4404fd
From eb087e0861f207858a4e08c72836a86f26d9701c Mon Sep 17 00:00:00 2001
4404fd
From: Quanah Gibson-Mount <quanah@openldap.org>
4404fd
Date: Thu, 14 Jun 2018 16:12:59 +0100
4404fd
Subject: [PATCH] ITS#8573 TLS option test suite
4404fd
4404fd
---
4404fd
 configure                                     |   4 +
4404fd
 configure.in                                  |   4 +
4404fd
 tests/data/slapd-tls-sasl.conf                |  65 ++
4404fd
 tests/data/slapd-tls.conf                     |  61 ++
4404fd
 tests/data/tls/ca/certs/testsuiteCA.crt       |  16 +
4404fd
 tests/data/tls/ca/private/testsuiteCA.key     |  16 +
4404fd
 .../tls/certs/bjensen@mailgw.example.com.crt  |  16 +
4404fd
 tests/data/tls/certs/localhost.crt            |  16 +
4404fd
 tests/data/tls/conf/openssl.cnf               | 129 ++++
4404fd
 tests/data/tls/create-crt.sh                  |  78 +++
4404fd
 .../private/bjensen@mailgw.example.com.key    |  16 +
4404fd
 tests/data/tls/private/localhost.key          |  16 +
4404fd
 tests/run.in                                  |   3 +-
4404fd
 tests/scripts/defines.sh                      |  21 +-
4404fd
 tests/scripts/test067-tls                     | 140 +++++
4404fd
 tests/scripts/test068-sasl-tls-external       | 102 ++++
4404fd
 .../test069-delta-multimaster-starttls        | 574 ++++++++++++++++++
4404fd
 tests/scripts/test070-delta-multimaster-ldaps | 571 +++++++++++++++++
4404fd
 18 files changed, 1846 insertions(+), 2 deletions(-)
4404fd
 create mode 100644 tests/data/slapd-tls-sasl.conf
4404fd
 create mode 100644 tests/data/slapd-tls.conf
4404fd
 create mode 100644 tests/data/tls/ca/certs/testsuiteCA.crt
4404fd
 create mode 100644 tests/data/tls/ca/private/testsuiteCA.key
4404fd
 create mode 100644 tests/data/tls/certs/bjensen@mailgw.example.com.crt
4404fd
 create mode 100644 tests/data/tls/certs/localhost.crt
4404fd
 create mode 100644 tests/data/tls/conf/openssl.cnf
4404fd
 create mode 100755 tests/data/tls/create-crt.sh
4404fd
 create mode 100644 tests/data/tls/private/bjensen@mailgw.example.com.key
4404fd
 create mode 100644 tests/data/tls/private/localhost.key
4404fd
 create mode 100755 tests/scripts/test067-tls
4404fd
 create mode 100755 tests/scripts/test068-sasl-tls-external
4404fd
 create mode 100755 tests/scripts/test069-delta-multimaster-starttls
4404fd
 create mode 100755 tests/scripts/test070-delta-multimaster-ldaps
4404fd
4404fd
diff --git a/configure b/configure
4404fd
index 16d4ab884..29b7ad91d 100755
4404fd
--- a/configure
4404fd
+++ b/configure
4404fd
@@ -761,6 +761,7 @@ AUTH_LIBS
4404fd
 LIBSLAPI
4404fd
 SLAPI_LIBS
4404fd
 MODULES_LIBS
4404fd
+WITH_TLS_TYPE
4404fd
 TLS_LIBS
4404fd
 SASL_LIBS
4404fd
 KRB5_LIBS
4404fd
@@ -5223,6 +5224,7 @@ KRB4_LIBS=
4404fd
 KRB5_LIBS=
4404fd
 SASL_LIBS=
4404fd
 TLS_LIBS=
4404fd
+WITH_TLS_TYPE=
4404fd
 MODULES_LIBS=
4404fd
 SLAPI_LIBS=
4404fd
 LIBSLAPI=
4404fd
@@ -15701,6 +15703,7 @@ fi
4404fd
 		if test $have_openssl = yes ; then
4404fd
 			ol_with_tls=openssl
4404fd
 			ol_link_tls=yes
4404fd
+			WITH_TLS_TYPE=openssl
4404fd
 
4404fd
 
4404fd
 $as_echo "#define HAVE_OPENSSL 1" >>confdefs.h
4404fd
@@ -15835,6 +15838,7 @@ fi
4404fd
 			if test $have_gnutls = yes ; then
4404fd
 				ol_with_tls=gnutls
4404fd
 				ol_link_tls=yes
4404fd
+				WITH_TLS_TYPE=gnutls
4404fd
 
4404fd
 				TLS_LIBS="-lgnutls"
4404fd
 
4404fd
diff --git a/configure.in b/configure.in
4404fd
index ee25a4a90..60c446096 100644
4404fd
--- a/configure.in
4404fd
+++ b/configure.in
4404fd
@@ -610,6 +610,7 @@ KRB4_LIBS=
4404fd
 KRB5_LIBS=
4404fd
 SASL_LIBS=
4404fd
 TLS_LIBS=
4404fd
+WITH_TLS_TYPE=
4404fd
 MODULES_LIBS=
4404fd
 SLAPI_LIBS=
4404fd
 LIBSLAPI=
4404fd
@@ -1210,6 +1211,7 @@ if test $ol_with_tls = openssl || test $ol_with_tls = auto ; then
4404fd
 		if test $have_openssl = yes ; then
4404fd
 			ol_with_tls=openssl
4404fd
 			ol_link_tls=yes
4404fd
+			WITH_TLS_TYPE=openssl
4404fd
 
4404fd
 			AC_DEFINE(HAVE_OPENSSL, 1, 
4404fd
 				[define if you have OpenSSL])
4404fd
@@ -1250,6 +1252,7 @@ if test $ol_link_tls = no ; then
4404fd
 			if test $have_gnutls = yes ; then
4404fd
 				ol_with_tls=gnutls
4404fd
 				ol_link_tls=yes
4404fd
+				WITH_TLS_TYPE=gnutls
4404fd
 
4404fd
 				TLS_LIBS="-lgnutls"
4404fd
 
4404fd
@@ -3261,6 +3264,7 @@ AC_SUBST(KRB4_LIBS)
4404fd
 AC_SUBST(KRB5_LIBS)
4404fd
 AC_SUBST(SASL_LIBS)
4404fd
 AC_SUBST(TLS_LIBS)
4404fd
+AC_SUBST(WITH_TLS_TYPE)
4404fd
 AC_SUBST(MODULES_LIBS)
4404fd
 AC_SUBST(SLAPI_LIBS)
4404fd
 AC_SUBST(LIBSLAPI)
4404fd
diff --git a/tests/data/slapd-tls-sasl.conf b/tests/data/slapd-tls-sasl.conf
4404fd
new file mode 100644
4404fd
index 000000000..f4bb0773e
4404fd
--- /dev/null
4404fd
+++ b/tests/data/slapd-tls-sasl.conf
4404fd
@@ -0,0 +1,65 @@
4404fd
+# stand-alone slapd config -- for testing (with indexing)
4404fd
+# $OpenLDAP$
4404fd
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
4404fd
+##
4404fd
+## Copyright 1998-2017 The OpenLDAP Foundation.
4404fd
+## All rights reserved.
4404fd
+##
4404fd
+## Redistribution and use in source and binary forms, with or without
4404fd
+## modification, are permitted only as authorized by the OpenLDAP
4404fd
+## Public License.
4404fd
+##
4404fd
+## A copy of this license is available in the file LICENSE in the
4404fd
+## top-level directory of the distribution or, alternatively, at
4404fd
+## <http://www.OpenLDAP.org/license.html>.
4404fd
+
4404fd
+#
4404fd
+include		@SCHEMADIR@/core.schema
4404fd
+include		@SCHEMADIR@/cosine.schema
4404fd
+#
4404fd
+include		@SCHEMADIR@/corba.schema
4404fd
+include		@SCHEMADIR@/java.schema
4404fd
+include		@SCHEMADIR@/inetorgperson.schema
4404fd
+include		@SCHEMADIR@/misc.schema
4404fd
+include		@SCHEMADIR@/nis.schema
4404fd
+include		@SCHEMADIR@/openldap.schema
4404fd
+#
4404fd
+include		@SCHEMADIR@/duaconf.schema
4404fd
+include		@SCHEMADIR@/dyngroup.schema
4404fd
+include		@SCHEMADIR@/ppolicy.schema
4404fd
+
4404fd
+#
4404fd
+pidfile		@TESTDIR@/slapd.1.pid
4404fd
+argsfile	@TESTDIR@/slapd.1.args
4404fd
+
4404fd
+# SSL configuration
4404fd
+TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt
4404fd
+TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key
4404fd
+TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt
4404fd
+TLSVerifyClient hard
4404fd
+
4404fd
+#
4404fd
+rootdse 	@DATADIR@/rootdse.ldif
4404fd
+
4404fd
+#mod#modulepath	../servers/slapd/back-@BACKEND@/
4404fd
+#mod#moduleload	back_@BACKEND@.la
4404fd
+#monitormod#modulepath ../servers/slapd/back-monitor/
4404fd
+#monitormod#moduleload back_monitor.la
4404fd
+
4404fd
+authz-regexp "email=([^,]*),cn=[^,]*,ou=OpenLDAP,o=OpenLDAP Foundation,st=CA,c=US" ldap:///ou=People,dc=example,dc=com??sub?(mail=$1)
4404fd
+
4404fd
+#######################################################################
4404fd
+# database definitions
4404fd
+#######################################################################
4404fd
+
4404fd
+database	@BACKEND@
4404fd
+suffix          "dc=example,dc=com"
4404fd
+rootdn          "cn=Manager,dc=example,dc=com"
4404fd
+rootpw          secret
4404fd
+#~null~#directory	@TESTDIR@/db.1.a
4404fd
+#indexdb#index		objectClass eq
4404fd
+#indexdb#index		mail eq
4404fd
+#ndb#dbname db_1_a
4404fd
+#ndb#include @DATADIR@/ndb.conf
4404fd
+
4404fd
+#monitor#database	monitor
4404fd
diff --git a/tests/data/slapd-tls.conf b/tests/data/slapd-tls.conf
4404fd
new file mode 100644
4404fd
index 000000000..6a7785557
4404fd
--- /dev/null
4404fd
+++ b/tests/data/slapd-tls.conf
4404fd
@@ -0,0 +1,61 @@
4404fd
+# stand-alone slapd config -- for testing (with indexing)
4404fd
+# $OpenLDAP$
4404fd
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
4404fd
+##
4404fd
+## Copyright 1998-2017 The OpenLDAP Foundation.
4404fd
+## All rights reserved.
4404fd
+##
4404fd
+## Redistribution and use in source and binary forms, with or without
4404fd
+## modification, are permitted only as authorized by the OpenLDAP
4404fd
+## Public License.
4404fd
+##
4404fd
+## A copy of this license is available in the file LICENSE in the
4404fd
+## top-level directory of the distribution or, alternatively, at
4404fd
+## <http://www.OpenLDAP.org/license.html>.
4404fd
+
4404fd
+#
4404fd
+include		@SCHEMADIR@/core.schema
4404fd
+include		@SCHEMADIR@/cosine.schema
4404fd
+#
4404fd
+include		@SCHEMADIR@/corba.schema
4404fd
+include		@SCHEMADIR@/java.schema
4404fd
+include		@SCHEMADIR@/inetorgperson.schema
4404fd
+include		@SCHEMADIR@/misc.schema
4404fd
+include		@SCHEMADIR@/nis.schema
4404fd
+include		@SCHEMADIR@/openldap.schema
4404fd
+#
4404fd
+include		@SCHEMADIR@/duaconf.schema
4404fd
+include		@SCHEMADIR@/dyngroup.schema
4404fd
+include		@SCHEMADIR@/ppolicy.schema
4404fd
+
4404fd
+#
4404fd
+pidfile		@TESTDIR@/slapd.1.pid
4404fd
+argsfile	@TESTDIR@/slapd.1.args
4404fd
+
4404fd
+# SSL configuration
4404fd
+TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key
4404fd
+TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt
4404fd
+
4404fd
+#
4404fd
+rootdse 	@DATADIR@/rootdse.ldif
4404fd
+
4404fd
+#mod#modulepath	../servers/slapd/back-@BACKEND@/
4404fd
+#mod#moduleload	back_@BACKEND@.la
4404fd
+#monitormod#modulepath ../servers/slapd/back-monitor/
4404fd
+#monitormod#moduleload back_monitor.la
4404fd
+
4404fd
+#######################################################################
4404fd
+# database definitions
4404fd
+#######################################################################
4404fd
+
4404fd
+database	@BACKEND@
4404fd
+suffix          "dc=example,dc=com"
4404fd
+rootdn          "cn=Manager,dc=example,dc=com"
4404fd
+rootpw          secret
4404fd
+#~null~#directory	@TESTDIR@/db.1.a
4404fd
+#indexdb#index		objectClass eq
4404fd
+#indexdb#index		mail eq
4404fd
+#ndb#dbname db_1_a
4404fd
+#ndb#include @DATADIR@/ndb.conf
4404fd
+
4404fd
+#monitor#database	monitor
4404fd
diff --git a/tests/data/tls/ca/certs/testsuiteCA.crt b/tests/data/tls/ca/certs/testsuiteCA.crt
4404fd
new file mode 100644
4404fd
index 000000000..7458e7461
4404fd
--- /dev/null
4404fd
+++ b/tests/data/tls/ca/certs/testsuiteCA.crt
4404fd
@@ -0,0 +1,16 @@
4404fd
+-----BEGIN CERTIFICATE-----
4404fd
+MIICgjCCAeugAwIBAgIJAJGJtO9oGgLiMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV
4404fd
+BAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UECgwTT3BlbkxEQVAgRm91bmRhdGlv
4404fd
+bjEfMB0GA1UECwwWT3BlbkxEQVAgVGVzdCBTdWl0ZSBDQTAgFw0xNzAxMTkyMDI0
4404fd
+NTFaGA8yNTE4MDIwMjIwMjQ1MVowWTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNB
4404fd
+MRwwGgYDVQQKDBNPcGVuTERBUCBGb3VuZGF0aW9uMR8wHQYDVQQLDBZPcGVuTERB
4404fd
+UCBUZXN0IFN1aXRlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3xcMd
4404fd
+rvEPxIzZ0FnGVfk6sLXW//4UbBZmmsHSNT7UDNpL301QrsOaATyiOMSPHxmQoLPb
4404fd
+lYOtTCPaHN9/KIHoCnEQ6tJRe30okA0DFnZvSH5jAm9E2QvsXMVXU5XIi9dZTNdL
4404fd
+6jwRajPQP3YfK+PyrtIqc0IvhB4Ori39vrFLpQIDAQABo1AwTjAdBgNVHQ4EFgQU
4404fd
+7fEPwfVJESrieK5MzzjBSK8xEfIwHwYDVR0jBBgwFoAU7fEPwfVJESrieK5MzzjB
4404fd
+SK8xEfIwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBtXLZWW6ZKZux/
4404fd
+wk7uLNZl01kPJUBiI+yMU5uY5PgOph1CpaUXp3QftCb0yRQ2g5d0CNYI5DyXuHws
4404fd
+ZSZRFF8SRwm3AogkMzYKenPF5m2OXSpvOMdnlbbFmIJnvwUfKhtinw+r0zvW8I8Q
4404fd
+aL52EFPS0o3tiAJXS82U2wrQdJ0YEw==
4404fd
+-----END CERTIFICATE-----
4404fd
diff --git a/tests/data/tls/ca/private/testsuiteCA.key b/tests/data/tls/ca/private/testsuiteCA.key
4404fd
new file mode 100644
4404fd
index 000000000..2e14d7033
4404fd
--- /dev/null
4404fd
+++ b/tests/data/tls/ca/private/testsuiteCA.key
4404fd
@@ -0,0 +1,16 @@
4404fd
+-----BEGIN PRIVATE KEY-----
4404fd
+MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALfFwx2u8Q/EjNnQ
4404fd
+WcZV+Tqwtdb//hRsFmaawdI1PtQM2kvfTVCuw5oBPKI4xI8fGZCgs9uVg61MI9oc
4404fd
+338ogegKcRDq0lF7fSiQDQMWdm9IfmMCb0TZC+xcxVdTlciL11lM10vqPBFqM9A/
4404fd
+dh8r4/Ku0ipzQi+EHg6uLf2+sUulAgMBAAECgYBDOb7kjuh0Iix8SXFt0ml3hMkg
4404fd
+O0kQ43FWW2pnoT64h3MbqjY4O5YmMimiFi4hRPkvJPpma01eCapb0ZAYjhLm1bpf
4404fd
+7Ey+724CEN3/DnorbQ3b/Fe2AVl4msJKEQFoercnaS9tFDPoijzH/quC2agH41tn
4404fd
+rGWTpahq6JUIP6xkwQJBAPHJZVHGQ8P/5bGxqOkPLtjIfDLtAgInMxZgDjHhHw2f
4404fd
+wGoeRrZ3J1yW0tnWtTXBN+5fKjCd6QpEvBmwhiZ+S+0CQQDCk1JBq64UotqeSWnk
4404fd
+AmhRMyVs87P0DPW2Gg8y96Q3d5Rwmy65ITr4pf/xufcSkrTSObDLhfhRyJKz7W4l
4404fd
+vjeZAkBq99CtZuugENxLyu+RfDgbjEb2OMjErxb49TISeyhD3MNBr3dVTk3Jtqg9
4404fd
+27F7wKm/+bYuoA3zjwkwzFntOb7ZAkAY0Hz/DwwGabaD1U0B3SS8pk8xk+rxRu3X
4404fd
+KX+iul5hDIkLy16sEYbZyyHXDCZsYfVZki3v5sgCdhfvhmozugyRAkBQgCeI8K1N
4404fd
+I9rHrcMZUjVT/3AdjSu6xIM87Vv/oIzGUNaadnQONRaXZ+Kp5pv9j4B/18rPcQwL
4404fd
++b2qljWeZbGH
4404fd
+-----END PRIVATE KEY-----
4404fd
diff --git a/tests/data/tls/certs/bjensen@mailgw.example.com.crt b/tests/data/tls/certs/bjensen@mailgw.example.com.crt
4404fd
new file mode 100644
4404fd
index 000000000..93e3a0d39
4404fd
--- /dev/null
4404fd
+++ b/tests/data/tls/certs/bjensen@mailgw.example.com.crt
4404fd
@@ -0,0 +1,16 @@
4404fd
+-----BEGIN CERTIFICATE-----
4404fd
+MIICejCCAeOgAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL
4404fd
+MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV
4404fd
+BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx
4404fd
+ODA1MjQyMzE2MTFaMIGbMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExHDAaBgNV
4404fd
+BAoME09wZW5MREFQIEZvdW5kYXRpb24xETAPBgNVBAsMCE9wZW5MREFQMSMwIQYD
4404fd
+VQQDDBpiamVuc2VuQG1haWxndy5leGFtcGxlLmNvbTEpMCcGCSqGSIb3DQEJARYa
4404fd
+YmplbnNlbkBtYWlsZ3cuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
4404fd
+MIGJAoGBAMjb2C5VL+f/B/f2xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKg
4404fd
+QbX2w0sPazujt8hG96F2mBv49pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmU
4404fd
+U++22BSuhthP5VQK7IqNyI7ZyQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAGjDTAL
4404fd
+MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADgYEAmAQhIIKqjC13rtAGEQHV/pKn
4404fd
+wOnLbNOumODqM+0MkEfqXXtR6eNGres2RNAtCJ5fqqDBTQCTqRzIt67cqdlJle2f
4404fd
+7vXYm8Y6NgxHwG+N1y7S0Xf+oo7/BJ+YJTLF7CLJuPNRqILWvXGlcNDcM1nekeKo
4404fd
+4DnnYQBDnq48VORVX94=
4404fd
+-----END CERTIFICATE-----
4404fd
diff --git a/tests/data/tls/certs/localhost.crt b/tests/data/tls/certs/localhost.crt
4404fd
new file mode 100644
4404fd
index 000000000..194cb119d
4404fd
--- /dev/null
4404fd
+++ b/tests/data/tls/certs/localhost.crt
4404fd
@@ -0,0 +1,16 @@
4404fd
+-----BEGIN CERTIFICATE-----
4404fd
+MIICgzCCAeygAwIBAgIBADANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJVUzEL
4404fd
+MAkGA1UECAwCQ0ExHDAaBgNVBAoME09wZW5MREFQIEZvdW5kYXRpb24xHzAdBgNV
4404fd
+BAsMFk9wZW5MREFQIFRlc3QgU3VpdGUgQ0EwIBcNMTcwNTEwMjMxNjExWhgPMjUx
4404fd
+ODA1MjQyMzE2MTFaMGoxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEcMBoGA1UE
4404fd
+CgwTT3BlbkxEQVAgRm91bmRhdGlvbjEcMBoGA1UECwwTT3BlbkxEQVAgVGVzdCBT
4404fd
+dWl0ZTESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
4404fd
+iQKBgQDutp3GaZXGSm7joDm1TYI+dhBAuL1+O+oJlmZL10GX/oHqc8WNobvuZGH4
4404fd
+7H8mQf7zWwJQWxL805oBDMPi2ncgha5ydaVsf4rBZATpweji04vd+672qtR/dGgv
4404fd
+8Re5G3ZFYWxUv8nb/DJojG601V2Ye/K3rf+Xwa9u4Q9EJqIivwIDAQABo0gwRjAJ
4404fd
+BgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAsBgNVHREEJTAjgglsb2NhbGhvc3SHBH8A
4404fd
+AAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZIhvcNAQELBQADgYEAYItH9TDh/lqG
4404fd
+8XcBPi0bzGaUPkGlDY615xvsVCflnsfRqLKP/dCfi1GjaDajEmE874pvnmmZfwxl
4404fd
+0MRTqnhEmFdqjPzVSVKCeNQYWGr3wzKwI7qrhTLMg3Tz98Sz0+HUY8G9fwsNekAR
4404fd
+GjeZB1FxqDGHjxBq2O828iejw28bSz4=
4404fd
+-----END CERTIFICATE-----
4404fd
diff --git a/tests/data/tls/conf/openssl.cnf b/tests/data/tls/conf/openssl.cnf
4404fd
new file mode 100644
4404fd
index 000000000..a3c8ad9f6
4404fd
--- /dev/null
4404fd
+++ b/tests/data/tls/conf/openssl.cnf
4404fd
@@ -0,0 +1,129 @@
4404fd
+HOME                    = .
4404fd
+RANDFILE                = $ENV::HOME/.rnd
4404fd
+
4404fd
+oid_section             = new_oids
4404fd
+
4404fd
+[ new_oids ]
4404fd
+tsa_policy1 = 1.2.3.4.1
4404fd
+tsa_policy2 = 1.2.3.4.5.6
4404fd
+tsa_policy3 = 1.2.3.4.5.7
4404fd
+
4404fd
+[ ca ]
4404fd
+default_ca      = CA_default            # The default ca section
4404fd
+
4404fd
+[ CA_default ]
4404fd
+
4404fd
+dir             = ./cruft		# Where everything is kept
4404fd
+certs           = $dir/certs            # Where the issued certs are kept
4404fd
+crl_dir         = $dir/crl              # Where the issued crl are kept
4404fd
+database        = $dir/index.txt        # database index file.
4404fd
+new_certs_dir   = $dir/certs         # default place for new certs.
4404fd
+certificate     = $dir/cacert.pem       # The CA certificate
4404fd
+serial          = $dir/serial           # The current serial number
4404fd
+crlnumber       = $dir/crlnumber        # the current crl number
4404fd
+crl             = $dir/crl.pem          # The current CRL
4404fd
+private_key     = $dir/private/cakey.pem# The private key
4404fd
+RANDFILE        = $dir/private/.rand    # private random number file
4404fd
+x509_extensions = usr_cert              # The extentions to add to the cert
4404fd
+name_opt        = ca_default            # Subject Name options
4404fd
+cert_opt        = ca_default            # Certificate field options
4404fd
+default_days    = 365                   # how long to certify for
4404fd
+default_crl_days= 30                    # how long before next CRL
4404fd
+default_md      = default               # use public key default MD
4404fd
+preserve        = no                    # keep passed DN ordering
4404fd
+policy          = policy_match
4404fd
+
4404fd
+[ policy_match ]
4404fd
+countryName             = match
4404fd
+stateOrProvinceName     = match
4404fd
+organizationName        = match
4404fd
+organizationalUnitName  = optional
4404fd
+commonName              = supplied
4404fd
+emailAddress            = optional
4404fd
+
4404fd
+[ policy_anything ]
4404fd
+countryName             = optional
4404fd
+stateOrProvinceName     = optional
4404fd
+localityName            = optional
4404fd
+organizationName        = optional
4404fd
+organizationalUnitName  = optional
4404fd
+commonName              = supplied
4404fd
+emailAddress            = optional
4404fd
+
4404fd
+[ req ]
4404fd
+default_bits            = 2048
4404fd
+default_keyfile         = privkey.pem
4404fd
+distinguished_name      = req_distinguished_name
4404fd
+attributes              = req_attributes
4404fd
+x509_extensions = v3_ca # The extentions to add to the self signed cert
4404fd
+
4404fd
+string_mask = utf8only
4404fd
+
4404fd
+[ req_distinguished_name ]
4404fd
+basicConstraints=CA:FALSE
4404fd
+
4404fd
+[ req_attributes ]
4404fd
+challengePassword               = A challenge password
4404fd
+challengePassword_min           = 4
4404fd
+challengePassword_max           = 20
4404fd
+
4404fd
+unstructuredName                = An optional company name
4404fd
+
4404fd
+[ usr_cert ]
4404fd
+
4404fd
+basicConstraints=CA:FALSE
4404fd
+nsComment                       = "OpenSSL Generated Certificate"
4404fd
+
4404fd
+subjectKeyIdentifier=hash
4404fd
+authorityKeyIdentifier=keyid,issuer
4404fd
+
4404fd
+[ v3_req ]
4404fd
+
4404fd
+basicConstraints = CA:FALSE
4404fd
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
4404fd
+subjectAltName = DNS:localhost,IP:127.0.0.1,IP:::1
4404fd
+
4404fd
+[ v3_ca ]
4404fd
+subjectKeyIdentifier=hash
4404fd
+authorityKeyIdentifier=keyid:always,issuer
4404fd
+basicConstraints = CA:true
4404fd
+
4404fd
+[ crl_ext ]
4404fd
+
4404fd
+authorityKeyIdentifier=keyid:always
4404fd
+
4404fd
+[ proxy_cert_ext ]
4404fd
+basicConstraints=CA:FALSE
4404fd
+nsComment                       = "OpenSSL Generated Certificate"
4404fd
+
4404fd
+subjectKeyIdentifier=hash
4404fd
+authorityKeyIdentifier=keyid,issuer
4404fd
+proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
4404fd
+
4404fd
+[ tsa ]
4404fd
+
4404fd
+default_tsa = tsa_config1       # the default TSA section
4404fd
+
4404fd
+[ tsa_config1 ]
4404fd
+
4404fd
+dir             = ./demoCA              # TSA root directory
4404fd
+serial          = $dir/tsaserial        # The current serial number (mandatory)
4404fd
+crypto_device   = builtin               # OpenSSL engine to use for signing
4404fd
+signer_cert     = $dir/tsacert.pem      # The TSA signing certificate
4404fd
+                                        # (optional)
4404fd
+certs           = $dir/cacert.pem       # Certificate chain to include in reply
4404fd
+                                        # (optional)
4404fd
+signer_key      = $dir/private/tsakey.pem # The TSA private key (optional)
4404fd
+
4404fd
+default_policy  = tsa_policy1           # Policy if request did not specify it
4404fd
+                                        # (optional)
4404fd
+other_policies  = tsa_policy2, tsa_policy3      # acceptable policies (optional)
4404fd
+digests         = md5, sha1             # Acceptable message digests (mandatory)
4404fd
+accuracy        = secs:1, millisecs:500, microsecs:100  # (optional)
4404fd
+clock_precision_digits  = 0     # number of digits after dot. (optional)
4404fd
+ordering                = yes   # Is ordering defined for timestamps?
4404fd
+                                # (optional, default: no)
4404fd
+tsa_name                = yes   # Must the TSA name be included in the reply?
4404fd
+                                # (optional, default: no)
4404fd
+ess_cert_id_chain       = no    # Must the ESS cert id chain be included?
4404fd
+                                # (optional, default: no)
4404fd
diff --git a/tests/data/tls/create-crt.sh b/tests/data/tls/create-crt.sh
4404fd
new file mode 100755
4404fd
index 000000000..8c33a24fe
4404fd
--- /dev/null
4404fd
+++ b/tests/data/tls/create-crt.sh
4404fd
@@ -0,0 +1,78 @@
4404fd
+#!/bin/sh
4404fd
+openssl=$(which openssl)
4404fd
+
4404fd
+if [ x"$openssl" = "x" ]; then
4404fd
+echo "OpenSSL command line binary not found, skipping..."
4404fd
+fi
4404fd
+
4404fd
+USAGE="$0 [-s] [-u <user@domain.com>]"
4404fd
+SERVER=0
4404fd
+USER=0
4404fd
+EMAIL=
4404fd
+
4404fd
+while test $# -gt 0 ; do
4404fd
+	case "$1" in
4404fd
+		-s | -server)
4404fd
+			SERVER=1;
4404fd
+			shift;;
4404fd
+		-u | -user)
4404fd
+			if [ x"$2" = "x" ]; then
4404fd
+				echo "User cert requires an email address as an argument"
4404fd
+				exit;
4404fd
+			fi
4404fd
+			USER=1;
4404fd
+			EMAIL="$2";
4404fd
+			shift; shift;;
4404fd
+		-)
4404fd
+			shift;;
4404fd
+		-*)
4404fd
+			echo "$USAGE"; exit 1
4404fd
+			;;
4404fd
+		*)
4404fd
+			break;;
4404fd
+	esac
4404fd
+done
4404fd
+
4404fd
+if [ $SERVER = 0 -a $USER = 0 ]; then
4404fd
+	echo "$USAGE";
4404fd
+	exit 1;
4404fd
+fi
4404fd
+
4404fd
+rm -rf ./openssl.cnf cruft
4404fd
+mkdir -p private certs cruft/private cruft/certs
4404fd
+
4404fd
+echo "00" > cruft/serial
4404fd
+touch cruft/index.txt
4404fd
+touch cruft/index.txt.attr
4404fd
+hn=$(hostname -f)
4404fd
+sed -e "s;@HOSTNAME@;$hn;" conf/openssl.cnf >  ./openssl.cnf
4404fd
+
4404fd
+if [ $SERVER = 1 ]; then
4404fd
+	rm -rf private/localhost.key certs/localhost.crt
4404fd
+
4404fd
+	$openssl req -new -nodes -out localhost.csr -keyout private/localhost.key \
4404fd
+		-newkey rsa:1024 -config ./openssl.cnf \
4404fd
+		-subj "/CN=localhost/OU=OpenLDAP Test Suite/O=OpenLDAP Foundation/ST=CA/C=US" \
4404fd
+		-batch > /dev/null 2>&1
4404fd
+
4404fd
+	$openssl ca -out certs/localhost.crt -notext -config ./openssl.cnf -days 183000 -in localhost.csr \
4404fd
+		-keyfile ca/private/testsuiteCA.key -extensions v3_req -cert ca/certs/testsuiteCA.crt \
4404fd
+		-batch >/dev/null 2>&1
4404fd
+
4404fd
+	rm -rf ./openssl.cnf ./localhost.csr cruft
4404fd
+fi
4404fd
+
4404fd
+if [ $USER = 1 ]; then
4404fd
+	rm -f certs/$EMAIL.crt private/$EMAIL.key $EMAIL.csr
4404fd
+
4404fd
+	$openssl req -new -nodes -out $EMAIL.csr -keyout private/$EMAIL.key \
4404fd
+		-newkey rsa:1024 -config ./openssl.cnf \
4404fd
+		-subj "/emailAddress=$EMAIL/CN=$EMAIL/OU=OpenLDAP/O=OpenLDAP Foundation/ST=CA/C=US" \
4404fd
+		-batch >/dev/null 2>&1
4404fd
+
4404fd
+	$openssl ca -out certs/$EMAIL.crt -notext -config ./openssl.cnf -days 183000 -in $EMAIL.csr \
4404fd
+		-keyfile ca/private/testsuiteCA.key -extensions req_distinguished_name \
4404fd
+		-cert ca/certs/testsuiteCA.crt -batch >/dev/null 2>&1
4404fd
+
4404fd
+	rm -rf ./openssl.cnf ./$EMAIL.csr cruft
4404fd
+fi
4404fd
diff --git a/tests/data/tls/private/bjensen@mailgw.example.com.key b/tests/data/tls/private/bjensen@mailgw.example.com.key
4404fd
new file mode 100644
4404fd
index 000000000..5f4625fd7
4404fd
--- /dev/null
4404fd
+++ b/tests/data/tls/private/bjensen@mailgw.example.com.key
4404fd
@@ -0,0 +1,16 @@
4404fd
+-----BEGIN PRIVATE KEY-----
4404fd
+MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAMjb2C5VL+f/B/f2
4404fd
+xJyhsdXeaGhWdABWqJlCiupk7QVPotpZphqJ2fKgQbX2w0sPazujt8hG96F2mBv4
4404fd
+9pHqzhSrKN70EA/E7b8d6ynjJpBU2P9ZgVlttnmUU++22BSuhthP5VQK7IqNyI7Z
4404fd
+yQ4hFzuqb/XrHD1VCDo/Z/JAkw7jAgMBAAECgYEApDgKQadoaZd7nmJlUWJqEV+r
4404fd
+oVK9uOEhK1zaUtV9bBA2J6uQQLZgORyJXQqJlT7f/3zVb6uGHr7lkkk03wxIu+3e
4404fd
+nIi7or/Cw6KmxhgslsQamf/ujjeqRlij/4pJIpEYByme9SstfzMBFNWU4t+fguPg
4404fd
+xXz6lvVZuNiYRWWuXxECQQDwakp31mNczqLPg8fuhdgixz7HCK5g6p4XDw+Cu9Ra
4404fd
+EenuOJVlnwXdW+g5jooiV5RWhxbTO6ImtgbcBGoeLSbVAkEA1eEcifIzgSi8XODd
4404fd
+9i6dCSMHKk4FgDRk2DJxRePLK2J1kt2bhOz/N1130fTargDWo8QiQAnd7RBOMJO/
4404fd
+pGaq1wJAZ2afzrjzlWf+WFgqdmk0k4i0dHBEZ8Sg5/P/TNAyPeb0gRPvFXz2zcUI
4404fd
+tTCcMrcOQsTpSUKdtB6YBqsTZRUwXQI/FbjHLTtr/7Ijb0tnP5l8WXE1SRajeGHZ
4404fd
+3BtDZdW8zKszRbc8FEP9p6HWiXxUuVdcdUV2NQrLf0goqMZYsFm9AkBtV3URLS4D
4404fd
+tw0VPr/TtzDx0UTJU5POdRcNrrpm233A0EyGNmLuM7y0iLxrvCIN9z0RVu7AeMBg
4404fd
+36Ixj3L+5H18
4404fd
+-----END PRIVATE KEY-----
4404fd
diff --git a/tests/data/tls/private/localhost.key b/tests/data/tls/private/localhost.key
4404fd
new file mode 100644
4404fd
index 000000000..8a24f69f8
4404fd
--- /dev/null
4404fd
+++ b/tests/data/tls/private/localhost.key
4404fd
@@ -0,0 +1,16 @@
4404fd
+-----BEGIN PRIVATE KEY-----
4404fd
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAO62ncZplcZKbuOg
4404fd
+ObVNgj52EEC4vX476gmWZkvXQZf+gepzxY2hu+5kYfjsfyZB/vNbAlBbEvzTmgEM
4404fd
+w+LadyCFrnJ1pWx/isFkBOnB6OLTi937rvaq1H90aC/xF7kbdkVhbFS/ydv8MmiM
4404fd
+brTVXZh78ret/5fBr27hD0QmoiK/AgMBAAECgYEA0gs5tNY/BaWFASGA5bj3u4Ij
4404fd
+Nu/XPPX3Lsx54o3bl6RIKEYKNF91f4QweNmP39f+P596373jbTe7sOTMkBXu7qnf
4404fd
+2B51VBJ72Uq92gO2VXImK+uuC6JdZfYTlX1QJkaR6mxhBl3KAgUeGUgbL0Xp9XeJ
4404fd
+bVcPqDOpRyIlW/80EHECQQD6PWRkk+0H4EMRA3GAnMQv/+Cy+sqF0T0OBNsQ846q
4404fd
+1hQhJfVvjgj2flmJZpH9zBTaqDn4grJDfQ9cViZwf4k7AkEA9DVNHPNVpkeToWrf
4404fd
+3yH55Ya5WEAl/6oNsHlaSZ88SHCZGqY7hQrpjSycsEezmsnDeqfdVuO97G2nHC7U
4404fd
+VdPUTQJAAq8r54RKs53tOj5+NjH4TMeC4oicKYlQDVlx/CGQszZuqthcZKDyaap7
4404fd
+TWUDReStiJbrYEYOoXiy9HucF/LWRwJAQKeH9f06lN5oaJkKEmJFbg5ALew14z1b
4404fd
+iHhofgtpg2hEMLkIEw4zjUvdZBJnq7h1R5j/0cxT8S+KybxgPSTrFQJBAPTrj7bP
4404fd
+5M7tPyQtyFxhFhas6g4ZHz/D2yB7BL+hL3IiJf3fdWNcHTzBDFEgDOVjR/7CZ6L3
4404fd
+b61hkjQZfbEg5cg=
4404fd
+-----END PRIVATE KEY-----
4404fd
diff --git a/tests/run.in b/tests/run.in
4404fd
index 6c33d4d20..793e388c1 100644
4404fd
--- a/tests/run.in
4404fd
+++ b/tests/run.in
4404fd
@@ -57,6 +57,7 @@ AC_valsort=valsort@BUILD_VALSORT@
4404fd
 # misc
4404fd
 AC_WITH_SASL=@WITH_SASL@
4404fd
 AC_WITH_TLS=@WITH_TLS@
4404fd
+AC_TLS_TYPE=@WITH_TLS_TYPE@
4404fd
 AC_WITH_MODULES_ENABLED=@WITH_MODULES_ENABLED@
4404fd
 AC_ACI_ENABLED=aci@WITH_ACI_ENABLED@
4404fd
 AC_THREADS=threads@BUILD_THREAD@
4404fd
@@ -75,7 +76,7 @@ export AC_bdb AC_hdb AC_ldap AC_mdb AC_meta AC_monitor AC_null AC_relay AC_sql \
4404fd
 	AC_refint AC_retcode AC_rwm AC_unique AC_syncprov AC_translucent \
4404fd
 	AC_valsort \
4404fd
 	AC_WITH_SASL AC_WITH_TLS AC_WITH_MODULES_ENABLED AC_ACI_ENABLED \
4404fd
-	AC_THREADS AC_LIBS_DYNAMIC
4404fd
+	AC_THREADS AC_LIBS_DYNAMIC AC_WITH_TLS AC_TLS_TYPE
4404fd
 
4404fd
 if test ! -x ../servers/slapd/slapd ; then
4404fd
 	echo "Could not locate slapd(8)"
4404fd
diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh
4404fd
index a7dacebdd..2c9e8f76a 100755
4404fd
--- a/tests/scripts/defines.sh
4404fd
+++ b/tests/scripts/defines.sh
4404fd
@@ -46,6 +46,9 @@ VALSORT=${AC_valsort-valsortno}
4404fd
 # misc
4404fd
 WITH_SASL=${AC_WITH_SASL-no}
4404fd
 USE_SASL=${SLAPD_USE_SASL-no}
4404fd
+WITH_TLS=${AC_WITH_TLS-no}
4404fd
+WITH_TLS_TYPE=${AC_TLS_TYPE-no}
4404fd
+
4404fd
 ACI=${AC_ACI_ENABLED-acino}
4404fd
 THREADS=${AC_THREADS-threadsno}
4404fd
 SLEEP0=${SLEEP0-1}
4404fd
@@ -104,6 +107,8 @@ P2SRSLAVECONF=$DATADIR/slapd-syncrepl-slave-persist2.conf
4404fd
 P3SRSLAVECONF=$DATADIR/slapd-syncrepl-slave-persist3.conf
4404fd
 REFSLAVECONF=$DATADIR/slapd-ref-slave.conf
4404fd
 SCHEMACONF=$DATADIR/slapd-schema.conf
4404fd
+TLSCONF=$DATADIR/slapd-tls.conf
4404fd
+TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf
4404fd
 GLUECONF=$DATADIR/slapd-glue.conf
4404fd
 REFINTCONF=$DATADIR/slapd-refint.conf
4404fd
 RETCODECONF=$DATADIR/slapd-retcode.conf
4404fd
@@ -164,6 +169,7 @@ SLURPLOG=$TESTDIR/slurp.log
4404fd
 CONFIGPWF=$TESTDIR/configpw
4404fd
 
4404fd
 # args
4404fd
+SASLARGS="-Q"
4404fd
 TOOLARGS="-x $LDAP_TOOLARGS"
4404fd
 TOOLPROTO="-P 3"
4404fd
 
4404fd
@@ -186,7 +192,8 @@ BCMP="diff -iB"
4404fd
 CMPOUT=/dev/null
4404fd
 SLAPD="$TESTWD/../servers/slapd/slapd -s0"
4404fd
 LDAPPASSWD="$CLIENTDIR/ldappasswd $TOOLARGS"
4404fd
-LDAPSASLSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $LDAP_TOOLARGS -LLL"
4404fd
+LDAPSASLSEARCH="$CLIENTDIR/ldapsearch $SASLARGS $TOOLPROTO $LDAP_TOOLARGS -LLL"
4404fd
+LDAPSASLWHOAMI="$CLIENTDIR/ldapwhoami $SASLARGS $LDAP_TOOLARGS"
4404fd
 LDAPSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $TOOLARGS -LLL"
4404fd
 LDAPRSEARCH="$CLIENTDIR/ldapsearch $TOOLPROTO $TOOLARGS"
4404fd
 LDAPDELETE="$CLIENTDIR/ldapdelete $TOOLPROTO $TOOLARGS"
4404fd
@@ -201,6 +208,7 @@ LDIFFILTER=$PROGDIR/ldif-filter
4404fd
 SLAPDMTREAD=$PROGDIR/slapd-mtread
4404fd
 LVL=${SLAPD_DEBUG-0x4105}
4404fd
 LOCALHOST=localhost
4404fd
+LOCALIP=127.0.0.1
4404fd
 BASEPORT=${SLAPD_BASEPORT-9010}
4404fd
 PORT1=`expr $BASEPORT + 1`
4404fd
 PORT2=`expr $BASEPORT + 2`
4404fd
@@ -209,11 +217,22 @@ PORT4=`expr $BASEPORT + 4`
4404fd
 PORT5=`expr $BASEPORT + 5`
4404fd
 PORT6=`expr $BASEPORT + 6`
4404fd
 URI1="ldap://${LOCALHOST}:$PORT1/"
4404fd
+URIP1="ldap://${LOCALIP}:$PORT1/"
4404fd
 URI2="ldap://${LOCALHOST}:$PORT2/"
4404fd
+URIP2="ldap://${LOCALIP}:$PORT2/"
4404fd
 URI3="ldap://${LOCALHOST}:$PORT3/"
4404fd
+URIP3="ldap://${LOCALIP}:$PORT3/"
4404fd
 URI4="ldap://${LOCALHOST}:$PORT4/"
4404fd
 URI5="ldap://${LOCALHOST}:$PORT5/"
4404fd
 URI6="ldap://${LOCALHOST}:$PORT6/"
4404fd
+SURI1="ldaps://${LOCALHOST}:$PORT1/"
4404fd
+SURIP1="ldaps://${LOCALIP}:$PORT1/"
4404fd
+SURI2="ldaps://${LOCALHOST}:$PORT2/"
4404fd
+SURIP2="ldaps://${LOCALIP}:$PORT2/"
4404fd
+SURI3="ldaps://${LOCALHOST}:$PORT3/"
4404fd
+SURI4="ldaps://${LOCALHOST}:$PORT4/"
4404fd
+SURI5="ldaps://${LOCALHOST}:$PORT5/"
4404fd
+SURI6="ldaps://${LOCALHOST}:$PORT6/"
4404fd
 
4404fd
 # LDIF
4404fd
 LDIF=$DATADIR/test.ldif
4404fd
diff --git a/tests/scripts/test067-tls b/tests/scripts/test067-tls
4404fd
new file mode 100755
4404fd
index 000000000..2b245f5f5
4404fd
--- /dev/null
4404fd
+++ b/tests/scripts/test067-tls
4404fd
@@ -0,0 +1,140 @@
4404fd
+#! /bin/sh
4404fd
+# $OpenLDAP$
4404fd
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
4404fd
+##
4404fd
+## Copyright 1998-2017 The OpenLDAP Foundation.
4404fd
+## All rights reserved.
4404fd
+##
4404fd
+## Redistribution and use in source and binary forms, with or without
4404fd
+## modification, are permitted only as authorized by the OpenLDAP
4404fd
+## Public License.
4404fd
+##
4404fd
+## A copy of this license is available in the file LICENSE in the
4404fd
+## top-level directory of the distribution or, alternatively, at
4404fd
+## <http://www.OpenLDAP.org/license.html>.
4404fd
+
4404fd
+echo "running defines.sh"
4404fd
+. $SRCDIR/scripts/defines.sh
4404fd
+
4404fd
+if test $WITH_TLS = no ; then
4404fd
+        echo "TLS support not available, test skipped"
4404fd
+        exit 0
4404fd
+fi
4404fd
+
4404fd
+mkdir -p $TESTDIR $DBDIR1
4404fd
+cp -r $DATADIR/tls $TESTDIR
4404fd
+
4404fd
+cd $TESTWD
4404fd
+
4404fd
+echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..."
4404fd
+. $CONFFILTER $BACKEND $MONITORDB < $TLSCONF > $CONF1
4404fd
+$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 &
4404fd
+PID=$!
4404fd
+if test $WAIT != 0 ; then
4404fd
+    echo PID $PID
4404fd
+    read foo
4404fd
+fi
4404fd
+KILLPIDS="$PID"
4404fd
+
4404fd
+sleep 1
4404fd
+
4404fd
+for i in 0 1 2 3 4 5; do
4404fd
+	$LDAPSEARCH -s base -b "" -H $URI1 \
4404fd
+		'objectclass=*' > /dev/null 2>&1
4404fd
+        RC=$?
4404fd
+        if test $RC = 0 ; then
4404fd
+                break
4404fd
+        fi
4404fd
+        echo "Waiting 5 seconds for slapd to start..."
4404fd
+        sleep 5
4404fd
+done
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch failed ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+echo -n "Using ldapsearch with startTLS with no server cert validation...."
4404fd
+$LDAPSEARCH -o tls_reqcert=never -ZZ -b "" -s base -H $URIP1 \
4404fd
+	'@extensibleObject' > $SEARCHOUT 2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch (startTLS) failed ($RC)!"
4404fd
+	exit $RC
4404fd
+else
4404fd
+	echo "success"
4404fd
+fi
4404fd
+
4404fd
+echo -n "Using ldapsearch with startTLS with hard require cert...."
4404fd
+$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -ZZ -b "" -s base -H $URIP1 \
4404fd
+	'@extensibleObject' > $SEARCHOUT 2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch (startTLS) failed ($RC)!"
4404fd
+	exit $RC
4404fd
+else
4404fd
+	echo "success"
4404fd
+fi
4404fd
+
4404fd
+if test $WITH_TLS_TYPE = openssl ; then
4404fd
+	echo -n "Using ldapsearch with startTLS and specific protocol version...."
4404fd
+	$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -o tls_protocol_min=3.3 -ZZ -b "" -s base -H $URIP1 \
4404fd
+		'@extensibleObject' > $SEARCHOUT 2>&1
4404fd
+	RC=$?
4404fd
+	if test $RC != 0 ; then
4404fd
+		echo "ldapsearch (protocol-min) failed ($RC)!"
4404fd
+		exit $RC
4404fd
+	else
4404fd
+		echo "success"
4404fd
+	fi
4404fd
+fi
4404fd
+
4404fd
+echo -n "Using ldapsearch on $SURI2 with no server cert validation..."
4404fd
+$LDAPSEARCH -o tls_reqcert=never -b "cn=Subschema" -s base -H $SURIP2 \
4404fd
+	'(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \
4404fd
+	>> $SEARCHOUT  2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch (ldaps) failed($RC)!"
4404fd
+	exit $RC
4404fd
+else
4404fd
+	echo "success"
4404fd
+fi
4404fd
+
4404fd
+echo -n "Using ldapsearch on $SURI2 with reqcert HARD and no CA cert.  Should fail..."
4404fd
+$LDAPSEARCH -o tls_reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \
4404fd
+	'(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \
4404fd
+	>> $SEARCHOUT  2>&1
4404fd
+RC=$?
4404fd
+if test $RC = 0 ; then
4404fd
+	echo "ldapsearch (ldaps) succeeded when it should have failed($RC)!"
4404fd
+	exit 1
4404fd
+else
4404fd
+	echo "failed correctly with error code ($RC)"
4404fd
+fi
4404fd
+
4404fd
+echo -n "Using ldapsearch on $SURI2 with CA cert and reqcert HARD..."
4404fd
+$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard -b "cn=Subschema" -s base -H $SURIP2 \
4404fd
+	'(&(objectClasses=top)(objectClasses=2.5.6.0))' cn objectClass \
4404fd
+	>> $SEARCHOUT  2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch (ldaps) failed ($RC)!"
4404fd
+	exit $RC
4404fd
+else
4404fd
+	echo "success"
4404fd
+fi
4404fd
+
4404fd
+test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo ">>>>> Test failed"
4404fd
+else
4404fd
+	echo ">>>>> Test succeeded"
4404fd
+	RC=0
4404fd
+fi
4404fd
+
4404fd
+test $KILLSERVERS != no && wait
4404fd
+
4404fd
+exit $RC
4404fd
diff --git a/tests/scripts/test068-sasl-tls-external b/tests/scripts/test068-sasl-tls-external
4404fd
new file mode 100755
4404fd
index 000000000..dcbc50fd4
4404fd
--- /dev/null
4404fd
+++ b/tests/scripts/test068-sasl-tls-external
4404fd
@@ -0,0 +1,102 @@
4404fd
+#! /bin/sh
4404fd
+# $OpenLDAP$
4404fd
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
4404fd
+##
4404fd
+## Copyright 1998-2017 The OpenLDAP Foundation.
4404fd
+## All rights reserved.
4404fd
+##
4404fd
+## Redistribution and use in source and binary forms, with or without
4404fd
+## modification, are permitted only as authorized by the OpenLDAP
4404fd
+## Public License.
4404fd
+##
4404fd
+## A copy of this license is available in the file LICENSE in the
4404fd
+## top-level directory of the distribution or, alternatively, at
4404fd
+## <http://www.OpenLDAP.org/license.html>.
4404fd
+
4404fd
+echo "running defines.sh"
4404fd
+. $SRCDIR/scripts/defines.sh
4404fd
+
4404fd
+if test $WITH_TLS = no ; then
4404fd
+        echo "TLS support not available, test skipped"
4404fd
+        exit 0
4404fd
+fi
4404fd
+
4404fd
+mkdir -p $TESTDIR $DBDIR1
4404fd
+cp -r $DATADIR/tls $TESTDIR
4404fd
+
4404fd
+cd $TESTWD
4404fd
+
4404fd
+echo "Running slapadd to build slapd database..."
4404fd
+. $CONFFILTER $BACKEND $MONITORDB < $TLSSASLCONF > $CONF1
4404fd
+$SLAPADD -f $CONF1 -l $LDIFORDERED
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+        echo "slapadd failed ($RC)!"
4404fd
+        exit $RC
4404fd
+fi
4404fd
+
4404fd
+echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..."
4404fd
+$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 &
4404fd
+PID=$!
4404fd
+if test $WAIT != 0 ; then
4404fd
+    echo PID $PID
4404fd
+    read foo
4404fd
+fi
4404fd
+KILLPIDS="$PID"
4404fd
+
4404fd
+sleep 1
4404fd
+
4404fd
+for i in 0 1 2 3 4 5; do
4404fd
+	$LDAPSEARCH -s base -b "" -H $URI1 \
4404fd
+		'objectclass=*' > /dev/null 2>&1
4404fd
+        RC=$?
4404fd
+        if test $RC = 0 ; then
4404fd
+                break
4404fd
+        fi
4404fd
+        echo "Waiting 5 seconds for slapd to start..."
4404fd
+        sleep 5
4404fd
+done
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch failed ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+echo -n "Using ldapwhoami with SASL/EXTERNAL...."
4404fd
+$LDAPSASLWHOAMI -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -o tls_reqcert=hard \
4404fd
+	-o tls_cert=$TESTDIR/tls/certs/bjensen@mailgw.example.com.crt -o tls_key=$TESTDIR/tls/private/bjensen@mailgw.example.com.key -ZZ -Y EXTERNAL -H $URIP1 \
4404fd
+	> $TESTOUT 2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapwhoami (startTLS) failed ($RC)!"
4404fd
+	exit $RC
4404fd
+else
4404fd
+	echo "success"
4404fd
+fi
4404fd
+
4404fd
+echo -n "Validating mapped SASL ID..."
4404fd
+echo 'dn:cn=barbara jensen,ou=information technology division,ou=people,dc=example,dc=com' > $TESTDIR/dn.out
4404fd
+$CMP $TESTDIR/dn.out $TESTOUT > $CMPOUT
4404fd
+
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "Comparison failed"
4404fd
+	test $KILLSERVERS != no && kill -HUP $PID
4404fd
+	exit $RC
4404fd
+else
4404fd
+	echo "success"
4404fd
+fi
4404fd
+
4404fd
+test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo ">>>>> Test failed"
4404fd
+else
4404fd
+	echo ">>>>> Test succeeded"
4404fd
+	RC=0
4404fd
+fi
4404fd
+
4404fd
+test $KILLSERVERS != no && wait
4404fd
+
4404fd
+exit $RC
4404fd
diff --git a/tests/scripts/test069-delta-multimaster-starttls b/tests/scripts/test069-delta-multimaster-starttls
4404fd
new file mode 100755
4404fd
index 000000000..2dfbb30a1
4404fd
--- /dev/null
4404fd
+++ b/tests/scripts/test069-delta-multimaster-starttls
4404fd
@@ -0,0 +1,574 @@
4404fd
+#! /bin/sh
4404fd
+# $OpenLDAP$
4404fd
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
4404fd
+##
4404fd
+## Copyright 1998-2017 The OpenLDAP Foundation.
4404fd
+## All rights reserved.
4404fd
+##
4404fd
+## Redistribution and use in source and binary forms, with or without
4404fd
+## modification, are permitted only as authorized by the OpenLDAP
4404fd
+## Public License.
4404fd
+##
4404fd
+## A copy of this license is available in the file LICENSE in the
4404fd
+## top-level directory of the distribution or, alternatively, at
4404fd
+## <http://www.OpenLDAP.org/license.html>.
4404fd
+
4404fd
+echo "running defines.sh"
4404fd
+. $SRCDIR/scripts/defines.sh
4404fd
+
4404fd
+if test $WITH_TLS = no ; then
4404fd
+        echo "TLS support not available, test skipped"
4404fd
+        exit 0
4404fd
+fi
4404fd
+
4404fd
+if test $SYNCPROV = syncprovno; then
4404fd
+	echo "Syncrepl provider overlay not available, test skipped"
4404fd
+	exit 0
4404fd
+fi
4404fd
+if test $ACCESSLOG = accesslogno; then
4404fd
+	echo "Accesslog overlay not available, test skipped"
4404fd
+	exit 0
4404fd
+fi
4404fd
+
4404fd
+MMR=2
4404fd
+
4404fd
+XDIR=$TESTDIR/srv
4404fd
+TMP=$TESTDIR/tmp
4404fd
+
4404fd
+mkdir -p $TESTDIR
4404fd
+cp -r $DATADIR/tls $TESTDIR
4404fd
+
4404fd
+$SLAPPASSWD -g -n >$CONFIGPWF
4404fd
+
4404fd
+if test x"$SYNCMODE" = x ; then
4404fd
+	SYNCMODE=rp
4404fd
+fi
4404fd
+case "$SYNCMODE" in
4404fd
+	ro)
4404fd
+		SYNCTYPE="type=refreshOnly interval=00:00:00:03"
4404fd
+		;;
4404fd
+	rp)
4404fd
+		SYNCTYPE="type=refreshAndPersist interval=00:00:00:03"
4404fd
+		;;
4404fd
+	*)
4404fd
+		echo "unknown sync mode $SYNCMODE"
4404fd
+		exit 1;
4404fd
+		;;
4404fd
+esac
4404fd
+
4404fd
+#
4404fd
+# Test delta-sync mmr
4404fd
+# - start servers
4404fd
+# - configure over ldap
4404fd
+# - populate over ldap
4404fd
+# - configure syncrepl over ldap
4404fd
+# - break replication
4404fd
+# - modify each server separately
4404fd
+# - restore replication
4404fd
+# - compare results
4404fd
+#
4404fd
+
4404fd
+nullExclude=""
4404fd
+test $BACKEND = null && nullExclude="# "
4404fd
+
4404fd
+KILLPIDS=
4404fd
+
4404fd
+echo "Initializing server configurations..."
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+
4404fd
+DBDIR=${XDIR}$n/db
4404fd
+CFDIR=${XDIR}$n/slapd.d
4404fd
+
4404fd
+mkdir -p ${XDIR}$n $DBDIR.1 $DBDIR.2 $CFDIR
4404fd
+
4404fd
+o=`expr 3 - $n`
4404fd
+cat > $TMP <
4404fd
+dn: cn=config
4404fd
+objectClass: olcGlobal
4404fd
+cn: config
4404fd
+olcServerID: $n
4404fd
+olcTLSCertificateFile: $TESTDIR/tls/certs/localhost.crt
4404fd
+olcTLSCertificateKeyFile: $TESTDIR/tls/private/localhost.key
4404fd
+
4404fd
+EOF
4404fd
+
4404fd
+if [ "$SYNCPROV" = syncprovmod -o "$ACCESSLOG" = accesslogmod ]; then
4404fd
+  cat <<EOF >> $TMP
4404fd
+dn: cn=module,cn=config
4404fd
+objectClass: olcModuleList
4404fd
+cn: module
4404fd
+olcModulePath: $TESTWD/../servers/slapd/overlays
4404fd
+EOF
4404fd
+  if [ "$SYNCPROV" = syncprovmod ]; then
4404fd
+  echo "olcModuleLoad: syncprov.la" >> $TMP
4404fd
+  fi
4404fd
+  if [ "$ACCESSLOG" = accesslogmod ]; then
4404fd
+  echo "olcModuleLoad: accesslog.la" >> $TMP
4404fd
+  fi
4404fd
+  echo "" >> $TMP
4404fd
+fi
4404fd
+
4404fd
+if [ "$BACKENDTYPE" = mod ]; then
4404fd
+cat <<EOF >> $TMP
4404fd
+dn: cn=module,cn=config
4404fd
+objectClass: olcModuleList
4404fd
+cn: module
4404fd
+olcModulePath: $TESTWD/../servers/slapd/back-$BACKEND
4404fd
+olcModuleLoad: back_$BACKEND.la
4404fd
+
4404fd
+EOF
4404fd
+fi
4404fd
+MYURI=`eval echo '$URI'$n`
4404fd
+PROVIDERURI=`eval echo '$URIP'$o`
4404fd
+if test $INDEXDB = indexdb ; then
4404fd
+INDEX1="olcDbIndex: objectClass,entryCSN,reqStart,reqDN,reqResult eq"
4404fd
+INDEX2="olcDbIndex: objectClass,entryCSN,entryUUID eq"
4404fd
+else
4404fd
+INDEX1=
4404fd
+INDEX2=
4404fd
+fi
4404fd
+cat >> $TMP <
4404fd
+dn: cn=schema,cn=config
4404fd
+objectclass: olcSchemaconfig
4404fd
+cn: schema
4404fd
+
4404fd
+include: file://$ABS_SCHEMADIR/core.ldif
4404fd
+
4404fd
+include: file://$ABS_SCHEMADIR/cosine.ldif
4404fd
+
4404fd
+include: file://$ABS_SCHEMADIR/inetorgperson.ldif
4404fd
+
4404fd
+include: file://$ABS_SCHEMADIR/openldap.ldif
4404fd
+
4404fd
+include: file://$ABS_SCHEMADIR/nis.ldif
4404fd
+
4404fd
+dn: olcDatabase={0}config,cn=config
4404fd
+objectClass: olcDatabaseConfig
4404fd
+olcDatabase: {0}config
4404fd
+olcRootPW:< file://$CONFIGPWF
4404fd
+
4404fd
+dn: olcDatabase={1}$BACKEND,cn=config
4404fd
+objectClass: olcDatabaseConfig
4404fd
+${nullExclude}objectClass: olc${BACKEND}Config
4404fd
+olcDatabase: {1}$BACKEND
4404fd
+olcSuffix: cn=log
4404fd
+${nullExclude}olcDbDirectory: ${DBDIR}.1
4404fd
+olcRootDN: $MANAGERDN
4404fd
+$INDEX1
4404fd
+
4404fd
+dn: olcOverlay=syncprov,olcDatabase={1}$BACKEND,cn=config
4404fd
+objectClass: olcOverlayConfig
4404fd
+objectClass: olcSyncProvConfig
4404fd
+olcOverlay: syncprov
4404fd
+olcSpNoPresent: TRUE
4404fd
+olcSpReloadHint: TRUE
4404fd
+
4404fd
+dn: olcDatabase={2}$BACKEND,cn=config
4404fd
+objectClass: olcDatabaseConfig
4404fd
+${nullExclude}objectClass: olc${BACKEND}Config
4404fd
+olcDatabase: {2}$BACKEND
4404fd
+olcSuffix: $BASEDN
4404fd
+${nullExclude}olcDbDirectory: ${DBDIR}.2
4404fd
+olcRootDN: $MANAGERDN
4404fd
+olcRootPW: $PASSWD
4404fd
+olcSyncRepl: rid=001 provider=$PROVIDERURI binddn="$MANAGERDN" bindmethod=simple
4404fd
+  credentials=$PASSWD searchbase="$BASEDN" $SYNCTYPE
4404fd
+  retry="3 +" timeout=3 logbase="cn=log"
4404fd
+  logfilter="(&(objectclass=auditWriteObject)(reqresult=0))"
4404fd
+  syncdata=accesslog tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt
4404fd
+  starttls=critical
4404fd
+olcMirrorMode: TRUE
4404fd
+$INDEX2
4404fd
+
4404fd
+dn: olcOverlay=syncprov,olcDatabase={2}$BACKEND,cn=config
4404fd
+objectClass: olcOverlayConfig
4404fd
+objectClass: olcSyncProvConfig
4404fd
+olcOverlay: syncprov
4404fd
+
4404fd
+dn: olcOverlay=accesslog,olcDatabase={2}$BACKEND,cn=config
4404fd
+objectClass: olcOverlayConfig
4404fd
+objectClass: olcAccessLogConfig
4404fd
+olcOverlay: accesslog
4404fd
+olcAccessLogDB: cn=log
4404fd
+olcAccessLogOps: writes
4404fd
+olcAccessLogSuccess: TRUE
4404fd
+
4404fd
+EOF
4404fd
+$SLAPADD -F $CFDIR -n 0  -d-1< $TMP > $TESTOUT 2>&1
4404fd
+PORT=`eval echo '$PORT'$n`
4404fd
+echo "Starting server $n on TCP/IP port $PORT..."
4404fd
+cd ${XDIR}${n}
4404fd
+LOG=`eval echo '$LOG'$n`
4404fd
+$SLAPD -F slapd.d -h $MYURI -d $LVL $TIMING > $LOG 2>&1 &
4404fd
+PID=$!
4404fd
+if test $WAIT != 0 ; then
4404fd
+    echo PID $PID
4404fd
+    read foo
4404fd
+fi
4404fd
+KILLPIDS="$PID $KILLPIDS"
4404fd
+cd $TESTWD
4404fd
+
4404fd
+echo "Using ldapsearch to check that server $n is running..."
4404fd
+for i in 0 1 2 3 4 5; do
4404fd
+	$LDAPSEARCH -s base -b "" -H $MYURI \
4404fd
+		'objectclass=*' > /dev/null 2>&1
4404fd
+	RC=$?
4404fd
+	if test $RC = 0 ; then
4404fd
+		break
4404fd
+	fi
4404fd
+	echo "Waiting 5 seconds for slapd to start..."
4404fd
+	sleep 5
4404fd
+done
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch failed ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+if [ $n = 1 ]; then
4404fd
+echo "Using ldapadd for context on server 1..."
4404fd
+$LDAPADD -D "$MANAGERDN" -H $URI1 -w $PASSWD -f $LDIFORDEREDCP \
4404fd
+	>> $TESTOUT 2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapadd failed for server $n database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+fi
4404fd
+
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+echo "Using ldapadd to populate server 1..."
4404fd
+$LDAPADD -D "$MANAGERDN" -H $URI1 -w $PASSWD -f $LDIFORDEREDNOCP \
4404fd
+	>> $TESTOUT 2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapadd failed for server $n database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..."
4404fd
+sleep $SLEEP1
4404fd
+
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+PORT=`expr $BASEPORT + $n`
4404fd
+URI="ldap://${LOCALHOST}:$PORT/"
4404fd
+
4404fd
+echo "Using ldapsearch to read all the entries from server $n..."
4404fd
+$LDAPSEARCH -S "" -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD  \
4404fd
+	'objectclass=*' > $TESTDIR/server$n.out 2>&1
4404fd
+RC=$?
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch failed at server $n ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+n=2
4404fd
+while [ $n -le $MMR ]; do
4404fd
+echo "Comparing retrieved entries from server 1 and server $n..."
4404fd
+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT
4404fd
+
4404fd
+if test $? != 0 ; then
4404fd
+	echo "test failed - server 1 and server $n databases differ"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit 1
4404fd
+fi
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+echo "Using ldapadd to populate server 2..."
4404fd
+$LDAPADD -D "$MANAGERDN" -H $URI2 -w $PASSWD -f $LDIFADD1 \
4404fd
+	>> $TESTOUT 2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapadd failed for server 2 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+THEDN="cn=James A Jones 2,ou=Alumni Association,ou=People,dc=example,dc=com"
4404fd
+sleep 1
4404fd
+for i in 1 2 3; do
4404fd
+	$LDAPSEARCH -S "" -b "$THEDN" -H $URI1 \
4404fd
+		-s base '(objectClass=*)' entryCSN > "${MASTEROUT}.$i" 2>&1
4404fd
+	RC=$?
4404fd
+
4404fd
+	if test $RC = 0 ; then
4404fd
+		break
4404fd
+	fi
4404fd
+
4404fd
+	if test $RC != 32 ; then
4404fd
+		echo "ldapsearch failed at slave ($RC)!"
4404fd
+		test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+		exit $RC
4404fd
+	fi
4404fd
+
4404fd
+	echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..."
4404fd
+	sleep $SLEEP1
4404fd
+done
4404fd
+
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+PORT=`expr $BASEPORT + $n`
4404fd
+URI="ldap://${LOCALHOST}:$PORT/"
4404fd
+
4404fd
+echo "Using ldapsearch to read all the entries from server $n..."
4404fd
+$LDAPSEARCH -S "" -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD  \
4404fd
+	'objectclass=*' > $TESTDIR/server$n.out 2>&1
4404fd
+RC=$?
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch failed at server $n ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+n=2
4404fd
+while [ $n -le $MMR ]; do
4404fd
+echo "Comparing retrieved entries from server 1 and server $n..."
4404fd
+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT
4404fd
+
4404fd
+if test $? != 0 ; then
4404fd
+	echo "test failed - server 1 and server $n databases differ"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit 1
4404fd
+fi
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+echo "Breaking replication between server 1 and 2..."
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+o=`expr 3 - $n`
4404fd
+MYURI=`eval echo '$URI'$n`
4404fd
+PROVIDERURI=`eval echo '$URIP'$o`
4404fd
+$LDAPMODIFY -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 <
4404fd
+dn: olcDatabase={2}$BACKEND,cn=config
4404fd
+changetype: modify
4404fd
+replace: olcSyncRepl
4404fd
+olcSyncRepl: rid=001 provider=$PROVIDERURI binddn="$MANAGERDN" bindmethod=simple
4404fd
+  credentials=InvalidPw searchbase="$BASEDN" $SYNCTYPE
4404fd
+  retry="3 +" timeout=3 logbase="cn=log"
4404fd
+  logfilter="(&(objectclass=auditWriteObject)(reqresult=0))"
4404fd
+  syncdata=accesslog tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt
4404fd
+  starttls=critical
4404fd
+-
4404fd
+replace: olcMirrorMode
4404fd
+olcMirrorMode: TRUE
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server $n config ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+echo "Using ldapmodify to force conflicts between server 1 and 2..."
4404fd
+$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+add: description
4404fd
+description: Amazing
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 1 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+add: description
4404fd
+description: Stupendous
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 2 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+delete: description
4404fd
+description: Outstanding
4404fd
+-
4404fd
+add: description
4404fd
+description: Mindboggling
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 1 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+delete: description
4404fd
+description: OutStanding
4404fd
+-
4404fd
+add: description
4404fd
+description: Bizarre
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 2 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+add: carLicense
4404fd
+carLicense: 123-XYZ
4404fd
+-
4404fd
+add: employeeNumber
4404fd
+employeeNumber: 32
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 1 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -D "$MANAGERDN" -H $URI2 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+add: employeeType
4404fd
+employeeType: deadwood
4404fd
+-
4404fd
+add: employeeNumber
4404fd
+employeeNumber: 64
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 2 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+replace: sn
4404fd
+sn: Replaced later
4404fd
+-
4404fd
+replace: sn
4404fd
+sn: Surname
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 1 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+echo "Restoring replication between server 1 and 2..."
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+o=`expr 3 - $n`
4404fd
+MYURI=`eval echo '$URI'$n`
4404fd
+PROVIDERURI=`eval echo '$URIP'$o`
4404fd
+$LDAPMODIFY -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 <
4404fd
+dn: olcDatabase={2}$BACKEND,cn=config
4404fd
+changetype: modify
4404fd
+replace: olcSyncRepl
4404fd
+olcSyncRepl: rid=001 provider=$PROVIDERURI binddn="$MANAGERDN" bindmethod=simple
4404fd
+  credentials=$PASSWD searchbase="$BASEDN" $SYNCTYPE
4404fd
+  retry="3 +" timeout=3 logbase="cn=log"
4404fd
+  logfilter="(&(objectclass=auditWriteObject)(reqresult=0))"
4404fd
+  syncdata=accesslog tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt
4404fd
+  starttls=critical
4404fd
+-
4404fd
+replace: olcMirrorMode
4404fd
+olcMirrorMode: TRUE
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server $n config ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..."
4404fd
+sleep $SLEEP1
4404fd
+
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+PORT=`expr $BASEPORT + $n`
4404fd
+URI="ldap://${LOCALHOST}:$PORT/"
4404fd
+
4404fd
+echo "Using ldapsearch to read all the entries from server $n..."
4404fd
+$LDAPSEARCH -S "" -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD  \
4404fd
+	'objectclass=*' > $TESTDIR/server$n.out 2>&1
4404fd
+RC=$?
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch failed at server $n ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+$LDIFFILTER -s a < $TESTDIR/server$n.out > $TESTDIR/server$n.flt
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+n=2
4404fd
+while [ $n -le $MMR ]; do
4404fd
+echo "Comparing retrieved entries from server 1 and server $n..."
4404fd
+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT
4404fd
+
4404fd
+if test $? != 0 ; then
4404fd
+	echo "test failed - server 1 and server $n databases differ"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit 1
4404fd
+fi
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+
4404fd
+echo ">>>>> Test succeeded"
4404fd
+
4404fd
+test $KILLSERVERS != no && wait
4404fd
+
4404fd
+exit 0
4404fd
diff --git a/tests/scripts/test070-delta-multimaster-ldaps b/tests/scripts/test070-delta-multimaster-ldaps
4404fd
new file mode 100755
4404fd
index 000000000..1024640ef
4404fd
--- /dev/null
4404fd
+++ b/tests/scripts/test070-delta-multimaster-ldaps
4404fd
@@ -0,0 +1,571 @@
4404fd
+#! /bin/sh
4404fd
+# $OpenLDAP$
4404fd
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
4404fd
+##
4404fd
+## Copyright 1998-2017 The OpenLDAP Foundation.
4404fd
+## All rights reserved.
4404fd
+##
4404fd
+## Redistribution and use in source and binary forms, with or without
4404fd
+## modification, are permitted only as authorized by the OpenLDAP
4404fd
+## Public License.
4404fd
+##
4404fd
+## A copy of this license is available in the file LICENSE in the
4404fd
+## top-level directory of the distribution or, alternatively, at
4404fd
+## <http://www.OpenLDAP.org/license.html>.
4404fd
+
4404fd
+echo "running defines.sh"
4404fd
+. $SRCDIR/scripts/defines.sh
4404fd
+
4404fd
+if test $WITH_TLS = no ; then
4404fd
+        echo "TLS support not available, test skipped"
4404fd
+        exit 0
4404fd
+fi
4404fd
+
4404fd
+if test $SYNCPROV = syncprovno; then
4404fd
+	echo "Syncrepl provider overlay not available, test skipped"
4404fd
+	exit 0
4404fd
+fi
4404fd
+if test $ACCESSLOG = accesslogno; then
4404fd
+	echo "Accesslog overlay not available, test skipped"
4404fd
+	exit 0
4404fd
+fi
4404fd
+
4404fd
+MMR=2
4404fd
+
4404fd
+XDIR=$TESTDIR/srv
4404fd
+TMP=$TESTDIR/tmp
4404fd
+
4404fd
+mkdir -p $TESTDIR
4404fd
+cp -r $DATADIR/tls $TESTDIR
4404fd
+
4404fd
+$SLAPPASSWD -g -n >$CONFIGPWF
4404fd
+
4404fd
+if test x"$SYNCMODE" = x ; then
4404fd
+	SYNCMODE=rp
4404fd
+fi
4404fd
+case "$SYNCMODE" in
4404fd
+	ro)
4404fd
+		SYNCTYPE="type=refreshOnly interval=00:00:00:03"
4404fd
+		;;
4404fd
+	rp)
4404fd
+		SYNCTYPE="type=refreshAndPersist interval=00:00:00:03"
4404fd
+		;;
4404fd
+	*)
4404fd
+		echo "unknown sync mode $SYNCMODE"
4404fd
+		exit 1;
4404fd
+		;;
4404fd
+esac
4404fd
+
4404fd
+#
4404fd
+# Test delta-sync mmr
4404fd
+# - start servers
4404fd
+# - configure over ldap
4404fd
+# - populate over ldap
4404fd
+# - configure syncrepl over ldap
4404fd
+# - break replication
4404fd
+# - modify each server separately
4404fd
+# - restore replication
4404fd
+# - compare results
4404fd
+#
4404fd
+
4404fd
+nullExclude=""
4404fd
+test $BACKEND = null && nullExclude="# "
4404fd
+
4404fd
+KILLPIDS=
4404fd
+
4404fd
+echo "Initializing server configurations..."
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+
4404fd
+DBDIR=${XDIR}$n/db
4404fd
+CFDIR=${XDIR}$n/slapd.d
4404fd
+
4404fd
+mkdir -p ${XDIR}$n $DBDIR.1 $DBDIR.2 $CFDIR
4404fd
+
4404fd
+o=`expr 3 - $n`
4404fd
+cat > $TMP <
4404fd
+dn: cn=config
4404fd
+objectClass: olcGlobal
4404fd
+cn: config
4404fd
+olcServerID: $n
4404fd
+olcTLSCertificateFile: $TESTDIR/tls/certs/localhost.crt
4404fd
+olcTLSCertificateKeyFile: $TESTDIR/tls/private/localhost.key
4404fd
+
4404fd
+EOF
4404fd
+
4404fd
+if [ "$SYNCPROV" = syncprovmod -o "$ACCESSLOG" = accesslogmod ]; then
4404fd
+  cat <<EOF >> $TMP
4404fd
+dn: cn=module,cn=config
4404fd
+objectClass: olcModuleList
4404fd
+cn: module
4404fd
+olcModulePath: $TESTWD/../servers/slapd/overlays
4404fd
+EOF
4404fd
+  if [ "$SYNCPROV" = syncprovmod ]; then
4404fd
+  echo "olcModuleLoad: syncprov.la" >> $TMP
4404fd
+  fi
4404fd
+  if [ "$ACCESSLOG" = accesslogmod ]; then
4404fd
+  echo "olcModuleLoad: accesslog.la" >> $TMP
4404fd
+  fi
4404fd
+  echo "" >> $TMP
4404fd
+fi
4404fd
+
4404fd
+if [ "$BACKENDTYPE" = mod ]; then
4404fd
+cat <<EOF >> $TMP
4404fd
+dn: cn=module,cn=config
4404fd
+objectClass: olcModuleList
4404fd
+cn: module
4404fd
+olcModulePath: $TESTWD/../servers/slapd/back-$BACKEND
4404fd
+olcModuleLoad: back_$BACKEND.la
4404fd
+
4404fd
+EOF
4404fd
+fi
4404fd
+MYURI=`eval echo '$SURIP'$n`
4404fd
+PROVIDERURI=`eval echo '$SURIP'$o`
4404fd
+if test $INDEXDB = indexdb ; then
4404fd
+INDEX1="olcDbIndex: objectClass,entryCSN,reqStart,reqDN,reqResult eq"
4404fd
+INDEX2="olcDbIndex: objectClass,entryCSN,entryUUID eq"
4404fd
+else
4404fd
+INDEX1=
4404fd
+INDEX2=
4404fd
+fi
4404fd
+cat >> $TMP <
4404fd
+dn: cn=schema,cn=config
4404fd
+objectclass: olcSchemaconfig
4404fd
+cn: schema
4404fd
+
4404fd
+include: file://$ABS_SCHEMADIR/core.ldif
4404fd
+
4404fd
+include: file://$ABS_SCHEMADIR/cosine.ldif
4404fd
+
4404fd
+include: file://$ABS_SCHEMADIR/inetorgperson.ldif
4404fd
+
4404fd
+include: file://$ABS_SCHEMADIR/openldap.ldif
4404fd
+
4404fd
+include: file://$ABS_SCHEMADIR/nis.ldif
4404fd
+
4404fd
+dn: olcDatabase={0}config,cn=config
4404fd
+objectClass: olcDatabaseConfig
4404fd
+olcDatabase: {0}config
4404fd
+olcRootPW:< file://$CONFIGPWF
4404fd
+
4404fd
+dn: olcDatabase={1}$BACKEND,cn=config
4404fd
+objectClass: olcDatabaseConfig
4404fd
+${nullExclude}objectClass: olc${BACKEND}Config
4404fd
+olcDatabase: {1}$BACKEND
4404fd
+olcSuffix: cn=log
4404fd
+${nullExclude}olcDbDirectory: ${DBDIR}.1
4404fd
+olcRootDN: $MANAGERDN
4404fd
+$INDEX1
4404fd
+
4404fd
+dn: olcOverlay=syncprov,olcDatabase={1}$BACKEND,cn=config
4404fd
+objectClass: olcOverlayConfig
4404fd
+objectClass: olcSyncProvConfig
4404fd
+olcOverlay: syncprov
4404fd
+olcSpNoPresent: TRUE
4404fd
+olcSpReloadHint: TRUE
4404fd
+
4404fd
+dn: olcDatabase={2}$BACKEND,cn=config
4404fd
+objectClass: olcDatabaseConfig
4404fd
+${nullExclude}objectClass: olc${BACKEND}Config
4404fd
+olcDatabase: {2}$BACKEND
4404fd
+olcSuffix: $BASEDN
4404fd
+${nullExclude}olcDbDirectory: ${DBDIR}.2
4404fd
+olcRootDN: $MANAGERDN
4404fd
+olcRootPW: $PASSWD
4404fd
+olcSyncRepl: rid=001 provider=$PROVIDERURI binddn="$MANAGERDN" bindmethod=simple
4404fd
+  credentials=$PASSWD searchbase="$BASEDN" $SYNCTYPE
4404fd
+  retry="3 +" timeout=3 logbase="cn=log"
4404fd
+  logfilter="(&(objectclass=auditWriteObject)(reqresult=0))"
4404fd
+  syncdata=accesslog tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt
4404fd
+olcMirrorMode: TRUE
4404fd
+$INDEX2
4404fd
+
4404fd
+dn: olcOverlay=syncprov,olcDatabase={2}$BACKEND,cn=config
4404fd
+objectClass: olcOverlayConfig
4404fd
+objectClass: olcSyncProvConfig
4404fd
+olcOverlay: syncprov
4404fd
+
4404fd
+dn: olcOverlay=accesslog,olcDatabase={2}$BACKEND,cn=config
4404fd
+objectClass: olcOverlayConfig
4404fd
+objectClass: olcAccessLogConfig
4404fd
+olcOverlay: accesslog
4404fd
+olcAccessLogDB: cn=log
4404fd
+olcAccessLogOps: writes
4404fd
+olcAccessLogSuccess: TRUE
4404fd
+
4404fd
+EOF
4404fd
+$SLAPADD -F $CFDIR -n 0  -d-1< $TMP > $TESTOUT 2>&1
4404fd
+PORT=`eval echo '$PORT'$n`
4404fd
+echo "Starting server $n on TCP/IP port $PORT..."
4404fd
+cd ${XDIR}${n}
4404fd
+LOG=`eval echo '$LOG'$n`
4404fd
+$SLAPD -F slapd.d -h $MYURI -d $LVL $TIMING > $LOG 2>&1 &
4404fd
+PID=$!
4404fd
+if test $WAIT != 0 ; then
4404fd
+    echo PID $PID
4404fd
+    read foo
4404fd
+fi
4404fd
+KILLPIDS="$PID $KILLPIDS"
4404fd
+cd $TESTWD
4404fd
+
4404fd
+echo "Using ldapsearch to check that server $n is running..."
4404fd
+for i in 0 1 2 3 4 5; do
4404fd
+	$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -s base -b "" -H $MYURI \
4404fd
+		'objectclass=*' > /dev/null 2>&1
4404fd
+	RC=$?
4404fd
+	if test $RC = 0 ; then
4404fd
+		break
4404fd
+	fi
4404fd
+	echo "Waiting 5 seconds for slapd to start..."
4404fd
+	sleep 5
4404fd
+done
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch failed ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+if [ $n = 1 ]; then
4404fd
+echo "Using ldapadd for context on server 1..."
4404fd
+$LDAPADD -D "$MANAGERDN" -H $SURIP1 -w $PASSWD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -f $LDIFORDEREDCP \
4404fd
+	>> $TESTOUT 2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapadd failed for server $n database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+fi
4404fd
+
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+echo "Using ldapadd to populate server 1..."
4404fd
+$LDAPADD -D "$MANAGERDN" -H $SURIP1 -w $PASSWD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -f $LDIFORDEREDNOCP \
4404fd
+	>> $TESTOUT 2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapadd failed for server $n database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..."
4404fd
+sleep $SLEEP1
4404fd
+
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+PORT=`expr $BASEPORT + $n`
4404fd
+URI="ldaps://${LOCALIP}:$PORT/"
4404fd
+
4404fd
+echo "Using ldapsearch to read all the entries from server $n..."
4404fd
+$LDAPSEARCH -S "" -b "$BASEDN" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $URI -w $PASSWD  \
4404fd
+	'objectclass=*' > $TESTDIR/server$n.out 2>&1
4404fd
+RC=$?
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch failed at server $n ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+n=2
4404fd
+while [ $n -le $MMR ]; do
4404fd
+echo "Comparing retrieved entries from server 1 and server $n..."
4404fd
+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT
4404fd
+
4404fd
+if test $? != 0 ; then
4404fd
+	echo "test failed - server 1 and server $n databases differ"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit 1
4404fd
+fi
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+echo "Using ldapadd to populate server 2..."
4404fd
+$LDAPADD -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD -f $LDIFADD1 \
4404fd
+	>> $TESTOUT 2>&1
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapadd failed for server 2 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+THEDN="cn=James A Jones 2,ou=Alumni Association,ou=People,dc=example,dc=com"
4404fd
+sleep 1
4404fd
+for i in 1 2 3; do
4404fd
+	$LDAPSEARCH -S "" -b "$THEDN" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -H $SURIP1 \
4404fd
+		-s base '(objectClass=*)' entryCSN > "${MASTEROUT}.$i" 2>&1
4404fd
+	RC=$?
4404fd
+
4404fd
+	if test $RC = 0 ; then
4404fd
+		break
4404fd
+	fi
4404fd
+
4404fd
+	if test $RC != 32 ; then
4404fd
+		echo "ldapsearch failed at slave ($RC)!"
4404fd
+		test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+		exit $RC
4404fd
+	fi
4404fd
+
4404fd
+	echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..."
4404fd
+	sleep $SLEEP1
4404fd
+done
4404fd
+
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+PORT=`expr $BASEPORT + $n`
4404fd
+URI="ldaps://${LOCALIP}:$PORT/"
4404fd
+
4404fd
+echo "Using ldapsearch to read all the entries from server $n..."
4404fd
+$LDAPSEARCH -S "" -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD  \
4404fd
+	'objectclass=*' > $TESTDIR/server$n.out 2>&1
4404fd
+RC=$?
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch failed at server $n ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+$LDIFFILTER < $TESTDIR/server$n.out > $TESTDIR/server$n.flt
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+n=2
4404fd
+while [ $n -le $MMR ]; do
4404fd
+echo "Comparing retrieved entries from server 1 and server $n..."
4404fd
+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT
4404fd
+
4404fd
+if test $? != 0 ; then
4404fd
+	echo "test failed - server 1 and server $n databases differ"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit 1
4404fd
+fi
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+echo "Breaking replication between server 1 and 2..."
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+o=`expr 3 - $n`
4404fd
+MYURI=`eval echo '$SURIP'$n`
4404fd
+PROVIDERURI=`eval echo '$SURIP'$o`
4404fd
+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D cn=config -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 <
4404fd
+dn: olcDatabase={2}$BACKEND,cn=config
4404fd
+changetype: modify
4404fd
+replace: olcSyncRepl
4404fd
+olcSyncRepl: rid=001 provider=$PROVIDERURI binddn="$MANAGERDN" bindmethod=simple
4404fd
+  credentials=InvalidPw searchbase="$BASEDN" $SYNCTYPE
4404fd
+  retry="3 +" timeout=3 logbase="cn=log"
4404fd
+  logfilter="(&(objectclass=auditWriteObject)(reqresult=0))"
4404fd
+  syncdata=accesslog tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt
4404fd
+-
4404fd
+replace: olcMirrorMode
4404fd
+olcMirrorMode: TRUE
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server $n config ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+echo "Using ldapmodify to force conflicts between server 1 and 2..."
4404fd
+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+add: description
4404fd
+description: Amazing
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 1 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+add: description
4404fd
+description: Stupendous
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 2 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+delete: description
4404fd
+description: Outstanding
4404fd
+-
4404fd
+add: description
4404fd
+description: Mindboggling
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 1 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+delete: description
4404fd
+description: OutStanding
4404fd
+-
4404fd
+add: description
4404fd
+description: Bizarre
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 2 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+add: carLicense
4404fd
+carLicense: 123-XYZ
4404fd
+-
4404fd
+add: employeeNumber
4404fd
+employeeNumber: 32
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 1 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP2 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+add: employeeType
4404fd
+employeeType: deadwood
4404fd
+-
4404fd
+add: employeeNumber
4404fd
+employeeNumber: 64
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 2 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+$LDAPMODIFY -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -D "$MANAGERDN" -H $SURIP1 -w $PASSWD \
4404fd
+	>> $TESTOUT 2>&1 << EOF
4404fd
+dn: $THEDN
4404fd
+changetype: modify
4404fd
+replace: sn
4404fd
+sn: Replaced later
4404fd
+-
4404fd
+replace: sn
4404fd
+sn: Surname
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server 1 database ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+
4404fd
+echo "Restoring replication between server 1 and 2..."
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+o=`expr 3 - $n`
4404fd
+MYURI=`eval echo '$SURIP'$n`
4404fd
+PROVIDERURI=`eval echo '$SURIP'$o`
4404fd
+$LDAPMODIFY -D cn=config -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -H $MYURI -y $CONFIGPWF > $TESTOUT 2>&1 <
4404fd
+dn: olcDatabase={2}$BACKEND,cn=config
4404fd
+changetype: modify
4404fd
+replace: olcSyncRepl
4404fd
+olcSyncRepl: rid=001 provider=$PROVIDERURI binddn="$MANAGERDN" bindmethod=simple
4404fd
+  credentials=$PASSWD searchbase="$BASEDN" $SYNCTYPE
4404fd
+  retry="3 +" timeout=3 logbase="cn=log"
4404fd
+  logfilter="(&(objectclass=auditWriteObject)(reqresult=0))"
4404fd
+  syncdata=accesslog tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt
4404fd
+-
4404fd
+replace: olcMirrorMode
4404fd
+olcMirrorMode: TRUE
4404fd
+
4404fd
+EOF
4404fd
+RC=$?
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapmodify failed for server $n config ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+echo "Waiting $SLEEP1 seconds for syncrepl to receive changes..."
4404fd
+sleep $SLEEP1
4404fd
+
4404fd
+n=1
4404fd
+while [ $n -le $MMR ]; do
4404fd
+PORT=`expr $BASEPORT + $n`
4404fd
+URI="ldaps://${LOCALIP}:$PORT/"
4404fd
+
4404fd
+echo "Using ldapsearch to read all the entries from server $n..."
4404fd
+$LDAPSEARCH -o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt -S "" -b "$BASEDN" -D "$MANAGERDN" -H $URI -w $PASSWD  \
4404fd
+	'objectclass=*' > $TESTDIR/server$n.out 2>&1
4404fd
+RC=$?
4404fd
+
4404fd
+if test $RC != 0 ; then
4404fd
+	echo "ldapsearch failed at server $n ($RC)!"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit $RC
4404fd
+fi
4404fd
+$LDIFFILTER -s a < $TESTDIR/server$n.out > $TESTDIR/server$n.flt
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+n=2
4404fd
+while [ $n -le $MMR ]; do
4404fd
+echo "Comparing retrieved entries from server 1 and server $n..."
4404fd
+$CMP $MASTERFLT $TESTDIR/server$n.flt > $CMPOUT
4404fd
+
4404fd
+if test $? != 0 ; then
4404fd
+	echo "test failed - server 1 and server $n databases differ"
4404fd
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+	exit 1
4404fd
+fi
4404fd
+n=`expr $n + 1`
4404fd
+done
4404fd
+
4404fd
+test $KILLSERVERS != no && kill -HUP $KILLPIDS
4404fd
+
4404fd
+echo ">>>>> Test succeeded"
4404fd
+
4404fd
+test $KILLSERVERS != no && wait
4404fd
+
4404fd
+exit 0
4404fd
-- 
4404fd
2.26.2
4404fd