]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/syncrepl.c
ITS#5376,ITS#5378
[openldap] / servers / slapd / syncrepl.c
index e91a393aeed9cc6ab03227fbbfea762f7f1d4044..0b9018bdedf921b2c6f412013cdaff87fdf77d27 100644 (file)
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2006 The OpenLDAP Foundation.
+ * Copyright 2003-2008 The OpenLDAP Foundation.
  * Portions Copyright 2003 by IBM Corporation.
  * Portions Copyright 2003 by Howard Chu, Symas Corporation.
  * All rights reserved.
@@ -52,7 +52,7 @@ struct nonpresent_entry {
 typedef struct syncinfo_s {
        struct slap_backend_db *si_be;
        struct re_s                     *si_re;
-       long                            si_rid;
+       int                                     si_rid;
        slap_bindconf           si_bindconf;
        struct berval           si_base;
        struct berval           si_logbase;
@@ -80,9 +80,11 @@ typedef struct syncinfo_s {
        int                                     si_tlimit;
        int                                     si_refreshDelete;
        int                                     si_refreshPresent;
+       int                                     si_refreshDone;
        int                                     si_syncdata;
        int                                     si_logstate;
        int                                     si_conn_setup;
+       ber_int_t                               si_msgid;
        Avlnode                         *si_presentlist;
        LDAP                            *si_ld;
        LDAP_LIST_HEAD(np, nonpresent_entry) si_nonpresentlist;
@@ -91,7 +93,7 @@ typedef struct syncinfo_s {
 
 static int syncuuid_cmp( const void *, const void * );
 static void avl_ber_bvfree( void * );
-static void syncrepl_del_nonpresent( Operation *, syncinfo_t *, BerVarray );
+static void syncrepl_del_nonpresent( Operation *, syncinfo_t *, BerVarray, struct berval * );
 static int syncrepl_message_to_op(
                                        syncinfo_t *, Operation *, LDAPMessage * );
 static int syncrepl_message_to_entry(
@@ -314,7 +316,6 @@ ldap_sync_search(
        BerElement *ber = (BerElement *)&berbuf;
        LDAPControl c[2], *ctrls[3];
        struct timeval timeout;
-       ber_int_t       msgid;
        int rc;
        int rhint;
        char *base;
@@ -402,7 +403,7 @@ ldap_sync_search(
 
        rc = ldap_search_ext( si->si_ld, base, scope, filter, attrs, attrsonly,
                ctrls, NULL, si->si_tlimit > 0 ? &timeout : NULL,
-               si->si_slimit, &msgid );
+               si->si_slimit, &si->si_msgid );
        ber_free_buf( ber );
        return rc;
 }
@@ -427,8 +428,8 @@ do_syncrep1(
        rc = ldap_initialize( &si->si_ld, si->si_bindconf.sb_uri.bv_val );
        if ( rc != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_ANY,
-                       "do_syncrep1: ldap_initialize failed (%s)\n",
-                       si->si_bindconf.sb_uri.bv_val, 0, 0 );
+                       "do_syncrep1: rid %03d ldap_initialize failed (%s)\n",
+                       si->si_rid, si->si_bindconf.sb_uri.bv_val, 0 );
                return rc;
        }
 
@@ -441,9 +442,9 @@ do_syncrep1(
                rc = ldap_start_tls_s( si->si_ld, NULL, NULL );
                if( rc != LDAP_SUCCESS ) {
                        Debug( LDAP_DEBUG_ANY,
-                               "%s: ldap_start_tls failed (%d)\n",
+                               "%s: rid %03d ldap_start_tls failed (%d)\n",
                                si->si_bindconf.sb_tls == SB_TLS_CRITICAL ? "Error" : "Warning",
-                               rc, 0 );
+                               si->si_rid, rc );
                        if( si->si_bindconf.sb_tls == SB_TLS_CRITICAL ) goto done;
                }
        }
@@ -457,9 +458,9 @@ do_syncrep1(
                                LDAP_OPT_X_SASL_SECPROPS, si->si_bindconf.sb_secprops);
 
                        if( rc != LDAP_OPT_SUCCESS ) {
-                               Debug( LDAP_DEBUG_ANY, "Error: ldap_set_option "
+                               Debug( LDAP_DEBUG_ANY, "Error: rid %03d ldap_set_option "
                                        "(%s,SECPROPS,\"%s\") failed!\n",
-                                       si->si_bindconf.sb_uri.bv_val, si->si_bindconf.sb_secprops, 0 );
+                                       si->si_rid, si->si_bindconf.sb_uri.bv_val, si->si_bindconf.sb_secprops );
                                goto done;
                        }
                }
@@ -488,9 +489,9 @@ do_syncrep1(
                if ( rc != LDAP_SUCCESS ) {
                        static struct berval bv_GSSAPI = BER_BVC( "GSSAPI" );
 
-                       Debug( LDAP_DEBUG_ANY, "do_syncrep1: "
+                       Debug( LDAP_DEBUG_ANY, "do_syncrep1: rid %03d "
                                "ldap_sasl_interactive_bind_s failed (%d)\n",
-                               rc, 0, 0 );
+                               si->si_rid, rc, 0 );
 
                        /* FIXME (see above comment) */
                        /* if Kerberos credentials cache is not active, retry */
@@ -515,8 +516,8 @@ do_syncrep1(
                        si->si_bindconf.sb_binddn.bv_val, LDAP_SASL_SIMPLE,
                        &si->si_bindconf.sb_cred, NULL, NULL, NULL );
                if ( rc != LDAP_SUCCESS ) {
-                       Debug( LDAP_DEBUG_ANY, "do_syncrep1: "
-                               "ldap_sasl_bind_s failed (%d)\n", rc, 0, 0 );
+                       Debug( LDAP_DEBUG_ANY, "do_syncrep1: rid %03d "
+                               "ldap_sasl_bind_s failed (%d)\n", si->si_rid, rc, 0 );
                        goto done;
                }
        }
@@ -584,11 +585,14 @@ do_syncrep1(
                        &si->si_syncCookie.ctxcsn, si->si_syncCookie.rid );
        }
 
+       si->si_refreshDone = 0;
+
        rc = ldap_sync_search( si, op->o_tmpmemctx );
 
        if( rc != LDAP_SUCCESS ) {
-               Debug( LDAP_DEBUG_ANY, "do_syncrep1: "
-                       "ldap_search_ext: %s (%d)\n", ldap_err2string( rc ), rc, 0 );
+               Debug( LDAP_DEBUG_ANY, "do_syncrep1: rid %03d "
+                       "ldap_search_ext: %s (%d)\n",
+                       si->si_rid, ldap_err2string( rc ), rc );
        }
 
 done:
@@ -630,8 +634,6 @@ do_syncrep2(
        int     rc, err, i;
        ber_len_t       len;
 
-       int rc_efree = 1;
-
        struct berval   *psub;
        Modifications   *modlist = NULL;
 
@@ -642,7 +644,6 @@ do_syncrep2(
        struct timeval tout = { 0, 0 };
 
        int             refreshDeletes = 0;
-       int             refreshDone = 1;
        BerVarray syncUUIDs = NULL;
        ber_tag_t si_tag;
 
@@ -654,7 +655,7 @@ do_syncrep2(
        ber_init2( ber, NULL, LBER_USE_DER );
        ber_set_option( ber, LBER_OPT_BER_MEMCTX, &op->o_tmpmemctx );
 
-       Debug( LDAP_DEBUG_TRACE, "=>do_syncrep2\n", 0, 0, 0 );
+       Debug( LDAP_DEBUG_TRACE, "=>do_syncrep2 rid %03d\n", si->si_rid, 0, 0 );
 
        psub = &si->si_be->be_nsuffix[0];
 
@@ -666,7 +667,7 @@ do_syncrep2(
                tout_p = NULL;
        }
 
-       while (( rc = ldap_result( si->si_ld, LDAP_RES_ANY, LDAP_MSG_ONE,
+       while (( rc = ldap_result( si->si_ld, si->si_msgid, LDAP_MSG_ONE,
                tout_p, &res )) > 0 )
        {
                if ( slapd_shutdown ) {
@@ -686,9 +687,9 @@ do_syncrep2(
                                ldap_get_entry_controls( si->si_ld, msg, &rctrls );
                                /* we can't work without the control */
                                if ( !rctrls ) {
-                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2: "
+                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2: rid %03d"
                                                "got search entry without "
-                                               "control\n", 0, 0, 0 );
+                                               "control\n", si->si_rid, 0, 0 );
                                        rc = -1;
                                        goto done;
                                }
@@ -698,8 +699,8 @@ do_syncrep2(
                                /* FIXME: what if syncUUID is NULL or empty?
                                 * (happens with back-sql...) */
                                if ( BER_BVISEMPTY( &syncUUID ) ) {
-                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2: "
-                                               "got empty syncUUID\n", 0, 0, 0 );
+                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2: rid %03d "
+                                               "got empty syncUUID\n", si->si_rid, 0, 0 );
                                        ldap_controls_free( rctrls );
                                        rc = -1;
                                        goto done;
@@ -715,19 +716,30 @@ do_syncrep2(
                                                slap_parse_sync_cookie( &syncCookie, NULL );
                                        }
                                }
+                               rc = 0;
                                if ( si->si_syncdata && si->si_logstate == SYNCLOG_LOGGING ) {
-                                       entry = NULL;
                                        modlist = NULL;
-                                       if ( syncrepl_message_to_op( si, op, msg ) == LDAP_SUCCESS &&
+                                       if (( rc = syncrepl_message_to_op( si, op, msg )) == LDAP_SUCCESS &&
                                                !BER_BVISNULL( &syncCookie.ctxcsn ) ) {
                                                syncrepl_updateCookie( si, op, psub, &syncCookie );
+                                       } else switch ( rc ) {
+                                               case LDAP_ALREADY_EXISTS:
+                                               case LDAP_NO_SUCH_OBJECT:
+                                               case LDAP_NO_SUCH_ATTRIBUTE:
+                                               case LDAP_TYPE_OR_VALUE_EXISTS:
+                                                       rc = LDAP_SYNC_REFRESH_REQUIRED;
+                                                       si->si_logstate = SYNCLOG_FALLBACK;
+                                                       ldap_abandon_ext( si->si_ld, si->si_msgid, NULL, NULL );
+                                                       break;
+                                               default:
+                                                       break;
                                        }
-                               } else if ( syncrepl_message_to_entry( si, op, msg,
-                                       &modlist, &entry, syncstate ) == LDAP_SUCCESS ) {
-                                       rc_efree = syncrepl_entry( si, op, entry, &modlist,
-                                               syncstate, &syncUUID, &syncCookie_req, &syncCookie.ctxcsn );
-                                       if ( !BER_BVISNULL( &syncCookie.ctxcsn ) )
-                                       {
+                               } else if (( rc = syncrepl_message_to_entry( si, op, msg,
+                                       &modlist, &entry, syncstate )) == LDAP_SUCCESS ) {
+                                       if (( rc = syncrepl_entry( si, op, entry, &modlist,
+                                               syncstate, &syncUUID, &syncCookie_req,
+                                               &syncCookie.ctxcsn )) == LDAP_SUCCESS &&
+                                               !BER_BVISNULL( &syncCookie.ctxcsn ) ) {
                                                syncrepl_updateCookie( si, op, psub, &syncCookie );
                                        }
                                }
@@ -735,20 +747,20 @@ do_syncrep2(
                                if ( modlist ) {
                                        slap_mods_free( modlist, 1 );
                                }
-                               if ( rc_efree && entry ) {
-                                       entry_free( entry );
-                               }
-                               entry = NULL;
+                               if ( rc )
+                                       goto done;
                                break;
 
                        case LDAP_RES_SEARCH_REFERENCE:
                                Debug( LDAP_DEBUG_ANY,
-                                       "do_syncrep2: reference received error\n", 0, 0, 0 );
+                                       "do_syncrep2: rid %03d reference received error\n",
+                                       si->si_rid, 0, 0 );
                                break;
 
                        case LDAP_RES_SEARCH_RESULT:
                                Debug( LDAP_DEBUG_SYNC,
-                                       "do_syncrep2: LDAP_RES_SEARCH_RESULT\n", 0, 0, 0 );
+                                       "do_syncrep2: rid %03d LDAP_RES_SEARCH_RESULT\n",
+                                       si->si_rid, 0, 0 );
                                ldap_parse_result( si->si_ld, msg, &err, NULL, NULL, NULL,
                                        &rctrls, 0 );
 #ifdef LDAP_X_SYNC_REFRESH_REQUIRED
@@ -797,11 +809,6 @@ do_syncrep2(
                                                &syncCookie_req.ctxcsn, &syncCookie.ctxcsn,
                                                &text );
                                }
-                               if ( !BER_BVISNULL( &syncCookie.ctxcsn ) &&
-                                       match < 0 && err == LDAP_SUCCESS )
-                               {
-                                       syncrepl_updateCookie( si, op, psub, &syncCookie );
-                               }
                                if ( rctrls ) {
                                        ldap_controls_free( rctrls );
                                }
@@ -813,12 +820,17 @@ do_syncrep2(
                                        if ( refreshDeletes == 0 && match < 0 &&
                                                err == LDAP_SUCCESS )
                                        {
-                                               syncrepl_del_nonpresent( op, si, NULL );
+                                               syncrepl_del_nonpresent( op, si, NULL, &syncCookie.ctxcsn );
                                        } else {
                                                avl_free( si->si_presentlist, avl_ber_bvfree );
                                                si->si_presentlist = NULL;
                                        }
                                }
+                               if ( !BER_BVISNULL( &syncCookie.ctxcsn ) &&
+                                       match < 0 && err == LDAP_SUCCESS )
+                               {
+                                       syncrepl_updateCookie( si, op, psub, &syncCookie );
+                               }
                                if ( err == LDAP_SUCCESS
                                        && si->si_logstate == SYNCLOG_FALLBACK ) {
                                        si->si_logstate = SYNCLOG_LOGGING;
@@ -839,19 +851,20 @@ do_syncrep2(
                                        ber_tag_t tag;
                                        case LDAP_TAG_SYNC_NEW_COOKIE:
                                                Debug( LDAP_DEBUG_SYNC,
-                                                       "do_syncrep2: %s - %s%s\n", 
+                                                       "do_syncrep2: rid %03d %s - %s\n", 
+                                                       si->si_rid,
                                                        "LDAP_RES_INTERMEDIATE", 
-                                                       "NEW_COOKIE", "\n" );
+                                                       "NEW_COOKIE" );
                                                ber_scanf( ber, "tm", &tag, &cookie );
                                                break;
                                        case LDAP_TAG_SYNC_REFRESH_DELETE:
                                        case LDAP_TAG_SYNC_REFRESH_PRESENT:
                                                Debug( LDAP_DEBUG_SYNC,
-                                                       "do_syncrep2: %s - %s%s\n", 
+                                                       "do_syncrep2: rid %03d %s - %s\n", 
+                                                       si->si_rid,
                                                        "LDAP_RES_INTERMEDIATE", 
                                                        si_tag == LDAP_TAG_SYNC_REFRESH_PRESENT ?
-                                                       "REFRESH_PRESENT" : "REFRESH_DELETE",
-                                                       "\n" );
+                                                       "REFRESH_PRESENT" : "REFRESH_DELETE" );
                                                if ( si_tag == LDAP_TAG_SYNC_REFRESH_DELETE ) {
                                                        si->si_refreshDelete = 1;
                                                } else {
@@ -870,19 +883,23 @@ do_syncrep2(
                                                                slap_parse_sync_cookie( &syncCookie, NULL );
                                                        }
                                                }
+                                               /* Defaults to TRUE */
                                                if ( ber_peek_tag( ber, &len ) ==
                                                        LDAP_TAG_REFRESHDONE )
                                                {
-                                                       ber_scanf( ber, "b", &refreshDone );
+                                                       ber_scanf( ber, "b", &si->si_refreshDone );
+                                               } else
+                                               {
+                                                       si->si_refreshDone = 1;
                                                }
                                                ber_scanf( ber, /*"{"*/ "}" );
                                                break;
                                        case LDAP_TAG_SYNC_ID_SET:
                                                Debug( LDAP_DEBUG_SYNC,
-                                                       "do_syncrep2: %s - %s%s\n", 
+                                                       "do_syncrep2: rid %03d %s - %s\n", 
+                                                       si->si_rid,
                                                        "LDAP_RES_INTERMEDIATE", 
-                                                       "SYNC_ID_SET",
-                                                       "\n" );
+                                                       "SYNC_ID_SET" );
                                                ber_scanf( ber, "t{" /*"}"*/, &tag );
                                                if ( ber_peek_tag( ber, &len ) ==
                                                        LDAP_TAG_SYNC_COOKIE )
@@ -905,7 +922,8 @@ do_syncrep2(
                                                ber_scanf( ber, "[W]", &syncUUIDs );
                                                ber_scanf( ber, /*"{"*/ "}" );
                                                if ( refreshDeletes ) {
-                                                       syncrepl_del_nonpresent( op, si, syncUUIDs );
+                                                       syncrepl_del_nonpresent( op, si, syncUUIDs,
+                                                               &syncCookie.ctxcsn );
                                                        ber_bvarray_free_x( syncUUIDs, op->o_tmpmemctx );
                                                } else {
                                                        for ( i = 0; !BER_BVISNULL( &syncUUIDs[i] ); i++ ) {
@@ -918,11 +936,12 @@ do_syncrep2(
                                                        }
                                                        slap_sl_free( syncUUIDs, op->o_tmpmemctx );
                                                }
+                                               slap_sync_cookie_free( &syncCookie, 0 );
                                                break;
                                        default:
                                                Debug( LDAP_DEBUG_ANY,
-                                                       "do_syncrep2 : unknown syncinfo tag (%ld)\n",
-                                               (long) si_tag, 0, 0 );
+                                                       "do_syncrep2: rid %03d unknown syncinfo tag (%ld)\n",
+                                                       si->si_rid, (long) si_tag, 0 );
                                                ldap_memfree( retoid );
                                                ber_bvfree( retdata );
                                                continue;
@@ -940,15 +959,13 @@ do_syncrep2(
                                                        &syncCookie.ctxcsn, &text );
                                        }
 
-                                       if ( !BER_BVISNULL( &syncCookie.ctxcsn ) &&
-                                               match < 0 )
-                                       {
-                                               syncrepl_updateCookie( si, op, psub, &syncCookie);
-                                       }
-
-                                       if ( si->si_refreshPresent == 1 ) {
-                                               if ( match < 0 ) {
-                                                       syncrepl_del_nonpresent( op, si, NULL );
+                                       if ( match < 0 ) {
+                                               if ( si->si_refreshPresent == 1 ) {
+                                                       syncrepl_del_nonpresent( op, si, NULL, &syncCookie.ctxcsn );
+                                               }
+                                               if ( !BER_BVISNULL( &syncCookie.ctxcsn ))
+                                               {
+                                                       syncrepl_updateCookie( si, op, psub, &syncCookie);
                                                }
                                        } 
 
@@ -957,9 +974,9 @@ do_syncrep2(
                                        break;
 
                                } else {
-                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2 : "
+                                       Debug( LDAP_DEBUG_ANY, "do_syncrep2: rid %03d "
                                                "unknown intermediate response (%d)\n",
-                                               rc, 0, 0 );
+                                               si->si_rid, rc, 0 );
                                        ldap_memfree( retoid );
                                        ber_bvfree( retdata );
                                        break;
@@ -967,8 +984,8 @@ do_syncrep2(
                                break;
 
                        default:
-                               Debug( LDAP_DEBUG_ANY, "do_syncrep2 : "
-                                       "unknown message\n", 0, 0, 0 );
+                               Debug( LDAP_DEBUG_ANY, "do_syncrep2: rid %03d "
+                                       "unknown message\n", si->si_rid, 0, 0 );
                                break;
 
                        }
@@ -989,7 +1006,7 @@ do_syncrep2(
                errstr = ldap_err2string( rc );
                
                Debug( LDAP_DEBUG_ANY,
-                       "do_syncrep2 : %s\n", errstr, 0, 0 );
+                       "do_syncrep2: rid %03d %s\n", si->si_rid, errstr, 0 );
        }
 
 done:
@@ -1025,10 +1042,10 @@ do_syncrepl(
        int rc = LDAP_SUCCESS;
        int dostop = 0;
        ber_socket_t s;
-       int i, defer = 1;
+       int i, defer = 1, fail = 0;
        Backend *be;
 
-       Debug( LDAP_DEBUG_TRACE, "=>do_syncrepl\n", 0, 0, 0 );
+       Debug( LDAP_DEBUG_TRACE, "=>do_syncrepl rid %03d\n", si->si_rid, 0, 0 );
 
        if ( si == NULL )
                return NULL;
@@ -1144,18 +1161,36 @@ reload:
 
                if ( !si->si_retrynum || si->si_retrynum[i] == RETRYNUM_TAIL ) {
                        ldap_pvt_runqueue_remove( &slapd_rq, rtask );
+                       fail = RETRYNUM_TAIL;
                } else if ( RETRYNUM_VALID( si->si_retrynum[i] ) ) {
                        if ( si->si_retrynum[i] > 0 )
                                si->si_retrynum[i]--;
+                       fail = si->si_retrynum[i];
                        rtask->interval.tv_sec = si->si_retryinterval[i];
                        ldap_pvt_runqueue_resched( &slapd_rq, rtask, 0 );
                        slap_wake_listener();
                }
        }
-       
+
        ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
        ldap_pvt_thread_mutex_unlock( &si->si_mutex );
 
+       if ( rc ) {
+               if ( fail == RETRYNUM_TAIL ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "do_syncrepl: rid %03d quitting\n",
+                               si->si_rid, 0, 0 );
+               } else if ( fail > 0 ) {
+                       Debug( LDAP_DEBUG_ANY,
+                               "do_syncrepl: rid %03d retrying (%d retries left)\n",
+                               si->si_rid, fail, 0 );
+               } else {
+                       Debug( LDAP_DEBUG_ANY,
+                               "do_syncrepl: rid %03d retrying\n",
+                               si->si_rid, 0, 0 );
+               }
+       }
+
        return NULL;
 }
 
@@ -1265,11 +1300,12 @@ syncrepl_message_to_op(
        struct berval   rdn = BER_BVNULL, sup = BER_BVNULL,
                prdn = BER_BVNULL, nrdn = BER_BVNULL,
                psup = BER_BVNULL, nsup = BER_BVNULL;
-       int             rc, deleteOldRdn = 0;
+       int             rc, deleteOldRdn = 0, freeReqDn = 0;
 
        if ( ldap_msgtype( msg ) != LDAP_RES_SEARCH_ENTRY ) {
-               Debug( LDAP_DEBUG_ANY,
-                       "Message type should be entry (%d)", ldap_msgtype( msg ), 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_op: rid %03d "
+                       "Message type should be entry (%d)",
+                       si->si_rid, ldap_msgtype( msg ), 0 );
                return -1;
        }
 
@@ -1282,7 +1318,8 @@ syncrepl_message_to_op(
 
        if ( rc != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_ANY,
-                       "syncrepl_message_to_op : dn get failed (%d)", rc, 0, 0 );
+                       "syncrepl_message_to_op: rid %03d dn get failed (%d)",
+                       si->si_rid, rc, 0 );
                return rc;
        }
 
@@ -1300,12 +1337,13 @@ syncrepl_message_to_op(
                        ber_dupbv( &op->o_req_ndn, &ndn );
                        slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
                        slap_sl_free( dn.bv_val, op->o_tmpmemctx );
+                       freeReqDn = 1;
                } else if ( !ber_bvstrcasecmp( &bv, &ls->ls_req )) {
                        int i = verb_to_mask( bvals[0].bv_val, modops );
                        if ( i < 0 ) {
                                Debug( LDAP_DEBUG_ANY,
-                                       "syncrepl_message_to_op : unknown op %s",
-                                       bvals[0].bv_val, 0, 0 );
+                                       "syncrepl_message_to_op: rid %03d unknown op %s",
+                                       si->si_rid, bvals[0].bv_val, 0 );
                                ch_free( bvals );
                                rc = -1;
                                goto done;
@@ -1338,6 +1376,7 @@ syncrepl_message_to_op(
        }
 
        op->o_callback = &cb;
+       slap_op_time( &op->o_time, &op->o_tincr );
 
        switch( op->o_tag ) {
        case LDAP_REQ_ADD:
@@ -1348,8 +1387,9 @@ syncrepl_message_to_op(
                rc = slap_mods_check( modlist, &text, txtbuf, textlen, NULL );
 
                if ( rc != LDAP_SUCCESS ) {
-                       Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_op: mods check (%s)\n",
-                               text, 0, 0 );
+                       Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_op: rid %03d "
+                               "mods check (%s)\n",
+                               si->si_rid, text, 0 );
                        goto done;
                }
 
@@ -1357,17 +1397,26 @@ syncrepl_message_to_op(
                        op->ora_e = ( Entry * ) ch_calloc( 1, sizeof( Entry ) );
                        op->ora_e->e_name = op->o_req_dn;
                        op->ora_e->e_nname = op->o_req_ndn;
+                       freeReqDn = 0;
                        rc = slap_mods2entry( modlist, &op->ora_e, 1, 0, &text, txtbuf, textlen);
                        if( rc != LDAP_SUCCESS ) {
-                               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_op: mods2entry (%s)\n",
-                                       text, 0, 0 );
+                               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_op: rid %03d "
+                               "mods2entry (%s)\n",
+                                       si->si_rid, text, 0 );
                        } else {
                                rc = op->o_bd->be_add( op, &rs );
+                               Debug( LDAP_DEBUG_SYNC,
+                                       "syncrepl_message_to_op: rid %03d be_add %s (%d)\n", 
+                                       si->si_rid, op->o_req_dn.bv_val, rc );
                        }
                        be_entry_release_w( op, op->ora_e );
                } else {
                        op->orm_modlist = modlist;
                        rc = op->o_bd->be_modify( op, &rs );
+                       modlist = op->orm_modlist;
+                       Debug( rc ? LDAP_DEBUG_ANY : LDAP_DEBUG_SYNC,
+                               "syncrepl_message_to_op: rid %03d be_modify %s (%d)\n", 
+                               si->si_rid, op->o_req_dn.bv_val, rc );
                }
                break;
        case LDAP_REQ_MODRDN:
@@ -1382,18 +1431,29 @@ syncrepl_message_to_op(
                                goto done;
                        op->orr_newSup = &psup;
                        op->orr_nnewSup = &nsup;
+               } else {
+                       op->orr_newSup = NULL;
+                       op->orr_nnewSup = NULL;
                }
                op->orr_newrdn = prdn;
                op->orr_nnewrdn = nrdn;
                op->orr_deleteoldrdn = deleteOldRdn;
                rc = op->o_bd->be_modrdn( op, &rs );
+               Debug( rc ? LDAP_DEBUG_ANY : LDAP_DEBUG_SYNC,
+                       "syncrepl_message_to_op: rid %03d be_modrdn %s (%d)\n", 
+                       si->si_rid, op->o_req_dn.bv_val, rc );
                break;
        case LDAP_REQ_DELETE:
                rc = op->o_bd->be_delete( op, &rs );
+               Debug( rc ? LDAP_DEBUG_ANY : LDAP_DEBUG_SYNC,
+                       "syncrepl_message_to_op: rid %03d be_delete %s (%d)\n", 
+                       si->si_rid, op->o_req_dn.bv_val, rc );
                break;
        }
 done:
        slap_graduate_commit_csn( op );
+       op->o_tmpfree( op->o_csn.bv_val, op->o_tmpmemctx );
+       BER_BVZERO( &op->o_csn );
        if ( modlist )
                slap_mods_free( modlist, op->o_tag != LDAP_REQ_ADD );
        if ( !BER_BVISNULL( &rdn )) {
@@ -1406,6 +1466,10 @@ done:
                if ( !BER_BVISNULL( &prdn ))
                        ch_free( prdn.bv_val );
        }
+       if ( freeReqDn ) {
+               ch_free( op->o_req_ndn.bv_val );
+               ch_free( op->o_req_dn.bv_val );
+       }
        ber_free ( ber, 0 );
        return rc;
 }
@@ -1430,24 +1494,25 @@ syncrepl_message_to_entry(
        char txtbuf[SLAP_TEXT_BUFLEN];
        size_t textlen = sizeof txtbuf;
 
-       struct berval   bdn = {0, NULL}, dn, ndn;
+       struct berval   bdn = BER_BVNULL, dn, ndn;
        int             rc;
 
        *modlist = NULL;
 
        if ( ldap_msgtype( msg ) != LDAP_RES_SEARCH_ENTRY ) {
-               Debug( LDAP_DEBUG_ANY,
-                       "Message type should be entry (%d)", ldap_msgtype( msg ), 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: rid %03d "
+                       "Message type should be entry (%d)",
+                       si->si_rid, ldap_msgtype( msg ), 0 );
                return -1;
        }
 
        op->o_tag = LDAP_REQ_ADD;
 
        rc = ldap_get_dn_ber( si->si_ld, msg, &ber, &bdn );
-
        if ( rc != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_ANY,
-                       "syncrepl_message_to_entry : dn get failed (%d)", rc, 0, 0 );
+                       "syncrepl_message_to_entry: rid %03d dn get failed (%d)",
+                       si->si_rid, rc, 0 );
                return rc;
        }
 
@@ -1458,17 +1523,18 @@ syncrepl_message_to_entry(
        slap_sl_free( dn.bv_val, op->o_tmpmemctx );
 
        if ( syncstate == LDAP_SYNC_PRESENT || syncstate == LDAP_SYNC_DELETE ) {
-               if ( entry )
-                       *entry = NULL;
-               return LDAP_SUCCESS;
+               /* NOTE: this could be done even before decoding the DN,
+                * although encoding errors wouldn't be detected */
+               rc = LDAP_SUCCESS;
+               goto done;
        }
 
        if ( entry == NULL ) {
-               return -1;
+               rc = -1;
+               goto done;
        }
 
        e = ( Entry * ) ch_calloc( 1, sizeof( Entry ) );
-       *entry = e;
        e->e_name = op->o_req_dn;
        e->e_nname = op->o_req_ndn;
 
@@ -1494,8 +1560,8 @@ syncrepl_message_to_entry(
        }
 
        if ( *modlist == NULL ) {
-               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: no attributes\n",
-                       0, 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: rid %03d no attributes\n",
+                       si->si_rid, 0, 0 );
                rc = -1;
                goto done;
        }
@@ -1503,8 +1569,8 @@ syncrepl_message_to_entry(
        rc = slap_mods_check( *modlist, &text, txtbuf, textlen, NULL );
 
        if ( rc != LDAP_SUCCESS ) {
-               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: mods check (%s)\n",
-                       text, 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: rid %03d mods check (%s)\n",
+                       si->si_rid, text, 0 );
                goto done;
        }
 
@@ -1535,18 +1601,19 @@ syncrepl_message_to_entry(
        
        rc = slap_mods2entry( *modlist, &e, 1, 1, &text, txtbuf, textlen);
        if( rc != LDAP_SUCCESS ) {
-               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: mods2entry (%s)\n",
-                       text, 0, 0 );
+               Debug( LDAP_DEBUG_ANY, "syncrepl_message_to_entry: rid %03d mods2entry (%s)\n",
+                       si->si_rid, text, 0 );
        }
 
 done:
-       ber_free ( ber, 0 );
+       ber_free( ber, 0 );
        if ( rc != LDAP_SUCCESS ) {
                if ( e ) {
                        entry_free( e );
-                       *entry = e = NULL;
+                       e = NULL;
                }
        }
+       *entry = e;
 
        return rc;
 }
@@ -1609,7 +1676,6 @@ syncrepl_entry(
        AttributeAssertion ava = { NULL, BER_BVNULL };
 #endif
        int rc = LDAP_SUCCESS;
-       int ret = LDAP_SUCCESS;
 
        struct berval pdn = BER_BVNULL;
        dninfo dni = {0};
@@ -1617,33 +1683,33 @@ syncrepl_entry(
 
        switch( syncstate ) {
        case LDAP_SYNC_PRESENT:
-               Debug( LDAP_DEBUG_SYNC, "%s: %s\n",
-                                       "syncrepl_entry",
+               Debug( LDAP_DEBUG_SYNC, "syncrepl_entry: rid %03d %s\n",
+                                       si->si_rid,
                                        "LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_PRESENT)", 0 );
                break;
        case LDAP_SYNC_ADD:
-               Debug( LDAP_DEBUG_SYNC, "%s: %s\n",
-                                       "syncrepl_entry",
+               Debug( LDAP_DEBUG_SYNC, "syncrepl_entry: rid %03d %s\n",
+                                       si->si_rid,
                                        "LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD)", 0 );
                break;
        case LDAP_SYNC_DELETE:
-               Debug( LDAP_DEBUG_SYNC, "%s: %s\n",
-                                       "syncrepl_entry",
+               Debug( LDAP_DEBUG_SYNC, "syncrepl_entry: rid %03d %s\n",
+                                       si->si_rid,
                                        "LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE)", 0 );
                break;
        case LDAP_SYNC_MODIFY:
-               Debug( LDAP_DEBUG_SYNC, "%s: %s\n",
-                                       "syncrepl_entry",
+               Debug( LDAP_DEBUG_SYNC, "syncrepl_entry: rid %03d %s\n",
+                                       si->si_rid,
                                        "LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY)", 0 );
                break;
        default:
-               Debug( LDAP_DEBUG_ANY, "%s: %s\n",
-                                       "syncrepl_entry",
+               Debug( LDAP_DEBUG_ANY, "syncrepl_entry: rid %03d %s\n",
+                                       si->si_rid,
                                        "LDAP_RES_SEARCH_ENTRY(UNKNOWN syncstate)", 0 );
        }
 
        if (( syncstate == LDAP_SYNC_PRESENT || syncstate == LDAP_SYNC_ADD )) {
-               if ( !si->si_refreshPresent ) {
+               if ( !si->si_refreshPresent && !si->si_refreshDone ) {
                        syncuuid_bv = ber_dupbv( NULL, syncUUID );
                        avl_insert( &si->si_presentlist, (caddr_t) syncuuid_bv,
                                syncuuid_cmp, avl_dup_error );
@@ -1698,8 +1764,8 @@ syncrepl_entry(
        if ( limits_check( op, &rs_search ) == 0 ) {
                rc = be->be_search( op, &rs_search );
                Debug( LDAP_DEBUG_SYNC,
-                               "syncrepl_entry: %s (%d)\n", 
-                               "be_search", rc, 0 );
+                               "syncrepl_entry: rid %03d be_search (%d)\n", 
+                               si->si_rid, rc, 0 );
        }
 
        if ( !BER_BVISNULL( &op->ors_filterstr ) ) {
@@ -1711,12 +1777,12 @@ syncrepl_entry(
 
        if ( entry && !BER_BVISNULL( &entry->e_name ) ) {
                Debug( LDAP_DEBUG_SYNC,
-                               "syncrepl_entry: %s\n",
-                               entry->e_name.bv_val, 0, 0 );
+                               "syncrepl_entry: rid %03d %s\n",
+                               si->si_rid, entry->e_name.bv_val, 0 );
        } else {
                Debug( LDAP_DEBUG_SYNC,
-                               "syncrepl_entry: %s\n",
-                               dni.dn.bv_val ? dni.dn.bv_val : "(null)", 0, 0 );
+                               "syncrepl_entry: rid %03d %s\n",
+                               si->si_rid, dni.dn.bv_val ? dni.dn.bv_val : "(null)", 0 );
        }
 
        if ( syncstate != LDAP_SYNC_DELETE ) {
@@ -1736,8 +1802,25 @@ syncrepl_entry(
                        ber_memfree( a->a_vals[0].bv_val );
                        ber_dupbv( &a->a_vals[0], &syncUUID_strrep );
                }
+               /* Don't save the contextCSN on the inooming context entry,
+                * we'll write it when syncrepl_updateCookie eventually
+                * gets called. (ITS#4622)
+                */
+               if ( syncstate == LDAP_SYNC_ADD && dn_match( &entry->e_nname,
+                       &be->be_nsuffix[0] )) {
+                       Attribute **ap;
+                       for ( ap = &entry->e_attrs; *ap; ap=&(*ap)->a_next ) {
+                               a = *ap;
+                               if ( a->a_desc == slap_schema.si_ad_contextCSN ) {
+                                       *ap = a->a_next;
+                                       attr_free( a );
+                                       break;
+                               }
+                       }
+               }
        }
 
+       slap_op_time( &op->o_time, &op->o_tincr );
        switch ( syncstate ) {
        case LDAP_SYNC_ADD:
        case LDAP_SYNC_MODIFY:
@@ -1756,20 +1839,20 @@ retry_add:;
 
                        rc = be->be_add( op, &rs_add );
                        Debug( LDAP_DEBUG_SYNC,
-                                       "syncrepl_entry: %s (%d)\n", 
-                                       "be_add", rc, 0 );
+                                       "syncrepl_entry: rid %03d be_add (%d)\n", 
+                                       si->si_rid, rc, 0 );
                        switch ( rs_add.sr_err ) {
                        case LDAP_SUCCESS:
                                be_entry_release_w( op, entry );
-                               ret = 0;
+                               entry = NULL;
                                break;
 
                        case LDAP_REFERRAL:
                        /* we assume that LDAP_NO_SUCH_OBJECT is returned 
                         * only if the suffix entry is not present */
                        case LDAP_NO_SUCH_OBJECT:
-                               syncrepl_add_glue( op, entry );
-                               ret = 0;
+                               rc = syncrepl_add_glue( op, entry );
+                               entry = NULL;
                                break;
 
                        /* if an entry was added via syncrepl_add_glue(),
@@ -1805,18 +1888,19 @@ retry_add:;
                                        cb2.sc_response = dn_callback;
                                        cb2.sc_private = &dni;
 
-                                       be->be_search( &op2, &rs2 );
+                                       rc = be->be_search( &op2, &rs2 );
+                                       if ( rc ) goto done;
 
                                        retry = 0;
+                                       slap_op_time( &op->o_time, &op->o_tincr );
                                        goto retry_add;
                                }
                                /* FALLTHRU */
 
                        default:
                                Debug( LDAP_DEBUG_ANY,
-                                       "syncrepl_entry : be_add failed (%d)\n",
-                                       rs_add.sr_err, 0, 0 );
-                               ret = 1;
+                                       "syncrepl_entry: rid %03d be_add failed (%d)\n",
+                                       si->si_rid, rs_add.sr_err, 0 );
                                break;
                        }
                        goto done;
@@ -1833,23 +1917,27 @@ retry_add:;
 
                        dnParent( &dni.ndn, &noldp );
                        dnParent( &entry->e_nname, &nnewp );
-                       if ( !dn_match( &noldp, &newp )) {
+                       if ( !dn_match( &noldp, &nnewp )) {
                                dnParent( &entry->e_name, &newp );
                                op->orr_newSup = &newp;
                                op->orr_nnewSup = &nnewp;
+                       } else {
+                               op->orr_newSup = NULL;
+                               op->orr_nnewSup = NULL;
                        }
                        op->orr_deleteoldrdn = 0;
                        rc = be->be_modrdn( op, &rs_modify );
                        Debug( LDAP_DEBUG_SYNC,
-                                       "syncrepl_entry: %s (%d)\n", 
-                                       "be_modrdn", rc, 0 );
+                                       "syncrepl_entry: rid %03d be_modrdn (%d)\n", 
+                                       si->si_rid, rc, 0 );
                        if ( rs_modify.sr_err == LDAP_SUCCESS ) {
                                op->o_req_dn = entry->e_name;
                                op->o_req_ndn = entry->e_nname;
                        } else {
-                               ret = 1;
                                goto done;
                        }
+                       if ( dni.wasChanged )
+                               slap_op_time( &op->o_time, &op->o_tincr );
                }
                if ( dni.wasChanged ) {
                        Modifications *mod, *modhead = NULL;
@@ -1905,15 +1993,14 @@ retry_add:;
 
                        rc = be->be_modify( op, &rs_modify );
                        Debug( LDAP_DEBUG_SYNC,
-                                       "syncrepl_entry: %s (%d)\n", 
-                                       "be_modify", rc, 0 );
+                                       "syncrepl_entry: rid %03d be_modify (%d)\n", 
+                                       si->si_rid, rc, 0 );
                        if ( rs_modify.sr_err != LDAP_SUCCESS ) {
                                Debug( LDAP_DEBUG_ANY,
-                                       "syncrepl_entry : be_modify failed (%d)\n",
-                                       rs_modify.sr_err, 0, 0 );
+                                       "syncrepl_entry: rid %03d be_modify failed (%d)\n",
+                                       si->si_rid, rs_modify.sr_err, 0 );
                        }
                }
-               ret = 1;
                goto done;
        case LDAP_SYNC_DELETE :
                if ( !BER_BVISNULL( &dni.dn )) {
@@ -1922,8 +2009,8 @@ retry_add:;
                        op->o_tag = LDAP_REQ_DELETE;
                        rc = be->be_delete( op, &rs_delete );
                        Debug( LDAP_DEBUG_SYNC,
-                                       "syncrepl_entry: %s (%d)\n", 
-                                       "be_delete", rc, 0 );
+                                       "syncrepl_entry: rid %03d be_delete (%d)\n", 
+                                       si->si_rid, rc, 0 );
 
                        while ( rs_delete.sr_err == LDAP_SUCCESS
                                && op->o_delete_glue_parent ) {
@@ -1941,13 +2028,11 @@ retry_add:;
                                }
                        }
                }
-               ret = 0;
                goto done;
 
        default :
                Debug( LDAP_DEBUG_ANY,
-                       "syncrepl_entry : unknown syncstate\n", 0, 0, 0 );
-               ret = 1;
+                       "syncrepl_entry: rid %03d unknown syncstate\n", si->si_rid, 0, 0 );
                goto done;
        }
 
@@ -1965,8 +2050,10 @@ done :
        if ( !BER_BVISNULL( &dni.dn ) ) {
                op->o_tmpfree( dni.dn.bv_val, op->o_tmpmemctx );
        }
+       if ( entry )
+               entry_free( entry );
        BER_BVZERO( &op->o_csn );
-       return ret;
+       return rc;
 }
 
 static struct berval gcbva[] = {
@@ -1981,7 +2068,8 @@ static void
 syncrepl_del_nonpresent(
        Operation *op,
        syncinfo_t *si,
-       BerVarray uuids )
+       BerVarray uuids,
+       struct berval *cookiecsn )
 {
        Backend* be = op->o_bd;
        slap_callback   cb = { NULL };
@@ -1993,6 +2081,7 @@ syncrepl_del_nonpresent(
        AttributeName   an[2];
 
        struct berval pdn = BER_BVNULL;
+       struct berval csn;
 
        op->o_req_dn = si->si_base;
        op->o_req_ndn = si->si_base;
@@ -2031,7 +2120,9 @@ syncrepl_del_nonpresent(
                for (i=0; uuids[i].bv_val; i++) {
                        op->ors_slimit = 1;
                        uf.f_av_value = uuids[i];
+                       filter2bv_x( op, op->ors_filter, &op->ors_filterstr );
                        rc = be->be_search( op, &rs_search );
+                       op->o_tmpfree( op->ors_filterstr.bv_val, op->o_tmpmemctx );
                }
                si->si_refreshDelete ^= NP_DELETE_ONE;
        } else {
@@ -2055,7 +2146,12 @@ syncrepl_del_nonpresent(
 
        if ( !LDAP_LIST_EMPTY( &si->si_nonpresentlist ) ) {
 
-               slap_queue_csn( op, &si->si_syncCookie.ctxcsn );
+               if ( cookiecsn && !BER_BVISNULL( cookiecsn ))
+                       csn = *cookiecsn;
+               else
+                       csn = si->si_syncCookie.ctxcsn;
+
+               slap_queue_csn( op, &csn );
 
                np_list = LDAP_LIST_FIRST( &si->si_nonpresentlist );
                while ( np_list != NULL ) {
@@ -2069,6 +2165,9 @@ syncrepl_del_nonpresent(
                        op->o_req_dn = *np_prev->npe_name;
                        op->o_req_ndn = *np_prev->npe_nname;
                        rc = op->o_bd->be_delete( op, &rs_delete );
+                       Debug( LDAP_DEBUG_SYNC,
+                               "syncrepl_del_nonpresent: rid %03d be_delete %s (%d)\n", 
+                               si->si_rid, op->o_req_dn.bv_val, rc );
 
                        if ( rs_delete.sr_err == LDAP_NOT_ALLOWED_ON_NONLEAF ) {
                                Modifications mod1, mod2;
@@ -2092,6 +2191,7 @@ syncrepl_del_nonpresent(
                                op->orm_modlist = &mod1;
 
                                rc = be->be_modify( op, &rs_modify );
+                               if ( mod2.sml_next ) slap_mods_free( mod2.sml_next, 1 );
                        }
 
                        while ( rs_delete.sr_err == LDAP_SUCCESS &&
@@ -2119,12 +2219,14 @@ syncrepl_del_nonpresent(
                }
 
                slap_graduate_commit_csn( op );
+               op->o_tmpfree( op->o_csn.bv_val, op->o_tmpmemctx );
+               BER_BVZERO( &op->o_csn );
        }
 
        return;
 }
 
-void
+int
 syncrepl_add_glue(
        Operation* op,
        Entry *e )
@@ -2234,6 +2336,10 @@ syncrepl_add_glue(
                } else {
                /* incl. ALREADY EXIST */
                        entry_free( glue );
+                       if ( rs_add.sr_err != LDAP_ALREADY_EXISTS ) {
+                               entry_free( e );
+                               return rc;
+                       }
                }
 
                /* Move to next child */
@@ -2264,7 +2370,7 @@ syncrepl_add_glue(
                entry_free( e );
        }
 
-       return;
+       return rc;
 }
 
 static void
@@ -2278,7 +2384,7 @@ syncrepl_updateCookie(
        Modifications mod = { { 0 } };
        struct berval vals[ 2 ];
 
-       int rc;
+       int rc, dbflags;
 
        slap_callback cb = { NULL };
        SlapReply       rs_modify = {REP_RESULT};
@@ -2310,15 +2416,22 @@ syncrepl_updateCookie(
        /* update contextCSN */
        op->o_msgid = SLAP_SYNC_UPDATE_MSGID;
        op->orm_modlist = &mod;
+       dbflags = SLAP_DBFLAGS(op->o_bd);
+       SLAP_DBFLAGS(op->o_bd) |= SLAP_DBFLAG_NOLASTMOD;
        rc = be->be_modify( op, &rs_modify );
+       SLAP_DBFLAGS(op->o_bd) = dbflags;
        op->o_msgid = 0;
 
        if ( rs_modify.sr_err != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_ANY,
-                       "be_modify failed (%d)\n", rs_modify.sr_err, 0, 0 );
+                       "syncrepl_updateCookie: rid %03d be_modify failed (%d)\n",
+                       si->si_rid, rs_modify.sr_err, 0 );
        }
 
        slap_graduate_commit_csn( op );
+       op->o_tmpfree( op->o_csn.bv_val, op->o_tmpmemctx );
+       BER_BVZERO( &op->o_csn );
+       if ( mod.sml_next ) slap_mods_free( mod.sml_next, 1 );
 
        return;
 }
@@ -2333,7 +2446,7 @@ dn_callback(
        if ( rs->sr_type == REP_SEARCH ) {
                if ( !BER_BVISNULL( &dni->dn ) ) {
                        Debug( LDAP_DEBUG_ANY,
-                               "dn_callback : consistency error - "
+                               "dn_callback: consistency error - "
                                "entryUUID is not unique\n", 0, 0, 0 );
                } else {
                        ber_dupbv_x( &dni->dn, &rs->sr_entry->e_name, op->o_tmpmemctx );
@@ -2414,7 +2527,7 @@ dn_callback(
        } else if ( rs->sr_type == REP_RESULT ) {
                if ( rs->sr_err == LDAP_SIZELIMIT_EXCEEDED ) {
                        Debug( LDAP_DEBUG_ANY,
-                               "dn_callback : consistency error - "
+                               "dn_callback: consistency error - "
                                "entryUUID is not unique\n", 0, 0, 0 );
                }
        }
@@ -2476,7 +2589,7 @@ null_callback(
                rs->sr_err != LDAP_NOT_ALLOWED_ON_NONLEAF )
        {
                Debug( LDAP_DEBUG_ANY,
-                       "null_callback : error code 0x%x\n",
+                       "null_callback: error code 0x%x\n",
                        rs->sr_err, 0, 0 );
        }
        return LDAP_SUCCESS;
@@ -2563,6 +2676,16 @@ avl_ber_bvfree( void *v_bv )
 void
 syncinfo_free( syncinfo_t *sie )
 {
+       if ( sie->si_ld ) {
+               if ( sie->si_conn_setup ) {
+                       ber_socket_t s;
+                       ldap_get_option( sie->si_ld, LDAP_OPT_DESC, &s );
+                       connection_client_stop( s );
+                       sie->si_conn_setup = 0;
+               }
+               ldap_unbind_ext( sie->si_ld, NULL, NULL );
+       }
+
        ldap_pvt_thread_mutex_destroy( &sie->si_mutex );
 
        bindconf_free( &sie->si_bindconf );
@@ -2618,9 +2741,6 @@ syncinfo_free( syncinfo_t *sie )
        if ( sie->si_presentlist ) {
            avl_free( sie->si_presentlist, avl_ber_bvfree );
        }
-       if ( sie->si_ld ) {
-               ldap_unbind_ext( sie->si_ld, NULL, NULL );
-       }
        while ( !LDAP_LIST_EMPTY( &sie->si_nonpresentlist )) {
                struct nonpresent_entry* npe;
                npe = LDAP_LIST_FIRST( &sie->si_nonpresentlist );
@@ -2678,9 +2798,10 @@ syncinfo_free( syncinfo_t *sie )
 /* mandatory */
 #define GOT_ID                 0x0001
 #define GOT_PROVIDER           0x0002
+#define GOT_BASE               0x0004
 
 /* check */
-#define GOT_ALL                        (GOT_ID|GOT_PROVIDER)
+#define GOT_ALL                        (GOT_ID|GOT_PROVIDER|GOT_BASE)
 
 static struct {
        struct berval key;
@@ -2785,6 +2906,15 @@ parse_syncrepl_line(
                                Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                                return -1;
                        }
+                       if ( select_backend( &si->si_base, 0, 0 ) != c->be ) {
+                               ber_memfree( si->si_base.bv_val );
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "Base DN \"%s\" is not within the database naming context",
+                                       val );
+                               Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
+                               return -1;
+                       }
+                       gots |= GOT_BASE;
                } else if ( !strncasecmp( c->argv[ i ], LOGBASESTR "=",
                                        STRLENOF( LOGBASESTR "=" ) ) )
                {
@@ -2911,8 +3041,11 @@ parse_syncrepl_line(
                        } else if ( strchr( val, ':' ) != NULL ) {
                                char *next, *ptr = val;
                                unsigned dd, hh, mm, ss;
+                               
+                               /* NOTE: the test for ptr[ 0 ] == '-'
+                                * should go before the call to strtoul() */
                                dd = strtoul( ptr, &next, 10 );
-                               if ( next == ptr || next[0] != ':' ) {
+                               if ( ptr[ 0 ] == '-' || next == ptr || next[0] != ':' ) {
                                        snprintf( c->msg, sizeof( c->msg ),
                                                "Error: parse_syncrepl_line: "
                                                "invalid interval \"%s\", unable to parse days", val );
@@ -2921,7 +3054,7 @@ parse_syncrepl_line(
                                }
                                ptr = next + 1;
                                hh = strtoul( ptr, &next, 10 );
-                               if ( next == ptr || next[0] != ':' || hh > 24 ) {
+                               if ( ptr[ 0 ] == '-' || next == ptr || next[0] != ':' || hh > 24 ) {
                                        snprintf( c->msg, sizeof( c->msg ),
                                                "Error: parse_syncrepl_line: "
                                                "invalid interval \"%s\", unable to parse hours", val );
@@ -2930,7 +3063,7 @@ parse_syncrepl_line(
                                }
                                ptr = next + 1;
                                mm = strtoul( ptr, &next, 10 );
-                               if ( next == ptr || next[0] != ':' || mm > 60 ) {
+                               if ( ptr[ 0 ] == '-' || next == ptr || next[0] != ':' || mm > 60 ) {
                                        snprintf( c->msg, sizeof( c->msg ),
                                                "Error: parse_syncrepl_line: "
                                                "invalid interval \"%s\", unable to parse minutes", val );
@@ -2939,7 +3072,7 @@ parse_syncrepl_line(
                                }
                                ptr = next + 1;
                                ss = strtoul( ptr, &next, 10 );
-                               if ( next == ptr || next[0] != '\0' || ss > 60 ) {
+                               if ( ptr[ 0 ] == '-' || next == ptr || next[0] != '\0' || ss > 60 ) {
                                        snprintf( c->msg, sizeof( c->msg ),
                                                "Error: parse_syncrepl_line: "
                                                "invalid interval \"%s\", unable to parse seconds", val );
@@ -3061,7 +3194,7 @@ parse_syncrepl_line(
                        if ( strcasecmp( val, "unlimited" ) == 0 ) {
                                si->si_slimit = 0;
 
-                       } else if ( lutil_atoi( &si->si_slimit, val ) != 0 || val < 0 ) {
+                       } else if ( lutil_atoi( &si->si_slimit, val ) != 0 || si->si_slimit < 0 ) {
                                snprintf( c->msg, sizeof( c->msg ),
                                        "invalid size limit value \"%s\".\n",
                                        val );
@@ -3075,7 +3208,7 @@ parse_syncrepl_line(
                        if ( strcasecmp( val, "unlimited" ) == 0 ) {
                                si->si_tlimit = 0;
 
-                       } else if ( lutil_atoi( &si->si_tlimit, val ) != 0 || val < 0 ) {
+                       } else if ( lutil_atoi( &si->si_tlimit, val ) != 0 || si->si_tlimit < 0 ) {
                                snprintf( c->msg, sizeof( c->msg ),
                                        "invalid time limit value \"%s\".\n",
                                        val );
@@ -3090,7 +3223,7 @@ parse_syncrepl_line(
                } else if ( bindconf_parse( c->argv[i], &si->si_bindconf ) ) {
                        snprintf( c->msg, sizeof( c->msg ),
                                "Error: parse_syncrepl_line: "
-                               "unknown keyword \"%s\"\n", c->argv[ i ] );
+                               "unable to parse \"%s\"\n", c->argv[ i ] );
                        Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                        return -1;
                }
@@ -3098,7 +3231,10 @@ parse_syncrepl_line(
 
        if ( gots != GOT_ALL ) {
                snprintf( c->msg, sizeof( c->msg ),
-                       "Error: Malformed \"syncrepl\" line in slapd config file" );
+                       "Error: Malformed \"syncrepl\" line in slapd config file, missing%s%s%s",
+                       gots & GOT_ID ? "" : " "IDSTR,
+                       gots & GOT_PROVIDER ? "" : " "PROVIDERSTR,
+                       gots & GOT_BASE ? "" : " "SEARCHBASESTR );
                Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->msg, 0 );
                return -1;
        }
@@ -3114,8 +3250,14 @@ add_syncrepl(
        int     rc = 0;
 
        if ( !( c->be->be_search && c->be->be_add && c->be->be_modify && c->be->be_delete ) ) {
-               Debug( LDAP_DEBUG_ANY, "%s: database %s does not support operations "
-                       "required for syncrepl\n", c->log, c->be->be_type, 0 );
+               snprintf( c->msg, sizeof(c->msg), "database %s does not support "
+                       "operations required for syncrepl", c->be->be_type );
+               Debug( LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 );
+               return 1;
+       }
+       if ( BER_BVISEMPTY( &c->be->be_rootdn )) {
+               strcpy( c->msg, "rootDN must be defined before syncrepl may be used" );
+               Debug( LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->msg, 0 );
                return 1;
        }
        si = (syncinfo_t *) ch_calloc( 1, sizeof( syncinfo_t ) );
@@ -3196,7 +3338,7 @@ syncrepl_unparse( syncinfo_t *si, struct berval *bv )
        si->si_bindconf.sb_uri = uri;
 
        ptr = buf;
-       ptr += snprintf( ptr, sizeof( buf ), IDSTR "=%03ld " PROVIDERSTR "=%s",
+       ptr += snprintf( ptr, sizeof( buf ), IDSTR "=%03d " PROVIDERSTR "=%s",
                si->si_rid, si->si_bindconf.sb_uri.bv_val );
        if ( !BER_BVISNULL( &bc )) {
                ptr = lutil_strcopy( ptr, bc.bv_val );