--- servers/slapd/filter.c	2007/09/27 21:14:23	1.134.2.4
+++ servers/slapd/filter.c	2009/08/13 00:48:32	1.134.2.17
@@ -1,8 +1,8 @@
 /* filter.c - routines for parsing and dealing with filters */
-/* $OpenLDAP: pkg/ldap/servers/slapd/filter.c,v 1.134.2.3 2007/08/31 23:13:59 quanah Exp $ */
+/* $OpenLDAP: pkg/ldap/servers/slapd/filter.c,v 1.134.2.16 2009/01/22 00:01:01 kurt Exp $ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2007 The OpenLDAP Foundation.
+ * Copyright 1998-2009 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -32,6 +32,7 @@
 #include <ac/string.h>
 
 #include "slap.h"
+#include "lutil.h"
 
 const Filter *slap_filter_objectClass_pres;
 const struct berval *slap_filterstr_objectClass_pres;
@@ -347,7 +348,7 @@ get_ssa(
 {
 	ber_tag_t	tag;
 	ber_len_t	len;
-	ber_tag_t	rc;
+	int	rc;
 	struct berval desc, value, nvalue;
 	char		*last;
 	SubstringsAssertion ssa;
@@ -384,6 +385,17 @@ get_ssa(
 
 	rc = LDAP_PROTOCOL_ERROR;
 
+	/* If there is no substring matching rule, there's nothing
+	 * we can do with this filter. But we continue to parse it
+	 * for logging purposes.
+	 */
+	if ( ssa.sa_desc->ad_type->sat_substr == NULL ) {
+		f->f_choice |= SLAPD_FILTER_UNDEFINED;
+		Debug( LDAP_DEBUG_FILTER,
+		"get_ssa: no substring matching rule for attributeType %s\n",
+			desc.bv_val, 0, 0 );
+	}
+
 	for ( tag = ber_first_element( ber, &len, &last );
 		tag != LBER_DEFAULT;
 		tag = ber_next_element( ber, &len, last ) )
@@ -443,7 +455,13 @@ get_ssa(
 		rc = asserted_value_validate_normalize(
 			ssa.sa_desc, ssa.sa_desc->ad_type->sat_equality,
 			usage, &value, &nvalue, text, op->o_tmpmemctx );
-		if( rc != LDAP_SUCCESS ) goto return_error;
+		if( rc != LDAP_SUCCESS ) {
+			f->f_choice |= SLAPD_FILTER_UNDEFINED;
+			Debug( LDAP_DEBUG_FILTER,
+			"get_ssa: illegal value for attributeType %s (%d) %s\n",
+				desc.bv_val, rc, *text );
+			ber_dupbv_x( &nvalue, &value, op->o_tmpmemctx );
+		}
 
 		switch ( tag ) {
 		case LDAP_SUBSTRING_INITIAL:
@@ -477,6 +495,7 @@ return_error:
 			return rc;
 		}
 
+		*text = NULL;
 		rc = LDAP_SUCCESS;
 	}
 
@@ -490,7 +509,7 @@ return_error:
 }
 
 void
-filter_free_x( Operation *op, Filter *f )
+filter_free_x( Operation *op, Filter *f, int freeme )
 {
 	Filter	*p, *next;
 
@@ -529,7 +548,7 @@ filter_free_x( Operation *op, Filter *f
 	case LDAP_FILTER_NOT:
 		for ( p = f->f_list; p != NULL; p = next ) {
 			next = p->f_next;
-			filter_free_x( op, p );
+			filter_free_x( op, p, 1 );
 		}
 		break;
 
@@ -546,7 +565,9 @@ filter_free_x( Operation *op, Filter *f
 		break;
 	}
 
-	op->o_tmpfree( f, op->o_tmpmemctx );
+	if ( freeme ) {
+		op->o_tmpfree( f, op->o_tmpmemctx );
+	}
 }
 
 void
@@ -558,7 +579,7 @@ filter_free( Filter *f )
 	op.o_hdr = &ohdr;
 	op.o_tmpmemctx = slap_sl_context( f );
 	op.o_tmpmfuncs = &slap_sl_mfuncs;
-	filter_free_x( &op, f );
+	filter_free_x( &op, f, 1 );
 }
 
 void
@@ -566,7 +587,7 @@ filter2bv_x( Operation *op, Filter *f, s
 {
 	int		i;
 	Filter		*p;
-	struct berval	tmp;
+	struct berval	tmp, value;
 	static struct berval
 			ber_bvfalse = BER_BVC( "(?=false)" ),
 			ber_bvtrue = BER_BVC( "(?=true)" ),
@@ -605,7 +626,17 @@ filter2bv_x( Operation *op, Filter *f, s
 		sign = "~=";
 
 simple:
-		filter_escape_value_x( &f->f_av_value, &tmp, op->o_tmpmemctx );
+		value = f->f_av_value;
+		if ( f->f_av_desc->ad_type->sat_equality &&
+			!undef &&
+			( f->f_av_desc->ad_type->sat_equality->smr_usage & SLAP_MR_MUTATION_NORMALIZER ))
+		{
+			f->f_av_desc->ad_type->sat_equality->smr_normalize(
+				(SLAP_MR_DENORMALIZE|SLAP_MR_VALUE_OF_ASSERTION_SYNTAX),
+				NULL, NULL, &f->f_av_value, &value, op->o_tmpmemctx );
+		}
+
+		filter_escape_value_x( &value, &tmp, op->o_tmpmemctx );
 		/* NOTE: tmp can legitimately be NULL (meaning empty) 
 		 * since in a Filter values in AVAs are supposed
 		 * to have been normalized, meaning that an empty value
@@ -621,6 +652,10 @@ simple:
 			f->f_av_desc->ad_cname.bv_val, sign,
 			tmp.bv_len ? tmp.bv_val : "" );
 
+		if ( value.bv_val != f->f_av_value.bv_val ) {
+			ber_memfree_x( value.bv_val, op->o_tmpmemctx );
+		}
+
 		ber_memfree_x( tmp.bv_val, op->o_tmpmemctx );
 		break;