]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/config.c
Fix bad eos in dead code.
[openldap] / servers / slapd / config.c
index 2366118e90a55076ba2d6ee76d12d8578edae927..cf25999f9a74f9d5041849be30717cb86cfb450f 100644 (file)
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Copyright 1998-2005 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -54,7 +54,8 @@ struct slap_limits_set deflimit = {
        0,
        -1,                             /* no limit on unchecked size */
        0,                              /* page limit */
-       0                               /* hide number of entries left */
+       0,                              /* hide number of entries left */
+       0                               /* number of total entries returned by pagedResults equal to hard limit */
 };
 
 AccessControl  *global_acl = NULL;
@@ -70,14 +71,14 @@ int         global_idletimeout = 0;
 char   *global_host = NULL;
 char   *global_realm = NULL;
 char           *ldap_srvtab = "";
-char           *default_passwd_hash = NULL;
+char           **default_passwd_hash = NULL;
 int            cargc = 0, cargv_size = 0;
 char   **cargv;
-struct berval default_search_base = { 0, NULL };
-struct berval default_search_nbase = { 0, NULL };
+struct berval default_search_base = BER_BVNULL;
+struct berval default_search_nbase = BER_BVNULL;
 unsigned               num_subordinates = 0;
-struct berval global_schemadn = { 0, NULL };
-struct berval global_schemandn = { 0, NULL };
+struct berval global_schemadn = BER_BVNULL;
+struct berval global_schemandn = BER_BVNULL;
 
 ber_len_t sockbuf_max_incoming = SLAP_SB_MAX_INCOMING_DEFAULT;
 ber_len_t sockbuf_max_incoming_auth= SLAP_SB_MAX_INCOMING_AUTH;
@@ -96,15 +97,15 @@ int use_reverse_lookup = 0;
 int slapi_plugins_used = 0;
 #endif
 
-static char    *fp_getline(FILE *fp, int *lineno);
-static void    fp_getline_init(int *lineno);
-static int     fp_parse_line(int lineno, char *line);
+static char *fp_getline(FILE *fp, int *lineno);
+static void fp_getline_init(int *lineno);
+static int fp_parse_line(int lineno, char *line);
 
 static char    *strtok_quote(char *line, char *sep);
-static int      load_ucdata(char *path);
+static int load_ucdata(char *path);
 
-static int     add_syncrepl LDAP_P(( Backend *, char **, int ));
-static int      parse_syncrepl_line LDAP_P(( char **, int, syncinfo_t *));
+static int add_syncrepl LDAP_P(( Backend *, char **, int ));
+static int parse_syncrepl_line LDAP_P(( char **, int, syncinfo_t *));
 
 int
 read_config( const char *fname, int depth )
@@ -117,9 +118,10 @@ read_config( const char *fname, int depth )
        struct berval vals[2];
        char *replicahost;
        LDAPURLDesc *ludp;
-       static int lastmod = 1;
        static BackendInfo *bi = NULL;
        static BackendDB        *be = NULL;
+       char    *next;
+
 
        vals[1].bv_val = NULL;
 
@@ -259,7 +261,7 @@ read_config( const char *fname, int depth )
                        if ( cargc < 2 ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG( CONFIG, CRIT, 
-                                       "%s: line %d: missing level in \"concurrency <level\" "
+                                       "%s: line %d: missing level in \"concurrency <level>\" "
                                        " line\n", fname, lineno, 0 );
 #else
                                Debug( LDAP_DEBUG_ANY,
@@ -270,7 +272,19 @@ read_config( const char *fname, int depth )
                                return( 1 );
                        }
 
-                       c = atoi( cargv[1] );
+                       c = strtol( cargv[1], &next, 10 );
+                       if ( next == NULL || next[0] != '\0' ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, CRIT, 
+                                       "%s: line %d: unable to parse level \"%s\" in \"concurrency <level>\" "
+                                       " line\n", fname, lineno, cargv[1] );
+#else
+                               Debug( LDAP_DEBUG_ANY,
+           "%s: line %d: unable to parse level \"%s\" in \"concurrency <level>\" line\n",
+                                   fname, lineno, cargv[1] );
+#endif
+                               return( 1 );
+                       }
 
                        if( c < 1 ) {
 #ifdef NEW_LOGGING
@@ -541,7 +555,19 @@ read_config( const char *fname, int depth )
                                return( 1 );
                        }
 
-                       c = atoi( cargv[1] );
+                       c = strtol( cargv[1], &next, 10 );
+                       if (next == NULL || next[0] != '\0' ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, CRIT, 
+                                       "%s: line %d: unable to parse count \"%s\" in \"threads <count>\" line\n",
+                                       fname, lineno, cargv[1] );
+#else
+                               Debug( LDAP_DEBUG_ANY,
+           "%s: line %d: unable to parse count \"%s\" in \"threads <count>\" line\n",
+                                   fname, lineno, cargv[1] );
+#endif
+                               return( 1 );
+                       }
 
                        if( c < 0 ) {
 #ifdef NEW_LOGGING
@@ -635,22 +661,34 @@ read_config( const char *fname, int depth )
                                return 1;
 
                        }
-
-                       if ( lutil_passwd_scheme( cargv[1] ) == 0 ) {
+                       for(i = 1; i < cargc; i++) {
+                               if ( lutil_passwd_scheme( cargv[i] ) == 0 ) {
+#ifdef NEW_LOGGING
+                                       LDAP_LOG( CONFIG, CRIT, 
+                                               "%s: line %d: password scheme \"%s\" not available\n",
+                                               fname, lineno, cargv[i] );
+#else
+                                       Debug( LDAP_DEBUG_ANY,
+                                               "%s: line %d: password scheme \"%s\" not available\n",
+                                               fname, lineno, cargv[i] );
+#endif
+                               } else {
+                                       ldap_charray_add( &default_passwd_hash, cargv[i] );
+                               }
+                       }
+                       if( !default_passwd_hash ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG( CONFIG, CRIT, 
-                                          "%s: line %d: password scheme \"%s\" not available\n",
-                                          fname, lineno, cargv[1] );
+                                       "%s: line %d: no valid hashes found\n",
+                                       fname, lineno, 0 );
 #else
                                Debug( LDAP_DEBUG_ANY,
-                                       "%s: line %d: password scheme \"%s\" not available\n",
-                                       fname, lineno, cargv[1] );
-#endif
+                                       "%s: line %d: no valid hashes found\n",
+                                       fname, lineno, 0 );
                                return 1;
+#endif
                        }
 
-                       default_passwd_hash = ch_strdup( cargv[1] );
-
                } else if ( strcasecmp( cargv[0], "password-crypt-salt-format" ) == 0 ) 
                {
                        if ( cargc < 2 ) {
@@ -674,6 +712,15 @@ read_config( const char *fname, int depth )
                } else if ( strncasecmp( cargv[0], "sasl", 4 ) == 0 ) {
                        if ( slap_sasl_config( cargc, cargv, line, fname, lineno ) )
                                return 1;
+#ifdef SLAP_X_SASL_REWRITE
+               /* use authid rewrite instead of sasl regexp */
+               } else if ( strncasecmp( cargv[0], "authid-rewrite", sizeof("authid-rewrite") - 1 ) == 0 ) {
+                       int rc = slap_sasl_rewrite_config( fname, lineno,
+                                       cargc, cargv );
+                       if ( rc ) {
+                               return rc;
+                       }
+#endif /* SLAP_X_SASL_REWRITE */
 
                } else if ( strcasecmp( cargv[0], "schemadn" ) == 0 ) {
                        struct berval dn;
@@ -772,7 +819,7 @@ read_config( const char *fname, int depth )
 
                        for ( i = 1; i < cargc; i++ ) {
                                if ( strncasecmp( cargv[i], "size", 4 ) == 0 ) {
-                                       rc = parse_limit( cargv[i], lim );
+                                       rc = limits_parse_one( cargv[i], lim );
                                        if ( rc ) {
 #ifdef NEW_LOGGING
                                                LDAP_LOG( CONFIG, CRIT, 
@@ -794,8 +841,6 @@ read_config( const char *fname, int depth )
                                        if ( strcasecmp( cargv[i], "unlimited" ) == 0 ) {
                                                lim->lms_s_soft = -1;
                                        } else {
-                                               char *next;
-
                                                lim->lms_s_soft = strtol( cargv[i] , &next, 0 );
                                                if ( next == cargv[i] ) {
 #ifdef NEW_LOGGING
@@ -852,7 +897,7 @@ read_config( const char *fname, int depth )
 
                        for ( i = 1; i < cargc; i++ ) {
                                if ( strncasecmp( cargv[i], "time", 4 ) == 0 ) {
-                                       rc = parse_limit( cargv[i], lim );
+                                       rc = limits_parse_one( cargv[i], lim );
                                        if ( rc ) {
 #ifdef NEW_LOGGING
                                                LDAP_LOG( CONFIG, CRIT, 
@@ -874,8 +919,6 @@ read_config( const char *fname, int depth )
                                        if ( strcasecmp( cargv[i], "unlimited" ) == 0 ) {
                                                lim->lms_t_soft = -1;
                                        } else {
-                                               char *next;
-
                                                lim->lms_t_soft = strtol( cargv[i] , &next, 0 );
                                                if ( next == cargv[i] ) {
 #ifdef NEW_LOGGING
@@ -920,7 +963,7 @@ read_config( const char *fname, int depth )
                                return( 1 );
                        }
 
-                       if ( parse_limits( be, fname, lineno, cargc, cargv ) ) {
+                       if ( limits_parse( be, fname, lineno, cargc, cargv ) ) {
                                return( 1 );
                        }
 
@@ -939,7 +982,7 @@ read_config( const char *fname, int depth )
                                return 1;
 
                        } else {
-                               be->be_flags |= SLAP_BFLAG_GLUE_SUBORDINATE;
+                               SLAP_DBFLAGS(be) |= SLAP_DBFLAG_GLUE_SUBORDINATE;
                                num_subordinates++;
                        }
 
@@ -1110,25 +1153,38 @@ read_config( const char *fname, int depth )
 "%s: line %d: depth line must appear inside a database definition.\n",
                                    fname, lineno, 0 );
 #endif
-                                                       return 1;
+                               return 1;
+                       }
 
-                       } else if ((i = atoi(cargv[1])) < 0) {
+                      i = strtol( cargv[1], &next, 10 );
+                      if ( next == NULL || next[0] != '\0' ) {
+#ifdef NEW_LOGGING
+                              LDAP_LOG( CONFIG, INFO, 
+                                         "%s: line %d: unable to parse depth \"%s\" in \"maxDerefDepth <depth>\" "
+                                         "line.\n", fname, lineno, cargv[1] );
+#else
+                               Debug( LDAP_DEBUG_ANY,
+                                         "%s: line %d: unable to parse depth \"%s\" in \"maxDerefDepth <depth>\" "
+                                         "line.\n", fname, lineno, cargv[1] );
+#endif
+                               return 1;
+                      }
+
+                      if (i < 0) {
 #ifdef NEW_LOGGING
                               LDAP_LOG( CONFIG, INFO, 
                                          "%s: line %d: depth must be positive.\n",
-                                         fname, lineno ,0 );
+                                         fname, lineno0 );
 #else
                                Debug( LDAP_DEBUG_ANY,
 "%s: line %d: depth must be positive.\n",
                                    fname, lineno, 0 );
 #endif
-                                                       return 1;
-
+                               return 1;
 
-                       } else {
-                           be->be_max_deref_depth = i;
-                                          }
 
+                       }
+                       be->be_max_deref_depth = i;
 
                /* set magic "root" dn for this database */
                } else if ( strcasecmp( cargv[0], "rootdn" ) == 0 ) {
@@ -1268,7 +1324,7 @@ read_config( const char *fname, int depth )
                } else if ( strcasecmp( cargv[0], "allows" ) == 0 ||
                        strcasecmp( cargv[0], "allow" ) == 0 )
                {
-                       slap_mask_t     allows;
+                       slap_mask_t     allows = 0;
 
                        if ( be != NULL ) {
 #ifdef NEW_LOGGING
@@ -1297,8 +1353,6 @@ read_config( const char *fname, int depth )
                                return( 1 );
                        }
 
-                       allows = 0;
-
                        for( i=1; i < cargc; i++ ) {
                                if( strcasecmp( cargv[i], "bind_v2" ) == 0 ) {
                                        allows |= SLAP_ALLOW_BIND_V2;
@@ -1312,28 +1366,28 @@ read_config( const char *fname, int depth )
                                } else if( strcasecmp( cargv[i], "update_anon" ) == 0 ) {
                                        allows |= SLAP_ALLOW_UPDATE_ANON;
 
-                               } else if( strcasecmp( cargv[i], "none" ) != 0 ) {
+                               } else {
 #ifdef NEW_LOGGING
                                        LDAP_LOG( CONFIG, CRIT, "%s: line %d: "
                                                "unknown feature %s in \"allow <features>\" line.\n",
-                                               fname, lineno, cargv[1] );
+                                               fname, lineno, cargv[i] );
 #else
                                        Debug( LDAP_DEBUG_ANY, "%s: line %d: "
                                                "unknown feature %s in \"allow <features>\" line\n",
                                                fname, lineno, cargv[i] );
 #endif
 
-                                       return( 1 );
+                                       return 1;
                                }
                        }
 
-                       global_allows = allows;
+                       global_allows |= allows;
 
                /* disallow these features */
                } else if ( strcasecmp( cargv[0], "disallows" ) == 0 ||
                        strcasecmp( cargv[0], "disallow" ) == 0 )
                {
-                       slap_mask_t     disallows;
+                       slap_mask_t     disallows = 0; 
 
                        if ( be != NULL ) {
 #ifdef NEW_LOGGING
@@ -1362,8 +1416,6 @@ read_config( const char *fname, int depth )
                                return( 1 );
                        }
 
-                       disallows = 0;
-
                        for( i=1; i < cargc; i++ ) {
                                if( strcasecmp( cargv[i], "bind_anon" ) == 0 ) {
                                        disallows |= SLAP_DISALLOW_BIND_ANON;
@@ -1380,7 +1432,7 @@ read_config( const char *fname, int depth )
                                } else if( strcasecmp( cargv[i], "tls_authc" ) == 0 ) {
                                        disallows |= SLAP_DISALLOW_TLS_AUTHC;
 
-                               } else if( strcasecmp( cargv[i], "none" ) != 0 ) {
+                               } else {
 #ifdef NEW_LOGGING
                                        LDAP_LOG( CONFIG, CRIT, 
                                                "%s: line %d: unknown feature %s in "
@@ -1392,17 +1444,17 @@ read_config( const char *fname, int depth )
                                            fname, lineno, cargv[i] );
 #endif
 
-                                       return( 1 );
+                                       return 1;
                                }
                        }
 
-                       global_disallows = disallows;
+                       global_disallows |= disallows;
 
                /* require these features */
                } else if ( strcasecmp( cargv[0], "requires" ) == 0 ||
                        strcasecmp( cargv[0], "require" ) == 0 )
                {
-                       slap_mask_t     requires;
+                       slap_mask_t     requires = 0; 
 
                        if ( cargc < 2 ) {
 #ifdef NEW_LOGGING
@@ -1418,8 +1470,6 @@ read_config( const char *fname, int depth )
                                return( 1 );
                        }
 
-                       requires = 0;
-
                        for( i=1; i < cargc; i++ ) {
                                if( strcasecmp( cargv[i], "bind" ) == 0 ) {
                                        requires |= SLAP_REQUIRE_BIND;
@@ -1483,64 +1533,67 @@ read_config( const char *fname, int depth )
                        }
 
                        for( i=1; i < cargc; i++ ) {
-                               if( strncasecmp( cargv[i], "ssf=",
-                                       sizeof("ssf") ) == 0 )
+                               slap_ssf_t      *tgt;
+                               char            *src;
+
+                               if ( strncasecmp( cargv[i], "ssf=",
+                                               STRLENOF("ssf=") ) == 0 )
                                {
-                                       set->sss_ssf =
-                                               atoi( &cargv[i][sizeof("ssf")] );
+                                       tgt = &set->sss_ssf;
+                                       src = &cargv[i][STRLENOF("ssf=")];
 
-                               } else if( strncasecmp( cargv[i], "transport=",
-                                       sizeof("transport") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "transport=",
+                                               STRLENOF("transport=") ) == 0 )
                                {
-                                       set->sss_transport =
-                                               atoi( &cargv[i][sizeof("transport")] );
+                                       tgt = &set->sss_transport;
+                                       src = &cargv[i][STRLENOF("transport=")];
 
-                               } else if( strncasecmp( cargv[i], "tls=",
-                                       sizeof("tls") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "tls=",
+                                               STRLENOF("tls=") ) == 0 )
                                {
-                                       set->sss_tls =
-                                               atoi( &cargv[i][sizeof("tls")] );
+                                       tgt = &set->sss_tls;
+                                       src = &cargv[i][STRLENOF("tls=")];
 
-                               } else if( strncasecmp( cargv[i], "sasl=",
-                                       sizeof("sasl") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "sasl=",
+                                               STRLENOF("sasl=") ) == 0 )
                                {
-                                       set->sss_sasl =
-                                               atoi( &cargv[i][sizeof("sasl")] );
+                                       tgt = &set->sss_sasl;
+                                       src = &cargv[i][STRLENOF("sasl=")];
 
-                               } else if( strncasecmp( cargv[i], "update_ssf=",
-                                       sizeof("update_ssf") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "update_ssf=",
+                                               STRLENOF("update_ssf=") ) == 0 )
                                {
-                                       set->sss_update_ssf =
-                                               atoi( &cargv[i][sizeof("update_ssf")] );
+                                       tgt = &set->sss_update_ssf;
+                                       src = &cargv[i][STRLENOF("update_ssf=")];
 
-                               } else if( strncasecmp( cargv[i], "update_transport=",
-                                       sizeof("update_transport") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "update_transport=",
+                                               STRLENOF("update_transport=") ) == 0 )
                                {
-                                       set->sss_update_transport =
-                                               atoi( &cargv[i][sizeof("update_transport")] );
+                                       tgt = &set->sss_update_transport;
+                                       src = &cargv[i][STRLENOF("update_transport=")];
 
-                               } else if( strncasecmp( cargv[i], "update_tls=",
-                                       sizeof("update_tls") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "update_tls=",
+                                               STRLENOF("update_tls=") ) == 0 )
                                {
-                                       set->sss_update_tls =
-                                               atoi( &cargv[i][sizeof("update_tls")] );
+                                       tgt = &set->sss_update_tls;
+                                       src = &cargv[i][STRLENOF("update_tls=")];
 
-                               } else if( strncasecmp( cargv[i], "update_sasl=",
-                                       sizeof("update_sasl") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "update_sasl=",
+                                               STRLENOF("update_sasl=") ) == 0 )
                                {
-                                       set->sss_update_sasl =
-                                               atoi( &cargv[i][sizeof("update_sasl")] );
+                                       tgt = &set->sss_update_sasl;
+                                       src = &cargv[i][STRLENOF("update_sasl=")];
 
-                               } else if( strncasecmp( cargv[i], "simple_bind=",
-                                       sizeof("simple_bind") ) == 0 )
+                               } else if ( strncasecmp( cargv[i], "simple_bind=",
+                                               STRLENOF("simple_bind=") ) == 0 )
                                {
-                                       set->sss_simple_bind =
-                                               atoi( &cargv[i][sizeof("simple_bind")] );
+                                       tgt = &set->sss_simple_bind;
+                                       src = &cargv[i][STRLENOF("simple_bind=")];
 
                                } else {
 #ifdef NEW_LOGGING
                                        LDAP_LOG( CONFIG, CRIT, 
-                                                  "%s: line %d: unknown factor %S in "
+                                                  "%s: line %d: unknown factor %s in "
                                                   "\"security <factors>\" line.\n",
                                                   fname, lineno, cargv[1] );
 #else
@@ -1551,7 +1604,24 @@ read_config( const char *fname, int depth )
 
                                        return( 1 );
                                }
+
+                               *tgt = strtol( src, &next, 10 );
+                               if ( next == NULL || next[0] != '\0' ) {
+#ifdef NEW_LOGGING
+                                       LDAP_LOG( CONFIG, CRIT, 
+                                                  "%s: line %d: unable to parse factor \"%s\" in "
+                                                  "\"security <factors>\" line.\n",
+                                                  fname, lineno, cargv[1] );
+#else
+                                       Debug( LDAP_DEBUG_ANY,
+                   "%s: line %d: unable to parse factor \"%s\" in \"security <factors>\" line\n",
+                                           fname, lineno, cargv[i] );
+#endif
+
+                                       return( 1 );
+                               }
                        }
+
                /* where to send clients when we don't hold it */
                } else if ( strcasecmp( cargv[0], "referral" ) == 0 ) {
                        if ( cargc < 2 ) {
@@ -1619,10 +1689,22 @@ read_config( const char *fname, int depth )
                                        "%s: line %d: Error in debug directive, \"debug subsys level\"\n",
                                        fname, lineno, 0 );
 #endif
-
                                return( 1 );
                        }
-                        level = atoi( cargv[2] );
+                        level = strtol( cargv[2], &next, 10 );
+                       if ( next == NULL || next[0] != '\0' ){
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, CRIT, 
+                                          "%s: line %d: unable to parse level \"%s\" in debug directive, "
+                                          "\"debug <subsys> <level>\"\n", fname, lineno , cargv[2] );
+#else
+                               Debug( LDAP_DEBUG_ANY,
+                                          "%s: line %d: unable to parse level \"%s\" in debug directive, "
+                                          "\"debug <subsys> <level>\"\n", fname, lineno , cargv[2] );
+#endif
+                               return( 1 );
+                       }
+
                         if ( level <= 0 ) level = lutil_mnem2level( cargv[2] );
                         lutil_set_debug_level( cargv[1], level );
                /* specify an Object Identifier macro */
@@ -1727,15 +1809,14 @@ read_config( const char *fname, int depth )
                        }
                        if ( strcasecmp( cargv[1], "off" ) == 0 ) {
 #ifdef NEW_LOGGING
-                               LDAP_LOG( CONFIG, CRIT, 
-                                       "%s: line %d: schema checking disabled! your mileage may "
-                                       "vary!\n", fname, lineno , 0 );
+                               LDAP_LOG( CONFIG, CRIT, "%s: line %d: "
+                                       "schema checking cannot be disabled, option ignored!\n",
+                                       fname, lineno , 0 );
 #else
-                               Debug( LDAP_DEBUG_ANY,
-                                       "%s: line %d: schema checking disabled! your mileage may vary!\n",
+                               Debug( LDAP_DEBUG_ANY, "%s: line %d: "
+                                       "schema checking cannot be diabled, option ignored!\n",
                                    fname, lineno, 0 );
 #endif
-                               global_schemacheck = 0;
                        } else {
                                global_schemacheck = 1;
                        }
@@ -1749,11 +1830,11 @@ read_config( const char *fname, int depth )
                        if ( cargc < 2 ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG( CONFIG, CRIT, 
-                                       "%s: line %d: missing level in \"loglevel <level>\""
+                                       "%s: line %d: missing level(s) in \"loglevel <level> [...]\""
                                        " line.\n", fname, lineno , 0 );
 #else
                                Debug( LDAP_DEBUG_ANY,
-                   "%s: line %d: missing level in \"loglevel <level>\" line\n",
+                   "%s: line %d: missing level(s) in \"loglevel <level> [...]\" line\n",
                                    fname, lineno, 0 );
 #endif
 
@@ -1763,7 +1844,21 @@ read_config( const char *fname, int depth )
                        ldap_syslog = 0;
 
                        for( i=1; i < cargc; i++ ) {
-                               ldap_syslog += atoi( cargv[1] );
+                               int     level = strtol( cargv[i], &next, 10 );
+                               if ( next == NULL || next[0] != '\0' ) {
+#ifdef NEW_LOGGING
+                                       LDAP_LOG( CONFIG, CRIT, 
+                                               "%s: line %d: unable to parse level \"%s\" in \"loglevel <level> [...]\""
+                                               " line.\n", fname, lineno , cargv[i] );
+#else
+                                       Debug( LDAP_DEBUG_ANY,
+                                               "%s: line %d: unable to parse level \"%s\" in \"loglevel <level> [...]\""
+                                               " line.\n", fname, lineno , cargv[i] );
+#endif
+                                       return( 1 );
+                               }
+
+                               ldap_syslog |= level;
                        }
 
                /* list of sync replication information in this backend (slave only) */
@@ -1780,12 +1875,25 @@ read_config( const char *fname, int depth )
                                            "a database definition.\n", fname, lineno, 0);
 #endif
                                return 1;
-                       } else {
-                               if ( add_syncrepl( be, cargv, cargc )) {
-                                       return 1;
-                               }
+
+                       } else if ( SLAP_SHADOW( be )) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, INFO, 
+                                       "%s: line %d: syncrepl: database already shadowed.\n",
+                                       fname, lineno, 0);
+#else
+                               Debug( LDAP_DEBUG_ANY,
+                                       "%s: line %d: syncrepl: database already shadowed.\n",
+                                       fname, lineno, 0);
+#endif
+                               return 1;
+
+                       } else if ( add_syncrepl( be, cargv, cargc )) {
+                               return 1;
                        }
 
+                       SLAP_DBFLAGS(be) |= ( SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SYNC_SHADOW );
+
                /* list of replicas of the data in this backend (master only) */
                } else if ( strcasecmp( cargv[0], "replica" ) == 0 ) {
                        if ( cargc < 2 ) {
@@ -1958,6 +2066,9 @@ read_config( const char *fname, int depth )
                                }
                        }
 
+               } else if ( strcasecmp( cargv[0], "replicationInterval" ) == 0 ) {
+                       /* ignore */
+
                /* dn of slave entity allowed to write to replica */
                } else if ( strcasecmp( cargv[0], "updatedn" ) == 0 ) {
                        if ( cargc < 2 ) {
@@ -1986,6 +2097,18 @@ read_config( const char *fname, int depth )
 #endif
                                return 1;
 
+                       } else if ( SLAP_SHADOW(be) ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, INFO, 
+                                       "%s: line %d: updatedn: database already shadowed.\n",
+                                       fname, lineno, 0);
+#else
+                               Debug( LDAP_DEBUG_ANY,
+                                       "%s: line %d: updatedn: database already shadowed.\n",
+                                       fname, lineno, 0);
+#endif
+                               return 1;
+
                        } else {
                                struct berval dn;
 
@@ -2007,7 +2130,9 @@ read_config( const char *fname, int depth )
 #endif
                                        return 1;
                                }
+
                        }
+                       SLAP_DBFLAGS(be) |= ( SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SLURP_SHADOW );
 
                } else if ( strcasecmp( cargv[0], "updateref" ) == 0 ) {
                        if ( cargc < 2 ) {
@@ -2035,14 +2160,14 @@ read_config( const char *fname, int depth )
 #endif
                                return 1;
 
-                       } else if ( !be->be_update_ndn.bv_len ) {
+                       } else if ( !SLAP_SHADOW(be) ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG( CONFIG, INFO, "%s: line %d: "
-                                       "updateref line must come after updatedn.\n",
+                                       "updateref line must come after syncrepl or updatedn.\n",
                                        fname, lineno , 0 );
 #else
                                Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-                                       "updateref line must after updatedn.\n",
+                                       "updateref line must after syncrepl or updatedn.\n",
                                    fname, lineno, 0 );
 #endif
                                return 1;
@@ -2063,8 +2188,9 @@ read_config( const char *fname, int depth )
 
                        vals[0].bv_val = cargv[1];
                        vals[0].bv_len = strlen( vals[0].bv_val );
-                       if( value_add( &be->be_update_refs, vals ) )
+                       if( value_add( &be->be_update_refs, vals ) ) {
                                return LDAP_OTHER;
+                       }
 
                /* replication log file to which changes are appended */
                } else if ( strcasecmp( cargv[0], "replogfile" ) == 0 ) {
@@ -2130,18 +2256,36 @@ read_config( const char *fname, int depth )
 
                                return( 1 );
                        }
+
+                       if ( be == NULL ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, INFO, "%s: line %d: lastmod"
+                                       " line must appear inside a database definition\n",
+                                       fname, lineno , 0 );
+#else
+                               Debug( LDAP_DEBUG_ANY, "%s: line %d: lastmod"
+                                       " line must appear inside a database definition\n",
+                                       fname, lineno, 0 );
+#endif
+                               return 1;
+
+                       } else if ( SLAP_NOLASTMODCMD(be) ) {
+#ifdef NEW_LOGGING
+                               LDAP_LOG( CONFIG, INFO, "%s: line %d: lastmod"
+                                       " not available for %s database\n",
+                                       fname, lineno , be->bd_info->bi_type );
+#else
+                               Debug( LDAP_DEBUG_ANY, "%s: line %d: lastmod"
+                                       " not available for %s databases\n",
+                                       fname, lineno, be->bd_info->bi_type );
+#endif
+                               return 1;
+                       }
+
                        if ( strcasecmp( cargv[1], "on" ) == 0 ) {
-                               if ( be ) {
-                                       be->be_flags &= ~SLAP_BFLAG_NOLASTMOD;
-                               } else {
-                                       lastmod = 1;
-                               }
+                               SLAP_DBFLAGS(be) &= ~SLAP_DBFLAG_NOLASTMOD;
                        } else {
-                               if ( be ) {
-                                       be->be_flags |= SLAP_BFLAG_NOLASTMOD;
-                               } else {
-                                       lastmod = 0;
-                               }
+                               SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NOLASTMOD;
                        }
 
 #ifdef SIGHUP
@@ -2774,7 +2918,7 @@ config_destroy( )
        if ( slapd_pid_file )
                free ( slapd_pid_file );
        if ( default_passwd_hash )
-               free( default_passwd_hash );
+               ldap_charray_free( default_passwd_hash );
        acl_destroy( global_acl, NULL );
 }
 
@@ -2807,26 +2951,30 @@ add_syncrepl(
        }
        si->si_bindmethod = LDAP_AUTH_SIMPLE;
        si->si_schemachecking = 0;
-       ber_str2bv( "(objectclass=*)", sizeof("(objectclass=*)")-1, 0,
+       ber_str2bv( "(objectclass=*)", STRLENOF("(objectclass=*)"), 1,
                &si->si_filterstr );
        si->si_base.bv_val = NULL;
        si->si_scope = LDAP_SCOPE_SUBTREE;
        si->si_attrsonly = 0;
        si->si_attrs = (char **) ch_calloc( 1, sizeof( char * ));
        si->si_attrs[0] = NULL;
+       si->si_exattrs = (char **) ch_calloc( 1, sizeof( char * ));
+       si->si_exattrs[0] = NULL;
        si->si_type = LDAP_SYNC_REFRESH_ONLY;
        si->si_interval = 86400;
+       si->si_retryinterval = NULL;
+       si->si_retrynum_init = NULL;
+       si->si_retrynum = NULL;
        si->si_syncCookie.ctxcsn = NULL;
        si->si_syncCookie.octet_str = NULL;
        si->si_syncCookie.sid = -1;
        si->si_manageDSAit = 0;
-       si->si_tlimit = -1;
-       si->si_slimit = -1;
-       si->si_syncUUID_ndn.bv_val = NULL;
-       si->si_syncUUID_ndn.bv_len = 0;
+       si->si_tlimit = 0;
+       si->si_slimit = 0;
 
        si->si_presentlist = NULL;
        LDAP_LIST_INIT( &si->si_nonpresentlist );
+       ldap_pvt_thread_mutex_init( &si->si_mutex );
 
        rc = parse_syncrepl_line( cargv, cargc, si );
 
@@ -2834,10 +2982,10 @@ add_syncrepl(
                if ( si->si_rid == si_entry->si_rid ) {
 #ifdef NEW_LOGGING
                        LDAP_LOG( CONFIG, ERR,
-                                       "add_syncrepl: duplicaetd replica id\n", 0, 0,0 );
+                               "add_syncrepl: duplicated replica id\n", 0, 0,0 );
 #else
                        Debug( LDAP_DEBUG_ANY,
-                                       "add_syncrepl: duplicated replica id\n",0, 0, 0 );
+                               "add_syncrepl: duplicated replica id\n",0, 0, 0 );
 #endif
                        duplicated_replica_id = 1;
                        break;
@@ -2845,38 +2993,7 @@ add_syncrepl(
        }
 
        if ( rc < 0 || duplicated_replica_id ) {
-               syncinfo_t *si_entry;
-               /* Something bad happened - back out */
-#ifdef NEW_LOGGING
-               LDAP_LOG( CONFIG, ERR, "failed to add syncinfo\n", 0, 0,0 );
-#else
                Debug( LDAP_DEBUG_ANY, "failed to add syncinfo\n", 0, 0, 0 );
-#endif
-
-               /* If error, remove all syncinfo */
-               LDAP_STAILQ_FOREACH( si_entry, &be->be_syncinfo, si_next ) {
-                       if ( si_entry->si_updatedn.bv_val ) {
-                               ch_free( si->si_updatedn.bv_val );
-                       }
-                       if ( si_entry->si_filterstr.bv_val ) {
-                               ch_free( si->si_filterstr.bv_val );
-                       }
-                       if ( si_entry->si_attrs ) {
-                               int i = 0;
-                               while ( si_entry->si_attrs[i] != NULL ) {
-                                       ch_free( si_entry->si_attrs[i] );
-                                       i++;
-                               }
-                               ch_free( si_entry->si_attrs );
-                       }
-               }
-
-               while ( !LDAP_STAILQ_EMPTY( &be->be_syncinfo )) {
-                       si_entry = LDAP_STAILQ_FIRST( &be->be_syncinfo );
-                       LDAP_STAILQ_REMOVE_HEAD( &be->be_syncinfo, si_next );
-                       ch_free( si_entry );
-               }
-               LDAP_STAILQ_INIT( &be->be_syncinfo );
                return 1;
        } else {
 #ifdef NEW_LOGGING
@@ -2889,7 +3006,7 @@ add_syncrepl(
                        si->si_provideruri == NULL ? "(null)" : si->si_provideruri, 0, 0 );
 #endif
                if ( !si->si_schemachecking ) {
-                       be->be_flags |= SLAP_BFLAG_NO_SCHEMA_CHECK;
+                       SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK;
                }
                si->si_be = be;
                LDAP_STAILQ_INSERT_TAIL( &be->be_syncinfo, si, si_next );
@@ -2922,6 +3039,7 @@ add_syncrepl(
 #define SCOPESTR               "scope"
 #define ATTRSSTR               "attrs"
 #define ATTRSONLYSTR   "attrsonly"
+#define EXATTRSSTR             "exattrs"
 #define TYPESTR                        "type"
 #define INTERVALSTR            "interval"
 #define LASTMODSTR             "lastmod"
@@ -2932,6 +3050,8 @@ add_syncrepl(
 #define SLIMITSTR              "sizelimit"
 #define TLIMITSTR              "timelimit"
 
+#define RETRYSTR               "retry"
+
 #define GOT_ID                 0x0001
 #define GOT_PROVIDER   0x0002
 #define GOT_METHOD             0x0004
@@ -2969,7 +3089,7 @@ parse_syncrepl_line(
                        si->si_provideruri_bv = (BerVarray)
                                ch_calloc( 2, sizeof( struct berval ));
                        ber_str2bv( si->si_provideruri, strlen( si->si_provideruri ),
-                               0, &si->si_provideruri_bv[0] );
+                               1, &si->si_provideruri_bv[0] );
                        si->si_provideruri_bv[1].bv_len = 0;
                        si->si_provideruri_bv[1].bv_val = NULL;
                        gots |= GOT_PROVIDER;
@@ -3004,7 +3124,7 @@ parse_syncrepl_line(
 #else /* HAVE_CYRUS_SASL */
                                fprintf( stderr, "Error: parse_syncrepl_line: "
                                        "not compiled with SASL support\n" );
-                               return 1;
+                               return -1;
 #endif /* HAVE_CYRUS_SASL */
                        } else {
                                si->si_bindmethod = -1;
@@ -3032,11 +3152,15 @@ parse_syncrepl_line(
                } else if ( !strncasecmp( cargv[ i ],
                                AUTHCSTR, sizeof( AUTHCSTR ) - 1 ) ) {
                        val = cargv[ i ] + sizeof( AUTHCSTR );
+                       if ( si->si_authcId )
+                               ch_free( si->si_authcId );
                        si->si_authcId = ch_strdup( val );
                } else if ( !strncasecmp( cargv[ i ],
                                OLDAUTHCSTR, sizeof( OLDAUTHCSTR ) - 1 ) ) {
                        /* Old authcID is provided for some backwards compatibility */
                        val = cargv[ i ] + sizeof( OLDAUTHCSTR );
+                       if ( si->si_authcId )
+                               ch_free( si->si_authcId );
                        si->si_authcId = ch_strdup( val );
                } else if ( !strncasecmp( cargv[ i ],
                                AUTHZSTR, sizeof( AUTHZSTR ) - 1 ) ) {
@@ -3069,7 +3193,7 @@ parse_syncrepl_line(
                        ber_str2bv( val, 0, 0, &bv );
                        if ( dnNormalize( 0, NULL, NULL, &bv, &si->si_base, NULL )) {
                                fprintf( stderr, "Invalid base DN \"%s\"\n", val );
-                               return 1;
+                               return -1;
                        }
                } else if ( !strncasecmp( cargv[ i ],
                        SCOPESTR, sizeof( SCOPESTR ) - 1 ) )
@@ -3079,12 +3203,18 @@ parse_syncrepl_line(
                                si->si_scope = LDAP_SCOPE_BASE;
                        } else if ( !strncasecmp( val, "one", sizeof( "one" ) - 1 )) {
                                si->si_scope = LDAP_SCOPE_ONELEVEL;
+#ifdef LDAP_SCOPE_SUBORDINATE
+                       } else if ( !strcasecmp( val, "subordinate" ) ||
+                               !strcasecmp( val, "children" ))
+                       {
+                               si->si_scope = LDAP_SCOPE_SUBORDINATE;
+#endif
                        } else if ( !strncasecmp( val, "sub", sizeof( "sub" ) - 1 )) {
                                si->si_scope = LDAP_SCOPE_SUBTREE;
                        } else {
                                fprintf( stderr, "Error: parse_syncrepl_line: "
                                        "unknown scope \"%s\"\n", val);
-                               return 1;
+                               return -1;
                        }
                } else if ( !strncasecmp( cargv[ i ],
                        ATTRSONLYSTR, sizeof( ATTRSONLYSTR ) - 1 ) )
@@ -3095,6 +3225,11 @@ parse_syncrepl_line(
                {
                        val = cargv[ i ] + sizeof( ATTRSSTR );
                        str2clist( &si->si_attrs, val, "," );
+               } else if ( !strncasecmp( cargv[ i ],
+                       EXATTRSSTR, sizeof( EXATTRSSTR ) - 1 ) )
+               {
+                       val = cargv[ i ] + sizeof( EXATTRSSTR );
+                       str2clist( &si->si_exattrs, val, "," );
                } else if ( !strncasecmp( cargv[ i ],
                        TYPESTR, sizeof( TYPESTR ) - 1 ) )
                {
@@ -3109,7 +3244,7 @@ parse_syncrepl_line(
                        } else {
                                fprintf( stderr, "Error: parse_syncrepl_line: "
                                        "unknown sync type \"%s\"\n", val);
-                               return 1;
+                               return -1;
                        }
                } else if ( !strncasecmp( cargv[ i ],
                        INTERVALSTR, sizeof( INTERVALSTR ) - 1 ) )
@@ -3128,21 +3263,21 @@ parse_syncrepl_line(
                                if ( hstr == NULL ) {
                                        fprintf( stderr, "Error: parse_syncrepl_line: "
                                                "invalid interval \"%s\"\n", val );
-                                       return 1;
+                                       return -1;
                                }
                                *hstr++ = '\0';
                                mstr = strchr( hstr, ':' );
                                if ( mstr == NULL ) {
                                        fprintf( stderr, "Error: parse_syncrepl_line: "
                                                "invalid interval \"%s\"\n", val );
-                                       return 1;
+                                       return -1;
                                }
                                *mstr++ = '\0';
                                sstr = strchr( mstr, ':' );
                                if ( sstr == NULL ) {
                                        fprintf( stderr, "Error: parse_syncrepl_line: "
                                                "invalid interval \"%s\"\n", val );
-                                       return 1;
+                                       return -1;
                                }
                                *sstr++ = '\0';
 
@@ -3155,7 +3290,7 @@ parse_syncrepl_line(
                                        ( ss > 60 ) || ( ss < 0 ) || ( dd < 0 )) {
                                        fprintf( stderr, "Error: parse_syncrepl_line: "
                                                "invalid interval \"%s\"\n", val );
-                                       return 1;
+                                       return -1;
                                }
                                si->si_interval = (( dd * 24 + hh ) * 60 + mm ) * 60 + ss;
                        }
@@ -3163,8 +3298,55 @@ parse_syncrepl_line(
                                fprintf( stderr, "Error: parse_syncrepl_line: "
                                        "invalid interval \"%ld\"\n",
                                        (long) si->si_interval);
-                               return 1;
+                               return -1;
+                       }
+               } else if ( !strncasecmp( cargv[ i ],
+                       RETRYSTR, sizeof( RETRYSTR ) - 1 ) )
+               {
+                       char *str;
+                       char **retry_list;
+                       int j, k, n;
+
+                       val = cargv[ i ] + sizeof( RETRYSTR );
+                       retry_list = (char **) ch_calloc( 1, sizeof( char * ));
+                       retry_list[0] = NULL;
+
+                       str2clist( &retry_list, val, " ,\t" );
+
+                       for ( k = 0; retry_list && retry_list[k]; k++ ) ;
+                       n = k / 2;
+                       if ( k % 2 ) {
+                               fprintf( stderr,
+                                               "Error: incomplete syncrepl retry list\n" );
+                               for ( k = 0; retry_list && retry_list[k]; k++ ) {
+                                       ch_free( retry_list[k] );
+                               }
+                               ch_free( retry_list );
+                               exit( EXIT_FAILURE );
+                       }
+                       si->si_retryinterval = (time_t *) ch_calloc( n + 1, sizeof( time_t ));
+                       si->si_retrynum = (int *) ch_calloc( n + 1, sizeof( int ));
+                       si->si_retrynum_init = (int *) ch_calloc( n + 1, sizeof( int ));
+                       for ( j = 0; j < n; j++ ) {
+                               si->si_retryinterval[j] = atoi( retry_list[j*2] );
+                               if ( *retry_list[j*2+1] == '+' ) {
+                                       si->si_retrynum_init[j] = -1;
+                                       si->si_retrynum[j] = -1;
+                                       j++;
+                                       break;
+                               } else {
+                                       si->si_retrynum_init[j] = atoi( retry_list[j*2+1] );
+                                       si->si_retrynum[j] = atoi( retry_list[j*2+1] );
+                               }
+                       }
+                       si->si_retrynum_init[j] = -2;
+                       si->si_retrynum[j] = -2;
+                       si->si_retryinterval[j] = 0;
+                       
+                       for ( k = 0; retry_list && retry_list[k]; k++ ) {
+                               ch_free( retry_list[k] );
                        }
+                       ch_free( retry_list );
                } else if ( !strncasecmp( cargv[ i ],
                        MANAGEDSAITSTR, sizeof( MANAGEDSAITSTR ) - 1 ) )
                {
@@ -3183,6 +3365,7 @@ parse_syncrepl_line(
                } else {
                        fprintf( stderr, "Error: parse_syncrepl_line: "
                                "unknown keyword \"%s\"\n", cargv[ i ] );
+                       return -1;
                }
        }