From: Kurt Zeilenga <kurt@openldap.org>
Date: Fri, 30 Jul 1999 23:00:02 +0000 (+0000)
Subject: Enhance LDIF handling
X-Git-Tag: TWEB_OL_BASE~358
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=b73b0c61582166d37d55a90067c5783d2164af39;p=openldap

Enhance LDIF handling
ldapsearch:
    use draft guidelines for determining when to use
    -t only writes binary attributes to files
    -tt writes all attributes to files
    output now lists URL instead of path to such files
    -T dir can be used to specify directory to create temp files in
    -V urlprefix can be used to change the URL prefix
    LDIF is now commented (can be disabled using -LL)
    LDIF now contains version attribute (can be disabled with -LLL)
LDIF:
    put interface changed to allow caller to specify how to encode
    put interface uses draft guidelines for determine when to base64 encode
    wrapping kludged to match old off by one bug
Tests:
    removed trailing space from some attributes (to avoid base64 encoding)
    enabled -LLL in defines.sh (should sed output to remove
        wrapping/comments/redundant separators)
Misc:
    updated codes outputting LDIF to use new put interface
TODO:
    handling of version attribute on input
    handling of URLs on input (ie: fetch URL)
---

diff --git a/clients/tools/ldapmodify.c b/clients/tools/ldapmodify.c
index 851b41fd75..0a230a2b76 100644
--- a/clients/tools/ldapmodify.c
+++ b/clients/tools/ldapmodify.c
@@ -340,7 +340,8 @@ static int
 process_ldif_rec( char *rbuf )
 {
     char	*line, *dn, *type, *value, *newrdn, *newsup, *p;
-    int		rc, linenum, vlen, modop, replicaport;
+    int		rc, linenum, modop, replicaport;
+	ber_len_t vlen;
     int		expect_modop, expect_sep, expect_ct, expect_newrdn, expect_newsup;
     int		expect_deleteoldrdn, deleteoldrdn;
     int		saw_replica, use_record, new_entry, delete_entry, got_all;
diff --git a/clients/tools/ldapsearch.c b/clients/tools/ldapsearch.c
index be840ee596..0ae11544ec 100644
--- a/clients/tools/ldapsearch.c
+++ b/clients/tools/ldapsearch.c
@@ -9,71 +9,87 @@
 #include <ac/string.h>
 #include <ac/unistd.h>
 
-#include <lber.h>
 #include <ldap.h>
 #include <ldif.h>
 
-#define DEFSEP		"="
+#include "ldap_defaults.h"
 
+#define DEFSEP		"="
 
 static void
 usage( char *s )
 {
-    fprintf( stderr, "usage: %s [options] filter [attributes...]\nwhere:\n", s );
-    fprintf( stderr, "    filter\tRFC-1558 compliant LDAP search filter\n" );
-    fprintf( stderr, "    attributes\twhitespace-separated list of attributes to retrieve\n" );
-    fprintf( stderr, "\t\t*          -- all user attributes\n" );
-    fprintf( stderr, "\t\tempty list -- all non-operational attributes\n" );
-    fprintf( stderr, "\t\t1.1        -- no attributes\n" );
-    fprintf( stderr, "options:\n" );
-    fprintf( stderr, "    -n\t\tshow what would be done but don't actually search\n" );
-    fprintf( stderr, "    -v\t\trun in verbose mode (diagnostics to standard output)\n" );
-    fprintf( stderr, "    -t\t\twrite values to files in /tmp\n" );
-    fprintf( stderr, "    -u\t\tinclude User Friendly entry names in the output\n" );
-    fprintf( stderr, "    -A\t\tretrieve attribute names only (no values)\n" );
-    fprintf( stderr, "    -B\t\tdo not suppress printing of non-ASCII values\n" );
-    fprintf( stderr, "    -L\t\tprint entries in LDIF format (-B is implied)\n" );
-    fprintf( stderr, "    -M\t\tenable Manage DSA IT control (-MM implies critical)\n" );
-    fprintf( stderr, "    -R\t\tdo not automatically follow referrals\n" );
-    fprintf( stderr, "    -d level\tset LDAP debugging level to `level'\n" );
-    fprintf( stderr, "    -F sep\tprint `sep' instead of `=' between attribute names and values\n" );
-    fprintf( stderr, "    -S attr\tsort the results by attribute `attr'\n" );
-    fprintf( stderr, "    -f file\tperform sequence of searches listed in `file'\n" );
-    fprintf( stderr, "    -b basedn\tbase dn for search\n" );
-    fprintf( stderr, "    -s scope\tone of base, one, or sub (search scope)\n" );
-    fprintf( stderr, "    -a deref\tone of never, always, search, or find (alias dereferencing)\n" );
-    fprintf( stderr, "    -l time lim\ttime limit (in seconds) for search\n" );
-    fprintf( stderr, "    -z size lim\tsize limit (in entries) for search\n" );
-    fprintf( stderr, "    -D binddn\tbind dn\n" );
-    fprintf( stderr, "    -w passwd\tbind passwd (for simple authentication)\n" );
-    fprintf( stderr, "    -W\t\tprompt for bind passwd\n" );
+	fprintf( stderr,
+"usage: %s [options] filter [attributes...]\nwhere:\n"
+"	filter\tRFC-1558 compliant LDAP search filter\n"
+"	attributes\twhitespace-separated list of attributes to retrieve\n"
+"\t\t1.1		-- no attributes\n"
+"\t\t*		  -- all user attributes\n"
+"\t\t+		  -- all operational attributes\n"
+"\t\tempty list -- all non-operational attributes\n"
+"options:\n"
+"	-n\t\tshow what would be done but don't actually search\n"
+"	-v\t\trun in verbose mode (diagnostics to standard output)\n"
+"	-t\t\twrite binary values to files in TMPDIR\n"
+"	-tt\t\twrite all values to files in TMPDIR\n"
+"	-T path\twrite files to directory specified by path (default: \"/tmp\")\n"
+"	-V prefix\tURL prefix for files (default: \"file://tmp/\"\n"
+"	-u\t\tinclude User Friendly entry names in the output\n"
+"	-A\t\tretrieve attribute names only (no values)\n"
+"	-B\t\tdo not suppress printing of binary values\n"
+"	-F sep\tprint `sep' instead of `=' between attribute names and values\n"
+"	-L\t\tprint entries in LDIF format (implies -B)\n"
+"	-LL\t\tprint entries in LDIF format without comments\n"
+"	-LLL\t\tprint entries in LDIF format without comments and version\n"
+"	-M\t\tenable Manage DSA IT control (-MM to make critical)\n"
+"	-R\t\tdo not automatically follow referrals\n"
+"	-S attr\tsort the results by attribute `attr'\n"
+"	-d level\tset LDAP debugging level to `level'\n"
+"	-f file\tperform sequence of searches listed in `file'\n"
+"	-b basedn\tbase dn for search\n"
+"	-s scope\tone of base, one, or sub (search scope)\n"
+"	-a deref\tone of never, always, search, or find (alias dereferencing)\n"
+"	-l limit\ttime limit (in seconds) for search\n"
+"	-z limit\tsize limit (in entries) for search\n"
+"	-D binddn\tbind dn\n"
+"	-w passwd\tbind passwd (for simple authentication)\n"
+"	-W\t\tprompt for bind passwd\n"
 #ifdef HAVE_KERBEROS
-    fprintf( stderr, "    -k\t\tuse Kerberos instead of Simple Password authentication\n" );
+"	-k\t\tuse Kerberos instead of Simple Password authentication\n"
 #endif
-    fprintf( stderr, "    -h host\tldap server\n" );
-    fprintf( stderr, "    -p port\tport on ldap server\n" );
-    fprintf( stderr, "    -P version\tprocotol version (2 or 3)\n" );
-    exit( EXIT_FAILURE );
+"	-h host\tldap server\n"
+"	-p port\tport on ldap server\n"
+"	-P version\tprocotol version (2 or 3)\n"
+,		s );
+
+	exit( EXIT_FAILURE );
 }
 
 static void print_entry LDAP_P((
-    LDAP	*ld,
-    LDAPMessage	*entry,
-    int		attrsonly));
+	LDAP	*ld,
+	LDAPMessage	*entry,
+	int		attrsonly));
 
-static int write_ldif_value LDAP_P((
-	char *type,
+static int write_ldif LDAP_P((
+	int type,
+	char *name,
 	char *value,
-	unsigned long vallen ));
+	ber_len_t vallen ));
 
 static int dosearch LDAP_P((
 	LDAP	*ld,
-    char	*base,
-    int		scope,
-    char	**attrs,
-    int		attrsonly,
-    char	*filtpatt,
-    char	*value));
+	char	*base,
+	int		scope,
+	char	**attrs,
+	int		attrsonly,
+	char	*filtpatt,
+	char	*value));
+
+#define TMPDIR "/tmp"
+#define URLPRE "file:/tmp/"
+
+static char *tmpdir = NULL;
+static char *urlpre = NULL;
 
 static char	*binddn = NULL;
 static char	*passwd = NULL;
@@ -83,122 +99,132 @@ static int	ldapport = 0;
 static char	*sep = DEFSEP;
 static char	*sortattr = NULL;
 static int	skipsortattr = 0;
-static int	verbose, not, includeufn, allow_binary, vals2tmp, ldif;
+static int	verbose, not, includeufn, binary, vals2tmp, ldif;
 
 int
 main( int argc, char **argv )
 {
-    char		*infile, *filtpattern, **attrs, line[ BUFSIZ ];
-    FILE		*fp;
-    int			rc, i, first, scope, deref, attrsonly, manageDSAit;
-    int			referrals, timelimit, sizelimit, debug;
+	char		*infile, *filtpattern, **attrs, line[ BUFSIZ ];
+	FILE		*fp;
+	int			rc, i, first, scope, deref, attrsonly, manageDSAit;
+	int			referrals, timelimit, sizelimit, debug;
 	int		authmethod, version, want_bindpw;
-    LDAP		*ld;
+	LDAP		*ld;
 
-    infile = NULL;
-    debug = verbose = allow_binary = not = vals2tmp =
-	    attrsonly = manageDSAit = ldif = want_bindpw = 0;
+	infile = NULL;
+	debug = verbose = binary = not = vals2tmp =
+		attrsonly = manageDSAit = ldif = want_bindpw = 0;
 
 	deref = referrals = sizelimit = timelimit = version = -1;
 
 	scope = LDAP_SCOPE_SUBTREE;
-    authmethod = LDAP_AUTH_SIMPLE;
+	authmethod = LDAP_AUTH_SIMPLE;
 
-    while (( i = getopt( argc, argv, "WKknuvtMRABLD:s:f:h:b:d:P:p:F:a:w:l:z:S:")) != EOF ) {
+	while (( i = getopt( argc, argv,
+		"WKknuvtMRABLD:s:f:h:b:d:P:p:F:a:w:l:z:S:T:V:")) != EOF )
+	{
 	switch( i ) {
 	case 'n':	/* do Not do any searches */
-	    ++not;
-	    break;
+		++not;
+		break;
 	case 'v':	/* verbose mode */
-	    ++verbose;
-	    break;
+		++verbose;
+		break;
 	case 'd':
-	    debug |= atoi( optarg );
-	    break;
+		debug |= atoi( optarg );
+		break;
 	case 'k':	/* use kerberos bind */
 #ifdef HAVE_KERBEROS
 		authmethod = LDAP_AUTH_KRBV4;
 #else
 		fprintf (stderr, "%s was not compiled with Kerberos support\n", argv[0]);
 #endif
-	    break;
+		break;
 	case 'K':	/* use kerberos bind, 1st part only */
 #ifdef HAVE_KERBEROS
 		authmethod = LDAP_AUTH_KRBV41;
 #else
 		fprintf (stderr, "%s was not compiled with Kerberos support\n", argv[0]);
 #endif
-	    break;
+		break;
 	case 'u':	/* include UFN */
-	    ++includeufn;
-	    break;
+		++includeufn;
+		break;
 	case 't':	/* write attribute values to /tmp files */
-	    ++vals2tmp;
-	    break;
+		++vals2tmp;
+		break;
 	case 'M':
 		/* enable Manage DSA IT */
 		manageDSAit++;
 		break;
 	case 'R':	/* don't automatically chase referrals */
 		referrals = (int) LDAP_OPT_OFF;
-	    break;
+		break;
 	case 'A':	/* retrieve attribute names only -- no values */
-	    ++attrsonly;
-	    break;
+		++attrsonly;
+		break;
 	case 'L':	/* print entries in LDIF format */
-	    ++ldif;
-	    /* fall through -- always allow binary when outputting LDIF */
+		++ldif;
+		/* fall through -- always allow binary when outputting LDIF */
 	case 'B':	/* allow binary values to be printed */
-	    ++allow_binary;
-	    break;
+		++binary;
+		break;
 	case 's':	/* search scope */
-	    if ( strcasecmp( optarg, "base" ) == 0 ) {
+		if ( strcasecmp( optarg, "base" ) == 0 ) {
 		scope = LDAP_SCOPE_BASE;
-	    } else if ( strcasecmp( optarg, "one" ) == 0 ) {
+		} else if ( strcasecmp( optarg, "one" ) == 0 ) {
 		scope = LDAP_SCOPE_ONELEVEL;
-	    } else if ( strcasecmp( optarg, "sub" ) == 0 ) {
+		} else if ( strcasecmp( optarg, "sub" ) == 0 ) {
 		scope = LDAP_SCOPE_SUBTREE;
-	    } else {
+		} else {
 		fprintf( stderr, "scope should be base, one, or sub\n" );
 		usage( argv[ 0 ] );
-	    }
-	    break;
+		}
+		break;
 
 	case 'a':	/* set alias deref option */
-	    if ( strcasecmp( optarg, "never" ) == 0 ) {
+		if ( strcasecmp( optarg, "never" ) == 0 ) {
 		deref = LDAP_DEREF_NEVER;
-	    } else if ( strcasecmp( optarg, "search" ) == 0 ) {
+		} else if ( strcasecmp( optarg, "search" ) == 0 ) {
 		deref = LDAP_DEREF_SEARCHING;
-	    } else if ( strcasecmp( optarg, "find" ) == 0 ) {
+		} else if ( strcasecmp( optarg, "find" ) == 0 ) {
 		deref = LDAP_DEREF_FINDING;
-	    } else if ( strcasecmp( optarg, "always" ) == 0 ) {
+		} else if ( strcasecmp( optarg, "always" ) == 0 ) {
 		deref = LDAP_DEREF_ALWAYS;
-	    } else {
+		} else {
 		fprintf( stderr, "alias deref should be never, search, find, or always\n" );
 		usage( argv[ 0 ] );
-	    }
-	    break;
-	    
+		}
+		break;
+		
+	case 'T':	/* field separator */
+		if( tmpdir ) free( tmpdir );
+		tmpdir = strdup( optarg );
+		break;
+	case 'V':	/* field separator */
+		if( urlpre ) free( urlpre );
+		urlpre = strdup( optarg );
+		break;
 	case 'F':	/* field separator */
-	    sep = strdup( optarg );
-	    break;
+		sep = strdup( optarg );
+		break;
 	case 'f':	/* input file */
-	    infile = strdup( optarg );
-	    break;
+		infile = strdup( optarg );
+		break;
 	case 'h':	/* ldap host */
-	    ldaphost = strdup( optarg );
-	    break;
+		ldaphost = strdup( optarg );
+		break;
 	case 'b':	/* searchbase */
-	    base = strdup( optarg );
-	    break;
+		base = strdup( optarg );
+		break;
 	case 'D':	/* bind DN */
-	    binddn = strdup( optarg );
-	    break;
+		binddn = strdup( optarg );
+		break;
 	case 'p':	/* ldap port */
-	    ldapport = atoi( optarg );
-	    break;
+		ldapport = atoi( optarg );
+		break;
 	case 'w':	/* bind password */
-	    passwd = strdup( optarg );
+		passwd = strdup( optarg );
 		{
 			char* p;
 
@@ -206,16 +232,16 @@ main( int argc, char **argv )
 				*p = '*';
 			}
 		}
-	    break;
+		break;
 	case 'l':	/* time limit */
-	    timelimit = atoi( optarg );
-	    break;
+		timelimit = atoi( optarg );
+		break;
 	case 'z':	/* size limit */
-	    sizelimit = atoi( optarg );
-	    break;
+		sizelimit = atoi( optarg );
+		break;
 	case 'S':	/* sort attribute */
-	    sortattr = strdup( optarg );
-	    break;
+		sortattr = strdup( optarg );
+		break;
 	case 'W':
 		want_bindpw++;
 		break;
@@ -234,41 +260,65 @@ main( int argc, char **argv )
 		}
 		break;
 	default:
-	    usage( argv[0] );
-	}
-    }
-
-    if ( argc - optind < 1 ) {
-	usage( argv[ 0 ] );
-    }
-    filtpattern = strdup( argv[ optind ] );
-    if ( argv[ optind + 1 ] == NULL ) {
-	attrs = NULL;
-    } else if ( sortattr == NULL || *sortattr == '\0' ) {
-        attrs = &argv[ optind + 1 ];
-    } else {
-	for ( i = optind + 1; i < argc; i++ ) {
-	    if ( strcasecmp( argv[ i ], sortattr ) == 0 ) {
-		break;
-	    }
+		usage( argv[0] );
 	}
-	if ( i == argc ) {
-		skipsortattr = 1;
-		argv[ optind ] = sortattr;
+	}
+
+	if ( argc - optind < 1 ) {
+		usage( argv[ 0 ] );
+	}
+
+	filtpattern = strdup( argv[ optind ] );
+
+	if ( argv[ optind + 1 ] == NULL ) {
+		attrs = NULL;
+	} else if ( sortattr == NULL || *sortattr == '\0' ) {
+		attrs = &argv[ optind + 1 ];
 	} else {
-		optind++;
+		for ( i = optind + 1; i < argc; i++ ) {
+			if ( strcasecmp( argv[ i ], sortattr ) == 0 ) {
+				break;
+			}
+		}
+		if ( i == argc ) {
+			skipsortattr = 1;
+			argv[ optind ] = sortattr;
+		} else {
+			optind++;
+		}
+		attrs = &argv[ optind ];
+	}
+
+	if ( infile != NULL ) {
+		if ( infile[0] == '-' && infile[1] == '\0' ) {
+			fp = stdin;
+		} else if (( fp = fopen( infile, "r" )) == NULL ) {
+			perror( infile );
+			return EXIT_FAILURE;
+		}
+	}
+
+	if( tmpdir == NULL
+		&& (tmpdir = getenv("TMPDIR")) == NULL
+		&& (tmpdir = getenv("TMP")) == NULL
+		&& (tmpdir = getenv("TEMP")) == NULL )
+	{
+		tmpdir = "/tmp";
 	}
-        attrs = &argv[ optind ];
-    }
 
-    if ( infile != NULL ) {
-	if ( infile[0] == '-' && infile[1] == '\0' ) {
-	    fp = stdin;
-	} else if (( fp = fopen( infile, "r" )) == NULL ) {
-	    perror( infile );
-	    return( EXIT_FAILURE );
+	if( urlpre == NULL ) {
+		urlpre = malloc( sizeof("file:///") + strlen(tmpdir) );
+
+		if( urlpre == NULL ) {
+			perror( "malloc" );
+			return EXIT_FAILURE;
+		}
+
+		sprintf( urlpre, "file:///%s/",
+			tmpdir[0] == '/' ? &tmpdir[1] : tmpdir );
+
+		/* urlpre should be URLized.... */
 	}
-    }
 
 	if ( debug ) {
 		if( ber_set_option( NULL, LBER_OPT_DEBUG_LEVEL, &debug ) != LBER_OPT_SUCCESS ) {
@@ -284,16 +334,16 @@ main( int argc, char **argv )
 	(void) SIGNAL( SIGPIPE, SIG_IGN );
 #endif
 
-    if ( verbose ) {
-	fprintf( stderr, "ldap_init( %s, %d )\n",
-		(ldaphost != NULL) ? ldaphost : "<DEFAULT>",
-		ldapport );
-    }
+	if ( verbose ) {
+		fprintf( stderr, "ldap_init( %s, %d )\n",
+			(ldaphost != NULL) ? ldaphost : "<DEFAULT>",
+			ldapport );
+	}
 
-    if (( ld = ldap_init( ldaphost, ldapport )) == NULL ) {
-	perror( "ldap_init" );
-	return( EXIT_FAILURE );
-    }
+	if (( ld = ldap_init( ldaphost, ldapport )) == NULL ) {
+		perror( "ldap_init" );
+		return( EXIT_FAILURE );
+	}
 
 	if (deref != -1 &&
 		ldap_set_option( ld, LDAP_OPT_DEREF, (void *) &deref ) != LDAP_OPT_SUCCESS )
@@ -324,25 +374,14 @@ main( int argc, char **argv )
 		fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n", version );
 	}
 
-	if (want_bindpw)
+	if (want_bindpw) {
 		passwd = getpass("Enter LDAP Password: ");
+	}
 
-    if ( ldap_bind_s( ld, binddn, passwd, authmethod ) != LDAP_SUCCESS ) {
-	ldap_perror( ld, "ldap_bind" );
-	return( EXIT_FAILURE );
-    }
-
-    if ( verbose ) {
-	fprintf( stderr, "filter pattern: %s\nreturning: ", filtpattern );
-	if ( attrs == NULL ) {
-	    printf( "ALL" );
-	} else {
-	    for ( i = 0; attrs[ i ] != NULL; ++i ) {
-		fprintf( stderr, "%s ", attrs[ i ] );
-	    }
+	if ( ldap_bind_s( ld, binddn, passwd, authmethod ) != LDAP_SUCCESS ) {
+		ldap_perror( ld, "ldap_bind" );
+		return( EXIT_FAILURE );
 	}
-	fprintf( stderr, "\n" );
-    }
 
 	if ( manageDSAit ) {
 		int err;
@@ -366,197 +405,270 @@ main( int argc, char **argv )
 		}
 	}
 
-    if ( infile == NULL ) {
-	rc = dosearch( ld, base, scope, attrs, attrsonly, filtpattern, "" );
-    } else {
-	rc = 0;
-	first = 1;
-	while ( rc == 0 && fgets( line, sizeof( line ), fp ) != NULL ) {
-	    line[ strlen( line ) - 1 ] = '\0';
-	    if ( !first ) {
-		putchar( '\n' );
-	    } else {
-		first = 0;
-	    }
-	    rc = dosearch( ld, base, scope, attrs, attrsonly, filtpattern,
-		    line );
+	if ( verbose ) {
+		fprintf( stderr, "filter%s: %s\nreturning: ",
+			infile != NULL ? " pattern" : "",
+			filtpattern );
+
+		if ( attrs == NULL ) {
+			printf( "ALL" );
+		} else {
+			for ( i = 0; attrs[ i ] != NULL; ++i ) {
+				fprintf( stderr, "%s ", attrs[ i ] );
+			}
+		}
+		fprintf( stderr, "\n" );
 	}
-	if ( fp != stdin ) {
-	    fclose( fp );
+
+	if ( ldif ) {
+		if (ldif < 3 ) {
+			/* TEMPORARILY put the version in a comment many tools cannot yet a version attribute  */
+			printf( "# version: 1\n");
+		}
+
+		if (ldif < 2 ) {
+			printf( "#\n# filter%s: %s\n# returning: ",
+				infile != NULL ? " pattern" : "",
+				filtpattern );
+
+			if ( attrs == NULL ) {
+				printf( "ALL" );
+			} else {
+				for ( i = 0; attrs[ i ] != NULL; ++i ) {
+					printf( "%s ", attrs[ i ] );
+				}
+			}
+			printf( "\n#\n\n" );
+		}
 	}
-    }
 
-    ldap_unbind( ld );
+	if ( infile == NULL ) {
+		rc = dosearch( ld, base, scope, attrs, attrsonly, NULL, filtpattern );
 
+	} else {
+		rc = 0;
+		first = 1;
+		while ( rc == 0 && fgets( line, sizeof( line ), fp ) != NULL ) {
+			line[ strlen( line ) - 1 ] = '\0';
+			if ( !first ) {
+				putchar( '\n' );
+			} else {
+				first = 0;
+			}
+			rc = dosearch( ld, base, scope, attrs, attrsonly,
+				filtpattern, line );
+		}
+		if ( fp != stdin ) {
+			fclose( fp );
+		}
+	}
 
+	ldap_unbind( ld );
 	return( rc );
 }
 
 
 static int dosearch(
 	LDAP	*ld,
-    char	*base,
-    int		scope,
-    char	**attrs,
-    int		attrsonly,
-    char	*filtpatt,
-    char	*value)
+	char	*base,
+	int		scope,
+	char	**attrs,
+	int		attrsonly,
+	char	*filtpatt,
+	char	*value)
 {
-    char		filter[ BUFSIZ ];
-    int			rc, first, matches;
-    LDAPMessage		*res, *e;
+	char		filter[ BUFSIZ ];
+	int			rc, first, matches;
+	LDAPMessage		*res, *e;
+
+	if( filtpatt != NULL ) {
+		sprintf( filter, filtpatt, value );
 
-    sprintf( filter, filtpatt, value );
+		if ( verbose ) {
+			fprintf( stderr, "filter is: (%s)\n", filter );
+		}
 
-    if ( verbose ) {
-	fprintf( stderr, "filter is: (%s)\n", filter );
-    }
+		if( ldif == 1 ) {
+			printf( "#\n# filter: %s\n#\n", filter );
+		}
 
-    if ( not ) {
-	return( LDAP_SUCCESS );
-    }
+	} else {
+		sprintf( filter, "%s", value );
+	}
 
-    if ( ldap_search( ld, base, scope, filter, attrs, attrsonly ) == -1 ) {
+	if ( not ) {
+		return( LDAP_SUCCESS );
+	}
+
+	if ( ldap_search( ld, base, scope, filter, attrs, attrsonly ) == -1 ) {
 		int ld_errno;
 		ldap_perror( ld, "ldap_search" );
 
 		ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ld_errno);
 		return( ld_errno );
-    }
+	}
 
-    matches = 0;
-    first = 1;
-    res = NULL;
-    while ( (rc = ldap_result( ld, LDAP_RES_ANY, sortattr ? 1 : 0, NULL, &res ))
-	    == LDAP_RES_SEARCH_ENTRY ) {
+	matches = 0;
+	first = 1;
+	res = NULL;
+	while ( (rc = ldap_result( ld, LDAP_RES_ANY, sortattr ? 1 : 0, NULL, &res ))
+		== LDAP_RES_SEARCH_ENTRY ) {
 	matches++;
 	e = ldap_first_entry( ld, res );
 	if ( !first ) {
-	    putchar( '\n' );
+		putchar( '\n' );
 	} else {
-	    first = 0;
+		first = 0;
 	}
 	print_entry( ld, e, attrsonly );
 	ldap_msgfree( res );
 	res = NULL;
-    }
-    if ( rc == -1 ) {
+	}
+	if ( rc == -1 ) {
 	ldap_perror( ld, "ldap_result" );
 	return( rc );
-    }
-    if (( rc = ldap_result2error( ld, res, 0 )) != LDAP_SUCCESS ) {
-        ldap_perror( ld, "ldap_search" );
-    }
-    if ( sortattr != NULL ) {
-	    (void) ldap_sort_entries( ld, &res,
-		    ( *sortattr == '\0' ) ? NULL : sortattr, strcasecmp );
-	    matches = 0;
-	    first = 1;
-	    for ( e = ldap_first_entry( ld, res ); e != NULL;
-		    e = ldap_next_entry( ld, e ) ) {
+	}
+	if (( rc = ldap_result2error( ld, res, 0 )) != LDAP_SUCCESS ) {
+		ldap_perror( ld, "ldap_search" );
+	}
+	if ( sortattr != NULL ) {
+		(void) ldap_sort_entries( ld, &res,
+			( *sortattr == '\0' ) ? NULL : sortattr, strcasecmp );
+		matches = 0;
+		first = 1;
+		for ( e = ldap_first_entry( ld, res ); e != NULL;
+			e = ldap_next_entry( ld, e ) ) {
 		matches++;
 		if ( !first ) {
-		    putchar( '\n' );
+			putchar( '\n' );
 		} else {
-		    first = 0;
+			first = 0;
 		}
 		print_entry( ld, e, attrsonly );
-	    }
-    }
+		}
+	}
 
-    if ( verbose ) {
-        printf( "%d matches\n", matches );
-    }
+	if ( verbose ) {
+		printf( "%d matches\n", matches );
+	}
 
-    ldap_msgfree( res );
-    return( rc );
+	ldap_msgfree( res );
+	return( rc );
 }
 
 
 void print_entry(
-    LDAP	*ld,
-    LDAPMessage	*entry,
-    int		attrsonly)
+	LDAP	*ld,
+	LDAPMessage	*entry,
+	int		attrsonly)
 {
-    char		*a, *dn, *ufn, tmpfname[ 64 ];
-    int			i, j, notascii;
-    BerElement		*ber = NULL;
-    struct berval	**bvals;
-    FILE		*tmpfp;
-
-    dn = ldap_get_dn( ld, entry );
-    if ( ldif ) {
-	write_ldif_value( "dn", dn, strlen( dn ));
-    } else {
-	printf( "%s\n", dn );
-    }
-    if ( includeufn ) {
-	ufn = ldap_dn2ufn( dn );
+	char		*a, *dn, *ufn;
+	char	tmpfname[ 256 ];
+	char	url[ 256 ];
+	int			i;
+	BerElement		*ber = NULL;
+	struct berval	**bvals;
+	FILE		*tmpfp;
+
+	dn = ldap_get_dn( ld, entry );
+	ufn = NULL;
+
+	if ( ldif == 1 ) {
+		ufn = ldap_dn2ufn( dn );
+		write_ldif( LDIF_PUT_COMMENT, NULL, ufn, strlen( ufn ));
+	}
 	if ( ldif ) {
-	    write_ldif_value( "ufn", ufn, strlen( ufn ));
+		write_ldif( LDIF_PUT_VALUE, "dn", dn, strlen( dn ));
 	} else {
-	    printf( "%s\n", ufn );
-	}
-	ldap_memfree( ufn );
-    }
-    ldap_memfree( dn );
-
-    for ( a = ldap_first_attribute( ld, entry, &ber ); a != NULL;
-	    a = ldap_next_attribute( ld, entry, ber ) ) {
-	if ( skipsortattr && strcasecmp( a, sortattr ) == 0 ) {
-	    continue;
-	}
-	if ( attrsonly ) {
-	    if ( ldif ) {
-		write_ldif_value( a, "", 0 );
-	    } else {
-		printf( "%s\n", a );
-	    }
-	} else if (( bvals = ldap_get_values_len( ld, entry, a )) != NULL ) {
-	    for ( i = 0; bvals[i] != NULL; i++ ) {
-		if ( vals2tmp ) {
-		    sprintf( tmpfname, "/tmp/ldapsearch-%s-XXXXXX", a );
-		    tmpfp = NULL;
-
-		    if ( mktemp( tmpfname ) == NULL ) {
-			perror( tmpfname );
-		    } else if (( tmpfp = fopen( tmpfname, "w")) == NULL ) {
-			perror( tmpfname );
-		    } else if ( fwrite( bvals[ i ]->bv_val,
-			    bvals[ i ]->bv_len, 1, tmpfp ) == 0 ) {
-			perror( tmpfname );
-		    } else if ( ldif ) {
-			write_ldif_value( a, tmpfname, strlen( tmpfname ));
-		    } else {
-			printf( "%s%s%s\n", a, sep, tmpfname );
-		    }
-
-		    if ( tmpfp != NULL ) {
-			fclose( tmpfp );
-		    }
+		printf( "%s\n", dn );
+	}
+
+	if ( includeufn ) {
+		if( ufn == NULL ) {
+			ufn = ldap_dn2ufn( dn );
+		}
+		if ( ldif ) {
+			write_ldif( LDIF_PUT_VALUE, "ufn", ufn, strlen( ufn ));
 		} else {
-		    notascii = 0;
-		    if ( !allow_binary ) {
-			for ( j = 0; (unsigned long) j < bvals[ i ]->bv_len; ++j ) {
-			    if ( !isascii( bvals[ i ]->bv_val[ j ] )) {
-				notascii = 1;
-				break;
-			    }
+			printf( "%s\n", ufn );
+		}
+	}
+
+	if( ufn != NULL ) ldap_memfree( ufn );
+	ldap_memfree( dn );
+
+	for ( a = ldap_first_attribute( ld, entry, &ber ); a != NULL;
+		a = ldap_next_attribute( ld, entry, ber ) )
+	{
+		if ( skipsortattr && strcasecmp( a, sortattr ) == 0 ) {
+			continue;
+		}
+
+		if ( attrsonly ) {
+			if ( ldif ) {
+				write_ldif( LDIF_PUT_NOVALUE, a, NULL, 0 );
+			} else {
+				printf( "%s\n", a );
 			}
-		    }
-
-		    if ( ldif ) {
-			write_ldif_value( a, bvals[ i ]->bv_val,
-				bvals[ i ]->bv_len );
-		    } else {
-			printf( "%s%s%s\n", a, sep,
-				notascii ? "NOT ASCII" : bvals[ i ]->bv_val );
-		    }
+
+		} else if (( bvals = ldap_get_values_len( ld, entry, a )) != NULL ) {
+			for ( i = 0; bvals[i] != NULL; i++ ) {
+				if ( vals2tmp > 1 || ( vals2tmp
+					&& ldif_is_not_printable( bvals[i]->bv_val, bvals[i]->bv_len ) ))
+				{
+					/* write value to file */
+					sprintf( tmpfname, "%s" LDAP_DIRSEP "ldapsearch-%s-XXXXXX",
+						tmpdir, a );
+					tmpfp = NULL;
+
+					if ( mktemp( tmpfname ) == NULL ) {
+						perror( tmpfname );
+						continue;
+					}
+
+					if (( tmpfp = fopen( tmpfname, "w")) == NULL ) {
+						perror( tmpfname );
+						continue;
+					}
+
+					if ( fwrite( bvals[ i ]->bv_val,
+						bvals[ i ]->bv_len, 1, tmpfp ) == 0 )
+					{
+						perror( tmpfname );
+						fclose( tmpfp );
+						continue;
+					}
+
+					fclose( tmpfp );
+
+					sprintf( url, "%s%s", urlpre,
+						&tmpfname[strlen(tmpdir) + sizeof(LDAP_DIRSEP) - 1] );
+
+					if ( ldif ) {
+						write_ldif( LDIF_PUT_URL, a, url, strlen( url ));
+					} else {
+						printf( "%s%s%s\n", a, sep, url );
+					}
+
+
+				} else {
+					if ( ldif ) {
+						write_ldif( LDIF_PUT_VALUE, a,
+							bvals[ i ]->bv_val, bvals[ i ]->bv_len );
+
+					} else {
+						int notprint = !binary && !vals2tmp
+							&& ldif_is_not_printable( bvals[i]->bv_val,
+								bvals[i]->bv_len ); 
+						printf( "%s%s", a, sep );
+						puts( notprint ? "NOT PRINTABLE" : bvals[ i ]->bv_val );
+						puts( "\n" );
+					}
+				}
+			}
+			ber_bvecfree( bvals );
 		}
-	    }
-	    ber_bvecfree( bvals );
 	}
-    }
 
 	if( ber != NULL ) {
 		ber_free( ber, 0 );
@@ -565,16 +677,16 @@ void print_entry(
 
 
 int
-write_ldif_value( char *type, char *value, unsigned long vallen )
+write_ldif( int type, char *name, char *value, ber_len_t vallen )
 {
-    char	*ldif;
+	char	*ldif;
 
-    if (( ldif = ldif_type_and_value( type, value, (int)vallen )) == NULL ) {
-	return( -1 );
-    }
+	if (( ldif = ldif_put( type, name, value, vallen )) == NULL ) {
+		return( -1 );
+	}
 
-    fputs( ldif, stdout );
-    ber_memfree( ldif );
+	fputs( ldif, stdout );
+	ber_memfree( ldif );
 
-    return( 0 );
+	return( 0 );
 }
diff --git a/include/ldif.h b/include/ldif.h
index ee0fac4903..8ce760d67c 100644
--- a/include/ldif.h
+++ b/include/ldif.h
@@ -7,6 +7,7 @@
  * license is available at http://www.OpenLDAP.org/license.html or
  * in file LICENSE in the top-level directory of the distribution.
  */
+
 /* Portions
  * Copyright (c) 1996 Regents of the University of Michigan.
  * All rights reserved.
@@ -32,10 +33,10 @@ extern int ldif_debug;
 
 /*
  * Macro to calculate maximum number of bytes that the base64 equivalent
- * of an item that is "vlen" bytes long will take up.  Base64 encoding
+ * of an item that is "len" bytes long will take up.  Base64 encoding
  * uses one byte for every six bits in the value plus up to two pad bytes.
  */
-#define LDIF_BASE64_LEN(vlen)	(((vlen) * 4 / 3 ) + 3)
+#define LDIF_BASE64_LEN(len)	(((len) * 4 / 3 ) + 3)
 
 /*
  * Macro to calculate maximum size that an LDIF-encoded type (length
@@ -43,31 +44,49 @@ extern int ldif_debug;
  * first newline + base64 value + continued lines.  Each continued line
  * needs room for a newline and a leading space character.
  */
-#define LDIF_SIZE_NEEDED(tlen,vlen) \
-    ((tlen) + 4 + LDIF_BASE64_LEN(vlen) \
-    + ((LDIF_BASE64_LEN(vlen) + (tlen) + 3) / LDIF_LINE_WIDTH * 2 ))
+#define LDIF_SIZE_NEEDED(nlen,vlen) \
+    ((nlen) + 4 + LDIF_BASE64_LEN(vlen) \
+    + ((LDIF_BASE64_LEN(vlen) + (nlen) + 3) / LDIF_LINE_WIDTH * 2 ))
 
 LDAP_F( int )
 ldif_parse_line LDAP_P((
 	LDAP_CONST char *line,
-	char **type, char **value, int *vlen));
+	char **name,
+	char **value,
+	ber_len_t *vlen));
 
 LDAP_F( char * )
 ldif_getline LDAP_P(( char **next ));
 
+#define LDIF_PUT_NOVALUE	0x0000	/* no value */
+#define LDIF_PUT_VALUE		0x0001	/* value w/ auto detection */
+#define LDIF_PUT_TEXT		0x0002	/* assume text */
+#define	LDIF_PUT_BINARY		0x0004	/* assume binary (convert to base64) */
+#define LDIF_PUT_B64		0x0008	/* pre-converted base64 value */
+
+#define LDIF_PUT_COMMENT	0x0010	/* comment */
+#define LDIF_PUT_URL		0x0020	/* url */
+#define LDIF_PUT_SEP		0x0040	/* separator */
+
 LDAP_F( void )
-ldif_put_type_and_value LDAP_P((
+ldif_sput LDAP_P((
 	char **out,
-	LDAP_CONST char *t,
+	int type,
+	LDAP_CONST char *name,
 	LDAP_CONST char *val,
-	int vlen ));
+	ber_len_t vlen ));
 
 LDAP_F( char * )
-ldif_type_and_value LDAP_P((
-	LDAP_CONST char *type,
+ldif_put LDAP_P((
+	int type,
+	LDAP_CONST char *name,
 	LDAP_CONST char *val,
-	int vlen ));
+	ber_len_t vlen ));
 
+LDAP_F( int )
+ldif_is_not_printable LDAP_P((
+	LDAP_CONST char *val,
+	ber_len_t vlen ));
 
 LDAP_END_DECL
 
diff --git a/libraries/libldif/line64.c b/libraries/libldif/line64.c
index 28936e1f76..7ec2bdde53 100644
--- a/libraries/libldif/line64.c
+++ b/libraries/libldif/line64.c
@@ -55,7 +55,7 @@ ldif_parse_line(
     LDAP_CONST char	*line,
     char	**type,
     char	**value,
-    int		*vlen
+    ber_len_t *vlen
 )
 {
 	char	*p, *s, *d, *byte, *stop;
@@ -69,7 +69,7 @@ ldif_parse_line(
 	*type = line;
 
 	for ( s = line; *s && *s != ':'; s++ )
-		;	/* NULL */
+		/* EMPTY */;
 	if ( *s == '\0' ) {
 		ber_pvt_log_printf( LDAP_DEBUG_PARSE, ldif_debug,
 			"ldif_parse_line missing ':'\n");
@@ -167,9 +167,11 @@ ldif_parse_line(
  * space character, it is a continuation of the previous line. the white
  * space character (nb: only one char), and preceeding newline are changed
  * into CONTINUED_LINE_MARKER chars, to be deleted later by the
- * str_parse_line() routine above.
+ * ldif_parse_line() routine above.
  *
- * it takes a pointer to a pointer to the buffer on the first call,
+ * ldif_getline will skip over any line which starts '#'.
+ *
+ * ldif_getline takes a pointer to a pointer to the buffer on the first call,
  * which it updates and must be supplied on subsequent calls.
  */
 
@@ -202,99 +204,198 @@ ldif_getline( char **next )
 	return( line );
 }
 
+/* compatibility with U-Mich off by one bug */
+#define LDIF_KLUDGE 1
+
 void
-ldif_put_type_and_value(
+ldif_sput(
 	char **out,
-	LDAP_CONST char *t,
+	int type,
+	LDAP_CONST char *name,
 	LDAP_CONST char *val,
-	int vlen )
+	ber_len_t vlen )
 {
-	unsigned char	*byte, *p, *stop;
+	unsigned char	*byte, *stop;
 	unsigned char	buf[3];
 	unsigned long	bits;
 	char		*save;
-	int		i, b64, pad, len, savelen;
-	len = 0;
+	int		pad;
+
+	ber_len_t savelen;
+	ber_len_t len=0;
+	ber_len_t i;
+
+	/* prefix */
+	switch( type ) {
+	case LDIF_PUT_COMMENT:
+		if( name != NULL ) break;
+
+		*(*out)++ = '#';
+		len++;
+
+		if( vlen ) {
+			*(*out)++ = ' ';
+			len++;
+			break;
+		}
+
+		/* no value, fall-thru */
 
-	/* put the type + ": " */
-	for ( p = (unsigned char *) t; *p; p++, len++ ) {
-		*(*out)++ = *p;
+	case LDIF_PUT_SEP:
+		*(*out)++ = '\n';
+		return;
 	}
-	*(*out)++ = ':';
-	len++;
+
+	/* name (attribute type) */
+	if( name != NULL ) {
+		/* put the name + ":" */
+		for ( i=0 ; name[i]; i++ ) {
+			*(*out)++ = name[i];
+			len++;
+		}
+
+		if( type != LDIF_PUT_COMMENT ) {
+			*(*out)++ = ':';
+			len++;
+		}
+
+#ifdef LDAP_DEBUG
+	} else {
+		assert( type == LDIF_PUT_COMMENT );
+#endif
+	}
+
+	switch( type ) {
+	case LDIF_PUT_NOVALUE:
+		*(*out)++ = '\n';
+		return;
+
+	case LDIF_PUT_URL: /* url value */
+		*(*out)++ = '<';
+		len++;
+		break;
+
+	case LDIF_PUT_B64: /* base64 value */
+		*(*out)++ = ':';
+		len++;
+		break;
+	}
+
+	switch( type ) {
+	case LDIF_PUT_TEXT:
+	case LDIF_PUT_URL:
+	case LDIF_PUT_B64:
+		*(*out)++ = ' ';
+		len++;
+		/* fall-thru */
+
+	case LDIF_PUT_COMMENT:
+		/* pre-encoded names */
+		for ( i=0; i < vlen; i++ ) {
+			if ( len > LDIF_LINE_WIDTH ) {
+				*(*out)++ = '\n';
+				*(*out)++ = ' ';
+				len = 1;
+			}
+
+			*(*out)++ = val[i];
+			len++;
+		}
+		*(*out)++ = '\n';
+		return;
+	}
+
 	save = *out;
 	savelen = len;
+
 	*(*out)++ = ' ';
-	b64 = 0;
+	len++;
+
+	if( vlen == 0 ) {
+		*(*out)++ = '\n';
+		return;
+	}
 
 	stop = (unsigned char *) (val + vlen);
-	if ( isascii( val[0] ) && (isspace( val[0] ) || val[0] == ':') ) {
-		b64 = 1;
-	} else {
+
+	if ( type == LDIF_PUT_VALUE &&
+		isgraph( val[0] ) && val[0] != ':' && val[0] != '<' &&
+		isgraph( val[vlen-1] ) )
+	{
+		int b64 = 0;
+
 		for ( byte = (unsigned char *) val; byte < stop;
-		    byte++, len++ ) {
+		    byte++, len++ )
+		{
 			if ( !isascii( *byte ) || !isprint( *byte ) ) {
 				b64 = 1;
 				break;
 			}
-			if ( len > LDIF_LINE_WIDTH ) {
+			if ( len > LDIF_LINE_WIDTH+LDIF_KLUDGE ) {
 				*(*out)++ = '\n';
 				*(*out)++ = ' ';
 				len = 1;
 			}
 			*(*out)++ = *byte;
 		}
+
+		if( !b64 ) {
+			*(*out)++ = '\n';
+			return;
+		}
 	}
-	if ( b64 ) {
-		*out = save;
-		*(*out)++ = ':';
-		*(*out)++ = ' ';
-		len = savelen + 2;
-		/* convert to base 64 (3 bytes => 4 base 64 digits) */
-		for ( byte = (unsigned char *) val; byte < stop - 2;
-		    byte += 3 ) {
-			bits = (byte[0] & 0xff) << 16;
-			bits |= (byte[1] & 0xff) << 8;
-			bits |= (byte[2] & 0xff);
-
-			for ( i = 0; i < 4; i++, len++, bits <<= 6 ) {
-				if ( len > LDIF_LINE_WIDTH ) {
-					*(*out)++ = '\n';
-					*(*out)++ = ' ';
-					len = 1;
-				}
 
-				/* get b64 digit from high order 6 bits */
-				*(*out)++ = nib2b64[ (bits & 0xfc0000L) >> 18 ];
+	*out = save;
+	*(*out)++ = ':';
+	*(*out)++ = ' ';
+	len = savelen + 2;
+
+	/* convert to base 64 (3 bytes => 4 base 64 digits) */
+	for ( byte = (unsigned char *) val;
+		byte < stop - 2;
+	    byte += 3 )
+	{
+		bits = (byte[0] & 0xff) << 16;
+		bits |= (byte[1] & 0xff) << 8;
+		bits |= (byte[2] & 0xff);
+
+		for ( i = 0; i < 4; i++, len++, bits <<= 6 ) {
+			if ( len > LDIF_LINE_WIDTH+LDIF_KLUDGE ) {
+				*(*out)++ = '\n';
+				*(*out)++ = ' ';
+				len = 1;
 			}
+
+			/* get b64 digit from high order 6 bits */
+			*(*out)++ = nib2b64[ (bits & 0xfc0000L) >> 18 ];
 		}
+	}
 
-		/* add padding if necessary */
-		if ( byte < stop ) {
-			for ( i = 0; byte + i < stop; i++ ) {
-				buf[i] = byte[i];
-			}
-			for ( pad = 0; i < 3; i++, pad++ ) {
-				buf[i] = '\0';
+	/* add padding if necessary */
+	if ( byte < stop ) {
+		for ( i = 0; byte + i < stop; i++ ) {
+			buf[i] = byte[i];
+		}
+		for ( pad = 0; i < 3; i++, pad++ ) {
+			buf[i] = '\0';
+		}
+		byte = buf;
+		bits = (byte[0] & 0xff) << 16;
+		bits |= (byte[1] & 0xff) << 8;
+		bits |= (byte[2] & 0xff);
+
+		for ( i = 0; i < 4; i++, len++, bits <<= 6 ) {
+			if ( len > LDIF_LINE_WIDTH+LDIF_KLUDGE ) {
+				*(*out)++ = '\n';
+				*(*out)++ = ' ';
+				len = 1;
 			}
-			byte = buf;
-			bits = (byte[0] & 0xff) << 16;
-			bits |= (byte[1] & 0xff) << 8;
-			bits |= (byte[2] & 0xff);
-
-			for ( i = 0; i < 4; i++, len++, bits <<= 6 ) {
-				if ( len > LDIF_LINE_WIDTH ) {
-					*(*out)++ = '\n';
-					*(*out)++ = ' ';
-					len = 1;
-				}
 
-				if( i + pad < 4 ) {
-					/* get b64 digit from low order 6 bits */
-					*(*out)++ = nib2b64[ (bits & 0xfc0000L) >> 18 ];
-				} else {
-					*(*out)++ = '=';
-				}
+			if( i + pad < 4 ) {
+				/* get b64 digit from low order 6 bits */
+				*(*out)++ = nib2b64[ (bits & 0xfc0000L) >> 18 ];
+			} else {
+				*(*out)++ = '=';
 			}
 		}
 	}
@@ -302,27 +403,57 @@ ldif_put_type_and_value(
 }
 
 
-char *
-ldif_type_and_value( LDAP_CONST char *type, LDAP_CONST char *val, int vlen )
 /*
- * return BER malloc'd, zero-terminated LDIF line
+ * ldif_type_and_value return BER malloc'd, zero-terminated LDIF line
  */
+char *
+ldif_put(
+	int type,
+	LDAP_CONST char *name,
+	LDAP_CONST char *val,
+	ber_len_t vlen )
 {
     char	*buf, *p;
-    int		tlen;
+    ber_len_t nlen;
 
-    tlen = strlen( type );
-    if (( buf = (char *) ber_memalloc( LDIF_SIZE_NEEDED( tlen, vlen ) + 1 ))
-		== NULL )
-	{
+    nlen = ( name != NULL ) ? strlen( name ) : 0;
+
+	buf = (char *) ber_memalloc( LDIF_SIZE_NEEDED( nlen, vlen ) + 1 );
+
+    if ( buf == NULL ) {
 		ber_pvt_log_printf( LDAP_DEBUG_ANY, ldif_debug,
 			"ldif_type_and_value: malloc failed!" );
 		return NULL;
     }
 
     p = buf;
-    ldif_put_type_and_value( &p, type, val, vlen );
+    ldif_sput( &p, type, name, val, vlen );
     *p = '\0';
 
     return( buf );
 }
+
+int ldif_is_not_printable(
+	LDAP_CONST char *val,
+	ber_len_t vlen )
+{
+	if( vlen == 0 || val == NULL  ) {
+		return -1;
+	}
+
+	if( isgraph( val[0] ) && val[0] != ':' && val[0] != '<' &&
+		isgraph( val[vlen-1] ) )
+	{
+		ber_len_t i;
+
+		for ( i = 0; val[i]; i++ ) {
+			if ( !isascii( val[i] ) || !isprint( val[i] ) ) {
+				return 1;
+			}
+		}
+
+		return 0;
+	}
+
+	return 1;
+}
diff --git a/servers/slapd/entry.c b/servers/slapd/entry.c
index e0465230e9..ce08b132d1 100644
--- a/servers/slapd/entry.c
+++ b/servers/slapd/entry.c
@@ -24,7 +24,8 @@ str2entry( char	*s )
 	char		*type;
 	char		*value;
 	char		*next;
-	int		vlen, nvals, maxvals;
+	ber_len_t	vlen;
+	int		nvals, maxvals;
 	struct berval	bval;
 	struct berval	*vals[2];
 	char		ptype[64];
@@ -194,7 +195,7 @@ entry2str(
 		/* put "dn: <dn>" */
 		tmplen = strlen( e->e_dn );
 		MAKE_SPACE( LDIF_SIZE_NEEDED( 2, tmplen ));
-		ldif_put_type_and_value( (char **) &ecur, "dn", e->e_dn, tmplen );
+		ldif_sput( (char **) &ecur, LDIF_PUT_VALUE, "dn", e->e_dn, tmplen );
 	}
 
 	/* put the attributes */
@@ -204,7 +205,7 @@ entry2str(
 			bv = a->a_vals[i];
 			tmplen = strlen( a->a_type );
 			MAKE_SPACE( LDIF_SIZE_NEEDED( tmplen, bv->bv_len ));
-			ldif_put_type_and_value( (char **) &ecur, a->a_type,
+			ldif_sput( (char **) &ecur, LDIF_PUT_VALUE, a->a_type,
 			    bv->bv_val, bv->bv_len );
 		}
 	}
diff --git a/servers/slapd/repl.c b/servers/slapd/repl.c
index 1b59f2be86..122872f92b 100644
--- a/servers/slapd/repl.c
+++ b/servers/slapd/repl.c
@@ -77,7 +77,8 @@ replog(
 				buf = (char *) ch_malloc( len );
 
 				bufp = buf;
-				ldif_put_type_and_value( &bufp, ml->ml_type,
+				ldif_sput( &bufp, LDIF_PUT_VALUE,
+					ml->ml_type,
 				    ml->ml_bvalues[i]->bv_val,
 				    ml->ml_bvalues[i]->bv_len );
 				*bufp = '\0';
diff --git a/servers/slapd/tools/ldif.c b/servers/slapd/tools/ldif.c
index 269a9b4d8a..94381c6202 100644
--- a/servers/slapd/tools/ldif.c
+++ b/servers/slapd/tools/ldif.c
@@ -71,7 +71,7 @@ main( int argc, char **argv )
 			cur += nread;
 		}
 
-		if (( out = ldif_type_and_value( type, val, cur )) == NULL ) {
+		if (( out = ldif_put( LDIF_PUT_BINARY, type, val, cur )) == NULL ) {
 		    	perror( "ldif_type_and_value" );
 			exit( 1 );
 		}
@@ -86,7 +86,7 @@ main( int argc, char **argv )
 	while ( fgets( buf, sizeof(buf), stdin ) != NULL ) {
 		if( buf[len=strlen(buf)] == '\n') buf[len] = '\0';
 
-		if (( out = ldif_type_and_value( type, buf, strlen( buf ) ))
+		if (( out = ldif_put( LDIF_PUT_VALUE, type, buf, strlen( buf ) ))
 		    == NULL ) {
 		    	perror( "ldif_type_and_value" );
 			exit( 1 );
diff --git a/servers/slapd/tools/ldif2id2children-bdb2.c b/servers/slapd/tools/ldif2id2children-bdb2.c
index 713b461dd9..f7a1b8319c 100644
--- a/servers/slapd/tools/ldif2id2children-bdb2.c
+++ b/servers/slapd/tools/ldif2id2children-bdb2.c
@@ -130,7 +130,7 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen;
+		ber_len_t		vlen;
 		Datum		key, data;
 
 		ldbm_datum_init( key );
diff --git a/servers/slapd/tools/ldif2id2children.c b/servers/slapd/tools/ldif2id2children.c
index 459579e7f1..1a72b1f17f 100644
--- a/servers/slapd/tools/ldif2id2children.c
+++ b/servers/slapd/tools/ldif2id2children.c
@@ -132,7 +132,7 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen;
+		ber_len_t		vlen;
 		Datum		key, data;
 
 		ldbm_datum_init( key );
@@ -219,7 +219,7 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char	*type, *val, *s, *dn;
-		int	vlen;
+		ber_len_t	vlen;
 		ID	pid;
 		char	buf2[20];
 		Datum	key, data;
diff --git a/servers/slapd/tools/ldif2index-bdb2.c b/servers/slapd/tools/ldif2index-bdb2.c
index d832256607..53fabcc2ab 100644
--- a/servers/slapd/tools/ldif2index-bdb2.c
+++ b/servers/slapd/tools/ldif2index-bdb2.c
@@ -121,7 +121,7 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen;
+		ber_len_t	vlen;
 
 		if ( fgets( line, sizeof(line), stdin ) != NULL ) {
 			int     len;
diff --git a/servers/slapd/tools/ldif2index.c b/servers/slapd/tools/ldif2index.c
index 6dfe83f382..f654baaa08 100644
--- a/servers/slapd/tools/ldif2index.c
+++ b/servers/slapd/tools/ldif2index.c
@@ -123,7 +123,7 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen;
+		ber_len_t		vlen;
 
 		if ( fgets( line, sizeof(line), stdin ) != NULL ) {
 			int     len;
diff --git a/servers/slapd/tools/ldif2ldbm-bdb2.c b/servers/slapd/tools/ldif2ldbm-bdb2.c
index 8ba47bb95a..e1471f92a4 100644
--- a/servers/slapd/tools/ldif2ldbm-bdb2.c
+++ b/servers/slapd/tools/ldif2ldbm-bdb2.c
@@ -214,7 +214,8 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen, indexmask, syntaxmask;
+		ber_len_t		vlen;
+		int indexmask, syntaxmask;
 
 		if ( fgets( line, sizeof(line), stdin ) != NULL ) {
 			int     len;
diff --git a/servers/slapd/tools/ldif2ldbm.c b/servers/slapd/tools/ldif2ldbm.c
index 407401196d..e95c5dddb2 100644
--- a/servers/slapd/tools/ldif2ldbm.c
+++ b/servers/slapd/tools/ldif2ldbm.c
@@ -222,7 +222,8 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen, indexmask, syntaxmask;
+		ber_len_t	vlen;
+		int			indexmask, syntaxmask;
 
 		if ( fgets( line, sizeof(line), stdin ) != NULL ) {
 			int     len;
diff --git a/servers/slurpd/re.c b/servers/slurpd/re.c
index 911cb61661..fa171ca159 100644
--- a/servers/slurpd/re.c
+++ b/servers/slurpd/re.c
@@ -125,9 +125,9 @@ Re_parse(
     int			state;
     int			nml;
     char		*buf, *rp, *p;
-    long		buflen;
+    size_t		buflen;
     char		*type, *value;
-    int			len;
+    ber_len_t	len;
     int			nreplicas;
 
     if ( re == NULL ) {
@@ -158,7 +158,7 @@ Re_parse(
 	if ( strncmp( buf, ERROR_STR, strlen( ERROR_STR )) == 0 ) {
 	    continue;
 	}
-	buflen = ( long ) strlen( buf );
+	buflen = strlen( buf );
 	if ( ldif_parse_line( buf, &type, &value, &len ) < 0 ) {
 	    Debug( LDAP_DEBUG_ANY,
 		    "Error: Re_parse: malformed replog file\n",
@@ -208,7 +208,7 @@ Re_parse(
 	if (( buf = ldif_getline( &rp )) == NULL ) {
 	    break;
 	}
-	buflen = ( long ) strlen( buf );
+	buflen = strlen( buf );
 	if (( buflen == 1 ) && ( buf[ 0 ] == '-' )) {
 	    type = "-";
 	    value = NULL;
@@ -259,7 +259,8 @@ get_repl_hosts(
     char		buf[ LDIF_LINE_WIDTH + 1 ];
     char		*type, *value, *line, *p;
     Rh			*rh = NULL;
-    int			nreplicas, len;
+    int			nreplicas;
+	ber_len_t	len;
     int			port;
     int			repl_ok;
     int			i;
@@ -566,7 +567,8 @@ Re_write(
 	    }
 	} else {
 	    char *obuf;
-	    obuf = ldif_type_and_value( re->re_mods[ i ].mi_type,
+	    obuf = ldif_put( LDIF_PUT_VALUE,
+			re->re_mods[ i ].mi_type,
 		    re->re_mods[ i ].mi_val ? re->re_mods[ i ].mi_val : "",
 		    re->re_mods[ i ].mi_len );
 	    if ( fputs( obuf, fp ) < 0 ) {
diff --git a/tests/data/acl.out.master b/tests/data/acl.out.master
index c246e03b95..1627d9372e 100644
--- a/tests/data/acl.out.master
+++ b/tests/data/acl.out.master
@@ -102,7 +102,7 @@ uid: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/modify.out.master b/tests/data/modify.out.master
index 22a3b943ef..244770c8a2 100644
--- a/tests/data/modify.out.master
+++ b/tests/data/modify.out.master
@@ -57,7 +57,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/modrdn.out.master b/tests/data/modrdn.out.master
index 8e1061ce05..aecb9c8b35 100644
--- a/tests/data/modrdn.out.master
+++ b/tests/data/modrdn.out.master
@@ -78,7 +78,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/modrdn.out.master.0 b/tests/data/modrdn.out.master.0
index 8e1061ce05..aecb9c8b35 100644
--- a/tests/data/modrdn.out.master.0
+++ b/tests/data/modrdn.out.master.0
@@ -78,7 +78,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/search.out.master b/tests/data/search.out.master
index 4f339c34d6..5ac2183f26 100644
--- a/tests/data/search.out.master
+++ b/tests/data/search.out.master
@@ -17,7 +17,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/test-ordered.ldif b/tests/data/test-ordered.ldif
index a57f997ab5..51ebed0ffa 100644
--- a/tests/data/test-ordered.ldif
+++ b/tests/data/test-ordered.ldif
@@ -120,7 +120,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/test.ldif b/tests/data/test.ldif
index aa02a479f1..6d301199b2 100644
--- a/tests/data/test.ldif
+++ b/tests/data/test.ldif
@@ -78,7 +78,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh
index 58e0842396..f13800d21e 100755
--- a/tests/scripts/defines.sh
+++ b/tests/scripts/defines.sh
@@ -30,7 +30,7 @@ CLIENTDIR=../clients/tools
 
 SLAPD=../servers/slapd/slapd
 SLURPD=../servers/slurpd/slurpd
-LDAPSEARCH="$CLIENTDIR/ldapsearch $PROTO"
+LDAPSEARCH="$CLIENTDIR/ldapsearch $PROTO -LLL"
 LDAPMODIFY="$CLIENTDIR/ldapmodify $PROTO"
 LDAPADD="$CLIENTDIR/ldapadd $PROTO"
 LDAPMODRDN="$CLIENTDIR/ldapmodrdn $PROTO"
diff --git a/tests/scripts/test001-ldif2ldbm b/tests/scripts/test001-ldif2ldbm
index a93b1d8f55..42123ec417 100755
--- a/tests/scripts/test001-ldif2ldbm
+++ b/tests/scripts/test001-ldif2ldbm
@@ -33,7 +33,7 @@ PID=$!
 
 echo "Using ldapsearch to retrieve all the entries..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+	$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 		'objectClass=*' > $SEARCHOUT 2>&1
 	RC=$?
 	if test $RC = 1 ; then
diff --git a/tests/scripts/test001-slapadd b/tests/scripts/test001-slapadd
index a93b1d8f55..42123ec417 100755
--- a/tests/scripts/test001-slapadd
+++ b/tests/scripts/test001-slapadd
@@ -33,7 +33,7 @@ PID=$!
 
 echo "Using ldapsearch to retrieve all the entries..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+	$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 		'objectClass=*' > $SEARCHOUT 2>&1
 	RC=$?
 	if test $RC = 1 ; then
diff --git a/tests/scripts/test002-populate b/tests/scripts/test002-populate
index 7d2d49df6c..252ce1faa0 100755
--- a/tests/scripts/test002-populate
+++ b/tests/scripts/test002-populate
@@ -22,7 +22,7 @@ PID=$!
 
 echo "Using ldapsearch to check that slapd is running..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -42,7 +42,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Using ldapsearch to read all the entries..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'objectclass=*' > $SEARCHOUT 2>&1
 
 kill -HUP $PID
diff --git a/tests/scripts/test003-search b/tests/scripts/test003-search
index 0642b057cf..2999b01117 100755
--- a/tests/scripts/test003-search
+++ b/tests/scripts/test003-search
@@ -30,7 +30,7 @@ PID=$!
 
 echo "Testing slapd searching..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -48,7 +48,7 @@ fi
 cat /dev/null > $SEARCHOUT
 
 echo "Testing exact searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'sn=jensen' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -57,7 +57,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing OR searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'(|(objectclass=rfc822mailgroup)(sn=jones))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -66,7 +66,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing AND matching and ends-with searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'(&(objectclass=rfc822mailgroup)(cn=A*))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -75,7 +75,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing NOT searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'(!(objectclass=person))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
diff --git a/tests/scripts/test004-modify b/tests/scripts/test004-modify
index f5f7cea5b4..234dcd4051 100755
--- a/tests/scripts/test004-modify
+++ b/tests/scripts/test004-modify
@@ -30,7 +30,7 @@ PID=$!
 
 echo "Testing slapd modify operations..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -116,7 +116,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Using ldapsearch to retrieve all the entries..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'objectClass=*' > $SEARCHOUT 2>&1
 RC=$?
 kill -HUP $PID
diff --git a/tests/scripts/test005-modrdn b/tests/scripts/test005-modrdn
index 946ad553d9..d7f63a8482 100755
--- a/tests/scripts/test005-modrdn
+++ b/tests/scripts/test005-modrdn
@@ -31,7 +31,7 @@ echo "Testing slapd modrdn operations..."
 
 # Make sure we can search the database
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -73,7 +73,7 @@ fi
 # Ensure the new rdn's can be found
 
 echo "Using ldapsearch to retrieve entries using new rdn (cn=James A Jones III)..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'cn=James A Jones III' | egrep -iv '^createtimestamp:|^modifytimestamp:' \
 	    > $SEARCHOUT 2>&1
 RC=$?
@@ -101,7 +101,7 @@ fi
 
 
 echo "Using ldapsearch to retrieve entries using new rdn (cn=James A Jones II)..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'cn=James A Jones II' | egrep -iv '^createtimestamp:|^modifytimestamp:' \
 	    >  $SEARCHOUT 2>&1
 RC=$?
@@ -131,7 +131,7 @@ fi
 # an attribute.
 
 echo "Using ldapsearch to retrieve entries using removed rdn (cn=James A Jones 2)..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'cn=James A Jones 2' | egrep -iv '^createtimestamp:|^modifytimestamp:' \
 	    > /dev/null 2>&1
 RC=$?
@@ -142,7 +142,7 @@ if test $RC = 0 ; then
 fi
 
 echo "Using ldapsearch to retrieve all the entries..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'objectClass=*' > $SEARCHOUT 2>&1
 RC=$?
 if test $RC != 0 ; then
@@ -182,7 +182,7 @@ fi
 # present
 
 echo "Using ldapsearch to retrieve entries using new rdn (cn=James A Jones 1)..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'cn=James A Jones 1' | egrep -iv '^createtimestamp:|^modifytimestamp:' \
 	    >  $SEARCHOUT 2>&1
 RC=$?
diff --git a/tests/scripts/test006-acls b/tests/scripts/test006-acls
index bdcf890aac..6ebc5755ef 100755
--- a/tests/scripts/test006-acls
+++ b/tests/scripts/test006-acls
@@ -30,7 +30,7 @@ PID=$!
 
 echo "Testing slapd access control..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -52,10 +52,10 @@ cat /dev/null > $SEARCHOUT
 # give us nothing if we're not bound, and should return all attributes
 # if we're bound as anyone under UM.
 #
-$LDAPSEARCH -L -b "$JAJDN" -h localhost -p $PORT "objectclass=*" \
+$LDAPSEARCH -b "$JAJDN" -h localhost -p $PORT "objectclass=*" \
 	>> $SEARCHOUT 2>&1
 
-$LDAPSEARCH -L -b "$JAJDN" -h localhost -p $PORT \
+$LDAPSEARCH -b "$JAJDN" -h localhost -p $PORT \
 	-D "$BABSDN" -w bjensen "objectclass=*"  >> $SEARCHOUT 2>&1
 
 
@@ -105,7 +105,7 @@ telephonenumber: +1 810 555 1212
 EOMODS4
 
 echo "Using ldapsearch to retrieve all the entries..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'objectClass=*' | . $SRCDIR/scripts/acfilter.sh >> $SEARCHOUT 2>&1
 RC=$?
 kill -HUP $PID
diff --git a/tests/scripts/test007-replication b/tests/scripts/test007-replication
index 9521a7ba13..53d71b2775 100755
--- a/tests/scripts/test007-replication
+++ b/tests/scripts/test007-replication
@@ -43,7 +43,7 @@ SLAVEPID=$!
 
 echo "Using ldapsearch to check that master slapd is running..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -54,7 +54,7 @@ done
 
 echo "Using ldapsearch to check that slave slapd is running..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -147,7 +147,7 @@ echo "Waiting 15 seconds for slurpd to send changes..."
 sleep 15
 
 echo "Using ldapsearch to read all the entries from the master..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'objectclass=*' > $MASTEROUT 2>&1
 
 if test $RC != 0 ; then
@@ -157,7 +157,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Using ldapsearch to read all the entries from the slave..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
 	'objectclass=*' > $SLAVEOUT 2>&1
 
 if test $RC != 0 ; then
diff --git a/tests/scripts/test008-concurrency b/tests/scripts/test008-concurrency
index 5b8958fc82..2ba50426d8 100755
--- a/tests/scripts/test008-concurrency
+++ b/tests/scripts/test008-concurrency
@@ -36,7 +36,7 @@ PID=$!
 
 echo "Using ldapsearch to check that slapd is running..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -55,7 +55,7 @@ if test $RC != 0 ; then
 fi 
 
 echo "Using ldapsearch to retrieve all the entries..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 			'objectClass=*' > $SEARCHOUT 2>&1
 RC=$?
 
diff --git a/tests/scripts/test009-referral b/tests/scripts/test009-referral
index 829271c9f6..c4c5bbf83f 100755
--- a/tests/scripts/test009-referral
+++ b/tests/scripts/test009-referral
@@ -39,7 +39,7 @@ SLAVEPID=$!
 
 echo "Testing for master slapd..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -56,7 +56,7 @@ fi
 
 echo "Testing for slave slapd..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $SLAVEPORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $SLAVEPORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -68,7 +68,7 @@ done
 cat /dev/null > $SEARCHOUT
 
 echo "Testing exact searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
 	'sn=jensen' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -77,7 +77,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing OR searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
 	'(|(objectclass=rfc822mailgroup)(sn=jones))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -86,7 +86,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing AND matching and ends-with searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
 	'(&(objectclass=rfc822mailgroup)(cn=A*))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -95,7 +95,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing NOT searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
 	'(!(objectclass=person))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"