1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * Copyright 2001-2002 Sun Microsystems, Inc. All rights reserved.
3*0Sstevel@tonic-gate * Use is subject to license terms.
4*0Sstevel@tonic-gate */
5*0Sstevel@tonic-gate
6*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
7*0Sstevel@tonic-gate
8*0Sstevel@tonic-gate
9*0Sstevel@tonic-gate /*
10*0Sstevel@tonic-gate * The contents of this file are subject to the Netscape Public
11*0Sstevel@tonic-gate * License Version 1.1 (the "License"); you may not use this file
12*0Sstevel@tonic-gate * except in compliance with the License. You may obtain a copy of
13*0Sstevel@tonic-gate * the License at http://www.mozilla.org/NPL/
14*0Sstevel@tonic-gate *
15*0Sstevel@tonic-gate * Software distributed under the License is distributed on an "AS
16*0Sstevel@tonic-gate * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
17*0Sstevel@tonic-gate * implied. See the License for the specific language governing
18*0Sstevel@tonic-gate * rights and limitations under the License.
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * The Original Code is Mozilla Communicator client code, released
21*0Sstevel@tonic-gate * March 31, 1998.
22*0Sstevel@tonic-gate *
23*0Sstevel@tonic-gate * The Initial Developer of the Original Code is Netscape
24*0Sstevel@tonic-gate * Communications Corporation. Portions created by Netscape are
25*0Sstevel@tonic-gate * Copyright (C) 1998-1999 Netscape Communications Corporation. All
26*0Sstevel@tonic-gate * Rights Reserved.
27*0Sstevel@tonic-gate *
28*0Sstevel@tonic-gate * Contributor(s):
29*0Sstevel@tonic-gate */
30*0Sstevel@tonic-gate /*
31*0Sstevel@tonic-gate * Copyright (c) 1990 Regents of the University of Michigan.
32*0Sstevel@tonic-gate * All rights reserved.
33*0Sstevel@tonic-gate */
34*0Sstevel@tonic-gate /*
35*0Sstevel@tonic-gate * search.c
36*0Sstevel@tonic-gate */
37*0Sstevel@tonic-gate
38*0Sstevel@tonic-gate #if 0
39*0Sstevel@tonic-gate #ifndef lint
40*0Sstevel@tonic-gate static char copyright[] = "@(#) Copyright (c) 1990 Regents of the University of Michigan.\nAll rights reserved.\n";
41*0Sstevel@tonic-gate #endif
42*0Sstevel@tonic-gate #endif
43*0Sstevel@tonic-gate
44*0Sstevel@tonic-gate #include "ldap-int.h"
45*0Sstevel@tonic-gate
46*0Sstevel@tonic-gate static int nsldapi_timeval2ldaplimit( struct timeval *timeoutp,
47*0Sstevel@tonic-gate int defaultvalue );
48*0Sstevel@tonic-gate static int nsldapi_search( LDAP *ld, const char *base, int scope,
49*0Sstevel@tonic-gate const char *filter, char **attrs, int attrsonly,
50*0Sstevel@tonic-gate LDAPControl **serverctrls, LDAPControl **clientctrls,
51*0Sstevel@tonic-gate int timelimit, int sizelimit, int *msgidp );
52*0Sstevel@tonic-gate static char *find_right_paren( char *s );
53*0Sstevel@tonic-gate static char *put_complex_filter( BerElement *ber, char *str,
54*0Sstevel@tonic-gate ber_tag_t tag, int not );
55*0Sstevel@tonic-gate static int unescape_filterval( char *str );
56*0Sstevel@tonic-gate static int hexchar2int( char c );
57*0Sstevel@tonic-gate static int is_valid_attr( char *a );
58*0Sstevel@tonic-gate static int put_simple_filter( BerElement *ber, char *str );
59*0Sstevel@tonic-gate static int put_substring_filter( BerElement *ber, char *type,
60*0Sstevel@tonic-gate char *str );
61*0Sstevel@tonic-gate static int put_filter_list( BerElement *ber, char *str );
62*0Sstevel@tonic-gate static int nsldapi_search_s( LDAP *ld, const char *base, int scope,
63*0Sstevel@tonic-gate const char *filter, char **attrs, int attrsonly,
64*0Sstevel@tonic-gate LDAPControl **serverctrls, LDAPControl **clientctrls,
65*0Sstevel@tonic-gate struct timeval *localtimeoutp, int timelimit, int sizelimit,
66*0Sstevel@tonic-gate LDAPMessage **res );
67*0Sstevel@tonic-gate
68*0Sstevel@tonic-gate /*
69*0Sstevel@tonic-gate * ldap_search - initiate an ldap search operation. Parameters:
70*0Sstevel@tonic-gate *
71*0Sstevel@tonic-gate * ld LDAP descriptor
72*0Sstevel@tonic-gate * base DN of the base object
73*0Sstevel@tonic-gate * scope the search scope - one of LDAP_SCOPE_BASE,
74*0Sstevel@tonic-gate * LDAP_SCOPE_ONELEVEL, LDAP_SCOPE_SUBTREE
75*0Sstevel@tonic-gate * filter a string containing the search filter
76*0Sstevel@tonic-gate * (e.g., "(|(cn=bob)(sn=bob))")
77*0Sstevel@tonic-gate * attrs list of attribute types to return for matches
78*0Sstevel@tonic-gate * attrsonly 1 => attributes only 0 => attributes and values
79*0Sstevel@tonic-gate *
80*0Sstevel@tonic-gate * Example:
81*0Sstevel@tonic-gate * char *attrs[] = { "mail", "title", 0 };
82*0Sstevel@tonic-gate * msgid = ldap_search( ld, "c=us@o=UM", LDAP_SCOPE_SUBTREE, "cn~=bob",
83*0Sstevel@tonic-gate * attrs, attrsonly );
84*0Sstevel@tonic-gate */
85*0Sstevel@tonic-gate int
86*0Sstevel@tonic-gate LDAP_CALL
ldap_search(LDAP * ld,const char * base,int scope,const char * filter,char ** attrs,int attrsonly)87*0Sstevel@tonic-gate ldap_search(
88*0Sstevel@tonic-gate LDAP *ld,
89*0Sstevel@tonic-gate const char *base,
90*0Sstevel@tonic-gate int scope,
91*0Sstevel@tonic-gate const char *filter,
92*0Sstevel@tonic-gate char **attrs,
93*0Sstevel@tonic-gate int attrsonly
94*0Sstevel@tonic-gate )
95*0Sstevel@tonic-gate {
96*0Sstevel@tonic-gate int msgid;
97*0Sstevel@tonic-gate
98*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "ldap_search\n", 0, 0, 0 );
99*0Sstevel@tonic-gate
100*0Sstevel@tonic-gate if ( ldap_search_ext( ld, base, scope, filter, attrs, attrsonly, NULL,
101*0Sstevel@tonic-gate NULL, NULL, -1, &msgid ) == LDAP_SUCCESS ) {
102*0Sstevel@tonic-gate return( msgid );
103*0Sstevel@tonic-gate } else {
104*0Sstevel@tonic-gate return( -1 ); /* error is in ld handle */
105*0Sstevel@tonic-gate }
106*0Sstevel@tonic-gate }
107*0Sstevel@tonic-gate
108*0Sstevel@tonic-gate
109*0Sstevel@tonic-gate /*
110*0Sstevel@tonic-gate * LDAPv3 extended search.
111*0Sstevel@tonic-gate * Returns an LDAP error code.
112*0Sstevel@tonic-gate */
113*0Sstevel@tonic-gate int
114*0Sstevel@tonic-gate LDAP_CALL
ldap_search_ext(LDAP * ld,const char * base,int scope,const char * filter,char ** attrs,int attrsonly,LDAPControl ** serverctrls,LDAPControl ** clientctrls,struct timeval * timeoutp,int sizelimit,int * msgidp)115*0Sstevel@tonic-gate ldap_search_ext(
116*0Sstevel@tonic-gate LDAP *ld,
117*0Sstevel@tonic-gate const char *base,
118*0Sstevel@tonic-gate int scope,
119*0Sstevel@tonic-gate const char *filter,
120*0Sstevel@tonic-gate char **attrs,
121*0Sstevel@tonic-gate int attrsonly,
122*0Sstevel@tonic-gate LDAPControl **serverctrls,
123*0Sstevel@tonic-gate LDAPControl **clientctrls,
124*0Sstevel@tonic-gate struct timeval *timeoutp, /* NULL means use ld->ld_timelimit */
125*0Sstevel@tonic-gate int sizelimit,
126*0Sstevel@tonic-gate int *msgidp
127*0Sstevel@tonic-gate )
128*0Sstevel@tonic-gate {
129*0Sstevel@tonic-gate /*
130*0Sstevel@tonic-gate * It is an error to pass in a zero'd timeval.
131*0Sstevel@tonic-gate */
132*0Sstevel@tonic-gate if ( timeoutp != NULL && timeoutp->tv_sec == 0 &&
133*0Sstevel@tonic-gate timeoutp->tv_usec == 0 ) {
134*0Sstevel@tonic-gate if ( ld != NULL ) {
135*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_PARAM_ERROR, NULL, NULL );
136*0Sstevel@tonic-gate }
137*0Sstevel@tonic-gate return( LDAP_PARAM_ERROR );
138*0Sstevel@tonic-gate }
139*0Sstevel@tonic-gate
140*0Sstevel@tonic-gate return( nsldapi_search( ld, base, scope, filter, attrs, attrsonly,
141*0Sstevel@tonic-gate serverctrls, clientctrls,
142*0Sstevel@tonic-gate nsldapi_timeval2ldaplimit( timeoutp, -1 ), sizelimit, msgidp ));
143*0Sstevel@tonic-gate }
144*0Sstevel@tonic-gate
145*0Sstevel@tonic-gate
146*0Sstevel@tonic-gate /*
147*0Sstevel@tonic-gate * Like ldap_search_ext() except an integer timelimit is passed instead of
148*0Sstevel@tonic-gate * using the overloaded struct timeval *timeoutp.
149*0Sstevel@tonic-gate */
150*0Sstevel@tonic-gate static int
nsldapi_search(LDAP * ld,const char * base,int scope,const char * filter,char ** attrs,int attrsonly,LDAPControl ** serverctrls,LDAPControl ** clientctrls,int timelimit,int sizelimit,int * msgidp)151*0Sstevel@tonic-gate nsldapi_search(
152*0Sstevel@tonic-gate LDAP *ld,
153*0Sstevel@tonic-gate const char *base,
154*0Sstevel@tonic-gate int scope,
155*0Sstevel@tonic-gate const char *filter,
156*0Sstevel@tonic-gate char **attrs,
157*0Sstevel@tonic-gate int attrsonly,
158*0Sstevel@tonic-gate LDAPControl **serverctrls,
159*0Sstevel@tonic-gate LDAPControl **clientctrls,
160*0Sstevel@tonic-gate int timelimit, /* -1 means use ld->ld_timelimit */
161*0Sstevel@tonic-gate int sizelimit, /* -1 means use ld->ld_sizelimit */
162*0Sstevel@tonic-gate int *msgidp
163*0Sstevel@tonic-gate )
164*0Sstevel@tonic-gate {
165*0Sstevel@tonic-gate BerElement *ber;
166*0Sstevel@tonic-gate int rc, rc_key;
167*0Sstevel@tonic-gate unsigned long key; /* XXXmcs: memcache */
168*0Sstevel@tonic-gate
169*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "ldap_search_ext\n", 0, 0, 0 );
170*0Sstevel@tonic-gate
171*0Sstevel@tonic-gate if ( !NSLDAPI_VALID_LDAP_POINTER( ld )) {
172*0Sstevel@tonic-gate return( LDAP_PARAM_ERROR );
173*0Sstevel@tonic-gate }
174*0Sstevel@tonic-gate
175*0Sstevel@tonic-gate if ( base == NULL ) {
176*0Sstevel@tonic-gate base = "";
177*0Sstevel@tonic-gate }
178*0Sstevel@tonic-gate
179*0Sstevel@tonic-gate if ( filter == NULL ) {
180*0Sstevel@tonic-gate filter = "(objectclass=*)";
181*0Sstevel@tonic-gate }
182*0Sstevel@tonic-gate
183*0Sstevel@tonic-gate if ( msgidp == NULL || ( scope != LDAP_SCOPE_BASE
184*0Sstevel@tonic-gate && scope != LDAP_SCOPE_ONELEVEL && scope != LDAP_SCOPE_SUBTREE )
185*0Sstevel@tonic-gate || ( sizelimit < -1 )) {
186*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_PARAM_ERROR, NULL, NULL );
187*0Sstevel@tonic-gate return( LDAP_PARAM_ERROR );
188*0Sstevel@tonic-gate }
189*0Sstevel@tonic-gate LDAP_MUTEX_LOCK( ld, LDAP_MSGID_LOCK );
190*0Sstevel@tonic-gate *msgidp = ++ld->ld_msgid;
191*0Sstevel@tonic-gate LDAP_MUTEX_UNLOCK( ld, LDAP_MSGID_LOCK );
192*0Sstevel@tonic-gate
193*0Sstevel@tonic-gate /*
194*0Sstevel@tonic-gate * XXXmcs: should use cache function pointers to hook in memcache
195*0Sstevel@tonic-gate */
196*0Sstevel@tonic-gate if ( ld->ld_memcache == NULL ) {
197*0Sstevel@tonic-gate rc_key = LDAP_NOT_SUPPORTED;
198*0Sstevel@tonic-gate } else if (( rc_key = ldap_memcache_createkey( ld, base, scope, filter,
199*0Sstevel@tonic-gate attrs, attrsonly, serverctrls, clientctrls, &key)) == LDAP_SUCCESS
200*0Sstevel@tonic-gate && ldap_memcache_result( ld, *msgidp, key ) == LDAP_SUCCESS ) {
201*0Sstevel@tonic-gate return LDAP_SUCCESS;
202*0Sstevel@tonic-gate }
203*0Sstevel@tonic-gate
204*0Sstevel@tonic-gate /* check the cache */
205*0Sstevel@tonic-gate if ( ld->ld_cache_on && ld->ld_cache_search != NULL ) {
206*0Sstevel@tonic-gate LDAP_MUTEX_LOCK( ld, LDAP_CACHE_LOCK );
207*0Sstevel@tonic-gate if ( (rc = (ld->ld_cache_search)( ld, *msgidp, LDAP_REQ_SEARCH,
208*0Sstevel@tonic-gate base, scope, filter, attrs, attrsonly )) != 0 ) {
209*0Sstevel@tonic-gate *msgidp = rc;
210*0Sstevel@tonic-gate LDAP_MUTEX_UNLOCK( ld, LDAP_CACHE_LOCK );
211*0Sstevel@tonic-gate return( LDAP_SUCCESS );
212*0Sstevel@tonic-gate }
213*0Sstevel@tonic-gate LDAP_MUTEX_UNLOCK( ld, LDAP_CACHE_LOCK );
214*0Sstevel@tonic-gate }
215*0Sstevel@tonic-gate
216*0Sstevel@tonic-gate /* caching off or did not find it in the cache - check the net */
217*0Sstevel@tonic-gate if (( rc = nsldapi_build_search_req( ld, base, scope, filter, attrs,
218*0Sstevel@tonic-gate attrsonly, serverctrls, clientctrls, timelimit, sizelimit,
219*0Sstevel@tonic-gate *msgidp, &ber )) != LDAP_SUCCESS ) {
220*0Sstevel@tonic-gate return( rc );
221*0Sstevel@tonic-gate }
222*0Sstevel@tonic-gate
223*0Sstevel@tonic-gate /* send the message */
224*0Sstevel@tonic-gate rc = nsldapi_send_initial_request( ld, *msgidp, LDAP_REQ_SEARCH,
225*0Sstevel@tonic-gate (char *) base, ber );
226*0Sstevel@tonic-gate
227*0Sstevel@tonic-gate /*
228*0Sstevel@tonic-gate * XXXmcs: should use cache function pointers to hook in memcache
229*0Sstevel@tonic-gate */
230*0Sstevel@tonic-gate if ( (rc_key == LDAP_SUCCESS) && (rc >= 0) ) {
231*0Sstevel@tonic-gate ldap_memcache_new( ld, rc, key, base );
232*0Sstevel@tonic-gate }
233*0Sstevel@tonic-gate
234*0Sstevel@tonic-gate *msgidp = rc;
235*0Sstevel@tonic-gate return( rc < 0 ? LDAP_GET_LDERRNO( ld, NULL, NULL ) : LDAP_SUCCESS );
236*0Sstevel@tonic-gate }
237*0Sstevel@tonic-gate
238*0Sstevel@tonic-gate
239*0Sstevel@tonic-gate /*
240*0Sstevel@tonic-gate * Convert a non-NULL timeoutp to a value in seconds that is appropriate to
241*0Sstevel@tonic-gate * send in an LDAP search request. If timeoutp is NULL, return defaultvalue.
242*0Sstevel@tonic-gate */
243*0Sstevel@tonic-gate static int
nsldapi_timeval2ldaplimit(struct timeval * timeoutp,int defaultvalue)244*0Sstevel@tonic-gate nsldapi_timeval2ldaplimit( struct timeval *timeoutp, int defaultvalue )
245*0Sstevel@tonic-gate {
246*0Sstevel@tonic-gate int timelimit;
247*0Sstevel@tonic-gate
248*0Sstevel@tonic-gate if ( NULL == timeoutp ) {
249*0Sstevel@tonic-gate timelimit = defaultvalue;
250*0Sstevel@tonic-gate } else if ( timeoutp->tv_sec > 0 ) {
251*0Sstevel@tonic-gate timelimit = timeoutp->tv_sec;
252*0Sstevel@tonic-gate } else if ( timeoutp->tv_usec > 0 ) {
253*0Sstevel@tonic-gate timelimit = 1; /* minimum we can express in LDAP */
254*0Sstevel@tonic-gate } else {
255*0Sstevel@tonic-gate /*
256*0Sstevel@tonic-gate * both tv_sec and tv_usec are less than one (zero?) so
257*0Sstevel@tonic-gate * to maintain compatiblity with our "zero means no limit"
258*0Sstevel@tonic-gate * convention we pass no limit to the server.
259*0Sstevel@tonic-gate */
260*0Sstevel@tonic-gate timelimit = 0; /* no limit */
261*0Sstevel@tonic-gate }
262*0Sstevel@tonic-gate
263*0Sstevel@tonic-gate return( timelimit );
264*0Sstevel@tonic-gate }
265*0Sstevel@tonic-gate
266*0Sstevel@tonic-gate
267*0Sstevel@tonic-gate /* returns an LDAP error code and also sets it in ld */
268*0Sstevel@tonic-gate int
nsldapi_build_search_req(LDAP * ld,const char * base,int scope,const char * filter,char ** attrs,int attrsonly,LDAPControl ** serverctrls,LDAPControl ** clientctrls,int timelimit,int sizelimit,int msgid,BerElement ** berp)269*0Sstevel@tonic-gate nsldapi_build_search_req(
270*0Sstevel@tonic-gate LDAP *ld,
271*0Sstevel@tonic-gate const char *base,
272*0Sstevel@tonic-gate int scope,
273*0Sstevel@tonic-gate const char *filter,
274*0Sstevel@tonic-gate char **attrs,
275*0Sstevel@tonic-gate int attrsonly,
276*0Sstevel@tonic-gate LDAPControl **serverctrls,
277*0Sstevel@tonic-gate LDAPControl **clientctrls, /* not used for anything yet */
278*0Sstevel@tonic-gate int timelimit, /* if -1, ld->ld_timelimit is used */
279*0Sstevel@tonic-gate int sizelimit, /* if -1, ld->ld_sizelimit is used */
280*0Sstevel@tonic-gate int msgid,
281*0Sstevel@tonic-gate BerElement **berp
282*0Sstevel@tonic-gate )
283*0Sstevel@tonic-gate {
284*0Sstevel@tonic-gate BerElement *ber;
285*0Sstevel@tonic-gate int err;
286*0Sstevel@tonic-gate char *fdup;
287*0Sstevel@tonic-gate
288*0Sstevel@tonic-gate /*
289*0Sstevel@tonic-gate * Create the search request. It looks like this:
290*0Sstevel@tonic-gate * SearchRequest := [APPLICATION 3] SEQUENCE {
291*0Sstevel@tonic-gate * baseObject DistinguishedName,
292*0Sstevel@tonic-gate * scope ENUMERATED {
293*0Sstevel@tonic-gate * baseObject (0),
294*0Sstevel@tonic-gate * singleLevel (1),
295*0Sstevel@tonic-gate * wholeSubtree (2)
296*0Sstevel@tonic-gate * },
297*0Sstevel@tonic-gate * derefAliases ENUMERATED {
298*0Sstevel@tonic-gate * neverDerefaliases (0),
299*0Sstevel@tonic-gate * derefInSearching (1),
300*0Sstevel@tonic-gate * derefFindingBaseObj (2),
301*0Sstevel@tonic-gate * alwaysDerefAliases (3)
302*0Sstevel@tonic-gate * },
303*0Sstevel@tonic-gate * sizelimit INTEGER (0 .. 65535),
304*0Sstevel@tonic-gate * timelimit INTEGER (0 .. 65535),
305*0Sstevel@tonic-gate * attrsOnly BOOLEAN,
306*0Sstevel@tonic-gate * filter Filter,
307*0Sstevel@tonic-gate * attributes SEQUENCE OF AttributeType
308*0Sstevel@tonic-gate * }
309*0Sstevel@tonic-gate * wrapped in an ldap message.
310*0Sstevel@tonic-gate */
311*0Sstevel@tonic-gate
312*0Sstevel@tonic-gate /* create a message to send */
313*0Sstevel@tonic-gate if (( err = nsldapi_alloc_ber_with_options( ld, &ber ))
314*0Sstevel@tonic-gate != LDAP_SUCCESS ) {
315*0Sstevel@tonic-gate return( err );
316*0Sstevel@tonic-gate }
317*0Sstevel@tonic-gate
318*0Sstevel@tonic-gate if ( base == NULL ) {
319*0Sstevel@tonic-gate base = "";
320*0Sstevel@tonic-gate }
321*0Sstevel@tonic-gate
322*0Sstevel@tonic-gate if ( sizelimit == -1 ) {
323*0Sstevel@tonic-gate sizelimit = ld->ld_sizelimit;
324*0Sstevel@tonic-gate }
325*0Sstevel@tonic-gate
326*0Sstevel@tonic-gate if ( timelimit == -1 ) {
327*0Sstevel@tonic-gate timelimit = ld->ld_timelimit;
328*0Sstevel@tonic-gate }
329*0Sstevel@tonic-gate
330*0Sstevel@tonic-gate #ifdef CLDAP
331*0Sstevel@tonic-gate if ( ld->ld_sbp->sb_naddr > 0 ) {
332*0Sstevel@tonic-gate err = ber_printf( ber, "{ist{seeiib", msgid,
333*0Sstevel@tonic-gate ld->ld_cldapdn, LDAP_REQ_SEARCH, base, scope, ld->ld_deref,
334*0Sstevel@tonic-gate sizelimit, timelimit, attrsonly );
335*0Sstevel@tonic-gate } else {
336*0Sstevel@tonic-gate #endif /* CLDAP */
337*0Sstevel@tonic-gate err = ber_printf( ber, "{it{seeiib", msgid,
338*0Sstevel@tonic-gate LDAP_REQ_SEARCH, base, scope, ld->ld_deref,
339*0Sstevel@tonic-gate sizelimit, timelimit, attrsonly );
340*0Sstevel@tonic-gate #ifdef CLDAP
341*0Sstevel@tonic-gate }
342*0Sstevel@tonic-gate #endif /* CLDAP */
343*0Sstevel@tonic-gate
344*0Sstevel@tonic-gate if ( err == -1 ) {
345*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_ENCODING_ERROR, NULL, NULL );
346*0Sstevel@tonic-gate ber_free( ber, 1 );
347*0Sstevel@tonic-gate return( LDAP_ENCODING_ERROR );
348*0Sstevel@tonic-gate }
349*0Sstevel@tonic-gate
350*0Sstevel@tonic-gate fdup = nsldapi_strdup( filter );
351*0Sstevel@tonic-gate if (fdup == NULL) {
352*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_NO_MEMORY, NULL, NULL );
353*0Sstevel@tonic-gate ber_free( ber, 1 );
354*0Sstevel@tonic-gate return( LDAP_NO_MEMORY );
355*0Sstevel@tonic-gate }
356*0Sstevel@tonic-gate err = ldap_put_filter( ber, fdup );
357*0Sstevel@tonic-gate NSLDAPI_FREE( fdup );
358*0Sstevel@tonic-gate
359*0Sstevel@tonic-gate if ( err == -1 ) {
360*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_FILTER_ERROR, NULL, NULL );
361*0Sstevel@tonic-gate ber_free( ber, 1 );
362*0Sstevel@tonic-gate return( LDAP_FILTER_ERROR );
363*0Sstevel@tonic-gate }
364*0Sstevel@tonic-gate
365*0Sstevel@tonic-gate if ( ber_printf( ber, "{v}}", attrs ) == -1 ) {
366*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_ENCODING_ERROR, NULL, NULL );
367*0Sstevel@tonic-gate ber_free( ber, 1 );
368*0Sstevel@tonic-gate return( LDAP_ENCODING_ERROR );
369*0Sstevel@tonic-gate }
370*0Sstevel@tonic-gate
371*0Sstevel@tonic-gate if ( (err = nsldapi_put_controls( ld, serverctrls, 1, ber ))
372*0Sstevel@tonic-gate != LDAP_SUCCESS ) {
373*0Sstevel@tonic-gate ber_free( ber, 1 );
374*0Sstevel@tonic-gate return( err );
375*0Sstevel@tonic-gate }
376*0Sstevel@tonic-gate
377*0Sstevel@tonic-gate *berp = ber;
378*0Sstevel@tonic-gate return( LDAP_SUCCESS );
379*0Sstevel@tonic-gate }
380*0Sstevel@tonic-gate
381*0Sstevel@tonic-gate static char *
find_right_paren(char * s)382*0Sstevel@tonic-gate find_right_paren( char *s )
383*0Sstevel@tonic-gate {
384*0Sstevel@tonic-gate int balance, escape;
385*0Sstevel@tonic-gate
386*0Sstevel@tonic-gate balance = 1;
387*0Sstevel@tonic-gate escape = 0;
388*0Sstevel@tonic-gate while ( *s && balance ) {
389*0Sstevel@tonic-gate if ( escape == 0 ) {
390*0Sstevel@tonic-gate if ( *s == '(' )
391*0Sstevel@tonic-gate balance++;
392*0Sstevel@tonic-gate else if ( *s == ')' )
393*0Sstevel@tonic-gate balance--;
394*0Sstevel@tonic-gate }
395*0Sstevel@tonic-gate if ( *s == '\\' && ! escape )
396*0Sstevel@tonic-gate escape = 1;
397*0Sstevel@tonic-gate else
398*0Sstevel@tonic-gate escape = 0;
399*0Sstevel@tonic-gate if ( balance )
400*0Sstevel@tonic-gate s++;
401*0Sstevel@tonic-gate }
402*0Sstevel@tonic-gate
403*0Sstevel@tonic-gate return( *s ? s : NULL );
404*0Sstevel@tonic-gate }
405*0Sstevel@tonic-gate
406*0Sstevel@tonic-gate static char *
put_complex_filter(BerElement * ber,char * str,ber_tag_t tag,int not)407*0Sstevel@tonic-gate put_complex_filter(
408*0Sstevel@tonic-gate BerElement *ber,
409*0Sstevel@tonic-gate char *str,
410*0Sstevel@tonic-gate ber_tag_t tag,
411*0Sstevel@tonic-gate int not
412*0Sstevel@tonic-gate )
413*0Sstevel@tonic-gate {
414*0Sstevel@tonic-gate char *next;
415*0Sstevel@tonic-gate
416*0Sstevel@tonic-gate /*
417*0Sstevel@tonic-gate * We have (x(filter)...) with str sitting on
418*0Sstevel@tonic-gate * the x. We have to find the paren matching
419*0Sstevel@tonic-gate * the one before the x and put the intervening
420*0Sstevel@tonic-gate * filters by calling put_filter_list().
421*0Sstevel@tonic-gate */
422*0Sstevel@tonic-gate
423*0Sstevel@tonic-gate /* put explicit tag */
424*0Sstevel@tonic-gate if ( ber_printf( ber, "t{", tag ) == -1 )
425*0Sstevel@tonic-gate return( NULL );
426*0Sstevel@tonic-gate
427*0Sstevel@tonic-gate str++;
428*0Sstevel@tonic-gate if ( (next = find_right_paren( str )) == NULL )
429*0Sstevel@tonic-gate return( NULL );
430*0Sstevel@tonic-gate
431*0Sstevel@tonic-gate *next = '\0';
432*0Sstevel@tonic-gate if ( put_filter_list( ber, str ) == -1 )
433*0Sstevel@tonic-gate return( NULL );
434*0Sstevel@tonic-gate *next++ = ')';
435*0Sstevel@tonic-gate
436*0Sstevel@tonic-gate /* flush explicit tagged thang */
437*0Sstevel@tonic-gate if ( ber_printf( ber, "}" ) == -1 )
438*0Sstevel@tonic-gate return( NULL );
439*0Sstevel@tonic-gate
440*0Sstevel@tonic-gate return( next );
441*0Sstevel@tonic-gate }
442*0Sstevel@tonic-gate
443*0Sstevel@tonic-gate int
ldap_put_filter(BerElement * ber,char * str)444*0Sstevel@tonic-gate ldap_put_filter( BerElement *ber, char *str )
445*0Sstevel@tonic-gate {
446*0Sstevel@tonic-gate char *next;
447*0Sstevel@tonic-gate int parens, balance, escape;
448*0Sstevel@tonic-gate
449*0Sstevel@tonic-gate /*
450*0Sstevel@tonic-gate * A Filter looks like this:
451*0Sstevel@tonic-gate * Filter ::= CHOICE {
452*0Sstevel@tonic-gate * and [0] SET OF Filter,
453*0Sstevel@tonic-gate * or [1] SET OF Filter,
454*0Sstevel@tonic-gate * not [2] Filter,
455*0Sstevel@tonic-gate * equalityMatch [3] AttributeValueAssertion,
456*0Sstevel@tonic-gate * substrings [4] SubstringFilter,
457*0Sstevel@tonic-gate * greaterOrEqual [5] AttributeValueAssertion,
458*0Sstevel@tonic-gate * lessOrEqual [6] AttributeValueAssertion,
459*0Sstevel@tonic-gate * present [7] AttributeType,,
460*0Sstevel@tonic-gate * approxMatch [8] AttributeValueAssertion
461*0Sstevel@tonic-gate * }
462*0Sstevel@tonic-gate *
463*0Sstevel@tonic-gate * SubstringFilter ::= SEQUENCE {
464*0Sstevel@tonic-gate * type AttributeType,
465*0Sstevel@tonic-gate * SEQUENCE OF CHOICE {
466*0Sstevel@tonic-gate * initial [0] IA5String,
467*0Sstevel@tonic-gate * any [1] IA5String,
468*0Sstevel@tonic-gate * final [2] IA5String
469*0Sstevel@tonic-gate * }
470*0Sstevel@tonic-gate * }
471*0Sstevel@tonic-gate * Note: tags in a choice are always explicit
472*0Sstevel@tonic-gate */
473*0Sstevel@tonic-gate
474*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "put_filter \"%s\"\n", str, 0, 0 );
475*0Sstevel@tonic-gate
476*0Sstevel@tonic-gate parens = 0;
477*0Sstevel@tonic-gate while ( *str ) {
478*0Sstevel@tonic-gate switch ( *str ) {
479*0Sstevel@tonic-gate case '(':
480*0Sstevel@tonic-gate str++;
481*0Sstevel@tonic-gate parens++;
482*0Sstevel@tonic-gate switch ( *str ) {
483*0Sstevel@tonic-gate case '&':
484*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "put_filter: AND\n",
485*0Sstevel@tonic-gate 0, 0, 0 );
486*0Sstevel@tonic-gate
487*0Sstevel@tonic-gate if ( (str = put_complex_filter( ber, str,
488*0Sstevel@tonic-gate LDAP_FILTER_AND, 0 )) == NULL )
489*0Sstevel@tonic-gate return( -1 );
490*0Sstevel@tonic-gate
491*0Sstevel@tonic-gate parens--;
492*0Sstevel@tonic-gate break;
493*0Sstevel@tonic-gate
494*0Sstevel@tonic-gate case '|':
495*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "put_filter: OR\n",
496*0Sstevel@tonic-gate 0, 0, 0 );
497*0Sstevel@tonic-gate
498*0Sstevel@tonic-gate if ( (str = put_complex_filter( ber, str,
499*0Sstevel@tonic-gate LDAP_FILTER_OR, 0 )) == NULL )
500*0Sstevel@tonic-gate return( -1 );
501*0Sstevel@tonic-gate
502*0Sstevel@tonic-gate parens--;
503*0Sstevel@tonic-gate break;
504*0Sstevel@tonic-gate
505*0Sstevel@tonic-gate case '!':
506*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "put_filter: NOT\n",
507*0Sstevel@tonic-gate 0, 0, 0 );
508*0Sstevel@tonic-gate
509*0Sstevel@tonic-gate if ( (str = put_complex_filter( ber, str,
510*0Sstevel@tonic-gate LDAP_FILTER_NOT, 1 )) == NULL )
511*0Sstevel@tonic-gate return( -1 );
512*0Sstevel@tonic-gate
513*0Sstevel@tonic-gate parens--;
514*0Sstevel@tonic-gate break;
515*0Sstevel@tonic-gate
516*0Sstevel@tonic-gate default:
517*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE,
518*0Sstevel@tonic-gate "put_filter: simple\n", 0, 0, 0 );
519*0Sstevel@tonic-gate
520*0Sstevel@tonic-gate balance = 1;
521*0Sstevel@tonic-gate escape = 0;
522*0Sstevel@tonic-gate next = str;
523*0Sstevel@tonic-gate while ( *next && balance ) {
524*0Sstevel@tonic-gate if ( escape == 0 ) {
525*0Sstevel@tonic-gate if ( *next == '(' )
526*0Sstevel@tonic-gate balance++;
527*0Sstevel@tonic-gate else if ( *next == ')' )
528*0Sstevel@tonic-gate balance--;
529*0Sstevel@tonic-gate }
530*0Sstevel@tonic-gate if ( *next == '\\' && ! escape )
531*0Sstevel@tonic-gate escape = 1;
532*0Sstevel@tonic-gate else
533*0Sstevel@tonic-gate escape = 0;
534*0Sstevel@tonic-gate if ( balance )
535*0Sstevel@tonic-gate next++;
536*0Sstevel@tonic-gate }
537*0Sstevel@tonic-gate if ( balance != 0 )
538*0Sstevel@tonic-gate return( -1 );
539*0Sstevel@tonic-gate
540*0Sstevel@tonic-gate *next = '\0';
541*0Sstevel@tonic-gate if ( put_simple_filter( ber, str ) == -1 ) {
542*0Sstevel@tonic-gate return( -1 );
543*0Sstevel@tonic-gate }
544*0Sstevel@tonic-gate *next++ = ')';
545*0Sstevel@tonic-gate str = next;
546*0Sstevel@tonic-gate parens--;
547*0Sstevel@tonic-gate break;
548*0Sstevel@tonic-gate }
549*0Sstevel@tonic-gate break;
550*0Sstevel@tonic-gate
551*0Sstevel@tonic-gate case ')':
552*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "put_filter: end\n", 0, 0,
553*0Sstevel@tonic-gate 0 );
554*0Sstevel@tonic-gate if ( ber_printf( ber, "]" ) == -1 )
555*0Sstevel@tonic-gate return( -1 );
556*0Sstevel@tonic-gate str++;
557*0Sstevel@tonic-gate parens--;
558*0Sstevel@tonic-gate break;
559*0Sstevel@tonic-gate
560*0Sstevel@tonic-gate case ' ':
561*0Sstevel@tonic-gate str++;
562*0Sstevel@tonic-gate break;
563*0Sstevel@tonic-gate
564*0Sstevel@tonic-gate default: /* assume it's a simple type=value filter */
565*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "put_filter: default\n", 0, 0,
566*0Sstevel@tonic-gate 0 );
567*0Sstevel@tonic-gate next = strchr( str, '\0' );
568*0Sstevel@tonic-gate if ( put_simple_filter( ber, str ) == -1 ) {
569*0Sstevel@tonic-gate return( -1 );
570*0Sstevel@tonic-gate }
571*0Sstevel@tonic-gate str = next;
572*0Sstevel@tonic-gate break;
573*0Sstevel@tonic-gate }
574*0Sstevel@tonic-gate }
575*0Sstevel@tonic-gate
576*0Sstevel@tonic-gate return( parens ? -1 : 0 );
577*0Sstevel@tonic-gate }
578*0Sstevel@tonic-gate
579*0Sstevel@tonic-gate
580*0Sstevel@tonic-gate /*
581*0Sstevel@tonic-gate * Put a list of filters like this "(filter1)(filter2)..."
582*0Sstevel@tonic-gate */
583*0Sstevel@tonic-gate
584*0Sstevel@tonic-gate static int
put_filter_list(BerElement * ber,char * str)585*0Sstevel@tonic-gate put_filter_list( BerElement *ber, char *str )
586*0Sstevel@tonic-gate {
587*0Sstevel@tonic-gate char *next;
588*0Sstevel@tonic-gate char save;
589*0Sstevel@tonic-gate
590*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "put_filter_list \"%s\"\n", str, 0, 0 );
591*0Sstevel@tonic-gate
592*0Sstevel@tonic-gate while ( *str ) {
593*0Sstevel@tonic-gate while ( *str && isspace( *str ) )
594*0Sstevel@tonic-gate str++;
595*0Sstevel@tonic-gate if ( *str == '\0' )
596*0Sstevel@tonic-gate break;
597*0Sstevel@tonic-gate
598*0Sstevel@tonic-gate if ( (next = find_right_paren( str + 1 )) == NULL )
599*0Sstevel@tonic-gate return( -1 );
600*0Sstevel@tonic-gate save = *++next;
601*0Sstevel@tonic-gate
602*0Sstevel@tonic-gate /* now we have "(filter)" with str pointing to it */
603*0Sstevel@tonic-gate *next = '\0';
604*0Sstevel@tonic-gate if ( ldap_put_filter( ber, str ) == -1 )
605*0Sstevel@tonic-gate return( -1 );
606*0Sstevel@tonic-gate *next = save;
607*0Sstevel@tonic-gate
608*0Sstevel@tonic-gate str = next;
609*0Sstevel@tonic-gate }
610*0Sstevel@tonic-gate
611*0Sstevel@tonic-gate return( 0 );
612*0Sstevel@tonic-gate }
613*0Sstevel@tonic-gate
614*0Sstevel@tonic-gate
615*0Sstevel@tonic-gate /*
616*0Sstevel@tonic-gate * is_valid_attr - returns 1 if a is a syntactically valid left-hand side
617*0Sstevel@tonic-gate * of a filter expression, 0 otherwise. A valid string may contain only
618*0Sstevel@tonic-gate * letters, numbers, hyphens, semi-colons, colons and periods. examples:
619*0Sstevel@tonic-gate * cn
620*0Sstevel@tonic-gate * cn;lang-fr
621*0Sstevel@tonic-gate * 1.2.3.4;binary;dynamic
622*0Sstevel@tonic-gate * mail;dynamic
623*0Sstevel@tonic-gate * cn:dn:1.2.3.4
624*0Sstevel@tonic-gate *
625*0Sstevel@tonic-gate * For compatibility with older servers, we also allow underscores in
626*0Sstevel@tonic-gate * attribute types, even through they are not allowed by the LDAPv3 RFCs.
627*0Sstevel@tonic-gate */
628*0Sstevel@tonic-gate static int
is_valid_attr(char * a)629*0Sstevel@tonic-gate is_valid_attr( char *a )
630*0Sstevel@tonic-gate {
631*0Sstevel@tonic-gate for ( ; *a; a++ ) {
632*0Sstevel@tonic-gate if ( !isascii( *a ) ) {
633*0Sstevel@tonic-gate return( 0 );
634*0Sstevel@tonic-gate } else if ( !isalnum( *a ) ) {
635*0Sstevel@tonic-gate switch ( *a ) {
636*0Sstevel@tonic-gate case '-':
637*0Sstevel@tonic-gate case '.':
638*0Sstevel@tonic-gate case ';':
639*0Sstevel@tonic-gate case ':':
640*0Sstevel@tonic-gate case '_':
641*0Sstevel@tonic-gate break; /* valid */
642*0Sstevel@tonic-gate default:
643*0Sstevel@tonic-gate return( 0 );
644*0Sstevel@tonic-gate }
645*0Sstevel@tonic-gate }
646*0Sstevel@tonic-gate }
647*0Sstevel@tonic-gate
648*0Sstevel@tonic-gate return( 1 );
649*0Sstevel@tonic-gate }
650*0Sstevel@tonic-gate
651*0Sstevel@tonic-gate static char *
find_star(char * s)652*0Sstevel@tonic-gate find_star( char *s )
653*0Sstevel@tonic-gate {
654*0Sstevel@tonic-gate for ( ; *s; ++s ) {
655*0Sstevel@tonic-gate switch ( *s ) {
656*0Sstevel@tonic-gate case '*': return s;
657*0Sstevel@tonic-gate case '\\':
658*0Sstevel@tonic-gate ++s;
659*0Sstevel@tonic-gate if ( hexchar2int(s[0]) >= 0 && hexchar2int(s[1]) >= 0 ) ++s;
660*0Sstevel@tonic-gate default: break;
661*0Sstevel@tonic-gate }
662*0Sstevel@tonic-gate }
663*0Sstevel@tonic-gate return NULL;
664*0Sstevel@tonic-gate }
665*0Sstevel@tonic-gate
666*0Sstevel@tonic-gate static int
put_simple_filter(BerElement * ber,char * str)667*0Sstevel@tonic-gate put_simple_filter( BerElement *ber, char *str )
668*0Sstevel@tonic-gate {
669*0Sstevel@tonic-gate char *s, *s2, *s3, filterop;
670*0Sstevel@tonic-gate char *value;
671*0Sstevel@tonic-gate ber_uint_t ftype;
672*0Sstevel@tonic-gate int rc, len;
673*0Sstevel@tonic-gate char *oid; /* for v3 extended filter */
674*0Sstevel@tonic-gate int dnattr; /* for v3 extended filter */
675*0Sstevel@tonic-gate
676*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "put_simple_filter \"%s\"\n", str, 0, 0 );
677*0Sstevel@tonic-gate
678*0Sstevel@tonic-gate rc = -1; /* pessimistic */
679*0Sstevel@tonic-gate
680*0Sstevel@tonic-gate if (( str = nsldapi_strdup( str )) == NULL ) {
681*0Sstevel@tonic-gate return( rc );
682*0Sstevel@tonic-gate }
683*0Sstevel@tonic-gate
684*0Sstevel@tonic-gate if ( (s = strchr( str, '=' )) == NULL ) {
685*0Sstevel@tonic-gate goto free_and_return;
686*0Sstevel@tonic-gate }
687*0Sstevel@tonic-gate value = s + 1;
688*0Sstevel@tonic-gate *s-- = '\0';
689*0Sstevel@tonic-gate filterop = *s;
690*0Sstevel@tonic-gate if ( filterop == '<' || filterop == '>' || filterop == '~' ||
691*0Sstevel@tonic-gate filterop == ':' ) {
692*0Sstevel@tonic-gate *s = '\0';
693*0Sstevel@tonic-gate }
694*0Sstevel@tonic-gate
695*0Sstevel@tonic-gate if ( ! is_valid_attr( str ) ) {
696*0Sstevel@tonic-gate goto free_and_return;
697*0Sstevel@tonic-gate }
698*0Sstevel@tonic-gate
699*0Sstevel@tonic-gate switch ( filterop ) {
700*0Sstevel@tonic-gate case '<':
701*0Sstevel@tonic-gate ftype = LDAP_FILTER_LE;
702*0Sstevel@tonic-gate break;
703*0Sstevel@tonic-gate case '>':
704*0Sstevel@tonic-gate ftype = LDAP_FILTER_GE;
705*0Sstevel@tonic-gate break;
706*0Sstevel@tonic-gate case '~':
707*0Sstevel@tonic-gate ftype = LDAP_FILTER_APPROX;
708*0Sstevel@tonic-gate break;
709*0Sstevel@tonic-gate case ':': /* extended filter - v3 only */
710*0Sstevel@tonic-gate /*
711*0Sstevel@tonic-gate * extended filter looks like this:
712*0Sstevel@tonic-gate *
713*0Sstevel@tonic-gate * [type][':dn'][':'oid]':='value
714*0Sstevel@tonic-gate *
715*0Sstevel@tonic-gate * where one of type or :oid is required.
716*0Sstevel@tonic-gate *
717*0Sstevel@tonic-gate */
718*0Sstevel@tonic-gate ftype = LDAP_FILTER_EXTENDED;
719*0Sstevel@tonic-gate s2 = s3 = NULL;
720*0Sstevel@tonic-gate if ( (s2 = strrchr( str, ':' )) == NULL ) {
721*0Sstevel@tonic-gate goto free_and_return;
722*0Sstevel@tonic-gate }
723*0Sstevel@tonic-gate if ( strcasecmp( s2, ":dn" ) == 0 ) {
724*0Sstevel@tonic-gate oid = NULL;
725*0Sstevel@tonic-gate dnattr = 1;
726*0Sstevel@tonic-gate *s2 = '\0';
727*0Sstevel@tonic-gate } else {
728*0Sstevel@tonic-gate oid = s2 + 1;
729*0Sstevel@tonic-gate dnattr = 0;
730*0Sstevel@tonic-gate *s2 = '\0';
731*0Sstevel@tonic-gate if ( (s3 = strrchr( str, ':' )) != NULL ) {
732*0Sstevel@tonic-gate if ( strcasecmp( s3, ":dn" ) == 0 ) {
733*0Sstevel@tonic-gate dnattr = 1;
734*0Sstevel@tonic-gate } else {
735*0Sstevel@tonic-gate goto free_and_return;
736*0Sstevel@tonic-gate }
737*0Sstevel@tonic-gate *s3 = '\0';
738*0Sstevel@tonic-gate }
739*0Sstevel@tonic-gate }
740*0Sstevel@tonic-gate if ( (rc = ber_printf( ber, "t{", ftype )) == -1 ) {
741*0Sstevel@tonic-gate goto free_and_return;
742*0Sstevel@tonic-gate }
743*0Sstevel@tonic-gate if ( oid != NULL ) {
744*0Sstevel@tonic-gate if ( (rc = ber_printf( ber, "ts", LDAP_TAG_MRA_OID,
745*0Sstevel@tonic-gate oid )) == -1 ) {
746*0Sstevel@tonic-gate goto free_and_return;
747*0Sstevel@tonic-gate }
748*0Sstevel@tonic-gate }
749*0Sstevel@tonic-gate if ( *str != '\0' ) {
750*0Sstevel@tonic-gate if ( (rc = ber_printf( ber, "ts",
751*0Sstevel@tonic-gate LDAP_TAG_MRA_TYPE, str )) == -1 ) {
752*0Sstevel@tonic-gate goto free_and_return;
753*0Sstevel@tonic-gate }
754*0Sstevel@tonic-gate }
755*0Sstevel@tonic-gate if (( len = unescape_filterval( value )) < 0 ||
756*0Sstevel@tonic-gate ( rc = ber_printf( ber, "totb}", LDAP_TAG_MRA_VALUE,
757*0Sstevel@tonic-gate value, len, LDAP_TAG_MRA_DNATTRS, dnattr )) == -1 ) {
758*0Sstevel@tonic-gate goto free_and_return;
759*0Sstevel@tonic-gate }
760*0Sstevel@tonic-gate rc = 0;
761*0Sstevel@tonic-gate goto free_and_return;
762*0Sstevel@tonic-gate /* break; */
763*0Sstevel@tonic-gate default:
764*0Sstevel@tonic-gate if ( find_star( value ) == NULL ) {
765*0Sstevel@tonic-gate ftype = LDAP_FILTER_EQUALITY;
766*0Sstevel@tonic-gate } else if ( strcmp( value, "*" ) == 0 ) {
767*0Sstevel@tonic-gate ftype = LDAP_FILTER_PRESENT;
768*0Sstevel@tonic-gate } else {
769*0Sstevel@tonic-gate rc = put_substring_filter( ber, str, value );
770*0Sstevel@tonic-gate goto free_and_return;
771*0Sstevel@tonic-gate }
772*0Sstevel@tonic-gate break;
773*0Sstevel@tonic-gate }
774*0Sstevel@tonic-gate
775*0Sstevel@tonic-gate if ( ftype == LDAP_FILTER_PRESENT ) {
776*0Sstevel@tonic-gate rc = ber_printf( ber, "ts", ftype, str );
777*0Sstevel@tonic-gate } else if (( len = unescape_filterval( value )) >= 0 ) {
778*0Sstevel@tonic-gate rc = ber_printf( ber, "t{so}", ftype, str, value, len );
779*0Sstevel@tonic-gate }
780*0Sstevel@tonic-gate if ( rc != -1 ) {
781*0Sstevel@tonic-gate rc = 0;
782*0Sstevel@tonic-gate }
783*0Sstevel@tonic-gate
784*0Sstevel@tonic-gate free_and_return:
785*0Sstevel@tonic-gate NSLDAPI_FREE( str );
786*0Sstevel@tonic-gate return( rc );
787*0Sstevel@tonic-gate }
788*0Sstevel@tonic-gate
789*0Sstevel@tonic-gate
790*0Sstevel@tonic-gate /*
791*0Sstevel@tonic-gate * Undo in place both LDAPv2 (RFC-1960) and LDAPv3 (hexadecimal) escape
792*0Sstevel@tonic-gate * sequences within the null-terminated string 'val'. The resulting value
793*0Sstevel@tonic-gate * may contain null characters.
794*0Sstevel@tonic-gate *
795*0Sstevel@tonic-gate * If 'val' contains invalid escape sequences we return -1.
796*0Sstevel@tonic-gate * Otherwise the length of the unescaped value is returned.
797*0Sstevel@tonic-gate */
798*0Sstevel@tonic-gate static int
unescape_filterval(char * val)799*0Sstevel@tonic-gate unescape_filterval( char *val )
800*0Sstevel@tonic-gate {
801*0Sstevel@tonic-gate int escape, firstdigit, ival;
802*0Sstevel@tonic-gate char *s, *d;
803*0Sstevel@tonic-gate
804*0Sstevel@tonic-gate escape = 0;
805*0Sstevel@tonic-gate for ( s = d = val; *s; s++ ) {
806*0Sstevel@tonic-gate if ( escape ) {
807*0Sstevel@tonic-gate /*
808*0Sstevel@tonic-gate * first try LDAPv3 escape (hexadecimal) sequence
809*0Sstevel@tonic-gate */
810*0Sstevel@tonic-gate if (( ival = hexchar2int( *s )) < 0 ) {
811*0Sstevel@tonic-gate if ( firstdigit ) {
812*0Sstevel@tonic-gate /*
813*0Sstevel@tonic-gate * LDAPv2 (RFC1960) escape sequence
814*0Sstevel@tonic-gate */
815*0Sstevel@tonic-gate *d++ = *s;
816*0Sstevel@tonic-gate escape = 0;
817*0Sstevel@tonic-gate } else {
818*0Sstevel@tonic-gate return(-1);
819*0Sstevel@tonic-gate }
820*0Sstevel@tonic-gate }
821*0Sstevel@tonic-gate if ( firstdigit ) {
822*0Sstevel@tonic-gate *d = ( ival<<4 );
823*0Sstevel@tonic-gate firstdigit = 0;
824*0Sstevel@tonic-gate } else {
825*0Sstevel@tonic-gate *d++ |= ival;
826*0Sstevel@tonic-gate escape = 0;
827*0Sstevel@tonic-gate }
828*0Sstevel@tonic-gate
829*0Sstevel@tonic-gate } else if ( *s != '\\' ) {
830*0Sstevel@tonic-gate *d++ = *s;
831*0Sstevel@tonic-gate escape = 0;
832*0Sstevel@tonic-gate
833*0Sstevel@tonic-gate } else {
834*0Sstevel@tonic-gate escape = 1;
835*0Sstevel@tonic-gate firstdigit = 1;
836*0Sstevel@tonic-gate }
837*0Sstevel@tonic-gate }
838*0Sstevel@tonic-gate
839*0Sstevel@tonic-gate return( d - val );
840*0Sstevel@tonic-gate }
841*0Sstevel@tonic-gate
842*0Sstevel@tonic-gate
843*0Sstevel@tonic-gate /*
844*0Sstevel@tonic-gate * convert character 'c' that represents a hexadecimal digit to an integer.
845*0Sstevel@tonic-gate * if 'c' is not a hexidecimal digit [0-9A-Fa-f], -1 is returned.
846*0Sstevel@tonic-gate * otherwise the converted value is returned.
847*0Sstevel@tonic-gate */
848*0Sstevel@tonic-gate static int
hexchar2int(char c)849*0Sstevel@tonic-gate hexchar2int( char c )
850*0Sstevel@tonic-gate {
851*0Sstevel@tonic-gate if ( c >= '0' && c <= '9' ) {
852*0Sstevel@tonic-gate return( c - '0' );
853*0Sstevel@tonic-gate }
854*0Sstevel@tonic-gate if ( c >= 'A' && c <= 'F' ) {
855*0Sstevel@tonic-gate return( c - 'A' + 10 );
856*0Sstevel@tonic-gate }
857*0Sstevel@tonic-gate if ( c >= 'a' && c <= 'f' ) {
858*0Sstevel@tonic-gate return( c - 'a' + 10 );
859*0Sstevel@tonic-gate }
860*0Sstevel@tonic-gate return( -1 );
861*0Sstevel@tonic-gate }
862*0Sstevel@tonic-gate
863*0Sstevel@tonic-gate static int
put_substring_filter(BerElement * ber,char * type,char * val)864*0Sstevel@tonic-gate put_substring_filter( BerElement *ber, char *type, char *val )
865*0Sstevel@tonic-gate {
866*0Sstevel@tonic-gate char *nextstar, gotstar = 0;
867*0Sstevel@tonic-gate ber_uint_t ftype;
868*0Sstevel@tonic-gate int len;
869*0Sstevel@tonic-gate
870*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "put_substring_filter \"%s=%s\"\n", type,
871*0Sstevel@tonic-gate val, 0 );
872*0Sstevel@tonic-gate
873*0Sstevel@tonic-gate if ( ber_printf( ber, "t{s{", LDAP_FILTER_SUBSTRINGS, type ) == -1 ) {
874*0Sstevel@tonic-gate return( -1 );
875*0Sstevel@tonic-gate }
876*0Sstevel@tonic-gate
877*0Sstevel@tonic-gate for ( ; val != NULL; val = nextstar ) {
878*0Sstevel@tonic-gate if ( (nextstar = find_star( val )) != NULL ) {
879*0Sstevel@tonic-gate *nextstar++ = '\0';
880*0Sstevel@tonic-gate }
881*0Sstevel@tonic-gate
882*0Sstevel@tonic-gate if ( gotstar == 0 ) {
883*0Sstevel@tonic-gate ftype = LDAP_SUBSTRING_INITIAL;
884*0Sstevel@tonic-gate } else if ( nextstar == NULL ) {
885*0Sstevel@tonic-gate ftype = LDAP_SUBSTRING_FINAL;
886*0Sstevel@tonic-gate } else {
887*0Sstevel@tonic-gate ftype = LDAP_SUBSTRING_ANY;
888*0Sstevel@tonic-gate }
889*0Sstevel@tonic-gate if ( *val != '\0' ) {
890*0Sstevel@tonic-gate if (( len = unescape_filterval( val )) < 0 ||
891*0Sstevel@tonic-gate ber_printf( ber, "to", ftype, val, len ) == -1 ) {
892*0Sstevel@tonic-gate return( -1 );
893*0Sstevel@tonic-gate }
894*0Sstevel@tonic-gate }
895*0Sstevel@tonic-gate
896*0Sstevel@tonic-gate gotstar = 1;
897*0Sstevel@tonic-gate }
898*0Sstevel@tonic-gate
899*0Sstevel@tonic-gate if ( ber_printf( ber, "}}" ) == -1 ) {
900*0Sstevel@tonic-gate return( -1 );
901*0Sstevel@tonic-gate }
902*0Sstevel@tonic-gate
903*0Sstevel@tonic-gate return( 0 );
904*0Sstevel@tonic-gate }
905*0Sstevel@tonic-gate
906*0Sstevel@tonic-gate int
907*0Sstevel@tonic-gate LDAP_CALL
ldap_search_st(LDAP * ld,const char * base,int scope,const char * filter,char ** attrs,int attrsonly,struct timeval * timeout,LDAPMessage ** res)908*0Sstevel@tonic-gate ldap_search_st(
909*0Sstevel@tonic-gate LDAP *ld,
910*0Sstevel@tonic-gate const char *base,
911*0Sstevel@tonic-gate int scope,
912*0Sstevel@tonic-gate const char *filter,
913*0Sstevel@tonic-gate char **attrs,
914*0Sstevel@tonic-gate int attrsonly,
915*0Sstevel@tonic-gate struct timeval *timeout,
916*0Sstevel@tonic-gate LDAPMessage **res
917*0Sstevel@tonic-gate )
918*0Sstevel@tonic-gate {
919*0Sstevel@tonic-gate return( nsldapi_search_s( ld, base, scope, filter, attrs, attrsonly,
920*0Sstevel@tonic-gate NULL, NULL, timeout, -1, -1, res ));
921*0Sstevel@tonic-gate }
922*0Sstevel@tonic-gate
923*0Sstevel@tonic-gate int
924*0Sstevel@tonic-gate LDAP_CALL
ldap_search_s(LDAP * ld,const char * base,int scope,const char * filter,char ** attrs,int attrsonly,LDAPMessage ** res)925*0Sstevel@tonic-gate ldap_search_s(
926*0Sstevel@tonic-gate LDAP *ld,
927*0Sstevel@tonic-gate const char *base,
928*0Sstevel@tonic-gate int scope,
929*0Sstevel@tonic-gate const char *filter,
930*0Sstevel@tonic-gate char **attrs,
931*0Sstevel@tonic-gate int attrsonly,
932*0Sstevel@tonic-gate LDAPMessage **res
933*0Sstevel@tonic-gate )
934*0Sstevel@tonic-gate {
935*0Sstevel@tonic-gate return( nsldapi_search_s( ld, base, scope, filter, attrs, attrsonly,
936*0Sstevel@tonic-gate NULL, NULL, NULL, -1, -1, res ));
937*0Sstevel@tonic-gate }
938*0Sstevel@tonic-gate
939*0Sstevel@tonic-gate int LDAP_CALL
ldap_search_ext_s(LDAP * ld,const char * base,int scope,const char * filter,char ** attrs,int attrsonly,LDAPControl ** serverctrls,LDAPControl ** clientctrls,struct timeval * timeoutp,int sizelimit,LDAPMessage ** res)940*0Sstevel@tonic-gate ldap_search_ext_s(
941*0Sstevel@tonic-gate LDAP *ld,
942*0Sstevel@tonic-gate const char *base,
943*0Sstevel@tonic-gate int scope,
944*0Sstevel@tonic-gate const char *filter,
945*0Sstevel@tonic-gate char **attrs,
946*0Sstevel@tonic-gate int attrsonly,
947*0Sstevel@tonic-gate LDAPControl **serverctrls,
948*0Sstevel@tonic-gate LDAPControl **clientctrls,
949*0Sstevel@tonic-gate struct timeval *timeoutp,
950*0Sstevel@tonic-gate int sizelimit,
951*0Sstevel@tonic-gate LDAPMessage **res
952*0Sstevel@tonic-gate )
953*0Sstevel@tonic-gate {
954*0Sstevel@tonic-gate return( nsldapi_search_s( ld, base, scope, filter, attrs, attrsonly,
955*0Sstevel@tonic-gate serverctrls, clientctrls, timeoutp,
956*0Sstevel@tonic-gate nsldapi_timeval2ldaplimit( timeoutp, -1 ), sizelimit, res ));
957*0Sstevel@tonic-gate }
958*0Sstevel@tonic-gate
959*0Sstevel@tonic-gate
960*0Sstevel@tonic-gate static int
nsldapi_search_s(LDAP * ld,const char * base,int scope,const char * filter,char ** attrs,int attrsonly,LDAPControl ** serverctrls,LDAPControl ** clientctrls,struct timeval * localtimeoutp,int timelimit,int sizelimit,LDAPMessage ** res)961*0Sstevel@tonic-gate nsldapi_search_s(
962*0Sstevel@tonic-gate LDAP *ld,
963*0Sstevel@tonic-gate const char *base,
964*0Sstevel@tonic-gate int scope,
965*0Sstevel@tonic-gate const char *filter,
966*0Sstevel@tonic-gate char **attrs,
967*0Sstevel@tonic-gate int attrsonly,
968*0Sstevel@tonic-gate LDAPControl **serverctrls,
969*0Sstevel@tonic-gate LDAPControl **clientctrls,
970*0Sstevel@tonic-gate struct timeval *localtimeoutp,
971*0Sstevel@tonic-gate int timelimit, /* -1 means use ld->ld_timelimit */
972*0Sstevel@tonic-gate int sizelimit, /* -1 means use ld->ld_sizelimit */
973*0Sstevel@tonic-gate LDAPMessage **res
974*0Sstevel@tonic-gate )
975*0Sstevel@tonic-gate {
976*0Sstevel@tonic-gate int err, msgid;
977*0Sstevel@tonic-gate
978*0Sstevel@tonic-gate /*
979*0Sstevel@tonic-gate * It is an error to pass in a zero'd timeval.
980*0Sstevel@tonic-gate */
981*0Sstevel@tonic-gate if ( localtimeoutp != NULL && localtimeoutp->tv_sec == 0 &&
982*0Sstevel@tonic-gate localtimeoutp->tv_usec == 0 ) {
983*0Sstevel@tonic-gate if ( ld != NULL ) {
984*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_PARAM_ERROR, NULL, NULL );
985*0Sstevel@tonic-gate }
986*0Sstevel@tonic-gate if ( res != NULL ) {
987*0Sstevel@tonic-gate *res = NULL;
988*0Sstevel@tonic-gate }
989*0Sstevel@tonic-gate return( LDAP_PARAM_ERROR );
990*0Sstevel@tonic-gate }
991*0Sstevel@tonic-gate
992*0Sstevel@tonic-gate if (( err = nsldapi_search( ld, base, scope, filter, attrs, attrsonly,
993*0Sstevel@tonic-gate serverctrls, clientctrls, timelimit, sizelimit, &msgid ))
994*0Sstevel@tonic-gate != LDAP_SUCCESS ) {
995*0Sstevel@tonic-gate if ( res != NULL ) {
996*0Sstevel@tonic-gate *res = NULL;
997*0Sstevel@tonic-gate }
998*0Sstevel@tonic-gate return( err );
999*0Sstevel@tonic-gate }
1000*0Sstevel@tonic-gate
1001*0Sstevel@tonic-gate if ( ldap_result( ld, msgid, 1, localtimeoutp, res ) == -1 ) {
1002*0Sstevel@tonic-gate /*
1003*0Sstevel@tonic-gate * Error. ldap_result() sets *res to NULL for us.
1004*0Sstevel@tonic-gate */
1005*0Sstevel@tonic-gate return( LDAP_GET_LDERRNO( ld, NULL, NULL ) );
1006*0Sstevel@tonic-gate }
1007*0Sstevel@tonic-gate
1008*0Sstevel@tonic-gate if ( LDAP_GET_LDERRNO( ld, NULL, NULL ) == LDAP_TIMEOUT ) {
1009*0Sstevel@tonic-gate (void) ldap_abandon( ld, msgid );
1010*0Sstevel@tonic-gate err = LDAP_TIMEOUT;
1011*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, err, NULL, NULL );
1012*0Sstevel@tonic-gate if ( res != NULL ) {
1013*0Sstevel@tonic-gate *res = NULL;
1014*0Sstevel@tonic-gate }
1015*0Sstevel@tonic-gate return( err );
1016*0Sstevel@tonic-gate }
1017*0Sstevel@tonic-gate
1018*0Sstevel@tonic-gate return( ldap_result2error( ld, *res, 0 ) );
1019*0Sstevel@tonic-gate }
1020