What is wrong with this LDAP filter packet? -

i trying port program queries ldap server perl go, , go version receiving response filter malformed:

00000057: ldaperr: dsid-0c0c0968, comment: server unable decode search request filter, data 0, v1db1\x00

i have used tcpdump capture data transmitted server both perl , go versions of program, , have found sending different filter packets. question not possible bugs in go program, understanding contents of ldap filter packets.

the encoded filter is:

(objectclass=*) 

and perl-generated packet (which server likes) looks this:

ascii   .  .  o  b  j  e  c  t  c  l   s  s hex    87 0b 6f 62 6a 65 63 74 43 6c 61 73 73 byte#   0  1  2  3  4  5  6  7  8  9 10 11 12 

the go-generated packet (which server doesn't like) looks this:

ascii  .  .  .  .  o  b  j  e  c  t  c  l   s  s hex   a7 0d 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 byte#  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 

this own breakdown of packets:

• byte 0: tag

  when dissect byte 0 both packets, see identical, except primitive/constructed bit, set primitive in perl version, , constructed in go version. see der encoding details.

  bit# 87 6 54321 perl 10 0 00111 go   10 1 00111 

  • bits 87: in both packets, 10 = context specific
  • bit 6: in perl version 0 = primitive, in go version 1 = constructed
  • bits 54321: 00111 = 7 = object descriptor

• byte 1: length

  11 bytes perl version, 13 go version

• bytes 2-3 go version

  • byte 2: tag 04: substring filter (see section 4.5.1 of rfc 4511)
  • byte 3: length of 11 bytes

• remainder: payload

  for both packets ascii text objectclass

my reading of rfc 4511 section 4.5.1 suggests go version "more" correct, yet perl version 1 works server. gives?

wireshark able parse both packets, , interprets them both equally.

the perl version correct, , go version incorrect.

as point out, rfc 4511 section 4.5.1 specifies encoding filter elements, like:

    filter ::= choice {          ,             [0] set size (1..max) of filter filter,          or              [1] set size (1..max) of filter filter,          not             [2] filter,          equalitymatch   [3] attributevalueassertion,          substrings      [4] substringfilter,          greaterorequal  [5] attributevalueassertion,          lessorequal     [6] attributevalueassertion,          present         [7] attributedescription,          approxmatch     [8] attributevalueassertion,          extensiblematch [9] matchingruleassertion,          ...  } 

and in case, relevant portion is:

         present         [7] attributedescription, 

the attributedescription element defined in section 4.1.4 of same specification:

    attributedescription ::= ldapstring                             -- constrained <attributedescription>                             -- [rfc4512] 

and section 4.1.2:

    ldapstring ::= octet string -- utf-8 encoded,                                 -- [iso10646] characters 

so means present filter component octet string, primitive element. go incorrectly converting constructed element, , directory server correctly rejecting malformed request.