]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/config.c
cleanup
[openldap] / servers / slapd / config.c
index ea3d1a65f47a4c9d40b3b5666a8a3df6e084860b..b9a3e895536f2acbffc5b79e0d94405f77ecb8e5 100644 (file)
@@ -1,8 +1,27 @@
 /* config.c - configuration file handling routines */
 /* $OpenLDAP$ */
-/*
- * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
- * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2004 The OpenLDAP Foundation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* Portions Copyright (c) 1995 Regents of the University of Michigan.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that this notice is preserved and that due credit is given
+ * to the University of Michigan at Ann Arbor. The name of the University
+ * may not be used to endorse or promote products derived from this
+ * software without specific prior written permission. This software
+ * is provided ``as is'' without express or implied warranty.
  */
 
 #include "portable.h"
@@ -18,7 +37,7 @@
 #include "ldap_pvt.h"
 #include "slap.h"
 #ifdef LDAP_SLAPI
-#include "slapi.h"
+#include "slapi/slapi.h"
 #endif
 #include "lutil.h"
 
 /*
  * defaults for various global variables
  */
-struct slap_limits_set deflimit = {
-       SLAPD_DEFAULT_TIMELIMIT,        /* backward compatible limits */
-       0,
-
-       SLAPD_DEFAULT_SIZELIMIT,        /* backward compatible limits */
-       0,
-       -1,                             /* no limit on unchecked size */
-       0,                              /* page limit */
-       0                               /* hide number of entries left */
-};
-
-AccessControl  *global_acl = NULL;
-slap_access_t          global_default_access = ACL_READ;
-slap_mask_t            global_restrictops = 0;
 slap_mask_t            global_allows = 0;
 slap_mask_t            global_disallows = 0;
-slap_mask_t            global_requires = 0;
-slap_ssf_set_t global_ssf_set;
 char           *replogfile;
 int            global_gentlehup = 0;
 int            global_idletimeout = 0;
 char   *global_host = NULL;
 char   *global_realm = NULL;
 char           *ldap_srvtab = "";
-char           *default_passwd_hash = NULL;
+char           **default_passwd_hash = NULL;
 int            cargc = 0, cargv_size = 0;
 char   **cargv;
-struct berval default_search_base = { 0, NULL };
-struct berval default_search_nbase = { 0, NULL };
+struct berval default_search_base = BER_BVNULL;
+struct berval default_search_nbase = BER_BVNULL;
 unsigned               num_subordinates = 0;
-struct berval global_schemadn = { 0, NULL };
-struct berval global_schemandn = { 0, NULL };
 
 ber_len_t sockbuf_max_incoming = SLAP_SB_MAX_INCOMING_DEFAULT;
 ber_len_t sockbuf_max_incoming_auth= SLAP_SB_MAX_INCOMING_AUTH;
@@ -77,15 +78,15 @@ int use_reverse_lookup = 0;
 int slapi_plugins_used = 0;
 #endif
 
-static char    *fp_getline(FILE *fp, int *lineno);
-static void    fp_getline_init(int *lineno);
-static int     fp_parse_line(int lineno, char *line);
+static char *fp_getline(FILE *fp, int *lineno);
+static void fp_getline_init(int *lineno);
+static int fp_parse_line(int lineno, char *line);
 
 static char    *strtok_quote(char *line, char *sep);
-static int      load_ucdata(char *path);
+static int load_ucdata(char *path);
 
-static int     add_syncrepl LDAP_P(( Backend *, char **, int ));
-static int      parse_syncrepl_line LDAP_P(( char **, int, syncinfo_t *));
+static int add_syncrepl LDAP_P(( Backend *, char **, int ));
+static int parse_syncrepl_line LDAP_P(( char **, int, syncinfo_t *));
 
 int
 read_config( const char *fname, int depth )
@@ -98,9 +99,10 @@ read_config( const char *fname, int depth )
        struct berval vals[2];
        char *replicahost;
        LDAPURLDesc *ludp;
-       static int lastmod = 1;
        static BackendInfo *bi = NULL;
        static BackendDB        *be = NULL;
+       char    *next;
+
 
        vals[1].bv_val = NULL;
 
@@ -240,7 +242,7 @@ read_config( const char *fname, int depth )
                        if ( cargc < 2 ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG( CONFIG, CRIT, 
-                                       "%s: line %d: missing level in \"concurrency <level\" "
+                                       "%s: line %d: missing level in \"concurrency <level>\" "
                                        " line\n", fname, lineno, 0 );
 #else
                                Debug( LDAP_DEBUG_ANY,
@@ -251,7 +253,19 @@ read_config( const char *fname, int depth )
                                return( 1 );
                        }
 
-                       c = atoi( cargv[1] );
+                       c = strtol( cargv[1], &next, 10 );
+                       if ( next == NULL || next[0] != '\0' ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, CRIT, 
+                                       "%s: line %d: unable to parse level \"%s\" in \"concurrency <level>\" "
+                                       " line\n", fname, lineno, cargv[1] );
+#else
+                               Debug( LDAP_DEBUG_ANY,
+           "%s: line %d: unable to parse level \"%s\" in \"concurrency <level>\" line\n",
+                                   fname, lineno, cargv[1] );
+#endif
+                               return( 1 );
+                       }
 
                        if( c < 1 ) {
 #ifdef NEW_LOGGING
@@ -522,7 +536,19 @@ read_config( const char *fname, int depth )
                                return( 1 );
                        }
 
-                       c = atoi( cargv[1] );
+                       c = strtol( cargv[1], &next, 10 );
+                       if (next == NULL || next[0] != '\0' ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, CRIT, 
+                                       "%s: line %d: unable to parse count \"%s\" in \"threads <count>\" line\n",
+                                       fname, lineno, cargv[1] );
+#else
+                               Debug( LDAP_DEBUG_ANY,
+           "%s: line %d: unable to parse count \"%s\" in \"threads <count>\" line\n",
+                                   fname, lineno, cargv[1] );
+#endif
+                               return( 1 );
+                       }
 
                        if( c < 0 ) {
 #ifdef NEW_LOGGING
@@ -616,22 +642,34 @@ read_config( const char *fname, int depth )
                                return 1;
 
                        }
-
-                       if ( lutil_passwd_scheme( cargv[1] ) == 0 ) {
+                       for(i = 1; i < cargc; i++) {
+                               if ( lutil_passwd_scheme( cargv[i] ) == 0 ) {
+#ifdef NEW_LOGGING
+                                       LDAP_LOG( CONFIG, CRIT, 
+                                               "%s: line %d: password scheme \"%s\" not available\n",
+                                               fname, lineno, cargv[i] );
+#else
+                                       Debug( LDAP_DEBUG_ANY,
+                                               "%s: line %d: password scheme \"%s\" not available\n",
+                                               fname, lineno, cargv[i] );
+#endif
+                               } else {
+                                       ldap_charray_add( &default_passwd_hash, cargv[i] );
+                               }
+                       }
+                       if( !default_passwd_hash ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG( CONFIG, CRIT, 
-                                          "%s: line %d: password scheme \"%s\" not available\n",
-                                          fname, lineno, cargv[1] );
+                                       "%s: line %d: no valid hashes found\n",
+                                       fname, lineno, 0 );
 #else
                                Debug( LDAP_DEBUG_ANY,
-                                       "%s: line %d: password scheme \"%s\" not available\n",
-                                       fname, lineno, cargv[1] );
-#endif
+                                       "%s: line %d: no valid hashes found\n",
+                                       fname, lineno, 0 );
                                return 1;
+#endif
                        }
 
-                       default_passwd_hash = ch_strdup( cargv[1] );
-
                } else if ( strcasecmp( cargv[0], "password-crypt-salt-format" ) == 0 ) 
                {
                        if ( cargc < 2 ) {
@@ -651,11 +689,26 @@ read_config( const char *fname, int depth )
 
                        lutil_salt_format( cargv[1] );
 
-               /* SASL config options */
-               } else if ( strncasecmp( cargv[0], "sasl", 4 ) == 0 ) {
+#ifdef SLAP_AUTH_REWRITE
+               /* use authid rewrite instead of sasl regexp */
+               } else if ( strncasecmp( cargv[0], "auth-rewrite",
+                       STRLENOF("auth-rewrite") ) == 0 )
+               {
+                       int rc = slap_sasl_rewrite_config( fname, lineno,
+                                       cargc, cargv );
+                       if ( rc ) {
+                               return rc;
+                       }
+#endif /* SLAP_AUTH_REWRITE */
+
+               /* Auth + SASL config options */
+               } else if ( !strncasecmp( cargv[0], "auth", STRLENOF("auth") ) ||
+                       !strncasecmp( cargv[0], "sasl", STRLENOF("sasl") ))
+               {
                        if ( slap_sasl_config( cargc, cargv, line, fname, lineno ) )
                                return 1;
 
+
                } else if ( strcasecmp( cargv[0], "schemadn" ) == 0 ) {
                        struct berval dn;
                        if ( cargc < 2 ) {
@@ -675,8 +728,8 @@ read_config( const char *fname, int depth )
                                rc = dnPrettyNormal( NULL, &dn, &be->be_schemadn,
                                        &be->be_schemandn, NULL );
                        } else {
-                               rc = dnPrettyNormal( NULL, &dn, &global_schemadn,
-                                       &global_schemandn, NULL );
+                               rc = dnPrettyNormal( NULL, &dn, &frontendDB->be_schemadn,
+                                       &frontendDB->be_schemandn, NULL );
                        }
                        if ( rc != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
@@ -746,14 +799,14 @@ read_config( const char *fname, int depth )
                        }
 
                        if ( be == NULL ) {
-                               lim = &deflimit;
+                               lim = &frontendDB->be_def_limit;
                        } else {
                                lim = &be->be_def_limit;
                        }
 
                        for ( i = 1; i < cargc; i++ ) {
                                if ( strncasecmp( cargv[i], "size", 4 ) == 0 ) {
-                                       rc = parse_limit( cargv[i], lim );
+                                       rc = limits_parse_one( cargv[i], lim );
                                        if ( rc ) {
 #ifdef NEW_LOGGING
                                                LDAP_LOG( CONFIG, CRIT, 
@@ -775,8 +828,6 @@ read_config( const char *fname, int depth )
                                        if ( strcasecmp( cargv[i], "unlimited" ) == 0 ) {
                                                lim->lms_s_soft = -1;
                                        } else {
-                                               char *next;
-
                                                lim->lms_s_soft = strtol( cargv[i] , &next, 0 );
                                                if ( next == cargv[i] ) {
 #ifdef NEW_LOGGING
@@ -826,14 +877,14 @@ read_config( const char *fname, int depth )
                        }
                        
                        if ( be == NULL ) {
-                               lim = &deflimit;
+                               lim = &frontendDB->be_def_limit;
                        } else {
                                lim = &be->be_def_limit;
                        }
 
                        for ( i = 1; i < cargc; i++ ) {
                                if ( strncasecmp( cargv[i], "time", 4 ) == 0 ) {
-                                       rc = parse_limit( cargv[i], lim );
+                                       rc = limits_parse_one( cargv[i], lim );
                                        if ( rc ) {
 #ifdef NEW_LOGGING
                                                LDAP_LOG( CONFIG, CRIT, 
@@ -855,8 +906,6 @@ read_config( const char *fname, int depth )
                                        if ( strcasecmp( cargv[i], "unlimited" ) == 0 ) {
                                                lim->lms_t_soft = -1;
                                        } else {
-                                               char *next;
-
                                                lim->lms_t_soft = strtol( cargv[i] , &next, 0 );
                                                if ( next == cargv[i] ) {
 #ifdef NEW_LOGGING
@@ -901,7 +950,7 @@ read_config( const char *fname, int depth )
                                return( 1 );
                        }
 
-                       if ( parse_limits( be, fname, lineno, cargc, cargv ) ) {
+                       if ( limits_parse( be, fname, lineno, cargc, cargv ) ) {
                                return( 1 );
                        }
 
@@ -920,26 +969,43 @@ read_config( const char *fname, int depth )
                                return 1;
 
                        } else {
-                               be->be_flags |= SLAP_BFLAG_GLUE_SUBORDINATE;
+                               SLAP_DBFLAGS(be) |= SLAP_DBFLAG_GLUE_SUBORDINATE;
                                num_subordinates++;
                        }
 
                /* add an overlay to this backend */
                } else if ( strcasecmp( cargv[0], "overlay" ) == 0 ) {
                        if ( be == NULL ) {
+                               if ( cargv[1][0] == '-' && overlay_config( frontendDB, &cargv[1][1] ) ) {
+                                       /* log error */
 #ifdef NEW_LOGGING
-                               LDAP_LOG( CONFIG, INFO, "%s: line %d: "
-                                       "overlay keyword must appear inside a database "
-                                       "definition.\n", fname, lineno, 0 );
+                                       LDAP_LOG( CONFIG, INFO, "%s: line %d: "
+                                               "(optional) global overlay \"%s\" configuration "
+                                               "failed (ignored)\n", fname, lineno, &cargv[1][1] );
 #else
-                               Debug( LDAP_DEBUG_ANY, "%s: line %d: overlay keyword "
-                                       "must appear inside a database definition.\n",
-                                   fname, lineno, 0 );
+                                       Debug( LDAP_DEBUG_ANY, "%s: line %d: "
+                                               "(optional) global overlay \"%s\" configuration "
+                                               "failed (ignored)\n", fname, lineno, &cargv[1][1] );
 #endif
-                               return 1;
+                               } else if ( overlay_config( frontendDB, cargv[1] ) ) {
+                                       return 1;
+                               }
 
-                       } else if ( overlay_config( be, cargv[1] )) {
-                               return 1;
+                       } else {
+                               if ( cargv[1][0] == '-' && overlay_config( be, &cargv[1][1] ) ) {
+                                       /* log error */
+#ifdef NEW_LOGGING
+                                       LDAP_LOG( CONFIG, INFO, "%s: line %d: "
+                                               "(optional) overlay \"%s\" configuration "
+                                               "failed (ignored)\n", fname, lineno, &cargv[1][1] );
+#else
+                                       Debug( LDAP_DEBUG_ANY, "%s: line %d: "
+                                               "(optional) overlay \"%s\" configuration "
+                                               "failed (ignored)\n", fname, lineno, &cargv[1][1] );
+#endif
+                               } else if ( overlay_config( be, cargv[1] ) ) {
+                                       return 1;
+                               }
                        }
 
                /* set database suffix */
@@ -1091,25 +1157,38 @@ read_config( const char *fname, int depth )
 "%s: line %d: depth line must appear inside a database definition.\n",
                                    fname, lineno, 0 );
 #endif
-                                                       return 1;
+                               return 1;
+                       }
+
+                      i = strtol( cargv[1], &next, 10 );
+                      if ( next == NULL || next[0] != '\0' ) {
+#ifdef NEW_LOGGING
+                              LDAP_LOG( CONFIG, INFO, 
+                                         "%s: line %d: unable to parse depth \"%s\" in \"maxDerefDepth <depth>\" "
+                                         "line.\n", fname, lineno, cargv[1] );
+#else
+                               Debug( LDAP_DEBUG_ANY,
+                                         "%s: line %d: unable to parse depth \"%s\" in \"maxDerefDepth <depth>\" "
+                                         "line.\n", fname, lineno, cargv[1] );
+#endif
+                               return 1;
+                      }
 
-                       } else if ((i = atoi(cargv[1])) < 0) {
+                      if (i < 0) {
 #ifdef NEW_LOGGING
                               LDAP_LOG( CONFIG, INFO, 
                                          "%s: line %d: depth must be positive.\n",
-                                         fname, lineno ,0 );
+                                         fname, lineno0 );
 #else
                                Debug( LDAP_DEBUG_ANY,
 "%s: line %d: depth must be positive.\n",
                                    fname, lineno, 0 );
 #endif
-                                                       return 1;
-
+                               return 1;
 
-                       } else {
-                           be->be_max_deref_depth = i;
-                                          }
 
+                       }
+                       be->be_max_deref_depth = i;
 
                /* set magic "root" dn for this database */
                } else if ( strcasecmp( cargv[0], "rootdn" ) == 0 ) {
@@ -1232,10 +1311,11 @@ read_config( const char *fname, int depth )
                        }
                        if ( be == NULL ) {
                                if ( strcasecmp( cargv[1], "on" ) == 0 ) {
-                                       global_restrictops |= SLAP_RESTRICT_OP_WRITES;
+                                       frontendDB->be_restrictops |= SLAP_RESTRICT_OP_WRITES;
                                } else {
-                                       global_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
+                                       frontendDB->be_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
                                }
+
                        } else {
                                if ( strcasecmp( cargv[1], "on" ) == 0 ) {
                                        be->be_restrictops |= SLAP_RESTRICT_OP_WRITES;
@@ -1244,12 +1324,121 @@ read_config( const char *fname, int depth )
                                }
                        }
 
+               /* restricts specific operations */
+               } else if ( strcasecmp( cargv[0], "restrict" ) == 0 ) {
+                       slap_mask_t     restrict = 0;
+                       struct restrictable_exops_t {
+                               char    *name;
+                               int     flag;
+                       } restrictable_exops[] = {
+                               { LDAP_EXOP_START_TLS,          SLAP_RESTRICT_EXOP_START_TLS },
+                               { LDAP_EXOP_MODIFY_PASSWD,      SLAP_RESTRICT_EXOP_MODIFY_PASSWD },
+                               { LDAP_EXOP_X_WHO_AM_I,         SLAP_RESTRICT_EXOP_WHOAMI },
+                               { LDAP_EXOP_X_CANCEL,           SLAP_RESTRICT_EXOP_CANCEL },
+                               { NULL,                         0 }
+                       };
+                       int             i;
+
+                       if ( cargc < 2 ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, CRIT, 
+                                       "%s: line %d: missing <op_list> in \"restrict <op_list>\" "
+                                       "line.\n", fname, lineno ,0 );
+#else
+                               Debug( LDAP_DEBUG_ANY,
+                                       "%s: line %d: missing <op_list> in \"restrict <op_list>\" "
+                                       "line.\n", fname, lineno, 0 );
+#endif
+
+                               return( 1 );
+                       }
+
+                       for ( i = 1; i < cargc; i++ ) {
+                               if ( strcasecmp( cargv[ i ], "read" ) == 0 ) {
+                                       restrict |= SLAP_RESTRICT_OP_READS;
+
+                               } else if ( strcasecmp( cargv[ i ], "write" ) == 0 ) {
+                                       restrict |= SLAP_RESTRICT_OP_WRITES;
+
+                               } else if ( strcasecmp( cargv[ i ], "add" ) == 0 ) {
+                                       restrict |= SLAP_RESTRICT_OP_ADD;
+
+                               } else if ( strcasecmp( cargv[ i ], "bind" ) == 0 ) {
+                                       restrict |= SLAP_RESTRICT_OP_BIND;
+
+                               } else if ( strcasecmp( cargv[ i ], "compare" ) == 0 ) {
+                                       restrict |= SLAP_RESTRICT_OP_COMPARE;
+
+                               } else if ( strcasecmp( cargv[ i ], "delete" ) == 0 ) {
+                                       restrict |= SLAP_RESTRICT_OP_DELETE;
+
+                               } else if ( strncasecmp( cargv[ i ], "extended",
+                                                       STRLENOF( "extended" ) ) == 0 ) {
+                                       char    *e = cargv[ i ] + STRLENOF( "extended" );
+
+                                       if ( e[0] == '=' ) {
+                                               int     j;
+
+                                               e++;
+                                               for ( j = 0; restrictable_exops[ j ].name; j++ ) {
+                                                       if ( strcmp( e, restrictable_exops[ j ].name ) == 0 ) {
+                                                               restrict |= restrictable_exops[ j ].flag;
+                                                               break;
+                                                       }
+                                               }
+
+                                               if ( restrictable_exops[ j ].name == NULL ) {
+                                                       goto restrict_unknown;
+                                               }
+
+                                               restrict &= ~SLAP_RESTRICT_OP_EXTENDED;
+
+                                       } else if ( e[0] == '\0' ) {
+                                               restrict &= ~SLAP_RESTRICT_EXOP_MASK;
+                                               restrict |= SLAP_RESTRICT_OP_EXTENDED;
+                                               
+                                       } else {
+                                               goto restrict_unknown;
+                                       }
+
+                               } else if ( strcasecmp( cargv[ i ], "modify" ) == 0 ) {
+                                       restrict |= SLAP_RESTRICT_OP_MODIFY;
+
+                               } else if ( strcasecmp( cargv[ i ], "rename" ) == 0
+                                               || strcasecmp( cargv[ i ], "modrdn" ) == 0 ) {
+                                       restrict |= SLAP_RESTRICT_OP_RENAME;
+
+                               } else if ( strcasecmp( cargv[ i ], "search" ) == 0 ) {
+                                       restrict |= SLAP_RESTRICT_OP_SEARCH;
+
+                               } else {
+restrict_unknown:;
+
+#ifdef NEW_LOGGING
+                                       LDAP_LOG( CONFIG, CRIT, "%s: line %d: "
+                                               "unknown operation %s in \"allow <features>\" line.\n",
+                                               fname, lineno, cargv[i] );
+#else
+                                       Debug( LDAP_DEBUG_ANY, "%s: line %d: "
+                                               "unknown operation %s in \"allow <features>\" line\n",
+                                               fname, lineno, cargv[i] );
+#endif
+                                       return 1;
+                               }
+                       }
+
+                       if ( be == NULL ) {
+                               frontendDB->be_restrictops |= restrict;
+
+                       } else {
+                               be->be_restrictops |= restrict;
+                       }
 
                /* allow these features */
                } else if ( strcasecmp( cargv[0], "allows" ) == 0 ||
                        strcasecmp( cargv[0], "allow" ) == 0 )
                {
-                       slap_mask_t     allows;
+                       slap_mask_t     allows = 0;
 
                        if ( be != NULL ) {
 #ifdef NEW_LOGGING
@@ -1278,8 +1467,6 @@ read_config( const char *fname, int depth )
                                return( 1 );
                        }
 
-                       allows = 0;
-
                        for( i=1; i < cargc; i++ ) {
                                if( strcasecmp( cargv[i], "bind_v2" ) == 0 ) {
                                        allows |= SLAP_ALLOW_BIND_V2;
@@ -1297,7 +1484,7 @@ read_config( const char *fname, int depth )
 #ifdef NEW_LOGGING
                                        LDAP_LOG( CONFIG, CRIT, "%s: line %d: "
                                                "unknown feature %s in \"allow <features>\" line.\n",
-                                               fname, lineno, cargv[1] );
+                                               fname, lineno, cargv[i] );
 #else
                                        Debug( LDAP_DEBUG_ANY, "%s: line %d: "
                                                "unknown feature %s in \"allow <features>\" line\n",
@@ -1434,7 +1621,7 @@ read_config( const char *fname, int depth )
                        }
 
                        if ( be == NULL ) {
-                               global_requires = requires;
+                               frontendDB->be_requires = requires;
                        } else {
                                be->be_requires = requires;
                        }
@@ -1458,70 +1645,73 @@ read_config( const char *fname, int depth )
                        }
 
                        if ( be == NULL ) {
-                               set = &global_ssf_set;
+                               set = &frontendDB->be_ssf_set;
                        } else {
                                set = &be->be_ssf_set;
                        }
 
                        for( i=1; i < cargc; i++ ) {
-                               if( strncasecmp( cargv[i], "ssf=",
-                                       sizeof("ssf") ) == 0 )
+                               slap_ssf_t      *tgt;
+                               char            *src;
+
+                               if ( strncasecmp( cargv[i], "ssf=",
+                                               STRLENOF("ssf=") ) == 0 )
                                {
-                                       set->sss_ssf =
-                                               atoi( &cargv[i][sizeof("ssf")] );
+                                       tgt = &set->sss_ssf;
+                                       src = &cargv[i][STRLENOF("ssf=")];
 
-                               } else if( strncasecmp( cargv[i], "transport=",
-                                       sizeof("transport") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "transport=",
+                                               STRLENOF("transport=") ) == 0 )
                                {
-                                       set->sss_transport =
-                                               atoi( &cargv[i][sizeof("transport")] );
+                                       tgt = &set->sss_transport;
+                                       src = &cargv[i][STRLENOF("transport=")];
 
-                               } else if( strncasecmp( cargv[i], "tls=",
-                                       sizeof("tls") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "tls=",
+                                               STRLENOF("tls=") ) == 0 )
                                {
-                                       set->sss_tls =
-                                               atoi( &cargv[i][sizeof("tls")] );
+                                       tgt = &set->sss_tls;
+                                       src = &cargv[i][STRLENOF("tls=")];
 
-                               } else if( strncasecmp( cargv[i], "sasl=",
-                                       sizeof("sasl") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "sasl=",
+                                               STRLENOF("sasl=") ) == 0 )
                                {
-                                       set->sss_sasl =
-                                               atoi( &cargv[i][sizeof("sasl")] );
+                                       tgt = &set->sss_sasl;
+                                       src = &cargv[i][STRLENOF("sasl=")];
 
-                               } else if( strncasecmp( cargv[i], "update_ssf=",
-                                       sizeof("update_ssf") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "update_ssf=",
+                                               STRLENOF("update_ssf=") ) == 0 )
                                {
-                                       set->sss_update_ssf =
-                                               atoi( &cargv[i][sizeof("update_ssf")] );
+                                       tgt = &set->sss_update_ssf;
+                                       src = &cargv[i][STRLENOF("update_ssf=")];
 
-                               } else if( strncasecmp( cargv[i], "update_transport=",
-                                       sizeof("update_transport") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "update_transport=",
+                                               STRLENOF("update_transport=") ) == 0 )
                                {
-                                       set->sss_update_transport =
-                                               atoi( &cargv[i][sizeof("update_transport")] );
+                                       tgt = &set->sss_update_transport;
+                                       src = &cargv[i][STRLENOF("update_transport=")];
 
-                               } else if( strncasecmp( cargv[i], "update_tls=",
-                                       sizeof("update_tls") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "update_tls=",
+                                               STRLENOF("update_tls=") ) == 0 )
                                {
-                                       set->sss_update_tls =
-                                               atoi( &cargv[i][sizeof("update_tls")] );
+                                       tgt = &set->sss_update_tls;
+                                       src = &cargv[i][STRLENOF("update_tls=")];
 
-                               } else if( strncasecmp( cargv[i], "update_sasl=",
-                                       sizeof("update_sasl") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "update_sasl=",
+                                               STRLENOF("update_sasl=") ) == 0 )
                                {
-                                       set->sss_update_sasl =
-                                               atoi( &cargv[i][sizeof("update_sasl")] );
+                                       tgt = &set->sss_update_sasl;
+                                       src = &cargv[i][STRLENOF("update_sasl=")];
 
-                               } else if( strncasecmp( cargv[i], "simple_bind=",
-                                       sizeof("simple_bind") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "simple_bind=",
+                                               STRLENOF("simple_bind=") ) == 0 )
                                {
-                                       set->sss_simple_bind =
-                                               atoi( &cargv[i][sizeof("simple_bind")] );
+                                       tgt = &set->sss_simple_bind;
+                                       src = &cargv[i][STRLENOF("simple_bind=")];
 
                                } else {
 #ifdef NEW_LOGGING
                                        LDAP_LOG( CONFIG, CRIT, 
-                                                  "%s: line %d: unknown factor %S in "
+                                                  "%s: line %d: unknown factor %s in "
                                                   "\"security <factors>\" line.\n",
                                                   fname, lineno, cargv[1] );
 #else
@@ -1532,7 +1722,24 @@ read_config( const char *fname, int depth )
 
                                        return( 1 );
                                }
+
+                               *tgt = strtol( src, &next, 10 );
+                               if ( next == NULL || next[0] != '\0' ) {
+#ifdef NEW_LOGGING
+                                       LDAP_LOG( CONFIG, CRIT, 
+                                                  "%s: line %d: unable to parse factor \"%s\" in "
+                                                  "\"security <factors>\" line.\n",
+                                                  fname, lineno, cargv[1] );
+#else
+                                       Debug( LDAP_DEBUG_ANY,
+                   "%s: line %d: unable to parse factor \"%s\" in \"security <factors>\" line\n",
+                                           fname, lineno, cargv[i] );
+#endif
+
+                                       return( 1 );
+                               }
                        }
+
                /* where to send clients when we don't hold it */
                } else if ( strcasecmp( cargv[0], "referral" ) == 0 ) {
                        if ( cargc < 2 ) {
@@ -1600,10 +1807,22 @@ read_config( const char *fname, int depth )
                                        "%s: line %d: Error in debug directive, \"debug subsys level\"\n",
                                        fname, lineno, 0 );
 #endif
-
                                return( 1 );
                        }
-                        level = atoi( cargv[2] );
+                        level = strtol( cargv[2], &next, 10 );
+                       if ( next == NULL || next[0] != '\0' ){
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, CRIT, 
+                                          "%s: line %d: unable to parse level \"%s\" in debug directive, "
+                                          "\"debug <subsys> <level>\"\n", fname, lineno , cargv[2] );
+#else
+                               Debug( LDAP_DEBUG_ANY,
+                                          "%s: line %d: unable to parse level \"%s\" in debug directive, "
+                                          "\"debug <subsys> <level>\"\n", fname, lineno , cargv[2] );
+#endif
+                               return( 1 );
+                       }
+
                         if ( level <= 0 ) level = lutil_mnem2level( cargv[2] );
                         lutil_set_debug_level( cargv[1], level );
                /* specify an Object Identifier macro */
@@ -1730,11 +1949,11 @@ read_config( const char *fname, int depth )
                        if ( cargc < 2 ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG( CONFIG, CRIT, 
-                                       "%s: line %d: missing level in \"loglevel <level>\""
+                                       "%s: line %d: missing level(s) in \"loglevel <level> [...]\""
                                        " line.\n", fname, lineno , 0 );
 #else
                                Debug( LDAP_DEBUG_ANY,
-                   "%s: line %d: missing level in \"loglevel <level>\" line\n",
+                   "%s: line %d: missing level(s) in \"loglevel <level> [...]\" line\n",
                                    fname, lineno, 0 );
 #endif
 
@@ -1744,7 +1963,73 @@ read_config( const char *fname, int depth )
                        ldap_syslog = 0;
 
                        for( i=1; i < cargc; i++ ) {
-                               ldap_syslog += atoi( cargv[1] );
+                               int     level;
+
+                               if ( isdigit( cargv[i][0] ) ) {
+                                       level = strtol( cargv[i], &next, 10 );
+                                       if ( next == NULL || next[0] != '\0' ) {
+#ifdef NEW_LOGGING
+                                               LDAP_LOG( CONFIG, CRIT, 
+                                                       "%s: line %d: unable to parse level \"%s\" "
+                                                       "in \"loglevel <level> [...]\" line.\n",
+                                                       fname, lineno , cargv[i] );
+#else
+                                               Debug( LDAP_DEBUG_ANY,
+                                                       "%s: line %d: unable to parse level \"%s\" "
+                                                       "in \"loglevel <level> [...]\" line.\n",
+                                                       fname, lineno , cargv[i] );
+#endif
+                                               return( 1 );
+                                       }
+                                       
+                               } else {
+                                       static struct {
+                                               int     i;
+                                               char    *s;
+                                       } int_2_level[] = {
+                                               { LDAP_DEBUG_TRACE,     "Trace"         },
+                                               { LDAP_DEBUG_PACKETS,   "Packets"       },
+                                               { LDAP_DEBUG_ARGS,      "Args"          },
+                                               { LDAP_DEBUG_CONNS,     "Conns"         },
+                                               { LDAP_DEBUG_BER,       "BER"           },
+                                               { LDAP_DEBUG_FILTER,    "Filter"        },
+                                               { LDAP_DEBUG_CONFIG,    "Config"        },
+                                               { LDAP_DEBUG_ACL,       "ACL"           },
+                                               { LDAP_DEBUG_STATS,     "Stats"         },
+                                               { LDAP_DEBUG_STATS2,    "Stats2"        },
+                                               { LDAP_DEBUG_SHELL,     "Shell"         },
+                                               { LDAP_DEBUG_PARSE,     "Parse"         },
+                                               { LDAP_DEBUG_CACHE,     "Cache"         },
+                                               { LDAP_DEBUG_INDEX,     "Index"         },
+                                               { -1,                   "Any"           },
+                                               { 0,                    NULL            }
+                                       };
+                                       int     j;
+
+                                       for ( j = 0; int_2_level[j].s; j++ ) {
+                                               if ( strcasecmp( cargv[i], int_2_level[j].s ) == 0 ) {
+                                                       level = int_2_level[j].i;
+                                                       break;
+                                               }
+                                       }
+
+                                       if ( int_2_level[j].s == NULL ) {
+#ifdef NEW_LOGGING
+                                               LDAP_LOG( CONFIG, CRIT, 
+                                                       "%s: line %d: unknown level \"%s\" "
+                                                       "in \"loglevel <level> [...]\" line.\n",
+                                                       fname, lineno , cargv[i] );
+#else
+                                               Debug( LDAP_DEBUG_ANY,
+                                                       "%s: line %d: unknown level \"%s\" "
+                                                       "in \"loglevel <level> [...]\" line.\n",
+                                                       fname, lineno , cargv[i] );
+#endif
+                                               return( 1 );
+                                       }
+                               }
+
+                               ldap_syslog |= level;
                        }
 
                /* list of sync replication information in this backend (slave only) */
@@ -1761,12 +2046,25 @@ read_config( const char *fname, int depth )
                                            "a database definition.\n", fname, lineno, 0);
 #endif
                                return 1;
-                       } else {
-                               if ( add_syncrepl( be, cargv, cargc )) {
-                                       return 1;
-                               }
+
+                       } else if ( SLAP_SHADOW( be )) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, INFO, 
+                                       "%s: line %d: syncrepl: database already shadowed.\n",
+                                       fname, lineno, 0);
+#else
+                               Debug( LDAP_DEBUG_ANY,
+                                       "%s: line %d: syncrepl: database already shadowed.\n",
+                                       fname, lineno, 0);
+#endif
+                               return 1;
+
+                       } else if ( add_syncrepl( be, cargv, cargc )) {
+                               return 1;
                        }
 
+                       SLAP_DBFLAGS(be) |= ( SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SYNC_SHADOW );
+
                /* list of replicas of the data in this backend (master only) */
                } else if ( strcasecmp( cargv[0], "replica" ) == 0 ) {
                        if ( cargc < 2 ) {
@@ -1939,7 +2237,10 @@ read_config( const char *fname, int depth )
                                }
                        }
 
-               /* dn of master entity allowed to write to replica */
+               } else if ( strcasecmp( cargv[0], "replicationInterval" ) == 0 ) {
+                       /* ignore */
+
+               /* dn of slave entity allowed to write to replica */
                } else if ( strcasecmp( cargv[0], "updatedn" ) == 0 ) {
                        if ( cargc < 2 ) {
 #ifdef NEW_LOGGING
@@ -1967,6 +2268,18 @@ read_config( const char *fname, int depth )
 #endif
                                return 1;
 
+                       } else if ( SLAP_SHADOW(be) ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, INFO, 
+                                       "%s: line %d: updatedn: database already shadowed.\n",
+                                       fname, lineno, 0);
+#else
+                               Debug( LDAP_DEBUG_ANY,
+                                       "%s: line %d: updatedn: database already shadowed.\n",
+                                       fname, lineno, 0);
+#endif
+                               return 1;
+
                        } else {
                                struct berval dn;
 
@@ -1988,7 +2301,9 @@ read_config( const char *fname, int depth )
 #endif
                                        return 1;
                                }
+
                        }
+                       SLAP_DBFLAGS(be) |= ( SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SLURP_SHADOW );
 
                } else if ( strcasecmp( cargv[0], "updateref" ) == 0 ) {
                        if ( cargc < 2 ) {
@@ -2016,14 +2331,14 @@ read_config( const char *fname, int depth )
 #endif
                                return 1;
 
-                       } else if ( !be->be_update_ndn.bv_len ) {
+                       } else if ( !SLAP_SHADOW(be) ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG( CONFIG, INFO, "%s: line %d: "
-                                       "updateref line must come after updatedn.\n",
+                                       "updateref line must come after syncrepl or updatedn.\n",
                                        fname, lineno , 0 );
 #else
                                Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-                                       "updateref line must after updatedn.\n",
+                                       "updateref line must after syncrepl or updatedn.\n",
                                    fname, lineno, 0 );
 #endif
                                return 1;
@@ -2044,8 +2359,9 @@ read_config( const char *fname, int depth )
 
                        vals[0].bv_val = cargv[1];
                        vals[0].bv_len = strlen( vals[0].bv_val );
-                       if( value_add( &be->be_update_refs, vals ) )
+                       if( value_add( &be->be_update_refs, vals ) ) {
                                return LDAP_OTHER;
+                       }
 
                /* replication log file to which changes are appended */
                } else if ( strcasecmp( cargv[0], "replogfile" ) == 0 ) {
@@ -2111,18 +2427,36 @@ read_config( const char *fname, int depth )
 
                                return( 1 );
                        }
+
+                       if ( be == NULL ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, INFO, "%s: line %d: lastmod"
+                                       " line must appear inside a database definition\n",
+                                       fname, lineno , 0 );
+#else
+                               Debug( LDAP_DEBUG_ANY, "%s: line %d: lastmod"
+                                       " line must appear inside a database definition\n",
+                                       fname, lineno, 0 );
+#endif
+                               return 1;
+
+                       } else if ( SLAP_NOLASTMODCMD(be) ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, INFO, "%s: line %d: lastmod"
+                                       " not available for %s database\n",
+                                       fname, lineno , be->bd_info->bi_type );
+#else
+                               Debug( LDAP_DEBUG_ANY, "%s: line %d: lastmod"
+                                       " not available for %s databases\n",
+                                       fname, lineno, be->bd_info->bi_type );
+#endif
+                               return 1;
+                       }
+
                        if ( strcasecmp( cargv[1], "on" ) == 0 ) {
-                               if ( be ) {
-                                       be->be_flags &= ~SLAP_BFLAG_NOLASTMOD;
-                               } else {
-                                       lastmod = 1;
-                               }
+                               SLAP_DBFLAGS(be) &= ~SLAP_DBFLAG_NOLASTMOD;
                        } else {
-                               if ( be ) {
-                                       be->be_flags |= SLAP_BFLAG_NOLASTMOD;
-                               } else {
-                                       lastmod = 0;
-                               }
+                               SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NOLASTMOD;
                        }
 
 #ifdef SIGHUP
@@ -2404,8 +2738,17 @@ read_config( const char *fname, int depth )
                        }
 #endif /* notdef */
 
-                       if ( netscape_plugin( be, fname, lineno, cargc, cargv ) 
-                                       != LDAP_SUCCESS ) {
+                       if ( slapi_int_read_config( be, fname, lineno, cargc, cargv ) 
+                                       != LDAP_SUCCESS )
+                       {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, INFO,
+                                               "%s: line %d: SLAPI config read failed.\n",
+                                               fname, lineno, 0 );
+#else
+                               Debug( LDAP_DEBUG_ANY, "%s: line %d: SLAPI "
+                                               "config read failed.\n", fname, lineno, 0 );
+#endif
                                return( 1 );
                        }
                        slapi_plugins_used++;
@@ -2451,57 +2794,82 @@ read_config( const char *fname, int depth )
                /* pass anything else to the current backend info/db config routine */
                } else {
                        if ( bi != NULL ) {
-                               if ( bi->bi_config == 0 ) {
+                               if ( bi->bi_config ) {
+                                       rc = (*bi->bi_config)( bi, fname, lineno, cargc, cargv );
+
+                                       switch ( rc ) {
+                                       case 0:
+                                               break;
+
+                                       case SLAP_CONF_UNKNOWN:
 #ifdef NEW_LOGGING
-                                       LDAP_LOG( CONFIG, INFO, 
-                                               "%s: line %d: unknown directive \"%s\" inside "
-                                               "backend info definition (ignored).\n",
-                                               fname, lineno, cargv[0] );
+                                               LDAP_LOG( CONFIG, INFO, 
+                                                       "%s: line %d: unknown directive \"%s\" inside "
+                                                       "backend info definition (ignored).\n",
+                                                       fname, lineno, cargv[0] );
 #else
-                                       Debug( LDAP_DEBUG_ANY,
+                                               Debug( LDAP_DEBUG_ANY,
 "%s: line %d: unknown directive \"%s\" inside backend info definition (ignored)\n",
-                                               fname, lineno, cargv[0] );
+                                                       fname, lineno, cargv[0] );
 #endif
+                                               break;
 
-                               } else {
-                                       if ( (*bi->bi_config)( bi, fname, lineno, cargc, cargv )
-                                               != 0 )
-                                       {
-                                               return( 1 );
+                                       default:
+                                               return 1;
                                        }
                                }
+
                        } else if ( be != NULL ) {
-                               if ( be->be_config == 0 ) {
+                               if ( be->be_config ) {
+                                       rc = (*be->be_config)( be, fname, lineno, cargc, cargv );
+
+                                       switch ( rc ) {
+                                       case 0:
+                                               break;
+
+                                       case SLAP_CONF_UNKNOWN:
 #ifdef NEW_LOGGING
-                                       LDAP_LOG( CONFIG, INFO, 
-                                               "%s: line %d: uknown directive \"%s\" inside "
-                                               "backend database definition (ignored).\n",
-                                               fname, lineno, cargv[0] );
+                                               LDAP_LOG( CONFIG, INFO, 
+                                                       "%s: line %d: unknown directive \"%s\" inside "
+                                                       "backend database definition (ignored).\n",
+                                                       fname, lineno, cargv[0] );
 #else
-                                       Debug( LDAP_DEBUG_ANY,
+                                               Debug( LDAP_DEBUG_ANY,
 "%s: line %d: unknown directive \"%s\" inside backend database definition (ignored)\n",
-                                       fname, lineno, cargv[0] );
+                                                       fname, lineno, cargv[0] );
 #endif
+                                               break;
 
-                               } else {
-                                       if ( (*be->be_config)( be, fname, lineno, cargc, cargv )
-                                               != 0 )
-                                       {
-                                               return( 1 );
+                                       default:
+                                               return 1;
                                        }
                                }
+
                        } else {
+                               if ( frontendDB->be_config ) {
+                                       rc = (*frontendDB->be_config)( frontendDB, fname, lineno, cargc, cargv );
+
+                                       switch ( rc ) {
+                                       case 0:
+                                               break;
+
+                                       case SLAP_CONF_UNKNOWN:
 #ifdef NEW_LOGGING
-                               LDAP_LOG( CONFIG, INFO, 
-                                       "%s: line %d: unknown directive \"%s\" outside backend "
-                                       "info and database definitions (ignored).\n",
-                                       fname, lineno, cargv[0] );
+                                               LDAP_LOG( CONFIG, INFO, 
+                                                       "%s: line %d: unknown directive \"%s\" inside "
+                                                       "global database definition (ignored).\n",
+                                                       fname, lineno, cargv[0] );
 #else
-                               Debug( LDAP_DEBUG_ANY,
-"%s: line %d: unknown directive \"%s\" outside backend info and database definitions (ignored)\n",
-                                   fname, lineno, cargv[0] );
+                                               Debug( LDAP_DEBUG_ANY,
+"%s: line %d: unknown directive \"%s\" inside global database definition (ignored)\n",
+                                                       fname, lineno, cargv[0] );
 #endif
+                                               break;
 
+                                       default:
+                                               return 1;
+                                       }
+                               }
                        }
                }
                free( saveline );
@@ -2510,10 +2878,10 @@ read_config( const char *fname, int depth )
 
        if ( depth == 0 ) ch_free( cargv );
 
-       if ( !global_schemadn.bv_val ) {
+       if ( BER_BVISNULL( &frontendDB->be_schemadn ) ) {
                ber_str2bv( SLAPD_SCHEMA_DN, sizeof(SLAPD_SCHEMA_DN)-1, 1,
-                       &global_schemadn );
-               dnNormalize( 0, NULL, NULL, &global_schemadn, &global_schemandn, NULL );
+                       &frontendDB->be_schemadn );
+               dnNormalize( 0, NULL, NULL, &frontendDB->be_schemadn, &frontendDB->be_schemandn, NULL );
        }
 
        if ( load_ucdata( NULL ) < 0 ) return 1;
@@ -2709,6 +3077,7 @@ fp_getline_init( int *lineno )
 static int
 load_ucdata( char *path )
 {
+#if 0
        static int loaded = 0;
        int err;
        
@@ -2729,22 +3098,32 @@ load_ucdata( char *path )
        }
        loaded = 1;
        return( 1 );
+#else
+       /* ucdata is now hardcoded */
+       return( 0 );
+#endif
 }
 
 void
 config_destroy( )
 {
        ucdata_unload( UCDATA_ALL );
-       free( global_schemandn.bv_val );
-       free( global_schemadn.bv_val );
+       if ( frontendDB ) {
+               /* NOTE: in case of early exit, frontendDB can be NULL */
+               if ( frontendDB->be_schemandn.bv_val )
+                       free( frontendDB->be_schemandn.bv_val );
+               if ( frontendDB->be_schemadn.bv_val )
+                       free( frontendDB->be_schemadn.bv_val );
+               if ( frontendDB->be_acl )
+                       acl_destroy( frontendDB->be_acl, NULL );
+       }
        free( line );
        if ( slapd_args_file )
                free ( slapd_args_file );
        if ( slapd_pid_file )
                free ( slapd_pid_file );
        if ( default_passwd_hash )
-               free( default_passwd_hash );
-       acl_destroy( global_acl, NULL );
+               ldap_charray_free( default_passwd_hash );
 }
 
 static int
@@ -2755,21 +3134,11 @@ add_syncrepl(
 )
 {
        syncinfo_t *si;
+       syncinfo_t *si_entry;
+       int     rc = 0;
+       int duplicated_replica_id = 0;
 
-       if ( be->be_syncinfo ) {
-#ifdef NEW_LOGGING
-               LDAP_LOG( CONFIG, INFO, 
-                           "add_syncrepl: multiple syncrepl lines in a database "
-                               "definition are yet to be supported.\n", 0, 0, 0 );
-#else
-               Debug( LDAP_DEBUG_ANY,
-                           "add_syncrepl: multiple syncrepl lines in a database "
-                               "definition are yet to be supported.\n", 0, 0, 0 );
-#endif
-               return 1;
-       }
-
-       si = be->be_syncinfo = (syncinfo_t *) ch_calloc( 1, sizeof( syncinfo_t ) );
+       si = (syncinfo_t *) ch_calloc( 1, sizeof( syncinfo_t ) );
 
        if ( si == NULL ) {
 #ifdef NEW_LOGGING
@@ -2786,39 +3155,89 @@ add_syncrepl(
        }
        si->si_bindmethod = LDAP_AUTH_SIMPLE;
        si->si_schemachecking = 0;
-       ber_str2bv( "(objectclass=*)", sizeof("(objectclass=*)")-1, 0,
+       ber_str2bv( "(objectclass=*)", STRLENOF("(objectclass=*)"), 0,
                &si->si_filterstr );
-       if ( be->be_suffix && be->be_suffix[0].bv_val ) {
-               ber_dupbv( &si->si_base, &be->be_nsuffix[0] );
-       }
+       si->si_base.bv_val = NULL;
        si->si_scope = LDAP_SCOPE_SUBTREE;
        si->si_attrsonly = 0;
        si->si_attrs = (char **) ch_calloc( 1, sizeof( char * ));
        si->si_attrs[0] = NULL;
+       si->si_exattrs = (char **) ch_calloc( 1, sizeof( char * ));
+       si->si_exattrs[0] = NULL;
        si->si_type = LDAP_SYNC_REFRESH_ONLY;
        si->si_interval = 86400;
+       si->si_retryinterval = 0;
+       si->si_retrynum_init = 0;
+       si->si_retrynum = 0;
        si->si_syncCookie.ctxcsn = NULL;
        si->si_syncCookie.octet_str = NULL;
        si->si_syncCookie.sid = -1;
        si->si_manageDSAit = 0;
-       si->si_tlimit = -1;
-       si->si_slimit = -1;
+       si->si_tlimit = 0;
+       si->si_slimit = 0;
        si->si_syncUUID_ndn.bv_val = NULL;
        si->si_syncUUID_ndn.bv_len = 0;
-       si->si_sync_mode = LDAP_SYNC_STATE_MODE;
 
        si->si_presentlist = NULL;
        LDAP_LIST_INIT( &si->si_nonpresentlist );
 
-       if ( parse_syncrepl_line( cargv, cargc, si ) < 0 ) {
+       rc = parse_syncrepl_line( cargv, cargc, si );
+
+       LDAP_STAILQ_FOREACH( si_entry, &be->be_syncinfo, si_next ) {
+               if ( si->si_rid == si_entry->si_rid ) {
+#ifdef NEW_LOGGING
+                       LDAP_LOG( CONFIG, ERR,
+                               "add_syncrepl: duplicated replica id\n", 0, 0,0 );
+#else
+                       Debug( LDAP_DEBUG_ANY,
+                               "add_syncrepl: duplicated replica id\n",0, 0, 0 );
+#endif
+                       duplicated_replica_id = 1;
+                       break;
+               }
+       }
+
+       if ( rc < 0 || duplicated_replica_id ) {
+               syncinfo_t *si_entry;
                /* Something bad happened - back out */
 #ifdef NEW_LOGGING
                LDAP_LOG( CONFIG, ERR, "failed to add syncinfo\n", 0, 0,0 );
 #else
                Debug( LDAP_DEBUG_ANY, "failed to add syncinfo\n", 0, 0, 0 );
 #endif
-               free( si );
-               be->be_syncinfo = NULL;
+
+               /* If error, remove all syncinfo */
+               LDAP_STAILQ_FOREACH( si_entry, &be->be_syncinfo, si_next ) {
+                       if ( si_entry->si_updatedn.bv_val ) {
+                               ch_free( si->si_updatedn.bv_val );
+                       }
+                       if ( si_entry->si_filterstr.bv_val ) {
+                               ch_free( si->si_filterstr.bv_val );
+                       }
+                       if ( si_entry->si_attrs ) {
+                               int i = 0;
+                               while ( si_entry->si_attrs[i] != NULL ) {
+                                       ch_free( si_entry->si_attrs[i] );
+                                       i++;
+                               }
+                               ch_free( si_entry->si_attrs );
+                       }
+                       if ( si_entry->si_exattrs ) {
+                               int i = 0;
+                               while ( si_entry->si_exattrs[i] != NULL ) {
+                                       ch_free( si_entry->si_exattrs[i] );
+                                       i++;
+                               }
+                               ch_free( si_entry->si_exattrs );
+                       }
+               }
+
+               while ( !LDAP_STAILQ_EMPTY( &be->be_syncinfo )) {
+                       si_entry = LDAP_STAILQ_FIRST( &be->be_syncinfo );
+                       LDAP_STAILQ_REMOVE_HEAD( &be->be_syncinfo, si_next );
+                       ch_free( si_entry );
+               }
+               LDAP_STAILQ_INIT( &be->be_syncinfo );
                return 1;
        } else {
 #ifdef NEW_LOGGING
@@ -2831,14 +3250,15 @@ add_syncrepl(
                        si->si_provideruri == NULL ? "(null)" : si->si_provideruri, 0, 0 );
 #endif
                if ( !si->si_schemachecking ) {
-                       be->be_flags |= SLAP_BFLAG_NO_SCHEMA_CHECK;
+                       SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK;
                }
                si->si_be = be;
+               LDAP_STAILQ_INSERT_TAIL( &be->be_syncinfo, si, si_next );
                return 0;
        }
 }
 
-#define IDSTR                  "id"
+#define IDSTR                  "rid"
 #define PROVIDERSTR            "provider"
 #define SUFFIXSTR              "suffix"
 #define UPDATEDNSTR            "updatedn"
@@ -2863,6 +3283,7 @@ add_syncrepl(
 #define SCOPESTR               "scope"
 #define ATTRSSTR               "attrs"
 #define ATTRSONLYSTR   "attrsonly"
+#define EXATTRSSTR             "exattrs"
 #define TYPESTR                        "type"
 #define INTERVALSTR            "interval"
 #define LASTMODSTR             "lastmod"
@@ -2873,6 +3294,8 @@ add_syncrepl(
 #define SLIMITSTR              "sizelimit"
 #define TLIMITSTR              "timelimit"
 
+#define RETRYSTR               "retry"
+
 #define GOT_ID                 0x0001
 #define GOT_PROVIDER   0x0002
 #define GOT_METHOD             0x0004
@@ -2901,7 +3324,7 @@ parse_syncrepl_line(
                                         "syncrepl id %d is out of range [0..999]\n", tmp );
                                return -1;
                        }
-                       si->si_id = tmp;
+                       si->si_rid = tmp;
                        gots |= GOT_ID;
                } else if ( !strncasecmp( cargv[ i ], PROVIDERSTR,
                                        sizeof( PROVIDERSTR ) - 1 )) {
@@ -2987,9 +3410,9 @@ parse_syncrepl_line(
                                SCHEMASTR, sizeof( SCHEMASTR ) - 1 ) )
                {
                        val = cargv[ i ] + sizeof( SCHEMASTR );
-                       if ( !strncasecmp( val, "on", sizeof( "on" ) - 1 )) {
+                       if ( !strncasecmp( val, "on", STRLENOF( "on" ) )) {
                                si->si_schemachecking = 1;
-                       } else if ( !strncasecmp( val, "off", sizeof( "off" ) - 1 ) ) {
+                       } else if ( !strncasecmp( val, "off", STRLENOF( "off" ) ) ) {
                                si->si_schemachecking = 0;
                        } else {
                                si->si_schemachecking = 1;
@@ -3004,7 +3427,9 @@ parse_syncrepl_line(
                {
                        struct berval bv;
                        val = cargv[ i ] + sizeof( SEARCHBASESTR );
-                       ch_free( si->si_base.bv_val );
+                       if ( si->si_base.bv_val ) {
+                               ch_free( si->si_base.bv_val );
+                       }
                        ber_str2bv( val, 0, 0, &bv );
                        if ( dnNormalize( 0, NULL, NULL, &bv, &si->si_base, NULL )) {
                                fprintf( stderr, "Invalid base DN \"%s\"\n", val );
@@ -3014,11 +3439,17 @@ parse_syncrepl_line(
                        SCOPESTR, sizeof( SCOPESTR ) - 1 ) )
                {
                        val = cargv[ i ] + sizeof( SCOPESTR );
-                       if ( !strncasecmp( val, "base", sizeof( "base" ) - 1 )) {
+                       if ( !strncasecmp( val, "base", STRLENOF( "base" ) )) {
                                si->si_scope = LDAP_SCOPE_BASE;
-                       } else if ( !strncasecmp( val, "one", sizeof( "one" ) - 1 )) {
+                       } else if ( !strncasecmp( val, "one", STRLENOF( "one" ) )) {
                                si->si_scope = LDAP_SCOPE_ONELEVEL;
-                       } else if ( !strncasecmp( val, "sub", sizeof( "sub" ) - 1 )) {
+#ifdef LDAP_SCOPE_SUBORDINATE
+                       } else if ( !strcasecmp( val, "subordinate" ) ||
+                               !strcasecmp( val, "children" ))
+                       {
+                               si->si_scope = LDAP_SCOPE_SUBORDINATE;
+#endif
+                       } else if ( !strncasecmp( val, "sub", STRLENOF( "sub" ) )) {
                                si->si_scope = LDAP_SCOPE_SUBTREE;
                        } else {
                                fprintf( stderr, "Error: parse_syncrepl_line: "
@@ -3034,14 +3465,19 @@ parse_syncrepl_line(
                {
                        val = cargv[ i ] + sizeof( ATTRSSTR );
                        str2clist( &si->si_attrs, val, "," );
+               } else if ( !strncasecmp( cargv[ i ],
+                       EXATTRSSTR, sizeof( EXATTRSSTR ) - 1 ) )
+               {
+                       val = cargv[ i ] + sizeof( EXATTRSSTR );
+                       str2clist( &si->si_exattrs, val, "," );
                } else if ( !strncasecmp( cargv[ i ],
                        TYPESTR, sizeof( TYPESTR ) - 1 ) )
                {
                        val = cargv[ i ] + sizeof( TYPESTR );
-                       if ( !strncasecmp( val, "refreshOnly", sizeof("refreshOnly")-1 )) {
+                       if ( !strncasecmp( val, "refreshOnly", STRLENOF("refreshOnly") )) {
                                si->si_type = LDAP_SYNC_REFRESH_ONLY;
                        } else if ( !strncasecmp( val, "refreshAndPersist",
-                               sizeof("refreshAndPersist")-1 ))
+                               STRLENOF("refreshAndPersist") ))
                        {
                                si->si_type = LDAP_SYNC_REFRESH_AND_PERSIST;
                                si->si_interval = 60;
@@ -3104,6 +3540,53 @@ parse_syncrepl_line(
                                        (long) si->si_interval);
                                return 1;
                        }
+               } else if ( !strncasecmp( cargv[ i ],
+                       RETRYSTR, sizeof( RETRYSTR ) - 1 ) )
+               {
+                       char *str;
+                       char **retry_list;
+                       int j, k, n;
+
+                       val = cargv[ i ] + sizeof( RETRYSTR );
+                       retry_list = (char **) ch_calloc( 1, sizeof( char * ));
+                       retry_list[0] = NULL;
+
+                       str2clist( &retry_list, val, " ,\t" );
+
+                       for ( k = 0; retry_list && retry_list[k]; k++ ) ;
+                       n = k / 2;
+                       if ( k % 2 ) {
+                               fprintf( stderr,
+                                               "Error: incomplete syncrepl retry list\n" );
+                               for ( k = 0; retry_list && retry_list[k]; k++ ) {
+                                       ch_free( retry_list[k] );
+                               }
+                               ch_free( retry_list );
+                               exit( EXIT_FAILURE );
+                       }
+                       si->si_retryinterval = (time_t *) ch_calloc( n + 1, sizeof( time_t ));
+                       si->si_retrynum = (int *) ch_calloc( n + 1, sizeof( int ));
+                       si->si_retrynum_init = (int *) ch_calloc( n + 1, sizeof( int ));
+                       for ( j = 0; j < n; j++ ) {
+                               si->si_retryinterval[j] = atoi( retry_list[j*2] );
+                               if ( *retry_list[j*2+1] == '+' ) {
+                                       si->si_retrynum_init[j] = -1;
+                                       si->si_retrynum[j] = -1;
+                                       j++;
+                                       break;
+                               } else {
+                                       si->si_retrynum_init[j] = atoi( retry_list[j*2+1] );
+                                       si->si_retrynum[j] = atoi( retry_list[j*2+1] );
+                               }
+                       }
+                       si->si_retrynum_init[j] = -2;
+                       si->si_retrynum[j] = -2;
+                       si->si_retryinterval[j] = 0;
+                       
+                       for ( k = 0; retry_list && retry_list[k]; k++ ) {
+                               ch_free( retry_list[k] );
+                       }
+                       ch_free( retry_list );
                } else if ( !strncasecmp( cargv[ i ],
                        MANAGEDSAITSTR, sizeof( MANAGEDSAITSTR ) - 1 ) )
                {