Ticket #47585 Replication Failures related to skipped entries due to cleaned rids

https://fedorahosted.org/389/ticket/47585
Reviewed by: nhosoi (Thanks!)
Branch: 389-ds-base-1.3.1
Fix Description: If a change was found in the changelog buffer that is
skipped due to having an unknown replica ID (rid), the entire buffer was
marked as CLC_STATE_NEW_RID.  When the buffer is exhausted and the iterator
code goes to read in the new buffer, it would not read in the new buffer
because it only loads a new buffer if the current buffer state is
CLC_STATE_READY.  I don't know why the entire buffer would be marked as
CLC_STATE_NEW_RID and stop iteration.  It seems to me that just the update
should be skipped, but new buffers should be loaded in order to keep sending
non-skipped updates to the consumer.
It is possible for a CSN with an unknown RID to get into the changelog if
the server with that RID had been removed by cleanruv/cleanallruv.  In that
case, the CSN should be skipped.  It is assumed that the change was already
sent - cleanallruv is supposed to wait until all known changes have been
seen before removing the RID from the RUV - so it is safe to skip it.
Added additional debugging, so that we can better tell why changelog entries
were skipped.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit cf08f1274404e4796966011a98a6a0acbbfd6070)
(cherry picked from commit 30bb98fb693ea1aac9774bdc43b923eacd72570a)
Revert "Ticket #47559 hung server - related to sasl and initialize"

This reverts commit 8a7ee90d6a770f1732bcd03b20471de3a6162b2b.
Ticket 47597 - Convert retro changelog plug-in to betxn

Retro cl plugin is already betxn aware.  The template and 20betxn.pl script
needed to be updated to reflect the new default.

https://fedorahosted.org/389/ticket/47597

Reviewed by: richm(Thanks!)
(cherry picked from commit 3dca85ec629be641f07ae2ecfef59609d4dc88e2)
Ticket 47598 - Convert ldbm_back_seq code to be transaction aware

Description: Attempt to retrieve the transaction,  and pass it to the db
             functions, and id2entry.  Also did a little code cleanup.

https://fedorahosted.org/389/ticket/47598

Reviewed by: richm(Thanks!)
(cherry picked from commit 50272119bbff52c5d9b6ce5d7302aef763aa96ec)
Ticket #47596 attrcrypt fails to find unlocked key

https://fedorahosted.org/389/ticket/47596
Reviewed by: nkinder (Thanks!)
Branch: 389-ds-base-1.3.1
Fix Description: There should always be a pre-authenticated slot/token that
has the servers cert and key.  Just loop through all of the slots that the
server's cert is found on, and use the first one that is authenticated.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit b1fad4e35c0f963bf4678a2ed9a068dbe4fb159c)
(cherry picked from commit cf091de4ae70ad8d683ff33c57e75e58ff900502)
Ticket 47599 - Reduce lock scope in retro changelog plug-in

Description:  Change the "changenumber" type to PRUint64. All changes to the static
              changenumbers are now atomic by use of slapi_counters.

              We still need to do the locking in retrocl_po.c as we need to
              serialize the actual updates.

https://fedorahosted.org/389/ticket/47599

Reviewed by: richm(Thanks!!)
(cherry picked from commit d708fb290cf5d9be5efe6fd1096f63014ed265d3)
Revert "Ticket 47599 - Reduce lock scope in retro changelog plug-in"

Wrong branch was pushed.

This reverts commit ded326633caca3de7092d678a521bf48d568e6f9.
Ticket 47599 - Reduce lock scope in retro changelog plug-in

Description:  Use RW locks for protecting the change numbers.

              We still need to do the locking in retrocl_po.c as we need to
              serialize the actual updates.

https://fedorahosted.org/389/ticket/47599

Reviewed by: richm(Thanks!!)
(cherry picked from commit e2c42bced86bac235ac56ae98eed303f61ebd15e)
Ticket #47605 CVE-2013-4485: DoS due to improper handling of ger attr searches

https://fedorahosted.org/389/ticket/47605
Reviewed by: nhosoi (Thanks!)
Branch: 389-ds-base-1.3.1
Fix Description: The traversal of the attr list looking for GER objectclasses
was modifying the same attribute twice, removing the "@" from it.  The second
time, since there was no "@" in the string, the strchr would return NULL, and
the code would not check for it.
The code was simplified and rewritten to use charray_merge_nodup
to build the gerattrs list with unique objectclass values, which I believe was
the intention of the original code.  I also added some error checking to look
for invalid attributes like "@name" "name@" and "name@name@name".
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit 7e03702932546e74f0044d11832e7e7e395cbb36)
(cherry picked from commit 12e54af6982ab5406f4bba6a02dd0724a0415501)
bump version to 1.3.1.15
Ticket 47599 - Reduce lock scope in retro changelog plug-in

Description:  Forgot to add definition of retrocl_cn_lock

https://fedorahosted.org/389/ticket/47599

Reviewed by: richm(Thanks!!)
(cherry picked from commit b330876a1bccd93a8e906ac56a10c002c981ecfc)
(cherry picked from commit f4d5900579c773e5cf4b69eaeba6104078512ab0)
bump version to 1.3.1.16
Ticket #47596 attrcrypt fails to find unlocked key

https://fedorahosted.org/389/ticket/47596
Reviewed by: nkinder (Thanks!)
Branch: 389-ds-base-1.3.1
Fix Description: Additional fix to the previous fix.  As it turns out, the
function PK11_IsLoggedIn() only returns true if the slot has been unlocked
with a pin or password.  If the slot does not need a login at all, because
the cert/key db has no password, PK11_IsLoggedIn will return false.  The code
must check for PK11_NeedLogin too.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit e66c4cecc47eff659a72a51c1e1722fb41c1dfbc)
(cherry picked from commit f608a943745e51fe4b5dbfb18bada2e2d13e0d6a)
Ticket 47591 - entries with empty objectclass attribute value can be hidden

Bug Description:   The problem is that for the empty value

	objectClass;vdcsn-5283b8e0000000c80000;deleted

	it is compared to "ldapsubentry" and "nstombstone"

	'if (PL_strncasecmp(type.bv_val,"tombstone",0)'

	and with length 0, this is always true.

Fix Description:   add a check bv_len >= strlen(valuetocompare)
			or	bv_len == strlen(valuetocompare)
			define constants for lengths

https://fedorahosted.org/389/ticket/47591

Reviewed by: richm, thanks
Ticket 47592 - automember plugin task memory leaks

The search pblock was not destroyed at the end of the export and rebuild
tasks.

https://fedorahosted.org/389/ticket/47592

Reviewed by: richm(Thanks!)
(cherry picked from commit 085c6d494f90231f2e572a668ab601c321bffb01)
Ticket 47613 - Impossible to configure nsslapd-allowed-sasl-mechanisms

Bug Description:  The design doc sasy you can use comma separated list of supported mechanisms,
                  but in fact this was not supported.

Fix Description:  Allow comma separated lists.

https://fedorahosted.org/389/ticket/47613

Reviewed by: richm(Thanks!)
(cherry picked from commit 6200f6812682760cd2a54d6a3bcbb009a0dffe79)
Ticket 47614 - Possible to specify invalid SASL mechanism in nsslapd-allowed-sasl-mechanisms

Bug Description:  Invalid values could be specified in the allowed sasl mechanisms configuration
                  attribute.  These values are directly passed to the sasl library.

Fix Description:  Follow RFR 4422, only allow upto 20 characters that are ASCII upper-case letters,
                  digits, hyphens, or underscores.

https://fedorahosted.org/389/ticket/47614

Reviewed by: richm(Thanks!)
(cherry picked from commit 7e8a5fc7183f7c08212bfb746ea8c5ceedee0132)
Ticket 47587 - hard coded limit of 64 masters in agreement and changelog code

Bug Description:  Need to remove hardcoded limit of 64 masters.

Fix Description:  Changed the default limit to 256, and then we resize the array
                  as needed.

https://fedorahosted.org/389/ticket/47587

Reviewed by: richm & tbordaz(Thanks!!)
(cherry picked from commit bae797c94207d15025e763cfea0634f42eeb1210)
Ticket #342 - better error message when cache overflows (phase 2)

Description: commit 892bf12c1bb8b10afea3d6ff711059bf04e362cc only
logs detailed cache overflow message on the allow ACIs. This patch
logs the same message when the cache overflow occurs on the deny
ACIs.

https://fedorahosted.org/389/ticket/342

Reviewed by rmeggins (Thank you, Rich!!)
(cherry picked from commit 24d1817f75daad3b45f13e38935c14d0b55c9af9)
(cherry picked from commit 3c6e0d06aa648d40577d321c1d52b604b27530cf)
Ticket 47620 - 389-ds rejects nsds5ReplicaProtocolTimeout attribute

Bug Description:  Attempting to add/modify/delete nsds5ReplicaProtocolTimeout
                  results in an error 53 (unwilling to perform).

Fix Description:  Allow nsds5ReplicaProtocolTimeout to be updated in agreements
                  and the replica configuration.  Also, made the config timeout
                  setting dynamic.

https://fedorahosted.org/389/ticket/47620

Reviewed by: rmeggins(Thanks!)
(cherry picked from commit 58fca2c4e4f2120cb6e5fb249008be8f551e944c)