]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/syncrepl.c
ITS#5376,ITS#5378
[openldap] / servers / slapd / syncrepl.c
index 2fdf30b3b4cc8b815e0a7065beabe95c4499ee03..0b9018bdedf921b2c6f412013cdaff87fdf77d27 100644 (file)
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2005 The OpenLDAP Foundation.
+ * Copyright 2003-2008 The OpenLDAP Foundation.
  * Portions Copyright 2003 by IBM Corporation.
  * Portions Copyright 2003 by Howard Chu, Symas Corporation.
  * All rights reserved.
 
 #include "ldap_rq.h"
 
-/* FIXME: for ldap_ld_free() */
-#undef ldap_debug
-#include "../../libraries/libldap/ldap-int.h"
-
 struct nonpresent_entry {
        struct berval *npe_name;
        struct berval *npe_nname;
        LDAP_LIST_ENTRY(nonpresent_entry) npe_link;
 };
 
+#define        SYNCDATA_DEFAULT        0       /* entries are plain LDAP entries */
+#define        SYNCDATA_ACCESSLOG      1       /* entries are accesslog format */
+#define        SYNCDATA_CHANGELOG      2       /* entries are changelog format */
+
+#define        SYNCLOG_LOGGING         0       /* doing a log-based update */
+#define        SYNCLOG_FALLBACK        1       /* doing a full refresh */
+
+#define RETRYNUM_FOREVER       (-1)    /* retry forever */
+#define RETRYNUM_TAIL          (-2)    /* end of retrynum array */
+#define RETRYNUM_VALID(n)      ((n) >= RETRYNUM_FOREVER)       /* valid retrynum */
+#define RETRYNUM_FINITE(n)     ((n) > RETRYNUM_FOREVER)        /* not forever */
+
 typedef struct syncinfo_s {
        struct slap_backend_db *si_be;
        struct re_s                     *si_re;
-       long                            si_rid;
-       struct berval           si_provideruri;
+       int                                     si_rid;
        slap_bindconf           si_bindconf;
-       struct berval           si_filterstr;
        struct berval           si_base;
+       struct berval           si_logbase;
+       struct berval           si_filterstr;
+       struct berval           si_logfilterstr;
        int                                     si_scope;
        int                                     si_attrsonly;
        char                            *si_anfile;
@@ -59,7 +68,8 @@ typedef struct syncinfo_s {
        int                                     si_allattrs;
        int                                     si_allopattrs;
        int                                     si_schemachecking;
-       int                                     si_type;
+       int                                     si_type;        /* the active type */
+       int                                     si_ctype;       /* the configured type */
        time_t                          si_interval;
        time_t                          *si_retryinterval;
        int                                     *si_retrynum_init;
@@ -70,6 +80,11 @@ typedef struct syncinfo_s {
        int                                     si_tlimit;
        int                                     si_refreshDelete;
        int                                     si_refreshPresent;
+       int                                     si_refreshDone;
+       int                                     si_syncdata;
+       int                                     si_logstate;
+       int                                     si_conn_setup;
+       ber_int_t                               si_msgid;
        Avlnode                         *si_presentlist;
        LDAP                            *si_ld;
        LDAP_LIST_HEAD(np, nonpresent_entry) si_nonpresentlist;
@@ -78,7 +93,9 @@ typedef struct syncinfo_s {
 
 static int syncuuid_cmp( const void *, const void * );
 static void avl_ber_bvfree( void * );
-static void syncrepl_del_nonpresent( Operation *, syncinfo_t *, BerVarray );
+static void syncrepl_del_nonpresent( Operation *, syncinfo_t *, BerVarray, struct berval * );
+static int syncrepl_message_to_op(
+                                       syncinfo_t *, Operation *, LDAPMessage * );
 static int syncrepl_message_to_entry(
                                        syncinfo_t *, Operation *, LDAPMessage *,
                                        Modifications **, Entry **, int );
@@ -178,7 +195,7 @@ init_syncrepl(syncinfo_t *si)
                }
 
                if ( attrs == NULL ) {
-                       Debug( LDAP_DEBUG_ANY, "out of memory\n", 0,0,0 );
+                       Debug( LDAP_DEBUG_ANY, "out of memory\n", 0, 0, 0 );
                }
 
                /* Add Attributes */
@@ -224,9 +241,8 @@ init_syncrepl(syncinfo_t *si)
                        j = 0;
                        while ( exattrs[j] != NULL ) {
                                if ( !strcmp( exattrs[j], sync_descs[i]->ad_cname.bv_val )) {
+                                       ch_free( exattrs[j] );
                                        for ( k = j; exattrs[k] != NULL; k++ ) {
-                                               if ( k == j )
-                                                       ch_free( exattrs[k] );
                                                exattrs[k] = exattrs[k+1];
                                        }
                                } else {
@@ -243,9 +259,8 @@ init_syncrepl(syncinfo_t *si)
                                        while ( oc->soc_required[k] ) {
                                                if ( !strcmp( exattrs[i],
                                                         oc->soc_required[k]->sat_cname.bv_val )) {
+                                                       ch_free( exattrs[i] );
                                                        for ( l = i; exattrs[l]; l++ ) {
-                                                               if ( l == i )
-                                                                       ch_free( exattrs[i] );
                                                                exattrs[l] = exattrs[l+1];
                                                        }
                                                } else {
@@ -265,6 +280,33 @@ init_syncrepl(syncinfo_t *si)
        si->si_exattrs = exattrs;       
 }
 
+typedef struct logschema {
+       struct berval ls_dn;
+       struct berval ls_req;
+       struct berval ls_mod;
+       struct berval ls_newRdn;
+       struct berval ls_delRdn;
+       struct berval ls_newSup;
+} logschema;
+
+static logschema changelog_sc = {
+       BER_BVC("targetDN"),
+       BER_BVC("changeType"),
+       BER_BVC("changes"),
+       BER_BVC("newRDN"),
+       BER_BVC("deleteOldRDN"),
+       BER_BVC("newSuperior")
+};
+
+static logschema accesslog_sc = {
+       BER_BVC("reqDN"),
+       BER_BVC("reqType"),
+       BER_BVC("reqMod"),
+       BER_BVC("reqNewRDN"),
+       BER_BVC("reqDeleteOldRDN"),
+       BER_BVC("reqNewSuperior")
+};
+
 static int
 ldap_sync_search(
        syncinfo_t *si,
@@ -274,21 +316,67 @@ ldap_sync_search(
        BerElement *ber = (BerElement *)&berbuf;
        LDAPControl c[2], *ctrls[3];
        struct timeval timeout;
-       ber_int_t       msgid;
        int rc;
+       int rhint;
+       char *base;
+       char **attrs, *lattrs[8];
+       char *filter;
+       int attrsonly;
+       int scope;
 
        /* setup LDAP SYNC control */
        ber_init2( ber, NULL, LBER_USE_DER );
        ber_set_option( ber, LBER_OPT_BER_MEMCTX, &ctx );
 
+       /* If we're using a log but we have no state, then fallback to
+        * normal mode for a full refresh.
+        */
+       if ( si->si_syncdata && BER_BVISEMPTY( &si->si_syncCookie.ctxcsn ))
+               si->si_logstate = SYNCLOG_FALLBACK;
+
+       /* Use the log parameters if we're in log mode */
+       if ( si->si_syncdata && si->si_logstate == SYNCLOG_LOGGING ) {
+               logschema *ls;
+               if ( si->si_syncdata == SYNCDATA_ACCESSLOG )
+                       ls = &accesslog_sc;
+               else
+                       ls = &changelog_sc;
+               lattrs[0] = ls->ls_dn.bv_val;
+               lattrs[1] = ls->ls_req.bv_val;
+               lattrs[2] = ls->ls_mod.bv_val;
+               lattrs[3] = ls->ls_newRdn.bv_val;
+               lattrs[4] = ls->ls_delRdn.bv_val;
+               lattrs[5] = ls->ls_newSup.bv_val;
+               lattrs[6] = slap_schema.si_ad_entryCSN->ad_cname.bv_val;
+               lattrs[7] = NULL;
+
+               rhint = 0;
+               base = si->si_logbase.bv_val;
+               filter = si->si_logfilterstr.bv_val;
+               attrs = lattrs;
+               attrsonly = 0;
+               scope = LDAP_SCOPE_SUBTREE;
+       } else {
+               rhint = 1;
+               base = si->si_base.bv_val;
+               filter = si->si_filterstr.bv_val;
+               attrs = si->si_attrs;
+               attrsonly = si->si_attrsonly;
+               scope = si->si_scope;
+       }
+       if ( si->si_syncdata && si->si_logstate == SYNCLOG_FALLBACK ) {
+               si->si_type = LDAP_SYNC_REFRESH_ONLY;
+       } else {
+               si->si_type = si->si_ctype;
+       }
+
        if ( !BER_BVISNULL( &si->si_syncCookie.octet_str ) )
        {
-               ber_printf( ber, "{eO}",
-                       abs(si->si_type),
-                       &si->si_syncCookie.octet_str );
+               ber_printf( ber, "{eOb}",
+                       abs(si->si_type), &si->si_syncCookie.octet_str, rhint );
        } else {
-               ber_printf( ber, "{e}",
-                       abs(si->si_type) );
+               ber_printf( ber, "{eb}",
+                       abs(si->si_type), rhint );
        }
 
        if ( (rc = ber_flatten2( ber, &c[0].ldctl_value, 0 )) == LBER_ERROR ) {
@@ -313,10 +401,9 @@ ldap_sync_search(
        timeout.tv_sec = si->si_tlimit;
        timeout.tv_usec = 0;
 
-       rc = ldap_search_ext( si->si_ld, si->si_base.bv_val, si->si_scope,
-               si->si_filterstr.bv_val, si->si_attrs, si->si_attrsonly,
+       rc = ldap_search_ext( si->si_ld, base, scope, filter, attrs, attrsonly,
                ctrls, NULL, si->si_tlimit > 0 ? &timeout : NULL,
-               si->si_slimit, &msgid );
+               si->si_slimit, &si->si_msgid );
        ber_free_buf( ber );
        return rc;
 }
@@ -338,11 +425,11 @@ do_syncrep1(
        psub = &si->si_be->be_nsuffix[0];
 
        /* Init connection to master */
-       rc = ldap_initialize( &si->si_ld, si->si_provideruri.bv_val );
+       rc = ldap_initialize( &si->si_ld, si->si_bindconf.sb_uri.bv_val );
        if ( rc != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_ANY,
-                       "do_syncrep1: ldap_initialize failed (%s)\n",
-                       si->si_provideruri.bv_val, 0, 0 );
+                       "do_syncrep1: rid %03d ldap_initialize failed (%s)\n",
+                       si->si_rid, si->si_bindconf.sb_uri.bv_val, 0 );
                return rc;
        }
 
@@ -355,9 +442,9 @@ do_syncrep1(
                rc = ldap_start_tls_s( si->si_ld, NULL, NULL );
                if( rc != LDAP_SUCCESS ) {
                        Debug( LDAP_DEBUG_ANY,
-                               "%s: ldap_start_tls failed (%d)\n",
+                               "%s: rid %03d ldap_start_tls failed (%d)\n",
                                si->si_bindconf.sb_tls == SB_TLS_CRITICAL ? "Error" : "Warning",
-                               rc, 0 );
+                               si->si_rid, rc );
                        if( si->si_bindconf.sb_tls == SB_TLS_CRITICAL ) goto done;
                }
        }
@@ -371,9 +458,9 @@ do_syncrep1(
                                LDAP_OPT_X_SASL_SECPROPS, si->si_bindconf.sb_secprops);
 
                        if( rc != LDAP_OPT_SUCCESS ) {
-                               Debug( LDAP_DEBUG_ANY, "Error: ldap_set_option "
+                               Debug( LDAP_DEBUG_ANY, "Error: rid %03d ldap_set_option "
                                        "(%s,SECPROPS,\"%s\") failed!\n",
-                                       si->si_provideruri.bv_val, si->si_bindconf.sb_secprops, 0 );
+                                       si->si_rid, si->si_bindconf.sb_uri.bv_val, si->si_bindconf.sb_secprops );
                                goto done;
                        }
                }
@@ -402,9 +489,9 @@ do_syncrep1(
                if ( rc != LDAP_SUCCESS ) {
                        static struct berval bv_GSSAPI = BER_BVC( "GSSAPI" );
 
-                       Debug( LDAP_DEBUG_ANY, "do_syncrep1: "
+                       Debug( LDAP_DEBUG_ANY, "do_syncrep1: rid %03d "
                                "ldap_sasl_interactive_bind_s failed (%d)\n",
-                               rc, 0, 0 );
+                               si->si_rid, rc, 0 );
 
                        /* FIXME (see above comment) */
                        /* if Kerberos credentials cache is not active, retry */
@@ -419,7 +506,7 @@ do_syncrep1(
 #else /* HAVE_CYRUS_SASL */
                /* Should never get here, we trapped this at config time */
                assert(0);
-               fprintf( stderr, "not compiled with SASL support\n" );
+               Debug( LDAP_DEBUG_SYNC, "not compiled with SASL support\n", 0, 0, 0 );
                rc = LDAP_OTHER;
                goto done;
 #endif
@@ -429,8 +516,8 @@ do_syncrep1(
                        si->si_bindconf.sb_binddn.bv_val, LDAP_SASL_SIMPLE,
                        &si->si_bindconf.sb_cred, NULL, NULL, NULL );
                if ( rc != LDAP_SUCCESS ) {
-                       Debug( LDAP_DEBUG_ANY, "do_syncrep1: "
-                               "ldap_sasl_bind_s failed (%d)\n", rc, 0, 0 );
+                       Debug( LDAP_DEBUG_ANY, "do_syncrep1: rid %03d "
+                               "ldap_sasl_bind_s failed (%d)\n", si->si_rid, rc, 0 );
                        goto done;
                }
        }
@@ -498,11 +585,14 @@ do_syncrep1(
                        &si->si_syncCookie.ctxcsn, si->si_syncCookie.rid );
        }
 
+       si->si_refreshDone = 0;
+
        rc = ldap_sync_search( si, op->o_tmpmemctx );
 
        if( rc != LDAP_SUCCESS ) {
-               Debug( LDAP_DEBUG_ANY, "do_syncrep1: "
-                       "ldap_search_ext: %s (%d)\n", ldap_err2string( rc ), rc, 0 );
+               Debug( LDAP_DEBUG_ANY, "do_syncrep1: rid %03d "
+                       "ldap_search_ext: %s (%d)\n",
+                       si->si_rid, ldap_err2string( rc ), rc );
        }
 
 done:
@@ -544,8 +634,6 @@ do_syncrep2(
        int     rc, err, i;
        ber_len_t       len;
 
-       int rc_efree = 1;
-
        struct berval   *psub;
        Modifications   *modlist = NULL;
 
@@ -556,7 +644,6 @@ do_syncrep2(
        struct timeval tout = { 0, 0 };
 
        int             refreshDeletes = 0;
-       int             refreshDone = 1;
        BerVarray syncUUIDs = NULL;
        ber_tag_t si_tag;
 
@@ -568,7 +655,7 @@ do_syncrep2(
        ber_init2( ber, NULL, LBER_USE_DER );
        ber_set_option( ber, LBER_OPT_BER_MEMCTX, &op->o_tmpmemctx );
 
-       Debug( LDAP_DEBUG_TRACE, "=>do_syncrep2\n", 0, 0, 0 );
+       Debug( LDAP_DEBUG_TRACE, "=>do_syncrep2 rid %03d\n", si->si_rid, 0, 0 );
 
        psub = &si->si_be->be_nsuffix[0];
 
@@ -580,7 +667,7 @@ do_syncrep2(
                tout_p = NULL;
        }
 
-       while (( rc = ldap_result( si->si_ld, LDAP_RES_ANY, LDAP_MSG_ONE,
+       while (( rc = ldap_result( si->si_ld, si->si_msgid, LDAP_MSG_ONE,
                tout_p, &res )) > 0 )
        {
                if ( slapd_shutdown ) {
@@ -600,16 +687,24 @@ do_syncrep2(
                                ldap_get_entry_controls( si->si_ld, msg, &rctrls );
                                /* we can't work without the control */
                                if ( !rctrls ) {
-                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2: "
+                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2: rid %03d"
                                                "got search entry without "
-                                               "control\n", 0, 0, 0 );
+                                               "control\n", si->si_rid, 0, 0 );
                                        rc = -1;
                                        goto done;
                                }
                                rctrlp = *rctrls;
                                ber_init2( ber, &rctrlp->ldctl_value, LBER_USE_DER );
                                ber_scanf( ber, "{em" /*"}"*/, &syncstate, &syncUUID );
-                               /* FIXME: what if syncUUID is NULL or empty? */
+                               /* FIXME: what if syncUUID is NULL or empty?
+                                * (happens with back-sql...) */
+                               if ( BER_BVISEMPTY( &syncUUID ) ) {
+                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2: rid %03d "
+                                               "got empty syncUUID\n", si->si_rid, 0, 0 );
+                                       ldap_controls_free( rctrls );
+                                       rc = -1;
+                                       goto done;
+                               }
                                if ( ber_peek_tag( ber, &len ) == LDAP_TAG_SYNC_COOKIE ) {
                                        ber_scanf( ber, /*"{"*/ "m}", &cookie );
                                        if ( !BER_BVISNULL( &cookie ) ) {
@@ -621,12 +716,30 @@ do_syncrep2(
                                                slap_parse_sync_cookie( &syncCookie, NULL );
                                        }
                                }
-                               if ( syncrepl_message_to_entry( si, op, msg,
-                                       &modlist, &entry, syncstate ) == LDAP_SUCCESS ) {
-                                       rc_efree = syncrepl_entry( si, op, entry, &modlist,
-                                               syncstate, &syncUUID, &syncCookie_req, &syncCookie.ctxcsn );
-                                       if ( !BER_BVISNULL( &syncCookie.octet_str ) )
-                                       {
+                               rc = 0;
+                               if ( si->si_syncdata && si->si_logstate == SYNCLOG_LOGGING ) {
+                                       modlist = NULL;
+                                       if (( rc = syncrepl_message_to_op( si, op, msg )) == LDAP_SUCCESS &&
+                                               !BER_BVISNULL( &syncCookie.ctxcsn ) ) {
+                                               syncrepl_updateCookie( si, op, psub, &syncCookie );
+                                       } else switch ( rc ) {
+                                               case LDAP_ALREADY_EXISTS:
+                                               case LDAP_NO_SUCH_OBJECT:
+                                               case LDAP_NO_SUCH_ATTRIBUTE:
+                                               case LDAP_TYPE_OR_VALUE_EXISTS:
+                                                       rc = LDAP_SYNC_REFRESH_REQUIRED;
+                                                       si->si_logstate = SYNCLOG_FALLBACK;
+                                                       ldap_abandon_ext( si->si_ld, si->si_msgid, NULL, NULL );
+                                                       break;
+                                               default:
+                                                       break;
+                                       }
+                               } else if (( rc = syncrepl_message_to_entry( si, op, msg,
+                                       &modlist, &entry, syncstate )) == LDAP_SUCCESS ) {
+                                       if (( rc = syncrepl_entry( si, op, entry, &modlist,
+                                               syncstate, &syncUUID, &syncCookie_req,
+                                               &syncCookie.ctxcsn )) == LDAP_SUCCESS &&
+                                               !BER_BVISNULL( &syncCookie.ctxcsn ) ) {
                                                syncrepl_updateCookie( si, op, psub, &syncCookie );
                                        }
                                }
@@ -634,22 +747,35 @@ do_syncrep2(
                                if ( modlist ) {
                                        slap_mods_free( modlist, 1 );
                                }
-                               if ( rc_efree && entry ) {
-                                       entry_free( entry );
-                               }
-                               entry = NULL;
+                               if ( rc )
+                                       goto done;
                                break;
 
                        case LDAP_RES_SEARCH_REFERENCE:
                                Debug( LDAP_DEBUG_ANY,
-                                       "do_syncrep2: reference received error\n", 0, 0, 0 );
+                                       "do_syncrep2: rid %03d reference received error\n",
+                                       si->si_rid, 0, 0 );
                                break;
 
                        case LDAP_RES_SEARCH_RESULT:
                                Debug( LDAP_DEBUG_SYNC,
-                                       "do_syncrep2: LDAP_RES_SEARCH_RESULT\n", 0, 0, 0 );
+                                       "do_syncrep2: rid %03d LDAP_RES_SEARCH_RESULT\n",
+                                       si->si_rid, 0, 0 );
                                ldap_parse_result( si->si_ld, msg, &err, NULL, NULL, NULL,
                                        &rctrls, 0 );
+#ifdef LDAP_X_SYNC_REFRESH_REQUIRED
+                               if ( err == LDAP_X_SYNC_REFRESH_REQUIRED ) {
+                                       /* map old result code to registered code */
+                                       err = LDAP_SYNC_REFRESH_REQUIRED;
+                               }
+#endif
+                               if ( err == LDAP_SYNC_REFRESH_REQUIRED ) {
+                                       if ( si->si_logstate == SYNCLOG_LOGGING ) {
+                                               si->si_logstate = SYNCLOG_FALLBACK;
+                                       }
+                                       rc = err;
+                                       goto done;
+                               }
                                if ( rctrls ) {
                                        rctrlp = *rctrls;
                                        ber_init2( ber, &rctrlp->ldctl_value, LBER_USE_DER );
@@ -683,11 +809,6 @@ do_syncrep2(
                                                &syncCookie_req.ctxcsn, &syncCookie.ctxcsn,
                                                &text );
                                }
-                               if ( !BER_BVISNULL( &syncCookie.octet_str ) &&
-                                       match < 0 && err == LDAP_SUCCESS )
-                               {
-                                       syncrepl_updateCookie( si, op, psub, &syncCookie );
-                               }
                                if ( rctrls ) {
                                        ldap_controls_free( rctrls );
                                }
@@ -699,13 +820,24 @@ do_syncrep2(
                                        if ( refreshDeletes == 0 && match < 0 &&
                                                err == LDAP_SUCCESS )
                                        {
-                                               syncrepl_del_nonpresent( op, si, NULL );
+                                               syncrepl_del_nonpresent( op, si, NULL, &syncCookie.ctxcsn );
                                        } else {
                                                avl_free( si->si_presentlist, avl_ber_bvfree );
                                                si->si_presentlist = NULL;
                                        }
                                }
-                               rc = -2;
+                               if ( !BER_BVISNULL( &syncCookie.ctxcsn ) &&
+                                       match < 0 && err == LDAP_SUCCESS )
+                               {
+                                       syncrepl_updateCookie( si, op, psub, &syncCookie );
+                               }
+                               if ( err == LDAP_SUCCESS
+                                       && si->si_logstate == SYNCLOG_FALLBACK ) {
+                                       si->si_logstate = SYNCLOG_LOGGING;
+                                       rc = LDAP_SYNC_REFRESH_REQUIRED;
+                               } else {
+                                       rc = -2;
+                               }
                                goto done;
                                break;
 
@@ -719,19 +851,20 @@ do_syncrep2(
                                        ber_tag_t tag;
                                        case LDAP_TAG_SYNC_NEW_COOKIE:
                                                Debug( LDAP_DEBUG_SYNC,
-                                                       "do_syncrep2: %s - %s%s\n", 
+                                                       "do_syncrep2: rid %03d %s - %s\n", 
+                                                       si->si_rid,
                                                        "LDAP_RES_INTERMEDIATE", 
-                                                       "NEW_COOKIE", "\n" );
+                                                       "NEW_COOKIE" );
                                                ber_scanf( ber, "tm", &tag, &cookie );
                                                break;
                                        case LDAP_TAG_SYNC_REFRESH_DELETE:
                                        case LDAP_TAG_SYNC_REFRESH_PRESENT:
                                                Debug( LDAP_DEBUG_SYNC,
-                                                       "do_syncrep2: %s - %s%s\n", 
+                                                       "do_syncrep2: rid %03d %s - %s\n", 
+                                                       si->si_rid,
                                                        "LDAP_RES_INTERMEDIATE", 
                                                        si_tag == LDAP_TAG_SYNC_REFRESH_PRESENT ?
-                                                       "REFRESH_PRESENT" : "REFRESH_DELETE",
-                                                       "\n" );
+                                                       "REFRESH_PRESENT" : "REFRESH_DELETE" );
                                                if ( si_tag == LDAP_TAG_SYNC_REFRESH_DELETE ) {
                                                        si->si_refreshDelete = 1;
                                                } else {
@@ -750,19 +883,23 @@ do_syncrep2(
                                                                slap_parse_sync_cookie( &syncCookie, NULL );
                                                        }
                                                }
+                                               /* Defaults to TRUE */
                                                if ( ber_peek_tag( ber, &len ) ==
                                                        LDAP_TAG_REFRESHDONE )
                                                {
-                                                       ber_scanf( ber, "b", &refreshDone );
+                                                       ber_scanf( ber, "b", &si->si_refreshDone );
+                                               } else
+                                               {
+                                                       si->si_refreshDone = 1;
                                                }
                                                ber_scanf( ber, /*"{"*/ "}" );
                                                break;
                                        case LDAP_TAG_SYNC_ID_SET:
                                                Debug( LDAP_DEBUG_SYNC,
-                                                       "do_syncrep2: %s - %s%s\n", 
+                                                       "do_syncrep2: rid %03d %s - %s\n", 
+                                                       si->si_rid,
                                                        "LDAP_RES_INTERMEDIATE", 
-                                                       "SYNC_ID_SET",
-                                                       "\n" );
+                                                       "SYNC_ID_SET" );
                                                ber_scanf( ber, "t{" /*"}"*/, &tag );
                                                if ( ber_peek_tag( ber, &len ) ==
                                                        LDAP_TAG_SYNC_COOKIE )
@@ -785,7 +922,8 @@ do_syncrep2(
                                                ber_scanf( ber, "[W]", &syncUUIDs );
                                                ber_scanf( ber, /*"{"*/ "}" );
                                                if ( refreshDeletes ) {
-                                                       syncrepl_del_nonpresent( op, si, syncUUIDs );
+                                                       syncrepl_del_nonpresent( op, si, syncUUIDs,
+                                                               &syncCookie.ctxcsn );
                                                        ber_bvarray_free_x( syncUUIDs, op->o_tmpmemctx );
                                                } else {
                                                        for ( i = 0; !BER_BVISNULL( &syncUUIDs[i] ); i++ ) {
@@ -798,11 +936,12 @@ do_syncrep2(
                                                        }
                                                        slap_sl_free( syncUUIDs, op->o_tmpmemctx );
                                                }
+                                               slap_sync_cookie_free( &syncCookie, 0 );
                                                break;
                                        default:
                                                Debug( LDAP_DEBUG_ANY,
-                                                       "do_syncrep2 : unknown syncinfo tag (%ld)\n",
-                                               (long) si_tag, 0, 0 );
+                                                       "do_syncrep2: rid %03d unknown syncinfo tag (%ld)\n",
+                                                       si->si_rid, (long) si_tag, 0 );
                                                ldap_memfree( retoid );
                                                ber_bvfree( retdata );
                                                continue;
@@ -820,15 +959,13 @@ do_syncrep2(
                                                        &syncCookie.ctxcsn, &text );
                                        }
 
-                                       if ( !BER_BVISNULL( &syncCookie.ctxcsn ) &&
-                                               match < 0 )
-                                       {
-                                               syncrepl_updateCookie( si, op, psub, &syncCookie);
-                                       }
-
-                                       if ( si->si_refreshPresent == 1 ) {
-                                               if ( match < 0 ) {
-                                                       syncrepl_del_nonpresent( op, si, NULL );
+                                       if ( match < 0 ) {
+                                               if ( si->si_refreshPresent == 1 ) {
+                                                       syncrepl_del_nonpresent( op, si, NULL, &syncCookie.ctxcsn );
+                                               }
+                                               if ( !BER_BVISNULL( &syncCookie.ctxcsn ))
+                                               {
+                                                       syncrepl_updateCookie( si, op, psub, &syncCookie);
                                                }
                                        } 
 
@@ -837,9 +974,9 @@ do_syncrep2(
                                        break;
 
                                } else {
-                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2 : "
+                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2: rid %03d "
                                                "unknown intermediate response (%d)\n",
-                                               rc, 0, 0 );
+                                               si->si_rid, rc, 0 );
                                        ldap_memfree( retoid );
                                        ber_bvfree( retdata );
                                        break;
@@ -847,8 +984,8 @@ do_syncrep2(
                                break;
 
                        default:
-                               Debug( LDAP_DEBUG_ANY, "do_syncrep2 : "
-                                       "unknown message\n", 0, 0, 0 );
+                               Debug( LDAP_DEBUG_ANY, "do_syncrep2: rid %03d "
+                                       "unknown message\n", si->si_rid, 0, 0 );
                                break;
 
                        }
@@ -869,7 +1006,7 @@ do_syncrep2(
                errstr = ldap_err2string( rc );
                
                Debug( LDAP_DEBUG_ANY,
-                       "do_syncrep2 : %s\n", errstr, 0, 0 );
+                       "do_syncrep2: rid %03d %s\n", si->si_rid, errstr, 0 );
        }
 
 done:
@@ -878,7 +1015,13 @@ done:
 
        if ( res ) ldap_msgfree( res );
 
-       if ( rc && si->si_ld ) {
+       if ( rc && rc != LDAP_SYNC_REFRESH_REQUIRED && si->si_ld ) {
+               if ( si->si_conn_setup ) {
+                       ber_socket_t s;
+                       ldap_get_option( si->si_ld, LDAP_OPT_DESC, &s );
+                       connection_client_stop( s );
+                       si->si_conn_setup = 0;
+               }
                ldap_unbind_ext( si->si_ld, NULL, NULL );
                si->si_ld = NULL;
        }
@@ -894,16 +1037,15 @@ do_syncrepl(
        struct re_s* rtask = arg;
        syncinfo_t *si = ( syncinfo_t * ) rtask->arg;
        Connection conn = {0};
-       char opbuf[OPERATION_BUFFER_SIZE];
+       OperationBuffer opbuf;
        Operation *op;
        int rc = LDAP_SUCCESS;
-       int first = 0;
        int dostop = 0;
        ber_socket_t s;
-       int i, defer = 1;
+       int i, defer = 1, fail = 0;
        Backend *be;
 
-       Debug( LDAP_DEBUG_TRACE, "=>do_syncrepl\n", 0, 0, 0 );
+       Debug( LDAP_DEBUG_TRACE, "=>do_syncrepl rid %03d\n", si->si_rid, 0, 0 );
 
        if ( si == NULL )
                return NULL;
@@ -921,8 +1063,11 @@ do_syncrepl(
 
        if ( slapd_shutdown ) {
                if ( si->si_ld ) {
-                       ldap_get_option( si->si_ld, LDAP_OPT_DESC, &s );
-                       connection_client_stop( s );
+                       if ( si->si_conn_setup ) {
+                               ldap_get_option( si->si_ld, LDAP_OPT_DESC, &s );
+                               connection_client_stop( s );
+                               si->si_conn_setup = 0;
+                       }
                        ldap_unbind_ext( si->si_ld, NULL, NULL );
                        si->si_ld = NULL;
                }
@@ -930,7 +1075,7 @@ do_syncrepl(
                return NULL;
        }
 
-       op = (Operation *)opbuf;
+       op = (Operation *) &opbuf;
        connection_fake_init( &conn, op, ctx );
 
        /* use global malloc for now */
@@ -944,29 +1089,35 @@ do_syncrepl(
 
        /* Establish session, do search */
        if ( !si->si_ld ) {
-               first = 1;
                si->si_refreshDelete = 0;
                si->si_refreshPresent = 0;
                rc = do_syncrep1( op, si );
        }
 
+reload:
        /* Process results */
        if ( rc == LDAP_SUCCESS ) {
                ldap_get_option( si->si_ld, LDAP_OPT_DESC, &s );
 
                rc = do_syncrep2( op, si );
+               if ( rc == LDAP_SYNC_REFRESH_REQUIRED ) {
+                       rc = ldap_sync_search( si, op->o_tmpmemctx );
+                       goto reload;
+               }
 
                if ( abs(si->si_type) == LDAP_SYNC_REFRESH_AND_PERSIST ) {
                        /* If we succeeded, enable the connection for further listening.
                         * If we failed, tear down the connection and reschedule.
                         */
                        if ( rc == LDAP_SUCCESS ) {
-                               if ( first ) {
-                                       rc = connection_client_setup( s, do_syncrepl, arg );
-                               } else {
+                               if ( si->si_conn_setup ) {
                                        connection_client_enable( s );
+                               } else {
+                                       rc = connection_client_setup( s, do_syncrepl, arg );
+                                       if ( rc == 0 )
+                                               si->si_conn_setup = 1;
                                } 
-                       } else if ( !first ) {
+                       } else if ( si->si_conn_setup ) {
                                dostop = 1;
                        }
                } else {
@@ -997,34 +1148,332 @@ do_syncrepl(
                rtask->interval.tv_sec = si->si_interval;
                ldap_pvt_runqueue_resched( &slapd_rq, rtask, defer );
                if ( si->si_retrynum ) {
-                       for ( i = 0; si->si_retrynum_init[i] != -2; i++ ) {
+                       for ( i = 0; si->si_retrynum_init[i] != RETRYNUM_TAIL; i++ ) {
                                si->si_retrynum[i] = si->si_retrynum_init[i];
                        }
-                       si->si_retrynum[i] = -2;
+                       si->si_retrynum[i] = RETRYNUM_TAIL;
                }
        } else {
                for ( i = 0; si->si_retrynum && si->si_retrynum[i] <= 0; i++ ) {
-                       if ( si->si_retrynum[i] == -1  || si->si_retrynum[i] == -2 )
+                       if ( si->si_retrynum[i] == RETRYNUM_FOREVER || si->si_retrynum[i] == RETRYNUM_TAIL )
                                break;
                }
 
-               if ( !si->si_retrynum || si->si_retrynum[i] == -2 ) {
+               if ( !si->si_retrynum || si->si_retrynum[i] == RETRYNUM_TAIL ) {
                        ldap_pvt_runqueue_remove( &slapd_rq, rtask );
-               } else if ( si->si_retrynum[i] >= -1 ) {
+                       fail = RETRYNUM_TAIL;
+               } else if ( RETRYNUM_VALID( si->si_retrynum[i] ) ) {
                        if ( si->si_retrynum[i] > 0 )
                                si->si_retrynum[i]--;
+                       fail = si->si_retrynum[i];
                        rtask->interval.tv_sec = si->si_retryinterval[i];
                        ldap_pvt_runqueue_resched( &slapd_rq, rtask, 0 );
                        slap_wake_listener();
                }
        }
-       
+
        ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
        ldap_pvt_thread_mutex_unlock( &si->si_mutex );
 
+       if ( rc ) {
+               if ( fail == RETRYNUM_TAIL ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "do_syncrepl: rid %03d quitting\n",
+                               si->si_rid, 0, 0 );
+               } else if ( fail > 0 ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "do_syncrepl: rid %03d retrying (%d retries left)\n",
+                               si->si_rid, fail, 0 );
+               } else {
+                       Debug( LDAP_DEBUG_ANY,
+                               "do_syncrepl: rid %03d retrying\n",
+                               si->si_rid, 0, 0 );
+               }
+       }
+
        return NULL;
 }
 
+static slap_verbmasks modops[] = {
+       { BER_BVC("add"), LDAP_REQ_ADD },
+       { BER_BVC("delete"), LDAP_REQ_DELETE },
+       { BER_BVC("modify"), LDAP_REQ_MODIFY },
+       { BER_BVC("modrdn"), LDAP_REQ_MODRDN},
+       { BER_BVNULL, 0 }
+};
+
+static Modifications *
+syncrepl_accesslog_mods(
+       syncinfo_t *si,
+       struct berval *vals
+)
+{
+       char *colon;
+       const char *text;
+       AttributeDescription *ad;
+       struct berval bv, bv2;
+       short op;
+       Modifications *mod = NULL, *modlist = NULL, **modtail;
+       int i;
+
+       modtail = &modlist;
+
+       for (i=0; !BER_BVISNULL( &vals[i] ); i++) {
+               ad = NULL;
+               bv = vals[i];
+
+               colon = ber_bvchr( &bv, ':' );
+               if ( !colon )
+                       continue;       /* invalid */
+               bv.bv_len = colon - bv.bv_val;
+               if ( slap_bv2ad( &bv, &ad, &text )) {
+                       /* Invalid */
+                       continue;
+               }
+               /* Ignore dynamically generated attrs */
+               if ( ad->ad_type->sat_flags & SLAP_AT_DYNAMIC )
+                       continue;
+               /* Ignore excluded attrs */
+               if ( ldap_charray_inlist( si->si_exattrs,
+                       ad->ad_type->sat_cname.bv_val ))
+                       continue;
+
+               switch(colon[1]) {
+               case '+':       op = LDAP_MOD_ADD; break;
+               case '-':       op = LDAP_MOD_DELETE; break;
+               case '=':       op = LDAP_MOD_REPLACE; break;
+               case '#':       op = LDAP_MOD_INCREMENT; break;
+               default:        continue;
+               }
+
+               if ( !mod || ad != mod->sml_desc || op != mod->sml_op ) {
+                       mod = (Modifications *) ch_malloc( sizeof( Modifications ));
+                       mod->sml_flags = 0;
+                       mod->sml_op = op;
+                       mod->sml_next = NULL;
+                       mod->sml_desc = ad;
+                       mod->sml_type = ad->ad_cname;
+                       mod->sml_values = NULL;
+                       mod->sml_nvalues = NULL;
+
+                       *modtail = mod;
+                       modtail = &mod->sml_next;
+               }
+               if ( colon[2] == ' ' ) {
+                       bv.bv_val = colon + 3;
+                       bv.bv_len = vals[i].bv_len - ( bv.bv_val - vals[i].bv_val );
+                       ber_dupbv( &bv2, &bv );
+                       ber_bvarray_add( &mod->sml_values, &bv2 );
+               }
+       }
+       return modlist;
+}
+
+static Modifications *
+syncrepl_changelog_mods(
+       syncinfo_t *si,
+       struct berval *vals
+)
+{
+       return NULL;    /* FIXME */
+}
+
+static int
+syncrepl_message_to_op(
+       syncinfo_t      *si,
+       Operation       *op,
+       LDAPMessage     *msg
+)
+{
+       BerElement      *ber = NULL;
+       Modifications   *modlist = NULL;
+       logschema *ls;
+       SlapReply rs = { REP_RESULT };
+       slap_callback cb = { NULL, null_callback, NULL, NULL };
+
+       const char      *text;
+       char txtbuf[SLAP_TEXT_BUFLEN];
+       size_t textlen = sizeof txtbuf;
+
+       struct berval   bdn, dn = BER_BVNULL, ndn;
+       struct berval   bv, *bvals = NULL;
+       struct berval   rdn = BER_BVNULL, sup = BER_BVNULL,
+               prdn = BER_BVNULL, nrdn = BER_BVNULL,
+               psup = BER_BVNULL, nsup = BER_BVNULL;
+       int             rc, deleteOldRdn = 0, freeReqDn = 0;
+
+       if ( ldap_msgtype( msg ) != LDAP_RES_SEARCH_ENTRY ) {
+               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_op: rid %03d "
+                       "Message type should be entry (%d)",
+                       si->si_rid, ldap_msgtype( msg ), 0 );
+               return -1;
+       }
+
+       if ( si->si_syncdata == SYNCDATA_ACCESSLOG )
+               ls = &accesslog_sc;
+       else
+               ls = &changelog_sc;
+
+       rc = ldap_get_dn_ber( si->si_ld, msg, &ber, &bdn );
+
+       if ( rc != LDAP_SUCCESS ) {
+               Debug( LDAP_DEBUG_ANY,
+                       "syncrepl_message_to_op: rid %03d dn get failed (%d)",
+                       si->si_rid, rc, 0 );
+               return rc;
+       }
+
+       op->o_tag = LBER_DEFAULT;
+
+       while (( rc = ldap_get_attribute_ber( si->si_ld, msg, ber, &bv, &bvals ))
+               == LDAP_SUCCESS ) {
+               if ( bv.bv_val == NULL )
+                       break;
+
+               if ( !ber_bvstrcasecmp( &bv, &ls->ls_dn )) {
+                       bdn = bvals[0];
+                       dnPrettyNormal( NULL, &bdn, &dn, &ndn, op->o_tmpmemctx );
+                       ber_dupbv( &op->o_req_dn, &dn );
+                       ber_dupbv( &op->o_req_ndn, &ndn );
+                       slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
+                       slap_sl_free( dn.bv_val, op->o_tmpmemctx );
+                       freeReqDn = 1;
+               } else if ( !ber_bvstrcasecmp( &bv, &ls->ls_req )) {
+                       int i = verb_to_mask( bvals[0].bv_val, modops );
+                       if ( i < 0 ) {
+                               Debug( LDAP_DEBUG_ANY,
+                                       "syncrepl_message_to_op: rid %03d unknown op %s",
+                                       si->si_rid, bvals[0].bv_val, 0 );
+                               ch_free( bvals );
+                               rc = -1;
+                               goto done;
+                       }
+                       op->o_tag = modops[i].mask;
+               } else if ( !ber_bvstrcasecmp( &bv, &ls->ls_mod )) {
+                       /* Parse attribute into modlist */
+                       if ( si->si_syncdata == SYNCDATA_ACCESSLOG )
+                               modlist = syncrepl_accesslog_mods( si, bvals );
+                       else
+                               modlist = syncrepl_changelog_mods( si, bvals );
+               } else if ( !ber_bvstrcasecmp( &bv, &ls->ls_newRdn )) {
+                       rdn = bvals[0];
+               } else if ( !ber_bvstrcasecmp( &bv, &ls->ls_delRdn )) {
+                       if ( !ber_bvstrcasecmp( &slap_true_bv, bvals ))
+                               deleteOldRdn = 1;
+               } else if ( !ber_bvstrcasecmp( &bv, &ls->ls_newSup )) {
+                       sup = bvals[0];
+               } else if ( !ber_bvstrcasecmp( &bv,
+                       &slap_schema.si_ad_entryCSN->ad_cname )) {
+                       slap_queue_csn( op, bvals );
+               }
+               ch_free( bvals );
+       }
+
+       /* If we didn't get a mod type or a target DN, bail out */
+       if ( op->o_tag == LBER_DEFAULT || BER_BVISNULL( &dn )) {
+               rc = -1;
+               goto done;
+       }
+
+       op->o_callback = &cb;
+       slap_op_time( &op->o_time, &op->o_tincr );
+
+       switch( op->o_tag ) {
+       case LDAP_REQ_ADD:
+       case LDAP_REQ_MODIFY:
+               /* If we didn't get required data, bail */
+               if ( !modlist ) goto done;
+
+               rc = slap_mods_check( modlist, &text, txtbuf, textlen, NULL );
+
+               if ( rc != LDAP_SUCCESS ) {
+                       Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_op: rid %03d "
+                               "mods check (%s)\n",
+                               si->si_rid, text, 0 );
+                       goto done;
+               }
+
+               if ( op->o_tag == LDAP_REQ_ADD ) {
+                       op->ora_e = ( Entry * ) ch_calloc( 1, sizeof( Entry ) );
+                       op->ora_e->e_name = op->o_req_dn;
+                       op->ora_e->e_nname = op->o_req_ndn;
+                       freeReqDn = 0;
+                       rc = slap_mods2entry( modlist, &op->ora_e, 1, 0, &text, txtbuf, textlen);
+                       if( rc != LDAP_SUCCESS ) {
+                               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_op: rid %03d "
+                               "mods2entry (%s)\n",
+                                       si->si_rid, text, 0 );
+                       } else {
+                               rc = op->o_bd->be_add( op, &rs );
+                               Debug( LDAP_DEBUG_SYNC,
+                                       "syncrepl_message_to_op: rid %03d be_add %s (%d)\n", 
+                                       si->si_rid, op->o_req_dn.bv_val, rc );
+                       }
+                       be_entry_release_w( op, op->ora_e );
+               } else {
+                       op->orm_modlist = modlist;
+                       rc = op->o_bd->be_modify( op, &rs );
+                       modlist = op->orm_modlist;
+                       Debug( rc ? LDAP_DEBUG_ANY : LDAP_DEBUG_SYNC,
+                               "syncrepl_message_to_op: rid %03d be_modify %s (%d)\n", 
+                               si->si_rid, op->o_req_dn.bv_val, rc );
+               }
+               break;
+       case LDAP_REQ_MODRDN:
+               if ( BER_BVISNULL( &rdn )) goto done;
+
+               if ( rdnPretty( NULL, &rdn, &prdn, NULL ))
+                       goto done;
+               if ( rdnNormalize( 0, NULL, NULL, &rdn, &nrdn, NULL ))
+                       goto done;
+               if ( !BER_BVISNULL( &sup )) {
+                       if ( dnPrettyNormal( NULL, &sup, &psup, &nsup, NULL ))
+                               goto done;
+                       op->orr_newSup = &psup;
+                       op->orr_nnewSup = &nsup;
+               } else {
+                       op->orr_newSup = NULL;
+                       op->orr_nnewSup = NULL;
+               }
+               op->orr_newrdn = prdn;
+               op->orr_nnewrdn = nrdn;
+               op->orr_deleteoldrdn = deleteOldRdn;
+               rc = op->o_bd->be_modrdn( op, &rs );
+               Debug( rc ? LDAP_DEBUG_ANY : LDAP_DEBUG_SYNC,
+                       "syncrepl_message_to_op: rid %03d be_modrdn %s (%d)\n", 
+                       si->si_rid, op->o_req_dn.bv_val, rc );
+               break;
+       case LDAP_REQ_DELETE:
+               rc = op->o_bd->be_delete( op, &rs );
+               Debug( rc ? LDAP_DEBUG_ANY : LDAP_DEBUG_SYNC,
+                       "syncrepl_message_to_op: rid %03d be_delete %s (%d)\n", 
+                       si->si_rid, op->o_req_dn.bv_val, rc );
+               break;
+       }
+done:
+       slap_graduate_commit_csn( op );
+       op->o_tmpfree( op->o_csn.bv_val, op->o_tmpmemctx );
+       BER_BVZERO( &op->o_csn );
+       if ( modlist )
+               slap_mods_free( modlist, op->o_tag != LDAP_REQ_ADD );
+       if ( !BER_BVISNULL( &rdn )) {
+               if ( !BER_BVISNULL( &nsup ))
+                       ch_free( nsup.bv_val );
+               if ( !BER_BVISNULL( &psup ))
+                       ch_free( psup.bv_val );
+               if ( !BER_BVISNULL( &nrdn ))
+                       ch_free( nrdn.bv_val );
+               if ( !BER_BVISNULL( &prdn ))
+                       ch_free( prdn.bv_val );
+       }
+       if ( freeReqDn ) {
+               ch_free( op->o_req_ndn.bv_val );
+               ch_free( op->o_req_dn.bv_val );
+       }
+       ber_free ( ber, 0 );
+       return rc;
+}
+
 static int
 syncrepl_message_to_entry(
        syncinfo_t      *si,
@@ -1045,24 +1494,25 @@ syncrepl_message_to_entry(
        char txtbuf[SLAP_TEXT_BUFLEN];
        size_t textlen = sizeof txtbuf;
 
-       struct berval   bdn = {0, NULL}, dn, ndn;
+       struct berval   bdn = BER_BVNULL, dn, ndn;
        int             rc;
 
        *modlist = NULL;
 
        if ( ldap_msgtype( msg ) != LDAP_RES_SEARCH_ENTRY ) {
-               Debug( LDAP_DEBUG_ANY,
-                       "Message type should be entry (%d)", ldap_msgtype( msg ), 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: rid %03d "
+                       "Message type should be entry (%d)",
+                       si->si_rid, ldap_msgtype( msg ), 0 );
                return -1;
        }
 
        op->o_tag = LDAP_REQ_ADD;
 
        rc = ldap_get_dn_ber( si->si_ld, msg, &ber, &bdn );
-
        if ( rc != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_ANY,
-                       "syncrepl_message_to_entry : dn get failed (%d)", rc, 0, 0 );
+                       "syncrepl_message_to_entry: rid %03d dn get failed (%d)",
+                       si->si_rid, rc, 0 );
                return rc;
        }
 
@@ -1073,17 +1523,18 @@ syncrepl_message_to_entry(
        slap_sl_free( dn.bv_val, op->o_tmpmemctx );
 
        if ( syncstate == LDAP_SYNC_PRESENT || syncstate == LDAP_SYNC_DELETE ) {
-               if ( entry )
-                       *entry = NULL;
-               return LDAP_SUCCESS;
+               /* NOTE: this could be done even before decoding the DN,
+                * although encoding errors wouldn't be detected */
+               rc = LDAP_SUCCESS;
+               goto done;
        }
 
        if ( entry == NULL ) {
-               return -1;
+               rc = -1;
+               goto done;
        }
 
        e = ( Entry * ) ch_calloc( 1, sizeof( Entry ) );
-       *entry = e;
        e->e_name = op->o_req_dn;
        e->e_nname = op->o_req_ndn;
 
@@ -1109,8 +1560,8 @@ syncrepl_message_to_entry(
        }
 
        if ( *modlist == NULL ) {
-               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: no attributes\n",
-                       0, 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: rid %03d no attributes\n",
+                       si->si_rid, 0, 0 );
                rc = -1;
                goto done;
        }
@@ -1118,8 +1569,8 @@ syncrepl_message_to_entry(
        rc = slap_mods_check( *modlist, &text, txtbuf, textlen, NULL );
 
        if ( rc != LDAP_SUCCESS ) {
-               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: mods check (%s)\n",
-                       text, 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: rid %03d mods check (%s)\n",
+                       si->si_rid, text, 0 );
                goto done;
        }
 
@@ -1150,18 +1601,19 @@ syncrepl_message_to_entry(
        
        rc = slap_mods2entry( *modlist, &e, 1, 1, &text, txtbuf, textlen);
        if( rc != LDAP_SUCCESS ) {
-               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: mods2entry (%s)\n",
-                       text, 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: rid %03d mods2entry (%s)\n",
+                       si->si_rid, text, 0 );
        }
 
 done:
-       ber_free ( ber, 0 );
+       ber_free( ber, 0 );
        if ( rc != LDAP_SUCCESS ) {
                if ( e ) {
                        entry_free( e );
-                       *entry = e = NULL;
+                       e = NULL;
                }
        }
+       *entry = e;
 
        return rc;
 }
@@ -1224,7 +1676,6 @@ syncrepl_entry(
        AttributeAssertion ava = { NULL, BER_BVNULL };
 #endif
        int rc = LDAP_SUCCESS;
-       int ret = LDAP_SUCCESS;
 
        struct berval pdn = BER_BVNULL;
        dninfo dni = {0};
@@ -1232,33 +1683,33 @@ syncrepl_entry(
 
        switch( syncstate ) {
        case LDAP_SYNC_PRESENT:
-               Debug( LDAP_DEBUG_SYNC, "%s: %s\n",
-                                       "syncrepl_entry",
+               Debug( LDAP_DEBUG_SYNC, "syncrepl_entry: rid %03d %s\n",
+                                       si->si_rid,
                                        "LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_PRESENT)", 0 );
                break;
        case LDAP_SYNC_ADD:
-               Debug( LDAP_DEBUG_SYNC, "%s: %s\n",
-                                       "syncrepl_entry",
+               Debug( LDAP_DEBUG_SYNC, "syncrepl_entry: rid %03d %s\n",
+                                       si->si_rid,
                                        "LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD)", 0 );
                break;
        case LDAP_SYNC_DELETE:
-               Debug( LDAP_DEBUG_SYNC, "%s: %s\n",
-                                       "syncrepl_entry",
+               Debug( LDAP_DEBUG_SYNC, "syncrepl_entry: rid %03d %s\n",
+                                       si->si_rid,
                                        "LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE)", 0 );
                break;
        case LDAP_SYNC_MODIFY:
-               Debug( LDAP_DEBUG_SYNC, "%s: %s\n",
-                                       "syncrepl_entry",
+               Debug( LDAP_DEBUG_SYNC, "syncrepl_entry: rid %03d %s\n",
+                                       si->si_rid,
                                        "LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY)", 0 );
                break;
        default:
-               Debug( LDAP_DEBUG_ANY, "%s: %s\n",
-                                       "syncrepl_entry",
+               Debug( LDAP_DEBUG_ANY, "syncrepl_entry: rid %03d %s\n",
+                                       si->si_rid,
                                        "LDAP_RES_SEARCH_ENTRY(UNKNOWN syncstate)", 0 );
        }
 
        if (( syncstate == LDAP_SYNC_PRESENT || syncstate == LDAP_SYNC_ADD )) {
-               if ( !si->si_refreshPresent ) {
+               if ( !si->si_refreshPresent && !si->si_refreshDone ) {
                        syncuuid_bv = ber_dupbv( NULL, syncUUID );
                        avl_insert( &si->si_presentlist, (caddr_t) syncuuid_bv,
                                syncuuid_cmp, avl_dup_error );
@@ -1280,12 +1731,12 @@ syncrepl_entry(
        ava.aa_value = *syncUUID;
        op->ors_filter = &f;
 
-       op->ors_filterstr.bv_len = STRLENOF( "(entryUUID=)" ) + syncUUID->bv_len;
+       op->ors_filterstr.bv_len = STRLENOF( "(entryUUID=)" ) + syncUUID_strrep.bv_len;
        op->ors_filterstr.bv_val = (char *) slap_sl_malloc(
                op->ors_filterstr.bv_len + 1, op->o_tmpmemctx ); 
        AC_MEMCPY( op->ors_filterstr.bv_val, "(entryUUID=", STRLENOF( "(entryUUID=" ) );
        AC_MEMCPY( &op->ors_filterstr.bv_val[STRLENOF( "(entryUUID=" )],
-               syncUUID->bv_val, syncUUID->bv_len );
+               syncUUID_strrep.bv_val, syncUUID_strrep.bv_len );
        op->ors_filterstr.bv_val[op->ors_filterstr.bv_len - 1] = ')';
        op->ors_filterstr.bv_val[op->ors_filterstr.bv_len] = '\0';
 
@@ -1313,8 +1764,8 @@ syncrepl_entry(
        if ( limits_check( op, &rs_search ) == 0 ) {
                rc = be->be_search( op, &rs_search );
                Debug( LDAP_DEBUG_SYNC,
-                               "syncrepl_entry: %s (%d)\n", 
-                               "be_search", rc, 0 );
+                               "syncrepl_entry: rid %03d be_search (%d)\n", 
+                               si->si_rid, rc, 0 );
        }
 
        if ( !BER_BVISNULL( &op->ors_filterstr ) ) {
@@ -1326,12 +1777,12 @@ syncrepl_entry(
 
        if ( entry && !BER_BVISNULL( &entry->e_name ) ) {
                Debug( LDAP_DEBUG_SYNC,
-                               "syncrepl_entry: %s\n",
-                               entry->e_name.bv_val, 0, 0 );
+                               "syncrepl_entry: rid %03d %s\n",
+                               si->si_rid, entry->e_name.bv_val, 0 );
        } else {
                Debug( LDAP_DEBUG_SYNC,
-                               "syncrepl_entry: %s\n",
-                               dni.dn.bv_val ? dni.dn.bv_val : "(null)", 0, 0 );
+                               "syncrepl_entry: rid %03d %s\n",
+                               si->si_rid, dni.dn.bv_val ? dni.dn.bv_val : "(null)", 0 );
        }
 
        if ( syncstate != LDAP_SYNC_DELETE ) {
@@ -1351,11 +1802,33 @@ syncrepl_entry(
                        ber_memfree( a->a_vals[0].bv_val );
                        ber_dupbv( &a->a_vals[0], &syncUUID_strrep );
                }
+               /* Don't save the contextCSN on the inooming context entry,
+                * we'll write it when syncrepl_updateCookie eventually
+                * gets called. (ITS#4622)
+                */
+               if ( syncstate == LDAP_SYNC_ADD && dn_match( &entry->e_nname,
+                       &be->be_nsuffix[0] )) {
+                       Attribute **ap;
+                       for ( ap = &entry->e_attrs; *ap; ap=&(*ap)->a_next ) {
+                               a = *ap;
+                               if ( a->a_desc == slap_schema.si_ad_contextCSN ) {
+                                       *ap = a->a_next;
+                                       attr_free( a );
+                                       break;
+                               }
+                       }
+               }
        }
 
+       slap_op_time( &op->o_time, &op->o_tincr );
        switch ( syncstate ) {
        case LDAP_SYNC_ADD:
        case LDAP_SYNC_MODIFY:
+               {
+                       Attribute *a = attr_find( entry->e_attrs, slap_schema.si_ad_entryCSN );
+                       if ( a )
+                               op->o_csn = a->a_vals[0];
+               }
 retry_add:;
                if ( BER_BVISNULL( &dni.dn )) {
 
@@ -1366,20 +1839,20 @@ retry_add:;
 
                        rc = be->be_add( op, &rs_add );
                        Debug( LDAP_DEBUG_SYNC,
-                                       "syncrepl_entry: %s (%d)\n", 
-                                       "be_add", rc, 0 );
+                                       "syncrepl_entry: rid %03d be_add (%d)\n", 
+                                       si->si_rid, rc, 0 );
                        switch ( rs_add.sr_err ) {
                        case LDAP_SUCCESS:
                                be_entry_release_w( op, entry );
-                               ret = 0;
+                               entry = NULL;
                                break;
 
                        case LDAP_REFERRAL:
                        /* we assume that LDAP_NO_SUCH_OBJECT is returned 
                         * only if the suffix entry is not present */
                        case LDAP_NO_SUCH_OBJECT:
-                               syncrepl_add_glue( op, entry );
-                               ret = 0;
+                               rc = syncrepl_add_glue( op, entry );
+                               entry = NULL;
                                break;
 
                        /* if an entry was added via syncrepl_add_glue(),
@@ -1415,18 +1888,19 @@ retry_add:;
                                        cb2.sc_response = dn_callback;
                                        cb2.sc_private = &dni;
 
-                                       be->be_search( &op2, &rs2 );
+                                       rc = be->be_search( &op2, &rs2 );
+                                       if ( rc ) goto done;
 
                                        retry = 0;
+                                       slap_op_time( &op->o_time, &op->o_tincr );
                                        goto retry_add;
                                }
                                /* FALLTHRU */
 
                        default:
                                Debug( LDAP_DEBUG_ANY,
-                                       "syncrepl_entry : be_add failed (%d)\n",
-                                       rs_add.sr_err, 0, 0 );
-                               ret = 1;
+                                       "syncrepl_entry: rid %03d be_add failed (%d)\n",
+                                       si->si_rid, rs_add.sr_err, 0 );
                                break;
                        }
                        goto done;
@@ -1443,23 +1917,27 @@ retry_add:;
 
                        dnParent( &dni.ndn, &noldp );
                        dnParent( &entry->e_nname, &nnewp );
-                       if ( !dn_match( &noldp, &newp )) {
+                       if ( !dn_match( &noldp, &nnewp )) {
                                dnParent( &entry->e_name, &newp );
                                op->orr_newSup = &newp;
                                op->orr_nnewSup = &nnewp;
+                       } else {
+                               op->orr_newSup = NULL;
+                               op->orr_nnewSup = NULL;
                        }
                        op->orr_deleteoldrdn = 0;
                        rc = be->be_modrdn( op, &rs_modify );
                        Debug( LDAP_DEBUG_SYNC,
-                                       "syncrepl_entry: %s (%d)\n", 
-                                       "be_modrdn", rc, 0 );
+                                       "syncrepl_entry: rid %03d be_modrdn (%d)\n", 
+                                       si->si_rid, rc, 0 );
                        if ( rs_modify.sr_err == LDAP_SUCCESS ) {
                                op->o_req_dn = entry->e_name;
                                op->o_req_ndn = entry->e_nname;
                        } else {
-                               ret = 1;
                                goto done;
                        }
+                       if ( dni.wasChanged )
+                               slap_op_time( &op->o_time, &op->o_tincr );
                }
                if ( dni.wasChanged ) {
                        Modifications *mod, *modhead = NULL;
@@ -1515,15 +1993,14 @@ retry_add:;
 
                        rc = be->be_modify( op, &rs_modify );
                        Debug( LDAP_DEBUG_SYNC,
-                                       "syncrepl_entry: %s (%d)\n", 
-                                       "be_modify", rc, 0 );
+                                       "syncrepl_entry: rid %03d be_modify (%d)\n", 
+                                       si->si_rid, rc, 0 );
                        if ( rs_modify.sr_err != LDAP_SUCCESS ) {
                                Debug( LDAP_DEBUG_ANY,
-                                       "syncrepl_entry : be_modify failed (%d)\n",
-                                       rs_modify.sr_err, 0, 0 );
+                                       "syncrepl_entry: rid %03d be_modify failed (%d)\n",
+                                       si->si_rid, rs_modify.sr_err, 0 );
                        }
                }
-               ret = 1;
                goto done;
        case LDAP_SYNC_DELETE :
                if ( !BER_BVISNULL( &dni.dn )) {
@@ -1532,8 +2009,8 @@ retry_add:;
                        op->o_tag = LDAP_REQ_DELETE;
                        rc = be->be_delete( op, &rs_delete );
                        Debug( LDAP_DEBUG_SYNC,
-                                       "syncrepl_entry: %s (%d)\n", 
-                                       "be_delete", rc, 0 );
+                                       "syncrepl_entry: rid %03d be_delete (%d)\n", 
+                                       si->si_rid, rc, 0 );
 
                        while ( rs_delete.sr_err == LDAP_SUCCESS
                                && op->o_delete_glue_parent ) {
@@ -1551,13 +2028,11 @@ retry_add:;
                                }
                        }
                }
-               ret = 0;
                goto done;
 
        default :
                Debug( LDAP_DEBUG_ANY,
-                       "syncrepl_entry : unknown syncstate\n", 0, 0, 0 );
-               ret = 1;
+                       "syncrepl_entry: rid %03d unknown syncstate\n", si->si_rid, 0, 0 );
                goto done;
        }
 
@@ -1575,7 +2050,10 @@ done :
        if ( !BER_BVISNULL( &dni.dn ) ) {
                op->o_tmpfree( dni.dn.bv_val, op->o_tmpmemctx );
        }
-       return ret;
+       if ( entry )
+               entry_free( entry );
+       BER_BVZERO( &op->o_csn );
+       return rc;
 }
 
 static struct berval gcbva[] = {
@@ -1590,7 +2068,8 @@ static void
 syncrepl_del_nonpresent(
        Operation *op,
        syncinfo_t *si,
-       BerVarray uuids )
+       BerVarray uuids,
+       struct berval *cookiecsn )
 {
        Backend* be = op->o_bd;
        slap_callback   cb = { NULL };
@@ -1602,6 +2081,7 @@ syncrepl_del_nonpresent(
        AttributeName   an[2];
 
        struct berval pdn = BER_BVNULL;
+       struct berval csn;
 
        op->o_req_dn = si->si_base;
        op->o_req_ndn = si->si_base;
@@ -1640,7 +2120,9 @@ syncrepl_del_nonpresent(
                for (i=0; uuids[i].bv_val; i++) {
                        op->ors_slimit = 1;
                        uf.f_av_value = uuids[i];
+                       filter2bv_x( op, op->ors_filter, &op->ors_filterstr );
                        rc = be->be_search( op, &rs_search );
+                       op->o_tmpfree( op->ors_filterstr.bv_val, op->o_tmpmemctx );
                }
                si->si_refreshDelete ^= NP_DELETE_ONE;
        } else {
@@ -1664,7 +2146,12 @@ syncrepl_del_nonpresent(
 
        if ( !LDAP_LIST_EMPTY( &si->si_nonpresentlist ) ) {
 
-               slap_queue_csn( op, &si->si_syncCookie.ctxcsn );
+               if ( cookiecsn && !BER_BVISNULL( cookiecsn ))
+                       csn = *cookiecsn;
+               else
+                       csn = si->si_syncCookie.ctxcsn;
+
+               slap_queue_csn( op, &csn );
 
                np_list = LDAP_LIST_FIRST( &si->si_nonpresentlist );
                while ( np_list != NULL ) {
@@ -1678,6 +2165,9 @@ syncrepl_del_nonpresent(
                        op->o_req_dn = *np_prev->npe_name;
                        op->o_req_ndn = *np_prev->npe_nname;
                        rc = op->o_bd->be_delete( op, &rs_delete );
+                       Debug( LDAP_DEBUG_SYNC,
+                               "syncrepl_del_nonpresent: rid %03d be_delete %s (%d)\n", 
+                               si->si_rid, op->o_req_dn.bv_val, rc );
 
                        if ( rs_delete.sr_err == LDAP_NOT_ALLOWED_ON_NONLEAF ) {
                                Modifications mod1, mod2;
@@ -1701,6 +2191,7 @@ syncrepl_del_nonpresent(
                                op->orm_modlist = &mod1;
 
                                rc = be->be_modify( op, &rs_modify );
+                               if ( mod2.sml_next ) slap_mods_free( mod2.sml_next, 1 );
                        }
 
                        while ( rs_delete.sr_err == LDAP_SUCCESS &&
@@ -1728,12 +2219,14 @@ syncrepl_del_nonpresent(
                }
 
                slap_graduate_commit_csn( op );
+               op->o_tmpfree( op->o_csn.bv_val, op->o_tmpmemctx );
+               BER_BVZERO( &op->o_csn );
        }
 
        return;
 }
 
-void
+int
 syncrepl_add_glue(
        Operation* op,
        Entry *e )
@@ -1744,11 +2237,12 @@ syncrepl_add_glue(
        int     rc;
        int suffrdns;
        int i;
-       struct berval dn = {0, NULL};
-       struct berval ndn = {0, NULL};
+       struct berval dn = BER_BVNULL;
+       struct berval ndn = BER_BVNULL;
        Entry   *glue;
        SlapReply       rs_add = {REP_RESULT};
-       char    *ptr, *comma;
+       struct berval   ptr, nptr;
+       char            *comma;
 
        op->o_tag = LDAP_REQ_ADD;
        op->o_callback = &cb;
@@ -1760,8 +2254,10 @@ syncrepl_add_glue(
 
        /* count RDNs in suffix */
        if ( !BER_BVISEMPTY( &be->be_nsuffix[0] ) ) {
-               for ( i = 0, ptr = be->be_nsuffix[0].bv_val; ptr; ptr = strchr( ptr, ',' ) ) {
-                       ptr++;
+               for ( i = 0, ptr = be->be_nsuffix[0], comma = ptr.bv_val; comma != NULL; comma = ber_bvchr( &ptr, ',' ) ) {
+                       comma++;
+                       ptr.bv_len -= comma - ptr.bv_val;
+                       ptr.bv_val = comma;
                        i++;
                }
                suffrdns = i;
@@ -1771,23 +2267,34 @@ syncrepl_add_glue(
        }
 
        /* Start with BE suffix */
-       for ( i = 0, ptr = NULL; i < suffrdns; i++ ) {
-               comma = strrchr( dn.bv_val, ',' );
-               if ( ptr ) *ptr = ',';
-               if ( comma ) *comma = '\0';
-               ptr = comma;
+       ptr = dn;
+       for ( i = 0; i < suffrdns; i++ ) {
+               comma = ber_bvrchr( &ptr, ',' );
+               if ( comma != NULL ) {
+                       ptr.bv_len = comma - ptr.bv_val;
+               } else {
+                       ptr.bv_len = 0;
+                       break;
+               }
        }
-       if ( ptr ) {
-               *ptr++ = ',';
-               dn.bv_len -= ptr - dn.bv_val;
-               dn.bv_val = ptr;
+       
+       if ( !BER_BVISEMPTY( &ptr ) ) {
+               dn.bv_len -= ptr.bv_len + 1;
+               dn.bv_val += ptr.bv_len + 1;
        }
+
        /* the normalizedDNs are always the same length, no counting
         * required.
         */
+       nptr = ndn;
        if ( ndn.bv_len > be->be_nsuffix[0].bv_len ) {
                ndn.bv_val += ndn.bv_len - be->be_nsuffix[0].bv_len;
                ndn.bv_len = be->be_nsuffix[0].bv_len;
+
+               nptr.bv_len = ndn.bv_val - nptr.bv_val - 1;
+
+       } else {
+               nptr.bv_len = 0;
        }
 
        while ( ndn.bv_val > e->e_nname.bv_val ) {
@@ -1829,23 +2336,28 @@ syncrepl_add_glue(
                } else {
                /* incl. ALREADY EXIST */
                        entry_free( glue );
+                       if ( rs_add.sr_err != LDAP_ALREADY_EXISTS ) {
+                               entry_free( e );
+                               return rc;
+                       }
                }
 
                /* Move to next child */
-               for (ptr = dn.bv_val-2; ptr > e->e_name.bv_val && *ptr != ','; ptr--) {
-                       /* empty */
-               }
-               if ( ptr == e->e_name.bv_val ) break;
-               dn.bv_val = ++ptr;
-               dn.bv_len = e->e_name.bv_len - (ptr-e->e_name.bv_val);
-               for( ptr = ndn.bv_val-2;
-                       ptr > e->e_nname.bv_val && *ptr != ',';
-                       ptr--)
-               {
-                       /* empty */
+               comma = ber_bvrchr( &ptr, ',' );
+               if ( comma == NULL ) {
+                       break;
                }
-               ndn.bv_val = ++ptr;
-               ndn.bv_len = e->e_nname.bv_len - (ptr-e->e_nname.bv_val);
+               ptr.bv_len = comma - ptr.bv_val;
+               
+               dn.bv_val = ++comma;
+               dn.bv_len = e->e_name.bv_len - (dn.bv_val - e->e_name.bv_val);
+
+               comma = ber_bvrchr( &nptr, ',' );
+               assert( comma != NULL );
+               nptr.bv_len = comma - nptr.bv_val;
+
+               ndn.bv_val = ++comma;
+               ndn.bv_len = e->e_nname.bv_len - (ndn.bv_val - e->e_nname.bv_val);
        }
 
        op->o_req_dn = e->e_name;
@@ -1858,7 +2370,7 @@ syncrepl_add_glue(
                entry_free( e );
        }
 
-       return;
+       return rc;
 }
 
 static void
@@ -1872,7 +2384,7 @@ syncrepl_updateCookie(
        Modifications mod = { { 0 } };
        struct berval vals[ 2 ];
 
-       int rc;
+       int rc, dbflags;
 
        slap_callback cb = { NULL };
        SlapReply       rs_modify = {REP_RESULT};
@@ -1904,15 +2416,22 @@ syncrepl_updateCookie(
        /* update contextCSN */
        op->o_msgid = SLAP_SYNC_UPDATE_MSGID;
        op->orm_modlist = &mod;
+       dbflags = SLAP_DBFLAGS(op->o_bd);
+       SLAP_DBFLAGS(op->o_bd) |= SLAP_DBFLAG_NOLASTMOD;
        rc = be->be_modify( op, &rs_modify );
+       SLAP_DBFLAGS(op->o_bd) = dbflags;
        op->o_msgid = 0;
 
        if ( rs_modify.sr_err != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_ANY,
-                       "be_modify failed (%d)\n", rs_modify.sr_err, 0, 0 );
+                       "syncrepl_updateCookie: rid %03d be_modify failed (%d)\n",
+                       si->si_rid, rs_modify.sr_err, 0 );
        }
 
        slap_graduate_commit_csn( op );
+       op->o_tmpfree( op->o_csn.bv_val, op->o_tmpmemctx );
+       BER_BVZERO( &op->o_csn );
+       if ( mod.sml_next ) slap_mods_free( mod.sml_next, 1 );
 
        return;
 }
@@ -1927,7 +2446,7 @@ dn_callback(
        if ( rs->sr_type == REP_SEARCH ) {
                if ( !BER_BVISNULL( &dni->dn ) ) {
                        Debug( LDAP_DEBUG_ANY,
-                               "dn_callback : consistency error - "
+                               "dn_callback: consistency error - "
                                "entryUUID is not unique\n", 0, 0, 0 );
                } else {
                        ber_dupbv_x( &dni->dn, &rs->sr_entry->e_name, op->o_tmpmemctx );
@@ -1944,10 +2463,11 @@ dn_callback(
                                 * discover if the deleteOldRdn argument applies here. It
                                 * would save an unnecessary Modify if we detected it, but
                                 * that's a fair amount of trouble to compare the two attr
-                                * lists in detail.
+                                * lists in detail. (Just test normalized DN; we ignore
+                                * insignificant changes here.)
                                 */
-                               if ( !dn_match( &rs->sr_entry->e_name,
-                                               &dni->new_entry->e_name ) )
+                               if ( !dn_match( &rs->sr_entry->e_nname,
+                                               &dni->new_entry->e_nname ) )
                                {
                                        dni->renamed = 1;
                                }
@@ -2007,7 +2527,7 @@ dn_callback(
        } else if ( rs->sr_type == REP_RESULT ) {
                if ( rs->sr_err == LDAP_SIZELIMIT_EXCEEDED ) {
                        Debug( LDAP_DEBUG_ANY,
-                               "dn_callback : consistency error - "
+                               "dn_callback: consistency error - "
                                "entryUUID is not unique\n", 0, 0, 0 );
                }
        }
@@ -2069,7 +2589,7 @@ null_callback(
                rs->sr_err != LDAP_NOT_ALLOWED_ON_NONLEAF )
        {
                Debug( LDAP_DEBUG_ANY,
-                       "null_callback : error code 0x%x\n",
+                       "null_callback: error code 0x%x\n",
                        rs->sr_err, 0, 0 );
        }
        return LDAP_SUCCESS;
@@ -2156,10 +2676,17 @@ avl_ber_bvfree( void *v_bv )
 void
 syncinfo_free( syncinfo_t *sie )
 {
+       if ( sie->si_ld ) {
+               if ( sie->si_conn_setup ) {
+                       ber_socket_t s;
+                       ldap_get_option( sie->si_ld, LDAP_OPT_DESC, &s );
+                       connection_client_stop( s );
+                       sie->si_conn_setup = 0;
+               }
+               ldap_unbind_ext( sie->si_ld, NULL, NULL );
+       }
+
        ldap_pvt_thread_mutex_destroy( &sie->si_mutex );
-       if ( !BER_BVISNULL( &sie->si_provideruri ) ) {
-               ch_free( sie->si_provideruri.bv_val );
-       }
 
        bindconf_free( &sie->si_bindconf );
 
@@ -2214,9 +2741,6 @@ syncinfo_free( syncinfo_t *sie )
        if ( sie->si_presentlist ) {
            avl_free( sie->si_presentlist, avl_ber_bvfree );
        }
-       if ( sie->si_ld ) {
-               ldap_ld_free( sie->si_ld, 1, NULL, NULL );
-       }
        while ( !LDAP_LIST_EMPTY( &sie->si_nonpresentlist )) {
                struct nonpresent_entry* npe;
                npe = LDAP_LIST_FIRST( &sie->si_nonpresentlist );
@@ -2254,8 +2778,11 @@ syncinfo_free( syncinfo_t *sie )
 #define RETRYSTR               "retry"
 #define SLIMITSTR              "sizelimit"
 #define TLIMITSTR              "timelimit"
+#define SYNCDATASTR            "syncdata"
 
 /* FIXME: undocumented */
+#define        LOGBASESTR      "logbase"
+#define LOGFILTERSTR   "logfilter"
 #define OLDAUTHCSTR            "bindprincipal"
 #define EXATTRSSTR             "exattrs"
 #define MANAGEDSAITSTR         "manageDSAit"
@@ -2271,9 +2798,10 @@ syncinfo_free( syncinfo_t *sie )
 /* mandatory */
 #define GOT_ID                 0x0001
 #define GOT_PROVIDER           0x0002
+#define GOT_BASE               0x0004
 
 /* check */
-#define GOT_ALL                        (GOT_ID|GOT_PROVIDER)
+#define GOT_ALL                        (GOT_ID|GOT_PROVIDER|GOT_BASE)
 
 static struct {
        struct berval key;
@@ -2282,51 +2810,62 @@ static struct {
        { BER_BVC("base"), LDAP_SCOPE_BASE },
        { BER_BVC("one"), LDAP_SCOPE_ONELEVEL },
        { BER_BVC("onelevel"), LDAP_SCOPE_ONELEVEL },   /* OpenLDAP extension */
-#ifdef LDAP_SCOPE_SUBORDINATE
        { BER_BVC("children"), LDAP_SCOPE_SUBORDINATE },
        { BER_BVC("subordinate"), LDAP_SCOPE_SUBORDINATE },
-#endif
        { BER_BVC("sub"), LDAP_SCOPE_SUBTREE },
        { BER_BVC("subtree"), LDAP_SCOPE_SUBTREE },     /* OpenLDAP extension */
        { BER_BVNULL, 0 }
 };
 
+static slap_verbmasks datamodes[] = {
+       { BER_BVC("default"), SYNCDATA_DEFAULT },
+       { BER_BVC("accesslog"), SYNCDATA_ACCESSLOG },
+       { BER_BVC("changelog"), SYNCDATA_CHANGELOG },
+       { BER_BVNULL, 0 }
+};
+
 static int
 parse_syncrepl_line(
-       char            **cargv,
-       int             cargc,
-       syncinfo_t      *si
-)
+       ConfigArgs      *c,
+       syncinfo_t      *si )
 {
        int     gots = 0;
        int     i;
        char    *val;
 
-       for ( i = 1; i < cargc; i++ ) {
-               if ( !strncasecmp( cargv[ i ], IDSTR "=",
+       for ( i = 1; i < c->argc; i++ ) {
+               if ( !strncasecmp( c->argv[ i ], IDSTR "=",
                                        STRLENOF( IDSTR "=" ) ) )
                {
                        int tmp;
                        /* '\0' string terminator accounts for '=' */
-                       val = cargv[ i ] + STRLENOF( IDSTR "=" );
-                       tmp= atoi( val );
+                       val = c->argv[ i ] + STRLENOF( IDSTR "=" );
+                       if ( lutil_atoi( &tmp, val ) != 0 ) {
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "Error: parse_syncrepl_line: "
+                                       "unable to parse syncrepl id \"%s\"", val );
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                               return -1;
+                       }
                        if ( tmp >= 1000 || tmp < 0 ) {
-                               fprintf( stderr, "Error: parse_syncrepl_line: "
-                                        "syncrepl id %d is out of range [0..999]\n", tmp );
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "Error: parse_syncrepl_line: "
+                                       "syncrepl id %d is out of range [0..999]", tmp );
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                return -1;
                        }
                        si->si_rid = tmp;
                        gots |= GOT_ID;
-               } else if ( !strncasecmp( cargv[ i ], PROVIDERSTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], PROVIDERSTR "=",
                                        STRLENOF( PROVIDERSTR "=" ) ) )
                {
-                       val = cargv[ i ] + STRLENOF( PROVIDERSTR "=" );
-                       ber_str2bv( val, 0, 1, &si->si_provideruri );
+                       val = c->argv[ i ] + STRLENOF( PROVIDERSTR "=" );
+                       ber_str2bv( val, 0, 1, &si->si_bindconf.sb_uri );
                        gots |= GOT_PROVIDER;
-               } else if ( !strncasecmp( cargv[ i ], SCHEMASTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], SCHEMASTR "=",
                                        STRLENOF( SCHEMASTR "=" ) ) )
                {
-                       val = cargv[ i ] + STRLENOF( SCHEMASTR "=" );
+                       val = c->argv[ i ] + STRLENOF( SCHEMASTR "=" );
                        if ( !strncasecmp( val, "on", STRLENOF( "on" ) )) {
                                si->si_schemachecking = 1;
                        } else if ( !strncasecmp( val, "off", STRLENOF( "off" ) ) ) {
@@ -2334,33 +2873,72 @@ parse_syncrepl_line(
                        } else {
                                si->si_schemachecking = 1;
                        }
-               } else if ( !strncasecmp( cargv[ i ], FILTERSTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], FILTERSTR "=",
                                        STRLENOF( FILTERSTR "=" ) ) )
                {
-                       val = cargv[ i ] + STRLENOF( FILTERSTR "=" );
+                       val = c->argv[ i ] + STRLENOF( FILTERSTR "=" );
+                       if ( si->si_filterstr.bv_val )
+                               ch_free( si->si_filterstr.bv_val );
                        ber_str2bv( val, 0, 1, &si->si_filterstr );
-               } else if ( !strncasecmp( cargv[ i ], SEARCHBASESTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], LOGFILTERSTR "=",
+                                       STRLENOF( LOGFILTERSTR "=" ) ) )
+               {
+                       val = c->argv[ i ] + STRLENOF( LOGFILTERSTR "=" );
+                       if ( si->si_logfilterstr.bv_val )
+                               ch_free( si->si_logfilterstr.bv_val );
+                       ber_str2bv( val, 0, 1, &si->si_logfilterstr );
+               } else if ( !strncasecmp( c->argv[ i ], SEARCHBASESTR "=",
                                        STRLENOF( SEARCHBASESTR "=" ) ) )
                {
                        struct berval   bv;
                        int             rc;
 
-                       val = cargv[ i ] + STRLENOF( SEARCHBASESTR "=" );
+                       val = c->argv[ i ] + STRLENOF( SEARCHBASESTR "=" );
                        if ( si->si_base.bv_val ) {
                                ch_free( si->si_base.bv_val );
                        }
                        ber_str2bv( val, 0, 0, &bv );
                        rc = dnNormalize( 0, NULL, NULL, &bv, &si->si_base, NULL );
                        if ( rc != LDAP_SUCCESS ) {
-                               fprintf( stderr, "Invalid base DN \"%s\": %d (%s)\n",
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "Invalid base DN \"%s\": %d (%s)",
+                                       val, rc, ldap_err2string( rc ) );
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                               return -1;
+                       }
+                       if ( select_backend( &si->si_base, 0, 0 ) != c->be ) {
+                               ber_memfree( si->si_base.bv_val );
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "Base DN \"%s\" is not within the database naming context",
+                                       val );
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                               return -1;
+                       }
+                       gots |= GOT_BASE;
+               } else if ( !strncasecmp( c->argv[ i ], LOGBASESTR "=",
+                                       STRLENOF( LOGBASESTR "=" ) ) )
+               {
+                       struct berval   bv;
+                       int             rc;
+
+                       val = c->argv[ i ] + STRLENOF( LOGBASESTR "=" );
+                       if ( si->si_logbase.bv_val ) {
+                               ch_free( si->si_logbase.bv_val );
+                       }
+                       ber_str2bv( val, 0, 0, &bv );
+                       rc = dnNormalize( 0, NULL, NULL, &bv, &si->si_logbase, NULL );
+                       if ( rc != LDAP_SUCCESS ) {
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "Invalid logbase DN \"%s\": %d (%s)",
                                        val, rc, ldap_err2string( rc ) );
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                return -1;
                        }
-               } else if ( !strncasecmp( cargv[ i ], SCOPESTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], SCOPESTR "=",
                                        STRLENOF( SCOPESTR "=" ) ) )
                {
                        int j;
-                       val = cargv[ i ] + STRLENOF( SCOPESTR "=" );
+                       val = c->argv[ i ] + STRLENOF( SCOPESTR "=" );
                        for ( j=0; !BER_BVISNULL(&scopes[j].key); j++ ) {
                                if (!strcasecmp( val, scopes[j].key.bv_val )) {
                                        si->si_scope = scopes[j].val;
@@ -2368,18 +2946,20 @@ parse_syncrepl_line(
                                }
                        }
                        if ( BER_BVISNULL(&scopes[j].key) ) {
-                               fprintf( stderr, "Error: parse_syncrepl_line: "
-                                       "unknown scope \"%s\"\n", val);
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "Error: parse_syncrepl_line: "
+                                       "unknown scope \"%s\"", val);
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                return -1;
                        }
-               } else if ( !strncasecmp( cargv[ i ], ATTRSONLYSTR "=",
-                                       STRLENOF( ATTRSONLYSTR "=" ) ) )
+               } else if ( !strncasecmp( c->argv[ i ], ATTRSONLYSTR,
+                                       STRLENOF( ATTRSONLYSTR ) ) )
                {
                        si->si_attrsonly = 1;
-               } else if ( !strncasecmp( cargv[ i ], ATTRSSTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], ATTRSSTR "=",
                                        STRLENOF( ATTRSSTR "=" ) ) )
                {
-                       val = cargv[ i ] + STRLENOF( ATTRSSTR "=" );
+                       val = c->argv[ i ] + STRLENOF( ATTRSSTR "=" );
                        if ( !strncasecmp( val, ":include:", STRLENOF(":include:") ) ) {
                                char *attr_fname;
                                attr_fname = ch_strdup( val + STRLENOF(":include:") );
@@ -2412,15 +2992,15 @@ parse_syncrepl_line(
                                        return -1;
                                }
                        }
-               } else if ( !strncasecmp( cargv[ i ], EXATTRSSTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], EXATTRSSTR "=",
                                        STRLENOF( EXATTRSSTR "=" ) ) )
                {
-                       val = cargv[ i ] + STRLENOF( EXATTRSSTR "=" );
+                       val = c->argv[ i ] + STRLENOF( EXATTRSSTR "=" );
                        if ( !strncasecmp( val, ":include:", STRLENOF(":include:") )) {
                                char *attr_fname;
                                attr_fname = ch_strdup( val + STRLENOF(":include:") );
                                si->si_exanlist = file2anlist(
-                                                                       si->si_exanlist, attr_fname, " ,\t" );
+                                       si->si_exanlist, attr_fname, " ,\t" );
                                if ( si->si_exanlist == NULL ) {
                                        ch_free( attr_fname );
                                        return -1;
@@ -2432,85 +3012,101 @@ parse_syncrepl_line(
                                        return -1;
                                }
                        }
-               } else if ( !strncasecmp( cargv[ i ], TYPESTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], TYPESTR "=",
                                        STRLENOF( TYPESTR "=" ) ) )
                {
-                       val = cargv[ i ] + STRLENOF( TYPESTR "=" );
+                       val = c->argv[ i ] + STRLENOF( TYPESTR "=" );
                        if ( !strncasecmp( val, "refreshOnly",
-                                               STRLENOF("refreshOnly") ))
+                                               STRLENOF("refreshOnly") ) )
                        {
-                               si->si_type = LDAP_SYNC_REFRESH_ONLY;
+                               si->si_type = si->si_ctype = LDAP_SYNC_REFRESH_ONLY;
                        } else if ( !strncasecmp( val, "refreshAndPersist",
-                                               STRLENOF("refreshAndPersist") ))
+                                               STRLENOF("refreshAndPersist") ) )
                        {
-                               si->si_type = LDAP_SYNC_REFRESH_AND_PERSIST;
+                               si->si_type = si->si_ctype = LDAP_SYNC_REFRESH_AND_PERSIST;
                                si->si_interval = 60;
                        } else {
-                               fprintf( stderr, "Error: parse_syncrepl_line: "
-                                       "unknown sync type \"%s\"\n", val);
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "Error: parse_syncrepl_line: "
+                                       "unknown sync type \"%s\"", val);
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                return -1;
                        }
-               } else if ( !strncasecmp( cargv[ i ], INTERVALSTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], INTERVALSTR "=",
                                        STRLENOF( INTERVALSTR "=" ) ) )
                {
-                       val = cargv[ i ] + STRLENOF( INTERVALSTR "=" );
+                       val = c->argv[ i ] + STRLENOF( INTERVALSTR "=" );
                        if ( si->si_type == LDAP_SYNC_REFRESH_AND_PERSIST ) {
                                si->si_interval = 0;
-                       } else {
-                               char *hstr;
-                               char *mstr;
-                               char *dstr;
-                               char *sstr;
-                               int dd, hh, mm, ss;
-                               dstr = val;
-                               hstr = strchr( dstr, ':' );
-                               if ( hstr == NULL ) {
-                                       fprintf( stderr, "Error: parse_syncrepl_line: "
-                                               "invalid interval \"%s\"\n", val );
+                       } else if ( strchr( val, ':' ) != NULL ) {
+                               char *next, *ptr = val;
+                               unsigned dd, hh, mm, ss;
+                               
+                               /* NOTE: the test for ptr[ 0 ] == '-'
+                                * should go before the call to strtoul() */
+                               dd = strtoul( ptr, &next, 10 );
+                               if ( ptr[ 0 ] == '-' || next == ptr || next[0] != ':' ) {
+                                       snprintf( c->msg, sizeof( c->msg ),
+                                               "Error: parse_syncrepl_line: "
+                                               "invalid interval \"%s\", unable to parse days", val );
+                                       Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                        return -1;
                                }
-                               *hstr++ = '\0';
-                               mstr = strchr( hstr, ':' );
-                               if ( mstr == NULL ) {
-                                       fprintf( stderr, "Error: parse_syncrepl_line: "
-                                               "invalid interval \"%s\"\n", val );
+                               ptr = next + 1;
+                               hh = strtoul( ptr, &next, 10 );
+                               if ( ptr[ 0 ] == '-' || next == ptr || next[0] != ':' || hh > 24 ) {
+                                       snprintf( c->msg, sizeof( c->msg ),
+                                               "Error: parse_syncrepl_line: "
+                                               "invalid interval \"%s\", unable to parse hours", val );
+                                       Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                        return -1;
                                }
-                               *mstr++ = '\0';
-                               sstr = strchr( mstr, ':' );
-                               if ( sstr == NULL ) {
-                                       fprintf( stderr, "Error: parse_syncrepl_line: "
-                                               "invalid interval \"%s\"\n", val );
+                               ptr = next + 1;
+                               mm = strtoul( ptr, &next, 10 );
+                               if ( ptr[ 0 ] == '-' || next == ptr || next[0] != ':' || mm > 60 ) {
+                                       snprintf( c->msg, sizeof( c->msg ),
+                                               "Error: parse_syncrepl_line: "
+                                               "invalid interval \"%s\", unable to parse minutes", val );
+                                       Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                        return -1;
                                }
-                               *sstr++ = '\0';
-
-                               dd = atoi( dstr );
-                               hh = atoi( hstr );
-                               mm = atoi( mstr );
-                               ss = atoi( sstr );
-                               if (( hh > 24 ) || ( hh < 0 ) ||
-                                       ( mm > 60 ) || ( mm < 0 ) ||
-                                       ( ss > 60 ) || ( ss < 0 ) || ( dd < 0 )) {
-                                       fprintf( stderr, "Error: parse_syncrepl_line: "
-                                               "invalid interval \"%s\"\n", val );
+                               ptr = next + 1;
+                               ss = strtoul( ptr, &next, 10 );
+                               if ( ptr[ 0 ] == '-' || next == ptr || next[0] != '\0' || ss > 60 ) {
+                                       snprintf( c->msg, sizeof( c->msg ),
+                                               "Error: parse_syncrepl_line: "
+                                               "invalid interval \"%s\", unable to parse seconds", val );
+                                       Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                        return -1;
                                }
                                si->si_interval = (( dd * 24 + hh ) * 60 + mm ) * 60 + ss;
+                       } else {
+                               unsigned long   t;
+
+                               if ( lutil_parse_time( val, &t ) != 0 ) {
+                                       snprintf( c->msg, sizeof( c->msg ),
+                                               "Error: parse_syncrepl_line: "
+                                               "invalid interval \"%s\"", val );
+                                       Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                                       return -1;
+                               }
+                               si->si_interval = (time_t)t;
                        }
                        if ( si->si_interval < 0 ) {
-                               fprintf( stderr, "Error: parse_syncrepl_line: "
-                                       "invalid interval \"%ld\"\n",
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "Error: parse_syncrepl_line: "
+                                       "invalid interval \"%ld\"",
                                        (long) si->si_interval);
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                return -1;
                        }
-               } else if ( !strncasecmp( cargv[ i ], RETRYSTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], RETRYSTR "=",
                                        STRLENOF( RETRYSTR "=" ) ) )
                {
                        char **retry_list;
                        int j, k, n;
 
-                       val = cargv[ i ] + STRLENOF( RETRYSTR "=" );
+                       val = c->argv[ i ] + STRLENOF( RETRYSTR "=" );
                        retry_list = (char **) ch_calloc( 1, sizeof( char * ));
                        retry_list[0] = NULL;
 
@@ -2519,62 +3115,127 @@ parse_syncrepl_line(
                        for ( k = 0; retry_list && retry_list[k]; k++ ) ;
                        n = k / 2;
                        if ( k % 2 ) {
-                               fprintf( stderr,
-                                               "Error: incomplete syncrepl retry list\n" );
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "Error: incomplete syncrepl retry list" );
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                for ( k = 0; retry_list && retry_list[k]; k++ ) {
                                        ch_free( retry_list[k] );
                                }
                                ch_free( retry_list );
-                               exit( EXIT_FAILURE );
+                               return 1;
                        }
                        si->si_retryinterval = (time_t *) ch_calloc( n + 1, sizeof( time_t ));
                        si->si_retrynum = (int *) ch_calloc( n + 1, sizeof( int ));
                        si->si_retrynum_init = (int *) ch_calloc( n + 1, sizeof( int ));
                        for ( j = 0; j < n; j++ ) {
-                               si->si_retryinterval[j] = atoi( retry_list[j*2] );
+                               unsigned long   t;
+                               if ( lutil_atoul( &t, retry_list[j*2] ) != 0 ) {
+                                       snprintf( c->msg, sizeof( c->msg ),
+                                               "Error: invalid retry interval \"%s\" (#%d)",
+                                               retry_list[j*2], j );
+                                       Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                                       /* do some cleanup */
+                                       return 1;
+                               }
+                               si->si_retryinterval[j] = (time_t)t;
                                if ( *retry_list[j*2+1] == '+' ) {
-                                       si->si_retrynum_init[j] = -1;
-                                       si->si_retrynum[j] = -1;
+                                       si->si_retrynum_init[j] = RETRYNUM_FOREVER;
+                                       si->si_retrynum[j] = RETRYNUM_FOREVER;
                                        j++;
                                        break;
                                } else {
-                                       si->si_retrynum_init[j] = atoi( retry_list[j*2+1] );
-                                       si->si_retrynum[j] = atoi( retry_list[j*2+1] );
+                                       if ( lutil_atoi( &si->si_retrynum_init[j], retry_list[j*2+1] ) != 0
+                                                       || si->si_retrynum_init[j] <= 0 )
+                                       {
+                                               snprintf( c->msg, sizeof( c->msg ),
+                                                       "Error: invalid initial retry number \"%s\" (#%d)",
+                                                       retry_list[j*2+1], j );
+                                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                                               /* do some cleanup */
+                                               return 1;
+                                       }
+                                       if ( lutil_atoi( &si->si_retrynum[j], retry_list[j*2+1] ) != 0
+                                                       || si->si_retrynum[j] <= 0 )
+                                       {
+                                               snprintf( c->msg, sizeof( c->msg ),
+                                                       "Error: invalid retry number \"%s\" (#%d)",
+                                                       retry_list[j*2+1], j );
+                                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                                               /* do some cleanup */
+                                               return 1;
+                                       }
                                }
                        }
-                       si->si_retrynum_init[j] = -2;
-                       si->si_retrynum[j] = -2;
+                       si->si_retrynum_init[j] = RETRYNUM_TAIL;
+                       si->si_retrynum[j] = RETRYNUM_TAIL;
                        si->si_retryinterval[j] = 0;
                        
                        for ( k = 0; retry_list && retry_list[k]; k++ ) {
                                ch_free( retry_list[k] );
                        }
                        ch_free( retry_list );
-               } else if ( !strncasecmp( cargv[ i ], MANAGEDSAITSTR "=",
+               } else if ( !strncasecmp( c->argv[ i ], MANAGEDSAITSTR "=",
                                        STRLENOF( MANAGEDSAITSTR "=" ) ) )
                {
-                       val = cargv[ i ] + STRLENOF( MANAGEDSAITSTR "=" );
-                       si->si_manageDSAit = atoi( val );
-               } else if ( !strncasecmp( cargv[ i ], SLIMITSTR "=",
+                       val = c->argv[ i ] + STRLENOF( MANAGEDSAITSTR "=" );
+                       if ( lutil_atoi( &si->si_manageDSAit, val ) != 0
+                               || si->si_manageDSAit < 0 || si->si_manageDSAit > 1 )
+                       {
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "invalid manageDSAit value \"%s\".\n",
+                                       val );
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                               return 1;
+                       }
+               } else if ( !strncasecmp( c->argv[ i ], SLIMITSTR "=",
                                        STRLENOF( SLIMITSTR "=") ) )
                {
-                       val = cargv[ i ] + STRLENOF( SLIMITSTR "=" );
-                       si->si_slimit = atoi( val );
-               } else if ( !strncasecmp( cargv[ i ], TLIMITSTR "=",
+                       val = c->argv[ i ] + STRLENOF( SLIMITSTR "=" );
+                       if ( strcasecmp( val, "unlimited" ) == 0 ) {
+                               si->si_slimit = 0;
+
+                       } else if ( lutil_atoi( &si->si_slimit, val ) != 0 || si->si_slimit < 0 ) {
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "invalid size limit value \"%s\".\n",
+                                       val );
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                               return 1;
+                       }
+               } else if ( !strncasecmp( c->argv[ i ], TLIMITSTR "=",
                                        STRLENOF( TLIMITSTR "=" ) ) )
                {
-                       val = cargv[ i ] + STRLENOF( TLIMITSTR "=" );
-                       si->si_tlimit = atoi( val );
-               } else if ( bindconf_parse( cargv[i], &si->si_bindconf )) {
-                       fprintf( stderr, "Error: parse_syncrepl_line: "
-                               "unknown keyword \"%s\"\n", cargv[ i ] );
+                       val = c->argv[ i ] + STRLENOF( TLIMITSTR "=" );
+                       if ( strcasecmp( val, "unlimited" ) == 0 ) {
+                               si->si_tlimit = 0;
+
+                       } else if ( lutil_atoi( &si->si_tlimit, val ) != 0 || si->si_tlimit < 0 ) {
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "invalid time limit value \"%s\".\n",
+                                       val );
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                               return 1;
+                       }
+               } else if ( !strncasecmp( c->argv[ i ], SYNCDATASTR "=",
+                                       STRLENOF( SYNCDATASTR "=" ) ) )
+               {
+                       val = c->argv[ i ] + STRLENOF( SYNCDATASTR "=" );
+                       si->si_syncdata = verb_to_mask( val, datamodes );
+               } else if ( bindconf_parse( c->argv[i], &si->si_bindconf ) ) {
+                       snprintf( c->msg, sizeof( c->msg ),
+                               "Error: parse_syncrepl_line: "
+                               "unable to parse \"%s\"\n", c->argv[ i ] );
+                       Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                        return -1;
                }
        }
 
        if ( gots != GOT_ALL ) {
-               fprintf( stderr,
-                       "Error: Malformed \"syncrepl\" line in slapd config file" );
+               snprintf( c->msg, sizeof( c->msg ),
+                       "Error: Malformed \"syncrepl\" line in slapd config file, missing%s%s%s",
+                       gots & GOT_ID ? "" : " "IDSTR,
+                       gots & GOT_PROVIDER ? "" : " "PROVIDERSTR,
+                       gots & GOT_BASE ? "" : " "SEARCHBASESTR );
+               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                return -1;
        }
 
@@ -2583,17 +3244,20 @@ parse_syncrepl_line(
 
 static int
 add_syncrepl(
-       Backend *be,
-       char    **cargv,
-       int     cargc
-)
+       ConfigArgs *c )
 {
        syncinfo_t *si;
        int     rc = 0;
 
-       if ( !( be->be_search && be->be_add && be->be_modify && be->be_delete )) {
-               Debug( LDAP_DEBUG_ANY, "database %s does not support operations "
-                       "required for syncrepl\n", be->be_type, 0, 0 );
+       if ( !( c->be->be_search && c->be->be_add && c->be->be_modify && c->be->be_delete ) ) {
+               snprintf( c->msg, sizeof(c->msg), "database %s does not support "
+                       "operations required for syncrepl", c->be->be_type );
+               Debug( LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 );
+               return 1;
+       }
+       if ( BER_BVISEMPTY( &c->be->be_rootdn )) {
+               strcpy( c->msg, "rootDN must be defined before syncrepl may be used" );
+               Debug( LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 );
                return 1;
        }
        si = (syncinfo_t *) ch_calloc( 1, sizeof( syncinfo_t ) );
@@ -2617,7 +3281,7 @@ add_syncrepl(
        si->si_allattrs = 0;
        si->si_allopattrs = 0;
        si->si_exattrs = NULL;
-       si->si_type = LDAP_SYNC_REFRESH_ONLY;
+       si->si_type = si->si_ctype = LDAP_SYNC_REFRESH_ONLY;
        si->si_interval = 86400;
        si->si_retryinterval = NULL;
        si->si_retrynum_init = NULL;
@@ -2625,18 +3289,19 @@ add_syncrepl(
        si->si_manageDSAit = 0;
        si->si_tlimit = 0;
        si->si_slimit = 0;
+       si->si_conn_setup = 0;
 
        si->si_presentlist = NULL;
        LDAP_LIST_INIT( &si->si_nonpresentlist );
        ldap_pvt_thread_mutex_init( &si->si_mutex );
 
-       rc = parse_syncrepl_line( cargv, cargc, si );
+       rc = parse_syncrepl_line( c, si );
 
        if ( rc == 0 ) {
-               si->si_be = be;
+               si->si_be = c->be;
                init_syncrepl( si );
                si->si_re = ldap_pvt_runqueue_insert( &slapd_rq, si->si_interval,
-                       do_syncrepl, si, "do_syncrepl", be->be_suffix[0].bv_val );
+                       do_syncrepl, si, "do_syncrepl", c->be->be_suffix[0].bv_val );
                if ( !si->si_re )
                        rc = -1;
        }
@@ -2647,12 +3312,12 @@ add_syncrepl(
        } else {
                Debug( LDAP_DEBUG_CONFIG,
                        "Config: ** successfully added syncrepl \"%s\"\n",
-                       BER_BVISNULL( &si->si_provideruri ) ?
-                       "(null)" : si->si_provideruri.bv_val, 0, 0 );
+                       BER_BVISNULL( &si->si_bindconf.sb_uri ) ?
+                       "(null)" : si->si_bindconf.sb_uri.bv_val, 0, 0 );
                if ( !si->si_schemachecking ) {
-                       SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK;
+                       SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK;
                }
-               be->be_syncinfo = si;
+               c->be->be_syncinfo = si;
                return 0;
        }
 }
@@ -2660,14 +3325,21 @@ add_syncrepl(
 static void
 syncrepl_unparse( syncinfo_t *si, struct berval *bv )
 {
-       struct berval bc;
+       struct berval bc, uri;
        char buf[BUFSIZ*2], *ptr;
        int i;
 
+       /* FIXME: we're not checking for buf[] overflow! */
+
+       /* temporarily inhibit bindconf from printing URI */
+       uri = si->si_bindconf.sb_uri;
+       BER_BVZERO( &si->si_bindconf.sb_uri );
        bindconf_unparse( &si->si_bindconf, &bc );
+       si->si_bindconf.sb_uri = uri;
+
        ptr = buf;
-       ptr += sprintf( ptr, IDSTR "=%03ld " PROVIDERSTR "=%s",
-               si->si_rid, si->si_provideruri.bv_val );
+       ptr += snprintf( ptr, sizeof( buf ), IDSTR "=%03d " PROVIDERSTR "=%s",
+               si->si_rid, si->si_bindconf.sb_uri.bv_val );
        if ( !BER_BVISNULL( &bc )) {
                ptr = lutil_strcopy( ptr, bc.bv_val );
                free( bc.bv_val );
@@ -2682,6 +3354,16 @@ syncrepl_unparse( syncinfo_t *si, struct berval *bv )
                ptr = lutil_strcopy( ptr, si->si_base.bv_val );
                *ptr++ = '"';
        }
+       if ( !BER_BVISEMPTY( &si->si_logfilterstr )) {
+               ptr = lutil_strcopy( ptr, " " LOGFILTERSTR "=\"" );
+               ptr = lutil_strcopy( ptr, si->si_logfilterstr.bv_val );
+               *ptr++ = '"';
+       }
+       if ( !BER_BVISNULL( &si->si_logbase )) {
+               ptr = lutil_strcopy( ptr, " " LOGBASESTR "=\"" );
+               ptr = lutil_strcopy( ptr, si->si_logbase.bv_val );
+               *ptr++ = '"';
+       }
        for (i=0; !BER_BVISNULL(&scopes[i].key);i++) {
                if ( si->si_scope == scopes[i].val ) {
                        ptr = lutil_strcopy( ptr, " " SCOPESTR "=" );
@@ -2690,7 +3372,7 @@ syncrepl_unparse( syncinfo_t *si, struct berval *bv )
                }
        }
        if ( si->si_attrsonly ) {
-               ptr = lutil_strcopy( ptr, " " ATTRSONLYSTR "=yes" );
+               ptr = lutil_strcopy( ptr, " " ATTRSONLYSTR );
        }
        if ( si->si_anfile ) {
                ptr = lutil_strcopy( ptr, " " ATTRSSTR "=:include:" );
@@ -2741,7 +3423,7 @@ syncrepl_unparse( syncinfo_t *si, struct berval *bv )
                        if ( space ) *ptr++ = ' ';
                        space = 1;
                        ptr += sprintf( ptr, "%ld ", (long) si->si_retryinterval[i] );
-                       if ( si->si_retrynum_init[i] == -1 )
+                       if ( si->si_retrynum_init[i] == RETRYNUM_FOREVER )
                                *ptr++ = '+';
                        else
                                ptr += sprintf( ptr, "%d", si->si_retrynum_init[i] );
@@ -2758,13 +3440,21 @@ syncrepl_unparse( syncinfo_t *si, struct berval *bv )
                ptr = lutil_strcopy( ptr, " " TLIMITSTR "=" );
                ptr += sprintf( ptr, "%d", si->si_tlimit );
        }
+
+       if ( si->si_syncdata ) {
+               if ( enum_to_verb( datamodes, si->si_syncdata, &bc ) >= 0 ) {
+                       ptr = lutil_strcopy( ptr, " " SYNCDATASTR "=" );
+                       ptr = lutil_strcopy( ptr, bc.bv_val );
+               }
+       }
        bc.bv_len = ptr - buf;
        bc.bv_val = buf;
        ber_dupbv( bv, &bc );
 }
 
 int
-syncrepl_config(ConfigArgs *c) {
+syncrepl_config( ConfigArgs *c )
+{
        if (c->op == SLAP_CONFIG_EMIT) {
                if ( c->be->be_syncinfo ) {
                        struct berval bv;
@@ -2779,24 +3469,23 @@ syncrepl_config(ConfigArgs *c) {
                if ( c->be->be_syncinfo ) {
                        re = c->be->be_syncinfo->si_re;
                        if ( re ) {
-                               if ( ldap_pvt_runqueue_isrunning( &slapd_rq, re ))
+                               if ( ldap_pvt_runqueue_isrunning( &slapd_rq, re ) )
                                        ldap_pvt_runqueue_stoptask( &slapd_rq, re );
                                ldap_pvt_runqueue_remove( &slapd_rq, re );
                        }
                        syncinfo_free( c->be->be_syncinfo );
                        c->be->be_syncinfo = NULL;
                }
-               SLAP_DBFLAGS(c->be) &= ~(SLAP_DBFLAG_SHADOW|SLAP_DBFLAG_SYNC_SHADOW);
+               SLAP_DBFLAGS( c->be ) &= ~(SLAP_DBFLAG_SHADOW|SLAP_DBFLAG_SYNC_SHADOW);
                return 0;
        }
-       if(SLAP_SHADOW(c->be)) {
+       if ( SLAP_SHADOW( c->be ) ) {
                Debug(LDAP_DEBUG_ANY, "%s: "
                        "syncrepl: database already shadowed.\n",
                        c->log, 0, 0);
                return(1);
-       } else if(add_syncrepl(c->be, c->argv, c->argc)) {
+       } else if ( add_syncrepl( c ) ) {
                return(1);
        }
-       SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SYNC_SHADOW);
-       return(0);
+       return config_sync_shadow( c );
 }