( !access_allowed( op, e, + f->f_sub_desc, NULL, ACL_SEARCH, NULL ) ) + { + return LDAP_INSUFFICIENT_ACCESS; } - /* for each value in the attribute see if regex matches */ - for ( i = 0; a->a_vals[i] != NULL; i++ ) { - val = a->a_vals[i]; - tmp = NULL; - if ( val->bv_len < sizeof(buf) ) { - strcpy( buf, val->bv_val ); - realval = buf; - } else { - tmp = (char *) ch_malloc( val->bv_len + 1 ); - strcpy( tmp, val->bv_val ); - realval = tmp; + for(a = attrs_find( e->e_attrs, f->f_sub_desc ); + a != NULL; + a = attrs_find( a->a_next, f->f_sub_desc ) ) + { + MatchingRule *mr = a->a_desc->ad_type->sat_substr; + struct berval *bv; + + if( mr == NULL ) { + continue; } - value_normalize( realval, a->a_syntax ); - rc = !regexec(&re, realval, 0, NULL, 0); + for ( bv = a->a_nvals; bv->bv_val != NULL; bv++ ) + { + int ret; + int rc; + const char *text; - if ( tmp != NULL ) { - free( tmp ); - } - if ( rc == 1 ) { - regfree(&re); - return( 0 ); + rc = value_match( &ret, a->a_desc, mr, 0, + bv, f->f_sub, &text ); + + if( rc != LDAP_SUCCESS ) { + return rc; + } + + if ( ret == 0 ) { + return LDAP_COMPARE_TRUE; + } } } - regfree(&re); +#ifdef NEW_LOGGING + LDAP_LOG( FILTER, ENTRY, "test_substrings_filter: return FALSE\n", 0, 0, 0 ); +#else + Debug( LDAP_DEBUG_FILTER, "end test_substrings_filter 1\n", 0, 0, 0 ); +#endif - Debug( LDAP_DEBUG_FILTER, "end test_substring_filter 1\n", 0, 0, 0 ); - return( 1 ); + return LDAP_COMPARE_FALSE; }