X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=libraries%2Flibldap%2Fsearch.c;h=762bfd2fe7abd4999fd9365d75f72dcea8d9c7a2;hb=2f964def8aecf06e13f513244150c5e24f5533ec;hp=da6e7d37636c35d446e6fe7942056e36bb8b3b4b;hpb=30eb9ed76f5b1cdc834ff531f449e1d9ee3badf3;p=openldap

diff --git a/libraries/libldap/search.c b/libraries/libldap/search.c
index da6e7d3763..762bfd2fe7 100644
--- a/libraries/libldap/search.c
+++ b/libraries/libldap/search.c
@@ -1,43 +1,169 @@
-/*
- *  Copyright (c) 1990 Regents of the University of Michigan.
- *  All rights reserved.
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2006 The OpenLDAP Foundation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
  *
- *  search.c
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* Portions Copyright (c) 1990 Regents of the University of Michigan.
+ * All rights reserved.
  */
 
 #include "portable.h"
 
-#ifndef lint 
-static char copyright[] = "@(#) Copyright (c) 1990 Regents of the University of Michigan.\nAll rights reserved.\n";
-#endif
-
 #include <stdio.h>
-#include <ctype.h>
-#include <stdlib.h>
+
+#include <ac/stdlib.h>
 
 #include <ac/socket.h>
 #include <ac/string.h>
 #include <ac/time.h>
 
-#include "lber.h"
-#include "ldap.h"
 #include "ldap-int.h"
+#include "ldap_log.h"
+
+/*
+ * ldap_search_ext - initiate an ldap search operation.
+ *
+ * Parameters:
+ *
+ *	ld		LDAP descriptor
+ *	base		DN of the base object
+ *	scope		the search scope - one of
+ *				LDAP_SCOPE_BASE (baseObject),
+ *			    LDAP_SCOPE_ONELEVEL (oneLevel),
+ *				LDAP_SCOPE_SUBTREE (subtree), or
+ *				LDAP_SCOPE_SUBORDINATE (children) -- OpenLDAP extension
+ *	filter		a string containing the search filter
+ *			(e.g., "(|(cn=bob)(sn=bob))")
+ *	attrs		list of attribute types to return for matches
+ *	attrsonly	1 => attributes only 0 => attributes and values
+ *
+ * Example:
+ *	char	*attrs[] = { "mail", "title", 0 };
+ *	ldap_search_ext( ld, "dc=example,dc=com", LDAP_SCOPE_SUBTREE, "cn~=bob",
+ *	    attrs, attrsonly, sctrls, ctrls, timeout, sizelimit,
+ *		&msgid );
+ */
+int
+ldap_search_ext(
+	LDAP *ld,
+	LDAP_CONST char *base,
+	int scope,
+	LDAP_CONST char *filter,
+	char **attrs,
+	int attrsonly,
+	LDAPControl **sctrls,
+	LDAPControl **cctrls,
+	struct timeval *timeout,
+	int sizelimit,
+	int *msgidp )
+{
+	int rc;
+	BerElement	*ber;
+	int timelimit;
+	ber_int_t id;
+
+	Debug( LDAP_DEBUG_TRACE, "ldap_search_ext\n", 0, 0, 0 );
+
+	assert( ld != NULL );
+	assert( LDAP_VALID( ld ) );
+
+	/* check client controls */
+	rc = ldap_int_client_controls( ld, cctrls );
+	if( rc != LDAP_SUCCESS ) return rc;
+
+	/*
+	 * if timeout is provided, both tv_sec and tv_usec must
+	 * not be zero
+	 */
+	if( timeout != NULL ) {
+		if( timeout->tv_sec == 0 && timeout->tv_usec == 0 ) {
+			return LDAP_PARAM_ERROR;
+		}
+
+		/* timelimit must be non-zero if timeout is provided */
+		timelimit = timeout->tv_sec != 0 ? timeout->tv_sec : 1;
+
+	} else {
+		/* no timeout, no timelimit */
+		timelimit = -1;
+	}
+
+	ber = ldap_build_search_req( ld, base, scope, filter, attrs,
+	    attrsonly, sctrls, cctrls, timelimit, sizelimit, &id ); 
+
+	if ( ber == NULL ) {
+		return ld->ld_errno;
+	}
+
+
+	/* send the message */
+	*msgidp = ldap_send_initial_request( ld, LDAP_REQ_SEARCH, base, ber, id );
+
+	if( *msgidp < 0 )
+		return ld->ld_errno;
+
+	return LDAP_SUCCESS;
+}
+
+int
+ldap_search_ext_s(
+	LDAP *ld,
+	LDAP_CONST char *base,
+	int scope,
+	LDAP_CONST char *filter,
+	char **attrs,
+	int attrsonly,
+	LDAPControl **sctrls,
+	LDAPControl **cctrls,
+	struct timeval *timeout,
+	int sizelimit,
+	LDAPMessage **res )
+{
+	int rc;
+	int	msgid;
 
-static char *find_right_paren LDAP_P(( char *s ));
-static char *put_complex_filter LDAP_P(( BerElement *ber, char *str,
-	unsigned long tag, int not ));
-static int put_filter LDAP_P(( BerElement *ber, char *str ));
-static int put_simple_filter LDAP_P(( BerElement *ber, char *str ));
-static int put_substring_filter LDAP_P(( BerElement *ber, char *type, char *str ));
-static int put_filter_list LDAP_P(( BerElement *ber, char *str ));
+	rc = ldap_search_ext( ld, base, scope, filter, attrs, attrsonly,
+		sctrls, cctrls, timeout, sizelimit, &msgid );
+
+	if ( rc != LDAP_SUCCESS ) {
+		return( rc );
+	}
+
+	rc = ldap_result( ld, msgid, LDAP_MSG_ALL, timeout, res );
+
+	if( rc <= 0 ) {
+		/* error(-1) or timeout(0) */
+		return( ld->ld_errno );
+	}
+
+	if( rc == LDAP_RES_SEARCH_REFERENCE || rc == LDAP_RES_INTERMEDIATE ) {
+		return( ld->ld_errno );
+	}
+
+	return( ldap_result2error( ld, *res, 0 ) );
+}
 
 /*
- * ldap_search - initiate an ldap (and X.500) search operation.  Parameters:
+ * ldap_search - initiate an ldap search operation.
+ *
+ * Parameters:
  *
  *	ld		LDAP descriptor
  *	base		DN of the base object
- *	scope		the search scope - one of LDAP_SCOPE_BASE,
- *			    LDAP_SCOPE_ONELEVEL, LDAP_SCOPE_SUBTREE
+ *	scope		the search scope - one of
+ *				LDAP_SCOPE_BASE (baseObject),
+ *			    LDAP_SCOPE_ONELEVEL (oneLevel),
+ *				LDAP_SCOPE_SUBTREE (subtree), or
+ *				LDAP_SCOPE_SUBORDINATE (children) -- OpenLDAP extension
  *	filter		a string containing the search filter
  *			(e.g., "(|(cn=bob)(sn=bob))")
  *	attrs		list of attribute types to return for matches
@@ -45,41 +171,48 @@ static int put_filter_list LDAP_P(( BerElement *ber, char *str ));
  *
  * Example:
  *	char	*attrs[] = { "mail", "title", 0 };
- *	msgid = ldap_search( ld, "c=us@o=UM", LDAP_SCOPE_SUBTREE, "cn~=bob",
+ *	msgid = ldap_search( ld, "dc=example,dc=com", LDAP_SCOPE_SUBTREE, "cn~=bob",
  *	    attrs, attrsonly );
  */
 int
-ldap_search( LDAP *ld, char *base, int scope, char *filter,
+ldap_search(
+	LDAP *ld, LDAP_CONST char *base, int scope, LDAP_CONST char *filter,
 	char **attrs, int attrsonly )
 {
 	BerElement	*ber;
+	ber_int_t	id;
 
 	Debug( LDAP_DEBUG_TRACE, "ldap_search\n", 0, 0, 0 );
 
-	if (( ber = ldap_build_search_req( ld, base, scope, filter, attrs,
-	    attrsonly )) == NULLBER ) {
+	assert( ld != NULL );
+	assert( LDAP_VALID( ld ) );
+
+	ber = ldap_build_search_req( ld, base, scope, filter, attrs,
+	    attrsonly, NULL, NULL, -1, -1, &id ); 
+
+	if ( ber == NULL ) {
 		return( -1 );
 	}
 
-#ifndef NO_CACHE
-	if ( ld->ld_cache != NULL ) {
-		if ( ldap_check_cache( ld, LDAP_REQ_SEARCH, ber ) == 0 ) {
-			ber_free( ber, 1 );
-			ld->ld_errno = LDAP_SUCCESS;
-			return( ld->ld_msgid );
-		}
-		ldap_add_request_to_cache( ld, LDAP_REQ_SEARCH, ber );
-	}
-#endif /* NO_CACHE */
 
 	/* send the message */
-	return ( ldap_send_initial_request( ld, LDAP_REQ_SEARCH, base, ber ));
+	return ( ldap_send_initial_request( ld, LDAP_REQ_SEARCH, base, ber, id ));
 }
 
 
 BerElement *
-ldap_build_search_req( LDAP *ld, char *base, int scope, char *filter,
-	char **attrs, int attrsonly )
+ldap_build_search_req(
+	LDAP *ld,
+	LDAP_CONST char *base,
+	ber_int_t scope,
+	LDAP_CONST char *filter,
+	char **attrs,
+	ber_int_t attrsonly,
+	LDAPControl **sctrls,
+	LDAPControl **cctrls,
+	ber_int_t timelimit,
+	ber_int_t sizelimit,
+	ber_int_t *idp)
 {
 	BerElement	*ber;
 	int		err;
@@ -109,446 +242,253 @@ ldap_build_search_req( LDAP *ld, char *base, int scope, char *filter,
 	 */
 
 	/* create a message to send */
-	if ( (ber = ldap_alloc_ber_with_options( ld )) == NULLBER ) {
-		return( NULLBER );
+	if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
+		return( NULL );
 	}
 
 	if ( base == NULL ) {
-	    base = "";
+		/* no base provided, use session default base */
+		base = ld->ld_options.ldo_defbase;
+
+		if ( base == NULL ) {
+			/* no session default base, use top */
+			base = "";
+		}
 	}
 
-#ifdef CLDAP
-	if ( ld->ld_sb.sb_naddr > 0 ) {
-	    err = ber_printf( ber, "{ist{seeiib", ++ld->ld_msgid,
-		ld->ld_cldapdn, LDAP_REQ_SEARCH, base, scope, ld->ld_deref,
-		ld->ld_sizelimit, ld->ld_timelimit, attrsonly );
-	} else {
-#endif /* CLDAP */
-		err = ber_printf( ber, "{it{seeiib", ++ld->ld_msgid,
-		    LDAP_REQ_SEARCH, base, scope, ld->ld_deref,
-		    ld->ld_sizelimit, ld->ld_timelimit, attrsonly );
-#ifdef CLDAP
+	LDAP_NEXT_MSGID( ld, *idp );
+#ifdef LDAP_CONNECTIONLESS
+	if ( LDAP_IS_UDP(ld) ) {
+	    err = ber_write( ber, ld->ld_options.ldo_peer,
+		    sizeof(struct sockaddr), 0);
+	}
+	if ( LDAP_IS_UDP(ld) && ld->ld_options.ldo_version == LDAP_VERSION2) {
+	    char *dn = ld->ld_options.ldo_cldapdn;
+	    if (!dn) dn = "";
+	    err = ber_printf( ber, "{ist{seeiib", *idp, dn,
+		LDAP_REQ_SEARCH, base, (ber_int_t) scope, ld->ld_deref,
+		(sizelimit < 0) ? ld->ld_sizelimit : sizelimit,
+		(timelimit < 0) ? ld->ld_timelimit : timelimit,
+		attrsonly );
+	} else
+#endif
+	{
+	    err = ber_printf( ber, "{it{seeiib", *idp,
+		LDAP_REQ_SEARCH, base, (ber_int_t) scope, ld->ld_deref,
+		(sizelimit < 0) ? ld->ld_sizelimit : sizelimit,
+		(timelimit < 0) ? ld->ld_timelimit : timelimit,
+		attrsonly );
 	}
-#endif /* CLDAP */
 
 	if ( err == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
-		return( NULLBER );
+		return( NULL );
+	}
+
+	if( filter == NULL ) {
+		filter = "(objectclass=*)";
 	}
 
-	filter = strdup( filter );
-	err = put_filter( ber, filter );
-	free( filter );
+	err = ldap_pvt_put_filter( ber, filter );
 
 	if ( err  == -1 ) {
 		ld->ld_errno = LDAP_FILTER_ERROR;
 		ber_free( ber, 1 );
-		return( NULLBER );
+		return( NULL );
 	}
 
-	if ( ber_printf( ber, "{v}}}", attrs ) == -1 ) {
-		ld->ld_errno = LDAP_ENCODING_ERROR;
-		ber_free( ber, 1 );
-		return( NULLBER );
-	}
+#ifdef LDAP_DEBUG
+	if ( ldap_debug & LDAP_DEBUG_ARGS ) {
+		char	buf[ BUFSIZ ] = { ' ', '*', '\0' };
 
-	return( ber );
-}
+		if ( attrs != NULL ) {
+			char	*ptr;
+			int	i;
 
-static char *
-find_right_paren( char *s )
-{
-	int	balance, escape;
-
-	balance = 1;
-	escape = 0;
-	while ( *s && balance ) {
-		if ( escape == 0 ) {
-			if ( *s == '(' )
-				balance++;
-			else if ( *s == ')' )
-				balance--;
-		}
-		if ( *s == '\\' && ! escape )
-			escape = 1;
-		else
-			escape = 0;
-		if ( balance )
-			s++;
-	}
-
-	return( *s ? s : NULL );
-}
-
-static char *
-put_complex_filter( BerElement *ber, char *str, unsigned long tag, int not )
-{
-	char	*next;
+			for ( ptr = buf, i = 0;
+				attrs[ i ] != NULL && ptr < &buf[ sizeof( buf ) ];
+				i++ )
+			{
+				ptr += snprintf( ptr, sizeof( buf ) - ( ptr - buf ),
+					" %s", attrs[ i ] );
+			}
 
-	/*
-	 * We have (x(filter)...) with str sitting on
-	 * the x.  We have to find the paren matching
-	 * the one before the x and put the intervening
-	 * filters by calling put_filter_list().
-	 */
+			if ( ptr >= &buf[ sizeof( buf ) ] ) {
+				AC_MEMCPY( &buf[ sizeof( buf ) - STRLENOF( "...(truncated)" ) - 1 ],
+					"...(truncated)", STRLENOF( "...(truncated)" ) + 1 );
+			} 
+		}
 
-	/* put explicit tag */
-	if ( ber_printf( ber, "t{", tag ) == -1 )
-		return( NULL );
-/*
-	if ( !not && ber_printf( ber, "{" ) == -1 )
-		return( NULL );
-*/
+		Debug( LDAP_DEBUG_ARGS, "ldap_build_search_req ATTRS:%s\n", buf, 0, 0 );
+	}
+#endif /* LDAP_DEBUG */
 
-	str++;
-	if ( (next = find_right_paren( str )) == NULL )
+	if ( ber_printf( ber, /*{*/ "{v}N}", attrs ) == -1 ) {
+		ld->ld_errno = LDAP_ENCODING_ERROR;
+		ber_free( ber, 1 );
 		return( NULL );
+	}
 
-	*next = '\0';
-	if ( put_filter_list( ber, str ) == -1 )
+	/* Put Server Controls */
+	if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
+		ber_free( ber, 1 );
 		return( NULL );
-	*next++ = ')';
+	}
 
-	/* flush explicit tagged thang */
-	if ( ber_printf( ber, "}" ) == -1 )
-		return( NULL );
-/*
-	if ( !not && ber_printf( ber, "}" ) == -1 )
+	if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
+		ld->ld_errno = LDAP_ENCODING_ERROR;
+		ber_free( ber, 1 );
 		return( NULL );
-*/
-
-	return( next );
-}
-
-static int
-put_filter( BerElement *ber, char *str )
-{
-	char	*next, *tmp, *s, *d;
-	int	parens, balance, escape, gotescape;
-
-	/*
-	 * A Filter looks like this:
-	 *      Filter ::= CHOICE {
-	 *              and             [0]     SET OF Filter,
-	 *              or              [1]     SET OF Filter,
-	 *              not             [2]     Filter,
-	 *              equalityMatch   [3]     AttributeValueAssertion,
-	 *              substrings      [4]     SubstringFilter,
-	 *              greaterOrEqual  [5]     AttributeValueAssertion,
-	 *              lessOrEqual     [6]     AttributeValueAssertion,
-	 *              present         [7]     AttributeType,,
-	 *              approxMatch     [8]     AttributeValueAssertion
-	 *      }
-	 *
-	 *      SubstringFilter ::= SEQUENCE {
-	 *              type               AttributeType,
-	 *              SEQUENCE OF CHOICE {
-	 *                      initial          [0] IA5String,
-	 *                      any              [1] IA5String,
-	 *                      final            [2] IA5String
-	 *              }
-	 *      }
-	 * Note: tags in a choice are always explicit
-	 */
-
-	Debug( LDAP_DEBUG_TRACE, "put_filter \"%s\"\n", str, 0, 0 );
-
-	gotescape = parens = 0;
-	while ( *str ) {
-		switch ( *str ) {
-		case '(':
-			str++;
-			parens++;
-			switch ( *str ) {
-			case '&':
-				Debug( LDAP_DEBUG_TRACE, "put_filter: AND\n",
-				    0, 0, 0 );
-
-				if ( (str = put_complex_filter( ber, str,
-				    LDAP_FILTER_AND, 0 )) == NULL )
-					return( -1 );
-
-				parens--;
-				break;
-
-			case '|':
-				Debug( LDAP_DEBUG_TRACE, "put_filter: OR\n",
-				    0, 0, 0 );
-
-				if ( (str = put_complex_filter( ber, str,
-				    LDAP_FILTER_OR, 0 )) == NULL )
-					return( -1 );
-
-				parens--;
-				break;
-
-			case '!':
-				Debug( LDAP_DEBUG_TRACE, "put_filter: NOT\n",
-				    0, 0, 0 );
-
-				if ( (str = put_complex_filter( ber, str,
-				    LDAP_FILTER_NOT, 1 )) == NULL )
-					return( -1 );
-
-				parens--;
-				break;
-
-			default:
-				Debug( LDAP_DEBUG_TRACE, "put_filter: simple\n",
-				    0, 0, 0 );
-
-				balance = 1;
-				escape = 0;
-				next = str;
-				while ( *next && balance ) {
-					if ( escape == 0 ) {
-						if ( *next == '(' )
-							balance++;
-						else if ( *next == ')' )
-							balance--;
-					}
-					if ( *next == '\\' && ! escape )
-						gotescape = escape = 1;
-					else
-						escape = 0;
-					if ( balance )
-						next++;
-				}
-				if ( balance != 0 )
-					return( -1 );
-
-				*next = '\0';
-				tmp = strdup( str );
-				if ( gotescape ) {
-					escape = 0;
-					for ( s = d = tmp; *s; s++ ) {
-						if ( *s != '\\' || escape ) {
-							*d++ = *s;
-							escape = 0;
-						} else {
-							escape = 1;
-						}
-					}
-					*d = '\0';
-				}
-				if ( put_simple_filter( ber, tmp ) == -1 ) {
-					free( tmp );
-					return( -1 );
-				}
-				free( tmp );
-				*next++ = ')';
-				str = next;
-				parens--;
-				break;
-			}
-			break;
-
-		case ')':
-			Debug( LDAP_DEBUG_TRACE, "put_filter: end\n", 0, 0,
-			    0 );
-			if ( ber_printf( ber, "]" ) == -1 )
-				return( -1 );
-			str++;
-			parens--;
-			break;
-
-		case ' ':
-			str++;
-			break;
-
-		default:	/* assume it's a simple type=value filter */
-			Debug( LDAP_DEBUG_TRACE, "put_filter: default\n", 0, 0,
-			    0 );
-			next = strchr( str, '\0' );
-			tmp = strdup( str );
-			if ( strchr( tmp, '\\' ) != NULL ) {
-				escape = 0;
-				for ( s = d = tmp; *s; s++ ) {
-					if ( *s != '\\' || escape ) {
-						*d++ = *s;
-						escape = 0;
-					} else {
-						escape = 1;
-					}
-				}
-				*d = '\0';
-			}
-			if ( put_simple_filter( ber, tmp ) == -1 ) {
-				free( tmp );
-				return( -1 );
-			}
-			free( tmp );
-			str = next;
-			break;
-		}
 	}
 
-	return( parens ? -1 : 0 );
+	return( ber );
 }
 
-/*
- * Put a list of filters like this "(filter1)(filter2)..."
- */
-
-static int
-put_filter_list( BerElement *ber, char *str )
+int
+ldap_search_st(
+	LDAP *ld, LDAP_CONST char *base, int scope,
+	LDAP_CONST char *filter, char **attrs,
+	int attrsonly, struct timeval *timeout, LDAPMessage **res )
 {
-	char	*next;
-	char	save;
-
-	Debug( LDAP_DEBUG_TRACE, "put_filter_list \"%s\"\n", str, 0, 0 );
-
-	while ( *str ) {
-		while ( *str && isspace( *str ) )
-			str++;
-		if ( *str == '\0' )
-			break;
+	int	msgid;
 
-		if ( (next = find_right_paren( str + 1 )) == NULL )
-			return( -1 );
-		save = *++next;
+	if ( (msgid = ldap_search( ld, base, scope, filter, attrs, attrsonly ))
+	    == -1 )
+		return( ld->ld_errno );
 
-		/* now we have "(filter)" with str pointing to it */
-		*next = '\0';
-		if ( put_filter( ber, str ) == -1 )
-			return( -1 );
-		*next = save;
+	if ( ldap_result( ld, msgid, LDAP_MSG_ALL, timeout, res ) == -1 )
+		return( ld->ld_errno );
 
-		str = next;
+	if ( ld->ld_errno == LDAP_TIMEOUT ) {
+		(void) ldap_abandon( ld, msgid );
+		ld->ld_errno = LDAP_TIMEOUT;
+		return( ld->ld_errno );
 	}
 
-	return( 0 );
+	return( ldap_result2error( ld, *res, 0 ) );
 }
 
-static int
-put_simple_filter( BerElement *ber, char *str )
+int
+ldap_search_s(
+	LDAP *ld,
+	LDAP_CONST char *base,
+	int scope,
+	LDAP_CONST char *filter,
+	char **attrs,
+	int attrsonly,
+	LDAPMessage **res )
 {
-	char		*s;
-	char		*value, savechar;
-	unsigned long	ftype;
-	int		rc;
-
-	Debug( LDAP_DEBUG_TRACE, "put_simple_filter \"%s\"\n", str, 0, 0 );
+	int	msgid;
 
-	if ( (s = strchr( str, '=' )) == NULL )
-		return( -1 );
-	value = s + 1;
-	*s-- = '\0';
-	savechar = *s;
-
-	switch ( *s ) {
-	case '<':
-		ftype = LDAP_FILTER_LE;
-		*s = '\0';
-		break;
-	case '>':
-		ftype = LDAP_FILTER_GE;
-		*s = '\0';
-		break;
-	case '~':
-		ftype = LDAP_FILTER_APPROX;
-		*s = '\0';
-		break;
-	default:
-		if ( strchr( value, '*' ) == NULL ) {
-			ftype = LDAP_FILTER_EQUALITY;
-		} else if ( strcmp( value, "*" ) == 0 ) {
-			ftype = LDAP_FILTER_PRESENT;
-		} else {
-			rc = put_substring_filter( ber, str, value );
-			*(value-1) = '=';
-			return( rc );
-		}
-		break;
-	}
+	if ( (msgid = ldap_search( ld, base, scope, filter, attrs, attrsonly ))
+	    == -1 )
+		return( ld->ld_errno );
 
-	if ( ftype == LDAP_FILTER_PRESENT ) {
-		rc = ber_printf( ber, "ts", ftype, str );
-	} else {
-		rc = ber_printf( ber, "t{ss}", ftype, str, value );
-	}
+	if ( ldap_result( ld, msgid, LDAP_MSG_ALL, (struct timeval *) NULL, res ) == -1 )
+		return( ld->ld_errno );
 
-	*s = savechar;
-	*(value-1) = '=';
-	return( rc == -1 ? rc : 0 );
+	return( ldap_result2error( ld, *res, 0 ) );
 }
 
-static int
-put_substring_filter( BerElement *ber, char *type, char *val )
-{
-	char		*nextstar, gotstar = 0;
-	unsigned long	ftype;
+static char escape[128] = {
+	1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1,
+
+	0, 0, 0, 0, 0, 0, 0, 0,
+	1, 1, 1, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 1, 0, 0, 0,
+
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 1
+};
+#define	NEEDFLTESCAPE(c)	((c) & 0x80 || escape[ (unsigned)(c) ])
 
-	Debug( LDAP_DEBUG_TRACE, "put_substring_filter \"%s=%s\"\n", type,
-	    val, 0 );
+/*
+ * compute the length of the escaped value
+ */
+ber_len_t
+ldap_bv2escaped_filter_value_len( struct berval *in )
+{
+	ber_len_t	i, l;
 
-	if ( ber_printf( ber, "t{s{", LDAP_FILTER_SUBSTRINGS, type ) == -1 )
-		return( -1 );
+	assert( in != NULL );
 
-	while ( val != NULL ) {
-		if ( (nextstar = strchr( val, '*' )) != NULL )
-			*nextstar++ = '\0';
+	if ( in->bv_len == 0 ) {
+		return 0;
+	}
 
-		if ( gotstar == 0 ) {
-			ftype = LDAP_SUBSTRING_INITIAL;
-		} else if ( nextstar == NULL ) {
-			ftype = LDAP_SUBSTRING_FINAL;
-		} else {
-			ftype = LDAP_SUBSTRING_ANY;
-		}
-		if ( *val != '\0' ) {
-			if ( ber_printf( ber, "ts", ftype, val ) == -1 )
-				return( -1 );
+	for( l = 0, i = 0; i < in->bv_len; l++, i++ ) {
+		char c = in->bv_val[ i ];
+		if ( NEEDFLTESCAPE( c ) ) {
+			l += 2;
 		}
-
-		gotstar = 1;
-		if ( nextstar != NULL )
-			*(nextstar-1) = '*';
-		val = nextstar;
 	}
 
-	if ( ber_printf( ber, "}}" ) == -1 )
-		return( -1 );
+	return l;
+}
 
-	return( 0 );
+int
+ldap_bv2escaped_filter_value( struct berval *in, struct berval *out )
+{
+	return ldap_bv2escaped_filter_value_x( in, out, 0, NULL );
 }
 
 int
-ldap_search_st( LDAP *ld, char *base, int scope, char *filter, char **attrs,
-	int attrsonly, struct timeval *timeout, LDAPMessage **res )
+ldap_bv2escaped_filter_value_x( struct berval *in, struct berval *out, int inplace, void *ctx )
 {
-	int	msgid;
+	ber_len_t	i, l;
 
-	if ( (msgid = ldap_search( ld, base, scope, filter, attrs, attrsonly ))
-	    == -1 )
-		return( ld->ld_errno );
+	assert( in != NULL );
+	assert( out != NULL );
 
-	if ( ldap_result( ld, msgid, 1, timeout, res ) == -1 )
-		return( ld->ld_errno );
+	BER_BVZERO( out );
 
-	if ( ld->ld_errno == LDAP_TIMEOUT ) {
-		(void) ldap_abandon( ld, msgid );
-		ld->ld_errno = LDAP_TIMEOUT;
-		return( ld->ld_errno );
+	if ( in->bv_len == 0 ) {
+		return 0;
 	}
 
-	return( ldap_result2error( ld, *res, 0 ) );
-}
+	/* assume we'll escape everything */
+	l = ldap_bv2escaped_filter_value_len( in );
+	if ( l == in->bv_len ) {
+		if ( inplace ) {
+			*out = *in;
+		} else {
+			ber_dupbv( out, in );
+		}
+		return 0;
+	}
+	out->bv_val = LDAP_MALLOCX( l + 1, ctx );
+	if ( out->bv_val == NULL ) {
+		return -1;
+	}
 
-int
-ldap_search_s( LDAP *ld, char *base, int scope, char *filter, char **attrs,
-	int attrsonly, LDAPMessage **res )
-{
-	int	msgid;
+	for ( i = 0; i < in->bv_len; i++ ) {
+		char c = in->bv_val[ i ];
+		if ( NEEDFLTESCAPE( c ) ) {
+			assert( out->bv_len < l - 2 );
+			out->bv_val[out->bv_len++] = '\\';
+			out->bv_val[out->bv_len++] = "0123456789ABCDEF"[0x0f & (c>>4)];
+			out->bv_val[out->bv_len++] = "0123456789ABCDEF"[0x0f & c];
 
-	if ( (msgid = ldap_search( ld, base, scope, filter, attrs, attrsonly ))
-	    == -1 )
-		return( ld->ld_errno );
+		} else {
+			assert( out->bv_len < l );
+			out->bv_val[out->bv_len++] = c;
+		}
+	}
 
-	if ( ldap_result( ld, msgid, 1, (struct timeval *) NULL, res ) == -1 )
-		return( ld->ld_errno );
+	out->bv_val[out->bv_len] = '\0';
 
-	return( ldap_result2error( ld, *res, 0 ) );
+	return 0;
 }