Ticket #47585 Replication Failures related to skipped entries due to cleaned rids

https://fedorahosted.org/389/ticket/47585
Reviewed by: nhosoi (Thanks!)
Branch: 389-ds-base-1.3.2
Fix Description: If a change was found in the changelog buffer that is
skipped due to having an unknown replica ID (rid), the entire buffer was
marked as CLC_STATE_NEW_RID.  When the buffer is exhausted and the iterator
code goes to read in the new buffer, it would not read in the new buffer
because it only loads a new buffer if the current buffer state is
CLC_STATE_READY.  I don't know why the entire buffer would be marked as
CLC_STATE_NEW_RID and stop iteration.  It seems to me that just the update
should be skipped, but new buffers should be loaded in order to keep sending
non-skipped updates to the consumer.
It is possible for a CSN with an unknown RID to get into the changelog if
the server with that RID had been removed by cleanruv/cleanallruv.  In that
case, the CSN should be skipped.  It is assumed that the change was already
sent - cleanallruv is supposed to wait until all known changes have been
seen before removing the RID from the RUV - so it is safe to skip it.
Added additional debugging, so that we can better tell why changelog entries
were skipped.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit cf08f1274404e4796966011a98a6a0acbbfd6070)
Revert "Ticket #47559 hung server - related to sasl and initialize"

This reverts commit 7b3b2fe9d4a7f73a12b4f2d499b2e6a2f80e454b.
Ticket 47597 - Convert retro changelog plug-in to betxn

Retro cl plugin is already betxn aware.  The template and 20betxn.pl script
needed to be updated to reflect the new default.

https://fedorahosted.org/389/ticket/47597

Reviewed by: richm(Thanks!)
(cherry picked from commit 3dca85ec629be641f07ae2ecfef59609d4dc88e2)
Ticket 47598 - Convert ldbm_back_seq code to be transaction aware

Description: Attempt to retrieve the transaction,  and pass it to the db
             functions, and id2entry.  Also did a little code cleanup.

https://fedorahosted.org/389/ticket/47598

Reviewed by: richm(Thanks!)
(cherry picked from commit 50272119bbff52c5d9b6ce5d7302aef763aa96ec)
Ticket #47596 attrcrypt fails to find unlocked key

https://fedorahosted.org/389/ticket/47596
Reviewed by: nkinder (Thanks!)
Branch: master
Fix Description: There should always be a pre-authenticated slot/token that
has the servers cert and key.  Just loop through all of the slots that the
server's cert is found on, and use the first one that is authenticated.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit b1fad4e35c0f963bf4678a2ed9a068dbe4fb159c)
Ticket 47599 - Reduce lock scope in retro changelog plug-in

Description:  Change the "changenumber" type to PRUint64. All changes to the static
              changenumbers are now atomic by use of slapi_counters.

              We still need to do the locking in retrocl_po.c as we need to
              serialize the actual updates.

https://fedorahosted.org/389/ticket/47599

Reviewed by: richm(Thanks!!)
(cherry picked from commit d708fb290cf5d9be5efe6fd1096f63014ed265d3)
Revert "Ticket 47599 - Reduce lock scope in retro changelog plug-in"

Wrong branch was pushed.

This reverts commit 66811be66f1ead1432bdbc0c540676cf8bd66985.
Ticket 47599 - Reduce lock scope in retro changelog plug-in

Description:  Use RW locks for protecting the change numbers.

              We still need to do the locking in retrocl_po.c as we need to
              serialize the actual updates.

https://fedorahosted.org/389/ticket/47599

Reviewed by: richm(Thanks!!)
(cherry picked from commit e2c42bced86bac235ac56ae98eed303f61ebd15e)
bump version to 1.3.2.4
Ticket #47605 CVE-2013-4485: DoS due to improper handling of ger attr searches

https://fedorahosted.org/389/ticket/47605
Reviewed by: nhosoi (Thanks!)
Branch: 389-ds-base-1.3.2
Fix Description: The traversal of the attr list looking for GER objectclasses
was modifying the same attribute twice, removing the "@" from it.  The second
time, since there was no "@" in the string, the strchr would return NULL, and
the code would not check for it.
The code was simplified and rewritten to use charray_merge_nodup
to build the gerattrs list with unique objectclass values, which I believe was
the intention of the original code.  I also added some error checking to look
for invalid attributes like "@name" "name@" and "name@name@name".
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit 7e03702932546e74f0044d11832e7e7e395cbb36)
bump version to 1.3.2.5
Ticket 47599 - Reduce lock scope in retro changelog plug-in

Description:  Forgot to add definition of retrocl_cn_lock

https://fedorahosted.org/389/ticket/47599

Reviewed by: richm(Thanks!!)
(cherry picked from commit b330876a1bccd93a8e906ac56a10c002c981ecfc)
bump version to 1.3.2.6
Ticket 47599 - fix memory leak

Coverity 12410

https://fedorahosted.org/389/ticket/47599

Reviewed by: richm(Thanks!)
(cherry picked from commit a16bf1b3c4ff0412c2481baace9b427750c11f8c)
Ticket 47593 - Update plugin API for OTP plugin

Description:  The upcoming OTP plugin from IPA needs a API update.  Some of the
              password scheme functions need to be available in the plugin API.

https://fedorahosted.org/389/ticket/47593

Reviewed by: richm(Thanks!)
(cherry picked from commit 6b83caf7167e74672c4b28e1958ddbcab7cfc2d8)
Bump version to 1.3.2.7
Ticket #47596 attrcrypt fails to find unlocked key

https://fedorahosted.org/389/ticket/47596
Reviewed by: nkinder (Thanks!)
Branch: 389-ds-base-1.3.2
Fix Description: Additional fix to the previous fix.  As it turns out, the
function PK11_IsLoggedIn() only returns true if the slot has been unlocked
with a pin or password.  If the slot does not need a login at all, because
the cert/key db has no password, PK11_IsLoggedIn will return false.  The code
must check for PK11_NeedLogin too.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit e66c4cecc47eff659a72a51c1e1722fb41c1dfbc)
Ticket 47591 - entries with empty objectclass attribute value can be hidden

Bug Description:   The problem is that for the empty value

	objectClass;vdcsn-5283b8e0000000c80000;deleted

	it is compared to "ldapsubentry" and "nstombstone"

	'if (PL_strncasecmp(type.bv_val,"tombstone",0)'

	and with length 0, this is always true.

Fix Description:   add a check bv_len >= strlen(valuetocompare)
			or	bv_len == strlen(valuetocompare)
			define constants for lengths

https://fedorahosted.org/389/ticket/47591

Reviewed by: richm, thanks
Ticket 47592 - automember plugin task memory leaks

The search pblock was not destroyed at the end of the export and rebuild
tasks.

https://fedorahosted.org/389/ticket/47592

Reviewed by: richm(Thanks!)
(cherry picked from commit 085c6d494f90231f2e572a668ab601c321bffb01)
Ticket 47613 - Impossible to configure nsslapd-allowed-sasl-mechanisms

Bug Description:  The design doc sasy you can use comma separated list of supported mechanisms,
                  but in fact this was not supported.

Fix Description:  Allow comma separated lists.

https://fedorahosted.org/389/ticket/47613

Reviewed by: richm(Thanks!)
(cherry picked from commit 6200f6812682760cd2a54d6a3bcbb009a0dffe79)