Merge ~sergiodj/ubuntu/+source/openldap:MRE-2.5.17-jammy into ubuntu/+source/openldap:ubuntu/jammy-devel

[Sergio Durigan Junior]

This is the MRE of OpenLDAP 2.5.17 to Jammy.

Nothing major to report here. Instead of trying to decide for a small set of upstream changes to list on d/changelog, I'm now listing everything.

PPA: https://launchpad.net/~sergiodj/+archive/ubuntu/openldap

dep8 results will be posted soon.

[Bryce Harrington (bryce)]

LGTM, +1, presuming the autopkgtests pass.

I like the more detailed changelog personally, and if it saves some thinking time not to have to filter it, then that's a bonus.

I skimmed briefly through the upstream diff, nothing caught my eye. A healthy chunk of it is debug messaging, which is a good sign. There's an `mplay` command being added although that appears just for analysis/debugging (I can't tell if it gets installed but am guessing no.) The remainder does indeed look like bugfixes.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: sergiodj, bryce
Uploaders: sergiodj, bryce
MP auto-approved

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Friday, February 09 2024, Bryce Harrington wrote:

> LGTM, +1, presuming the autopkgtests pass.

Thanks, Bryce.

I just got the results:

Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-sergiodj-openldap/?format=plain)
  openldap @ amd64:
    http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-sergiodj-openldap/jammy/amd64/o/openldap/20240209_225823_2ec27@/log.gz
    09.02.24 22:58:23 ✅ Triggers: openldap/2.5.17+dfsg-0ubuntu0.22.04.1~ppa1
  openldap @ arm64:
    http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-sergiodj-openldap/jammy/arm64/o/openldap/20240209_230358_34851@/log.gz
    09.02.24 23:03:58 ✅ Triggers: openldap/2.5.17+dfsg-0ubuntu0.22.04.1~ppa1
  openldap @ armhf:
    http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-sergiodj-openldap/jammy/armhf/o/openldap/20240209_230114_34851@/log.gz
    09.02.24 23:01:14 ✅ Triggers: openldap/2.5.17+dfsg-0ubuntu0.22.04.1~ppa1
  openldap @ ppc64el:
    http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-sergiodj-openldap/jammy/ppc64el/o/openldap/20240209_231213_2ec27@/log.gz
    09.02.24 23:12:13 ✅ Triggers: openldap/2.5.17+dfsg-0ubuntu0.22.04.1~ppa1
  openldap @ s390x:
    http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-sergiodj-openldap/jammy/s390x/o/openldap/20240209_225840_2ec27@/log.gz
    09.02.24 22:58:40 ✅ Triggers: openldap/2.5.17+dfsg-0ubuntu0.22.04.1~ppa1

Therefore, I'm uploading the package now:

$ dput openldap_2.5.17+dfsg-0ubuntu0.22.04.1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/openldap/openldap_2.5.17+dfsg-0ubuntu0.22.04.1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/openldap/openldap_2.5.17+dfsg-0ubuntu0.22.04.1.dsc: Valid signature from 106DA1C8C3CBBF14
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openldap_2.5.17+dfsg-0ubuntu0.22.04.1.dsc: done.
  Uploading openldap_2.5.17+dfsg.orig.tar.gz: done.
  Uploading openldap_2.5.17+dfsg-0ubuntu0.22.04.1.debian.tar.xz: done.
  Uploading openldap_2.5.17+dfsg-0ubuntu0.22.04.1_source.buildinfo: done.
  Uploading openldap_2.5.17+dfsg-0ubuntu0.22.04.1_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

diff --git a/CHANGES b/CHANGES
index 23c0e5e..8b691f0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,37 @@
 OpenLDAP 2.5 Change Log
 
+OpenLDAP 2.5.17 Release (2024/01/29)
+	Added slapo-dynlist option to disable filter support (ITS#10025)
+	Fixed liblber missing newline on long msg (ITS#10105)
+	Fixed libldap exit handling with OpenSSL3 (ITS#9952)
+	Fixed libldap with TLS and multiple ldap URIs (ITS#10101)
+	Fixed libldap OpenSSL cipher suite handling (ITS#10094)
+	Fixed libldap OpenSSL 3.0 and Diffie-Hellman param files (ITS#10124)
+	Fixed libldap timestamps on Windows (ITS#10100)
+	Fixed lloadd to work when resolv.conf is missing (ITS#10070)
+	Fixed lloadd handling of closing connection (ITS#10083)
+	Fixed slapd to honour disclose in matchedDN handling (ITS#10139)
+	Fixed slapd handling of regex testing in ACLs (ITS#10089)
+	Fixed slapd-asyncmeta when remote suffix is empty (ITS#10076)
+	Fixed slapo-dynlist so it can't be global (ITS#10091)
+	Build
+		Fixed lloadd type mismatches (ITS#10074)
+		Fixed builds for Windows (ITS#10117)
+		Fixed build with clang16 (ITS#10123
+	Documentation
+		Fixed slapo-homedir(5) attribute name for olcHomedirArchivePath (ITS#10057)
+	Minor Cleanup
+		ITS#10059
+		ITS#10068
+		ITS#10109
+		ITS#10110
+		ITS#10129
+		ITS#10130
+		ITS#10135
+		ITS#10144
+		ITS#10145
+		ITS#10153
+
 OpenLDAP 2.5.16 Release (2023/07/31)
 	Fixed slapd cn=config incorrect handling of paused (ITS#10045)
 	Fixed slapd-meta to account for MOD ops being optional (ITS#10067)
diff --git a/build/version.var b/build/version.var
index cd4e7aa..e2d54d0 100644
--- a/build/version.var
+++ b/build/version.var
@@ -15,9 +15,9 @@
 ol_package=OpenLDAP
 ol_major=2
 ol_minor=5
-ol_patch=16
-ol_api_inc=20516
+ol_patch=17
+ol_api_inc=20517
 ol_api_current=1
-ol_api_revision=11
+ol_api_revision=12
 ol_api_age=1
-ol_release_date="2023/07/31"
+ol_release_date="2024/01/29"
diff --git a/clients/tools/common.c b/clients/tools/common.c
index b88f219..9dfbb53 100644
--- a/clients/tools/common.c
+++ b/clients/tools/common.c
@@ -1472,10 +1472,11 @@ tool_bind( LDAP *ld )
 
 		} else {
 			char *pw = getpassphrase( _("Enter LDAP Password: ") );
-			if ( pw ) {
-				passwd.bv_val = ber_strdup( pw );
-				passwd.bv_len = strlen( passwd.bv_val );
+			if ( pw == NULL ) { /* Allow EOF to exit. */
+				tool_exit( ld, EXIT_FAILURE );
 			}
+			passwd.bv_val = ber_strdup( pw );
+			passwd.bv_len = strlen( passwd.bv_val );
 		}
 	}
 
diff --git a/clients/tools/ldappasswd.c b/clients/tools/ldappasswd.c
index 2cf14d1..036e5e1 100644
--- a/clients/tools/ldappasswd.c
+++ b/clients/tools/ldappasswd.c
@@ -206,7 +206,12 @@ main( int argc, char *argv[] )
 	if( want_oldpw && oldpw.bv_val == NULL ) {
 		/* prompt for old password */
 		char *ckoldpw;
-		oldpw.bv_val = strdup(getpassphrase(_("Old password: ")));
+		ckoldpw = getpassphrase(_("Old password: "));
+		if ( ckoldpw == NULL ) { /* Allow EOF to exit. */
+			rc = EXIT_FAILURE;
+			goto done;
+		}
+		oldpw.bv_val = strdup( ckoldpw );
 		ckoldpw = getpassphrase(_("Re-enter old password: "));
 
 		if( oldpw.bv_val == NULL || ckoldpw == NULL ||
@@ -231,7 +236,12 @@ main( int argc, char *argv[] )
 	if( want_newpw && newpw.bv_val == NULL ) {
 		/* prompt for new password */
 		char *cknewpw;
-		newpw.bv_val = strdup(getpassphrase(_("New password: ")));
+		cknewpw = getpassphrase(_("New password: "));
+		if ( cknewpw == NULL ) { /* Allow EOF to exit. */
+			rc = EXIT_FAILURE;
+			goto done;
+		}
+		newpw.bv_val = strdup( cknewpw );
 		cknewpw = getpassphrase(_("Re-enter new password: "));
 
 		if( newpw.bv_val == NULL || cknewpw == NULL ||
diff --git a/clients/tools/ldapvc.c b/clients/tools/ldapvc.c
index 4f35025..264f293 100644
--- a/clients/tools/ldapvc.c
+++ b/clients/tools/ldapvc.c
@@ -309,8 +309,13 @@ main( int argc, char *argv[] )
 #endif
            && !cred.bv_val)
 	{
-		cred.bv_val = strdup(getpassphrase(_("User's password: ")));
-	    cred.bv_len = strlen(cred.bv_val);
+		char *userpw = getpassphrase(_("User's password: "));
+		if ( userpw == NULL ) /* Allow EOF to exit. */
+		{
+			tool_exit( ld, EXIT_FAILURE );
+		}
+		cred.bv_val = strdup(userpw);
+		cred.bv_len = strlen(cred.bv_val);
 	}
 
 #ifdef LDAP_API_FEATURE_VERIFY_CREDENTIALS_INTERACTIVE
diff --git a/contrib/slapd-modules/lastmod/lastmod.c b/contrib/slapd-modules/lastmod/lastmod.c
index 116b9ae..b329ef7 100644
--- a/contrib/slapd-modules/lastmod/lastmod.c
+++ b/contrib/slapd-modules/lastmod/lastmod.c
@@ -372,7 +372,7 @@ best_guess( Operation *op,
 	
 		entryCSN.bv_val = csnbuf;
 		entryCSN.bv_len = sizeof( csnbuf );
-		slap_get_csn( NULL, &entryCSN, 0 );
+		slap_get_csn( op, &entryCSN, 0 );
 
 		ber_dupbv( bv_entryCSN, &entryCSN );
 		ber_dupbv( bv_nentryCSN, &entryCSN );
@@ -833,6 +833,11 @@ lastmod_db_open( BackendDB *be, ConfigReply *cr )
 	static char		tmbuf[ LDAP_LUTIL_GENTIME_BUFSIZE ];
 
 	char			csnbuf[ LDAP_PVT_CSNSTR_BUFSIZE ];
+	void			*thrctx = ldap_pvt_thread_pool_context();
+	Connection		conn = { 0 };
+	OperationBuffer		opbuf;
+	Operation		*op;
+
 	struct berval		entryCSN;
 	struct berval timestamp;
 
@@ -841,6 +846,9 @@ lastmod_db_open( BackendDB *be, ConfigReply *cr )
 		return -1;
 	}
 
+	connection_fake_init2( &conn, &opbuf, thrctx, 0 );
+	op = &opbuf.ob_op;
+
 	/*
 	 * Start
 	 */
@@ -850,7 +858,7 @@ lastmod_db_open( BackendDB *be, ConfigReply *cr )
 
 	entryCSN.bv_val = csnbuf;
 	entryCSN.bv_len = sizeof( csnbuf );
-	slap_get_csn( NULL, &entryCSN, 0 );
+	slap_get_csn( op, &entryCSN, 0 );
 
 	if ( BER_BVISNULL( &lmi->lmi_rdnvalue ) ) {
 		ber_str2bv( "Lastmod", 0, 1, &lmi->lmi_rdnvalue );
diff --git a/debian/changelog b/debian/changelog
index 96e71ea..5b5eb53 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,22 @@
+openldap (2.5.17+dfsg-0ubuntu0.22.04.1) jammy; urgency=medium
+
+  * New upstream version (LP: #2040465).
+    - Added slapo-dynlist option to disable filter support (ITS#10025)
+    - Fixed liblber missing newline on long msg (ITS#10105)
+    - Fixed libldap exit handling with OpenSSL3 (ITS#9952)
+    - Fixed libldap with TLS and multiple ldap URIs (ITS#10101)
+    - Fixed libldap OpenSSL cipher suite handling (ITS#10094)
+    - Fixed libldap OpenSSL 3.0 and Diffie-Hellman param files (ITS#10124)
+    - Fixed libldap timestamps on Windows (ITS#10100)
+    - Fixed lloadd to work when resolv.conf is missing (ITS#10070)
+    - Fixed lloadd handling of closing connection (ITS#10083)
+    - Fixed slapd to honour disclose in matchedDN handling (ITS#10139)
+    - Fixed slapd handling of regex testing in ACLs (ITS#10089)
+    - Fixed slapd-asyncmeta when remote suffix is empty (ITS#10076)
+    - Fixed slapo-dynlist so it can't be global (ITS#10091)
+
+ -- Sergio Durigan Junior <[e-mail]>  Fri, 09 Feb 2024 15:12:07 -0500
+
 openldap (2.5.16+dfsg-0ubuntu0.22.04.2) jammy-security; urgency=medium
 
   * No change rebuild to fix CVE-2023-2953 in the -security pocket.
diff --git a/doc/guide/admin/guide.html b/doc/guide/admin/guide.html
index 679b61e..dc31ac2 100644
--- a/doc/guide/admin/guide.html
+++ b/doc/guide/admin/guide.html
@@ -23,7 +23,7 @@
 <DIV CLASS="title">
 <H1 CLASS="doc-title">OpenLDAP Software 2.5 Administrator's Guide</H1>
 <ADDRESS CLASS="doc-author">The OpenLDAP Project &lt;<A HREF="https://www.openldap.org/">https://www.openldap.org/</A>&gt;</ADDRESS>
-<ADDRESS CLASS="doc-modified">31 July 2023</ADDRESS>
+<ADDRESS CLASS="doc-modified">29 January 2024</ADDRESS>
 <BR CLEAR="All">
 </DIV>
 <DIV CLASS="contents">
diff --git a/doc/man/man5/lloadd.conf.5 b/doc/man/man5/lloadd.conf.5
index 49c72b9..50269b3 100644
--- a/doc/man/man5/lloadd.conf.5
+++ b/doc/man/man5/lloadd.conf.5
@@ -598,7 +598,16 @@ option. The authentication configuration is shared between them.
 .B [secprops=<properties>]
 .B [timeout=<seconds>]
 .B [network\-timeout=<seconds>]
+.B [keepalive=<idle>:<probes>:<interval>]
 .B [tcp\-user\-timeout=<milliseconds>]
+.B [tls_cert=<file>]
+.B [tls_key=<file>]
+.B [tls_cacert=<file>]
+.B [tls_cacertdir=<path>]
+.B [tls_reqcert=never|allow|try|demand]
+.B [tls_cipher_suite=<ciphers>]
+.B [tls_crlcheck=none|peer|all]
+.B [tls_protocol_min=<major>[.<minor>]]
 
 Specifies the bind credentials
 .B lloadd
@@ -658,6 +667,23 @@ Timeout set to 0 means no timeout is in effect and by default, no timeouts are
 in effect.
 
 The
+.B keepalive
+parameter sets the values of \fIidle\fP, \fIprobes\fP, and \fIinterval\fP
+used to check whether a socket is alive;
+.I idle
+is the number of seconds a connection needs to remain idle before TCP
+starts sending keepalive probes;
+.I probes
+is the maximum number of keepalive probes TCP should send before dropping
+the connection;
+.I interval
+is interval in seconds between individual keepalive probes.
+Only some systems support the customization of these values;
+the
+.B keepalive
+parameter is ignored otherwise, and system-wide settings are used.
+
+The
 .B tcp\-user\-timeout
 parameter, if non-zero, corresponds to the
 .B TCP_USER_TIMEOUT
@@ -671,16 +697,7 @@ ignored otherwise and system-wide settings are used.
 .B backend-server
 .B uri=ldap[s]://<hostname>[:port]
 .B [retry=<retry interval in ms>]
-.B [keepalive=<idle>:<probes>:<interval>]
 .B [starttls=yes|critical]
-.B [tls_cert=<file>]
-.B [tls_key=<file>]
-.B [tls_cacert=<file>]
-.B [tls_cacertdir=<path>]
-.B [tls_reqcert=never|allow|try|demand]
-.B [tls_cipher_suite=<ciphers>]
-.B [tls_crlcheck=none|peer|all]
-.B [tls_protocol_min=<major>[.<minor>]]
 .B [numconns=<conns>]
 .B [bindconns=<conns>]
 .B [max-pending-ops=<ops>]
@@ -725,23 +742,6 @@ connections,
 the default, means no limit will be imposed for this backend.
 
 The
-.B keepalive
-parameter sets the values of \fIidle\fP, \fIprobes\fP, and \fIinterval\fP
-used to check whether a socket is alive;
-.I idle
-is the number of seconds a connection needs to remain idle before TCP
-starts sending keepalive probes;
-.I probes
-is the maximum number of keepalive probes TCP should send before dropping
-the connection;
-.I interval
-is interval in seconds between individual keepalive probes.
-Only some systems support the customization of these values;
-the
-.B keepalive
-parameter is ignored otherwise, and system-wide settings are used.
-
-The
 .B starttls
 parameter specifies use of the StartTLS extended operation
 to establish a TLS session before Binding to the provider. If the
diff --git a/doc/man/man5/slapo-dynlist.5 b/doc/man/man5/slapo-dynlist.5
index 49a3d50..7fe0f70 100644
--- a/doc/man/man5/slapo-dynlist.5
+++ b/doc/man/man5/slapo-dynlist.5
@@ -134,6 +134,13 @@ character is also specified, then the member and memberOf values will be
 populated recursively, for nested groups. Note that currently nesting is
 only supported for Search operations, not Compares.
 
+.TP
+.B dynlist\-simple TRUE | FALSE
+This option downgrades to the behavior of the OpenLDAP 2.4 dynlist overlay.
+It disables memberOf processing, nested group support, and filter evaluation
+of dynamically generated values.
+The default is FALSE.
+
 .LP
 The dynlist overlay may be used with any backend, but it is mainly 
 intended for use with local storage backends.
diff --git a/doc/man/man5/slapo-homedir.5 b/doc/man/man5/slapo-homedir.5
index 5cd4ee8..cb1ac5b 100644
--- a/doc/man/man5/slapo-homedir.5
+++ b/doc/man/man5/slapo-homedir.5
@@ -77,7 +77,7 @@ IGNORE.
 .TP
 .B homedir\-archive\-path <pathname>
 .TP
-.B olcArchivePath: pathname
+.B olcHomedirArchivePath: pathname
 These options specify the destination path for TAR files created by
 the ARCHIVE delete style.
 .SH REPLICATION
@@ -90,6 +90,32 @@ for more information on configure syncrepl.
 
 Partial replication (e.g. with filters) is especially useful for
 providing different provisioning options to different sets of users.
+.SH EXAMPLE
+The following LDIF could be used to add this overlay to
+.B cn=config
+(adjust to suit)
+.LP
+.RS
+.nf
+dn: cn=module{0},cn=config
+changetype: modify
+add: olcModuleLoad
+olcModuleLoad: homedir
+
+dn: olcOverlay=homedir,olcDatabase={1}mdb,cn=config
+changetype: add
+objectClass: olcOverlayConfig
+objectClass: olcHomedirConfig
+olcOverlay: homedir
+olcSkeletonPath: /etc/skel
+olcMinimumUidNumber: 1000
+olcHomedirRegexp: ^(/home/[-_/a-z0-9]+)$ /export/$1
+olcHomedirDeleteStyle: ARCHIVE
+olcHomedirArchivePath: /archive
+.fi
+.RE
+.LP
+
 .SH BUGS
 DELETE, MOD, and MODRDN operations that remove the unix attributes
 when delete style is set to DELETE will recursively delete the (regex
@@ -113,6 +139,7 @@ resolve uid/gid into symbolic names.
 
 No attempt is made to try to mkdir() the parent directories needed for
 a given home directory or archive path.
+
 .SH FILES
 .TP
 ETCDIR/slapd.conf
diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8
index a93fcbc..809f9e7 100644
--- a/doc/man/man8/slapd.8
+++ b/doc/man/man8/slapd.8
@@ -12,7 +12,7 @@ slapd \- Stand-alone LDAP Daemon
 .BR \-4 | \-6 ]
 [\c
 .BR \-T \ { acl \||\| a [ dd ]\||\| auth \||\| c [ at ]\||\|
-.BR d [ n ]\||\| i [ ndex ]\||\| p [ asswd ]\||\| s [ chema ]\||\| t [ est ]}]
+.BR d [ n ]\||\| i [ ndex ]\||\| m [ odify ]\||\| p [ asswd ]\||\| s [ chema ]\||\| t [ est ]}]
 [\c
 .BI \-d \ debug-level\fR]
 [\c
@@ -87,6 +87,7 @@ Run in Tool mode. The \fItool\fP argument selects whether to run as
 .IR slapcat ,
 .IR slapdn ,
 .IR slapindex ,
+.IR slapmodify ,
 .IR slappasswd ,
 .IR slapschema ,
 or
@@ -366,6 +367,7 @@ To test whether the configuration file is correct or not, type:
 .BR slapcat (8),
 .BR slapdn (8),
 .BR slapindex (8),
+.BR slapmodify (8),
 .BR slappasswd (8),
 .BR slapschema (8),
 .BR slaptest (8).
diff --git a/include/ac/string.h b/include/ac/string.h
index c4c1354..20a68d7 100644
--- a/include/ac/string.h
+++ b/include/ac/string.h
@@ -58,7 +58,7 @@ LDAP_F(char *) ldap_pvt_strtok LDAP_P(( char *str,
 #elif !defined(_WIN32)
 	/* some systems fail to declare strdup */
 	/* Windows does not require this declaration */
-	LDAP_LIBC_F(char *) (strdup)();
+	LDAP_LIBC_F(char *) (strdup) LDAP_P((const char *s));
 #endif
 
 /*
@@ -68,8 +68,8 @@ LDAP_F(char *) ldap_pvt_strtok LDAP_P(( char *str,
 
 /* we don't want these declared for Windows or Mingw */
 #ifndef _WIN32
-int (strcasecmp)();
-int (strncasecmp)();
+LDAP_LIBC_F(int) (strcasecmp) LDAP_P((const char *s1, const char *s2));
+LDAP_LIBC_F(int) (strncasecmp) LDAP_P((const char *s1, const char *s2, size_t n));
 #endif
 
 #ifndef SAFEMEMCPY
diff --git a/libraries/liblber/debug.c b/libraries/liblber/debug.c
index 1744e58..1f4fdbb 100644
--- a/libraries/liblber/debug.c
+++ b/libraries/liblber/debug.c
@@ -43,12 +43,15 @@ void (lutil_debug)( int debug, int level, const char *fmt, ... )
 {
 	char buffer[4096];
 	va_list vl;
+	int len;
 
 	if ( !(level & debug ) ) return;
 
 	va_start( vl, fmt );
-	vsnprintf( buffer, sizeof(buffer), fmt, vl );
+	len = vsnprintf( buffer, sizeof(buffer), fmt, vl );
 	va_end( vl );
+	if ( len >= sizeof(buffer)-2 )
+		buffer[sizeof(buffer)-2] = '\n';
 	ber_pvt_log_print( buffer );
 }
 
diff --git a/libraries/libldap/getdn.c b/libraries/libldap/getdn.c
index 6170596..7d8b52f 100644
--- a/libraries/libldap/getdn.c
+++ b/libraries/libldap/getdn.c
@@ -2562,6 +2562,8 @@ rdn2strlen( LDAPRDN rdn, unsigned flags, ber_len_t *len,
 			l += vl;
 		}
 	}
+	if ( !iAVA )
+		return( -1 );	/* RDN ::= SET SIZE (1..MAX) OF AVA */
 	
 	*len = l;
 	
@@ -2635,6 +2637,8 @@ rdn2DCEstrlen( LDAPRDN rdn, unsigned flags, ber_len_t *len )
 			l += vl;
 		}
 	}
+	if ( !iAVA )
+		return( -1 );	/* RDN ::= SET SIZE (1..MAX) OF AVA */
 	
 	*len = l;
 	
@@ -2716,6 +2720,8 @@ rdn2UFNstrlen( LDAPRDN rdn, unsigned flags, ber_len_t *len )
 			l += vl;
 		}
 	}
+	if ( !iAVA )
+		return( -1 );	/* RDN ::= SET SIZE (1..MAX) OF AVA */
 	
 	*len = l;
 	
@@ -2794,6 +2800,8 @@ rdn2ADstrlen( LDAPRDN rdn, unsigned flags, ber_len_t *len )
 			l += vl;
 		}
 	}
+	if ( !iAVA )
+		return( -1 );	/* RDN ::= SET SIZE (1..MAX) OF AVA */
 	
 	*len = l;
 	
diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
index 3a81790..b991553 100644
--- a/libraries/libldap/init.c
+++ b/libraries/libldap/init.c
@@ -544,9 +544,6 @@ ldap_int_destroy_global_options(void)
 		gopts->ldo_def_sasl_authcid = NULL;
 	}
 #endif
-#ifdef HAVE_TLS
-	ldap_int_tls_destroy( gopts );
-#endif
 }
 
 /* 
diff --git a/libraries/libldap/open.c b/libraries/libldap/open.c
index bfdbb25..93720eb 100644
--- a/libraries/libldap/open.c
+++ b/libraries/libldap/open.c
@@ -543,6 +543,7 @@ ldap_int_open_connection(
 				LDAP_MUTEX_UNLOCK( &lo->ldo_mutex );
 			}
 			ber_int_sb_close( conn->lconn_sb );
+			ber_int_sb_destroy( conn->lconn_sb );
 			return -1;
 		}
 	}
diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
index 4a5d42b..f9dcbfc 100644
--- a/libraries/libldap/tls2.c
+++ b/libraries/libldap/tls2.c
@@ -160,6 +160,14 @@ ldap_pvt_tls_destroy( void )
 	tls_imp->ti_tls_destroy();
 }
 
+static void
+ldap_exit_tls_destroy( void )
+{
+	struct ldapoptions *lo = LDAP_INT_GLOBAL_OPT();
+
+	ldap_int_tls_destroy( lo );
+}
+
 /*
  * Initialize a particular TLS implementation.
  * Called once per implementation.
@@ -168,6 +176,7 @@ static int
 tls_init(tls_impl *impl, int do_threads )
 {
 	static int tls_initialized = 0;
+	int rc;
 
 	if ( !tls_initialized++ ) {
 #ifdef LDAP_R_COMPILE
@@ -183,7 +192,10 @@ tls_init(tls_impl *impl, int do_threads )
 #endif
 	}
 
-	return impl->ti_tls_init();
+	rc = impl->ti_tls_init();
+
+	atexit( ldap_exit_tls_destroy );
+	return rc;
 }
 
 /*
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
index d6405bc..055d140 100644
--- a/libraries/libldap/tls_o.c
+++ b/libraries/libldap/tls_o.c
@@ -294,7 +294,7 @@ tlso_stecpy( char *dst, const char *src, const char *end )
  * Try to find any TLS1.3 ciphers in the given list of suites.
  */
 static void
-tlso_ctx_cipher13( tlso_ctx *ctx, char *suites )
+tlso_ctx_cipher13( tlso_ctx *ctx, char *suites, char **oldsuites )
 {
 	char tls13_suites[1024], *ts = tls13_suites, *te = tls13_suites + sizeof(tls13_suites);
 	char *ptr, *colon, *nptr;
@@ -303,6 +303,8 @@ tlso_ctx_cipher13( tlso_ctx *ctx, char *suites )
 	SSL *s = SSL_new( ctx );
 	int ret;
 
+	*oldsuites = NULL;
+
 	if ( !s )
 		return;
 
@@ -334,8 +336,15 @@ tlso_ctx_cipher13( tlso_ctx *ctx, char *suites )
 					if ( tls13_suites[0] )
 						ts = tlso_stecpy( ts, ":", te );
 					ts = tlso_stecpy( ts, nptr, te );
+				} else if (! *oldsuites) {
+					/* should never happen, set_ciphersuites should
+					 * only succeed for TLSv1.3 and above
+					 */
+					*oldsuites = ptr;
 				}
 			}
+		} else if (! *oldsuites) {
+			*oldsuites = ptr;
 		}
 		if ( !colon || ts >= te )
 			break;
@@ -415,10 +424,11 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
 	}
 
 	if ( lo->ldo_tls_ciphersuite ) {
+		char *oldsuites = lt->lt_ciphersuite;
 #if OPENSSL_VERSION_NUMBER >= 0x10101000
-		tlso_ctx_cipher13( ctx, lt->lt_ciphersuite );
+		tlso_ctx_cipher13( ctx, lt->lt_ciphersuite, &oldsuites );
 #endif
-		if ( !SSL_CTX_set_cipher_list( ctx, lt->lt_ciphersuite ) )
+		if ( oldsuites && !SSL_CTX_set_cipher_list( ctx, oldsuites ) )
 		{
 			Debug1( LDAP_DEBUG_ANY,
 				   "TLS: could not set cipher list %s.\n",
@@ -529,7 +539,7 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
 	if ( is_server && lo->ldo_tls_dhfile ) {
 #if OPENSSL_VERSION_MAJOR >= 3
 		EVP_PKEY *dh;
-#define	bio_params( bio, dh )	dh = PEM_read_bio_Parameters( bio, &dh )
+#define	bio_params( bio, dh )	dh = PEM_read_bio_Parameters( bio, NULL )
 #else
 		DH *dh;
 #define	bio_params( bio, dh )	dh = PEM_read_bio_DHparams( bio, NULL, NULL, NULL )
diff --git a/libraries/libldap/url.c b/libraries/libldap/url.c
index 493fd7c..a56af30 100644
--- a/libraries/libldap/url.c
+++ b/libraries/libldap/url.c
@@ -867,6 +867,10 @@ ldap_url_parse_ext( LDAP_CONST char *url_in, LDAPURLDesc **ludpp, unsigned flags
 	}
 
 	if ( enclosed ) {
+		if ( ! *url ) {
+			LDAP_FREE( url );
+			return LDAP_URL_ERR_BADENCLOSURE;
+		}
 		p = &url[strlen(url)-1];
 
 		if( *p != '>' ) {
diff --git a/libraries/libldap/util-int.c b/libraries/libldap/util-int.c
index 57c6523..7cab9ea 100644
--- a/libraries/libldap/util-int.c
+++ b/libraries/libldap/util-int.c
@@ -182,116 +182,65 @@ static int _ldap_pvt_gt_subs;
  * This is pretty clunky.
  */
 static LARGE_INTEGER _ldap_pvt_gt_freq;
-static LARGE_INTEGER _ldap_pvt_gt_prev;
-static int _ldap_pvt_gt_offset;
+static LARGE_INTEGER _ldap_pvt_gt_start_count;
+static long _ldap_pvt_gt_start_sec;
+static long _ldap_pvt_gt_start_nsec;
+static double _ldap_pvt_gt_nanoticks;
 
 #define SEC_TO_UNIX_EPOCH 11644473600LL
 #define TICKS_PER_SECOND 10000000
 #define BILLION	1000000000L
 
 static int
-ldap_pvt_gettimensec(int *sec)
+ldap_pvt_gettimensec(long *sec)
 {
 	LARGE_INTEGER count;
+	LARGE_INTEGER freq;
+	int nsec;
 
-	QueryPerformanceCounter( &count );
-
-	/* It shouldn't ever go backwards, but multiple CPUs might
-	 * be able to hit in the same tick.
-	 */
-	LDAP_MUTEX_LOCK( &ldap_int_gettime_mutex );
+	QueryPerformanceFrequency( &freq );
 	/* We assume Windows has at least a vague idea of
 	 * when a second begins. So we align our nanosecond count
-	 * with the Windows millisecond count using this offset.
-	 * We retain the submillisecond portion of our own count.
-	 *
-	 * Note - this also assumes that the relationship between
-	 * the PerformanceCounter and SystemTime stays constant;
-	 * that assumption breaks if the SystemTime is adjusted by
-	 * an external action.
+	 * with the Windows millisecond count.
 	 */
-	if ( !_ldap_pvt_gt_freq.QuadPart ) {
-		LARGE_INTEGER c2;
+	if ( freq.QuadPart != _ldap_pvt_gt_freq.QuadPart ) {
 		ULARGE_INTEGER ut;
 		FILETIME ft0, ft1;
-		long long t;
-		int nsec;
-
-		/* Initialize our offset */
-		QueryPerformanceFrequency( &_ldap_pvt_gt_freq );
-
+		/* initialize */
+		LDAP_MUTEX_LOCK( &ldap_int_gettime_mutex );
 		/* Wait for a tick of the system time: 10-15ms */
 		GetSystemTimeAsFileTime( &ft0 );
 		do {
 			GetSystemTimeAsFileTime( &ft1 );
 		} while ( ft1.dwLowDateTime == ft0.dwLowDateTime );
+		QueryPerformanceCounter( &_ldap_pvt_gt_start_count );
 
 		ut.LowPart = ft1.dwLowDateTime;
 		ut.HighPart = ft1.dwHighDateTime;
-		QueryPerformanceCounter( &c2 );
-
-		/* get second and fraction portion of counter */
-		t = c2.QuadPart % (_ldap_pvt_gt_freq.QuadPart*10);
-
-		/* convert to nanoseconds */
-		t *= BILLION;
-		nsec = t / _ldap_pvt_gt_freq.QuadPart;
-
-		ut.QuadPart /= 10;
-		ut.QuadPart %= (10 * BILLION);
-		_ldap_pvt_gt_offset = nsec - ut.QuadPart;
-		count = c2;
+		_ldap_pvt_gt_start_nsec = ut.QuadPart % TICKS_PER_SECOND * 100;
+		_ldap_pvt_gt_start_sec = ut.QuadPart / TICKS_PER_SECOND - SEC_TO_UNIX_EPOCH;
+		_ldap_pvt_gt_freq = freq;
+		_ldap_pvt_gt_nanoticks = (double)BILLION / freq.QuadPart;
+		LDAP_MUTEX_UNLOCK( &ldap_int_gettime_mutex );
 	}
-	if ( count.QuadPart <= _ldap_pvt_gt_prev.QuadPart ) {
-		_ldap_pvt_gt_subs++;
-	} else {
-		_ldap_pvt_gt_subs = 0;
-		_ldap_pvt_gt_prev = count;
+	QueryPerformanceCounter( &count );
+	count.QuadPart -= _ldap_pvt_gt_start_count.QuadPart;
+	*sec = _ldap_pvt_gt_start_sec + count.QuadPart / freq.QuadPart;
+	nsec = _ldap_pvt_gt_start_nsec + (double)(count.QuadPart % freq.QuadPart) * _ldap_pvt_gt_nanoticks;
+	if ( nsec > BILLION) {
+		nsec -= BILLION;
+		(*sec)++;
 	}
-	LDAP_MUTEX_UNLOCK( &ldap_int_gettime_mutex );
-
-	/* convert to nanoseconds */
-	count.QuadPart %= _ldap_pvt_gt_freq.QuadPart*10;
-	count.QuadPart *= BILLION;
-	count.QuadPart /= _ldap_pvt_gt_freq.QuadPart;
-	count.QuadPart -= _ldap_pvt_gt_offset;
-
-	/* We've extracted the 1s and nanoseconds.
-	 * The 1sec digit is used to detect wraparound in nanosecnds.
-	 */
-	if (count.QuadPart < 0)
-		count.QuadPart += (10 * BILLION);
-	else if (count.QuadPart >= (10 * BILLION))
-		count.QuadPart -= (10 * BILLION);
-
-	*sec = count.QuadPart / BILLION;
-	return count.QuadPart % BILLION;
+	return nsec;
 }
 
-
 /* emulate POSIX clock_gettime */
 int
 ldap_pvt_clock_gettime( int clk_id, struct timespec *tv )
 {
-	FILETIME ft;
-	ULARGE_INTEGER ut;
-	int sec, sec0;
-
-	GetSystemTimeAsFileTime( &ft );
-	ut.LowPart = ft.dwLowDateTime;
-	ut.HighPart = ft.dwHighDateTime;
-
-	/* convert to sec */
-	ut.QuadPart /= TICKS_PER_SECOND;
-
-	tv->tv_nsec = ldap_pvt_gettimensec(&sec);
-	tv->tv_sec = ut.QuadPart - SEC_TO_UNIX_EPOCH;
-
-	/* check for carry from microseconds */
-	sec0 = tv->tv_sec % 10;
-	if (sec0 < sec || (sec0 == 9 && !sec))
-		tv->tv_sec++;
-
+	long sec;
+	tv->tv_nsec = ldap_pvt_gettimensec( &sec );
+	tv->tv_sec = sec;
 	return 0;
 }
 
@@ -306,6 +255,8 @@ ldap_pvt_gettimeofday( struct timeval *tv, void *unused )
 	return 0;
 }
 
+static long _ldap_pvt_gt_prevsec;
+static int _ldap_pvt_gt_prevnsec;
 
 /* return a broken out time, with nanoseconds
  */
@@ -313,17 +264,18 @@ void
 ldap_pvt_gettime( struct lutil_tm *tm )
 {
 	SYSTEMTIME st;
-	int sec, sec0;
-	static const char daysPerMonth[] = {
-	31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31};
+	LARGE_INTEGER ft;
+	long sec;
 
-	GetSystemTime( &st );
+	/* Convert sec/nsec to Windows FILETIME,
+	 * then turn that into broken out SYSTEMTIME */
 	tm->tm_nsec = ldap_pvt_gettimensec(&sec);
-	tm->tm_usub = _ldap_pvt_gt_subs;
+	ft.QuadPart = sec;
+	ft.QuadPart += SEC_TO_UNIX_EPOCH;
+	ft.QuadPart *= TICKS_PER_SECOND;
+	ft.QuadPart += tm->tm_nsec / 100;
+	FileTimeToSystemTime( (FILETIME *)&ft, &st );
 
-	/* any difference larger than nanoseconds is
-	 * already reflected in st
-	 */
 	tm->tm_sec = st.wSecond;
 	tm->tm_min = st.wMinute;
 	tm->tm_hour = st.wHour;
@@ -331,42 +283,18 @@ ldap_pvt_gettime( struct lutil_tm *tm )
 	tm->tm_mon = st.wMonth - 1;
 	tm->tm_year = st.wYear - 1900;
 
-	/* check for carry from nanoseconds */
-	sec0 = tm->tm_sec % 10;
-	if (sec0 < sec || (sec0 == 9 && !sec)) {
-		tm->tm_sec++;
-		/* FIXME: we don't handle leap seconds */
-		if (tm->tm_sec > 59) {
-			tm->tm_sec = 0;
-			tm->tm_min++;
-			if (tm->tm_min > 59) {
-				tm->tm_min = 0;
-				tm->tm_hour++;
-				if (tm->tm_hour > 23) {
-					int days = daysPerMonth[tm->tm_mon];
-					tm->tm_hour = 0;
-					tm->tm_mday++;
-
-					/* if it's February of a leap year,
-					 * add 1 day to this month
-					 */
-					if (tm->tm_mon == 1 &&
-						((!(st.wYear % 4) && (st.wYear % 100)) ||
-						!(st.wYear % 400)))
-						days++;
-
-					if (tm->tm_mday > days) {
-						tm->tm_mday = 1;
-						tm->tm_mon++;
-						if (tm->tm_mon > 11) {
-							tm->tm_mon = 0;
-							tm->tm_year++;
-						}
-					}
-				}
-			}
-		}
+	LDAP_MUTEX_LOCK( &ldap_int_gettime_mutex );
+	if ( tm->tm_sec < _ldap_pvt_gt_prevsec
+		|| ( tm->tm_sec == _ldap_pvt_gt_prevsec
+		&& tm->tm_nsec <= _ldap_pvt_gt_prevnsec )) {
+		_ldap_pvt_gt_subs++;
+	} else {
+		_ldap_pvt_gt_subs = 0;
+		_ldap_pvt_gt_prevsec = sec;
+		_ldap_pvt_gt_prevnsec = tm->tm_nsec;
 	}
+	LDAP_MUTEX_UNLOCK( &ldap_int_gettime_mutex );
+	tm->tm_usub = _ldap_pvt_gt_subs;
 }
 #else
 
diff --git a/libraries/liblmdb/CHANGES b/libraries/liblmdb/CHANGES
index 76dd591..10e81d5 100644
--- a/libraries/liblmdb/CHANGES
+++ b/libraries/liblmdb/CHANGES
@@ -1,5 +1,11 @@
 LMDB 0.9 Change Log
 
+LMDB 0.9.32 Release (2024/01/29)
+	ITS#9378 - Add ability to replay log and replay log tool
+	ITS#10095 - partial revert of ITS#9278. The patch was incorrect and introduced numerous race conditions.
+	ITS#10125 - mdb_load: fix cursor reinit in Append mode
+	ITS#10137 - Allow users to define MDB_IDL_LOGN
+
 LMDB 0.9.31 Release (2023/07/10)
 	ITS#8447 - Fix cursor_put(MDB_CURRENT) on DUPSORT DB with different sized data
 
diff --git a/libraries/liblmdb/Makefile b/libraries/liblmdb/Makefile
index f254511..000f1f9 100644
--- a/libraries/liblmdb/Makefile
+++ b/libraries/liblmdb/Makefile
@@ -78,6 +78,7 @@ mtest3:	mtest3.o liblmdb.a
 mtest4:	mtest4.o liblmdb.a
 mtest5:	mtest5.o liblmdb.a
 mtest6:	mtest6.o liblmdb.a
+mplay:	mplay.o liblmdb.a
 
 mdb.o: mdb.c lmdb.h midl.h
 	$(CC) $(CFLAGS) $(CPPFLAGS) -c mdb.c
diff --git a/libraries/liblmdb/lmdb.h b/libraries/liblmdb/lmdb.h
index ff03c22..d638a67 100644
--- a/libraries/liblmdb/lmdb.h
+++ b/libraries/liblmdb/lmdb.h
@@ -200,7 +200,7 @@ typedef int mdb_filehandle_t;
 /** Library minor version */
 #define MDB_VERSION_MINOR	9
 /** Library patch version */
-#define MDB_VERSION_PATCH	31
+#define MDB_VERSION_PATCH	32
 
 /** Combine args a,b,c into a single integer for easy version comparisons */
 #define MDB_VERINT(a,b,c)	(((a) << 24) | ((b) << 16) | (c))
@@ -210,7 +210,7 @@ typedef int mdb_filehandle_t;
 	MDB_VERINT(MDB_VERSION_MAJOR,MDB_VERSION_MINOR,MDB_VERSION_PATCH)
 
 /** The release date of this library version */
-#define MDB_VERSION_DATE	"July 10, 2023"
+#define MDB_VERSION_DATE	"January 29, 2024"
 
 /** A stringifier for the version info */
 #define MDB_VERSTR(a,b,c,d)	"LMDB " #a "." #b "." #c ": (" d ")"
diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index deb6779..0570dea 100644
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -481,18 +481,26 @@ typedef MDB_ID	txnid_t;
 #define MDB_DEBUG 0
 #endif
 
+#define MDB_DBG_INFO	1
+#define MDB_DBG_TRACE	2
+
 #if MDB_DEBUG
-static int mdb_debug;
+static int mdb_debug = MDB_DBG_TRACE;
 static txnid_t mdb_debug_start;
 
 	/**	Print a debug message with printf formatting.
 	 *	Requires double parenthesis around 2 or more args.
 	 */
-# define DPRINTF(args) ((void) ((mdb_debug) && DPRINTF0 args))
+# define DPRINTF(args) ((void) ((mdb_debug & MDB_DBG_INFO) && DPRINTF0 args))
 # define DPRINTF0(fmt, ...) \
 	fprintf(stderr, "%s:%d " fmt "\n", mdb_func_, __LINE__, __VA_ARGS__)
+	/** Trace info for replaying */
+# define MDB_TRACE(args)	((void) ((mdb_debug & MDB_DBG_TRACE) && DPRINTF1 args))
+# define DPRINTF1(fmt, ...) \
+	fprintf(stderr, ">%d:%s: " fmt "\n", getpid(), mdb_func_, __VA_ARGS__)
 #else
 # define DPRINTF(args)	((void) 0)
+# define MDB_TRACE(args)	((void) 0)
 #endif
 	/**	Print a debug string.
 	 *	The string is printed literally, with no format processing.
@@ -589,6 +597,11 @@ static txnid_t mdb_debug_start;
 	 *	This is used for printing a hex dump of a key's contents.
 	 */
 #define DKBUF	char kbuf[DKBUF_MAXKEYSIZE*2+1]
+	/**	A data value buffer.
+	 *	@ingroup debug
+	 *	This is used for printing a hex dump of a #MDB_DUPSORT value's contents.
+	 */
+#define DDBUF	char dbuf[DKBUF_MAXKEYSIZE*2+1+2]
 	/**	Display a key in hex.
 	 *	@ingroup debug
 	 *	Invoke a function to display a key in hex.
@@ -596,6 +609,7 @@ static txnid_t mdb_debug_start;
 #define	DKEY(x)	mdb_dkey(x, kbuf)
 #else
 #define	DKBUF
+#define	DDBUF
 #define DKEY(x)	0
 #endif
 
@@ -1423,6 +1437,9 @@ static int	mdb_update_key(MDB_cursor *mc, MDB_val *key);
 static void	mdb_cursor_pop(MDB_cursor *mc);
 static int	mdb_cursor_push(MDB_cursor *mc, MDB_page *mp);
 
+static int	_mdb_cursor_del(MDB_cursor *mc, unsigned int flags);
+static int	_mdb_cursor_put(MDB_cursor *mc, MDB_val *key, MDB_val *data, unsigned int flags);
+
 static int	mdb_cursor_del0(MDB_cursor *mc);
 static int	mdb_del0(MDB_txn *txn, MDB_dbi dbi, MDB_val *key, MDB_val *data, unsigned flags);
 static int	mdb_cursor_sibling(MDB_cursor *mc, int move_right);
@@ -1614,6 +1631,18 @@ mdb_dkey(MDB_val *key, char *buf)
 	return buf;
 }
 
+static char *
+mdb_dval(MDB_txn *txn, MDB_dbi dbi, MDB_val *data, char *buf)
+{
+	if (txn->mt_dbs[dbi].md_flags & MDB_DUPSORT) {
+		mdb_dkey(data, buf+1);
+		*buf = '[';
+		strcpy(buf + data->mv_size * 2 + 1, "]");
+	} else
+		*buf = '\0';
+	return buf;
+}
+
 static const char *
 mdb_leafnode_type(MDB_node *n)
 {
@@ -2786,7 +2815,7 @@ mdb_txn_renew0(MDB_txn *txn)
 		txn->mt_txnid++;
 #if MDB_DEBUG
 		if (txn->mt_txnid == mdb_debug_start)
-			mdb_debug = 1;
+			mdb_debug = MDB_DBG_INFO;
 #endif
 		txn->mt_child = NULL;
 		txn->mt_loose_pgs = NULL;
@@ -2945,6 +2974,7 @@ renew:
 			txn->mt_txnid, (flags & MDB_RDONLY) ? 'r' : 'w',
 			(void *) txn, (void *) env, txn->mt_dbs[MAIN_DBI].md_root));
 	}
+	MDB_TRACE(("%p, %p, %u = %p", env, parent, flags, txn));
 
 	return rc;
 }
@@ -3080,18 +3110,25 @@ mdb_txn_reset(MDB_txn *txn)
 	mdb_txn_end(txn, MDB_END_RESET);
 }
 
-void
-mdb_txn_abort(MDB_txn *txn)
+static void
+_mdb_txn_abort(MDB_txn *txn)
 {
 	if (txn == NULL)
 		return;
 
 	if (txn->mt_child)
-		mdb_txn_abort(txn->mt_child);
+		_mdb_txn_abort(txn->mt_child);
 
 	mdb_txn_end(txn, MDB_END_ABORT|MDB_END_SLOT|MDB_END_FREE);
 }
 
+void
+mdb_txn_abort(MDB_txn *txn)
+{
+	MDB_TRACE(("%p", txn));
+	_mdb_txn_abort(txn);
+}
+
 /** Save the freelist as of this transaction to the freeDB.
  * This changes the freelist. Keep trying until it stabilizes.
  */
@@ -3182,7 +3219,7 @@ mdb_freelist_save(MDB_txn *txn)
 			pglast = head_id = *(txnid_t *)key.mv_data;
 			total_room = head_room = 0;
 			mdb_tassert(txn, pglast <= env->me_pglast);
-			rc = mdb_cursor_del(&mc, 0);
+			rc = _mdb_cursor_del(&mc, 0);
 			if (rc)
 				return rc;
 		}
@@ -3202,7 +3239,7 @@ mdb_freelist_save(MDB_txn *txn)
 			do {
 				freecnt = free_pgs[0];
 				data.mv_size = MDB_IDL_SIZEOF(free_pgs);
-				rc = mdb_cursor_put(&mc, &key, &data, MDB_RESERVE);
+				rc = _mdb_cursor_put(&mc, &key, &data, MDB_RESERVE);
 				if (rc)
 					return rc;
 				/* Retry if mt_free_pgs[] grew during the Put() */
@@ -3251,7 +3288,7 @@ mdb_freelist_save(MDB_txn *txn)
 		key.mv_size = sizeof(head_id);
 		key.mv_data = &head_id;
 		data.mv_size = (head_room + 1) * sizeof(pgno_t);
-		rc = mdb_cursor_put(&mc, &key, &data, MDB_RESERVE);
+		rc = _mdb_cursor_put(&mc, &key, &data, MDB_RESERVE);
 		if (rc)
 			return rc;
 		/* IDL is initially empty, zero out at least the length */
@@ -3306,7 +3343,7 @@ mdb_freelist_save(MDB_txn *txn)
 			data.mv_data = mop -= len;
 			save = mop[0];
 			mop[0] = len;
-			rc = mdb_cursor_put(&mc, &key, &data, MDB_CURRENT);
+			rc = _mdb_cursor_put(&mc, &key, &data, MDB_CURRENT);
 			mop[0] = save;
 			if (rc || !(mop_len -= len))
 				break;
@@ -3467,8 +3504,8 @@ done:
 	return MDB_SUCCESS;
 }
 
-int
-mdb_txn_commit(MDB_txn *txn)
+static int
+_mdb_txn_commit(MDB_txn *txn)
 {
 	int		rc;
 	unsigned int i, end_mode;
@@ -3481,7 +3518,7 @@ mdb_txn_commit(MDB_txn *txn)
 	end_mode = MDB_END_EMPTY_COMMIT|MDB_END_UPDATE|MDB_END_SLOT|MDB_END_FREE;
 
 	if (txn->mt_child) {
-		rc = mdb_txn_commit(txn->mt_child);
+		rc = _mdb_txn_commit(txn->mt_child);
 		if (rc)
 			goto fail;
 	}
@@ -3661,7 +3698,7 @@ mdb_txn_commit(MDB_txn *txn)
 					goto fail;
 				}
 				data.mv_data = &txn->mt_dbs[i];
-				rc = mdb_cursor_put(&mc, &txn->mt_dbxs[i].md_name, &data,
+				rc = _mdb_cursor_put(&mc, &txn->mt_dbxs[i].md_name, &data,
 					F_SUBDATA);
 				if (rc)
 					goto fail;
@@ -3692,10 +3729,17 @@ done:
 	return MDB_SUCCESS;
 
 fail:
-	mdb_txn_abort(txn);
+	_mdb_txn_abort(txn);
 	return rc;
 }
 
+int
+mdb_txn_commit(MDB_txn *txn)
+{
+	MDB_TRACE(("%p", txn));
+	return _mdb_txn_commit(txn);
+}
+
 /** Read the environment parameters of a DB environment before
  * mapping it into memory.
  * @param[in] env the environment handle
@@ -3992,6 +4036,7 @@ mdb_env_create(MDB_env **env)
 	GET_PAGESIZE(e->me_os_psize);
 	VGMEMP_CREATE(e,0,0);
 	*env = e;
+	MDB_TRACE(("%p", e));
 	return MDB_SUCCESS;
 }
 
@@ -4115,6 +4160,7 @@ mdb_env_set_mapsize(MDB_env *env, size_t size)
 	env->me_mapsize = size;
 	if (env->me_psize)
 		env->me_maxpg = env->me_mapsize / env->me_psize;
+	MDB_TRACE(("%p, %"Yu"", env, size));
 	return MDB_SUCCESS;
 }
 
@@ -4124,6 +4170,7 @@ mdb_env_set_maxdbs(MDB_env *env, MDB_dbi dbs)
 	if (env->me_map)
 		return EINVAL;
 	env->me_maxdbs = dbs + CORE_DBS;
+	MDB_TRACE(("%p, %u", env, dbs));
 	return MDB_SUCCESS;
 }
 
@@ -4133,6 +4180,7 @@ mdb_env_set_maxreaders(MDB_env *env, unsigned int readers)
 	if (env->me_map || readers < 1)
 		return EINVAL;
 	env->me_maxreaders = readers;
+	MDB_TRACE(("%p, %u", env, readers));
 	return MDB_SUCCESS;
 }
 
@@ -5076,6 +5124,7 @@ mdb_env_open(MDB_env *env, const char *path, unsigned int flags, mdb_mode_t mode
 	}
 
 leave:
+	MDB_TRACE(("%p, %s, %u, %04o", env, path, flags & (CHANGEABLE|CHANGELESS), mode));
 	if (rc) {
 		mdb_env_close0(env, excl);
 	}
@@ -5162,17 +5211,6 @@ mdb_env_close0(MDB_env *env, int excl)
 				sem_unlink(env->me_txns->mti_wmname);
 			}
 		}
-#elif defined(MDB_ROBUST_SUPPORTED)
-		/* If we have the filelock:  If we are the
-		 * only remaining user, clean up robust
-		 * mutexes.
-		 */
-		if (excl == 0)
-			mdb_env_excl_lock(env, &excl);
-		if (excl > 0) {
-			pthread_mutex_destroy(env->me_txns->mti_rmutex);
-			pthread_mutex_destroy(env->me_txns->mti_wmutex);
-		}
 #endif
 		munmap((void *)env->me_txns, (env->me_maxreaders-1)*sizeof(MDB_reader)+sizeof(MDB_txninfo));
 	}
@@ -5199,6 +5237,7 @@ mdb_env_close(MDB_env *env)
 	if (env == NULL)
 		return;
 
+	MDB_TRACE(("%p", env));
 	VGMEMP_DESTROY(env);
 	while ((dp = env->me_dpages) != NULL) {
 		VGMEMP_DEFINED(&dp->mp_next, sizeof(dp->mp_next));
@@ -6570,8 +6609,8 @@ mdb_cursor_touch(MDB_cursor *mc)
 /** Do not spill pages to disk if txn is getting full, may fail instead */
 #define MDB_NOSPILL	0x8000
 
-int
-mdb_cursor_put(MDB_cursor *mc, MDB_val *key, MDB_val *data,
+static int
+_mdb_cursor_put(MDB_cursor *mc, MDB_val *key, MDB_val *data,
     unsigned int flags)
 {
 	MDB_env		*env;
@@ -7034,7 +7073,7 @@ put_sub:
 			new_dupdata = (int)dkey.mv_size;
 			/* converted, write the original data first */
 			if (dkey.mv_size) {
-				rc = mdb_cursor_put(&mc->mc_xcursor->mx_cursor, &dkey, &xdata, xflags);
+				rc = _mdb_cursor_put(&mc->mc_xcursor->mx_cursor, &dkey, &xdata, xflags);
 				if (rc)
 					goto bad_sub;
 				/* we've done our job */
@@ -7062,7 +7101,7 @@ put_sub:
 			ecount = mc->mc_xcursor->mx_db.md_entries;
 			if (flags & MDB_APPENDDUP)
 				xflags |= MDB_APPEND;
-			rc = mdb_cursor_put(&mc->mc_xcursor->mx_cursor, data, &xdata, xflags);
+			rc = _mdb_cursor_put(&mc->mc_xcursor->mx_cursor, data, &xdata, xflags);
 			if (flags & F_SUBDATA) {
 				void *db = NODEDATA(leaf);
 				memcpy(db, &mc->mc_xcursor->mx_db, sizeof(MDB_db));
@@ -7103,7 +7142,20 @@ bad_sub:
 }
 
 int
-mdb_cursor_del(MDB_cursor *mc, unsigned int flags)
+mdb_cursor_put(MDB_cursor *mc, MDB_val *key, MDB_val *data,
+    unsigned int flags)
+{
+	DKBUF;
+	DDBUF;
+	int rc = _mdb_cursor_put(mc, key, data, flags);
+	MDB_TRACE(("%p, %"Z"u[%s], %"Z"u%s, %u",
+		mc, key ? key->mv_size:0, DKEY(key), data ? data->mv_size:0,
+			data ? mdb_dval(mc->mc_txn, mc->mc_dbi, data, dbuf):"", flags));
+	return rc;
+}
+
+static int
+_mdb_cursor_del(MDB_cursor *mc, unsigned int flags)
 {
 	MDB_node	*leaf;
 	MDB_page	*mp;
@@ -7141,7 +7193,7 @@ mdb_cursor_del(MDB_cursor *mc, unsigned int flags)
 			if (!F_ISSET(leaf->mn_flags, F_SUBDATA)) {
 				mc->mc_xcursor->mx_cursor.mc_pg[0] = NODEDATA(leaf);
 			}
-			rc = mdb_cursor_del(&mc->mc_xcursor->mx_cursor, MDB_NOSPILL);
+			rc = _mdb_cursor_del(&mc->mc_xcursor->mx_cursor, MDB_NOSPILL);
 			if (rc)
 				return rc;
 			/* If sub-DB still has entries, we're done */
@@ -7205,6 +7257,14 @@ fail:
 	return rc;
 }
 
+int
+mdb_cursor_del(MDB_cursor *mc, unsigned int flags)
+{
+	MDB_TRACE(("%p, %u",
+		mc, flags));
+	return _mdb_cursor_del(mc, flags);
+}
+
 /** Allocate and initialize new pages for a database.
  * Set #MDB_TXN_ERROR on failure.
  * @param[in] mc a cursor on the database being added to.
@@ -7698,6 +7758,7 @@ mdb_cursor_open(MDB_txn *txn, MDB_dbi dbi, MDB_cursor **ret)
 		return ENOMEM;
 	}
 
+	MDB_TRACE(("%p, %u = %p", txn, dbi, mc));
 	*ret = mc;
 
 	return MDB_SUCCESS;
@@ -7761,6 +7822,7 @@ mdb_cursor_count(MDB_cursor *mc, size_t *countp)
 void
 mdb_cursor_close(MDB_cursor *mc)
 {
+	MDB_TRACE(("%p", mc));
 	if (mc && !mc->mc_backup) {
 		/* remove from txn, if tracked */
 		if ((mc->mc_flags & C_UNTRACK) && mc->mc_txn->mt_cursors) {
@@ -8570,6 +8632,8 @@ int
 mdb_del(MDB_txn *txn, MDB_dbi dbi,
     MDB_val *key, MDB_val *data)
 {
+	DKBUF;
+	DDBUF;
 	if (!key || !TXN_DBI_EXIST(txn, dbi, DB_USRVALID))
 		return EINVAL;
 
@@ -8581,6 +8645,9 @@ mdb_del(MDB_txn *txn, MDB_dbi dbi,
 		data = NULL;
 	}
 
+	MDB_TRACE(("%p, %u, %"Z"u[%s], %"Z"u%s",
+		txn, dbi, key ? key->mv_size:0, DKEY(key), data ? data->mv_size:0,
+		data ? mdb_dval(txn, dbi, data, dbuf):""));
 	return mdb_del0(txn, dbi, key, data, 0);
 }
 
@@ -8621,7 +8688,7 @@ mdb_del0(MDB_txn *txn, MDB_dbi dbi,
 		mc.mc_flags |= C_UNTRACK;
 		mc.mc_next = txn->mt_cursors[dbi];
 		txn->mt_cursors[dbi] = &mc;
-		rc = mdb_cursor_del(&mc, flags);
+		rc = _mdb_cursor_del(&mc, flags);
 		txn->mt_cursors[dbi] = mc.mc_next;
 	}
 	return rc;
@@ -9063,6 +9130,8 @@ mdb_put(MDB_txn *txn, MDB_dbi dbi,
 	MDB_cursor mc;
 	MDB_xcursor mx;
 	int rc;
+	DKBUF;
+	DDBUF;
 
 	if (!key || !data || !TXN_DBI_EXIST(txn, dbi, DB_USRVALID))
 		return EINVAL;
@@ -9073,10 +9142,12 @@ mdb_put(MDB_txn *txn, MDB_dbi dbi,
 	if (txn->mt_flags & (MDB_TXN_RDONLY|MDB_TXN_BLOCKED))
 		return (txn->mt_flags & MDB_TXN_RDONLY) ? EACCES : MDB_BAD_TXN;
 
+	MDB_TRACE(("%p, %u, %"Z"u[%s], %"Z"u%s, %u",
+		txn, dbi, key ? key->mv_size:0, DKEY(key), data->mv_size, mdb_dval(txn, dbi, data, dbuf), flags));
 	mdb_cursor_init(&mc, txn, dbi, &mx);
 	mc.mc_next = txn->mt_cursors[dbi];
 	txn->mt_cursors[dbi] = &mc;
-	rc = mdb_cursor_put(&mc, key, data, flags);
+	rc = _mdb_cursor_put(&mc, key, data, flags);
 	txn->mt_cursors[dbi] = mc.mc_next;
 	return rc;
 }
@@ -9479,7 +9550,7 @@ finish:
 		my.mc_error = rc;
 	mdb_env_cthr_toggle(&my, 1 | MDB_EOF);
 	rc = THREAD_FINISH(thr);
-	mdb_txn_abort(txn);
+	_mdb_txn_abort(txn);
 
 done:
 #ifdef _WIN32
@@ -9591,7 +9662,7 @@ mdb_env_copyfd0(MDB_env *env, HANDLE fd)
 	}
 
 leave:
-	mdb_txn_abort(txn);
+	_mdb_txn_abort(txn);
 	return rc;
 }
 
@@ -9806,6 +9877,7 @@ int mdb_dbi_open(MDB_txn *txn, const char *name, unsigned int flags, MDB_dbi *db
 			}
 		}
 		mdb_default_cmp(txn, MAIN_DBI);
+		MDB_TRACE(("%p, (null), %u = %u", txn, flags, MAIN_DBI));
 		return MDB_SUCCESS;
 	}
 
@@ -9867,7 +9939,7 @@ int mdb_dbi_open(MDB_txn *txn, const char *name, unsigned int flags, MDB_dbi *db
 		dummy.md_root = P_INVALID;
 		dummy.md_flags = flags & PERSISTENT_FLAGS;
 		WITH_CURSOR_TRACKING(mc,
-			rc = mdb_cursor_put(&mc, &key, &data, F_SUBDATA));
+			rc = _mdb_cursor_put(&mc, &key, &data, F_SUBDATA));
 		dbflag |= DB_DIRTY;
 	}
 
@@ -9892,6 +9964,7 @@ int mdb_dbi_open(MDB_txn *txn, const char *name, unsigned int flags, MDB_dbi *db
 		if (!unused) {
 			txn->mt_numdbs++;
 		}
+		MDB_TRACE(("%p, %s, %u = %u", txn, name, flags, slot));
 	}
 
 	return rc;
@@ -9923,6 +9996,7 @@ void mdb_dbi_close(MDB_env *env, MDB_dbi dbi)
 	ptr = env->me_dbxs[dbi].md_name.mv_data;
 	/* If there was no name, this was already closed */
 	if (ptr) {
+		MDB_TRACE(("%p, %u", env, dbi));
 		env->me_dbxs[dbi].md_name.mv_data = NULL;
 		env->me_dbxs[dbi].md_name.mv_size = 0;
 		env->me_dbflags[dbi] = 0;
@@ -10057,6 +10131,7 @@ int mdb_drop(MDB_txn *txn, MDB_dbi dbi, int del)
 	if (rc)
 		return rc;
 
+	MDB_TRACE(("%u, %d", dbi, del));
 	rc = mdb_drop0(mc, mc->mc_db->md_flags & MDB_DUPSORT);
 	/* Invalidate the dropped DB's cursors */
 	for (m2 = txn->mt_cursors[dbi]; m2; m2 = m2->mc_next)
diff --git a/libraries/liblmdb/mdb_load.c b/libraries/liblmdb/mdb_load.c
index d2a3cec..cba6c06 100644
--- a/libraries/liblmdb/mdb_load.c
+++ b/libraries/liblmdb/mdb_load.c
@@ -449,7 +449,7 @@ int main(int argc, char *argv[])
 			if (rc == MDB_KEYEXIST && putflags)
 				continue;
 			if (rc) {
-				fprintf(stderr, "mdb_cursor_put failed, error %d %s\n", rc, mdb_strerror(rc));
+				fprintf(stderr, "%s: line %" Z "d: mdb_cursor_put failed, error %d %s\n", prog, lineno, rc, mdb_strerror(rc));
 				goto txn_abort;
 			}
 			batch++;
@@ -470,9 +470,11 @@ int main(int argc, char *argv[])
 					fprintf(stderr, "mdb_cursor_open failed, error %d %s\n", rc, mdb_strerror(rc));
 					goto txn_abort;
 				}
-				if (appflag & MDB_APPENDDUP) {
+				if (append) {
 					MDB_val k, d;
 					mdb_cursor_get(mc, &k, &d, MDB_LAST);
+					memcpy(prevk.mv_data, k.mv_data, k.mv_size);
+					prevk.mv_size = k.mv_size;
 				}
 				batch = 0;
 			}
diff --git a/libraries/liblmdb/midl.h b/libraries/liblmdb/midl.h
index 2075206..ff740ae 100644
--- a/libraries/liblmdb/midl.h
+++ b/libraries/liblmdb/midl.h
@@ -56,7 +56,9 @@ typedef MDB_ID *MDB_IDL;
 /* IDL sizes - likely should be even bigger
  *   limiting factors: sizeof(ID), thread stack size
  */
+#ifndef MDB_IDL_LOGN
 #define	MDB_IDL_LOGN	16	/* DB_SIZE is 2^16, UM_SIZE is 2^17 */
+#endif
 #define MDB_IDL_DB_SIZE		(1<<MDB_IDL_LOGN)
 #define MDB_IDL_UM_SIZE		(1<<(MDB_IDL_LOGN+1))
 
diff --git a/libraries/liblmdb/mplay.c b/libraries/liblmdb/mplay.c
new file mode 100644
index 0000000..0fef74f
--- /dev/null
+++ b/libraries/liblmdb/mplay.c
@@ -0,0 +1,582 @@
+/* mplay.c - memory-mapped database log replay */
+/*
+ * Copyright 2011-2023 Howard Chu, Symas Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <time.h>
+#include <string.h>
+#include <ctype.h>
+#include <assert.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+
+#include "lmdb.h"
+
+#define E(expr) CHECK((rc = (expr)) == MDB_SUCCESS, #expr)
+#define RES(err, expr) ((rc = expr) == (err) || (CHECK(!rc, #expr), 0))
+#define CHECK(test, msg) ((test) ? (void)0 : ((void)fprintf(stderr, \
+	"%s:%d: %s: %s\n", __FILE__, __LINE__, msg, mdb_strerror(rc)), abort()))
+
+#define MDB_SCNy(t)	"z" #t
+
+#define SCMP(s)	s, (sizeof(s)-1)
+char inbuf[8192];
+char *dbuf, *kbuf;
+size_t dbufsize;
+int maxkey;
+
+#define SOFF(s)	(sizeof(s)+1)
+
+#define MAXENVS	16
+#define MAXTXNS	16
+#define MAXCRSS	16
+
+#define MAXPIDS	16
+
+typedef struct crspair {
+	void *tcrs;	/* scanned text pointer */
+	MDB_cursor *rcrs;
+} crspair;
+
+typedef struct txnpair {
+	void *ttxn;	/* scanned text pointer */
+	MDB_txn *rtxn;
+	crspair cursors[MAXCRSS];
+	int ncursors;
+} txnpair;
+
+typedef struct envpair {
+	void *tenv;
+	MDB_env *renv;
+	txnpair txns[MAXTXNS];
+	int ntxns;
+} envpair;
+
+envpair envs[MAXENVS];
+int nenvs;
+
+envpair *lastenv;
+txnpair *lasttxn;
+crspair *lastcrs;
+
+typedef struct pidpair {
+	int tpid;
+	pid_t rpid;
+	int fdout, fdin;
+} pidpair;
+
+pidpair *lastpid;
+
+pidpair pids[MAXPIDS];
+int npids;
+
+unsigned long lcount;
+
+static int unhex(unsigned char *c2)
+{
+	int x, c;
+	x = *c2++ & 0x4f;
+	if (x & 0x40)
+		x -= 55;
+	c = x << 4;
+	x = *c2 & 0x4f;
+	if (x & 0x40)
+		x -= 55;
+	c |= x;
+	return c;
+}
+
+int inhex(char *in, char *out)
+{
+	char *c2 = out;
+	while (isxdigit(*in)) {
+		*c2++ = unhex((unsigned char *)in);
+		in += 2;
+	}
+	return c2 - out;
+}
+
+static void addenv(void *tenv, MDB_env *renv)
+{
+	assert(nenvs < MAXENVS);
+	envs[nenvs].tenv = tenv;
+	envs[nenvs].renv = renv;
+	envs[nenvs].ntxns = 0;
+	lastenv = envs+nenvs;
+	nenvs++;
+}
+
+static envpair *findenv(void *tenv)
+{
+	int i;
+	if (!lastenv || lastenv->tenv != tenv) {
+		for (i=0; i<nenvs; i++)
+			if (envs[i].tenv == tenv)
+				break;
+		assert(i < nenvs);
+		lastenv = &envs[i];
+	}
+	return lastenv;
+}
+
+static void delenv(envpair *ep)
+{
+	int i = ep - envs;
+	for (; i<nenvs-1; i++)
+		envs[i] = envs[i+1];
+	nenvs--;
+	lastenv = NULL;
+}
+
+static void addtxn(void *tenv, void *ttxn, MDB_txn *rtxn)
+{
+	envpair *ep;
+	txnpair *tp;
+
+	ep = findenv(tenv);
+	assert(ep->ntxns < MAXTXNS);
+	tp = ep->txns+ep->ntxns;
+	tp->ttxn = ttxn;
+	tp->rtxn = rtxn;
+	tp->ncursors = 0;
+	ep->ntxns++;
+	lasttxn = tp;
+}
+
+static txnpair *findtxn(void *ttxn)
+{
+	int i, j;
+	if (lasttxn && lasttxn->ttxn == ttxn)
+		return lasttxn;
+	if (lastenv) {
+		for (i=0; i<lastenv->ntxns; i++) {
+			if (lastenv->txns[i].ttxn == ttxn) {
+				lasttxn = lastenv->txns+i;
+				return lasttxn;
+			}
+		}
+	}
+	for (i=0; i<nenvs; i++) {
+		if (envs+i == lastenv) continue;
+		for (j=0; j<envs[i].ntxns; j++) {
+			if (envs[i].txns[j].ttxn == ttxn) {
+				lastenv = envs+i;
+				lasttxn = envs[i].txns+j;
+				return lasttxn;
+			}
+		}
+	}
+	assert(0);	/* should have found it */
+}
+
+static void deltxn(txnpair *tp)
+{
+	int i = tp - lastenv->txns;
+	for (; i<lastenv->ntxns-1; i++)
+		lastenv->txns[i] = lastenv->txns[i+1];
+	lastenv->ntxns--;
+	lasttxn = NULL;
+}
+
+static void addcrs(txnpair *tp, void *tcrs, MDB_cursor *rcrs)
+{
+	int j = tp->ncursors;
+	assert(tp->ncursors < MAXCRSS);
+
+	tp->cursors[j].tcrs = tcrs;
+	tp->cursors[j].rcrs = rcrs;
+	tp->ncursors++;
+	lastcrs = tp->cursors+j;
+}
+
+static crspair *findcrs(void *tcrs)
+{
+	int i, j, k;
+	envpair *ep;
+	txnpair *tp;
+	crspair *cp;
+	if (lastcrs && lastcrs->tcrs == tcrs)
+		return lastcrs;
+	if (lasttxn) {
+		for (k=0, cp=lasttxn->cursors; k<lasttxn->ncursors; k++, cp++) {
+			if (cp->tcrs == tcrs) {
+				lastcrs = cp;
+				return lastcrs;
+			}
+		}
+	}
+	if (lastenv) {
+		for (j=0, tp=lastenv->txns; j<lastenv->ntxns; j++, tp++){
+			if (tp == lasttxn)
+				continue;
+			for (k=0, cp = tp->cursors; k<tp->ncursors; k++, cp++) {
+				if (cp->tcrs == tcrs) {
+					lastcrs = cp;
+					lasttxn = tp;
+					return lastcrs;
+				}
+			}
+		}
+	}
+	for (i=0, ep=envs; i<nenvs; i++, ep++) {
+		for (j=0, tp=ep->txns; j<ep->ntxns; j++, tp++) {
+			if (tp == lasttxn)
+				continue;
+			for (k=0, cp = tp->cursors; k<tp->ncursors; k++, cp++) {
+				if (cp->tcrs == tcrs) {
+					lastcrs = cp;
+					lasttxn = tp;
+					lastenv = ep;
+					return lastcrs;
+				}
+			}
+		}
+	}
+	assert(0);	/* should have found it already */
+}
+
+static void delcrs(void *tcrs)
+{
+	int i;
+	crspair *cp = findcrs(tcrs);
+	mdb_cursor_close(cp->rcrs);
+	for (i = cp - lasttxn->cursors; i<lasttxn->ncursors-1; i++)
+		lasttxn->cursors[i] = lasttxn->cursors[i+1];
+	lasttxn->ncursors--;
+	lastcrs = NULL;
+}
+
+void child()
+{
+	int rc;
+	MDB_val key, data;
+	char *ptr;
+
+	while (fgets(inbuf, sizeof(inbuf), stdin)) {
+		ptr = inbuf;
+		if (!strncmp(ptr, SCMP("exit")))
+			break;
+
+		if (!strncmp(ptr, SCMP("mdb_env_create"))) {
+			void *tenv;
+			MDB_env *renv;
+			sscanf(ptr+SOFF("mdb_env_create"), "%p", &tenv);
+			E(mdb_env_create(&renv));
+			addenv(tenv, renv);
+		} else if (!strncmp(ptr, SCMP("mdb_env_set_maxdbs"))) {
+			void *tenv;
+			envpair *ep;
+			unsigned int maxdbs;
+			sscanf(ptr+SOFF("mdb_env_set_maxdbs"), "%p, %u", &tenv, &maxdbs);
+			ep = findenv(tenv);
+			E(mdb_env_set_maxdbs(ep->renv, maxdbs));
+		} else if (!strncmp(ptr, SCMP("mdb_env_set_mapsize"))) {
+			void *tenv;
+			envpair *ep;
+			size_t mapsize;
+			sscanf(ptr+SOFF("mdb_env_set_mapsize"), "%p, %"MDB_SCNy(u), &tenv, &mapsize);
+			ep = findenv(tenv);
+			E(mdb_env_set_mapsize(ep->renv, mapsize));
+		} else if (!strncmp(ptr, SCMP("mdb_env_open"))) {
+			void *tenv;
+			envpair *ep;
+			char *path;
+			int len;
+			unsigned int flags, mode;
+			sscanf(ptr+SOFF("mdb_env_open"), "%p, %n", &tenv, &len);
+			path = ptr+SOFF("mdb_env_open")+len;
+			ptr = strchr(path, ',');
+			*ptr++ = '\0';
+			sscanf(ptr, "%u, %o", &flags, &mode);
+			ep = findenv(tenv);
+			E(mdb_env_open(ep->renv, path, flags, mode));
+			if (!maxkey) {
+				maxkey = mdb_env_get_maxkeysize(ep->renv);
+				kbuf = malloc(maxkey+2);
+				dbuf = malloc(maxkey+2);
+				dbufsize = maxkey;
+			}
+		} else if (!strncmp(ptr, SCMP("mdb_env_close"))) {
+			void *tenv;
+			envpair *ep;
+			sscanf(ptr+SOFF("mdb_env_close"), "%p", &tenv);
+			ep = findenv(tenv);
+			mdb_env_close(ep->renv);
+			delenv(ep);
+			if (!nenvs)	/* if no other envs left, this process is done */
+				break;
+		} else if (!strncmp(ptr, SCMP("mdb_txn_begin"))) {
+			unsigned int flags;
+			void *tenv, *ttxn;
+			envpair *ep;
+			MDB_txn *rtxn;
+			sscanf(ptr+SOFF("mdb_txn_begin"), "%p, %*p, %u = %p", &tenv, &flags, &ttxn);
+			ep = findenv(tenv);
+			E(mdb_txn_begin(ep->renv, NULL, flags, &rtxn));
+			addtxn(tenv, ttxn, rtxn);
+		} else if (!strncmp(ptr, SCMP("mdb_txn_commit"))) {
+			void *ttxn;
+			txnpair *tp;
+			sscanf(ptr+SOFF("mdb_txn_commit"), "%p", &ttxn);
+			tp = findtxn(ttxn);
+			E(mdb_txn_commit(tp->rtxn));
+			deltxn(tp);
+		} else if (!strncmp(ptr, SCMP("mdb_txn_abort"))) {
+			void *ttxn;
+			txnpair *tp;
+			sscanf(ptr+SOFF("mdb_txn_abort"), "%p", &ttxn);
+			tp = findtxn(ttxn);
+			mdb_txn_abort(tp->rtxn);
+			deltxn(tp);
+		} else if (!strncmp(ptr, SCMP("mdb_dbi_open"))) {
+			void *ttxn;
+			txnpair *tp;
+			char *dbname;
+			unsigned int flags;
+			unsigned int tdbi;
+			MDB_dbi dbi;
+			sscanf(ptr+SOFF("mdb_dbi_open"), "%p, ", &ttxn);
+			dbname = strchr(ptr+SOFF("mdb_dbi_open"), ',');
+			dbname += 2;
+			ptr = strchr(dbname, ',');
+			*ptr++ = '\0';
+			if (!strcmp(dbname, "(null)"))
+				dbname = NULL;
+			sscanf(ptr, "%u = %u", &flags, &tdbi);
+			tp = findtxn(ttxn);
+			E(mdb_dbi_open(tp->rtxn, dbname, flags, &dbi));
+		} else if (!strncmp(ptr, SCMP("mdb_dbi_close"))) {
+			void *tenv;
+			envpair *ep;
+			unsigned int tdbi;
+			sscanf(ptr+SOFF("mdb_dbi_close"), "%p, %u", &tenv, &tdbi);
+			ep = findenv(tenv);
+			mdb_dbi_close(ep->renv, tdbi);
+		} else if (!strncmp(ptr, SCMP("mdb_cursor_open"))) {
+			void *ttxn, *tcrs;
+			txnpair *tp;
+			MDB_cursor *rcrs;
+			unsigned int tdbi;
+			sscanf(ptr+SOFF("mdb_cursor_open"), "%p, %u = %p", &ttxn, &tdbi, &tcrs);
+			tp = findtxn(ttxn);
+			E(mdb_cursor_open(tp->rtxn, tdbi, &rcrs));
+			addcrs(tp, tcrs, rcrs);
+		} else if (!strncmp(ptr, SCMP("mdb_cursor_close"))) {
+			void *tcrs;
+			sscanf(ptr+SOFF("mdb_cursor_close"), "%p", &tcrs);
+			delcrs(tcrs);
+		} else if (!strncmp(ptr, SCMP("mdb_cursor_put"))) {
+			void *tcrs;
+			crspair *cp;
+			unsigned int flags;
+			int len;
+			sscanf(ptr+SOFF("mdb_cursor_put"), "%p, ", &tcrs);
+			cp = findcrs(tcrs);
+			ptr = strchr(ptr+SOFF("mdb_cursor_put"), ',');
+			sscanf(ptr+1, "%"MDB_SCNy(u)",", &key.mv_size);
+			if (key.mv_size) {
+				ptr = strchr(ptr, '[');
+				inhex(ptr+1, kbuf);
+				key.mv_data = kbuf;
+				ptr += key.mv_size * 2 + 2;
+			}
+			ptr = strchr(ptr+1, ',');
+			sscanf(ptr+1, "%"MDB_SCNy(u)"%n", &data.mv_size, &len);
+			if (data.mv_size > dbufsize) {
+				dbuf = realloc(dbuf, data.mv_size+2);
+				assert(dbuf != NULL);
+				dbufsize = data.mv_size;
+			}
+			ptr += len+1;
+			if (*ptr == '[') {
+				inhex(ptr+1, dbuf);
+				data.mv_data = dbuf;
+				ptr += data.mv_size * 2 + 2;
+			} else {
+				sprintf(dbuf, "%09ld", (long)mdb_txn_id(lasttxn->rtxn));
+			}
+			sscanf(ptr+1, "%u", &flags);
+			E(mdb_cursor_put(cp->rcrs, &key, &data, flags));
+		} else if (!strncmp(ptr, SCMP("mdb_cursor_del"))) {
+			void *tcrs;
+			crspair *cp;
+			unsigned int flags;
+			sscanf(ptr+SOFF("mdb_cursor_del"), "%p, %u", &tcrs, &flags);
+			cp = findcrs(tcrs);
+			E(mdb_cursor_del(cp->rcrs, flags));
+		} else if (!strncmp(ptr, SCMP("mdb_put"))) {
+			void *ttxn;
+			txnpair *tp;
+			unsigned int tdbi, flags;
+			int len;
+			sscanf(ptr+SOFF("mdb_put"),"%p, %u, %"MDB_SCNy(u), &ttxn, &tdbi, &key.mv_size);
+			tp = findtxn(ttxn);
+			ptr = strchr(ptr+SOFF("mdb_put"), '[');
+			inhex(ptr+1, kbuf);
+			key.mv_data = kbuf;
+			ptr += key.mv_size * 2 + 2;
+			sscanf(ptr+1, "%"MDB_SCNy(u)"%n", &data.mv_size, &len);
+			if (data.mv_size > dbufsize) {
+				dbuf = realloc(dbuf, data.mv_size+2);
+				assert(dbuf != NULL);
+				dbufsize = data.mv_size;
+			}
+			ptr += len+1;
+			if (*ptr == '[') {
+				inhex(ptr+1, dbuf);
+				ptr += data.mv_size * 2 + 2;
+			} else {
+				sprintf(dbuf, "%09ld", (long)mdb_txn_id(tp->rtxn));
+			}
+			data.mv_data = dbuf;
+			sscanf(ptr+1, "%u", &flags);
+			RES(MDB_KEYEXIST,mdb_put(tp->rtxn, tdbi, &key, &data, flags));
+		} else if (!strncmp(ptr, SCMP("mdb_del"))) {
+			void *ttxn;
+			txnpair *tp;
+			unsigned int tdbi;
+			int len;
+			sscanf(ptr+SOFF("mdb_del"),"%p, %u, %"MDB_SCNy(u), &ttxn, &tdbi, &key.mv_size);
+			tp = findtxn(ttxn);
+			ptr = strchr(ptr+SOFF("mdb_del"), '[');
+			inhex(ptr+1, kbuf);
+			key.mv_data = kbuf;
+			ptr += key.mv_size * 2 + 2;
+			sscanf(ptr+1, "%"MDB_SCNy(u)"%n", &data.mv_size, &len);
+			if (data.mv_size > dbufsize) {
+				dbuf = realloc(dbuf, data.mv_size+2);
+				assert(dbuf != NULL);
+				dbufsize = data.mv_size;
+			}
+			ptr += len+1;
+			if (*ptr == '[') {
+				inhex(ptr+1, dbuf);
+			} else {
+				sprintf(dbuf, "%09ld", (long)mdb_txn_id(tp->rtxn));
+			}
+			data.mv_data = dbuf;
+			RES(MDB_NOTFOUND,mdb_del(tp->rtxn, tdbi, &key, &data));
+		}
+		write(1, "\n", 1);
+	}
+	exit(0);
+}
+
+static pidpair *addpid(int tpid)
+{
+	int fdout[2], fdin[2];
+	pid_t pid;
+	assert(npids < MAXPIDS);
+	pids[npids].tpid = tpid;
+	pipe(fdout);
+	pipe(fdin);
+	if ((pid = fork()) == 0) {
+		/* child */
+		fclose(stdin);
+		fclose(stdout);
+		dup2(fdout[0], 0);
+		dup2(fdin[1], 1);
+		stdin = fdopen(0, "r");
+		stdout = fdopen(1, "w");
+		child();
+		return 0;	/* NOTREACHED */
+	} else {
+		pids[npids].rpid = pid;
+		pids[npids].fdout = fdout[1];
+		pids[npids].fdin = fdin[0];
+		lastpid = pids+npids;
+		npids++;
+		return lastpid;
+	}
+}
+
+static pidpair *findpid(int tpid)
+{
+	int i;
+	if (!lastpid || lastpid->tpid != tpid) {
+		for (i=0; i<npids; i++)
+			if (pids[i].tpid == tpid)
+				break;
+		if (i == npids)
+			return NULL;
+		lastpid = &pids[i];
+	}
+	return lastpid;
+}
+
+volatile pid_t killpid;
+
+static void delpid(int tpid)
+{
+	pidpair *pp = findpid(tpid);
+	if (pp) {
+		pid_t kpid = pp->rpid;
+		killpid = kpid;
+		write(pp->fdout, "exit\n", sizeof("exit"));
+		while (killpid == kpid)
+			usleep(10000);
+	}
+}
+
+static void reaper(int sig)
+{
+	int status, i;
+	pid_t pid = waitpid(-1, &status, 0);
+	if (pid > 0) {
+		fprintf(stderr, "# %s %d\n", WIFEXITED(status) ? "exited" : "killed", pid);
+		for (i=0; i<npids; i++)
+			if (pids[i].rpid == pid)
+				break;
+		assert(i < npids);
+		close(pids[i].fdout);
+		close(pids[i].fdin);
+		for (;i<npids-1; i++)
+			pids[i] = pids[i+1];
+		npids--;
+		killpid = 0;
+	}
+}
+
+int main(int argc,char * argv[])
+{
+	signal(SIGCHLD, reaper);
+
+	while (fgets(inbuf, sizeof(inbuf), stdin)) {
+		pidpair *pp;
+		int tpid, len;
+		char c, *ptr;
+		lcount++;
+
+		if (inbuf[0] == '#' && !strncmp(inbuf+1, SCMP(" killed"))) {
+			sscanf(inbuf+SOFF("killed"),"%d", &tpid);
+			delpid(tpid);
+			continue;
+		}
+
+		if (inbuf[0] != '>')
+			continue;
+		ptr = inbuf+1;
+		sscanf(ptr, "%d:%n", &tpid, &len);
+		pp = findpid(tpid);
+		if (!pp)
+			pp = addpid(tpid);	/* new process */
+
+		ptr = inbuf+len+1;
+		len = strlen(ptr);
+		write(pp->fdout, ptr, len);	/* send command and wait for ack */
+		read(pp->fdin, &c, 1);
+	}
+	while (npids)
+		delpid(pids[0].tpid);
+}
diff --git a/servers/lloadd/daemon.c b/servers/lloadd/daemon.c
index b88fd68..e048936 100644
--- a/servers/lloadd/daemon.c
+++ b/servers/lloadd/daemon.c
@@ -92,6 +92,11 @@ struct event_base *listener_base = NULL;
 LloadListener **lload_listeners = NULL;
 static ldap_pvt_thread_t listener_tid, *daemon_tid;
 
+#ifndef RESOLV_CONF_PATH
+#define RESOLV_CONF_PATH "/etc/resolv.conf"
+#endif
+char *lload_resolvconf_path = RESOLV_CONF_PATH;
+
 struct event_base *daemon_base = NULL;
 struct evdns_base *dnsbase;
 
@@ -1238,13 +1243,22 @@ lloadd_daemon( struct event_base *daemon_base )
 
     assert( daemon_base != NULL );
 
-    dnsbase = evdns_base_new( daemon_base, EVDNS_BASE_INITIALIZE_NAMESERVERS );
+    dnsbase = evdns_base_new( daemon_base, 0 );
     if ( !dnsbase ) {
         Debug( LDAP_DEBUG_ANY, "lloadd startup: "
                 "failed to set up for async name resolution\n" );
         return -1;
     }
 
+    /*
+     * ITS#10070: Allow both operation without working DNS (test environments)
+     * and e.g. containers that don't have a /etc/resolv.conf but do have a
+     * server listening on 127.0.0.1 which is the default.
+     */
+    (void)evdns_base_resolv_conf_parse( dnsbase,
+            DNS_OPTION_NAMESERVERS|DNS_OPTION_HOSTSFILE,
+            lload_resolvconf_path );
+
     if ( lload_daemon_threads > SLAPD_MAX_DAEMON_THREADS )
         lload_daemon_threads = SLAPD_MAX_DAEMON_THREADS;
 
diff --git a/servers/lloadd/libevent_support.c b/servers/lloadd/libevent_support.c
index 2f94c5e..8d7378c 100644
--- a/servers/lloadd/libevent_support.c
+++ b/servers/lloadd/libevent_support.c
@@ -131,6 +131,12 @@ lload_libevent_cond_timedwait(
     return ldap_pvt_thread_cond_wait( cond, mutex );
 }
 
+unsigned long
+lload_libevent_thread_self( void )
+{
+    return (unsigned long)ldap_pvt_thread_self();
+}
+
 int
 lload_libevent_init( void )
 {
@@ -160,7 +166,7 @@ lload_libevent_init( void )
 
     evthread_set_lock_callbacks( &cbs );
     evthread_set_condition_callbacks( &cond_cbs );
-    evthread_set_id_callback( ldap_pvt_thread_self );
+    evthread_set_id_callback( lload_libevent_thread_self );
     return 0;
 }
 
diff --git a/servers/lloadd/module_init.c b/servers/lloadd/module_init.c
index 1475538..d4eebf6 100644
--- a/servers/lloadd/module_init.c
+++ b/servers/lloadd/module_init.c
@@ -145,7 +145,6 @@ lload_back_initialize( BackendInfo *bi )
 {
     bi->bi_flags = SLAP_BFLAG_STANDALONE;
     bi->bi_open = lload_back_open;
-    bi->bi_config = config_generic_wrapper;
     bi->bi_pause = lload_pause_cb;
     bi->bi_unpause = lload_unpause_cb;
     bi->bi_close = lload_back_close;
diff --git a/servers/lloadd/upstream.c b/servers/lloadd/upstream.c
index 6824fa8..5e64029 100644
--- a/servers/lloadd/upstream.c
+++ b/servers/lloadd/upstream.c
@@ -118,17 +118,22 @@ static int
 handle_unsolicited( LloadConnection *c, BerElement *ber )
 {
     CONNECTION_ASSERT_LOCKED(c);
-    if ( c->c_state != LLOAD_C_PREPARING ) {
-        c->c_state = LLOAD_C_CLOSING;
+
+    assert( c->c_state != LLOAD_C_INVALID );
+    if ( c->c_state == LLOAD_C_DYING ) {
+        CONNECTION_UNLOCK(c);
+        goto out;
     }
+    c->c_state = LLOAD_C_CLOSING;
 
     Debug( LDAP_DEBUG_STATS, "handle_unsolicited: "
             "teardown for upstream connection connid=%lu\n",
             c->c_connid );
 
     CONNECTION_DESTROY(c);
-    ber_free( ber, 1 );
 
+out:
+    ber_free( ber, 1 );
     return -1;
 }
 
diff --git a/servers/slapd/aci.c b/servers/slapd/aci.c
index 33e6074..c8cc41d 100644
--- a/servers/slapd/aci.c
+++ b/servers/slapd/aci.c
@@ -39,6 +39,7 @@
 #include "slap.h"
 #include "lber_pvt.h"
 #include "lutil.h"
+#include "slap-config.h"
 
 /* use most appropriate size */
 #define ACI_BUF_SIZE 			1024
@@ -741,8 +742,7 @@ aci_init( void )
 
 static int
 dynacl_aci_parse(
-	const char *fname,
-	int lineno,
+	ConfigArgs *c,
 	const char *opts,
 	slap_style_t sty,
 	const char *right,
@@ -752,17 +752,19 @@ dynacl_aci_parse(
 	const char		*text = NULL;
 
 	if ( sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE ) {
-		fprintf( stderr, "%s: line %d: "
-			"inappropriate style \"%s\" in \"aci\" by clause\n",
-			fname, lineno, style_strings[sty] );
+		snprintf( c->cr_msg, sizeof( c->cr_msg ),
+			"inappropriate style \"%s\" in \"aci\" by clause",
+			style_strings[sty] );
+		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 		return -1;
 	}
 
 	if ( right != NULL && *right != '\0' ) {
 		if ( slap_str2ad( right, &ad, &text ) != LDAP_SUCCESS ) {
-			fprintf( stderr,
-				"%s: line %d: aci \"%s\": %s\n",
-				fname, lineno, right, text );
+			snprintf( c->cr_msg, sizeof( c->cr_msg ),
+				"aci \"%s\": %s",
+				right, text );
+			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 			return -1;
 		}
 
@@ -771,10 +773,10 @@ dynacl_aci_parse(
 	}
 
 	if ( !is_at_syntax( ad->ad_type, SLAPD_ACI_SYNTAX) ) {
-		fprintf( stderr, "%s: line %d: "
-			"aci \"%s\": inappropriate syntax: %s\n",
-			fname, lineno, right,
-			ad->ad_type->sat_syntax_oid );
+		snprintf( c->cr_msg, sizeof( c->cr_msg ),
+			"aci \"%s\": inappropriate syntax: %s",
+			right, ad->ad_type->sat_syntax_oid );
+		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 		return -1;
 	}
 
diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index 60b74e3..f08de6a 100644
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -37,6 +37,7 @@
 #include "slap.h"
 #include "lber_pvt.h"
 #include "lutil.h"
+#include "slap-config.h"
 
 static const char style_base[] = "base";
 const char *style_strings[] = {
@@ -76,8 +77,7 @@ static int		check_scope( BackendDB *be, AccessControl *a );
 #ifdef SLAP_DYNACL
 static int
 slap_dynacl_config(
-	const char *fname,
-	int lineno,
+	struct config_args_s *c,
 	Access *b,
 	const char *name,
 	const char *opts,
@@ -89,9 +89,10 @@ slap_dynacl_config(
 
 	for ( da = b->a_dynacl; da; da = da->da_next ) {
 		if ( strcasecmp( da->da_name, name ) == 0 ) {
-			Debug( LDAP_DEBUG_ANY,
-				"%s: line %d: dynacl \"%s\" already specified.\n",
-				fname, lineno, name );
+			snprintf( c->cr_msg, sizeof( c->cr_msg ),
+				"dynacl \"%s\" already specified",
+				name );
+			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 			return acl_usage();
 		}
 	}
@@ -105,7 +106,7 @@ slap_dynacl_config(
 	*tmp = *da;
 
 	if ( tmp->da_parse ) {
-		rc = ( *tmp->da_parse )( fname, lineno, opts, sty, right, &tmp->da_private );
+		rc = ( *tmp->da_parse )( c, opts, sty, right, &tmp->da_private );
 		if ( rc ) {
 			ch_free( tmp );
 			return rc;
@@ -119,8 +120,8 @@ slap_dynacl_config(
 }
 #endif /* SLAP_DYNACL */
 
-static void
-regtest(const char *fname, int lineno, char *pat) {
+static int
+regtest(struct config_args_s *c, char *pat) {
 	int e;
 	regex_t re;
 
@@ -156,25 +157,27 @@ regtest(const char *fname, int lineno, char *pat) {
 
 	*dp = '\0';
 	if ( size >= (sizeof(buf) - 1) ) {
-		Debug( LDAP_DEBUG_ANY,
-			"%s: line %d: regular expression \"%s\" too large\n",
-			fname, lineno, pat );
+		snprintf( c->cr_msg, sizeof( c->cr_msg),
+				  "regular expression too large \"%s\"", pat);
+		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 		(void)acl_usage();
-		exit( EXIT_FAILURE );
+		return -1;
 	}
 
-	if ((e = regcomp(&re, buf, REG_EXTENDED|REG_ICASE))) {
+	if ( (e = regcomp(&re, buf, REG_EXTENDED|REG_ICASE)) ) {
 		char error[ SLAP_TEXT_BUFLEN ];
 
 		regerror(e, &re, error, sizeof(error));
 
-		Debug(LDAP_DEBUG_ANY,
-		      "%s: line %d: regular expression \"%s\" bad because of %s\n",
-		      fname, lineno, pat, error );
+		snprintf( c->cr_msg, sizeof ( c->cr_msg ),
+				  "regular expression \"%s\" bad because of %s", pat, error);
+		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 		acl_usage();
-		exit( EXIT_FAILURE );
+		regfree(&re);
+		return -1;
 	}
 	regfree(&re);
+	return 0;
 }
 
 /*
@@ -212,7 +215,7 @@ check_scope( BackendDB *be, AccessControl *a )
 			ber_len_t	rebuflen;
 			regex_t		re;
 			int		rc;
-			
+
 			/* add trailing '$' to database suffix to form
 			 * a simple trial regex pattern "<suffix>$" */
 			AC_MEMCPY( dnbuf, be->be_nsuffix[0].bv_val,
@@ -319,11 +322,7 @@ regex_done:;
 
 int
 parse_acl(
-	Backend	*be,
-	const char	*fname,
-	int		lineno,
-	int		argc,
-	char		**argv,
+	struct config_args_s *c,
 	int		pos )
 {
 	int		i;
@@ -333,14 +332,19 @@ parse_acl(
 	Access	*b = NULL;
 	int rc;
 	const char *text;
+	Backend *be = c->be;
+	const char *fname = c->fname;
+	int lineno = c->lineno;
+	int argc = c->argc;
+	char **argv = c->argv;
 
 	for ( i = 1; i < argc; i++ ) {
 		/* to clause - select which entries are protected */
 		if ( strcasecmp( argv[i], "to" ) == 0 ) {
 			if ( a != NULL ) {
-				Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-					"only one to clause allowed in access line\n",
-				    fname, lineno );
+				snprintf( c->cr_msg, sizeof( c->cr_msg ),
+					"only one to clause allowed in access line" );
+				Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 				goto fail;
 			}
 			a = (AccessControl *) ch_calloc( 1, sizeof(AccessControl) );
@@ -355,10 +359,9 @@ parse_acl(
 					if ( !BER_BVISEMPTY( &a->acl_dn_pat ) ||
 						a->acl_dn_style != ACL_STYLE_REGEX )
 					{
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: dn pattern"
-							" already specified in to clause.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						"dn pattern already specified in to clause." );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -370,9 +373,9 @@ parse_acl(
 				split( left, '.', &left, &style );
 
 				if ( right == NULL ) {
-					Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-						"missing \"=\" in \"%s\" in to clause\n",
-					    fname, lineno, left );
+					snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							  "missing \"=\" in \"%s\" in to clause", left );
+					Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 					goto fail;
 				}
 
@@ -380,10 +383,9 @@ parse_acl(
 					if ( !BER_BVISEMPTY( &a->acl_dn_pat ) ||
 						a->acl_dn_style != ACL_STYLE_REGEX )
 					{
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: dn pattern"
-							" already specified in to clause.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg),
+						"dn pattern already specified in to clause" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -424,12 +426,12 @@ parse_acl(
 							a->acl_dn_style = ACL_STYLE_BASE;
 							ber_str2bv( right, 0, 1, &a->acl_dn_pat );
 
-						} else if ( strcmp(right, "*") == 0 
-							|| strcmp(right, ".*") == 0 
-							|| strcmp(right, ".*$") == 0 
-							|| strcmp(right, "^.*") == 0 
+						} else if ( strcmp(right, "*") == 0
+							|| strcmp(right, ".*") == 0
+							|| strcmp(right, ".*$") == 0
+							|| strcmp(right, "^.*") == 0
 							|| strcmp(right, "^.*$") == 0
-							|| strcmp(right, ".*$$") == 0 
+							|| strcmp(right, ".*$$") == 0
 							|| strcmp(right, "^.*$$") == 0 )
 						{
 							ber_str2bv( "*", STRLENOF("*"), 1, &a->acl_dn_pat );
@@ -439,9 +441,9 @@ parse_acl(
 						}
 
 					} else {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"unknown dn style \"%s\" in to clause\n",
-						    fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						"unknown dn style \"%s\" in to clause", style );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -450,9 +452,9 @@ parse_acl(
 
 				if ( strcasecmp( left, "filter" ) == 0 ) {
 					if ( (a->acl_filter = str2filter( right )) == NULL ) {
-						Debug( LDAP_DEBUG_ANY,
-				"%s: line %d: bad filter \"%s\" in to clause\n",
-						    fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						"bad filter \"%s\" in to clause", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -460,37 +462,36 @@ parse_acl(
 						|| strcasecmp( left, "attrs" ) == 0 )	/* DOCUMENTED */
 				{
 					if ( strcasecmp( left, "attr" ) == 0 ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: \"attr\" "
-							"is deprecated (and undocumented); "
-							"use \"attrs\" instead.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								  "\"attr\" is deprecated (and undocumented); "
+								  "use \"attrs\" instead");
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 					}
 
 					a->acl_attrs = str2anlist( a->acl_attrs,
 						right, "," );
 					if ( a->acl_attrs == NULL ) {
-						Debug( LDAP_DEBUG_ANY,
-				"%s: line %d: unknown attr \"%s\" in to clause\n",
-						    fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								  "unknown attr \"%s\" in to clause", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 				} else if ( strncasecmp( left, "val", 3 ) == 0 ) {
 					struct berval	bv;
 					char		*mr;
-					
+
 					if ( !BER_BVISEMPTY( &a->acl_attrval ) ) {
-						Debug( LDAP_DEBUG_ANY,
-				"%s: line %d: attr val already specified in to clause.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								  "attr val already specified in to clause" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 					if ( a->acl_attrs == NULL || !BER_BVISEMPTY( &a->acl_attrs[1].an_name ) )
 					{
-						Debug( LDAP_DEBUG_ANY,
-				"%s: line %d: attr val requires a single attribute.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						"attr val requires a single attribute");
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -504,23 +505,23 @@ parse_acl(
 
 						a->acl_attrval_mr = mr_find( mr );
 						if ( a->acl_attrval_mr == NULL ) {
-							Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-								"invalid matching rule \"%s\".\n",
-								fname, lineno, mr );
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								"invalid matching rule \"%s\"", mr);
+							Debug( LDAP_DEBUG_ANY, "%s: %s\n", c->log, c->cr_msg );
 							goto fail;
 						}
 
 						if( !mr_usable_with_at( a->acl_attrval_mr, a->acl_attrs[ 0 ].an_desc->ad_type ) )
 						{
-							Debug(LDAP_DEBUG_ANY,
-							      "%s: line %d: matching rule \"%s\" use " "with attr \"%s\" not appropriate.\n",
-							      fname, lineno,
-							      mr,
-							      a->acl_attrs[0].an_name.bv_val );
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							      "matching rule \"%s\" use " "with attr \"%s\" not appropriate",
+									  mr,
+									  a->acl_attrs[0].an_name.bv_val );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c-> log, c->cr_msg );
 							goto fail;
 						}
 					}
-					
+
 					if ( style != NULL ) {
 						if ( strcasecmp( style, "regex" ) == 0 ) {
 							int e = regcomp( &a->acl_attrval_re, bv.bv_val,
@@ -529,9 +530,10 @@ parse_acl(
 								char	err[SLAP_TEXT_BUFLEN];
 
 								regerror( e, &a->acl_attrval_re, err, sizeof( err ) );
-								Debug(LDAP_DEBUG_ANY,
-								      "%s: line %d: regular expression \"%s\" bad because of %s\n",
-								      fname, lineno, right, err );
+								snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								      "regular expression \"%s\" bad because of %s",
+								      right, err );
+								Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 								goto fail;
 							}
 							a->acl_attrval_style = ACL_STYLE_REGEX;
@@ -561,34 +563,31 @@ parse_acl(
 								} else if ( !strcasecmp( style, "children" ) ) {
 									a->acl_attrval_style = ACL_STYLE_CHILDREN;
 								} else {
-									Debug(LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL,
-									      "%s: line %d: unknown val.<style> \"%s\" for attributeType \"%s\" " "with DN syntax.\n",
-									      fname,
-									      lineno,
+									snprintf( c->cr_msg, sizeof( c->cr_msg ),
+									      "unknown val.<style> \"%s\" for attributeType \"%s\" " "with DN syntax",
 									      style,
 									      a->acl_attrs[0].an_desc->ad_cname.bv_val );
+									Debug( LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 									goto fail;
 								}
 
 								rc = dnNormalize( 0, NULL, NULL, &bv, &a->acl_attrval, NULL );
 								if ( rc != LDAP_SUCCESS ) {
-									Debug(LDAP_DEBUG_ANY,
-									      "%s: line %d: unable to normalize DN \"%s\" " "for attributeType \"%s\" (%d).\n",
-									      fname,
-									      lineno,
+									snprintf( c->cr_msg, sizeof( c->cr_msg ),
+									      "unable to normalize DN \"%s\" " "for attributeType \"%s\" (%d)",
 									      bv.bv_val,
 									      a->acl_attrs[0].an_desc->ad_cname.bv_val,
 									      rc );
+									Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 									goto fail;
 								}
 
 							} else {
-								Debug(LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL,
-								      "%s: line %d: unknown val.<style> \"%s\" for attributeType \"%s\".\n",
+								snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								      "unknown val.<style> \"%s\" for attributeType \"%s\"",
 								      fname,
-								      lineno,
-								      style,
 								      a->acl_attrs[0].an_desc->ad_cname.bv_val );
+								Debug( LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 								goto fail;
 							}
 						}
@@ -607,9 +606,10 @@ parse_acl(
 						}
 
 						if ( a->acl_attrval_mr == NULL ) {
-							Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-								"attr \"%s\" does not have an EQUALITY matching rule.\n",
-								fname, lineno, a->acl_attrs[ 0 ].an_name.bv_val );
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								"attr \"%s\" does not have an EQUALITY matching rule",
+								a->acl_attrs[ 0 ].an_name.bv_val );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 							goto fail;
 						}
 
@@ -622,42 +622,43 @@ parse_acl(
 							&text,
 							NULL );
 						if ( rc != LDAP_SUCCESS ) {
-							Debug(LDAP_DEBUG_ANY,
-							      "%s: line %d: %s: line %d: " " attr \"%s\" normalization failed (%d: %s).\n",
-							      fname, lineno,
-							      fname, lineno,
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							      "attr \"%s\" normalization failed (%d: %s).\n",
 							      a->acl_attrs[0].an_name.bv_val,
 							      rc, text );
+							Debug(LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 							goto fail;
 						}
 					}
 
 				} else {
-					Debug( LDAP_DEBUG_ANY,
-						"%s: line %d: expecting <what> got \"%s\"\n",
-					    fname, lineno, left );
+					snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						"expecting <what> got \"%s\"",
+					    left );
+					Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 					goto fail;
 				}
 			}
 
-			if ( !BER_BVISNULL( &a->acl_dn_pat ) && 
+			if ( !BER_BVISNULL( &a->acl_dn_pat ) &&
 					ber_bvccmp( &a->acl_dn_pat, '*' ) )
 			{
 				free( a->acl_dn_pat.bv_val );
 				BER_BVZERO( &a->acl_dn_pat );
 				a->acl_dn_style = ACL_STYLE_REGEX;
 			}
-			
+
 			if ( !BER_BVISEMPTY( &a->acl_dn_pat ) ||
-					a->acl_dn_style != ACL_STYLE_REGEX ) 
+					a->acl_dn_style != ACL_STYLE_REGEX )
 			{
 				if ( a->acl_dn_style != ACL_STYLE_REGEX ) {
 					struct berval bv;
 					rc = dnNormalize( 0, NULL, NULL, &a->acl_dn_pat, &bv, NULL);
 					if ( rc != LDAP_SUCCESS ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: bad DN \"%s\" in to DN clause\n",
-							fname, lineno, a->acl_dn_pat.bv_val );
+						snprintf( c->cr_msg, sizeof(c->cr_msg ),
+							"bad DN \"%s\" in to DN clause",
+							a->acl_dn_pat.bv_val );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 					free( a->acl_dn_pat.bv_val );
@@ -670,9 +671,10 @@ parse_acl(
 						char	err[ SLAP_TEXT_BUFLEN ];
 
 						regerror( e, &a->acl_dn_re, err, sizeof( err ) );
-						Debug(LDAP_DEBUG_ANY,
-						      "%s: line %d: regular expression \"%s\" bad because of %s\n",
-						      fname, lineno, right, err );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						      "regular expression \"%s\" bad because of %s",
+						      right, err );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 				}
@@ -681,9 +683,9 @@ parse_acl(
 		/* by clause - select who has what access to entries */
 		} else if ( strcasecmp( argv[i], "by" ) == 0 ) {
 			if ( a == NULL ) {
-				Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-					"to clause required before by clause in access line\n",
-					fname, lineno );
+				snprintf( c->cr_msg, sizeof( c->cr_msg ),
+					"to clause required before by clause in access line");
+				Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 				goto fail;
 			}
 
@@ -692,9 +694,9 @@ parse_acl(
 			 */
 
 			if ( ++i == argc ) {
-				Debug( LDAP_DEBUG_ANY,
-					"%s: line %d: premature EOL: expecting <who>\n",
-					fname, lineno );
+				snprintf( c->cr_msg, sizeof( c->cr_msg ),
+					"premature EOL: expecting <who>");
+				Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 				goto fail;
 			}
 
@@ -722,16 +724,14 @@ parse_acl(
 						if ( style_level != NULL ) {
 							char *p = strchr( style_level, '}' );
 							if ( p == NULL ) {
-								Debug( LDAP_DEBUG_ANY,
-									"%s: line %d: premature eol: "
-									"expecting closing '}' in \"level{n}\"\n",
-									fname, lineno );
+								snprintf( c->cr_msg, sizeof( c->cr_msg ),
+									"premature eol: expecting closing '}' in \"level{n}\"");
+								Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 								goto fail;
 							} else if ( p == style_level ) {
-								Debug( LDAP_DEBUG_ANY,
-									"%s: line %d: empty level "
-									"in \"level{n}\"\n",
-									fname, lineno );
+								snprintf( c->cr_msg, sizeof( c->cr_msg ),
+									"empty level in \"level{n}\"");
+								Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 								goto fail;
 							}
 							p[0] = '\0';
@@ -762,10 +762,9 @@ parse_acl(
 				} else if ( strcasecmp( style, "level" ) == 0 )
 				{
 					if ( lutil_atoi( &level, style_level ) != 0 ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: unable to parse level "
-							"in \"level{n}\"\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"unable to parse level in \"level{n}\"");
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -782,26 +781,25 @@ parse_acl(
 
 				} else if ( strcasecmp( style, "ipv6" ) == 0 ) {
 #ifndef LDAP_PF_INET6
-					Debug( LDAP_DEBUG_ANY,
-						"%s: line %d: IPv6 not supported\n",
-						fname, lineno );
+					snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						"IPv6 not supported");
+					Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 #endif /* ! LDAP_PF_INET6 */
 					sty = ACL_STYLE_IPV6;
 
 				} else if ( strcasecmp( style, "path" ) == 0 ) {
 					sty = ACL_STYLE_PATH;
 #ifndef LDAP_PF_LOCAL
-					Debug( LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL,
-						"%s: line %d: "
-						"\"path\" style modifier is useless without local.\n",
-						fname, lineno );
+					snprintf( c->cr_msg, sizeof( c->cr_msg),
+						"\"path\" style modifier is useless without local");
+					Debug( LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 					goto fail;
 #endif /* LDAP_PF_LOCAL */
 
 				} else {
-					Debug( LDAP_DEBUG_ANY,
-						"%s: line %d: unknown style \"%s\" in by clause\n",
-						fname, lineno, style );
+					snprintf( c->cr_msg, sizeof ( c->cr_msg ),
+						"unknown style \"%s\" in by clause", style );
+					Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 					goto fail;
 				}
 
@@ -810,9 +808,9 @@ parse_acl(
 				{
 					switch ( sty ) {
 					case ACL_STYLE_REGEX:
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"\"regex\" style implies \"expand\" modifier.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"\"regex\" style implies \"expand\" modifier" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 						break;
 
@@ -903,15 +901,15 @@ parse_acl(
 						} else {
 							acl_regex_normalized_dn( right, &bv );
 							if ( !ber_bvccmp( &bv, '*' ) ) {
-								regtest( fname, lineno, bv.bv_val );
+								if ( regtest( c, bv.bv_val ) != 0)
+									goto fail;
 							}
 						}
 
 					} else if ( right == NULL || *right == '\0' ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"missing \"=\" in (or value after) \"%s\" "
-							"in by clause\n",
-							fname, lineno, left );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"missing \"=\" in (or value after) \"%s\" in by clause", left );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 
 					} else {
@@ -924,9 +922,9 @@ parse_acl(
 
 				if ( !BER_BVISNULL( &bv ) ) {
 					if ( !BER_BVISEMPTY( &bdn->a_pat ) ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: dn pattern already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"dn pattern already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -939,9 +937,9 @@ parse_acl(
 						rc = dnNormalize(0, NULL, NULL,
 							&bv, &bdn->a_pat, NULL);
 						if ( rc != LDAP_SUCCESS ) {
-							Debug( LDAP_DEBUG_ANY,
-								"%s: line %d: bad DN \"%s\" in by DN clause\n",
-								fname, lineno, bv.bv_val );
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								"bad DN \"%s\" in by DN clause", bv.bv_val );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 							goto fail;
 						}
 						free( bv.bv_val );
@@ -950,10 +948,9 @@ parse_acl(
 							&& !BER_BVISNULL( &be->be_rootndn )
 							&& dn_match( &bdn->a_pat, &be->be_rootndn ) )
 						{
-							Debug( LDAP_DEBUG_ANY,
-								"%s: line %d: rootdn is always granted "
-								"unlimited privileges.\n",
-								fname, lineno );
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								"rootdn is always granted unlimited privileges" );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						}
 
 					} else {
@@ -980,32 +977,29 @@ parse_acl(
 							bdn->a_expand = expand;
 
 						} else {
-							Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-								"\"expand\" used with no expansions in \"pattern\".\n",
-								fname, lineno );
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								"\"expand\" used with no expansions in \"pattern\"");
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 							goto fail;
-						} 
+						}
 					}
 					if ( sty == ACL_STYLE_SELF ) {
 						bdn->a_self_level = level;
 
 					} else {
 						if ( level < 0 ) {
-							Debug( LDAP_DEBUG_ANY,
-								"%s: line %d: bad negative level \"%d\" "
-								"in by DN clause\n",
-								fname, lineno, level );
+							snprintf( c->cr_msg, sizeof( c ->cr_msg ),
+								"bad negative level \"%d\" in by DN clause", level );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 							goto fail;
 						} else if ( level == 1 ) {
-							Debug( LDAP_DEBUG_ANY,
-								"%s: line %d: \"onelevel\" should be used "
-								"instead of \"level{1}\" in by DN clause\n",
-								fname, lineno );
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								"\"onelevel\" should be used instead of \"level{1}\" in by DN clause" );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						} else if ( level == 0 && sty == ACL_STYLE_LEVEL ) {
-							Debug( LDAP_DEBUG_ANY,
-								"%s: line %d: \"base\" should be used "
-								"instead of \"level{0}\" in by DN clause\n",
-								fname, lineno );
+							snprintf ( c->cr_msg, sizeof( c->cr_msg ),
+								"\"base\" should be used instead of \"level{0}\" in by DN clause" );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						}
 
 						bdn->a_level = level;
@@ -1015,27 +1009,25 @@ parse_acl(
 
 				if ( strcasecmp( left, "dnattr" ) == 0 ) {
 					if ( right == NULL || right[0] == '\0' ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"missing \"=\" in (or value after) \"%s\" "
-							"in by clause\n",
-							fname, lineno, left );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"missing \"=\" in (or value after) \"%s\" in by clause", left );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if( bdn->a_at != NULL ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: dnattr already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"dnattr already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					rc = slap_str2ad( right, &bdn->a_at, &text );
 
 					if( rc != LDAP_SUCCESS ) {
-						Debug(LDAP_DEBUG_ANY,
-						      "%s: line %d: dnattr \"%s\": %s\n",
-						      fname, lineno, right,
-						      text );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						      "dnattr \"%s\": %s", right, text );
+						Debug(LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1045,18 +1037,17 @@ parse_acl(
 						!is_at_syntax( bdn->a_at->ad_type,
 						SLAPD_NAMEUID_SYNTAX ))
 					{
-						Debug(LDAP_DEBUG_ANY,
-						      "%s: line %d: dnattr \"%s\": " "inappropriate syntax: %s\n\n",
-						      fname, lineno, right,
-						      bdn->a_at->ad_type->sat_syntax_oid );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						      "dnattr \"%s\": " "inappropriate syntax: %s",
+							  right, bdn->a_at->ad_type->sat_syntax_oid );
+						Debug(LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if( bdn->a_at->ad_type->sat_equality == NULL ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: dnattr \"%s\": "
-							"inappropriate matching (no EQUALITY)\n",
-							fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"dnattr \"%s\": inappropriate matching (no EQUALITY)", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1071,11 +1062,9 @@ parse_acl(
 					switch ( sty ) {
 					case ACL_STYLE_REGEX:
 						/* legacy, tolerated */
-						Debug( LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL,
-							"%s: line %d: "
-							"deprecated group style \"regex\"; "
-							"use \"expand\" instead.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"deprecated group style \"regex\"; use \"expand\" instead" );
+						Debug( LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 						sty = ACL_STYLE_EXPAND;
 						break;
 
@@ -1087,26 +1076,23 @@ parse_acl(
 
 					default:
 						/* unknown */
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: "
-							"inappropriate style \"%s\" in by clause.\n",
-							fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"inappropriate style \"%s\" in by clause", style );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( right == NULL || right[0] == '\0' ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: "
-							"missing \"=\" in (or value after) \"%s\" "
-							"in by clause.\n",
-							fname, lineno, left );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"missing \"=\" in (or value after) \"%s\" in by clause", left );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( !BER_BVISEMPTY( &b->a_group_pat ) ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: group pattern already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"group pattern already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1123,7 +1109,8 @@ parse_acl(
 					if ( sty == ACL_STYLE_EXPAND ) {
 						acl_regex_normalized_dn( right, &bv );
 						if ( !ber_bvccmp( &bv, '*' ) ) {
-							regtest( fname, lineno, bv.bv_val );
+							if ( regtest( c, bv.bv_val ) != 0)
+								goto fail;
 						}
 						b->a_group_pat = bv;
 
@@ -1132,9 +1119,9 @@ parse_acl(
 						rc = dnNormalize( 0, NULL, NULL, &bv,
 							&b->a_group_pat, NULL );
 						if ( rc != LDAP_SUCCESS ) {
-							Debug( LDAP_DEBUG_ANY,
-								"%s: line %d: bad DN \"%s\".\n",
-								fname, lineno, right );
+							snprintf( c->cr_msg, sizeof( c->cr_msg),
+								"bad DN \"%s\"", right );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 							goto fail;
 						}
 					}
@@ -1144,10 +1131,9 @@ parse_acl(
 						*--value = '/';
 
 						if ( b->a_group_oc == NULL ) {
-							Debug( LDAP_DEBUG_ANY,
-								"%s: line %d: group objectclass "
-								"\"%s\" unknown.\n",
-								fname, lineno, value );
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								"group objectclass \"%s\" unknown", value );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 							goto fail;
 						}
 
@@ -1155,10 +1141,9 @@ parse_acl(
 						b->a_group_oc = oc_find( SLAPD_GROUP_CLASS );
 
 						if( b->a_group_oc == NULL ) {
-							Debug( LDAP_DEBUG_ANY,
-								"%s: line %d: group default objectclass "
-								"\"%s\" unknown.\n",
-								fname, lineno, SLAPD_GROUP_CLASS );
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								"group default objectclass \"%s\" unknown", SLAPD_GROUP_CLASS );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 							goto fail;
 						}
 					}
@@ -1166,20 +1151,18 @@ parse_acl(
 					if ( is_object_subclass( slap_schema.si_oc_referral,
 						b->a_group_oc ) )
 					{
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: group objectclass \"%s\" "
-							"is subclass of referral.\n",
-							fname, lineno, value );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"group objectclass \"%s\" is subclass of referral", value );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( is_object_subclass( slap_schema.si_oc_alias,
 						b->a_group_oc ) )
 					{
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: group objectclass \"%s\" "
-							"is subclass of alias.\n",
-							fname, lineno, value );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"group objectclass \"%s\" is subclass of alias", value );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1191,10 +1174,9 @@ parse_acl(
 
 					rc = slap_str2ad( attr_name, &b->a_group_at, &text );
 					if ( rc != LDAP_SUCCESS ) {
-						Debug(LDAP_DEBUG_ANY,
-						      "%s: line %d: group \"%s\": %s.\n",
-						      fname, lineno, right,
-						      text );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						      "group \"%s\": %s", right, text );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1205,11 +1187,10 @@ parse_acl(
 						&& !is_at_subtype( b->a_group_at->ad_type,
 							slap_schema.si_ad_labeledURI->ad_type ) /* e.g. memberURL */ )
 					{
-						Debug(LDAP_DEBUG_ANY,
-						      "%s: line %d: group \"%s\" attr \"%s\": inappropriate syntax: %s; " "must be " SLAPD_DN_SYNTAX " (DN), " SLAPD_NAMEUID_SYNTAX " (NameUID) " "or a subtype of labeledURI.\n",
-						      fname, lineno, right,
-						      attr_name,
-						      at_syntax(b->a_group_at->ad_type) );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						      "group \"%s\" attr \"%s\": inappropriate syntax: %s; " "must be " SLAPD_DN_SYNTAX " (DN), " SLAPD_NAMEUID_SYNTAX " (NameUID) " "or a subtype of labeledURI",
+						      right, attr_name, at_syntax(b->a_group_at->ad_type) );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1225,11 +1206,11 @@ parse_acl(
 							ocs, NULL );
 
 						if( rc != 0 ) {
-							Debug(LDAP_DEBUG_ANY,
-							      "%s: line %d: group: \"%s\" not allowed by \"%s\".\n",
-							      fname, lineno,
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							      "group: \"%s\" not allowed by \"%s\".\n",
 							      b->a_group_at->ad_cname.bv_val,
 							      b->a_group_oc->soc_oid );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 							goto fail;
 						}
 					}
@@ -1250,24 +1231,23 @@ parse_acl(
 						break;
 
 					default:
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"inappropriate style \"%s\" in by clause.\n",
-						    fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"inappropriate style \"%s\" in by clause", style );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( right == NULL || right[0] == '\0' ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"missing \"=\" in (or value after) \"%s\" "
-							"in by clause.\n",
-							fname, lineno, left );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"missing \"=\" in (or value after) \"%s\" in by clause", left);
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( !BER_BVISEMPTY( &b->a_peername_pat ) ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"peername pattern already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"peername pattern already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1275,7 +1255,8 @@ parse_acl(
 					if ( sty == ACL_STYLE_REGEX ) {
 						acl_regex_normalized_dn( right, &bv );
 						if ( !ber_bvccmp( &bv, '*' ) ) {
-							regtest( fname, lineno, bv.bv_val );
+							if ( regtest( c, bv.bv_val ) != 0)
+								goto fail;
 						}
 						b->a_peername_pat = bv;
 
@@ -1293,9 +1274,9 @@ parse_acl(
 							b->a_peername_addr = inet_addr( addr );
 							if ( b->a_peername_addr == (unsigned long)(-1) ) {
 								/* illegal address */
-								Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-									"illegal peername address \"%s\".\n",
-									fname, lineno, addr );
+								snprintf( c->cr_msg, sizeof( c->cr_msg ),
+									"illegal peername address \"%s\"", addr );
+								Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 								goto fail;
 							}
 
@@ -1306,13 +1287,12 @@ parse_acl(
 									(unsigned long)(-1) )
 								{
 									/* illegal mask */
-									Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-										"illegal peername address mask "
-										"\"%s\".\n",
-										fname, lineno, mask );
+									snprintf( c->cr_msg, sizeof( c->cr_msg ),
+										"illegal peername address mask \"%s\"", mask );
+									Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 									goto fail;
 								}
-							} 
+							}
 
 							b->a_peername_port = -1;
 							if ( port ) {
@@ -1321,10 +1301,9 @@ parse_acl(
 								b->a_peername_port = strtol( port, &end, 10 );
 								if ( end == port || end[0] != '}' ) {
 									/* illegal port */
-									Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-										"illegal peername port specification "
-										"\"{%s}\".\n",
-										fname, lineno, port );
+									snprintf( c->cr_msg, sizeof( c->cr_msg ),
+										"illegal peername port specification \"{%s}\"", port );
+									Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 									goto fail;
 								}
 							}
@@ -1340,9 +1319,9 @@ parse_acl(
 
 							if ( inet_pton( AF_INET6, addr, &b->a_peername_addr6 ) != 1 ) {
 								/* illegal address */
-								Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-									"illegal peername address \"%s\".\n",
-									fname, lineno, addr );
+								snprintf( c->cr_msg, sizeof( c->cr_msg ),
+									"illegal peername address \"%s\"", addr );
+								Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 								goto fail;
 							}
 
@@ -1352,10 +1331,9 @@ parse_acl(
 
 							if ( inet_pton( AF_INET6, mask, &b->a_peername_mask6 ) != 1 ) {
 								/* illegal mask */
-								Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-									"illegal peername address mask "
-									"\"%s\".\n",
-									fname, lineno, mask );
+								snprintf( c->cr_msg, sizeof( c->cr_msg ),
+									"illegal peername address mask \"%s\"", mask );
+								Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 								goto fail;
 							}
 
@@ -1366,10 +1344,9 @@ parse_acl(
 								b->a_peername_port = strtol( port, &end, 10 );
 								if ( end == port || end[0] != '}' ) {
 									/* illegal port */
-									Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-										"illegal peername port specification "
-										"\"{%s}\".\n",
-										fname, lineno, port );
+									snprintf( c->cr_msg, sizeof( c->cr_msg ),
+										"illegal peername port specification \"{%s}\"", port );
+									Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 									goto fail;
 								}
 							}
@@ -1390,24 +1367,23 @@ parse_acl(
 
 					default:
 						/* unknown */
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"inappropriate style \"%s\" in by clause\n",
-						    fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"inappropriate style \"%s\" in by clause", style );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( right == NULL || right[0] == '\0' ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"missing \"=\" in (or value after) \"%s\" "
-							"in by clause\n",
-							fname, lineno, left );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"missing \"=\" in (or value after) \"%s\" in by clause", left );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( !BER_BVISNULL( &b->a_sockname_pat ) ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"sockname pattern already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"sockname pattern already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1415,10 +1391,11 @@ parse_acl(
 					if ( sty == ACL_STYLE_REGEX ) {
 						acl_regex_normalized_dn( right, &bv );
 						if ( !ber_bvccmp( &bv, '*' ) ) {
-							regtest( fname, lineno, bv.bv_val );
+							if ( regtest( c, bv.bv_val ) != 0)
+								goto fail;
 						}
 						b->a_sockname_pat = bv;
-						
+
 					} else {
 						ber_str2bv( right, 0, 1, &b->a_sockname_pat );
 					}
@@ -1436,11 +1413,9 @@ parse_acl(
 					case ACL_STYLE_EXPAND:
 						/* tolerated: means exact,expand */
 						if ( expand ) {
-							Debug( LDAP_DEBUG_ANY,
-								"%s: line %d: "
-								"\"expand\" modifier "
-								"with \"expand\" style.\n",
-								fname, lineno );
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								"\"expand\" modifier with \"expand\" style" );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						}
 						sty = ACL_STYLE_BASE;
 						expand = 1;
@@ -1448,24 +1423,23 @@ parse_acl(
 
 					default:
 						/* unknown */
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"inappropriate style \"%s\" in by clause.\n",
-						    fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg),
+							"inappropriate style \"%s\" in by clause", style );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( right == NULL || right[0] == '\0' ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"missing \"=\" in (or value after) \"%s\" "
-							"in by clause.\n",
-							fname, lineno, left );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"missing \"=\" in (or value after) \"%s\" in by clause", left );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( !BER_BVISEMPTY( &b->a_domain_pat ) ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: domain pattern already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"domain pattern already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1474,7 +1448,8 @@ parse_acl(
 					if ( sty == ACL_STYLE_REGEX ) {
 						acl_regex_normalized_dn( right, &bv );
 						if ( !ber_bvccmp( &bv, '*' ) ) {
-							regtest( fname, lineno, bv.bv_val );
+							if ( regtest( c, bv.bv_val ) != 0)
+								goto fail;
 						}
 						b->a_domain_pat = bv;
 
@@ -1495,24 +1470,23 @@ parse_acl(
 
 					default:
 						/* unknown */
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"inappropriate style \"%s\" in by clause.\n",
-						    fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg),
+							"inappropriate style \"%s\" in by clause", style );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( right == NULL || right[0] == '\0' ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"missing \"=\" in (or value after) \"%s\" "
-							"in by clause.\n",
-							fname, lineno, left );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"missing \"=\" in (or value after) \"%s\" in by clause", left );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( !BER_BVISEMPTY( &b->a_sockurl_pat ) ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: sockurl pattern already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"sockurl pattern already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1520,10 +1494,11 @@ parse_acl(
 					if ( sty == ACL_STYLE_REGEX ) {
 						acl_regex_normalized_dn( right, &bv );
 						if ( !ber_bvccmp( &bv, '*' ) ) {
-							regtest( fname, lineno, bv.bv_val );
+							if ( regtest( c, bv.bv_val ) != 0)
+								goto fail;
 						}
 						b->a_sockurl_pat = bv;
-						
+
 					} else {
 						ber_str2bv( right, 0, 1, &b->a_sockurl_pat );
 					}
@@ -1534,37 +1509,36 @@ parse_acl(
 					switch ( sty ) {
 						/* deprecated */
 					case ACL_STYLE_REGEX:
-						Debug( LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL,
-							"%s: line %d: "
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
 							"deprecated set style "
 							"\"regex\" in <by> clause; "
-							"use \"expand\" instead.\n",
-							fname, lineno );
+							"use \"expand\" instead" );
+						Debug( LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 						sty = ACL_STYLE_EXPAND;
 						/* FALLTHRU */
-						
+
 					case ACL_STYLE_BASE:
 					case ACL_STYLE_EXPAND:
 						break;
 
 					default:
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"inappropriate style \"%s\" in by clause.\n",
-							fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"inappropriate style \"%s\" in by clause", style );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( !BER_BVISEMPTY( &b->a_set_pat ) ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: set attribute already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"set attribute already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( right == NULL || *right == '\0' ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: no set is defined.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"no set is defined" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
@@ -1581,12 +1555,12 @@ parse_acl(
 
 #if 1 /* tolerate legacy "aci" <who> */
 					if ( strcasecmp( left, "aci" ) == 0 ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
 							"undocumented deprecated \"aci\" directive "
-							"is superseded by \"dynacl/aci\".\n",
-							fname, lineno );
+							"is superseded by \"dynacl/aci\"" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						name = "aci";
-						
+
 					} else
 #endif /* tolerate legacy "aci" <who> */
 					if ( strncasecmp( left, "dynacl/", STRLENOF( "dynacl/" ) ) == 0 ) {
@@ -1599,10 +1573,10 @@ parse_acl(
 					}
 
 					if ( name ) {
-						if ( slap_dynacl_config( fname, lineno, b, name, opts, sty, right ) ) {
-							Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-								"unable to configure dynacl \"%s\".\n",
-								fname, lineno, name );
+						if ( slap_dynacl_config( c, b, name, opts, sty, right ) ) {
+							snprintf( c->cr_msg, sizeof( c->cr_msg ),
+								"unable to configure dynacl \"%s\"", name );
+							Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 							goto fail;
 						}
 
@@ -1613,37 +1587,37 @@ parse_acl(
 
 				if ( strcasecmp( left, "ssf" ) == 0 ) {
 					if ( sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"inappropriate style \"%s\" in by clause.\n",
-						    fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"inappropriate style \"%s\" in by clause", style );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( b->a_authz.sai_ssf ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: ssf attribute already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"ssf attribute already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( right == NULL || *right == '\0' ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: no ssf is defined.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"no ssf is defined" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( lutil_atou( &b->a_authz.sai_ssf, right ) != 0 ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: unable to parse ssf value (%s).\n",
-							fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"unable to parse ssf value (%s)", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( !b->a_authz.sai_ssf ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: invalid ssf value (%s).\n",
-							fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"invalid ssf value (%s)", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 					continue;
@@ -1651,37 +1625,37 @@ parse_acl(
 
 				if ( strcasecmp( left, "transport_ssf" ) == 0 ) {
 					if ( sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"inappropriate style \"%s\" in by clause.\n",
-							fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"inappropriate style \"%s\" in by clause", style );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( b->a_authz.sai_transport_ssf ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"transport_ssf attribute already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"transport_ssf attribute already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( right == NULL || *right == '\0' ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: no transport_ssf is defined.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"no transport_ssf is defined" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( lutil_atou( &b->a_authz.sai_transport_ssf, right ) != 0 ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"unable to parse transport_ssf value (%s).\n",
-							fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"unable to parse transport_ssf value (%s)", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( !b->a_authz.sai_transport_ssf ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: invalid transport_ssf value (%s).\n",
-							fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"invalid transport_ssf value (%s)", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 					continue;
@@ -1689,37 +1663,36 @@ parse_acl(
 
 				if ( strcasecmp( left, "tls_ssf" ) == 0 ) {
 					if ( sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"inappropriate style \"%s\" in by clause.\n",
-							fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"inappropriate style \"%s\" in by clause", style );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( b->a_authz.sai_tls_ssf ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"tls_ssf attribute already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"tls_ssf attribute already specified" );
 						goto fail;
 					}
 
 					if ( right == NULL || *right == '\0' ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: no tls_ssf is defined\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"no tls_ssf is defined" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( lutil_atou( &b->a_authz.sai_tls_ssf, right ) != 0 ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"unable to parse tls_ssf value (%s).\n",
-							fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"unable to parse tls_ssf value (%s)", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( !b->a_authz.sai_tls_ssf ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: invalid tls_ssf value (%s).\n",
-							fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"invalid tls_ssf value (%s)", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 					continue;
@@ -1727,37 +1700,37 @@ parse_acl(
 
 				if ( strcasecmp( left, "sasl_ssf" ) == 0 ) {
 					if ( sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"inappropriate style \"%s\" in by clause.\n",
-							fname, lineno, style );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"inappropriate style \"%s\" in by clause", style );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( b->a_authz.sai_sasl_ssf ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"sasl_ssf attribute already specified.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"sasl_ssf attribute already specified" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( right == NULL || *right == '\0' ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: no sasl_ssf is defined.\n",
-							fname, lineno );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"no sasl_ssf is defined" );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( lutil_atou( &b->a_authz.sai_sasl_ssf, right ) != 0 ) {
-						Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-							"unable to parse sasl_ssf value (%s).\n",
-							fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"unable to parse sasl_ssf value (%s)", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 
 					if ( !b->a_authz.sai_sasl_ssf ) {
-						Debug( LDAP_DEBUG_ANY,
-							"%s: line %d: invalid sasl_ssf value (%s).\n",
-							fname, lineno, right );
+						snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							"invalid sasl_ssf value (%s)", right );
+						Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 						goto fail;
 					}
 					continue;
@@ -1770,7 +1743,7 @@ parse_acl(
 				break;
 			}
 
-			if ( i == argc || ( strcasecmp( left, "stop" ) == 0 ) ) { 
+			if ( i == argc || ( strcasecmp( left, "stop" ) == 0 ) ) {
 				/* out of arguments or plain stop */
 
 				ACL_PRIV_ASSIGN( b->a_access_mask, ACL_PRIV_ADDITIVE );
@@ -1831,9 +1804,9 @@ parse_acl(
 			}
 
 			if ( ACL_IS_INVALID( b->a_access_mask ) ) {
-				Debug( LDAP_DEBUG_ANY,
-					"%s: line %d: expecting <access> got \"%s\".\n",
-					fname, lineno, left );
+				snprintf( c->cr_msg, sizeof( c->cr_msg ),
+					"expecting <access> got \"%s\"", left );
+				Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 				goto fail;
 			}
 
@@ -1862,19 +1835,18 @@ parse_acl(
 			b = NULL;
 
 		} else {
-			Debug( LDAP_DEBUG_ANY,
-				"%s: line %d: expecting \"to\" "
-				"or \"by\" got \"%s\"\n",
-				fname, lineno, argv[i] );
+			snprintf( c->cr_msg, sizeof( c->cr_msg ),
+				"expecting \"to\" or \"by\" got \"%s\"", argv[i] );
+			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 			goto fail;
 		}
 	}
 
 	/* if we have no real access clause, complain and do nothing */
 	if ( a == NULL ) {
-		Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-			"warning: no access clause(s) specified in access line.\n",
-			fname, lineno );
+		snprintf( c->cr_msg, sizeof( c->cr_msg ),
+			"warning: no access clause(s) specified in access line");
+		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 		goto fail;
 
 	} else {
@@ -1883,53 +1855,49 @@ parse_acl(
 			print_acl( be, a );
 		}
 #endif
-	
+
 		if ( a->acl_access == NULL ) {
-			Debug( LDAP_DEBUG_ANY, "%s: line %d: "
-				"warning: no by clause(s) specified in access line.\n",
-				fname, lineno );
+			snprintf( c->cr_msg, sizeof( c->cr_msg ),
+				"warning: no by clause(s) specified in access line" );
+			Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 			goto fail;
 		}
 
 		if ( be != NULL ) {
 			if ( be->be_nsuffix == NULL ) {
-				Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-					"scope checking needs suffix before ACLs.\n",
-					fname, lineno );
+				snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						  "warning: scope checking needs suffix before ACLs" );
+				Debug( LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 				/* go ahead, since checking is not authoritative */
 			} else if ( !BER_BVISNULL( &be->be_nsuffix[ 1 ] ) ) {
-				Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-					"scope checking only applies to single-valued "
-					"suffix databases\n",
-					fname, lineno );
+				snprintf( c->cr_msg, sizeof( c->cr_msg ),
+						  "warning: scope checking only applies to single-valued suffix databases" );
+				Debug( LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 				/* go ahead, since checking is not authoritative */
 			} else {
 				switch ( check_scope( be, a ) ) {
 				case ACL_SCOPE_UNKNOWN:
-					Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-						"cannot assess the validity of the ACL scope within "
-						"backend naming context\n",
-						fname, lineno );
+					snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							  "warning: cannot assess the validity of the ACL scope within backend naming context" );
+					Debug( LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 					break;
 
 				case ACL_SCOPE_WARN:
-					Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-						"ACL could be out of scope within backend naming context\n",
-						fname, lineno );
+					snprintf( c->cr_msg, sizeof( c->cr_msg ),
+					"warning: ACL could be out of scope within backend naming context" );
+					Debug( LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 					break;
 
 				case ACL_SCOPE_PARTIAL:
-					Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-						"ACL appears to be partially out of scope within "
-						"backend naming context\n",
-						fname, lineno );
+					snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							  "warning: ACL appears to be partially out of scope within backend naming context" );
+					Debug( LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 					break;
-	
+
 				case ACL_SCOPE_ERR:
-					Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-						"ACL appears to be out of scope within "
-						"backend naming context\n",
-						fname, lineno );
+					snprintf( c->cr_msg, sizeof( c->cr_msg ),
+							  "warning: ACL appears to be out of scope within backend naming context" );
+					Debug( LDAP_DEBUG_ACL, "%s: %s.\n", c->log, c->cr_msg );
 					break;
 
 				default:
@@ -1999,7 +1967,7 @@ accessmask2str( slap_mask_t mask, char *buf, int debug )
 		} else {
 			ptr = lutil_strcopy( ptr, "unknown" );
 		}
-		
+
 		if ( !debug ) {
 			*ptr = '\0';
 			return buf;
@@ -2020,7 +1988,7 @@ accessmask2str( slap_mask_t mask, char *buf, int debug )
 	if ( ACL_PRIV_ISSET(mask, ACL_PRIV_MANAGE) ) {
 		none = 0;
 		*ptr++ = 'm';
-	} 
+	}
 
 	if ( ACL_PRIV_ISSET(mask, ACL_PRIV_WRITE) ) {
 		none = 0;
@@ -2033,37 +2001,37 @@ accessmask2str( slap_mask_t mask, char *buf, int debug )
 	} else if ( ACL_PRIV_ISSET(mask, ACL_PRIV_WDEL) ) {
 		none = 0;
 		*ptr++ = 'z';
-	} 
+	}
 
 	if ( ACL_PRIV_ISSET(mask, ACL_PRIV_READ) ) {
 		none = 0;
 		*ptr++ = 'r';
-	} 
+	}
 
 	if ( ACL_PRIV_ISSET(mask, ACL_PRIV_SEARCH) ) {
 		none = 0;
 		*ptr++ = 's';
-	} 
+	}
 
 	if ( ACL_PRIV_ISSET(mask, ACL_PRIV_COMPARE) ) {
 		none = 0;
 		*ptr++ = 'c';
-	} 
+	}
 
 	if ( ACL_PRIV_ISSET(mask, ACL_PRIV_AUTH) ) {
 		none = 0;
 		*ptr++ = 'x';
-	} 
+	}
 
 	if ( ACL_PRIV_ISSET(mask, ACL_PRIV_DISCLOSE) ) {
 		none = 0;
 		*ptr++ = 'd';
-	} 
+	}
 
 	if ( none && ACL_PRIV_ISSET(mask, ACL_PRIV_NONE) ) {
 		none = 0;
 		*ptr++ = '0';
-	} 
+	}
 
 	if ( none ) {
 		ptr = buf;
@@ -2178,7 +2146,7 @@ str2accessmask( const char *str )
 }
 
 static int
-acl_usage( void )
+acl_usage(void)
 {
 	char *access =
 		"<access clause> ::= access to <what> "
@@ -2227,7 +2195,7 @@ acl_usage( void )
 
 /*
  * Set pattern to a "normalized" DN from src.
- * At present it simply eats the (optional) space after 
+ * At present, it simply eats the (optional) space after
  * a RDN separator (,)
  * Eventually will evolve in a more complete normalization
  */
@@ -2245,10 +2213,10 @@ acl_regex_normalized_dn(
 	for ( p = str; p && p[0]; p++ ) {
 		/* escape */
 		if ( p[0] == '\\' && p[1] ) {
-			/* 
+			/*
 			 * if escaping a hex pair we should
-			 * increment p twice; however, in that 
-			 * case the second hex number does 
+			 * increment p twice; however, in that
+			 * case the second hex number does
 			 * no harm
 			 */
 			p++;
@@ -2256,7 +2224,7 @@ acl_regex_normalized_dn(
 
 		if ( p[0] == ',' && p[1] == ' ' ) {
 			char *q;
-			
+
 			/*
 			 * too much space should be an error if we are pedantic
 			 */
@@ -2532,7 +2500,7 @@ dnaccess2text( slap_dn_access *bdn, char *ptr, int is_realdn )
 		if ( is_realdn ) {
 			assert( ! ber_bvccmp( &bdn->a_pat, '*' ) );
 		}
-			
+
 		ptr = acl_safe_strbvcopy( ptr, &bdn->a_pat );
 		if ( bdn->a_style == ACL_STYLE_SELF && bdn->a_self_level != 0 ) {
 			char buf[SLAP_TEXT_BUFLEN];
@@ -2546,7 +2514,7 @@ dnaccess2text( slap_dn_access *bdn, char *ptr, int is_realdn )
 		ptr = acl_safe_strcopy( ptr, "dn." );
 		if ( bdn->a_style == ACL_STYLE_BASE )
 			ptr = acl_safe_strcopy( ptr, style_base );
-		else 
+		else
 			ptr = acl_safe_strcopy( ptr, style_strings[bdn->a_style] );
 		if ( bdn->a_style == ACL_STYLE_LEVEL ) {
 			char buf[SLAP_TEXT_BUFLEN];
@@ -2668,7 +2636,7 @@ access2text( Access *b, char *ptr )
 	/* Security Strength Factors */
 	if ( b->a_authz.sai_ssf ) {
 		char buf[SLAP_TEXT_BUFLEN];
-		int n = snprintf( buf, sizeof(buf), " ssf=%u", 
+		int n = snprintf( buf, sizeof(buf), " ssf=%u",
 			b->a_authz.sai_ssf );
 		ptr = acl_safe_strncopy( ptr, buf, n );
 	}
diff --git a/servers/slapd/back-asyncmeta/map.c b/servers/slapd/back-asyncmeta/map.c
index b811708..66bb8b0 100644
--- a/servers/slapd/back-asyncmeta/map.c
+++ b/servers/slapd/back-asyncmeta/map.c
@@ -197,16 +197,26 @@ ignore:
 	}
 
 	/* DN longer than our suffix and doesn't match */
-	if ( diff > 0 && !DN_SEPARATOR(dn->bv_val[diff-1]))
+	if ( osuff->bv_len != 0 && diff > 0 && !DN_SEPARATOR(dn->bv_val[diff-1]) )
 		goto ignore;
 
 	/* suffix is same length as ours, but doesn't match */
 	if ( strcasecmp( osuff->bv_val, &dn->bv_val[diff] ))
 		goto ignore;
 
+	/* if remote suffix is empty, remove or add the dn separator*/
+	if ( nsuff->bv_len == 0 ) {
+		diff--;
+	} else if ( osuff->bv_len == 0 ) {
+		diff++;
+	}
+
+
 	res->bv_len = diff + nsuff->bv_len;
 	res->bv_val = dc->op->o_tmpalloc( res->bv_len + 1, dc->memctx );
 	strncpy( res->bv_val, dn->bv_val, diff );
+	if ( osuff->bv_len == 0 )
+		res->bv_val[diff-1] = ',';
 	strcpy( &res->bv_val[diff], nsuff->bv_val );
 
 	if (pretty.bv_val)
diff --git a/servers/slapd/back-ldap/chain.c b/servers/slapd/back-ldap/chain.c
index d6ffd1a..fece74d 100644
--- a/servers/slapd/back-ldap/chain.c
+++ b/servers/slapd/back-ldap/chain.c
@@ -1040,7 +1040,7 @@ ldap_chain_response( Operation *op, SlapReply *rs )
 
 	/* we need this to know if back-ldap returned any result */
 	lb.lb_lc = lc;
-	sc2.sc_next = sc->sc_next;
+	sc2.sc_next = sc;
 	sc2.sc_private = &lb;
 	sc2.sc_response = ldap_chain_cb_response;
 	op->o_callback = &sc2;
diff --git a/servers/slapd/back-null/null.c b/servers/slapd/back-null/null.c
index 50b6fbc..c8d3292 100644
--- a/servers/slapd/back-null/null.c
+++ b/servers/slapd/back-null/null.c
@@ -72,8 +72,8 @@ null_back_db_open( BackendDB *be, ConfigReply *cr )
 
 	if ( ni->ni_dosearch ) {
 		e = entry_alloc();
-		e->e_name = be->be_suffix[0];
-		e->e_nname = be->be_nsuffix[0];
+		ber_dupbv( &e->e_name, &be->be_suffix[0] );
+		ber_dupbv( &e->e_nname, &be->be_nsuffix[0] );
 
 		dnRdn( &e->e_nname, &bv[0] );
 		bv[1].bv_val = strchr(bv[0].bv_val, '=') + 1;
diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index 4c4b925..59236c4 100644
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -2247,7 +2247,7 @@ sortval_reject:
 				for ( a=c->be->be_acl; a; a = a->acl_next )
 					i++;
 			}
-			if ( parse_acl(c->be, c->fname, c->lineno, c->argc, c->argv, i ) ) {
+			if ( parse_acl( c, i ) ) {
 				if ( SLAP_CONFIG( c->be ) && !c->be->be_acl) {
 					c->be->be_acl = defacl_parsed;
 				}
@@ -2533,7 +2533,7 @@ sortval_reject:
 
 #ifdef LDAP_SLAPI
 		case CFG_PLUGIN:
-			if(slapi_int_read_config(c->be, c->fname, c->lineno, c->argc, c->argv, c->valx) != LDAP_SUCCESS)
+			if(slapi_int_read_config(c) != LDAP_SUCCESS)
 				return(1);
 			slapi_plugins_used++;
 			break;
@@ -4360,7 +4360,8 @@ config_tls_config(ConfigArgs *c) {
 #endif
 
 static CfEntryInfo *
-config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last )
+config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last,
+	Operation *op )
 {
 	struct berval cdn;
 	char *c;
@@ -4377,7 +4378,14 @@ config_find_base( CfEntryInfo *root, struct berval *dn, CfEntryInfo **last )
 	for (;*c != ',';c--);
 
 	while(root) {
-		*last = root;
+		if ( !op || access_allowed( op, root->ce_entry,
+					slap_schema.si_ad_entry, NULL, ACL_DISCLOSE, NULL ) ) {
+			/*
+			 * ITS#10139: Only record the lowermost entry that the user has
+			 * disclose access to
+			 */
+			*last = root;
+		}
 		for (--c;c>dn->bv_val && *c != ',';c--);
 		cdn.bv_val = c;
 		if ( *c == ',' )
@@ -5495,7 +5503,7 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs,
 	 * Databases and Overlays to be inserted. Don't do any
 	 * auto-renumbering if manageDSAit control is present.
 	 */
-	ce = config_find_base( cfb->cb_root, &e->e_nname, &last );
+	ce = config_find_base( cfb->cb_root, &e->e_nname, &last, op );
 	if ( ce ) {
 		if ( ( op && op->o_managedsait ) ||
 			( ce->ce_type != Cft_Database && ce->ce_type != Cft_Overlay &&
@@ -5516,14 +5524,14 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs,
 	/* If last is NULL, the new entry is the root/suffix entry, 
 	 * otherwise last should be the parent.
 	 */
-	if ( last && !dn_match( &last->ce_entry->e_nname, &pdn ) ) {
-		if ( rs ) {
+	if ( cfb->cb_root && ( !last || !dn_match( &last->ce_entry->e_nname, &pdn ) ) ) {
+		if ( last && rs ) {
 			rs->sr_matched = last->ce_entry->e_name.bv_val;
 		}
 		Debug( LDAP_DEBUG_TRACE, "%s: config_add_internal: "
 			"DN=\"%s\" not child of DN=\"%s\"\n",
 			log_prefix, e->e_name.bv_val,
-			last->ce_entry->e_name.bv_val );
+			last ? last->ce_entry->e_name.bv_val : "" );
 		return LDAP_NO_SUCH_OBJECT;
 	}
 
@@ -6461,7 +6469,7 @@ config_back_modify( Operation *op, SlapReply *rs )
 
 	cfb = (CfBackInfo *)op->o_bd->be_private;
 
-	ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
+	ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last, op );
 	if ( !ce ) {
 		if ( last )
 			rs->sr_matched = last->ce_entry->e_name.bv_val;
@@ -6569,7 +6577,7 @@ config_back_modrdn( Operation *op, SlapReply *rs )
 
 	cfb = (CfBackInfo *)op->o_bd->be_private;
 
-	ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
+	ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last, op );
 	if ( !ce ) {
 		if ( last )
 			rs->sr_matched = last->ce_entry->e_name.bv_val;
@@ -6785,7 +6793,7 @@ config_back_delete( Operation *op, SlapReply *rs )
 
 	cfb = (CfBackInfo *)op->o_bd->be_private;
 
-	ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
+	ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last, op );
 	if ( !ce ) {
 		if ( last )
 			rs->sr_matched = last->ce_entry->e_name.bv_val;
@@ -6938,7 +6946,7 @@ config_back_search( Operation *op, SlapReply *rs )
 	cfb = (CfBackInfo *)op->o_bd->be_private;
 
 	ldap_pvt_thread_rdwr_rlock( &cfb->cb_rwlock );
-	ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last );
+	ce = config_find_base( cfb->cb_root, &op->o_req_ndn, &last, op );
 	if ( !ce ) {
 		if ( last )
 			rs->sr_matched = last->ce_entry->e_name.bv_val;
@@ -7026,7 +7034,7 @@ int config_back_entry_get(
 	if ( !paused ) {
 		ldap_pvt_thread_rdwr_rlock( &cfb->cb_rwlock );
 	}
-	ce = config_find_base( cfb->cb_root, ndn, &last );
+	ce = config_find_base( cfb->cb_root, ndn, &last, op );
 	if ( ce ) {
 		e = ce->ce_entry;
 		if ( e ) {
@@ -7332,7 +7340,7 @@ config_check_schema(Operation *op, CfBackInfo *cfb)
 		return 0;
 
 	/* Make sure the main schema entry exists */
-	ce = config_find_base( cfb->cb_root, &schema_dn, &last );
+	ce = config_find_base( cfb->cb_root, &schema_dn, &last, op );
 	if ( ce ) {
 		Attribute *a;
 		struct berval *bv;
@@ -7447,7 +7455,12 @@ config_back_db_open( BackendDB *be, ConfigReply *cr )
 	 */
 	save_access = be->bd_self->be_acl;
 	be->bd_self->be_acl = NULL;
-	parse_acl(be->bd_self, "config_back_db_open", 0, 6, (char **)defacl, 0 );
+	c.be = be->bd_self;
+	c.fname = "config_back_db_open";
+	c.lineno = 0;
+	c.argc = 6;
+	c.argv = (char **)defacl;
+	parse_acl( &c, 0 );
 	defacl_parsed = be->bd_self->be_acl;
 	if ( save_access ) {
 		be->bd_self->be_acl = save_access;
@@ -8029,7 +8042,7 @@ config_tool_entry_modify( BackendDB *be, Entry *e, struct berval *text )
 	BackendInfo *bi = cfb->cb_db.bd_info;
 	CfEntryInfo *ce, *last;
 
-	ce = config_find_base( cfb->cb_root, &e->e_nname, &last );
+	ce = config_find_base( cfb->cb_root, &e->e_nname, &last, NULL );
 
 	if ( ce && bi && bi->bi_tool_entry_modify )
 		return bi->bi_tool_entry_modify( &cfb->cb_db, e, text );
@@ -8044,7 +8057,7 @@ config_tool_entry_delete( BackendDB *be, struct berval *ndn, struct berval *text
 	BackendInfo *bi = cfb->cb_db.bd_info;
 	CfEntryInfo *ce, *last;
 
-	ce = config_find_base( cfb->cb_root, ndn, &last );
+	ce = config_find_base( cfb->cb_root, ndn, &last, NULL );
 
 	if ( ce && bi && bi->bi_tool_entry_delete )
 		return bi->bi_tool_entry_delete( &cfb->cb_db, ndn, text );
diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c
index 940ca3d..beabe44 100644
--- a/servers/slapd/controls.c
+++ b/servers/slapd/controls.c
@@ -17,6 +17,7 @@
 
 #include <stdio.h>
 
+#include <ac/ctype.h>
 #include <ac/string.h>
 #include <ac/socket.h>
 
diff --git a/servers/slapd/overlays/dynlist.c b/servers/slapd/overlays/dynlist.c
index 10cacf9..5c38b64 100644
--- a/servers/slapd/overlays/dynlist.c
+++ b/servers/slapd/overlays/dynlist.c
@@ -65,6 +65,7 @@ typedef struct dynlist_info_t {
 typedef struct dynlist_gen_t {
 	dynlist_info_t	*dlg_dli;
 	int				 dlg_memberOf;
+	int				 dlg_simple;
 } dynlist_gen_t;
 
 #define DYNLIST_USAGE \
@@ -556,9 +557,8 @@ dynlist_nested_member_dg( Operation *op, SlapReply *rs )
 }
 
 static void
-dynlist_nested_member( Operation *op, dynlist_member_t *dm, TAvlnode *subs )
+dynlist_nested_member( Operation *op, slap_overinst *on, dynlist_member_t *dm, TAvlnode *subs )
 {
-	slap_overinst	*on = (slap_overinst *)op->o_bd->bd_info;
 	TAvlnode *ptr;
 	dynlist_name_t *dyn;
 	Entry *ne;
@@ -596,12 +596,12 @@ dynlist_nested_member( Operation *op, dynlist_member_t *dm, TAvlnode *subs )
 			dynlist_urlmembers( op, dyn, &cb );
 		}
 		if ( dyn->dy_subs )
-			dynlist_nested_member( op, dm, dyn->dy_subs );
+			dynlist_nested_member( op, on, dm, dyn->dy_subs );
 	}
 }
 
 static int
-dynlist_prepare_entry( Operation *op, SlapReply *rs, dynlist_info_t *dli, dynlist_name_t *dyn )
+dynlist_prepare_entry( Operation *op, SlapReply *rs, slap_overinst *on, dynlist_info_t *dli, dynlist_name_t *dyn )
 {
 	Attribute	*a, *id = NULL;
 	slap_callback	cb = { 0 };
@@ -875,7 +875,7 @@ checkdyn:
 		/* ensure e is modifiable */
 		if ( e == rs->sr_entry && !( rs->sr_flags & REP_ENTRY_MODIFIABLE ) ) {
 			e = entry_dup( rs->sr_entry );
-			rs_replace_entry( op, rs, (slap_overinst *)op->o_bd->bd_info, e );
+			rs_replace_entry( op, rs, on, e );
 			rs->sr_flags |= REP_ENTRY_MODIFIABLE | REP_ENTRY_MUSTBEFREED;
 		}
 		if ( dyn->dy_subs ) {
@@ -888,7 +888,7 @@ checkdyn:
 					dm.dm_mod.sm_type = dlm->dlm_member_ad->ad_cname;
 					dm.dm_e = e;
 					dm.dm_ad = dlm->dlm_member_ad;
-					dynlist_nested_member( op, &dm, dyn->dy_subs );
+					dynlist_nested_member( op, on, &dm, dyn->dy_subs );
 					if ( dm.dm_groups )
 						ldap_tavl_free( dm.dm_groups, NULL );
 				}
@@ -904,7 +904,7 @@ checkdyn:
 	}
 
 	if ( e != rs->sr_entry ) {
-		rs_replace_entry( op, rs, (slap_overinst *)op->o_bd->bd_info, e );
+		rs_replace_entry( op, rs, on, e );
 		rs->sr_flags |= REP_ENTRY_MODIFIABLE | REP_ENTRY_MUSTBEFREED;
 	}
 
@@ -1098,7 +1098,7 @@ done:;
 		r.sr_attrs = an;
 
 		o.o_acl_priv = ACL_COMPARE;
-		dynlist_prepare_entry( &o, &r, dli, NULL );
+		dynlist_prepare_entry( &o, &r, on, dli, NULL );
 		a = attrs_find( r.sr_entry->e_attrs, op->orc_ava->aa_desc );
 
 		ret = LDAP_NO_SUCH_ATTRIBUTE;
@@ -1131,6 +1131,7 @@ release:;
 #define	WANT_MEMBER	2
 
 typedef struct dynlist_search_t {
+	slap_overinst *ds_on;
 	TAvlnode *ds_names;
 	TAvlnode *ds_fnodes;
 	dynlist_info_t *ds_dli;
@@ -1555,11 +1556,11 @@ dynlist_test_dynmember(Operation *op, dynlist_name_t *dyn, Entry *e)
 }
 
 static int
-dynlist_test_membership(Operation *op, dynlist_name_t *dyn, Entry *e)
+dynlist_test_membership(Operation *op, slap_overinst *on, dynlist_name_t *dyn, Entry *e)
 {
 	if ( dyn->dy_staticmember ) {
 		Entry *grp;
-		if ( overlay_entry_get_ov( op, &dyn->dy_nname, NULL, NULL, 0, &grp, (slap_overinst *)op->o_bd->bd_info ) == LDAP_SUCCESS && grp ) {
+		if ( overlay_entry_get_ov( op, &dyn->dy_nname, NULL, NULL, 0, &grp, on ) == LDAP_SUCCESS && grp ) {
 			Attribute *a = attr_find( grp->e_attrs, dyn->dy_staticmember );
 			int rc;
 			if ( a ) {
@@ -1569,7 +1570,7 @@ dynlist_test_membership(Operation *op, dynlist_name_t *dyn, Entry *e)
 			} else {
 				rc = LDAP_COMPARE_FALSE;
 			}
-			overlay_entry_release_ov( op, grp, 0, (slap_overinst *)op->o_bd->bd_info );
+			overlay_entry_release_ov( op, grp, 0, on );
 			return rc;
 		}
 	}
@@ -1591,7 +1592,7 @@ dynlist_add_memberOf(Operation *op, SlapReply *rs, dynlist_search_t *ds)
 		dyn = ptr->avl_data;
 		for ( dlm = dyn->dy_dli->dli_dlm; dlm; dlm = dlm->dlm_next ) {
 			if ( dlm->dlm_memberOf_ad ) {
-				if ( dynlist_test_membership( op, dyn, e ) == LDAP_COMPARE_TRUE ) {
+				if ( dynlist_test_membership( op, ds->ds_on, dyn, e ) == LDAP_COMPARE_TRUE ) {
 					/* ensure e is modifiable, but do not replace
 					 * sr_entry yet since we have pointers into it */
 					if ( !( rs->sr_flags & REP_ENTRY_MODIFIABLE ) && e == rs->sr_entry ) {
@@ -1655,7 +1656,7 @@ dynlist_search2resp( Operation *op, SlapReply *rs )
 			dyn = ldap_tavl_find( ds->ds_names, &rs->sr_entry->e_nname, dynlist_avl_cmp );
 			if ( dyn ) {
 				dyn->dy_seen = 1;
-				rc = dynlist_prepare_entry( op, rs, dyn->dy_dli, dyn );
+				rc = dynlist_prepare_entry( op, rs, ds->ds_on, dyn->dy_dli, dyn );
 			} else if ( ds->ds_want )
 				dynlist_add_memberOf( op, rs, ds );
 		}
@@ -1667,7 +1668,7 @@ dynlist_search2resp( Operation *op, SlapReply *rs )
 				for ( dli = ds->ds_dli; dli; dli = dli->dli_next ) {
 					if ( is_entry_objectclass_or_sub( rs->sr_entry, dli->dli_oc ) &&
 						dynlist_check_scope( op, rs->sr_entry, dli ))
-						rc = dynlist_prepare_entry( op, rs, dli, NULL );
+						rc = dynlist_prepare_entry( op, rs, ds->ds_on, dli, NULL );
 				}
 			}
 		}
@@ -1677,7 +1678,7 @@ dynlist_search2resp( Operation *op, SlapReply *rs )
 		}
 		return rc;
 	} else if ( rs->sr_type == REP_RESULT && rs->sr_err == LDAP_SUCCESS ) {
-		slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
+		slap_overinst *on = ds->ds_on;
 		TAvlnode *ptr, *skip = NULL;
 		SlapReply r = *rs;
 		dynlist_map_t *dlm = NULL;
@@ -1729,7 +1730,7 @@ dynlist_search2resp( Operation *op, SlapReply *rs )
 				r.sr_entry == NULL )
 				goto next;
 			r.sr_flags = REP_ENTRY_MUSTRELEASE;
-			dynlist_prepare_entry( op, &r, dyn->dy_dli, dyn );
+			dynlist_prepare_entry( op, &r, on, dyn->dy_dli, dyn );
 			if ( test_filter( op, r.sr_entry, f ) == LDAP_COMPARE_TRUE ) {
 				r.sr_attrs = op->ors_attrs;
 				rs->sr_err = send_search_entry( op, &r );
@@ -1895,6 +1896,8 @@ dynlist_search( Operation *op, SlapReply *rs )
 		userattrs = SLAP_USERATTRS( attrflags );
 	}
 
+	if (dlg->dlg_simple)
+		goto simple;
 	/* Find all groups in scope. For group expansion
 	 * we only need the groups within the search scope, but
 	 * for memberOf populating, we need all dyngroups.
@@ -2063,12 +2066,14 @@ dynlist_search( Operation *op, SlapReply *rs )
 				dynlist_nestlink( op, ds );
 		}
 	}
+simple:
 
 	if ( dlg->dlg_dli || ds->ds_names != NULL ) {
 		sc->sc_response = dynlist_search2resp;
 		sc->sc_cleanup = dynlist_search_cleanup;
 		sc->sc_next = op->o_callback;
 		op->o_callback = sc;
+		ds->ds_on = on;
 
 		/* dynamic lists need this */
 		ds->ds_dli = dlg->dlg_dli;
@@ -2145,6 +2150,13 @@ static ConfigTable dlcfg[] = {
 		3, 3, 0, ARG_MAGIC|DL_ATTRPAIR_COMPAT, dl_cfgen,
 			NULL, NULL, NULL },
 #endif
+	{ "dynlist-simple", NULL, 0, 0, 0, ARG_OFFSET|ARG_ON_OFF,
+		(void *)offsetof(dynlist_gen_t, dlg_simple),
+		"( OLcfgOvAt:8.2 NAME 'olcDynListSimple' "
+			"DESC 'Simple mode - disable features added since 2.4.' "
+			"EQUALITY booleanMatch "
+			"SYNTAX OMsBoolean SINGLE-VALUE )",
+			NULL, NULL },
 	{ NULL, NULL, 0, 0, 0, ARG_IGNORED }
 };
 
@@ -2153,7 +2165,7 @@ static ConfigOCs dlocs[] = {
 		"NAME ( 'olcDynListConfig' 'olcDynamicList' ) "
 		"DESC 'Dynamic list configuration' "
 		"SUP olcOverlayConfig "
-		"MAY olcDynListAttrSet )",
+		"MAY ( olcDynListAttrSet $ olcDynListSimple ) )",
 		Cft_Overlay, dlcfg, NULL, NULL },
 	{ NULL, 0, NULL }
 };
@@ -2740,10 +2752,13 @@ dynlist_db_init(
 	slap_overinst *on = (slap_overinst *)be->bd_info;
 	dynlist_gen_t *dlg;
 
-	dlg = (dynlist_gen_t *)ch_malloc( sizeof( *dlg ));
+	if ( SLAP_ISGLOBALOVERLAY( be ) ) {
+		Debug( LDAP_DEBUG_ANY, "dynlist cannot be used as global overlay.\n" );
+		return 1;
+	}
+
+	dlg = (dynlist_gen_t *)ch_calloc( 1, sizeof( *dlg ));
 	on->on_bi.bi_private = dlg;
-	dlg->dlg_dli = NULL;
-	dlg->dlg_memberOf = 0;
 
 	return 0;
 }
diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index 106a371..c1364a9 100644
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -100,9 +100,7 @@ LDAP_SLAPD_F (int) acl_string_expand LDAP_P((
  */
 LDAP_SLAPD_V (LDAP_CONST char *) style_strings[];
 
-LDAP_SLAPD_F (int) parse_acl LDAP_P(( Backend *be,
-	const char *fname, int lineno,
-	int argc, char **argv, int pos ));
+LDAP_SLAPD_F (int) parse_acl LDAP_P(( struct config_args_s *ca, int pos ));
 
 LDAP_SLAPD_F (char *) access2str LDAP_P(( slap_access_t access ));
 LDAP_SLAPD_F (slap_access_t) str2access LDAP_P(( const char *str ));
diff --git a/servers/slapd/slap-config.h b/servers/slapd/slap-config.h
index 3252fd7..5682204 100644
--- a/servers/slapd/slap-config.h
+++ b/servers/slapd/slap-config.h
@@ -196,31 +196,31 @@ typedef struct config_args_s {
 #define value_ndn values.v_dn.vdn_ndn
 #define value_ad values.v_ad
 
-int config_fp_parse_line(ConfigArgs *c);
-
-int config_register_schema(ConfigTable *ct, ConfigOCs *co);
-int config_del_vals(ConfigTable *cf, ConfigArgs *c);
-int config_get_vals(ConfigTable *ct, ConfigArgs *c);
-int config_add_vals(ConfigTable *ct, ConfigArgs *c);
-
-int config_push_cleanup(ConfigArgs *c, ConfigDriver *cleanup);
-int config_run_cleanup(ConfigArgs *c);
-
-void init_config_argv( ConfigArgs *c );
-int init_config_attrs(ConfigTable *ct);
-int init_config_ocs( ConfigOCs *ocs );
-void config_parse_ldif( ConfigArgs *c );
-int config_parse_vals(ConfigTable *ct, ConfigArgs *c, int valx);
-int config_parse_add(ConfigTable *ct, ConfigArgs *c, int valx);
-int read_config_file(const char *fname, int depth, ConfigArgs *cf,
+LDAP_SLAPD_F (int) config_fp_parse_line(ConfigArgs *c);
+
+LDAP_SLAPD_F (int) config_register_schema(ConfigTable *ct, ConfigOCs *co);
+LDAP_SLAPD_F (int) config_del_vals(ConfigTable *cf, ConfigArgs *c);
+LDAP_SLAPD_F (int) config_get_vals(ConfigTable *ct, ConfigArgs *c);
+LDAP_SLAPD_F (int) config_add_vals(ConfigTable *ct, ConfigArgs *c);
+
+LDAP_SLAPD_F (int) config_push_cleanup(ConfigArgs *c, ConfigDriver *cleanup);
+LDAP_SLAPD_F (int) config_run_cleanup(ConfigArgs *c);
+
+LDAP_SLAPD_F (void) init_config_argv( ConfigArgs *c );
+LDAP_SLAPD_F (int) init_config_attrs(ConfigTable *ct);
+LDAP_SLAPD_F (int) init_config_ocs( ConfigOCs *ocs );
+LDAP_SLAPD_F (void) config_parse_ldif( ConfigArgs *c );
+LDAP_SLAPD_F (int) config_parse_vals(ConfigTable *ct, ConfigArgs *c, int valx);
+LDAP_SLAPD_F (int) config_parse_add(ConfigTable *ct, ConfigArgs *c, int valx);
+LDAP_SLAPD_F (int) read_config_file(const char *fname, int depth, ConfigArgs *cf,
 	ConfigTable *cft );
 
-ConfigTable * config_find_keyword(ConfigTable *ct, ConfigArgs *c);
-Entry * config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent,
+LDAP_SLAPD_F (ConfigTable *) config_find_keyword(ConfigTable *ct, ConfigArgs *c);
+LDAP_SLAPD_F (Entry *) config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent,
 	ConfigArgs *c, struct berval *rdn, ConfigOCs *main, ConfigOCs *extra );
 
-Listener *config_check_my_url(const char *url, LDAPURLDesc *lud);
-int config_shadow( ConfigArgs *c, slap_mask_t flag );
+LDAP_SLAPD_F (Listener *) config_check_my_url(const char *url, LDAPURLDesc *lud);
+LDAP_SLAPD_F (int) config_shadow( ConfigArgs *c, slap_mask_t flag );
 #define	config_slurp_shadow(c)	config_shadow((c), SLAP_DBFLAG_SLURP_SHADOW)
 #define	config_sync_shadow(c)	config_shadow((c), SLAP_DBFLAG_SYNC_SHADOW)
 
@@ -231,7 +231,7 @@ int config_shadow( ConfigArgs *c, slap_mask_t flag );
 #define	SLAP_X_ORDERED_FMT	"{%d}"
 
 LDAP_SLAPD_V (slap_verbmasks *) slap_ldap_response_code;
-extern int slap_ldap_response_code_register( struct berval *bv, int err );
+LDAP_SLAPD_F (int) slap_ldap_response_code_register( struct berval *bv, int err );
 
 LDAP_SLAPD_V (ConfigTable) olcDatabaseDummy[];
 
diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h
index 5cf2f46..605a80f 100644
--- a/servers/slapd/slap.h
+++ b/servers/slapd/slap.h
@@ -1319,12 +1319,15 @@ typedef struct AuthorizationInformation {
 	slap_ssf_t	sai_sasl_ssf;		/* SASL SSF */
 } AuthorizationInformation;
 
+typedef struct config_args_s ConfigArgs;	/* slap-config.h */
+typedef struct config_reply_s ConfigReply;	/* slap-config.h */
+
 #ifdef SLAP_DYNACL
 
 /*
  * "dynamic" ACL infrastructure (for ACIs and more)
  */
-typedef int (slap_dynacl_parse) LDAP_P(( const char *fname, int lineno,
+typedef int (slap_dynacl_parse) LDAP_P(( ConfigArgs *ca,
 	const char *opts, slap_style_t, const char *, void **privp ));
 typedef int (slap_dynacl_unparse) LDAP_P(( void *priv, struct berval *bv ));
 typedef int (slap_dynacl_mask) LDAP_P((
@@ -2019,7 +2022,6 @@ typedef int (BI_config) LDAP_P((BackendInfo *bi,
 	const char *fname, int lineno,
 	int argc, char **argv));
 
-typedef struct config_reply_s ConfigReply; /* slap-config.h */
 typedef int (BI_db_func) LDAP_P((Backend *bd, ConfigReply *cr));
 typedef BI_db_func BI_db_init;
 typedef BI_db_func BI_db_open;
diff --git a/servers/slapd/slapi/Makefile.in b/servers/slapd/slapi/Makefile.in
index 0e46f78..32ade0c 100644
--- a/servers/slapd/slapi/Makefile.in
+++ b/servers/slapd/slapi/Makefile.in
@@ -19,9 +19,6 @@ LIBRARY = libslapi.la
 #all-common: $(LIBRARY) $(PROGRAMS)
 #	@touch plugin.c slapi_pblock.c slapi_utils.c slapi_ops.c slapi_ext.c
 
-NT_SRCS = nt_err.c
-NT_OBJS = nt_err.lo
-
 LIB_DEFS = -DSLAPI_LIBRARY
 
 SRCS=  plugin.c slapi_pblock.c slapi_utils.c printmsg.c slapi_ops.c slapi_dn.c slapi_ext.c slapi_overlay.c \
@@ -31,12 +28,15 @@ OBJS=  plugin.lo slapi_pblock.lo slapi_utils.lo printmsg.lo slapi_ops.lo slapi_d
 
 XSRCS= version.c
 
-LDAP_INCDIR= ../../../include -I.. -I.       
-LDAP_LIBDIR= ../../../libraries       
+LDAP_INCDIR= ../../../include -I.. -I.
+LDAP_LIBDIR= ../../../libraries
+
+shared_LDAP_LIBS = $(LDAP_LIBLDAP_LA) $(LDAP_LIBLBER_LA)
 
 XLIBS = $(LIBRARY)
 XXLIBS = 
-NT_LINK_LIBS = $(AC_LIBS)
+MOD_LIBS = $(MODULES_LIBS)
+NT_LINK_LIBS = $(AC_LIBS) -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS)
 
 XINCPATH = -I$(srcdir)/.. -I$(srcdir)
 XDEFS = $(MODULES_CPPFLAGS)
diff --git a/servers/slapd/slapi/plugin.c b/servers/slapd/slapi/plugin.c
index de8c60d..ca5dbea 100644
--- a/servers/slapd/slapi/plugin.c
+++ b/servers/slapd/slapi/plugin.c
@@ -36,7 +36,7 @@
 #include <ltdl.h>
 
 static int slapi_int_load_plugin( Slapi_PBlock *, const char *, const char *, int, 
-	SLAPI_FUNC *, lt_dlhandle * );
+	SLAPI_FUNC *, lt_dlhandle *, ConfigArgs *c );
 
 /* pointer to link list of extended objects */
 static ExtendedOp *pGExtendedOps = NULL;
@@ -68,15 +68,15 @@ static Slapi_PBlock *
 plugin_pblock_new(
 	int type, 
 	int argc, 
-	char *argv[] ) 
+	ConfigArgs *c )
 {
 	Slapi_PBlock	*pPlugin = NULL; 
 	Slapi_PluginDesc *pPluginDesc = NULL;
 	lt_dlhandle	hdLoadHandle;
 	int		rc;
 	char		**av2 = NULL, **ppPluginArgv;
-	char		*path = argv[2];
-	char		*initfunc = argv[3];
+	char		*path = c->argv[2];
+	char		*initfunc = c->argv[3];
 
 	pPlugin = slapi_pblock_new();
 	if ( pPlugin == NULL ) {
@@ -87,7 +87,7 @@ plugin_pblock_new(
 	slapi_pblock_set( pPlugin, SLAPI_PLUGIN_TYPE, (void *)&type );
 	slapi_pblock_set( pPlugin, SLAPI_PLUGIN_ARGC, (void *)&argc );
 
-	av2 = ldap_charray_dup( argv );
+	av2 = ldap_charray_dup( c->argv );
 	if ( av2 == NULL ) {
 		rc = LDAP_NO_MEMORY;
 		goto done;
@@ -102,7 +102,7 @@ plugin_pblock_new(
 	slapi_pblock_set( pPlugin, SLAPI_PLUGIN_ARGV, (void *)ppPluginArgv );
 	slapi_pblock_set( pPlugin, SLAPI_X_CONFIG_ARGV, (void *)av2 );
 
-	rc = slapi_int_load_plugin( pPlugin, path, initfunc, 1, NULL, &hdLoadHandle );
+	rc = slapi_int_load_plugin( pPlugin, path, initfunc, 1, NULL, &hdLoadHandle, c );
 	if ( rc != 0 ) {
 		goto done;
 	}
@@ -556,7 +556,8 @@ slapi_int_load_plugin(
 	const char	*initfunc, 
 	int		doInit,
 	SLAPI_FUNC	*pInitFunc,
-	lt_dlhandle	*pLdHandle ) 
+	lt_dlhandle	*pLdHandle,
+	ConfigArgs *c )
 {
 	int		rc = LDAP_SUCCESS;
 	SLAPI_FUNC	fpInitFunc = NULL;
@@ -570,15 +571,17 @@ slapi_int_load_plugin(
 	/* load in the module */
 	*pLdHandle = lt_dlopen( path );
 	if ( *pLdHandle == NULL ) {
-		fprintf( stderr, "failed to load plugin %s: %s\n",
+		snprintf( c->cr_msg, sizeof( c->cr_msg ), "failed to load plugin %s: %s",
 			 path, lt_dlerror() );
+		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 		return LDAP_LOCAL_ERROR;
 	}
 
 	fpInitFunc = (SLAPI_FUNC)lt_dlsym( *pLdHandle, initfunc );
 	if ( fpInitFunc == NULL ) {
-		fprintf( stderr, "failed to find symbol %s in plugin %s: %s\n",
+		snprintf( c->cr_msg, sizeof( c->cr_msg ), "failed to find symbol %s in plugin %s: %s",
 			 initfunc, path, lt_dlerror() );
+		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 		lt_dlclose( *pLdHandle );
 		return LDAP_LOCAL_ERROR;
 	}
@@ -643,50 +646,46 @@ slapi_int_call_plugins(
 
 int
 slapi_int_read_config(
-	Backend		*be, 		
-	const char	*fname, 
-	int		lineno, 
-	int		argc, 
-	char		**argv,
-	int		index )
+	struct config_args_s *c )
 {
 	int		iType = -1;
 	int		numPluginArgc = 0;
 
-	if ( argc < 4 ) {
-		fprintf( stderr,
-			"%s: line %d: missing arguments "
+	if ( c->argc < 4 ) {
+		snprintf( c->cr_msg, sizeof( c->cr_msg ),
+			"missing arguments "
 			"in \"plugin <plugin_type> <lib_path> "
-			"<init_function> [<arguments>]\" line\n",
-			fname, lineno );
+			"<init_function> [<arguments>]\" line" );
+		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 		return 1;
 	}
 
 	/* automatically instantiate overlay if necessary */
-	if ( !slapi_over_is_inst( be ) ) {
-		ConfigReply cr = { 0 };
-		if ( slapi_over_config( be, &cr ) != 0 ) {
-			fprintf( stderr, "Failed to instantiate SLAPI overlay: "
-				"err=%d msg=\"%s\"\n", cr.err, cr.msg );
+	if ( !slapi_over_is_inst( c->be ) ) {
+		if ( slapi_over_config( c->be, &c->reply ) != 0 ) {
+			Debug( LDAP_DEBUG_ANY, "%s: "
+			"Failed to instantiate SLAPI overlay: "
+				"err=%d msg=\"%s\"\n", c->log, c->reply.err, c->reply.msg );
 			return -1;
 		}
 	}
 	
-	if ( strcasecmp( argv[1], "preoperation" ) == 0 ) {
+	if ( strcasecmp( c->argv[1], "preoperation" ) == 0 ) {
 		iType = SLAPI_PLUGIN_PREOPERATION;
-	} else if ( strcasecmp( argv[1], "postoperation" ) == 0 ) {
+	} else if ( strcasecmp( c->argv[1], "postoperation" ) == 0 ) {
 		iType = SLAPI_PLUGIN_POSTOPERATION;
-	} else if ( strcasecmp( argv[1], "extendedop" ) == 0 ) {
+	} else if ( strcasecmp( c->argv[1], "extendedop" ) == 0 ) {
 		iType = SLAPI_PLUGIN_EXTENDEDOP;
-	} else if ( strcasecmp( argv[1], "object" ) == 0 ) {
+	} else if ( strcasecmp( c->argv[1], "object" ) == 0 ) {
 		iType = SLAPI_PLUGIN_OBJECT;
 	} else {
-		fprintf( stderr, "%s: line %d: invalid plugin type \"%s\".\n",
-				fname, lineno, argv[1] );
+		snprintf( c->cr_msg, sizeof( c->cr_msg ),
+			"invalid plugin type \"%s\"", c->argv[1] );
+		Debug( LDAP_DEBUG_ANY, "%s: %s.\n", c->log, c->cr_msg );
 		return 1;
 	}
 	
-	numPluginArgc = argc - 4;
+	numPluginArgc = c->argc - 4;
 
 	if ( iType == SLAPI_PLUGIN_PREOPERATION ||
 		  	iType == SLAPI_PLUGIN_EXTENDEDOP ||
@@ -695,23 +694,23 @@ slapi_int_read_config(
 		int rc;
 		Slapi_PBlock *pPlugin;
 
-		pPlugin = plugin_pblock_new( iType, numPluginArgc, argv );
+		pPlugin = plugin_pblock_new( iType, numPluginArgc, c->argv );
 		if (pPlugin == NULL) {
 			return 1;
 		}
 
 		if (iType == SLAPI_PLUGIN_EXTENDEDOP) {
-			rc = slapi_int_register_extop(be, &pGExtendedOps, pPlugin);
+			rc = slapi_int_register_extop(c->be, &pGExtendedOps, pPlugin);
 			if ( rc != LDAP_SUCCESS ) {
 				slapi_pblock_destroy( pPlugin );
 				return 1;
 			}
 		}
 
-		rc = slapi_int_register_plugin_index( be, pPlugin, index );
+		rc = slapi_int_register_plugin_index( c->be, pPlugin, c->valx );
 		if ( rc != LDAP_SUCCESS ) {
 			if ( iType == SLAPI_PLUGIN_EXTENDEDOP ) {
-				slapi_int_unregister_extop( be, &pGExtendedOps, pPlugin );
+				slapi_int_unregister_extop( c->be, &pGExtendedOps, pPlugin );
 			}
 			slapi_pblock_destroy( pPlugin );
 			return 1;
diff --git a/servers/slapd/slapi/printmsg.c b/servers/slapd/slapi/printmsg.c
index 15b6004..5251846 100644
--- a/servers/slapd/slapi/printmsg.c
+++ b/servers/slapd/slapi/printmsg.c
@@ -32,6 +32,10 @@
 #include <slap.h>
 #include <slapi.h>
 
+#ifdef _WIN32
+#include <io.h>
+#endif
+
 #include <ldap_pvt_thread.h>
 
 /* Single threads access to routine */
@@ -60,18 +64,30 @@ slapi_int_log_error(
 
 	/* for now, we log all severities */
 	if ( level <= slapi_log_level ) {
+#ifdef _WIN32
+		intptr_t fhandle;
+#endif
 		fp = fopen( slapi_log_file, "a" );
 		if ( fp == NULL) {
 			rc = -1;
 			goto done;
 		}
 
+#ifdef _WIN32
+		fhandle = _get_osfhandle( fileno( fp ));
+#endif
 		/*
 		 * FIXME: could block
 		 */
+#ifdef _WIN32
+		while ( LockFile( fhandle, 0, 0, UINT_MAX, UINT_MAX ) == 0 ) {
+			/* DO NOTHING */ ;
+		}
+#else
 		while ( lockf( fileno( fp ), F_LOCK, 0 ) != 0 ) {
 			/* DO NOTHING */ ;
 		}
+#endif
 
 		time( &currentTime );
 		ltm = localtime( &currentTime );
@@ -85,7 +101,11 @@ slapi_int_log_error(
 		}
 		fflush( fp );
 
+#ifdef _WIN32
+		UnlockFile( fhandle, 0, 0, UINT_MAX, UINT_MAX );
+#else
 		lockf( fileno( fp ), F_ULOCK, 0 );
+#endif
 
 		fclose( fp );
 
diff --git a/servers/slapd/slapi/proto-slapi.h b/servers/slapd/slapi/proto-slapi.h
index 9d52510..e9eb76b 100644
--- a/servers/slapd/slapi/proto-slapi.h
+++ b/servers/slapd/slapi/proto-slapi.h
@@ -72,8 +72,7 @@ LDAP_SLAPI_F (int) slapi_int_register_extop LDAP_P((Backend *pBE, ExtendedOp **o
 LDAP_SLAPI_F (int) slapi_int_get_extop_plugin LDAP_P((struct berval  *reqoid, SLAPI_FUNC *pFuncAddr ));
 LDAP_SLAPI_F (struct berval *) slapi_int_get_supported_extop LDAP_P(( int ));
 LDAP_SLAPI_F (int) slapi_int_unregister_plugins LDAP_P((Backend *be, int index));
-LDAP_SLAPI_F (int) slapi_int_read_config LDAP_P((Backend *be, const char *fname, int lineno,
-		int argc, char **argv, int index ));
+LDAP_SLAPI_F (int) slapi_int_read_config LDAP_P(( struct config_args_s *c ));
 LDAP_SLAPI_F (void) slapi_int_plugin_unparse LDAP_P((Backend *be, BerVarray *out ));
 LDAP_SLAPI_F (int) slapi_int_initialize LDAP_P((void));
 
diff --git a/servers/slapd/slapi/slapi_utils.c b/servers/slapd/slapi/slapi_utils.c
index 6c1cecf..c459122 100644
--- a/servers/slapd/slapi/slapi_utils.c
+++ b/servers/slapd/slapi/slapi_utils.c
@@ -31,7 +31,11 @@
 #include <slap.h>
 #include <slapi.h>
 
+#ifdef _WIN32
+#include <winsock.h>
+#else
 #include <netdb.h>
+#endif
 
 #ifdef LDAP_SLAPI
 
@@ -1971,6 +1975,8 @@ slapi_timer_current_time( void )
 	 */
 #else /* _WIN32 */
 	LARGE_INTEGER now;
+	static LARGE_INTEGER base_time, performance_freq;
+	static int performance_counter_present;
 
 	if ( first_time ) {
 		first_time = 0;
diff --git a/servers/slapd/slappasswd.c b/servers/slapd/slappasswd.c
index 9c2adef..e384364 100644
--- a/servers/slapd/slappasswd.c
+++ b/servers/slapd/slappasswd.c
@@ -250,11 +250,16 @@ slappasswd( int argc, char *argv[] )
 		if( newpw == NULL ) {
 			/* prompt for new password */
 			char *cknewpw;
-			newpw = ch_strdup(getpassphrase("New password: "));
+			newpw = getpassphrase("New password: ");
+			if ( newpw == NULL ) { /* Allow EOF to exit. */
+				rc = EXIT_FAILURE;
+				goto destroy;
+			}
+			newpw = ch_strdup(newpw);
 			cknewpw = getpassphrase("Re-enter new password: ");
-	
-			if( strcmp( newpw, cknewpw )) {
-				fprintf( stderr, "Password values do not match\n" );
+			if( cknewpw == NULL || strcmp( newpw, cknewpw )) {
+				fprintf( stderr,
+				    "Password values do not match\n" );
 				rc = EXIT_FAILURE;
 				goto destroy;
 			}
diff --git a/tests/progs/slapd-tester.c b/tests/progs/slapd-tester.c
index 7ad88b8..8f9656e 100644
--- a/tests/progs/slapd-tester.c
+++ b/tests/progs/slapd-tester.c
@@ -406,6 +406,9 @@ main( int argc, char **argv )
 
 	if ( pw_ask ) {
 		passwd = getpassphrase( _("Enter LDAP Password: ") );
+		if ( passwd == NULL ) { /* Allow EOF to exit. */
+			exit( EXIT_FAILURE );
+		}
 
 	} else if ( pw_file ) {
 		struct berval	pw;