diff --git a/mozilla/directory/c-sdk/ldap/clients/tools/fileurl.c b/mozilla/directory/c-sdk/ldap/clients/tools/fileurl.c
index 307c0911720..2b66537b577 100644
--- a/mozilla/directory/c-sdk/ldap/clients/tools/fileurl.c
+++ b/mozilla/directory/c-sdk/ldap/clients/tools/fileurl.c
@@ -29,10 +29,12 @@
 #include "fileurl.h"
 #include <ctype.h>	/* for isalpha() */
 
-static int str_starts_with( char *s, char *prefix );
+static int str_starts_with( const char *s, char *prefix );
 static void hex_unescape( char *s );
 static int unhex( char c );
 static void strcpy_escaped_and_convert( char *s1, char *s2 );
+static int berval_from_file( const char *path, struct berval *bvp,
+	int reporterrs );
 
 /*
  * Convert a file URL to a local path.
@@ -58,9 +60,10 @@ static void strcpy_escaped_and_convert( char *s1, char *s2 );
  *
  */
 int
-ldaptool_fileurl2path( char *fileurl, char **localpathp )
+ldaptool_fileurl2path( const char *fileurl, char **localpathp )
 {
-    char	*path;
+    const char	*path;
+    char	*pathcopy;
 
     /*
      * Make sure this is a file URL we can handle.
@@ -107,10 +110,10 @@ ldaptool_fileurl2path( char *fileurl, char **localpathp )
      * Duplicate the path so we can safely alter it.
      * Unescape any %HH sequences.
      */
-    if (( path = strdup( path )) == NULL ) {
+    if (( pathcopy = strdup( path )) == NULL ) {
 	return( LDAPTOOL_FILEURL_NOMEMORY );
     }
-    hex_unescape( path );
+    hex_unescape( pathcopy );
 
 #ifdef _WINDOWS
     /*
@@ -121,19 +124,19 @@ ldaptool_fileurl2path( char *fileurl, char **localpathp )
     {
 	char	*p;
 
-	for ( p = path; *p != '\0'; ++p ) {
+	for ( p = pathcopy; *p != '\0'; ++p ) {
 	    if ( *p == '/' ) {
 		*p = '\\';
 	    }
 	}
     }
 
-    if ( isalpha( path[0] ) && path[1] == '|' ) {
-	path[1] = ':';
+    if ( isalpha( pathcopy[0] ) && pathcopy[1] == '|' ) {
+	pathcopy[1] = ':';
     }
 #endif /* _WINDOWS */
 
-    *localpathp = path;
+    *localpathp = pathcopy;
     return( LDAPTOOL_FILEURL_SUCCESS );
 }
 
@@ -196,11 +199,194 @@ ldaptool_path2fileurl( char *path, char **urlp )
 }
 
 
+/*
+ * Populate *bvp from "value" of length "vlen."
+ *
+ * If recognize_url_syntax is non-zero, :<fileurl is recognized.
+ * If always_try_file is recognized and no file URL was found, an
+ * attempt is made to stat and read the value as if it were the name
+ * of a file.
+ *
+ * If reporterrs is non-zero, specific error messages are printed to
+ * stderr.
+ *
+ * If successful, LDAPTOOL_FILEURL_SUCCESS is returned and bvp->bv_len
+ * and bvp->bv_val are set (the latter is set to malloc'd memory).
+ * Upon failure, a different LDAPTOOL_FILEURL_ error code is returned.
+ */
+int
+ldaptool_berval_from_ldif_value( const char *value, int vlen,
+	struct berval *bvp, int recognize_url_syntax, int always_try_file,
+	int reporterrs )
+{
+    int	rc = LDAPTOOL_FILEURL_SUCCESS;	/* optimistic */
+    struct stat	fstats;
+
+    /* recognize "attr :< url" syntax if LDIF version is >= 1 */
+    if ( recognize_url_syntax && *value == '<' ) {
+	const char	*url;
+	char		*path;
+
+	for ( url = value + 1; isspace( *url ); ++url ) {
+	    ;	/* NULL */
+	}
+
+	/*
+	 * We only support file:// URLs for now.
+	 */
+	rc = ldaptool_fileurl2path( url, &path );
+	switch( rc ) {
+	case LDAPTOOL_FILEURL_NOTAFILEURL:
+	    if ( reporterrs ) fprintf( stderr, "%s: unsupported URL \"%s\";"
+		" use a file:// URL instead.\n", ldaptool_progname, url );
+	    break;
+
+	case LDAPTOOL_FILEURL_MISSINGPATH:
+	    if ( reporterrs ) fprintf( stderr,
+		    "%s: unable to process URL \"%s\" --"
+		    " missing path.\n", ldaptool_progname, url );
+	    break;
+
+	case LDAPTOOL_FILEURL_NONLOCAL:
+	    if ( reporterrs ) fprintf( stderr,
+		    "%s: unable to process URL \"%s\" -- only"
+		    " local file:// URLs are supported.\n",
+		    ldaptool_progname, url );
+	    break;
+
+	case LDAPTOOL_FILEURL_NOMEMORY:
+	    if ( reporterrs ) perror( "ldaptool_fileurl2path" );
+	    break;
+
+	case LDAPTOOL_FILEURL_SUCCESS:
+	    if ( stat( path, &fstats ) != 0 ) {
+		if ( reporterrs ) perror( path );
+	    } else if ( fstats.st_mode & S_IFDIR ) {	
+		if ( reporterrs ) fprintf( stderr,
+			"%s: %s is a directory, not a file\n",
+			ldaptool_progname, path );
+		rc = LDAPTOOL_FILEURL_FILEIOERROR;
+	    } else {
+		rc = berval_from_file( path, bvp, reporterrs );
+	    }
+	    free( path );
+	    break;
+
+	default:
+	    if ( reporterrs ) fprintf( stderr,
+		    "%s: unable to process URL \"%s\""
+		    " -- unknown error\n", ldaptool_progname, url );
+	}
+
+    } else if ( always_try_file && (stat( value, &fstats ) == 0) &&
+	     !(fstats.st_mode & S_IFDIR)) {	/* get value from file */
+	rc = berval_from_file( value, bvp, reporterrs );
+    } else {
+	bvp->bv_len = vlen;
+	if (( bvp->bv_val = (char *)malloc( vlen + 1 )) == NULL ) {
+	    if ( reporterrs ) perror( "malloc" );
+	    rc = LDAPTOOL_FILEURL_NOMEMORY;
+	} else {
+	    SAFEMEMCPY( bvp->bv_val, value, vlen );
+	    bvp->bv_val[ vlen ] = '\0';
+	}
+    }
+
+    return( rc );
+}
+
+
+/*
+ * Map an LDAPTOOL_FILEURL_ error code to an LDAP error code (crude).
+ */
+int
+ldaptool_fileurlerr2ldaperr( int lderr )
+{
+    int		rc;
+
+    switch( lderr ) {
+    case LDAPTOOL_FILEURL_SUCCESS:
+	rc = LDAP_SUCCESS;
+	break;
+    case LDAPTOOL_FILEURL_NOMEMORY:
+	rc = LDAP_NO_MEMORY;
+	break;
+    default:
+	rc = LDAP_PARAM_ERROR;
+    }
+
+    return( rc );
+} 
+
+
+/*
+ * Populate *bvp with the contents of the file named by "path".
+ *
+ * If reporterrs is non-zero, specific error messages are printed to
+ * stderr.
+ *
+ * If successful, LDAPTOOL_FILEURL_SUCCESS is returned and bvp->bv_len
+ * and bvp->bv_val are set (the latter is set to malloc'd memory).
+ * Upon failure, a different LDAPTOOL_FILEURL_ error code is returned.
+ */
+
+static int
+berval_from_file( const char *path, struct berval *bvp, int reporterrs )
+{
+    FILE	*fp;
+    long	rlen;
+    int		eof;
+#if defined( XP_WIN32 )
+    char	mode[20] = "r+b";
+#else
+    char	mode[20] = "r";
+#endif
+
+    if (( fp = fopen( path, mode )) == NULL ) {
+	if ( reporterrs ) perror( path );
+	return( LDAPTOOL_FILEURL_FILEIOERROR );
+    }
+
+    if ( fseek( fp, 0L, SEEK_END ) != 0 ) {
+	if ( reporterrs ) perror( path );
+	fclose( fp );
+	return( LDAPTOOL_FILEURL_FILEIOERROR );
+    }
+
+    bvp->bv_len = ftell( fp );
+
+    if (( bvp->bv_val = (char *)malloc( bvp->bv_len + 1 )) == NULL ) {
+	if ( reporterrs ) perror( "malloc" );
+	fclose( fp );
+	return( LDAPTOOL_FILEURL_NOMEMORY );
+    }
+
+    if ( fseek( fp, 0L, SEEK_SET ) != 0 ) {
+	if ( reporterrs ) perror( path );
+	fclose( fp );
+	return( LDAPTOOL_FILEURL_FILEIOERROR );
+    }
+
+    rlen = fread( bvp->bv_val, 1, bvp->bv_len, fp );
+    eof = feof( fp );
+    fclose( fp );
+
+    if ( rlen != (long)bvp->bv_len ) {
+	if ( reporterrs ) perror( path );
+	free( bvp->bv_val );
+	return( LDAPTOOL_FILEURL_FILEIOERROR );
+    }
+
+    bvp->bv_val[ bvp->bv_len ] = '\0';
+    return( LDAPTOOL_FILEURL_SUCCESS );
+}
+
+
 /*
  * Return a non-zero value if the string s begins with prefix and zero if not.
  */
 static int
-str_starts_with( char *s, char *prefix )
+str_starts_with( const char *s, char *prefix )
 {
     size_t	prefix_len;
 
diff --git a/mozilla/directory/c-sdk/ldap/clients/tools/fileurl.h b/mozilla/directory/c-sdk/ldap/clients/tools/fileurl.h
index 1161a52a2f6..abca5605fbe 100644
--- a/mozilla/directory/c-sdk/ldap/clients/tools/fileurl.h
+++ b/mozilla/directory/c-sdk/ldap/clients/tools/fileurl.h
@@ -29,17 +29,17 @@
  * ldaptool_fileurl2path() convert a file URL to a local path.
  *
  * If successful, LDAPTOOL_FILEURL_SUCCESS is returned and *localpathp is
- * set point to an allocated string.  If not, an differnet LDAPTOOL_FILEURL_
+ * set point to an allocated string.  If not, a different LDAPTOOL_FILEURL_
  * error code is returned.
  */
-int ldaptool_fileurl2path( char *fileurl, char **localpathp );
+int ldaptool_fileurl2path( const char *fileurl, char **localpathp );
 
 
 /*
  * Convert a local path to a file URL.
  *
  * If successful, LDAPTOOL_FILEURL_SUCCESS is returned and *urlp is
- * set point to an allocated string.  If not, an different LDAPTOOL_FILEURL_
+ * set point to an allocated string.  If not, a different LDAPTOOL_FILEURL_
  * error code is returned.  At present, the only possible error is
  * LDAPTOOL_FILEURL_NOMEMORY.
  *
@@ -48,10 +48,37 @@ int ldaptool_path2fileurl( char *path, char **urlp );
 
 
 /*
- * Possible return codes for ldaptool_fileurl2path and ldaptool_path2fileurl.
+ * Populate *bvp from "value" of length "vlen."
+ *
+ * If recognize_url_syntax is non-zero, :<fileurl is recognized.
+ * If always_try_file is recognized and no file URL was found, an
+ * attempt is made to stat and read the value as if it were the name
+ * of a file.
+ *
+ * If reporterrs is non-zero, specific error messages are printed to
+ * stderr.
+ *
+ * If successful, LDAPTOOL_FILEURL_SUCCESS is returned and bvp->bv_len
+ * and bvp->bv_val are set (the latter is set to malloc'd memory).
+ * Upon failure, a different LDAPTOOL_FILEURL_ error code is returned.
+ */
+int ldaptool_berval_from_ldif_value( const char *value, int vlen,
+	struct berval *bvp, int recognize_url_syntax, int always_try_file,
+	int reporterrs );
+
+
+/*
+ * Map an LDAPTOOL_FILEURL_ error code to an LDAP error code (crude).
+ */
+int ldaptool_fileurlerr2ldaperr( int lderr );
+
+
+/*
+ * Possible return codes for the functions declared in this file:
  */
 #define LDAPTOOL_FILEURL_SUCCESS	0
 #define LDAPTOOL_FILEURL_NOTAFILEURL	1
 #define LDAPTOOL_FILEURL_MISSINGPATH	2
 #define LDAPTOOL_FILEURL_NONLOCAL	3
 #define LDAPTOOL_FILEURL_NOMEMORY	4
+#define LDAPTOOL_FILEURL_FILEIOERROR	5
diff --git a/mozilla/directory/c-sdk/ldap/clients/tools/ldapcmp.c b/mozilla/directory/c-sdk/ldap/clients/tools/ldapcmp.c
index 3b701cc44b4..00139c44d7d 100644
--- a/mozilla/directory/c-sdk/ldap/clients/tools/ldapcmp.c
+++ b/mozilla/directory/c-sdk/ldap/clients/tools/ldapcmp.c
@@ -565,13 +565,7 @@ print_entry( ld, entry, attrsonly )
 		} else {
 		    notascii = 0;
 		    if ( !ldif && !allow_binary ) {
-			unsigned long	j;
-			for ( j = 0; j < bvals[ i ]->bv_len; ++j ) {
-			    if ( !isascii( bvals[ i ]->bv_val[ j ] )) {
-				notascii = 1;
-				break;
-			    }
-			}
+			notascii = !ldaptool_berval_is_ascii( bvals[ i ] );
 		    }
 
 		    if ( ldif ) {
diff --git a/mozilla/directory/c-sdk/ldap/clients/tools/ldapmodify.c b/mozilla/directory/c-sdk/ldap/clients/tools/ldapmodify.c
index b51a45dd621..35458d76bad 100644
--- a/mozilla/directory/c-sdk/ldap/clients/tools/ldapmodify.c
+++ b/mozilla/directory/c-sdk/ldap/clients/tools/ldapmodify.c
@@ -70,7 +70,6 @@ static int dodelete( char *dn );
 static int dorename( char *dn, char *newrdn, char *newparent,
 	int deleteoldrdn );
 static void freepmods( LDAPMod **pmods );
-static int fromfile( char *path, struct berval *bv );
 static char *read_one_record( FILE *fp );
 static char *strdup_and_trim( char *s );
 
@@ -701,9 +700,8 @@ static void
 addmodifyop( LDAPMod ***pmodsp, int modop, char *attr, char *value, int vlen )
 {
     LDAPMod		**pmods;
-    int			i, j;
+    int			i, j, rc;
     struct berval	*bvp;
-	struct stat fstats;
 
     pmods = *pmodsp;
     modop |= LDAP_MOD_BVALUES;
@@ -759,83 +757,12 @@ addmodifyop( LDAPMod ***pmodsp, int modop, char *attr, char *value, int vlen )
 	}
 	pmods[ i ]->mod_bvalues[ j ] = bvp;
 
-	/* recognize "attr :< url" syntax if LDIF version is >= 1 */
-	if ( ldif_version >= LDIF_VERSION_ONE && *value == '<' ) {
-	    char	*url, *path;
-	    int		rc = LDAP_SUCCESS;
 
-	    for ( url = value + 1; isspace( *url ); ++url ) {
-		;	/* NULL */
-	    }
-
-	    /*
-	     * We only support file:// URLs for now.
-	     */
-	    switch( ldaptool_fileurl2path( url, &path )) {
-	    case LDAPTOOL_FILEURL_NOTAFILEURL:
-		fprintf( stderr, "%s: unsupported URL \"%s\";"
-		    " use a file:// URL instead.\n", ldaptool_progname, url );
-		rc = LDAP_PARAM_ERROR;
-		break;
-
-	    case LDAPTOOL_FILEURL_MISSINGPATH:
-		fprintf( stderr, "%s: unable to process URL \"%s\" --"
-			" missing path.\n", ldaptool_progname, url );
-		rc = LDAP_PARAM_ERROR;
-		break;
-
-	    case LDAPTOOL_FILEURL_NONLOCAL:
-		fprintf( stderr, "%s: unable to process URL \"%s\" -- only"
-			" local file:// URLs are supported.\n",
-			ldaptool_progname, url );
-		rc = LDAP_PARAM_ERROR;
-		break;
-
-	    case LDAPTOOL_FILEURL_NOMEMORY:
-		perror( "ldaptool_fileurl2path" );
-		rc = LDAP_NO_MEMORY;
-		break;
-
-	    case LDAPTOOL_FILEURL_SUCCESS:
-		if ( stat( path, &fstats ) != 0 ) {
-		    perror( path );
-		    rc = LDAP_LOCAL_ERROR;
-		} else if ( fstats.st_mode & S_IFDIR ) {	
-		    fprintf( stderr, "%s: %s is a directory, not a file\n",
-			    ldaptool_progname, path );
-		    rc = LDAP_LOCAL_ERROR;
-		} else if ( fromfile( path, bvp ) < 0 ) {
-		    rc = LDAP_LOCAL_ERROR;
-		}
-		free( path );
-		break;
-
-	    default:
-		fprintf( stderr, "%s: unable to process URL \"%s\""
-			" -- unknown error\n", ldaptool_progname, url );
-		rc = LDAP_LOCAL_ERROR;
-	    }
-
-
-	    if ( rc != LDAP_SUCCESS ) {
-		exit( rc );
-	    }
-
-	} else if ( valsfromfiles && 
-		 (stat( value, &fstats ) == 0) &&
-		 !(fstats.st_mode & S_IFDIR)) {	
-		/* get value from file */
-	    if ( fromfile( value, bvp ) < 0 ) {
-		exit( LDAP_LOCAL_ERROR );
-	    }
-	} else {
-	    bvp->bv_len = vlen;
-	    if (( bvp->bv_val = (char *)malloc( vlen + 1 )) == NULL ) {
-		perror( "malloc" );
-		exit( LDAP_NO_MEMORY );
-	    }
-	    SAFEMEMCPY( bvp->bv_val, value, vlen );
-	    bvp->bv_val[ vlen ] = '\0';
+	rc = ldaptool_berval_from_ldif_value( value, vlen, bvp,
+		    ( ldif_version >= LDIF_VERSION_ONE ), valsfromfiles,
+			1 /* report errors */ );
+	if ( rc != LDAPTOOL_FILEURL_SUCCESS ) {
+	    exit( ldaptool_fileurlerr2ldaperr( rc ));
 	}
     }
 }
@@ -845,7 +772,6 @@ static int
 domodify( char *dn, LDAPMod **pmods, int newentry )
 {
     int			i, j, notascii, op;
-    unsigned long	k;
     struct berval	*bvp;
 
     if ( pmods == NULL ) {
@@ -865,12 +791,7 @@ domodify( char *dn, LDAPMod **pmods, int newentry )
 		    bvp = pmods[ i ]->mod_bvalues[ j ];
 		    notascii = 0;
 		    if ( !display_binary_values ) {
-			for ( k = 0; k < bvp->bv_len; ++k ) {
-			    if ( !isascii( bvp->bv_val[ k ] )) {
-				notascii = 1;
-				break;
-			    }
-			}
+			notascii = !ldaptool_berval_is_ascii( bvp );
 		    }
 		    if ( notascii ) {
 			printf( "\tNOT ASCII (%ld bytes)\n", bvp->bv_len );
@@ -1006,58 +927,6 @@ freepmods( LDAPMod **pmods )
 }
 
 
-static int
-fromfile( char *path, struct berval *bv )
-{
-	FILE		*fp;
-	long		rlen;
-	int		eof;
-#if defined( XP_WIN32 )
-	char	mode[20] = "r+b";
-#else
-	char	mode[20] = "r";
-#endif
-
-	if (( fp = fopen( path, mode )) == NULL ) {
-	    	perror( path );
-		return( -1 );
-	}
-
-	if ( fseek( fp, 0L, SEEK_END ) != 0 ) {
-		perror( path );
-		fclose( fp );
-		return( -1 );
-	}
-
-	bv->bv_len = ftell( fp );
-
-	if (( bv->bv_val = (char *)malloc( bv->bv_len + 1 )) == NULL ) {
-		perror( "malloc" );
-		fclose( fp );
-		return( -1 );
-	}
-
-	if ( fseek( fp, 0L, SEEK_SET ) != 0 ) {
-		perror( path );
-		fclose( fp );
-		return( -1 );
-	}
-
-	rlen = fread( bv->bv_val, 1, bv->bv_len, fp );
-	eof = feof( fp );
-	fclose( fp );
-
-	if ( rlen != (long)bv->bv_len ) {
-		perror( path );
-		free( bv->bv_val );
-		return( -1 );
-	}
-
-	bv->bv_val[ bv->bv_len ] = '\0';
-	return( bv->bv_len );
-}
-
-
 static char *
 read_one_record( FILE *fp )
 {
diff --git a/mozilla/directory/c-sdk/ldap/clients/tools/ldaptool.h b/mozilla/directory/c-sdk/ldap/clients/tools/ldaptool.h
index 760a5a71159..475d14da0ac 100644
--- a/mozilla/directory/c-sdk/ldap/clients/tools/ldaptool.h
+++ b/mozilla/directory/c-sdk/ldap/clients/tools/ldaptool.h
@@ -97,6 +97,10 @@ extern "C" {
 /*
  * shared macros, structures, etc.
  */
+#define LDAPTOOL_RESULT_IS_AN_ERROR( rc ) \
+		( (rc) != LDAP_SUCCESS && (rc) != LDAP_COMPARE_TRUE \
+		&& (rc) != LDAP_COMPARE_FALSE )
+
 #define LDAPTOOL_DEFSEP		"="	/* used by ldapcmp and ldapsearch */
 #define LDAPTOOL_DEFHOST	"localhost"
 #define LDAPTOOL_DEFCERTDBPATH	"."
@@ -122,7 +126,6 @@ extern FILE		*ldaptool_fp;
 extern char		*ldaptool_charset;
 extern char		*ldaptool_convdir;
 extern LDAPControl	*ldaptool_request_ctrls[];
-extern int		pw_expiring;
 
 
 /*
@@ -146,6 +149,7 @@ void ldaptool_add_control_to_array( LDAPControl *ctrl, LDAPControl **array);
 void ldaptool_reset_control_array( LDAPControl **array );
 char *ldaptool_get_tmp_dir( void );
 char *ldaptool_local2UTF8( const char * );
+int ldaptool_berval_is_ascii( const struct berval *bvp );
 int ldaptool_sasl_bind_s( LDAP *ld, const char *dn, const char *mechanism,
         const struct berval *cred, LDAPControl **serverctrls,
         LDAPControl **clientctrls, struct berval **servercredp, char *msg );
@@ -160,6 +164,10 @@ int ldaptool_delete_ext_s( LDAP *ld, const char *dn, LDAPControl **serverctrls,
 int ldaptool_rename_s(  LDAP *ld, const char *dn, const char *newrdn,
         const char *newparent, int deleteoldrdn, LDAPControl **serverctrls,
         LDAPControl **clientctrls, char *msg );
+int ldaptool_compare_ext_s( LDAP *ld, const char *dn, const char *attrtype,
+	    const struct berval *bvalue, LDAPControl **serverctrls,
+	    LDAPControl **clientctrls, char *msg );
+int ldaptool_boolean_str2value ( const char *s );
 
 #ifdef __cplusplus
 }