diff -Nru openldap-2.6.4+dfsg/aclocal.m4 openldap-2.6.6+dfsg/aclocal.m4
--- openldap-2.6.4+dfsg/aclocal.m4	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/aclocal.m4	2023-07-31 18:09:15.000000000 +0000
@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.5 -*- Autoconf -*-
 
-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+# Copyright (C) 1996-2021 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -12,9 +12,9 @@
 # PARTICULAR PURPOSE.
 
 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
-dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-dnl serial 11 (pkg-config-0.29.1)
-dnl
+# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+# serial 12 (pkg-config-0.29.2)
+
 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
 dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
 dnl
@@ -55,7 +55,7 @@
 dnl See the "Since" comment for each macro you use to see what version
 dnl of the macros you require.
 m4_defun([PKG_PREREQ],
-[m4_define([PKG_MACROS_VERSION], [0.29.1])
+[m4_define([PKG_MACROS_VERSION], [0.29.2])
 m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
     [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
 ])dnl PKG_PREREQ
@@ -156,7 +156,7 @@
 AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
 
 pkg_failed=no
-AC_MSG_CHECKING([for $1])
+AC_MSG_CHECKING([for $2])
 
 _PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
 _PKG_CONFIG([$1][_LIBS], [libs], [$2])
@@ -166,11 +166,11 @@
 See the pkg-config man page for more details.])
 
 if test $pkg_failed = yes; then
-   	AC_MSG_RESULT([no])
+        AC_MSG_RESULT([no])
         _PKG_SHORT_ERRORS_SUPPORTED
         if test $_pkg_short_errors_supported = yes; then
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
-        else 
+        else
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
         fi
 	# Put the nasty error message in config.log where it belongs
@@ -187,7 +187,7 @@
 _PKG_TEXT])[]dnl
         ])
 elif test $pkg_failed = untried; then
-     	AC_MSG_RESULT([no])
+        AC_MSG_RESULT([no])
 	m4_default([$4], [AC_MSG_FAILURE(
 [The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
diff -Nru openldap-2.6.4+dfsg/build/lib.mk openldap-2.6.6+dfsg/build/lib.mk
--- openldap-2.6.4+dfsg/build/lib.mk	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/build/lib.mk	2023-07-31 18:09:15.000000000 +0000
@@ -40,7 +40,7 @@
 clean-common: 	FORCE
 	$(RM) $(LIBRARY) ../$(LIBRARY) $(XLIBRARY) \
 		$(PROGRAMS) $(XPROGRAMS) $(XSRCS) $(XXSRCS) \
-		*.o *.lo a.out *.exe *.pc core version.c .libs/*
+		*.o *.lo a.out *.exe core version.c .libs/*
 
 depend-common: FORCE
 	$(MKDEP) $(DEFS) $(DEFINES) $(SRCS) $(XXSRCS)
diff -Nru openldap-2.6.4+dfsg/build/openldap.m4 openldap-2.6.6+dfsg/build/openldap.m4
--- openldap-2.6.4+dfsg/build/openldap.m4	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/build/openldap.m4	2023-07-31 18:09:15.000000000 +0000
@@ -154,6 +154,7 @@
 if test $ol_cv_header_stdc = yes; then
   # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
 AC_RUN_IFELSE([AC_LANG_SOURCE([[#include <ctype.h>
+#include <stdlib.h>
 #ifndef HAVE_EBCDIC
 #	define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
 #	define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
@@ -303,8 +304,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -360,9 +365,13 @@
 AC_DEFUN([OL_PTHREAD_TEST_PROGRAM],
 [AC_LANG_SOURCE([OL_PTHREAD_TEST_INCLUDES
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 OL_PTHREAD_TEST_FUNCTION
 }
@@ -484,7 +493,7 @@
 #include <sys/types.h>
 #include <regex.h>
 static char *pattern, *string;
-main()
+int main(void)
 {
 	int rc;
 	regex_t re;
@@ -511,7 +520,8 @@
 [AC_CACHE_CHECK([if toupper() requires islower()],ol_cv_c_upper_lower,[
 	AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #include <ctype.h>
-main()
+#include <stdlib.h>
+int main(void)
 {
 	if ('C' == toupper('C'))
 		exit(0);
@@ -569,7 +579,7 @@
 			]])],[ol_cv_nonposix_strerror_r=yes],[ol_cv_nonposix_strerror_r=no])
 	else
 		AC_RUN_IFELSE([AC_LANG_SOURCE([[
-			main() {
+			int main(void) {
 				char buf[100];
 				buf[0] = 0;
 				strerror_r( 1, buf, sizeof buf );
diff -Nru openldap-2.6.4+dfsg/build/version.var openldap-2.6.6+dfsg/build/version.var
--- openldap-2.6.4+dfsg/build/version.var	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/build/version.var	2023-07-31 18:09:15.000000000 +0000
@@ -15,9 +15,9 @@
 ol_package=OpenLDAP
 ol_major=2
 ol_minor=6
-ol_patch=4
-ol_api_inc=20604
+ol_patch=6
+ol_api_inc=20606
 ol_api_current=2
 ol_api_revision=200
 ol_api_age=0
-ol_release_date="2023/02/08"
+ol_release_date="2023/07/31"
diff -Nru openldap-2.6.4+dfsg/CHANGES openldap-2.6.6+dfsg/CHANGES
--- openldap-2.6.4+dfsg/CHANGES	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/CHANGES	2023-07-31 18:09:15.000000000 +0000
@@ -1,5 +1,50 @@
 OpenLDAP 2.6 Change Log
 
+OpenLDAP 2.6.6 Release (2023/07/31)
+	Fixed slapd cn=config incorrect handling of paused (ITS#10045)
+	Fixed slapd-meta to account for MOD ops being optional (ITS#10067)
+	Fixed slapd-asyncmeta to account for MOD ops being optional (ITS#10067)
+
+OpenLDAP 2.6.5 Release (2023/07/10)
+	Fixed libldap handling of TCP KEEPALIVE options (ITS#10015)
+	Fixed libldap with async connections (ITS#10023)
+	Fixed libldap openssl TLSv1.3 cipher suite handling (ITS#10035)
+	Fixed slapd callback handling with overlays that do extended operations (ITS#9990)
+	Fixed slapd conversion of pcache configurations (ITS#10031)
+	Fixed slapd cn=config modification handling with abandon (ITS#10045)
+	Fixed slapd-mdb online indexer termination and cleanup (ITS#9993)
+	Fixed slapd-mdb online indexer when interrupted (ITS#10047)
+	Fixed slapd-monitor connection cleanup (ITS#10042)
+	Fixed slapo-constraint handling of push replication (ITS#9953)
+	Fixed slapo-dynlist filter evaluation efficiency (ITS#10041)
+	Fixed slapo-pcache handling of invalid schema (ITS#10032)
+	Fixed slapo-ppolicy handling of push replication (ITS#9953)
+	Fixed slapo-ppolicy handling of pwdMinDelay (ITS#10028)
+	Fixed slapo-syncprov abandon handling (ITS#10016)
+	Fixed slapo-translucent handling of invalid schema (ITS#10032)
+	Fixed slapo-unique handling of push replication (ITS#9953)
+	Fixed slapo-variant to improve regex handling (ITS#10048)
+	Build Environment
+		Fixed compatibility with stricter C99 compilers (ITS#10011)
+		Keep .pc files during make clean (ITS#9989)
+	Contrib
+		Fixed slapo-variant handling of push replication (ITS#9953)
+	Minor Cleanup
+		ITS#9855
+		ITS#9995
+		ITS#9996
+		ITS#9997
+		ITS#9998
+		ITS#9999
+		ITS#10000
+		ITS#10003
+		ITS#10004
+		ITS#10033
+		ITS#10037
+		ITS#10039
+		ITS#10046
+		ITS#10063
+
 OpenLDAP 2.6.4 Release (2023/02/08)
 	Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618)
 	Fixed ldapsearch memory leak with paged results (ITS#9860)
diff -Nru openldap-2.6.4+dfsg/clients/tools/ldapdelete.c openldap-2.6.6+dfsg/clients/tools/ldapdelete.c
--- openldap-2.6.4+dfsg/clients/tools/ldapdelete.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/clients/tools/ldapdelete.c	2023-07-31 18:09:15.000000000 +0000
@@ -389,7 +389,9 @@
 		break;
 	default:
 		tool_perror( "ldap_search", srch_rc, NULL, NULL, NULL, NULL );
-		return( srch_rc );
+		rc = srch_rc;
+		srch_rc = 0;
+		goto leave;
 	}
 
 	entries = ldap_count_entries( ld, res );
@@ -405,15 +407,14 @@
 			if( dn == NULL ) {
 				ldap_get_option( ld, LDAP_OPT_RESULT_CODE, &rc );
 				tool_perror( "ldap_prune", rc, NULL, NULL, NULL, NULL );
-				ber_memfree( dn );
-				return rc;
+				goto leave;
 			}
 
 			rc = deletechildren( ld, dn, 0 );
 			if ( rc != LDAP_SUCCESS ) {
 				tool_perror( "ldap_prune", rc, NULL, NULL, NULL, NULL );
 				ber_memfree( dn );
-				return rc;
+				goto leave;
 			}
 
 			if ( verbose ) {
@@ -424,7 +425,7 @@
 			if ( rc != LDAP_SUCCESS ) {
 				tool_perror( "ldap_delete", rc, NULL, NULL, NULL, NULL );
 				ber_memfree( dn );
-				return rc;
+				goto leave;
 
 			}
 			
@@ -436,6 +437,7 @@
 		}
 	}
 
+leave:
 	ldap_msgfree( res );
 
 	if ( srch_rc == LDAP_SIZELIMIT_EXCEEDED ) {
diff -Nru openldap-2.6.4+dfsg/configure openldap-2.6.6+dfsg/configure
--- openldap-2.6.4+dfsg/configure	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/configure	2023-07-31 18:09:15.000000000 +0000
@@ -1,5 +1,5 @@
 #! /bin/sh
-# From configure.ac Id: ce84c9890960e2b21de8d80075b2e94b2fa81bea .
+# From configure.ac Id: 9d37fff6d98b298663abe1f15cf9cc44b936f43c .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.69.
 #
@@ -810,7 +810,6 @@
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -970,7 +969,6 @@
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE}'
@@ -1223,15 +1221,6 @@
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1369,7 +1358,7 @@
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1522,7 +1511,6 @@
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -14978,6 +14966,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <ctype.h>
+#include <stdlib.h>
 #ifndef HAVE_EBCDIC
 #	define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
 #	define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
@@ -15946,6 +15935,10 @@
 else
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
+#include <stdlib.h>
+#ifdef HAVE_SYS_POLL_H
+#include <sys/epoll.h>
+#endif
 int main(int argc, char **argv)
 {
 	int epfd = epoll_create(256);
@@ -16126,7 +16119,7 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
-			main() {
+			int main(void) {
 				char buf[100];
 				buf[0] = 0;
 				strerror_r( 1, buf, sizeof buf );
@@ -16326,7 +16319,7 @@
 #include <sys/types.h>
 #include <regex.h>
 static char *pattern, *string;
-main()
+int main(void)
 {
 	int rc;
 	regex_t re;
@@ -17122,9 +17115,9 @@
 fi
 rm -f conftest.err conftest.i conftest.$ac_ext
 
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL_export_keying_material_early in -lssl" >&5
-$as_echo_n "checking for SSL_export_keying_material_early in -lssl... " >&6; }
-if ${ac_cv_lib_ssl_SSL_export_keying_material_early+:} false; then :
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL_CTX_set_ciphersuites in -lssl" >&5
+$as_echo_n "checking for SSL_CTX_set_ciphersuites in -lssl... " >&6; }
+if ${ac_cv_lib_ssl_SSL_CTX_set_ciphersuites+:} false; then :
   $as_echo_n "(cached) " >&6
 else
   ac_check_lib_save_LIBS=$LIBS
@@ -17138,27 +17131,27 @@
 #ifdef __cplusplus
 extern "C"
 #endif
-char SSL_export_keying_material_early ();
+char SSL_CTX_set_ciphersuites ();
 int
 main ()
 {
-return SSL_export_keying_material_early ();
+return SSL_CTX_set_ciphersuites ();
   ;
   return 0;
 }
 _ACEOF
 if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_ssl_SSL_export_keying_material_early=yes
+  ac_cv_lib_ssl_SSL_CTX_set_ciphersuites=yes
 else
-  ac_cv_lib_ssl_SSL_export_keying_material_early=no
+  ac_cv_lib_ssl_SSL_CTX_set_ciphersuites=no
 fi
 rm -f core conftest.err conftest.$ac_objext \
     conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ssl_SSL_export_keying_material_early" >&5
-$as_echo "$ac_cv_lib_ssl_SSL_export_keying_material_early" >&6; }
-if test "x$ac_cv_lib_ssl_SSL_export_keying_material_early" = xyes; then :
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ssl_SSL_CTX_set_ciphersuites" >&5
+$as_echo "$ac_cv_lib_ssl_SSL_CTX_set_ciphersuites" >&6; }
+if test "x$ac_cv_lib_ssl_SSL_CTX_set_ciphersuites" = xyes; then :
   have_openssl=yes
 else
   have_openssl=no
@@ -17559,16 +17552,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -17664,8 +17665,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -17744,16 +17749,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -17854,8 +17867,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -17934,16 +17951,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18044,8 +18069,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -18124,16 +18153,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18234,8 +18271,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -18314,16 +18355,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18424,8 +18473,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -18504,16 +18557,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18615,8 +18676,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -18695,16 +18760,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18805,8 +18878,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -18885,16 +18962,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -18996,8 +19081,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -19076,16 +19165,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19187,8 +19284,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -19267,16 +19368,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19377,8 +19486,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -19457,16 +19570,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19568,8 +19689,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -19648,16 +19773,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19759,8 +19892,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -19839,16 +19976,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -19949,8 +20094,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -20029,16 +20178,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -20139,8 +20296,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -20219,16 +20380,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -20330,8 +20499,12 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
@@ -20410,16 +20583,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -20631,14 +20812,12 @@
 /* end confdefs.h.  */
 
 #include <pthread.h>
-#ifndef NULL
-#define NULL (void*)0
-#endif
+pthread_t thread;
 
 int
 main ()
 {
-pthread_detach(NULL);
+pthread_detach(thread);
   ;
   return 0;
 }
@@ -20752,16 +20931,24 @@
 #define NULL (void*)0
 #endif
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	return (void *) (p == NULL);
 }
 
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 
 	/* pthread test function */
@@ -20851,6 +21038,9 @@
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
+#define _XOPEN_SOURCE 500               /* For pthread_setconcurrency() on glibc */
+#include <stdlib.h>
+#include <stdio.h>
 #include <sys/types.h>
 #include <sys/time.h>
 #include <unistd.h>
@@ -20861,8 +21051,12 @@
 
 static int fildes[2];
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	int i;
 	struct timeval tv;
@@ -20886,9 +21080,13 @@
 	exit(0); /* if we exit here, the select blocked the whole process */
 }
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 	pthread_t t;
 
@@ -22058,8 +22256,8 @@
 fi
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for WT" >&5
-$as_echo_n "checking for WT... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for wiredtiger" >&5
+$as_echo_n "checking for wiredtiger... " >&6; }
 
 if test -n "$WT_CFLAGS"; then
     pkg_cv_WT_CFLAGS="$WT_CFLAGS"
@@ -22099,7 +22297,7 @@
 
 
 if test $pkg_failed = yes; then
-   	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -22126,7 +22324,7 @@
 and WT_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
-     	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -23241,7 +23439,8 @@
 /* end confdefs.h.  */
 
 #include <ctype.h>
-main()
+#include <stdlib.h>
+int main(void)
 {
 	if ('C' == toupper('C'))
 		exit(0);
@@ -25275,7 +25474,7 @@
 
 	BUILD_PW_ARGON2=$ol_enable_argon2
 	if test "$ol_enable_argon2" = "yes" ; then
-		SLAPD_DYNAMIC_PWMODS="$SLAPD_DYNAMIC_PWDMODS argon2.la"
+		SLAPD_DYNAMIC_PWMODS="$SLAPD_DYNAMIC_PWMODS argon2.la"
 	fi
 
 cat >>confdefs.h <<_ACEOF
diff -Nru openldap-2.6.4+dfsg/configure.ac openldap-2.6.6+dfsg/configure.ac
--- openldap-2.6.4+dfsg/configure.ac	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/configure.ac	2023-07-31 18:09:15.000000000 +0000
@@ -25,7 +25,7 @@
 dnl Configure.in for OpenLDAP
 AC_COPYRIGHT([[Copyright 1998-2022 The OpenLDAP Foundation. All rights reserved.
 Restrictions apply, see COPYRIGHT and LICENSE files.]])
-AC_REVISION([$Id: ce84c9890960e2b21de8d80075b2e94b2fa81bea $])
+AC_REVISION([$Id: 9d37fff6d98b298663abe1f15cf9cc44b936f43c $])
 AC_INIT([OpenLDAP],,[https://bugs.openldap.org],,[https://www.openldap.org])
 AC_CONFIG_SRCDIR(build/version.sh)dnl
 dnl ----------------------------------------------------------------
@@ -1003,7 +1003,11 @@
 AC_CHECK_HEADERS( sys/epoll.h )
 if test "${ac_cv_header_sys_epoll_h}" = yes; then
 	AC_MSG_CHECKING(for epoll system call)
-	AC_RUN_IFELSE([AC_LANG_SOURCE([[int main(int argc, char **argv)
+	AC_RUN_IFELSE([AC_LANG_SOURCE([[#include <stdlib.h>
+#ifdef HAVE_SYS_POLL_H
+#include <sys/epoll.h>
+#endif
+int main(int argc, char **argv)
 {
 	int epfd = epoll_create(256);
 	exit (epfd == -1 ? 1 : 0);
@@ -1226,7 +1230,7 @@
 [#endif]])],
 					, [AC_MSG_FAILURE([OpenSSL 1.1.1 or newer required])])
 
-		AC_CHECK_LIB(ssl, SSL_export_keying_material_early,
+		AC_CHECK_LIB(ssl, SSL_CTX_set_ciphersuites,
 			[have_openssl=yes], [have_openssl=no],
 			[-lcrypto])
 
@@ -1356,10 +1360,10 @@
 		dnl 	pthread_create() in -lpthread (many)
 		dnl 	pthread_create() in -lc_r (FreeBSD)
 		dnl
-		dnl Check pthread (draft4) flags (depreciated)
+		dnl Check pthread (draft4) flags (deprecated)
 		dnl 	pthread_create() with -threads (OSF/1)
 		dnl
-		dnl Check pthread (draft4) libraries (depreciated)
+		dnl Check pthread (draft4) libraries (deprecated)
 		dnl 	pthread_mutex_unlock() in -lpthreads -lmach -lexc -lc_r (OSF/1)
 		dnl 	pthread_mutex_lock() in -lpthreads -lmach -lexc (OSF/1)
 		dnl 	pthread_mutex_trylock() in -lpthreads -lexc (OSF/1)
@@ -1378,7 +1382,7 @@
 			ol_link_threads=posix
 			ol_link_pthreads=""
 		fi
-		
+
 dnl		OL_PTHREAD_TRY([-mt],		[ol_cv_pthread_mt])
 		OL_PTHREAD_TRY([-kthread],	[ol_cv_pthread_kthread])
 		OL_PTHREAD_TRY([-pthread],	[ol_cv_pthread_pthread])
@@ -1465,10 +1469,8 @@
 				dnl save the flags
 				AC_LINK_IFELSE([AC_LANG_PROGRAM([[
 #include <pthread.h>
-#ifndef NULL
-#define NULL (void*)0
-#endif
-]], [[pthread_detach(NULL);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no])
+pthread_t thread;
+]], [[pthread_detach(thread);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no])
 			])
 
 			if test $ol_cv_func_pthread_detach = no ; then
@@ -1523,6 +1525,9 @@
 				AC_CACHE_CHECK([if select yields when using pthreads],
 					ol_cv_pthread_select_yields,[
 				AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#define _XOPEN_SOURCE 500               /* For pthread_setconcurrency() on glibc */
+#include <stdlib.h>
+#include <stdio.h>
 #include <sys/types.h>
 #include <sys/time.h>
 #include <unistd.h>
@@ -1533,8 +1538,12 @@
 
 static int fildes[2];
 
+#ifdef __STDC__
+static void *task(void *p)
+#else
 static void *task(p)
 	void *p;
+#endif
 {
 	int i;
 	struct timeval tv;
@@ -1558,9 +1567,13 @@
 	exit(0); /* if we exit here, the select blocked the whole process */
 }
 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
 int main(argc, argv)
 	int argc;
 	char **argv;
+#endif
 {
 	pthread_t t;
 
@@ -3038,7 +3051,7 @@
 
 	BUILD_PW_ARGON2=$ol_enable_argon2
 	if test "$ol_enable_argon2" = "yes" ; then
-		SLAPD_DYNAMIC_PWMODS="$SLAPD_DYNAMIC_PWDMODS argon2.la"
+		SLAPD_DYNAMIC_PWMODS="$SLAPD_DYNAMIC_PWMODS argon2.la"
 	fi
 	AC_DEFINE_UNQUOTED(SLAPD_PWMOD_PW_ARGON2,$SLAPD_MOD_DYNAMIC,[define for Argon2 Password hashing module])
 fi
diff -Nru openldap-2.6.4+dfsg/contrib/ldaptcl/tclAppInit.c openldap-2.6.6+dfsg/contrib/ldaptcl/tclAppInit.c
--- openldap-2.6.4+dfsg/contrib/ldaptcl/tclAppInit.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/contrib/ldaptcl/tclAppInit.c	2023-07-31 18:09:15.000000000 +0000
@@ -45,9 +45,7 @@
  */
 
 int
-main(argc, argv)
-    int argc;			/* Number of command-line arguments. */
-    char **argv;		/* Values of command-line arguments. */
+main(int argc, char **argv)
 {
 #ifdef USE_TCLX
     TclX_Main(argc, argv, Tcl_AppInit);
diff -Nru openldap-2.6.4+dfsg/contrib/ldaptcl/tkAppInit.c openldap-2.6.6+dfsg/contrib/ldaptcl/tkAppInit.c
--- openldap-2.6.4+dfsg/contrib/ldaptcl/tkAppInit.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/contrib/ldaptcl/tkAppInit.c	2023-07-31 18:09:15.000000000 +0000
@@ -37,16 +37,9 @@
  * This is the main program for the application.
  *-----------------------------------------------------------------------------
  */
-#ifdef __cplusplus
 int
 main (int    argc,
       char **argv)
-#else
-int
-main (argc, argv)
-    int    argc;
-    char **argv;
-#endif
 {
 #ifdef USE_TCLX
     TkX_Main(argc, argv, Tcl_AppInit);
@@ -68,14 +61,8 @@
  * interp->result if an error occurs.
  *-----------------------------------------------------------------------------
  */
-#ifdef __cplusplus
 int
 Tcl_AppInit (Tcl_Interp *interp)
-#else
-int
-Tcl_AppInit (interp)
-    Tcl_Interp *interp;
-#endif
 {
     if (Tcl_Init (interp) == TCL_ERROR) {
         return TCL_ERROR;
diff -Nru openldap-2.6.4+dfsg/contrib/slapd-modules/datamorph/tests/run openldap-2.6.6+dfsg/contrib/slapd-modules/datamorph/tests/run
--- openldap-2.6.4+dfsg/contrib/slapd-modules/datamorph/tests/run	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/contrib/slapd-modules/datamorph/tests/run	2023-07-31 18:09:15.000000000 +0000
@@ -12,207 +12,6 @@
 ## A copy of this license is available in the file LICENSE in the
 ## top-level directory of the distribution or, alternatively, at
 ## <http://www.OpenLDAP.org/license.html>.
-##
-## ACKNOWLEDGEMENTS:
-## This module was written in 2016 by Ondřej Kuzník for Symas Corp.
 
-USAGE="$0 [-b <backend>] [-c] [-k] [-l #] [-p] [-s {ro|rp}] [-u] [-w] <script>"
+TOPSRCDIR="$SRCDIR" OBJDIR="${LDAP_BUILD}" SRCDIR="${SRCDIR}/tests" DEFSDIR="${SRCDIR}/scripts" SCRIPTDIR="${TOPDIR}/tests/scripts" "${LDAP_BUILD}/tests/run" $*
 
-TOPSRCDIR="${SRCDIR-$LDAP_SRC}"
-SRCDIR="${TOPSRCDIR}/tests"
-eval `grep EGREP_CMD= ${LDAP_BUILD}/tests/run`
-eval `$EGREP_CMD -e '^LN_S=' ${LDAP_BUILD}/tests/run`
-
-export SRCDIR TOPSRCDIR LN_S EGREP_CMD
-
-. "${SRCDIR}/scripts/defines.sh"
-
-BACKEND=
-CLEAN=no
-WAIT=0
-KILLSERVERS=yes
-PRESERVE=${PRESERVE-no}
-SYNCMODE=${SYNCMODE-rp}
-USERDATA=no
-LOOP=1
-COUNTER=1
-
-while test $# -gt 0 ; do
-	case "$1" in
-		-b | -backend)
-			BACKEND="$2"
-			shift; shift ;;
-
-		-c | -clean)
-			CLEAN=yes
-			shift ;;
-
-		-k | -kill)
-			KILLSERVERS=no
-			shift ;;
-		-l | -loop)
-			NUM="`echo $2 | sed 's/[0-9]//g'`"
-			if [ -z "$NUM" ]; then
-				LOOP=$2
-			else
-				echo "Loop variable not an int: $2"
-				echo "$USAGE"; exit 1
-			fi
-			shift ;
-			shift ;;
-
-		-p | -preserve)
-			PRESERVE=yes
-			shift ;;
-
-		-s | -syncmode)
-			case "$2" in
-				ro | rp)
-					SYNCMODE="$2"
-					;;
-				*)
-					echo "unknown sync mode $2"
-					echo "$USAGE"; exit 1
-					;;
-			esac
-			shift; shift ;;
-
-		-u | -userdata)
-			USERDATA=yes
-			shift ;;
-
-		-w | -wait)
-			WAIT=1
-			shift ;;
-
-		-)
-			shift
-			break ;;
-
-		-*)
-			echo "$USAGE"; exit 1
-			;;
-
-		*)
-			break ;;
-	esac
-done
-
-eval `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run`
-export `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run | sed 's/=.*//'`
-
-if test -z "$BACKEND" ; then
-	for b in mdb ; do
-		if eval "test \"\$AC_$b\" != no" ; then
-			BACKEND=$b
-			break
-		fi
-	done
-	if test -z "$BACKEND" ; then
-		echo "No suitable default database backend configured" >&2
-		exit 1
-	fi
-fi
-
-BACKENDTYPE=`eval 'echo $AC_'$BACKEND`
-if test "x$BACKENDTYPE" = "x" ; then
-	BACKENDTYPE="unknown"
-fi
-
-# Backend features.  indexdb: indexing and unchecked limit.
-# maindb: main storage backend.  Currently index,limits,mode,paged results.
-INDEXDB=noindexdb MAINDB=nomaindb
-case $BACKEND in
-	mdb) INDEXDB=indexdb MAINDB=maindb ;;
-esac
-
-export	BACKEND BACKENDTYPE INDEXDB MAINDB \
-	WAIT KILLSERVERS PRESERVE SYNCMODE USERDATA \
-	SRCDIR
-
-if test $# = 0 ; then
-	echo "$USAGE"; exit 1
-fi
-
-# need defines.sh for the definitions of the directories
-. $SRCDIR/scripts/defines.sh
-
-SCRIPTDIR="${TOPDIR}/tests/scripts"
-
-export SCRIPTDIR
-
-SCRIPTNAME="$1"
-shift
-
-if test -x "${SCRIPTDIR}/${SCRIPTNAME}" ; then
-	SCRIPT="${SCRIPTDIR}/${SCRIPTNAME}"
-elif test -x "`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"
-elif test -x "`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"
-else
-	echo "run: ${SCRIPTNAME} not found (or not executable)"
-	exit 1;
-fi
-
-if test ! -r ${DATADIR}/test.ldif ; then
-	${LN_S} ${SRCDIR}/data ${DATADIR}
-fi
-if test ! -r ${SCHEMADIR}/core.schema ; then
-	${LN_S} ${TOPSRCDIR}/servers/slapd/schema ${SCHEMADIR}
-fi
-if test ! -r ./data; then
-	${LN_S} ${TOPDIR}/tests/data ./
-fi
-
-if test -d ${TESTDIR} ; then
-	if test $PRESERVE = no ; then
-		echo "Cleaning up test run directory leftover from previous run."
-		/bin/rm -rf ${TESTDIR}
-	elif test $PRESERVE = yes ; then
-		echo "Cleaning up only database directories leftover from previous run."
-		/bin/rm -rf ${TESTDIR}/db.*
-	fi
-fi
-mkdir -p ${TESTDIR}
-
-if test $USERDATA = yes ; then
-	if test ! -d userdata ; then
-		echo "User data directory (userdata) does not exist."
-		exit 1
-	fi
-	cp -R userdata/* ${TESTDIR}
-fi
-
-# disable LDAP initialization
-LDAPNOINIT=true; export LDAPNOINIT
-
-echo "Running ${SCRIPT} for ${BACKEND}..."
-while [ $COUNTER -le $LOOP ]; do
-	if [ $LOOP -gt 1 ]; then
-		echo "Running $COUNTER of $LOOP iterations"
-	fi
-	$SCRIPT $*
-	RC=$?
-
-	if test $CLEAN = yes ; then
-		echo "Cleaning up test run directory from this run."
-		/bin/rm -rf ${TESTDIR}
-		echo "Cleaning up symlinks."
-		/bin/rm -f ${DATADIR} ${SCHEMADIR}
-	fi
-
-	if [ $RC -ne 0 ]; then
-		if [ $LOOP -gt 1 ]; then
-			echo "Failed after $COUNTER of $LOOP iterations"
-		fi
-		exit $RC
-	else
-		COUNTER=`expr $COUNTER + 1`
-		if [ $COUNTER -le $LOOP ]; then
-			echo "Cleaning up test run directory from this run."
-			/bin/rm -rf ${TESTDIR}
-		fi
-	fi
-done
-exit $RC
diff -Nru openldap-2.6.4+dfsg/contrib/slapd-modules/emptyds/tests/run openldap-2.6.6+dfsg/contrib/slapd-modules/emptyds/tests/run
--- openldap-2.6.4+dfsg/contrib/slapd-modules/emptyds/tests/run	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/contrib/slapd-modules/emptyds/tests/run	2023-07-31 18:09:15.000000000 +0000
@@ -12,207 +12,6 @@
 ## A copy of this license is available in the file LICENSE in the
 ## top-level directory of the distribution or, alternatively, at
 ## <http://www.OpenLDAP.org/license.html>.
-##
-## ACKNOWLEDGEMENTS:
-## This module was written in 2016 by Ondřej Kuzník for Symas Corp.
 
-USAGE="$0 [-b <backend>] [-c] [-k] [-l #] [-p] [-s {ro|rp}] [-u] [-w] <script>"
+TOPSRCDIR="$SRCDIR" OBJDIR="${LDAP_BUILD}" SRCDIR="${SRCDIR}/tests" DEFSDIR="${SRCDIR}/scripts" SCRIPTDIR="${TOPDIR}/tests/scripts" "${LDAP_BUILD}/tests/run" $*
 
-TOPSRCDIR="${SRCDIR-$LDAP_SRC}"
-SRCDIR="${TOPSRCDIR}/tests"
-eval `grep EGREP_CMD= ${LDAP_BUILD}/tests/run`
-eval `$EGREP_CMD -e '^LN_S=' ${LDAP_BUILD}/tests/run`
-
-export SRCDIR TOPSRCDIR LN_S EGREP_CMD
-
-. "${SRCDIR}/scripts/defines.sh"
-
-BACKEND=
-CLEAN=no
-WAIT=0
-KILLSERVERS=yes
-PRESERVE=${PRESERVE-no}
-SYNCMODE=${SYNCMODE-rp}
-USERDATA=no
-LOOP=1
-COUNTER=1
-
-while test $# -gt 0 ; do
-	case "$1" in
-		-b | -backend)
-			BACKEND="$2"
-			shift; shift ;;
-
-		-c | -clean)
-			CLEAN=yes
-			shift ;;
-
-		-k | -kill)
-			KILLSERVERS=no
-			shift ;;
-		-l | -loop)
-			NUM="`echo $2 | sed 's/[0-9]//g'`"
-			if [ -z "$NUM" ]; then
-				LOOP=$2
-			else
-				echo "Loop variable not an int: $2"
-				echo "$USAGE"; exit 1
-			fi
-			shift ;
-			shift ;;
-
-		-p | -preserve)
-			PRESERVE=yes
-			shift ;;
-
-		-s | -syncmode)
-			case "$2" in
-				ro | rp)
-					SYNCMODE="$2"
-					;;
-				*)
-					echo "unknown sync mode $2"
-					echo "$USAGE"; exit 1
-					;;
-			esac
-			shift; shift ;;
-
-		-u | -userdata)
-			USERDATA=yes
-			shift ;;
-
-		-w | -wait)
-			WAIT=1
-			shift ;;
-
-		-)
-			shift
-			break ;;
-
-		-*)
-			echo "$USAGE"; exit 1
-			;;
-
-		*)
-			break ;;
-	esac
-done
-
-eval `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run`
-export `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run | sed 's/=.*//'`
-
-if test -z "$BACKEND" ; then
-	for b in mdb ; do
-		if eval "test \"\$AC_$b\" != no" ; then
-			BACKEND=$b
-			break
-		fi
-	done
-	if test -z "$BACKEND" ; then
-		echo "No suitable default database backend configured" >&2
-		exit 1
-	fi
-fi
-
-BACKENDTYPE=`eval 'echo $AC_'$BACKEND`
-if test "x$BACKENDTYPE" = "x" ; then
-	BACKENDTYPE="unknown"
-fi
-
-# Backend features.  indexdb: indexing and unchecked limit.
-# maindb: main storage backend.  Currently index,limits,mode,paged results.
-INDEXDB=noindexdb MAINDB=nomaindb
-case $BACKEND in
-	mdb) INDEXDB=indexdb MAINDB=maindb ;;
-esac
-
-export	BACKEND BACKENDTYPE INDEXDB MAINDB \
-	WAIT KILLSERVERS PRESERVE SYNCMODE USERDATA \
-	SRCDIR
-
-if test $# = 0 ; then
-	echo "$USAGE"; exit 1
-fi
-
-# need defines.sh for the definitions of the directories
-. $SRCDIR/scripts/defines.sh
-
-SCRIPTDIR="${TOPDIR}/tests/scripts"
-
-export SCRIPTDIR
-
-SCRIPTNAME="$1"
-shift
-
-if test -x "${SCRIPTDIR}/${SCRIPTNAME}" ; then
-	SCRIPT="${SCRIPTDIR}/${SCRIPTNAME}"
-elif test -x "`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"
-elif test -x "`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"
-else
-	echo "run: ${SCRIPTNAME} not found (or not executable)"
-	exit 1;
-fi
-
-if test ! -r ${DATADIR}/test.ldif ; then
-	${LN_S} ${SRCDIR}/data ${DATADIR}
-fi
-if test ! -r ${SCHEMADIR}/core.schema ; then
-	${LN_S} ${TOPSRCDIR}/servers/slapd/schema ${SCHEMADIR}
-fi
-if test ! -r ./data; then
-	${LN_S} ${TOPDIR}/tests/data ./
-fi
-
-if test -d ${TESTDIR} ; then
-	if test $PRESERVE = no ; then
-		echo "Cleaning up test run directory leftover from previous run."
-		/bin/rm -rf ${TESTDIR}
-	elif test $PRESERVE = yes ; then
-		echo "Cleaning up only database directories leftover from previous run."
-		/bin/rm -rf ${TESTDIR}/db.*
-	fi
-fi
-mkdir -p ${TESTDIR}
-
-if test $USERDATA = yes ; then
-	if test ! -d userdata ; then
-		echo "User data directory (userdata) does not exist."
-		exit 1
-	fi
-	cp -R userdata/* ${TESTDIR}
-fi
-
-# disable LDAP initialization
-LDAPNOINIT=true; export LDAPNOINIT
-
-echo "Running ${SCRIPT} for ${BACKEND}..."
-while [ $COUNTER -le $LOOP ]; do
-	if [ $LOOP -gt 1 ]; then
-		echo "Running $COUNTER of $LOOP iterations"
-	fi
-	$SCRIPT $*
-	RC=$?
-
-	if test $CLEAN = yes ; then
-		echo "Cleaning up test run directory from this run."
-		/bin/rm -rf ${TESTDIR}
-		echo "Cleaning up symlinks."
-		/bin/rm -f ${DATADIR} ${SCHEMADIR}
-	fi
-
-	if [ $RC -ne 0 ]; then
-		if [ $LOOP -gt 1 ]; then
-			echo "Failed after $COUNTER of $LOOP iterations"
-		fi
-		exit $RC
-	else
-		COUNTER=`expr $COUNTER + 1`
-		if [ $COUNTER -le $LOOP ]; then
-			echo "Cleaning up test run directory from this run."
-			/bin/rm -rf ${TESTDIR}
-		fi
-	fi
-done
-exit $RC
diff -Nru openldap-2.6.4+dfsg/contrib/slapd-modules/variant/slapo-variant.5 openldap-2.6.6+dfsg/contrib/slapd-modules/variant/slapo-variant.5
--- openldap-2.6.4+dfsg/contrib/slapd-modules/variant/slapo-variant.5	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/contrib/slapd-modules/variant/slapo-variant.5	2023-07-31 18:09:15.000000000 +0000
@@ -341,14 +341,14 @@
 
 # share the Headquarters' address as the company address
 dn: olcVariantVariantAttribute=postaladdress,name={0}example,olcOverlay={x}variant,$DATABASE
-objectClass: olcVariantVariantAttribute
+objectClass: olcVariantAttribute
 olcVariantVariantAttribute: postaladdress
 olcVariantAlternativeAttribute: postaladdress
 olcVariantAlternativeEntry: ou=Headquarters,dc=example,dc=com
 
 # populate telephonenumber from CEO's home phone
 dn: name=Take phone from CEO entry,name={0}example,olcOverlay={x}variant,$DATABASE
-objectClass: olcVariantVariantAttribute
+objectClass: olcVariantAttribute
 olcVariantVariantAttribute: telephonenumber
 olcVariantAlternativeAttribute: homephone
 olcVariantAlternativeEntry: cn=John Doe,ou=People,dc=example,dc=com
diff -Nru openldap-2.6.4+dfsg/contrib/slapd-modules/variant/tests/data/test001-04a-same-regex.ldif openldap-2.6.6+dfsg/contrib/slapd-modules/variant/tests/data/test001-04a-same-regex.ldif
--- openldap-2.6.4+dfsg/contrib/slapd-modules/variant/tests/data/test001-04a-same-regex.ldif	1970-01-01 00:00:00.000000000 +0000
+++ openldap-2.6.6+dfsg/contrib/slapd-modules/variant/tests/data/test001-04a-same-regex.ldif	2023-07-31 18:09:15.000000000 +0000
@@ -0,0 +1,4 @@
+dn: name={3}regex,olcOverlay={0}variant,olcDatabase={1}mdb,cn=config
+changetype: modify
+replace: olcVariantEntryRegex
+olcVariantEntryRegex: (.*),(ou=.*technology.*)(,)dc=example,dc=com
diff -Nru openldap-2.6.4+dfsg/contrib/slapd-modules/variant/tests/data/test001-04b-same-regex.ldif openldap-2.6.6+dfsg/contrib/slapd-modules/variant/tests/data/test001-04b-same-regex.ldif
--- openldap-2.6.4+dfsg/contrib/slapd-modules/variant/tests/data/test001-04b-same-regex.ldif	1970-01-01 00:00:00.000000000 +0000
+++ openldap-2.6.6+dfsg/contrib/slapd-modules/variant/tests/data/test001-04b-same-regex.ldif	2023-07-31 18:09:15.000000000 +0000
@@ -0,0 +1,4 @@
+dn: name=regex,olcOverlay={0}variant,olcDatabase={1}@BACKEND@,cn=config
+changetype: add
+objectclass: olcVariantRegex
+olcVariantEntryRegex: .*
diff -Nru openldap-2.6.4+dfsg/contrib/slapd-modules/variant/tests/run openldap-2.6.6+dfsg/contrib/slapd-modules/variant/tests/run
--- openldap-2.6.4+dfsg/contrib/slapd-modules/variant/tests/run	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/contrib/slapd-modules/variant/tests/run	2023-07-31 18:09:15.000000000 +0000
@@ -12,207 +12,6 @@
 ## A copy of this license is available in the file LICENSE in the
 ## top-level directory of the distribution or, alternatively, at
 ## <http://www.OpenLDAP.org/license.html>.
-##
-## ACKNOWLEDGEMENTS:
-## This module was written in 2016 by Ondřej Kuzník for Symas Corp.
 
-USAGE="$0 [-b <backend>] [-c] [-k] [-l #] [-p] [-s {ro|rp}] [-u] [-w] <script>"
+TOPSRCDIR="$SRCDIR" OBJDIR="${LDAP_BUILD}" SRCDIR="${SRCDIR}/tests" DEFSDIR="${SRCDIR}/scripts" SCRIPTDIR="${TOPDIR}/tests/scripts" "${LDAP_BUILD}/tests/run" $*
 
-TOPSRCDIR="${SRCDIR-$LDAP_SRC}"
-SRCDIR="${TOPSRCDIR}/tests"
-eval `grep EGREP_CMD= ${LDAP_BUILD}/tests/run`
-eval `$EGREP_CMD -e '^LN_S=' ${LDAP_BUILD}/tests/run`
-
-export SRCDIR TOPSRCDIR LN_S EGREP_CMD
-
-. "${SRCDIR}/scripts/defines.sh"
-
-BACKEND=
-CLEAN=no
-WAIT=0
-KILLSERVERS=yes
-PRESERVE=${PRESERVE-no}
-SYNCMODE=${SYNCMODE-rp}
-USERDATA=no
-LOOP=1
-COUNTER=1
-
-while test $# -gt 0 ; do
-	case "$1" in
-		-b | -backend)
-			BACKEND="$2"
-			shift; shift ;;
-
-		-c | -clean)
-			CLEAN=yes
-			shift ;;
-
-		-k | -kill)
-			KILLSERVERS=no
-			shift ;;
-		-l | -loop)
-			NUM="`echo $2 | sed 's/[0-9]//g'`"
-			if [ -z "$NUM" ]; then
-				LOOP=$2
-			else
-				echo "Loop variable not an int: $2"
-				echo "$USAGE"; exit 1
-			fi
-			shift ;
-			shift ;;
-
-		-p | -preserve)
-			PRESERVE=yes
-			shift ;;
-
-		-s | -syncmode)
-			case "$2" in
-				ro | rp)
-					SYNCMODE="$2"
-					;;
-				*)
-					echo "unknown sync mode $2"
-					echo "$USAGE"; exit 1
-					;;
-			esac
-			shift; shift ;;
-
-		-u | -userdata)
-			USERDATA=yes
-			shift ;;
-
-		-w | -wait)
-			WAIT=1
-			shift ;;
-
-		-)
-			shift
-			break ;;
-
-		-*)
-			echo "$USAGE"; exit 1
-			;;
-
-		*)
-			break ;;
-	esac
-done
-
-eval `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run`
-export `$EGREP_CMD -e '^AC' ${LDAP_BUILD}/tests/run | sed 's/=.*//'`
-
-if test -z "$BACKEND" ; then
-	for b in mdb ; do
-		if eval "test \"\$AC_$b\" != no" ; then
-			BACKEND=$b
-			break
-		fi
-	done
-	if test -z "$BACKEND" ; then
-		echo "No suitable default database backend configured" >&2
-		exit 1
-	fi
-fi
-
-BACKENDTYPE=`eval 'echo $AC_'$BACKEND`
-if test "x$BACKENDTYPE" = "x" ; then
-	BACKENDTYPE="unknown"
-fi
-
-# Backend features.  indexdb: indexing and unchecked limit.
-# maindb: main storage backend.  Currently index,limits,mode,paged results.
-INDEXDB=noindexdb MAINDB=nomaindb
-case $BACKEND in
-	mdb) INDEXDB=indexdb MAINDB=maindb ;;
-esac
-
-export	BACKEND BACKENDTYPE INDEXDB MAINDB \
-	WAIT KILLSERVERS PRESERVE SYNCMODE USERDATA \
-	SRCDIR
-
-if test $# = 0 ; then
-	echo "$USAGE"; exit 1
-fi
-
-# need defines.sh for the definitions of the directories
-. $SRCDIR/scripts/defines.sh
-
-SCRIPTDIR="${TOPDIR}/tests/scripts"
-
-export SCRIPTDIR
-
-SCRIPTNAME="$1"
-shift
-
-if test -x "${SCRIPTDIR}/${SCRIPTNAME}" ; then
-	SCRIPT="${SCRIPTDIR}/${SCRIPTNAME}"
-elif test -x "`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/test*-${SCRIPTNAME}`"
-elif test -x "`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"; then
-	SCRIPT="`echo ${SCRIPTDIR}/${SCRIPTNAME}-*`"
-else
-	echo "run: ${SCRIPTNAME} not found (or not executable)"
-	exit 1;
-fi
-
-if test ! -r ${DATADIR}/test.ldif ; then
-	${LN_S} ${SRCDIR}/data ${DATADIR}
-fi
-if test ! -r ${SCHEMADIR}/core.schema ; then
-	${LN_S} ${TOPSRCDIR}/servers/slapd/schema ${SCHEMADIR}
-fi
-if test ! -r ./data; then
-	${LN_S} ${TOPDIR}/tests/data ./
-fi
-
-if test -d ${TESTDIR} ; then
-	if test $PRESERVE = no ; then
-		echo "Cleaning up test run directory leftover from previous run."
-		/bin/rm -rf ${TESTDIR}
-	elif test $PRESERVE = yes ; then
-		echo "Cleaning up only database directories leftover from previous run."
-		/bin/rm -rf ${TESTDIR}/db.*
-	fi
-fi
-mkdir -p ${TESTDIR}
-
-if test $USERDATA = yes ; then
-	if test ! -d userdata ; then
-		echo "User data directory (userdata) does not exist."
-		exit 1
-	fi
-	cp -R userdata/* ${TESTDIR}
-fi
-
-# disable LDAP initialization
-LDAPNOINIT=true; export LDAPNOINIT
-
-echo "Running ${SCRIPT} for ${BACKEND}..."
-while [ $COUNTER -le $LOOP ]; do
-	if [ $LOOP -gt 1 ]; then
-		echo "Running $COUNTER of $LOOP iterations"
-	fi
-	$SCRIPT $*
-	RC=$?
-
-	if test $CLEAN = yes ; then
-		echo "Cleaning up test run directory from this run."
-		/bin/rm -rf ${TESTDIR}
-		echo "Cleaning up symlinks."
-		/bin/rm -f ${DATADIR} ${SCHEMADIR}
-	fi
-
-	if [ $RC -ne 0 ]; then
-		if [ $LOOP -gt 1 ]; then
-			echo "Failed after $COUNTER of $LOOP iterations"
-		fi
-		exit $RC
-	else
-		COUNTER=`expr $COUNTER + 1`
-		if [ $COUNTER -le $LOOP ]; then
-			echo "Cleaning up test run directory from this run."
-			/bin/rm -rf ${TESTDIR}
-		fi
-	fi
-done
-exit $RC
diff -Nru openldap-2.6.4+dfsg/contrib/slapd-modules/variant/variant.c openldap-2.6.6+dfsg/contrib/slapd-modules/variant/variant.c
--- openldap-2.6.4+dfsg/contrib/slapd-modules/variant/variant.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/contrib/slapd-modules/variant/variant.c	2023-07-31 18:09:15.000000000 +0000
@@ -282,9 +282,7 @@
 	variantEntry_info *vei;
 	int rc;
 
-	/* Replication always uses the rootdn */
-	if ( ov->passReplication && SLAPD_SYNC_IS_SYNCCONN(op->o_connid) &&
-			be_isroot( op ) ) {
+	if ( ov->passReplication && be_shadow_update( op ) ) {
 		return SLAP_CB_CONTINUE;
 	}
 
@@ -431,9 +429,7 @@
 	regmatch_t pmatch[10];
 	int rc, nmatch = sizeof(pmatch) / sizeof(regmatch_t);
 
-	/* Replication always uses the rootdn */
-	if ( ov->passReplication && SLAPD_SYNC_IS_SYNCCONN(op->o_connid) &&
-			be_isroot( op ) ) {
+	if ( ov->passReplication && be_shadow_update( op ) ) {
 		return SLAP_CB_CONTINUE;
 	}
 
@@ -868,6 +864,9 @@
 
 		dnMatch( &diff, 0, NULL, NULL, &vei->dn, &vei2->dn );
 		if ( !diff ) {
+			snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+					"duplicate variant dn: %s", ca->value_ndn.bv_val );
+			Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 			return LDAP_CONSTRAINT_VIOLATION;
 		}
 	}
@@ -888,7 +887,11 @@
 	} else if ( ca->op == LDAP_MOD_DELETE ) {
 		ber_memfree( vei->dn.bv_val );
 		BER_BVZERO( &vei->dn );
-		regfree( vei->regex );
+		if ( vei->regex ) {
+			regfree( vei->regex );
+			ch_free( vei->regex );
+			vei->regex = NULL;
+		}
 		return LDAP_SUCCESS;
 	}
 
@@ -909,8 +912,9 @@
 		if ( vei == vei2 ) continue;
 
 		if ( !ber_bvcmp( &ca->value_bv, &vei2->dn ) ) {
-			ch_free( vei );
-			ca->ca_private = NULL;
+			snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+					"duplicate variant regex: %s", ca->value_dn.bv_val );
+			Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 			return LDAP_CONSTRAINT_VIOLATION;
 		}
 	}
@@ -918,7 +922,10 @@
 	vei->regex = ch_calloc( 1, sizeof(regex_t) );
 	if ( regcomp( vei->regex, vei->dn.bv_val, REG_EXTENDED ) ) {
 		ch_free( vei->regex );
-		ch_free( vei->dn.bv_val );
+		vei->regex = NULL;
+		snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+				"cannot process regex: %s", vei->dn.bv_val );
+		Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 		return LDAP_CONSTRAINT_VIOLATION;
 	}
 
@@ -967,9 +974,10 @@
 		if ( ( ( *p >= '0' ) && ( *p <= '9' ) ) || ( *p == '$' ) ) {
 			p += 1;
 		} else {
-			Debug( LDAP_DEBUG_ANY, "variant_set_alt_pattern: "
-					"invalid replacement pattern supplied '%s'\n",
+			snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+					"invalid replacement pattern supplied '%s'",
 					ca->value_bv.bv_val );
+			Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 			return LDAP_CONSTRAINT_VIOLATION;
 		}
 	}
@@ -1013,6 +1021,9 @@
 	rc = slap_str2ad( s, ad, &text );
 	ber_memfree( ca->value_string );
 	if ( rc ) {
+		snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+				"attribute %s invalid: %s", s, text );
+		Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 		return rc;
 	}
 
@@ -1020,6 +1031,10 @@
 	if ( vai->attr && vai->alternative &&
 			vai->attr->ad_type->sat_syntax !=
 					vai->alternative->ad_type->sat_syntax ) {
+		snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+				"attribute '%s' syntax doesn't match alternative attribute '%s'",
+				vai->attr->ad_cname.bv_val, vai->alternative->ad_cname.bv_val );
+		Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 		return LDAP_CONSTRAINT_VIOLATION;
 	}
 
@@ -1028,6 +1043,9 @@
 		LDAP_SLIST_FOREACH( vai2, &vai->variant->attributes, next ) {
 			if ( vai == vai2 ) continue;
 			if ( vai->attr == vai2->attr ) {
+				snprintf( ca->cr_msg, sizeof(ca->cr_msg),
+						"duplicate attribute '%s'", vai->attr->ad_cname.bv_val );
+				Debug( LDAP_DEBUG_ANY, "%s: %s\n", ca->log, ca->cr_msg );
 				return LDAP_CONSTRAINT_VIOLATION;
 			}
 		}
diff -Nru openldap-2.6.4+dfsg/debian/changelog openldap-2.6.6+dfsg/debian/changelog
--- openldap-2.6.4+dfsg/debian/changelog	2023-06-21 18:48:31.000000000 +0000
+++ openldap-2.6.6+dfsg/debian/changelog	2023-08-02 23:53:17.000000000 +0000
@@ -1,3 +1,97 @@
+openldap (2.6.6+dfsg-1~exp1ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2028721). Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+    - d/t/smbk5pwd: Allow the openldap user to read the Heimdal master key in the
+      smbk5pwd DEP8 test (LP #2004560)
+      [ Partially incorporated by Debian. ]
+
+ -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Wed, 02 Aug 2023 19:53:17 -0400
+
+openldap (2.6.6+dfsg-1~exp1) experimental; urgency=medium
+
+  * New upstream version 2.6.6+dfsg
+
+ -- Sergio Durigan Junior <sergiodj@debian.org>  Mon, 31 Jul 2023 18:24:38 -0400
+
+openldap (2.6.5+dfsg-1~exp1ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2028721). Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+    - d/t/smbk5pwd: Allow the openldap user to read the Heimdal master key in the
+      smbk5pwd DEP8 test (LP #2004560)
+      [ Partially incorporated by Debian. ]
+  * Drop changes:
+    - Build the passwd/sha2 contrib module with -fno-strict-aliasing to
+      avoid computing an incorrect SHA256 hash with some versions of the
+      compiler (LP: #2000817):
+      + d/t/{control,sha2-contrib}: test to verify the SHA256 hash
+        produced by passwd/sha2
+      + d/rules: set -fno-strict-aliasing only when building the
+        passwd/sha2 contrib module
+      [ Incorporated by Debian. ]
+
+ -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Thu, 27 Jul 2023 13:18:18 -0400
+
+openldap (2.6.5+dfsg-1~exp1) experimental; urgency=medium
+
+  [ Sergio Durigan Junior ]
+  * New upstream version 2.6.5+dfsg
+  * d/control: Bump Standards-Version to 4.6.2; no changes needed.
+  * d/control: Bump debhelper-compat to 13.
+  * d/control: Drop lsb-base from slapd's Depends.
+
+  [ Ryan Tandy ]
+  * Fix smbk5pwd autopkgtest with /var/lib/heimdal-kdc 700 (#1020442)
+  * Update more Lintian overrides to use square brackets
+  * Drop unused custom-library-search-path override
+  * Add wildcards to make overrides work with older lintian.
+    Apparently ftp-master's auto-rejects are not evaluated using the latest
+    version of lintian.
+  * Fix sha2 autopkgtest failure (#1030814)
+
+  [ Gioele Barabucci ]
+  * slapd.scripts-common: Avoid double-UTF8-encoding org name.
+    (Closes: #1016185)
+  * d/slapd.scripts-common: Remove outdated `migrate_to_slapd_d_style`
+  * d/slapd.postinst: Remove test for ancient version.
+  * slapd.scripts-common: Remove unused `normalize_ldif`
+  * d/slapd.scripts-common: Use sed instead of perl in `release_diagnostics`
+
+  [ Andreas Hasenack ]
+  * d/rules: Fix passwd/sha2 build.
+    Build the passwd/sha2 contrib module with -fno-strict-aliasing to avoid
+    computing an incorrect SHA256 hash with some versions of the compiler
+    (LP: #2000817)
+  * d/t/sha2-contrib: add test for sha2 module.
+    DEP8 test to verify the SHA256 hash produced by passwd/sha2
+
+ -- Sergio Durigan Junior <sergiodj@debian.org>  Mon, 24 Jul 2023 19:26:16 -0400
+
 openldap (2.6.4+dfsg-1~exp1ubuntu1) mantic; urgency=medium
 
   * Merge with Debian unstable (LP: #2018093). Remaining changes:
diff -Nru openldap-2.6.4+dfsg/debian/control openldap-2.6.6+dfsg/debian/control
--- openldap-2.6.4+dfsg/debian/control	2023-06-21 18:48:31.000000000 +0000
+++ openldap-2.6.6+dfsg/debian/control	2023-08-02 23:53:17.000000000 +0000
@@ -7,7 +7,7 @@
  Torsten Landschoff <torsten@debian.org>,
  Ryan Tandy <ryan@nardis.ca>,
  Sergio Durigan Junior <sergiodj@debian.org>
-Build-Depends: debhelper-compat (= 12),
+Build-Depends: debhelper-compat (= 13),
                dh-apparmor,
                dpkg-dev (>= 1.17.14),
                groff-base,
@@ -31,7 +31,7 @@
                libsasl2-modules-gssapi-mit <!nocheck>,
                sasl2-bin <!nocheck>,
 Build-Conflicts: libbind-dev, bind-dev, autoconf2.13
-Standards-Version: 4.6.0
+Standards-Version: 4.6.2
 Homepage: https://www.openldap.org/
 Rules-Requires-Root: no
 Vcs-Git: https://salsa.debian.org/openldap-team/openldap.git
@@ -43,7 +43,7 @@
 Pre-Depends: debconf (>= 0.5) | debconf-2.0, ${misc:Pre-Depends}
 Depends: ${shlibs:Depends}, libldap2 (= ${binary:Version}),
  coreutils (>= 4.5.1-1), psmisc, perl:any (>> 5.8.0) | libmime-base64-perl,
- adduser, lsb-base (>= 3.2-13), ${perl:Depends}, ${misc:Depends}
+ adduser, ${perl:Depends}, ${misc:Depends}
 Recommends: ldap-utils
 Suggests: libsasl2-modules, ufw,
  libsasl2-modules-gssapi-mit | libsasl2-modules-gssapi-heimdal
diff -Nru openldap-2.6.4+dfsg/debian/rules openldap-2.6.6+dfsg/debian/rules
--- openldap-2.6.4+dfsg/debian/rules	2023-06-21 18:48:14.000000000 +0000
+++ openldap-2.6.6+dfsg/debian/rules	2023-08-02 23:53:05.000000000 +0000
@@ -81,7 +81,7 @@
 override_dh_auto_build:
 	dh_auto_build
 ifeq ($(filter pkg.openldap.noslapd,$(DEB_BUILD_PROFILES)),)
-	# passwd/sha2 needs special handling, see #2000817
+	# passwd/sha2 needs special handling, see #1030716 and LP: #2000817
 	for mod in $(CONTRIB_MODULES); do \
 		if [ "$$mod" = "passwd/sha2" ]; then \
 			EXTRA_OPT="-fno-strict-aliasing"; \
diff -Nru openldap-2.6.4+dfsg/debian/slapd-contrib.lintian-overrides openldap-2.6.6+dfsg/debian/slapd-contrib.lintian-overrides
--- openldap-2.6.4+dfsg/debian/slapd-contrib.lintian-overrides	2022-11-18 20:46:10.000000000 +0000
+++ openldap-2.6.6+dfsg/debian/slapd-contrib.lintian-overrides	2023-08-02 23:52:20.000000000 +0000
@@ -1,4 +1,2 @@
-# rpath set by krb5-config.heimdal; #868840
-custom-library-search-path RUNPATH /usr/lib/*/heimdal [usr/lib/ldap/smbk5pwd.so.0.0.0]
 # #204975
 package-has-unnecessary-activation-of-ldconfig-trigger
diff -Nru openldap-2.6.4+dfsg/debian/slapd.postinst openldap-2.6.6+dfsg/debian/slapd.postinst
--- openldap-2.6.4+dfsg/debian/slapd.postinst	2022-11-18 20:46:10.000000000 +0000
+++ openldap-2.6.6+dfsg/debian/slapd.postinst	2023-08-02 23:52:20.000000000 +0000
@@ -38,21 +38,6 @@
 		fi
 	fi
 
-	# Move to slapd.d configuration style.
-	if ! migrate_to_slapd_d_style; then
-		return 1
-	fi
-
-	# One-time upgrade fix for olcAccess on cn=Subschema
-	if previous_version_older 2.4.23-5 && previous_version_newer 2.4.23-3 \
-	   && [ -e "$SLAPD_CONF/cn=config/olcDatabase={-1}frontend.ldif" ] \
-	   && ! grep -i 'olcAccess:.*subschema' "$SLAPD_CONF/cn=config/olcDatabase={-1}frontend.ldif"
-	then
-		sed -i '/olcAccess: {0}/a\
-olcAccess: {1}to dn.exact="" by * read\
-olcAccess: {2}to dn.base="cn=Subschema" by * read' "${SLAPD_CONF}/cn=config/olcDatabase={-1}frontend.ldif"
-	fi
-
 	# Update permissions of all database directories and /var/run/slapd
 	update_databases_permissions
 	update_permissions /var/run/slapd
diff -Nru openldap-2.6.4+dfsg/debian/slapd.scripts-common openldap-2.6.6+dfsg/debian/slapd.scripts-common
--- openldap-2.6.4+dfsg/debian/slapd.scripts-common	2022-11-18 20:46:10.000000000 +0000
+++ openldap-2.6.6+dfsg/debian/slapd.scripts-common	2023-08-02 23:52:20.000000000 +0000
@@ -114,51 +114,6 @@
 # }}}
 # ----- Dumping and loading the data ------------------------------------ {{{
 
-migrate_to_slapd_d_style() {				# {{{
-
-	# Check if we need to migrate to the new style.
-	if previous_version_older 2.4.23-3 && [ -f "${SLAPD_CONF}" ] \
-	   && ! [ -d /etc/ldap/slapd.d ]
-	then
-
-		# Create the new configuration directory
-		mkdir /etc/ldap/slapd.d
-
-		echo -n "  Migrating slapd.conf to slapd.d configuration style... " >&2
-		capture_diagnostics slaptest -f ${SLAPD_CONF} -F /etc/ldap/slapd.d || failed=1
-		if [ "$failed" ]; then
-
-			echo "failed." >&2
-			echo >&2
-			cat <<-EOF
-Migrating slapd.conf file (${SLAPD_CONF}) to slapd.d failed with the following
-error while running slaptest:
-EOF
-			release_diagnostics "    "
-			rm -rf /etc/ldap/slapd.d
-			return 1
-		fi
-
-		# Backup the old slapd.conf
-		mv ${SLAPD_CONF} ${SLAPD_CONF}.old
-		SLAPD_CONF=/etc/ldap/slapd.d
-
-		# Add olcAccess control to grant local root connections access
-		sed -i '/^olcDatabase: {-1}frontend/a\
-olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break\
-olcAccess: {1}to dn.exact="" by * read\
-olcAccess: {2}to dn.base="cn=Subschema" by * read' "${SLAPD_CONF}/cn=config/olcDatabase={-1}frontend.ldif"
-		sed -i '/^olcDatabase: {0}config/a\
-olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break' "${SLAPD_CONF}/cn=config/olcDatabase={0}config.ldif"
-
-		# TODO: Now we are doing something that is not allowed by policy but it
-		# has to be done.
-		sed -i -e "/^[[:space:]]*SLAPD_CONF=.*/ s/^/#/" /etc/default/slapd
-		echo "done." >&2
-	fi
-}
-
-# }}}
 dump_config() {								# {{{
 # Dump the cn=config database to the backup directory.
 # This is not the same as backup_config_once, which copies the slapd.d 
@@ -495,11 +450,6 @@
 	echo "done." >&2
 }
 # }}}
-encode_utf8() { #{{{
-# Make the value utf8 encoded. Takes one argument and utf8 encode it.
-# Usage: val=`encode_utf8 <value>`
-  perl -e 'use Encode; print encode_utf8($ARGV[0]);' "$1"
-} #}}}
 create_new_directory() {						# {{{
 # Create a new directory. Takes the basedn and the dc value of that entry.
 # Other information is extracted from debconf.
@@ -509,9 +459,8 @@
 	basedn="$1"
 	dc="$2"
 	
-	# Encode to utf8 and base64 encode the organization.
 	db_get shared/organization
-	organization=`encode_utf8 "$RET"`
+	organization="$RET"
 	db_get slapd/internal/adminpw
 	adminpass="$RET"
 
@@ -563,11 +512,6 @@
 }
 
 # }}}
-normalize_ldif() {							# {{{
-# Unwrap LDIF lines and strip comments.
-	perl -00 -pe 's/\n[ \t]//g; s/^#.*\n//mg' "$@"
-}
-# }}}
 
 
 set_defaults_for_unseen_entries() {					# {{{
@@ -757,11 +701,7 @@
 # prefixing each line.
 # Usage: release_diagnostics "prefix"
 
-	local script
-	script='
-		seek STDIN, 0, 0;
-		print "$ARGV[0]$_" while (<STDIN>);';
-	perl -e "$script" "$1" <&7
+	{ exec < /dev/stdin ; sed -e "s/^/$1/" ; } <&7
 }
 
 # }}}
diff -Nru openldap-2.6.4+dfsg/debian/source/lintian-overrides openldap-2.6.6+dfsg/debian/source/lintian-overrides
--- openldap-2.6.4+dfsg/debian/source/lintian-overrides	2022-11-18 20:46:10.000000000 +0000
+++ openldap-2.6.6+dfsg/debian/source/lintian-overrides	2023-08-02 23:52:20.000000000 +0000
@@ -1,10 +1,10 @@
 # this file lists copyright notices applying to the schemas
-openldap source: license-problem-non-free-RFC servers/slapd/schema/README
+openldap source: license-problem-non-free-RFC *servers/slapd/schema/README*
 # RFC text removed, files contain functional interface definitions only
 # Copyright notices have been retained to preserve attribution
-openldap source: license-problem-non-free-RFC debian/schema/core.ldif
-openldap source: license-problem-non-free-RFC debian/schema/core.schema
-openldap source: license-problem-non-free-RFC debian/schema/pmi.schema
+openldap source: license-problem-non-free-RFC *debian/schema/core.ldif*
+openldap source: license-problem-non-free-RFC *debian/schema/core.schema*
+openldap source: license-problem-non-free-RFC *debian/schema/pmi.schema*
 # internal templates, not shown to users
-openldap source: untranslatable-debconf-templates slapd.templates: 89
-openldap source: untranslatable-debconf-templates slapd.templates: 94
+openldap source: untranslatable-debconf-templates *slapd.templates:*89*
+openldap source: untranslatable-debconf-templates *slapd.templates:*94*
diff -Nru openldap-2.6.4+dfsg/debian/tests/sha2-contrib openldap-2.6.6+dfsg/debian/tests/sha2-contrib
--- openldap-2.6.4+dfsg/debian/tests/sha2-contrib	2023-06-21 18:46:28.000000000 +0000
+++ openldap-2.6.6+dfsg/debian/tests/sha2-contrib	2023-08-02 23:52:20.000000000 +0000
@@ -3,7 +3,7 @@
 set -e
 
 reference_hash="{SHA256}$(echo -n secret | openssl dgst -sha256 -binary | openssl enc -base64)"
-test_hash=$(slappasswd -s secret -h '{SHA256}' -o module-load=pw-sha2)
+test_hash=$(/usr/sbin/slappasswd -s secret -h '{SHA256}' -o module-load=pw-sha2)
 
 echo "Reference hash of \"secret\" (openssl): ${reference_hash}"
 echo "slapd's pw-sha2 hash:                 ${test_hash}"
diff -Nru openldap-2.6.4+dfsg/debian/tests/smbk5pwd openldap-2.6.6+dfsg/debian/tests/smbk5pwd
--- openldap-2.6.4+dfsg/debian/tests/smbk5pwd	2023-06-21 18:48:26.000000000 +0000
+++ openldap-2.6.6+dfsg/debian/tests/smbk5pwd	2023-08-02 23:53:05.000000000 +0000
@@ -6,10 +6,8 @@
 schema2ldif /etc/ldap/schema/hdb.schema | ldapadd -H ldapi:// -Y EXTERNAL
 
 # Grant slapd access to the Heimdal master key
-chgrp openldap /var/lib/heimdal-kdc/*key
-chmod g+r /var/lib/heimdal-kdc/*key
-chgrp openldap /var/lib/heimdal-kdc
-chmod g+x /var/lib/heimdal-kdc
+chgrp openldap /var/lib/heimdal-kdc /var/lib/heimdal-kdc/*key
+chmod g+rX /var/lib/heimdal-kdc /var/lib/heimdal-kdc/*key
 
 apparmor_profile="/etc/apparmor.d/usr.sbin.slapd"
 if [ -f "${apparmor_profile}" ]; then
diff -Nru openldap-2.6.4+dfsg/doc/guide/admin/aspell.en.pws openldap-2.6.6+dfsg/doc/guide/admin/aspell.en.pws
--- openldap-2.6.4+dfsg/doc/guide/admin/aspell.en.pws	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/doc/guide/admin/aspell.en.pws	2023-07-31 18:09:15.000000000 +0000
@@ -680,7 +680,6 @@
 Preprocessor
 lastName
 lldap
-cachesize
 slapauth
 attributeType
 attributetype
diff -Nru openldap-2.6.4+dfsg/doc/guide/admin/guide.html openldap-2.6.6+dfsg/doc/guide/admin/guide.html
--- openldap-2.6.4+dfsg/doc/guide/admin/guide.html	2023-02-08 21:35:07.000000000 +0000
+++ openldap-2.6.6+dfsg/doc/guide/admin/guide.html	2023-07-31 20:08:53.000000000 +0000
@@ -23,7 +23,7 @@
 <DIV CLASS="title">
 <H1 CLASS="doc-title">OpenLDAP Software 2.6 Administrator's Guide</H1>
 <ADDRESS CLASS="doc-author">The OpenLDAP Project &lt;<A HREF="https://www.openldap.org/">https://www.openldap.org/</A>&gt;</ADDRESS>
-<ADDRESS CLASS="doc-modified">8 February 2023</ADDRESS>
+<ADDRESS CLASS="doc-modified">31 July 2023</ADDRESS>
 <BR CLEAR="All">
 </DIV>
 <DIV CLASS="contents">
@@ -5720,8 +5720,8 @@
         pcacheTemplate (&amp;(sn=)(givenName=)) 0 3600
         pcacheTemplate (&amp;(departmentNumber=)(secretary=*)) 0 3600
 
-        cachesize 20
         directory ./testrun/db.2.a
+        maxsize   1073741824
         index       objectClass eq
         index       cn,sn,uid,mail  pres,eq,sub
 </PRE>
@@ -5751,7 +5751,7 @@
    objectClass: olcPcacheDatabase
    olcDatabase: {0}mdb
    olcDbDirectory: ./testrun/db.2.a
-   olcDbCacheSize: 20
+   olcDbMaxSize: 1073741824
    olcDbIndex: objectClass eq
    olcDbIndex: cn,sn,uid,mail  pres,eq,sub
 </PRE>
diff -Nru openldap-2.6.4+dfsg/doc/guide/admin/overlays.sdf openldap-2.6.6+dfsg/doc/guide/admin/overlays.sdf
--- openldap-2.6.4+dfsg/doc/guide/admin/overlays.sdf	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/doc/guide/admin/overlays.sdf	2023-07-31 18:09:15.000000000 +0000
@@ -783,8 +783,8 @@
 >	pcacheTemplate (&(sn=)(givenName=)) 0 3600
 >	pcacheTemplate (&(departmentNumber=)(secretary=*)) 0 3600
 >
->	cachesize 20
 >	directory ./testrun/db.2.a
+>	maxsize   1073741824
 >	index       objectClass eq
 >	index       cn,sn,uid,mail  pres,eq,sub
 
@@ -817,7 +817,7 @@
 >   objectClass: olcPcacheDatabase
 >   olcDatabase: {0}mdb
 >   olcDbDirectory: ./testrun/db.2.a
->   olcDbCacheSize: 20
+>   olcDbMaxSize: 1073741824
 >   olcDbIndex: objectClass eq
 >   olcDbIndex: cn,sn,uid,mail  pres,eq,sub
 
diff -Nru openldap-2.6.4+dfsg/doc/man/man5/lloadd.conf.5 openldap-2.6.6+dfsg/doc/man/man5/lloadd.conf.5
--- openldap-2.6.4+dfsg/doc/man/man5/lloadd.conf.5	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/doc/man/man5/lloadd.conf.5	2023-07-31 18:09:15.000000000 +0000
@@ -977,7 +977,7 @@
 .SH LIMITATIONS
 Support for proxying SASL Binds is limited to the
 .B EXTERNAL
-mechanism (and only to extract the DN of a client TLS cerificate if used during
+mechanism (and only to extract the DN of a client TLS certificate if used during
 the last renegotiation) and mechanisms that rely neither on connection metadata
 (as Kerberos does) nor establish a SASL integrity/confidentialiy layer (again,
 some Kerberos mechanisms,
diff -Nru openldap-2.6.4+dfsg/doc/man/man5/slapd-ldap.5 openldap-2.6.6+dfsg/doc/man/man5/slapd-ldap.5
--- openldap-2.6.4+dfsg/doc/man/man5/slapd-ldap.5	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/doc/man/man5/slapd-ldap.5	2023-07-31 18:09:15.000000000 +0000
@@ -406,6 +406,7 @@
 The identity associated to this directive is also used for privileged
 operations whenever \fBidassert\-bind\fP is defined and \fBacl\-bind\fP
 is not.  See \fBacl\-bind\fP for details.
+.RE
 
 .TP
 .B idassert-passthru <authz-regexp>
diff -Nru openldap-2.6.4+dfsg/doc/man/man5/slapo-pcache.5 openldap-2.6.6+dfsg/doc/man/man5/slapo-pcache.5
--- openldap-2.6.4+dfsg/doc/man/man5/slapo-pcache.5	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/doc/man/man5/slapo-pcache.5	2023-07-31 18:09:15.000000000 +0000
@@ -211,7 +211,7 @@
 .RS
 .nf
 directory /var/tmp/cache
-cachesize 100
+maxsize   1073741824
 .fi
 .RE
 .LP
diff -Nru openldap-2.6.4+dfsg/libraries/libldap/init.c openldap-2.6.6+dfsg/libraries/libldap/init.c
--- openldap-2.6.4+dfsg/libraries/libldap/init.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/libraries/libldap/init.c	2023-07-31 18:09:15.000000000 +0000
@@ -96,9 +96,9 @@
 	{0, ATTR_OPTION,	"URI",			NULL,	LDAP_OPT_URI}, /* replaces HOST/PORT */
 	{0, ATTR_OPTION,	"SOCKET_BIND_ADDRESSES",	NULL,	LDAP_OPT_SOCKET_BIND_ADDRESSES},
 	{0, ATTR_BOOL,		"REFERRALS",	NULL,	LDAP_BOOL_REFERRALS},
-	{0, ATTR_INT,		"KEEPALIVE_IDLE",	NULL,	LDAP_OPT_X_KEEPALIVE_IDLE},
-	{0, ATTR_INT,		"KEEPALIVE_PROBES",	NULL,	LDAP_OPT_X_KEEPALIVE_PROBES},
-	{0, ATTR_INT,		"KEEPALIVE_INTERVAL",	NULL,	LDAP_OPT_X_KEEPALIVE_INTERVAL},
+	{0, ATTR_OPT_INT,	"KEEPALIVE_IDLE",	NULL,	LDAP_OPT_X_KEEPALIVE_IDLE},
+	{0, ATTR_OPT_INT,	"KEEPALIVE_PROBES",	NULL,	LDAP_OPT_X_KEEPALIVE_PROBES},
+	{0, ATTR_OPT_INT,	"KEEPALIVE_INTERVAL",	NULL,	LDAP_OPT_X_KEEPALIVE_INTERVAL},
 
 #if 0
 	/* This should only be allowed via ldap_set_option(3) */
diff -Nru openldap-2.6.4+dfsg/libraries/libldap/open.c openldap-2.6.6+dfsg/libraries/libldap/open.c
--- openldap-2.6.4+dfsg/libraries/libldap/open.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/libraries/libldap/open.c	2023-07-31 18:09:15.000000000 +0000
@@ -501,6 +501,11 @@
 	if( proto == LDAP_PROTO_UDP ) return 0;
 #endif
 
+	if ( async && rc == -2) {
+		/* Need to let the connect complete asynchronously before we continue */
+		return -2;
+	}
+
 #ifdef HAVE_TLS
 	if ((rc == 0 || rc == -2) && ( ld->ld_options.ldo_tls_mode == LDAP_OPT_X_TLS_HARD ||
 		strcmp( srv->lud_scheme, "ldaps" ) == 0 ))
@@ -585,9 +590,9 @@
 	/* Attach the passed socket as the *LDAP's connection */
 	c = ldap_new_connection( ld, NULL, 1, 0, NULL, 0, 0 );
 	if( c == NULL ) {
+		LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 		ldap_unbind_ext( ld, NULL, NULL );
 		*ldp = NULL;
-		LDAP_MUTEX_UNLOCK( &ld->ld_conn_mutex );
 		return( LDAP_NO_MEMORY );
 	}
 	ber_sockbuf_ctrl( c->lconn_sb, LBER_SB_OPT_SET_FD, fdp );
diff -Nru openldap-2.6.4+dfsg/libraries/libldap/tls_o.c openldap-2.6.6+dfsg/libraries/libldap/tls_o.c
--- openldap-2.6.4+dfsg/libraries/libldap/tls_o.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/libraries/libldap/tls_o.c	2023-07-31 18:09:15.000000000 +0000
@@ -335,7 +335,7 @@
 				if ( !strncmp( ver, "TLSv", 4 ) && strncmp( ver+4, "1.3", 3 ) >= 0 ) {
 					if ( tls13_suites[0] )
 						ts = tlso_stecpy( ts, ":", te );
-					ts = tlso_stecpy( ts, sname, te );
+					ts = tlso_stecpy( ts, nptr, te );
 				}
 			}
 		}
diff -Nru openldap-2.6.4+dfsg/libraries/liblmdb/CHANGES openldap-2.6.6+dfsg/libraries/liblmdb/CHANGES
--- openldap-2.6.4+dfsg/libraries/liblmdb/CHANGES	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/libraries/liblmdb/CHANGES	2023-07-31 18:09:15.000000000 +0000
@@ -1,5 +1,8 @@
 LMDB 0.9 Change Log
 
+LMDB 0.9.31 Release (2023/07/10)
+	ITS#8447 - Fix cursor_put(MDB_CURRENT) on DUPSORT DB with different sized data
+
 LMDB 0.9.30 Release (2023/02/08)
 	ITS#9806 - LMDB page_split: key threshold depends on page size
 	ITS#9916 - avoid gcc optimization bug on sparc64 linux
diff -Nru openldap-2.6.4+dfsg/libraries/liblmdb/lmdb.h openldap-2.6.6+dfsg/libraries/liblmdb/lmdb.h
--- openldap-2.6.4+dfsg/libraries/liblmdb/lmdb.h	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/libraries/liblmdb/lmdb.h	2023-07-31 18:09:15.000000000 +0000
@@ -200,7 +200,7 @@
 /** Library minor version */
 #define MDB_VERSION_MINOR	9
 /** Library patch version */
-#define MDB_VERSION_PATCH	30
+#define MDB_VERSION_PATCH	31
 
 /** Combine args a,b,c into a single integer for easy version comparisons */
 #define MDB_VERINT(a,b,c)	(((a) << 24) | ((b) << 16) | (c))
@@ -210,7 +210,7 @@
 	MDB_VERINT(MDB_VERSION_MAJOR,MDB_VERSION_MINOR,MDB_VERSION_PATCH)
 
 /** The release date of this library version */
-#define MDB_VERSION_DATE	"February 8, 2023"
+#define MDB_VERSION_DATE	"July 10, 2023"
 
 /** A stringifier for the version info */
 #define MDB_VERSTR(a,b,c,d)	"LMDB " #a "." #b "." #c ": (" d ")"
diff -Nru openldap-2.6.4+dfsg/libraries/liblmdb/mdb.c openldap-2.6.6+dfsg/libraries/liblmdb/mdb.c
--- openldap-2.6.4+dfsg/libraries/liblmdb/mdb.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/libraries/liblmdb/mdb.c	2023-07-31 18:09:15.000000000 +0000
@@ -6963,11 +6963,14 @@
 			else if (!(mc->mc_flags & C_SUB))
 				memcpy(olddata.mv_data, data->mv_data, data->mv_size);
 			else {
+				if (key->mv_size != NODEKSZ(leaf))
+					goto new_ksize;
 				memcpy(NODEKEY(leaf), key->mv_data, key->mv_size);
 				goto fix_parent;
 			}
 			return MDB_SUCCESS;
 		}
+new_ksize:
 		mdb_node_del(mc, 0);
 	}
 
diff -Nru openldap-2.6.4+dfsg/libraries/librewrite/ldapmap.c openldap-2.6.6+dfsg/libraries/librewrite/ldapmap.c
--- openldap-2.6.4+dfsg/libraries/librewrite/ldapmap.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/libraries/librewrite/ldapmap.c	2023-07-31 18:09:15.000000000 +0000
@@ -343,6 +343,7 @@
 			NULL, NULL, NULL );
 		if ( rc == LDAP_SERVER_DOWN && first_try ) {
 			first_try = 0;
+			ldap_unbind_ext( ld, NULL, NULL );
 			if ( ldap_initialize( &ld, data->lm_url ) != LDAP_SUCCESS ) {
 				rc = REWRITE_ERR;
 				goto rc_return;
@@ -360,11 +361,14 @@
 			data->lm_attrs, 0, NULL, NULL, NULL, 1, &res );
 	if ( rc == LDAP_SERVER_DOWN && first_try ) {
 		first_try = 0;
-                if ( ldap_initialize( &ld, data->lm_url ) != LDAP_SUCCESS ) {
+		ldap_unbind_ext( ld, NULL, NULL );
+		if ( ldap_initialize( &ld, data->lm_url ) != LDAP_SUCCESS ) {
 			rc = REWRITE_ERR;
 			goto rc_return;
 		}
 		set_version = 1;
+		ldap_msgfree( res );
+		res = NULL;
 		goto do_bind;
 
 	} else if ( rc != LDAP_SUCCESS ) {
@@ -373,7 +377,6 @@
 	}
 
 	if ( ldap_count_entries( ld, res ) != 1 ) {
-		ldap_msgfree( res );
 		rc = REWRITE_ERR;
 		goto rc_return;
 	}
@@ -408,14 +411,14 @@
 		}
 	}
 	
-	ldap_msgfree( res );
-
 	if ( val->bv_val == NULL ) {
 		rc = REWRITE_ERR;
 		goto rc_return;
 	}
 
 rc_return:;
+	ldap_msgfree( res );
+
 	if ( data->lm_when == MAP_LDAP_EVERYTIME ) {
 		if ( ld != NULL ) {
 			ldap_unbind_ext( ld, NULL, NULL );
diff -Nru openldap-2.6.4+dfsg/Makefile.in openldap-2.6.6+dfsg/Makefile.in
--- openldap-2.6.4+dfsg/Makefile.in	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/Makefile.in	2023-07-31 18:09:15.000000000 +0000
@@ -29,7 +29,7 @@
 	$(RM) -r autom4te.cache
 
 veryclean-local: FORCE
-	$(RM) config.status libtool stamp-h stamp-h.in
+	$(RM) config.status libtool stamp-h stamp-h.in libraries/libldap/ldap.pc libraries/liblber/lber.pc
 
 distclean: veryclean FORCE
 
diff -Nru openldap-2.6.4+dfsg/servers/slapd/at.c openldap-2.6.6+dfsg/servers/slapd/at.c
--- openldap-2.6.4+dfsg/servers/slapd/at.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/at.c	2023-07-31 18:09:15.000000000 +0000
@@ -952,11 +952,15 @@
 		}
 
 		if ( oidm ) {
+			if ( *err == at->at_oid )
+				*err = oidm;
 			SLAP_FREE( at->at_oid );
 			at->at_oid = oidm;
 		}
 
 		if ( soidm ) {
+			if ( *err == at->at_syntax_oid )
+				*err = soidm;
 			SLAP_FREE( at->at_syntax_oid );
 			at->at_syntax_oid = soidm;
 		}
diff -Nru openldap-2.6.4+dfsg/servers/slapd/back-asyncmeta/modify.c openldap-2.6.6+dfsg/servers/slapd/back-asyncmeta/modify.c
--- openldap-2.6.4+dfsg/servers/slapd/back-asyncmeta/modify.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/back-asyncmeta/modify.c	2023-07-31 18:09:15.000000000 +0000
@@ -67,21 +67,15 @@
 
 	for ( i = 0, ml = op->orm_modlist; ml; i++ ,ml = ml->sml_next )
 		;
-	if (i > 0) {
-		mods = op->o_tmpalloc( sizeof( LDAPMod )*i, op->o_tmpmemctx );
-	}
 
-	if ( mods == NULL ) {
-		rs->sr_err = LDAP_OTHER;
-		retcode = META_SEARCH_ERR;
-		goto doreturn;
-	}
-	modv = ( LDAPMod ** )op->o_tmpalloc( ( i + 1 )*sizeof( LDAPMod * ), op->o_tmpmemctx );
+	modv = op->o_tmpalloc( ( i + 1 )*sizeof( LDAPMod * ) + i*sizeof( LDAPMod ),
+			op->o_tmpmemctx );
 	if ( modv == NULL ) {
 		rs->sr_err = LDAP_OTHER;
 		retcode = META_SEARCH_ERR;
 		goto doreturn;
 	}
+	mods = (LDAPMod *)&modv[ i + 1 ];
 
 	isupdate = be_shadow_update( op );
 	for ( i = 0, ml = op->orm_modlist; ml; ml = ml->sml_next ) {
@@ -224,6 +218,8 @@
 		op->o_tmpfree( mdn.bv_val, op->o_tmpmemctx );
 	}
 
+	op->o_tmpfree( modv, op->o_tmpmemctx );
+
 doreturn:;
 	Debug( LDAP_DEBUG_TRACE, "%s <<< asyncmeta_back_modify_start[%p]=%d\n", op->o_log_prefix, msc, candidates[candidate].sr_msgid );
 	return retcode;
diff -Nru openldap-2.6.4+dfsg/servers/slapd/back-mdb/config.c openldap-2.6.6+dfsg/servers/slapd/back-mdb/config.c
--- openldap-2.6.4+dfsg/servers/slapd/back-mdb/config.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/back-mdb/config.c	2023-07-31 18:09:15.000000000 +0000
@@ -214,6 +214,10 @@
 	int i, first = 1;
 	int intr = 0;
 
+	Debug( LDAP_DEBUG_ARGS,
+		LDAP_XSTRING(mdb_online_index) ": database %s: "
+		"starting\n", be->be_suffix[0].bv_val );
+
 	connection_fake_init( &conn, &opbuf, ctx );
 	op = &opbuf.ob_op;
 
@@ -275,6 +279,10 @@
 			memcpy( &id, key.mv_data, sizeof( id ));
 		}
 
+		Debug( LDAP_DEBUG_ARGS,
+			LDAP_XSTRING(mdb_online_index) ": database %s: "
+			"indexing %lx\n", be->be_suffix[0].bv_val, (long)id );
+
 		rc = mdb_id2entry( op, curs, id, &e );
 		mdb_cursor_close( curs );
 		if ( rc ) {
@@ -308,23 +316,34 @@
 
 	/* all done */
 	if ( !intr ) {
-		for ( i = 0; i < mdb->mi_nattrs; i++ ) {
-			if ( mdb->mi_attrs[ i ]->ai_indexmask & MDB_INDEX_DELETING
-				|| mdb->mi_attrs[ i ]->ai_newmask == 0 )
-			{
-				continue;
-			}
-			mdb->mi_attrs[ i ]->ai_indexmask = mdb->mi_attrs[ i ]->ai_newmask;
-			mdb->mi_attrs[ i ]->ai_newmask = 0;
-		}
-		/* zero out checkpoint DB */
 		rc = mdb_txn_begin( mdb->mi_dbenv, NULL, 0, &txn );
-		if ( !rc ) {
+		if ( rc ) {
+			Debug( LDAP_DEBUG_ANY,
+				LDAP_XSTRING(mdb_online_index) ": database %s: "
+				"final txn_begin failed: %s (%d)\n",
+				be->be_suffix[0].bv_val, mdb_strerror(rc), rc );
+			intr = 1; /* maybe it will succeed on a future retry */
+		} else {
+			for ( i = 0; i < mdb->mi_nattrs; i++ ) {
+				if ( mdb->mi_attrs[ i ]->ai_indexmask & MDB_INDEX_DELETING
+					|| mdb->mi_attrs[ i ]->ai_newmask == 0 )
+				{
+					continue;
+				}
+				mdb->mi_attrs[ i ]->ai_indexmask = mdb->mi_attrs[ i ]->ai_newmask;
+				mdb->mi_attrs[ i ]->ai_newmask = 0;
+			}
+
+			/* zero out checkpoint DB */
 			mdb_drop( txn, mdb->mi_idxckp, 0 );
 			mdb_txn_commit( txn );
 		}
 	}
 
+	Debug( LDAP_DEBUG_ARGS,
+		LDAP_XSTRING(mdb_online_index) ": database %s: "
+		"stopping, %s done\n", be->be_suffix[0].bv_val, intr ? "not" : "all" );
+
 	ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
 	if ( ldap_pvt_runqueue_isrunning( &slapd_rq, rtask ))
 		ldap_pvt_runqueue_stoptask( &slapd_rq, rtask );
@@ -361,6 +380,10 @@
 		return rc;
 	}
 
+	Debug( LDAP_DEBUG_ARGS,
+		LDAP_XSTRING(mdb_setup_indexer) ": path %s: "
+		"starting\n", mdb->mi_dbenv_home );
+
 	key.mv_size = sizeof( s );
 	key.mv_data = &s;
 
@@ -389,6 +412,9 @@
 		data.mv_size = sizeof( ID );
 		data.mv_data = &id;
 		rc = mdb_cursor_put( curs, &key, &data, 0 );
+		Debug( LDAP_DEBUG_ARGS,
+			LDAP_XSTRING(mdb_setup_indexer) ": path %s: "
+			"resetting to 0\n", mdb->mi_dbenv_home );
 	}
 
 done:
diff -Nru openldap-2.6.4+dfsg/servers/slapd/back-mdb/init.c openldap-2.6.6+dfsg/servers/slapd/back-mdb/init.c
--- openldap-2.6.4+dfsg/servers/slapd/back-mdb/init.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/back-mdb/init.c	2023-07-31 18:09:15.000000000 +0000
@@ -313,7 +313,7 @@
 	mdb->mi_flags |= MDB_IS_OPEN;
 
 	if ( do_index )
-		mdb_start_index_task( be );
+		mdb_start_index_task( be->bd_self );
 
 	return 0;
 
diff -Nru openldap-2.6.4+dfsg/servers/slapd/back-mdb/tools.c openldap-2.6.6+dfsg/servers/slapd/back-mdb/tools.c
--- openldap-2.6.4+dfsg/servers/slapd/back-mdb/tools.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/back-mdb/tools.c	2023-07-31 18:09:15.000000000 +0000
@@ -58,6 +58,8 @@
 static MDB_val key, data;
 static ID previd = NOID;
 
+static int reindexing;
+
 typedef struct dn_id {
 	ID id;
 	struct berval dn;
@@ -223,6 +225,20 @@
 		}
 		mdb_tool_txn = NULL;
 	}
+	if( reindexing ) {
+		struct mdb_info *mdb = be->be_private;
+		if ( !txi ) {
+			int rc = mdb_txn_begin( mdb->mi_dbenv, NULL, 0, &txi );
+			if( rc != 0 ) {
+				Debug( LDAP_DEBUG_ANY,
+					"=> " LDAP_XSTRING(mdb_tool_entry_close) ": database %s: "
+					"txn_begin failed: %s (%d)\n",
+					be->be_suffix[0].bv_val, mdb_strerror(rc), rc );
+				return -1;
+			}
+		}
+		mdb_drop( txi, mdb->mi_idxckp, 0 );
+	}
 	if( txi ) {
 		int rc;
 		if (( rc = mdb_txn_commit( txi ))) {
@@ -841,6 +857,8 @@
 		return 0;
 	}
 
+	reindexing = 1;
+
 	/* Check for explicit list of attrs to index */
 	if ( adv ) {
 		int i, j, n;
diff -Nru openldap-2.6.4+dfsg/servers/slapd/back-meta/modify.c openldap-2.6.6+dfsg/servers/slapd/back-meta/modify.c
--- openldap-2.6.4+dfsg/servers/slapd/back-meta/modify.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/back-meta/modify.c	2023-07-31 18:09:15.000000000 +0000
@@ -74,18 +74,8 @@
 	for ( i = 0, ml = op->orm_modlist; ml; i++ ,ml = ml->sml_next )
 		;
 
-	mods = ch_malloc( sizeof( LDAPMod )*i );
-	if ( mods == NULL ) {
-		rs->sr_err = LDAP_OTHER;
-		send_ldap_result( op, rs );
-		goto cleanup;
-	}
-	modv = ( LDAPMod ** )ch_malloc( ( i + 1 )*sizeof( LDAPMod * ) );
-	if ( modv == NULL ) {
-		rs->sr_err = LDAP_OTHER;
-		send_ldap_result( op, rs );
-		goto cleanup;
-	}
+	modv = ch_malloc( ( i + 1 )*sizeof( LDAPMod * ) + i*sizeof( LDAPMod ) );
+	mods = (LDAPMod *)&modv[ i + 1 ];
 
 	dc.ctx = "modifyAttrDN";
 	isupdate = be_shadow_update( op );
@@ -206,11 +196,10 @@
 	}
 	if ( modv != NULL ) {
 		for ( i = 0; modv[ i ]; i++ ) {
-			free( modv[ i ]->mod_bvalues );
+			ch_free( modv[ i ]->mod_bvalues );
 		}
 	}
-	free( mods );
-	free( modv );
+	ch_free( modv );
 
 	if ( mc ) {
 		meta_back_release_conn( mi, mc );
diff -Nru openldap-2.6.4+dfsg/servers/slapd/back-monitor/search.c openldap-2.6.6+dfsg/servers/slapd/back-monitor/search.c
--- openldap-2.6.4+dfsg/servers/slapd/back-monitor/search.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/back-monitor/search.c	2023-07-31 18:09:15.000000000 +0000
@@ -97,7 +97,7 @@
 
 	/* return entries */
 	for ( ; e != NULL; e = e_tmp ) {
-		Entry *sub_nv = NULL, *sub_ch = NULL;
+		Entry *sub_nv = NULL, *sub_ch = NULL, *locked = e;
 
 		monitor_cache_lock( e );
 		monitor_entry_update( op, rs, e );
@@ -109,7 +109,6 @@
 		e_tmp = mp->mp_next;
 
 		if ( op->o_abandon ) {
-			monitor_cache_release( mi, e );
 			rc = SLAPD_ABANDON;
 			goto freeout;
 		}
@@ -128,19 +127,21 @@
 					monitor_cache_lock( e );
 					monitor_cache_release( mi, e );
 				}
-				e = rs->sr_entry;
 				goto freeout;
 			}
 		}
 		if ( sub_nv == NULL ) {
-			monitor_cache_release( mi, e );
+			monitor_cache_release( mi, locked );
+			locked = NULL;
 		}
 
 		if ( sub ) {
 			rc = monitor_send_children( op, rs, sub_nv, sub_ch, sub );
 			if ( rc ) {
 freeout:
-				monitor_cache_release( mi, e );
+				if ( locked ) {
+					monitor_cache_release( mi, locked );
+				}
 				if ( nonvolatile == 0 ) {
 					for ( ; e_tmp != NULL; ) {
 						mp = ( monitor_entry_t * )e_tmp->e_private;
@@ -158,8 +159,8 @@
 				return( rc );
 			}
 		}
-		if ( sub_nv != NULL ) {
-			monitor_cache_release( mi, e );
+		if ( locked ) {
+			monitor_cache_release( mi, locked );
 		}
 	}
 	
diff -Nru openldap-2.6.4+dfsg/servers/slapd/bconfig.c openldap-2.6.6+dfsg/servers/slapd/bconfig.c
--- openldap-2.6.4+dfsg/servers/slapd/bconfig.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/bconfig.c	2023-07-31 18:09:15.000000000 +0000
@@ -5749,12 +5749,21 @@
 		}
 	}
 
+	/*
+	 * ITS#10045 Pre-check for abandon but be willing to handle that the
+	 * operation might be abandoned while waiting for the server to pause.
+	 */
 	if ( op->o_abandon ) {
 		rs->sr_err = SLAPD_ABANDON;
+		dopause = 0;
 		goto out;
 	}
 	if ( slap_pause_server() < 0 )
 		dopause = 0;
+	if ( op->o_abandon ) {
+		rs->sr_err = SLAPD_ABANDON;
+		goto unpause;
+	}
 
 	ldap_pvt_thread_rdwr_wlock( &cfb->cb_rwlock );
 
@@ -5823,6 +5832,8 @@
 
 out2:;
 	ldap_pvt_thread_rdwr_wunlock( &cfb->cb_rwlock );
+
+unpause:;
 	if ( dopause )
 		slap_unpause_server();
 
@@ -6332,12 +6343,21 @@
 	}
 
 	if ( do_pause ) {
+		/*
+		 * ITS#10045 Pre-check for abandon but be willing to handle that the
+		 * operation might be abandoned while waiting for the server to pause.
+		 */
 		if ( op->o_abandon ) {
 			rs->sr_err = SLAPD_ABANDON;
+			do_pause = 0;
 			goto out;
 		}
 		if ( slap_pause_server() < 0 )
 			do_pause = 0;
+		if ( op->o_abandon ) {
+			rs->sr_err = SLAPD_ABANDON;
+			goto unpause;
+		}
 	}
 	ldap_pvt_thread_rdwr_wlock( &cfb->cb_rwlock );
 
@@ -6384,6 +6404,7 @@
 	}
 
 	ldap_pvt_thread_rdwr_wunlock( &cfb->cb_rwlock );
+unpause:;
 	if ( do_pause )
 		slap_unpause_server();
 out:
@@ -6544,12 +6565,21 @@
 		}
 	}
 
+	/*
+	 * ITS#10045 Pre-check for abandon but be willing to handle that the
+	 * operation might be abandoned while waiting for the server to pause.
+	 */
 	if ( op->o_abandon ) {
 		rs->sr_err = SLAPD_ABANDON;
+		dopause = 0;
 		goto out;
 	}
 	if ( slap_pause_server() < 0 )
 		dopause = 0;
+	if ( op->o_abandon ) {
+		rs->sr_err = SLAPD_ABANDON;
+		goto unpause;
+	}
 
 	ldap_pvt_thread_rdwr_wlock( &cfb->cb_rwlock );
 
@@ -6633,6 +6663,7 @@
 
 	ldap_pvt_thread_rdwr_wunlock( &cfb->cb_rwlock );
 
+unpause:
 	if ( dopause )
 		slap_unpause_server();
 out:
@@ -6697,6 +6728,11 @@
 
 		ldap_pvt_thread_rdwr_wlock( &cfb->cb_rwlock );
 
+		if ( op->o_abandon ) {
+			rs->sr_err = SLAPD_ABANDON;
+			goto out2;
+		}
+
 		if ( ce->ce_type == Cft_Overlay ){
 			overlay_remove( ce->ce_be, (slap_overinst *)ce->ce_bi, op );
 		} else if ( ce->ce_type == Cft_Misc ) {
diff -Nru openldap-2.6.4+dfsg/servers/slapd/overlays/constraint.c openldap-2.6.6+dfsg/servers/slapd/overlays/constraint.c
--- openldap-2.6.4+dfsg/servers/slapd/overlays/constraint.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/overlays/constraint.c	2023-07-31 18:09:15.000000000 +0000
@@ -816,7 +816,7 @@
 	int rc = 0;
 	char *msg = NULL;
 
-	if (get_relax(op) || SLAPD_SYNC_IS_SYNCCONN( op->o_connid )) {
+	if ( get_relax(op) || be_shadow_update( op ) ) {
 		return SLAP_CB_CONTINUE;
 	}
 
@@ -958,7 +958,7 @@
 	char *msg = NULL;
 	int is_v;
 
-	if (get_relax(op) || SLAPD_SYNC_IS_SYNCCONN( op->o_connid )) {
+	if ( get_relax(op) || be_shadow_update( op ) ) {
 		return SLAP_CB_CONTINUE;
 	}
 
diff -Nru openldap-2.6.4+dfsg/servers/slapd/overlays/dynlist.c openldap-2.6.6+dfsg/servers/slapd/overlays/dynlist.c
--- openldap-2.6.4+dfsg/servers/slapd/overlays/dynlist.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/overlays/dynlist.c	2023-07-31 18:09:15.000000000 +0000
@@ -99,6 +99,83 @@
 	return 0;
 }
 
+static Filter *
+transform_filter( Operation *op, dynlist_info_t *dli, int not, Filter *orig )
+{
+	Filter *f;
+	dynlist_map_t *dlm;
+
+	/* Tilt the filter towards TRUE if it could match through this dli */
+	int result = not ? LDAP_COMPARE_FALSE : LDAP_COMPARE_TRUE;
+
+	if ( orig ) {
+		f = orig;
+	} else {
+		f = orig = filter_dup( op->ors_filter, op->o_tmpmemctx );
+	}
+
+	switch( f->f_choice & SLAPD_FILTER_MASK ) {
+	case LDAP_FILTER_EQUALITY:
+	case LDAP_FILTER_GE:
+	case LDAP_FILTER_LE:
+	case LDAP_FILTER_APPROX:
+		for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) {
+			AttributeDescription *ad = dlm->dlm_mapped_ad ? dlm->dlm_mapped_ad : dlm->dlm_member_ad;
+			if ( f->f_av_desc == ad ) {
+				filter_free_x( op, f, 0 );
+				f->f_choice = SLAPD_FILTER_COMPUTED;
+				f->f_result = result;
+				break;
+			}
+		}
+		break;
+	case LDAP_FILTER_PRESENT:
+		for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) {
+			AttributeDescription *ad = dlm->dlm_mapped_ad ? dlm->dlm_mapped_ad : dlm->dlm_member_ad;
+			if ( f->f_sub_desc == ad ) {
+				filter_free_x( op, f, 0 );
+				f->f_choice = SLAPD_FILTER_COMPUTED;
+				f->f_result = result;
+				break;
+			}
+		}
+		break;
+	case LDAP_FILTER_SUBSTRINGS:
+		for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) {
+			AttributeDescription *ad = dlm->dlm_mapped_ad ? dlm->dlm_mapped_ad : dlm->dlm_member_ad;
+			if ( f->f_desc == ad ) {
+				filter_free_x( op, f, 0 );
+				f->f_choice = SLAPD_FILTER_COMPUTED;
+				f->f_result = result;
+				break;
+			}
+		}
+		break;
+	case LDAP_FILTER_EXT:
+		for ( dlm = dli->dli_dlm; dlm; dlm = dlm->dlm_next ) {
+			AttributeDescription *ad = dlm->dlm_mapped_ad ? dlm->dlm_mapped_ad : dlm->dlm_member_ad;
+			if ( f->f_mr_desc == ad ) {
+				filter_free_x( op, f, 0 );
+				f->f_choice = SLAPD_FILTER_COMPUTED;
+				f->f_result = result;
+				break;
+			}
+		}
+		break;
+	case LDAP_FILTER_AND:
+	case LDAP_FILTER_OR:
+		for ( f = f->f_list; f; f = f->f_next )
+			transform_filter( op, dli, not, f );
+		break;
+	case LDAP_FILTER_NOT:
+		transform_filter( op, dli, !not, f->f_list );
+	case SLAPD_FILTER_COMPUTED:
+		break;
+	}
+
+	return orig;
+}
+
 typedef struct dynlist_filterinst_t {
 	AttributeAssertion *df_a;
 	Entry *df_e;
@@ -1790,7 +1867,7 @@
 	dynlist_info_t	*dli;
 	Operation o = *op;
 	dynlist_map_t *dlm;
-	Filter f[3];
+	Filter f[4];
 	AttributeAssertion ava[2];
 	AttributeName an[2] = {0};
 
@@ -1908,27 +1985,45 @@
 		}
 
 		if ( tmpwant ) {
+			Filter *f_new = NULL;
+
+			if ( tmpwant == WANT_MEMBER ) {
+				/*
+				 * If we only need to list groups, not their members, keep the
+				 * filter, assuming any references to mapped attributes make it
+				 * succeed.
+				 *
+				 * A nested groups search will indicate that it needs both.
+				 */
+				f_new = transform_filter( op, dli, 0, NULL );
+			}
 
 			if ( static_oc ) {
-				f[0].f_choice = LDAP_FILTER_OR;
+				f[0].f_choice = LDAP_FILTER_AND;
 				f[0].f_list = &f[1];
 				f[0].f_next = NULL;
-				f[1].f_choice = LDAP_FILTER_EQUALITY;
-				f[1].f_next = &f[2];
-				f[1].f_ava = &ava[0];
-				f[1].f_av_desc = slap_schema.si_ad_objectClass;
-				f[1].f_av_value = dli->dli_oc->soc_cname;
+				f[1].f_choice = LDAP_FILTER_OR;
+				f[1].f_list = &f[2];
+				f[1].f_next = f_new;
 				f[2].f_choice = LDAP_FILTER_EQUALITY;
-				f[2].f_ava = &ava[1];
+				f[2].f_next = &f[3];
+				f[2].f_ava = &ava[0];
 				f[2].f_av_desc = slap_schema.si_ad_objectClass;
-				f[2].f_av_value = static_oc->soc_cname;
-				f[2].f_next = NULL;
+				f[2].f_av_value = dli->dli_oc->soc_cname;
+				f[3].f_choice = LDAP_FILTER_EQUALITY;
+				f[3].f_ava = &ava[1];
+				f[3].f_av_desc = slap_schema.si_ad_objectClass;
+				f[3].f_av_value = static_oc->soc_cname;
+				f[3].f_next = NULL;
 			} else {
-				f[0].f_choice = LDAP_FILTER_EQUALITY;
-				f[0].f_ava = ava;
-				f[0].f_av_desc = slap_schema.si_ad_objectClass;
-				f[0].f_av_value = dli->dli_oc->soc_cname;
+				f[0].f_choice = LDAP_FILTER_AND;
+				f[0].f_list = &f[1];
 				f[0].f_next = NULL;
+				f[1].f_choice = LDAP_FILTER_EQUALITY;
+				f[1].f_ava = ava;
+				f[1].f_av_desc = slap_schema.si_ad_objectClass;
+				f[1].f_av_value = dli->dli_oc->soc_cname;
+				f[1].f_next = f_new;
 			}
 
 			if ( o.o_callback != sc ) {
@@ -1963,6 +2058,7 @@
 			}
 			o.o_tmpfree( o.ors_filterstr.bv_val, o.o_tmpmemctx );
 			o.ors_filterstr.bv_val = NULL;
+			filter_free_x( &o, f_new, 1 );
 			if ( found != ds->ds_found && nested )
 				dynlist_nestlink( op, ds );
 		}
diff -Nru openldap-2.6.4+dfsg/servers/slapd/overlays/pcache.c openldap-2.6.6+dfsg/servers/slapd/overlays/pcache.c
--- openldap-2.6.4+dfsg/servers/slapd/overlays/pcache.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/overlays/pcache.c	2023-07-31 18:09:15.000000000 +0000
@@ -3841,8 +3841,8 @@
 
 	/* We can only create this entry if the database is table-driven
 	 */
-	if ( cm->db.bd_info->bi_cf_ocs )
-		config_build_entry( op, rs, pe, ca, &bv, cm->db.bd_info->bi_cf_ocs,
+	if ( cm->db.be_cf_ocs )
+		config_build_entry( op, rs, pe, ca, &bv, cm->db.be_cf_ocs,
 			&pcocs[1] );
 
 	return 0;
diff -Nru openldap-2.6.4+dfsg/servers/slapd/overlays/ppolicy.c openldap-2.6.6+dfsg/servers/slapd/overlays/ppolicy.c
--- openldap-2.6.4+dfsg/servers/slapd/overlays/ppolicy.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/overlays/ppolicy.c	2023-07-31 18:09:15.000000000 +0000
@@ -1687,7 +1687,8 @@
 		} else if ( ppb->pp.pwdMinDelay ) {
 			int waittime = ppb->pp.pwdMinDelay << fc;
 			time_t wait_end;
-			struct berval lockout_stamp;
+			char lockout_stamp_buf[ LDAP_LUTIL_GENTIME_BUFSIZE ];
+			struct berval lockout_stamp = BER_BVC(lockout_stamp_buf);
 
 			if ( waittime > ppb->pp.pwdMaxDelay ) {
 				waittime = ppb->pp.pwdMaxDelay;
@@ -2293,7 +2294,7 @@
 		return rs->sr_err;
 
 	/* If this is a replica, assume the provider checked everything */
-	if ( SLAPD_SYNC_IS_SYNCCONN( op->o_connid ) )
+	if ( be_shadow_update( op ) )
 		return SLAP_CB_CONTINUE;
 
 	ppolicy_get( op, op->ora_e, &pp );
@@ -2463,7 +2464,7 @@
 	/* If this is a replica, we may need to tweak some of the
 	 * provider's modifications. Otherwise, just pass it through.
 	 */
-	if ( SLAPD_SYNC_IS_SYNCCONN( op->o_connid ) ) {
+	if ( be_shadow_update( op ) ) {
 		Modifications **prev;
 		Attribute *a_grace, *a_lock, *a_fail, *a_success;
 
diff -Nru openldap-2.6.4+dfsg/servers/slapd/overlays/syncprov.c openldap-2.6.6+dfsg/servers/slapd/overlays/syncprov.c
--- openldap-2.6.4+dfsg/servers/slapd/overlays/syncprov.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/overlays/syncprov.c	2023-07-31 18:09:15.000000000 +0000
@@ -869,6 +869,11 @@
 
 #define FS_UNLINK	1
 #define FS_LOCK		2
+#define FS_DEFER	4
+
+#define FSR_NOTFREE	0
+#define FSR_DIDFREE	1
+#define FSR_CANFREE	2
 
 static int
 syncprov_free_syncop( syncops *so, int flags )
@@ -879,12 +884,19 @@
 	if ( flags & FS_LOCK )
 		ldap_pvt_thread_mutex_lock( &so->s_mutex );
 	/* already being freed, or still in use */
-	if ( !so->s_inuse || --so->s_inuse > 0 ) {
+	if ( !so->s_inuse || so->s_inuse > 1 ) {
 		if ( flags & FS_LOCK )
 			ldap_pvt_thread_mutex_unlock( &so->s_mutex );
-		return 0;
+		if ( !( flags & FS_DEFER ) && so->s_inuse )
+			so->s_inuse--;
+		return FSR_NOTFREE;
 	}
 	ldap_pvt_thread_mutex_unlock( &so->s_mutex );
+
+	/* caller wants to cleanup other stuff before actual free */
+	if ( flags & FS_DEFER )
+		return FSR_CANFREE;
+
 	if (( flags & FS_UNLINK ) && so->s_si ) {
 		syncops **sop;
 		ldap_pvt_thread_mutex_lock( &so->s_si->si_ops_mutex );
@@ -912,7 +924,7 @@
 	}
 	ldap_pvt_thread_mutex_destroy( &so->s_mutex );
 	ch_free( so );
-	return 1;
+	return FSR_DIDFREE;
 }
 
 /* Send a persistent search response */
@@ -1027,6 +1039,9 @@
 			} else {
 				rc = syncprov_sendresp( op, sr->s_info, so, sr->s_mode );
 			}
+		} else {
+			/* set rc so we don't do a new qstart */
+			rc = 1;
 		}
 
 		free_resinfo( sr );
@@ -1053,6 +1068,9 @@
 	return rc;
 }
 
+static int
+syncprov_drop_psearch( syncops *so, int lock );
+
 /* task for playing back queued responses */
 static void *
 syncprov_qtask( void *ctx, void *arg )
@@ -1061,7 +1079,7 @@
 	OperationBuffer opbuf;
 	Operation *op;
 	BackendDB be;
-	int rc;
+	int rc, flag, frc;
 
 	op = &opbuf.ob_op;
 	*op = *so->s_op;
@@ -1090,14 +1108,24 @@
 	if ( !rc && !so->s_res )
 		rc = 1;
 
+	flag = FS_UNLINK;
+	if ( rc && op->o_abandon )
+		flag = FS_DEFER;
+
 	/* decrement use count... */
-	if ( !syncprov_free_syncop( so, FS_UNLINK )) {
+	frc = syncprov_free_syncop( so, flag );
+	if ( frc == FSR_NOTFREE ) {
 		if ( rc )
 			/* if we didn't unlink, and task is no longer queued, clear flag */
 			so->s_flags ^= PS_TASK_QUEUED;
 		ldap_pvt_thread_mutex_unlock( &so->s_mutex );
 	}
 
+	/* if we got abandoned while processing, cleanup now */
+	if ( frc == FSR_CANFREE ) {
+		syncprov_drop_psearch( so, 1 );
+	}
+
 	return NULL;
 }
 
@@ -1272,7 +1300,9 @@
 				return SLAP_CB_CONTINUE;
 			}
 		}
-		syncprov_drop_psearch( so, 0 );
+		/* if task is active, it must drop itself */
+		if ( !( so->s_flags & PS_TASK_QUEUED ))
+			syncprov_drop_psearch( so, 0 );
 	}
 	return SLAP_CB_CONTINUE;
 }
diff -Nru openldap-2.6.4+dfsg/servers/slapd/overlays/translucent.c openldap-2.6.6+dfsg/servers/slapd/overlays/translucent.c
--- openldap-2.6.4+dfsg/servers/slapd/overlays/translucent.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/overlays/translucent.c	2023-07-31 18:09:15.000000000 +0000
@@ -176,9 +176,9 @@
 
 	/* We can only create this entry if the database is table-driven
 	 */
-	if ( ov->db.bd_info->bi_cf_ocs )
+	if ( ov->db.be_cf_ocs )
 		config_build_entry( op, rs, cei, ca, &bv,
-				    ov->db.bd_info->bi_cf_ocs,
+				    ov->db.be_cf_ocs,
 				    &translucentocs[1] );
 
 	return 0;
diff -Nru openldap-2.6.4+dfsg/servers/slapd/overlays/unique.c openldap-2.6.6+dfsg/servers/slapd/overlays/unique.c
--- openldap-2.6.4+dfsg/servers/slapd/overlays/unique.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/overlays/unique.c	2023-07-31 18:09:15.000000000 +0000
@@ -1074,7 +1074,7 @@
 	Debug(LDAP_DEBUG_TRACE, "==> unique_add <%s>\n",
 	      op->o_req_dn.bv_val );
 
-	if ( SLAPD_SYNC_IS_SYNCCONN( op->o_connid ) || (
+	if ( be_shadow_update( op ) || (
 			get_relax(op) > SLAP_CONTROL_IGNORED
 			&& access_allowed( op, op->ora_e,
 				slap_schema.si_ad_entry, NULL,
@@ -1226,7 +1226,7 @@
 		return rc;
 	}
 
-	if ( SLAPD_SYNC_IS_SYNCCONN( op->o_connid ) ) {
+	if ( be_shadow_update( op ) ) {
 		return rc;
 	}
 	if ( get_relax(op) > SLAP_CONTROL_IGNORED
@@ -1366,7 +1366,7 @@
 	Debug(LDAP_DEBUG_TRACE, "==> unique_modrdn <%s> <%s>\n",
 		op->o_req_dn.bv_val, op->orr_newrdn.bv_val );
 
-	if ( SLAPD_SYNC_IS_SYNCCONN( op->o_connid ) ) {
+	if ( be_shadow_update( op ) ) {
 		return rc;
 	}
 	if ( get_relax(op) > SLAP_CONTROL_IGNORED
diff -Nru openldap-2.6.4+dfsg/servers/slapd/passwd.c openldap-2.6.6+dfsg/servers/slapd/passwd.c
--- openldap-2.6.4+dfsg/servers/slapd/passwd.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/passwd.c	2023-07-31 18:09:15.000000000 +0000
@@ -291,6 +291,8 @@
 	} else {
 		slap_callback **sc;
 
+		cb.sc_next = op->o_callback;
+
 		op->o_tag = LDAP_REQ_MODIFY;
 		op->o_callback = &cb;
 		op->orm_modlist = qpw->rs_mods;
diff -Nru openldap-2.6.4+dfsg/servers/slapd/pwmods/README.argon2 openldap-2.6.6+dfsg/servers/slapd/pwmods/README.argon2
--- openldap-2.6.4+dfsg/servers/slapd/pwmods/README.argon2	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/pwmods/README.argon2	2023-07-31 18:09:15.000000000 +0000
@@ -15,28 +15,16 @@
 Building
 --------
 
-1) Customize the OPENLDAP variable in Makefile to point to the OpenLDAP
-source root.
-
-For initial testing you might also want to edit DEFS to define
-SLAPD_ARGON2_DEBUG, which enables logging to stderr (don't leave this on
-in production, as it prints passwords in cleartext).
-
-2) Run 'make' to produce argon2.so
-
-3) Copy argon2.so somewhere permanent.
-
-4) Edit your slapd.conf (eg. /etc/ldap/slapd.conf), and add:
-
-moduleload ...path/to/argon2.so
-
-5) Restart slapd.
-
+This module is now part of regular OpenLDAP build process and enabled if
+libsodium or libargon2 library and the corresponding development headers are
+present. You can also choose the library to build against if you prefer by
+passing --enable-argon2=<libsodium|libargon2> to your configure invocation.
 
 Configuring
 -----------
 
-The {ARGON2} password scheme should now be recognised.
+Load the argon2 module (e.g. with olcModuleLoad or moduleload) and the
+{ARGON2} password scheme should now be recognised.
 
 You can also tell OpenLDAP to use one of this scheme when processing LDAP
 Password Modify Extended Operations, thanks to the password-hash option in
diff -Nru openldap-2.6.4+dfsg/servers/slapd/syncrepl.c openldap-2.6.6+dfsg/servers/slapd/syncrepl.c
--- openldap-2.6.4+dfsg/servers/slapd/syncrepl.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/syncrepl.c	2023-07-31 18:09:15.000000000 +0000
@@ -604,8 +604,10 @@
 			lattrs[2] = NULL;
 			rc = ldap_search_ext_s( si->si_ld, "", LDAP_SCOPE_BASE, generic_filterstr.bv_val, lattrs, 0,
 				NULL, NULL, NULL, si->si_slimit, &res );
-			if ( rc )
+			if ( rc ) {
+				ldap_msgfree( res );
 				return rc;
+			}
 			msg = ldap_first_message( si->si_ld, res );
 			if ( msg && ldap_msgtype( msg ) == LDAP_RES_SEARCH_ENTRY ) {
 				BerElement *ber = NULL;
diff -Nru openldap-2.6.4+dfsg/servers/slapd/syslog.c openldap-2.6.6+dfsg/servers/slapd/syslog.c
--- openldap-2.6.4+dfsg/servers/slapd/syslog.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/servers/slapd/syslog.c	2023-07-31 18:09:15.000000000 +0000
@@ -209,7 +209,7 @@
 }
 
 void
-closelog()
+closelog(void)
 {
 	(void)close(LogFile);
 	LogFile = -1;
diff -Nru openldap-2.6.4+dfsg/tests/progs/slapd-mtread.c openldap-2.6.6+dfsg/tests/progs/slapd-mtread.c
--- openldap-2.6.4+dfsg/tests/progs/slapd-mtread.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/progs/slapd-mtread.c	2023-07-31 18:09:15.000000000 +0000
@@ -528,6 +528,7 @@
 			if ( rc ) {
 				tester_ldap_error( ld, "ldap_search_ext_s", NULL );
 			}
+			ldap_msgfree( res );
 			break;
 		}
 
@@ -566,6 +567,7 @@
 
 	default:
 		tester_ldap_error( ld, "ldap_search_ext_s", NULL );
+		ldap_msgfree( res );
 		break;
 	}
 
diff -Nru openldap-2.6.4+dfsg/tests/progs/slapd-search.c openldap-2.6.6+dfsg/tests/progs/slapd-search.c
--- openldap-2.6.4+dfsg/tests/progs/slapd-search.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/progs/slapd-search.c	2023-07-31 18:09:15.000000000 +0000
@@ -214,6 +214,7 @@
 			if ( rc ) {
 				tester_ldap_error( ld, "ldap_search_ext_s", NULL );
 			}
+			ldap_msgfree( res );
 			break;
 		}
 
@@ -270,6 +271,7 @@
 
 	default:
 		tester_ldap_error( ld, "ldap_search_ext_s", NULL );
+		ldap_msgfree( res );
 		break;
 	}
 
diff -Nru openldap-2.6.4+dfsg/tests/progs/slapd-watcher.c openldap-2.6.6+dfsg/tests/progs/slapd-watcher.c
--- openldap-2.6.4+dfsg/tests/progs/slapd-watcher.c	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/progs/slapd-watcher.c	2023-07-31 18:09:15.000000000 +0000
@@ -539,12 +539,12 @@
 						}
 					}
 				}
-				ldap_msgfree( res );
 				break;
 
 			default:
 				tester_ldap_error( ld, "ldap_search_ext_s(baseDN)", sv->url );
 			}
+			ldap_msgfree( res );
 		}
 	}
 
diff -Nru openldap-2.6.4+dfsg/tests/scripts/lloadd/test001-backend-issues openldap-2.6.6+dfsg/tests/scripts/lloadd/test001-backend-issues
--- openldap-2.6.4+dfsg/tests/scripts/lloadd/test001-backend-issues	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/lloadd/test001-backend-issues	2023-07-31 18:09:15.000000000 +0000
@@ -55,6 +55,7 @@
 RC=$?
 if test $RC != 0 ; then
     echo "slapadd failed ($RC)!"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
     exit $RC
 fi
 
diff -Nru openldap-2.6.4+dfsg/tests/scripts/lloadd/test002-load openldap-2.6.6+dfsg/tests/scripts/lloadd/test002-load
--- openldap-2.6.4+dfsg/tests/scripts/lloadd/test002-load	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/lloadd/test002-load	2023-07-31 18:09:15.000000000 +0000
@@ -74,6 +74,7 @@
 RC=$?
 if test $RC != 0 ; then
     echo "slapadd failed ($RC)!"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
     exit $RC
 fi
 
diff -Nru openldap-2.6.4+dfsg/tests/scripts/lloadd/test003-cnconfig openldap-2.6.6+dfsg/tests/scripts/lloadd/test003-cnconfig
--- openldap-2.6.4+dfsg/tests/scripts/lloadd/test003-cnconfig	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/lloadd/test003-cnconfig	2023-07-31 18:09:15.000000000 +0000
@@ -75,6 +75,7 @@
 RC=$?
 if test $RC != 0 ; then
     echo "slapadd failed ($RC)!"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
     exit $RC
 fi
 
diff -Nru openldap-2.6.4+dfsg/tests/scripts/lloadd/test004-monitor openldap-2.6.6+dfsg/tests/scripts/lloadd/test004-monitor
--- openldap-2.6.4+dfsg/tests/scripts/lloadd/test004-monitor	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/lloadd/test004-monitor	2023-07-31 18:09:15.000000000 +0000
@@ -87,6 +87,7 @@
 RC=$?
 if test $RC != 0 ; then
     echo "slapadd failed ($RC)!"
+    test $KILLSERVERS != no && kill -HUP $KILLPIDS
     exit $RC
 fi
 
diff -Nru openldap-2.6.4+dfsg/tests/scripts/lloadd/test007-coherence openldap-2.6.6+dfsg/tests/scripts/lloadd/test007-coherence
--- openldap-2.6.4+dfsg/tests/scripts/lloadd/test007-coherence	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/lloadd/test007-coherence	2023-07-31 18:09:15.000000000 +0000
@@ -88,6 +88,7 @@
 RC=$?
 if test $RC != 0 ; then
 	echo "slapadd failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
 	exit $RC
 fi
 
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test049-sync-config openldap-2.6.6+dfsg/tests/scripts/test049-sync-config
--- openldap-2.6.4+dfsg/tests/scripts/test049-sync-config	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test049-sync-config	2023-07-31 18:09:15.000000000 +0000
@@ -61,6 +61,12 @@
 echo "Starting provider slapd on TCP/IP port $PORT1..."
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CFPRO -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 cd $PRODIR
 $SLAPD -F ./slapd.d -h $URI1 -d $LVL > $LOG1 2>&1 &
 PID=$!
@@ -134,6 +140,13 @@
 
 echo "Starting consumer slapd on TCP/IP port $PORT2..."
 $SLAPADD -F $CFCON -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
 cd $CONDIR
 $SLAPD -F ./slapd.d -h $URI2 -d $LVL > $LOG2 2>&1 &
 CONSUMERPID=$!
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test050-syncrepl-multiprovider openldap-2.6.6+dfsg/tests/scripts/test050-syncrepl-multiprovider
--- openldap-2.6.4+dfsg/tests/scripts/test050-syncrepl-multiprovider	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test050-syncrepl-multiprovider	2023-07-31 18:09:15.000000000 +0000
@@ -79,6 +79,11 @@
 olcDatabase: {0}config
 olcRootPW:< file://$CONFIGPWF
 EOF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 n=`expr $n + 1`
 done
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test053-syncprov-glue openldap-2.6.6+dfsg/tests/scripts/test053-syncprov-glue
--- openldap-2.6.4+dfsg/tests/scripts/test053-syncprov-glue	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test053-syncprov-glue	2023-07-31 18:09:15.000000000 +0000
@@ -74,6 +74,11 @@
 olcRootPW:< file://$CONFIGPWF
 
 EOF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 echo "Initializing provider2 configurations..."
 $SLAPADD -F $CFPRO2 -n 0 <<EOF
@@ -87,6 +92,11 @@
 olcRootPW:< file://$CONFIGPWF
 
 EOF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 $SLAPADD -F $CFCONS -n 0 <<EOF
 dn: cn=config
@@ -98,6 +108,11 @@
 olcDatabase: {0}config
 olcRootPW:< file://$CONFIGPWF
 EOF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 echo "Starting provider slapd on TCP/IP port $PORT1..."
 cd $PRODDIR
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test058-syncrepl-asymmetric openldap-2.6.6+dfsg/tests/scripts/test058-syncrepl-asymmetric
--- openldap-2.6.4+dfsg/tests/scripts/test058-syncrepl-asymmetric	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test058-syncrepl-asymmetric	2023-07-31 18:09:15.000000000 +0000
@@ -175,6 +175,12 @@
 olcRootPW:< file://$CONFIGPWF
 
 EOF
+	RC=$?
+	if test $RC != 0 ; then
+		echo "slapadd failed ($RC)!"
+		exit $RC
+	fi
+
 	ID=`expr $ID + 1`
 done
 
@@ -191,6 +197,12 @@
 olcRootPW:< file://$CONFIGPWF
 
 EOF
+
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 done
 
 echo "Starting central provider slapd on TCP/IP port $PORT1..."
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test059-consumer-config openldap-2.6.6+dfsg/tests/scripts/test059-consumer-config
--- openldap-2.6.4+dfsg/tests/scripts/test059-consumer-config	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test059-consumer-config	2023-07-31 18:09:15.000000000 +0000
@@ -57,6 +57,12 @@
 echo "Starting provider slapd on TCP/IP port $PORT1..."
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CFPRO -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 $SLAPD -F $CFPRO -h $URI1 -d $LVL > $LOG1 2>&1 &
 PID=$!
 if test $WAIT != 0 ; then
@@ -182,6 +188,13 @@
 
 echo "Starting consumer slapd on TCP/IP port $PORT2..."
 $SLAPADD -F $CFCON -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
 $SLAPD -F $CFCON -h $URI2 -d $LVL > $LOG2 2>&1 &
 CONSUMERPID=$!
 if test $WAIT != 0 ; then
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test061-syncreplication-initiation openldap-2.6.6+dfsg/tests/scripts/test061-syncreplication-initiation
--- openldap-2.6.4+dfsg/tests/scripts/test061-syncreplication-initiation	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test061-syncreplication-initiation	2023-07-31 18:09:15.000000000 +0000
@@ -82,6 +82,12 @@
 olcRootPW:< file://$CONFIGPWF
 
 EOF
+
+	RC=$?
+	if test $RC != 0 ; then
+		echo "slapadd failed ($RC)!"
+		exit $RC
+	fi
 done
 
 echo "Starting provider slapd on $PROV_URI"
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test062-config-delete openldap-2.6.6+dfsg/tests/scripts/test062-config-delete
--- openldap-2.6.4+dfsg/tests/scripts/test062-config-delete	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test062-config-delete	2023-07-31 18:09:15.000000000 +0000
@@ -39,6 +39,12 @@
 echo "Starting slapd on TCP/IP port $PORT1... $PWD"
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CONFDIR -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 cd $TESTDIR
 $SLAPD -F ./slapd.d -h $URI1 -d $LVL > $LOG1 2>&1 &
 PID=$!
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test063-delta-multiprovider openldap-2.6.6+dfsg/tests/scripts/test063-delta-multiprovider
--- openldap-2.6.4+dfsg/tests/scripts/test063-delta-multiprovider	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test063-delta-multiprovider	2023-07-31 18:09:15.000000000 +0000
@@ -214,6 +214,12 @@
 EOF
 
 $SLAPADD -F $CFDIR -n 0  -d-1< $TMP > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 PORT=`eval echo '$PORT'$n`
 echo "Starting server $n on TCP/IP port $PORT..."
 cd ${XDIR}${n}
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test064-constraint openldap-2.6.6+dfsg/tests/scripts/test064-constraint
--- openldap-2.6.4+dfsg/tests/scripts/test064-constraint	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test064-constraint	2023-07-31 18:09:15.000000000 +0000
@@ -120,6 +120,11 @@
 EOF
 
 $SLAPADD -F $CONFDIR -n 0 -l $TESTDIR/config.ldif
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 echo "Starting slapd on TCP/IP port $PORT1..."
 $SLAPD -F $CONFDIR -h $URI1 -d $LVL > $LOG1 2>&1 &
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test066-autoca openldap-2.6.6+dfsg/tests/scripts/test066-autoca
--- openldap-2.6.4+dfsg/tests/scripts/test066-autoca	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test066-autoca	2023-07-31 18:09:15.000000000 +0000
@@ -47,6 +47,12 @@
 echo "Starting slapd on TCP/IP port $PORT1..."
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CFDIR -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 $SLAPD -F $CFDIR -h $URIP1 -d $LVL > $LOG1 2>&1 &
 PID=$!
 if test $WAIT != 0 ; then
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test069-delta-multiprovider-starttls openldap-2.6.6+dfsg/tests/scripts/test069-delta-multiprovider-starttls
--- openldap-2.6.4+dfsg/tests/scripts/test069-delta-multiprovider-starttls	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test069-delta-multiprovider-starttls	2023-07-31 18:09:15.000000000 +0000
@@ -195,7 +195,14 @@
 olcAccessLogSuccess: TRUE
 
 EOF
+
 $SLAPADD -F $CFDIR -n 0  -d-1< $TMP > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 PORT=`eval echo '$PORT'$n`
 echo "Starting server $n on TCP/IP port $PORT..."
 cd ${XDIR}${n}
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test070-delta-multiprovider-ldaps openldap-2.6.6+dfsg/tests/scripts/test070-delta-multiprovider-ldaps
--- openldap-2.6.4+dfsg/tests/scripts/test070-delta-multiprovider-ldaps	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test070-delta-multiprovider-ldaps	2023-07-31 18:09:15.000000000 +0000
@@ -195,6 +195,12 @@
 
 EOF
 $SLAPADD -F $CFDIR -n 0  -d-1< $TMP > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 PORT=`eval echo '$PORT'$n`
 echo "Starting server $n on TCP/IP port $PORT..."
 cd ${XDIR}${n}
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test071-dirsync openldap-2.6.6+dfsg/tests/scripts/test071-dirsync
--- openldap-2.6.4+dfsg/tests/scripts/test071-dirsync	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test071-dirsync	2023-07-31 18:09:15.000000000 +0000
@@ -88,6 +88,13 @@
 o: OpenLDAP Testing
 
 EOMODS
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
 $SLAPD -f $CONF2 -h $URI2 -d $LVL > $LOG2 2>&1 &
 CONSUMERPID=$!
 if test $WAIT != 0 ; then
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test076-authid-rewrite openldap-2.6.6+dfsg/tests/scripts/test076-authid-rewrite
--- openldap-2.6.4+dfsg/tests/scripts/test076-authid-rewrite	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test076-authid-rewrite	2023-07-31 18:09:15.000000000 +0000
@@ -31,6 +31,12 @@
 echo "Starting slapd on TCP/IP port $PORT1... $PWD"
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CONFDIR -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 cd $TESTDIR
 $SLAPD -F ./slapd.d -h $URI1 -d $LVL > $LOG1 2>&1 &
 PID=$!
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test078-persistent-sessionlog openldap-2.6.6+dfsg/tests/scripts/test078-persistent-sessionlog
--- openldap-2.6.4+dfsg/tests/scripts/test078-persistent-sessionlog	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test078-persistent-sessionlog	2023-07-31 18:09:15.000000000 +0000
@@ -185,6 +185,12 @@
 
 EOF
 $SLAPADD -F $CFDIR -n 0  -d-1< $TMP > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 PORT=`eval echo '$PORT'$n`
 echo "Starting server $n on TCP/IP port $PORT..."
 cd ${XDIR}${n}
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test083-argon2 openldap-2.6.6+dfsg/tests/scripts/test083-argon2
--- openldap-2.6.4+dfsg/tests/scripts/test083-argon2	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test083-argon2	2023-07-31 18:09:15.000000000 +0000
@@ -97,6 +97,11 @@
 fi
 
 $SLAPADD -F $CONFDIR -n 0 -l $TESTDIR/config.ldif
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
 
 echo "Starting slapd on TCP/IP port $PORT1..."
 $SLAPD -F $CONFDIR -h $URI1 -d $LVL > $LOG1 2>&1 &
diff -Nru openldap-2.6.4+dfsg/tests/scripts/test086-delta-consumer-config openldap-2.6.6+dfsg/tests/scripts/test086-delta-consumer-config
--- openldap-2.6.4+dfsg/tests/scripts/test086-delta-consumer-config	2023-02-08 18:53:35.000000000 +0000
+++ openldap-2.6.6+dfsg/tests/scripts/test086-delta-consumer-config	2023-07-31 18:09:15.000000000 +0000
@@ -61,6 +61,12 @@
 echo "Starting provider slapd on TCP/IP port $PORT1..."
 . $CONFFILTER $BACKEND < $DYNAMICCONF > $CONFLDIF
 $SLAPADD -F $CFPRO -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
 $SLAPD -F $CFPRO -h $URI1 -d $LVL > $LOG1 2>&1 &
 PID=$!
 if test $WAIT != 0 ; then
@@ -324,6 +330,13 @@
 
 echo "Starting consumer slapd on TCP/IP port $PORT2..."
 $SLAPADD -F $CFCON -n 0 -l $CONFLDIF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
 $SLAPD -F $CFCON -h $URI2 -d $LVL > $LOG2 2>&1 &
 CONSUMERPID=$!
 if test $WAIT != 0 ; then