https://bugzilla.redhat.com/show_bug.cgi?id=504651
Resolves: 504651
Bug Description: Need to store additional attributes in Retro Changelog
Submitted by: Endi Sukma Dewata <edewata@redhat.com>
Reviewed by: rmeggins (thanks!)
Platforms tested: FC10 x86_64
Fix Description: The fix allows recording some user-defined attributes
from the target entry of the operation (e.g. objectGUID) and built-in
attributes generated by the plugin (e.g. isReplicated) into the change
log entry. The attributes should be specified in the configuration entry:

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
...
nsslapd-attribute: objectGUID
nsslapd-attribute: isReplicated

The change log entry will contain the additional attributes:

dn: changeNumber=...,cn=changelog
...
objectGUID: ...
isReplicated: ...
---

https://bugzilla.redhat.com/show_bug.cgi?id=519065
Resolves: 519065
Bug Description: Fails to start if attrcrypt can't unwrap keys
Reviewed by: nhosoi (Thanks!)
Fix Description: If not using the attrcrypt feature, just return success
if the keys could not be unwrapped.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no

Resolves: bug 487425
Bug Description: slapd crashes after changelog is moved
Reviewed by: rmeggins
Fix Description: Call clcache_set_config after the global changelog cache pool has been allocated.
Platforms tested: HPUX 11 (PA-RISC 2.0 64-bit)
Flag Day: no
Doc impact: no
<diffs>

https://bugzilla.redhat.com/show_bug.cgi?id=518544
Resolves: bug 518544
Bug Description: large entries cause server SASL responses to fail
Reviewed by: nhosoi (Thanks!)
Branch: HEAD and 1.2
Fix Description: The SASL server code was broken when we switched over to
use NSPR I/O for the SASL IO layer.  If the entire encrypted buffer could
not be sent to the client, the server was just failing.  Instead, the server
must keep track of how many encrypted bytes were sent.  If all of the
encrypted bytes could not be sent, we must return the appropriate error
to the caller to let them know the operation would block.  The caller in
this case is the write_function() which does a poll() to see if the socket
is available for writing again, then will attempt the send again.
I also cleaned up usage of the various Debug macros.
Finally, I discovered that the sasl init code was calling config_get_localhost()
before that value could be set.  In most cases, it is ok, because it will
fall back to the default hostname from the system.  However, if for some
reason you want to use a different localhost, it will fail.  Now it will be
set in the boostrap config code.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no

Reviewed by: nhosoi (Thanks!)

Pre-hashed passwords may not use the standard internal salt length.  The old
ldif base64 decode function would return the number of bytes in the decoded
string - the new NSPR function does not.  We can't use strlen on the decoded
value since it is binary and may contain nulls.  The solution is to use a
function to calculate exactly how many bytes the encode string will have
when decoded, taking into account padding.  Since we know exactly how many
bytes are decoded, and we know exactly how many bytes of that decoded value
are the hash, the remainder must be the salt, however many bytes that is.
I tested this code with salt lengths from 1 to 99.
Reviewed by: nkinder (Thanks!)

The commit a26ba73fb5040383c27872997bc07ab0c2006459 made to fix the bug 509472
put the assertion at the wrong place.  It should be applied just for the worker
thread.

modifying attributes with subtypes

Andrey Ivanov (andrey.ivanov@polytechnique.fr) pointed out my previous
check-in for bug 506786 had an inefficient code.  To determine whether
to delete an equality index key or not, the code checks the key still
exists in the value array having the same attribute type.  The check
should be done as soon as one value is found in the value array instead
of checking through all of them.

Reviewed by: nkinder (Thanks!)