syncrepl.c

/* syncrepl.c -- Replication Engine which uses the LDAP Sync protocol */
/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
 *
 * Copyright 2003-2020 The OpenLDAP Foundation.
 * Portions Copyright 2003 by IBM Corporation.
 * Portions Copyright 2003-2008 by Howard Chu, Symas Corporation.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted only as authorized by the OpenLDAP
 * Public License.
 *
 * A copy of this license is available in the file LICENSE in the
 * top-level directory of the distribution or, alternatively, at
 * <http://www.OpenLDAP.org/license.html>.
 */

#include "portable.h"

#include <stdio.h>

#include <ac/string.h>
#include <ac/socket.h>

#include "lutil.h"
#include "slap.h"
#include "lutil_ldap.h"

#include "config.h"

#include "ldap_rq.h"

#include "rewrite.h"
#define SUFFIXM_CTX	"<suffix massage>"

#ifdef LDAP_CONTROL_X_DIRSYNC
#define MSAD_DIRSYNC	0x04
#define MSAD_DIRSYNC_MODIFY	0x10

static AttributeDescription *sy_ad_objectGUID;
static AttributeDescription *sy_ad_instanceType;
static AttributeDescription *sy_ad_isDeleted;
static AttributeDescription *sy_ad_whenCreated;
static AttributeDescription *sy_ad_dirSyncCookie;

static struct berval msad_addval = BER_BVC("range=1-1");
static struct berval msad_delval = BER_BVC("range=0-0");
#endif

static AttributeDescription *sy_ad_nsUniqueId;
static AttributeDescription *sy_ad_dseeLastChange;

#define DSEE_SYNC_ADD	0x20

#define	UUIDLEN	16

struct nonpresent_entry {
	struct berval *npe_name;
	struct berval *npe_nname;
	LDAP_LIST_ENTRY(nonpresent_entry) npe_link;
};

typedef struct cookie_state {
	ldap_pvt_thread_mutex_t	cs_mutex;
	ldap_pvt_thread_cond_t cs_cond;
	struct berval *cs_vals;
	int *cs_sids;
	int	cs_num;
	int cs_age;
	int cs_ref;
	int cs_updating;

	/* pending changes, not yet committed */
	ldap_pvt_thread_mutex_t	cs_pmutex;
	struct berval *cs_pvals;
	int *cs_psids;
	int	cs_pnum;
} cookie_state;

#define	SYNCDATA_DEFAULT	0	/* entries are plain LDAP entries */
#define	SYNCDATA_ACCESSLOG	1	/* entries are accesslog format */
#define	SYNCDATA_CHANGELOG	2	/* entries are changelog format */

#define	SYNCLOG_LOGGING		0	/* doing a log-based update */
#define	SYNCLOG_FALLBACK	1	/* doing a full refresh */

#define RETRYNUM_FOREVER	(-1)	/* retry forever */
#define RETRYNUM_TAIL		(-2)	/* end of retrynum array */
#define RETRYNUM_VALID(n)	((n) >= RETRYNUM_FOREVER)	/* valid retrynum */
#define RETRYNUM_FINITE(n)	((n) > RETRYNUM_FOREVER)	/* not forever */

typedef struct syncinfo_s {
	struct syncinfo_s	*si_next;
	BackendDB		*si_be;
	BackendDB		*si_wbe;
	struct re_s		*si_re;
	int			si_rid;
	char			si_ridtxt[ STRLENOF("rid=999") + 1 ];
	slap_bindconf		si_bindconf;
	struct berval		si_base;
	struct berval		si_logbase;
	struct berval		si_filterstr;
	struct berval		si_logfilterstr;
	Filter			*si_filter;
	Filter			*si_logfilter;
	struct berval		si_contextdn;
	int			si_scope;
	int			si_attrsonly;
	char			*si_anfile;
	AttributeName		*si_anlist;
	AttributeName		*si_exanlist;
	char 			**si_attrs;
	char			**si_exattrs;
	int			si_allattrs;
	int			si_allopattrs;
	int			si_schemachecking;
	int			si_type;	/* the active type */
	int			si_ctype;	/* the configured type */
	time_t			si_interval;
	time_t			*si_retryinterval;
	int			*si_retrynum_init;
	int			*si_retrynum;
	struct sync_cookie	si_syncCookie;
	cookie_state		*si_cookieState;
	int			si_cookieAge;
	int			si_manageDSAit;
	int			si_slimit;
	int			si_tlimit;
	int			si_refreshDelete;
	int			si_refreshPresent;
	int			si_refreshDone;
	int			si_syncdata;
	int			si_logstate;
	int			si_lazyCommit;
	int			si_got;
	int			si_strict_refresh;	/* stop listening during fallback refresh */
	int			si_too_old;
	ber_int_t	si_msgid;
	Avlnode			*si_presentlist;
	LDAP			*si_ld;
	Connection		*si_conn;
	LDAP_LIST_HEAD(np, nonpresent_entry)	si_nonpresentlist;
	struct rewrite_info *si_rewrite;
	struct berval	si_suffixm;
#ifdef LDAP_CONTROL_X_DIRSYNC
	struct berval		si_dirSyncCookie;
#endif
	unsigned long	si_prevchange;;
	unsigned long	si_lastchange;
	ldap_pvt_thread_mutex_t	si_mutex;
} syncinfo_t;

static int syncuuid_cmp( const void *, const void * );
static int presentlist_insert( syncinfo_t* si, struct berval *syncUUID );
static void presentlist_delete( Avlnode **av, struct berval *syncUUID );
static char *presentlist_find( Avlnode *av, struct berval *syncUUID );
static int presentlist_free( Avlnode *av );
static void syncrepl_del_nonpresent( Operation *, syncinfo_t *, BerVarray, struct sync_cookie *, int );
static int syncrepl_message_to_op(
					syncinfo_t *, Operation *, LDAPMessage * );
static int syncrepl_message_to_entry(
					syncinfo_t *, Operation *, LDAPMessage *,
					Modifications **, Entry **, int, struct berval* );
static int syncrepl_entry(
					syncinfo_t *, Operation*, Entry*,
					Modifications**,int, struct berval*,
					struct berval *cookieCSN );
static int syncrepl_updateCookie(
					syncinfo_t *, Operation *,
					struct sync_cookie *, int save );
static struct berval * slap_uuidstr_from_normalized(
					struct berval *, struct berval *, void * );
static int syncrepl_add_glue_ancestors(
	Operation* op, Entry *e );

#ifdef LDAP_CONTROL_X_DIRSYNC
static int syncrepl_dirsync_message(
					syncinfo_t *, Operation *, LDAPMessage *,
					Modifications **, Entry **, int *, struct berval* );
static int syncrepl_dirsync_cookie(
					syncinfo_t *, Operation *, LDAPControl ** );
#endif

static int syncrepl_dsee_update( syncinfo_t *si, Operation *op ) ;

/* delta-mpr overlay handler */
static int syncrepl_op_modify( Operation *op, SlapReply *rs );

/* callback functions */
static int dn_callback( Operation *, SlapReply * );
static int nonpresent_callback( Operation *, SlapReply * );

static AttributeDescription *sync_descs[4];

static AttributeDescription *dsee_descs[7];

/* delta-mpr */
static AttributeDescription *ad_reqMod, *ad_reqDN;

typedef struct logschema {
	struct berval ls_dn;
	struct berval ls_req;
	struct berval ls_mod;
	struct berval ls_newRdn;
	struct berval ls_delRdn;
	struct berval ls_newSup;
	struct berval ls_controls;
	struct berval ls_uuid;
	struct berval ls_changenum;
} logschema;

static logschema changelog_sc = {
	BER_BVC("targetDN"),
	BER_BVC("changeType"),
	BER_BVC("changes"),
	BER_BVC("newRDN"),
	BER_BVC("deleteOldRDN"),
	BER_BVC("newSuperior"),
	BER_BVNULL,
	BER_BVC("targetUniqueId"),
	BER_BVC("changeNumber")
};

static logschema accesslog_sc = {
	BER_BVC("reqDN"),
	BER_BVC("reqType"),
	BER_BVC("reqMod"),
	BER_BVC("reqNewRDN"),
	BER_BVC("reqDeleteOldRDN"),
	BER_BVC("reqNewSuperior"),
	BER_BVC("reqControls")
};

static const char *
syncrepl_state2str( int state )
{
	switch ( state ) {
	case LDAP_SYNC_PRESENT:
		return "PRESENT";

	case LDAP_SYNC_ADD:
		return "ADD";

	case LDAP_SYNC_MODIFY:
		return "MODIFY";

	case LDAP_SYNC_DELETE:
		return "DELETE";
#ifdef LDAP_CONTROL_X_DIRSYNC
	case MSAD_DIRSYNC_MODIFY:
		return "DIRSYNC_MOD";
#endif
	case DSEE_SYNC_ADD:
		return "DSEE_ADD";
	}

	return "UNKNOWN";
}

static slap_overinst syncrepl_ov;

static void
init_syncrepl(syncinfo_t *si)
{
	int i, j, k, l, n;
	char **attrs, **exattrs;

	if ( !syncrepl_ov.on_bi.bi_type ) {
		syncrepl_ov.on_bi.bi_type = "syncrepl";
		syncrepl_ov.on_bi.bi_op_modify = syncrepl_op_modify;
		overlay_register( &syncrepl_ov );
	}

	/* delta-MPR needs the overlay, nothing else does.
	 * This must happen before accesslog overlay is configured.
	 */
	if ( si->si_syncdata &&
		!overlay_is_inst( si->si_be, syncrepl_ov.on_bi.bi_type )) {
		overlay_config( si->si_be, syncrepl_ov.on_bi.bi_type, -1, NULL, NULL );
		if ( !ad_reqMod ) {
			const char *text;
			logschema *ls = &accesslog_sc;

			slap_bv2ad( &ls->ls_mod, &ad_reqMod, &text );
			slap_bv2ad( &ls->ls_dn, &ad_reqDN, &text );
		}
	}

	if ( !sync_descs[0] ) {
		sync_descs[0] = slap_schema.si_ad_objectClass;
		sync_descs[1] = slap_schema.si_ad_structuralObjectClass;
		sync_descs[2] = slap_schema.si_ad_entryCSN;
		sync_descs[3] = NULL;
	}

	if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
		/* DSEE doesn't support allopattrs */
		si->si_allopattrs = 0;
		if ( !dsee_descs[0] ) {
			dsee_descs[0] = slap_schema.si_ad_objectClass;
			dsee_descs[1] = slap_schema.si_ad_creatorsName;
			dsee_descs[2] = slap_schema.si_ad_createTimestamp;
			dsee_descs[3] = slap_schema.si_ad_modifiersName;
			dsee_descs[4] = slap_schema.si_ad_modifyTimestamp;
			dsee_descs[5] = sy_ad_nsUniqueId;
			dsee_descs[6] = NULL;
		}
	}

	if ( si->si_allattrs && si->si_allopattrs )
		attrs = NULL;
	else
		attrs = anlist2attrs( si->si_anlist );

	if ( attrs ) {
		if ( si->si_allattrs ) {
			i = 0;
			while ( attrs[i] ) {
				if ( !is_at_operational( at_find( attrs[i] ) ) ) {
					for ( j = i; attrs[j] != NULL; j++ ) {
						if ( j == i )
							ch_free( attrs[i] );
						attrs[j] = attrs[j+1];
					}
				} else {
					i++;
				}
			}
			attrs = ( char ** ) ch_realloc( attrs, (i + 2)*sizeof( char * ) );
			attrs[i] = ch_strdup("*");
			attrs[i + 1] = NULL;

		} else if ( si->si_allopattrs ) {
			i = 0;
			while ( attrs[i] ) {
				if ( is_at_operational( at_find( attrs[i] ) ) ) {
					for ( j = i; attrs[j] != NULL; j++ ) {
						if ( j == i )
							ch_free( attrs[i] );
						attrs[j] = attrs[j+1];
					}
				} else {
					i++;
				}
			}
			attrs = ( char ** ) ch_realloc( attrs, (i + 2)*sizeof( char * ) );
			attrs[i] = ch_strdup("+");
			attrs[i + 1] = NULL;
		}

		for ( i = 0; sync_descs[i] != NULL; i++ ) {
			j = 0;
			while ( attrs[j] ) {
				if ( !strcmp( attrs[j], sync_descs[i]->ad_cname.bv_val ) ) {
					for ( k = j; attrs[k] != NULL; k++ ) {
						if ( k == j )
							ch_free( attrs[k] );
						attrs[k] = attrs[k+1];
					}
				} else {
					j++;
				}
			}
		}

		for ( n = 0; attrs[ n ] != NULL; n++ ) /* empty */;

		if ( si->si_allopattrs ) {
			attrs = ( char ** ) ch_realloc( attrs, (n + 2)*sizeof( char * ) );
		} else {
			attrs = ( char ** ) ch_realloc( attrs, (n + 4)*sizeof( char * ) );
		}

		/* Add Attributes */
		if ( si->si_allopattrs ) {
			attrs[n++] = ch_strdup( sync_descs[0]->ad_cname.bv_val );
		} else {
			if ( si->si_syncdata != SYNCDATA_CHANGELOG ) {
				for ( i = 0; sync_descs[ i ] != NULL; i++ ) {
					attrs[ n++ ] = ch_strdup ( sync_descs[i]->ad_cname.bv_val );
				}
			}
		}
		attrs[ n ] = NULL;

	} else {

		i = 0;
		if ( si->si_allattrs == si->si_allopattrs ) {
			attrs = (char**) ch_malloc( 3 * sizeof(char*) );
			attrs[i++] = ch_strdup( "*" );
			attrs[i++] = ch_strdup( "+" );
			si->si_allattrs = si->si_allopattrs = 1;
		} else if ( si->si_allattrs && !si->si_allopattrs ) {
			for ( n = 0; sync_descs[ n ] != NULL; n++ ) ;
			attrs = (char**) ch_malloc( (n+1)* sizeof(char*) );
			attrs[i++] = ch_strdup( "*" );
			for ( j = 1; sync_descs[ j ] != NULL; j++ ) {
				attrs[i++] = ch_strdup ( sync_descs[j]->ad_cname.bv_val );
			}
		} else if ( !si->si_allattrs && si->si_allopattrs ) {
			attrs = (char**) ch_malloc( 3 * sizeof(char*) );
			attrs[i++] = ch_strdup( "+" );
			attrs[i++] = ch_strdup( sync_descs[0]->ad_cname.bv_val );
		}
		attrs[i] = NULL;
	}

	if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
		for ( n = 0; attrs[ n ] != NULL; n++ ) /* empty */;
		attrs = ( char ** ) ch_realloc( attrs, (n + 6)*sizeof( char * ) );
		for ( i = 0; dsee_descs[ i ] != NULL; i++ ) {
			attrs[ n++ ] = ch_strdup ( dsee_descs[i]->ad_cname.bv_val );
		}
		attrs[n] = NULL;
	}
	
	si->si_attrs = attrs;

	exattrs = anlist2attrs( si->si_exanlist );

	if ( exattrs ) {
		for ( n = 0; exattrs[n] != NULL; n++ ) ;

		for ( i = 0; sync_descs[i] != NULL; i++ ) {
			j = 0;
			while ( exattrs[j] != NULL ) {
				if ( !strcmp( exattrs[j], sync_descs[i]->ad_cname.bv_val ) ) {
					ch_free( exattrs[j] );
					for ( k = j; exattrs[k] != NULL; k++ ) {
						exattrs[k] = exattrs[k+1];
					}
				} else {
					j++;
				}
			}
		}

		for ( i = 0; exattrs[i] != NULL; i++ ) {
			for ( j = 0; si->si_anlist[j].an_name.bv_val; j++ ) {
				ObjectClass	*oc;
				if ( ( oc = si->si_anlist[j].an_oc ) ) {
					k = 0;
					while ( oc->soc_required[k] ) {
						if ( !strcmp( exattrs[i],
							 oc->soc_required[k]->sat_cname.bv_val ) ) {
							ch_free( exattrs[i] );
							for ( l = i; exattrs[l]; l++ ) {
								exattrs[l] = exattrs[l+1];
							}
						} else {
							k++;
						}
					}
				}
			}
		}

		for ( i = 0; exattrs[i] != NULL; i++ ) ;

		if ( i != n )
			exattrs = (char **) ch_realloc( exattrs, (i + 1)*sizeof(char *) );
	}

	si->si_exattrs = exattrs;	
}

static struct berval generic_filterstr = BER_BVC("(objectclass=*)");

static int
ldap_sync_search(
	syncinfo_t *si,
	void *ctx )
{
	BerElementBuffer berbuf;
	BerElement *ber = (BerElement *)&berbuf;
	LDAPControl c[3], *ctrls[4];
	int rc;
	int rhint;
	char *base;
	char **attrs, *lattrs[9];
	char *filter;
	int attrsonly;
	int scope;
	char filterbuf[sizeof("(changeNumber>=18446744073709551615)")];

	/* setup LDAP SYNC control */
	ber_init2( ber, NULL, LBER_USE_DER );
	ber_set_option( ber, LBER_OPT_BER_MEMCTX, &ctx );

	/* If we're using a log but we have no state, then fallback to
	 * normal mode for a full refresh.
	 */
	if ( si->si_syncdata ) {
		if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
			LDAPMessage *res, *msg;
			unsigned long first = 0, last = 0;
			int gotfirst = 0, gotlast = 0;
			/* See if we're new enough for the remote server */
			lattrs[0] = "firstchangenumber";
			lattrs[1] = "lastchangenumber";
			lattrs[2] = NULL;
			rc = ldap_search_ext_s( si->si_ld, "", LDAP_SCOPE_BASE, generic_filterstr.bv_val, lattrs, 0,
				NULL, NULL, NULL, si->si_slimit, &res );
			if ( rc )
				return rc;
			msg = ldap_first_message( si->si_ld, res );
			if ( msg && ldap_msgtype( msg ) == LDAP_RES_SEARCH_ENTRY ) {
				BerElement *ber = NULL;
				struct berval bv, *bvals, **bvp = &bvals;;
				rc = ldap_get_dn_ber( si->si_ld, msg, &ber, &bv );
				for ( rc = ldap_get_attribute_ber( si->si_ld, msg, ber, &bv, bvp );
					rc == LDAP_SUCCESS;
					rc = ldap_get_attribute_ber( si->si_ld, msg, ber, &bv, bvp ) ) {
					if ( bv.bv_val == NULL )
						break;
					if ( !strcasecmp( bv.bv_val, "firstchangenumber" )) {
						first = strtoul( bvals[0].bv_val, NULL, 0 );
						gotfirst = 1;
					} else if ( !strcasecmp( bv.bv_val, "lastchangenumber" )) {
						last = strtoul( bvals[0].bv_val, NULL, 0 );
						gotlast = 1;
					}
				}
			}
			ldap_msgfree( res );
			if ( gotfirst && gotlast ) {
				if ( si->si_lastchange < first || (!si->si_lastchange && !si->si_refreshDone ))
					si->si_logstate = SYNCLOG_FALLBACK;
				/* if we're in logging mode, it will update si_lastchange itself */
				if ( si->si_logstate == SYNCLOG_FALLBACK )
					si->si_lastchange = last;
			} else {
				/* should be an error; changelog plugin not enabled on provider */
				si->si_logstate = SYNCLOG_FALLBACK;
			}
		} else
		if ( si->si_logstate == SYNCLOG_LOGGING && !si->si_syncCookie.numcsns &&
				!si->si_refreshDone ) {
			si->si_logstate = SYNCLOG_FALLBACK;
		}
	}

	/* Use the log parameters if we're in log mode */
	if ( si->si_syncdata && si->si_logstate == SYNCLOG_LOGGING ) {
		logschema *ls;
		if ( si->si_syncdata == SYNCDATA_ACCESSLOG )
			ls = &accesslog_sc;
		else
			ls = &changelog_sc;
		lattrs[0] = ls->ls_dn.bv_val;
		lattrs[1] = ls->ls_req.bv_val;
		lattrs[2] = ls->ls_mod.bv_val;
		lattrs[3] = ls->ls_newRdn.bv_val;
		lattrs[4] = ls->ls_delRdn.bv_val;
		lattrs[5] = ls->ls_newSup.bv_val;
		if ( si->si_syncdata == SYNCDATA_ACCESSLOG ) {
			lattrs[6] = ls->ls_controls.bv_val;
			lattrs[7] = slap_schema.si_ad_entryCSN->ad_cname.bv_val;
			lattrs[8] = NULL;
			filter = si->si_logfilterstr.bv_val;
			scope = LDAP_SCOPE_SUBTREE;
		} else {
			lattrs[6] = ls->ls_uuid.bv_val;
			lattrs[7] = ls->ls_changenum.bv_val;
			lattrs[8] = NULL;
			sprintf( filterbuf, "(changeNumber>=%lu)", si->si_lastchange+1 );
			filter = filterbuf;
			scope = LDAP_SCOPE_ONELEVEL;
		}

		rhint = 0;
		base = si->si_logbase.bv_val;
		attrs = lattrs;
		attrsonly = 0;
	} else {
		rhint = 1;
		base = si->si_base.bv_val;
		filter = si->si_filterstr.bv_val;
		attrs = si->si_attrs;
		attrsonly = si->si_attrsonly;
		scope = si->si_scope;
	}
	if ( si->si_syncdata && si->si_logstate == SYNCLOG_FALLBACK ) {
		si->si_type = LDAP_SYNC_REFRESH_ONLY;
	} else {
		si->si_type = si->si_ctype;
	}

#ifdef LDAP_CONTROL_X_DIRSYNC
	if ( si->si_ctype == MSAD_DIRSYNC ) {
		ber_printf( ber, "{iiO}", LDAP_CONTROL_X_DIRSYNC_INCREMENTAL_VALUES, 0, &si->si_dirSyncCookie );

		if ( (rc = ber_flatten2( ber, &c[0].ldctl_value, 0 ) ) == -1 ) {
			ber_free_buf( ber );
			return rc;
		}
		c[0].ldctl_oid = LDAP_CONTROL_X_DIRSYNC;
		c[0].ldctl_iscritical = 1;
		ctrls[0] = &c[0];

		if ( !BER_BVISEMPTY( &si->si_dirSyncCookie )) {
			c[1].ldctl_oid = LDAP_CONTROL_X_SHOW_DELETED;
			BER_BVZERO( &c[1].ldctl_value );
			c[1].ldctl_iscritical = 1;
			ctrls[1] = &c[1];
			ctrls[2] = NULL;
		} else {
			ctrls[1] = NULL;
		}
	} else
#endif
	if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
		if ( si->si_logstate == SYNCLOG_LOGGING && si->si_type == LDAP_SYNC_REFRESH_AND_PERSIST ) {
			c[0].ldctl_oid = LDAP_CONTROL_PERSIST_REQUEST;
			c[0].ldctl_iscritical = 0;
			rc = ldap_create_persistentsearch_control_value( si->si_ld, LDAP_CONTROL_PERSIST_ENTRY_CHANGE_ADD,
				0, 1, &c[0].ldctl_value );
			ctrls[0] = &c[0];
			ctrls[1] = NULL;
		} else {
			ctrls[0] = NULL;
		}
	} else
	{
		if ( !BER_BVISNULL( &si->si_syncCookie.octet_str ) )
		{
			ber_printf( ber, "{eOb}",
				abs(si->si_type), &si->si_syncCookie.octet_str, rhint );
		} else {
			ber_printf( ber, "{eb}",
				abs(si->si_type), rhint );
		}

		if ( (rc = ber_flatten2( ber, &c[0].ldctl_value, 0 ) ) == -1 ) {
			ber_free_buf( ber );
			return rc;
		}

		c[0].ldctl_oid = LDAP_CONTROL_SYNC;
		c[0].ldctl_iscritical = si->si_type < 0;
		ctrls[0] = &c[0];

		c[1].ldctl_oid = LDAP_CONTROL_MANAGEDSAIT;
		BER_BVZERO( &c[1].ldctl_value );
		c[1].ldctl_iscritical = 1;
		ctrls[1] = &c[1];

		if ( !BER_BVISNULL( &si->si_bindconf.sb_authzId ) ) {
			c[2].ldctl_oid = LDAP_CONTROL_PROXY_AUTHZ;
			c[2].ldctl_value = si->si_bindconf.sb_authzId;
			c[2].ldctl_iscritical = 1;
			ctrls[2] = &c[2];
			ctrls[3] = NULL;
		} else {
			ctrls[2] = NULL;
		}
	}

	rc = ldap_search_ext( si->si_ld, base, scope, filter, attrs, attrsonly,
		ctrls, NULL, NULL, si->si_slimit, &si->si_msgid );
	ber_free_buf( ber );
	return rc;
}

static int
merge_state( syncinfo_t *si )
{
	int i, j = 0, k, numcsns = 0, alloc = 0, changed = 0;
	BerVarray new_ctxcsn = si->si_syncCookie.ctxcsn;
	int *new_sids = NULL;

	/* Count and set up sids */
	for ( i=0; i < si->si_cookieState->cs_num; i++ ) {
		if ( si->si_cookieState->cs_sids[i] == -1 ) {
			continue;
		}

		for ( ; j < si->si_syncCookie.numcsns &&
					si->si_syncCookie.sids[j] == -1;
				j++ )
			alloc = 1; /* Just skip over them */

		for ( ; j < si->si_syncCookie.numcsns &&
					si->si_syncCookie.sids[j] < si->si_cookieState->cs_sids[i];
				j++ ) {
			if ( si->si_syncCookie.sids[j] != -1 ) {
				new_sids = ch_realloc( new_sids, (numcsns+1)*sizeof(int) );
				new_sids[numcsns++] = si->si_syncCookie.sids[j];
			}
		}

		if ( j < si->si_syncCookie.numcsns &&
				si->si_syncCookie.sids[j] == si->si_cookieState->cs_sids[i] ) j++;

		new_sids = ch_realloc( new_sids, (numcsns+1)*sizeof(int) );
		new_sids[numcsns++] = si->si_cookieState->cs_sids[i];
	}

	for ( ; j < si->si_syncCookie.numcsns; j++ ) {
		if ( si->si_syncCookie.sids[j] != -1 ) {
			new_sids = ch_realloc( new_sids, (numcsns+1)*sizeof(int) );
			new_sids[numcsns++] = si->si_syncCookie.sids[j];
		}
	}

	if ( alloc || numcsns != si->si_syncCookie.numcsns ) {
		/* Short circuit allocations if we don't need to start over */
		alloc = 1;
		new_ctxcsn = ch_calloc( numcsns + 1, sizeof( BerValue ) );
	}

	i = j = 0;
	for ( k=0; k < numcsns; k++ ) {
		while ( i < si->si_cookieState->cs_num &&
				si->si_cookieState->cs_sids[i] < new_sids[k] )
			i++;

		while ( j < si->si_syncCookie.numcsns &&
				si->si_syncCookie.sids[j] < new_sids[k] )
			j++;

		if ( j < si->si_syncCookie.numcsns &&
				si->si_cookieState->cs_sids[i] == si->si_syncCookie.sids[j] ) {
			assert( si->si_cookieState->cs_sids[i] == new_sids[k] );
			if ( !bvmatch( &si->si_syncCookie.ctxcsn[j],
					&si->si_cookieState->cs_vals[i] )) {
				ber_bvreplace( &new_ctxcsn[k], &si->si_cookieState->cs_vals[i] );
				changed = 1;
			} else if ( alloc ) {
				ber_dupbv( &new_ctxcsn[k], &si->si_syncCookie.ctxcsn[j] );
			}
			i++;
			j++;
		} else if ( si->si_cookieState->cs_sids[i] == new_sids[k] ) {
			changed = 1;
			ber_bvreplace( &new_ctxcsn[k], &si->si_cookieState->cs_vals[i] );
			i++;
		} else {
			if ( alloc ) {
				ber_dupbv( &new_ctxcsn[k], &si->si_syncCookie.ctxcsn[j] );
			}
			j++;
		}
	}
	assert( i == si->si_cookieState->cs_num );
	assert( j == si->si_syncCookie.numcsns );

	si->si_syncCookie.numcsns = numcsns;
	if ( alloc ) {
		changed = 1;
		ch_free( si->si_syncCookie.sids );
		si->si_syncCookie.sids = new_sids;

		ber_bvarray_free( si->si_syncCookie.ctxcsn );
		si->si_syncCookie.ctxcsn = new_ctxcsn;
	} else {
		ch_free( new_sids );
	}
	return changed;
}

static int
check_syncprov(
	Operation *op,
	syncinfo_t *si )
{
	AttributeName at[2];
	Attribute a = {0};
	Entry e = {0};
	SlapReply rs = {REP_SEARCH};
	int i, j, changed = 0;

	/* Look for contextCSN from syncprov overlay. If
	 * there's no overlay, this will be a no-op. That means
	 * this is a pure consumer, so local changes will not be
	 * allowed, and all changes will already be reflected in
	 * the cookieState.
	 */
	a.a_desc = slap_schema.si_ad_contextCSN;
	e.e_attrs = &a;
	e.e_name = si->si_contextdn;
	e.e_nname = si->si_contextdn;
	at[0].an_name = a.a_desc->ad_cname;
	at[0].an_desc = a.a_desc;
	BER_BVZERO( &at[1].an_name );
	rs.sr_entry = &e;
	rs.sr_flags = REP_ENTRY_MODIFIABLE;
	rs.sr_attrs = at;
	op->o_req_dn = e.e_name;
	op->o_req_ndn = e.e_nname;

	ldap_pvt_thread_mutex_lock( &si->si_cookieState->cs_mutex );
	i = backend_operational( op, &rs );
	if ( i == LDAP_SUCCESS && a.a_nvals ) {
		int num = a.a_numvals;
		/* check for differences */
		if ( num != si->si_cookieState->cs_num ) {
			changed = 1;
		} else {
			for ( i=0; i<num; i++ ) {
				if ( ber_bvcmp( &a.a_nvals[i],
					&si->si_cookieState->cs_vals[i] )) {
					changed = 1;
					break;
				}
			}
		}
		if ( changed ) {
			ber_bvarray_free( si->si_cookieState->cs_vals );
			ch_free( si->si_cookieState->cs_sids );
			si->si_cookieState->cs_num = num;
			si->si_cookieState->cs_vals = a.a_nvals;
			si->si_cookieState->cs_sids = slap_parse_csn_sids( a.a_nvals,
				num, NULL );
			si->si_cookieState->cs_age++;
		} else {
			ber_bvarray_free( a.a_nvals );
		}
		ber_bvarray_free( a.a_vals );
	}
	/* See if the cookieState has changed due to anything outside
	 * this particular consumer. That includes other consumers in
	 * the same context, or local changes detected above.
	 */
	if ( si->si_cookieState->cs_num > 0 && si->si_cookieAge !=
		si->si_cookieState->cs_age ) {
		if ( !si->si_syncCookie.numcsns ) {
			ber_bvarray_free( si->si_syncCookie.ctxcsn );
			ber_bvarray_dup_x( &si->si_syncCookie.ctxcsn,
				si->si_cookieState->cs_vals, NULL );
			changed = 1;
		} else if ( merge_state( si ) ) {
			changed = 1;
		}
	}
	if ( changed ) {
		si->si_cookieAge = si->si_cookieState->cs_age;
		ch_free( si->si_syncCookie.octet_str.bv_val );
		slap_compose_sync_cookie( NULL, &si->si_syncCookie.octet_str,
			si->si_syncCookie.ctxcsn, si->si_syncCookie.rid,
			si->si_syncCookie.sid, NULL );
		ch_free( si->si_syncCookie.sids );
		slap_reparse_sync_cookie( &si->si_syncCookie, op->o_tmpmemctx );
	}
	ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
	return changed;
}

static int
do_syncrep1(
	Operation *op,
	syncinfo_t *si )
{
	int	rc;
	int cmdline_cookie_found = 0;

	struct sync_cookie	*sc = NULL;
#ifdef HAVE_TLS
	void	*ssl;
#endif

	rc = slap_client_connect( &si->si_ld, &si->si_bindconf );
	if ( rc != LDAP_SUCCESS ) {
		goto done;
	}
	op->o_protocol = LDAP_VERSION3;

	/* Set SSF to strongest of TLS, SASL SSFs */
	op->o_sasl_ssf = 0;
	op->o_tls_ssf = 0;
	op->o_transport_ssf = 0;
#ifdef HAVE_TLS
	if ( ldap_get_option( si->si_ld, LDAP_OPT_X_TLS_SSL_CTX, &ssl )
		== LDAP_SUCCESS && ssl != NULL )
	{
		op->o_tls_ssf = ldap_pvt_tls_get_strength( ssl );
	}
#endif /* HAVE_TLS */
	{
		ber_len_t ssf; /* ITS#5403, 3864 LDAP_OPT_X_SASL_SSF probably ought
						  to use sasl_ssf_t but currently uses ber_len_t */
		if ( ldap_get_option( si->si_ld, LDAP_OPT_X_SASL_SSF, &ssf )
			== LDAP_SUCCESS )
			op->o_sasl_ssf = ssf;
	}
	op->o_ssf = ( op->o_sasl_ssf > op->o_tls_ssf )
		?  op->o_sasl_ssf : op->o_tls_ssf;

	ldap_set_option( si->si_ld, LDAP_OPT_TIMELIMIT, &si->si_tlimit );

	rc = LDAP_DEREF_NEVER;	/* actually could allow DEREF_FINDING */
	ldap_set_option( si->si_ld, LDAP_OPT_DEREF, &rc );

	ldap_set_option( si->si_ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF );

	si->si_syncCookie.rid = si->si_rid;

	/* whenever there are multiple data sources possible, advertise sid */
	si->si_syncCookie.sid = ( SLAP_MULTIPROVIDER( si->si_be ) || si->si_be != si->si_wbe ) ?
		slap_serverID : -1;

#ifdef LDAP_CONTROL_X_DIRSYNC
	if ( si->si_ctype == MSAD_DIRSYNC ) {
		if ( BER_BVISEMPTY( &si->si_dirSyncCookie )) {
			BerVarray cookies = NULL;
			void *ctx = op->o_tmpmemctx;

			op->o_req_ndn = si->si_contextdn;
			op->o_req_dn = op->o_req_ndn;

			/* try to read stored cookie */
			op->o_tmpmemctx = NULL;
			backend_attribute( op, NULL, &op->o_req_ndn,
				sy_ad_dirSyncCookie, &cookies, ACL_READ );
			op->o_tmpmemctx = ctx;
			if ( cookies )
				si->si_dirSyncCookie = cookies[0];
		}
	} else
#endif
	if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
		if ( !si->si_lastchange ) {
			BerVarray vals = NULL;

			op->o_req_ndn = si->si_contextdn;
			op->o_req_dn = op->o_req_ndn;
			/* try to read last change number */
			backend_attribute( op, NULL, &op->o_req_ndn,
				sy_ad_dseeLastChange, &vals, ACL_READ );
			if ( vals ) {
				si->si_lastchange = strtoul( vals[0].bv_val, NULL, 0 );
				si->si_prevchange = si->si_lastchange;
			}
		}
	} else
	{

	/* We've just started up, or the remote server hasn't sent us
	 * any meaningful state.
	 */
	if ( !si->si_syncCookie.ctxcsn ) {
		int i;

		LDAP_STAILQ_FOREACH( sc, &slap_sync_cookie, sc_next ) {
			if ( si->si_rid == sc->rid ) {
				cmdline_cookie_found = 1;
				break;
			}
		}

		if ( cmdline_cookie_found ) {
			/* cookie is supplied in the command line */

			LDAP_STAILQ_REMOVE( &slap_sync_cookie, sc, sync_cookie, sc_next );

			slap_sync_cookie_free( &si->si_syncCookie, 0 );
			si->si_syncCookie.octet_str = sc->octet_str;
			ch_free( sc );
			/* ctxcsn wasn't parsed yet, do it now */
			slap_parse_sync_cookie( &si->si_syncCookie, NULL );
		} else {
			ldap_pvt_thread_mutex_lock( &si->si_cookieState->cs_mutex );
			if ( !si->si_cookieState->cs_num ) {
				/* get contextCSN shadow replica from database */
				BerVarray csn = NULL;
				void *ctx = op->o_tmpmemctx;

				op->o_req_ndn = si->si_contextdn;
				op->o_req_dn = op->o_req_ndn;

				/* try to read stored contextCSN */
				op->o_tmpmemctx = NULL;
				backend_attribute( op, NULL, &op->o_req_ndn,
					slap_schema.si_ad_contextCSN, &csn, ACL_READ );
				op->o_tmpmemctx = ctx;
				if ( csn ) {
					si->si_cookieState->cs_vals = csn;
					for (i=0; !BER_BVISNULL( &csn[i] ); i++);
					si->si_cookieState->cs_num = i;
					si->si_cookieState->cs_sids = slap_parse_csn_sids( csn, i, NULL );
					slap_sort_csn_sids( csn, si->si_cookieState->cs_sids, i, NULL );
				}
			}
			if ( si->si_cookieState->cs_num ) {
				ber_bvarray_free( si->si_syncCookie.ctxcsn );
				if ( ber_bvarray_dup_x( &si->si_syncCookie.ctxcsn,
					si->si_cookieState->cs_vals, NULL )) {
					rc = LDAP_NO_MEMORY;
					ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
					goto done;
				}
				si->si_syncCookie.numcsns = si->si_cookieState->cs_num;
				si->si_syncCookie.sids = ch_malloc( si->si_cookieState->cs_num *
					sizeof(int) );
				for ( i=0; i<si->si_syncCookie.numcsns; i++ )
					si->si_syncCookie.sids[i] = si->si_cookieState->cs_sids[i];
			}
			ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
		}

		ch_free( si->si_syncCookie.octet_str.bv_val );
		slap_compose_sync_cookie( NULL, &si->si_syncCookie.octet_str,
			si->si_syncCookie.ctxcsn, si->si_syncCookie.rid,
			si->si_syncCookie.sid, NULL );
	} else {
		/* ITS#6367: recreate the cookie so it has our SID, not our peer's */
		ch_free( si->si_syncCookie.octet_str.bv_val );
		BER_BVZERO( &si->si_syncCookie.octet_str );
		/* Look for contextCSN from syncprov overlay. */
		check_syncprov( op, si );
		if ( BER_BVISNULL( &si->si_syncCookie.octet_str ))
			slap_compose_sync_cookie( NULL, &si->si_syncCookie.octet_str,
				si->si_syncCookie.ctxcsn, si->si_syncCookie.rid,
				si->si_syncCookie.sid, NULL );
	}

	}

	si->si_refreshDone = 0;
	Debug( LDAP_DEBUG_SYNC, "do_syncrep1: %s starting refresh (sending cookie=%s)\n",
		si->si_ridtxt, si->si_syncCookie.octet_str.bv_val );

	rc = ldap_sync_search( si, op->o_tmpmemctx );

	if( rc != LDAP_SUCCESS ) {
		Debug( LDAP_DEBUG_ANY, "do_syncrep1: %s "
			"ldap_search_ext: %s (%d)\n",
			si->si_ridtxt, ldap_err2string( rc ), rc );
	}

done:
	if ( rc ) {
		if ( si->si_ld ) {
			ldap_unbind_ext( si->si_ld, NULL, NULL );
			si->si_ld = NULL;
		}
	}

	return rc;
}

static int
compare_csns( struct sync_cookie *sc1, struct sync_cookie *sc2, int *which )
{
	int i, j, match = 0;
	const char *text;

	*which = 0;

	if ( sc1->numcsns < sc2->numcsns ) {
		*which = sc1->numcsns;
		return -1;
	}

	for (j=0; j<sc2->numcsns; j++) {
		for (i=0; i<sc1->numcsns; i++) {
			if ( sc1->sids[i] != sc2->sids[j] )
				continue;
			value_match( &match, slap_schema.si_ad_entryCSN,
				slap_schema.si_ad_entryCSN->ad_type->sat_ordering,
				SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
				&sc1->ctxcsn[i], &sc2->ctxcsn[j], &text );
			if ( match < 0 ) {
				*which = j;
				return match;
			}
			break;
		}
		if ( i == sc1->numcsns ) {
			/* sc2 has a sid sc1 lacks */
			*which = j;
			return -1;
		}
	}
	return match;
}

#define SYNC_TIMEOUT	0
#define SYNC_SHUTDOWN	-100
#define SYNC_ERROR		-101
#define SYNC_REPOLL		-102
#define SYNC_PAUSED		-103

static int
do_syncrep2(
	Operation *op,
	syncinfo_t *si )
{
	BerElementBuffer berbuf;
	BerElement	*ber = (BerElement *)&berbuf;

	LDAPMessage	*msg = NULL;

	struct sync_cookie	syncCookie = { NULL };
	struct sync_cookie	syncCookie_req = { NULL };

	int		rc,
			err = LDAP_SUCCESS;

	Modifications	*modlist = NULL;

	int				m;

	struct timeval tout = { 0, 0 };

	int		refreshDeletes = 0;
	char empty[6] = "empty";

	if ( slapd_shutdown ) {
		rc = SYNC_SHUTDOWN;
		goto done;
	}

	ber_init2( ber, NULL, LBER_USE_DER );
	ber_set_option( ber, LBER_OPT_BER_MEMCTX, &op->o_tmpmemctx );

	Debug( LDAP_DEBUG_TRACE, "=>do_syncrep2 %s\n", si->si_ridtxt );

	slap_dup_sync_cookie( &syncCookie_req, &si->si_syncCookie );

	while ( ( rc = ldap_result( si->si_ld, si->si_msgid, LDAP_MSG_ONE,
		&tout, &msg ) ) > 0 )
	{
		int				match, punlock, syncstate;
		struct berval	*retdata, syncUUID[2], cookie = BER_BVNULL;
		char			*retoid;
		LDAPControl		**rctrls = NULL, *rctrlp = NULL;
		BerVarray		syncUUIDs;
		ber_len_t		len;
		ber_tag_t		si_tag;
		Entry			*entry;
		struct berval	bdn;

		if ( slapd_shutdown ) {
			rc = SYNC_SHUTDOWN;
			goto done;
		}
		switch( ldap_msgtype( msg ) ) {
		case LDAP_RES_SEARCH_ENTRY:
#ifdef LDAP_CONTROL_X_DIRSYNC
			if ( si->si_ctype == MSAD_DIRSYNC ) {
				BER_BVZERO( &syncUUID[0] );
				rc = syncrepl_dirsync_message( si, op, msg, &modlist, &entry, &syncstate, syncUUID );
				if ( rc == 0 )
					rc = syncrepl_entry( si, op, entry, &modlist, syncstate, syncUUID, NULL );
				op->o_tmpfree( syncUUID[0].bv_val, op->o_tmpmemctx );
				if ( modlist )
					slap_mods_free( modlist, 1);
				if ( rc )
					goto done;
				break;
			}
#endif
			ldap_get_entry_controls( si->si_ld, msg, &rctrls );
			ldap_get_dn_ber( si->si_ld, msg, NULL, &bdn );
			if (!bdn.bv_len) {
				bdn.bv_val = empty;
				bdn.bv_len = sizeof(empty)-1;
			}
			if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
				if ( si->si_logstate == SYNCLOG_LOGGING ) {
					rc = syncrepl_message_to_op( si, op, msg );
					if ( rc )
						goto logerr;
					if ( si->si_type == LDAP_SYNC_REFRESH_AND_PERSIST && rctrls ) {
						LDAPControl **next = NULL;
						/* The notification control is only sent during persist phase */
						rctrlp = ldap_control_find( LDAP_CONTROL_PERSIST_ENTRY_CHANGE_NOTICE, rctrls, &next );
						if ( rctrlp ) {
							if ( !si->si_refreshDone )
								si->si_refreshDone = 1;
							if ( si->si_refreshDone )
								syncrepl_dsee_update( si, op );
						}
					}

				} else {
					syncstate = DSEE_SYNC_ADD;
					rc = syncrepl_message_to_entry( si, op, msg,
						&modlist, &entry, syncstate, syncUUID );
					if ( rc == 0 )
						rc = syncrepl_entry( si, op, entry, &modlist, syncstate, syncUUID, NULL );
					op->o_tmpfree( syncUUID[0].bv_val, op->o_tmpmemctx );
					if ( modlist )
						slap_mods_free( modlist, 1);
				}
				if ( rc )
					goto done;
				break;
			}
			/* we can't work without the control */
			if ( rctrls ) {
				LDAPControl **next = NULL;
				/* NOTE: make sure we use the right one;
				 * a better approach would be to run thru
				 * the whole list and take care of all */
				/* NOTE: since we issue the search request,
				 * we should know what controls to expect,
				 * and there should be none apart from the
				 * sync-related control */
				rctrlp = ldap_control_find( LDAP_CONTROL_SYNC_STATE, rctrls, &next );
				if ( next && ldap_control_find( LDAP_CONTROL_SYNC_STATE, next, NULL ) )
				{
					bdn.bv_val[bdn.bv_len] = '\0';
					Debug( LDAP_DEBUG_ANY, "do_syncrep2: %s "
						"got search entry with multiple "
						"Sync State control (%s)\n", si->si_ridtxt, bdn.bv_val );
					ldap_controls_free( rctrls );
					rc = -1;
					goto done;
				}
			}
			if ( rctrlp == NULL ) {
				bdn.bv_val[bdn.bv_len] = '\0';
				Debug( LDAP_DEBUG_ANY, "do_syncrep2: %s "
					"got search entry without "
					"Sync State control (%s)\n", si->si_ridtxt, bdn.bv_val );
				rc = -1;
				goto done;
			}
			ber_init2( ber, &rctrlp->ldctl_value, LBER_USE_DER );
			if ( ber_scanf( ber, "{em" /*"}"*/, &syncstate, &syncUUID[0] )
					== LBER_ERROR ) {
				bdn.bv_val[bdn.bv_len] = '\0';
				Debug( LDAP_DEBUG_ANY, "do_syncrep2: %s malformed message (%s)\n",
					si->si_ridtxt, bdn.bv_val );
				ldap_controls_free( rctrls );
				rc = -1;
				goto done;
			}
			/* FIXME: what if syncUUID is NULL or empty?
			 * (happens with back-sql...) */
			if ( syncUUID[0].bv_len != UUIDLEN ) {
				bdn.bv_val[bdn.bv_len] = '\0';
				Debug( LDAP_DEBUG_ANY, "do_syncrep2: %s "
					"got empty or invalid syncUUID with LDAP_SYNC_%s (%s)\n",
					si->si_ridtxt,
					syncrepl_state2str( syncstate ), bdn.bv_val );
				ldap_controls_free( rctrls );
				rc = -1;
				goto done;
			}
			punlock = -1;
			if ( ber_peek_tag( ber, &len ) == LDAP_TAG_SYNC_COOKIE ) {
				if ( ber_scanf( ber, /*"{"*/ "m}", &cookie ) != LBER_ERROR ) {

				Debug( LDAP_DEBUG_SYNC, "do_syncrep2: %s cookie=%s\n",
					si->si_ridtxt,
					BER_BVISNULL( &cookie ) ? "" : cookie.bv_val );

				if ( !BER_BVISNULL( &cookie ) ) {
					ch_free( syncCookie.octet_str.bv_val );
					ber_dupbv( &syncCookie.octet_str, &cookie );
				}
				if ( !BER_BVISNULL( &syncCookie.octet_str ) )
				{
					slap_parse_sync_cookie( &syncCookie, NULL );
					if ( syncCookie.ctxcsn ) {
						int i, sid = slap_parse_csn_sid( syncCookie.ctxcsn );
						check_syncprov( op, si );
						ldap_pvt_thread_mutex_lock( &si->si_cookieState->cs_mutex );
						for ( i =0; i<si->si_cookieState->cs_num; i++ ) {
#ifdef CHATTY_SYNCLOG
							Debug( LDAP_DEBUG_SYNC, "do_syncrep2: %s CSN for sid %d: %s\n",
								si->si_ridtxt, i, si->si_cookieState->cs_vals[i].bv_val );
#endif
							/* new SID */
							if ( sid < si->si_cookieState->cs_sids[i] )
								break;
							if ( si->si_cookieState->cs_sids[i] == sid ) {
								if ( ber_bvcmp( syncCookie.ctxcsn, &si->si_cookieState->cs_vals[i] ) <= 0 ) {
									bdn.bv_val[bdn.bv_len] = '\0';
									Debug( LDAP_DEBUG_SYNC, "do_syncrep2: %s CSN too old, ignoring %s (%s)\n",
										si->si_ridtxt, syncCookie.ctxcsn->bv_val, bdn.bv_val );
									si->si_too_old = 1;
									ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
									ldap_controls_free( rctrls );
									rc = 0;
									goto done;
								}
								si->si_too_old = 0;
								break;
							}
						}
						ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );

						/* check pending CSNs too */
						while ( ldap_pvt_thread_mutex_trylock( &si->si_cookieState->cs_pmutex )) {
							if ( slapd_shutdown ) {
								rc = SYNC_SHUTDOWN;
								goto done;
							}
							if ( !ldap_pvt_thread_pool_pausecheck( &connection_pool ))
								ldap_pvt_thread_yield();
						}

						for ( i =0; i<si->si_cookieState->cs_pnum; i++ ) {
							if ( sid < si->si_cookieState->cs_psids[i] )
								break;
							if ( si->si_cookieState->cs_psids[i] == sid ) {
								if ( ber_bvcmp( syncCookie.ctxcsn, &si->si_cookieState->cs_pvals[i] ) <= 0 ) {
									ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_pmutex );
									bdn.bv_val[bdn.bv_len] = '\0';
									Debug( LDAP_DEBUG_SYNC, "do_syncrep2: %s CSN pending, ignoring %s (%s)\n",
										si->si_ridtxt, syncCookie.ctxcsn->bv_val, bdn.bv_val );
									ldap_controls_free( rctrls );
									rc = 0;
									goto done;
								}
								ber_bvreplace( &si->si_cookieState->cs_pvals[i],
									syncCookie.ctxcsn );
								break;
							}
						}
						/* new SID, add it */
						if ( i == si->si_cookieState->cs_pnum ||
							sid != si->si_cookieState->cs_psids[i] ) {
							slap_insert_csn_sids(
								(struct sync_cookie *)&si->si_cookieState->cs_pvals,
								i, sid, syncCookie.ctxcsn );
						}
						assert( punlock < 0 );
						punlock = i;