From 49f414738569096eae2c94a4f05f0f3f2636b8b7 Mon Sep 17 00:00:00 2001
From: Kurt Zeilenga <kurt@openldap.org>
Date: Sat, 24 Jun 2000 01:40:39 +0000
Subject: [PATCH] Added -llber 'N' ber_printf format which inserts a NULL if an
 internal flag set.  Used for SEQUENCE testing.  Flag must be set using
 debugger.  Modified ber_printf to use new format were needed for
 extensibility testing.

Added first cut -lldap support for extended responses.
Modified ldapsearch(1) to handle v3 search references when not
chasing.  Also added extended/unsolicited notification handling
and extended partial response handling.  Changes include a
number of LDIF enhancements.

Fixed getpassphrase() returns NULL bugs
---
 clients/tools/ldapdelete.c   |   2 +-
 clients/tools/ldapmodify.c   |   2 +-
 clients/tools/ldapmodrdn.c   |   2 +-
 clients/tools/ldappasswd.c   |  12 +-
 clients/tools/ldapsearch.c   | 320 ++++++++++++++++++++++++-----------
 include/ldap.h               |   9 +
 libraries/liblber/encode.c   |  12 ++
 libraries/liblber/etest.c    |   2 +-
 libraries/libldap/abandon.c  |   2 +-
 libraries/libldap/add.c      |   8 +-
 libraries/libldap/compare.c  |   4 +-
 libraries/libldap/controls.c |   4 +-
 libraries/libldap/delete.c   |   2 +-
 libraries/libldap/error.c    |   6 +-
 libraries/libldap/extended.c | 118 ++++++++++++-
 libraries/libldap/kbind.c    |   4 +-
 libraries/libldap/ldap-int.h |   1 +
 libraries/libldap/modify.c   |   8 +-
 libraries/libldap/modrdn.c   |   6 +-
 libraries/libldap/request.c  |   4 +-
 libraries/libldap/result.c   |  27 ++-
 libraries/libldap/sasl.c     |   8 +-
 libraries/libldap/search.c   |  14 +-
 libraries/libldap/sortctrl.c |   4 +-
 libraries/libldap/unbind.c   |   2 +-
 libraries/libldap/vlvctrl.c  |   4 +-
 servers/slapd/passwd.c       |   2 +-
 servers/slapd/result.c       |  12 +-
 28 files changed, 438 insertions(+), 163 deletions(-)

diff --git a/clients/tools/ldapdelete.c b/clients/tools/ldapdelete.c
index 8cf1e2f94b..9c2215efec 100644
--- a/clients/tools/ldapdelete.c
+++ b/clients/tools/ldapdelete.c
@@ -318,7 +318,7 @@ main( int argc, char **argv )
 
 	if (want_bindpw) {
 		passwd.bv_val = getpassphrase("Enter LDAP Password: ");
-		passwd.bv_len = strlen( passwd.bv_val );
+		passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
 	}
 
 	if ( authmethod == LDAP_AUTH_SASL ) {
diff --git a/clients/tools/ldapmodify.c b/clients/tools/ldapmodify.c
index b289406130..5624b30101 100644
--- a/clients/tools/ldapmodify.c
+++ b/clients/tools/ldapmodify.c
@@ -382,7 +382,7 @@ main( int argc, char **argv )
 
 	if (want_bindpw) {
 		passwd.bv_val = getpassphrase("Enter LDAP Password: ");
-		passwd.bv_len = strlen( passwd.bv_val );
+		passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
 	}
 
 	if ( authmethod == LDAP_AUTH_SASL ) {
diff --git a/clients/tools/ldapmodrdn.c b/clients/tools/ldapmodrdn.c
index afbf959d5f..40615d047c 100644
--- a/clients/tools/ldapmodrdn.c
+++ b/clients/tools/ldapmodrdn.c
@@ -365,7 +365,7 @@ main(int argc, char **argv)
 
 	if (want_bindpw) {
 		passwd.bv_val = getpassphrase("Enter LDAP Password: ");
-		passwd.bv_len = strlen( passwd.bv_val );
+		passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
 	}
 
 	if ( authmethod == LDAP_AUTH_SASL ) {
diff --git a/clients/tools/ldappasswd.c b/clients/tools/ldappasswd.c
index 2da63eb81e..7d558620e0 100644
--- a/clients/tools/ldappasswd.c
+++ b/clients/tools/ldappasswd.c
@@ -249,7 +249,9 @@ main( int argc, char *argv[] )
 		newpw = strdup(getpassphrase("Old password: "));
 		ckoldpw = getpassphrase("Re-enter old password: ");
 
-		if( strncmp( oldpw, ckoldpw, strlen(oldpw) )) {
+		if( newpw== NULL || ckoldpw == NULL ||
+			strncmp( oldpw, ckoldpw, strlen(oldpw) ))
+		{
 			fprintf( stderr, "passwords do not match\n" );
 			return EXIT_FAILURE;
 		}
@@ -261,7 +263,9 @@ main( int argc, char *argv[] )
 		newpw = strdup(getpassphrase("New password: "));
 		cknewpw = getpassphrase("Re-enter new password: ");
 
-		if( strncmp( newpw, cknewpw, strlen(newpw) )) {
+		if( newpw== NULL || cknewpw == NULL ||
+			strncmp( newpw, cknewpw, strlen(newpw) ))
+		{
 			fprintf( stderr, "passwords do not match\n" );
 			return EXIT_FAILURE;
 		}
@@ -281,7 +285,7 @@ main( int argc, char *argv[] )
 		/* handle bind password */
 		fprintf( stderr, "Bind DN: %s\n", binddn );
 		passwd.bv_val = strdup( getpassphrase("Enter bind password: "));
-		passwd.bv_len = strlen( passwd.bv_val );
+		passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
 	}
 
 	if ( debug ) {
@@ -400,7 +404,7 @@ main( int argc, char *argv[] )
 			free(newpw);
 		}
 
-		ber_printf( ber, /*{*/ "}" );
+		ber_printf( ber, /*{*/ "N}" );
 
 		rc = ber_flatten( ber, &bv );
 
diff --git a/clients/tools/ldapsearch.c b/clients/tools/ldapsearch.c
index f35c4d4fee..b1d5879a44 100644
--- a/clients/tools/ldapsearch.c
+++ b/clients/tools/ldapsearch.c
@@ -32,9 +32,6 @@
 #include "ldif.h"
 #include "ldap_defaults.h"
 
-#undef DEPSEP
-#define DEFSEP		"="
-
 static void
 usage( const char *s )
 {
@@ -91,6 +88,18 @@ usage( const char *s )
 	exit( EXIT_FAILURE );
 }
 
+static void print_extended(
+	LDAP *ld,
+	LDAPMessage *extended );
+
+static void print_partial(
+	LDAP *ld,
+	LDAPMessage *partial );
+
+static void print_reference(
+	LDAP *ld,
+	LDAPMessage *reference );
+
 static void print_entry LDAP_P((
 	LDAP	*ld,
 	LDAPMessage	*entry,
@@ -130,10 +139,9 @@ static int	sasl_integrity = 0;
 static int	sasl_privacy = 0;
 #endif
 static int	use_tls = 0;
-static char	*sep = DEFSEP;
 static char	*sortattr = NULL;
 static int	skipsortattr = 0;
-static int	verbose, not, includeufn, binary, vals2tmp, ldif;
+static int	verbose, not, includeufn, vals2tmp, ldif;
 
 int
 main( int argc, char **argv )
@@ -146,7 +154,7 @@ main( int argc, char **argv )
 	LDAP		*ld;
 
 	infile = NULL;
-	debug = verbose = binary = not = vals2tmp =
+	debug = verbose = not = vals2tmp =
 		attrsonly = manageDSAit = ldif = want_bindpw = 0;
 
 	deref = sizelimit = timelimit = version = -1;
@@ -158,10 +166,10 @@ main( int argc, char **argv )
 	authmethod = LDAP_AUTH_SIMPLE;
 
 	while (( i = getopt( argc, argv,
-		"Aa:Bb:D:d:EF:f:h:IKkLl:MnP:p:RS:s:T:tU:uV:vWw:X:Y:Zz:")) != EOF )
+		"Aa:b:D:d:Ef:h:IKkLl:MnP:p:RS:s:T:tU:uV:vWw:X:Y:Zz:")) != EOF )
 	{
 	switch( i ) {
-	case 'n':	/* do Not do any searches */
+	case 'n':	/* do nothing */
 		++not;
 		break;
 	case 'v':	/* verbose mode */
@@ -205,16 +213,14 @@ main( int argc, char **argv )
 		break;
 	case 'L':	/* print entries in LDIF format */
 		++ldif;
-		/* fall through -- always allow binary when outputting LDIF */
-	case 'B':	/* allow binary values to be printed */
-		++binary;
 		break;
+
 	case 's':	/* search scope */
 		if ( strcasecmp( optarg, "base" ) == 0 ) {
 		scope = LDAP_SCOPE_BASE;
-		} else if ( strcasecmp( optarg, "one" ) == 0 ) {
+		} else if ( strncasecmp( optarg, "one", sizeof("one")-1 ) == 0 ) {
 		scope = LDAP_SCOPE_ONELEVEL;
-		} else if ( strcasecmp( optarg, "sub" ) == 0 ) {
+		} else if ( strncasecmp( optarg, "sub", sizeof("sub")-1 ) == 0 ) {
 		scope = LDAP_SCOPE_SUBTREE;
 		} else {
 		fprintf( stderr, "scope should be base, one, or sub\n" );
@@ -225,9 +231,9 @@ main( int argc, char **argv )
 	case 'a':	/* set alias deref option */
 		if ( strcasecmp( optarg, "never" ) == 0 ) {
 		deref = LDAP_DEREF_NEVER;
-		} else if ( strcasecmp( optarg, "search" ) == 0 ) {
+		} else if ( strncasecmp( optarg, "search", sizeof("search")-1 ) == 0 ) {
 		deref = LDAP_DEREF_SEARCHING;
-		} else if ( strcasecmp( optarg, "find" ) == 0 ) {
+		} else if ( strncasecmp( optarg, "find", sizeof("find")-1 ) == 0 ) {
 		deref = LDAP_DEREF_FINDING;
 		} else if ( strcasecmp( optarg, "always" ) == 0 ) {
 		deref = LDAP_DEREF_ALWAYS;
@@ -245,9 +251,6 @@ main( int argc, char **argv )
 		if( urlpre ) free( urlpre );
 		urlpre = strdup( optarg );
 		break;
-	case 'F':	/* field separator */
-		sep = strdup( optarg );
-		break;
 	case 'f':	/* input file */
 		infile = strdup( optarg );
 		break;
@@ -366,11 +369,8 @@ main( int argc, char **argv )
 	}
 	}
 
-#define LDAP_LDIF 1
-#ifdef LDAP_LDIF
 	/* no alternative format */
 	if( ldif == 0 ) ldif = 1;
-#endif
 
 	if ( ( authmethod == LDAP_AUTH_KRBV4 ) || ( authmethod ==
 			LDAP_AUTH_KRBV41 ) ) {
@@ -509,10 +509,15 @@ main( int argc, char **argv )
 			referrals ? "on" : "off" );
 	}
 
-	if (version != -1 &&
-		ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version ) != LDAP_OPT_SUCCESS )
+	if (version == -1 ) {
+		version = 3;
+	}
+
+	if( ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version )
+		!= LDAP_OPT_SUCCESS )
 	{
-		fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n", version );
+		fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",
+			version );
 	}
 
 	if ( use_tls && ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS ) {
@@ -524,7 +529,7 @@ main( int argc, char **argv )
 
 	if (want_bindpw) {
 		passwd.bv_val = getpassphrase("Enter LDAP Password: ");
-		passwd.bv_len = strlen( passwd.bv_val );
+		passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
 	}
 
 	if ( authmethod == LDAP_AUTH_SASL ) {
@@ -567,8 +572,7 @@ main( int argc, char **argv )
 			argv[0] );
 		return( EXIT_FAILURE );
 #endif
-	}
-	else {
+	} else {
 		if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod )
 				!= LDAP_SUCCESS ) {
 			ldap_perror( ld, "ldap_bind" );
@@ -613,25 +617,23 @@ main( int argc, char **argv )
 		fprintf( stderr, "\n" );
 	}
 
-	if ( ldif ) {
-		if (ldif < 3 ) {
-			printf( "version: 1\n\n");
-		}
+	if (ldif < 3 ) {
+		printf( "version: 2\n\n");
+	}
 
-		if (ldif < 2 ) {
-			printf( "#\n# filter%s: %s\n# returning: ",
-				infile != NULL ? " pattern" : "",
-				filtpattern );
+	if (ldif < 2 ) {
+		printf( "#\n# filter%s: %s\n# returning: ",
+			infile != NULL ? " pattern" : "",
+			filtpattern );
 
-			if ( attrs == NULL ) {
-				printf( "ALL" );
-			} else {
-				for ( i = 0; attrs[ i ] != NULL; ++i ) {
-					printf( "%s ", attrs[ i ] );
-				}
+		if ( attrs == NULL ) {
+			printf( "ALL" );
+		} else {
+			for ( i = 0; attrs[ i ] != NULL; ++i ) {
+				printf( "%s ", attrs[ i ] );
 			}
-			printf( "\n#\n\n" );
 		}
+		printf( "\n#\n\n" );
 	}
 
 	if ( infile == NULL ) {
@@ -670,8 +672,14 @@ static int dosearch(
 	char	*value)
 {
 	char		filter[ BUFSIZ ];
-	int			rc, first, matches;
-	LDAPMessage		*res, *e;
+	int			rc, first;
+	int			nresponses;
+	int			nentries;
+	int			nreferences;
+	int			nextended;
+	int			npartial;
+	LDAPMessage		*res, *msg;
+	ber_int_t	msgid;
 
 	if( filtpatt != NULL ) {
 		sprintf( filter, filtpatt, value );
@@ -692,62 +700,184 @@ static int dosearch(
 		return( LDAP_SUCCESS );
 	}
 
-	if ( ldap_search( ld, base, scope, filter, attrs, attrsonly ) == -1 ) {
+	msgid = ldap_search( ld, base, scope, filter, attrs, attrsonly );
+	if( msgid == -1 ) {
 		int ld_errno;
 		ldap_perror( ld, "ldap_search" );
-
 		ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ld_errno);
 		return( ld_errno );
 	}
 
-	matches = 0;
-	first = 1;
-	res = NULL;
-	while ( (rc = ldap_result( ld, LDAP_RES_ANY, sortattr ? 1 : 0, NULL, &res ))
-		== LDAP_RES_SEARCH_ENTRY ) {
-	matches++;
-	e = ldap_first_entry( ld, res );
-	if ( !first ) {
-		putchar( '\n' );
-	} else {
-		first = 0;
-	}
-	print_entry( ld, e, attrsonly );
-	ldap_msgfree( res );
+	nresponses = nentries = nreferences = nextended = npartial = 0;
+
 	res = NULL;
+	while ((rc = ldap_result( ld, LDAP_RES_ANY,
+		sortattr ? 1 : 0, NULL, &res )) > 0 )
+	{
+		if( sortattr ) {
+			(void) ldap_sort_entries( ld, &res,
+				( *sortattr == '\0' ) ? NULL : sortattr, strcasecmp );
+		}
+
+		for ( msg = ldap_first_message( ld, res );
+			msg != NULL;
+			msg = ldap_next_message( ld, msg ) )
+		{
+			nresponses++;
+
+			switch( ldap_msgtype( msg ) ) {
+			case LDAP_RES_SEARCH_ENTRY:
+				if( nresponses > 1 ) putchar('\n');
+				nentries++;
+				print_entry( ld, msg, attrsonly );
+				break;
+
+			case LDAP_RES_SEARCH_REFERENCE:
+				if( nresponses > 1 ) putchar('\n');
+				nreferences++;
+				print_reference( ld, msg );
+				break;
+
+			case LDAP_RES_EXTENDED:
+				if( nresponses > 1 ) putchar('\n');
+				nextended++;
+				print_extended( ld, msg );
+
+				rc = ldap_result2error( ld, msg, 0 );
+
+				if( rc != LDAP_SUCCESS ) {
+					ldap_perror( ld, "ldap_search" );
+				}
+
+				if( ldap_msgid( msg ) == 0 ) {
+					/* unsolicited extended operation */
+					goto done;
+				}
+
+				break;
+
+			case LDAP_RES_EXTENDED_PARTIAL:
+				if( nresponses > 1 ) putchar('\n');
+				npartial++;
+				print_partial( ld, msg );
+				break;
+
+			case LDAP_RES_SEARCH_RESULT:
+				/* if( nresponses > 1 ) putchar('\n'); */
+				rc = ldap_result2error( ld, msg, 0 );
+
+				if( rc != LDAP_SUCCESS ) {
+					ldap_perror( ld, "ldap_search" );
+				}
+
+				goto done;
+
+			}
+		}
+
+		ldap_msgfree( res );
 	}
+
 	if ( rc == -1 ) {
-	ldap_perror( ld, "ldap_result" );
+		ldap_perror( ld, "ldap_result" );
+		return( rc );
+	}
+
+done:
+	if ( verbose ) {
+		printf( "%d responses\n", nresponses );
+	}
+
 	return( rc );
+}
+
+
+static void print_reference(
+	LDAP *ld,
+	LDAPMessage *reference )
+{
+	int rc, i;
+	char **refs = NULL;
+
+	if( ldif == 1 ) {
+		printf("# search reference\n");
 	}
-	if (( rc = ldap_result2error( ld, res, 0 )) != LDAP_SUCCESS ) {
-		ldap_perror( ld, "ldap_search" );
+
+	rc = ldap_parse_reference( ld, reference, &refs, NULL, 0 );
+
+	for( i=0; refs[i] != NULL; i++ ) {
+		write_ldif( LDIF_PUT_VALUE, "ref", refs[i], strlen(refs[i]) );
 	}
-	if ( sortattr != NULL ) {
-		(void) ldap_sort_entries( ld, &res,
-			( *sortattr == '\0' ) ? NULL : sortattr, strcasecmp );
-		matches = 0;
-		first = 1;
-		for ( e = ldap_first_entry( ld, res ); e != NULL;
-			e = ldap_next_entry( ld, e ) ) {
-		matches++;
-		if ( !first ) {
-			putchar( '\n' );
-		} else {
-			first = 0;
-		}
-		print_entry( ld, e, attrsonly );
-		}
+
+	ber_memvfree( (void **) refs );
+
+	if( rc != LDAP_SUCCESS ) {
+		ldap_perror(ld, "ldap_parse_reference");
+		exit( EXIT_FAILURE );
 	}
+}
 
-	if ( verbose ) {
-		printf( "%d matches\n", matches );
+static void print_extended(
+	LDAP *ld,
+	LDAPMessage *extended )
+{
+	char rst[16];
+	int rc;
+	char *retoid = NULL;
+	struct berval *retdata = NULL;
+
+	if( ldif == 1 ) {
+		printf("# extended result response\n");
 	}
 
-	ldap_msgfree( res );
-	return( rc );
+	rc = ldap_parse_extended_result( ld, extended,
+		&retoid, &retdata, 0 );
+
+	write_ldif( LDIF_PUT_VALUE, "extended",
+		retoid, retoid ? strlen(retoid) : 0 );
+
+	if(retdata) {
+		write_ldif( LDIF_PUT_BINARY, "data", 
+			retdata->bv_val, retdata->bv_len );
+	}
+
+	sprintf( rst, "%ld", (long) rst );
+	write_ldif( LDIF_PUT_VALUE, "result", rst, strlen(rst));
+
+	if( rc != LDAP_SUCCESS ) {
+		ldap_perror(ld, "ldap_parse_extended_result");
+		exit( EXIT_FAILURE );
+	}
 }
 
+static void print_partial(
+	LDAP *ld,
+	LDAPMessage *partial )
+{
+	int rc;
+	char *retoid = NULL;
+	struct berval *retdata = NULL;
+
+	if( ldif == 1 ) {
+		printf("# extended partial response\n");
+	}
+
+	rc = ldap_parse_extended_partial( ld, partial,
+		&retoid, &retdata, NULL, 0 );
+
+	write_ldif( LDIF_PUT_VALUE, "partial",
+		retoid, retoid ? strlen(retoid) : 0 );
+
+	if(retdata) {
+		write_ldif( LDIF_PUT_BINARY, "data", 
+			retdata->bv_val, retdata->bv_len );
+	}
+
+	if( rc != LDAP_SUCCESS ) {
+		ldap_perror(ld, "ldap_parse_extended_partial");
+		exit( EXIT_FAILURE );
+	}
+}
 
 static void
 print_entry(
@@ -768,10 +898,10 @@ print_entry(
 
 	if ( ldif == 1 ) {
 		ufn = ldap_dn2ufn( dn );
-		write_ldif( LDIF_PUT_COMMENT, NULL, ufn, strlen( ufn ));
+		write_ldif( LDIF_PUT_COMMENT, NULL, ufn, ufn ? strlen( ufn ) : 0 );
 	}
 	if ( ldif ) {
-		write_ldif( LDIF_PUT_VALUE, "dn", dn, strlen( dn ));
+		write_ldif( LDIF_PUT_VALUE, "dn", dn, dn ? strlen( dn ) : 0);
 	} else {
 		printf( "%s\n", dn );
 	}
@@ -781,7 +911,7 @@ print_entry(
 			ufn = ldap_dn2ufn( dn );
 		}
 		if ( ldif ) {
-			write_ldif( LDIF_PUT_VALUE, "ufn", ufn, strlen( ufn ));
+			write_ldif( LDIF_PUT_VALUE, "ufn", ufn, ufn ? strlen( ufn ) : 0 );
 		} else {
 			printf( "%s\n", ufn );
 		}
@@ -843,25 +973,11 @@ print_entry(
 					sprintf( url, "%s%s", urlpre,
 						&tmpfname[strlen(tmpdir) + sizeof(LDAP_DIRSEP) - 1] );
 
-					if ( ldif ) {
-						write_ldif( LDIF_PUT_URL, a, url, strlen( url ));
-					} else {
-						printf( "%s%s%s\n", a, sep, url );
-					}
-
+					write_ldif( LDIF_PUT_URL, a, url, strlen( url ));
 
 				} else {
-					if ( ldif ) {
-						write_ldif( LDIF_PUT_VALUE, a,
-							bvals[ i ]->bv_val, bvals[ i ]->bv_len );
-
-					} else {
-						int notprint = !binary && !vals2tmp
-							&& ldif_is_not_printable( bvals[i]->bv_val,
-								bvals[i]->bv_len ); 
-						printf( "%s%s", a, sep );
-						puts( notprint ? "NOT PRINTABLE" : bvals[ i ]->bv_val );
-					}
+					write_ldif( LDIF_PUT_VALUE, a,
+						bvals[ i ]->bv_val, bvals[ i ]->bv_len );
 				}
 			}
 			ber_bvecfree( bvals );
diff --git a/include/ldap.h b/include/ldap.h
index 8dc109bbb9..7028af91dc 100644
--- a/include/ldap.h
+++ b/include/ldap.h
@@ -609,6 +609,15 @@ ldap_parse_extended_result LDAP_P((
 	struct berval	**retdatap,
 	int				freeit ));
 
+LDAP_F( int )
+ldap_parse_extended_partial LDAP_P((
+	LDAP			*ld,
+	LDAPMessage		*res,
+	char			**retoidp,
+	struct berval	**retdatap,
+	LDAPControl		***serverctrls,
+	int				freeit ));
+
 /*
  * in abandon.c:
  */
diff --git a/libraries/liblber/encode.c b/libraries/liblber/encode.c
index 68f321d8be..00bcf197af 100644
--- a/libraries/liblber/encode.c
+++ b/libraries/liblber/encode.c
@@ -649,6 +649,9 @@ ber_put_set( BerElement *ber )
 	return( ber_put_seqorset( ber ) );
 }
 
+/* N tag */
+static ber_tag_t lber_int_null = 0;
+
 /* VARARGS */
 int
 ber_printf( BerElement *ber, LDAP_CONST char *fmt, ... )
@@ -698,6 +701,15 @@ ber_printf( BerElement *ber, LDAP_CONST char *fmt, ... )
 			rc = ber_put_null( ber, ber->ber_tag );
 			break;
 
+		case 'N':	/* Debug NULL */
+			if( lber_int_null != 0 ) {
+				/* Insert NULL to ensure peer ignores unknown tags */
+				rc = ber_put_null( ber, lber_int_null );
+			} else {
+				rc = 0;
+			}
+			break;
+
 		case 'o':	/* octet string (non-null terminated) */
 			s = va_arg( ap, char * );
 			len = va_arg( ap, ber_len_t );
diff --git a/libraries/liblber/etest.c b/libraries/liblber/etest.c
index 01c10e9907..0b91ba75ce 100644
--- a/libraries/liblber/etest.c
+++ b/libraries/liblber/etest.c
@@ -144,7 +144,7 @@ main( int argc, char **argv )
 	}
 
 	fprintf(stderr, "encode: end\n" );
-	if( ber_printf( ber, /*{*/ "}" ) == -1 ) {
+	if( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
 		perror( /*{*/ "ber_printf }" );
 		return( EXIT_FAILURE );
 	}
diff --git a/libraries/libldap/abandon.c b/libraries/libldap/abandon.c
index 3ce621f7aa..82526f5256 100644
--- a/libraries/libldap/abandon.c
+++ b/libraries/libldap/abandon.c
@@ -163,7 +163,7 @@ do_abandon(
 
 				} else {
 					/* close '{' */
-					err = ber_printf( ber, /*{*/ "}" );
+					err = ber_printf( ber, /*{*/ "N}" );
 
 					if( err == -1 ) {
 						/* encoding error */
diff --git a/libraries/libldap/add.c b/libraries/libldap/add.c
index d3816b448c..5ae7460527 100644
--- a/libraries/libldap/add.c
+++ b/libraries/libldap/add.c
@@ -123,10 +123,10 @@ ldap_add_ext(
 	/* for each attribute in the entry... */
 	for ( i = 0; attrs[i] != NULL; i++ ) {
 		if ( ( attrs[i]->mod_op & LDAP_MOD_BVALUES) != 0 ) {
-			rc = ber_printf( ber, "{s[V]}", attrs[i]->mod_type,
+			rc = ber_printf( ber, "{s[V]N}", attrs[i]->mod_type,
 			    attrs[i]->mod_bvalues );
 		} else {
-			rc = ber_printf( ber, "{s[v]}", attrs[i]->mod_type,
+			rc = ber_printf( ber, "{s[v]N}", attrs[i]->mod_type,
 			    attrs[i]->mod_values );
 		}
 		if ( rc == -1 ) {
@@ -136,7 +136,7 @@ ldap_add_ext(
 		}
 	}
 
-	if ( ber_printf( ber, /*{{*/ "}}" ) == -1 ) {
+	if ( ber_printf( ber, /*{{*/ "N}N}" ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return ld->ld_errno;
@@ -148,7 +148,7 @@ ldap_add_ext(
 		return ld->ld_errno;
 	}
 
-	if ( ber_printf( ber, /*{*/ "}" ) == -1 ) {
+	if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return ld->ld_errno;
diff --git a/libraries/libldap/compare.c b/libraries/libldap/compare.c
index 9cfa56963a..a48dda120f 100644
--- a/libraries/libldap/compare.c
+++ b/libraries/libldap/compare.c
@@ -66,7 +66,7 @@ ldap_compare_ext(
 		return( LDAP_NO_MEMORY );
 	}
 
-	if ( ber_printf( ber, "{it{s{sO}}", /* '}' */
+	if ( ber_printf( ber, "{it{s{sON}N}", /* '}' */
 		++ld->ld_msgid,
 		LDAP_REQ_COMPARE, dn, attr, bvalue ) == -1 )
 	{
@@ -81,7 +81,7 @@ ldap_compare_ext(
 		return ld->ld_errno;
 	}
 
-	if( ber_printf( ber, /*{*/ "}" ) == -1 ) {
+	if( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return( ld->ld_errno );
diff --git a/libraries/libldap/controls.c b/libraries/libldap/controls.c
index b486960500..72857fb3bb 100644
--- a/libraries/libldap/controls.c
+++ b/libraries/libldap/controls.c
@@ -94,14 +94,14 @@ ldap_int_put_controls(
 		}
 
 
-		if( ber_printf( ber, /*{*/"}" ) == -1 ) {
+		if( ber_printf( ber, /*{*/"N}" ) == -1 ) {
 			ld->ld_errno = LDAP_ENCODING_ERROR;
 			return ld->ld_errno;
 		}
 	}
 
 
-	if( ber_printf( ber, /*{*/"}" ) == -1 ) {
+	if( ber_printf( ber, /*{*/ "}" ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		return ld->ld_errno;
 	}
diff --git a/libraries/libldap/delete.c b/libraries/libldap/delete.c
index e750ecb9d8..714acc5a5a 100644
--- a/libraries/libldap/delete.c
+++ b/libraries/libldap/delete.c
@@ -74,7 +74,7 @@ ldap_delete_ext(
 		return ld->ld_errno;
 	}
 
-	if ( ber_printf( ber, /*{*/ "}" ) == -1 ) {
+	if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return( ld->ld_errno );
diff --git a/libraries/libldap/error.c b/libraries/libldap/error.c
index 34cac4600b..5b771f9fad 100644
--- a/libraries/libldap/error.c
+++ b/libraries/libldap/error.c
@@ -235,7 +235,8 @@ ldap_parse_result(
 	for ( lm = r; lm->lm_chain != NULL; lm = lm->lm_chain ) {
 		/* skip over entries and references */
 		if( lm->lm_msgtype != LDAP_RES_SEARCH_ENTRY &&
-			lm->lm_msgtype != LDAP_RES_SEARCH_REFERENCE )
+			lm->lm_msgtype != LDAP_RES_SEARCH_REFERENCE &&
+			lm->lm_msgtype != LDAP_RES_EXTENDED_PARTIAL )
 		{
 			break;
 		}
@@ -342,7 +343,8 @@ ldap_parse_result(
 		for ( lm = lm->lm_chain; lm != NULL; lm = lm->lm_chain ) {
 			/* skip over entries and references */
 			if( lm->lm_msgtype != LDAP_RES_SEARCH_ENTRY &&
-				lm->lm_msgtype != LDAP_RES_SEARCH_REFERENCE )
+				lm->lm_msgtype != LDAP_RES_SEARCH_REFERENCE &&
+				lm->lm_msgtype != LDAP_RES_EXTENDED_PARTIAL )
 			{
 				/* more results to return */
 				errcode = LDAP_MORE_RESULTS_TO_RETURN;
diff --git a/libraries/libldap/extended.c b/libraries/libldap/extended.c
index f42afd281a..4925618592 100644
--- a/libraries/libldap/extended.c
+++ b/libraries/libldap/extended.c
@@ -68,13 +68,13 @@ ldap_extended_operation(
 	}
 
 	if ( reqdata != NULL ) {
-		rc = ber_printf( ber, "{it{tstO}", /* '}' */
+		rc = ber_printf( ber, "{it{tstON}", /* '}' */
 			++ld->ld_msgid, LDAP_REQ_EXTENDED,
 			LDAP_TAG_EXOP_REQ_OID, reqoid,
 			LDAP_TAG_EXOP_REQ_VALUE, reqdata );
 
 	} else {
-		rc = ber_printf( ber, "{it{ts}", /* '}' */
+		rc = ber_printf( ber, "{it{tsN}", /* '}' */
 			++ld->ld_msgid, LDAP_REQ_EXTENDED,
 			LDAP_TAG_EXOP_REQ_OID, reqoid );
 	}
@@ -91,7 +91,7 @@ ldap_extended_operation(
 		return ld->ld_errno;
 	}
 
-	if ( ber_printf( ber, /*{*/ "}" ) == -1 ) {
+	if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return( ld->ld_errno );
@@ -274,3 +274,115 @@ ldap_parse_extended_result (
 
 	return LDAP_SUCCESS;
 }
+
+
+/* Parse an extended partial */
+int
+ldap_parse_extended_partial (
+	LDAP			*ld,
+	LDAPMessage		*res,
+	char			**retoidp,
+	struct berval	**retdatap,
+	LDAPControl		***serverctrls,
+	int				freeit )
+{
+	BerElement *ber;
+	ber_tag_t rc;
+	ber_tag_t tag;
+	ber_len_t len;
+	struct berval *resdata;
+	char *resoid;
+
+	assert( ld != NULL );
+	assert( LDAP_VALID( ld ) );
+	assert( res != NULL );
+
+	Debug( LDAP_DEBUG_TRACE, "ldap_parse_extended_result\n", 0, 0, 0 );
+
+	if( ld->ld_version < LDAP_VERSION3 ) {
+		ld->ld_errno = LDAP_NOT_SUPPORTED;
+		return ld->ld_errno;
+	}
+
+	if( res->lm_msgtype != LDAP_RES_EXTENDED_PARTIAL ) {
+		ld->ld_errno = LDAP_PARAM_ERROR;
+		return ld->ld_errno;
+	}
+
+	if( retoidp != NULL ) *retoidp = NULL;
+	if( retdatap != NULL ) *retdatap = NULL;
+
+	ber = ber_dup( res->lm_ber );
+
+	if ( ber == NULL ) {
+		ld->ld_errno = LDAP_NO_MEMORY;
+		return ld->ld_errno;
+	}
+
+	rc = ber_scanf( ber, "{" /*}*/ );
+
+	if( rc == LBER_ERROR ) {
+		ld->ld_errno = LDAP_DECODING_ERROR;
+		ber_free( ber, 0 );
+		return ld->ld_errno;
+	}
+
+	resoid = NULL;
+	resdata = NULL;
+
+	tag = ber_peek_tag( ber, &len );
+
+	if( tag == LDAP_TAG_EXOP_RES_OID ) {
+		/* we have a resoid */
+		if( ber_scanf( ber, "a", &resoid ) == LBER_ERROR ) {
+			ld->ld_errno = LDAP_DECODING_ERROR;
+			ber_free( ber, 0 );
+			return ld->ld_errno;
+		}
+
+		tag = ber_peek_tag( ber, &len );
+	}
+
+	if( tag == LDAP_TAG_EXOP_RES_VALUE ) {
+		/* we have a resdata */
+		if( ber_scanf( ber, "O", &resdata ) == LBER_ERROR ) {
+			ld->ld_errno = LDAP_DECODING_ERROR;
+			ber_free( ber, 0 );
+			if( resoid != NULL ) LDAP_FREE( resoid );
+			return ld->ld_errno;
+		}
+	}
+
+	if ( serverctrls == NULL ) {
+		rc = LDAP_SUCCESS;
+		goto free_and_return;
+	}
+
+	if ( ber_scanf( ber, /*{*/ "}" ) == LBER_ERROR ) {
+		rc = LDAP_DECODING_ERROR;
+		goto free_and_return;
+	}
+
+	rc = ldap_int_get_controls( ber, serverctrls );
+
+free_and_return:
+	ber_free( ber, 0 );
+
+	if( retoidp != NULL ) {
+		*retoidp = resoid;
+	} else {
+		LDAP_FREE( resoid );
+	}
+
+	if( retdatap != NULL ) {
+		*retdatap = resdata;
+	} else {
+		ber_bvfree( resdata );
+	}
+
+	if( freeit ) {
+		ldap_msgfree( res );
+	}
+
+	return LDAP_SUCCESS;
+}
diff --git a/libraries/libldap/kbind.c b/libraries/libldap/kbind.c
index fd6d59ab7f..84fa3dddf5 100644
--- a/libraries/libldap/kbind.c
+++ b/libraries/libldap/kbind.c
@@ -81,7 +81,7 @@ ldap_kerberos_bind1( LDAP *ld, LDAP_CONST char *dn )
 	}
 
 	/* fill it in */
-	rc = ber_printf( ber, "{it{isto}}", ++ld->ld_msgid, LDAP_REQ_BIND,
+	rc = ber_printf( ber, "{it{istoN}N}", ++ld->ld_msgid, LDAP_REQ_BIND,
 	    ld->ld_version, dn, LDAP_AUTH_KRBV41, cred, credlen );
 
 	if ( rc == -1 ) {
@@ -159,7 +159,7 @@ ldap_kerberos_bind2( LDAP *ld, LDAP_CONST char *dn )
 	}
 
 	/* fill it in */
-	rc = ber_printf( ber, "{it{isto}}", ++ld->ld_msgid, LDAP_REQ_BIND,
+	rc = ber_printf( ber, "{it{istoN}N}", ++ld->ld_msgid, LDAP_REQ_BIND,
 	    ld->ld_version, dn, LDAP_AUTH_KRBV42, cred, credlen );
 
 
diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h
index b3192d5721..c477d1fb81 100644
--- a/libraries/libldap/ldap-int.h
+++ b/libraries/libldap/ldap-int.h
@@ -458,6 +458,7 @@ LDAP_F (int) ldap_append_referral( LDAP *ld, char **referralsp, char *s );
 #ifdef LDAP_CONNECTIONLESS
 LDAP_F (int) cldap_getmsg( LDAP *ld, struct timeval *timeout, BerElement *ber );
 #endif
+LDAP_F (char *) ldap_int_msgtype2str( ber_tag_t tag );
 
 /*
  * in search.c
diff --git a/libraries/libldap/modify.c b/libraries/libldap/modify.c
index 83a4b67a3e..da8b0e6027 100644
--- a/libraries/libldap/modify.c
+++ b/libraries/libldap/modify.c
@@ -88,11 +88,11 @@ ldap_modify_ext( LDAP *ld,
 	/* for each modification to be performed... */
 	for ( i = 0; mods[i] != NULL; i++ ) {
 		if (( mods[i]->mod_op & LDAP_MOD_BVALUES) != 0 ) {
-			rc = ber_printf( ber, "{e{s[V]}}",
+			rc = ber_printf( ber, "{e{s[V]N}N}",
 			    (ber_int_t) ( mods[i]->mod_op & ~LDAP_MOD_BVALUES ),
 			    mods[i]->mod_type, mods[i]->mod_bvalues );
 		} else {
-			rc = ber_printf( ber, "{e{s[v]}}",
+			rc = ber_printf( ber, "{e{s[v]N}N}",
 				(ber_int_t) mods[i]->mod_op,
 			    mods[i]->mod_type, mods[i]->mod_values );
 		}
@@ -104,7 +104,7 @@ ldap_modify_ext( LDAP *ld,
 		}
 	}
 
-	if ( ber_printf( ber, /*{{*/ "}}" ) == -1 ) {
+	if ( ber_printf( ber, /*{{*/ "N}N}" ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return( ld->ld_errno );
@@ -116,7 +116,7 @@ ldap_modify_ext( LDAP *ld,
 		return ld->ld_errno;
 	}
 
-	if ( ber_printf( ber, /*{*/ "}" ) == -1 ) {
+	if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return( ld->ld_errno );
diff --git a/libraries/libldap/modrdn.c b/libraries/libldap/modrdn.c
index 29108a3f38..13678ef041 100644
--- a/libraries/libldap/modrdn.c
+++ b/libraries/libldap/modrdn.c
@@ -83,13 +83,13 @@ ldap_rename(
 			return( ld->ld_errno );
 		}
 
-		rc = ber_printf( ber, "{it{ssbts}", /* '}' */ 
+		rc = ber_printf( ber, "{it{ssbtsN}", /* '}' */ 
 			++ld->ld_msgid, LDAP_REQ_MODDN,
 			dn, newrdn, (ber_int_t) deleteoldrdn,
 			LDAP_TAG_NEWSUPERIOR, newSuperior );
 
 	} else {
-		rc = ber_printf( ber, "{it{ssb}", /* '}' */ 
+		rc = ber_printf( ber, "{it{ssbN}", /* '}' */ 
 			++ld->ld_msgid, LDAP_REQ_MODDN,
 			dn, newrdn, (ber_int_t) deleteoldrdn );
 	}
@@ -106,7 +106,7 @@ ldap_rename(
 		return ld->ld_errno;
 	}
 
-	rc = ber_printf( ber, /*{*/ "}" );
+	rc = ber_printf( ber, /*{*/ "N}" );
 	if ( rc < 0 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
diff --git a/libraries/libldap/request.c b/libraries/libldap/request.c
index 97197ce2a0..8c348a1552 100644
--- a/libraries/libldap/request.c
+++ b/libraries/libldap/request.c
@@ -1010,7 +1010,7 @@ re_encode_request( LDAP *ld, BerElement *origber, ber_int_t msgid, char **dnp, i
 	if ( tag == LDAP_REQ_BIND ) {
 		rc = ber_printf( ber, "{it{is" /*}}*/, msgid, tag, ver, *dnp );
 	} else if ( tag == LDAP_REQ_DELETE ) {
-		rc = ber_printf( ber, "{its}", msgid, tag, *dnp );
+		rc = ber_printf( ber, "{itsN}", msgid, tag, *dnp );
 	} else {
 		rc = ber_printf( ber, "{it{s" /*}}*/, msgid, tag, *dnp );
 	}
@@ -1024,7 +1024,7 @@ re_encode_request( LDAP *ld, BerElement *origber, ber_int_t msgid, char **dnp, i
 	if ( tag != LDAP_REQ_DELETE && (
 		ber_write(ber, tmpber.ber_ptr, ( tmpber.ber_end - tmpber.ber_ptr ), 0)
 		!= ( tmpber.ber_end - tmpber.ber_ptr ) ||
-	    ber_printf( ber, /*{{*/ "}}" ) == -1 ) )
+	    ber_printf( ber, /*{{*/ "N}N}" ) == -1 ) )
 	{
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
diff --git a/libraries/libldap/result.c b/libraries/libldap/result.c
index 6fa1ef19fe..3d326ca7c5 100644
--- a/libraries/libldap/result.c
+++ b/libraries/libldap/result.c
@@ -135,7 +135,8 @@ ldap_result(
 			if ( all == LDAP_MSG_ONE
 			    || (lm->lm_msgtype != LDAP_RES_SEARCH_RESULT
 			    && lm->lm_msgtype != LDAP_RES_SEARCH_REFERENCE	/* LDAPv3 */
-			    && lm->lm_msgtype != LDAP_RES_SEARCH_ENTRY) )
+			    && lm->lm_msgtype != LDAP_RES_SEARCH_ENTRY
+				&& lm->lm_msgtype != LDAP_RES_EXTENDED_PARTIAL) )
 				break;
 
 			for ( tmp = lm; tmp != NULL; tmp = tmp->lm_chain ) {
@@ -382,8 +383,7 @@ try_read1msg(
 	}
 
 	Debug( LDAP_DEBUG_TRACE, "ldap_read: message type %s msgid %ld, original id %ld\n",
-	    ( tag == LDAP_RES_SEARCH_ENTRY ) ? "entry" : 
-		( tag == LDAP_RES_SEARCH_REFERENCE ) ? "reference" : "result",
+	    ldap_int_msgtype2str( tag ),
 		(long) lr->lr_msgid, (long) lr->lr_origid );
 
 	id = lr->lr_origid;
@@ -653,7 +653,8 @@ lr->lr_res_matched ? lr->lr_res_matched : "" );
 	/* part of a search response - add to end of list of entries */
 	for ( tmp = l; (tmp->lm_chain != NULL) &&
 	    	((tmp->lm_chain->lm_msgtype == LDAP_RES_SEARCH_ENTRY) ||
-	    	 (tmp->lm_chain->lm_msgtype == LDAP_RES_SEARCH_REFERENCE));
+	    	 (tmp->lm_chain->lm_msgtype == LDAP_RES_SEARCH_REFERENCE) ||
+			 (tmp->lm_chain->lm_msgtype == LDAP_RES_EXTENDED_PARTIAL ));
 	    tmp = tmp->lm_chain )
 		;	/* NULL */
 	tmp->lm_chain = new;
@@ -793,6 +794,24 @@ ldap_msgid( LDAPMessage *lm )
 }
 
 
+char * ldap_int_msgtype2str( ber_tag_t tag )
+{
+	switch( tag ) {
+	case LDAP_RES_ADD: return "add";
+	case LDAP_RES_BIND: return "bind";
+	case LDAP_RES_COMPARE: return "compare";
+	case LDAP_RES_DELETE: return "delete";
+	case LDAP_RES_EXTENDED: return "extended-result";
+	case LDAP_RES_EXTENDED_PARTIAL: return "extended-partial";
+	case LDAP_RES_MODIFY: return "modify";
+	case LDAP_RES_RENAME: return "rename";
+	case LDAP_RES_SEARCH_ENTRY: return "search-entry";
+	case LDAP_RES_SEARCH_REFERENCE: return "search-reference";
+	case LDAP_RES_SEARCH_RESULT: return "search-result";
+	}
+	return "unknown";
+}
+
 int
 ldap_msgfree( LDAPMessage *lm )
 {
diff --git a/libraries/libldap/sasl.c b/libraries/libldap/sasl.c
index 1243454d76..a7dab4373a 100644
--- a/libraries/libldap/sasl.c
+++ b/libraries/libldap/sasl.c
@@ -97,21 +97,21 @@ ldap_sasl_bind(
 
 	if( mechanism == LDAP_SASL_SIMPLE ) {
 		/* simple bind */
-		rc = ber_printf( ber, "{it{istO}" /*}*/,
+		rc = ber_printf( ber, "{it{istON}" /*}*/,
 			++ld->ld_msgid, LDAP_REQ_BIND,
 			ld->ld_version, dn, LDAP_AUTH_SIMPLE,
 			cred );
 		
 	} else if ( cred == NULL ) {
 		/* SASL bind w/o creditials */
-		rc = ber_printf( ber, "{it{ist{s}}" /*}*/,
+		rc = ber_printf( ber, "{it{ist{sN}N}" /*}*/,
 			++ld->ld_msgid, LDAP_REQ_BIND,
 			ld->ld_version, dn, LDAP_AUTH_SASL,
 			mechanism );
 
 	} else {
 		/* SASL bind w/ creditials */
-		rc = ber_printf( ber, "{it{ist{sO}}" /*}*/,
+		rc = ber_printf( ber, "{it{ist{sON}N}" /*}*/,
 			++ld->ld_msgid, LDAP_REQ_BIND,
 			ld->ld_version, dn, LDAP_AUTH_SASL,
 			mechanism, cred );
@@ -129,7 +129,7 @@ ldap_sasl_bind(
 		return ld->ld_errno;
 	}
 
-	if ( ber_printf( ber, /*{*/ "}" ) == -1 ) {
+	if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return ld->ld_errno;
diff --git a/libraries/libldap/search.c b/libraries/libldap/search.c
index 4f9984affe..b57ac9730c 100644
--- a/libraries/libldap/search.c
+++ b/libraries/libldap/search.c
@@ -173,7 +173,7 @@ ldap_search_ext_s(
 		return( ld->ld_errno );
 	}
 
-	if( rc == LDAP_RES_SEARCH_REFERENCE) {
+	if( rc == LDAP_RES_SEARCH_REFERENCE || rc == LDAP_RES_EXTENDED_PARTIAL ) {
 		return( ld->ld_errno );
 	}
 
@@ -325,7 +325,7 @@ ldap_build_search_req(
 		return( NULL );
 	}
 
-	if ( ber_printf( ber, /*{*/ "{v}}", attrs ) == -1 ) {
+	if ( ber_printf( ber, /*{*/ "{v}N}", attrs ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return( NULL );
@@ -337,7 +337,7 @@ ldap_build_search_req(
 		return( NULL );
 	}
 
-	if ( ber_printf( ber, /*{*/ "}", attrs ) == -1 ) {
+	if ( ber_printf( ber, /*{*/ "N}" ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return( NULL );
@@ -523,7 +523,7 @@ put_complex_filter( BerElement *ber, char *str, ber_tag_t tag, int not )
 	*next++ = ')';
 
 	/* flush explicit tagged thang */
-	if ( ber_printf( ber, /*{*/ "}" ) == -1 )
+	if ( ber_printf( ber, /*{*/ "N}" ) == -1 )
 		return( NULL );
 
 	return( next );
@@ -823,7 +823,7 @@ put_simple_filter(
 				ber_slen_t len = ldap_pvt_filter_value_unescape( value );
 
 				if( len >= 0 ) {
-					rc = ber_printf( ber, "totb}",
+					rc = ber_printf( ber, "totbN}",
 						LDAP_FILTER_EXT_VALUE, value, len,
 						LDAP_FILTER_EXT_DNATTRS, dn != NULL);
 				} else {
@@ -852,7 +852,7 @@ put_simple_filter(
 		ber_slen_t len = ldap_pvt_filter_value_unescape( value );
 
 		if( len >= 0 ) {
-			rc = ber_printf( ber, "t{so}",
+			rc = ber_printf( ber, "t{soN}",
 				ftype, str, value, len );
 		}
 	}
@@ -903,7 +903,7 @@ put_substring_filter( BerElement *ber, char *type, char *val )
 		gotstar = 1;
 	}
 
-	if ( ber_printf( ber, /* {{ */ "}}" ) == -1 )
+	if ( ber_printf( ber, /* {{ */ "N}N}" ) == -1 )
 		return( -1 );
 
 	return( 0 );
diff --git a/libraries/libldap/sortctrl.c b/libraries/libldap/sortctrl.c
index 07ad5736b4..5d6afb9898 100644
--- a/libraries/libldap/sortctrl.c
+++ b/libraries/libldap/sortctrl.c
@@ -321,11 +321,11 @@ ldap_create_sort_control (
 			if( tag == LBER_ERROR ) goto exit;
 		}
 
-		tag = ber_printf(ber, /*{*/ "}");
+		tag = ber_printf(ber, /*{*/ "N}");
 		if( tag == LBER_ERROR ) goto exit;
 	}
 
-	tag = ber_printf(ber, /*{*/ "}");
+	tag = ber_printf(ber, /*{*/ "N}");
 	if( tag == LBER_ERROR ) goto exit;
 
 	ld->ld_errno = ldap_int_create_control( LDAP_CONTROL_SORTREQUEST,
diff --git a/libraries/libldap/unbind.c b/libraries/libldap/unbind.c
index 36810f3d8d..98a559669f 100644
--- a/libraries/libldap/unbind.c
+++ b/libraries/libldap/unbind.c
@@ -200,7 +200,7 @@ ldap_send_unbind(
 		return ld->ld_errno;
 	}
 
-	if ( ber_printf( ber, /*{*/ "}", LDAP_REQ_UNBIND ) == -1 ) {
+	if ( ber_printf( ber, /*{*/ "N}", LDAP_REQ_UNBIND ) == -1 ) {
 		ld->ld_errno = LDAP_ENCODING_ERROR;
 		ber_free( ber, 1 );
 		return( ld->ld_errno );
diff --git a/libraries/libldap/vlvctrl.c b/libraries/libldap/vlvctrl.c
index 40785e9534..b4f01e133a 100644
--- a/libraries/libldap/vlvctrl.c
+++ b/libraries/libldap/vlvctrl.c
@@ -96,7 +96,7 @@ ldap_create_vlv_control( LDAP *ld,
 	if( tag == LBER_ERROR ) goto exit;
 
 	if (vlvinfop->ldvlv_attrvalue == NULL) {
-		tag = ber_printf(ber, "t{ii}",
+		tag = ber_printf(ber, "t{iiN}",
 			LDAP_VLVBYINDEX_IDENTIFIER,
 			vlvinfop->ldvlv_offset,
 			vlvinfop->ldvlv_count);
@@ -116,7 +116,7 @@ ldap_create_vlv_control( LDAP *ld,
 		if( tag == LBER_ERROR ) goto exit;
 	}
 
-	tag = ber_printf(ber, /*{*/ "}"); 
+	tag = ber_printf(ber, /*{*/ "N}"); 
 	if( tag == LBER_ERROR ) goto exit;
 
 	ld->ld_errno = ldap_int_create_control(
diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index 8246f55965..db240991da 100644
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -202,7 +202,7 @@ struct berval * slap_passwd_return(
 
 	if( ber == NULL ) return NULL;
 	
-	rc = ber_printf( ber, "{tO}",
+	rc = ber_printf( ber, "{tON}",
 		LDAP_TAG_EXOP_X_MODIFY_PASSWD_GEN, cred );
 
 	if( rc == -1 ) {
diff --git a/servers/slapd/result.c b/servers/slapd/result.c
index 70fabc0a95..7a7000d625 100644
--- a/servers/slapd/result.c
+++ b/servers/slapd/result.c
@@ -276,7 +276,7 @@ send_ldap_response(
 
 #ifdef LDAP_CONNECTIONLESS
 	if ( op->o_cldap ) {
-		rc = ber_printf( ber, "{is{t{ess}}}", msgid, "", tag,
+		rc = ber_printf( ber, "{is{t{essN}N}N}", msgid, "", tag,
 		    err, matched ? matched : "", text ? text : "" );
 	} else
 #endif
@@ -312,7 +312,7 @@ send_ldap_response(
 		}
 
 		if( rc != -1 ) {
-			rc = ber_printf( ber, "}}" );
+			rc = ber_printf( ber, "N}N}" );
 		}
 	}
 
@@ -747,7 +747,7 @@ send_search_entry(
 			}
 		}
 
-		if (( rc = ber_printf( ber, /*{[*/ "]}" )) == -1 ) {
+		if (( rc = ber_printf( ber, /*{[*/ "]N}" )) == -1 ) {
 			Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
 			ber_free( ber, 1 );
 			send_ldap_result( conn, op, LDAP_OTHER,
@@ -822,7 +822,7 @@ send_search_entry(
 			}
 		}
 
-		if (( rc = ber_printf( ber, /*{[*/ "]}" )) == -1 ) {
+		if (( rc = ber_printf( ber, /*{[*/ "]N}" )) == -1 ) {
 			Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
 			ber_free( ber, 1 );
 			send_ldap_result( conn, op, LDAP_OTHER,
@@ -833,7 +833,7 @@ send_search_entry(
 
 	attrs_free( aa );
 
-	rc = ber_printf( ber, /*{{{*/ "}}}" );
+	rc = ber_printf( ber, /*{{{*/ "}N}N}" );
 
 	if ( rc == -1 ) {
 		Debug( LDAP_DEBUG_ANY, "ber_printf failed\n", 0, 0, 0 );
@@ -934,7 +934,7 @@ send_search_reference(
 		return -1;
 	}
 
-	rc = ber_printf( ber, "{it{V}}", op->o_msgid,
+	rc = ber_printf( ber, "{it{V}N}", op->o_msgid,
 		LDAP_RES_SEARCH_REFERENCE, refs );
 
 	if ( rc == -1 ) {
-- 
2.39.5