Ticket 47489 - Under specific values of nsDS5ReplicaName, replication may get broken or updates missing

Bug Description:
	If the 'nsDS5ReplicaName' (of a replica), contains the database suffix (e.g. 'db', 'db3' or 'db4).
	Then replication plugin fails to open the changelog. It could conduct to changelog being recreated or some
	last updates to be corrupted.
	A consequence that I can reproduce, is that some updates may be removed from the changelog and missing
	updates on consumers.
	This could conduct to replication break, if for example an entry created is not replicated and then later updated.

Fix Description:
	The fix consist to use 'PL_strrstr' rather than 'strstr' to check the database suffix is valid

https://fedorahosted.org/389/ticket/47489

Reviewed by: Rich Megginson (thanks Rich !)

Platforms tested: Fedora 17

Flag Day: no

Doc impact: no
Ticket 449 - Allow macro aci keywords to be case-insensitive

This allows the macro aci keywords ($attr and $dn) to be
case-insensitive.  We were allowing the keywords to be set
regardless of case, but we were only processing them properly
if they were lowercase.  This patch makes the processing
case-insensitive as well.

I also added validation of the attribute name that is appended
to the $attr keyword.  We previously performed no validation.  The
patch ensures that the attribute name is legal per RFC 4512, but
we don't check if it is defined in the schema.  This will allow an
aci to be set prior to adding the attribute to the schema.  It
also allows attributes that are used in an extensibleObject entry
to work properly with macro acis.
Ticket 47512 - backend txn plugin fixup tasks should be done in a txn

Description:  If a plugin is a backend txn plugin, then its fixup tasks should
              also be done in a transaction.

https://fedorahosted.org/389/ticket/47512

Reviewed by: richm(Thanks!)
Coverity fix - 11952

Fix resource leak in linked-attributes fixup task
Ticket 47505 - Get rid of  valueset_add_valuearray_ext

Bug Description:  function is no longer used

Fix Description:   remove from code

https://fedorahosted.org/389/ticket/47505

Reviewed by:MarkR
Ticket 47487 - enhance retro changelog

Bug Description:  applications using retro cl might need the
			full information on deleted entries
			eg to verify if the entry matches filter or access

Fix Description:  introduce a new attribute in the retro changelog
			config entry: nsslapd-log-deleted (off by default)

https://fedorahosted.org/389/ticket/47487

Reviewed by: MarkR
Ticket 314 - ChaiOnUpdate for root handling

Bug Description:  If chaining and distribution are configured
			updates as root are always applied locally
			This leads to inconsistent data

Fix Description:   Add a configuration option to control the
			processing of root updates. Valid options are:
			- local: apply changes to the local database
			- reject: do not handle root updates
			- referral: return the referral to the
					chaining backend

https://fedorahosted.org/389/ticket/314

Reviewed by: ?
Use defines for backend error handling
Ticket 47401 - report unindexed internal searches

Bug Description:  Internal search operations that are unindexed are not logged.  By
                  default plugins do not log their operations, even if access log level
                  is set to record internal operations - unless the undocumented config
                  attribute "nsslapd-logAccess: on" is set in each plugin config entry.

Fix Description:  Record the unindexed search in the error log, if access logging is not
                  recording internal operations.  Also, a new config attribute was added
                  to cn=config:

                     nsslapd-plugin-logging: on|off

                  When set to on, it turns on logging for all plugin internal operations.

https://fedorahosted.org/389/ticket/47401

Reviewed by: nhosoi(Thanks!)
Ticket #460 - support multiple subtrees and filters

Description:
1. Support multiple subtrees
   new config parameter in windwows sync agreement:
   winSyncSubtreePair: <DS Subtree>:<AD Subtree>

   Example:
   winSyncSubtreePair: ou=OU1,dc=DSexample,dc=com:ou=OU1,DC=ADexample,DC=com
   winSyncSubtreePair: ou=OU2,dc=DSexample,dc=com:ou=OU2,DC=ADexample,DC=com
   winSyncSubtreePair: ou=OU3,dc=DSexample,dc=com:ou=OU3,DC=ADexample,DC=com

 . Attribute type "winSyncSubtreePair" is added to the objectclass
   "nsDSWindowsReplicationAgreement".
 . If "winSyncSubtreePair" is not set, there is not behavioral
   difference: the AD subtree "nsds7WindowsReplicaSubtree" and the
   DS subtree "nsds7DirectoryReplicaSubtree" are used for the sync
   target checks.
 . When "winSyncSubtreePair" is set, the above 2 config parameters
   are ignored.
   To determine if an entry is the target of the synchronization,
   the DN is examined whether the DN is a descendent of any of the
   subtrees or not. If it is, the subtree of the counter part is
   retrieved.
   Moving an entry from one subtree to another is synchronized.
   Members of a group is synchronized as long as the member entry
   is in any of the defined subtrees.

2. Support filters
   new config parameters in windwows sync agreement:
   winSyncWindowsFilter: <additional filter on AD>
   winSyncDirectoryFilter: <additional filter on DS>

   Example:
   winSyncWindowsFilter: (|(cn=*user*)(cn=*group*))
   winSyncDirectoryFilter: (|(uid=*user*)(cn=*group*))

 . The filters are set to the windows_userfilter and directory_
   userfilter in the private area in the windows agreement.  And
   when each server is searched the filters are added to the internal
   filter.  For instance, filters shown in the above Example allow
   synchronizing the entries which CN contains "user" or "group".

3. Misc
 . Added slapi_sdn_set_ndn_byref, slapi_sdn_set_ndn_passin, and
   slapi_sdn_common_ancestor to dn.c (see also slapi-plugin.h).
 . Fixed memory leaks.
 . Fixed some of the mixed indentations.

https://fedorahosted.org/389/ticket/460

Reviewed by Rich (Thank you!!)
Ticket #47516 replication stops with excessive clock skew

https://fedorahosted.org/389/ticket/47516
Reviewed by: nhosoi (Thanks!)
Branch: master
Fix Description: Add a new configuration parameter to cn=config
nsslapd-ignore-time-skew: on|off - default off
If nsslapd-ignore-time-skew: on, the replication consumer will log errors
about excessive time skew, but will allow replication to proceed, and will
not return a time skew error to the replication supplier.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: yes - document new config param