syncrepl.c

/* syncrepl.c -- Replication Engine which uses the LDAP Sync protocol */
/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
 *
 * Copyright 2003-2020 The OpenLDAP Foundation.
 * Portions Copyright 2003 by IBM Corporation.
 * Portions Copyright 2003-2008 by Howard Chu, Symas Corporation.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted only as authorized by the OpenLDAP
 * Public License.
 *
 * A copy of this license is available in the file LICENSE in the
 * top-level directory of the distribution or, alternatively, at
 * <http://www.OpenLDAP.org/license.html>.
 */

#include "portable.h"

#include <stdio.h>

#include <ac/string.h>
#include <ac/socket.h>

#include "lutil.h"
#include "slap.h"
#include "lutil_ldap.h"

#include "config.h"

#include "ldap_rq.h"

#include "rewrite.h"
#define SUFFIXM_CTX	"<suffix massage>"

#ifdef LDAP_CONTROL_X_DIRSYNC
#define MSAD_DIRSYNC	0x04
#define MSAD_DIRSYNC_MODIFY	0x10

static AttributeDescription *sy_ad_objectGUID;
static AttributeDescription *sy_ad_instanceType;
static AttributeDescription *sy_ad_isDeleted;
static AttributeDescription *sy_ad_whenCreated;
static AttributeDescription *sy_ad_dirSyncCookie;

static struct berval msad_addval = BER_BVC("range=1-1");
static struct berval msad_delval = BER_BVC("range=0-0");
#endif

static AttributeDescription *sy_ad_nsUniqueId;
static AttributeDescription *sy_ad_dseeLastChange;

#define DSEE_SYNC_ADD	0x20

#define	UUIDLEN	16

struct nonpresent_entry {
	struct berval *npe_name;
	struct berval *npe_nname;
	LDAP_LIST_ENTRY(nonpresent_entry) npe_link;
};

typedef struct cookie_state {
	ldap_pvt_thread_mutex_t	cs_mutex;
	ldap_pvt_thread_cond_t cs_cond;
	struct berval *cs_vals;
	int *cs_sids;
	int	cs_num;
	int cs_age;
	int cs_ref;
	int cs_updating;

	/* pending changes, not yet committed */
	ldap_pvt_thread_mutex_t	cs_pmutex;
	struct berval *cs_pvals;
	int *cs_psids;
	int	cs_pnum;
} cookie_state;

#define	SYNCDATA_DEFAULT	0	/* entries are plain LDAP entries */
#define	SYNCDATA_ACCESSLOG	1	/* entries are accesslog format */
#define	SYNCDATA_CHANGELOG	2	/* entries are changelog format */

#define	SYNCLOG_LOGGING		0	/* doing a log-based update */
#define	SYNCLOG_FALLBACK	1	/* doing a full refresh */

#define RETRYNUM_FOREVER	(-1)	/* retry forever */
#define RETRYNUM_TAIL		(-2)	/* end of retrynum array */
#define RETRYNUM_VALID(n)	((n) >= RETRYNUM_FOREVER)	/* valid retrynum */
#define RETRYNUM_FINITE(n)	((n) > RETRYNUM_FOREVER)	/* not forever */

typedef struct syncinfo_s {
	struct syncinfo_s	*si_next;
	BackendDB		*si_be;
	BackendDB		*si_wbe;
	struct re_s		*si_re;
	int			si_rid;
	char			si_ridtxt[ STRLENOF("rid=999") + 1 ];
	slap_bindconf		si_bindconf;
	struct berval		si_base;
	struct berval		si_logbase;
	struct berval		si_filterstr;
	struct berval		si_logfilterstr;
	Filter			*si_filter;
	Filter			*si_logfilter;
	struct berval		si_contextdn;
	int			si_scope;
	int			si_attrsonly;
	char			*si_anfile;
	AttributeName		*si_anlist;
	AttributeName		*si_exanlist;
	char 			**si_attrs;
	char			**si_exattrs;
	int			si_allattrs;
	int			si_allopattrs;
	int			si_schemachecking;
	int			si_type;	/* the active type */
	int			si_ctype;	/* the configured type */
	time_t			si_interval;
	time_t			*si_retryinterval;
	int			*si_retrynum_init;
	int			*si_retrynum;
	struct sync_cookie	si_syncCookie;
	cookie_state		*si_cookieState;
	int			si_cookieAge;
	int			si_manageDSAit;
	int			si_slimit;
	int			si_tlimit;
	int			si_refreshDelete;
	int			si_refreshPresent;
	int			si_refreshDone;
	int			si_syncdata;
	int			si_logstate;
	int			si_lazyCommit;
	int			si_got;
	int			si_strict_refresh;	/* stop listening during fallback refresh */
	int			si_too_old;
	ber_int_t	si_msgid;
	Avlnode			*si_presentlist;
	LDAP			*si_ld;
	Connection		*si_conn;
	LDAP_LIST_HEAD(np, nonpresent_entry)	si_nonpresentlist;
	struct rewrite_info *si_rewrite;
	struct berval	si_suffixm;
#ifdef LDAP_CONTROL_X_DIRSYNC
	struct berval		si_dirSyncCookie;
#endif
	unsigned long	si_prevchange;;
	unsigned long	si_lastchange;
	ldap_pvt_thread_mutex_t	si_mutex;
} syncinfo_t;

static int syncuuid_cmp( const void *, const void * );
static int presentlist_insert( syncinfo_t* si, struct berval *syncUUID );
static void presentlist_delete( Avlnode **av, struct berval *syncUUID );
static char *presentlist_find( Avlnode *av, struct berval *syncUUID );
static int presentlist_free( Avlnode *av );
static void syncrepl_del_nonpresent( Operation *, syncinfo_t *, BerVarray, struct sync_cookie *, int );
static int syncrepl_message_to_op(
					syncinfo_t *, Operation *, LDAPMessage * );
static int syncrepl_message_to_entry(
					syncinfo_t *, Operation *, LDAPMessage *,
					Modifications **, Entry **, int, struct berval* );
static int syncrepl_entry(
					syncinfo_t *, Operation*, Entry*,
					Modifications**,int, struct berval*,
					struct berval *cookieCSN );
static int syncrepl_updateCookie(
					syncinfo_t *, Operation *,
					struct sync_cookie *, int save );
static struct berval * slap_uuidstr_from_normalized(
					struct berval *, struct berval *, void * );
static int syncrepl_add_glue_ancestors(
	Operation* op, Entry *e );

#ifdef LDAP_CONTROL_X_DIRSYNC
static int syncrepl_dirsync_message(
					syncinfo_t *, Operation *, LDAPMessage *,
					Modifications **, Entry **, int *, struct berval* );
static int syncrepl_dirsync_cookie(
					syncinfo_t *, Operation *, LDAPControl ** );
#endif

static int syncrepl_dsee_update( syncinfo_t *si, Operation *op ) ;

/* delta-mpr overlay handler */
static int syncrepl_op_modify( Operation *op, SlapReply *rs );

/* callback functions */
static int dn_callback( Operation *, SlapReply * );
static int nonpresent_callback( Operation *, SlapReply * );

static AttributeDescription *sync_descs[4];

static AttributeDescription *dsee_descs[7];

/* delta-mpr */
static AttributeDescription *ad_reqMod, *ad_reqDN;

typedef struct logschema {
	struct berval ls_dn;
	struct berval ls_req;
	struct berval ls_mod;
	struct berval ls_newRdn;
	struct berval ls_delRdn;
	struct berval ls_newSup;
	struct berval ls_controls;
	struct berval ls_uuid;
	struct berval ls_changenum;
} logschema;

static logschema changelog_sc = {
	BER_BVC("targetDN"),
	BER_BVC("changeType"),
	BER_BVC("changes"),
	BER_BVC("newRDN"),
	BER_BVC("deleteOldRDN"),
	BER_BVC("newSuperior"),
	BER_BVNULL,
	BER_BVC("targetUniqueId"),
	BER_BVC("changeNumber")
};

static logschema accesslog_sc = {
	BER_BVC("reqDN"),
	BER_BVC("reqType"),
	BER_BVC("reqMod"),
	BER_BVC("reqNewRDN"),
	BER_BVC("reqDeleteOldRDN"),
	BER_BVC("reqNewSuperior"),
	BER_BVC("reqControls")
};

static const char *
syncrepl_state2str( int state )
{
	switch ( state ) {
	case LDAP_SYNC_PRESENT:
		return "PRESENT";

	case LDAP_SYNC_ADD:
		return "ADD";

	case LDAP_SYNC_MODIFY:
		return "MODIFY";

	case LDAP_SYNC_DELETE:
		return "DELETE";
#ifdef LDAP_CONTROL_X_DIRSYNC
	case MSAD_DIRSYNC_MODIFY:
		return "DIRSYNC_MOD";
#endif
	case DSEE_SYNC_ADD:
		return "DSEE_ADD";
	}

	return "UNKNOWN";
}

static slap_overinst syncrepl_ov;

static void
init_syncrepl(syncinfo_t *si)
{
	int i, j, k, l, n;
	char **attrs, **exattrs;

	if ( !syncrepl_ov.on_bi.bi_type ) {
		syncrepl_ov.on_bi.bi_type = "syncrepl";
		syncrepl_ov.on_bi.bi_op_modify = syncrepl_op_modify;
		overlay_register( &syncrepl_ov );
	}

	/* delta-MPR needs the overlay, nothing else does.
	 * This must happen before accesslog overlay is configured.
	 */
	if ( si->si_syncdata &&
		!overlay_is_inst( si->si_be, syncrepl_ov.on_bi.bi_type )) {
		overlay_config( si->si_be, syncrepl_ov.on_bi.bi_type, -1, NULL, NULL );
		if ( !ad_reqMod ) {
			const char *text;
			logschema *ls = &accesslog_sc;

			slap_bv2ad( &ls->ls_mod, &ad_reqMod, &text );
			slap_bv2ad( &ls->ls_dn, &ad_reqDN, &text );
		}
	}

	if ( !sync_descs[0] ) {
		sync_descs[0] = slap_schema.si_ad_objectClass;
		sync_descs[1] = slap_schema.si_ad_structuralObjectClass;
		sync_descs[2] = slap_schema.si_ad_entryCSN;
		sync_descs[3] = NULL;
	}

	if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
		/* DSEE doesn't support allopattrs */
		si->si_allopattrs = 0;
		if ( !dsee_descs[0] ) {
			dsee_descs[0] = slap_schema.si_ad_objectClass;
			dsee_descs[1] = slap_schema.si_ad_creatorsName;
			dsee_descs[2] = slap_schema.si_ad_createTimestamp;
			dsee_descs[3] = slap_schema.si_ad_modifiersName;
			dsee_descs[4] = slap_schema.si_ad_modifyTimestamp;
			dsee_descs[5] = sy_ad_nsUniqueId;
			dsee_descs[6] = NULL;
		}
	}

	if ( si->si_allattrs && si->si_allopattrs )
		attrs = NULL;
	else
		attrs = anlist2attrs( si->si_anlist );

	if ( attrs ) {
		if ( si->si_allattrs ) {
			i = 0;
			while ( attrs[i] ) {
				if ( !is_at_operational( at_find( attrs[i] ) ) ) {
					for ( j = i; attrs[j] != NULL; j++ ) {
						if ( j == i )
							ch_free( attrs[i] );
						attrs[j] = attrs[j+1];
					}
				} else {
					i++;
				}
			}
			attrs = ( char ** ) ch_realloc( attrs, (i + 2)*sizeof( char * ) );
			attrs[i] = ch_strdup("*");
			attrs[i + 1] = NULL;

		} else if ( si->si_allopattrs ) {
			i = 0;
			while ( attrs[i] ) {
				if ( is_at_operational( at_find( attrs[i] ) ) ) {
					for ( j = i; attrs[j] != NULL; j++ ) {
						if ( j == i )
							ch_free( attrs[i] );
						attrs[j] = attrs[j+1];
					}
				} else {
					i++;
				}
			}
			attrs = ( char ** ) ch_realloc( attrs, (i + 2)*sizeof( char * ) );
			attrs[i] = ch_strdup("+");
			attrs[i + 1] = NULL;
		}

		for ( i = 0; sync_descs[i] != NULL; i++ ) {
			j = 0;
			while ( attrs[j] ) {
				if ( !strcmp( attrs[j], sync_descs[i]->ad_cname.bv_val ) ) {
					for ( k = j; attrs[k] != NULL; k++ ) {
						if ( k == j )
							ch_free( attrs[k] );
						attrs[k] = attrs[k+1];
					}
				} else {
					j++;
				}
			}
		}

		for ( n = 0; attrs[ n ] != NULL; n++ ) /* empty */;

		if ( si->si_allopattrs ) {
			attrs = ( char ** ) ch_realloc( attrs, (n + 2)*sizeof( char * ) );
		} else {
			attrs = ( char ** ) ch_realloc( attrs, (n + 4)*sizeof( char * ) );
		}

		/* Add Attributes */
		if ( si->si_allopattrs ) {
			attrs[n++] = ch_strdup( sync_descs[0]->ad_cname.bv_val );
		} else {
			if ( si->si_syncdata != SYNCDATA_CHANGELOG ) {
				for ( i = 0; sync_descs[ i ] != NULL; i++ ) {
					attrs[ n++ ] = ch_strdup ( sync_descs[i]->ad_cname.bv_val );
				}
			}
		}
		attrs[ n ] = NULL;

	} else {

		i = 0;
		if ( si->si_allattrs == si->si_allopattrs ) {
			attrs = (char**) ch_malloc( 3 * sizeof(char*) );
			attrs[i++] = ch_strdup( "*" );
			attrs[i++] = ch_strdup( "+" );
			si->si_allattrs = si->si_allopattrs = 1;
		} else if ( si->si_allattrs && !si->si_allopattrs ) {
			for ( n = 0; sync_descs[ n ] != NULL; n++ ) ;
			attrs = (char**) ch_malloc( (n+1)* sizeof(char*) );
			attrs[i++] = ch_strdup( "*" );
			for ( j = 1; sync_descs[ j ] != NULL; j++ ) {
				attrs[i++] = ch_strdup ( sync_descs[j]->ad_cname.bv_val );
			}
		} else if ( !si->si_allattrs && si->si_allopattrs ) {
			attrs = (char**) ch_malloc( 3 * sizeof(char*) );
			attrs[i++] = ch_strdup( "+" );
			attrs[i++] = ch_strdup( sync_descs[0]->ad_cname.bv_val );
		}
		attrs[i] = NULL;
	}

	if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
		for ( n = 0; attrs[ n ] != NULL; n++ ) /* empty */;
		attrs = ( char ** ) ch_realloc( attrs, (n + 6)*sizeof( char * ) );
		for ( i = 0; dsee_descs[ i ] != NULL; i++ ) {
			attrs[ n++ ] = ch_strdup ( dsee_descs[i]->ad_cname.bv_val );
		}
		attrs[n] = NULL;
	}
	
	si->si_attrs = attrs;

	exattrs = anlist2attrs( si->si_exanlist );

	if ( exattrs ) {
		for ( n = 0; exattrs[n] != NULL; n++ ) ;

		for ( i = 0; sync_descs[i] != NULL; i++ ) {
			j = 0;
			while ( exattrs[j] != NULL ) {
				if ( !strcmp( exattrs[j], sync_descs[i]->ad_cname.bv_val ) ) {
					ch_free( exattrs[j] );
					for ( k = j; exattrs[k] != NULL; k++ ) {
						exattrs[k] = exattrs[k+1];
					}
				} else {
					j++;
				}
			}
		}

		for ( i = 0; exattrs[i] != NULL; i++ ) {
			for ( j = 0; si->si_anlist[j].an_name.bv_val; j++ ) {
				ObjectClass	*oc;
				if ( ( oc = si->si_anlist[j].an_oc ) ) {
					k = 0;
					while ( oc->soc_required[k] ) {
						if ( !strcmp( exattrs[i],
							 oc->soc_required[k]->sat_cname.bv_val ) ) {
							ch_free( exattrs[i] );
							for ( l = i; exattrs[l]; l++ ) {
								exattrs[l] = exattrs[l+1];
							}
						} else {
							k++;
						}
					}
				}
			}
		}

		for ( i = 0; exattrs[i] != NULL; i++ ) ;

		if ( i != n )
			exattrs = (char **) ch_realloc( exattrs, (i + 1)*sizeof(char *) );
	}

	si->si_exattrs = exattrs;	
}

static struct berval generic_filterstr = BER_BVC("(objectclass=*)");

static int
ldap_sync_search(
	syncinfo_t *si,
	void *ctx )
{
	BerElementBuffer berbuf;
	BerElement *ber = (BerElement *)&berbuf;
	LDAPControl c[3], *ctrls[4];
	int rc;
	int rhint;
	char *base;
	char **attrs, *lattrs[9];
	char *filter;
	int attrsonly;
	int scope;
	char filterbuf[sizeof("(changeNumber>=18446744073709551615)")];

	/* setup LDAP SYNC control */
	ber_init2( ber, NULL, LBER_USE_DER );
	ber_set_option( ber, LBER_OPT_BER_MEMCTX, &ctx );

	/* If we're using a log but we have no state, then fallback to
	 * normal mode for a full refresh.
	 */
	if ( si->si_syncdata ) {
		if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
			LDAPMessage *res, *msg;
			unsigned long first = 0, last = 0;
			int gotfirst = 0, gotlast = 0;
			/* See if we're new enough for the remote server */
			lattrs[0] = "firstchangenumber";
			lattrs[1] = "lastchangenumber";
			lattrs[2] = NULL;
			rc = ldap_search_ext_s( si->si_ld, "", LDAP_SCOPE_BASE, generic_filterstr.bv_val, lattrs, 0,
				NULL, NULL, NULL, si->si_slimit, &res );
			if ( rc )
				return rc;
			msg = ldap_first_message( si->si_ld, res );
			if ( msg && ldap_msgtype( msg ) == LDAP_RES_SEARCH_ENTRY ) {
				BerElement *ber = NULL;
				struct berval bv, *bvals, **bvp = &bvals;;
				rc = ldap_get_dn_ber( si->si_ld, msg, &ber, &bv );
				for ( rc = ldap_get_attribute_ber( si->si_ld, msg, ber, &bv, bvp );
					rc == LDAP_SUCCESS;
					rc = ldap_get_attribute_ber( si->si_ld, msg, ber, &bv, bvp ) ) {
					if ( bv.bv_val == NULL )
						break;
					if ( !strcasecmp( bv.bv_val, "firstchangenumber" )) {
						first = strtoul( bvals[0].bv_val, NULL, 0 );
						gotfirst = 1;
					} else if ( !strcasecmp( bv.bv_val, "lastchangenumber" )) {
						last = strtoul( bvals[0].bv_val, NULL, 0 );
						gotlast = 1;
					}
				}
			}
			ldap_msgfree( res );
			if ( gotfirst && gotlast ) {
				if ( si->si_lastchange < first || (!si->si_lastchange && !si->si_refreshDone ))
					si->si_logstate = SYNCLOG_FALLBACK;
				/* if we're in logging mode, it will update si_lastchange itself */
				if ( si->si_logstate == SYNCLOG_FALLBACK )
					si->si_lastchange = last;
			} else {
				/* should be an error; changelog plugin not enabled on provider */
				si->si_logstate = SYNCLOG_FALLBACK;
			}
		} else
		if ( si->si_logstate == SYNCLOG_LOGGING && !si->si_syncCookie.numcsns &&
				!si->si_refreshDone ) {
			si->si_logstate = SYNCLOG_FALLBACK;
		}
	}

	/* Use the log parameters if we're in log mode */
	if ( si->si_syncdata && si->si_logstate == SYNCLOG_LOGGING ) {
		logschema *ls;
		if ( si->si_syncdata == SYNCDATA_ACCESSLOG )
			ls = &accesslog_sc;
		else
			ls = &changelog_sc;
		lattrs[0] = ls->ls_dn.bv_val;
		lattrs[1] = ls->ls_req.bv_val;
		lattrs[2] = ls->ls_mod.bv_val;
		lattrs[3] = ls->ls_newRdn.bv_val;
		lattrs[4] = ls->ls_delRdn.bv_val;
		lattrs[5] = ls->ls_newSup.bv_val;
		if ( si->si_syncdata == SYNCDATA_ACCESSLOG ) {
			lattrs[6] = ls->ls_controls.bv_val;
			lattrs[7] = slap_schema.si_ad_entryCSN->ad_cname.bv_val;
			lattrs[8] = NULL;
			filter = si->si_logfilterstr.bv_val;
			scope = LDAP_SCOPE_SUBTREE;
		} else {
			lattrs[6] = ls->ls_uuid.bv_val;
			lattrs[7] = ls->ls_changenum.bv_val;
			lattrs[8] = NULL;
			sprintf( filterbuf, "(changeNumber>=%lu)", si->si_lastchange+1 );
			filter = filterbuf;
			scope = LDAP_SCOPE_ONELEVEL;
		}

		rhint = 0;
		base = si->si_logbase.bv_val;
		attrs = lattrs;
		attrsonly = 0;
	} else {
		rhint = 1;
		base = si->si_base.bv_val;
		filter = si->si_filterstr.bv_val;
		attrs = si->si_attrs;
		attrsonly = si->si_attrsonly;
		scope = si->si_scope;
	}
	if ( si->si_syncdata && si->si_logstate == SYNCLOG_FALLBACK ) {
		si->si_type = LDAP_SYNC_REFRESH_ONLY;
	} else {
		si->si_type = si->si_ctype;
	}

#ifdef LDAP_CONTROL_X_DIRSYNC
	if ( si->si_ctype == MSAD_DIRSYNC ) {
		ber_printf( ber, "{iiO}", LDAP_CONTROL_X_DIRSYNC_INCREMENTAL_VALUES, 0, &si->si_dirSyncCookie );

		if ( (rc = ber_flatten2( ber, &c[0].ldctl_value, 0 ) ) == -1 ) {
			ber_free_buf( ber );
			return rc;
		}
		c[0].ldctl_oid = LDAP_CONTROL_X_DIRSYNC;
		c[0].ldctl_iscritical = 1;
		ctrls[0] = &c[0];

		if ( !BER_BVISEMPTY( &si->si_dirSyncCookie )) {
			c[1].ldctl_oid = LDAP_CONTROL_X_SHOW_DELETED;
			BER_BVZERO( &c[1].ldctl_value );
			c[1].ldctl_iscritical = 1;
			ctrls[1] = &c[1];
			ctrls[2] = NULL;
		} else {
			ctrls[1] = NULL;
		}
	} else
#endif
	if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
		if ( si->si_logstate == SYNCLOG_LOGGING && si->si_type == LDAP_SYNC_REFRESH_AND_PERSIST ) {
			c[0].ldctl_oid = LDAP_CONTROL_PERSIST_REQUEST;
			c[0].ldctl_iscritical = 0;
			rc = ldap_create_persistentsearch_control_value( si->si_ld, LDAP_CONTROL_PERSIST_ENTRY_CHANGE_ADD,
				0, 1, &c[0].ldctl_value );
			ctrls[0] = &c[0];
			ctrls[1] = NULL;
		} else {
			ctrls[0] = NULL;
		}
	} else
	{
		if ( !BER_BVISNULL( &si->si_syncCookie.octet_str ) )
		{
			ber_printf( ber, "{eOb}",
				abs(si->si_type), &si->si_syncCookie.octet_str, rhint );
		} else {
			ber_printf( ber, "{eb}",
				abs(si->si_type), rhint );
		}

		if ( (rc = ber_flatten2( ber, &c[0].ldctl_value, 0 ) ) == -1 ) {
			ber_free_buf( ber );
			return rc;
		}

		c[0].ldctl_oid = LDAP_CONTROL_SYNC;
		c[0].ldctl_iscritical = si->si_type < 0;
		ctrls[0] = &c[0];

		c[1].ldctl_oid = LDAP_CONTROL_MANAGEDSAIT;
		BER_BVZERO( &c[1].ldctl_value );
		c[1].ldctl_iscritical = 1;
		ctrls[1] = &c[1];

		if ( !BER_BVISNULL( &si->si_bindconf.sb_authzId ) ) {
			c[2].ldctl_oid = LDAP_CONTROL_PROXY_AUTHZ;
			c[2].ldctl_value = si->si_bindconf.sb_authzId;
			c[2].ldctl_iscritical = 1;
			ctrls[2] = &c[2];
			ctrls[3] = NULL;
		} else {
			ctrls[2] = NULL;
		}
	}

	rc = ldap_search_ext( si->si_ld, base, scope, filter, attrs, attrsonly,
		ctrls, NULL, NULL, si->si_slimit, &si->si_msgid );
	ber_free_buf( ber );
	return rc;
}

/* #define DEBUG_MERGE_STATE	1 */

static int
merge_state( syncinfo_t *si, struct sync_cookie *sc1, struct sync_cookie *sc2 )
{
	int i, j, k, changed = 0;
	int ei, ej;
	int *newsids;
	struct berval *newcsns;

	ei = sc1->numcsns;
	ej = sc2->numcsns;
#ifdef DEBUG_MERGE_STATE
	for ( i=0; i<ei; i++ ) {
		fprintf(stderr, "merge_state: %s si_syncCookie [%d] %d %s\n",
			si->si_ridtxt, i, sc1->sids[i], sc1->ctxcsn[i].bv_val );
	}
	for ( i=0; i<ej; i++ ) {
		fprintf(stderr, "merge_state: %s si_cookieState [%d] %d %s\n",
			si->si_ridtxt, i, sc2->sids[i], sc2->ctxcsn[i].bv_val );
	}
#endif
	/* see if they cover the same SIDs */
	if ( ei == ej ) {
		for ( i = 0; i < ei; i++ ) {
			if ( sc1->sids[i] != sc2->sids[i] ) {
				changed = 1;
				break;
			}
		}
		/* SIDs are the same, take fast path */
		if ( !changed ) {
			for ( i = 0; i > ei; i++ ) {
				if ( !bvmatch( &sc1->ctxcsn[i], &sc2->ctxcsn[i] )) {
					ber_bvreplace( &sc1->ctxcsn[i], &sc2->ctxcsn[i] );
					changed = 1;
				}
			}
			return changed;
		}
		changed = 0;
	}

	i = ei + ej;
	newsids = ch_malloc( sizeof(int) * i );
	newcsns = ch_malloc( sizeof(struct berval) * ( i + 1 ));

	for ( i=0, j=0, k=0; i < ei || j < ej ; ) {
		if ( sc1->sids[i] == -1 ) {
			i++;
			continue;
		}
		if ( j >= ej || (i < ei && sc1->sids[i] < sc2->sids[j] )) {
			newsids[k] = sc1->sids[i];
			ber_dupbv( &newcsns[k], &sc1->ctxcsn[i] );
			i++; k++;
			continue;
		}
		if ( i < ei && sc1->sids[i] == sc2->sids[j] ) {
			newsids[k] = sc1->sids[i];
			ber_dupbv( &newcsns[k], &sc2->ctxcsn[j] );
			if ( !bvmatch( &sc1->ctxcsn[i], &sc2->ctxcsn[j] ))
				changed = 1;
			i++; j++; k++;
			continue;
		}
		if ( j < ej ) {
			if ( sc2->sids[j] == -1 ) {
				j++;
				continue;
			}
			newsids[k] = sc2->sids[j];
			ber_dupbv( &newcsns[k], &sc2->ctxcsn[j] );
			changed = 1;
			j++; k++;
		}
	}

	ber_bvarray_free( sc1->ctxcsn );
	ch_free( sc1->sids );
	sc1->numcsns = k;
	sc1->sids = ch_realloc( newsids, sizeof(int) * k );
	sc1->ctxcsn = ch_realloc( newcsns, sizeof(struct berval) * (k+1) );
	BER_BVZERO( &sc1->ctxcsn[k] );
#ifdef DEBUG_MERGE_STATE
	for ( i=0; i<sc1->numcsns; i++ ) {
		fprintf(stderr, "merge_state: %s si_syncCookie2 [%d] %d %s\n",
			si->si_ridtxt, i, sc1->sids[i], sc1->ctxcsn[i].bv_val );
	}
#endif

	return changed;
}

#ifdef DEBUG_MERGE_STATE
static void
merge_test( syncinfo_t *si ) {
	struct sync_cookie sc1, sc2;
	int ret;

	sc1.numcsns = 1;
	sc1.sids = malloc( sizeof(int));
	sc1.ctxcsn = malloc( sizeof( struct berval ) * 2);
	sc1.sids[0] = 1;
	{ struct berval bv = BER_BVC("20200826182258.100566Z#000000#001#000000");
	ber_dupbv( &sc1.ctxcsn[0], &bv ); }
	BER_BVZERO( &sc1.ctxcsn[1] );

	sc2.numcsns = 3;
	sc2.sids = malloc( sizeof(int) * 3);
	sc2.ctxcsn = malloc( sizeof(struct berval) * 4);
	sc2.sids[0] = 1;
	sc2.sids[1] = 2;
	sc2.sids[2] = 3;
	{ struct berval bv = BER_BVC("20200826182258.100567Z#000000#001#000000");
	ber_dupbv( &sc2.ctxcsn[0], &bv ); }
	{ struct berval bv = BER_BVC("20200826182259.141950Z#000000#002#000000");
	ber_dupbv( &sc2.ctxcsn[1], &bv ); }
	{ struct berval bv = BER_BVC("20200826182300.171795Z#000000#003#000000");
	ber_dupbv( &sc2.ctxcsn[2], &bv ); }
	BER_BVZERO( &sc2.ctxcsn[3] );

	ret = merge_state( si, &sc1, &sc2 );
}
#endif

static int
check_syncprov(
	Operation *op,
	syncinfo_t *si )
{
	AttributeName at[2];
	Attribute a = {0};
	Entry e = {0};
	SlapReply rs = {REP_SEARCH};
	int i, j, changed = 0;

	/* Look for contextCSN from syncprov overlay. If
	 * there's no overlay, this will be a no-op. That means
	 * this is a pure consumer, so local changes will not be
	 * allowed, and all changes will already be reflected in
	 * the cookieState.
	 */
	a.a_desc = slap_schema.si_ad_contextCSN;
	e.e_attrs = &a;
	e.e_name = si->si_contextdn;
	e.e_nname = si->si_contextdn;
	at[0].an_name = a.a_desc->ad_cname;
	at[0].an_desc = a.a_desc;
	BER_BVZERO( &at[1].an_name );
	rs.sr_entry = &e;
	rs.sr_flags = REP_ENTRY_MODIFIABLE;
	rs.sr_attrs = at;
	op->o_req_dn = e.e_name;
	op->o_req_ndn = e.e_nname;

	ldap_pvt_thread_mutex_lock( &si->si_cookieState->cs_mutex );
	i = backend_operational( op, &rs );
	if ( i == LDAP_SUCCESS && a.a_nvals ) {
		int num = a.a_numvals;
		/* check for differences */
		if ( num != si->si_cookieState->cs_num ) {
			changed = 1;
		} else {
			for ( i=0; i<num; i++ ) {
				if ( ber_bvcmp( &a.a_nvals[i],
					&si->si_cookieState->cs_vals[i] )) {
					changed = 1;
					break;
				}
			}
		}
		if ( changed ) {
			ber_bvarray_free( si->si_cookieState->cs_vals );
			ch_free( si->si_cookieState->cs_sids );
			si->si_cookieState->cs_num = num;
			si->si_cookieState->cs_vals = a.a_nvals;
			si->si_cookieState->cs_sids = slap_parse_csn_sids( a.a_nvals,
				num, NULL );
			si->si_cookieState->cs_age++;
		} else {
			ber_bvarray_free( a.a_nvals );
		}
		ber_bvarray_free( a.a_vals );
	}
	/* See if the cookieState has changed due to anything outside
	 * this particular consumer. That includes other consumers in
	 * the same context, or local changes detected above.
	 */
	if ( si->si_cookieState->cs_num > 0 && si->si_cookieAge !=
		si->si_cookieState->cs_age ) {
		if ( !si->si_syncCookie.numcsns ) {
			ber_bvarray_free( si->si_syncCookie.ctxcsn );
			ber_bvarray_dup_x( &si->si_syncCookie.ctxcsn,
				si->si_cookieState->cs_vals, NULL );
			changed = 1;
		} else {
			changed = merge_state( si, &si->si_syncCookie,
				(struct sync_cookie *)&si->si_cookieState->cs_vals );
		}
	}
	if ( changed ) {
		si->si_cookieAge = si->si_cookieState->cs_age;
		ch_free( si->si_syncCookie.octet_str.bv_val );
		slap_compose_sync_cookie( NULL, &si->si_syncCookie.octet_str,
			si->si_syncCookie.ctxcsn, si->si_syncCookie.rid,
			si->si_syncCookie.sid, NULL );
		ch_free( si->si_syncCookie.sids );
		slap_reparse_sync_cookie( &si->si_syncCookie, op->o_tmpmemctx );
	}
	ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
	return changed;
}

static int
do_syncrep1(
	Operation *op,
	syncinfo_t *si )
{
	int	rc;
	int cmdline_cookie_found = 0;

	struct sync_cookie	*sc = NULL;
#ifdef HAVE_TLS
	void	*ssl;
#endif

	rc = slap_client_connect( &si->si_ld, &si->si_bindconf );
	if ( rc != LDAP_SUCCESS ) {
		goto done;
	}
	op->o_protocol = LDAP_VERSION3;

	/* Set SSF to strongest of TLS, SASL SSFs */
	op->o_sasl_ssf = 0;
	op->o_tls_ssf = 0;
	op->o_transport_ssf = 0;
#ifdef HAVE_TLS
	if ( ldap_get_option( si->si_ld, LDAP_OPT_X_TLS_SSL_CTX, &ssl )
		== LDAP_SUCCESS && ssl != NULL )
	{
		op->o_tls_ssf = ldap_pvt_tls_get_strength( ssl );
	}
#endif /* HAVE_TLS */
	{
		ber_len_t ssf; /* ITS#5403, 3864 LDAP_OPT_X_SASL_SSF probably ought
						  to use sasl_ssf_t but currently uses ber_len_t */
		if ( ldap_get_option( si->si_ld, LDAP_OPT_X_SASL_SSF, &ssf )
			== LDAP_SUCCESS )
			op->o_sasl_ssf = ssf;
	}
	op->o_ssf = ( op->o_sasl_ssf > op->o_tls_ssf )
		?  op->o_sasl_ssf : op->o_tls_ssf;

	ldap_set_option( si->si_ld, LDAP_OPT_TIMELIMIT, &si->si_tlimit );

	rc = LDAP_DEREF_NEVER;	/* actually could allow DEREF_FINDING */
	ldap_set_option( si->si_ld, LDAP_OPT_DEREF, &rc );

	ldap_set_option( si->si_ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF );

	si->si_syncCookie.rid = si->si_rid;

	/* whenever there are multiple data sources possible, advertise sid */
	si->si_syncCookie.sid = ( SLAP_MULTIPROVIDER( si->si_be ) || si->si_be != si->si_wbe ) ?
		slap_serverID : -1;

#ifdef LDAP_CONTROL_X_DIRSYNC
	if ( si->si_ctype == MSAD_DIRSYNC ) {
		if ( BER_BVISEMPTY( &si->si_dirSyncCookie )) {
			BerVarray cookies = NULL;
			void *ctx = op->o_tmpmemctx;

			op->o_req_ndn = si->si_contextdn;
			op->o_req_dn = op->o_req_ndn;

			/* try to read stored cookie */
			op->o_tmpmemctx = NULL;
			backend_attribute( op, NULL, &op->o_req_ndn,
				sy_ad_dirSyncCookie, &cookies, ACL_READ );
			op->o_tmpmemctx = ctx;
			if ( cookies )
				si->si_dirSyncCookie = cookies[0];
		}
	} else
#endif
	if ( si->si_syncdata == SYNCDATA_CHANGELOG ) {
		if ( !si->si_lastchange ) {
			BerVarray vals = NULL;

			op->o_req_ndn = si->si_contextdn;
			op->o_req_dn = op->o_req_ndn;
			/* try to read last change number */
			backend_attribute( op, NULL, &op->o_req_ndn,
				sy_ad_dseeLastChange, &vals, ACL_READ );
			if ( vals ) {
				si->si_lastchange = strtoul( vals[0].bv_val, NULL, 0 );
				si->si_prevchange = si->si_lastchange;
			}
		}
	} else
	{

	/* We've just started up, or the remote server hasn't sent us
	 * any meaningful state.
	 */
	if ( !si->si_syncCookie.ctxcsn ) {
		int i;

		LDAP_STAILQ_FOREACH( sc, &slap_sync_cookie, sc_next ) {
			if ( si->si_rid == sc->rid ) {
				cmdline_cookie_found = 1;
				break;
			}
		}

		if ( cmdline_cookie_found ) {
			/* cookie is supplied in the command line */

			LDAP_STAILQ_REMOVE( &slap_sync_cookie, sc, sync_cookie, sc_next );

			slap_sync_cookie_free( &si->si_syncCookie, 0 );
			si->si_syncCookie.octet_str = sc->octet_str;
			ch_free( sc );
			/* ctxcsn wasn't parsed yet, do it now */
			slap_parse_sync_cookie( &si->si_syncCookie, NULL );
		} else {
			ldap_pvt_thread_mutex_lock( &si->si_cookieState->cs_mutex );
			if ( !si->si_cookieState->cs_num ) {
				/* get contextCSN shadow replica from database */
				BerVarray csn = NULL;
				void *ctx = op->o_tmpmemctx;

				op->o_req_ndn = si->si_contextdn;
				op->o_req_dn = op->o_req_ndn;

				/* try to read stored contextCSN */
				op->o_tmpmemctx = NULL;
				backend_attribute( op, NULL, &op->o_req_ndn,
					slap_schema.si_ad_contextCSN, &csn, ACL_READ );
				op->o_tmpmemctx = ctx;
				if ( csn ) {
					si->si_cookieState->cs_vals = csn;
					for (i=0; !BER_BVISNULL( &csn[i] ); i++);
					si->si_cookieState->cs_num = i;
					si->si_cookieState->cs_sids = slap_parse_csn_sids( csn, i, NULL );
					slap_sort_csn_sids( csn, si->si_cookieState->cs_sids, i, NULL );
				}
			}
			if ( si->si_cookieState->cs_num ) {
				ber_bvarray_free( si->si_syncCookie.ctxcsn );
				if ( ber_bvarray_dup_x( &si->si_syncCookie.ctxcsn,
					si->si_cookieState->cs_vals, NULL )) {
					rc = LDAP_NO_MEMORY;
					ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
					goto done;
				}
				si->si_syncCookie.numcsns = si->si_cookieState->cs_num;
				si->si_syncCookie.sids = ch_malloc( si->si_cookieState->cs_num *
					sizeof(int) );
				for ( i=0; i<si->si_syncCookie.numcsns; i++ )
					si->si_syncCookie.sids[i] = si->si_cookieState->cs_sids[i];
			}
			ldap_pvt_thread_mutex_unlock( &si->si_cookieState->cs_mutex );
		}

		ch_free( si->si_syncCookie.octet_str.bv_val );
		slap_compose_sync_cookie( NULL, &si->si_syncCookie.octet_str,
			si->si_syncCookie.ctxcsn, si->si_syncCookie.rid,
			si->si_syncCookie.sid, NULL );
	} else {
		/* ITS#6367: recreate the cookie so it has our SID, not our peer's */
		ch_free( si->si_syncCookie.octet_str.bv_val );
		BER_BVZERO( &si->si_syncCookie.octet_str );
		/* Look for contextCSN from syncprov overlay. */
		check_syncprov( op, si );
		if ( BER_BVISNULL( &si->si_syncCookie.octet_str ))
			slap_compose_sync_cookie( NULL, &si->si_syncCookie.octet_str,
				si->si_syncCookie.ctxcsn, si->si_syncCookie.rid,
				si->si_syncCookie.sid, NULL );
	}

	}

	si->si_refreshDone = 0;
	Debug( LDAP_DEBUG_SYNC, "do_syncrep1: %s starting refresh (sending cookie=%s)\n",
		si->si_ridtxt, si->si_syncCookie.octet_str.bv_val );

	rc = ldap_sync_search( si, op->o_tmpmemctx );

	if( rc != LDAP_SUCCESS ) {
		Debug( LDAP_DEBUG_ANY, "do_syncrep1: %s "
			"ldap_search_ext: %s (%d)\n",
			si->si_ridtxt, ldap_err2string( rc ), rc );
	}

done:
	if ( rc ) {
		if ( si->si_ld ) {
			ldap_unbind_ext( si->si_ld, NULL, NULL );
			si->si_ld = NULL;
		}
	}

	return rc;
}

static int
compare_csns( struct sync_cookie *sc1, struct sync_cookie *sc2, int *which )
{
	int i, j, match = 0;
	const char *text;

	*which = 0;

	if ( sc1->numcsns < sc2->numcsns ) {
		*which = sc1->numcsns;
		return -1;
	}

	for (j=0; j<sc2->numcsns; j++) {
		for (i=0; i<sc1->numcsns; i++) {
			if ( sc1->sids[i] != sc2->sids[j] )
				continue;
			value_match( &match, slap_schema.si_ad_entryCSN,
				slap_schema.si_ad_entryCSN->ad_type->sat_ordering,
				SLAP_MR_VALUE_OF_ATTRIBUTE_SYNTAX,
				&sc1->ctxcsn[i], &sc2->ctxcsn[j], &text );
			if ( match < 0 ) {
				*which = j;
				return match;
			}
			break;
		}
		if ( i == sc1->numcsns ) {
			/* sc2 has a sid sc1 lacks */
			*which = j;
			return -1;
		}
	}
	return match;
}

#define SYNC_TIMEOUT	0
#define SYNC_SHUTDOWN	-100
#define SYNC_ERROR		-101
#define SYNC_REPOLL		-102
#define SYNC_PAUSED		-103

static int
do_syncrep2(
	Operation *op,
	syncinfo_t *si )
{
	BerElementBuffer berbuf;
	BerElement	*ber = (BerElement *)&berbuf;

	LDAPMessage	*msg = NULL;

	struct sync_cookie	syncCookie = { NULL };
	struct sync_cookie	syncCookie_req = { NULL };

	int		rc,
			err = LDAP_SUCCESS;

	Modifications	*modlist = NULL;

	int				m;

	struct timeval tout = { 0, 0 };

	int		refreshDeletes = 0;
	char empty[6] = "empty";

	if ( slapd_shutdown ) {
		rc = SYNC_SHUTDOWN;
		goto done;
	}

	ber_init2( ber, NULL, LBER_USE_DER );
	ber_set_option( ber, LBER_OPT_BER_MEMCTX, &op->o_tmpmemctx