]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/syncrepl.c
Plug leaks
[openldap] / servers / slapd / syncrepl.c
index 991a0c7d2c34ece905f63be197807a49c1c838df..c297650da2b359b674029c58b8360ad131f86c93 100644 (file)
@@ -60,6 +60,7 @@ typedef struct cookie_state {
 typedef struct syncinfo_s {
        struct syncinfo_s       *si_next;
        struct slap_backend_db *si_be;
+       struct slap_backend_db *si_wbe;
        struct re_s                     *si_re;
        int                                     si_rid;
        char                            si_ridtxt[8];
@@ -111,8 +112,7 @@ static int syncrepl_message_to_entry(
                                        Modifications **, Entry **, int );
 static int syncrepl_entry(
                                        syncinfo_t *, Operation*, Entry*,
-                                       Modifications**,int, struct berval*,
-                                       struct sync_cookie * );
+                                       Modifications**,int, struct berval* );
 static int syncrepl_updateCookie(
                                        syncinfo_t *, Operation *, struct berval *,
                                        struct sync_cookie * );
@@ -453,47 +453,15 @@ do_syncrep1(
        op->o_ssf = ( op->o_sasl_ssf > op->o_tls_ssf )
                ?  op->o_sasl_ssf : op->o_tls_ssf;
 
-
+       /* We've just started up, or the remote server hasn't sent us
+        * any meaningful state.
+        */
        if ( BER_BVISNULL( &si->si_syncCookie.octet_str ) ) {
                int i;
 
-               ldap_pvt_thread_mutex_lock( &si->si_cookieState->cs_mutex );
-               if ( !si->si_cookieState->cs_num ) {
-                       /* get contextCSN shadow replica from database */
-                       BerVarray csn = NULL;
-                       void *ctx = op->o_tmpmemctx;
-
-                       op->o_req_ndn = op->o_bd->be_nsuffix[0];
-                       op->o_req_dn = op->o_req_ndn;
-
-                       /* try to read stored contextCSN */
-                       op->o_tmpmemctx = NULL;
-                       backend_attribute( op, NULL, &op->o_req_ndn,
-                               slap_schema.si_ad_contextCSN, &csn, ACL_READ );
-                       op->o_tmpmemctx = ctx;
-                       if ( csn ) {
-                               si->si_cookieState->cs_vals = csn;
-                               for (i=0; !BER_BVISNULL( &csn[i] ); i++);
-                               si->si_cookieState->cs_num = i;
-                               si->si_cookieState->cs_sids = slap_parse_csn_sids( csn, i );
-                       }
-               }
-               if ( si->si_cookieState->cs_num ) {
-                       ber_bvarray_free( si->si_syncCookie.ctxcsn );
-                       if ( ber_bvarray_dup_x( &si->si_syncCookie.ctxcsn,
-                               si->si_cookieState->cs_vals, NULL )) {
-                               rc = LDAP_NO_MEMORY;
-                               goto done;
-                       }
-                       si->si_syncCookie.numcsns = si->si_cookieState->cs_num;
-                       si->si_syncCookie.sids = ch_malloc( si->si_cookieState->cs_num *
-                               sizeof(int) );
-                       for ( i=0; i<si->si_syncCookie.numcsns; i++ )
-                               si->si_syncCookie.sids[i] = si->si_cookieState->cs_sids[i];
-               }
-               ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
-
                si->si_syncCookie.rid = si->si_rid;
+               si->si_syncCookie.sid = SLAP_SINGLE_SHADOW( si->si_be ) ? -1 :
+                       slap_serverID;
 
                LDAP_STAILQ_FOREACH( sc, &slap_sync_cookie, sc_next ) {
                        if ( si->si_rid == sc->rid ) {
@@ -509,24 +477,109 @@ do_syncrep1(
 
                        /* ctxcsn wasn't parsed yet, do it now */
                        slap_parse_sync_cookie( sc, op->o_tmpmemctx );
-                       if ( !sc->ctxcsn ) {
-                               /* if cmdline cookie does not have ctxcsn */
-                               /* component, set it to an initial value */
-                               slap_init_sync_cookie_ctxcsn( sc );
-                       }
                        slap_sync_cookie_free( &si->si_syncCookie, 0 );
                        slap_dup_sync_cookie( &si->si_syncCookie, sc );
                        slap_sync_cookie_free( sc, 1 );
+               } else {
+                       ldap_pvt_thread_mutex_lock( &si->si_cookieState->cs_mutex );
+                       if ( !si->si_cookieState->cs_num ) {
+                               /* get contextCSN shadow replica from database */
+                               BerVarray csn = NULL;
+                               void *ctx = op->o_tmpmemctx;
+
+                               op->o_req_ndn = op->o_bd->be_nsuffix[0];
+                               op->o_req_dn = op->o_req_ndn;
+
+                               /* try to read stored contextCSN */
+                               op->o_tmpmemctx = NULL;
+                               backend_attribute( op, NULL, &op->o_req_ndn,
+                                       slap_schema.si_ad_contextCSN, &csn, ACL_READ );
+                               op->o_tmpmemctx = ctx;
+                               if ( csn ) {
+                                       si->si_cookieState->cs_vals = csn;
+                                       for (i=0; !BER_BVISNULL( &csn[i] ); i++);
+                                       si->si_cookieState->cs_num = i;
+                                       si->si_cookieState->cs_sids = slap_parse_csn_sids( csn, i, NULL );
+                               }
+                       }
+                       if ( si->si_cookieState->cs_num ) {
+                               ber_bvarray_free( si->si_syncCookie.ctxcsn );
+                               if ( ber_bvarray_dup_x( &si->si_syncCookie.ctxcsn,
+                                       si->si_cookieState->cs_vals, NULL )) {
+                                       rc = LDAP_NO_MEMORY;
+                                       goto done;
+                               }
+                               si->si_syncCookie.numcsns = si->si_cookieState->cs_num;
+                               si->si_syncCookie.sids = ch_malloc( si->si_cookieState->cs_num *
+                                       sizeof(int) );
+                               for ( i=0; i<si->si_syncCookie.numcsns; i++ )
+                                       si->si_syncCookie.sids[i] = si->si_cookieState->cs_sids[i];
+                       }
+                       ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
                }
 
                slap_compose_sync_cookie( NULL, &si->si_syncCookie.octet_str,
-                       si->si_syncCookie.ctxcsn, si->si_syncCookie.rid );
+                       si->si_syncCookie.ctxcsn, si->si_syncCookie.rid,
+                       si->si_syncCookie.sid );
        } else {
+               AttributeName at[2];
+               Attribute a = { slap_schema.si_ad_contextCSN };
+               Entry e = {0};
+               SlapReply rs = {0};
+               int i, j, changed = 0;
+
+               /* Look for contextCSN from syncprov overlay. If
+                * there's no overlay, this will be a no-op. That means
+                * this is a pure consumer, so local changes will not be
+                * allowed, and all changes will already be reflected in
+                * the cookieState.
+                */
+               e.e_attrs = &a;
+               e.e_name = si->si_wbe->be_suffix[0];
+               e.e_nname = si->si_wbe->be_nsuffix[0];
+               rs.sr_entry = &e;
+               rs.sr_flags = REP_ENTRY_MODIFIABLE;
+               at[0].an_name = a.a_desc->ad_cname;
+               at[0].an_desc = a.a_desc;
+               BER_BVZERO( &at[1].an_name );
+
                ldap_pvt_thread_mutex_lock( &si->si_cookieState->cs_mutex );
-               /* match SIDs */
+               rc = backend_operational( op, &rs );
+               if ( rc == LDAP_SUCCESS && a.a_vals ) {
+                       int num;
+                       for (i=0; !BER_BVISNULL( &a.a_vals[i] ); i++) ;
+                       num = i;
+                       /* check for differences */
+                       if ( num != si->si_cookieState->cs_num ) {
+                               changed = 1;
+                       } else {
+                               for ( i=0; i<num; i++ ) {
+                                       if ( ber_bvcmp( &a.a_vals[i],
+                                               &si->si_cookieState->cs_vals[i] )) {
+                                               changed =1;
+                                               break;
+                                       }
+                               }
+                       }
+                       if ( changed ) {
+                               ber_bvarray_free( si->si_cookieState->cs_vals );
+                               ch_free( si->si_cookieState->cs_sids );
+                               si->si_cookieState->cs_num = num;
+                               si->si_cookieState->cs_vals = a.a_vals;
+                               si->si_cookieState->cs_sids = slap_parse_csn_sids( a.a_vals,
+                                       num, NULL );
+                               si->si_cookieState->cs_age++;
+                       } else {
+                               ber_bvarray_free( a.a_vals );
+                       }
+                       changed = 0;
+               }
+               /* See if the cookieState has changed due to anything outside
+                * this particular consumer. That includes other consumers in
+                * the same context, or local changes detected above.
+                */
                if ( si->si_cookieState->cs_num > 1 && si->si_cookieAge !=
                        si->si_cookieState->cs_age ) {
-                       int i, j;
 
                        for (i=0; !BER_BVISNULL( &si->si_syncCookie.ctxcsn[i] ); i++) {
                                /* bogus, just dup everything */
@@ -534,17 +587,28 @@ do_syncrep1(
                                        ber_bvarray_free( si->si_syncCookie.ctxcsn );
                                        ber_bvarray_dup_x( &si->si_syncCookie.ctxcsn,
                                                si->si_cookieState->cs_vals, NULL );
+                                       changed = 1;
                                        break;
                                }
                                for (j=0; j<si->si_cookieState->cs_num; j++) {
                                        if ( si->si_syncCookie.sids[i] !=
                                                si->si_cookieState->cs_sids[j] )
                                                continue;
+                                       if ( bvmatch( &si->si_syncCookie.ctxcsn[i],
+                                               &si->si_cookieState->cs_vals[j] ))
+                                               break;
                                        ber_bvreplace( &si->si_syncCookie.ctxcsn[i],
                                                &si->si_cookieState->cs_vals[j] );
+                                       changed = 1;
                                        break;
                                }
                        }
+                       if ( changed ) {
+                               ch_free( si->si_syncCookie.octet_str.bv_val );
+                               slap_compose_sync_cookie( NULL, &si->si_syncCookie.octet_str,
+                                       si->si_syncCookie.ctxcsn, si->si_syncCookie.rid,
+                                       SLAP_SINGLE_SHADOW( si->si_be ) ? -1 : slap_serverID );
+                       }
                }
                ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
        }
@@ -576,6 +640,11 @@ compare_csns( struct sync_cookie *sc1, struct sync_cookie *sc2, int *which )
 
        *which = 0;
 
+       if ( sc1->numcsns < sc2->numcsns ) {
+               *which = sc1->numcsns;
+               return -1;
+       }
+
        for (i=0; !BER_BVISNULL( &sc1->ctxcsn[i] ); i++) {
                for (j=0; !BER_BVISNULL( &sc2->ctxcsn[j] ); j++) {
                        if ( sc1->sids[i] != sc2->sids[j] )
@@ -722,7 +791,7 @@ do_syncrep2(
                                        &modlist, &entry, syncstate ) ) == LDAP_SUCCESS )
                                {
                                        if ( ( rc = syncrepl_entry( si, op, entry, &modlist,
-                                               syncstate, &syncUUID, &syncCookie_req ) ) == LDAP_SUCCESS &&
+                                               syncstate, &syncUUID ) ) == LDAP_SUCCESS &&
                                                syncCookie.ctxcsn )
                                        {
                                                rc = syncrepl_updateCookie( si, op, psub, &syncCookie );
@@ -783,10 +852,11 @@ do_syncrep2(
                                        }
                                        ber_scanf( ber, /*"{"*/ "}" );
                                }
-                               if ( !syncCookie_req.ctxcsn ) {
-                                       match = -1;
-                               } else if ( !syncCookie.ctxcsn ) {
+                               if ( !syncCookie.ctxcsn ) {
                                        match = 1;
+                               } else if ( !syncCookie_req.ctxcsn ) {
+                                       match = -1;
+                                       m = 0;
                                } else {
                                        match = compare_csns( &syncCookie_req, &syncCookie, &m );
                                }
@@ -929,10 +999,11 @@ do_syncrep2(
                                                continue;
                                        }
 
-                                       if ( !syncCookie_req.ctxcsn ) {
-                                               match = -1;
-                                       } else if ( !syncCookie.ctxcsn ) {
+                                       if ( !syncCookie.ctxcsn ) {
                                                match = 1;
+                                       } else if ( !syncCookie_req.ctxcsn ) {
+                                               match = -1;
+                                               m = 0;
                                        } else {
                                                match = compare_csns( &syncCookie_req, &syncCookie, &m );
                                        }
@@ -1069,6 +1140,15 @@ do_syncrepl(
        if ( !si->si_schemachecking )
                op->o_no_schema_check = 1;
 
+       /* If we're glued, send writes through the glue parent */
+       if ( !si->si_wbe ) {
+               if ( SLAP_GLUE_SUBORDINATE( be )) {
+                       si->si_wbe = select_backend( &be->be_nsuffix[0], 0, 1 );
+               } else {
+                       si->si_wbe = be;
+               }
+       }
+
        /* Establish session, do search */
        if ( !si->si_ld ) {
                si->si_refreshDelete = 0;
@@ -1087,6 +1167,13 @@ reload:
                        goto reload;
                }
 
+               /* We got deleted while running on cn=config */
+               if ( !si->si_ctype ) {
+                       if ( si->si_conn_setup )
+                               dostop = 1;
+                       rc = -1;
+               }
+
                if ( abs(si->si_type) == LDAP_SYNC_REFRESH_AND_PERSIST ) {
                        /* If we succeeded, enable the connection for further listening.
                         * If we failed, tear down the connection and reschedule.
@@ -1141,7 +1228,8 @@ reload:
                                break;
                }
 
-               if ( !si->si_retrynum || si->si_retrynum[i] == RETRYNUM_TAIL ) {
+               if ( !si->si_ctype
+                       || !si->si_retrynum || si->si_retrynum[i] == RETRYNUM_TAIL ) {
                        ldap_pvt_runqueue_remove( &slapd_rq, rtask );
                } else if ( RETRYNUM_VALID( si->si_retrynum[i] ) ) {
                        if ( si->si_retrynum[i] > 0 )
@@ -1155,6 +1243,25 @@ reload:
        ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
        ldap_pvt_thread_mutex_unlock( &si->si_mutex );
 
+       /* Do final delete cleanup */
+       if ( !si->si_ctype ) {
+               cookie_state *cs = NULL;
+               syncinfo_t **sip;
+
+               cs = be->be_syncinfo->si_cookieState;
+               for ( sip = &be->be_syncinfo; *sip != si; sip = &(*sip)->si_next );
+               *sip = si->si_next;
+               syncinfo_free( si, 0 );
+               if ( !be->be_syncinfo ) {
+                       SLAP_DBFLAGS( be ) &= ~(SLAP_DBFLAG_SHADOW|SLAP_DBFLAG_SYNC_SHADOW);
+                       if ( cs ) {
+                               ch_free( cs->cs_sids );
+                               ber_bvarray_free( cs->cs_vals );
+                               ldap_pvt_thread_mutex_destroy( &cs->cs_mutex );
+                               ch_free( cs );
+                       }
+               }
+       }
        return NULL;
 }
 
@@ -1296,6 +1403,7 @@ syncrepl_message_to_op(
        }
 
        op->o_tag = LBER_DEFAULT;
+       op->o_bd = si->si_wbe;
 
        while (( rc = ldap_get_attribute_ber( si->si_ld, msg, ber, &bv, &bvals ) )
                == LDAP_SUCCESS ) {
@@ -1389,10 +1497,12 @@ syncrepl_message_to_op(
                                be_entry_release_w( op, op->ora_e );
                } else {
                        op->orm_modlist = modlist;
+                       op->o_bd = si->si_wbe;
                        rc = op->o_bd->be_modify( op, &rs );
                        Debug( rc ? LDAP_DEBUG_ANY : LDAP_DEBUG_SYNC,
                                "syncrepl_message_to_op: %s be_modify %s (%d)\n", 
                                si->si_ridtxt, op->o_req_dn.bv_val, rc );
+                       op->o_bd = si->si_be;
                }
                break;
        case LDAP_REQ_MODRDN:
@@ -1446,6 +1556,7 @@ syncrepl_message_to_op(
        }
 done:
        slap_graduate_commit_csn( op );
+       op->o_bd = si->si_be;
        op->o_tmpfree( op->o_csn.bv_val, op->o_tmpmemctx );
        BER_BVZERO( &op->o_csn );
        if ( modlist ) {
@@ -1494,7 +1605,7 @@ syncrepl_message_to_entry(
        size_t textlen = sizeof txtbuf;
 
        struct berval   bdn = BER_BVNULL, dn, ndn;
-       int             rc;
+       int             rc, is_ctx;
 
        *modlist = NULL;
 
@@ -1523,8 +1634,7 @@ syncrepl_message_to_entry(
        }
 
        if ( entry == NULL ) {
-               rc = -1;
-               goto done;
+               return -1;
        }
 
        dnPrettyNormal( NULL, &bdn, &dn, &ndn, op->o_tmpmemctx );
@@ -1533,6 +1643,8 @@ syncrepl_message_to_entry(
        slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
        slap_sl_free( dn.bv_val, op->o_tmpmemctx );
 
+       is_ctx = dn_match( &op->o_req_ndn, &op->o_bd->be_nsuffix[0] );
+
        e = entry_alloc();
        e->e_name = op->o_req_dn;
        e->e_nname = op->o_req_ndn;
@@ -1544,6 +1656,15 @@ syncrepl_message_to_entry(
                        break;
                }
 
+               /* Drop all updates to the contextCSN of the context entry
+                * (ITS#4622, etc.)
+                */
+               if ( is_ctx && !strcasecmp( tmp.sml_type.bv_val,
+                       slap_schema.si_ad_contextCSN->ad_cname.bv_val )) {
+                       ber_bvarray_free( tmp.sml_values );
+                       continue;
+               }
+
                mod  = (Modifications *) ch_malloc( sizeof( Modifications ) );
 
                mod->sml_op = LDAP_MOD_REPLACE;
@@ -1613,7 +1734,8 @@ done:
                        e = NULL;
                }
        }
-       *entry = e;
+       if ( entry )
+               *entry = e;
 
        return rc;
 }
@@ -1656,8 +1778,7 @@ syncrepl_entry(
        Entry* entry,
        Modifications** modlist,
        int syncstate,
-       struct berval* syncUUID,
-       struct sync_cookie* syncCookie_req )
+       struct berval* syncUUID )
 {
        Backend *be = op->o_bd;
        slap_callback   cb = { NULL, NULL, NULL, NULL };
@@ -1814,24 +1935,6 @@ syncrepl_entry(
                                si->si_ridtxt, dni.dn.bv_val ? dni.dn.bv_val : "(null)", 0 );
        }
 
-       /* Don't save the contextCSN on the inooming context entry,
-        * we'll write it when syncrepl_updateCookie eventually
-        * gets called. (ITS#4622)
-        */
-       if ( syncstate == LDAP_SYNC_ADD && dn_match( &entry->e_nname,
-               &be->be_nsuffix[0] ) )
-       {
-               Attribute *a, **ap;
-               for ( ap = &entry->e_attrs; *ap; ap=&(*ap)->a_next ) {
-                       a = *ap;
-                       if ( a->a_desc == slap_schema.si_ad_contextCSN ) {
-                               *ap = a->a_next;
-                               attr_free( a );
-                               break;
-                       }
-               }
-       }
-
        slap_op_time( &op->o_time, &op->o_tincr );
        switch ( syncstate ) {
        case LDAP_SYNC_ADD:
@@ -1855,8 +1958,9 @@ retry_add:;
                        op->o_req_ndn = entry->e_nname;
                        op->o_tag = LDAP_REQ_ADD;
                        op->ora_e = entry;
+                       op->o_bd = si->si_wbe;
 
-                       rc = be->be_add( op, &rs_add );
+                       rc = op->o_bd->be_add( op, &rs_add );
                        Debug( LDAP_DEBUG_SYNC,
                                        "syncrepl_entry: %s be_add (%d)\n", 
                                        si->si_ridtxt, rc, 0 );
@@ -1889,6 +1993,7 @@ retry_add:;
                                        SlapReply       rs2 = { 0 };
                                        slap_callback   cb2 = { 0 };
 
+                                       op2.o_bd = be;
                                        op2.o_tag = LDAP_REQ_SEARCH;
                                        op2.o_req_dn = entry->e_name;
                                        op2.o_req_ndn = entry->e_nname;
@@ -1924,6 +2029,7 @@ retry_add:;
                                        si->si_ridtxt, rs_add.sr_err, 0 );
                                break;
                        }
+                       op->o_bd = be;
                        goto done;
                }
                /* FALLTHRU */
@@ -1990,7 +2096,8 @@ retry_add:;
                                        }
                                }
                        }
-                       rc = be->be_modrdn( op, &rs_modify );
+                       op->o_bd = si->si_wbe;
+                       rc = op->o_bd->be_modrdn( op, &rs_modify );
                        op->o_tmpfree( op->orr_nnewrdn.bv_val, op->o_tmpmemctx );
                        op->o_tmpfree( op->orr_newrdn.bv_val, op->o_tmpmemctx );
 
@@ -1998,14 +2105,16 @@ retry_add:;
                        Debug( LDAP_DEBUG_SYNC,
                                        "syncrepl_entry: %s be_modrdn (%d)\n", 
                                        si->si_ridtxt, rc, 0 );
+                       op->o_bd = be;
                        goto done;
                }
                if ( dni.mods ) {
                        op->o_tag = LDAP_REQ_MODIFY;
                        op->orm_modlist = dni.mods;
                        op->orm_no_opattrs = 1;
+                       op->o_bd = si->si_wbe;
 
-                       rc = be->be_modify( op, &rs_modify );
+                       rc = op->o_bd->be_modify( op, &rs_modify );
                        slap_mods_free( op->orm_modlist, 1 );
                        Debug( LDAP_DEBUG_SYNC,
                                        "syncrepl_entry: %s be_modify (%d)\n", 
@@ -2015,6 +2124,7 @@ retry_add:;
                                        "syncrepl_entry: %s be_modify failed (%d)\n",
                                        si->si_ridtxt, rs_modify.sr_err, 0 );
                        }
+                       op->o_bd = be;
                } else {
                        Debug( LDAP_DEBUG_SYNC,
                                        "syncrepl_entry: %s entry unchanged, ignored (%s)\n", 
@@ -2026,7 +2136,8 @@ retry_add:;
                        op->o_req_dn = dni.dn;
                        op->o_req_ndn = dni.ndn;
                        op->o_tag = LDAP_REQ_DELETE;
-                       rc = be->be_delete( op, &rs_delete );
+                       op->o_bd = si->si_wbe;
+                       rc = op->o_bd->be_delete( op, &rs_delete );
                        Debug( LDAP_DEBUG_SYNC,
                                        "syncrepl_entry: %s be_delete (%d)\n", 
                                        si->si_ridtxt, rc, 0 );
@@ -2034,7 +2145,7 @@ retry_add:;
                        while ( rs_delete.sr_err == LDAP_SUCCESS
                                && op->o_delete_glue_parent ) {
                                op->o_delete_glue_parent = 0;
-                               if ( !be_issuffix( op->o_bd, &op->o_req_ndn ) ) {
+                               if ( !be_issuffix( be, &op->o_req_ndn ) ) {
                                        slap_callback cb = { NULL };
                                        cb.sc_response = slap_null_cb;
                                        dnParent( &op->o_req_ndn, &pdn );
@@ -2046,6 +2157,7 @@ retry_add:;
                                        break;
                                }
                        }
+                       op->o_bd = be;
                }
                goto done;
 
@@ -2171,6 +2283,7 @@ syncrepl_del_nonpresent(
                        csn = si->si_syncCookie.ctxcsn[0];
                }
 
+               op->o_bd = si->si_wbe;
                slap_queue_csn( op, &csn );
 
                np_list = LDAP_LIST_FIRST( &si->si_nonpresentlist );
@@ -2210,14 +2323,14 @@ syncrepl_del_nonpresent(
                                op->o_tag = LDAP_REQ_MODIFY;
                                op->orm_modlist = &mod1;
 
-                               rc = be->be_modify( op, &rs_modify );
+                               rc = op->o_bd->be_modify( op, &rs_modify );
                                if ( mod2.sml_next ) slap_mods_free( mod2.sml_next, 1 );
                        }
 
                        while ( rs_delete.sr_err == LDAP_SUCCESS &&
                                        op->o_delete_glue_parent ) {
                                op->o_delete_glue_parent = 0;
-                               if ( !be_issuffix( op->o_bd, &op->o_req_ndn ) ) {
+                               if ( !be_issuffix( be, &op->o_req_ndn ) ) {
                                        slap_callback cb = { NULL };
                                        cb.sc_response = slap_null_cb;
                                        dnParent( &op->o_req_ndn, &pdn );
@@ -2239,6 +2352,7 @@ syncrepl_del_nonpresent(
                }
 
                slap_graduate_commit_csn( op );
+               op->o_bd = be;
 
                op->o_tmpfree( op->o_csn.bv_val, op->o_tmpmemctx );
                BER_BVZERO( &op->o_csn );
@@ -2449,6 +2563,7 @@ syncrepl_updateCookie(
                                first = syncCookie->ctxcsn[i];
                }
        }
+       op->o_bd = si->si_wbe;
        slap_queue_csn( op, &first );
 
        op->o_tag = LDAP_REQ_MODIFY;
@@ -2468,11 +2583,9 @@ syncrepl_updateCookie(
        else
                op->orm_modlist = &mod[1];
 
-       op->o_permissive_modify = SLAP_CONTROL_CRITICAL;
        op->orm_no_opattrs = 1;
-       rc = be->be_modify( op, &rs_modify );
+       rc = op->o_bd->be_modify( op, &rs_modify );
        op->o_msgid = 0;
-       op->o_permissive_modify = 0;
 
        if ( rs_modify.sr_err == LDAP_SUCCESS ) {
                slap_sync_cookie_free( &si->si_syncCookie, 0 );
@@ -2495,7 +2608,7 @@ syncrepl_updateCookie(
                        value_add( &si->si_cookieState->cs_vals, syncCookie->ctxcsn );
                        free( si->si_cookieState->cs_sids );
                        si->si_cookieState->cs_sids = slap_parse_csn_sids(
-                               si->si_cookieState->cs_vals, si->si_cookieState->cs_num );
+                               si->si_cookieState->cs_vals, si->si_cookieState->cs_num, NULL );
                }
 
                si->si_cookieState->cs_age++;
@@ -2508,6 +2621,7 @@ syncrepl_updateCookie(
        ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
 
        slap_graduate_commit_csn( op );
+       op->o_bd = be;
        op->o_tmpfree( op->o_csn.bv_val, op->o_tmpmemctx );
        BER_BVZERO( &op->o_csn );
        if ( mod[1].sml_next ) slap_mods_free( mod[1].sml_next, 1 );
@@ -2670,7 +2784,10 @@ dn_callback(
                        if ( dni->new_entry ) {
                                Modifications **modtail, **ml;
                                Attribute *old, *new;
-                               int i;
+                               int i, is_ctx;
+
+                               is_ctx = dn_match( &rs->sr_entry->e_nname,
+                                       &op->o_bd->be_nsuffix[0] );
 
                                /* Did the DN change?
                                 */
@@ -2705,6 +2822,22 @@ dn_callback(
                                modtail = &dni->mods;
                                ml = dni->modlist;
 
+                               /* Make sure new entry is actually newer than old entry */
+                               old = attr_find( rs->sr_entry->e_attrs,
+                                       slap_schema.si_ad_entryCSN );
+                               new = attr_find( dni->new_entry->e_attrs,
+                                       slap_schema.si_ad_entryCSN );
+                               if ( new && old && ber_bvcmp( &old->a_vals[0],
+                                       &new->a_vals[0] ) >= 0 ) {
+                                       Debug( LDAP_DEBUG_SYNC,
+                                               "dn_callback : new entry is older than ours "
+                                               "%s ours %s, new %s\n",
+                                               rs->sr_entry->e_name.bv_val,
+                                               old->a_vals[0].bv_val,
+                                               new->a_vals[0].bv_val );
+                                       return LDAP_SUCCESS;
+                               }
+
                                /* We assume that attributes are saved in the same order
                                 * in the remote and local databases. So if we walk through
                                 * the attributeDescriptions one by one they should match in
@@ -2719,6 +2852,13 @@ dn_callback(
                                                new = new->a_next;
                                                continue;
                                        }
+                                       /* Skip contextCSN */
+                                       if ( is_ctx && old->a_desc ==
+                                               slap_schema.si_ad_contextCSN ) {
+                                               old = old->a_next;
+                                               continue;
+                                       }
+
                                        if ( old->a_desc != new->a_desc ) {
                                                Modifications *mod;
                                                Attribute *tmp;
@@ -2930,106 +3070,119 @@ avl_ber_bvfree( void *v_bv )
 }
 
 void
-syncinfo_free( syncinfo_t *sie )
+syncinfo_free( syncinfo_t *sie, int free_all )
 {
-       if ( sie->si_ld ) {
-               if ( sie->si_conn_setup ) {
-                       ber_socket_t s;
-                       ldap_get_option( sie->si_ld, LDAP_OPT_DESC, &s );
-                       connection_client_stop( s );
-                       sie->si_conn_setup = 0;
-               }
-               ldap_unbind_ext( sie->si_ld, NULL, NULL );
-       }
+       syncinfo_t *si_next;
 
-       /* re-fetch it, in case it was already removed */
-       sie->si_re = ldap_pvt_runqueue_find( &slapd_rq, do_syncrepl, sie );
-       if ( sie->si_re ) {
-               if ( ldap_pvt_runqueue_isrunning( &slapd_rq, sie->si_re ) )
-                       ldap_pvt_runqueue_stoptask( &slapd_rq, sie->si_re );
-               ldap_pvt_runqueue_remove( &slapd_rq, sie->si_re );
+       if ( free_all && sie->si_cookieState ) {
+               ch_free( sie->si_cookieState->cs_sids );
+               ber_bvarray_free( sie->si_cookieState->cs_vals );
+               ldap_pvt_thread_mutex_destroy( &sie->si_cookieState->cs_mutex );
+               ch_free( sie->si_cookieState );
        }
+       do {
+               si_next = sie->si_next;
 
-       ldap_pvt_thread_mutex_destroy( &sie->si_mutex );
-
-       bindconf_free( &sie->si_bindconf );
-
-       if ( sie->si_filterstr.bv_val ) {
-               ch_free( sie->si_filterstr.bv_val );
-       }
-       if ( sie->si_logfilterstr.bv_val ) {
-               ch_free( sie->si_logfilterstr.bv_val );
-       }
-       if ( sie->si_base.bv_val ) {
-               ch_free( sie->si_base.bv_val );
-       }
-       if ( sie->si_logbase.bv_val ) {
-               ch_free( sie->si_logbase.bv_val );
-       }
-       if ( sie->si_attrs ) {
-               int i = 0;
-               while ( sie->si_attrs[i] != NULL ) {
-                       ch_free( sie->si_attrs[i] );
-                       i++;
+               if ( sie->si_ld ) {
+                       if ( sie->si_conn_setup ) {
+                               ber_socket_t s;
+                               ldap_get_option( sie->si_ld, LDAP_OPT_DESC, &s );
+                               connection_client_stop( s );
+                               sie->si_conn_setup = 0;
+                       }
+                       ldap_unbind_ext( sie->si_ld, NULL, NULL );
                }
-               ch_free( sie->si_attrs );
-       }
-       if ( sie->si_exattrs ) {
-               int i = 0;
-               while ( sie->si_exattrs[i] != NULL ) {
-                       ch_free( sie->si_exattrs[i] );
-                       i++;
+       
+               /* re-fetch it, in case it was already removed */
+               sie->si_re = ldap_pvt_runqueue_find( &slapd_rq, do_syncrepl, sie );
+               if ( sie->si_re ) {
+                       if ( ldap_pvt_runqueue_isrunning( &slapd_rq, sie->si_re ) )
+                               ldap_pvt_runqueue_stoptask( &slapd_rq, sie->si_re );
+                       ldap_pvt_runqueue_remove( &slapd_rq, sie->si_re );
                }
-               ch_free( sie->si_exattrs );
-       }
-       if ( sie->si_anlist ) {
-               int i = 0;
-               while ( sie->si_anlist[i].an_name.bv_val != NULL ) {
-                       ch_free( sie->si_anlist[i].an_name.bv_val );
-                       i++;
+       
+               ldap_pvt_thread_mutex_destroy( &sie->si_mutex );
+       
+               bindconf_free( &sie->si_bindconf );
+       
+               if ( sie->si_filterstr.bv_val ) {
+                       ch_free( sie->si_filterstr.bv_val );
                }
-               ch_free( sie->si_anlist );
-       }
-       if ( sie->si_exanlist ) {
-               int i = 0;
-               while ( sie->si_exanlist[i].an_name.bv_val != NULL ) {
-                       ch_free( sie->si_exanlist[i].an_name.bv_val );
-                       i++;
+               if ( sie->si_logfilterstr.bv_val ) {
+                       ch_free( sie->si_logfilterstr.bv_val );
                }
-               ch_free( sie->si_exanlist );
-       }
-       if ( sie->si_retryinterval ) {
-               ch_free( sie->si_retryinterval );
-       }
-       if ( sie->si_retrynum ) {
-               ch_free( sie->si_retrynum );
-       }
-       if ( sie->si_retrynum_init ) {
-               ch_free( sie->si_retrynum_init );
-       }
-       slap_sync_cookie_free( &sie->si_syncCookie, 0 );
-       if ( sie->si_presentlist ) {
-           avl_free( sie->si_presentlist, avl_ber_bvfree );
-       }
-       while ( !LDAP_LIST_EMPTY( &sie->si_nonpresentlist ) ) {
-               struct nonpresent_entry* npe;
-               npe = LDAP_LIST_FIRST( &sie->si_nonpresentlist );
-               LDAP_LIST_REMOVE( npe, npe_link );
-               if ( npe->npe_name ) {
-                       if ( npe->npe_name->bv_val ) {
-                               ch_free( npe->npe_name->bv_val );
+               if ( sie->si_base.bv_val ) {
+                       ch_free( sie->si_base.bv_val );
+               }
+               if ( sie->si_logbase.bv_val ) {
+                       ch_free( sie->si_logbase.bv_val );
+               }
+               if ( sie->si_attrs ) {
+                       int i = 0;
+                       while ( sie->si_attrs[i] != NULL ) {
+                               ch_free( sie->si_attrs[i] );
+                               i++;
                        }
-                       ch_free( npe->npe_name );
+                       ch_free( sie->si_attrs );
                }
-               if ( npe->npe_nname ) {
-                       if ( npe->npe_nname->bv_val ) {
-                               ch_free( npe->npe_nname->bv_val );
+               if ( sie->si_exattrs ) {
+                       int i = 0;
+                       while ( sie->si_exattrs[i] != NULL ) {
+                               ch_free( sie->si_exattrs[i] );
+                               i++;
                        }
-                       ch_free( npe->npe_nname );
+                       ch_free( sie->si_exattrs );
                }
-               ch_free( npe );
-       }
-       ch_free( sie );
+               if ( sie->si_anlist ) {
+                       int i = 0;
+                       while ( sie->si_anlist[i].an_name.bv_val != NULL ) {
+                               ch_free( sie->si_anlist[i].an_name.bv_val );
+                               i++;
+                       }
+                       ch_free( sie->si_anlist );
+               }
+               if ( sie->si_exanlist ) {
+                       int i = 0;
+                       while ( sie->si_exanlist[i].an_name.bv_val != NULL ) {
+                               ch_free( sie->si_exanlist[i].an_name.bv_val );
+                               i++;
+                       }
+                       ch_free( sie->si_exanlist );
+               }
+               if ( sie->si_retryinterval ) {
+                       ch_free( sie->si_retryinterval );
+               }
+               if ( sie->si_retrynum ) {
+                       ch_free( sie->si_retrynum );
+               }
+               if ( sie->si_retrynum_init ) {
+                       ch_free( sie->si_retrynum_init );
+               }
+               slap_sync_cookie_free( &sie->si_syncCookie, 0 );
+               if ( sie->si_presentlist ) {
+                   avl_free( sie->si_presentlist, avl_ber_bvfree );
+               }
+               while ( !LDAP_LIST_EMPTY( &sie->si_nonpresentlist ) ) {
+                       struct nonpresent_entry* npe;
+                       npe = LDAP_LIST_FIRST( &sie->si_nonpresentlist );
+                       LDAP_LIST_REMOVE( npe, npe_link );
+                       if ( npe->npe_name ) {
+                               if ( npe->npe_name->bv_val ) {
+                                       ch_free( npe->npe_name->bv_val );
+                               }
+                               ch_free( npe->npe_name );
+                       }
+                       if ( npe->npe_nname ) {
+                               if ( npe->npe_nname->bv_val ) {
+                                       ch_free( npe->npe_nname->bv_val );
+                               }
+                               ch_free( npe->npe_nname );
+                       }
+                       ch_free( npe );
+               }
+               ch_free( sie );
+               sie = si_next;
+       } while ( free_all && si_next );
 }
 
 
@@ -3049,22 +3202,13 @@ syncinfo_free( syncinfo_t *sie )
 #define SLIMITSTR              "sizelimit"
 #define TLIMITSTR              "timelimit"
 #define SYNCDATASTR            "syncdata"
+#define LOGBASESTR             "logbase"
+#define LOGFILTERSTR   "logfilter"
 
 /* FIXME: undocumented */
-#define        LOGBASESTR      "logbase"
-#define LOGFILTERSTR   "logfilter"
-#define OLDAUTHCSTR            "bindprincipal"
 #define EXATTRSSTR             "exattrs"
 #define MANAGEDSAITSTR         "manageDSAit"
 
-/* FIXME: unused */
-#define LASTMODSTR             "lastmod"
-#define LMGENSTR               "gen"
-#define LMNOSTR                        "no"
-#define LMREQSTR               "req"
-#define SRVTABSTR              "srvtab"
-#define SUFFIXSTR              "suffix"
-
 /* mandatory */
 #define GOT_ID                 0x0001
 #define GOT_PROVIDER   0x0002
@@ -3575,7 +3719,7 @@ add_syncrepl(
                        Debug( LDAP_DEBUG_ANY,
                                "version %d incompatible with syncrepl\n",
                                si->si_bindconf.sb_version, 0, 0 );
-                       syncinfo_free( si );    
+                       syncinfo_free( si, 0 ); 
                        return 1;
                }
 
@@ -3618,7 +3762,7 @@ add_syncrepl(
 #endif
        if ( rc < 0 ) {
                Debug( LDAP_DEBUG_ANY, "failed to add syncinfo\n", 0, 0, 0 );
-               syncinfo_free( si );    
+               syncinfo_free( si, 0 ); 
                return 1;
        } else {
                Debug( LDAP_DEBUG_CONFIG,
@@ -3829,7 +3973,18 @@ syncrepl_config( ConfigArgs *c )
                                si = *sip;
                                if ( c->valx == -1 || i == c->valx ) {
                                        *sip = si->si_next;
-                                       syncinfo_free( si );
+                                       /* If the task is currently active, we have to leave
+                                        * it running. It will exit on its own. This will only
+                                        * happen when running on the cn=config DB.
+                                        */
+                                       if ( si->si_re &&
+                                               ldap_pvt_runqueue_isrunning( &slapd_rq, si->si_re ) ) {
+                                               si->si_ctype = 0;
+                                       } else {
+                                               syncinfo_free( si, 0 );
+                                       }
+                                       if ( i == c->valx )
+                                               break;
                                } else {
                                        sip = &si->si_next;
                                }