From ac7f6c2e376144b8d2754af982557545fde614f8 Mon Sep 17 00:00:00 2001
From: Kurt Zeilenga <kurt@openldap.org>
Date: Tue, 29 Feb 2000 23:48:01 +0000
Subject: [PATCH] Replace do_*() return -1 with return SLAPD_DISCONNECT. Only
 return SLAPD_DISCONNECT with a send_ldap_disconnect() was called. Add initial
 code for support predetermined filter results when filter is undefined (or
 known to be true or false).

---
 servers/slapd/back-bdb2/filterindex.c |  7 ----
 servers/slapd/back-ldbm/filterindex.c |  7 ----
 servers/slapd/bind.c                  |  4 +-
 servers/slapd/compare.c               |  6 +--
 servers/slapd/connection.c            |  2 +-
 servers/slapd/controls.c              | 12 +++---
 servers/slapd/delete.c                |  2 +-
 servers/slapd/filter.c                | 57 +++++++++++++++++----------
 servers/slapd/filterentry.c           | 18 +++++++--
 servers/slapd/modify.c                |  4 +-
 servers/slapd/modrdn.c                |  8 ++--
 servers/slapd/search.c                | 30 ++++++--------
 servers/slapd/slap.h                  | 28 ++++++++-----
 13 files changed, 102 insertions(+), 83 deletions(-)

diff --git a/servers/slapd/back-bdb2/filterindex.c b/servers/slapd/back-bdb2/filterindex.c
index 1136661e44..5c689aae70 100644
--- a/servers/slapd/back-bdb2/filterindex.c
+++ b/servers/slapd/back-bdb2/filterindex.c
@@ -18,13 +18,6 @@ static ID_BLOCK	*list_candidates( BackendDB *be, Filter *flist, int ftype );
 static ID_BLOCK	*substring_candidates( BackendDB *be, Filter *f );
 static ID_BLOCK	*substring_comp_candidates( BackendDB *be, char *type, char *val, int prepost );
 
-/*
- * test_filter - test a filter against a single entry.
- * returns	0	filter matched
- *		-1	filter did not match
- *		>0	an ldap error code
- */
-
 ID_BLOCK *
 bdb2i_filter_candidates(
     BackendDB	*be,
diff --git a/servers/slapd/back-ldbm/filterindex.c b/servers/slapd/back-ldbm/filterindex.c
index 9191ea28ff..35c3beed1e 100644
--- a/servers/slapd/back-ldbm/filterindex.c
+++ b/servers/slapd/back-ldbm/filterindex.c
@@ -33,13 +33,6 @@ static ID_BLOCK	*substring_candidates( Backend *be, Filter *f );
 static ID_BLOCK	*substring_comp_candidates( Backend *be, char *type,
 	struct berval *val, int prepost );
 
-/*
- * test_filter - test a filter against a single entry.
- * returns	0	filter matched
- *		-1	filter did not match
- *		>0	an ldap error code
- */
-
 ID_BLOCK *
 filter_candidates(
     Backend	*be,
diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index 096dc6b038..c825d0b8b1 100644
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -147,7 +147,7 @@ do_bind(
 		send_ldap_disconnect( conn, op,
 			LDAP_PROTOCOL_ERROR,
     		"decoding error" );
-		rc = -1;
+		rc = SLAPD_DISCONNECT;
 		goto cleanup;
 	}
 
@@ -181,7 +181,7 @@ do_bind(
 				(unsigned long) version, 0, 0 );
 			send_ldap_disconnect( conn, op,
 				LDAP_PROTOCOL_ERROR, "sasl bind requires LDAPv3" );
-			rc = -1;
+			rc = SLAPD_DISCONNECT;
 			goto cleanup;
 		}
 
diff --git a/servers/slapd/compare.c b/servers/slapd/compare.c
index 890c3e0193..c95d98952f 100644
--- a/servers/slapd/compare.c
+++ b/servers/slapd/compare.c
@@ -73,7 +73,7 @@ do_compare(
 		Debug( LDAP_DEBUG_ANY, "ber_scanf failed\n", 0, 0, 0 );
 		send_ldap_disconnect( conn, op,
 			LDAP_PROTOCOL_ERROR, "decoding error" );
-		return -1;
+		return SLAPD_DISCONNECT;
 	}
 
 	ndn = ch_strdup( dn );
@@ -89,7 +89,7 @@ do_compare(
 		Debug( LDAP_DEBUG_ANY, "do_compare: get ava failed\n", 0, 0, 0 );
 		send_ldap_disconnect( conn, op,
 			LDAP_PROTOCOL_ERROR, "decoding error" );
-		rc = -1;
+		rc = SLAPD_DISCONNECT;
 		goto cleanup;
 	}
 
@@ -97,7 +97,7 @@ do_compare(
 		Debug( LDAP_DEBUG_ANY, "ber_scanf failed\n", 0, 0, 0 );
 		send_ldap_disconnect( conn, op,
 			LDAP_PROTOCOL_ERROR, "decoding error" );
-		rc = -1;
+		rc = SLAPD_DISCONNECT;
 		goto cleanup;
 	}
 
diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c
index 6f4ebf0a63..17dcffefd4 100644
--- a/servers/slapd/connection.c
+++ b/servers/slapd/connection.c
@@ -781,7 +781,7 @@ connection_operation( void *arg_v )
 		break;
 	}
 
-	if( rc == -1 ) tag = LBER_ERROR;
+	if( rc == SLAPD_DISCONNECT ) tag = LBER_ERROR;
 
 	ldap_pvt_thread_mutex_lock( &num_ops_mutex );
 	num_ops_completed++;
diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c
index c5cdb803d4..1f514b2471 100644
--- a/servers/slapd/controls.c
+++ b/servers/slapd/controls.c
@@ -49,7 +49,7 @@ int get_ctrls(
 
 	if(( tag = ber_peek_tag( ber, &len )) != LDAP_TAG_CONTROLS ) {
 		if( tag == LBER_ERROR ) {
-			rc = -1;
+			rc = SLAPD_DISCONNECT;
 			errmsg = "unexpected data in PDU";
 		}
 
@@ -59,7 +59,7 @@ int get_ctrls(
 	Debug( LDAP_DEBUG_TRACE, "=> get_ctrls\n", 0, 0, 0 );
 
 	if( op->o_protocol < LDAP_VERSION3 ) {
-		rc = -1;
+		rc = SLAPD_DISCONNECT;
 		errmsg = "controls require LDAPv3";
 		goto return_results;
 	}
@@ -121,7 +121,7 @@ int get_ctrls(
 				0, 0, 0 );
 			*ctrls = NULL;
 			ldap_controls_free( tctrls );
-			rc = -1;
+			rc = SLAPD_DISCONNECT;
 			errmsg = "decoding controls error";
 			goto return_results;
 		}
@@ -137,7 +137,7 @@ int get_ctrls(
 					0, 0, 0 );
 				*ctrls = NULL;
 				ldap_controls_free( tctrls );
-				rc = -1;
+				rc = SLAPD_DISCONNECT;
 				errmsg = "decoding controls error";
 				goto return_results;
 			}
@@ -159,7 +159,7 @@ int get_ctrls(
 					0, 0, 0 );
 				*ctrls = NULL;
 				ldap_controls_free( tctrls );
-				rc = -1;
+				rc = SLAPD_DISCONNECT;
 				errmsg = "decoding controls error";
 				goto return_results;
 			}
@@ -181,7 +181,7 @@ return_results:
 		nctrls, rc, errmsg ? errmsg : "");
 
 	if( sendres && rc != LDAP_SUCCESS ) {
-		if( rc == -1 ) {
+		if( rc == SLAPD_DISCONNECT ) {
 			send_ldap_disconnect( conn, op, rc, errmsg );
 		} else {
 			send_ldap_result( conn, op, rc,
diff --git a/servers/slapd/delete.c b/servers/slapd/delete.c
index fbb532a416..fad869826f 100644
--- a/servers/slapd/delete.c
+++ b/servers/slapd/delete.c
@@ -55,7 +55,7 @@ do_delete(
 		Debug( LDAP_DEBUG_ANY, "ber_scanf failed\n", 0, 0, 0 );
 		send_ldap_disconnect( conn, op,
 			LDAP_PROTOCOL_ERROR, "decoding error" );
-		return -1;
+		return SLAPD_DISCONNECT;
 	}
 
 	ndn = ch_strdup( dn );
diff --git a/servers/slapd/filter.c b/servers/slapd/filter.c
index 8d225049f0..83d8336fe6 100644
--- a/servers/slapd/filter.c
+++ b/servers/slapd/filter.c
@@ -20,6 +20,7 @@ static int	get_substring_filter(Connection *conn, BerElement *ber, Filter *f, ch
 int
 get_filter( Connection *conn, BerElement *ber, Filter **filt, char **fstr )
 {
+	ber_tag_t	tag;
 	ber_len_t	len;
 	int		err;
 	Filter		*f;
@@ -60,15 +61,23 @@ get_filter( Connection *conn, BerElement *ber, Filter **filt, char **fstr )
 	 *
 	 */
 
+	tag = ber_peek_tag( ber, &len );
+
+	if( tag == LBER_ERROR ) {
+		return SLAPD_DISCONNECT;
+	}
+
 	f = (Filter *) ch_malloc( sizeof(Filter) );
 	f->f_next = NULL;
 
 	err = LDAP_SUCCESS;
 	*fstr = NULL;
-	f->f_choice = ber_peek_tag( ber, &len );
+	f->f_choice = tag; 
 
 	switch ( f->f_choice ) {
-#ifndef SLAPD_SCHEMA_NOT_COMPAT
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+	/* not yet implemented */
+#else
 	case LDAP_FILTER_EQUALITY:
 		Debug( LDAP_DEBUG_FILTER, "EQUALITY\n", 0, 0, 0 );
 		if ( (err = get_ava( ber, &f->f_ava )) == LDAP_SUCCESS ) {
@@ -107,13 +116,14 @@ get_filter( Connection *conn, BerElement *ber, Filter **filt, char **fstr )
 	case LDAP_FILTER_PRESENT:
 		Debug( LDAP_DEBUG_FILTER, "PRESENT\n", 0, 0, 0 );
 		if ( ber_scanf( ber, "a", &f->f_type ) == LBER_ERROR ) {
-			err = -1;
-		} else {
-			err = LDAP_SUCCESS;
-			attr_normalize( f->f_type );
-			*fstr = ch_malloc( 5 + strlen( f->f_type ) );
-			sprintf( *fstr, "(%s=*)", f->f_type );
+			err = SLAPD_DISCONNECT;
+			break;
 		}
+
+		err = LDAP_SUCCESS;
+		attr_normalize( f->f_type );
+		*fstr = ch_malloc( 5 + strlen( f->f_type ) );
+		sprintf( *fstr, "(%s=*)", f->f_type );
 		break;
 
 	case LDAP_FILTER_APPROX:
@@ -164,13 +174,7 @@ get_filter( Connection *conn, BerElement *ber, Filter **filt, char **fstr )
 		/* not yet implemented */
 		Debug( LDAP_DEBUG_ANY, "extensible match not yet implemented.\n",
 		       f->f_choice, 0, 0 );
-		err = -1;
-		break;
-
-	case LBER_DEFAULT:
-		Debug( LDAP_DEBUG_ANY, "decoding filter error\n",
-		       0, 0, 0 );
-		err = -1;
+		err = LDAP_PROTOCOL_ERROR;
 		break;
 
 	default:
@@ -247,7 +251,7 @@ get_substring_filter(
 	Debug( LDAP_DEBUG_FILTER, "begin get_substring_filter\n", 0, 0, 0 );
 
 	if ( ber_scanf( ber, "{a" /*}*/, &f->f_sub_type ) == LBER_ERROR ) {
-		return( -1 );
+		return SLAPD_DISCONNECT;
 	}
 
 	attr_normalize( f->f_sub_type );
@@ -265,7 +269,7 @@ get_substring_filter(
 
 	if( fstr ) {
 		*fstr = ch_malloc( strlen( f->f_sub_type ) + 3 );
-		sprintf( *fstr, "(%s=", f->f_sub_type );
+		sprintf( *fstr, "(%s=" /*)*/, f->f_sub_type );
 	}
 
 	for ( tag = ber_first_element( ber, &len, &last ); tag != LBER_DEFAULT;
@@ -273,7 +277,7 @@ get_substring_filter(
 	{
 		rc = ber_scanf( ber, "O", &val );
 		if ( rc == LBER_ERROR ) {
-			rc = -1;
+			rc = SLAPD_DISCONNECT;
 			goto return_error;
 		}
 
@@ -368,7 +372,7 @@ return_error:
 		if ( f->f_sub_final == NULL ) {
 			strcat( *fstr, "*" );
 		}
-		strcat( *fstr, ")" );
+		strcat( *fstr, /*(*/ ")" );
 	}
 
 	Debug( LDAP_DEBUG_FILTER, "end get_substring_filter\n", 0, 0, 0 );
@@ -441,6 +445,9 @@ filter_free( Filter *f )
 		}
 		break;
 
+	case SLAPD_FILTER_COMPUTED:
+		break;
+
 	default:
 		Debug( LDAP_DEBUG_ANY, "unknown filter type %lu\n",
 		       f->f_choice, 0, 0 );
@@ -459,7 +466,7 @@ filter_print( Filter *f )
 	Filter	*p;
 
 	if ( f == NULL ) {
-		fprintf( stderr, "NULL" );
+		fprintf( stderr, "No filter!" );
 	}
 
 	switch ( f->f_choice ) {
@@ -532,7 +539,7 @@ filter_print( Filter *f )
 		fprintf( stderr, "(%s=*)",
 			f->f_desc->ad_cname );
 #else
-		fprintf( stderr, "%s=*", f->f_type );
+		fprintf( stderr, "(%s=*)", f->f_type );
 #endif
 		break;
 
@@ -548,6 +555,14 @@ filter_print( Filter *f )
 		fprintf( stderr, /*(*/ ")" );
 		break;
 
+	case SLAPD_FILTER_COMPUTED:
+		fprintf( stderr, "(%s)",
+			f->f_result == LDAP_COMPARE_FALSE ? "false" :
+			f->f_result == LDAP_COMPARE_TRUE ? "true" :
+			f->f_result == SLAPD_COMPARE_UNDEFINED ? "undefined" :
+			"error" );
+		break;
+
 	default:
 		fprintf( stderr, "(unknown filter %lu)", f->f_choice );
 		break;
diff --git a/servers/slapd/filterentry.c b/servers/slapd/filterentry.c
index 2732730eaf..97918c731f 100644
--- a/servers/slapd/filterentry.c
+++ b/servers/slapd/filterentry.c
@@ -53,9 +53,10 @@ static int	test_presence_filter(Backend *be,
 /*
  * test_filter - test a filter against a single entry.
  * returns:
- *		LDAP_COMPARE_TRUE	filter matched
- *		LDAP_COMPARE_FALSE	filter did not match
- *	or an ldap error code
+ *		LDAP_COMPARE_TRUE		filter matched
+ *		LDAP_COMPARE_FALSE		filter did not match
+ *		SLAPD_COMPARE_UNDEFINED	filter is undefined
+ *	or an ldap result code indicating error
  */
 
 int
@@ -72,6 +73,17 @@ test_filter(
 	Debug( LDAP_DEBUG_FILTER, "=> test_filter\n", 0, 0, 0 );
 
 	switch ( f->f_choice ) {
+#ifdef SLAPD_SCHEMA_NOT_COMPAT
+	case SLAPD_FILTER_COMPUTED:
+		Debug( LDAP_DEBUG_FILTER, "    COMPUTED %s (%d)\n",
+			f->f_result == LDAP_COMPARE_FALSE ? "false" :
+			f->f_result == LDAP_COMPARE_TRUE ? "true" :
+			f->f_result == SLAPD_COMPARE_UNDEFINED ? "undefined" : "error",
+			f->f_result, 0 );
+		rc = f->f_result;
+		break;
+#endif
+
 	case LDAP_FILTER_EQUALITY:
 		Debug( LDAP_DEBUG_FILTER, "    EQUALITY\n", 0, 0, 0 );
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
diff --git a/servers/slapd/modify.c b/servers/slapd/modify.c
index 8760244da1..4c201af7fb 100644
--- a/servers/slapd/modify.c
+++ b/servers/slapd/modify.c
@@ -83,7 +83,7 @@ do_modify(
 		Debug( LDAP_DEBUG_ANY, "do_modify: ber_scanf failed\n", 0, 0, 0 );
 		send_ldap_disconnect( conn, op,
 			LDAP_PROTOCOL_ERROR, "decoding error" );
-		return -1;
+		return SLAPD_DISCONNECT;
 	}
 
 	Debug( LDAP_DEBUG_ARGS, "do_modify: dn (%s)\n", dn, 0, 0 );
@@ -113,7 +113,7 @@ do_modify(
 		{
 			send_ldap_disconnect( conn, op,
 				LDAP_PROTOCOL_ERROR, "decoding modlist error" );
-			rc = -1;
+			rc = SLAPD_DISCONNECT;
 			goto cleanup;
 		}
 
diff --git a/servers/slapd/modrdn.c b/servers/slapd/modrdn.c
index 784fe795c5..0530579ee0 100644
--- a/servers/slapd/modrdn.c
+++ b/servers/slapd/modrdn.c
@@ -80,7 +80,7 @@ do_modrdn(
 		Debug( LDAP_DEBUG_ANY, "ber_scanf failed\n", 0, 0, 0 );
 		send_ldap_disconnect( conn, op,
 			LDAP_PROTOCOL_ERROR, "decoding error" );
-		return -1;
+		return SLAPD_DISCONNECT;
 	}
 
 	ndn = ch_strdup( dn );
@@ -111,7 +111,7 @@ do_modrdn(
 			       0, 0, 0 );
 			send_ldap_disconnect( conn, op,
 				LDAP_PROTOCOL_ERROR, "newSuperior requires LDAPv3" );
-			rc = -1;
+			rc = SLAPD_DISCONNECT;
 			goto cleanup;
 		}
 
@@ -122,7 +122,7 @@ do_modrdn(
 			   0, 0, 0 );
 			send_ldap_disconnect( conn, op,
 				LDAP_PROTOCOL_ERROR, "decoding error" );
-			rc = -1;
+			rc = SLAPD_DISCONNECT;
 			goto cleanup;
 		}
 
@@ -147,7 +147,7 @@ do_modrdn(
 		Debug( LDAP_DEBUG_ANY, "do_modrdn: ber_scanf failed\n", 0, 0, 0 );
 		send_ldap_disconnect( conn, op,
 				LDAP_PROTOCOL_ERROR, "decoding error" );
-		rc = -1;
+		rc = SLAPD_DISCONNECT;
 		goto cleanup;
 	}
 
diff --git a/servers/slapd/search.c b/servers/slapd/search.c
index 2c3f42707c..24bf9c34b3 100644
--- a/servers/slapd/search.c
+++ b/servers/slapd/search.c
@@ -32,7 +32,7 @@ do_search(
     Operation	*op	/* info about the op to which we're responding */
 )
 {
-	int		i, err;
+	int		i;
 	ber_int_t		scope, deref, attrsonly;
 	ber_int_t		sizelimit, timelimit;
 	char		*base = NULL, *nbase = NULL, *fstr = NULL;
@@ -76,12 +76,12 @@ do_search(
 	 */
 
 	/* baseObject, scope, derefAliases, sizelimit, timelimit, attrsOnly */
-	if ( ber_scanf( op->o_ber, "{aiiiib",
+	if ( ber_scanf( op->o_ber, "{aiiiib" /*}*/,
 		&base, &scope, &deref, &sizelimit,
 	    &timelimit, &attrsonly ) == LBER_ERROR ) {
 		send_ldap_disconnect( conn, op,
 			LDAP_PROTOCOL_ERROR, "decoding error" );
-		rc = -1;
+		rc = SLAPD_DISCONNECT;
 		goto return_results;
 	}
 
@@ -91,9 +91,8 @@ do_search(
 	case LDAP_SCOPE_SUBTREE:
 		break;
 	default:
-		send_ldap_result( conn, op, LDAP_PROTOCOL_ERROR,
+		send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR,
 			NULL, "invalid scope", NULL, NULL );
-		rc = -1;
 		goto return_results;
 	}
 
@@ -104,18 +103,16 @@ do_search(
 	case LDAP_DEREF_ALWAYS:
 		break;
 	default:
-		send_ldap_result( conn, op, LDAP_PROTOCOL_ERROR,
+		send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR,
 			NULL, "invalid deref", NULL, NULL );
-		rc = -1;
 		goto return_results;
 	}
 
 	nbase = ch_strdup( base );
 
 	if( dn_normalize( nbase ) == NULL ) {
-		send_ldap_result( conn, op, LDAP_INVALID_DN_SYNTAX,
+		send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX,
 			NULL, "invalid DN", NULL, NULL );
-		rc = -1;
 		goto return_results;
 	}
 
@@ -124,15 +121,14 @@ do_search(
 	    attrsonly);
 
 	/* filter - returns a "normalized" version */
-	if ( (err = get_filter( conn, op->o_ber, &filter, &fstr )) != 0 ) {
-		if( err == -1 ) {
+	if ( (rc = get_filter( conn, op->o_ber, &filter, &fstr )) != LDAP_SUCCESS ) {
+		if( rc == SLAPD_DISCONNECT ) {
 			send_ldap_disconnect( conn, op,
-				LDAP_PROTOCOL_ERROR, "decode error" );
+				LDAP_PROTOCOL_ERROR, "decode filter error" );
 		} else {
-			send_ldap_result( conn, op, err,
-				NULL, "Bad search filter", NULL, NULL );
+			send_ldap_result( conn, op, rc,
+				NULL, "bad search filter", NULL, NULL );
 		}
-		rc = -1;
 		goto return_results;
 	}
 
@@ -141,8 +137,8 @@ do_search(
 	/* attributes */
 	if ( ber_scanf( op->o_ber, /*{*/ "{v}}", &attrs ) == LBER_ERROR ) {
 		send_ldap_disconnect( conn, op,
-			LDAP_PROTOCOL_ERROR, "decoding error" );
-		rc = -1;
+			LDAP_PROTOCOL_ERROR, "decoding attrs error" );
+		rc = SLAPD_DISCONNECT;
 		goto return_results;
 	}
 
diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h
index 3ac6b2a9a9..a4dabc8247 100644
--- a/servers/slapd/slap.h
+++ b/servers/slapd/slap.h
@@ -62,8 +62,12 @@ LDAP_BEGIN_DECL
 
 #define MAXREMATCHES 10
 
-/* psuedo error code to indicating abandoned operation */
-#define SLAPD_ABANDON -1
+/* psuedo error code indicating disconnect */
+#define SLAPD_DISCONNECT -1
+
+/* psuedo error code indicating abandoned operation */
+#define SLAPD_ABANDON -2
+
 
 /* We assume "C" locale, that is US-ASCII */
 #define ASCII_SPACE(c)	( (c) == ' ' )
@@ -332,10 +336,15 @@ typedef struct slap_mra {
 /*
  * represents a search filter
  */
+
 typedef struct slap_filter {
-	ber_tag_t	f_choice;	/* values taken from ldap.h */
+	ber_tag_t	f_choice;	/* values taken from ldap.h, plus: */
+#define SLAPD_FILTER_COMPUTED ((ber_tag_t) 0x01U)
 
 	union f_un_u {
+		/* precomputed result */
+		ber_int_t f_un_result;
+
 #ifdef SLAPD_SCHEMA_NOT_COMPAT
 		/* DN */
 		char *f_un_dn;
@@ -352,9 +361,6 @@ typedef struct slap_filter {
 		/* matching rule assertion */
 		MatchingRuleAssertion *f_un_mra;
 
-		/* and, or, not */
-		struct slap_filter *f_un_complex;
-
 #define f_dn			f_un.f_un_dn
 #define f_desc			f_un.f_un_desc
 #define f_ava			f_un.f_un_ava
@@ -380,9 +386,6 @@ typedef struct slap_filter {
 		/* extensible */
 		Mra		f_un_fra;	
 
-		/* and, or, not, list */
-		struct slap_filter	*f_un_complex;
-
 		/* substrings */
 		struct sub {
 			char	*f_un_sub_type;
@@ -407,8 +410,12 @@ typedef struct slap_filter {
 #define f_sub_any	f_un.f_un_sub.f_un_sub_any
 #define f_sub_final	f_un.f_un_sub.f_un_sub_final
 #endif
+
+		/* and, or, not */
+		struct slap_filter *f_un_complex;
 	} f_un;
 
+#define f_result	f_un.f_un_result
 #define f_and		f_un.f_un_complex
 #define f_or		f_un.f_un_complex
 #define f_not		f_un.f_un_complex
@@ -417,6 +424,9 @@ typedef struct slap_filter {
 	struct slap_filter	*f_next;
 } Filter;
 
+/* compare routines can return undefined */
+#define SLAPD_COMPARE_UNDEFINED	((ber_tag_t) -1)
+
 /*
  * represents an attribute (description + values)
  */
-- 
2.39.5