Merge ~sergiodj/ubuntu/+source/openldap:MRE-2.5.15-jammy into ubuntu/+source/openldap:ubuntu/jammy-devel

[Sergio Durigan Junior]

This is the MRE of OpenLDAP 2.5.15 for Jammy.

As usual, this MRE introduces several bugfixes to the OpenLDAP package. There is one change which adds support for OpenSSL 3.0 to libldap, but it's a small commit and I don't believe it can be characterized as a new feature:

https://git.openldap.org/openldap/openldap/-/commit/7fba0f7ee568bdf04c608c0e66aefb2012e3fc33

PPA: https://launchpad.net/~sergiodj/+archive/ubuntu/openldap/+packages

I'll wait for the builds to be published before I trigger the dep8 tests for the reverse deps.

[Sergio Durigan Junior (sergiodj)]

FWIW, in theory this MRE should target Kinetic as well, but I don't think it's worth the effort so I will wait until Kinetic is EOL before I upload it to Jammy.

[Sergio Durigan Junior (sergiodj)]

Analysis of the dep8 failures:

- libaws @ amd64:
- libaws @ arm64:
- libaws @ armhf:
- libaws @ ppc64el:
- libaws @ s390x:
- nss-pam-ldapd @ amd64:
- nss-pam-ldapd @ arm64:
- nss-pam-ldapd @ armhf:
- nss-pam-ldapd @ ppc64el:
- nss-pam-ldapd @ s390x:
- sudo @ armhf:
- volatildap @ armhf:
- cyrus-imapd @ ppc64el:
- pdns @ amd64:
- pdns @ arm64:
- pdns @ armhf:
- pdns @ ppc64el:
- pdns @ s390x:
- kopanocore @ s390x:
- squid @ armhf:

Already failing in Jammy.

- exim4 @ ppc64el:

Retriggered, and it failed again. However, the failure is well known (*** TLS startup failed (connect(): error:0A000438:SSL routines::tlsv1 alert internal error) and flaky.

The libreoffice tests are still running, but I don't foresee any problems with them. Everything else passed.

[Lena Voytek (lvoytek)]

LGTM, I looked through the list of changes and they all seem fine to me. A lot of them seem pretty helpful and otherwise the rest are mostly code style updates. The OpenSSL 3.0 support update looks fine on its own too. The bug report looks good too, although it may be worth mentioning the update for OpenSSL 3 support since its available in Jammy and could cause varied behavior with other packages.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: sergiodj, lvoytek
Uploaders: sergiodj, lvoytek
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

I don't think we link with openssl, at least in mantic (also checked in focal):

$ grep tls debian/configure.options
# --with-tls with TLS/SSL support auto|openssl|gnutls [auto]
--with-tls=gnutls

[Sergio Durigan Junior (sergiodj)]

On Wednesday, July 12 2023, Andreas Hasenack wrote:

> I don't think we link with openssl, at least in mantic (also checked in focal):
>
> $ grep tls debian/configure.options
> # --with-tls with TLS/SSL support auto|openssl|gnutls [auto]
> --with-tls=gnutls

Thanks Lena and Andreas.

Indeed, OpenLDAP isn't linked against OpenSSL in Jammy, so the change is
moot.

I'll go ahead and upload it.

$ dput openldap_2.5.15+dfsg-0ubuntu0.22.04.1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/openldap/openldap_2.5.15+dfsg-0ubuntu0.22.04.1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/openldap/openldap_2.5.15+dfsg-0ubuntu0.22.04.1.dsc: Valid signature from 106DA1C8C3CBBF14
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openldap_2.5.15+dfsg-0ubuntu0.22.04.1.dsc: done.
  Uploading openldap_2.5.15+dfsg.orig.tar.gz: done.
  Uploading openldap_2.5.15+dfsg-0ubuntu0.22.04.1.debian.tar.xz: done.
  Uploading openldap_2.5.15+dfsg-0ubuntu0.22.04.1_source.buildinfo: done.
  Uploading openldap_2.5.15+dfsg-0ubuntu0.22.04.1_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

diff --git a/CHANGES b/CHANGES
index fe6949b..6256ae7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,43 @@
 OpenLDAP 2.5 Change Log
 
+OpenLDAP 2.5.15 Release (2023/07/10)
+	Added libldap openssl3 support (ITS#9436, ITS#10030)
+	Fixed libldap handling of TCP KEEPALIVE options (ITS#10015)
+	Fixed libldap with async connections (ITS#10023)
+	Fixed libldap openssl TLSv1.3 cipher suite handling (ITS#10035)
+	Fixed slapd callback handling with overlays that do extended operations (ITS#9990)
+	Fixed slapd conversion of pcache configurations (ITS#10031)
+	Fixed slapd cn=config modification handling with abandon (ITS#10045)
+	Fixed slapo-constraint handling of push replication (ITS#9953)
+	Fixed slapo-dynlist filter evaluation efficiency (ITS#10041)
+	Fixed slapo-pcache handling of invalid schema (ITS#10032)
+	Fixed slapo-ppolicy handling of push replication (ITS#9953)
+	Fixed slapo-ppolicy handling of pwdMinDelay (ITS#10028)
+	Fixed slapo-syncprov abandon handling (ITS#10016)
+	Fixed slapo-translucent handling of invalid schema (ITS#10032)
+	Fixed slapo-unique handling of push replication (ITS#9953)
+	Fixed slapo-variant to improve regex handling (ITS#10048)
+	Build Environment
+		Fixed compatibility with stricter C99 compilers (ITS#10011)
+		Keep .pc files during make clean (ITS#9989)
+	Contrib
+		Fixed slapo-variant handling of push replication (ITS#9953)
+	Minor Cleanup
+		ITS#9855
+		ITS#9995
+		ITS#9996
+		ITS#9997
+		ITS#9998
+		ITS#9999
+		ITS#10000
+		ITS#10003
+		ITS#10004
+		ITS#10033
+		ITS#10037
+		ITS#10039
+		ITS#10046
+		ITS#10063
+
 OpenLDAP 2.5.14 Release (2023/02/08)
 	Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618)
 	Fixed ldapsearch memory leak with paged results (ITS#9860)
diff --git a/Makefile.in b/Makefile.in
index 5c6bec0..2b87aa6 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -29,7 +29,7 @@ clean-local: FORCE
 	$(RM) -r autom4te.cache
 
 veryclean-local: FORCE
-	$(RM) config.status libtool stamp-h stamp-h.in
+	$(RM) config.status libtool stamp-h stamp-h.in libraries/libldap/ldap.pc libraries/liblber/lber.pc
 
 distclean: veryclean FORCE
 
diff --git a/aclocal.m4 b/aclocal.m4
index daf32af..8ccd66a 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.5 -*- Autoconf -*-
 
-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2021 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -12,9 +12,9 @@
 # PARTICULAR PURPOSE.
 
 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
-dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-dnl serial 11 (pkg-config-0.29.1)
-dnl
+# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+# serial 12 (pkg-config-0.29.2)
+
 dnl Copyright © 2004 Scott James Remnant <[e-mail]>.
 dnl Copyright © 2012-2015 Dan Nicholson <[e-mail]>
 dnl
@@ -55,7 +55,7 @@ dnl
 dnl See the "Since" comment for each macro you use to see what version
 dnl of the macros you require.
 m4_defun([PKG_PREREQ],
-[m4_define([PKG_MACROS_VERSION], [0.29.1])
+[m4_define([PKG_MACROS_VERSION], [0.29.2])
 m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
     [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
 ])dnl PKG_PREREQ
@@ -156,7 +156,7 @@ AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
 AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
 
 pkg_failed=no
-AC_MSG_CHECKING([for $1])
+AC_MSG_CHECKING([for $2])
 
 _PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
 _PKG_CONFIG([$1][_LIBS], [libs], [$2])
@@ -166,11 +166,11 @@ and $1[]_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details.])
 
 if test $pkg_failed = yes; then
-   	AC_MSG_RESULT([no])
+        AC_MSG_RESULT([no])
         _PKG_SHORT_ERRORS_SUPPORTED
         if test $_pkg_short_errors_supported = yes; then
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
-        else 
+        else
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
         fi
 	# Put the nasty error message in config.log where it belongs
@@ -187,7 +187,7 @@ installed software in a non-standard prefix.
 _PKG_TEXT])[]dnl
         ])
 elif test $pkg_failed = untried; then
-     	AC_MSG_RESULT([no])
+        AC_MSG_RESULT([no])
 	m4_default([$4], [AC_MSG_FAILURE(
 [The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
diff --git a/build/lib.mk b/build/lib.mk
index 442c0d3..c50ef52 100644
--- a/build/lib.mk
+++ b/build/lib.mk
@@ -40,7 +40,7 @@ lint5: lint5-local FORCE
 clean-common: 	FORCE
 	$(RM) $(LIBRARY) ../$(LIBRARY) $(XLIBRARY) \
 		$(PROGRAMS) $(XPROGRAMS) $(XSRCS) $(XXSRCS) \
-		*.o *.lo a.out *.exe *.pc core version.c .libs/*
+		*.o *.lo a.out *.exe core version.c .libs/*
 
 depend-common: FORCE
 	$(MKDEP) $(DEFS) $(DEFINES) $(SRCS) $(XXSRCS)
diff --git a/build/openldap.m4 b/build/openldap.m4
index c7fa19e..9419aaf 100644
--- a/build/openldap.m4
+++ b/build/openldap.m4
@@ -154,6 +154,7 @@ fi
 if test $ol_cv_header_stdc = yes; then
   # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
 AC_RUN_IFELSE([AC_LANG_SOURCE([[#include <ctype.h>
+#include <stdlib.h>
 #ifndef HAVE_EBCDIC
 #	define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
 #	define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
@@ -303,8 +304,12 @@ AC_DEFUN([OL_PTHREAD_TEST_INCLUDES], [[
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -360,9 +365,13 @@ AC_DEFUN([OL_PTHREAD_TEST_FUNCTION],[[
 AC_DEFUN([OL_PTHREAD_TEST_PROGRAM],
 [AC_LANG_SOURCE([OL_PTHREAD_TEST_INCLUDES
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 OL_PTHREAD_TEST_FUNCTION
 }
@@ -484,7 +493,7 @@ AC_CACHE_CHECK([for compatible POSIX regex],ol_cv_c_posix_regex,[
 #include <sys/types.h>
 #include <regex.h>
 static char *pattern, *string;
-main()
+int main(void)
 {
 	int rc;
 	regex_t re;
@@ -511,7 +520,8 @@ AC_DEFUN([OL_C_UPPER_LOWER],
 [AC_CACHE_CHECK([if toupper() requires islower()],ol_cv_c_upper_lower,[
 	AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #include <ctype.h>
-main()
+#include <stdlib.h>
+int main(void)
 {
 	if ('C' == toupper('C'))
 		exit(0);
@@ -569,7 +579,7 @@ AC_DEFUN([OL_NONPOSIX_STRERROR_R],
 			]])],[ol_cv_nonposix_strerror_r=yes],[ol_cv_nonposix_strerror_r=no])
 	else
 		AC_RUN_IFELSE([AC_LANG_SOURCE([[
-			main() {
+			int main(void) {
 				char buf[100];
 				buf[0] = 0;
 				strerror_r( 1, buf, sizeof buf );
diff --git a/build/version.var b/build/version.var
index 19cfaea..5bcd71b 100644
--- a/build/version.var
+++ b/build/version.var
@@ -15,9 +15,9 @@
 ol_package=OpenLDAP
 ol_major=2
 ol_minor=5
-ol_patch=14
-ol_api_inc=20514
+ol_patch=15
+ol_api_inc=20515
 ol_api_current=1
-ol_api_revision=9
+ol_api_revision=10
 ol_api_age=1
-ol_release_date="2023/02/08"
+ol_release_date="2023/07/10"
diff --git a/clients/tools/ldapdelete.c b/clients/tools/ldapdelete.c
index 6024a33..e572e43 100644
--- a/clients/tools/ldapdelete.c
+++ b/clients/tools/ldapdelete.c
@@ -386,7 +386,9 @@ more:;
 		break;
 	default:
 		tool_perror( "ldap_search", srch_rc, NULL, NULL, NULL, NULL );
-		return( srch_rc );
+		rc = srch_rc;
+		srch_rc = 0;
+		goto leave;
 	}
 
 	entries = ldap_count_entries( ld, res );
@@ -402,15 +404,14 @@ more:;
 			if( dn == NULL ) {
 				ldap_get_option( ld, LDAP_OPT_RESULT_CODE, &rc );
 				tool_perror( "ldap_prune", rc, NULL, NULL, NULL, NULL );
-				ber_memfree( dn );
-				return rc;
+				goto leave;
 			}
 
 			rc = deletechildren( ld, dn, 0 );
 			if ( rc != LDAP_SUCCESS ) {
 				tool_perror( "ldap_prune", rc, NULL, NULL, NULL, NULL );
 				ber_memfree( dn );
-				return rc;
+				goto leave;
 			}
 
 			if ( verbose ) {
@@ -421,7 +422,7 @@ more:;
 			if ( rc != LDAP_SUCCESS ) {
 				tool_perror( "ldap_delete", rc, NULL, NULL, NULL, NULL );
 				ber_memfree( dn );
-				return rc;
+				goto leave;
 
 			}
 			
@@ -433,6 +434,7 @@ more:;
 		}
 	}
 
+leave:
 	ldap_msgfree( res );
 
 	if ( srch_rc == LDAP_SIZELIMIT_EXCEEDED ) {
diff --git a/configure b/configure
index b718883..ae23534 100755
--- a/configure
+++ b/configure
@@ -1,5 +1,5 @@
 #! /bin/sh
-# From configure.ac Id: 3943f6265060065483db582e5c7bef14fe934d80 .
+# From configure.ac Id: a4836a8a0218326643db20d8131fc717d1fc3edf .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.69.
 #
@@ -812,7 +812,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -973,7 +972,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE}'
@@ -1226,15 +1224,6 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1372,7 +1361,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1525,7 +1514,6 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -15303,6 +15291,7 @@ else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <ctype.h>
+#include <stdlib.h>
 #ifndef HAVE_EBCDIC
 #	define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
 #	define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
@@ -16271,6 +16260,10 @@ $as_echo "no" >&6; }
 else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
+#include <stdlib.h>
+#ifdef HAVE_SYS_POLL_H
+#include <sys/epoll.h>
+#endif
 int main(int argc, char **argv)
 {
 	int epfd = epoll_create(256);
@@ -16451,7 +16444,7 @@ else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
-			main() {
+			int main(void) {
 				char buf[100];
 				buf[0] = 0;
 				strerror_r( 1, buf, sizeof buf );
@@ -16651,7 +16644,7 @@ else
 #include <sys/types.h>
 #include <regex.h>
 static char *pattern, *string;
-main()
+int main(void)
 {
 	int rc;
 	regex_t re;
@@ -17447,9 +17440,9 @@ See \`config.log' for more details" "$LINENO" 5; }
 fi
 rm -f conftest.err conftest.i conftest.$ac_ext
 
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL_export_keying_material_early in -lssl" >&5
-$as_echo_n "checking for SSL_export_keying_material_early in -lssl... " >&6; }
-if ${ac_cv_lib_ssl_SSL_export_keying_material_early+:} false; then :
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL_CTX_set_ciphersuites in -lssl" >&5
+$as_echo_n "checking for SSL_CTX_set_ciphersuites in -lssl... " >&6; }
+if ${ac_cv_lib_ssl_SSL_CTX_set_ciphersuites+:} false; then :
   $as_echo_n "(cached) " >&6
 else
   ac_check_lib_save_LIBS=$LIBS
@@ -17463,27 +17456,27 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 #ifdef __cplusplus
 extern "C"
 #endif
-char SSL_export_keying_material_early ();
+char SSL_CTX_set_ciphersuites ();
 int
 main ()
 {
-return SSL_export_keying_material_early ();
+return SSL_CTX_set_ciphersuites ();
   ;
   return 0;
 }
 _ACEOF
 if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_ssl_SSL_export_keying_material_early=yes
+  ac_cv_lib_ssl_SSL_CTX_set_ciphersuites=yes
 else
-  ac_cv_lib_ssl_SSL_export_keying_material_early=no
+  ac_cv_lib_ssl_SSL_CTX_set_ciphersuites=no
 fi
 rm -f core conftest.err conftest.$ac_objext \
     conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ssl_SSL_export_keying_material_early" >&5
-$as_echo "$ac_cv_lib_ssl_SSL_export_keying_material_early" >&6; }
-if test "x$ac_cv_lib_ssl_SSL_export_keying_material_early" = xyes; then :
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ssl_SSL_CTX_set_ciphersuites" >&5
+$as_echo "$ac_cv_lib_ssl_SSL_CTX_set_ciphersuites" >&6; }
+if test "x$ac_cv_lib_ssl_SSL_CTX_set_ciphersuites" = xyes; then :
   have_openssl=yes
 else
   have_openssl=no
@@ -17865,8 +17858,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -17945,16 +17942,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18050,8 +18055,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -18130,16 +18139,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18240,8 +18257,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -18320,16 +18341,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18430,8 +18459,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -18510,16 +18543,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18620,8 +18661,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -18700,16 +18745,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18810,8 +18863,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -18890,16 +18947,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19001,8 +19066,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -19081,16 +19150,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19191,8 +19268,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -19271,16 +19352,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19382,8 +19471,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -19462,16 +19555,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19573,8 +19674,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -19653,16 +19758,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19763,8 +19876,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -19843,16 +19960,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19954,8 +20079,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -20034,16 +20163,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -20145,8 +20282,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -20225,16 +20366,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -20335,8 +20484,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -20415,16 +20568,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -20525,8 +20686,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -20605,16 +20770,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -20716,8 +20889,12 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -20796,16 +20973,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -21017,14 +21202,12 @@ else
 /* end confdefs.h.  */
 
 #include <pthread.h>
-#ifndef NULL
-#define NULL (void*)0
-#endif
+pthread_t thread;
 
 int
 main ()
 {
-pthread_detach(NULL);
+pthread_detach(thread);
   ;
   return 0;
 }
@@ -21138,16 +21321,24 @@ else
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -21237,6 +21428,9 @@ else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
+#define _XOPEN_SOURCE 500               /* For pthread_setconcurrency() on glibc */
+#include <stdlib.h>
+#include <stdio.h>
 #include <sys/types.h>
 #include <sys/time.h>
 #include <unistd.h>
@@ -21247,8 +21441,12 @@ else
 
 static int fildes[2];
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	int i;
 	struct timeval tv;
@@ -21272,9 +21470,13 @@ static void *task(p)
 	exit(0); /* if we exit here, the select blocked the whole process */
 }
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 	pthread_t t;
 
@@ -22566,8 +22768,8 @@ $as_echo "no" >&6; }
 fi
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for WT" >&5
-$as_echo_n "checking for WT... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for wiredtiger" >&5
+$as_echo_n "checking for wiredtiger... " >&6; }
 
 if test -n "$WT_CFLAGS"; then
     pkg_cv_WT_CFLAGS="$WT_CFLAGS"
@@ -22607,7 +22809,7 @@ fi
 
 
 if test $pkg_failed = yes; then
-   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -22634,7 +22836,7 @@ Alternatively, you may set the environment variables WT_CFLAGS
 and WT_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
-     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -23734,7 +23936,8 @@ else
 /* end confdefs.h.  */
 
 #include <ctype.h>
-main()
+#include <stdlib.h>
+int main(void)
 {
 	if ('C' == toupper('C'))
 		exit(0);
@@ -25785,7 +25988,7 @@ $as_echo "#define HAVE_LIBSODIUM 1" >>confdefs.h
 
 	BUILD_PW_ARGON2=$ol_enable_argon2
 	if test "$ol_enable_argon2" = "yes" ; then
-		SLAPD_DYNAMIC_PWMODS="$SLAPD_DYNAMIC_PWDMODS argon2.la"
+		SLAPD_DYNAMIC_PWMODS="$SLAPD_DYNAMIC_PWMODS argon2.la"
 	fi
 
 cat >>confdefs.h <<_ACEOF
diff --git a/configure.ac b/configure.ac
index c8dfa2a..6ddfee5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -25,7 +25,7 @@ dnl ================================================================
 dnl Configure.in for OpenLDAP
 AC_COPYRIGHT([[Copyright 1998-2022 The OpenLDAP Foundation. All rights reserved.
 Restrictions apply, see COPYRIGHT and LICENSE files.]])
-AC_REVISION([$Id: 3943f6265060065483db582e5c7bef14fe934d80 $])
+AC_REVISION([$Id: a4836a8a0218326643db20d8131fc717d1fc3edf $])
 AC_INIT([OpenLDAP],,[https://bugs.openldap.org],,[https://www.openldap.org])
 AC_CONFIG_SRCDIR(build/version.sh)dnl
 dnl ----------------------------------------------------------------
@@ -1009,7 +1009,11 @@ dnl ----------------------------------------------------------------
 AC_CHECK_HEADERS( sys/epoll.h )
 if test "${ac_cv_header_sys_epoll_h}" = yes; then
 	AC_MSG_CHECKING(for epoll system call)
-	AC_RUN_IFELSE([AC_LANG_SOURCE([[int main(int argc, char **argv)
+	AC_RUN_IFELSE([AC_LANG_SOURCE([[#include <stdlib.h>
+#ifdef HAVE_SYS_POLL_H
+#include <sys/epoll.h>
+#endif
+int main(int argc, char **argv)
 {
 	int epfd = epoll_create(256);
 	exit (epfd == -1 ? 1 : 0);
@@ -1232,7 +1236,7 @@ if test $ol_with_tls = openssl || test $ol_with_tls = auto ; then
 [#endif]])],
 					, [AC_MSG_FAILURE([OpenSSL 1.1.1 or newer required])])
 
-		AC_CHECK_LIB(ssl, SSL_export_keying_material_early,
+		AC_CHECK_LIB(ssl, SSL_CTX_set_ciphersuites,
 			[have_openssl=yes], [have_openssl=no],
 			[-lcrypto])
 
@@ -1362,10 +1366,10 @@ case $ol_with_threads in auto | yes | posix)
 		dnl 	pthread_create() in -lpthread (many)
 		dnl 	pthread_create() in -lc_r (FreeBSD)
 		dnl
-		dnl Check pthread (draft4) flags (depreciated)
+		dnl Check pthread (draft4) flags (deprecated)
 		dnl 	pthread_create() with -threads (OSF/1)
 		dnl
-		dnl Check pthread (draft4) libraries (depreciated)
+		dnl Check pthread (draft4) libraries (deprecated)
 		dnl 	pthread_mutex_unlock() in -lpthreads -lmach -lexc -lc_r (OSF/1)
 		dnl 	pthread_mutex_lock() in -lpthreads -lmach -lexc (OSF/1)
 		dnl 	pthread_mutex_trylock() in -lpthreads -lexc (OSF/1)
@@ -1386,7 +1390,7 @@ case $ol_with_threads in auto | yes | posix)
 			ol_link_threads=posix
 			ol_link_pthreads=""
 		fi
-		
+
 dnl		OL_PTHREAD_TRY([-mt],		[ol_cv_pthread_mt])
 		OL_PTHREAD_TRY([-kthread],	[ol_cv_pthread_kthread])
 		OL_PTHREAD_TRY([-pthread],	[ol_cv_pthread_pthread])
@@ -1473,10 +1477,8 @@ pthread_rwlock_t rwlock;
 				dnl save the flags
 				AC_LINK_IFELSE([AC_LANG_PROGRAM([[
 #include <pthread.h>
-#ifndef NULL
-#define NULL (void*)0
-#endif
-]], [[pthread_detach(NULL);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no])
+pthread_t thread;
+]], [[pthread_detach(thread);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no])
 			])
 
 			if test $ol_cv_func_pthread_detach = no ; then
@@ -1531,6 +1533,9 @@ dnl			esac
 				AC_CACHE_CHECK([if select yields when using pthreads],
 					ol_cv_pthread_select_yields,[
 				AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#define _XOPEN_SOURCE 500               /* For pthread_setconcurrency() on glibc */
+#include <stdlib.h>
+#include <stdio.h>
 #include <sys/types.h>
 #include <sys/time.h>
 #include <unistd.h>
@@ -1541,8 +1546,12 @@ dnl			esac
 
 static int fildes[2];
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	int i;
 	struct timeval tv;
@@ -1566,9 +1575,13 @@ static void *task(p)
 	exit(0); /* if we exit here, the select blocked the whole process */
 }
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 	pthread_t t;
 
@@ -3093,7 +3106,7 @@ if test "$ol_enable_argon2" = "yes" ; then
 
 	BUILD_PW_ARGON2=$ol_enable_argon2
 	if test "$ol_enable_argon2" = "yes" ; then
-		SLAPD_DYNAMIC_PWMODS="$SLAPD_DYNAMIC_PWDMODS argon2.la"
+		SLAPD_DYNAMIC_PWMODS="$SLAPD_DYNAMIC_PWMODS argon2.la"
 	fi
 	AC_DEFINE_UNQUOTED(SLAPD_PWMOD_PW_ARGON2,$SLAPD_MOD_DYNAMIC,[define for Argon2 Password hashing module])
 fi
diff --git a/contrib/ldaptcl/tclAppInit.c b/contrib/ldaptcl/tclAppInit.c
index f84e182..d50a724 100644
--- a/contrib/ldaptcl/tclAppInit.c
+++ b/contrib/ldaptcl/tclAppInit.c
@@ -45,9 +45,7 @@ EXTERN int		Tcltest_Init _ANSI_ARGS_((Tcl_Interp *interp));
  */
 
 int
-main(argc, argv)
-    int argc;			/* Number of command-line arguments. */
-    char **argv;		/* Values of command-line arguments. */
+main(int argc, char **argv)
 {
 #ifdef USE_TCLX
     TclX_Main(argc, argv, Tcl_AppInit);
diff --git a/contrib/ldaptcl/tkAppInit.c b/contrib/ldaptcl/tkAppInit.c
index 68fd956..6934523 100644
--- a/contrib/ldaptcl/tkAppInit.c
+++ b/contrib/ldaptcl/tkAppInit.c
@@ -37,16 +37,9 @@ int (*tclDummyMathPtr)() = matherr;
  * This is the main program for the application.
  *-----------------------------------------------------------------------------
  */
-#ifdef __cplusplus
 int
 main (int    argc,
       char **argv)
-#else
-int
-main (argc, argv)
-    int    argc;
-    char **argv;
-#endif
 {
 #ifdef USE_TCLX
     TkX_Main(argc, argv, Tcl_AppInit);
@@ -68,14 +61,8 @@ main (argc, argv)
  * interp->result if an error occurs.
  *-----------------------------------------------------------------------------
  */
-#ifdef __cplusplus
 int
 Tcl_AppInit (Tcl_Interp *interp)
-#else
-int
-Tcl_AppInit (interp)
-    Tcl_Interp *interp;
-#endif
 {
     if (Tcl_Init (interp) == TCL_ERROR) {
         return TCL_ERROR;
diff --git a/contrib/slapd-modules/datamorph/tests/run b/contrib/slapd-modules/datamorph/tests/run
index 6a38431..239bff7 100755
--- a/contrib/slapd-modules/datamorph/tests/run
+++ b/contrib/slapd-modules/datamorph/tests/run
@@ -12,218 +12,6 @@
 ## A copy of this license is available in the file LICENSE in the
 ## top-level directory of the distribution or, alternatively, at
 ## <http://www.OpenLDAP.org/license.html>.
-##
-## ACKNOWLEDGEMENTS:
-## This module was written in 2016 by Ondřej Kuzník for Symas Corp.
-
-USAGE="$0 [-b <backend>] [-c] [-k] [-l #] [-p] [-s {ro|rp}] [-u] [-w] <script>"
-
-TOPSRCDIR="${SRCDIR-$LDAP_SRC}"
-SRCDIR="${TOPSRCDIR}/tests"
-eval `grep EGREP_CMD= ${LDAP_BUILD}/tests/run`
-eval `$EGREP_CMD -e '^LN_S=' ${LDAP_BUILD}/tests/run`
-
-export SRCDIR TOPSRCDIR LN_S EGREP_CMD
-
-. "${SRCDIR}/scripts/defines.sh"
-
-BACKEND=
-CLEAN=no
-WAIT=0
-KILLSERVERS=yes
-PRESERVE=${PRESERVE-no}
-SYNCMODE=${SYNCMODE-rp}
-USERDATA=no
-LOOP=1
-COUNTER=1
-
-while test $# -gt 0 ; do
-	case "$1" in
-		-b | -backend)
-			BACKEND="$2"
-			shift; shift ;;
-
-		-c | -clean)
-			CLEAN=yes
-			shift ;;
-
-		-k | -kill)
-			KILLSERVERS=no
-			shift ;;
-		-l | -loop)
-			NUM="`echo $2 | sed 's/[0-9]//g'`"
-			if [ -z "$NUM" ]; then
-				LOOP=$2
-			else
-				echo "Loop variable not an int: $2"
-				echo "$USAGE"; exit 1
-			fi
-			shift ;
-			shift ;;
-
-		-p | -preserve)
-			PRESERVE=yes
-			shift ;;
-
-		-s | -syncmode)
-			case "$2" in
-				ro | rp)
-					SYNCMODE="$2"
-					;;
-				*)
-					echo "unknown sync mode $2"
-					echo "$USAGE"; exit 1
-					;;
-			esac
-			shift; shift ;;
-
-		-u | -userdata)
-			USERDATA=yes
-			shift ;;
-
-		-w | -wait)
-			WAIT=1
-			shift ;;
-
-		-)
-			shift
-			break ;;
-
-		-*)
-			echo "$USAGE"; exit 1
-			;;
-
-		*)
-			break ;;
-	esac
-done
-
-eval `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run`
-export `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run | sed 's/=.*//'`
-
-if test -z "$BACKEND" ; then
-	for b in mdb ; do
-		if eval "test \"\$AC_$b\" != no" ; then
-			BACKEND=$b
-			break
-		fi
-	done
-	if test -z "$BACKEND" ; then
-		echo "No suitable default database backend configured" >&2
-		exit 1
-	fi
-fi
-
-BACKENDTYPE=`eval 'echo $AC_'$BACKEND`
-if test "x$BACKENDTYPE" = "x" ; then
-	BACKENDTYPE="unknown"
-fi
-
-# Backend features.  indexdb: indexing and unchecked limit.
-# maindb: main storage backend.  Currently index,limits,mode,paged results.
-INDEXDB=noindexdb MAINDB=nomaindb
-case $BACKEND in
-	mdb) INDEXDB=indexdb MAINDB=maindb ;;
-	ndb) INDEXDB=indexdb ;;
-esac
-
-export	BACKEND BACKENDTYPE INDEXDB MAINDB \
-	WAIT KILLSERVERS PRESERVE SYNCMODE USERDATA \
-	SRCDIR
-
-if test $# = 0 ; then
-	echo "$USAGE"; exit 1
-fi
-
-# need defines.sh for the definitions of the directories
-. $SRCDIR/scripts/defines.sh
-
-SCRIPTDIR="${TOPDIR}/tests/scripts"
-
-export SCRIPTDIR
-
-SCRIPTNAME="$1"
-shift
-
-if test -x "${SCRIPTDIR}/${SCRIPTNAME}" ; then
-	SCRIPT="${SCRIPTDIR}/${SCRIPTNAME}"
-elif test -x "`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"
-elif test -x "`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"
-else
-	echo "run: ${SCRIPTNAME} not found (or not executable)"
-	exit 1;
-fi
-
-if test ! -r ${DATADIR}/test.ldif ; then
-	${LN_S} ${SRCDIR}/data ${DATADIR}
-fi
-if test ! -r ${SCHEMADIR}/core.schema ; then
-	${LN_S} ${TOPSRCDIR}/servers/slapd/schema ${SCHEMADIR}
-fi
-if test ! -r ./data; then
-	${LN_S} ${TOPDIR}/tests/data ./
-fi
-
-if test -d ${TESTDIR} ; then
-	if test $PRESERVE = no ; then
-		echo "Cleaning up test run directory leftover from previous run."
-		/bin/rm -rf ${TESTDIR}
-	elif test $PRESERVE = yes ; then
-		echo "Cleaning up only database directories leftover from previous run."
-		/bin/rm -rf ${TESTDIR}/db.*
-	fi
-fi
-if test $BACKEND = ndb ; then
-	mysql --user root <<EOF
-	drop database if exists db_1;
-	drop database if exists db_2;
-	drop database if exists db_3;
-	drop database if exists db_4;
-	drop database if exists db_5;
-	drop database if exists db_6;
-EOF
-fi
-mkdir -p ${TESTDIR}
-
-if test $USERDATA = yes ; then
-	if test ! -d userdata ; then
-		echo "User data directory (userdata) does not exist."
-		exit 1
-	fi
-	cp -R userdata/* ${TESTDIR}
-fi
-
-# disable LDAP initialization
-LDAPNOINIT=true; export LDAPNOINIT
-
-echo "Running ${SCRIPT} for ${BACKEND}..."
-while [ $COUNTER -le $LOOP ]; do
-	if [ $LOOP -gt 1 ]; then
-		echo "Running $COUNTER of $LOOP iterations"
-	fi
-	$SCRIPT $*
-	RC=$?
 
-	if test $CLEAN = yes ; then
-		echo "Cleaning up test run directory from this run."
-		/bin/rm -rf ${TESTDIR}
-		echo "Cleaning up symlinks."
-		/bin/rm -f ${DATADIR} ${SCHEMADIR}
-	fi
+TOPSRCDIR="$SRCDIR" OBJDIR="${LDAP_BUILD}" SRCDIR="${SRCDIR}/tests" DEFSDIR="${SRCDIR}/scripts" SCRIPTDIR="${TOPDIR}/tests/scripts" "${LDAP_BUILD}/tests/run" $*
 
-	if [ $RC -ne 0 ]; then
-		if [ $LOOP -gt 1 ]; then
-			echo "Failed after $COUNTER of $LOOP iterations"
-		fi
-		exit $RC
-	else
-		COUNTER=`expr $COUNTER + 1`
-		if [ $COUNTER -le $LOOP ]; then
-			echo "Cleaning up test run directory from this run."
-			/bin/rm -rf ${TESTDIR}
-		fi
-	fi
-done
-exit $RC
diff --git a/contrib/slapd-modules/emptyds/tests/run b/contrib/slapd-modules/emptyds/tests/run
index e28820c..239bff7 100755
--- a/contrib/slapd-modules/emptyds/tests/run
+++ b/contrib/slapd-modules/emptyds/tests/run
@@ -12,207 +12,6 @@
 ## A copy of this license is available in the file LICENSE in the
 ## top-level directory of the distribution or, alternatively, at
 ## <http://www.OpenLDAP.org/license.html>.
-##
-## ACKNOWLEDGEMENTS:
-## This module was written in 2016 by Ondřej Kuzník for Symas Corp.
-
-USAGE="$0 [-b <backend>] [-c] [-k] [-l #] [-p] [-s {ro|rp}] [-u] [-w] <script>"
-
-TOPSRCDIR="${SRCDIR-$LDAP_SRC}"
-SRCDIR="${TOPSRCDIR}/tests"
-eval `grep EGREP_CMD= ${LDAP_BUILD}/tests/run`
-eval `$EGREP_CMD -e '^LN_S=' ${LDAP_BUILD}/tests/run`
-
-export SRCDIR TOPSRCDIR LN_S EGREP_CMD
-
-. "${SRCDIR}/scripts/defines.sh"
-
-BACKEND=
-CLEAN=no
-WAIT=0
-KILLSERVERS=yes
-PRESERVE=${PRESERVE-no}
-SYNCMODE=${SYNCMODE-rp}
-USERDATA=no
-LOOP=1
-COUNTER=1
-
-while test $# -gt 0 ; do
-	case "$1" in
-		-b | -backend)
-			BACKEND="$2"
-			shift; shift ;;
-
-		-c | -clean)
-			CLEAN=yes
-			shift ;;
-
-		-k | -kill)
-			KILLSERVERS=no
-			shift ;;
-		-l | -loop)
-			NUM="`echo $2 | sed 's/[0-9]//g'`"
-			if [ -z "$NUM" ]; then
-				LOOP=$2
-			else
-				echo "Loop variable not an int: $2"
-				echo "$USAGE"; exit 1
-			fi
-			shift ;
-			shift ;;
-
-		-p | -preserve)
-			PRESERVE=yes
-			shift ;;
-
-		-s | -syncmode)
-			case "$2" in
-				ro | rp)
-					SYNCMODE="$2"
-					;;
-				*)
-					echo "unknown sync mode $2"
-					echo "$USAGE"; exit 1
-					;;
-			esac
-			shift; shift ;;
-
-		-u | -userdata)
-			USERDATA=yes
-			shift ;;
-
-		-w | -wait)
-			WAIT=1
-			shift ;;
-
-		-)
-			shift
-			break ;;
-
-		-*)
-			echo "$USAGE"; exit 1
-			;;
-
-		*)
-			break ;;
-	esac
-done
-
-eval `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run`
-export `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run | sed 's/=.*//'`
-
-if test -z "$BACKEND" ; then
-	for b in mdb ; do
-		if eval "test \"\$AC_$b\" != no" ; then
-			BACKEND=$b
-			break
-		fi
-	done
-	if test -z "$BACKEND" ; then
-		echo "No suitable default database backend configured" >&2
-		exit 1
-	fi
-fi
-
-BACKENDTYPE=`eval 'echo $AC_'$BACKEND`
-if test "x$BACKENDTYPE" = "x" ; then
-	BACKENDTYPE="unknown"
-fi
-
-# Backend features.  indexdb: indexing and unchecked limit.
-# maindb: main storage backend.  Currently index,limits,mode,paged results.
-INDEXDB=noindexdb MAINDB=nomaindb
-case $BACKEND in
-	mdb) INDEXDB=indexdb MAINDB=maindb ;;
-esac
-
-export	BACKEND BACKENDTYPE INDEXDB MAINDB \
-	WAIT KILLSERVERS PRESERVE SYNCMODE USERDATA \
-	SRCDIR
-
-if test $# = 0 ; then
-	echo "$USAGE"; exit 1
-fi
-
-# need defines.sh for the definitions of the directories
-. $SRCDIR/scripts/defines.sh
-
-SCRIPTDIR="${TOPDIR}/tests/scripts"
-
-export SCRIPTDIR
-
-SCRIPTNAME="$1"
-shift
-
-if test -x "${SCRIPTDIR}/${SCRIPTNAME}" ; then
-	SCRIPT="${SCRIPTDIR}/${SCRIPTNAME}"
-elif test -x "`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"
-elif test -x "`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"
-else
-	echo "run: ${SCRIPTNAME} not found (or not executable)"
-	exit 1;
-fi
-
-if test ! -r ${DATADIR}/test.ldif ; then
-	${LN_S} ${SRCDIR}/data ${DATADIR}
-fi
-if test ! -r ${SCHEMADIR}/core.schema ; then
-	${LN_S} ${TOPSRCDIR}/servers/slapd/schema ${SCHEMADIR}
-fi
-if test ! -r ./data; then
-	${LN_S} ${TOPDIR}/tests/data ./
-fi
-
-if test -d ${TESTDIR} ; then
-	if test $PRESERVE = no ; then
-		echo "Cleaning up test run directory leftover from previous run."
-		/bin/rm -rf ${TESTDIR}
-	elif test $PRESERVE = yes ; then
-		echo "Cleaning up only database directories leftover from previous run."
-		/bin/rm -rf ${TESTDIR}/db.*
-	fi
-fi
-mkdir -p ${TESTDIR}
-
-if test $USERDATA = yes ; then
-	if test ! -d userdata ; then
-		echo "User data directory (userdata) does not exist."
-		exit 1
-	fi
-	cp -R userdata/* ${TESTDIR}
-fi
-
-# disable LDAP initialization
-LDAPNOINIT=true; export LDAPNOINIT
-
-echo "Running ${SCRIPT} for ${BACKEND}..."
-while [ $COUNTER -le $LOOP ]; do
-	if [ $LOOP -gt 1 ]; then
-		echo "Running $COUNTER of $LOOP iterations"
-	fi
-	$SCRIPT $*
-	RC=$?
 
-	if test $CLEAN = yes ; then
-		echo "Cleaning up test run directory from this run."
-		/bin/rm -rf ${TESTDIR}
-		echo "Cleaning up symlinks."
-		/bin/rm -f ${DATADIR} ${SCHEMADIR}
-	fi
+TOPSRCDIR="$SRCDIR" OBJDIR="${LDAP_BUILD}" SRCDIR="${SRCDIR}/tests" DEFSDIR="${SRCDIR}/scripts" SCRIPTDIR="${TOPDIR}/tests/scripts" "${LDAP_BUILD}/tests/run" $*
 
-	if [ $RC -ne 0 ]; then
-		if [ $LOOP -gt 1 ]; then
-			echo "Failed after $COUNTER of $LOOP iterations"
-		fi
-		exit $RC
-	else
-		COUNTER=`expr $COUNTER + 1`
-		if [ $COUNTER -le $LOOP ]; then
-			echo "Cleaning up test run directory from this run."
-			/bin/rm -rf ${TESTDIR}
-		fi
-	fi
-done
-exit $RC
diff --git a/contrib/slapd-modules/variant/slapo-variant.5 b/contrib/slapd-modules/variant/slapo-variant.5
index a480744..f46eb69 100644
--- a/contrib/slapd-modules/variant/slapo-variant.5
+++ b/contrib/slapd-modules/variant/slapo-variant.5
@@ -341,14 +341,14 @@ olcVariantEntry: dc=example,dc=com
 
 # share the Headquarters' address as the company address
 dn: olcVariantVariantAttribute=postaladdress,name={0}example,olcOverlay={x}variant,$DATABASE
-objectClass: olcVariantVariantAttribute
+objectClass: olcVariantAttribute
 olcVariantVariantAttribute: postaladdress
 olcVariantAlternativeAttribute: postaladdress
 olcVariantAlternativeEntry: ou=Headquarters,dc=example,dc=com
 
 # populate telephonenumber from CEO's home phone
 dn: name=Take phone from CEO entry,name={0}example,olcOverlay={x}variant,$DATABASE
-objectClass: olcVariantVariantAttribute
+objectClass: olcVariantAttribute
 olcVariantVariantAttribute: telephonenumber
 olcVariantAlternativeAttribute: homephone
 olcVariantAlternativeEntry: cn=John Doe,ou=People,dc=example,dc=com
diff --git a/contrib/slapd-modules/variant/tests/data/test001-04a-same-regex.ldif b/contrib/slapd-modules/variant/tests/data/test001-04a-same-regex.ldif
 new file mode 100644
index 0000000..071df0f
--- /dev/null
+++ b/contrib/slapd-modules/variant/tests/data/test001-04a-same-regex.ldif
@@ -0,0 +1,4 @@
+dn: name={3}regex,olcOverlay={0}variant,olcDatabase={1}mdb,cn=config
+changetype: modify
+replace: olcVariantEntryRegex
+olcVariantEntryRegex: (.*),(ou=.*technology.*)(,)dc=example,dc=com
diff --git a/contrib/slapd-modules/variant/tests/data/test001-04b-same-regex.ldif b/contrib/slapd-modules/variant/tests/data/test001-04b-same-regex.ldif
 new file mode 100644
index 0000000..5fa1d3b
--- /dev/null
+++ b/contrib/slapd-modules/variant/tests/data/test001-04b-same-regex.ldif
@@ -0,0 +1,4 @@
+dn: name=regex,olcOverlay={0}variant,olcDatabase={1}@BACKEND@,cn=config
+changetype: add
+objectclass: olcVariantRegex
+olcVariantEntryRegex: .*
diff --git a/contrib/slapd-modules/variant/tests/run b/contrib/slapd-modules/variant/tests/run
index 6a38431..239bff7 100755
--- a/contrib/slapd-modules/variant/tests/run
+++ b/contrib/slapd-modules/variant/tests/run
@@ -12,218 +12,6 @@
 ## A copy of this license is available in the file LICENSE in the
 ## top-level directory of the distribution or, alternatively, at
 ## <http://www.OpenLDAP.org/license.html>.
-##
-## ACKNOWLEDGEMENTS:
-## This module was written in 2016 by Ondřej Kuzník for Symas Corp.
-
-USAGE="$0 [-b <backend>] [-c] [-k] [-l #] [-p] [-s {ro|rp}] [-u] [-w] <script>"
-
-TOPSRCDIR="${SRCDIR-$LDAP_SRC}"
-SRCDIR="${TOPSRCDIR}/tests"
-eval `grep EGREP_CMD= ${LDAP_BUILD}/tests/run`
-eval `$EGREP_CMD -e '^LN_S=' ${LDAP_BUILD}/tests/run`
-
-export SRCDIR TOPSRCDIR LN_S EGREP_CMD
-
-. "${SRCDIR}/scripts/defines.sh"
-
-BACKEND=
-CLEAN=no
-WAIT=0
-KILLSERVERS=yes
-PRESERVE=${PRESERVE-no}
-SYNCMODE=${SYNCMODE-rp}
-USERDATA=no
-LOOP=1
-COUNTER=1
-
-while test $# -gt 0 ; do
-	case "$1" in
-		-b | -backend)
-			BACKEND="$2"
-			shift; shift ;;
-
-		-c | -clean)
-			CLEAN=yes
-			shift ;;
-
-		-k | -kill)
-			KILLSERVERS=no
-			shift ;;
-		-l | -loop)
-			NUM="`echo $2 | sed 's/[0-9]//g'`"
-			if [ -z "$NUM" ]; then
-				LOOP=$2
-			else
-				echo "Loop variable not an int: $2"
-				echo "$USAGE"; exit 1
-			fi
-			shift ;
-			shift ;;
-
-		-p | -preserve)
-			PRESERVE=yes
-			shift ;;
-
-		-s | -syncmode)
-			case "$2" in
-				ro | rp)
-					SYNCMODE="$2"
-					;;
-				*)
-					echo "unknown sync mode $2"
-					echo "$USAGE"; exit 1
-					;;
-			esac
-			shift; shift ;;
-
-		-u | -userdata)
-			USERDATA=yes
-			shift ;;
-
-		-w | -wait)
-			WAIT=1
-			shift ;;
-
-		-)
-			shift
-			break ;;
-
-		-*)
-			echo "$USAGE"; exit 1
-			;;
-
-		*)
-			break ;;
-	esac
-done
-
-eval `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run`
-export `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run | sed 's/=.*//'`
-
-if test -z "$BACKEND" ; then
-	for b in mdb ; do
-		if eval "test \"\$AC_$b\" != no" ; then
-			BACKEND=$b
-			break
-		fi
-	done
-	if test -z "$BACKEND" ; then
-		echo "No suitable default database backend configured" >&2
-		exit 1
-	fi
-fi
-
-BACKENDTYPE=`eval 'echo $AC_'$BACKEND`
-if test "x$BACKENDTYPE" = "x" ; then
-	BACKENDTYPE="unknown"
-fi
-
-# Backend features.  indexdb: indexing and unchecked limit.
-# maindb: main storage backend.  Currently index,limits,mode,paged results.
-INDEXDB=noindexdb MAINDB=nomaindb
-case $BACKEND in
-	mdb) INDEXDB=indexdb MAINDB=maindb ;;
-	ndb) INDEXDB=indexdb ;;
-esac
-
-export	BACKEND BACKENDTYPE INDEXDB MAINDB \
-	WAIT KILLSERVERS PRESERVE SYNCMODE USERDATA \
-	SRCDIR
-
-if test $# = 0 ; then
-	echo "$USAGE"; exit 1
-fi
-
-# need defines.sh for the definitions of the directories
-. $SRCDIR/scripts/defines.sh
-
-SCRIPTDIR="${TOPDIR}/tests/scripts"
-
-export SCRIPTDIR
-
-SCRIPTNAME="$1"
-shift
-
-if test -x "${SCRIPTDIR}/${SCRIPTNAME}" ; then
-	SCRIPT="${SCRIPTDIR}/${SCRIPTNAME}"
-elif test -x "`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"
-elif test -x "`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"
-else
-	echo "run: ${SCRIPTNAME} not found (or not executable)"
-	exit 1;
-fi
-
-if test ! -r ${DATADIR}/test.ldif ; then
-	${LN_S} ${SRCDIR}/data ${DATADIR}
-fi
-if test ! -r ${SCHEMADIR}/core.schema ; then
-	${LN_S} ${TOPSRCDIR}/servers/slapd/schema ${SCHEMADIR}
-fi
-if test ! -r ./data; then
-	${LN_S} ${TOPDIR}/tests/data ./
-fi
-
-if test -d ${TESTDIR} ; then
-	if test $PRESERVE = no ; then
-		echo "Cleaning up test run directory leftover from previous run."
-		/bin/rm -rf ${TESTDIR}
-	elif test $PRESERVE = yes ; then
-		echo "Cleaning up only database directories leftover from previous run."
-		/bin/rm -rf ${TESTDIR}/db.*
-	fi
-fi
-if test $BACKEND = ndb ; then
-	mysql --user root <<EOF
-	drop database if exists db_1;
-	drop database if exists db_2;
-	drop database if exists db_3;
-	drop database if exists db_4;
-	drop database if exists db_5;
-	drop database if exists db_6;
-EOF
-fi
-mkdir -p ${TESTDIR}
-
-if test $USERDATA = yes ; then
-	if test ! -d userdata ; then
-		echo "User data directory (userdata) does not exist."
-		exit 1
-	fi
-	cp -R userdata/* ${TESTDIR}
-fi
-
-# disable LDAP initialization
-LDAPNOINIT=true; export LDAPNOINIT
-
-echo "Running ${SCRIPT} for ${BACKEND}..."
-while [ $COUNTER -le $LOOP ]; do
-	if [ $LOOP -gt 1 ]; then
-		echo "Running $COUNTER of $LOOP iterations"
-	fi
-	$SCRIPT $*
-	RC=$?
 
-	if test $CLEAN = yes ; then
-		echo "Cleaning up test run directory from this run."
-		/bin/rm -rf ${TESTDIR}
-		echo "Cleaning up symlinks."
-		/bin/rm -f ${DATADIR} ${SCHEMADIR}
-	fi
+TOPSRCDIR="$SRCDIR" OBJDIR="${LDAP_BUILD}" SRCDIR="${SRCDIR}/tests" DEFSDIR="${SRCDIR}/scripts" SCRIPTDIR="${TOPDIR}/tests/scripts" "${LDAP_BUILD}/tests/run" $*
 
-	if [ $RC -ne 0 ]; then
-		if [ $LOOP -gt 1 ]; then
-			echo "Failed after $COUNTER of $LOOP iterations"
-		fi
-		exit $RC
-	else
-		COUNTER=`expr $COUNTER + 1`
-		if [ $COUNTER -le $LOOP ]; then
-			echo "Cleaning up test run directory from this run."
-			/bin/rm -rf ${TESTDIR}
-		fi
-	fi
-done
-exit $RC
diff --git a/contrib/slapd-modules/variant/variant.c b/contrib/slapd-modules/variant/variant.c
index edf4832..cc1c693 100644
--- a/contrib/slapd-modules/variant/variant.c
+++ b/contrib/slapd-modules/variant/variant.c
@@ -282,9 +282,7 @@ variant_op_add( Operation *op, SlapReply *rs )
 	variantEntry_info *vei;
 	int rc;
 
-	/* Replication always uses the rootdn */
-	if ( ov->passReplication && SLAPD_SYNC_IS_SYNCCONN(op->o_connid) &&
-			be_isroot( op ) ) {
+	if ( ov->passReplication && be_shadow_update( op ) ) {
 		return SLAP_CB_CONTINUE;
 	}
 
@@ -431,9 +429,7 @@ variant_op_mod( Operation *op, SlapReply *rs )
 	regmatch_t pmatch[10];
 	int rc, nmatch = sizeof(pmatch) / sizeof(regmatch_t);
 
-	/* Replication always uses the rootdn */
-	if ( ov->passReplication && SLAPD_SYNC_IS_SYNCCONN(op->o_connid) &&
-			be_isroot( op ) ) {
+	if ( ov->passReplication && be_shadow_update( op ) ) {
 		return SLAP_CB_CONTINUE;
 	}
 
@@ -868,6 +864,9 @@ variant_set_dn( ConfigArgs *ca )
 
 		dnMatch( &diff, 0, NULL, NULL, &vei->dn, &vei2->dn );
 		if ( !diff ) {
+			snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+					"duplicate variant dn: %s", ca->value_ndn.bv_val );
+			Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 			ca->reply.err = LDAP_CONSTRAINT_VIOLATION;
 			return ca->reply.err;
 		}
@@ -889,7 +888,11 @@ variant_set_regex( ConfigArgs *ca )
 	} else if ( ca->op == LDAP_MOD_DELETE ) {
 		ber_memfree( vei->dn.bv_val );
 		BER_BVZERO( &vei->dn );
-		regfree( vei->regex );
+		if ( vei->regex ) {
+			regfree( vei->regex );
+			ch_free( vei->regex );
+			vei->regex = NULL;
+		}
 		return LDAP_SUCCESS;
 	}
 
@@ -910,8 +913,9 @@ variant_set_regex( ConfigArgs *ca )
 		if ( vei == vei2 ) continue;
 
 		if ( !ber_bvcmp( &ca->value_bv, &vei2->dn ) ) {
-			ch_free( vei );
-			ca->ca_private = NULL;
+			snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+					"duplicate variant regex: %s", ca->value_dn.bv_val );
+			Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 			ca->reply.err = LDAP_CONSTRAINT_VIOLATION;
 			return ca->reply.err;
 		}
@@ -920,6 +924,10 @@ variant_set_regex( ConfigArgs *ca )
 	vei->regex = ch_calloc( 1, sizeof(regex_t) );
 	if ( regcomp( vei->regex, vei->dn.bv_val, REG_EXTENDED ) ) {
 		ch_free( vei->regex );
+		vei->regex = NULL;
+		snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+				"cannot process regex: %s", vei->dn.bv_val );
+		Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 		ca->reply.err = LDAP_CONSTRAINT_VIOLATION;
 		return ca->reply.err;
 	}
@@ -969,9 +977,10 @@ variant_set_alt_pattern( ConfigArgs *ca )
 		if ( ( ( *p >= '0' ) && ( *p <= '9' ) ) || ( *p == '$' ) ) {
 			p += 1;
 		} else {
-			Debug( LDAP_DEBUG_ANY, "variant_set_alt_pattern: "
-					"invalid replacement pattern supplied '%s'\n",
+			snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+					"invalid replacement pattern supplied '%s'",
 					ca->value_bv.bv_val );
+			Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 			ca->reply.err = LDAP_CONSTRAINT_VIOLATION;
 			return ca->reply.err;
 		}
@@ -1017,6 +1026,9 @@ variant_set_attribute( ConfigArgs *ca )
 	rc = slap_str2ad( s, ad, &text );
 	ber_memfree( ca->value_string );
 	if ( rc ) {
+		snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+				"attribute %s invalid: %s", s, text );
+		Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 		return rc;
 	}
 
@@ -1024,6 +1036,10 @@ variant_set_attribute( ConfigArgs *ca )
 	if ( vai->attr && vai->alternative &&
 			vai->attr->ad_type->sat_syntax !=
 					vai->alternative->ad_type->sat_syntax ) {
+		snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+				"attribute '%s' syntax doesn't match alternative attribute '%s'",
+				vai->attr->ad_cname.bv_val, vai->alternative->ad_cname.bv_val );
+		Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 		ca->reply.err = LDAP_CONSTRAINT_VIOLATION;
 		return ca->reply.err;
 	}
@@ -1033,6 +1049,9 @@ variant_set_attribute( ConfigArgs *ca )
 		LDAP_SLIST_FOREACH( vai2, &vai->variant->attributes, next ) {
 			if ( vai == vai2 ) continue;
 			if ( vai->attr == vai2->attr ) {
+				snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+						"duplicate attribute '%s'", vai->attr->ad_cname.bv_val );
+				Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 				ca->reply.err = LDAP_CONSTRAINT_VIOLATION;
 				return ca->reply.err;
 			}
diff --git a/debian/changelog b/debian/changelog
index 786cdf7..61b5af5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+openldap (2.5.15+dfsg-0ubuntu0.22.04.1) jammy; urgency=medium
+
+  * New upstream version (LP: #2027079).
+    - Several fixes, including to asynchronous connections to the OpenLDAP
+      server.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 11 Jul 2023 15:26:41 -0400
+
 openldap (2.5.14+dfsg-0ubuntu0.22.04.2) jammy; urgency=medium
 
   * Build the passwd/sha2 contrib module with -fno-strict-aliasing to
diff --git a/doc/guide/admin/aspell.en.pws b/doc/guide/admin/aspell.en.pws
index 63d3f0e..67bd346 100644
--- a/doc/guide/admin/aspell.en.pws
+++ b/doc/guide/admin/aspell.en.pws
@@ -680,7 +680,6 @@ affectsMultipleDSAs
 Preprocessor
 lastName
 lldap
-cachesize
 slapauth
 attributeType
 attributetype
diff --git a/doc/guide/admin/guide.html b/doc/guide/admin/guide.html
index b1467fc..5fb51d0 100644
--- a/doc/guide/admin/guide.html
+++ b/doc/guide/admin/guide.html
@@ -23,7 +23,7 @@
 <DIV CLASS="title">
 <H1 CLASS="doc-title">OpenLDAP Software 2.5 Administrator's Guide</H1>
 <ADDRESS CLASS="doc-author">The OpenLDAP Project &lt;<A HREF="https://www.openldap.org/">https://www.openldap.org/</A>&gt;</ADDRESS>
-<ADDRESS CLASS="doc-modified">8 February 2023</ADDRESS>
+<ADDRESS CLASS="doc-modified">10 July 2023</ADDRESS>
 <BR CLEAR="All">
 </DIV>
 <DIV CLASS="contents">
@@ -5732,8 +5732,8 @@ Members of a group
         pcacheTemplate (&amp;(sn=)(givenName=)) 0 3600
         pcacheTemplate (&amp;(departmentNumber=)(secretary=*)) 0 3600
 
-        cachesize 20
         directory ./testrun/db.2.a
+        maxsize   1073741824
         index       objectClass eq
         index       cn,sn,uid,mail  pres,eq,sub
 </PRE>
@@ -5763,7 +5763,7 @@ Members of a group
    objectClass: olcPcacheDatabase
    olcDatabase: {0}mdb
    olcDbDirectory: ./testrun/db.2.a
-   olcDbCacheSize: 20
+   olcDbMaxSize: 1073741824
    olcDbIndex: objectClass eq
    olcDbIndex: cn,sn,uid,mail  pres,eq,sub
 </PRE>
diff --git a/doc/guide/admin/overlays.sdf b/doc/guide/admin/overlays.sdf
index 20e4b93..47cb7b8 100644
--- a/doc/guide/admin/overlays.sdf
+++ b/doc/guide/admin/overlays.sdf
@@ -783,8 +783,8 @@ at server {{EX:ldap.example.com}}.
 >	pcacheTemplate (&(sn=)(givenName=)) 0 3600
 >	pcacheTemplate (&(departmentNumber=)(secretary=*)) 0 3600
 >
->	cachesize 20
 >	directory ./testrun/db.2.a
+>	maxsize   1073741824
 >	index       objectClass eq
 >	index       cn,sn,uid,mail  pres,eq,sub
 
@@ -817,7 +817,7 @@ at server {{EX:ldap.example.com}}.
 >   objectClass: olcPcacheDatabase
 >   olcDatabase: {0}mdb
 >   olcDbDirectory: ./testrun/db.2.a
->   olcDbCacheSize: 20
+>   olcDbMaxSize: 1073741824
 >   olcDbIndex: objectClass eq
 >   olcDbIndex: cn,sn,uid,mail  pres,eq,sub
 
diff --git a/doc/man/man5/lloadd.conf.5 b/doc/man/man5/lloadd.conf.5
index 53f50ba..49c72b9 100644
--- a/doc/man/man5/lloadd.conf.5
+++ b/doc/man/man5/lloadd.conf.5
@@ -824,7 +824,7 @@ The original ETCDIR/lloadd.conf is another example.
 .SH LIMITATIONS
 Support for proxying SASL Binds is limited to the
 .B EXTERNAL
-mechanism (and only to extract the DN of a client TLS cerificate if used during
+mechanism (and only to extract the DN of a client TLS certificate if used during
 the last renegotiation) and mechanisms that rely neither on connection metadata
 (as Kerberos does) nor establish a SASL integrity/confidentialiy layer (again,
 some Kerberos mechanisms,
diff --git a/doc/man/man5/slapd-ldap.5 b/doc/man/man5/slapd-ldap.5
index ffcbe81..a3c46e9 100644
--- a/doc/man/man5/slapd-ldap.5
+++ b/doc/man/man5/slapd-ldap.5
@@ -402,6 +402,7 @@ which defaults to "allow".
 The identity associated to this directive is also used for privileged
 operations whenever \fBidassert\-bind\fP is defined and \fBacl\-bind\fP
 is not.  See \fBacl\-bind\fP for details.
+.RE
 
 .TP
 .B idassert-passthru <authz-regexp>
diff --git a/doc/man/man5/slapo-pcache.5 b/doc/man/man5/slapo-pcache.5
index 1425897..3cfd7f2 100644
--- a/doc/man/man5/slapo-pcache.5
+++ b/doc/man/man5/slapo-pcache.5
@@ -208,7 +208,7 @@ shown here:
 .RS
 .nf
 directory /var/tmp/cache
-cachesize 100
+maxsize   1073741824
 .fi
 .RE
 .LP
diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
index a2409d7..3a81790 100644
--- a/libraries/libldap/init.c
+++ b/libraries/libldap/init.c
@@ -96,9 +96,9 @@ static const struct ol_attribute {
 	{0, ATTR_OPTION,	"URI",			NULL,	LDAP_OPT_URI}, /* replaces HOST/PORT */
 	{0, ATTR_OPTION,	"SOCKET_BIND_ADDRESSES",	NULL,	LDAP_OPT_SOCKET_BIND_ADDRESSES},
 	{0, ATTR_BOOL,		"REFERRALS",	NULL,	LDAP_BOOL_REFERRALS},
-	{0, ATTR_INT,		"KEEPALIVE_IDLE",	NULL,	LDAP_OPT_X_KEEPALIVE_IDLE},
-	{0, ATTR_INT,		"KEEPALIVE_PROBES",	NULL,	LDAP_OPT_X_KEEPALIVE_PROBES},
-	{0, ATTR_INT,		"KEEPALIVE_INTERVAL",	NULL,	LDAP_OPT_X_KEEPALIVE_INTERVAL},
+	{0, ATTR_OPT_INT,	"KEEPALIVE_IDLE",	NULL,	LDAP_OPT_X_KEEPALIVE_IDLE},
+	{0, ATTR_OPT_INT,	"KEEPALIVE_PROBES",	NULL,	LDAP_OPT_X_KEEPALIVE_PROBES},
+	{0, ATTR_OPT_INT,	"KEEPALIVE_INTERVAL",	NULL,	LDAP_OPT_X_KEEPALIVE_INTERVAL},
 
 #if 0
 	/* This should only be allowed via ldap_set_option(3) */
diff --git a/libraries/libldap/open.c b/libraries/libldap/open.c
index afef818..bfdbb25 100644
--- a/libraries/libldap/open.c
+++ b/libraries/libldap/open.c
@@ -501,6 +501,11 @@ ldap_int_open_connection(
 	if( proto == LDAP_PROTO_UDP ) return 0;
 #endif
 
+	if ( async && rc == -2) {
+		/* Need to let the connect complete asynchronously before we continue */
+		return -2;
+	}
+
 #ifdef HAVE_TLS
 	if ((rc == 0 || rc == -2) && ( ld->ld_options.ldo_tls_mode == LDAP_OPT_X_TLS_HARD ||
 		strcmp( srv->lud_scheme, "ldaps" ) == 0 ))
@@ -585,9 +590,9 @@ ldap_open_internal_connection( LDAP **ldp, ber_socket_t *fdp )
 	/* Attach the passed socket as the *LDAP's connection */
 	c = ldap_new_connection( ld, NULL, 1, 0, NULL, 0, 0 );
 	if( c == NULL ) {
+		LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 		ldap_unbind_ext( ld, NULL, NULL );
 		*ldp = NULL;
-		LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 		return( LDAP_NO_MEMORY );
 	}
 	ber_sockbuf_ctrl( c->lconn_sb, LBER_SB_OPT_SET_FD, fdp );
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
index 834d986..d6405bc 100644
--- a/libraries/libldap/tls_o.c
+++ b/libraries/libldap/tls_o.c
@@ -52,6 +52,10 @@
 #define ASN1_STRING_data(x)	ASN1_STRING_get0_data(x)
 #endif
 
+#if OPENSSL_VERSION_MAJOR >= 3
+#define ERR_get_error_line( a, b )	ERR_get_error_all( a, b, NULL, NULL, NULL )
+#define SSL_get_peer_certificate( s )	SSL_get1_peer_certificate( s )
+#endif
 typedef SSL_CTX tlso_ctx;
 typedef SSL tlso_session;
 
@@ -329,7 +333,7 @@ tlso_ctx_cipher13( tlso_ctx *ctx, char *suites )
 				if ( !strncmp( ver, "TLSv", 4 ) && strncmp( ver+4, "1.3", 3 ) >= 0 ) {
 					if ( tls13_suites[0] )
 						ts = tlso_stecpy( ts, ":", te );
-					ts = tlso_stecpy( ts, sname, te );
+					ts = tlso_stecpy( ts, nptr, te );
 				}
 			}
 		}
@@ -523,7 +527,13 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
 	}
 
 	if ( is_server && lo->ldo_tls_dhfile ) {
+#if OPENSSL_VERSION_MAJOR >= 3
+		EVP_PKEY *dh;
+#define	bio_params( bio, dh )	dh = PEM_read_bio_Parameters( bio, &dh )
+#else
 		DH *dh;
+#define	bio_params( bio, dh )	dh = PEM_read_bio_DHparams( bio, NULL, NULL, NULL )
+#endif
 		BIO *bio;
 
 		if (( bio=BIO_new_file( lt->lt_dhfile,"r" )) == NULL ) {
@@ -533,7 +543,7 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
 			tlso_report_error();
 			return -1;
 		}
-		if (!( dh=PEM_read_bio_DHparams( bio, NULL, NULL, NULL ))) {
+		if (!( bio_params( bio, dh ))) {
 			Debug1( LDAP_DEBUG_ANY,
 				"TLS: could not read DH parameters file `%s'.\n",
 				lo->ldo_tls_dhfile );
@@ -542,9 +552,13 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
 			return -1;
 		}
 		BIO_free( bio );
+#if OPENSSL_VERSION_MAJOR >= 3
+		SSL_CTX_set0_tmp_dh_pkey( ctx, dh );
+#else
 		SSL_CTX_set_tmp_dh( ctx, dh );
 		SSL_CTX_set_options( ctx, SSL_OP_SINGLE_DH_USE );
 		DH_free( dh );
+#endif
 	}
 
 	if ( lo->ldo_tls_ecname ) {
diff --git a/libraries/liblmdb/CHANGES b/libraries/liblmdb/CHANGES
index 6ff5d5f..76dd591 100644
--- a/libraries/liblmdb/CHANGES
+++ b/libraries/liblmdb/CHANGES
@@ -1,5 +1,8 @@
 LMDB 0.9 Change Log
 
+LMDB 0.9.31 Release (2023/07/10)
+	ITS#8447 - Fix cursor_put(MDB_CURRENT) on DUPSORT DB with different sized data
+
 LMDB 0.9.30 Release (2023/02/08)
 	ITS#9806 - LMDB page_split: key threshold depends on page size
 	ITS#9916 - avoid gcc optimization bug on sparc64 linux
diff --git a/libraries/liblmdb/lmdb.h b/libraries/liblmdb/lmdb.h
index 5f5d80a..ff03c22 100644
--- a/libraries/liblmdb/lmdb.h
+++ b/libraries/liblmdb/lmdb.h
@@ -200,7 +200,7 @@ typedef int mdb_filehandle_t;
 /** Library minor version */
 #define MDB_VERSION_MINOR	9
 /** Library patch version */
-#define MDB_VERSION_PATCH	30
+#define MDB_VERSION_PATCH	31
 
 /** Combine args a,b,c into a single integer for easy version comparisons */
 #define MDB_VERINT(a,b,c)	(((a) << 24) | ((b) << 16) | (c))
@@ -210,7 +210,7 @@ typedef int mdb_filehandle_t;
 	MDB_VERINT(MDB_VERSION_MAJOR,MDB_VERSION_MINOR,MDB_VERSION_PATCH)
 
 /** The release date of this library version */
-#define MDB_VERSION_DATE	"February 8, 2023"
+#define MDB_VERSION_DATE	"July 10, 2023"
 
 /** A stringifier for the version info */
 #define MDB_VERSTR(a,b,c,d)	"LMDB " #a "." #b "." #c ": (" d ")"
diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index 9315171..deb6779 100644
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -6963,11 +6963,14 @@ current:
 			else if (!(mc->mc_flags & C_SUB))
 				memcpy(olddata.mv_data, data->mv_data, data->mv_size);
 			else {
+				if (key->mv_size != NODEKSZ(leaf))
+					goto new_ksize;
 				memcpy(NODEKEY(leaf), key->mv_data, key->mv_size);
 				goto fix_parent;
 			}
 			return MDB_SUCCESS;
 		}
+new_ksize:
 		mdb_node_del(mc, 0);
 	}
 
diff --git a/libraries/librewrite/ldapmap.c b/libraries/librewrite/ldapmap.c
index 7d0252b..e62cd3a 100644
--- a/libraries/librewrite/ldapmap.c
+++ b/libraries/librewrite/ldapmap.c
@@ -343,6 +343,7 @@ do_bind:;
 			NULL, NULL, NULL );
 		if ( rc == LDAP_SERVER_DOWN && first_try ) {
 			first_try = 0;
+			ldap_unbind_ext( ld, NULL, NULL );
 			if ( ldap_initialize( &ld, data->lm_url ) != LDAP_SUCCESS ) {
 				rc = REWRITE_ERR;
 				goto rc_return;
@@ -360,11 +361,14 @@ do_bind:;
 			data->lm_attrs, 0, NULL, NULL, NULL, 1, &res );
 	if ( rc == LDAP_SERVER_DOWN && first_try ) {
 		first_try = 0;
-                if ( ldap_initialize( &ld, data->lm_url ) != LDAP_SUCCESS ) {
+		ldap_unbind_ext( ld, NULL, NULL );
+		if ( ldap_initialize( &ld, data->lm_url ) != LDAP_SUCCESS ) {
 			rc = REWRITE_ERR;
 			goto rc_return;
 		}
 		set_version = 1;
+		ldap_msgfree( res );
+		res = NULL;
 		goto do_bind;
 
 	} else if ( rc != LDAP_SUCCESS ) {
@@ -373,7 +377,6 @@ do_bind:;
 	}
 
 	if ( ldap_count_entries( ld, res ) != 1 ) {
-		ldap_msgfree( res );
 		rc = REWRITE_ERR;
 		goto rc_return;
 	}
@@ -408,14 +411,14 @@ do_bind:;
 		}
 	}
 	
-	ldap_msgfree( res );
-
 	if ( val->bv_val == NULL ) {
 		rc = REWRITE_ERR;
 		goto rc_return;
 	}
 
 rc_return:;
+	ldap_msgfree( res );
+
 	if ( data->lm_when == MAP_LDAP_EVERYTIME ) {
 		if ( ld != NULL ) {
 			ldap_unbind_ext( ld, NULL, NULL );
diff --git a/servers/slapd/at.c b/servers/slapd/at.c
index 99efba6..353a641 100644
--- a/servers/slapd/at.c
+++ b/servers/slapd/at.c
@@ -952,11 +952,15 @@ error_return:;
 		}
 
 		if ( oidm ) {
+			if ( *err == at->at_oid )
+				*err = oidm;
 			SLAP_FREE( at->at_oid );
 			at->at_oid = oidm;
 		}
 
 		if ( soidm ) {
+			if ( *err == at->at_syntax_oid )
+				*err = soidm;
 			SLAP_FREE( at->at_syntax_oid );
 			at->at_syntax_oid = soidm;
 		}
diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index 52fe6ad..15d4a6a 100644
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -5953,12 +5953,21 @@ config_back_add( Operation *op, SlapReply *rs )
 		}
 	}
 
+	/*
+	 * ITS#10045 Pre-check for abandon but be willing to handle that the
+	 * operation might be abandoned while waiting for the server to pause.
+	 */
 	if ( op->o_abandon ) {
 		rs->sr_err = SLAPD_ABANDON;
+		dopause = 0;
 		goto out;
 	}
 	if ( slap_pause_server() < 0 )
 		dopause = 0;
+	if ( op->o_abandon ) {
+		rs->sr_err = SLAPD_ABANDON;
+		goto out;
+	}
 
 	ldap_pvt_thread_rdwr_wlock( &cfb->cb_rwlock );
 
@@ -6011,10 +6020,11 @@ config_back_add( Operation *op, SlapReply *rs )
 
 out2:;
 	ldap_pvt_thread_rdwr_wunlock( &cfb->cb_rwlock );
+
+out:;
 	if ( dopause )
 		slap_unpause_server();
 
-out:;
 	{	int repl = op->o_dont_replicate;
 		if ( rs->sr_err == LDAP_COMPARE_TRUE ) {
 			rs->sr_text = NULL; /* Set after config_add_internal */
@@ -6490,12 +6500,21 @@ config_back_modify( Operation *op, SlapReply *rs )
 	slap_mods_opattrs( op, &op->orm_modlist, 1 );
 
 	if ( do_pause ) {
+		/*
+		 * ITS#10045 Pre-check for abandon but be willing to handle that the
+		 * operation might be abandoned while waiting for the server to pause.
+		 */
 		if ( op->o_abandon ) {
 			rs->sr_err = SLAPD_ABANDON;
+			do_pause = 0;
 			goto out;
 		}
 		if ( slap_pause_server() < 0 )
 			do_pause = 0;
+		if ( op->o_abandon ) {
+			rs->sr_err = SLAPD_ABANDON;
+			goto out;
+		}
 	}
 	ldap_pvt_thread_rdwr_wlock( &cfb->cb_rwlock );
 
@@ -6530,9 +6549,9 @@ config_back_modify( Operation *op, SlapReply *rs )
 	}
 
 	ldap_pvt_thread_rdwr_wunlock( &cfb->cb_rwlock );
+out:
 	if ( do_pause )
 		slap_unpause_server();
-out:
 	send_ldap_result( op, rs );
 	slap_graduate_commit_csn( op );
 	return rs->sr_err;
@@ -6662,12 +6681,21 @@ config_back_modrdn( Operation *op, SlapReply *rs )
 		goto out;
 	}
 
+	/*
+	 * ITS#10045 Pre-check for abandon but be willing to handle that the
+	 * operation might be abandoned while waiting for the server to pause.
+	 */
 	if ( op->o_abandon ) {
 		rs->sr_err = SLAPD_ABANDON;
+		dopause = 0;
 		goto out;
 	}
 	if ( slap_pause_server() < 0 )
 		dopause = 0;
+	if ( op->o_abandon ) {
+		rs->sr_err = SLAPD_ABANDON;
+		goto out;
+	}
 
 	ldap_pvt_thread_rdwr_wlock( &cfb->cb_rwlock );
 
@@ -6737,9 +6765,9 @@ config_back_modrdn( Operation *op, SlapReply *rs )
 
 	ldap_pvt_thread_rdwr_wunlock( &cfb->cb_rwlock );
 
+out:
 	if ( dopause )
 		slap_unpause_server();
-out:
 	send_ldap_result( op, rs );
 	return rs->sr_err;
 }
@@ -6774,6 +6802,11 @@ config_back_delete( Operation *op, SlapReply *rs )
 
 		ldap_pvt_thread_rdwr_wlock( &cfb->cb_rwlock );
 
+		if ( op->o_abandon ) {
+			rs->sr_err = SLAPD_ABANDON;
+			goto out2;
+		}
+
 		if ( ce->ce_type == Cft_Overlay ){
 			overlay_remove( ce->ce_be, (slap_overinst *)ce->ce_bi, op );
 		} else if ( ce->ce_type == Cft_Misc ) {
diff --git a/servers/slapd/overlays/constraint.c b/servers/slapd/overlays/constraint.c
index 1feff7a..c691f0b 100644
--- a/servers/slapd/overlays/constraint.c
+++ b/servers/slapd/overlays/constraint.c
@@ -816,7 +816,7 @@ constraint_add( Operation *op, SlapReply *rs )
 	int rc = 0;
 	char *msg = NULL;
 
-	if (get_relax(op) || SLAPD_SYNC_IS_SYNCCONN( op->o_connid )) {
+	if ( get_relax(op) || be_shadow_update( op ) ) {
 		return SLAP_CB_CONTINUE;
 	}
 
@@ -958,7 +958,7 @@ constraint_update( Operation *op, SlapReply *rs )
 	char *msg = NULL;
 	int is_v;
 
-	if (get_relax(op) || SLAPD_SYNC_IS_SYNCCONN( op->o_connid )) {
+	if ( get_relax(op) || be_shadow_update( op ) ) {
 		return SLAP_CB_CONTINUE;
 	}
 
diff --git a/servers/slapd/overlays/dynlist.c b/servers/slapd/overlays/dynlist.c
index 89425c7..10cacf9 100644
--- a/servers/slapd/overlays/dynlist.c
+++ b/servers/slapd/overlays/dynlist.c
@@ -99,6 +99,83 @@ ad_infilter( AttributeDescription *ad, Filter *f )
 	return 0;
 }
 
+static Filter *
+transform_filter( Operation *op, dynlist_info_t *dli, int not, Filter *orig )
+{
+	Filter *f;
+	dynlist_map_t *dlm;
+
+	/* Tilt the filter towards TRUE if it could match through this dli */
+	int result = not ? LDAP_COMPARE_FALSE : LDAP_COMPARE_TRUE;
+
+	if ( orig ) {
+		f = orig;
+	} else {
+		f = orig = filter_dup( op->ors_filter, op->o_tmpmemctx );
+	}
+
+	switch( f->f_choice & SLAPD_FILTER_MASK ) {
+	case LDAP_FILTER_EQUALITY:
+	case LDAP_FILTER_GE:
+	case LDAP_FILTER_LE:
+	case LDAP_FILTER_APPROX:
+		for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) {
+			AttributeDescription *ad = dlm->dlm_mapped_ad ? dlm->dlm_mapped_ad : dlm->dlm_member_ad;
+			if ( f->f_av_desc == ad ) {
+				filter_free_x( op, f, 0 );
+				f->f_choice = SLAPD_FILTER_COMPUTED;
+				f->f_result = result;
+				break;
+			}
+		}
+		break;
+	case LDAP_FILTER_PRESENT:
+		for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) {
+			AttributeDescription *ad = dlm->dlm_mapped_ad ? dlm->dlm_mapped_ad : dlm->dlm_member_ad;
+			if ( f->f_sub_desc == ad ) {
+				filter_free_x( op, f, 0 );
+				f->f_choice = SLAPD_FILTER_COMPUTED;
+				f->f_result = result;
+				break;
+			}
+		}
+		break;
+	case LDAP_FILTER_SUBSTRINGS:
+		for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) {
+			AttributeDescription *ad = dlm->dlm_mapped_ad ? dlm->dlm_mapped_ad : dlm->dlm_member_ad;
+			if ( f->f_desc == ad ) {
+				filter_free_x( op, f, 0 );
+				f->f_choice = SLAPD_FILTER_COMPUTED;
+				f->f_result = result;
+				break;
+			}
+		}
+		break;
+	case LDAP_FILTER_EXT:
+		for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) {
+			AttributeDescription *ad = dlm->dlm_mapped_ad ? dlm->dlm_mapped_ad : dlm->dlm_member_ad;
+			if ( f->f_mr_desc == ad ) {
+				filter_free_x( op, f, 0 );
+				f->f_choice = SLAPD_FILTER_COMPUTED;
+				f->f_result = result;
+				break;
+			}
+		}
+		break;
+	case LDAP_FILTER_AND:
+	case LDAP_FILTER_OR:
+		for ( f = f->f_list; f; f = f->f_next )
+			transform_filter( op, dli, not, f );
+		break;
+	case LDAP_FILTER_NOT:
+		transform_filter( op, dli, !not, f->f_list );
+	case SLAPD_FILTER_COMPUTED:
+		break;
+	}
+
+	return orig;
+}
+
 typedef struct dynlist_filterinst_t {
 	AttributeAssertion *df_a;
 	Entry *df_e;
@@ -1790,7 +1867,7 @@ dynlist_search( Operation *op, SlapReply *rs )
 	dynlist_info_t	*dli;
 	Operation o = *op;
 	dynlist_map_t *dlm;
-	Filter f[3];
+	Filter f[4];
 	AttributeAssertion ava[2];
 	AttributeName an[2] = {0};
 
@@ -1908,27 +1985,45 @@ dynlist_search( Operation *op, SlapReply *rs )
 		}
 
 		if ( tmpwant ) {
+			Filter *f_new = NULL;
+
+			if ( tmpwant == WANT_MEMBER ) {
+				/*
+				 * If we only need to list groups, not their members, keep the
+				 * filter, assuming any references to mapped attributes make it
+				 * succeed.
+				 *
+				 * A nested groups search will indicate that it needs both.
+				 */
+				f_new = transform_filter( op, dli, 0, NULL );
+			}
 
 			if ( static_oc ) {
-				f[0].f_choice = LDAP_FILTER_OR;
+				f[0].f_choice = LDAP_FILTER_AND;
 				f[0].f_list = &f[1];
 				f[0].f_next = NULL;
-				f[1].f_choice = LDAP_FILTER_EQUALITY;
-				f[1].f_next = &f[2];
-				f[1].f_ava = &ava[0];
-				f[1].f_av_desc = slap_schema.si_ad_objectClass;
-				f[1].f_av_value = dli->dli_oc->soc_cname;
+				f[1].f_choice = LDAP_FILTER_OR;
+				f[1].f_list = &f[2];
+				f[1].f_next = f_new;
 				f[2].f_choice = LDAP_FILTER_EQUALITY;
-				f[2].f_ava = &ava[1];
+				f[2].f_next = &f[3];
+				f[2].f_ava = &ava[0];
 				f[2].f_av_desc = slap_schema.si_ad_objectClass;
-				f[2].f_av_value = static_oc->soc_cname;
-				f[2].f_next = NULL;
+				f[2].f_av_value = dli->dli_oc->soc_cname;
+				f[3].f_choice = LDAP_FILTER_EQUALITY;
+				f[3].f_ava = &ava[1];
+				f[3].f_av_desc = slap_schema.si_ad_objectClass;
+				f[3].f_av_value = static_oc->soc_cname;
+				f[3].f_next = NULL;
 			} else {
-				f[0].f_choice = LDAP_FILTER_EQUALITY;
-				f[0].f_ava = ava;
-				f[0].f_av_desc = slap_schema.si_ad_objectClass;
-				f[0].f_av_value = dli->dli_oc->soc_cname;
+				f[0].f_choice = LDAP_FILTER_AND;
+				f[0].f_list = &f[1];
 				f[0].f_next = NULL;
+				f[1].f_choice = LDAP_FILTER_EQUALITY;
+				f[1].f_ava = ava;
+				f[1].f_av_desc = slap_schema.si_ad_objectClass;
+				f[1].f_av_value = dli->dli_oc->soc_cname;
+				f[1].f_next = f_new;
 			}
 
 			if ( o.o_callback != sc ) {
@@ -1963,6 +2058,7 @@ dynlist_search( Operation *op, SlapReply *rs )
 			}
 			o.o_tmpfree( o.ors_filterstr.bv_val, o.o_tmpmemctx );
 			o.ors_filterstr.bv_val = NULL;
+			filter_free_x( &o, f_new, 1 );
 			if ( found != ds->ds_found && nested )
 				dynlist_nestlink( op, ds );
 		}
diff --git a/servers/slapd/overlays/pcache.c b/servers/slapd/overlays/pcache.c
index 726eaeb..2b947e4 100644
--- a/servers/slapd/overlays/pcache.c
+++ b/servers/slapd/overlays/pcache.c
@@ -3841,8 +3841,8 @@ pc_cfadd( Operation *op, SlapReply *rs, Entry *p, ConfigArgs *ca )
 
 	/* We can only create this entry if the database is table-driven
 	 */
-	if ( cm->db.bd_info->bi_cf_ocs )
-		config_build_entry( op, rs, pe, ca, &bv, cm->db.bd_info->bi_cf_ocs,
+	if ( cm->db.be_cf_ocs )
+		config_build_entry( op, rs, pe, ca, &bv, cm->db.be_cf_ocs,
 			&pcocs[1] );
 
 	return 0;
diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
index a3f2e70..48b9942 100644
--- a/servers/slapd/overlays/ppolicy.c
+++ b/servers/slapd/overlays/ppolicy.c
@@ -1617,7 +1617,8 @@ ppolicy_bind_response( Operation *op, SlapReply *rs )
 		} else if ( ppb->pp.pwdMinDelay ) {
 			int waittime = ppb->pp.pwdMinDelay << fc;
 			time_t wait_end;
-			struct berval lockout_stamp;
+			char lockout_stamp_buf[ LDAP_LUTIL_GENTIME_BUFSIZE ];
+			struct berval lockout_stamp = BER_BVC(lockout_stamp_buf);
 
 			if ( waittime > ppb->pp.pwdMaxDelay ) {
 				waittime = ppb->pp.pwdMaxDelay;
@@ -2223,7 +2224,7 @@ ppolicy_add(
 		return rs->sr_err;
 
 	/* If this is a replica, assume the provider checked everything */
-	if ( SLAPD_SYNC_IS_SYNCCONN( op->o_connid ) )
+	if ( be_shadow_update( op ) )
 		return SLAP_CB_CONTINUE;
 
 	ppolicy_get( op, op->ora_e, &pp );
@@ -2390,7 +2391,7 @@ ppolicy_modify( Operation *op, SlapReply *rs )
 	/* If this is a replica, we may need to tweak some of the
 	 * provider's modifications. Otherwise, just pass it through.
 	 */
-	if ( SLAPD_SYNC_IS_SYNCCONN( op->o_connid ) ) {
+	if ( be_shadow_update( op ) ) {
 		Modifications **prev;
 		Attribute *a_grace, *a_lock, *a_fail, *a_success;
 
diff --git a/servers/slapd/overlays/syncprov.c b/servers/slapd/overlays/syncprov.c
index 1ff507c..5504c97 100644
--- a/servers/slapd/overlays/syncprov.c
+++ b/servers/slapd/overlays/syncprov.c
@@ -869,6 +869,11 @@ static void free_resinfo( syncres *sr )
 
 #define FS_UNLINK	1
 #define FS_LOCK		2
+#define FS_DEFER	4
+
+#define FSR_NOTFREE	0
+#define FSR_DIDFREE	1
+#define FSR_CANFREE	2
 
 static int
 syncprov_free_syncop( syncops *so, int flags )
@@ -879,12 +884,19 @@ syncprov_free_syncop( syncops *so, int flags )
 	if ( flags & FS_LOCK )
 		ldap_pvt_thread_mutex_lock( &so->s_mutex );
 	/* already being freed, or still in use */
-	if ( !so->s_inuse || --so->s_inuse > 0 ) {
+	if ( !so->s_inuse || so->s_inuse > 1 ) {
 		if ( flags & FS_LOCK )
 			ldap_pvt_thread_mutex_unlock( &so->s_mutex );
-		return 0;
+		if ( !( flags & FS_DEFER ) && so->s_inuse )
+			so->s_inuse--;
+		return FSR_NOTFREE;
 	}
 	ldap_pvt_thread_mutex_unlock( &so->s_mutex );
+
+	/* caller wants to cleanup other stuff before actual free */
+	if ( flags & FS_DEFER )
+		return FSR_CANFREE;
+
 	if (( flags & FS_UNLINK ) && so->s_si ) {
 		syncops **sop;
 		ldap_pvt_thread_mutex_lock( &so->s_si->si_ops_mutex );
@@ -912,7 +924,7 @@ syncprov_free_syncop( syncops *so, int flags )
 	}
 	ldap_pvt_thread_mutex_destroy( &so->s_mutex );
 	ch_free( so );
-	return 1;
+	return FSR_DIDFREE;
 }
 
 /* Send a persistent search response */
@@ -1027,6 +1039,9 @@ syncprov_qplay( Operation *op, syncops *so )
 			} else {
 				rc = syncprov_sendresp( op, sr->s_info, so, sr->s_mode );
 			}
+		} else {
+			/* set rc so we don't do a new qstart */
+			rc = 1;
 		}
 
 		free_resinfo( sr );
@@ -1053,6 +1068,9 @@ syncprov_qplay( Operation *op, syncops *so )
 	return rc;
 }
 
+static int
+syncprov_drop_psearch( syncops *so, int lock );
+
 /* task for playing back queued responses */
 static void *
 syncprov_qtask( void *ctx, void *arg )
@@ -1061,7 +1079,7 @@ syncprov_qtask( void *ctx, void *arg )
 	OperationBuffer opbuf;
 	Operation *op;
 	BackendDB be;
-	int rc;
+	int rc, flag, frc;
 
 	op = &opbuf.ob_op;
 	*op = *so->s_op;
@@ -1090,14 +1108,24 @@ syncprov_qtask( void *ctx, void *arg )
 	if ( !rc && !so->s_res )
 		rc = 1;
 
+	flag = FS_UNLINK;
+	if ( rc && op->o_abandon )
+		flag = FS_DEFER;
+
 	/* decrement use count... */
-	if ( !syncprov_free_syncop( so, FS_UNLINK )) {
+	frc = syncprov_free_syncop( so, flag );
+	if ( frc == FSR_NOTFREE ) {
 		if ( rc )
 			/* if we didn't unlink, and task is no longer queued, clear flag */
 			so->s_flags ^= PS_TASK_QUEUED;
 		ldap_pvt_thread_mutex_unlock( &so->s_mutex );
 	}
 
+	/* if we got abandoned while processing, cleanup now */
+	if ( frc == FSR_CANFREE ) {
+		syncprov_drop_psearch( so, 1 );
+	}
+
 	return NULL;
 }
 
@@ -1272,7 +1300,9 @@ syncprov_op_abandon( Operation *op, SlapReply *rs )
 				return SLAP_CB_CONTINUE;
 			}
 		}
-		syncprov_drop_psearch( so, 0 );
+		/* if task is active, it must drop itself */
+		if ( !( so->s_flags & PS_TASK_QUEUED ))
+			syncprov_drop_psearch( so, 0 );
 	}
 	return SLAP_CB_CONTINUE;
 }
diff --git a/servers/slapd/overlays/translucent.c b/servers/slapd/overlays/translucent.c
index 2d31bb0..09b12dc 100644
--- a/servers/slapd/overlays/translucent.c
+++ b/servers/slapd/overlays/translucent.c
@@ -176,9 +176,9 @@ translucent_cfadd( Operation *op, SlapReply *rs, Entry *e, ConfigArgs *ca )
 
 	/* We can only create this entry if the database is table-driven
 	 */
-	if ( ov->db.bd_info->bi_cf_ocs )
+	if ( ov->db.be_cf_ocs )
 		config_build_entry( op, rs, cei, ca, &bv,
-				    ov->db.bd_info->bi_cf_ocs,
+				    ov->db.be_cf_ocs,
 				    &translucentocs[1] );
 
 	return 0;
diff --git a/servers/slapd/overlays/unique.c b/servers/slapd/overlays/unique.c
index 7a7c8fb..7ff128a 100644
--- a/servers/slapd/overlays/unique.c
+++ b/servers/slapd/overlays/unique.c
@@ -1073,7 +1073,7 @@ unique_add(
 	Debug(LDAP_DEBUG_TRACE, "==> unique_add <%s>\n",
 	      op->o_req_dn.bv_val );
 
-	if ( SLAPD_SYNC_IS_SYNCCONN( op->o_connid ) || (
+	if ( be_shadow_update( op ) || (
 			get_relax(op) > SLAP_CONTROL_IGNORED
 			&& access_allowed( op, op->ora_e,
 				slap_schema.si_ad_entry, NULL,
@@ -1225,7 +1225,7 @@ unique_modify(
 		return rc;
 	}
 
-	if ( SLAPD_SYNC_IS_SYNCCONN( op->o_connid ) ) {
+	if ( be_shadow_update( op ) ) {
 		return rc;
 	}
 	if ( get_relax(op) > SLAP_CONTROL_IGNORED
@@ -1365,7 +1365,7 @@ unique_modrdn(
 	Debug(LDAP_DEBUG_TRACE, "==> unique_modrdn <%s> <%s>\n",
 		op->o_req_dn.bv_val, op->orr_newrdn.bv_val );
 
-	if ( SLAPD_SYNC_IS_SYNCCONN( op->o_connid ) ) {
+	if ( be_shadow_update( op ) ) {
 		return rc;
 	}
 	if ( get_relax(op) > SLAP_CONTROL_IGNORED
diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index eef5b09..b6b1ddb 100644
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -291,6 +291,8 @@ old_good:
 	} else {
 		slap_callback **sc;
 
+		cb.sc_next = op->o_callback;
+
 		op->o_tag = LDAP_REQ_MODIFY;
 		op->o_callback = &cb;
 		op->orm_modlist = qpw->rs_mods;
diff --git a/servers/slapd/pwmods/README.argon2 b/servers/slapd/pwmods/README.argon2
index 595c50d..33c562b 100644
--- a/servers/slapd/pwmods/README.argon2
+++ b/servers/slapd/pwmods/README.argon2
@@ -15,28 +15,16 @@ Both hash the password "secret", the first using the salt "saltsalt", the second
 Building
 --------
 
-1) Customize the OPENLDAP variable in Makefile to point to the OpenLDAP
-source root.
-
-For initial testing you might also want to edit DEFS to define
-SLAPD_ARGON2_DEBUG, which enables logging to stderr (don't leave this on
-in production, as it prints passwords in cleartext).
-
-2) Run 'make' to produce argon2.so
-
-3) Copy argon2.so somewhere permanent.
-
-4) Edit your slapd.conf (eg. /etc/ldap/slapd.conf), and add:
-
-moduleload ...path/to/argon2.so
-
-5) Restart slapd.
-
+This module is now part of regular OpenLDAP build process and enabled if
+libsodium or libargon2 library and the corresponding development headers are
+present. You can also choose the library to build against if you prefer by
+passing --enable-argon2=<libsodium|libargon2> to your configure invocation.
 
 Configuring
 -----------
 
-The {ARGON2} password scheme should now be recognised.
+Load the argon2 module (e.g. with olcModuleLoad or moduleload) and the
+{ARGON2} password scheme should now be recognised.
 
 You can also tell OpenLDAP to use one of this scheme when processing LDAP
 Password Modify Extended Operations, thanks to the password-hash option in
diff --git a/servers/slapd/syncrepl.c b/servers/slapd/syncrepl.c
index 5fceb63..3b02a3b 100644
--- a/servers/slapd/syncrepl.c
+++ b/servers/slapd/syncrepl.c
@@ -604,8 +604,10 @@ ldap_sync_search(
 			lattrs[2] = NULL;
 			rc = ldap_search_ext_s( si->si_ld, "", LDAP_SCOPE_BASE, generic_filterstr.bv_val, lattrs, 0,
 				NULL, NULL, NULL, si->si_slimit, &res );
-			if ( rc )
+			if ( rc ) {
+				ldap_msgfree( res );
 				return rc;
+			}
 			msg = ldap_first_message( si->si_ld, res );
 			if ( msg && ldap_msgtype( msg ) == LDAP_RES_SEARCH_ENTRY ) {
 				BerElement *ber = NULL;
diff --git a/servers/slapd/syslog.c b/servers/slapd/syslog.c
index 47ea1c6..50f3053 100644
--- a/servers/slapd/syslog.c
+++ b/servers/slapd/syslog.c
@@ -209,7 +209,7 @@ openlog(const char *ident, int logstat, int logfac)
 }
 
 void
-closelog()
+closelog(void)
 {
 	(void)close(LogFile);
 	LogFile = -1;
diff --git a/tests/progs/slapd-mtread.c b/tests/progs/slapd-mtread.c
index 587d3cf..bf6014a 100644
--- a/tests/progs/slapd-mtread.c
+++ b/tests/progs/slapd-mtread.c
@@ -528,6 +528,7 @@ do_random( LDAP *ld,
 			if ( rc ) {
 				tester_ldap_error( ld, "ldap_search_ext_s", NULL );
 			}
+			ldap_msgfree( res );
 			break;
 		}
 
@@ -566,6 +567,7 @@ do_random( LDAP *ld,
 
 	default:
 		tester_ldap_error( ld, "ldap_search_ext_s", NULL );
+		ldap_msgfree( res );
 		break;
 	}
 
diff --git a/tests/progs/slapd-search.c b/tests/progs/slapd-search.c
index 13a2818..f849199 100644
--- a/tests/progs/slapd-search.c
+++ b/tests/progs/slapd-search.c
@@ -214,6 +214,7 @@ do_random( struct tester_conn_args *config,
 			if ( rc ) {
 				tester_ldap_error( ld, "ldap_search_ext_s", NULL );
 			}
+			ldap_msgfree( res );
 			break;
 		}
 
@@ -270,6 +271,7 @@ do_random( struct tester_conn_args *config,
 
 	default:
 		tester_ldap_error( ld, "ldap_search_ext_s", NULL );
+		ldap_msgfree( res );
 		break;
 	}
 
diff --git a/tests/progs/slapd-watcher.c b/tests/progs/slapd-watcher.c
index 0fed11f..3c315d7 100644
--- a/tests/progs/slapd-watcher.c
+++ b/tests/progs/slapd-watcher.c
@@ -537,7 +537,6 @@ setup_server( struct tester_conn_args *config, server *sv, int first )
 						}
 					}
 				}
-				ldap_msgfree( res );
 				break;
 
 			default:
@@ -545,6 +544,7 @@ setup_server( struct tester_conn_args *config, server *sv, int first )
 				if ( first )
 					exit( EXIT_FAILURE );
 			}
+			ldap_msgfree( res );
 		}
 	}
 
diff --git a/tests/scripts/lloadd/test001-backend-issues b/tests/scripts/lloadd/test001-backend-issues
index 9b0b0b2..b7f99fc 100755
--- a/tests/scripts/lloadd/test001-backend-issues
+++ b/tests/scripts/lloadd/test001-backend-issues
@@ -55,6 +55,7 @@ $SLAPADD -f $CONF3 -l $LDIFORDERED
 RC=$?
 if test $RC != 0 ; then
     echo "slapadd failed ($RC)!"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
     exit $RC
 fi
 
diff --git a/tests/scripts/lloadd/test002-load b/tests/scripts/lloadd/test002-load
index 942f6bc..2de04d6 100755
--- a/tests/scripts/lloadd/test002-load
+++ b/tests/scripts/lloadd/test002-load
@@ -74,6 +74,7 @@ $SLAPADD -f $CONF3 -l $LDIFORDERED
 RC=$?
 if test $RC != 0 ; then
     echo "slapadd failed ($RC)!"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
     exit $RC
 fi
 
diff --git a/tests/scripts/lloadd/test003-cnconfig b/tests/scripts/lloadd/test003-cnconfig
index edf5801..b578b96 100755
--- a/tests/scripts/lloadd/test003-cnconfig
+++ b/tests/scripts/lloadd/test003-cnconfig
@@ -75,6 +75,7 @@ $SLAPADD -f $CONF3 -l $LDIFORDERED
 RC=$?
 if test $RC != 0 ; then
     echo "slapadd failed ($RC)!"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
     exit $RC
 fi
 
diff --git a/tests/scripts/lloadd/test004-monitor b/tests/scripts/lloadd/test004-monitor
index d1db7c1..5fe9276 100755
--- a/tests/scripts/lloadd/test004-monitor
+++ b/tests/scripts/lloadd/test004-monitor
@@ -87,6 +87,7 @@ $SLAPADD -f $CONF3 -l $LDIFORDERED
 RC=$?
 if test $RC != 0 ; then
     echo "slapadd failed ($RC)!"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
     exit $RC
 fi
 
diff --git a/tests/scripts/test049-sync-config b/tests/scripts/test049-sync-config
index 88a57b9..b05e041 100755
--- a/tests/scripts/test049-sync-config
+++ b/tests/scripts/test049-sync-config
@@ -61,6 +61,12 @@ esac
 echo "Starting provider slapd on TCP/IP port $PORT1..."
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CFPRO -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 cd $PRODIR
 $SLAPD -F ./slapd.d -h $URI1 -d $LVL > $LOG1 2>&1 &
 PID=$!
@@ -134,6 +140,13 @@ fi
 
 echo "Starting consumer slapd on TCP/IP port $PORT2..."
 $SLAPADD -F $CFCON -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
 cd $CONDIR
 $SLAPD -F ./slapd.d -h $URI2 -d $LVL > $LOG2 2>&1 &
 CONSUMERPID=$!
diff --git a/tests/scripts/test050-syncrepl-multiprovider b/tests/scripts/test050-syncrepl-multiprovider
index d32ae66..065c86a 100755
--- a/tests/scripts/test050-syncrepl-multiprovider
+++ b/tests/scripts/test050-syncrepl-multiprovider
@@ -79,6 +79,11 @@ objectClass: olcDatabaseConfig
 olcDatabase: {0}config
 olcRootPW:< file://$CONFIGPWF
 EOF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 n=`expr $n + 1`
 done
diff --git a/tests/scripts/test053-syncprov-glue b/tests/scripts/test053-syncprov-glue
index a75a318..3caa0d4 100755
--- a/tests/scripts/test053-syncprov-glue
+++ b/tests/scripts/test053-syncprov-glue
@@ -74,6 +74,11 @@ olcDatabase: {0}config
 olcRootPW:< file://$CONFIGPWF
 
 EOF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 echo "Initializing provider2 configurations..."
 $SLAPADD -F $CFPRO2 -n 0 <<EOF
@@ -87,6 +92,11 @@ olcDatabase: {0}config
 olcRootPW:< file://$CONFIGPWF
 
 EOF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 $SLAPADD -F $CFCONS -n 0 <<EOF
 dn: cn=config
@@ -98,6 +108,11 @@ objectClass: olcDatabaseConfig
 olcDatabase: {0}config
 olcRootPW:< file://$CONFIGPWF
 EOF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 echo "Starting provider slapd on TCP/IP port $PORT1..."
 cd $PRODDIR
diff --git a/tests/scripts/test058-syncrepl-asymmetric b/tests/scripts/test058-syncrepl-asymmetric
index 22015a7..f950761 100755
--- a/tests/scripts/test058-syncrepl-asymmetric
+++ b/tests/scripts/test058-syncrepl-asymmetric
@@ -175,6 +175,12 @@ olcDatabase: {0}config
 olcRootPW:< file://$CONFIGPWF
 
 EOF
+	RC=$?
+	if test $RC != 0 ; then
+		echo "slapadd failed ($RC)!"
+		exit $RC
+	fi
+
 	ID=`expr $ID + 1`
 done
 
@@ -191,6 +197,12 @@ olcDatabase: {0}config
 olcRootPW:< file://$CONFIGPWF
 
 EOF
+
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 done
 
 echo "Starting central provider slapd on TCP/IP port $PORT1..."
diff --git a/tests/scripts/test059-consumer-config b/tests/scripts/test059-consumer-config
index 56848db..30e87e4 100755
--- a/tests/scripts/test059-consumer-config
+++ b/tests/scripts/test059-consumer-config
@@ -57,6 +57,12 @@ esac
 echo "Starting provider slapd on TCP/IP port $PORT1..."
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CFPRO -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 $SLAPD -F $CFPRO -h $URI1 -d $LVL > $LOG1 2>&1 &
 PID=$!
 if test $WAIT != 0 ; then
@@ -182,6 +188,13 @@ fi
 
 echo "Starting consumer slapd on TCP/IP port $PORT2..."
 $SLAPADD -F $CFCON -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
 $SLAPD -F $CFCON -h $URI2 -d $LVL > $LOG2 2>&1 &
 CONSUMERPID=$!
 if test $WAIT != 0 ; then
diff --git a/tests/scripts/test061-syncreplication-initiation b/tests/scripts/test061-syncreplication-initiation
index a8ce51c..3e3b973 100755
--- a/tests/scripts/test061-syncreplication-initiation
+++ b/tests/scripts/test061-syncreplication-initiation
@@ -82,6 +82,12 @@ olcDatabase: {0}config
 olcRootPW:< file://$CONFIGPWF
 
 EOF
+
+	RC=$?
+	if test $RC != 0 ; then
+		echo "slapadd failed ($RC)!"
+		exit $RC
+	fi
 done
 
 echo "Starting provider slapd on $PROV_URI"
diff --git a/tests/scripts/test062-config-delete b/tests/scripts/test062-config-delete
index dde8acd..afb87c4 100755
--- a/tests/scripts/test062-config-delete
+++ b/tests/scripts/test062-config-delete
@@ -39,6 +39,12 @@ $SLAPPASSWD -g -n >$CONFIGPWF
 echo "Starting slapd on TCP/IP port $PORT1... $PWD"
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CONFDIR -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 cd $TESTDIR
 $SLAPD -F ./slapd.d -h $URI1 -d $LVL > $LOG1 2>&1 &
 PID=$!
diff --git a/tests/scripts/test063-delta-multiprovider b/tests/scripts/test063-delta-multiprovider
index df4bdd1..8ce5906 100755
--- a/tests/scripts/test063-delta-multiprovider
+++ b/tests/scripts/test063-delta-multiprovider
@@ -214,6 +214,12 @@ olcDatabase: {3}monitor
 EOF
 
 $SLAPADD -F $CFDIR -n 0  -d-1< $TMP > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 PORT=`eval echo '$PORT'$n`
 echo "Starting server $n on TCP/IP port $PORT..."
 cd ${XDIR}${n}
diff --git a/tests/scripts/test064-constraint b/tests/scripts/test064-constraint
index c263cf9..5519123 100755
--- a/tests/scripts/test064-constraint
+++ b/tests/scripts/test064-constraint
@@ -120,6 +120,11 @@ olcConstraintAttribute: uid
 EOF
 
 $SLAPADD -F $CONFDIR -n 0 -l $TESTDIR/config.ldif
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 echo "Starting slapd on TCP/IP port $PORT1..."
 $SLAPD -F $CONFDIR -h $URI1 -d $LVL > $LOG1 2>&1 &
diff --git a/tests/scripts/test066-autoca b/tests/scripts/test066-autoca
index fd23140..dd8b502 100755
--- a/tests/scripts/test066-autoca
+++ b/tests/scripts/test066-autoca
@@ -47,6 +47,12 @@ $SLAPPASSWD -g -n >$CONFIGPWF
 echo "Starting slapd on TCP/IP port $PORT1..."
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CFDIR -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 $SLAPD -F $CFDIR -h $URIP1 -d $LVL > $LOG1 2>&1 &
 PID=$!
 if test $WAIT != 0 ; then
diff --git a/tests/scripts/test069-delta-multiprovider-starttls b/tests/scripts/test069-delta-multiprovider-starttls
index 2f5a0d3..277c0a7 100755
--- a/tests/scripts/test069-delta-multiprovider-starttls
+++ b/tests/scripts/test069-delta-multiprovider-starttls
@@ -195,7 +195,14 @@ olcAccessLogOps: writes
 olcAccessLogSuccess: TRUE
 
 EOF
+
 $SLAPADD -F $CFDIR -n 0  -d-1< $TMP > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 PORT=`eval echo '$PORT'$n`
 echo "Starting server $n on TCP/IP port $PORT..."
 cd ${XDIR}${n}
diff --git a/tests/scripts/test070-delta-multiprovider-ldaps b/tests/scripts/test070-delta-multiprovider-ldaps
index 18869d1..3fb96cc 100755
--- a/tests/scripts/test070-delta-multiprovider-ldaps
+++ b/tests/scripts/test070-delta-multiprovider-ldaps
@@ -195,6 +195,12 @@ olcAccessLogSuccess: TRUE
 
 EOF
 $SLAPADD -F $CFDIR -n 0  -d-1< $TMP > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 PORT=`eval echo '$PORT'$n`
 echo "Starting server $n on TCP/IP port $PORT..."
 cd ${XDIR}${n}
diff --git a/tests/scripts/test071-dirsync b/tests/scripts/test071-dirsync
index 9f5aede..455629b 100755
--- a/tests/scripts/test071-dirsync
+++ b/tests/scripts/test071-dirsync
@@ -88,6 +88,13 @@ objectclass: dcObject
 o: OpenLDAP Testing
 
 EOMODS
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
 $SLAPD -f $CONF2 -h $URI2 -d $LVL > $LOG2 2>&1 &
 CONSUMERPID=$!
 if test $WAIT != 0 ; then
diff --git a/tests/scripts/test076-authid-rewrite b/tests/scripts/test076-authid-rewrite
index 7799d88..383e4c3 100755
--- a/tests/scripts/test076-authid-rewrite
+++ b/tests/scripts/test076-authid-rewrite
@@ -31,6 +31,12 @@ $SLAPPASSWD -g -n >$CONFIGPWF
 echo "Starting slapd on TCP/IP port $PORT1... $PWD"
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CONFDIR -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 cd $TESTDIR
 $SLAPD -F ./slapd.d -h $URI1 -d $LVL > $LOG1 2>&1 &
 PID=$!
diff --git a/tests/scripts/test078-persistent-sessionlog b/tests/scripts/test078-persistent-sessionlog
index acb8fad..8f3d07f 100755
--- a/tests/scripts/test078-persistent-sessionlog
+++ b/tests/scripts/test078-persistent-sessionlog
@@ -185,6 +185,12 @@ olcAccessLogSuccess: TRUE
 
 EOF
 $SLAPADD -F $CFDIR -n 0  -d-1< $TMP > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 PORT=`eval echo '$PORT'$n`
 echo "Starting server $n on TCP/IP port $PORT..."
 cd ${XDIR}${n}
diff --git a/tests/scripts/test083-argon2 b/tests/scripts/test083-argon2
index 9700f1a..01803b3 100755
--- a/tests/scripts/test083-argon2
+++ b/tests/scripts/test083-argon2
@@ -97,6 +97,11 @@ EOF
 fi
 
 $SLAPADD -F $CONFDIR -n 0 -l $TESTDIR/config.ldif
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 echo "Starting slapd on TCP/IP port $PORT1..."
 $SLAPD -F $CONFDIR -h $URI1 -d $LVL > $LOG1 2>&1 &
diff --git a/tests/scripts/test086-delta-consumer-config b/tests/scripts/test086-delta-consumer-config
index b8f08cf..d89af3f 100755
--- a/tests/scripts/test086-delta-consumer-config
+++ b/tests/scripts/test086-delta-consumer-config
@@ -61,6 +61,12 @@ esac
 echo "Starting provider slapd on TCP/IP port $PORT1..."
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CFPRO -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 $SLAPD -F $CFPRO -h $URI1 -d $LVL > $LOG1 2>&1 &
 PID=$!
 if test $WAIT != 0 ; then
@@ -324,6 +330,13 @@ fi
 
 echo "Starting consumer slapd on TCP/IP port $PORT2..."
 $SLAPADD -F $CFCON -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
 $SLAPD -F $CFCON -h $URI2 -d $LVL > $LOG2 2>&1 &
 CONSUMERPID=$!
 if test $WAIT != 0 ; then