Ticket #47585 Replication Failures related to skipped entries due to cleaned rids

https://fedorahosted.org/389/ticket/47585
Reviewed by: nhosoi (Thanks!)
Branch: 389-ds-base-1.2.11
Fix Description: If a change was found in the changelog buffer that is
skipped due to having an unknown replica ID (rid), the entire buffer was
marked as CLC_STATE_NEW_RID.  When the buffer is exhausted and the iterator
code goes to read in the new buffer, it would not read in the new buffer
because it only loads a new buffer if the current buffer state is
CLC_STATE_READY.  I don't know why the entire buffer would be marked as
CLC_STATE_NEW_RID and stop iteration.  It seems to me that just the update
should be skipped, but new buffers should be loaded in order to keep sending
non-skipped updates to the consumer.
It is possible for a CSN with an unknown RID to get into the changelog if
the server with that RID had been removed by cleanruv/cleanallruv.  In that
case, the CSN should be skipped.  It is assumed that the change was already
sent - cleanallruv is supposed to wait until all known changes have been
seen before removing the RID from the RUV - so it is safe to skip it.
Added additional debugging, so that we can better tell why changelog entries
were skipped.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit cf08f1274404e4796966011a98a6a0acbbfd6070)
(cherry picked from commit 30bb98fb693ea1aac9774bdc43b923eacd72570a)
(cherry picked from commit fc70e4ac6accaa14d140e333829e98897f6ff164)
(cherry picked from commit 7eefa121784774a2c1535404f0b95b78970b43c2)
Revert "Ticket #47559 hung server - related to sasl and initialize"

This reverts commit a572cb299d8b31f270c9d7d53ad799e91c4dc212.
Ticket #47596 attrcrypt fails to find unlocked key

https://fedorahosted.org/389/ticket/47596
Reviewed by: nkinder (Thanks!)
Branch: 389-ds-base-1.2.11
Fix Description: There should always be a pre-authenticated slot/token that
has the servers cert and key.  Just loop through all of the slots that the
server's cert is found on, and use the first one that is authenticated.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit b1fad4e35c0f963bf4678a2ed9a068dbe4fb159c)
(cherry picked from commit cf091de4ae70ad8d683ff33c57e75e58ff900502)
(cherry picked from commit 92b46296c0b4ab9aa436ae09bca95832e2276c6e)
(cherry picked from commit e2d11075405898c84e50e2a98788ac4614efd2c1)
Ticket #47605 CVE-2013-4485: DoS due to improper handling of ger attr searches

https://fedorahosted.org/389/ticket/47605
Reviewed by: nhosoi (Thanks!)
Branch: 389-ds-base-1.2.11
Fix Description: The traversal of the attr list looking for GER objectclasses
was modifying the same attribute twice, removing the "@" from it.  The second
time, since there was no "@" in the string, the strchr would return NULL, and
the code would not check for it.
The code was simplified and rewritten to use charray_merge_nodup
to build the gerattrs list with unique objectclass values, which I believe was
the intention of the original code.  I also added some error checking to look
for invalid attributes like "@name" "name@" and "name@name@name".
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit 7e03702932546e74f0044d11832e7e7e395cbb36)
(cherry picked from commit 12e54af6982ab5406f4bba6a02dd0724a0415501)
(cherry picked from commit c9c566ab37a022107a187e9c5f7502d027338965)
(cherry picked from commit 3c677cab6c6001dcc48c6661fb893323626caadb)
bump version to 1.2.11.25
Ticket #47596 attrcrypt fails to find unlocked key

https://fedorahosted.org/389/ticket/47596
Reviewed by: nkinder (Thanks!)
Branch: 389-ds-base-1.2.11
Fix Description: Additional fix to the previous fix.  As it turns out, the
function PK11_IsLoggedIn() only returns true if the slot has been unlocked
with a pin or password.  If the slot does not need a login at all, because
the cert/key db has no password, PK11_IsLoggedIn will return false.  The code
must check for PK11_NeedLogin too.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit e66c4cecc47eff659a72a51c1e1722fb41c1dfbc)
(cherry picked from commit f608a943745e51fe4b5dbfb18bada2e2d13e0d6a)
(cherry picked from commit 5d2a20b4881d5374a9088ed1504b2d7e753976bb)
(cherry picked from commit 33df11ea7a9cbef5f78fe0d43da8a1c77b0a6c98)
Ticket 47591 - entries with empty objectclass attribute value can be hidden

Bug Description:   The problem is that for the empty value

	objectClass;vdcsn-5283b8e0000000c80000;deleted

	it is compared to "ldapsubentry" and "nstombstone"

	'if (PL_strncasecmp(type.bv_val,"tombstone",0)'

	and with length 0, this is always true.

Fix Description:   add a check bv_len >= strlen(valuetocompare)
			or	bv_len == strlen(valuetocompare)
			define constants for lengths

https://fedorahosted.org/389/ticket/47591

Reviewed by: richm, thanks
Ticket 47587 - hard coded limit of 64 masters in agreement and changelog code

Bug Description:  Need to remove hardcoded limit of 64 masters.

Fix Description:  Changed the default limit to 256, and then we resize the array
                  as needed.

https://fedorahosted.org/389/ticket/47587

Reviewed by: richm & tbordaz(Thanks!!)
Ticket #47623 fix memleak caused by 47347

https://fedorahosted.org/389/ticket/47623
Reviewed by: nhosoi (Thanks!)
Branch: 389-ds-base-1.2.11
Fix Description: Only need to create the mutex when creating a new PR object.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit 98ccb602058270e97a3702ae2b81c17635af8d27)
(cherry picked from commit 65c51555c0ecc94c5d93f09124168697ba1db6b3)
(cherry picked from commit 8a2c666df491b7c8666f8a70a5038b35c43fbc3b)
(cherry picked from commit 8968e078caacf1021a11c19546c448a4b65db098)
Ticket #47623 fix memleak caused by 47347

https://fedorahosted.org/389/ticket/47623
Reviewed by: tbordaz, nhosoi (Thanks!)
Branch: 389-ds-base-1.2.11
Fix Description: Create the mutex if it doesn't exist.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit 0d4849dd7551347f0e24ac1027f4d0501084dcf3)
(cherry picked from commit 5d3ae5f709964cd7dfb73b631a22389223f5ef25)
(cherry picked from commit 5c649ddacd1d2c11b6e922b29472094b780c2a0e)
(cherry picked from commit 75ed4b36722eeff8dc2d6aad0cf5e32dc474c3a7)
Ticket 47627 - changelog iteration should ignore cleaned rids when getting the minCSN

Description:  If a change is not found in the change log the server will look for a min csn
              to start the replay. This minCSN should not come from a cleaned RUV element.

https://fedorahosted.org/389/ticket/47627

Reviewed by: rmeggins & lkrispenz(Thanks!!)
(cherry picked from commit 9c6e9bb12327a2d50e651221614d34984b605427)