Add general extensible matching support and integerBitAndMatch

and integerBitOrMatch enhancement (ITS#1302 + minor changes)
from Luke Howard <lukeh@padl.com>.

servers/slapd/filterentry.c

@@ -15,6 +15,8 @@
 
 #include "slap.h"
 
+#define SLAPD_EXT_FILTERS 1
+
 static int	test_filter_and( Backend *be,
 	Connection *conn, Operation *op,
 	Entry *e, Filter *flist );
@@ -220,6 +222,58 @@ test_filter(
 	return( rc );
 }
 
+static int test_mra_filter(
+	Backend *be,
+	Connection *conn,
+	Operation *op,
+	Entry *e,
+	MatchingRuleAssertion *mra )
+{
+	int		i;
+	Attribute	*a;
+
+	if( !access_allowed( be, conn, op, e,
+		mra->ma_desc, mra->ma_value, ACL_SEARCH ) )
+	{
+		return LDAP_INSUFFICIENT_ACCESS;
+	}
+
+	if( strcmp(mra->ma_rule->smr_syntax->ssyn_oid,
+		mra->ma_desc->ad_type->sat_syntax->ssyn_oid) != 0)
+	{
+		return LDAP_INVALID_SYNTAX;
+	}
+
+	if( mra->ma_rule == NULL )
+	{
+		return LDAP_INAPPROPRIATE_MATCHING;
+	}
+
+	for(a = attrs_find( e->e_attrs, mra->ma_desc );
+		a != NULL;
+		a = attrs_find( a->a_next, mra->ma_desc ) )
+	{
+		for ( i = 0; a->a_vals[i] != NULL; i++ ) {
+			int ret;
+			int rc;
+			const char *text;
+
+			rc = value_match( &ret, a->a_desc, mra->ma_rule, 0,
+				a->a_vals[i], mra->ma_value,
+				&text );
+
+			if( rc != LDAP_SUCCESS ) {
+				return rc;
+			}
+
+			if ( ret ) {
+				return LDAP_COMPARE_TRUE;
+			}
+		}
+	}
+
+	return LDAP_COMPARE_FALSE;
+}
 
 static int
 test_ava_filter(

servers/slapd/schema_init.c

@@ -10,6 +10,7 @@
 #include <stdio.h>
 
 #include <ac/ctype.h>
+#include <ac/errno.h>
 #include <ac/string.h>
 #include <ac/socket.h>
 
@@ -3222,6 +3223,54 @@ objectIdentifierFirstComponentMatch(
 	return rc;
 }
 
+static int
+integerBitAndMatch(
+	int *matchp,
+	slap_mask_t flags,
+	Syntax *syntax,
+	MatchingRule *mr,
+	struct berval *value,
+	void *assertedValue )
+{
+	long lValue, lAssertedValue;
+
+	/* safe to assume integers are NUL terminated? */
+	lValue = strtoul(value->bv_val, NULL, 10);
+	if(( lValue == LONG_MIN || lValue == LONG_MAX) && errno == ERANGE )
+		return LDAP_CONSTRAINT_VIOLATION;
+
+	lAssertedValue = strtol(((struct berval *)assertedValue)->bv_val, NULL, 10);
+	if(( lAssertedValue == LONG_MIN || lAssertedValue == LONG_MAX) && errno == ERANGE )
+		return LDAP_CONSTRAINT_VIOLATION;
+
+	*matchp = (lValue & lAssertedValue);
+	return LDAP_SUCCESS;
+}
+
+static int
+integerBitOrMatch(
+	int *matchp,
+	slap_mask_t flags,
+	Syntax *syntax,
+	MatchingRule *mr,
+	struct berval *value,
+	void *assertedValue )
+{
+	long lValue, lAssertedValue;
+
+	/* safe to assume integers are NUL terminated? */
+	lValue = strtoul(value->bv_val, NULL, 10);
+	if(( lValue == LONG_MIN || lValue == LONG_MAX) && errno == ERANGE )
+		return LDAP_CONSTRAINT_VIOLATION;
+
+	lAssertedValue = strtol(((struct berval *)assertedValue)->bv_val, NULL, 10);
+	if(( lAssertedValue == LONG_MIN || lAssertedValue == LONG_MAX) && errno == ERANGE )
+		return LDAP_CONSTRAINT_VIOLATION;
+
+	*matchp = (lValue | lAssertedValue);
+	return LDAP_SUCCESS;
+}
+
 static int
 check_time_syntax (struct berval *val,
 	int start,
@@ -4010,6 +4059,20 @@ struct mrule_defs_rec mrule_defs[] = {
 		OpenLDAPaciMatch, NULL, NULL,
 		NULL},
 
+	{"( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' "
+		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )",
+		SLAP_MR_EXT,
+		NULL, NULL,
+		integerBitAndMatch, NULL, NULL,
+		NULL},
+
+	{"( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' "
+		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )",
+		SLAP_MR_EXT,
+		NULL, NULL,
+		integerBitOrMatch, NULL, NULL,
+		NULL},
+
 	{NULL, SLAP_MR_NONE, NULL, NULL, NULL, NULL}
 };