Ticket #47660 - config_set_allowed_to_delete_attrs: Valgrind reports Invalid read

Description: There was a logic error in checking the availability of
a pointer.  Before checking the contents of an address, the correctness
of the pointer needed to be checked.

Also, one memory leak was found in the error return case.

Note: these 2 issues were introduece by this commit:
commit 94b123780b21e503b78bceca9d60904206ef91fa
Trac Ticket #447 - Possible to add invalid attribute to nsslapd-allowed-to-delete-attrs

https://fedorahosted.org/389/ticket/47660

Reviewed by rmeggins@redhat.com (Thank you, Rich!)
(cherry picked from commit 1a788bf35a138d221f2bfb88d6da5fc5244d738c)
Ticket #47571 - targetattr ACIs ignore subtype

Description:
Subtypes in targetattr, userattr in aci as well as filter and attribute list
in the search are supported.
* If targetattr contains subtypes, the base type only as well as other subtypes
  are not allowed to access (or denied to access).
* If userattr contains subtypes, the base type as well as other subtypes in
  entries do not match the userattr value.
* If attribute list in search has a base type attribute, and a targetattr has
  a type with subtypes, then only the subtyped value is returned.  E.g.,
    attribute list: sn
    targetattr: sn;en
      ==>
    sn;en: <sn-en-value> and
    sn;en;phonetic: <sn-en-phonetic-value> are returned
    but
    sn or sn;fr is not.
  If attribute list has a type with subtype, then if the targetattr allows the
  subtype, the value is returned.  E.g.,
    attribute list: sn;en
    targetattr: sn;en
      ==>
    sn;en: <sn-en-value> and
    sn;en;phonetic: <sn-en-phonetic-value> are returned
    but
    sn or sn;fr is not.
1) slapd/attr.c
   * slapi_attr_type_cmp assumed the subtype order in 2 args are identical,
     but it is not always guaranteed.  Removed the assumption.
   * Added another compare type SLAPI_TYPE_CMP_SUBTYPES to comp_cmp which is
     called by slapi_attr_type_cmp to support full subtypes comparison.
2) plugin/acl.c:
   * Changed to call slapi_attr_type_cmp with human readable macros, e.g.,
     SLAPI_TYPE_CMP_BASE, SLAPI_TYPE_CMP_SUBTYPE, etc.
   * Replaced strcasecmp with slapi_attr_type_cmp for attribute type comparison.
   * Changed to call slapi_attr_type_cmp with SLAPI_TYPE_CMP_SUBTYPES (full
     subtype comparison) in acl__get_attrEval, where the next attribute to
	 compare is determined.
3) slapd/search.c,result.c
   send_all_attrs/send_specific_attrs use a dontsendattr array to control the
   duplicate attribute types.  Replaced the logic with a simpler one by creating
   an charray with no duplicates.

https://fedorahosted.org/389/ticket/47571

Reviewed by tbordaz@redhat.com (Thank you, Thierry!)
(cherry picked from commit 85a78741dfeb636a1cf7cced1576278e65f5bb58)
Ticket #47571 - targetattr ACIs ignore subtype

Description: commit 85a78741dfeb636a1cf7cced1576278e65f5bb58
introduced 2 coverity issues:
12423: Explicit null dereferenced
do_search (slapd/search.c)
If attribute list contains multiple "*"s and "aci"s in ldapsearch,
the previous code attempted to add "aci" once for "*" and replacing
"aci" with normalized aci (if any) once and eliminating the duplicated
"aci"s. The code contained a null dereferenced bug. Even if duplicated
attributes are included in the attribute list, they are removed later
in send_specific_attrs. Thus, this patch simplifies the logic to avoid
the null dereference.

12422: Logically dead code
comp_cmp (slapd/attr.c)
Eliminated the dead code (case s1 == NULL AND s2 == NULL).

https://fedorahosted.org/389/ticket/47571

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)
(cherry picked from commit 36c48b8395c6e4ca374c74f91dad6b022aa99ce1)
Ticket 47629 - random crashes related to sync repl

Bug Description:  if there is no cookie, the persist thread starts
        before the initial refresh is complete, both threads use the
	same operation structure and there is a race condition
	on setting and freeing the search entry.

Fix Description:   ensure that the persist thread only starts sending
	updates once the refresh is complete

https://fedorahosted.org/389/ticket/47629

Reviewed by: Rich, thanks
Ticket 408 - Fix crash when disabling/enabling the setting

Bug Description:  Enabling/disabling can lead to crash as the setting
                  was not designed to be dynamically updated.

Fix Description:  Do not use the actual config setting to determine if the
                  cache is enabled.  Instead we record when the cache is
                  initialized.  The server still needs to be restarted for
                  the config change to take effect.

                  Also freed the cache at server shtudown.

https://fedorahosted.org/389/ticket/408

Reviewed by: rmeggins(Thanks!)
(cherry picked from commit 03c90f04065059ee310e9fa7d98228e0aa39fa50)
Ticket 47620 - Unable to delete protocol timeout attribute

Bug Description:  Attempting to delete nsds5ReplicaProtocolTimeout from a replication
                  agreement unexpectedly fails with an error 53.

Fix Description:  The previous delete operation check was in the wrong location, and the
                  delete operation was treated as a modify - which then triggered the
                  error 53.  Added the correct check for the delete operation.

                  Also removed some old code for a CLEANALLRUV attribute that was never
                  implemented.

https://fedorahosted.org/389/ticket/47620

Reviewed by: nhosoi(Thanks!)
(cherry picked from commit 9c41a365e8fbd23cab28eb91f50cdce696a30730)
Ticket #47516 replication stops with excessive clock skew

https://fedorahosted.org/389/ticket/47516
Reviewed by: nhosoi (Thanks!)
Branch: 389-ds-base-1.3.2
Fix Description: The previous fix was not adequate.  Instead, the determination
of whether or not to ignore time skew should be determined in
csngen_adjust_time().
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: yes - document new config param
(cherry picked from commit 9f2b104b0938b21d7c9fe37c736d0e6328843aeb)
Ticket #342 - better error message when cache overflows

Description: commit 892bf12c1bb8b10afea3d6ff711059bf04e362cc
introduced an invalid memory read/write.  This patch prepares one
extra aclpblock for the acl cache overflow.

https://fedorahosted.org/389/ticket/342

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)
(cherry picked from commit 3fee1fc829a4a9573d087d1ead3c949239e5e914)