Merging upstream version 2.6.8+dfsg.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

31 files changed, 1079 insertions, 36 deletions

diff --git a/servers/slapd/overlays/Makefile.in b/servers/slapd/overlays/Makefile.in
index e6711fe..6d886f8 100644
--- a/servers/slapd/overlays/Makefile.in
+++ b/servers/slapd/overlays/Makefile.in
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 2003-2022 The OpenLDAP Foundation.
+## Copyright 2003-2024 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without
@@ -24,6 +24,7 @@ SRCS = overlays.c \
 	dynlist.c \
 	homedir.c \
 	memberof.c \
+	nestgroup.c \
 	otp.c \
 	pcache.c \
 	collect.c \
@@ -96,6 +97,9 @@ homedir.la : homedir.lo
 memberof.la : memberof.lo
 	$(LTLINK_MOD) -module -o $@ memberof.lo version.lo $(LINK_LIBS)
 
+nestgroup.la : nestgroup.lo
+	$(LTLINK_MOD) -module -o $@ nestgroup.lo version.lo $(LINK_LIBS)
+
 otp.la : otp.lo
 	$(LTLINK_MOD) -module -o $@ otp.lo version.lo $(LINK_LIBS)
 
diff --git a/servers/slapd/overlays/accesslog.c b/servers/slapd/overlays/accesslog.c
index 182be57..19bbdbf 100644
--- a/servers/slapd/overlays/accesslog.c
+++ b/servers/slapd/overlays/accesslog.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2005-2022 The OpenLDAP Foundation.
+ * Copyright 2005-2024 The OpenLDAP Foundation.
  * Portions copyright 2004-2005 Symas Corporation.
  * All rights reserved.
  *
@@ -1567,7 +1567,7 @@ accesslog_response(Operation *op, SlapReply *rs)
 	lo = logops+logop+EN_OFFSET;
 
 	/* can't do anything if logDB isn't open */
-	if ( !SLAP_DBOPEN( li->li_db ) ) {
+	if ( !li->li_db || !SLAP_DBOPEN( li->li_db ) ) {
 		goto skip;
 	}
 
@@ -2497,7 +2497,13 @@ accesslog_db_root(
 				attr_merge_one( e, slap_schema.si_ad_entryCSN,
 					&a->a_vals[0], &a->a_nvals[0] );
 				attr_merge( e, a->a_desc, a->a_vals, a->a_nvals );
+
+				/* Populate minCSN */
 				attr_merge( e, ad_minCSN, a->a_vals, a->a_nvals );
+				ber_bvarray_dup_x( &li->li_mincsn, a->a_vals, NULL );
+				li->li_numcsns = a->a_numvals;
+				li->li_sids = slap_parse_csn_sids( li->li_mincsn, li->li_numcsns, NULL );
+				slap_sort_csn_sids( li->li_mincsn, li->li_sids, li->li_numcsns, NULL );
 			}
 			be_entry_release_rw( op, e_ctx, 0 );
 		}
diff --git a/servers/slapd/overlays/auditlog.c b/servers/slapd/overlays/auditlog.c
index 9292d4a..69482e7 100644
--- a/servers/slapd/overlays/auditlog.c
+++ b/servers/slapd/overlays/auditlog.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2005-2022 The OpenLDAP Foundation.
+ * Copyright 2005-2024 The OpenLDAP Foundation.
  * Portions copyright 2004-2005 Symas Corporation.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/autoca.c b/servers/slapd/overlays/autoca.c
index 5fcd204..692d9d5 100644
--- a/servers/slapd/overlays/autoca.c
+++ b/servers/slapd/overlays/autoca.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2009-2022 The OpenLDAP Foundation.
+ * Copyright 2009-2024 The OpenLDAP Foundation.
  * Copyright 2009-2018 by Howard Chu.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/collect.c b/servers/slapd/overlays/collect.c
index bbc6219..b133cd2 100644
--- a/servers/slapd/overlays/collect.c
+++ b/servers/slapd/overlays/collect.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2022 The OpenLDAP Foundation.
+ * Copyright 2003-2024 The OpenLDAP Foundation.
  * Portions Copyright 2003 Howard Chu.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/constraint.c b/servers/slapd/overlays/constraint.c
index f939b37..9622c29 100644
--- a/servers/slapd/overlays/constraint.c
+++ b/servers/slapd/overlays/constraint.c
@@ -369,6 +369,7 @@ constraint_cf_gen( ConfigArgs *c )
 						ap.attrs[i] = NULL;
 						if ( slap_str2ad( ap.lud->lud_attrs[i], &ap.attrs[i], &text ) ) {
 							ch_free( ap.attrs );
+							ap.attrs = NULL;
 							snprintf( c->cr_msg, sizeof( c->cr_msg ),
 								"%s <%s>: %s\n", c->argv[0], ap.lud->lud_attrs[i], text );
 							rc = ARG_BAD_CONF;
@@ -557,7 +558,7 @@ done:;
 				a2->restrict_filter = ap.restrict_filter;
 				a2->restrict_val = ap.restrict_val;
 
-				for ( app = &on->on_bi.bi_private; *app; app = &(*app)->ap_next )
+				for ( app = (constraint **)&on->on_bi.bi_private; *app; app = &(*app)->ap_next )
 					/* Get to the end */ ;
 
 				a2->ap_next = *app;
diff --git a/servers/slapd/overlays/dds.c b/servers/slapd/overlays/dds.c
index c19f042..422183a 100644
--- a/servers/slapd/overlays/dds.c
+++ b/servers/slapd/overlays/dds.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2005-2022 The OpenLDAP Foundation.
+ * Copyright 2005-2024 The OpenLDAP Foundation.
  * Portions Copyright 2005-2006 SysNet s.n.c.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/deref.c b/servers/slapd/overlays/deref.c
index 93b7f69..aed4f68 100644
--- a/servers/slapd/overlays/deref.c
+++ b/servers/slapd/overlays/deref.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2022 The OpenLDAP Foundation.
+ * Copyright 1998-2024 The OpenLDAP Foundation.
  * Portions Copyright 2008 Pierangelo Masarati.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/dyngroup.c b/servers/slapd/overlays/dyngroup.c
index 5d890d6..2c9ba7e 100644
--- a/servers/slapd/overlays/dyngroup.c
+++ b/servers/slapd/overlays/dyngroup.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2022 The OpenLDAP Foundation.
+ * Copyright 2003-2024 The OpenLDAP Foundation.
  * Copyright 2003 by Howard Chu.
  * All rights reserved.
  *
@@ -111,7 +111,7 @@ static int dgroup_cf( ConfigArgs *c )
 		 */
 		a2 = ch_malloc( sizeof(adpair) );
 
-		for ( app = &on->on_bi.bi_private; *app; app = &(*app)->ap_next )
+		for ( app = (adpair **)&on->on_bi.bi_private; *app; app = &(*app)->ap_next )
 			/* Get to the end */ ;
 
 		a2->ap_mem = ap.ap_mem;
diff --git a/servers/slapd/overlays/dynlist.c b/servers/slapd/overlays/dynlist.c
index 5c38b64..eb3a313 100644
--- a/servers/slapd/overlays/dynlist.c
+++ b/servers/slapd/overlays/dynlist.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2022 The OpenLDAP Foundation.
+ * Copyright 2003-2024 The OpenLDAP Foundation.
  * Portions Copyright 2004-2005 Pierangelo Masarati.
  * Portions Copyright 2008 Emmanuel Dreyfus.
  * All rights reserved.
@@ -1648,6 +1648,9 @@ dynlist_search2resp( Operation *op, SlapReply *rs )
 	dynlist_name_t *dyn;
 	int rc;
 
+	if ( op->o_abandon )
+		return SLAP_CB_CONTINUE;
+
 	if ( rs->sr_type == REP_SEARCH && rs->sr_entry != NULL ) {
 		rc = SLAP_CB_CONTINUE;
 		/* See if this is one of our dynamic groups */
diff --git a/servers/slapd/overlays/homedir.c b/servers/slapd/overlays/homedir.c
index 159090e..78e3886 100644
--- a/servers/slapd/overlays/homedir.c
+++ b/servers/slapd/overlays/homedir.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2009-2022 The OpenLDAP Foundation.
+ * Copyright 2009-2024 The OpenLDAP Foundation.
  * Portions copyright 2009-2010 Symas Corporation.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/memberof.c b/servers/slapd/overlays/memberof.c
index 5affbbf..351aa56 100644
--- a/servers/slapd/overlays/memberof.c
+++ b/servers/slapd/overlays/memberof.c
@@ -159,6 +159,7 @@ typedef struct memberof_t {
 #define	MEMBEROF_FDANGLING_MASK	(MEMBEROF_FDANGLING_DROP|MEMBEROF_FDANGLING_ERROR)
 #define	MEMBEROF_FREFINT	0x04U
 #define	MEMBEROF_FREVERSE	0x08U
+#define	MEMBEROF_FADDCHECK	0x10U
 
 	ber_int_t		mo_dangling_err;
 
@@ -174,6 +175,8 @@ typedef struct memberof_t {
 	MEMBEROF_CHK((mo),MEMBEROF_FREFINT)
 #define MEMBEROF_REVERSE(mo) \
 	MEMBEROF_CHK((mo),MEMBEROF_FREVERSE)
+#define MEMBEROF_ADDCHECK(mo) \
+	MEMBEROF_CHK((mo),MEMBEROF_FADDCHECK)
 } memberof_t;
 
 typedef enum memberof_is_t {
@@ -385,6 +388,10 @@ memberof_value_modify(
 	op2.orm_no_opattrs = 1;
 	op2.o_dont_replicate = 1;
 
+	/* main op has already completed if we got here, so even
+	 * if its abandon flag was set we must complete as well. */
+	op2.o_abandon = 0;
+
 	if ( !BER_BVISNULL( &mo->mo_ndn ) ) {
 		ml = &mod[ mcnt ];
 		ml->sml_numvals = 1;
@@ -521,6 +528,87 @@ static int memberof_res_delete( Operation *op, SlapReply *rs );
 static int memberof_res_modify( Operation *op, SlapReply *rs );
 static int memberof_res_modrdn( Operation *op, SlapReply *rs );
 
+typedef struct mo_addcheck_t {
+	memberof_t	*ma_mo;
+	Entry *ma_e;
+	Attribute *ma_a;
+} mo_addcheck_t;
+
+static int memberof_res_addcheck( Operation *op, SlapReply *rs )
+{
+	mo_addcheck_t *ma = op->o_callback->sc_private;
+	if ( rs->sr_type == REP_SEARCH ) {
+		if ( !ma->ma_a ) {
+			attr_merge_one( ma->ma_e, ma->ma_mo->mo_ad_memberof,
+				&rs->sr_entry->e_name, &rs->sr_entry->e_nname );
+			ma->ma_a = attr_find( ma->ma_e->e_attrs, ma->ma_mo->mo_ad_memberof );
+		} else {
+			if ( attr_valfind( ma->ma_a, SLAP_MR_EQUALITY | SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH |
+				SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH, &rs->sr_entry->e_nname, NULL, NULL )) {
+				attr_valadd( ma->ma_a, &rs->sr_entry->e_name, &rs->sr_entry->e_nname, 1 );
+			}
+		}
+	}
+	return 0;
+}
+
+/* Check if an entry being added is already a member of existing groups;
+ * add those groups to the entry's memberof if any.
+ */
+static void
+memberof_addcheck( Operation *op )
+{
+	slap_overinst	*on = (slap_overinst *)op->o_bd->bd_info;
+	memberof_t	*mo = (memberof_t *)on->on_bi.bi_private;
+	Operation o = *op;
+	Filter mf;
+	AttributeAssertion mava;
+	slap_callback sc = {0};
+	mo_addcheck_t ma;
+	SlapReply rs = {REP_SEARCH};
+
+	o.o_dn = op->o_bd->be_rootdn;
+	o.o_ndn = op->o_bd->be_rootndn;
+	o.o_bd->bd_info = (BackendInfo *)on->on_info;
+	o.o_tag = LDAP_REQ_SEARCH;
+	o.o_req_dn = op->o_bd->be_suffix[0];
+	o.o_req_ndn = op->o_bd->be_nsuffix[0];
+	o.o_do_not_cache = 1;
+	o.ors_scope = LDAP_SCOPE_SUBTREE;
+	o.ors_slimit = SLAP_NO_LIMIT;
+	o.ors_tlimit = SLAP_NO_LIMIT;
+	o.ors_limit = NULL;
+	o.ors_attrsonly = 1;
+	o.ors_attrs = slap_anlist_no_attrs;
+	mf.f_choice = LDAP_FILTER_EQUALITY;
+	mf.f_ava = &mava;
+	mf.f_next = NULL;
+	mf.f_av_desc = mo->mo_ad_member;
+	mf.f_av_value = op->o_req_ndn;
+	o.ors_filter = &mf;
+	o.ors_filterstr.bv_val = op->o_tmpalloc( mo->mo_ad_member->ad_cname.bv_len + 2
+		+ op->o_req_ndn.bv_len + 2, op->o_tmpmemctx );
+	{
+		char *ptr = o.ors_filterstr.bv_val;
+		*ptr++ = '(';
+		ptr = lutil_strcopy( ptr, mo->mo_ad_member->ad_cname.bv_val );
+		*ptr++ = '=';
+		ptr = lutil_strcopy( ptr, op->o_req_ndn.bv_val );
+		*ptr++ = ')';
+		*ptr = '\0';
+	}
+	sc.sc_private = &ma;
+	sc.sc_response = memberof_res_addcheck;
+	ma.ma_mo = mo;
+	ma.ma_e = op->ora_e;
+	ma.ma_a = attr_find( op->ora_e->e_attrs, mo->mo_ad_memberof );
+	o.o_callback = &sc;
+
+	o.o_bd->be_search( &o, &rs );
+	o.o_bd->bd_info = (BackendInfo *)on;
+	op->o_tmpfree( o.ors_filterstr.bv_val, op->o_tmpmemctx );
+}
+
 static int
 memberof_op_add( Operation *op, SlapReply *rs )
 {
@@ -549,6 +637,10 @@ memberof_op_add( Operation *op, SlapReply *rs )
 		return SLAP_CB_CONTINUE;
 	}
 
+	if ( MEMBEROF_ADDCHECK( mo )) {
+		memberof_addcheck( op );
+	}
+
 	if ( MEMBEROF_REVERSE( mo ) ) {
 		for ( ap = &op->ora_e->e_attrs; *ap; ap = &(*ap)->a_next ) {
 			Attribute	*a = *ap;
@@ -1649,6 +1741,7 @@ enum {
 #endif
 
 	MO_DANGLING_ERROR,
+	MO_ADDCHECK,
 
 	MO_LAST
 };
@@ -1730,6 +1823,14 @@ static ConfigTable mo_cfg[] = {
 			"SYNTAX OMsDirectoryString SINGLE-VALUE )",
 		NULL, NULL },
 
+	{ "memberof-addcheck", "true|FALSE",
+		2, 2, 0, ARG_MAGIC|ARG_ON_OFF|MO_ADDCHECK, mo_cf_gen,
+		"( OLcfgOvAt:18.8 NAME 'olcMemberOfAddCheck' "
+			"DESC 'Check for memberships on added entries' "
+			"EQUALITY booleanMatch "
+			"SYNTAX OMsBoolean SINGLE-VALUE )",
+		NULL, NULL },
+
 	{ NULL, NULL, 0, 0, 0, ARG_IGNORED }
 };
 
@@ -1749,6 +1850,7 @@ static ConfigOCs mo_ocs[] = {
 #if 0
 			"$ olcMemberOfReverse "
 #endif
+			"$ olcMemberOfAddCheck "
 			") "
 		")",
 		Cft_Overlay, mo_cfg, NULL, NULL },
@@ -1887,6 +1989,10 @@ mo_cf_gen( ConfigArgs *c )
 			c->value_ad = mo->mo_ad_memberof;
 			break;
 
+		case MO_ADDCHECK:
+			c->value_int = MEMBEROF_ADDCHECK( mo );
+			break;
+
 		default:
 			assert( 0 );
 			return 1;
@@ -1937,6 +2043,10 @@ mo_cf_gen( ConfigArgs *c )
 			memberof_make_member_filter( mo );
 			break;
 
+		case MO_ADDCHECK:
+			mo->mo_flags &= ~MEMBEROF_FADDCHECK;
+			break;
+
 		default:
 			assert( 0 );
 			return 1;
@@ -2046,6 +2156,15 @@ mo_cf_gen( ConfigArgs *c )
 			memberof_make_member_filter( mo );
 			} break;
 
+		case MO_ADDCHECK:
+			if ( c->value_int ) {
+				mo->mo_flags |= MEMBEROF_FADDCHECK;
+
+			} else {
+				mo->mo_flags &= ~MEMBEROF_FADDCHECK;
+			}
+			break;
+
 		default:
 			assert( 0 );
 			return 1;
diff --git a/servers/slapd/overlays/nestgroup.c b/servers/slapd/overlays/nestgroup.c
new file mode 100644
index 0000000..ca5c928
--- /dev/null
+++ b/servers/slapd/overlays/nestgroup.c
@@ -0,0 +1,909 @@
+/* nestgroup.c - nested group overlay */
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 2024 The OpenLDAP Foundation.
+ * Copyright 2024 by Howard Chu.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* ACKNOWLEDGEMENTS:
+ * This work was initially developed by Howard Chu for inclusion in
+ * OpenLDAP Software.
+ */
+
+#include "portable.h"
+
+#ifdef SLAPD_OVER_NESTGROUP
+
+#include <stdio.h>
+
+#include <ac/string.h>
+#include <ac/socket.h>
+
+#include "lutil.h"
+#include "slap.h"
+#include "slap-config.h"
+
+/* This overlay dynamically constructs member and memberOf attributes
+ * for nested groups.
+ */
+
+#define SLAPD_MEMBEROF_ATTR	"memberOf"
+
+#define NG_MBR_VALUES	0x01
+#define NG_MBR_FILTER	0x02
+#define NG_MOF_VALUES	0x04
+#define NG_MOF_FILTER	0x08
+#define NG_NEGATED		0x10
+
+static AttributeDescription *ad_member;
+static AttributeDescription *ad_memberOf;
+
+static slap_verbmasks nestgroup_flags[] = {
+	{ BER_BVC("member-values"),	NG_MBR_VALUES },
+	{ BER_BVC("member-filter"),	NG_MBR_FILTER },
+	{ BER_BVC("memberof-values"),	NG_MOF_VALUES },
+	{ BER_BVC("memberof-filter"),	NG_MOF_FILTER },
+	{ BER_BVNULL,	0 }
+};
+
+enum {
+	NG_MEMBER = 1,
+	NG_MEMBEROF,
+	NG_GROUPBASE,
+	NG_FLAGS
+};
+
+typedef struct nestgroup_info_t {
+	AttributeDescription *ngi_member;
+	AttributeDescription *ngi_memberOf;
+	BerVarray ngi_groupBase;
+	BerVarray ngi_ngroupBase;
+	int ngi_flags;
+} nestgroup_info_t;
+
+static int ngroup_cf( ConfigArgs *c )
+{
+	slap_overinst *on = (slap_overinst *)c->bi;
+	nestgroup_info_t *ngi = (nestgroup_info_t *)on->on_bi.bi_private;
+	int rc = 1;
+
+	if ( c->op == SLAP_CONFIG_EMIT ) {
+		switch( c->type ) {
+		case NG_MEMBER:
+			if ( ngi->ngi_member ) {
+				value_add_one( &c->rvalue_vals, &ngi->ngi_member->ad_cname );
+				rc = 0;
+			}
+			break;
+		case NG_MEMBEROF:
+			if ( ngi->ngi_memberOf ) {
+				value_add_one( &c->rvalue_vals, &ngi->ngi_memberOf->ad_cname );
+				rc = 0;
+			}
+			break;
+		case NG_GROUPBASE:
+			if ( ngi->ngi_groupBase ) {
+				value_add( &c->rvalue_vals, ngi->ngi_groupBase );
+				value_add( &c->rvalue_nvals, ngi->ngi_ngroupBase );
+				rc = 0;
+			}
+			break;
+		case NG_FLAGS:
+			return mask_to_verbs( nestgroup_flags, ngi->ngi_flags, &c->rvalue_vals );
+		default:
+			break;
+		}
+		return rc;
+	} else if ( c->op == LDAP_MOD_DELETE ) {
+		switch( c->type ) {
+		case NG_MEMBER:
+			ngi->ngi_member = ad_member;
+			rc = 0;
+			break;
+		case NG_MEMBEROF:
+			ngi->ngi_memberOf = ad_memberOf;
+			rc = 0;
+			break;
+		case NG_GROUPBASE:
+			if ( c->valx < 0 ) {
+				ber_bvarray_free( ngi->ngi_groupBase );
+				ber_bvarray_free( ngi->ngi_ngroupBase );
+				ngi->ngi_groupBase = NULL;
+				ngi->ngi_ngroupBase = NULL;
+			} else {
+				int i = c->valx;
+				ch_free( ngi->ngi_groupBase[i].bv_val );
+				ch_free( ngi->ngi_ngroupBase[i].bv_val );
+				do {
+					ngi->ngi_groupBase[i] = ngi->ngi_groupBase[i+1];
+					ngi->ngi_ngroupBase[i] = ngi->ngi_ngroupBase[i+1];
+					i++;
+				} while ( !BER_BVISNULL( &ngi->ngi_groupBase[i] ));
+			}
+			rc = 0;
+			break;
+		case NG_FLAGS:
+			if ( !c->line ) {
+				ngi->ngi_flags = 0;
+			} else {
+				int i = verb_to_mask( c->line, nestgroup_flags );
+				ngi->ngi_flags &= ~nestgroup_flags[i].mask;
+			}
+			rc = 0;
+			break;
+		default:
+			break;
+		}
+		return rc;
+	}
+
+	switch( c->type ) {
+	case NG_MEMBER:
+		if ( !is_at_syntax( c->value_ad->ad_type, SLAPD_DN_SYNTAX ) &&
+			!is_at_syntax( c->value_ad->ad_type, SLAPD_NAMEUID_SYNTAX )) {
+			snprintf( c->cr_msg, sizeof( c->cr_msg ),
+				"member attribute=\"%s\" must use DN (%s) or NAMEUID (%s) syntax",
+				c->argv[1], SLAPD_DN_SYNTAX, SLAPD_NAMEUID_SYNTAX );
+			Debug( LDAP_DEBUG_CONFIG|LDAP_DEBUG_NONE,
+				"%s: %s\n", c->log, c->cr_msg );
+			return ARG_BAD_CONF;
+		}
+		ngi->ngi_member = c->value_ad;
+		rc = 0;
+		break;
+	case NG_MEMBEROF:
+		if ( !is_at_syntax( c->value_ad->ad_type, SLAPD_DN_SYNTAX ) &&
+			!is_at_syntax( c->value_ad->ad_type, SLAPD_NAMEUID_SYNTAX )) {
+			snprintf( c->cr_msg, sizeof( c->cr_msg ),
+				"memberOf attribute=\"%s\" must use DN (%s) or NAMEUID (%s) syntax",
+				c->argv[1], SLAPD_DN_SYNTAX, SLAPD_NAMEUID_SYNTAX );
+			Debug( LDAP_DEBUG_CONFIG|LDAP_DEBUG_NONE,
+				"%s: %s\n", c->log, c->cr_msg );
+			return ARG_BAD_CONF;
+		}
+		ngi->ngi_memberOf = c->value_ad;
+		rc = 0;
+		break;
+	case NG_GROUPBASE:
+		ber_bvarray_add( &ngi->ngi_groupBase, &c->value_dn );
+		ber_bvarray_add( &ngi->ngi_ngroupBase, &c->value_ndn );
+		rc = 0;
+		break;
+	case NG_FLAGS: {
+		slap_mask_t flags = 0;
+		int i;
+		if ( c->op != SLAP_CONFIG_ADD && c->argc > 2 ) {
+			/* We wouldn't know how to delete these values later */
+			snprintf( c->cr_msg, sizeof( c->cr_msg ),
+				"Please insert multiple names as separate %s values",
+				c->argv[0] );
+			Debug( LDAP_DEBUG_CONFIG|LDAP_DEBUG_NONE,
+				"%s: %s\n", c->log, c->cr_msg );
+			rc = LDAP_INVALID_SYNTAX;
+			break;
+		}
+		i = verbs_to_mask( c->argc, c->argv, nestgroup_flags, &flags );
+		if ( i ) {
+			snprintf( c->cr_msg, sizeof( c->cr_msg ), "<%s> unknown option", c->argv[0] );
+			Debug(LDAP_DEBUG_ANY, "%s: %s %s\n",
+				c->log, c->cr_msg, c->argv[i]);
+			return(1);
+		}
+		ngi->ngi_flags |= flags;
+		rc = 0;
+		break; }
+	default:
+		break;
+	}
+
+	return rc;
+}
+
+static ConfigTable ngroupcfg[] = {
+	{ "nestgroup-member", "member-ad", 2, 2, 0,
+	  ARG_MAGIC|ARG_ATDESC|NG_MEMBER, ngroup_cf,
+	  "( OLcfgOvAt:25.1 NAME 'olcNestGroupMember' "
+	  "EQUALITY caseIgnoreMatch "
+	  "DESC 'Member attribute' "
+	  "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
+	{ "nestgroup-memberof", "memberOf-ad", 2, 2, 0,
+	  ARG_MAGIC|ARG_ATDESC|NG_MEMBEROF, ngroup_cf,
+	  "( OLcfgOvAt:25.2 NAME 'olcNestGroupMemberOf' "
+	  "EQUALITY caseIgnoreMatch "
+	  "DESC 'MemberOf attribute' "
+	  "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
+	{ "nestgroup-base", "dn", 2, 2, 0,
+	  ARG_DN|ARG_QUOTE|ARG_MAGIC|NG_GROUPBASE, ngroup_cf,
+	  "( OLcfgOvAt:25.3 NAME 'olcNestGroupBase' "
+	  "EQUALITY distinguishedNameMatch "
+	  "DESC 'Base[s] of group subtree[s]' "
+	  "SYNTAX OMsDN )", NULL, NULL },
+	{ "nestgroup-flags", "options", 2, 0, 0,
+	  ARG_MAGIC|NG_FLAGS, ngroup_cf,
+	  "( OLcfgOvAt:25.4 NAME 'olcNestGroupFlags' "
+	  "EQUALITY caseIgnoreMatch "
+	  "DESC 'Features to use' "
+	  "SYNTAX OMsDirectoryString )", NULL, NULL },
+	{ NULL, NULL, 0, 0, 0, ARG_IGNORED }
+};
+
+static ConfigOCs ngroupocs[] = {
+	{ "( OLcfgOvOc:25.1 "
+	  "NAME 'olcNestGroupConfig' "
+	  "DESC 'Nested Group configuration' "
+	  "SUP olcOverlayConfig "
+	  "MAY ( olcNestGroupMember $ olcNestGroupMemberOf $ "
+	  " olcNestGroupBase $ olcNestGroupFlags ) ) ",
+	  Cft_Overlay, ngroupcfg },
+	{ NULL, 0, NULL }
+};
+
+typedef struct nestgroup_filterinst_t {
+	Filter *nf_f;
+	Filter *nf_new;
+	Entry *nf_e;
+} nestgroup_filterinst_t;
+
+/* Record occurrences of ad in filter. Ignore in negated filters. */
+static void
+nestgroup_filter_instances( Operation *op, AttributeDescription *ad, Filter *f, int not,
+	int *nfn, nestgroup_filterinst_t **nfp, int *negated )
+{
+	if ( !f )
+		return;
+
+	switch( f->f_choice & SLAPD_FILTER_MASK ) {
+	case LDAP_FILTER_EQUALITY:
+		if ( f->f_av_desc == ad ) {
+			if ( not ) {
+				*negated = 1;
+			} else {
+				nestgroup_filterinst_t *nf = *nfp;
+				int n = *nfn;
+				nf = op->o_tmprealloc( nf, (n + 1) * sizeof(nestgroup_filterinst_t), op->o_tmpmemctx );
+				nf[n].nf_f = f;
+				nf[n].nf_new = NULL;
+				nf[n++].nf_e = NULL;
+				*nfp = nf;
+				*nfn = n;
+			}
+		}
+		break;
+	case SLAPD_FILTER_COMPUTED:
+	case LDAP_FILTER_PRESENT:
+	case LDAP_FILTER_GE:
+	case LDAP_FILTER_LE:
+	case LDAP_FILTER_APPROX:
+	case LDAP_FILTER_SUBSTRINGS:
+	case LDAP_FILTER_EXT:
+		break;
+	case LDAP_FILTER_NOT:	not ^= 1;
+		/* FALLTHRU */
+	case LDAP_FILTER_AND:
+	case LDAP_FILTER_OR:
+		for ( f = f->f_list; f; f = f->f_next )
+			nestgroup_filter_instances( op, ad, f, not, nfn, nfp, negated );
+	}
+}
+
+static int
+nestgroup_check_needed( Operation *op, int attrflags, AttributeDescription *ad )
+{
+	if ( is_at_operational( ad->ad_type )) {
+		if ( SLAP_OPATTRS( attrflags ))
+			return 1;
+	} else {
+		if ( SLAP_USERATTRS( attrflags ))
+			return 1;
+	}
+	return ( ad_inlist( ad, op->ors_attrs ));
+}
+
+typedef struct DNpair {
+	struct berval dp_ndn;
+	struct berval dp_dn;
+	struct DNpair *dp_next;
+	int dp_flag;
+} DNpair;
+
+typedef struct gdn_info {
+	TAvlnode *gi_DNs;
+	DNpair *gi_DNlist;
+	nestgroup_info_t *gi_ngi;
+	int gi_numDNs;
+	int gi_saveDN;
+	Attribute *gi_merge;
+} gdn_info;
+
+static int
+nestgroup_dncmp( const void *v1, const void *v2 )
+{
+	return ber_bvcmp((const struct berval *)v1, (const struct berval *)v2);
+}
+
+static int
+nestgroup_gotDNresp( Operation *op, SlapReply *rs )
+{
+	if ( rs->sr_type == REP_SEARCH ) {
+		gdn_info *gi = (gdn_info *)(op->o_callback+1);
+		DNpair *dp = op->o_tmpalloc( sizeof(DNpair), op->o_tmpmemctx );
+		dp->dp_ndn = rs->sr_entry->e_nname;
+		if ( ldap_tavl_insert( &gi->gi_DNs, dp, nestgroup_dncmp, ldap_avl_dup_error )) {
+			op->o_tmpfree( dp, op->o_tmpmemctx );
+		} else {
+			ber_dupbv_x( &dp->dp_ndn, &rs->sr_entry->e_nname, op->o_tmpmemctx );
+			if ( gi->gi_saveDN )
+				ber_dupbv_x( &dp->dp_dn, &rs->sr_entry->e_name, op->o_tmpmemctx );
+			gi->gi_numDNs++;
+			dp->dp_next = gi->gi_DNlist;
+			dp->dp_flag = 0;
+			gi->gi_DNlist = dp;
+		}
+	}
+	return 0;
+}
+
+static void
+nestgroup_get_parentDNs( Operation *op, struct berval *ndn )
+{
+	SlapReply r = { REP_SEARCH };
+	gdn_info *gi = (gdn_info *)(op->o_callback+1);
+	nestgroup_info_t *ngi = gi->gi_ngi;
+	int i;
+
+	op->ors_filter->f_av_value = *ndn;
+	for ( i=0; !BER_BVISEMPTY( &ngi->ngi_ngroupBase[i] ); i++ ) {
+		op->o_req_dn = ngi->ngi_groupBase[i];
+		op->o_req_ndn = ngi->ngi_ngroupBase[i];
+		op->o_bd->be_search( op, &r );
+	}
+	gi->gi_numDNs = 0; /* ignore first count, that's just the original member= result set */
+
+	while ( gi->gi_DNlist ) {
+		int prevnum;
+		DNpair *dp = gi->gi_DNlist;
+		gi->gi_DNlist = NULL;
+		for ( ; dp; dp=dp->dp_next ) {
+			op->ors_filter->f_av_value = dp->dp_ndn;
+			prevnum = gi->gi_numDNs;
+			for ( i=0; !BER_BVISEMPTY( &ngi->ngi_ngroupBase[i] ); i++ ) {
+				op->o_req_dn = ngi->ngi_groupBase[i];
+				op->o_req_ndn = ngi->ngi_ngroupBase[i];
+				op->o_bd->be_search( op, &r );
+			}
+			if ( gi->gi_numDNs > prevnum )
+				dp->dp_flag = 1;	/* this group had a parent */
+		}
+	}
+}
+
+static void
+nestgroup_memberFilter( Operation *op, int mbr_nf, nestgroup_filterinst_t *mbr_f )
+{
+	slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
+	nestgroup_info_t *ngi = on->on_bi.bi_private;
+	AttributeDescription *ad = mbr_f[0].nf_f->f_av_desc;
+	slap_callback *sc;
+	gdn_info *gi;
+	Filter mf;
+	AttributeAssertion mava;
+	Operation o = *op;
+	int i;
+
+	o.o_managedsait = SLAP_CONTROL_CRITICAL;
+	sc = op->o_tmpcalloc( 1, sizeof(slap_callback) + sizeof(gdn_info), op->o_tmpmemctx);
+	gi = (gdn_info *)(sc+1);
+	gi->gi_ngi = ngi;
+	o.o_callback = sc;
+	sc->sc_response = nestgroup_gotDNresp;
+	o.ors_attrs = slap_anlist_no_attrs;
+
+	mf.f_choice = LDAP_FILTER_EQUALITY;
+	mf.f_ava = &mava;
+	mf.f_av_desc = ad;
+	mf.f_next = NULL;
+
+	o.ors_scope = LDAP_SCOPE_SUBTREE;
+	o.ors_deref = LDAP_DEREF_NEVER;
+	o.ors_limit = NULL;
+	o.ors_tlimit = SLAP_NO_LIMIT;
+	o.ors_slimit = SLAP_NO_LIMIT;
+	o.ors_filter = &mf;
+	o.o_bd->bd_info = (BackendInfo *)on->on_info;
+
+	for ( i=0; i<mbr_nf; i++ ) {
+		gi->gi_DNs = NULL;
+		gi->gi_numDNs = 0;
+		nestgroup_get_parentDNs( &o, &mbr_f[i].nf_f->f_av_value );
+		if ( gi->gi_numDNs ) {
+			int j;
+			Filter *f, *nf;
+			TAvlnode *t;
+			DNpair *dp;
+
+			f = op->o_tmpalloc( sizeof(Filter), op->o_tmpmemctx );
+			f->f_next = NULL;
+			t = ldap_tavl_end( gi->gi_DNs, TAVL_DIR_RIGHT );
+			do {
+				dp = t->avl_data;
+				if ( dp->dp_flag ) {
+					nf = f;
+					nf->f_ava = op->o_tmpcalloc( 1, sizeof( AttributeAssertion ), op->o_tmpmemctx );
+					nf->f_choice = LDAP_FILTER_EQUALITY;
+					nf->f_av_desc = ad;
+					nf->f_av_value = dp->dp_ndn;
+					f = op->o_tmpalloc( sizeof(Filter), op->o_tmpmemctx );
+					f->f_next = nf;
+				}
+				t = ldap_tavl_next( t, TAVL_DIR_LEFT );
+				op->o_tmpfree( dp, op->o_tmpmemctx );
+			} while ( t );
+			ldap_tavl_free( gi->gi_DNs, NULL );
+			f->f_choice = LDAP_FILTER_EQUALITY;
+			f->f_ava = mbr_f[i].nf_f->f_ava;
+			mbr_f[i].nf_new = f;
+		}
+	}
+	o.o_bd->bd_info = (BackendInfo *)on->on_info;
+	op->o_tmpfree( sc, op->o_tmpmemctx );
+}
+
+static void
+nestgroup_addUnique( Operation *op, Attribute *old, Attribute *new )
+{
+	/* strip out any duplicates from new before adding */
+	struct berval *bv, *nbv;
+	int i, j, flags;
+
+	bv = op->o_tmpalloc( (new->a_numvals + 1) * 2 * sizeof(struct berval), op->o_tmpmemctx );
+	nbv = bv + new->a_numvals+1;
+
+	flags = SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH|SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH;
+	for (i=0,j=0; i<new->a_numvals; i++) {
+		int rc = attr_valfind( old, flags, &new->a_nvals[i], NULL, NULL );
+		if ( rc ) {
+			bv[j] = new->a_vals[i];
+			nbv[j++] = new->a_nvals[i];
+		}
+	}
+	BER_BVZERO( &bv[j] );
+	BER_BVZERO( &nbv[j] );
+	attr_valadd( old, bv, nbv, j );
+	op->o_tmpfree( bv, op->o_tmpmemctx );
+}
+
+static void
+nestgroup_get_childDNs( Operation *op, slap_overinst *on, gdn_info *gi, struct berval *ndn )
+{
+	nestgroup_info_t *ngi = on->on_bi.bi_private;
+	Entry *e;
+	Attribute *a;
+
+	if ( overlay_entry_get_ov( op, ndn, NULL, NULL, 0, &e, on ) != LDAP_SUCCESS || e == NULL )
+		return;
+
+	a = attr_find( e->e_attrs, ngi->ngi_member );
+	if ( a ) {
+		int i, j;
+		for (i = 0; i<a->a_numvals; i++ ) {
+			/* record all group entries */
+			for (j = 0; !BER_BVISEMPTY( &ngi->ngi_groupBase[j] ); j++) {
+				if ( dnIsSuffix( &a->a_nvals[i], &ngi->ngi_ngroupBase[j] )) {
+					DNpair *dp = op->o_tmpalloc( sizeof(DNpair), op->o_tmpmemctx );
+					dp->dp_ndn = a->a_nvals[i];
+					if ( ldap_tavl_insert( &gi->gi_DNs, dp, nestgroup_dncmp, ldap_avl_dup_error )) {
+						op->o_tmpfree( dp, op->o_tmpmemctx );
+					} else {
+						ber_dupbv_x( &dp->dp_ndn, &a->a_nvals[i], op->o_tmpmemctx );
+						gi->gi_numDNs++;
+						dp->dp_next = gi->gi_DNlist;
+						gi->gi_DNlist = dp;
+					}
+					break;
+				}
+			}
+		}
+		if ( gi->gi_merge ) {
+			nestgroup_addUnique( op, gi->gi_merge, a );
+		}
+	}
+	overlay_entry_release_ov( op, e, 0, on );
+}
+
+static void
+nestgroup_memberOfFilter( Operation *op, int mof_nf, nestgroup_filterinst_t *mof_f )
+{
+	slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
+	AttributeDescription *ad = mof_f[0].nf_f->f_av_desc;
+	gdn_info gi = {0};
+	int i;
+
+	for ( i=0; i<mof_nf; i++ ) {
+		gi.gi_DNs = NULL;
+		gi.gi_numDNs = 0;
+		nestgroup_get_childDNs( op, on, &gi, &mof_f[i].nf_f->f_av_value );
+
+		while ( gi.gi_DNlist ) {
+			DNpair *dp = gi.gi_DNlist;
+			gi.gi_DNlist = NULL;
+			for ( ; dp; dp=dp->dp_next ) {
+				nestgroup_get_childDNs( op, on, &gi, &dp->dp_ndn );
+			}
+		}
+
+		if ( gi.gi_numDNs ) {
+			int j;
+			Filter *f, *nf;
+			TAvlnode *t;
+			DNpair *dp;
+
+			f = op->o_tmpalloc( sizeof(Filter), op->o_tmpmemctx );
+			f->f_next = NULL;
+			t = ldap_tavl_end( gi.gi_DNs, TAVL_DIR_RIGHT );
+			do {
+				dp = t->avl_data;
+				nf = f;
+				nf->f_ava = op->o_tmpcalloc( 1, sizeof( AttributeAssertion ), op->o_tmpmemctx );
+				nf->f_choice = LDAP_FILTER_EQUALITY;
+				nf->f_av_desc = ad;
+				nf->f_av_value = dp->dp_ndn;
+				f = op->o_tmpalloc( sizeof(Filter), op->o_tmpmemctx );
+				f->f_next = nf;
+				t = ldap_tavl_next( t, TAVL_DIR_LEFT );
+				op->o_tmpfree( dp, op->o_tmpmemctx );
+			} while ( t );
+			ldap_tavl_free( gi.gi_DNs, NULL );
+			f->f_choice = LDAP_FILTER_EQUALITY;
+			f->f_ava = mof_f[i].nf_f->f_ava;
+			mof_f[i].nf_new = f;
+		}
+	}
+}
+
+static void
+nestgroup_memberOfVals( Operation *op, slap_overinst *on, Attribute *a )
+{
+	nestgroup_info_t *ngi = on->on_bi.bi_private;
+	Operation o = *op;
+	slap_callback *sc;
+	gdn_info *gi;
+	Filter mf;
+	AttributeAssertion mava;
+	int i;
+
+	o.o_managedsait = SLAP_CONTROL_CRITICAL;
+	sc = op->o_tmpcalloc( 1, sizeof(slap_callback) + sizeof(gdn_info), op->o_tmpmemctx);
+	gi = (gdn_info *)(sc+1);
+	gi->gi_ngi = ngi;
+	o.o_callback = sc;
+	sc->sc_response = nestgroup_gotDNresp;
+	o.ors_attrs = slap_anlist_no_attrs;
+
+	mf.f_choice = LDAP_FILTER_EQUALITY;
+	mf.f_ava = &mava;
+	mf.f_av_desc = ngi->ngi_member;
+	mf.f_next = NULL;
+
+	o.ors_filter = &mf;
+	o.ors_scope = LDAP_SCOPE_SUBTREE;
+	o.ors_deref = LDAP_DEREF_NEVER;
+	o.ors_limit = NULL;
+	o.ors_tlimit = SLAP_NO_LIMIT;
+	o.ors_slimit = SLAP_NO_LIMIT;
+	o.o_bd->bd_info = (BackendInfo *)on->on_info;
+	gi->gi_saveDN = 1;
+
+	for ( i=0; i<a->a_numvals; i++ ) {
+		nestgroup_get_parentDNs( &o, &a->a_nvals[i] );
+
+		while ( gi->gi_DNlist ) {
+			DNpair *dp = gi->gi_DNlist;
+			gi->gi_DNlist = NULL;
+			for ( ; dp; dp=dp->dp_next ) {
+				nestgroup_get_parentDNs( &o, &dp->dp_ndn );
+			}
+		}
+	}
+	if ( gi->gi_DNs ) {
+		TAvlnode *p = ldap_tavl_end( gi->gi_DNs, TAVL_DIR_LEFT );
+		int flags = SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH|SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH;
+		do {
+			DNpair *dp = p->avl_data;
+			int rc = attr_valfind( a, flags, &dp->dp_ndn, NULL, NULL );
+			if ( rc )
+				attr_valadd( a, &dp->dp_dn, &dp->dp_ndn, 1 );
+			op->o_tmpfree( dp->dp_dn.bv_val, op->o_tmpmemctx );
+			op->o_tmpfree( dp->dp_ndn.bv_val, op->o_tmpmemctx );
+			op->o_tmpfree( dp, op->o_tmpmemctx );
+			p = ldap_tavl_next( p, TAVL_DIR_RIGHT );
+		} while ( p );
+		ldap_tavl_free( gi->gi_DNs, NULL );
+	}
+	o.o_bd->bd_info = (BackendInfo *)on->on_info;
+	op->o_tmpfree( sc, op->o_tmpmemctx );
+}
+
+typedef struct nestgroup_cbinfo {
+	slap_overinst *nc_on;
+	int nc_needed;
+} nestgroup_cbinfo;
+
+static int
+nestgroup_searchresp( Operation *op, SlapReply *rs )
+{
+	if (rs->sr_type == REP_SEARCH ) {
+		nestgroup_cbinfo *nc = op->o_callback->sc_private;
+		slap_overinst *on = nc->nc_on;
+		nestgroup_info_t *ngi = on->on_bi.bi_private;
+		Attribute *a;
+
+		if ( nc->nc_needed & NG_MBR_VALUES ) {
+			a = attr_find( rs->sr_entry->e_attrs, ngi->ngi_member );
+			if ( a ) {
+				gdn_info gi = {0};
+				int i, j;
+				if ( !( rs->sr_flags & REP_ENTRY_MODIFIABLE )) {
+					Entry *e = entry_dup( rs->sr_entry );
+					rs_replace_entry( op, rs, on, e );
+					rs->sr_flags |= REP_ENTRY_MODIFIABLE | REP_ENTRY_MUSTBEFREED;
+					a = attr_find( e->e_attrs, ngi->ngi_member );
+				}
+				gi.gi_merge = a;
+
+				for ( i=0; i<a->a_numvals; i++ ) {
+					for ( j=0; !BER_BVISEMPTY( &ngi->ngi_ngroupBase[j] ); j++ ) {
+						if ( dnIsSuffix( &a->a_nvals[i], &ngi->ngi_ngroupBase[j] )) {
+							nestgroup_get_childDNs( op, on, &gi, &a->a_nvals[i] );
+
+							while ( gi.gi_DNlist ) {
+								DNpair *dp = gi.gi_DNlist;
+								gi.gi_DNlist = NULL;
+								for ( ; dp; dp=dp->dp_next ) {
+									nestgroup_get_childDNs( op, on, &gi, &dp->dp_ndn );
+								}
+							}
+							break;
+						}
+					}
+				}
+				if ( gi.gi_numDNs ) {
+					TAvlnode *p = ldap_tavl_end( gi.gi_DNs, TAVL_DIR_LEFT );
+					do {
+						DNpair *dp = p->avl_data;
+						op->o_tmpfree( dp->dp_ndn.bv_val, op->o_tmpmemctx );
+						op->o_tmpfree( dp, op->o_tmpmemctx );
+						p = ldap_tavl_next( p, TAVL_DIR_RIGHT );
+					} while ( p );
+					ldap_tavl_free( gi.gi_DNs, NULL );
+				}
+			}
+		}
+
+		if ( nc->nc_needed & NG_MOF_VALUES ) {
+			a = attr_find( rs->sr_entry->e_attrs, ngi->ngi_memberOf );
+			if ( a ) {
+				if ( !( rs->sr_flags & REP_ENTRY_MODIFIABLE )) {
+					Entry *e = entry_dup( rs->sr_entry );
+					rs_replace_entry( op, rs, on, e );
+					rs->sr_flags |= REP_ENTRY_MODIFIABLE | REP_ENTRY_MUSTBEFREED;
+					a = attr_find( e->e_attrs, ngi->ngi_memberOf );
+				}
+				nestgroup_memberOfVals( op, on, a );
+			}
+		}
+		if (( nc->nc_needed & NG_NEGATED ) &&
+			test_filter( op, rs->sr_entry, op->ors_filter ) != LDAP_COMPARE_TRUE )
+			return 0;
+	}
+	return SLAP_CB_CONTINUE;
+}
+
+static int
+nestgroup_op_search( Operation *op, SlapReply *rs )
+{
+	slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
+	nestgroup_info_t *ngi = on->on_bi.bi_private;
+	int mbr_nf = 0, mof_nf = 0, negated = 0;
+	nestgroup_filterinst_t *mbr_f = NULL, *mof_f = NULL;
+
+	if ( get_manageDSAit( op ))
+		return SLAP_CB_CONTINUE;
+
+	/* groupBase must be explicitly configured */
+	if ( !ngi->ngi_ngroupBase )
+		return SLAP_CB_CONTINUE;
+
+	/* handle attrs in filter */
+	if ( ngi->ngi_flags & NG_MBR_FILTER ) {
+		nestgroup_filter_instances( op, ngi->ngi_member, op->ors_filter, 0, &mbr_nf, &mbr_f, &negated );
+		if ( mbr_nf ) {
+			/* find member=(parent groups) */
+			nestgroup_memberFilter( op, mbr_nf, mbr_f );
+		}
+	}
+	if ( ngi->ngi_flags & NG_MOF_FILTER ) {
+		nestgroup_filter_instances( op, ngi->ngi_memberOf, op->ors_filter, 0, &mof_nf, &mof_f, &negated );
+		if ( mof_nf ) {
+			/* find memberOf=(child groups) */
+			nestgroup_memberOfFilter( op, mof_nf, mof_f );
+		}
+	}
+	if ( mbr_nf ) {
+		int i;
+		for ( i=0; i<mbr_nf; i++ ) {
+			if ( mbr_f[i].nf_new ) {
+				mbr_f[i].nf_f->f_choice = LDAP_FILTER_OR;
+				mbr_f[i].nf_f->f_list = mbr_f[i].nf_new;
+			}
+		}
+		op->o_tmpfree( mbr_f, op->o_tmpmemctx );
+	}
+	if ( mof_nf ) {
+		int i;
+		for ( i=0; i<mof_nf; i++ ) {
+			if ( mof_f[i].nf_new ) {
+				mof_f[i].nf_f->f_choice = LDAP_FILTER_OR;
+				mof_f[i].nf_f->f_list = mof_f[i].nf_new;
+			}
+		}
+		op->o_tmpfree( mof_f, op->o_tmpmemctx );
+	}
+
+	if ( ngi->ngi_flags & ( NG_MBR_VALUES|NG_MOF_VALUES )) {
+		/* check for attrs in attrlist */
+		int attrflags = slap_attr_flags( op->ors_attrs );
+		int needed = 0;
+		if (( ngi->ngi_flags & NG_MBR_VALUES ) &&
+			nestgroup_check_needed( op, attrflags, ngi->ngi_member )) {
+			/* collect all members from child groups */
+			needed |= NG_MBR_VALUES;
+		}
+		if (( ngi->ngi_flags & NG_MOF_VALUES ) &&
+			nestgroup_check_needed( op, attrflags, ngi->ngi_memberOf )) {
+			/* collect DNs of all parent groups */
+			needed |= NG_MOF_VALUES;
+		}
+		if ( needed ) {
+			nestgroup_cbinfo *nc;
+			slap_callback *sc = op->o_tmpcalloc( 1, sizeof(slap_callback)+sizeof(nestgroup_cbinfo), op->o_tmpmemctx );
+			nc = (nestgroup_cbinfo *)(sc+1);
+			sc->sc_private = nc;
+			nc->nc_needed = needed;
+			nc->nc_on = on;
+			sc->sc_response = nestgroup_searchresp;
+			sc->sc_next = op->o_callback;
+			op->o_callback = sc;
+			if ( negated ) nc->nc_needed |= NG_NEGATED;
+		}
+	}
+	return SLAP_CB_CONTINUE;
+}
+
+static int
+nestgroup_db_init(
+	BackendDB *be,
+	ConfigReply *cr)
+{
+	slap_overinst *on = (slap_overinst *)be->bd_info;
+	nestgroup_info_t *ngi;
+	int rc;
+	const char *text = NULL;
+
+	ngi = (nestgroup_info_t *)ch_calloc( 1, sizeof( *ngi ));
+	on->on_bi.bi_private = ngi;
+
+	if ( !ad_memberOf ) {
+		rc = slap_str2ad( SLAPD_MEMBEROF_ATTR, &ad_memberOf, &text );
+		if ( rc != LDAP_SUCCESS ) {
+			Debug( LDAP_DEBUG_ANY, "nestgroup_db_init: "
+					"unable to find attribute=\"%s\": %s (%d)\n",
+					SLAPD_MEMBEROF_ATTR, text, rc );
+			return rc;
+		}
+	}
+
+	if ( !ad_member ) {
+		rc = slap_str2ad( SLAPD_GROUP_ATTR, &ad_member, &text );
+		if ( rc != LDAP_SUCCESS ) {
+			Debug( LDAP_DEBUG_ANY, "nestgroup_db_init: "
+					"unable to find attribute=\"%s\": %s (%d)\n",
+					SLAPD_GROUP_ATTR, text, rc );
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+static int
+nestgroup_db_open(
+	BackendDB *be,
+	ConfigReply *cr)
+{
+	slap_overinst *on = (slap_overinst *)be->bd_info;
+	nestgroup_info_t *ngi = on->on_bi.bi_private;
+
+	if ( !ngi->ngi_member )
+		ngi->ngi_member = ad_member;
+
+	if ( !ngi->ngi_memberOf )
+		ngi->ngi_memberOf = ad_memberOf;
+
+	return 0;
+}
+
+static int
+nestgroup_db_destroy(
+	BackendDB *be,
+	ConfigReply *cr
+)
+{
+	slap_overinst *on = (slap_overinst *) be->bd_info;
+	nestgroup_info_t *ngi = on->on_bi.bi_private;
+
+	ber_bvarray_free( ngi->ngi_groupBase );
+	ber_bvarray_free( ngi->ngi_ngroupBase );
+	ch_free( ngi );
+
+	return 0;
+}
+
+static slap_overinst nestgroup;
+
+/* This overlay is set up for dynamic loading via moduleload. For static
+ * configuration, you'll need to arrange for the slap_overinst to be
+ * initialized and registered by some other function inside slapd.
+ */
+
+int nestgroup_initialize() {
+	int code;
+
+	code = register_at(
+	"( 1.2.840.113556.1.2.102 "
+	"NAME 'memberOf' "
+	"DESC 'Group that the entry belongs to' "
+	"SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' "
+	"EQUALITY distinguishedNameMatch "	/* added */
+	"USAGE dSAOperation "			/* added; questioned */
+	"NO-USER-MODIFICATION " 		/* added */
+	"X-ORIGIN 'iPlanet Delegated Administrator' )",
+	&ad_memberOf, 0 );
+	if ( code && code != SLAP_SCHERR_ATTR_DUP ) {
+		Debug( LDAP_DEBUG_ANY,
+			"nestgroup_initialize: register_at (memberOf) failed\n" );
+		return code;
+	}
+
+	nestgroup.on_bi.bi_type = "nestgroup";
+	nestgroup.on_bi.bi_db_init = nestgroup_db_init;
+	nestgroup.on_bi.bi_db_open = nestgroup_db_open;
+	nestgroup.on_bi.bi_db_destroy = nestgroup_db_destroy;
+
+	nestgroup.on_bi.bi_op_search = nestgroup_op_search;
+/*	nestgroup.on_bi.bi_op_compare = nestgroup_op_compare; */
+
+	nestgroup.on_bi.bi_cf_ocs = ngroupocs;
+	code = config_register_schema( ngroupcfg, ngroupocs );
+	if ( code ) return code;
+
+	return overlay_register( &nestgroup );
+}
+
+#if SLAPD_OVER_NESTGROUP == SLAPD_MOD_DYNAMIC
+int
+init_module( int argc, char *argv[] )
+{
+	return nestgroup_initialize();
+}
+#endif
+
+#endif /* defined(SLAPD_OVER_NESTGROUP) */
diff --git a/servers/slapd/overlays/otp.c b/servers/slapd/overlays/otp.c
index 590ee50..b39c186 100644
--- a/servers/slapd/overlays/otp.c
+++ b/servers/slapd/overlays/otp.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2015-2022 The OpenLDAP Foundation.
+ * Copyright 2015-2024 The OpenLDAP Foundation.
  * Portions Copyright 2015 by Howard Chu, Symas Corp.
  * Portions Copyright 2016-2017 by Michael Ströder <michael@stroeder.com>
  * Portions Copyright 2018 by Ondřej Kuzník, Symas Corp.
diff --git a/servers/slapd/overlays/overlays.c b/servers/slapd/overlays/overlays.c
index 8290200..6ee4395 100644
--- a/servers/slapd/overlays/overlays.c
+++ b/servers/slapd/overlays/overlays.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2022 The OpenLDAP Foundation.
+ * Copyright 2003-2024 The OpenLDAP Foundation.
  * Copyright 2003 by Howard Chu.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/pcache.c b/servers/slapd/overlays/pcache.c
index 2b947e4..3a1e18a 100644
--- a/servers/slapd/overlays/pcache.c
+++ b/servers/slapd/overlays/pcache.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2022 The OpenLDAP Foundation.
+ * Copyright 2003-2024 The OpenLDAP Foundation.
  * Portions Copyright 2003 IBM Corporation.
  * Portions Copyright 2003-2009 Symas Corporation.
  * All rights reserved.
diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
index 29a77c8..0cdba70 100644
--- a/servers/slapd/overlays/ppolicy.c
+++ b/servers/slapd/overlays/ppolicy.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2004-2022 The OpenLDAP Foundation.
+ * Copyright 2004-2024 The OpenLDAP Foundation.
  * Portions Copyright 2004-2005 Howard Chu, Symas Corporation.
  * Portions Copyright 2004 Hewlett-Packard Company.
  * All rights reserved.
diff --git a/servers/slapd/overlays/refint.c b/servers/slapd/overlays/refint.c
index 201803b..77935a7 100644
--- a/servers/slapd/overlays/refint.c
+++ b/servers/slapd/overlays/refint.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2004-2022 The OpenLDAP Foundation.
+ * Copyright 2004-2024 The OpenLDAP Foundation.
  * Portions Copyright 2004 Symas Corporation.
  * All rights reserved.
  *
@@ -603,6 +603,7 @@ refint_repair(
 	op->o_ndn = op->o_bd->be_rootndn;
 	cache = op->o_do_not_cache;
 	op->o_do_not_cache = 1;
+	op->o_abandon = 0;
 
 	/* search */
 	rc = op->o_bd->be_search( op, &rs );
diff --git a/servers/slapd/overlays/remoteauth.c b/servers/slapd/overlays/remoteauth.c
index 1d60af0..63f784e 100644
--- a/servers/slapd/overlays/remoteauth.c
+++ b/servers/slapd/overlays/remoteauth.c
@@ -2,7 +2,7 @@
 /* remoteauth.c - Overlay to delegate bind processing to a remote server */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2004-2022 The OpenLDAP Foundation.
+ * Copyright 2004-2024 The OpenLDAP Foundation.
  * Portions Copyright 2017-2021 Ondřej Kuzník, Symas Corporation.
  * Portions Copyright 2004-2017 Howard Chu, Symas Corporation.
  * Portions Copyright 2004 Hewlett-Packard Company.
diff --git a/servers/slapd/overlays/retcode.c b/servers/slapd/overlays/retcode.c
index 15052e0..85b8f74 100644
--- a/servers/slapd/overlays/retcode.c
+++ b/servers/slapd/overlays/retcode.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2005-2022 The OpenLDAP Foundation.
+ * Copyright 2005-2024 The OpenLDAP Foundation.
  * Portions Copyright 2005 Pierangelo Masarati <ando@sys-net.it>
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/rwm.c b/servers/slapd/overlays/rwm.c
index af10f6d..d12d7b3 100644
--- a/servers/slapd/overlays/rwm.c
+++ b/servers/slapd/overlays/rwm.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2022 The OpenLDAP Foundation.
+ * Copyright 2003-2024 The OpenLDAP Foundation.
  * Portions Copyright 2003 Pierangelo Masarati.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/rwm.h b/servers/slapd/overlays/rwm.h
index 6753737..1504699 100644
--- a/servers/slapd/overlays/rwm.h
+++ b/servers/slapd/overlays/rwm.h
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 1999-2003 Howard Chu.
  * Portions Copyright 2000-2003 Pierangelo Masarati.
  * All rights reserved.
diff --git a/servers/slapd/overlays/rwmconf.c b/servers/slapd/overlays/rwmconf.c
index a1a9f36..4b3c690 100644
--- a/servers/slapd/overlays/rwmconf.c
+++ b/servers/slapd/overlays/rwmconf.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 1999-2003 Howard Chu.
  * Portions Copyright 2000-2003 Pierangelo Masarati.
  * All rights reserved.
diff --git a/servers/slapd/overlays/rwmdn.c b/servers/slapd/overlays/rwmdn.c
index c67e3cf..fd53002 100644
--- a/servers/slapd/overlays/rwmdn.c
+++ b/servers/slapd/overlays/rwmdn.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 1999-2003 Howard Chu.
  * Portions Copyright 2000-2003 Pierangelo Masarati.
  * All rights reserved.
diff --git a/servers/slapd/overlays/rwmmap.c b/servers/slapd/overlays/rwmmap.c
index 74ffd05..90a800c 100644
--- a/servers/slapd/overlays/rwmmap.c
+++ b/servers/slapd/overlays/rwmmap.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1999-2022 The OpenLDAP Foundation.
+ * Copyright 1999-2024 The OpenLDAP Foundation.
  * Portions Copyright 1999-2003 Howard Chu.
  * Portions Copyright 2000-2003 Pierangelo Masarati.
  * All rights reserved.
diff --git a/servers/slapd/overlays/seqmod.c b/servers/slapd/overlays/seqmod.c
index 503d6a6..64c1c33 100644
--- a/servers/slapd/overlays/seqmod.c
+++ b/servers/slapd/overlays/seqmod.c
@@ -1,7 +1,7 @@
 /* seqmod.c - sequenced modifies */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2004-2022 The OpenLDAP Foundation.
+ * Copyright 2004-2024 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/servers/slapd/overlays/sssvlv.c b/servers/slapd/overlays/sssvlv.c
index 828782a..95803d9 100644
--- a/servers/slapd/overlays/sssvlv.c
+++ b/servers/slapd/overlays/sssvlv.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2009-2022 The OpenLDAP Foundation.
+ * Copyright 2009-2024 The OpenLDAP Foundation.
  * Portions copyright 2009 Symas Corporation.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/syncprov.c b/servers/slapd/overlays/syncprov.c
index f208846..6739e24 100644
--- a/servers/slapd/overlays/syncprov.c
+++ b/servers/slapd/overlays/syncprov.c
@@ -2,7 +2,7 @@
 /* syncprov.c - syncrepl provider */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2004-2022 The OpenLDAP Foundation.
+ * Copyright 2004-2024 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -3878,14 +3878,14 @@ sp_cf_gen(ConfigArgs *c)
 		break;
 	case SP_NOPRES:
 		si->si_nopres = c->value_int;
-		break;
-	case SP_USEHINT:
-		si->si_usehint = c->value_int;
-		if ( si->si_usehint ) {
+		if ( si->si_nopres ) {
 			/* Consider we might be a delta provider, but it's ok if not */
 			(void)syncprov_setup_accesslog();
 		}
 		break;
+	case SP_USEHINT:
+		si->si_usehint = c->value_int;
+		break;
 	case SP_LOGDB:
 		if ( si->si_logs ) {
 			Debug( LDAP_DEBUG_ANY, "syncprov_config: while configuring "
diff --git a/servers/slapd/overlays/translucent.c b/servers/slapd/overlays/translucent.c
index 09b12dc..0b2fa4c 100644
--- a/servers/slapd/overlays/translucent.c
+++ b/servers/slapd/overlays/translucent.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2004-2022 The OpenLDAP Foundation.
+ * Copyright 2004-2024 The OpenLDAP Foundation.
  * Portions Copyright 2005 Symas Corporation.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/unique.c b/servers/slapd/overlays/unique.c
index 561d86d..c3913af 100644
--- a/servers/slapd/overlays/unique.c
+++ b/servers/slapd/overlays/unique.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2004-2022 The OpenLDAP Foundation.
+ * Copyright 2004-2024 The OpenLDAP Foundation.
  * Portions Copyright 2004,2006-2007 Symas Corporation.
  * All rights reserved.
  *
diff --git a/servers/slapd/overlays/valsort.c b/servers/slapd/overlays/valsort.c
index 3d998e2..6cc95f7 100644
--- a/servers/slapd/overlays/valsort.c
+++ b/servers/slapd/overlays/valsort.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2005-2022 The OpenLDAP Foundation.
+ * Copyright 2005-2024 The OpenLDAP Foundation.
  * Portions copyright 2005 Symas Corporation.
  * All rights reserved.
  *
@@ -201,7 +201,7 @@ valsort_cf_func(ConfigArgs *c) {
 		return(1);
 	}
 
-	for ( vip = &on->on_bi.bi_private; *vip; vip = &(*vip)->vi_next )
+	for ( vip = (valsort_info **)&on->on_bi.bi_private; *vip; vip = &(*vip)->vi_next )
 		/* Get to the end */ ;
 
 	vi = ch_malloc( sizeof(valsort_info) );