VERSION.sh

@@ -10,7 +10,7 @@ vendor="389 Project"
 # PACKAGE_VERSION is constructed from these
 VERSION_MAJOR=1
 VERSION_MINOR=4
-VERSION_MAINT=0.19
+VERSION_MAINT=0.20
 # NOTE: VERSION_PREREL is automatically set for builds made out of a git tree
 VERSION_PREREL=
 VERSION_DATE=$(date -u +%Y%m%d)

dirsrvtests/tests/suites/ds_tools/replcheck_test.py

@@ -125,24 +125,48 @@ def replcheck_cmd_list(topo_tls_ldapi):
         inst.start()
 
     ds_replcheck_path = os.path.join(m1.ds_paths.bin_dir, 'ds-replcheck')
-    replcheck_cmd = [[ds_replcheck_path, '-b', DEFAULT_SUFFIX, '-D', DN_DM, '-w', PW_DM, '-l', '1',
-                      '-m', 'ldap://{}:{}'.format(m1.host, m1.port), '--conflict',
+
+    replcheck_cmd = [[ds_replcheck_path, 'online', '-b', DEFAULT_SUFFIX, '-D', DN_DM, '-w', PW_DM, '-l', '1',
+                      '-m', 'ldap://{}:{}'.format(m1.host, m1.port), '--conflicts',
                       '-r', 'ldap://{}:{}'.format(m2.host, m2.port)],
-                     [ds_replcheck_path, '-b', DEFAULT_SUFFIX, '-D', DN_DM, '-w', PW_DM, '-l', '1',
-                      '-m', 'ldaps://{}:{}'.format(m1.host, m1.sslport), '--conflict',
+                     [ds_replcheck_path, 'online', '-b', DEFAULT_SUFFIX, '-D', DN_DM, '-w', PW_DM, '-l', '1',
+                      '-m', 'ldaps://{}:{}'.format(m1.host, m1.sslport), '--conflicts',
                       '-r', 'ldaps://{}:{}'.format(m2.host, m2.sslport)],
-                     [ds_replcheck_path, '-b', DEFAULT_SUFFIX, '-D', DN_DM, '-w', PW_DM, '-l', '1',
+                     [ds_replcheck_path, 'online', '-b', DEFAULT_SUFFIX, '-D', DN_DM, '-w', PW_DM, '-l', '1',
                       '-m', 'ldap://{}:{}'.format(m1.host, m1.port), '-Z', m1.get_ssca_dir(),
-                      '-r', 'ldap://{}:{}'.format(m2.host, m2.port), '--conflict'],
-                     [ds_replcheck_path, '-b', DEFAULT_SUFFIX, '-D', DN_DM, '-w', PW_DM, '-l', '1',
+                      '-r', 'ldap://{}:{}'.format(m2.host, m2.port), '--conflicts'],
+                     [ds_replcheck_path, 'online', '-b', DEFAULT_SUFFIX, '-D', DN_DM, '-w', PW_DM, '-l', '1',
                       '-m', 'ldapi://%2fvar%2frun%2fslapd-{}.socket'.format(m1.serverid), '--conflict',
                       '-r', 'ldapi://%2fvar%2frun%2fslapd-{}.socket'.format(m2.serverid)],
-                     [ds_replcheck_path, '-b', DEFAULT_SUFFIX, '--conflict',
-                      '-M', '/tmp/export_{}.ldif'.format(m1.serverid),
-                      '-R', '/tmp/export_{}.ldif'.format(m2.serverid)]]
+                     [ds_replcheck_path, 'offline', '-b', DEFAULT_SUFFIX, '--conflicts', '--rid', '1',
+                      '-m', '/tmp/export_{}.ldif'.format(m1.serverid),
+                      '-r', '/tmp/export_{}.ldif'.format(m2.serverid)]]
     return replcheck_cmd
 
 
+def test_state(topo_tls_ldapi):
+    """Check "state" report
+
+    :id: 1cc6b28b-8a42-45fb-ab50-9552db0ac178
+    :setup: Two master replication
+    :steps:
+        1. Get the replication state value
+        2. The state value is as expected
+    :expectedresults:
+        1. It should be successful
+        2. It should be successful
+    """
+    m1 = topo_tls_ldapi.ms["master1"]
+    m2 = topo_tls_ldapi.ms["master2"]
+    ds_replcheck_path = os.path.join(m1.ds_paths.bin_dir, 'ds-replcheck')
+
+    tool_cmd = [ds_replcheck_path, 'state', '-b', DEFAULT_SUFFIX, '-D', DN_DM, '-w', PW_DM,
+                '-m', 'ldaps://{}:{}'.format(m1.host, m1.sslport),
+                '-r', 'ldaps://{}:{}'.format(m2.host, m2.sslport)]
+    result = subprocess.check_output(tool_cmd, encoding='utf-8')
+    assert (result.rstrip() == "Replication State: Master and Replica are in perfect synchronization")
+
+
 def test_check_ruv(topo_tls_ldapi):
     """Check that the report has RUV
 

dirsrvtests/tests/suites/password/pwdModify_test.py

+# Copyright (C) 2018 Red Hat, Inc.
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ---
+#
+import pytest
+import subprocess
+import re
+from ldap.controls import LDAPControl
+from lib389._constants import *
+from lib389.tasks import *
+from lib389.utils import *
+from lib389.topologies import topology_st as topo
+from lib389.idm.user import UserAccounts, TEST_USER_PROPERTIES
+from lib389.idm.organizationalunit import OrganizationalUnits
+from lib389.idm.nscontainer import nsContainers
+from lib389.pwpolicy import PwPolicyManager
+
+DEBUGGING = os.getenv("DEBUGGING", default=False)
+if DEBUGGING:
+    logging.getLogger(__name__).setLevel(logging.DEBUG)
+else:
+    logging.getLogger(__name__).setLevel(logging.INFO)
+log = logging.getLogger(__name__)
+
+
+OLD_PASSWD = 'password'
+NEW_PASSWD = 'newpassword'
+SHORT_PASSWD = 'wd'
+TESTPEOPLE_OU = "TestPeople_bug834047"
+
+
+@pytest.fixture(scope="function")
+def pwd_policy_setup(topo, request):
+    """
+    Setup to set passwordStorageScheme as CLEAR
+    passwordHistory to on
+    passwordStorageScheme to SSHA
+    passwordHistory off
+    """
+    log.info("Change the pwd storage type to clear and change the password once to refresh it(for the rest of tests")
+    topo.standalone.config.set('passwordStorageScheme', 'CLEAR')
+    assert topo.standalone.passwd_s(user_2.dn, OLD_PASSWD, NEW_PASSWD)
+    topo.standalone.config.set('passwordHistory', 'on')
+
+    def fin():
+        topo.standalone.simple_bind_s(DN_DM, PASSWORD)
+        topo.standalone.config.set('passwordStorageScheme', 'SSHA')
+        topo.standalone.config.set('passwordHistory', 'off')
+    request.addfinalizer(fin)
+
+
+def test_pwd_modify_with_different_operation(topo):
+    """Performing various password modify operation,
+    make sure that password is actually modified
+
+    :id: e36d68a8-0960-48e4-932c-6c2f64abaebc
+    :setup: Standalone instance and TLS enabled
+    :steps:
+        1. Attempt for Password change for an entry that does not exists
+        2. Attempt for Password change for an entry that exists
+        3. Attempt for Password change to old for an entry that exists
+        4. Attempt for Password Change with Binddn as testuser but with wrong old password
+        5. Attempt for Password Change with Binddn as testuser
+        6. Attempt for Password Change without giving newpassword
+        7. Checking password change Operation using a Non-Secure connection
+        8. Testuser attempts to change password for testuser2(userPassword attribute is Set)
+        9. Directory Manager attempts to change password for testuser2(userPassword attribute is Set)
+        10. Create a password syntax policy. Attempt to change to password that violates that policy
+        11. userPassword mod with control results in ber decode error
+
+    :expectedresults:
+        1. Operation should be successful
+        2. Operation should be successful
+        3. Operation should be successful
+        4. Operation should not be successful
+        5. Operation should be successful
+        6. Operation should be successful
+        7. Operation should not be successful
+        8. Operation should not be successful
+        9. Operation should be successful
+        10. Operation should violates the policy
+        11. Operation should be successful
+     """
+    topo.standalone.enable_tls()
+    os.environ["LDAPTLS_CACERTDIR"] = topo.standalone.get_ssca_dir()
+    users = UserAccounts(topo.standalone, DEFAULT_SUFFIX)
+    TEST_USER_PROPERTIES['userpassword'] = OLD_PASSWD
+    global user
+    user = users.create(properties=TEST_USER_PROPERTIES)
+    with pytest.raises(ldap.NO_SUCH_OBJECT):
+        log.info("Attempt for Password change for an entry that does not exists")
+        assert topo.standalone.passwd_s('uid=testuser1,ou=People,dc=example,dc=com', OLD_PASSWD, NEW_PASSWD)
+    log.info("Attempt for Password change for an entry that exists")
+    assert topo.standalone.passwd_s(user.dn, OLD_PASSWD, NEW_PASSWD)
+    log.info("Attempt for Password change to old for an entry that exists")
+    assert topo.standalone.passwd_s(user.dn, NEW_PASSWD, OLD_PASSWD)
+    log.info("Attempt for Password Change with Binddn as testuser but with wrong old password")
+    topo.standalone.simple_bind_s(user.dn, OLD_PASSWD)
+    with pytest.raises(ldap.INVALID_CREDENTIALS):
+        topo.standalone.passwd_s(user.dn, NEW_PASSWD, NEW_PASSWD)
+    log.info("Attempt for Password Change with Binddn as testuser")
+    assert topo.standalone.passwd_s(user.dn, OLD_PASSWD, NEW_PASSWD)
+    log.info("Attempt for Password Change without giving newpassword")
+    assert topo.standalone.passwd_s(user.dn, None, OLD_PASSWD)
+    assert user.get_attr_val_utf8('uid') == 'testuser'
+    log.info("Change password to NEW_PASSWD i.e newpassword")
+    assert topo.standalone.passwd_s(user.dn, None, NEW_PASSWD)
+    assert topo.standalone.passwd_s(user.dn, NEW_PASSWD, None)
+    log.info("Check binding with old/new password")
+    password = [OLD_PASSWD, NEW_PASSWD]
+    for pass_val in password:
+        with pytest.raises(ldap.INVALID_CREDENTIALS):
+            topo.standalone.simple_bind_s(user.dn, pass_val)
+    log.info("Change password back to OLD_PASSWD i.e password")
+    topo.standalone.simple_bind_s(DN_DM, PASSWORD)
+    assert topo.standalone.passwd_s(user.dn, None, NEW_PASSWD)
+    log.info("Checking password change Operation using a Non-Secure connection")
+    conn = ldap.initialize("ldap://%s:%s" % (HOST_STANDALONE, PORT_STANDALONE))
+    with pytest.raises(ldap.CONFIDENTIALITY_REQUIRED):
+        conn.passwd_s(user.dn, NEW_PASSWD, OLD_PASSWD)
+    log.info("Testuser attempts to change password for testuser2(userPassword attribute is Set)")
+    global user_2
+    users = UserAccounts(topo.standalone, DEFAULT_SUFFIX)
+    user_2 = users.create(properties={
+        'uid': 'testuser2',
+        'cn': 'testuser2',
+        'sn': 'testuser2',
+        'uidNumber': '3000',
+        'gidNumber': '4000',
+        'homeDirectory': '/home/testuser2',
+        'userPassword': OLD_PASSWD
+    })
+    topo.standalone.simple_bind_s(user.dn, NEW_PASSWD)
+    with pytest.raises(ldap.INSUFFICIENT_ACCESS):
+        assert topo.standalone.passwd_s(user_2.dn, OLD_PASSWD, NEW_PASSWD)
+    log.info("Directory Manager attempts to change password for testuser2(userPassword attribute is Set)")
+    topo.standalone.simple_bind_s(DN_DM, PASSWORD)
+    assert topo.standalone.passwd_s(user_2.dn, OLD_PASSWD, NEW_PASSWD)
+    log.info("Changing userPassword attribute to Undefined for testuser2")
+    topo.standalone.modify_s(user_2.dn, [(ldap.MOD_REPLACE, 'userPassword', None)])
+    log.info("Testuser attempts to change password for testuser2(userPassword attribute is Undefined)")
+    with pytest.raises(ldap.INSUFFICIENT_ACCESS):
+        topo.standalone.simple_bind_s(user.dn, NEW_PASSWD)
+        assert topo.standalone.passwd_s(user_2.dn, None, NEW_PASSWD)
+    log.info("Directory Manager attempts to change password for testuser2(userPassword attribute is Undefined)")
+    topo.standalone.simple_bind_s(DN_DM, PASSWORD)
+    assert topo.standalone.passwd_s(user_2.dn, None, OLD_PASSWD)
+    log.info("Create a password syntax policy. Attempt to change to password that violates that policy")
+    topo.standalone.config.set('PasswordCheckSyntax', 'on')
+    with pytest.raises(ldap.CONSTRAINT_VIOLATION):
+        assert topo.standalone.passwd_s(user_2.dn, OLD_PASSWD, SHORT_PASSWD)
+    log.info("Reset password syntax policy")
+    topo.standalone.config.set('PasswordCheckSyntax', 'off')
+    log.info("userPassword mod with control results in ber decode error")
+    topo.standalone.simple_bind_s(DN_DM, PASSWORD)
+    assert topo.standalone.modify_ext_s(user.dn, [(ldap.MOD_REPLACE, 'userpassword', b'abcdefg')],
+                                        serverctrls=[LDAPControl('2.16.840.1.113730.3.4.2', 1, None)])
+    log.info("Reseting the testuser's password")
+    topo.standalone.passwd_s(user.dn, 'abcdefg', NEW_PASSWD)
+
+
+def test_pwd_modify_with_password_policy(topo, pwd_policy_setup):
+    """Performing various password modify operation,
+    with passwordStorageScheme as CLEAR
+    passwordHistory to on
+
+    :id: 200bf0fd-20ab-4dde-849e-54067e98b917
+    :setup: Standalone instance (TLS enabled) with pwd_policy_setup
+    :steps:
+        1. Change the password and check that a new entry has been added to the history
+        2. Try changing password to one stored in history
+        3. Change the password several times in a row, and try binding after each change
+        4. Try to bind using short password
+
+    :expectedresults:
+        1. Operation should be successful
+        2. Operation should be unsuccessful
+        3. Operation should be successful
+        4. Operation should be unsuccessful
+     """
+    log.info("Change the password and check that a new entry has been added to the history")
+    topo.standalone.passwd_s(user_2.dn, NEW_PASSWD, OLD_PASSWD)
+    regex = re.search('Z(.+)', user_2.get_attr_val_utf8('passwordhistory'))
+    assert NEW_PASSWD == regex.group(1)
+    log.info("Try changing password to one stored in history.  Should fail")
+    with pytest.raises(ldap.CONSTRAINT_VIOLATION):
+        assert topo.standalone.passwd_s(user_2.dn, OLD_PASSWD, NEW_PASSWD)
+    log.info("Change the password several times in a row, and try binding after each change")
+    topo.standalone.passwd_s(user.dn, NEW_PASSWD, OLD_PASSWD)
+    assert topo.standalone.simple_bind_s(user.dn, OLD_PASSWD)
+    topo.standalone.passwd_s(user.dn, OLD_PASSWD, SHORT_PASSWD)
+    assert topo.standalone.simple_bind_s(user.dn, SHORT_PASSWD)
+    with pytest.raises(ldap.CONSTRAINT_VIOLATION):
+        topo.standalone.passwd_s(user.dn, SHORT_PASSWD, OLD_PASSWD)
+
+
+def test_pwd_modify_with_subsuffix(topo):
+    """Performing various password modify operation.
+
+     :id: 2255b4e6-3546-4ec5-84a5-cd8b3d894ac5
+     :setup: Standalone instance (TLS enabled)
+     :steps:
+         1. Add a new SubSuffix & password policy
+         2. Add two New users under the SubEntry
+         3. Change password of uid=test_user0,ou=TestPeople_bug834047,dc=example,dc=com to newpassword
+         4. Try to delete password- case when password is specified
+         5. Try to delete password- case when password is not specified
+
+     :expectedresults:
+         1. Operation should be successful
+         2. Operation should be successful
+         3. Operation should be successful
+         4. Operation should be successful
+         5. Operation should be successful
+      """
+
+    log.info("Add a new SubSuffix")
+    ous = OrganizationalUnits(topo.standalone, DEFAULT_SUFFIX)
+    ou_temp = ous.create(properties={'ou': TESTPEOPLE_OU})
+
+    log.info("Add the container & create password policies")
+    policy = PwPolicyManager(topo.standalone)
+    policy.create_subtree_policy(ou_temp.dn, properties={
+        'passwordHistory': 'on',
+        'passwordInHistory': '6',
+        'passwordChange': 'on',
+        'passwordStorageScheme': 'CLEAR'})
+    
+    log.info("Add two New users under the SubEntry")
+    user = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=TestPeople_bug834047')
+    test_user0 = user.create(properties={
+        'uid': 'test_user0',
+        'cn': 'test0',
+        'sn': 'test0',
+        'uidNumber': '3002',
+        'gidNumber': '4002',
+        'homeDirectory': '/home/test_user0',
+        'userPassword': OLD_PASSWD
+        })
+    test_user1 = user.create(properties={
+        'uid': 'test_user1',
+        'cn': 'test1',
+        'sn': 'test1',
+        'uidNumber': '3003',
+        'gidNumber': '4003',
+        'homeDirectory': '/home/test_user3',
+        'userPassword': OLD_PASSWD
+        })
+    log.info(f"Changing password of {test_user0.dn} to newpassword")
+    topo.standalone.simple_bind_s(test_user0.dn, OLD_PASSWD)
+    topo.standalone.modify_s(test_user0.dn, [(ldap.MOD_REPLACE, 'userPassword', ensure_bytes(NEW_PASSWD))])
+    topo.standalone.simple_bind_s(test_user0.dn, NEW_PASSWD)
+    log.info("Try to delete password- case when password is specified")
+    topo.standalone.modify_s(test_user0.dn, [(ldap.MOD_DELETE, 'userPassword', ensure_bytes(NEW_PASSWD))])
+    topo.standalone.simple_bind_s(test_user1.dn, OLD_PASSWD)
+    log.info("Try to delete password- case when password is not specified")
+    topo.standalone.modify_s(test_user1.dn, [(ldap.MOD_DELETE, 'userPassword', None)])
+
+
+if __name__ == '__main__':
+    # Run isolated
+    # -s for DEBUG mode
+    CURRENT_FILE = os.path.realpath(__file__)
+    pytest.main(["-s", CURRENT_FILE])

dirsrvtests/tests/suites/plugins/cos_test.py

+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2016 Red Hat, Inc.
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ---
+#
+'''
+Created on Nov 27th, 2018
+
+@author: tbordaz
+'''
+import logging
+import subprocess
+import pytest
+from lib389 import Entry
+from lib389.utils import *
+from lib389.plugins import *
+from lib389._constants import *
+from lib389.topologies import topology_st as topo
+
+def add_user(server, uid, testbase, locality=None, tel=None, title=None):
+    dn = 'uid=%s,%s' % (uid, testbase)
+    log.fatal('Adding user (%s): ' % dn)
+    server.add_s(Entry((dn, {'objectclass': ['top', 'person', 'organizationalPerson', 'inetOrgPerson'],
+                             'cn': 'user_%s' % uid,
+                             'sn': 'user_%s' % uid,
+                             'uid': uid,
+                             'l': locality,
+                             'title': title,
+                             'telephoneNumber': tel,
+                             'description': 'description real'})))
+
+@pytest.mark.ds50053
+def test_cos_operational_default(topo):
+    """operational-default cosAttribute should not overwrite an existing value
+
+    :id: 12fadff9-e14a-4c64-a3ee-51152cb8fcfb
+    :setup: Standalone Instance
+    :steps:
+        1. Create a user entry with attribute 'l' and 'telephonenumber' (real attribute with real value)
+        2. Create cos that defines 'l' as operational-default (virt. attr. with value != real value)
+        3. Create cos that defines 'telephone' as default (virt. attr. with value != real value)
+        4. Check that telephone is retrieved with real value
+        5. Check that 'l' is retrieved with real value
+    :expectedresults:
+        1. should succeed
+        2. should succeed
+        3. should succeed
+    """
+
+    REAL = 'real'
+    VIRTUAL = 'virtual'
+    TEL_REAL = '1234 is %s' % REAL
+    TEL_VIRT = '4321 is %s' % VIRTUAL
+
+    LOC_REAL = 'here is %s' % REAL
+    LOC_VIRT = 'there is %s' % VIRTUAL
+
+    TITLE_REAL = 'title is %s' % REAL
+
+    inst = topo[0]
+
+    PEOPLE = 'ou=people,%s' % SUFFIX
+    add_user(inst, 'user_0', PEOPLE, locality=LOC_REAL, tel=TEL_REAL, title=TITLE_REAL)
+
+    # locality cos operational-default
+    LOC_COS_TEMPLATE = "cn=locality_template,%s" % PEOPLE
+    LOC_COS_DEFINITION = "cn=locality_definition,%s" % PEOPLE
+    inst.add_s(Entry((LOC_COS_TEMPLATE, {
+            'objectclass': ['top', 'extensibleObject', 'costemplate',
+                            'ldapsubentry'],
+            'l': LOC_VIRT})))
+
+    inst.add_s(Entry((LOC_COS_DEFINITION, {
+            'objectclass': ['top', 'LdapSubEntry', 'cosSuperDefinition',
+                            'cosPointerDefinition'],
+            'cosTemplateDn': LOC_COS_TEMPLATE,
+            'cosAttribute': 'l operational-default'})))
+
+    # telephone cos default
+    TEL_COS_TEMPLATE = "cn=telephone_template,%s" % PEOPLE
+    TEL_COS_DEFINITION = "cn=telephone_definition,%s" % PEOPLE
+    inst.add_s(Entry((TEL_COS_TEMPLATE, {
+            'objectclass': ['top', 'extensibleObject', 'costemplate',
+                            'ldapsubentry'],
+            'telephonenumber': TEL_VIRT})))
+
+    inst.add_s(Entry((TEL_COS_DEFINITION, {
+            'objectclass': ['top', 'LdapSubEntry', 'cosSuperDefinition',
+                            'cosPointerDefinition'],
+            'cosTemplateDn': TEL_COS_TEMPLATE,
+            'cosAttribute': 'telephonenumber default'})))
+
+    # seeAlso cos operational
+    SEEALSO_VIRT = "dc=%s,dc=example,dc=com" % VIRTUAL
+    SEEALSO_COS_TEMPLATE = "cn=seealso_template,%s" % PEOPLE
+    SEEALSO_COS_DEFINITION = "cn=seealso_definition,%s" % PEOPLE
+    inst.add_s(Entry((SEEALSO_COS_TEMPLATE, {
+            'objectclass': ['top', 'extensibleObject', 'costemplate',
+                            'ldapsubentry'],
+            'seealso': SEEALSO_VIRT})))
+
+    inst.add_s(Entry((SEEALSO_COS_DEFINITION, {
+            'objectclass': ['top', 'LdapSubEntry', 'cosSuperDefinition',
+                            'cosPointerDefinition'],
+            'cosTemplateDn': SEEALSO_COS_TEMPLATE,
+            'cosAttribute': 'seealso operational'})))
+
+    # description cos override
+    DESC_VIRT = "desc is %s" % VIRTUAL
+    DESC_COS_TEMPLATE = "cn=desc_template,%s" % PEOPLE
+    DESC_COS_DEFINITION = "cn=desc_definition,%s" % PEOPLE
+    inst.add_s(Entry((DESC_COS_TEMPLATE, {
+            'objectclass': ['top', 'extensibleObject', 'costemplate',
+                            'ldapsubentry'],
+            'description': DESC_VIRT})))
+
+    inst.add_s(Entry((DESC_COS_DEFINITION, {
+            'objectclass': ['top', 'LdapSubEntry', 'cosSuperDefinition',
+                            'cosPointerDefinition'],
+            'cosTemplateDn': DESC_COS_TEMPLATE,
+            'cosAttribute': 'description override'})))
+
+    # title cos override
+    TITLE_VIRT = []
+    for i in range(2):
+        TITLE_VIRT.append("title is %s %d" % (VIRTUAL, i))
+    TITLE_COS_TEMPLATE = "cn=title_template,%s" % PEOPLE
+    TITLE_COS_DEFINITION = "cn=title_definition,%s" % PEOPLE
+    inst.add_s(Entry((TITLE_COS_TEMPLATE, {
+            'objectclass': ['top', 'extensibleObject', 'costemplate',
+                            'ldapsubentry'],
+            'title': TITLE_VIRT})))
+
+    inst.add_s(Entry((TITLE_COS_DEFINITION, {
+            'objectclass': ['top', 'LdapSubEntry', 'cosSuperDefinition',
+                            'cosPointerDefinition'],
+            'cosTemplateDn': TITLE_COS_TEMPLATE,
+            'cosAttribute': 'title merge-schemes'})))
+
+    # note that the search requests both attributes (it is required for operational*)
+    ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0", ["telephonenumber", "l"])
+    assert len(ents) == 1
+    ent = ents[0]
+
+    # Check telephonenumber (specifier default) with real value => real
+    assert ent.hasAttr('telephonenumber')
+    value = ent.getValue('telephonenumber')
+    log.info('Returned telephonenumber (exp. real): %s' % value)
+    log.info('Returned telephonenumber: %d' % value.find(REAL.encode()))
+    assert value.find(REAL.encode()) != -1
+
+    # Check 'locality' (specifier operational-default) with real value => real
+    assert ent.hasAttr('l')
+    value = ent.getValue('l')
+    log.info('Returned l (exp. real): %s ' % value)
+    log.info('Returned l: %d' % value.find(REAL.encode()))
+    assert value.find(REAL.encode()) != -1
+    
+    # Check 'seealso' (specifier operational) without real value => virtual
+    assert not ent.hasAttr('seealso')
+    ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0", ["seealso"])
+    assert len(ents) == 1
+    ent = ents[0]
+    value = ent.getValue('seealso')
+    log.info('Returned seealso (exp. virtual): %s' % value)
+    log.info('Returned seealso: %d' % value.find(VIRTUAL.encode()))
+    assert value.find(VIRTUAL.encode()) != -1
+    
+    # Check 'description' (specifier override) with real value => virtual
+    assert not ent.hasAttr('description')
+    ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0")
+    assert len(ents) == 1
+    ent = ents[0]
+    value = ent.getValue('description')
+    log.info('Returned description (exp. virtual): %s' % value)
+    log.info('Returned description: %d' % value.find(VIRTUAL.encode()))
+    assert value.find(VIRTUAL.encode()) != -1
+
+    # Check 'title' (specifier merge-schemes) with real value => real value returned
+    ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0")
+    assert len(ents) == 1
+    ent = ents[0]
+    found_real = False
+    found_virtual = False
+    for value in ent.getValues('title'):
+        log.info('Returned title (exp. real): %s' % value)
+        if value.find(VIRTUAL.encode()) != -1:
+            found_virtual = True
+        if value.find(REAL.encode()) != -1:
+            found_real = True
+    assert not found_virtual
+    assert found_real
+
+    # Check 'title ((specifier merge-schemes) without real value => real value returned
+    ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0")
+    assert len(ents) == 1
+    inst.modify_s(ents[0].dn,[(ldap.MOD_DELETE, 'title', None)])
+
+    inst.restart()
+    ents = inst.search_s(SUFFIX, ldap.SCOPE_SUBTREE, "uid=user_0")
+    assert len(ents) == 1
+    ent = ents[0]
+    found_real = False
+    found_virtual = False
+    count = 0
+    for value in ent.getValues('title'):
+        log.info('Returned title(exp. virt): %s' % value)
+        count = count + 1
+        if value.find(VIRTUAL.encode()) != -1:
+            found_virtual = True
+        if value.find(REAL.encode()) != -1:
+            found_real = True
+    assert not found_real
+    assert found_virtual
+    assert count == 2

docker/389ds_poc/Dockerfile

@@ -33,7 +33,7 @@ RUN dnf install -y 389-ds-base/dist/rpms/*389*.rpm && \
 
 # Create the example setup inf. It's valid for containers!
 # Build the instance from the new installer tools.
-RUN /usr/sbin/dscreate create-template > /root/ds-setup.inf && /usr/sbin/dscreate -v fromfile /root/ds-setup.inf --containerised
+RUN /usr/sbin/dscreate create-template > /root/ds-setup.inf && /usr/sbin/dscreate -v from-file /root/ds-setup.inf --containerised
 
 # Finally add the volumes, they will inherit the contents of these directories.
 VOLUME /etc/dirsrv

include/ldaputil/certmap.h

@@ -16,6 +16,7 @@
 /* What was extcmap.h begins ... */
 
 #include <ldap.h>
+#include <nss3/cert.h>
 
 #ifndef NSAPI_PUBLIC
 #define NSAPI_PUBLIC
@@ -156,7 +157,7 @@ typedef int (*CertVerifyFn_t)(void *cert, LDAP *ld, void *certmap_info, LDAPMess
  *  otherwise return LDAPU_CERT_MAP_INITFN_FAILED.  The server startup will be
  *  aborted if the return value is not LDAPU_SUCCESS.
  */
-typedef int (*CertMapInitFn_t)(void *certmap_info, const char *issuerName, const char *issuerDN, const char *libname);
+typedef int (*CertMapInitFn_t)(void *certmap_info, const char *issuerName, const CERTName *issuerDN, const char *libname);
 
 /*
  * Refer to the description of the function ldapu_get_cert_ava_val
@@ -209,27 +210,30 @@ extern "C" {
 
 NSAPI_PUBLIC int ldapu_cert_to_ldap_entry(void *cert, LDAP *ld, const char *basedn, LDAPMessage **res);
 
-NSAPI_PUBLIC int ldapu_set_cert_mapfn(const char *issuerDN,
+NSAPI_PUBLIC int ldapu_set_cert_mapfn(const CERTName *issuerDN,
                                       CertMapFn_t mapfn);
 
 
-NSAPI_PUBLIC CertMapFn_t ldapu_get_cert_mapfn(const char *issuerDN);
+NSAPI_PUBLIC CertMapFn_t ldapu_get_cert_mapfn(const CERTName *issuerDN);
 
-NSAPI_PUBLIC int ldapu_set_cert_searchfn(const char *issuerDN,
+NSAPI_PUBLIC int ldapu_set_cert_searchfn(const CERTName *issuerDN,
                                          CertSearchFn_t searchfn);
 
 
-NSAPI_PUBLIC CertSearchFn_t ldapu_get_cert_searchfn(const char *issuerDN);
+NSAPI_PUBLIC CertSearchFn_t ldapu_get_cert_searchfn(const CERTName *issuerDN);
 
-NSAPI_PUBLIC int ldapu_set_cert_verifyfn(const char *issuerDN,
+NSAPI_PUBLIC int ldapu_set_cert_verifyfn(const CERTName *issuerDN,
                                          CertVerifyFn_t verifyFn);
 
-NSAPI_PUBLIC CertVerifyFn_t ldapu_get_cert_verifyfn(const char *issuerDN);
+NSAPI_PUBLIC CertVerifyFn_t ldapu_get_cert_verifyfn(const CERTName *issuerDN);
 
 
 NSAPI_PUBLIC int ldapu_get_cert_subject_dn(void *cert, char **subjectDN);
 
 
+NSAPI_PUBLIC CERTName *ldapu_get_cert_issuer_dn_as_CERTName(CERTCertificate *cert);
+
+
 NSAPI_PUBLIC int ldapu_get_cert_issuer_dn(void *cert, char **issuerDN);
 
 
@@ -242,7 +246,7 @@ NSAPI_PUBLIC int ldapu_free_cert_ava_val(char **val);
 NSAPI_PUBLIC int ldapu_get_cert_der(void *cert, unsigned char **derCert, unsigned int *len);
 
 
-NSAPI_PUBLIC int ldapu_issuer_certinfo(const char *issuerDN,
+NSAPI_PUBLIC int ldapu_issuer_certinfo(const CERTName *issuerDN,
                                        void **certmap_info);
 
 

include/ldaputil/ldaputil.h

@@ -48,7 +48,7 @@ enum
 typedef struct
 {
     char *issuerName;            /* issuer (symbolic/short) name */
-    char *issuerDN;              /* cert issuer's DN */
+    CERTName *issuerDN;          /* cert issuer's DN */
     LDAPUPropValList_t *propval; /* pointer to the prop-val pairs list */
     CertMapFn_t mapfn;           /* cert to ldapdn & filter mapping func */
     CertVerifyFn_t verifyfn;     /* verify cert function */

ldap/servers/plugins/automember/automember.c

@@ -74,7 +74,6 @@ static void automember_free_regex_rule(struct automemberRegexRule *rule);
 static int automember_parse_grouping_attr(char *value, char **grouping_attr, char **grouping_value);
 static int automember_update_membership(struct configEntry *config, Slapi_Entry *e, PRFileDesc *ldif_fd);
 static int automember_add_member_value(Slapi_Entry *member_e, const char *group_dn, char *grouping_attr, char *grouping_value, PRFileDesc *ldif_fd);
-const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val);
 
 /*
  * task functions
@@ -1927,25 +1926,6 @@ typedef struct _task_data
     int scope;
 } task_data;
 
-/*
- * extract a single value from the entry (as a string) -- if it's not in the
- * entry, the default will be returned (which can be NULL).
- * you do not need to free anything returned by this.
- */
-const char *
-fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val)
-{
-    Slapi_Value *val = NULL;
-    Slapi_Attr *attr;
-
-    if (slapi_entry_attr_find(e, attrname, &attr) != 0) {
-        return default_val;
-    }
-    slapi_attr_first_value(attr, &val);
-
-    return slapi_value_get_string(val);
-}
-
 static void
 automember_task_destructor(Slapi_Task *task)
 {
@@ -2038,17 +2018,17 @@ automember_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter __attr
     /*
      *  Grab the task params
      */
-    if ((base_dn = fetch_attr(e, "basedn", 0)) == NULL) {
+    if ((base_dn = slapi_fetch_attr(e, "basedn", 0)) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((filter = fetch_attr(e, "filter", 0)) == NULL) {
+    if ((filter = slapi_fetch_attr(e, "filter", 0)) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    scope = fetch_attr(e, "scope", "sub");
+    scope = slapi_fetch_attr(e, "scope", "sub");
     /*
      *  setup our task data
      */
@@ -2265,22 +2245,22 @@ automember_task_add_export_updates(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry
 
     *returncode = LDAP_SUCCESS;
 
-    if ((ldif = fetch_attr(e, "ldif", 0)) == NULL) {
+    if ((ldif = slapi_fetch_attr(e, "ldif", 0)) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((base_dn = fetch_attr(e, "basedn", 0)) == NULL) {
+    if ((base_dn = slapi_fetch_attr(e, "basedn", 0)) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((filter = fetch_attr(e, "filter", 0)) == NULL) {
+    if ((filter = slapi_fetch_attr(e, "filter", 0)) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    scope = fetch_attr(e, "scope", "sub");
+    scope = slapi_fetch_attr(e, "scope", "sub");
 
     slapi_pblock_get(pb, SLAPI_REQUESTOR_DN, &bind_dn);
 
@@ -2473,12 +2453,12 @@ automember_task_add_map_entries(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *e
     /*
      *  Get the params
      */
-    if ((ldif_in = fetch_attr(e, "ldif_in", 0)) == NULL) {
+    if ((ldif_in = slapi_fetch_attr(e, "ldif_in", 0)) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((ldif_out = fetch_attr(e, "ldif_out", 0)) == NULL) {
+    if ((ldif_out = slapi_fetch_attr(e, "ldif_out", 0)) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;

ldap/servers/plugins/chainingdb/cb_instance.c

@@ -1840,7 +1840,7 @@ cb_instance_add_config_check_callback(Slapi_PBlock *pb __attribute__((unused)),
     if ((rc = cb_build_backend_instance_config(inst, e, 0)) != LDAP_SUCCESS) {
         slapi_log_err(SLAPI_LOG_ERR, CB_PLUGIN_SUBSYSTEM,
                       "cb_instance_add_config_check_callback - Can't instantiate chaining backend instance %s.\n", inst->inst_name);
-        *returncode = rc;
+        *returncode = LDAP_UNWILLING_TO_PERFORM;
         cb_instance_free(inst);
         return SLAPI_DSE_CALLBACK_ERROR;
     }

ldap/servers/plugins/cos/cos_cache.c

@@ -2279,7 +2279,7 @@ cos_cache_query_attr(cos_cache *ptheCache, vattr_context *context, Slapi_Entry *
         /* now for the tests */
 
         /* would we be allowed to supply this attribute if we had one? */
-        if (entry_has_value && !pAttr->attr_override && !pAttr->attr_operational && !pAttr->attr_operational_default) {
+        if (entry_has_value && !pAttr->attr_override && !pAttr->attr_operational) {
             /* answer: no, move on to the next attribute */
             attr_index++;
             continue;

ldap/servers/plugins/linkedattrs/fixup_task.c

@@ -22,7 +22,6 @@ static void linked_attrs_fixup_task_thread(void *arg);
 static void linked_attrs_fixup_links(struct configEntry *config);
 static int linked_attrs_remove_backlinks_callback(Slapi_Entry *e, void *callback_data);
 static int linked_attrs_add_backlinks_callback(Slapi_Entry *e, void *callback_data);
-static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val);
 
 /*
  * Function Implementations
@@ -52,7 +51,7 @@ linked_attrs_fixup_task_add(Slapi_PBlock *pb,
     }
 
     /* get arg(s) and setup our task data */
-    linkdn = fetch_attr(e, "linkdn", 0);
+    linkdn = slapi_fetch_attr(e, "linkdn", 0);
     if (linkdn) {
         mytaskdata->linkdn = slapi_dn_normalize(slapi_ch_strdup(linkdn));
     }
@@ -459,22 +458,3 @@ done:
 
     return rc;
 }
-
-/* extract a single value from the entry (as a string) -- if it's not in the
- * entry, the default will be returned (which can be NULL).
- * you do not need to free anything returned by this.
- */
-static const char *
-fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val)
-{
-    Slapi_Attr *attr;
-    Slapi_Value *val = NULL;
-
-    if (slapi_entry_attr_find(e, attrname, &attr) != 0) {
-        return default_val;
-    }
-
-    slapi_attr_first_value(attr, &val);
-
-    return slapi_value_get_string(val);
-}

ldap/servers/plugins/memberof/memberof.c

@@ -142,7 +142,6 @@ static int memberof_replace_dn_from_groups(Slapi_PBlock *pb, MemberOfConfig *con
 static int memberof_modop_one_replace_r(Slapi_PBlock *pb, MemberOfConfig *config, int mod_op, Slapi_DN *group_sdn, Slapi_DN *op_this_sdn, Slapi_DN *replace_with_sdn, Slapi_DN *op_to_sdn, memberofstringll *stack);
 static int memberof_task_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter, int *returncode, char *returntext, void *arg);
 static void memberof_task_destructor(Slapi_Task *task);
-static const char *fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val);
 static void memberof_fixup_task_thread(void *arg);
 static int memberof_fix_memberof(MemberOfConfig *config, Slapi_Task *task, task_data *td);
 static int memberof_fix_memberof_callback(Slapi_Entry *e, void *callback_data);
@@ -2871,22 +2870,6 @@ done:
                   "memberof_fixup_task_thread - refcount decremented.\n");
 }
 
-/* extract a single value from the entry (as a string) -- if it's not in the
- * entry, the default will be returned (which can be NULL).
- * you do not need to free anything returned by this.
- */
-const char *
-fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val)
-{
-    Slapi_Attr *attr;
-    Slapi_Value *val = NULL;
-
-    if (slapi_entry_attr_find(e, attrname, &attr) != 0)
-        return default_val;
-    slapi_attr_first_value(attr, &val);
-    return slapi_value_get_string(val);
-}
-
 int
 memberof_task_add(Slapi_PBlock *pb,
                   Slapi_Entry *e,
@@ -2906,13 +2889,13 @@ memberof_task_add(Slapi_PBlock *pb,
     *returncode = LDAP_SUCCESS;
 
     /* get arg(s) */
-    if ((dn = fetch_attr(e, "basedn", 0)) == NULL) {
+    if ((dn = slapi_fetch_attr(e, "basedn", 0)) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
 
-    if ((filter = fetch_attr(e, "filter", "(|(objectclass=inetuser)(objectclass=inetadmin)(objectclass=nsmemberof))")) == NULL) {
+    if ((filter = slapi_fetch_attr(e, "filter", "(|(objectclass=inetuser)(objectclass=inetadmin)(objectclass=nsmemberof))")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;

ldap/servers/plugins/memberof/memberof.h

@@ -102,7 +102,7 @@ void *memberof_get_plugin_id(void);
 void memberof_release_config(void);
 PRUint64 get_plugin_started(void);
 void ancestor_hashtable_entry_free(memberof_cached_value *entry);
-PLHashTable *hashtable_new();
+PLHashTable *hashtable_new(int usetxn);
 int memberof_use_txn();
 
 #endif /* _MEMBEROF_H_ */

ldap/servers/plugins/memberof/memberof_config.c

@@ -698,8 +698,8 @@ memberof_copy_config(MemberOfConfig *dest, MemberOfConfig *src)
 
         /* Allocate our caches here since we only copy the config at the start of an op */
         if (memberof_use_txn() == 1){
-            dest->ancestors_cache = hashtable_new();
-            dest->fixup_cache = hashtable_new();
+            dest->ancestors_cache = hashtable_new(1);
+            dest->fixup_cache = hashtable_new(1);
         }
 
         /* Check if the copy is already up to date */

ldap/servers/plugins/posix-winsync/posix-group-task.c

@@ -42,22 +42,6 @@ posix_group_fixup_task_thread(void *arg);
 static int
 posix_group_fix_memberuid_callback(Slapi_Entry *e, void *callback_data);
 
-/* extract a single value from the entry (as a string) -- if it's not in the
- * entry, the default will be returned (which can be NULL).
- * you do not need to free anything returned by this.
- */
-static const char *
-fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val)
-{
-    Slapi_Attr *attr;
-    Slapi_Value *val = NULL;
-
-    if (slapi_entry_attr_find(e, attrname, &attr) != 0)
-        return default_val;
-    slapi_attr_first_value(attr, &val);
-    return slapi_value_get_string(val);
-}
-
 /* e configEntry */
 int
 posix_group_task_add(Slapi_PBlock *pb __attribute__((unused)),
@@ -82,7 +66,7 @@ posix_group_task_add(Slapi_PBlock *pb __attribute__((unused)),
 
     /* get arg(s) */
     /* default: set replication basedn */
-    if ((dn = fetch_attr(e, "basedn", slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) {
+    if ((dn = slapi_fetch_attr(e, "basedn", (char *)slapi_sdn_get_dn(posix_winsync_config_get_suffix()))) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
@@ -91,7 +75,7 @@ posix_group_task_add(Slapi_PBlock *pb __attribute__((unused)),
     slapi_log_err(SLAPI_LOG_PLUGIN, POSIX_WINSYNC_PLUGIN_NAME,
                   "posix_group_task_add: retrieved basedn: %s\n", dn);
 
-    if ((filter = fetch_attr(e, "filter", "(&(objectclass=ntGroup)(|(uniquemember=*)(memberuid=*)))")) == NULL) {
+    if ((filter = slapi_fetch_attr(e, "filter", "(&(objectclass=ntGroup)(|(uniquemember=*)(memberuid=*)))")) == NULL) {
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rv = SLAPI_DSE_CALLBACK_ERROR;
         goto out;

ldap/servers/plugins/replication/repl5_inc_protocol.c

@@ -717,7 +717,7 @@ repl5_inc_run(Private_Repl_Protocol *prp)
             } else if ((e1 = event_occurred(prp, EVENT_WINDOW_CLOSED)) ||
                        event_occurred(prp, EVENT_BACKOFF_EXPIRED)) {
                 /* this events - should not occur - log a warning and go to sleep */
-                slapi_log_err(SLAPI_LOG_ERR, repl_plugin_name,
+                slapi_log_err(SLAPI_LOG_WARNING, repl_plugin_name,
                               "repl5_inc_run - %s: "
                               "Event %s should not occur in state %s; going to sleep\n",
                               agmt_get_long_name(prp->agmt), e1 ? event2name(EVENT_WINDOW_CLOSED) : event2name(EVENT_BACKOFF_EXPIRED), state2name(current_state));
@@ -1065,7 +1065,7 @@ repl5_inc_run(Private_Repl_Protocol *prp)
                     } else if (rc == UPDATE_TRANSIENT_ERROR) {
                         dev_debug("repl5_inc_run(STATE_SENDING_UPDATES) -> send_updates = UPDATE_TRANSIENT_ERROR -> STATE_BACKOFF_START");
                         agmt_set_last_update_status(prp->agmt, 0, NSDS50_REPL_TRANSIENT_ERROR,
-                                                    "Incremental update transient error.  Backing off, will retry update later.");
+                                                    "Incremental update transient warning.  Backing off, will retry update later.");
                         next_state = STATE_BACKOFF_START;
                     } else if (rc == UPDATE_FATAL_ERROR) {
                         dev_debug("repl5_inc_run(STATE_SENDING_UPDATES) -> send_updates = UPDATE_FATAL_ERROR -> STATE_STOP_FATAL_ERROR");

ldap/servers/plugins/replication/repl5_protocol_util.c

@@ -662,7 +662,7 @@ protocol_response2string(int response)
     case NSDS50_REPL_CONN_TIMEOUT:
         return "connection timeout";
     case NSDS50_REPL_TRANSIENT_ERROR:
-        return "transient error";
+        return "transient warning";
     case NSDS50_REPL_RUV_ERROR:
         return "RUV error";
     default:

ldap/servers/plugins/replication/repl5_replica_config.c

@@ -1353,19 +1353,6 @@ replica_execute_cleanruv_task(Object *r, ReplicaId rid, char *returntext __attri
     return LDAP_SUCCESS;
 }
 
-const char *
-fetch_attr(Slapi_Entry *e, const char *attrname, const char *default_val)
-{
-    Slapi_Attr *attr;
-    Slapi_Value *val = NULL;
-
-    if (slapi_entry_attr_find(e, attrname, &attr) != 0)
-        return default_val;
-
-    slapi_attr_first_value(attr, &val);
-    return slapi_value_get_string(val);
-}
-
 static int
 replica_cleanall_ruv_task(Slapi_PBlock *pb __attribute__((unused)),
                           Slapi_Entry *e,
@@ -1399,7 +1386,7 @@ replica_cleanall_ruv_task(Slapi_PBlock *pb __attribute__((unused)),
     /*
      *  Get our task settings
      */
-    if ((rid_str = fetch_attr(e, "replica-id", 0)) == NULL) {
+    if ((rid_str = slapi_fetch_attr(e, "replica-id", 0)) == NULL) {
         PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Missing replica-id attribute");
         cleanruv_log(task, -1, CLEANALLRUV_ID, SLAPI_LOG_ERR, "%s", returntext);
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
@@ -1407,14 +1394,14 @@ replica_cleanall_ruv_task(Slapi_PBlock *pb __attribute__((unused)),
         goto out;
     }
     rid = atoi(rid_str);
-    if ((base_dn = fetch_attr(e, "replica-base-dn", 0)) == NULL) {
+    if ((base_dn = slapi_fetch_attr(e, "replica-base-dn", 0)) == NULL) {
         PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Missing replica-base-dn attribute");
         cleanruv_log(task, (int)rid, CLEANALLRUV_ID, SLAPI_LOG_ERR, "%s", returntext);
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rc = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((force_cleaning = fetch_attr(e, "replica-force-cleaning", 0)) != NULL) {
+    if ((force_cleaning = slapi_fetch_attr(e, "replica-force-cleaning", 0)) != NULL) {
         if (strcasecmp(force_cleaning, "yes") != 0 && strcasecmp(force_cleaning, "no") != 0) {
             PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Invalid value for replica-force-cleaning "
                                                                "(%s).  Value must be \"yes\" or \"no\" for task - (%s)",
@@ -2868,14 +2855,14 @@ replica_cleanall_ruv_abort(Slapi_PBlock *pb __attribute__((unused)),
     /*
      *  Get our task settings
      */
-    if ((rid_str = fetch_attr(e, "replica-id", 0)) == NULL) {
+    if ((rid_str = slapi_fetch_attr(e, "replica-id", 0)) == NULL) {
         PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Missing required attr \"replica-id\"");
         cleanruv_log(task, -1, ABORT_CLEANALLRUV_ID, SLAPI_LOG_ERR, "%s", returntext);
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;
         rc = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    certify_all = fetch_attr(e, "replica-certify-all", 0);
+    certify_all = slapi_fetch_attr(e, "replica-certify-all", 0);
     /*
      *  Check the rid
      */
@@ -2888,7 +2875,7 @@ replica_cleanall_ruv_abort(Slapi_PBlock *pb __attribute__((unused)),
         rc = SLAPI_DSE_CALLBACK_ERROR;
         goto out;
     }
-    if ((base_dn = fetch_attr(e, "replica-base-dn", 0)) == NULL) {
+    if ((base_dn = slapi_fetch_attr(e, "replica-base-dn", 0)) == NULL) {
         PR_snprintf(returntext, SLAPI_DSE_RETURNTEXT_SIZE, "Missing required attr \"replica-base-dn\"");
         cleanruv_log(task, rid, ABORT_CLEANALLRUV_ID, SLAPI_LOG_ERR, "%s", returntext);
         *returncode = LDAP_OBJECT_CLASS_VIOLATION;

ldap/servers/plugins/replication/windows_inc_protocol.c

@@ -364,7 +364,7 @@ windows_inc_run(Private_Repl_Protocol *prp)
             } else if ((e1 = event_occurred(prp, EVENT_WINDOW_CLOSED)) ||
                        event_occurred(prp, EVENT_BACKOFF_EXPIRED)) {
                 /* this events - should not occur - log a warning and go to sleep */
-                slapi_log_err(SLAPI_LOG_ERR, windows_repl_plugin_name,
+                slapi_log_err(SLAPI_LOG_WARNING, windows_repl_plugin_name,
                               "windows_inc_run - %s: "
                               "Event %s should not occur in state %s; going to sleep\n",
                               agmt_get_long_name(prp->agmt),